modules

[opaque elm]

┌──(kali㉿kali)-[~]
└─$ sudo apt install odat
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package odat

[fathom pendant]

Weird

[opaque elm]

Why ?

[fathom pendant]

https://github.com/quentinhardy/odat/blob/master/README.md

Try directly here?

[opaque elm]

Yes, try again

[fathom pendant]

Is your kali up-to-date?

[opaque elm]

Yes

[fathom pendant]

¯_(ツ)_/¯

Good luck in resolving it

The Readme has direct links to the downloads it looks like

[opaque elm]

I agree

[fathom pendant]

But I think you're only like a small handful of people that have complaints on it from Kali

[umbral fulcrum]

hey I'm stuck in "AD Enumeration & Attacks - Skills Assessment Part I" in Question: "Find cleartext credentials for another domain user. Submit the username as your answer. "

can someone hint a way please ...

[fickle thicket]

i mean the services come from the DLL right which are then loaded by some process like svchost?

[fathom pendant]

No

The DLL just points to the service executable

[fickle thicket]

o shit.

ok

[faint rampart]

walk the dog. XD

[fickle thicket]

i was so confused LOL

let me research more about it

[fathom pendant]

DLL stands for Dynamic Link Library

So an executable will call the associated DLL to load the needed services

Or usually start them

[fickle thicket]

ok. BUT the DLL != the services right?

[fathom pendant]

Yeah

[opaque elm]

I don't complain

[fathom pendant]

Complaint being that you're having issues installing it

[wooden summit]

hey there anyone available for help with:
https://academy.hackthebox.com/module/216/section/2325

I m having trouble completing the assessment, due to missing data from the log.
Plz feel free to DM me about this.

[opaque elm]

../kali/Documents/oracle-instantclient-sqlplus-linuxx64(2).rpm is for architecture amd64 ; the package cannot be built on this system

[fathom pendant]

Read the Readme on how to convert it to a usable package

It literally has instructions under the links

[dire ice]

hey - feeling pretty dumb rn as i cant progress past the smbclient section in the first stages - i can show the list of drives but when i use smbclient \\the ip\WorkShares i get the NT status not found error - where am i going wrong?

i actually wrote 4 backslash and then two as seperators but discord has deleted some of those?

[raven gorge]

Hey folks, can I ask a hint on AD Enumeration & Attacks - Skills Assessment Part II - Locate a configuration file containing an MSSQL connection string? I'm trying to move forward from the previous question just with the tools available in the given Parrot instance, but don't see a clear path

[vagrant orbit]

Good evening gang, where do I put suggestions for fixes to modules - noticed a pretty annoying problem in the new Malware analysis module that has a very easy fix.

[acoustic owl]

Report it in #858470491676737536

[vagrant orbit]

Cheers

[umbral fulcrum]

how did u retrieve the zip from the 3rd machine ??

cause I can't do it from my VM 4 some reason ...

[clear hatch]

Can someone teach me how to exploit this possible LFI??

<?php
if (isset($_GET['language'])) {
    $lang = $_GET['language'];
} else {
    $lang = "en.php";
}
?>
`<SNIP>`
            <?php
            include('./languages/' . $lang);
            echo $p2;
            ?>

[neon ingot]

Fcrackzip doesn’t seem to want to want to reconize dictionaries

[hallow kiln]

is that from a challenge?

[warm sand]

~~any admin available for the flag on thick client applications module? found the hard coded string but it is not accepted!? thank you!~~nvm got it..

[next bronze]

\\ip\share is right

[next bronze]

the hint is useful

[dire ice]

oh ok thanks

so only 2 and one not four and two - doh!

[hallow kiln]

both should work

[clear hatch]

Im currently doing the Documentation & Reporting module, and I've done more than what was outlined in the sample report but I found this in an index.php.bak

[dire ice]

4+2 fails - ill go back and try again

[next bronze]

include('./languages/' classic path transversal LFI

[clear hatch]

RIGHT

but i cant seem to get any callback...

no read

I went to the LFI module to brush up but cant find any that include dot sourcing (i think thats what thats called)

i wrote this and then tried...

We can see that if the 'language' parameter is set while a client makes a GET request, $lang is set to the value of the 'language' parameter. If the language parameter is not set, then $lang will be a string, "en.php". Later in the code we see the include() method being called with unsanitized user based input from the 'language' parameter. We can abuse this functionality of the code to read files...

maybe a link to some resource online that refrences this would help...

[clear hatch]

I just dont feel comfortable moving on and using the code as evidence for this finding without producing something tangible for the client.

[next bronze]

why can't you get lfi to work?

[clear hatch]

not dot sourcing

I'm not actually seeing output for the different languages, i cant get anything to show.

I already found the XSS vuln in the content parameter.
Maybe i should fuzz for more parameters?

[vital elk]

I was working through Attacking Common Services - Attacking DNS and came up with a question. (DNS / Zones are definitely on my list of things to get a deeper understanding of)

Why am I able to use inlanefreight.htb instead of ns.inlanefreight.htb when doing an AXFR? Does the AXFR automatically know the nameserver based on a lookup it does itself?

I realized I can specify ns.inlanefreight.htb if I add it to /etc/hosts, but being able to just use the domain itself is throwing me off. Every example I'm coming across is dig AXFR @<ns> <subdomin>.

Specific example from assessment. I can use:

dig axfr @inlanefreight.htb xxxxx.inlanefreight.htb

instead of

dig axfr @ns.inlanefreight.htb xxxxx.inlanefreight.htb

[fathom pendant]

I'm about to blow your mind. You can use the ip too

It's because .htb isn't a valid tld so subdomains don't redirect

[raven gorge]

oh, okay, okay, I'm just blind, thanks for reaffirming

[fathom pendant]

Like you can do dig axfr domain @ip

[vital elk]

That makes sense, domain and ip being interchangable

[fathom pendant]

It also cascades, even though ns is a valid subdomain, because it's not a public domain, it doesn't redirect

Even with inlanefreight.htb in your hosts

[vital elk]

Gotcha, I think. So when the lookup happens for the tld of .htb it returns "invalid" and basically exits out of the "lifecycle"?

[fathom pendant]

Yep

[vital elk]

🙌 some stuff is clicking, going to do a bit more reading, but thank you!!

[fathom pendant]

It says "oh this tld doesn't exist" so it doesn't keep going left

[waxen steppe]

I downloaded parrot on my own VM, and I want my hostname to show my IP like it does in HTB academy. Anyone know how?

[clear hatch]

use this at the end of your ~/.bashrc file

PS1='\[\e[96m\][\e[92m\D{%D} \[\e[92m\]\t\[\e[96m\]] \[\e[92m\]\u\[\e[96m\]@\[\e[92m\]\h\[\e[96m\]:\[\e[38;5;27;1m\]\w\n \[\e[0;96m\]\$\[\e[96m\]> \[\e[0m\]'

then source ~/.bashrc

https://bash-prompt-generator.org/

[waxen steppe]

where is that file found, do I just nano it?

[clear hatch]

sudo nano /home/parrot/.bashrc

[fathom pendant]

.bashrc

[clear hatch]

^

[fathom pendant]

It's a hidden file, need the .

[waxen steppe]

ah

I did it before but saw it empty so I thought I did something wrong

[clear hatch]

I like how i make one tiny mistake.. its not like i hadnt already given the proper filename XD

[vital elk]

it's possible you're using .zshrc if it is empty

[fathom pendant]

Default in parrot is bash

[waxen steppe]

zshrc isnt emtpy

[clear hatch]

lol

[waxen steppe]

is

[fathom pendant]

Zshrc and bashrc are different so you can't just copy over

[waxen steppe]

should I go with bashrc anyways?

[fathom pendant]

I think its in /etc/profile now

Or something like that

[waxen steppe]

ill try with bashrc

[fathom pendant]

I think it got moved or removed

[waxen steppe]

ok that works, just looks lil bit ugly

[fathom pendant]

Do ls /etc/

[fathom pendant]

Because you overrode what it was initially using

Also it's only gonna show the ip for htb if you're connected to the vpn

[waxen steppe]

d

[clear hatch]

make your own here https://bash-prompt-generator.org/

[waxen steppe]

I tried

It looks so ass wtf have I done hahah

any way to reset everything to 0? or just reinstall the instance

[fathom pendant]

You overrode the default it was using

[clear hatch]

XD

[fathom pendant]

Just sudo rm .bashrc

[waxen steppe]

ill reinstall the instance ahaha no prob

ill try that

[fathom pendant]

Then reset

[waxen steppe]

nope

if i edit bashrc its empty

so it removed it but now its doomed, ill just reinstall it no prob ahahah

[fathom pendant]

Close and reopen terminal

[obtuse verge]

Can someone help me in {Attacking Enterprise Networks -> Exploitation & Privilege Escalation] module?

[clear hatch]

@fathom pendant Would you mind helping me understand why I can't achieve LFI in the Documentation and Reporting module? Or is this fully up to me to understand/complete?

