modules

[ebon coral]

You can do bruteforce instead of dig

[native turtle]

I see that on https there is a basic auth, but I can't run hydra because of an SSL error...

I already tried brute force SMTP , RDP , FTP

[quiet heart]

to find subdomains?

[native turtle]

mysql block my host if I try to brute

[ebon coral]

Yes

[lusty thicket]

try smtp with the username in email format

[native turtle]

already tried

[lusty thicket]

and use a common wordlist😉

[native turtle]

ok so it s the wordlist the problem...

[quiet heart]

yeah i found some subdomains like ns.inlanefreight.htb and i try dig again but nothing happen

[lusty thicket]

yes

[native turtle]

thank you...

[quiet heart]

any hint?

[weary lily]

I second this question.

[fathom pendant]

You need to use subbrute, and then you'll get a set of subdomains to try with

[quiet heart]

i found 3 subs no one work:

dig AXFR @IP helpdesk.inlanefreight.htb

; <<>> DiG 9.18.12-1~bpo11+1-Debian <<>> AXFR @IP helpdesk.inlanefreight.htb
; (1 server found)
;; global options: +cmd
; Transfer failed.

[fathom pendant]

There is a shorter domain that should work, did you let the command run for a bit?

[quiet heart]

yeah

[fathom pendant]

h* is gonna be your only hint

I just sanity checked this earlier

[quiet heart]

thank you

[fathom pendant]

You can use a vm

[charred fable]

👍

It feels so much better with the VM specially after I changed it to 50% @fathom pendant

[glass cargo]

Can anyone who used backbox or blackarch give their opinion on the distro?

[thorn urchin]

no because it has nothing to do with modules

read #welcome verify your account and then you can ask in #general

[limber river]

if you have only 500 cubes, and you need to pick one module from tier 3, which one would you choose ?

[thorn urchin]

ADCS

simple reason: ADCS is the hottest thing right now in pentesting AD networks

but training materials are sparse

[limber river]

over kerberos attack ?

[thorn urchin]

definitely

theres other training out there you can do for kerberos stuff

adcs practice is hard to find

[limber river]

eeem I got ur point , fair enough ty

[thorn urchin]

my disclaimer would be that I havnt finished the adcs module yet

but its a big reason I got excited for getting my free gold sub

[limber river]

free gold sub ?

[thorn urchin]

found a bug, htb gave me gold sub for it

[limber river]

congrats bro , that's awesome

[supple gorge]

congrats, that's a major W (win)

[next bronze]

disagree with this, many of the ESCs need to be chained with other kerberos attacks in order to succeed

[thorn urchin]

its not a matter of whats priority to learn. but whats better use of cubes

you can go elsewhere to learn the necessary kerberos stuff, adcs practice stuff is harder to find

[next bronze]

I agree with that, but many of the kerberos attacks steps are not in depth because it's required knowledge, so if you're not already familiar with kerberos stuff, it can be confusing

the ADCS module is probably better value, but it won't be as effective if kerberos attacks are new to you

[thorn urchin]

Reasonable disclaimer, I still wouldnt change it as my answer to the original question

but id agree that if someone had more cubes to spare, then kerb attacks would be a good first one. Im doing it now myself

[next bronze]

fair enough

[kindred jewel]

Module: Using the Metasploit Framework
Section: Encoders

Text: Shikata Ga Nai (SGN) is one of the most utilized Encoding schemes today because it is so hard to detect that payloads encoded through its mechanism are not universally undetectable anymore. Far from it.

Can someone please re-word this? I can't comprehend its meaning in its current form.

It is so hard to detect, because it is not universally undetectable makes no sense to me.

[next bronze]

it's been posted to #858470491676737536
sgn was very difficult to detect back then but now it's easily detected

[kindred jewel]

Thanks that is a nice distillation.

[thorn urchin]

if you want a slightly deeper how: its basically perfect at making a payload not trigger static signatures, but sadly instead its own decoders gets sigged instead.

