modules

[ebon jasper]

In module it is lab.local I will try inlanefreight but now my notebook battery run out. I will try to figure it out later

[tidal kelp]

@modern epoch sorry for the ping. Do you mind if I DM you? I'm doing the NLTM relay Skill Assessment, when pwned BACKUP01, tried to abuse file sharing ...

[cunning frigate]

I did try to reset, terminate start again, im user bob, i did do it 4 times now and none work error is KDC_ERRR_PADATA_TYPE_NOSUPP

[modern epoch]

Sure, no worries. Please DM and we can see

[hasty solar]

Dm me but these days I'm quite busy with family and friends, I ve got to redo the lab because didn't take notes but no problem

[tall laurel]

will pentester path modules prepare me to tackle easy htb boxes?

[fathom pendant]

mostly: thing to note the boxes generally don't require AD

but other basic knowledge may help

[fathom pendant]

the pentester path is more to get you on the path to well a Pentesting Job (or at least the mindset for it) you mostly need to be able to adapt to a given situation. Most boxes themselves have a gimmick or two to exploit.

[tidal kelp]

@next bronze feel free to DM me. i have done NTLM relay module.

[acoustic owl]

Take another look at the sections in the module. You have to combine several things to get to the flag.

[safe dock]

Guys why video and audio is not playing in my vm linuk

[slender shoal]

If you need assistance with a module you can ask here. If it is unrelated to an academy module, please ask the proper channels. As well, read #rules and #welcome.

[safe dock]

/rank

[tiny ledge]

Can anyone nudge me forward on footprinting lab - Hard. I found out theres a pop3s I can connect to, but can't figure out how to login, is it any of the credentials found in earlier labs (easy/medium) or am I completely out of track ?

[silver iris]

Hey guys,

i´m currently doing "Password Attacks -Medium Lab" i found the zipfile in the smb share, used zip2john, but when i want to crack it with either rockyou or the provdid worlists, john just ends the session after 1 second with "session completed". Anyone knows why?

[lusty thicket]

you’re completely out of track

enumerate more😉

[turbid jewel]

same here

i'll try to enumerate more

[cedar void]

Not sure if I saved the keroberos hash correctly:

||hashcat -m 13100 --hash-type=19700 rc4_to_crack /usr/share/wordlists/rockyou.txt||

I tried removing potential whitespace but that didn't fix my issue and it seems like from what I read that wouldn't be an issue anyway.
https://academy.hackthebox.com/module/143/section/1423

[next bronze]

that's not how you use hashcat, =m and --hash-type are the same thing, only use one, and idk what hash you have but that's not a kerberoast hash

[cedar void]

Its not a kerberoash ? I thought the string 'krb5tgs$23$' would be associated with a kerberoast hash based on what I researched.

[next bronze]

you cut off the first part, include the full hash

and the whole hash needs to be a single line,

[misty current]

To save your time, add one more piped command | Export-Csv .\hashes.csv -NoTypeInformation after your command, so that you don't have to deal with manually removing newlines.

[turbid jewel]

@lusty thicket can u give another tip? Where i'm supposed to enumerate more?

i can't find any new information

[lusty thicket]

scan both tcp & udp

[turbid jewel]

no way

i forgot that

[vestal merlin]

Hi guys. I'm on footprinting module skill assessment, medium lab. I got creds via nfs, then i log in via rdp, i got sa:xxxxxxx cred, but i can't log into sql with sa:xxxxxxx creds, is there anything i'm missing? I tried reusing ps, flipping usernames, none work. i've completed hard lab, done the medium lab two week ago, just gave up and come back, still i faced the same problem. please help 🙏

[turbid jewel]

try running the sql as admin

[acoustic owl]

Your Windows user has no rights to access the database. But sometimes users are lazy and use the same password for several accounts. Maybe there is a Windows user who is similar to sa.

[sinful tide]

Hi in the vulnerability assessment module they use cvss 3.1 and even nesus uses 3.0
Yet 4.0 was out this November so I wanted to know if we are still using 3.X or we should start using 4.0 now

[silver iris]

Nobody any idea?

[latent glen]

I am on Active Directory SKills assessment part 1 and I cannot seem to find a way to log into the domain. Anyone can give me a little hint?

ive got hashes but I cant log in with them

[next bronze]

pth, if you can't then crack them

[acoustic owl]

Simply state in the report which version you have used.

[latent glen]

eyo okay I must be doing something wrong. Ive been trying every pth technique

lemme go back

[sinful tide]

So like there is no specific version that should be used ? Like we are free to use the one we like ?

[acoustic owl]

Always declare the version. This way, your customer can understand the calculation method

[sinful tide]

Ok ok I see thanks

[eager badger]

Hi guys, anyone can help me in Skills Assessment - File Inclusion ? I know I tried to exploit it as well but still doesnt work 😦

[latent glen]

I feel like Ive tried every pth technique, none work

and I cannt crack the hash

lemme try invoke the hash

[next bronze]

it's just a general suggestion, I don't know what you have, it might not even be right way

is it a ntlm hash?

[latent glen]

yessir

[lusty thicket]

yes

[next bronze]

do you know the user that the hash belows to

[tiny ledge]

Any nudge forward for footprinting hard, not getting the community string (tbh dont really understand the concept of it to begin with), been trying with braa, snmpwalk etc. only getting the generic reply, which does not seem to help me anyway, any help appreciated: onesixtyone -c /opt/useful/SecLists/Discovery/SNMP/snmp.txt 10.129.12.128
Scanning 1 hosts, 3220 communities
10.129.12.128 [backup] Linux NIXHARD 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64

All the hints are pointing towards this, but what do I do with it ?

I tried all the other wordlists, but this is the only reply I'm getting, and it does not tell me anything

[latent glen]

WEB-WIN01$

I can enumerate pass-pol I can enumerate shares

but pth wont work

but wait gimme a sec

Ill get back to you in a minute

[next bronze]

you generally cannot login locally with a machine account, if that's what you're trying to do. try other ways you can abuse it

[latent glen]

oh my days

I completely ignored something

I am an idiot

I assumed something.

and I was badly wrong. Its okay, I am on the right path again

[quartz verge]

@ohyeah229

[lusty thicket]

the snmp section covered that

[latent glen]

though one thing is weird. I kerberoasted one service, cracked the hash, submitted the password to the question and it was correct. However when I type the user name to the previous question it says incorrect

its literally written in the cracked hash, wont accept the answer tho

yea it isnt correct but now Im confused again
but ill survive

[lusty thicket]

i think you’re in the right section

go through the section again and connect the dots .

[next bronze]

what question

[latent glen]

nah its okay. I selected the wrong service but the password happened to be the same for both

which is why I saw the wrong samaccountname

I just keep stumbling

[vestal merlin]

thanks alot. I got into the sql server. found accounts table, query it and done got the flag. One thing i don't understand, why did opening as administrator got me into sql server but not filling in the creds like normal ?

[manic onyx]

I'm doing the easy lab for Common Service Attacks and found a username from SMTP enum. I tried to brute force all other services and got nothing, and now I am trying to brute the basic HTTP auth on https://machineip:443. I am having some trouble with hydra to do this, as it is giving me a "SSL routnes:ssl3_get_record:wrong version number" error when I use this cmd: hydra -l [user] -P pws.list -f [IP] http-get / -I -v

Or sorry I meant this command: hydra -l [user] -P pws.list -f [IP] https-get / -I -v

Does anyone know how to address this error? I always seem to have dififculty dealing with this weird http basic auth pages with hydra, and now HTTPS isn't helping that

[hallow remnant]

https://github.com/Charlie-belmer/nosqli/releases

[floral drum]

ssup guys

i am back

[lusty thicket]

the module didn’t mention 1 thing about that

[left grove]

Hey guys, I'm having trouble on the Procedures portion of Intro to Assembly, I feel like it should be super easy but I've been stuck on it for days now. I copied the code into Vim and saved it, ran it with ./assembler.sh -g, and then I assumed that the next step would to be to set the break point to Exit+0 (*0x401046) since it just loops otherwise but no matter where I look in the stack I'm not finding this 6 digit 0x with no 0s. Any pointers in the right direction would be much appreciated

[manic onyx]

Ok I got it, I was doing too much and just didn't do the most obvious thing

[lusty thicket]

😉

[next bronze]

you almost have it, which register points to the top of the stack?

also n in gdb to skip over the loops, then si to step over each instructions, but your break point should be right so there's no need for that

[worldly leaf]

help me find an official moderator or administrator, anyone here?

[fathom pendant]

I'm an unoffical mod

[worldly leaf]

it will work

[fathom pendant]

consider actually being specific with your requests for help

[worldly leaf]

help me verify my identity in #bot-commands

[fathom pendant]

oh just DM a mod/admin then (I'm not actually a mod/admin) you can see who is a mod/admin on the righthand side

it literally is right there in the message "please contact a mod or admin"

[worldly leaf]

Thanks, the right hand has many!!

i never knew it was on my right hand 🙂

[fathom pendant]

:D

[acoustic owl]

If you still need help, you can send me a DM

[fathom pendant]

https://tenor.com/view/the-office-dwight-schrute-gif-14865294

me whenever I see payload's name in the forums when searching for a nudge

[worldly leaf]

i desperately need help

[fathom pendant]

send payload a DM so he can help resolve the issue :D

he is mod :)

we need the undertaker meme with Payload LMAO

[ocean minnow]

hello, i need help. from Linux Fundamentals module, section: Filter Contents. (https://academy.hackthebox.com/module/18/section/80) what is this question means?

[fathom pendant]

basically all unique links in that domain :) you're gonna have to filter for it considering cURL pulls the page source

[ocean minnow]

is that include the javascript src ? it must be in the domain www.inlanefreight.com right?

[fathom pendant]

any calls to a different src won't be included

curl does the same thing that "view-source" does (essentially)

[dull thistle]

For windows attack (CDSA), on credential for object properties Q3, cannot generate the bonni 4771 ID on security logs. How can this be triggered even after following the example?

[buoyant escarp]

Footprinting - Hard

need a nudge, i tried all 4 wordlists inside SecLists/SNMP/ for SNMP to enum community string, without success, which file should i use?