[fathom pendant]

I haven't done that module

My guess is you aren't properly trying to go back enough for the file

[clear hatch]

it could be this BUT, the source code im reading:

<!DOCTYPE html>
<?php
if (isset($_GET['language'])) {
    $lang = $_GET['language'];
} else {
    $lang = "en.php";
}
?>

<SNIP>

            <?php
            include('./languages/' . $lang);
            echo $p2;
            ?>

is from index.php.bak found at http://victimhost/files/ where a File Directory Listing was found.

So that's the off part.. it could be that this old code has been replaced by something, or moved to another parameter, i've used ffuf to fuzz the parameters and found ONLY the "content" param and NO "language" param. This might be a rabbit hole... i just wish i could confirm...

[fathom pendant]

?language=file

[clear hatch]

exactly

ive tried EVERYTHING and cant get a callback

[fathom pendant]

have you looked at the whole page when you tried? ¯_(ツ)_/¯

[clear hatch]

oh mf

lemme try it all again XD

i mean i looked at source plenty of times but

[fathom pendant]

[clear hatch]

i used -fs 5053 when fuzzing with ffuf... THAT should have caught any diff in the size of the body!

[devout cairn]

For the Skills assessment for service login brute forcing. Any suggestions on how detailed to get when generating the potential password list using cupp? I used baseline information and after removing the ones that don't meet the policy using sed it's still showing almost 24hrs to run the brute force

[fathom pendant]

Don't attack ssh if other services are running

[devout cairn]

The exercise specifically says to try brute forcing the ssh server though

[fathom pendant]

Does the question specifically state "attack ssh with these rules?"

Or something to that effect

Haven't done that module so genuinely asking

[devout cairn]

" As you now have the name of an employee from the previous skills assessment question, try to gather basic information about them, and generate a custom password wordlist that meets the password policy. Also use 'usernameGenerator' to generate potential usernames for the employee. Finally, try to brute force the SSH server shown above to get the flag. "

[fathom pendant]

Ahhh ok

[paper rivet]

Any hints in Intro to Whitebox Pentesting --> Code Review Authentication? I have tried with all functions as answer... Please

[devout cairn]

I can be more specific but getting to this required getting a name from the previous flag. Assuming we shouldnt post specific details about the contents of the boxes here if we can avoid so as to not spoil it for others?

[plucky torrent]

Hi guys!!! I just started hack the box but anytime I scan an up address I get this error:

-# птар -T4 - р- -A 10.10.11.236
Starting Nmap 7.94 ( https: //nmap.org ) at 2023-11-22 13:13 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nap done: 1 IP address (0 hosts up) scanned in 3.24 seconds

Pls how can I solve it.

[fathom pendant]

That doesn't look related to academy, read #welcome so you can find where to ask in a more appropriate place

[bright quiver]

When I am logged in as backdoor for module MSSQL footprinting....is the hostname not QF....ec or do I need to add something else to it? I ran this query in SQL - SELECT HOST_NAME() AS HostName, SUSER_NAME() LoggedInUser - any assistance please

[devout cairn]

got it. I was just being too thorough even with the base info for cupp

[green shuttle]

Module : modern web exploitation ,, second order command injection ,, changed the command multiple time and it did't work out anyone can help ?

[bright quiver]

Anyone able to give a hint or so for When I am logged in as backdoor for module MSSQL footprinting....is the hostname not QF....ec or do I need to add something else to it? I ran this query in SQL - SELECT HOST_NAME() AS HostName, SUSER_NAME() LoggedInUser - any assistance please

nvm - figured it out

[tidal kelp]

Module: Attacking Common Services
Section: Attacking Tomcat
I've got the RCE on the web app but having trouble navigating the server. what's the syntax for changing dir?

have tried with a +, '', "" nothing seems to work

[thorn urchin]

Depending on what payload you used changing directories might not be possible

youd have to specify full path for all your commands

[clear hatch]

check out laudanum webshell jsp

[tidal kelp]

I got to work just now

[clear hatch]

oof

i felt that

[tidal kelp]

now I Just need to find the flag

[dreamy solar]

Hello I have a question, I have this exercice which does not stop the bug I do not know how to carry out the exercise what should I do?

[clear hatch]

Hey, exactly how many findings are in the Documentation and Reporting module?

[thorn urchin]

¯_(ツ)_/¯

as many as you can find

[clear hatch]

awesome.

thats what i thought

[thorn urchin]

I ended up half assing it and not doing the actual report. I caught DA in five minutes, submitted the flag and moved on

[clear hatch]

😦 i cant do that.. my pride wont allow it.....

i have to prove it to myself yaknow

[thorn urchin]

I get it

[clear hatch]

i guess that's why noone wants to help with it XD

[thorn urchin]

I was just having big anxiety about the report stuff so I eventually said fuck it and just finished the module

I spent like two months on the module due to getting into my own head

[clear hatch]

Oh i have crazy anxietty bout it too, its just that i took a professional communications class in highschool that i did really well in. So i figure i should do the report..

[clear hatch]

oh im on day 3

[thorn urchin]

Yeah no doubt you def should

Im just saying why I didnt lul

[clear hatch]

right right

[tidal kelp]

for this, anyone got any good tips on how to easy look for the flags when you got RCE? flag wasn't in web root, so I'm a little bit consfused on where to start looking

[tawny sable]

Hello everyone. Would appreciate some help here: I am getting this error "[-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)" while using impacket-GetUserSPNs in the "Attacking Enterprise Network" modules. Anoyone here who have had the same issue?

[thorn urchin]

your time is off from the DC

sync your time to the DC

[fathom pendant]

The question tells you where to look

[clear hatch]

Clock skew too great; that's the tell there

[fathom pendant]

Iirc it's a linux host so some linux commands work

[tidal kelp]

does it?

[fathom pendant]

Just can't cd due to the nature of the shell

[tidal kelp]

it just say Find and submit the contents of tomcat_flag.txt

[dreamy solar]

I don't know how to authenticate to connect to the box

[fathom pendant]

Also that's common application module not common services module

[tidal kelp]

ah sorry my bad

[fathom pendant]

Then work backwards start at ls /

And move from there

[tidal kelp]

thats gonna take some time 🙂

[fathom pendant]

And?

[tawny sable]

It seems like i, for some reason, can't reach the DC with rdate for some reason

[fathom pendant]

Or go ls ../

[thorn urchin]

then use something else

[fathom pendant]

It really seems like you didn't try anything, just couldn't cd and went "well I'm out of ideas"

[thorn urchin]

Sometimes hacking takes time.

[tidal kelp]

I've started to go throug them all

[thorn urchin]

Theres a couple clever tricks you can try, but they only work with the knowledge that youre trying to get a flag file

[tidal kelp]

just thought it might be a smarter way

[thorn urchin]

in the Linux privesc skill assessment I got root and every flag but the very first flag. Got so annoyed I grepped the entire filesystem for the flag format

[tidal kelp]

ah ok

found it

woop

proably not the smartest way , but I got there

[tawny sable]

Sorry if I am being intrusive and asking straight forward questions. I have been trying with rdate and ntpdate for almost an hour now. All i get is "ntpdig: no eligible servers" and "rdate: Unable to get a reasonable time estimate". I'm not sure what I am doing wrong here.

[thorn urchin]

Whats the exact commands youre running

[tawny sable]

I have been attempting a few different one, but these are the last two: "sudo proxychains rdate -t 4 -n <DC IP>" and "sudo proxychains ntpdate <DC IP> "

[thorn urchin]

both use UDP and proxychains doesnt traffic UDP

Either manually update your time or use a better pivoting method like ligolo

[tawny sable]

So I got to use another method of forwarding the traffic to the DC?

Right, thank you. I will try

[thorn urchin]

Or manually update your time yeah

[hazy grotto]

Hey Could you give me a nudge on this? I got added to local, then i restarted but still denied access to the admin directory

Anyone have a nudge on windows priv esc section Weak Permissions? I was added to local admin. Tried restarting but still can't get access to admin directory

[tawny sable]

Have you tried to check if you are assigned to the group?

[misty current]

You mean restarted the instance from the section portal or hit a restart inside the machine itself?

[hazy grotto]

machine

[tawny sable]

Did you disconnect or log out when you restarted the machine?

[misty current]

Do a sign out and sign in. That should refresh the access tokens for your newly added administrator.

Restarting should have done the same, not sure why that didn't work

[hazy grotto]

once i sign out. it closes the rdp session

I restart and try it doesn't work again

[misty current]

It closes the rdp session. Yup. Just rdp again without restarting.

[undone narwhal]

i think you have to sign out not just close the rdp session

[tawny sable]

Correct ^

[hazy grotto]

This correct?

[misty current]

Yup

[hazy grotto]

Once i click that. It signs up and shuts down rdp

signs out

[misty current]

That's expected.

Just RDP again

[hazy grotto]

Yes

[tawny sable]

Then you just connect it back up, and the group policy should be updated

[misty current]

but don't restart the instance.

[hazy grotto]

no i didn't do that

[fathom pendant]

... try running command line as administrator

[misty current]

^

[fathom pendant]

You're still running it in context of a user account

[sly dome]

this is another case of skill issue

[fathom pendant]

@dreamy solar cause you're going an additional level too deep the file path is //DC01/julio/julio.txt/

[sly dome]

🤣 dont be upset im another noob

[misty current]

He probably saw that and deleted it asap lol

[fathom pendant]

Hold on let me diffuse this situation

[sly dome]

i mean if you see yourself in administrators group…

[sly dome]

why you tried to do it from command line also

do it from explorer he will ask for admin rights

[fathom pendant]

Eh command line isn't bad per se

[sly dome]

yap

[fathom pendant]

And probably comfortability with it

[rustic sage]

Anybody worked on bumblebee on sherlocks?