[kindred jewel]

So really, no matter how many iterations you'd do the decoders are always present and found

[thorn urchin]

yes cause the last decoder on the stack will just get flagged by a competent AV

you could mix it with other more modern means but then it just brings up the question why not just rely on those other modern methods instead

[next bronze]

yep evasion nowadays is not as simple as just an encoder anymore

[thorn urchin]

also beating the static signature is literally only half the battle 😂

only a quarter or less if we wanna be pendantic

[kindred jewel]

It is a bit sad doing these modules knowing that the most basic EDR product would block literally everything I'm doing

[thorn urchin]

you gotta crawl before you can run

[tough coyote]

I need assistance on module Supply Chain Attacks: Dev-not so ready secrets

anyone has a moment?

[tidal hornet]

why target disconnected continuously and slow

[upper ruin]

Enumerate the "flagDB" database and submit a flag as your answer.

Attacking Common Services - SQL.

I found mssqlsvc's password, but I can't seem to log in. Am I on the right path?

[clever dew]

Anyone able to pop me a hint for DETECTING WINDOWS ATTACKS WITH SPLUNK - Detecting Ransomware please?

Modify the action-related part of the Splunk search of this section that detects excessive file overwrites so that it detects ransomware that delete the original files instead of overwriting them. Run this search against the "ransomware_excessive_delete_aleta" index and the "bro:smb_files:json" sourcetype. Enter the value of the "count" field as your answer.

I've modified the action-related part of the splunk search and changed the index to match that in the question however the count I am getting does not seem to be right.

Edit: Figured it out

[shut wraith]

There is a tool called tplmap. It's a python script that automates Server Side Template Injections. When I use it, it returns this error:
module 'collections' has no attribute 'Mapping'
This error is due to the "importing from collections was deprecated and eventually removed in Python 3.10. The syntax in 3.10 is to import collections.abc instead."
Can you please help me edit the code so that it uses collections.abc instead of collections

[next bronze]

try another authentication mode

[upper ruin]

Will do, kind sir.

Thank You for the response.

[solar zodiac]

Hi everyone! I'm stuck on the second question in the CrackMapExec Skills assessment. Could anyone provide a nudge?

im not sure if my CME is broken or if I'm going down the wrong path

[lofty rivet]

I've been having all kinds of issues with nmap getting hung at near completion (usually > 90% complete) during the "Network enumeration with nmap" module. It doesn't seem to be tied to any certain flag or command, the pwnbox pings at around 3ms so shouldn't be related to any kind of lag. Any tips on anything I can do to make sure the scan completes?

It seems to be getting hung at "undergoing script scan"

[tulip dragon]

trying to run the socksoverrdp server.exe on the 2nd target machine but getting error

RDP and SOCKS Tunneling with SocksOverRDP
PIVOTING, TUNNELING, AND PORT

https://tenor.com/view/travolta-desert-dry-drought-gif-20765263

[heavy marsh]

The ACL Enumeration section's lab is near unresponsive.

I cannot enumerate if I don't get any output.

Any way we can get this fixed?

[fathom pendant]

plugin not loaded on the client

Did you get the success message when loading the dll

[tulip dragon]

I go tsuccess message with client.dll

[heavy marsh]

Why does powershell call it "Self-Membership" and Bloodhound call it "AddSelf"???

I can't find anything linking the two. This is for ACL enumeration in AD labs.

[fathom pendant]

Are you following the section exactly?

[tulip dragon]

maybe I am missing something but it tried section exactly

[fathom pendant]

Did you skip over rdp to the middleman host?

[tulip dragon]

don't get it

[fathom pendant]

Then you skipped over something in the section

You're at point a. You need to go to point b. And then you can get to c through pivots

[heavy marsh]

Where do I find a cross reference between BloodHound labels and actual ObjecAceTypes?

[fathom pendant]

@heavy marsh

Bloodhound is likely listing the ACL, not the ACE

[heavy marsh]

So there is no cross-reference?