[lusty thicket]

the same wordlist used in the section

[buoyant escarp]

oh god damn, ive overseen the result, didnt notice it has found it alrdy xD

[ocean minnow]

i've tried every possible answer but it is incorrect. i even download the page source (https://www.inlanefreight.com) and inspect it manually, extracting everything with the domain www.inlanefreight.com and sort uniq it exclude other domains, emails etcetra.. still incorrect answer. i've submit many answers but still incorrect. does it have submission limit or something?

[fathom pendant]

No submission limit

[lusty thicket]

[fathom pendant]

From google:

The route or also known as “path,” is the part of the URL that comes straight after your domain (i.e., yourdomain.com/PATH) Destination Type: what kind of document do you want to share. Destination Document: the hyperlink of the original document URL.

[modest remnant]

I'm not really sure what's happening. I'm wrapping up "basic tools" module and trying the optional exercise. I spawn the target and the in-browser Pwnbox. I tried nc'ing to the target host and port, ssh'ing to it, using a browser, but I'm not getting any kind of banner or anything other than TIMEOUTs. I'm on the third target reset. Any thoughts?

[fathom pendant]

Are you running the vpn on your system at all?

[modest remnant]

No, I thought with the in-browser pwnbox that wasn't needed? I can ping the IP.

[fathom pendant]

I'm just trying to narrow things down

If you run the vpn on your system AND pwnbox it causes issues

[modest remnant]

ah, yeah, definitely not doing that. :)

[fathom pendant]

What is the question explicitly asking

[modest remnant]

"Apply what you learned in this section to grab the banner of the above server and submit it as the answer."

[fathom pendant]

Then do what was explained

[modest remnant]

I've tried:
nc <ip> <port>
ssh <ip> -p <port>
browser

[fathom pendant]

Note: using netcat will take a moment for it to give you a banner

Usually up to a minute

[modest remnant]

it timesout

times-out? however you write that. haha

[fathom pendant]

Timeouts

[lusty thicket]

reset the machine and try again

[fathom pendant]

They've done that a few times already

[lusty thicket]

strange

[modest remnant]

maybe the lag is just too much. >200ms for most

[fathom pendant]

Try nmap ip --script banner -p port

¯_(ツ)_/¯

[fathom pendant]

What's the module name?

[ocean minnow]

please help advise me.

curl -s https://www.inlanefreight.com | grep -oE 'href=["'\'']https://www.inlanefreight.com[^"'\''"]+' | sed -E 's/href=["'\'']https:\/\/www.inlanefreight.com([^"'\''"]+)["'\'']/\1/' | sed -E 's/href=["'\'']//' | sort -u | wc -l

[buoyant escarp]

Finally

[modest remnant]

Basic Tools haha

[fathom pendant]

Is that the actual name of the module?

[modest remnant]

Once I added -Pn it came back as filtered/unknown. Without it - "host seems down"

Getting Started -> Pentesting Basics -> Basic Tools

[fathom pendant]

Oh yeah forgot about this module

Section?

Ssh is the answer

[modest remnant]

I think I'm going to chalk it up to lag and try later. I hit my pwnbox spawn limit. :-\

[fathom pendant]

If you can: set up your own vm

[modest remnant]

Have that - was looking for the openvpn file but don't see it.

oh, found it...

[fathom pendant]

It's a public ip for this exercise, so vpn not needed

netcat ip port should work

[modest remnant]

damn. from the VM it came back immediately. Thanks - lesson learned.

[quaint viper]

Suggest me the course for cyber security

I am fresher in this field. So suggest like that only.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[golden kraken]

can someone help me with this
To get the flag, start the above exercise, then use cURL to download the file returned by '/download.php' in the server shown above.
the file im getting doesnt have a flag

[fathom pendant]

Information Security Fundamentals in academy

[fathom pendant]

Well you likely have to do stuff to make it readable

[ocean minnow]

help.. I even use hakrawler to extract path from the url. count every unique endpoints url. but submited answer is incorrect. actually this question is easy but i don't understand what it actually wants. i've submitted many numbers but incorrect.

[fathom pendant]

The answer is less than 50

[ocean minnow]

is what i'm doing that correct or i missed something?

[fathom pendant]

I believe so

I dont recall all of what I did

But 24 is too low

So there's something being lost in your filtering

[steep loom]

can anyone DM me for some help with the skills asessment on the Injection attacks module? thank you!

[ocean minnow]

do you mind pointing to me what am im missed?

[fathom pendant]

No

[fathom pendant]

As I said, I forgot what I did to get the answer

[solemn rose]

@ocean minnow i think there is something with the server at the moment, at my machine didn't downloaded anything for like 5 min , at my VM i curled google and redirected it for 5 secs ...... i found the answer but i am not sure do you want the answer or want to discover it yourself ....

[shut wraith]

WEB ATTACKS

Advanced File Disclosure

Question:
Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

1. I used the CDATA method and it is working BLIND. Thus I can't read the flag file.
2. Itried to use the error method but there are no errors showing in the response code.

Any help would be greatly appreciated.

[round sable]

Thanks
@hallow remnant I'm testing the tool with the skill assessment, just for the sake of testing it. Although it found the injection type, it seems that the payloads it found are not working, it didn't find the working payload I found manually. So my question is is the tool really working as expected, did you indeed use one of the payloads it found, or did you just get the injection type from it but found your own payload manually ?

[fathom pendant]

Don't cheat or "hack" your way to the answer in the future

Also if you did it in an automated way that's very likely against the ToS

[ocean minnow]

yep apologies

[fathom pendant]

They can see deleted messages btw

[shut wraith]

Any hints for this @fathom pendant

[fathom pendant]

Haven't done that

Switch to tcp vpn download my guy

[winter grail]

Hi guys ! I have a question concerning the module "Getting Started", in "Privilege Escalation", "SSH Keys".

Unless I am misunderstanding something, i do not think that what is written here is accurate.
If we are able to get read access to the .ssh folder of a user or root and have read access to the ssh keys, we can use it to potentially connect to other servers if they have the id_rsa.pub in their authorized_keys.

But it should be very unlikely to be able to connect to the server itself using this key unless the admin generated the key on the server itself and didn't bother removing it.

Am I missing something ?

[shut wraith]

You're missing the one most important ingredient to pumpkin soup

[next bronze]

to be able to use ssh keys, it must be stored somewhere

[fathom pendant]

this is accurate info: the id_rsa key is generally stored in the hidden .ssh folder, and the public key as well - (which is added to authorized keys) - they are used to match each other. If the matching keys fit for other devices it doesn't matter who generated the keys

it's like having one key for multiple locks

in some instances a user's rsa key ends up being the root key as well

[winter grail]

that's pure madness honestly 😄

[fathom pendant]

it happens more often than you think

convenience over security

though you can generate keys with a password ¯_(ツ)_/¯

literally requiring a password to use them

(this is touched on in the password attacks module)

[winter grail]

But it still seems crazy to me that a server admin would generate the ssh leys on the server and then add it to the authorized_keys instead of doing it locally and then using ssh-copy

[fathom pendant]

that isn't the point

when i say added i'm not generally meaning manually

it's via whatever method works

[winter grail]

that's what I have difficulty to understand..
I do not have a lot of experience in pentest and this is the first time that I had to use the id_rsa of the root user in order to connect to it on the same machine

[fathom pendant]

because the root user is a defaualt usertype on linux distros, like Administrator on Windows Machines. When you run sudo x then you run the command as root. In a properly set up environment: regular users are limited on what they can sudo

root is what's known as super user

and at this point in learning you have no access to shadow files or a user that has a sudo bin they can escape from

so you take advantage of whatever user2 has access to

from the perspective of an outsider: you don't know root's password

so you can't just su to root

[winter grail]

I mean, you are absolutely right,

my mind was just focused on the fact that the private key is meant to be kept confidential and should only reside on the client machine from which you connect to the server.

And to be fair, this exercise was a learning experience because I wouldn't even have crossed my mind to try this key to login to the root with it.
I would, however have tried it against other servers on the network if there was any.

I spent way too much time on this one 😅

[fathom pendant]

it makes sense still to keep the key on the target itself

because to a non-technical user they wouldn't think about .ssh

as it's a hidden file so a normal ls -l won't find it

¯_(ツ)_/¯

[covert cradle]

I've used keys I compromised on real red team engagements to further compromise the machine I found the key on. Tons of people don't understand how to properly do ssh proxy jumps, don't understand the importance of read-only deploy keys for applications, don't understand the dangers of agent forwarding, etc. So they do dumb things like copy their ssh private keys onto remote servers.

[pure sorrel]

I'm trying to do the Active Directory Skills Assessment 1, and for question 3, I can not seem to get the hash of the ***_sql user. I am 99% certain that I need to use power view, but I can't find it on the system, nor can I figure out a way to upload it. I've already established a reverse shell with nc on my attack machine and made an http server on my attack box to use to transfer the files over the shell. But no luck

[next bronze]

you can upload with the webshell given, or using smbserver, or through a web server

[wanton jasper]

Im not there yet but if you cant get access to the tools you may have to "live off the land" with buitin tools

[frozen glade]

Did you manage to figure it out? I am also wondering...

[pure sorrel]

I've tried, but have found nothing 😦
will keep trying. I'm probably overlooking something easy

[next bronze]

break at start, then use si to step over each instructions

[frozen glade]

yes that part is pretty clear, I also managed to actually read rax with display $rax but nevertheless he doesn't accept the hex? maybe I am missing something

[frozen glade]

ah, got it, I entered the hex in reverse instead of just c/p ... suppose I got a little confused with the little-endian formatting.. tks for your help

[next bronze]

they asked for the hex value in the register, so just give that, and you don't need to do display $rax, it's shown right at the top in gdb

[frozen glade]

jesus, yes you are correct, I can see it now 🙂 thank you

[shut wraith]

Can you help me @next bronze

[next bronze]

?

[shut wraith]

WEB ATTACKS

Advanced File Disclosure

Question:
Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

1. I used the CDATA method and it is working BLIND. Thus I can't read the flag file.
2. Itried to use the error method but there are no errors showing in the response code.

Any help would be greatly appreciated.

[next bronze]

both works, use similar code as the section, remember to modify the email tag

[shut wraith]

Sir I did all of that. And the curl to get the xxe.dtd works but it doesn't display the response

[next bronze]

why are you curling your own dtd

[shut wraith]

That's how they did it in the module. What alternative do you suggest?