[fathom pendant]

Sir

[sly dome]

but having windows GUI

access to a folder is easier from explorer.exe imho

[fathom pendant]

I directed you to the right place earlier @rustic sage

This is for academy modules not sherlocks

[undone narwhal]

once you go cmd there is no going back

[fathom pendant]

Hes just ribbing you tbh he literally just did it to the guy before you. He's not actually talking shit

And his time will and has come before

For being called out on skill issue

Because at this point it's a meme

[misty current]

[fathom pendant]

We all have dumb moments

[sly dome]

broo

took it serious?

[fathom pendant]

And once figured out we can have a collective laugh about it because it was likely something simple

[sly dome]

come on haha the best part is to laugh at ourselves, you dont wanna know the things i miss and fail at 🤣

[fathom pendant]

https://tenor.com/view/my-goodness-what-an-idea-why-didnt-i-facepalm-the-simpsons-gif-17489109

[sly dome]

but i learn a lot

go sleep man

health is priority

[fathom pendant]

Me when I was told I was being big dumb on an ad enum question

[turbid hull]

So i know if i have a question on ad enum i have to ask to Marcie since i won't get claped

[fathom pendant]

I'll still call you a bozo

[turbid hull]

aaarg, my heart is bleeding, i am a bozo anyway tho

[fathom pendant]

Cause I am terrible at AD

[fathom pendant]

That do be how blood flows

[tawny sable]

I am losing my mind at this impacket-GetUserSPNs error. I still get the "[-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)" Even though the timezone on both machines are the same

I also get this message if that is to any help: [-] CCache file is not found. Skipping...

[thorn urchin]

doesnt matter if the timezones are the same, that actual time needs to be the same

As I said earlier, you need to sync your time to the DC. Either by manually setting the time, or by using a better pivot method so you can use one of the tools to sync

[hallow kiln]

Ntpdate and rdate legit fail for some, haven't figured out why, faketime has never failed anyone afaik though

[thorn urchin]

theyre failing for them atm cause they were trying to proxychains it

[hazy grotto]

Then I wouldn’t be able to hack

[fathom pendant]

https://tenor.com/view/sheldon-i-dont-need-sleep-i-need-it-gif-20600532

[limber river]

https://academy.hackthebox.com/module/113/section/1097 I can't get the shell from this app , I found CVE but can't exploit it ?

[thorn urchin]

I mean historically Ive seen YOU be that bully, not bullying other bullies.

You've calmed down mostly since then though.

[small sage]

https://tenor.com/view/perfect-popcorn-michael-jackson-gif-26271837

[thorn urchin]

Yaoi is my friend though?????

Wtf revisionist history is this lmao

Youre also posting some manifesto rant type stuff in #modules right now

[hazy grotto]

@fathom pendant I forgot to say thank you.

[orchid pine]

guys ifk if its only m,e but im really struggling to understand the xxe exploitation part advanced file disclouser section

i dont feel like its a good explication

or im just dumb

[spring viper]

sure

[bright quiver]

can someone let me know if this is correct for the IPMI module...I have the hash in a txt file and am running it like this: ||hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u||, but I know you are supposed to leave off the ?1?1?1?1?1?1?1?1 - is that the only part to leave off? So then do I run it as this: ||hashcat -m 7300 ipmi.txt -a 3 -1 ?d?u||

if someone can either let me know here or DM that would be awesome - ty

[fathom pendant]

Wrong

That specific mask is relevant to a specific scenario

You need to use the password list

[fathom pendant]

The ?1?1?1?1?1?1?1?1 is a mask for a specified length of string for a default password

The section explains that if you're dealing with that scenario- do that

[bright quiver]

@fathom pendant ok - let me figure out the correct hashcat syntax command - thanks for the info

[fathom pendant]

You're close you really don't need too many additional arguments just hash and wordlist (and mode)

[bright quiver]

@fathom pendant got it - used THE wordlist - thanks again

[orchid pine]

Like fo real guys

That section of xxe advanced file disclosure is driving me crazy

[heavy marsh]

Attacking Common Services Easy Lab: I have the SQL username and password, but the SELECT INTO OUTFILE isn't working

[thorn urchin]

the easy lab is actually the hardest lab in the module

[heavy marsh]

Really?!

That sucks! lol

[thorn urchin]

into outfile does work but it takes a little conceptual mind bending

[heavy marsh]

any hints, I've tried something that worked for somebody else, but is not working for me.

[fathom pendant]

Make sure you're putting the slashes the right way

[orchid pine]

Guys need some external references about blind xml if anyone knows annything that can help me plzz send it to me

i was digging but still struggling

[heavy marsh]

Okay I got a shell, but I can't do anything with it. Not sure how specific I can be here without revealing spoilers

I guess I should say I was able to get a webshell uploaded, but no shell

Getting this error in the web interface:

Warning: shell_exec(): Cannot execute a blank command in C:\xampp\htdocs\backdoor2.php on line 1

[thorn urchin]

did you uhh supply a command

[heavy marsh]

Tried whoami

[thorn urchin]

your shell is bad

$_GET['whoami'] would be querying the parameter named whoami, not executing whoami

[heavy marsh]

The one from the module didn't work either

[thorn urchin]

what error did you get with that one

[heavy marsh]

I forget

[thorn urchin]

and did you supply a command to the c parameter

[heavy marsh]

Module was pretty light on this, so no

I just tried CMD from another example in one of the links I found

[thorn urchin]

well try that one again and supplying a command to the c param

[heavy marsh]

Is there a man page or whitepaper I can read on this before I waste my time trying random commands?

[thorn urchin]

its a web shell that executes commands you supply to it

its not any more complex than that

[thorn urchin]

the path is wrong

you gotta use the correct path you found from earlier

[heavy marsh]

how do I even find that path in the first place? I found that from somewhere on the HTB forums

C:\xampp\htdocs\backdoor2.php

[thorn urchin]

I dont remember its been far too long since I did that lab

finding that path was def one of the hardest parts of that lab though

[heavy marsh]

If it's not covered in the module I have no clue

Is there a good walkthrough for this somewhere so I can go step by step and fill in the gaps?

[next bronze]

isn't that the default webroot for xampp though

[thorn urchin]

yes but knowing to use the default xampp webroot is the issue

[next bronze]

true

[thorn urchin]

its covered in the you need to synthesize information youve learned to discover it.

Its why its a skill ASSESSMENT

my only gripe is that the order of the labs is wrong

[heavy marsh]

What do I need to do in order to make this work?

None of the commands are working

[fathom pendant]

you find out that it's an xampp hosted site on a windows system

i forget exactly how but there's breadcrumbs

backdoor.php?CMD=command

[thorn urchin]

what commands are you supplying to the shell

[heavy marsh]

So if I'm trying to put my research plan together for this: I'm looking at XAMPP, then looking at PHP webshells, and then identifying ways to write commands for those two services into a webshell?!

[heavy marsh]

whoami

to test it

[thorn urchin]

okay and what output did you get

[heavy marsh]

One moment

[thorn urchin]

thats the same thing we already covered

[heavy marsh]

I've been trying a lot

[thorn urchin]

you dont embed it in the $_GET, you supply it to the parameter you specify in $_GET

if your parameter is $_GET['cmd'] your request should be backdoor.php?cmd=whoami

[heavy marsh]

I thought I already tried that, let me try again

[thorn urchin]

make sure youre using the correct webshell and changing cmd to whatever youve supplied for that webshell

cause it can be literally whatever you name it

Ive had it be 0 for space reasons before

[heavy marsh]

Tried that, no go

[next bronze]

what's the full url you used?

[heavy marsh]

http://10.129.27.215/xammp/htdocs/backdoorgo.php?cmd=whoami

[next bronze]

wasn't it backdoor15 here?

[heavy marsh]

I've redone it and renamed it over a dozen times

I'm now using noun names to keep track

That's how ridiculous this is

I understand your confusion though

[next bronze]

use the file name of whatever backdoor you've created, it shouldn't return a 404 if you have created it

[heavy marsh]

Use that filename where?

[next bronze]

the file name you created using this command

or however you're creating the backdoor

[heavy marsh]

I don't have a reverse shell or anything, it's the one-liner from the module

[next bronze]

I know

[next bronze]

the webroot is without the system directory names

[thorn urchin]

Hes saying you can use one of the several webshells you've already uploaded

[heavy marsh]

Link to stack overflow, probably won't help, lol

[thorn urchin]

why are you googling that

[heavy marsh]

I plugged it into the address bar

[thorn urchin]

???

why??

[heavy marsh]

What do you want me to try?

[thorn urchin]

you already know you need to supply the target host first...

thats not even fundementals knowledge, thats can you use a web browser knowledge

[next bronze]

what's the url you're using now? have you changed it since the previous returns a 404?