[shadow anvil]

Unsure if you've solved it already, but i also had challenges with this question. Did solve it and at least for me the hash values changed because i reset the Admin pwd, so had to restart and grab the original hash.

#modules message

#modules message

Good luck. Was a tough slog to finish the module but I learnt a lot.

[heavy marsh]

I found this

Later on the same page it has this:

But there is no cross-reference between them. That's what I'm looking for.

This is still a good reference though:
https://www.thehacker.recipes/a-d/movement/dacl

[next bronze]

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces the connection is pretty obvious

[rustic sage]

how does one dump an NTDS.dit? I don't get it the password module just talks about using CME to do it, but isn't there another way to do it if you have the VSS file?

[rustic sage]

nvm I figured it out

[sullen tusk]

would modules for example like, windows fundamentals, like, be incliuded if you just selected a job=path to complete? idk if i'm wording this right...xD if, you just picked a job-path. and along the way of completing it, would you still get the individual credit/badge for the modules that make up the path itself? i'm like assuming yes but just wanted to make sure xD

if this is wrong channel to ask i do apologize i am new here

[jolly cradle]

Most of the job paths already have some assumptions made that you have operating system fundamentals down so they can expand on their respective subject down the line

[fathom pendant]

Each job-role path has a respective "pre-requisite" path that's recommended

[sullen tusk]

tysm! it kinda seemed like common-sense, but i just like to make sure by asking. i have the same issue IRL aswell, and haven't been able to figure out why. i just..idk, i guess need confirmation coming from more than just my own mind xD

i inted to become certified in pentester

[fathom pendant]

Learn by doing, and fucking around

The academy module labs are great to fuck around with because: they're an isolated an environment

[sullen tusk]

i truly love that. it's exactly what i've been doing, and it's very nice to hear another person say something like that

i'm a lil social awkward so like, i'm not also sure my thought process is correct

[fathom pendant]

So if you brick it, just respawn it

¯_(ツ)_/¯

[sullen tusk]

but that's exactly what i've been doing,

[fathom pendant]

Step 1: if you don't get the answer to a module question - re-read the section, you likely overlooked something

I.e. the common pitfall that people make in the Linux Fundamentals module is not using ssh and connecting to the target

And wondering why their answer is wrong

Step 2: if you're sure a set of commands should work, do it Step by step until it breaks

Step 0: RTFM

[jolly cradle]

https://imgur.com/B9OBJVP

[fathom pendant]

Most of these modules were written by people that didn't have the grace of having a legal place to learn these things

So if they could learn from nothing. You can learn from something

[sullen tusk]

i went from, learning red-teaming/pentesting/bbh could be a job/career in the first place. like at all. and new right then and there it's what i wanted. i always kinda messed around with hacking throughout life, but, obviously, for selfish/the wrong reasons. but to learn that like. the literal existence of bug bounty programs exist. or that pentesting for companies exist. it just truly aligned up with myself. i've gone from like...just kinda looking at youtube vids, and discovering hackthebox, to, running my own VMS(cuz at first, i ilterally only had 1 pwnbox per 24 hrs), but once i learned that literally all the pwnbox is, is a vm essentially, and i could just run my own, to practice all i want (i still sub'd to academy of course though lol with time), but then i started messsing around( and yes, bricking) my own home systems, labs, etc. ive played with kali, parrot, i really like blacharch linux but just, i guess don't have knowledge enough to nav through it? (none of the same cli commands from kali work on it), but then, with time, i also learned that it TRULY doesn't matter which OS i picked. i think i just wanted to look cool? like, you can essentially create your own OS ezpz lemon squeezy in minutes

with just the linux kernel essentially, i can wipe a machine, just slap on linux, and from there, install and use any of the toools i wanted. like.....i didn't literally NEED blackarch, cuz it looked cool, cuz ill literally never even used most of those 30000 tools

[fathom pendant]

It's also easy to get trapped in the mindset of "I couldn't possibly be wrong, it's the module that's broken"

[sullen tusk]

i've prolly wiped/re-installed systems like 20 times since the start lol

[fathom pendant]