[next bronze]

in the module they told you to curl your own dtd? you're supposed to get the target to retrieve the file

I mean, I can see excatly what you're supposed to do in one of the screenshots in the section

do you get a request on your webserver?

[shut wraith]

Yes I do

[next bronze]

make sure your dtd file is correct for the type of attack you're using

[shut wraith]

This is the dtd file:
<!ENTITY joined "%begin;%file;%end;">

[next bronze]

should work, restart the target

[shut wraith]

I have restarted and tried it 3-4 times

[next bronze]

why are there 3 dots in your request

[shut wraith]

I removed that but nothing changed

[shut wraith]

Another thing. I can't do the error method because the error code doesn't show in the response code no matter what I do like deleting letters or referencing non-existing entities...

This whole thing exercise is rigged

[next bronze]

I can get the answer with the first part of your xml, so make sure the rest of your request is correct

[shut wraith]

But I didn't change the rest of my request. The only thing I changed is the email section to the &joined; entity...

[latent glen]

DONE! That took way too long but I now fully understand everything. Quite happy.

onto the last one
sorry that was not as a reply to this but what I said earlier. The AD skills assessment

[shut wraith]

This exercise is so stupid

[next bronze]

then you're missing something, check everything again

[shut wraith]

I showed you everything and you said you got the answer using an identical request

[next bronze]

I don't have the rest of the request and like I said, I only used the first part

add a tel number

[slender shoal]

If you need to, take a break, relax and come back. The best thing you can do while learning is be relaxed. This field is difficult and will challenge you.

[shut wraith]

Sure but the problem was that I didn't add a phone number to the submission form even though it is not a requirement. This caused me to be stuck for the entire day. Is that a take the break moment or a HTB needs to fix their exercise moment

[next bronze]

if you think what you did should have worked, then the answer lies somewhere else, being able to test and troubleshoot is part of developing a methodology. in the real world, you don't always know what happens when you change something, so it's important to be thorough. for now, take a break

[gloomy kettle]

On the digital forensics course, on the question “Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.” Target: 10.129.228.172
Life Left: 92 minute(s)

The link it says to go to has nothing on it and won’t load or establish a connection

[buoyant escarp]

It would be so cool if academy had videos too, reading so many pages get quite exhausting sometimes

[gloomy kettle]

So true

[next bronze]

did you rdp in

[gloomy kettle]

I’m using Microsoft Remote Desktop to try to rdp and I’m doing that to the target address but also not working. Have a feeling I’m rdp’ing wrong lol(I’m new to this)

[next bronze]

the target address is 10.129.228.172?

[gloomy kettle]

That’s correct

[next bronze]

are you able to rdp in then

[gloomy kettle]

Not with Microsoft Remote Desktop

[next bronze]

can't say I've used that for the modules but it should work, what's the error

you should do it in pwnbox if you don't have a linux vm

[gloomy kettle]

I’ll try that. Spawning one now.

[next bronze]

do you know the command to use rdp on that?

[gloomy kettle]

Pretty sure. Just gonna use remmina

Just ran sudo apt-get install rdesktop

Then ran rdesktop then the target address, said yes to the certificate trust, then got a Failed to Initialize NLA and a Failed to Connect, CredSSP

Just gonna go back to remmina

[next bronze]

xfreerdp /v:10.129.228.172 /u:'Administrator' /p:'password' /size:1400x1000 +clipboard /dynamic-resolution /cert-ignore &

[gloomy kettle]

Trying that now

Jus got something that looked like some kind of help menu

[next bronze]

did it work?

[gloomy kettle]

No

Just got a help menu, a correct usage format, and a few errors

[next bronze]

send it

[gloomy kettle]

Help menu’s like 100 lines, the usage says xfreerdp [file] [options] [/v:<server>[:port]]

And the error says [ERROR] [com.winpr.commandline] - Failed at index 1 [/v:10.129.228.172]: Invalid sigil

[fathom pendant]

try respawning the target and using a new IP, give it like 5 minutes to fully spawn

[gloomy kettle]

Ok. It’s the same target no matter what pretty sure. But respawning now

Nvm. The new target is 10.129.27.37

[shut wraith]

Don't post the target IP publicly cause I'm pretty sure u can get hacked that way

[fathom pendant]

eh; they'd have to be on the same vpn server first off

second off if a user is found to be attacking another: then their account gets banned

[turbid jewel]

[cedar void]

I am having issues with the last question of this module:

"What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word) "

https://academy.hackthebox.com/module/143/section/1485

This is what I have tried so far:

||"Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}"||
||
$gpogroupsid = Convert-NameToSid "GPO Management"||

||"Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $gpogroupsid} -Verbose"||
||
" Get-DomainGroup -Identity "Dagmar Payne" | select memberof"||

[fathom pendant]

You need to wait longer for get-DomainObjectACL

It looks frozen but its still doing the search, it can take up to like 10 minutes iirc

[wanton jasper]

There is a faster way to do it that they dont teach that takes just a few seconds if you go research it

[cedar void]

bloodhound ?

[wanton jasper]

no

just a better way to write the command for this specifc task

still using get-DomainObjectACL

[cedar void]

Oh okay .

[fathom pendant]

Rerun the command for the forendsid

And just wait

I literally watched YouTube while I waited lol

[cedar void]

Not the command with the group variable I created(||Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $gpogroupsid} -Verbose||), but instead just forends id?

[wanton jasper]

||$sid = Convert-NameToSid forend
Get-DomainObjectACL -Identity "GPO Management" -ResolveGUIDs | ? {$_.SecurityIdentifier -eq $sid}||

[fathom pendant]

That works too

[cedar void]

So the first command I used . Okay

[cedar void]

you waited 10 minutes

[fathom pendant]

The reason is because the search is looking for the rights that the sid has over the identity you're looking up

[wanton jasper]

Could take 30

[fathom pendant]

If you look at the results: you get the object, what rights the user has over the object, etc.

@cedar void I'd take a moment before moving on to try and understand the output, it is explained in the section - but it's not quite obvious until you perform some tasks

I.e. using rights to assign an spn to do password cracking

[wanton jasper]

Not going to lie Ill be taking another pass through the ACL stuff, we completly new for me

[fathom pendant]

^ I spent a solid few minutes trying to understand the output and the example from the module before it clicked

Once I did everything else I did made more sense

[wanton jasper]

gonna have to study bloodhound more too. I got really lost with all of the options in there.

[fathom pendant]

I didn't care for needing bloodhound for some tasks, as a note: you'd want to use a docker bloodhound for parrot, as the latest in their repo is 4.0.6 and the bloodhound on the windows targets is 4.1.0

So the collection data gets borked

[wanton jasper]

Like I really want to learn bloodhound in and out. Seems so good. Same for burp

[fathom pendant]

It's good

[wanton jasper]

considering buying the bloodgound module but probably overkill for now

[fathom pendant]

I just prefer to learn LoLbin type stuff

As bloodhound is "noisy"

[wanton jasper]

fair enough. I should spend more time on lol because my end goal is red team

[fathom pendant]

Like bloodhound is good if your challenge is just "see if our EDR even works lmao"

[tall laurel]

how long does nessus scan take usually?

[fathom pendant]

The skill assessments for that module have pre-populated scans

The scans themselves can take easily an hour

[tall laurel]

meaning I don't actually have to laucnh it?

[south glen]

hello can any one help me with the module : attacking common services section : attacking email services i already found the m**** user for the server i am not able to only find the password for it can any one help me with the worldlist to use cause i already have tried with pws.list provided in resoure and also the fastrack.txt worldlist

[fathom pendant]

Nope, just sign into it via the https://target_ip:nessus_port

The module should give you creds

[south glen]

hey @fathom pendant can you help me with this one #modules message

[cobalt stone]

Where can I report outdated info on modules?

[fathom pendant]

Try without the @domain

[fathom pendant]

#858470491676737536

[cobalt stone]

Gracias

[south glen]

i already tried

[fathom pendant]

I forget what exactly I did, I just remember it didn't take long

[south glen]

if you can be more specific that would be great help.

[fathom pendant]

I dont recall so I can't be more specific

[south glen]

was not funny at all

[fathom pendant]

Listen if I don't remember it usually means I didn't fight the struggle bus with it. Or at least didn't fight long with it

[surreal nymph]

Hey hackers , I just pwned popcorn without metasploit 🤗🎇🍿. What a start to the new year 🎊🎇 . Thank you to the community for sharing knowledge🪔🧁

[south glen]

no not even intrested to know .. nothing vauluable to learn so i'll pass

[fathom pendant]

Congrats but this isn't the channel to share progress on starting-point machines

[surreal nymph]

Oh cool, thank you

This is only for academy ,right ?

[fathom pendant]

Read #welcome to find out how to access more of the channel

And yes this channel is regarding academy modules

[surreal nymph]

Awesome! Thank you!

[zenith ginkgo]

Thank you MarcieLee.

[ebon jasper]

Hello mate : ) That problem is magically gone with 2023 😂 I did nothing with my tool nor pc but problem is gone very interesting and I am happy😅

[sharp nexus]

I think I'm a little confused. I'm working on the Pentester job path and they have us attacking boxes and all that, but does a client always provide the machines IP, or is there scenarios like a Blackbox scenario where we aren't given any IP to work with, and we have to rely on osint?

If so, then how would one even go about trying to find IP addresses for the machines?

[fathom pendant]

There's still a scope to work with

And that's also something that's discussed in the meetings leading up to the pentest

What sort of external recon is allowed and such

[sharp nexus]

Well I mean in the real world a hacker's not just going to know the machine IP, how do they do it if we don't practice the same techniques?

Would that not be a crucial step in the attacking process if you were treating it as a real attack?

I guess what I'm trying to ask is why we aren't required to go through that step if hackers are.

Is it just like super easy to get the machine IP, and it's not worth the effort?

This might be a dumb question because I guess you could just get the companies website IP, but in scenarios where that doesnt lead you anywhere, what would a hacker do to figure out that info?

[quick cloud]

which module is this about?