[hallow kiln]

it'll just be http://10.129.27.215/backdoorgo.php?cmd=whoami

[thorn urchin]

Youve clearly accessed your webshells before to even see their errors

just do the same thing again

You shouldnt be regressing this hard

[thorn urchin]

okay now did you supply a command to CMD

[heavy marsh]

??

[thorn urchin]

what is the EXACT url you used to access this

[heavy marsh]

Should I restart this machine?

[next bronze]

and what's the command you used to create that?

[thorn urchin]

did you try CMD

[heavy marsh]

Thank you guys for the help, but I think I might need to restart

[thorn urchin]

if CMD doesnt work. then something about your command to generate the webshell broke

[hallow kiln]

just try it with capital letters as madf0x said

[heavy marsh]

MariaMaria she reminds me of a westside story!

THERE WE GO!!!

[thorn urchin]

okay now super important

do you understand now why your earlier attempts werent working

does the different elements make sense now

[heavy marsh]

No

I will be honest

I was waiting for someone to tell me to RTFM so I could find out where the FM was

Then I would have read up and tried later

[thorn urchin]

Theres no manual for this because this is basic webshell 101 stuff

https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/

[heavy marsh]

So what was I doing wrong? Capitalization?

[thorn urchin]

yes

the parameter has to be exactly what you defined it to be

you can make the parameter nearly anything but its gotta be the same in your request

[thorn urchin]

this article might help understand it better

[heavy marsh]

Thank you for linking supplemental content.

So what do I do now? This is not an interactive shell

Just text

[thorn urchin]

you deal with your limitations 🙂

[heavy marsh]

So should I try FTP?

[thorn urchin]

either try to leverage a rev shell payload, or issue commands until you get what you need

[heavy marsh]

Now that I've got through all of this it seems like a bummer that it's a dead end.

[thorn urchin]

its not a dead end

youre system

youve won

you just gotta collect your prize now

a shell doesnt have to be interactive to be useful

[heavy marsh]

So what now?

[thorn urchin]

nt authority\system is basically the root user for windows

[thorn urchin]

go get the flag

[heavy marsh]

Yeah, I know that, I just don't see how I can use html text to root a system?!

[thorn urchin]

???????

bruh

[hallow kiln]

like this ^

[thorn urchin]

Im at my limit Im sorry man

Good luck, im off to play bg3 with the gf

[heavy marsh]

Thanks for all of the help

[next bronze]

a shell is just text, doesn't matter if it's interactive or not

[fathom pendant]

You're leveraging system commands my guy

[thorn urchin]

only thing I could add is you need to loosen up your concept of what a shell is

[next bronze]

hit me up when you get a 3d rendered shell

[fathom pendant]

VR Hacking

[heavy marsh]

So how do I interact with the shell?

[hallow kiln]

you already are, you can issue any command you want

[fathom pendant]

by sending commands in your parameter

?CMD=dir

?CMD=imdumb

[next bronze]

doesn't work, I want a refund

[heavy marsh]

😆

That's funny.

[heavy marsh]

You're funny

Yeah now the backdoor is not working at all.

Had to reset the machine, it's back

No flag.txt

lol

It's still just html

[thorn urchin]

its always html

[heavy marsh]

🤦‍♂️

[thorn urchin]

the html is just the output of your commands

literally no different than getting text back from any other shell

gotta go look for the flag.txt

idr if the lab tells you where it is or not. You may have to look around on the machine

[heavy marsh]

Not in hidden text, I don't know where else to look.

[thorn urchin]

bruh

are you trolling now

[heavy marsh]

Lab just says the target server

It was a longshot!

[thorn urchin]

the html you see is just the command output

I don't know how to explain that conceptually any simpler

[heavy marsh]

I'm trying to use the module's content, but it seems more like a CTF now

[thorn urchin]

have you used ANY shell before

[heavy marsh]

Yes

[thorn urchin]

same shit

literally the exact same

[heavy marsh]

rev, bind, metasploit, etc

[thorn urchin]

only difference is you cant cd to different directories

and you see the output with your browser instead of a terminal

theres no hidden text, theres nothing fancy about it being html

its JUST regular text from the command

[heavy marsh]

So is there a way to upgrade the shell?

[thorn urchin]

You can but its really not necessary

[heavy marsh]

What would you recommend I do?

[thorn urchin]

use regular normal system commands to look around for the flag

checking the adminstrators desktop is typically a good spot if not the c:\ root

[heavy marsh]

nothing but whoami and dir works

everything else just hangs

I'm assuming I just put commands after CMD=

?

Tried to cd C: a bunch of ways

[next bronze]

you can't cd, said it right here

use full path

[heavy marsh]

so what is the full path? without me knowing I can't "type flag.txt"

Is there a brute force tool for this

[next bronze]

find it

[heavy marsh]

?

[hallow kiln]

you should know the default Windows directory structure man

[fallow stirrup]

is extranet considered as a wan?

[fathom pendant]

Just use dir commands to find it

You can dir a full file path much like ls

[heavy marsh]

Yeah, I figured it out, time-consuming, but I got the flag.

It alluded to a second method?!

There are two ways to get the flag!?!?!?!

[fathom pendant]

Probably getting a Rev shell

Or something

[heavy marsh]

That's what I was trying to do

[fathom pendant]

¯_(ツ)_/¯

[hallow kiln]

I just added myself as admin and RDPd in lol

[heavy marsh]

Then again there was not much guidance

[hallow kiln]

because it's a skills assessment...

[fathom pendant]

Skill assessments generally don't have guidance my guy

[heavy marsh]

net add....??

[hallow kiln]

you're on the right track

[fallow stirrup]

are you guys working?

[heavy marsh]

So you're already admin so it would be an admin to make another admin

[heavy marsh]

I'm working? What is it that you do for work?

[heavy marsh]

Thank you for the guidance!

[heavy marsh]

Not working for me for some reason

[hallow kiln]

what's your command?

[heavy marsh]

for the second command

[next bronze]

you need to create the user before you can add them, have you done that?

[heavy marsh]

sorry had to paste them in reverse

[next bronze]

are you sure your syntax to add a user is correct

[heavy marsh]

Is this right?

My screenshot got deleted

[fathom pendant]

Probably a mod deleting it

Bc spoilers

[heavy marsh]

How is it spoilers if it's not even covered in the MODULES!?!?

lol

[fathom pendant]

Because it's still an alternative way to get the answer

Could also just be automod yeeting it

Try encasing it in code block

[heavy marsh]

how in code block?

||http://<IP>backdoorgo.php?CMD=net user testuser 123456789 /add http://<IP>/backdoorgo.php?CMD=net localgroup administrators testuser /add ||

Like this?

http://<IP>backdoorgo.php?CMD=net user testuser 123456789 /add
http://<IP>/backdoorgo.php?CMD=net localgroup administrators testuser /add

Anyway, so what is wrong with these commands

?

[next bronze]

looks good, what makes you think its wrong

[hallow kiln]

it can't be reset

[fathom pendant]

and did you try to ssh/rdp in with those creds?

[fathom pendant]

you do the double brackets outside the code blocking btw

||like this||

anything inside the backticks is considered code to be printed

gotta love markdown

[umbral fulcrum]

hey guys, I need a bit help with bloodhound using pivoting ( I keep getting error massage ...)

and the if I do ||.\SharpHound.exe -c All --zipfilename|| in the target machine I can't pass it back to my VM ...

[fiery berry]

If you have access via RDP just use the /drive: option, otherwise transfer the file to the external facing machine the one you use to tunnel the traffic

[umbral fulcrum]

hhmm don't know this one /drive:

[latent cave]

it's super useful, I use it by default just in case

[fiery berry]

read the man page

[kind turret]

The /drive option allows you to redirect a directory as a named share. For example, suppose you have a Windows machine and you want to transfer files to it from a Linux machine. You can use the command:

xfreerdp /v:WINDOWS_IP /u:USERNAME /p:PASSWORD /drive:NAMED_SHARE_NAME,"LINUX_DIR"

Then, on your Windows machine, you navigate to C:\Share and use the command net use to see the path of the mapped drive.

Once you know it, any files within "LINUX_DIR" will be available to you in NAMED_SHARE_NAME

So you can use copy on them

[umbral fulcrum]

thanks I just read it

[clear hatch]

Anyone know of a way to compile source for ipmitool AND its dependencies into one debian file or something? so that I can upload it the parrot foothold in one go?

tried to use ssh -L 4444:remote_host:623 htb-student@IP to forward local trffic at port 4444 to the remote IP at 623
but I cant do the same things with ipmitool(on Ubuntu-VM) as msfconsole(on Parrot). There seems to be python-ipmi, which is also unavailable on the parrotboxes.

[umbral fulcrum]

my command in windows target :
powershell -ep bypass
. .\SharpHound.ps1
.\SharpHound.exe -c All --zipfilename got2work

but it doesn't get load 2 bloodhound ...

any advice please ??