When in fact. It's a skill issue

[sullen tusk]

no no no no no no

yes

[fathom pendant]

And I will call out a skill issue, if I know for a fact, the intended command works

[sullen tusk]

how can i turn off the slow mode? i like can't reply and send messages like i would like

[fathom pendant]

Slow mode is on admins side not ours

Its enabled to stop people from spamming a bunch

[sullen tusk]

its 100% a skill issue always in my case. i just choose to not give up. if i really sit there long enough, and if i really sit there and figure out like, "okay i did this this and this", like....so far, even if it took an all-nighter, i've been able to complete the tasks i've started

[rustic sage]

A lot of modules miss out on certain things that are crucial to getting the answer to some of the questions asked. It could be a simple one liner that is necessary and you failed to learn about at all.

[fathom pendant]

Also a good method of asking questions here is:
Module Name & Section
What you're struggling with
What you tried

[sullen tusk]

liek right now i'm on the "oopsie" lab in the HTB labs,

the one prior, gave me the most issues, but omg did it feel so good to finally complete it in the end, with the reverse(dontwanntputspoilers)

[fathom pendant]

That's the thing, it's meant to lead you in the direction tbh. They lead you to a command that's almost like what you need, but not quite

[sullen tusk]

yse^

and i truly enjoy that

[fathom pendant]

This channel isn't for starting-point machines btw

[sullen tusk]

oh im so sory

[fathom pendant]

#welcome explains how to access more of the server

[sullen tusk]

im sorry thats my fault

[tulip dragon]

thx , I will look into it

[fathom pendant]

This channel is for the learning modules in htb academy

[fathom pendant]

You're good, just letting you know - if you need nudges there's a more appropriate place to ask

Also fwiw, walk-throughs can be a good teacher - if you're not just blindly following them

Question things, asking why, is how you improve

[sullen tusk]

heard, ty. i completed the linux fundamentals module last night. i was kinda stuck or hesitant on what to start on from there? but like, i figure i should go and learn the things i don't already know. so i picked the networking module. i figure it's a logical thing to learn allllllllll the basic fundamentals, even if they seem irrelevant at first. cuz taht's exactly what it was for me like, "well i'm not trying to learn how to be a sys admin, or create, run, and maintain a network, i just wanna be a hacker"

[rustic sage]

I spent almost 2 hours last night trying to see if I'm going crazy or doing something wrong while trying to do a password attack only to realize that you needed to wait 30 min, not only that the module told you to attack the wrong protocol

[sullen tusk]

but i think it made sense to like. in order to be the best version of what im going for, it makes sense to just know absolutely everything, and not just oh the hacker modules

[fathom pendant]

Information Security Foundations Path is a good one, it's a pre-req to the pen tester one

[sullen tusk]

^ty

[fathom pendant]

It's a lesson in humility, don't just assume the question is telling you where to start

The pivoting module is similar

It's assuming you've read the section up to that point

Though pivoting module is very much a follow-along guide

[fathom pendant]

Always scan the target first, even if given a bunch of info

[rustic sage]

yes it is not a "oh you missed something in the section" thing

[sullen tusk]

just this convo alone with you guys really makes me feel very encouraged about going after this. i didn't have anyone IRL to talk to about it, and no mentor-type person to ask aswell. so i just wanna say thank you guys for just being a cool community like this

[fathom pendant]

Rule 1 of enumerating: treat it as if you didn't have the question to point you

[sullen tusk]

i love how you guys aren't just flat out giving out the answers to the questions, but more of forcing you to see what it is your doing and try and figure it out

omg, tbh, it's no lie that when you read "OSINT is almost like, 90% of a successful campaign"

[fathom pendant]

As long as you're not just seeking the answer, someone will help

[sullen tusk]

truly doing all the research and info gathering you can on the target like.

really really really really does help out so much

also for password cracking, i found out the hard way that like,

[fathom pendant]

Which is why earlier I stated that including what you've done helps narrow down what someone will suggest to try