[sharp nexus]

The Pentesting jobpath

[quick cloud]

Theres modules that teach about OSINT

[sharp nexus]

So then it'd just be an OSINT thing?

weird

If I was trying to protect a system, I would think that the mach8ne IP would be like holy information not to share with anyone outside the company.

[wary mural]

I need a little help

Can anybody recommend me a fast and good VNC for android, using which I can get access to a device sharing local network with me?
[educational purposes only]

[quick cloud]

This is modules chat

btw

[wary mural]

What chat then

Do i have to go to

[quick cloud]

Probably somewhere in HTB: Serious Discussions

[wary mural]

Can u recommend a VNC then?

[zinc spruce]

Hello has anyone completed Protein Cookies 2 challenge??

[tranquil axle]

Behind every website you visit is a machine ip that you could pentest and there is no hiding those

[sharp nexus]

Fair enough

[tranquil axle]

And if you get paid to pentest then you are provided with what a company wants pentested. This may be one or more websites but it can also be that they give you access to their internal network directly as a low privilege account to see how far you can get once you are in

[nocturne summit]

hyy guys

[quick crane]

if you need help for this,you can dm me

[plain coral]

Nice little tip I found, if you are restricted and can't get PowerView running on your box and you need to lookup a domain SID to perform a /ptt attack. You can use sid::lookup /domain:INLANEFREIGHT.LOCAL within mimikatz to get the domain SID.

[sharp nexus]

It's kind of wild how easy it is to accidentally break the law with hacking, whether it be malicious or not.

[acoustic owl]

Read and follow #welcome to see more channels

[acoustic owl]

Better ask in #challenges

[sharp nexus]

Figured it out, you can just use whatweb to get the server IP address a website is running on.

[fathom pendant]

Reminder: this channel is for assistance with academy modules.

[sharp nexus]

IS there like a general chat channel?

[fathom pendant]

Read #welcome and follow instructions to find out

[lusty thicket]

[stray locust]

hey new here learning ethical haking unethical hacking is a plus too

[acoustic owl]

Read #welcome and #rules

[latent glen]

@next bronze Wow, it really seems to have clicked. Skills assessment 2 has been really fun. Been going through it, very methodically. SLowly but surely. Its amazing how these skills assessments drive home techniques we've learned (thats the point I know).

[latent glen]

lol, Im guessing that doesn't have to be done for a module. So you best not ask that in this forum. The admins will tell you the same thing

well, the reason won't be valid. They won't I can guarantee it

want me to show you 5 instances wheere they told people that asked unrelated stuff to dont ask it here

its against the rules

[pure sorrel]

Does anyone have advice or hints? This question seems to not be in any of the forums which makes me think it's an easy question, which is doubly frustrating

[lusty thicket]

there are tools like rubeus used for that in the module

[pure sorrel]

I can't figure out how to get them on the machine though, and they're not there already

[lusty thicket]

the file transfers module showed a few methods for that

[slender shoal]

Keep the conversation on topic. If you need assistance with a module, you can ask it here. If not, read #rules and #welcome.

[lethal python]

Nah nvm

I found a way.

[lusty thicket]

awesome

[lethal python]

?

[lusty thicket]

that’s good

[lethal python]

alr?

[lusty thicket]

really great

[lethal python]

bro alr

don't ping.

[quasi jungle]

https://academy.hackthebox.com/module/17/section/88

In this room, when visiting the website with the port specified it works fine when browsing the website but I get a timeout when I visit wp-content or wp-includes, website shows a 404 nginx page when a directory doesn't exist or a page has a firewall but it seems to be glitching out for the directory needed

[mental phoenix]

hello can any one help me with this

Enumerate the Linux environment and look for interesting files that might contain sensitive data

[lusty thicket]

the / signifies a directory

[mental phoenix]

Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer. https://academy.hackthebox.com/module/51/section/1592

[quasi jungle]

Yes I know, its common sense to put a /

[lusty thicket]

did you end it with a / ?

[lusty thicket]

what have you tried?

[quasi jungle]

Worked, Thanks.

[mental phoenix]

I tried everything but it didn't work. I've been stuck for two days

[lusty thicket]

i remember being stuck there too

i eventually grepped for the flag

[mental phoenix]

Can you help me please I'm so stuck here and I'm tired of trying

I have tried everything that comes to my mind and I have not found the flag

[lusty thicket]

you could always use the grep command 😉

[mental phoenix]

i use but i can't find flag

[mental phoenix]

i recursively search within files with grep and then list the filenames that match your search query to find the flag. grep -r -l 'search-query-here' /path/to/search
but i can't find

[cedar void]

These two commands are both basically equivalent right:

"Get-ADGroup -Identity "Help Desk Level 1" -Properties * | Select -ExpandProperty Members"

"Add-DomainGroupMember -Identity 'Help Desk Level 1' -Members 'damundsen' -Credential $Cred2 -Verbose"

https://academy.hackthebox.com/module/143/section/1486

[midnight galleon]

Hi, in the shells and payloads module, live engagement section, 3rd host, the host is vulnerable to X vulnerability, I used msfvenom check function for that X vulnerability and it is sure vulnerable, but when I try to use the exploit it says that exploitation completed but no session, I am sure that I set all the required options for that exploit

I would appreciate any help I was stuck on this for 4 days

[next bronze]

glad to hear that, good work

[cyan belfry]

So I am on the linux fundamentals and doing one question asking how many total packages are on the system. How would I use the find command to find "Packages" I know how to find it if its a certain file extension but idk what they consider a package

[languid wharf]

AD Enumeration Module on the Kerberoasting from linux section. I've got the SAPService creds, but how do I check what groups does he belong to?
I've tried with almost all the tools mentiond in the Credentialed Enumeration from linux section but with no success

[next bronze]

check the output of GetUserSPNs.py

[next bronze]

make sure the options are configured right in msf

[next bronze]

if you have to do apt install then it's a package, google how you can use apt to list installed pacakges

[cyan belfry]

Yeah I found the dpkg

[midnight galleon]

Yeah I am pretty sure

[next bronze]

also use the right variant, the hostname gives your a hint on the vulnerability type

[pure sorrel]

I went through the whole module for a second time. I've tried encoding, http, https, smb shares, ftp, and still nothing

[ember quest]

Hi guys, I'm having an issue on the Footprinting module, Hard lab, and I'm not sure if its a local one or I'm missing something. I found an SSH key, but when I try to connect with it, it just times out. I've changed the permissions,but still no luck. I've got a verbose mode log, but unfortunately, it doesn't help me much either. Has anybody else encountered this?

[next bronze]

you can use that, but there are a few extra things listed in the output

[lusty thicket]

are there any errors?

[calm dune]

hi

how can print the value of a function?

def list(data):
finall_list=[]
for i in data:
finall_list.append(i)
print(list(data))

output : None

[next bronze]

because the function isn't returning anything

[midnight galleon]

I sure did

I tried the manual exploitation but it crashed the system

[next bronze]

you sure about that? that exploit has variants for different OS versions

[next bronze]

msf should work, use the one with the last word starting with p

[cyan belfry]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

What does it mean by submit the number?

[pure sorrel]

So, sometimes the upload works when I use the webshell, and I can see the files. But they come in with a size of 0 bytes, and when I use them in the reverse shell I get no output

[turbid jewel]

checl if there is no extra lines

i really encourage u using vim to check and remove any extra blank line at the end

[midnight galleon]

I did

Exploitation completed, but no session was created

My lhost and lport are correct
Target lhost&lport are correct

And yes I made sure it is lhosts

[next bronze]

restart the lab, and try again, if it still doesn't work, dm me screenshots of your msf options and ifconfig of the attack host

[midnight galleon]

I did this more than 10 times
I will dm you

[bright quiver]

can someone give me some advice on misc techniques for linux priv esc module...i am trying to run the cp command but i get this error after the mounting :

||[root@htb-zilqzxubew]─[/home/htb-ac-814020]
└──╼ #sudo mount -t nfs 10.129.2.210:/tmp /mnt
┌─[root@htb-zilqzxubew]─[/home/htb-ac-814020]
└──╼ #cp shell /mnt
cp: cannot stat 'shell': No such file or directory||

[languid wharf]

Idk how I didn't notice it, thanks

[tall laurel]

holy moly file transfers is such a wordy module.

[ember quest]

Thanks, but it doesn't seem to be the case, I tried connecting with a password instead but I'm not getting any response either, its like the ssh service is completely unresponsive

[bright quiver]

nvm

[pure sorrel]

I got it. It turns out my downloads on my host machine were corrupt and at 0 bytes for some reason. I also refreshed the VMs a few times and the used the native Antak upload option and it finally work
Thank you!

[blissful cliff]

Anyone available to sanity check "Information Gathering - Web Edition" .. Vhosts section, just want confirmation on a flag is all 🙂 TIA

[lusty thicket]

what’s the question

[blissful cliff]

I have 2 vhosts giving the same flag, just want to confirm it isn't an issue with the module is all

And that I've maybe just nit uncovered the correct vhist yet

[next bronze]

the flags are all different

[blissful cliff]

This was my assumption, ill retrace what I've done to see what the deal is 😅

[blissful cliff]

Nevermind, using a different wordless uncovered the final vhost

[fathom pendant]

8 hour days

But also the time is absolutely bullshit, some take you longer, some take you shorter than the time estimated

[next bronze]

the estimate doesn't matter, go at your own pace

[fathom pendant]

https://tenor.com/view/waiting-gif-21631787

[charred harness]

@tiny reef How, 😂I am trying but unable to do

[acoustic owl]

Me waiting for my exam result 😂

[proven pasture]

Totally not what I was actually typeing dang lanageu settings.

I am going back and forth between the BBH and the SOC. Has anyone else here done the SOC? I cannot even get 50% done because everything keeps crashing.

Also, for the BBH, are there many folks that did anything with the hackerone?

[brisk valley]

hey so i run into an error when i wanted to clone the XSStrike

it says: fatal: unable to access 'https://github.com/s0md3v/XSStrike.git/': Failed to connect to github.com port 443 after 129614 ms: Couldn't connect to server

and am in a htb innstance

can someone help?

[next bronze]

can it even connect to the internet?

[fathom pendant]

1: if you're connected to the 10.129.x.x target, they have no internet access
2: unless you pay money, pwnbox is limited as well

[brisk valley]

yea its connnected to 10.129.x.x

so i have to make a new target?