[latent cave]

hello everyone, I've been stuck on the AD Enumeration & Attacks - Skills Assessment Part II for a few days and was wondering if someone went through it recently? 🙂

[next bronze]

are you using the right sharphound version

[next bronze]

just ask your question

[latent cave]

I'm stuck at "Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host. " and can't seem to be able to enumerate the users that I have access to enough so that I can get to Admin. I've tried Kerberoasting, creating a shadow copy of C, responder, all to no avail 🤔 I'm thinking I'm supposed to be able to force admin to change his password but can't find the powershell command to do so

[next bronze]

you can find the ForceChangePassword commands here https://academy.hackthebox.com/module/143/section/1486 also remember to enumerate the rights of all the other users you have access to

[latent cave]

thanks a lot, I'll do that! 🙂

[eager loom]

i dont understand why these commands produce different results.

1. ss -l -4 | grep -v "127.0.0" | grep "LISTEN" | wc -l
2. ss -l -4 | grep -v "127.0.0" | wc -l

because ss -l tells it to only list listening sockets

but it still gives a diferent result when using it with grep

[umbral fulcrum]

download the latest debug.zip from here:
https://github.com/BloodHoundAD/SharpHound/releases/tag/v2.0.1

[next bronze]

when you run sharphound it will tell you what version of bloodhound it's compatible with

[umbral fulcrum]

5.0.0

[next bronze]

and what version is your bloodhound

[umbral fulcrum]

hmmm

not 5 ....

[next bronze]

use sharphound 2.0.0

[umbral fulcrum]

same result...

both 4.3.1

[proven panther]

Im on the GET section of the Web requests module. When doing the task at the end where you enter a city name, I dont have a line appear in my browser dev tools network section with the search.php?search= when i enter a city name. Any ideas why?

[spring viper]

I use the release right b4 2.0.0 and it works

or you could update bloodhound ._.

it says in the github releases which goes with which

[drifting pike]

Hi, I am new in the Cyber Security and Pentesting field. I don't have much prior knowledge to practice. So I am going to complete these following modules to learn basics.
But the module seems boring to me. There is so much theory and absorbing all without practical application is though for me. I can't remember all the lesson from module.

1. Introduction to Computer Networking (Completed)
2. Windows Fundamentals (On going)
3. Linux Fundamentals
4. Web Requests
5. Introduction to Web Applications

Is there anything I can do for make my learning more interesting and effective? Please suggest me some tips or some additional resources if needed? Please, help me and guide me.

[strong sierra]

Hi everyone ! Where can I ask questions about machines ?

[tiny yacht]

Yo ! Looking for a hint for Command Injection>Advanced Command Obfuscation.
Question:Find the output of the following command using one of the techniques you learned in this section: find /usr/share/ | grep root | grep mysql | tail -n 1

I've arleady tried to encode this command to base64, i was trying to use reverse
Some commands worked but non of them showed the resault.
EDIT:
Found a partial sulution for that ! Not sure if this is the correct approach but it worked 😄

[next bronze]

take notes, no one is gonna remember all of them, the skills assessment at the end of each module is a chance for practical application, those modules can be boring yes, but they also help your fundamentals to use each OS effectively

[next bronze]

#boxes , read and follow the instructions in #welcome to get verified

[oblique spoke]

hello! i am currently pivuting and tunneling section and i need to transfer some binaries from linux to windows. Any tip? i tried smb i tried python

[spring viper]

is the windows host behind the pivot host

like are you trying to go attack -> pivot host -> windows box

[oblique spoke]

attack linunx -> pivot windows-> target windows

and i need to transfer from attack linux to povot windows

[spring viper]

the module explains this better then I can but the windows host doesn't know how to reach you yet so you need to upload your binary to the jump host and then from jump host to Windows

and then when you trigger the binary on Windows with the remote port forward implemented the Windows box will know how to connect back to you

but the module does a good job of explaining it

[snow tiger]

Hi guys, need a bit of help regards: Skills Assessment - Using Web Proxies. managed to decode the cookie. For the next question, i have tried to encode the payload > som reason not getting the 88 character for the paylod.

[coral mulch]

hello, so after some consulting, i will subscribe to HTB Academy

i feel its the best resource for me

i was going to thm but someone told me its more in depth here, so i would like how you guys take notes, and you guys schedule your studying time and pratice

[dusky rivet]

On my side, I just opened a new Word document and created chapters with headings and sub-headings, making brief notes. Some people prefer to just take the commands and enter them into cheertree, for example, or obsidian. I personally prefer to have context. Everyone has their own method for taking notes. As far as practice time is concerned, the ideal is to do it several times a week. If you take too big a break, you'll quickly lose your habits and it will take you a long time to get back into it. Do as much as you can 😉

[coral mulch]

ok

@dusky rivet thanks i am pretending to use the mornings like 2 to 3 hours

[dusky rivet]

Hello everyone.
Hope you're good!

Question for the AD Enumeration & Attacks - Skills Assessment Part II on Question 4 :
"Use a common method to obtain weak credentials for another user. Provide the username of the user whose credentials you obtained."

Context: I got the user ABXXX via Responder.
I cracked his password using hashcat. I'm currently logged into the MS01 machine.

Problem: It doesn't seem possible to get a list of users on the domain. I have tried "import-module Activedirectory" and "import-module .\PowerView.ps1" (I have tried many things to make them work... None succeed)

Questions: I guess it will be password spraying via the password we already got for the account ABXXX. But without a list of users this will not be possible.
So:
1- Why isn't it possible to import these modules and do a "Get-ADUsers -Filter *" (it's an example)?
2- Are these modules only available on a domain controller? (PowerView + ActiveDirectory)
3- How to enumerate all the users of the domain without these modules?
4- The user ABXXX could log on to the server SQL01 to access the DB, I am not good enough on MSSQL to enumerate esaly users. Was it the good way to enumerate?

Thanks in advance for your time, enjoy your day ! 🙂

[faint rampart]

You cannot use any Powerview functions because of the Kerberos Double Hop problem if you recall

Youre using creds over more than a single hop, TGT isnt cached so its not sent with each request or interaction with the DC.

[faint rampart]

enumerate users using the methods thought in the modules, ALOT of those were given, try them

[faint rampart]

Hint for way forward : try common passwords

[dusky rivet]

Not sure about that. I'm on ssh on the parrot os they give. Then I used evil winrm to log on the MS01. So it's a simple hop

[dusky rivet]

I'll read them back!

[faint rampart]

lol, everytime you use Winrm its not a single hop
Not sure if thats exctly the reason, but I have tried it with a couple boxes and PowerView over WinRM would only work when you pass the credentials as a PS credential Object

[faint rampart]

all the best, I had a lot of fun on that one, I hope you do too!

[dusky rivet]

Ok thanks for the tips, I'll try to cache the credntials in that way and to test PowerView again!

[next bronze]

are you saying that logging in using winrm with domain credentials is not a single hop?

[umbral fulcrum]

hey guys got NTLM, but when I run the hashcat it i only do 13% and doesn't show it
any idea y is that?

[faint rampart]

Im not sure, correct me if I am wrong, it would be a learning opportunity 😅 but whenever I use Domain credentials with Winrm I usually get the DCOM, findall blah blah Exception error which was the same from the Double Hop problem, unless I pass it as a credential Object

[dusky rivet]

Well, I tried to cache credentials in PS and executed powerview again. Seems not working. problem isn't there

[faint rampart]

Weird it did for me

did you pass it with -Credential $creds?

[dusky rivet]

Yes, same issue with -credential

[next bronze]

I don't think that's right, when you connect using winrm, it's a single hop, it's when to trying to authenticate to another machine inside that winrm session, then it's a double hop

[next bronze]

wdym only do 13%

[next bronze]

you can get domain users in a lot of ways other than powerview btw

[faint rampart]

Okay okay, thank you very much.
Could you perhaps explain why you woudl get the same error as you would in a Double Hop problem scenerio in this case since we consider this to be a single hop.

[next bronze]

I've not seen those error before in winrm, are you using evil-winrm?

[south glen]

hey all, i need help with module: password attacks section : password mutation i have already find the password for user sam with suggestion in this channel to remove 17k lines of the mutated password list and running the attack against ftp instead of ssh but still for some reason i m not able to login with the found password ||B@tm@n2022|| to any of the service even ftp ......plz help i am stuck here from 3 days

[analog dock]

Just did the pivot skills assessment again, amazing how easy it is with ligolo

[faint rampart]

I did that about 4 months ago, and I had the error, also when I did Authority on HTB I had the same error

[umbral fulcrum]

it gives a massage of "Approaching final keyspace - workload adjusted. "

[faint rampart]

or maybe I am remembering wrong lol 💀 I will redo it again.
I have a personal note on it tho and I just checked and saw the error in my walkthrough, but thank you tho

[next bronze]

I used evil-winrm for authority and didn't have problems, hmm might want to reinstall yours

[next bronze]

the wordlist ran out, use a bigger one

[faint rampart]

alrighty, thank you!

[next bronze]

they tell you which use you should login as, if you can't, then the password is probably wrong

[umbral fulcrum]

no way

[rough shoal]

stuck at the first section for environment enumeration, is this the correct channel to ask?

[rustic sage]

The password you've entered in the message is wrong.

[south glen]

okay

[rustic sage]

Perform the attack again or recheck your terminal output.

[next bronze]

I mean, if hashcat went though rockyou and didn't crack it, then the password is not in rockyou

[umbral fulcrum]

the policy is very weak I don't believe it went on all of it in a few seconds and didn't find

[next bronze]

ntlm is md5, it will only take a few seconds to go through rockyou with a reasonable gpu

[south glen]

yes you are right i just copied the incomplete password from the terminal output thanks for pointing out.