[sullen tusk]

essentially it's not like in the movies, if the password is IN THE WORDLIST you're using to "crack" the hash, it simply won't happen

[fathom pendant]

Wait until you learn about masking :)

That takes AGES

[sullen tusk]

you can run a cracker all day and overheat your machine all day but so far i've experienced that like, dude if that pw simply isn't in the wordlist youre trying, it won't catch

[fathom pendant]

Depending

[wooden kernel]

If you have trouble with the Oracle TNS exercise in Footprinting because sqlplus cannot be installed with apt:

E: Unable to locate package oracle-instantclient-devel
E: Unable to locate package oracle-instantclient-sqlplus

installing it manually worked https://www.geeksforgeeks.org/how-to-install-sqlplus-on-linux/

[fathom pendant]

Hashcat and John are the 2 major ones

[sullen tusk]

is there a way to like.......idk, config the tool, like, hashcat for example, or john, like. let's say i throw one wordliost at it

but, is there a way to like,

[fathom pendant]

Occasionally you'll see Chickenman poke his head in here

(Chickenman as in the lead dev for hashcat btw)

[sullen tusk]

idk.......yes, theres 1k words in the word list, but is their a way to config it to be able to like. use combinations of the passwords? liek if in the word list i'm using contains all the colors, and then all the countries, individually is there a way to set it or config it to where like, it'll run through all of them individually,

but then start to COMBINE the words., like, blue, red, usa, india, and THEN, blueusa, redindia?

[fathom pendant]

Not really? You'd need to generate that list yourself

[sullen tusk]

ahhhh, ty

[fathom pendant]

Iirc there's an attack or whatever mode but I'd have to rtfm for that

Also if you didn't catch on: rtfm, read the fancy manual

[sullen tusk]

im sorry i think i know what iirc means, but could i ask you to plz tell me the rtfm?

[rustic sage]

the pwnbox that comes with the website has a ton of wordlists.

[sullen tusk]

ahhhhhhhh

sorry lmao

[fathom pendant]

Yes and in password attacks, mutated section youre instructed to create a wordlist using a ruleset

Btw that list is used throughout the rest of the module afaik

[rustic sage]

oh @sullen tusk when you do need to use wordlists in a module, a lot of the times the ones you are supposed to use if not specified will be on the upper right hand corner of the page in a resources button

[fathom pendant]

^

If it's not there it's likely gonna be rockyou

But usually they'll tell you what list to use

[rustic sage]

14 million passwords in rockyou; got like 40 more lists with millions of passwords

[sullen tusk]

no, yes, it does come with a good wordlist, i was refering to cracking my own wifi password with a flipper and marauder. like, obviouslyiknowmyownwifi'spassword, i just wanted to make sure i had a lil methodology down. so like, essentially what it was is like, i would set to like, record of sniff the traffic, then, get the wap, and like, deauth it to get the handshakes (i guess the wifi devboard simply isn't strong enough, but i literally couldnt FORCE any device off the network, and the capture the eapol when reconnecting) i like literally had to go around the house making everyone disconnect and reconnect to the wifi,

[fathom pendant]

Wifi cracking is different from other bruteforce methods fwiw

[sullen tusk]

then once i had the 4 eapols. i took the pcap from wireshark and converted it into the hash from hashcat, and then ran a bunch of different wordlists through it

it took my cheap hp 250$ laptop 4 hrs and several pauses/restarts(because of temperature), just to get through the entire rockyou xD

[fathom pendant]

¯_(ツ)_/¯

[sullen tusk]

but then later, i learned that what i COUDLVE done, was use my actual real cpu, with like, a friggin graphics card, and use that,

[fathom pendant]

Yep

Or gpu pass through in the vm

[sullen tusk]

but then also thats when i learned, it liuterally DOESNT matter, if the pass itself wasn't already in the wordlist

[rustic sage]

it is damn near impossible to hack wpa3

[fathom pendant]

many says to crack an egg ¯_(ツ)_/¯

[sullen tusk]

therse a 3?!?!?!?