[fathom pendant]

Then point 1

The targets don't have internet access

You have to download on your system and transfer over

[next bronze]

hey have you done the tier 4 AD modules? the LDAP and powerview modules, any thoughts on those?

xsstrike might already be installed, check in the usual directories

[fathom pendant]

^

[brisk valley]

i mean it loads on the website

[fathom pendant]

?

[brisk valley]

but i cannt clonne into the terminnal

the target is 10.129.x.x

[fathom pendant]

"It loads on the website" now I'm confused

Are you referring to pwnbox?

[brisk valley]

sorry if my english is a bit bad mann am from greece

[next bronze]

afaik none of the spawned targets can connect to the internet

[fathom pendant]

Or are you ssh/rdp to the 10.129.x.x target

Pwnbox is the in-browser vm

The little window

[brisk valley]

the pwnnbox says: uk 67 ms

[fathom pendant]

Then that is NOT the target

Have you bought cubes?

[brisk valley]

i am conected through the htb vm ad when i try to clone the Xsstrike it says the messsage i send earlier

[fathom pendant]

[This is also why it's suggested to make your own vm]

[brisk valley]

not bought

[proven pasture]

@fathom pendant have you tried using WSL instead of a different VM?

[brisk valley]

my teachers friend works at htb so he gave me cubes

[fathom pendant]

OK your messaging is confusing. Please link your main htb account following #welcome so you can post screenshots

[fathom pendant]

Nope, I prefer the abstraction layer of a vm hypervisor

Less likely to incidentally brick My computer

[proven pasture]

Oh, okay. I have gone back and forth between Hyper -V and VMs. I think that wsl seems to user fewer resources. Plus. it boots up dater. Well, in my mind anyway. lol.

[fathom pendant]

My point being is wsl is more closely linked to the main OS

[next bronze]

hyper-v is still a vm, and wsl uses hyperv to virtualise a linux os

[brisk valley]

i will try to make it more clear. when i am in the module and go at the end of the page there is a button that says start instace or spawn i dont remember, i press that and it spwans a vm.

[proven pasture]

I understand. You want that barrier. I have different boxes for different activites, so I guess I never think of that. I have been thinking of just using my PI4, or save up for the 5, lol.

[fathom pendant]

Start instance is the pwnbox

[brisk valley]

yea thats what i did

[fathom pendant]

It is not the target

[brisk valley]

sorry i got confused

[fathom pendant]

And using that, it gives you the error

[brisk valley]

it doesnt give me the error when i do the xss discovery

the error shows up when i try to clone the xsstrike

[fathom pendant]

¯_(ツ)_/¯

Message support then

[brisk valley]

ok ill do that

thanks for your time

[fathom pendant]

As it appears to be a pwnbox issue or something

[brisk valley]

ok thanks for helping

[acoustic owl]

Yes, I have done both. I thought they were very good.

[next bronze]

thanks, time to use my cubes I guess

which one would you do first?

[bright quiver]

can someone give me a tip as to maybe what i may be missing on commands or steps? i am on python hijacking section under priv esc linux...this is my error:

||htb-student@ubuntu:~$ ls
mem_status.py mem_status2.py status.py status1.py util.py
htb-student@ubuntu:~$ sudo /usr/bin/python3 /home/htb-student/mem_status2.py
[sudo] password for htb-student:
Sorry, user htb-student is not allowed to execute '/usr/bin/python3 /home/htb-student/mem_status2.py' as root on ubuntu.
htb-student@ubuntu:~$||

[acoustic owl]

What do you have more difficulties with?

[next bronze]

hmm I don't think I have difficulties with those atm, just want to learn more

[bright quiver]

this is what is in the py script

||#### Hijacking
import os
os.system('cat root/flag.txt')

global _TOTAL_PHYMEM
ret = _psplatform.virtual_memory()
# cached for later use in Process.memory_percent()
_TOTAL_PHYMEM = ret.total
return ret||

[lusty thicket]

follow the steps shown in the section

[bright quiver]

@lusty thicket are we to edit the mem_status.py script?

[lusty thicket]

no

[bright quiver]

ok

@lusty thicket so i cannot run this command sudo /usr/bin/python3 ./mem_status.py...i need to run this sudo /usr/bin/python3 /home/htb-student/mem_status.py...but i only get available memory output and that's it

[lusty thicket]

go through the section again your task is very clear

[bright quiver]

@lusty thicket went back and got this result

||htb-student@ubuntu:~$ sudo /usr/bin/python3 /home/htb-student/mem_status.py
uid=0(root) gid=0(root) groups=0(root)
Traceback (most recent call last):
File "/home/htb-student/mem_status.py", line 4, in <module>
available_memory = psutil.virtual_memory().available * 100 / psutil.virtual_memory().total
AttributeError: 'NoneType' object has no attribute 'available'||

so got the flag...i get where i went wrong and needed to do...ty

[tender acorn]

I am wrong ore are the cheet sheet in last time a littel bit broken?

[brazen saffron]

About CSRF, in the input when we give a file, when we pass a .js file, will it be executed when we send it?

[brisk valley]

does anyone know how to fix the target system in the cross site scripting module on the physhing session?

because it says that the target doesnt have internet

[brisk valley]

it says the connection has timed out

[lusty thicket]

strange

[topaz locust]

anyone around for a quick dm about modern web exploitation skills assessment (dns-rebinding)?

[fading mist]

can somebody help me with one of the Linux Q's? Ive been trying to find the answer for awhile now but i get 0 results when looking for it in the terminal

would really appreciate it, its making me insane ;-;

[fathom pendant]

Are you ssh to the target?

It also helps to give more context, module and section name

[fading mist]

tyty, no its just on the local machine

im working on Task Scheduling and the Q is the find what is the type of service of "syslog.service"

[fathom pendant]

Ah

[fading mist]

I already tried systemctl -p Type

and it returns nothing

and when im the show and search for type, still nothing ;-;

it might just be my local machine or something, but just wanted to ask first to see if im doing something wrong

[fathom pendant]

Hint: ssh to the target

[fading mist]

in this one i cant ssh to the target

[civic stag]

damn

[fading mist]

and trying to start an instance doesnt work either for me :PPP

[fathom pendant]

Ah yeah this can be done without it

You're using systemctl yeah?

[fading mist]

yea

tried it with two different ways, -p Type and show

[fathom pendant]

Combine tags

systemctl show syslog.service -p

Iirc that's how I got it

[fading mist]

still nothing

this is what i got

https://ibb.co/GCzgcW2

[fathom pendant]

Don't put type? See what happens

[fading mist]

systemctl: option requires an argument -- 'p'

[fathom pendant]

Ah

Like I said it's been a minute

[fading mist]

haha its okay

[fathom pendant]

It's weird that of you run 'show' it gives you nothing

[fading mist]

ikr ?!

[fathom pendant]

Bc if it didn't exist: it would tell you

¯_(ツ)_/¯

[fading mist]

oo rlly :o

[fathom pendant]

Yeah

[fading mist]

well it does exists.... i just dont know how it doesnt have a type

and htb is asking for it

[fathom pendant]

It should

Is the thing

[fading mist]

should i reboot??

[fathom pendant]

¯_(ツ)_/¯

[fading mist]

lets find out

[fathom pendant]

Probably

[fading mist]

welp that was expected.. still nothing

[fathom pendant]

I'm checking my machine now

Otherwise it might need pwnbox to answer

[fading mist]

okiokki

[fathom pendant]

I'm using a parrot VM myself

So the environment is mostly similar

[fading mist]

aa, im using thehtb version

idk if it rlly makes a dif

[fathom pendant]

It really doesn't

[fading mist]

figured :P

[fathom pendant]

Htb-edition is mostly marketing stuff, since pwnbox is based off parrot

[fathom pendant]

Ah it might not show then, do -p LoadError

;)

[fading mist]

0.0 this is the output ||LoadError=org.freedesktop.systemd1.NoSuchUnit "Unit syslog.service not found.||

[fathom pendant]

Ye add r in front of syslog.service (rsyslog.service)

And you'll get the answer

[fading mist]

how tf

how did you know it was rsyslog and not syslog 0.0 ?! im so confused now @.@

[fathom pendant]

👍 found it out by fuckin around with locate and find

[fathom pendant]

Like I said, fucked around a bit. Because there has to be a system logging service running

[fading mist]

god... tysm, srry that you spoonfed me

ill take this as a lesson to fuck around and find out

[fathom pendant]

Nah it's more of a pain in the ass

Some of the modules do genuinely have those "lmao you thought" moments

[fading mist]

smh my head.. cant wait =.=

[fathom pendant]

Helping you helps me be more accurate with others in the future

[fading mist]

ahh yeah ofc :P,, tyty for the help !

[fathom pendant]

when I did it, I did it on the pwnbox. Which is likely why it gave me the answer without having to fuck around ¯_(ツ)_/¯

You had the right steps so it's not like I directly spoonfed it to you

It's just on parrot OS it's slightly different enough to be a pain

[fading mist]

yeah it was likely to give it to you on there

ill know for next time some shit like that happens just gotta dig for it 🕳️

[brazen saffron]

About CSRF, in the input when we give a file, when we pass a .js file, will it be executed when we send it?

[sleek moss]

hi guys for the lab hydra im on login form attack and + 1 Using what you learned in this section, try attacking the '/login.php' page to identify the password for the 'admin' user. Once you login, you should find a flag. Submit the flag as the answer.

i got the password and iam logged into admin but the flag dont work

[tight matrix]

hey I am a beginner should i take the Nmap Network Enumeration with Nmap

[cedar void]

I am unable to spawn my lab in the firefox browser. I am operating from another laptop.

[hallow remnant]

The tool both correctly identified the type of vulnerability and gave a working payload.

For transparency's sake: I passed it a captured burp request (vs. messing with the tool's other functionality).

[sleek moss]

also guys I cant connect to hacktheboxtarget on brute force I used to be able to but not anymore

[rustic sage]

Hello everyone.

[sleek moss]

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-01-01 20:59:12
[DATA] max 4 tasks per 1 server, overall 4 tasks, 200354 login tries (l:14/p:14311), ~50089 tries per task
[DATA] attacking ssh://92/
[ERROR] target ssh://94.22/ does not support password authentication (method reply 4).