[next bronze]

use a rule or something

[mortal basin]

🔥

And that’s 15/15 😎

[umbral fulcrum]

I need a bit help

I'm stuck on "AD Enumeration & Attacks - Skills Assessment Part I" 4 3 days now

if someone can help me please

[dusky rivet]

which question?

[carmine hill]

Now release the surprise 😁 we all want to confirm what the 15/15 was for

[mortal basin]

Bigger spiders 🕷️🔜

[carmine hill]

CBBH vs whatever will come would feel like this

[umbral fulcrum]

Find cleartext credentials for another domain user. Submit the username as your answer.

I didn't find clear text password, but did see a folder of t*
and using mimikatz found its NTLM, but can't crack it ....

as well I tried to get bloodhound but it just didn't work (DKW) ....

so I'm in "Submit this user's cleartext password." after guessing the user through the Q it self ...

[acoustic owl]

When will the path be published?

[mortal basin]

Very 🔜

[dusky rivet]

yeah understable, made the same as you

[acoustic owl]

after CDSA I'm going to learn Python, PHP, C#, Java and Node.JS for the new path 😇

[long anvil]

SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe) - Followed instructions to a T, got a date but is not valid, could anyone please give me a hint?

[dusky rivet]

try to do it remotely via secretdump

[umbral fulcrum]

tried it as well

[dusky rivet]

I tried it yesterday and it worked, come DM

[royal sigil]

hello i make the skill assesement of WEB attack i have already the user who is admin and the token but im stuck on part for changing the password anyone con give me hint thanks

[sly kelp]

What resources you are going to follow ?

[acoustic owl]

I learned Python during the pandemic with Udemy courses. Just watch the video and follow along. Then build something yourself...
That actually worked quite well. I'm certainly not a programmer, but the scripts here at HTB have never overwhelmed me. I think I'll do the same with all the other languages.

[steady bison]

Hey people, I've got a question about the broken authentification module, if anyone could help me, i'd be very grateful! I posted it in the #1024429874246590575 under "Broken Authentification --> Tmp Password Token". (I hope I am allowed to ask here "again").

[ivory dock]

Hi, can anyone help with Hashcat - Cracking Common Hashes?

[acoustic owl]

If you say what exactly the problem is, I'm sure you'll get help here

[ivory dock]

I tried cracking with type md5, md4 and NTLM and tried all availabel rules liste here https://hashcat.net/wiki/doku.php?id=rule_based_attack but none worked. I read somewhere above that the hashid output may not be correct for the first lines of the results...

[acoustic owl]

You are on the right track with ||NTLM||

[ivory dock]

Okay but is there really no better way than random guessing rules?

[ivory dock]

Okay I solved it now and no, there is no better way than trying all rules. But thx for the hint, the hashid output is confusing

[royal sigil]

i have tried like this HEAD /api.php/reset.php/user/||52||

[hoary moon]

I have tried SQL Injection on an Instagram account it doesn't work for some reason can someone say why it didn't work? #community-content

@tough fjord

I'm trying to crack the password.

[sly dome]

did u solve it?

mimikatz is the way

[surreal rain]

https://tenor.com/view/kyloren-sad-star-wars-i-know-what-i-have-to-do-adam-driver-gif-11159545

[low vine]

So excited to tackle these

[raven gorge]

Enumeration & Attacks - Skills Assessment Part II Q7 having a bit of a dilemma here. I have rce on the sql server SQL01 and got a reverse shell using netcat. But I'm struggling with the privilege escalation. User has ||SeImpersonatePrivilege|| privilege and I know that there as some paths I could take from there, in particular ||printspooler|| which is what ||getsystem in meterpreter|| relays to. I just discarded them as an option as none of those exploits where given on the attack box and I don't think using ||metasploit|| is meant to be the path to follow. On the other hand I couldn't get Print Nightmare to work. I don't really see a path to follow other that what I mentioned, am I missing something else?

[pine dagger]

AD one? I used ||metasploit and meterpreter|| with the creds from the previous question. Try looking for a ||meterpreter for the service you compromised||.

[raven gorge]

Hey that's right ||metasploit > meterpreter > getsystem, some specific module or transferring a meterpreter reverse shell to the user temp directory as I did|| do the thing but I was wondering if anybody could achieve privesc without using ||metasploit||

[faint rampart]

||spoofer and the potato family|| lol

[snow swan]

Hello, i m stuck on the question 2 on the skills assessment of using crackmapexec, i don't find any access to the SQL01 server. Any hint ?

[orchid pine]

hello guys im doing the web attack module error based xxe and im losing my min with it i want to understand the concept behind this i cannod do thing withpout understanding theme i hope some one of you guys can help me

so my question is why we need to host the payload in our host then called it externally

why including the whole patload in the request is not going to work

plzz guys im losing it i feel so dumb and stupid

and i didnt find any extrnel resources that may help me

[sly dome]

i compiled printspoofer myself and transfered it to the sql01 computer

then used it to send me back a reverse as nt authority/system

[raven gorge]

sql server is not available check what you can do with the kerberoasted account on the other servers

[snow swan]

I found credentials in smb shares but i can't do anything with these creds

[raven gorge]

hum, sounds like the way, I kind of wanted to stick just to the attack host and the exploits available there, not sure if that was the purpose of the scenario, doubting it now

[sly dome]

there is no other way apart from abusing seimpersonate there

metasploit uses it when you issue getsystem

[raven gorge]

talking of AD Enumeration & Attacks - Skills Assessment Part I? PM me

[raven gorge]

correct, that made me ask

[sly dome]

both approachs are valid

metasploit or manual

[raven gorge]

yeah, I just thought that since that privesc was not mention in the module maybe it wasn't the lesson to learn there

my bad, overcomplicating things

[sly dome]

it’s mentioned

privileged access section

[raven gorge]

uh oh, let me zip my mouth for a while 🤐

[orchid pine]

Anyone can help this stupid person

[olive fiber]

Amny help about the secondo "Submit this user's cleartext password." of t... user ? AD Enumeration & Attacks - Skills Assessment Part I

[royal sigil]

hello i make the skill assesement of WEB attack i have already the user who is admin and the token but im stuck on part for changing the password anyone con give me hint thanks
I have tried like this :
HEAD /reset.php/api.php/user/||52||

[orchid pine]

Brother can i ask you in sms

[tidal kelp]

try a different request method

[undone narwhal]

i think this is wrong
you need to host DTD file on your machine and call it with the request, here you are using DTD payload in the request

[royal sigil]

ok

[orchid pine]

Im trying to figure out what is the difference what will change

Wht will make one work and the other fail

[undone narwhal]

what do you mean other? you cant mix those two things and expect it to work

[thorn urchin]

the answer is pretty simple dtd's must be hosted separately and cant be inline

and unless you have arbitrary upload its simpler to host it yourself

[olive fiber]

nevermind, rebooted the machine and the method worked

[orchid pine]

My man can i ask you just to understand something

[thorn urchin]

https://dontasktoask.com

[orchid pine]

I want to say can i dm you

XD

[thorn urchin]

no

Just ask here

[orchid pine]

My question was like we don’t use a dtd file we just write that payload in the request

[thorn urchin]

I just told you why

you cant inline it

the designers of xml and dtd didnt allow it

Its like writing a buggy program and asking why cant the bug just not exist. Because thats not how the language was designed.

[clear hatch]

Why isnt ipmitool available on our parrot boxes???

[novel matrix]

Its like saying why isnt every pentesting tool on parrot (github repos). If it isnt on parrot, you will need to install it

[clear hatch]

well... i cant exactly just "install" it, and it has dependencies

I would LOVE to know how to take an apt package AND its dependencies and install them on another host machine.....

i just dont recall it being outlined in the cirriculum

i WAS able to get ipmitool configured and made on the parrot host... just not its dependencies, maybe I just GO find them and zip em all up????

[clear hatch]

thats like saying that you just need to use apt-get install

which you DONT

what a crap answer XD

[fathom pendant]

Well install the dependencies

It's not really a crap answer, and sometimes you'll need to install or update packages to fix dependencies

¯_(ツ)_/¯

[clear hatch]

so thats AN answer. His reply stated i "needed to install it".

saying that i need the dependencies too is probably going to fix my issue

[novel matrix]

If ya dont have it, then you need to “install” it

[fathom pendant]

That's how installing things works

[clear hatch]

does parrot have docker?

so i COULD install it on docker

[fathom pendant]

In a windows environment the install.exe contains checks and calls to dependency fixes

[clear hatch]

yeah by your logic

all i have to do is install

bam

[fathom pendant]

weird hill to die on ¯_(ツ)_/¯

We didn't know previously you were having dependency issues

[clear hatch]

hamburber hill

[fathom pendant]

You just blank stated about not being able to install it

[clear hatch]

hmm

[fathom pendant]

Or having issues with jt

[clear hatch]

?

ive asked questions multiple ways before

[fathom pendant]

And this is the comment that he was replying to

As your other question about the tool was 12 hours ago it's not anyone's job to research your chat history for a more full context

[clear hatch]

lol

[fathom pendant]

Oh @autumn pilot is there plans to update pwnbox to the 6.5 iteration once it's fully out and stable? It currently takes some effort to get from 5.x to 6.5 so idk how that works on backend

[rustic sage]

alguien de habla hispana?