[fathom pendant]

wpa3 is just the version

[sullen tusk]

-actual gasp-

[fathom pendant]

Like wi-fi 6

[sullen tusk]

no i know, but wpa2 iscrazy difficult as is xD

[rustic sage]

yeah the only way oyu gonna hack wpa3 is by pointing a gun at the owner.

[fathom pendant]

Or cat 6 cables

[sullen tusk]

so i truly believe it when said 3 is damn near impossible xD

lmao

[fathom pendant]

Impossible for just casual people

[sullen tusk]

the evil portal one was fun aswell. i ran it at work just to see if i config'd it correctly to work in public and at home(obviously, this is literally the ONLY time i used or will use it in public, cuzz i had permission)

ubt just to see the looks on everyones faces is priceless, like, "omg?? we have free wifi now?? all i gotta do is enter my gmail credentials??? bet!!"

aaaaaaaand, hit send, nothing happens xD

[fathom pendant]

Yep

[sullen tusk]

just any input is sent to my flipper, obviously i stood right next to them and made them type like gbberish, but

[fathom pendant]

Well not "nothing"

[sullen tusk]

it's those lil moments like that that make it fun aswell

[fathom pendant]

But academy will not teach you any type of attack like that btw

[sullen tusk]

i mean, they hit send, and it just refreshes to the same page, meanwhile whatever they entered is sent to me

[fathom pendant]

Were getting severely off-track now

[sullen tusk]

no no that was just for funsies on the side, sometimes i get burnt out studying academy

im sorry =/

i think that's twice now, i really am. i'll stop

[fathom pendant]

All good just reigning it in before someone's help request gets drowned out

[fathom pendant]

There's a #general chat btw

Read #welcome

[rustic sage]

The otherday I tried doing stuff i learned in HTB on some scammers I got contacted by from singapore

[acoustic owl]

You should refrain from such things. They are illegal and violate the rules of HTB

[paper gust]

This is true, but don't think that a bigger wordlist is always better, we have smarter attacks these days than just adding more and more words

[rustic sage]

okay. none of it was hacking it was just OSINT stuff, btw.

[paper gust]

ehhhhh, we'll see about that

[fathom pendant]

This man is cookin

[paper gust]

a lot of people are very confident that their preferred AP vendor is going to implement WPA3 correctly, I'm a little less so

[fathom pendant]

❤️ I still need to join your discord btw, I forgor last time

[paper gust]

haha

[rustic sage]

wait the vendors implement the WPA3

[fathom pendant]

Vendors doing things incorrectly? That never happens

[paper gust]

haha ikr

[fathom pendant]

Yes, vendors need to implement it for your device to use it

Like 5G

[rustic sage]

I thought wpa3 is like a program that's executed by the system embedded onto the hardware

[paper gust]

I have a feeling we'll see plenty of "oops the field size is too small and all our customers have been using easily crackable WPA3 my baaaaad"

[rustic sage]

you know widely distributed by the governetment/FCC

[paper gust]

the protocol, which is based around the dragonfly protocol iirc

[fathom pendant]

My wifi password is one334 good luck cracking it

[paper gust]

relied on the discrete log problem for it's hardness

which works if implemented properly

[fathom pendant]

Much like RSA and prime factors

[paper gust]

right

but much like weak RSA you can find in some CTFs and such

it can be done wrong with only small variations

[rustic sage]

😂😂

[paper gust]

too short, minimum of 8 for WPA2 😛

[rustic sage]

wait @paper gust youre the guye MarcieLee said created hashcat, that's pretty cool

been using that thing all week

[paper gust]

well, i didn't create it, i just work on it as a part of the team

[rustic sage]

Anyone here with bug bounty experience? I am newbie here !

oh

[fathom pendant]

^ he just hangs out here

[fathom pendant]

This isn't the channel to discuss bug bounties (in general)

Read #welcome

I summoned the chicken

https://tenor.com/view/adult-swim-comedy-billy-witch-doctor-arise-chicken-arise-gif-3382769

[paper gust]

haha

[rustic sage]

Ooh my bad thanks for help!