• 1 Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?

anyone hoiw to fo fix

[next bronze]

did you put the right ip in your command?

does not support password authentication
means you can't brute it, also module and section would be helpful

[foggy sail]

For those who struggles with the module INTRODUCTION TO WINDOWS COMMAND LINE”, question # 5 (user4) - use Get-Childitem cmdlt

[sleek moss]

Service Authentication Brute Forcing

hydra

and yes i used the target ip but I cant visit the website

or ssh the prev sections I could use the target

[cedar void]

I tried spawing my IP machine on three different browswers with no luck. Again, I am using a new laptop because the power unexpectedly went out on my old laptop

[sleek moss]

Login Brute Forcing

your meant to make wordlist and pasword and then brute force ssh with the ip

hydra -L //Desktop/bill.txt -P /william.txt ssh://94.22 -u -f -t 4

ssh://ip:22

[next bronze]

please send your messages in one coherent paragraph
the port is not 22, use the port specified in the target ip

[sleek moss]

hydra -L //bill.txt -P /william.txt ssh://94.ip:36504 -u -f -t 4
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-01-01 21:10:40
[DATA] max 4 tasks per 1 server, overall 4 tasks, 200354 login tries (l:14/p:14311), ~50089 tries per task
[DATA] attacking ssh://94.237.56.188:41986/
[ERROR] could not connect to ssh://94.237.56.188:41986 - Connection refused

[next bronze]

reset the target

[sleek moss]

thank u

[next bronze]

disable adblocks, and contact support if still doesn't work

[cedar void]

Do adblocks turn on by default when downloading a new browswer?

*browser

[next bronze]

depends on how now you are, you'll need basic networking knowledge, do Introduction to Networking if you aren't familar with it, then after that, sure, nmap is a great tool

[next bronze]

depends on the browser, brave yes

[cedar void]

I don;t think its the adblocker since I can watch youtube ads

[sleek moss]

it worked for hydra but when i try to ssh into it it says └─$ ssh b.gates@83.136.250.104:39697
ssh: Could not resolve hostname 83.136.250.104:39697: Name or service not known

[cedar void]

oh wait maybe it is

[next bronze]

google how to specify a port with ssh

[sleek moss]

danke

[cedar void]

Oh wait yes it is. Not all videos have ads

Support isn't available

I wonder if I have to set up the pwnbox whenever I get a new laptop

Is it possible that antivirus software block my target IP spawining? I got a notification from mcfee that it blocked some risky connections

[next bronze]

your mistake is having mcafee installed in the first place

[supple gorge]

bruh... it came with my PC -_-

but really, first time having a premium antivirus, I got hit by Redline.. they were no help (called 5 times), I had to self troubleshoot and find the script that was running every time I ran my pc... tough times... This was a few months ago... I would have found that shit in minutes now but back then it took 2-3 days

Off topic... sorry.

To answer wandacalverton, you don't need to set pwnbox, it's web based.

antivirus won't block target from spawning, it's done by htb...

It will always tell you it blocked risky connections... it would be a problem if you got a page not found

PS: now I'm on windows defender

[next bronze]

as someone who works in an AV company, I can tell you that they don't give a f about regular consumers if they get hit by a virus, support won't be much help unless you paid for their incident response or similar, if they even have that service for b2c

[cedar void]

So what do you think could be the issue since I don't have any adblockers or scriptblockers turned on. I can't think of anything other than the fact that I last had my web based pwnbox open on my old laptop before my laptop went black because of a power cable failure

[sleek moss]

yo i have flag for HTB but it dont accept it what to do?

[supple gorge]

Oh that's good insight...

they had 3-5 technicians get remote access to my computer... they knew even less than I did (with 1 exception)

I had sec+ (among others) level knowledge.

MOst went, oh if macafee scan didn't find anything then you're safe. And I"m like no... I'm not... it still screams every once in a while.

One guy actually pulled out Autoruns which was pretty decent on his part. He also looked over th file system, he just didn't spot the thing that didn't belong...

Which btw, it was named ./Steam

I missed that shit too until I found the script hanging.

(again sorry for offtopic)

[supple gorge]

wrong flag

[sleek moss]

it not

[supple gorge]

check formatting

[sleek moss]

its correct
HTB{flag!}

nvm there was space

[supple gorge]

what's the issue, target is not spawning? Sometimes it's finnicky.

try a few times, change servers tcp/udp all that stuff.

If you wanna try to troubleshoot, use a different device and see if that solves it (to see if the issue is device related)

[cedar void]

I tried targeting the IP for any lab ...and everytime I try to do that , it reverts back to the 'Click here to spawn the target system!' text after attempting to spawn the target IP address each time.

I tried on Edge, chrome, firefox and brave and I am having the same issue

[next bronze]

lol that's a funny story, I'm surprised they even offer remote to consumers, hope you didn't have to pay extras. b2c supports are (usually) outsourced and the quality varies wildly because they don't care much about consumers after they have sold you the product (I'm in b2b so I can talk as much crap about b2c as I want)

[supple gorge]

"Click here to spawn the target system!' "

Are you spawning the module's target or pawnbox, are you have the same issue for both?

Maybe click and give it some time, the browser shouldn't matter

[cedar void]

The pawnbox opens fine. Its the target IP address that I am having issue with

[supple gorge]

hahah, I got a 1 year macafee sub w/ pc, so ig that was included.

Yeah, they didn't really care much, interesting to see from someone who works in it

It was a stressful day...

But I think I remember them talking and checking whether my subscription included that and talking about upgrading or something, don't quite remember it, but eventually they got the (higher tiered support guy that spun autoruns)

[supple gorge]

at this point I'd ask for screenshots... how long are you waiting when you press spawn instance?

[cedar void]

Everytime I try to spawn the target IP , it never gives me any IP address

[supple gorge]

give it a second.

Is anyone else having a similar issue?

It shouldn't be because of your device bud.

You could try it on a phone if you wanna check lol

[next bronze]

ah you got hit by the classic upselling "pay more so we can fix it for you"
and I don't work for mcafee, but their consumer AV is well known for being crap. no idea about their enterprise products though.

[next bronze]

try another section?

[cedar void]

I tried this severl times all night. Nothing has changed so far.

[cedar void]

I tried another section as well

[supple gorge]

welp, this sounds like an email support situation.

unless someone else got more ideas

[clever dew]

I'm stumped on this one now too, anyone able to provide a nudge in the right direction please?

[cedar void]

Maybe it is. I already emailed them

[regal lotus]

Is grabbing someone’s IP but not sharing it legal

[supple gorge]

I've heard the mods usually say

read #welcome

How are you grabbing it lmao...

Here in my hands, I hold 10.0.0.10

[regal lotus]

What is that?

[supple gorge]

feel free to dm, I'd want a picture of the yara and the seatbelt.exe

mind I'm in the middle fo the cdsa exam.

But generally, you check the packets, maybe make a super broad rule to then specify the answer... just gotta find the right string/command

[regal lotus]

I have no idea about hacking or coding

I want to learn tho

[supple gorge]

start off by reading #welcome

[regal lotus]

Ok

I have to pay for a course?

Wait

[supple gorge]

.

[regal lotus]

I read it

[supple gorge]

yes, buy cobes or subscription

[regal lotus]

Do u know how to grab ips or no

I want to learn to hack

[next bronze]

what do you even mean by grab ip

I grab 127.0.0.1 all the time

[regal lotus]

What is that

[supple gorge]

bud... you're way ahead

gotta learn the basics

[next bronze]

my ip, and yours, and everyone else's

[regal lotus]

WHAT

MINE?!?!;

[supple gorge]

hmmm @next bronze , you got his ip?

[regal lotus]

NO

STOP

PLEASE

DONT

[next bronze]

yeah just ping it

[regal lotus]

Why😭

[steel knot]

Hi i just joined hack the box and wanting to learn the fundamentals any tips on what modules to start with for the basic!

[supple gorge]

ping Krox_ ain't working lmao /j

[next bronze]

alright before this gets out of hand, that is a private ip, if you want to get started, hackthebox has some free tier 0 modules, check those out

[supple gorge]

there is a security fundamentals path

[steel knot]

thank you

[regal lotus]

Where do I find them?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[supple gorge]

I think there is a "getting started" module and some initial tier0 modules that you can use if you're a complete beginner

[steel knot]

i found it thank you for the help

[regal lotus]

Thx

[supple gorge]

to answer all the people asking to learn to hack.

You gotta start from the basics, learn basics of networking, learn the basic of OS, software among others. After getting the fountationals down, you can move forward and learn bit by bit

Biggest tip is stay curious and poke around, go little by little, don't try to jump the horse

[regal lotus]

Has anyone tried a chamoy pickle kit

This is a random question

[supple gorge]

maybe, maybe not... but bud, this channel is for #modules related questions... I think there's a better general channel for that

[regal lotus]

What is a module

I have no clue what any of this is😭

[supple gorge]

this is for HTB: Academy

the #welcome should explain stuff or so I'm told

[regal lotus]

Ok

Have you hacked anything before?

[regal lotus]

Anyone^

What even is that

[next bronze]

please check #welcome , get verified, this isn't the channel for this

knowing how to use google is an important foundation skill to be a hecker

[supple gorge]

we're on their shoes

oh, it's an idiom (on his role)

[cedar void]

I don't perhaps need to spawn a new cloud address after attempting my htb academy lap exercises on a new computer?

[burnt seal]

Anyone have any issues with the CPT- Attacking common services Hard lab final question?

I've got the flag, directly copying, wrote it down manually, still having issues

Also where does thediscord request help button post to?

[supple gorge]

nope, that cloud address is accessible from any machine

[regal lotus]

Done verifying

[burnt seal]

Likely wasn't actually sending a POST request, Hard to say without seeing it first hand

https://tenor.com/view/hackerman-gif-22344136

That's exactly what its like! Don't forget the being asked to hack insta

[cedar void]

And I don't understand Why the 'Adblock Detection' Screen comes on when I can go to youtube and watch videos with ads

This is hackthebox labs

[lusty thicket]

probably cause post and get requests are structured differently

[burnt seal]

BUMP , This is driving me insane

[burnt seal]

Wait reloaded the page and it had accepted, even though it said it was wrong -.-

[sleek moss]

in brute force login for hydra when you brute force into SSH why do they then bruteforce the 2nd acc in FTP

instead of just brute forcing again from ssh?