[fathom pendant]

Ingles solamente. Lee #rules

[novel matrix]

English please

[thorn urchin]

Yeah all you have to do is install it. Whats the issue?

Oh not in apt-> look tool up -> find installation instructions -> follow them

[rustic sage]

I in a module where it asks me to examine all the ports and services of a specific host, then capture a flag that I suppose its content should be sent: I open 2 terminals, one is dedicated to examine the ports with nmap using the commands -p- -sV -sS , And the other I capture the traffic with tcpdump -n host -v -A(shows the content in Hexadecimal), all the ports filtered and no relevant flag, I am 2 days stuck, help

[clear hatch]

did this and there are missing dependencies

do i just do that same exact thing for the dependencies?

[thorn urchin]

yup

welcome to learning computers

[sly dome]

mimikatz

[olive fiber]

thank you, already did it after i reboot the machine

[sly dome]

i think i did it with netexec tho

but dont remember exactly

[hazy grotto]

Happy Thanksgiving everyone

[orchid pine]

DTD can be declared inline in your XML document

[gray merlin]

I have no idea what exercise you are working on, but, have you tried UDP?

[orchid pine]

i understand now its not the thing but now it make sens after 2 days of me being so stupid thank you btw so much

[wicked sierra]

hello! I would need help, I cannot access any http://[IP] from the module ignition even when doing what i am supposed to

nvm found it

[orchid pine]

guys another question another question is bout the xxe section in web attack module its when i will call the %error it will expand to content SYSTEM '%nonExistingEntity;/%file;' but how it will read %file is it something about how paramter entity treat what is inside the entity normally it will need to throw invalid uri no

[clear hatch]

@thorn urchin I apologize for atting you.
Can I DM you a zip with my attack_path.md for Documentation & Reporting so that you can have context into what I am attempting to do?

[fathom pendant]

Ignition is a box, not an academy module

[orchid pine]

why we couldnt just use

cuz it will throw invalid URI

[orchid pine]

but here will not treat that as a file but as aprametre wtf

i'm about to explode

[fathom pendant]

Take a step back dude

Just take a breather and walk away for a minute

[orchid pine]

@fathom pendant was doing this prat for 2 days and i feel so dumb 😂

i was doing extrenal research but i have no luck with it i fixed the first confucion but i have another confusion after the fist one

[fathom pendant]

That's because you are, but that's beside the point. Just take it step by step from the lesson

[wicked sierra]

ah my bad sorry!

[vocal gate]

Hi everyone! Can someone who has worked on "Analyzing Evil With Sysmon & Event Logs" module help me? So, on Detection Example 1, I'm having difficulties trying to hijack Windows Calculator using reflective DLL. I placed both files to a writable directory (under Desktop), but I did not get the "hellow from DllMain!" message. Instead, the Calculator started running. Am I supposed to use a tool to gain access to any of the file's config script to execute it?

[rustic sage]

oh, i tried to restart my virtual machine/workstation but it said i can only do once per day .... can someone help me? I wished to continue the exercises still today

[misty current]

Are you talking about the PwnBox?

[rustic sage]

i am talking about the workstateion

anyways, i think i screwed up, Just in the tutorial, goddamn ~~

[misty current]

Hmm, can you fill in on which tutorial/exercise you're working on?

[rustic sage]

it was at the very first one, perhaps "Introduction to the academy" / "Interactive Section with Target" are the names you are searching for?

i turned off my workspace and then tried to turn it on to get it slate-clean

[rustic sage]

the pwnbox

[misty current]

Ah, "My WorkStation" is also referred to the PwnBox. You would need to have a subscription to have unlimited spawns.

Do you have an active subscription? or just doing it from saved cubes

[rustic sage]

Neither, created my account just now

[misty current]

"Free users are allowed one Pwnbox spawn per day. Each Pwnbox spawn allows for two hours of usage. Get unlimited Pwnbox access by either subscribing for any plan or buying any amount of cubes in Academy's billing page, https://academy.hackthebox.com/billing"

[rustic sage]

is the day reseted in some arbitrary world thing or is it more of an "after 24h of what you did has passed"

[misty current]

Safe to assume 24 hours after you've used PwnBox for 2H

[rustic sage]

tyvm for being so helpful, I think that's it for today.

[river trail]

hello... do people here discuss about internet routes or something similar? Like if your computer is being routed somewhere it shouldn't be?
i read the welcome but i didn't get exactly where i should post this

[misty current]

https://discord.com/channels/473760315293696010/1024429874246590575 This might be a good place to post about it.

[sly grotto]

hey
i can not buy Platinum plan in htb academy
how can i contact support?

[fathom pendant]

via green bubble in academy

[sly grotto]

no answer after 12hour :((

[umbral fulcrum]

hey, yes @dusky rivet helped me with that (thnx)

now I'm on trying to get to the DC01 ...

[weary torrent]

you got this brother

[rustic sage]

I'm still trying to find a common password for the first question from 3 days, can you give me some hints? I have to try normal pass or some wordlist from seclists?

[umbral fulcrum]

🤯

[green aurora]

can anyone help me with password cracking with hashcat im stuck in this question Crack the following hash: 7106812752615cdfe427e01b98cd4083

[umbral fulcrum]

what module?

[green aurora]

password cracking with hashcat

[green aurora]

CRACKING PASSWORDS WITH HASHCAT

[umbral fulcrum]

sorry haven't gone there yet ...

[green aurora]

okay

[green aurora]

which module

[rustic sage]

Using Crackmapexec Skill Assessment

[next bronze]

try rockyou with a rule

[green aurora]

Sorry no idea about this module

@next bronze i have tried it

But not getting any results

[next bronze]

use a different rule then

[next bronze]

try an attack instead of password spraying

[rustic sage]

which section?

[wraith hare]

Hello. I’m trying to use a VM for Ethical Hacking Course using Parallels. I have a Macbook air M1 ajd juat want to use a secure VM. Does this require to select “isolate system”? Saying this because its easy to paste and copy throught VMs, but worried about the security

[vital adder]

not the right place for this, read #welcome and #rules after that use /verify at #bot-commands and take this to #1024429874246590575

[pastel lava]

im a bit confused on the priv esc linux module the section is special permissions "Find a file with the setuid bit set that was not shown in the section command output (full path to the binary). " ive ran the command tried all of the ones with different bits but i cant get the right answer any clues?

[next bronze]

search for files with setuid set, it's in the results

[austere aspen]

has anyone finished the "ATTACKING COMMON SERVICES: Attacking DNS" part? I really have no idea what I am doing wrong here...

[supple ingot]

so not really related to an academy module but when watching some tryhackme koth videos i noticed they are able to ssh into a box without a password using a private rsa key they found somewhere on the box. did i understand right or did i miss something? is it possible to ssh into a box without a password using a private ssh key?

[sly kelp]

Yes if you have the key file you can pass that with ssh and it will give you access

[supple ingot]

thats neat. thanks!

[sly kelp]

shh -i file name@ip

i think it is the command for that if i am not wrong

[supple ingot]

yeah its
ssh -i key_file user@ip

[sly kelp]

That is used for mostly for Priv escalation scenarios

[acoustic owl]

Without knowing what you have tried, we cannot tell you what might be wrong

[sly kelp]

New pathway dropping when ?

[acoustic owl]

#modules message

[austere aspen]

Sure. 🙂
I edited the /etc/hosts and added the target IP given by HTB and the Domain of the module.
Then I discovered two subdomains. But zone transfer does not work. I might have done sth wrong so far, but can not find what...

[autumn crest]

Hi, I'm asking for help please... I entered SSH with Tom but then I'm blocked... Give me a tip please 😊

[acoustic owl]

You do not actually need to edit /etc/hosts. The target server is the NameServer

[austere aspen]

So it should work withdig axfr <DOMAIN> @<nameserver> right?

[acoustic owl]

Only if the nameserver (@NameServerIP) allows a zonetransfer

otherwise you have to force him to give you the information you want

[rustic sage]

Any black friday deals for academy htb?

[acoustic owl]

No, only for Swag

https://hackthebox.store/collections/black-friday-2023

[grizzled schooner]

footprinting module - SNMP trying to obtain the custom script and I'm a little lost when I ran ||snmpwalk|| I didn't see a script, but I also don't really know what it is I'm looking for ||braa|| doesn't work either... just says the syntax is invalid

any hints or nudges would be appreciated

[rapid kiln]

Hi @here can some please dm me kira ssh password.
I am on Password Attacks -> Protected Files and did not save the creds which were previously used. For this lab I require the creds for kira 😦

No worries figure out

[grizzled schooner]

Thanks, wouldn't have thought to do that

[sly dome]

you do not have to, but the output can be bit overwhelming

anyways if you look thoroughly at it, you will see the script running

[green shuttle]

module :modern web exploitation techniques LAB:xss via websocket i have tried multiple payloads various types but it did't work any one can help ?