[fathom pendant]

Anyway we've hard derailed the channel (as usual for a Tuesday morning)

[paper gust]

haha per usual

[fathom pendant]

So about those academy modules

Pretty challenging amirite?

[rustic sage]

I found myself duckduckgoing for clues to answers all the time but that's stopped as I've gotten to the attacking parts

[fathom pendant]

Asking here is good for a quick sanity check

[small basin]

Could someone please tell me what I might be doing wrong with the "Tapping Into ETW" module? (https://academy.hackthebox.com/module/216/section/2325)
I replicated all the steps, have SilkETW.exe running as Administrator, did reset the VM, but I can't find the log entries for both examples in the etw.json

[fathom pendant]

Wdym "reset the vm"

Actually clicked "restart" from within the vm?

[small basin]

I restarted the target windows vm via the web interface to get a fresh instance

[fathom pendant]

Resetting from the web interface starts a new instance

So it didn't capture anything since its new

[gray field]

Hello, in Attacking Common Services - Easy we are supposed to brute force the user fxxx password. I am struggling with this since quite a few hours using rockyou list. mysql is blocked after around 100 passwds, ftp doesn't provide anything, rdp either, smb disagrees. Is there anything I am missing ?

[small basin]

I restarted the VM and then did all the steps again

[fathom pendant]

Ah

That bit was unclear in how you listed the steps

You listed it as though resetting the vm was a step

[small basin]

for the first example I see the cmd.exe under the spoolsv.exe but I can't find the entry if I search for the PID of the spoolsv.exe

[fathom pendant]

(Which sounds odd to me but I haven't done these modules)

[small basin]

hmm ok

[fathom pendant]

Are you looking at the spoolsv.exe from the context of the example: or from looking at it in the instance

Bc very likely. Those will be different

[small basin]

I follow the steps from the example and search for the PID I used from process hacker (not the one from the screenshots)

[steep kraken]

Footprinting Lab - Medium . i need some help. i have logged into the SQL managament sudio, i ave expanded all avaioable menu's but i cant find anything usefull. plz help

[faint rampart]

you cant even disassociate so its probably not possible to capture a 4way.

[faint rampart]

Check out the ||Explorer Tab -> Expand Databases, you can also issues sql queries, look around more||

[steep kraken]

i have expanded the DB's like 10 times. lol

[faint rampart]

https://www.youtube.com/watch?v=moCgS2kfxnU&t=57s

[rustic sage]

one of the tables is bound to have the HTB account

HTB could be a customer

[steep kraken]

allright, thanks . let me have a crack at it

[steep kraken]

this video is the shiz niz. after watching it ive got the answer. MY GHHHAAAAAAADDDDD

[faint rampart]

Oh, I know Youre welcome

[cerulean grail]

Hi, I'm trying to figure out the distinctions between using wget, get, and curl. Are some of them only for tranferring one-way like only from the target to our host?

It's in the getting Started module in the Pentester job path

[buoyant escarp]

I cant remember, was it the oracle db?

[lusty thicket]

have you tried attacking smtp?

[gray field]

@lusty thicket SMTP provided the login fxxx@xxx.

[misty venture]

Hi everyone, any tips for the last question in "STACK-BASED BUFFER OVERFLOWS ON LINUX X86" please? I

[umbral fulcrum]

hey guy, I have a problem when fuzzing through proxychains.

||proxychains ffuf -w directory-list-2.3-small.txt:FUZZ -u http://IP:PORT/FUZZ||

can someone give me a hint what I'm missing please?

[lusty thicket]

can you give me a hint of the module and section?

[umbral fulcrum]

it's on Dante lab ...
but going through the modules I did find anything that points out that I need extra "touch" when doing proxychains ...

[umbral fulcrum]

there's a -x in the help menu (ffuf) that explain about using socks5://127.0.0.1:1080 but if I'm using proxychains isn't it doing it by itself?