[fathom pendant]

because SSH is very slow

:)

[oak ocean]

I got stuck on this part for more than 3 hours.
"Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_)."
in Pass the Ticket (PtT) from Linux of Password Attacks module.

By now I have gained all the accesses available, like root, julio, david etc.

I have found ccache files along with outputs of "find / -name "keytab" 2>/dev/null".

But I am failing to impersonate to read the flag in \DC01\linux01.

The command I am using is: kinit LINUX01$.INLANEFREIGHT.HTB -k -t /var/redacted/ccache_INLANEFREIGHT.HTB

[fathom pendant]

Is the ccache expired?

[oak ocean]

Not sure. But I am getting such error:
kinit: Client 'LINUX01$[e-mail]' not found in Kerberos database while getting initial credentials

[fathom pendant]

then try the method of export KRB5CCNAME=/path/to/ccache

also it's likely that the .INLANEFREIGHT.HTB is what's fucking up your kinit, try just the LINUX01$@INLANEFREIGHT.HTB

also it's yeeting it because it sees codeblock as spam if your account isn't linked

[oak ocean]

Hmmm... I exported KRB5CCNAME and it is showing the right file. But still I am getting the same issue.

[fathom pendant]

iirc there's 2 ccache files

one is expired, other isn't

[oak ocean]

I am seeing only ccache file, is that in the same directory?
||Ticket cache: FILE:/var/lib/sss/db/ccache_INLANEFREIGHT.HTB
Default principal: LINUX01$@INLANEFREIGHT.HTB||

[fathom pendant]

oh wait yeah there should only be one

it's been a minute since i did this one

[oak ocean]

When I check klist, I can see I have already impersonated a few service principles. Like:
-krbtgt/[e-mail]
-ldap/dc01.inlanefreight.htb@
-ldap/[e-mail]
May be I already have the right to accomplish the task. Is it just to use smbclient //dc01/linux01$ -k -c ls -no-pass?

[fathom pendant]

try

[oak ocean]

Sigh. Not working.
root@linux01:~# smbclient //dc01/LINUX01$ -k -c ls -no-pass
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

[next bronze]

kerberos needs fqdn, use the full name

[round sable]

Thanks !

[oak ocean]

You mean for my smbclient command?

[next bronze]

yeah, dc01.inlanefreight.htb

[oak ocean]

I want to end this task with an unintended way. I am so tired lol
root@linux01:~# smbclient //dc01.inlanefreight.htb/LINUX01$ -k -c ls -no-pass
session setup failed: NT_STATUS_CONNECTION_RESET

[oak ocean]

Finally found the way from the HTB forum. There were guys like me who struglled, some of them even skipped the module. There is a need to add a little more hint to this task. The existing hint is confusing and even misguiding.

[tall laurel]

Currently stuck at Windows File Transfer Methods module. Is this question limited to only using powershell?

Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, RDP to the box, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.

[fathom pendant]

there's a few ways to transfer: SMB, Mounting with the Remote Desktop Program, Hosting a Web Server

[hollow jackal]

Can somebody help me with PHP Web Shells in Shells & payload section , I cant find credentials to login to rConfig web page

[slender shoal]

I stored the queries in a variable so instead of typing everything out it was just a variable. If you want you can dm me.

[karmic kettle]

hi, I am new to hack the box and is having troubles with Ninetail, can anyone guide me on what i need to do

[pastel lava]

been stuck on the linux priv esc module for a while now the sudo section ive completed the skill assessment and everything else i identified what i can run as root with sudo -l ive checked gtfo bins, tried to find exploits online asked chatgpt but cannot figure out what to do am i on the wrong track or something

[pastel lava]

got it

[fiery berry]

Wrong channel, I guess this is the one you're looking for #starting-point

[karmic kettle]

oh yes sorry i am new

but i have no access to it

[fiery berry]

read #welcome

[karmic kettle]

if my htb account is enterprise can i still do it

[fiery berry]

read #welcome and find it out since I don't have access to that info

[quasi moth]

Does someone knows what is "special rewards" for Weekly Streaks

[acoustic owl]

Check your Badges

https://academy.hackthebox.com/my-badges

[quasi moth]

Badges is the only one rewards?

[acoustic owl]

idk

[quasi moth]

Lol, got it

[acoustic owl]

But you're sure to get badges.

another platform has a similar system. But you have to be active there every day.

When you reach a goal, you get a badge

[misty current]

I wonder what's the highest streak week that's going on. I'm on 6 week streak but I wonder if I started late and missed some week.

[acoustic owl]

I have no idea. As you can see, I don't even have the first week streak

As soon as I find some time again, I'll finish the CWEE path

[turbid jewel]

Do u mods have all paths/modules?

[acoustic owl]

I buy the modules like everyone else here

[misty current]

Ah, I just noticed. Thought you'd be keeping up the streak. I guess you chose to chill for now lol

[pulsar dirge]

Can anyone DM me or can I DM anyone about Client-Side Prototype Pollution in Whitebox Attacks?

[acoustic owl]

Before the CDSA exam, I prepared for the exam with various things and therefore didn't do any new modules.
I hadn't actually done any modules since the CDSA exam. But more due to a lack of time.

[acoustic owl]

What exactly do you want to know? Just ask your question here

[pulsar dirge]

I can't get my payload to execute on the client side, even if it works on my end.

I'm trying a simple GET request to see if it works and I get nothing.

When sending the link to the admin, I don't get any request to my http server.

[acoustic owl]

Nothing is ever sent to your HTTP server. You have to find another way

Check this Page
|| https://github.com/BlackFan/client-side-prototype-pollution/blob/master/gadgets/jquery.md||

And read the Hint from the Task

[pulsar dirge]

Yeah, but what option do I have with the payloads? Can't extract cookies, can't extract content of the admin page...

My idea was to fetch the content of the admin page and send it to my HTTP server.

Ah, okay, maybe I did find something. Let me check again.

[acoustic owl]

As the hint says, let the admin do something for you

[pulsar dirge]

I didn't know I could see what I needed, but I solved it now. Thank you, much appreciated!

[short gulch]

Any tips on the last question on the Skill Assessment of Understanding Log Sources and Investigating with Splunk?
Splunk - find through SPL searches against all data the process that started the infection.

As far as I've found out, the .exe file that "created remote threads in rundll32.exe" was simply downloaded thru msedge and executed manually thru explorer. I don't understand the question

[shut wraith]

WEB ATTACKS

Web Attacks - Skills Assessment

Try to escalate your privileges and exploit different vulnerabilities to read the flag at '/flag.php'.

1. I found the reset page.
2. I fuzzed for parameters
3. I cannot find any parameters.

Any help would be appreciated

[acoustic owl]

What exactly is unclear? You seem to have answered the question

[acoustic owl]

Try to list the users

[short gulch]

Ok, I've found the answers, I thought the task was to investigate the origins of the .exe that was the answer to the previous question (which eventually led to compromise). My bad

[shut wraith]

How do I list users if I dont have initial access. All I have is the reset.php and the index.php which is an auth page. I also have profile.php and api.php but can't do anything with those...

[acoustic owl]

You can't do anything with it? Really not? Take a closer look at these things.

[supple gorge]

Hard to keep the streak when the exam is 7 days long haha

[acoustic owl]

This feature did not exist before.

[supple gorge]

it's been 5 weeks, it was out when you took the exam, I'm just speaking for myself that it gets hard to keep streak while you're doing the exam

[acoustic owl]

Yes, it came out before I took the exam. But I didn't do any modules before the exam, or work through the modules I had already solved again. At least partially. But of course that didn't give me any points.

But don't worry, I'll get those badges lol

[leaden pond]

Has anyone encountered this error with evil-winrm? I've been setting up a new attack VM (parrot Linux VM hosted on M1 Mac), and I haven't been able to get evil-winrm working.

[viscid cedar]

In https://academy.hackthebox.com/module/67/section/627 Windows Privilege Escalation, Kernel Exploits, Does CVE-2020-0688 actually work with windows/x64/meterpreter/reverse_https , or do you need to use a different msfvenom reverse shell?

[sly dome]

the payload shouldn’t matter but just stick to reverse tcp

[rustic sage]

Hi guys, I need help with this. The HTB Academy objectives are not loading for me, I have the student plan, can someone give me a hand?

[rustic sage]

"Target: Click here to spawn the target system!"

[swift forge]

Is there a way in command line to read all of the files recursively throughout a directory tree?

I'm in intro to windows command line and they want me to fine a file that contains a flag, but the exercise is not using the standard flag format that HTB is using

There is over 100 child directories and tons of the same flag.txt file with nothing in it

[wanton jasper]

not sure what exercise that is but if there are decoy flags with nothin in it and find a way to filter your results from empty files

[swift forge]

Yes that is what I'm looking to do, I just don't know how to do it

[marble pagoda]

with python or powershell probably. When you google "recursive search tree" + powershell/python you should get results

[floral condor]

It's the entire morning that I'm firing sqlmap in SQLMap Essential module, I'm stuck against Attack Tuning -> Case #6. Any suggestion beside Use the prefix '`)'?

[sly dome]

all of them but the one are 0 bits 🙂

[swift forge]

Yeah I haven't been able to find that

[sly dome]

find by > 0 bits

[wanton jasper]

Should be able to do it with a one liner in powershell. This is a task that I would personally use chat gpt for since I am not the best at powershell but I am sure you can research some other forums to see examples of filtering searches as well

[sly dome]

Get-ChildItem -Path "C:\Your\Path\Here" -Recurse | Where-Object { $_.Length -gt 0 }

[manic lantern]

Can someone explain the following, please?

I was doing: Utilize the Get-WinEvent cmdlet to traverse all event logs located within the "C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement" directory and determine when the \\*\PRINT share was added. Enter the time of the identified event in the format HH:MM:SS as your answer. in the Windows Event Logs & Finding Evil module in the Get-WinEvent subsection.

But somehow neither 19:30:30 nor 20:30:30 wasn't correct.

I did get the correct answer eventually, but had to adjust to my own time-zone...?

[dawn loom]

So you got the answer?