[unique palm]

Hey!
in the module "Shells&Payloads" it asks me for the PowerShell version. However when i Print the PowerShell Version i get the version 7.2.1. The answer is incorrect. What am i doing wrong?

Question:
In Pwnbox issue the $PSversiontable variable using PowerShell. Submit the edition of PowerShell that is running as the answer.

[acoustic owl]

Read the question carefully!

[unique palm]

Oh wow.. I guess its time for some sleep 😄

[mint gale]

Module: SECURITY MONITORING & SIEM FUNDAMENTALS
Section: Introduction To The Elastic Stack

You are asked to open Discover in Elastic and make some parameterizations to find results, but it keeps loading forever and does not load anything, not even with other parameterizations. Has anyone done this module and know what could be happening?

[verbal dagger]

hello, having a hard time at the skills assessment - website in the login brute forcing section. i got the first flag, and i got what i need from burp for the admin login, but haven't had enough time on the target to test different word lists and password lists together. wanted to try rockyou, and a few others, but i would need it to run over night. anything i can try?

[next bronze]

this shouldn't take too long and rockyou is unnecessary, make sure your requests are sent correctly, in hydra or whatever

[verbal dagger]

so default credentials are the way to go? thank you, i'll give them a try.

[next bronze]

I don't remember what's the password but you don't need a crazy wordlist

[verbal dagger]

that helps. going to try some more of the shorter ones.

[fresh compass]

Hi! In the windows privilege escalation skills assessment - part 1 I can’t get Juicypotato to work. Any help?

I tried PrintNightmare but was the same, it didn’t work

[frozen schooner]

hi all. i am stuck on windows event logs module, could use some help

[frozen schooner]

regarding this question:

Analyze the event with ID 4624, that took place on 8/3/2022 at 10:23:25. Conduct a similar investigation as outlined in this section and provide the name of the executable responsible for the modification of the auditing settings as your answer. Answer format: T_W_____.exe

I have browsed the events log and found an entry regarding the date, however, i cannot find the answer. I have re-read the module several times and I just cannot understand where to find this executable.

edit: I used windows event code 4907 and a similar time range to find the EXE. i think there is missing info as it was not clear at all what i am looking for. key is to look at the event codes, specifically the one in the example

[foggy jackal]

i need a nudge on the documentation and reporting module practice question. anyone around to help

[next bronze]

if you think juicy potato should work, try a different clsid

[austere aspen]

How can I force him?

[fathom pendant]

There's a tool referenced in the module, start there

[fresh compass]

It worked man, thank you so much

[analog stump]

guys please how can i get the keys for the ctfs in ctf.htb platform ??

[grand marsh]

regarding the OS fundamentals course Mac OS module, so if I don't have a mac, I won't be able to complete the interactive tasks and "return" the cubes for the course, correct?

[next bronze]

I've done that module and have never owned a mac

[woven copper]

So theres is no material to download that needs to run on Mac or what did you do ?

[next bronze]

look at the questions, you can find the answers on google or it's the same as a linux system

[woven copper]

Sounds like better don't take that module , thanks

[stiff bone]

please help me with a hint on what I need to focus on in ABUSING HTTP MISCONFIGURATIONS Skills Assessment - Hard. I looked at all the parameters, I understand which parameter is the key one, but I don’t understand what I need to do with the authorization form. The password reset and new user registration buttons do not work. I tried to sort through the host header, did a transfer, but I can’t catch anything.

[woven copper]

Hey @delete_me , How's it going? I'm also stuck on the Hard Assessment, but I'm a few steps ahead. Look at the response headers; there's some version leakage that points to the initial vector

[stiff bone]

wrote in DM

[strong bear]

Hi, Use the cracked password of the user Kira, log in to the host, and read the Notes.zip file containing the flag. Then, submit the flag as the answer.

I need a hint please, I use mutate passwordlist, iT's OK?

john --wordlist=mut_password.list notes.hash
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2023-11-24 23:49) 0g/s 2200p/s 2200c/s 2200C/s L0veme..L0veme99!
Session completed

Is it the same mutation like kira's password?

[hazy grotto]

What section and module? I belive PW attacks

[wet kite]

I just did the NMAP Medium section, when i ran my nmap commando from my local kali it didn't show the correct value, but from the pwnbox it did. anybody an idea why?

[hazy grotto]

I've had similiar issues with my own Kali and pwnbox. Some modules i know i have the right command and i don't get the right result. Then i switch over to pwn and it works/ *shrugs

[wet kite]

yeah only had the idea because i was looking through old discord messages for a hint 😄

would be really interesting why this is happening

[hazy grotto]

HTB's way to promote it's users to switch over. lol

[wet kite]

xD

maybe worth trying a local parrot, just to compare the results 😄

[wet kite]

#welcome message

[cedar void]

Hi for the easy lab of the Attacking Common services , would the command in the following screenshot be helpful in executing a webshell?

https://academy.hackthebox.com/module/116/section/1466

[supple ingot]

...oh goddamn it lmao. thanks for that!

[wet kite]

after that you should have access to more channels

[supple ingot]

yea, i see them now. thanks for that!

i'll repost it there

[next bronze]

you already have a scuffed webshell, it will take whatever is in the cmd parameter and execute it, for example, http://whatever/backdoor.php?cmd=whoami

[cedar void]

So is the backdoor.php on the remote machine? Whenever I tried to enter 'http://IP_ADDRESS/backdoor.php' it says

[next bronze]

have you created it?

[foggy sail]

Hi, Are you still stuck?

[hallow remnant]

Hey @acoustic owl , did you encounter a resolution to this issue? I'm encountering a similar discrepancy and am unsure if it's because the machine is down:

[cedar void]

Oh I haven't yet. Would I just open up a text editor, copy and paste the code for a backdoor.php and save it as 'backdoor.php'?

[next bronze]

the backdoor is crafted using an sql injection

[rustic sage]

sup guys

I am new to this server

and looking for new friends at the htb community!

[cedar void]

Hi , how long have you been learning hacking?

[cedar void]

Not sure sure where to start. Can I DM'ed you what I have attempted

[rustic sage]

I am new to the community

and right now

I started a week ago

pretty new to htb

[cedar void]

What got you interested in htb?

[rustic sage]

my friend got me into it

he showed me it and I started learning new stuff

[cedar void]

What have you learned so far?

[rustic sage]

his name is @rustic sage

[rustic sage]

I am mostly in htb labs but overall

I know nmap

learning sql map

[cedar void]

nmap is a great tool . Great for footprinting

[rustic sage]

gobuster

and in htb labs

I am in starting point

it teaching me how to hack basic stuff

[cedar void]

Gobuster is a good tool for finding directories of a website for sure

[rustic sage]

Hello Wanda

[cedar void]

Hi 'lock.sec'

[rustic sage]

hey

[cedar void]

How is your friday night

[rustic sage]

Feels great, high school is crazy

think god we have a break

[cedar void]

You are in high school and getting in to hacking? Thats cool. I wished I would have done that when I was in high school.

Did anyone get you into hacking in high school or did you learn on your own

[cedar void]

Pentesting path will really challenging your hacking knowledge and increase it too

[rustic sage]

I am 16 right now, my old friend got me out skid community aka "Toxic Place" and i am sharing the tips and tricks for other skids help them escape.

but sadly he got banned

My stroy being a skid.

I was going after dos and ip pulling kids on xbox, i was like dang this is awesome. and i got harassment from real hackers, this one real hacker killed my own network, thanks to karma, and I started talking too hackers help me out escape skid community.

that's how i got inside HTB

[rustic sage]

and I asked my good friend name KeyMermaid join this server, get friends and learn, cuz i know somebody inside HTB community more better then me

[rustic sage]

yea

[cedar void]

What SKID community you are talking about? The one who catches pedophiles ...from my general understanding

[rustic sage]

no, script kittys, copy + v code, saying they made it but they did not

[next bronze]

you guys should get verified with the steps at #welcome , and take this conversation to #general , this channel is for discussing modules in academy

[rustic sage]

@rustic sage call in gc

[cedar void]

Oh yes . They copy and paste code and they often don't understand the code they are using

[cedar void]

Can I dm'ed you about my issue. I am on the pentester path and I haven't gotten to the SQL injection module yet and as a result don't know how to execute those attacks

[rustic sage]

I have a question. The question is are you a skid if you copy and paste code but understanding and learning from it?

[cedar void]

I think so. Some hackers told me you can be a skilled hacker and copy code that you didn't make but you still understand how it works and how to execute it

[thorn urchin]

There really isnt a binary do X and youre a skid do Y and youre not

Skid mentality is easy to spot though

[next bronze]

well the screenshot you gave is sql injection, but if you're doing attacking common services easy, then you don't need that, use what you have learnt in the module to enumerate the services and get the flag

[next bronze]

wtf is skid

[cedar void]

he means script kiddie

[rustic sage]

skid easy way saying it

[thorn urchin]

Skid == script kiddie

this is old slang

[next bronze]

is script kiddie too long to type out

[rustic sage]

kiddie?

i call them noobs

[thorn urchin]

noobs doesnt quite hit the particular flavor that skid hits

[rustic sage]

what word that hits?

[rustic sage]

ofc

[next bronze]

dm me if you need to