[manic lantern]

I do

[solemn surge]

Hello, I would like, for the module "linux fundamentals", to create a bash script which connects me directly with openvpn and opens a new terminal connected via ssh to htb-student and lets me interact with that new terminal to do the module.

This is the script I wrote :

launchhackthebox.ssh:

#!/bin/bash
openvpn hackthebox/vpn/eu-academy-1-DE.ovpn &
gnome-terminal -- ./launchssh.sh $1

launchssh.sh:

#!/bin/bash
sshpass -p "HTB_@cademy_stdnt!" ssh -o StrictHostKeyChecking=no htb-student@$1

But it doesn't work because I can't use the new terminal its opens.

[rustic sage]

Noting that i wanna start from zero, How to hack?

.

[dawn loom]

Hey, guys. I'm trying to get a Windows VM set up on VMware so I can actually begin doing some real learning on HTB Academy. 😑

Got almost everything installed (as per the instructions on https://academy.hackthebox.com/module/87/section/885), but WSL will not work.

Tried accessing the VM Bios, as well as disabling Hyper-V & Windows Subsystems for Linux (WSL) on my host machine, as suggested on the VMware forums by someone w/ a similar problem (https://communities.vmware.com/t5/VMware-Workstation-Pro/VMware-Workstation-16-1-2-on-Windows-10-21H1-Host-unable-to-run/td-p/2869908).

Clearly most people here have gotten past the first freakin' module... so I'm hoping any Windows users can tell me how they set up a Windows 10 VM, on a Windows 10 PC, while using WSL2 in the VM.

[supple gorge]

look for an option on VMWare that say enable nester virtualization

[nocturne dragon]

Hey guys. Newb here. I'm reaching out bc I am regretfully stuck on the very first question on the Password Attacks Module - Network services questions (Yes, i've downloaded the password and user name list from the top of the page). I started with crackmapexec, utilizing the user.list and password.list and all I ever see with any of the services I'm trying, is either status_logon_failure, or Authenciation failed. I know i'm missing something really stupid and basic here - i haven't done a module since october so i'm a bit out of practice.

[wanton jasper]

not sure, try another tool thats mentioned?

[sly dome]

i dont think thats doable because openvpn needs elevated rights

[solemn surge]

Thanks for responding this message. Using sudo ./launchhackthebox.sh, its launchs openvpn and I think that if I only write the two first line, its connects me with openvpn. I create a post about that here : https://discordapp.com/channels/473760315293696010/1191786935056879636

[dawn loom]

Yeah, I tried that too.

[supple gorge]

that's not it i don't think, could be wrong. Try to find another option

[solemn surge]

https://discordapp.com/channels/473760315293696010/774040263278592041/1191790015253057686 Its indeed works

[rustic sage]

[next bronze]

you need to enable hyperv in the vm

[sly dome]

idk i just use zsh autocompletion xd

[viscid cedar]

Thanks, is there any reason that CVE-2020-0668.exe shouldn't work if the maintenanceservice.exe is in C:\Tools and not C:\Users/htb-student\Desktop ? Assuming of course I use the correct path for the second argument?

I tried and the app reports success, however only if I placed the malware in C:\Users\htb-student\Desktop do I see htb-student:(F) from

icacls 'C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe'

[shrewd hazel]

Need help with the Module Web Proxies, specifically the Proxying Tools options. i know how to get into msfconsole and set the rhost, rport, etc, but routing the traffic through burp i am a bit confused on. also dont know what website to go with, i was using 8.8.8.8 or google.com bascially but i am a bit lost

[next bronze]

dude did you jsut try to hack google

[lusty thicket]

go through the modules options by entering the command options

[shrewd hazel]

okay, i see the proxies options, enable that and set it to localhost?

ohhhhh or need to turn on that proxychain thing

[lusty thicket]

as you can see proxytype:host:port

[shrewd hazel]

but do i need to do anything with linux proxychain? or am i headed in the wrong direction?

@lusty thicket does this look right?

[lusty thicket]

you can also modify proxychains to route your traffic through burpsuite

[lusty thicket]

yes

[shrewd hazel]

so technically i can set it here in proxies, as well as via proxychains

[lusty thicket]

should be http:lo:port

[lusty thicket]

yes

[shrewd hazel]

gotcha, set the proxies to 127.0.0.1:8080

going to do the run command and see what burp picks up

it wouldnt appear under the intercept tab tho in burp, but the http history i guess?

is there anyway to hone in on which item to focus on?

@lusty thicket 😅

[lusty thicket]

the question says ‘what is the last line in the request?’

[shrewd hazel]

its apparently suppose to begin with msf but im not see that going through these requests in the http history

i think i setup the proxy wrong, not seeing it on burp suite even with rerun

it looks right but then after hitting run, i dont see anything in burp

[lusty thicket]

might be a problem with your rhost and rport

[shrewd hazel]

what should i change them too? thats the target, the instructions said any website lol so i just used google, maybe thats the problem

[lusty thicket]

google.com doesn’t use the port 8080

[shrewd hazel]

it should get something tho in the http history tho, no?

ran a couple of times with varying options but nothing appearing in the http history which makes me think there is more to the burp proxy setup

[lusty thicket]

maybe set the proxies with this format

[shrewd hazel]

that did it!

lol now i am seeing it route through burp

that was it lol having to specify the http:IP:PORT

guess its like a parameter thing specifying what to use to communiate?

[ashen herald]

mmmh any hint regarding File Inclusion skill assessment?
||- Found the admin page ( hinted )

• Found various logs
• Tried poisoning UA with "issues" [ " gets translated to x22 ]

< Uncaught Error: Undefined constant 'x22cmd\x22'>
||

Imho, i'm missing something stupid regarding the last point :°)

[lusty thicket]

awesome

[lusty thicket]

strange

[dawn loom]

During initial installation of the Windows ISO, I had trouble installing some versions other than Home.

Chat GPT:
[ Enable Hyper-V on Windows 10 VM:

Inside the VM, open Control Panel.
Go to Programs and Features > Turn Windows features on or off.
Enable "Hyper-V" (if available). If Hyper-V is not listed, it might be due to the VM's Windows 10 edition (some editions like Home do not support Hyper-V). ]

Turns out Home is the only version that doesn't support Hyper-V. Have to create a new Windows Pro or Edu. machine.

Guess no one uses VMs at home according to Microsoft.

[thorn urchin]

yeah pretty much

[ashen herald]

yep, i do agree. In the end using ||<?php system($_GET[‘cmd’]); ?>|| via burp worked it out, using ||<?php system($_GET["cmd"]); ?>|| via || curl -A || and modifications, broke the things

[thorn urchin]

Home is meant for regular avg joe users. Anyone running a VM by def is not a regular avg joe user

[dawn loom]

Learning is pain of mind, like exercise is pain of body.

[dawn loom]

How to you make text in your messages be blacked out like a redacted document? That's awesome.

[thorn urchin]

double pipes ||

[ashen herald]

double pipe on start and and, or well "select" with the mouse and "eye" icon

[thorn urchin]

and end with ||

[ashen herald]

and yeah, is pretty useful to avoid unwanted spoilers to third parties

[dawn loom]

I am a ||mysterious|| man. ||Iron Man song plays in background||

[thorn urchin]

Im not sure babies first php web shell counts as spoilers but yeah lol

[ashen herald]

😄

[dawn loom]

😆 Does that work in any server, or is that an HTB server thing?

[ashen herald]

should be discordwide

[dawn loom]

IT WORKS!

[ashen herald]

might still be an unwanted hint to someone 😛

[sly dome]

the double quotes are breaking the log

[cyan belfry]

Is anyone able to help me out with this one

[thorn urchin]

it means what it says.

count the unique paths and submit the number

[cyan belfry]

I meant is anyone able to give a hint of what tool to use? I tried the ones stated within the pages

[fathom pendant]

My brain forgot how I got the answer

[fathom pendant]

Start with curl

[cyan belfry]

Alrighty

[fathom pendant]

If you do man curl you can see all the flags/options for it

[silent fern]

Is it normal for environments on the academy to take extremely long to respond ?

[sly dome]

curl and bash-fu

like grep, cut…

[shrewd hazel]

Anyone do Web Proxies Module, section Burp Intruder? I cant figure out how to set this up right even with the hint

[sly dome]

just add .html to the payload

that thing with the strange symbol in the intruder tab

literally straightforward

[shrewd hazel]

what am i doing wrong then lol im clearly missing something @sly dome

[manic onyx]

Is netsh.exe able to be run without administrator privileges?

Doing the tunneling and pivoting module and the exercise wants me to set it up on a windows machine that I only have standard user access on. I can try to elevate but I don'

don't think that is intended for the exercise

[fathom pendant]

Did you even try to run as admin, and try password?

[manic onyx]

Yes, I have tried the HTB student password

[lusty thicket]

under the admin directory

[shrewd hazel]

@lusty thicket im just lost on this one, been trying to set the correct get command and payload options/payload processing.

[manic onyx]

yeah nvm im stupid

[shrewd hazel]

@lusty thicket im trying here lol

[desert thorn]

Hey everybody! I am currently working on the "ATTACKING WEB APPLICATIONS WITH FFUF" module and I'm kind of stuck in the sub-domain fuzzing section. The question asks about a customer sub-domain portal on 'inlanefreight.com', but when I fuzz for the subdomains of inlanefreight.com, I only receive the ones already shown in the running text, not any additional ones. Did someone perhaps get stuck in the same place and might be willing to help out?

[lusty thicket]

are you

go through the section again

[shrewd hazel]

@lusty thicket okay im stupid idk. i get that its going to iterate within a specific directory being IP:PORT/admin

for any file with .html

so id need some wildcard thing for *.html

[lusty thicket]

intercept a request to the /admin directory and then ctrl+i send to intruder

[sly dome]

the wildcard is the payload symbol

[desert thorn]

Ok, then my command must be wrong:
ffuf -w ~/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/

Could you maybe give me a hint, where my problem could be?

[sly dome]

and after that you add .html

then you select a wordlist

and run the attack

then filter by 200 or 301 maybe xd

[lusty thicket]

idk if the FUZZ keyword is case-sensitive

[shrewd hazel]

@sly dome where do i get this wordlist from?

[lusty thicket]

use the same wordlist used in the section