[sly dome]

you should get into the ligolo gvng

[umbral fulcrum]

what is it?

[sly dome]

pivoting tool that uses layer3 instead of layer5 for the tunnel

making everything better

and now it has been updated

you can have X tunnels at the same time

[umbral fulcrum]

found out that when doing:
||ffuf -x socks5://127.0.0.1:1080 -w //directory-list-2.3-small.txt:FUZZ -u http://IP:PORT/FUZZ ||
& when doing
||proxychains ffuf -x socks5://127.0.0.1:1080 -w //directory-list-2.3-small.txt:FUZZ -u http://IP:PORT/FUZZ ||

it has the same result, Y it happens I didn't get

[umbral fulcrum]

so If I understand u correctly, the reason is that -x flag works on layer 3, so that's Y it happened over the proxychains ?!

[sly dome]

dude

what?

[umbral fulcrum]

lol, then no...

I'm trying to figure out Y both commands do the same thing.

guess I need a bit more research ...

[cedar bear]

hi everyone, I'm stuck on the module "broken authentication".
in the section "Predictable Reset Token", there is an md5 hash that's supposed to be generated based on the epoch time in milliseconds, but i can't seem to find a valid token for the admin, after brute-forcing the +1/-1 seconds.
anyone knows why that could be ?

found the problem, i had to add the username in front !

[fathom pendant]

usually having a username helps :^)

[tulip parrot]

Module :Windows Privilege Escalation
Windows Built-in Groups
Hello, I have an issue with the command : $key = Get-BootKey -SystemHivePath .\SYSTEM
I get this error : Get-BootKey : Requested registry access is not allowed.
I don't know what to do, i did not find any usefull information online
Thx

[fathom pendant]

• Requested Registry Access is not allowed = you don't have perms to view it :) hth

[tulip parrot]

I don't undestand i did everything that was in the module

Do you have any hint ?

[gray field]

@lusty thicket The pass obtained doesn't satisfy much mysql : ERROR 1045 (28000): Access denied for user 'fxx@xx'@'10.10.15.17' (using password: YES). It looks like a dead end as ftp doesn't appreciate it much either.

[faint rampart]

Are you running this on the copy of the SYSTEM hive you made?

[tulip parrot]

yes

[faint rampart]

and you made the copies how?

[lusty thicket]

mysql -u user -ppass -h ip

[tulip parrot]

with diskshadow, i shadow the C: to E:. Actually the SYSTEM file was already in the folder. How do I make one ?

[faint rampart]

I thought so, If you want to use DSinternals on that copy you need to specify its path with the E:\SYSTEM iirc I prefer to reg save its more straight forward

[tulip parrot]

I do use its path. It does not work.

[gray field]

@lusty thicket yes ... same result giving -ppass or -p and pass after, and idem after resetting

[faint rampart]

weird, just use reg save then, I didnt spend much time on that technique XD theres like 4 ways to copy that, reg save works well.

[fathom pendant]

try leaving out the domain

[gray field]

@lusty thicket .... better after removing domain name👍

[lusty thicket]

yes

[tulip parrot]

How do you copy on your machine ?

[faint rampart]

copy on my machine? You could use reg save to create the copies of the system and sam registry and use dsinternals to extract or transfer over to your machines and extract with secretsdump.

[tulip parrot]

Yes on my machine, I use xfreerdp and I can not get the files to work them on my machine

[fathom pendant]

xfreerdp has a /drive: option

[faint rampart]

Review the file transfer module and xfreerdp has a /drive option

[faint rampart]

You could also use mimikatz, but you should really review the file transfer module.

[fathom pendant]

^ file transfer is invaluable

[ebon jasper]

I had no idea I already did your first mention but I am getting wrong hashes

I even got the 2 hash of Adminstrator
I checked it with impacket
First one hash belongs to 172.16.19.3 (windows)
Second Adminstrator hash belongs to 172.16.19.19 which is linux

But none of them worked
I tried --sam, --lsa, --ntds with hash of 172.16.19.3 but couldn't find a ws01 adminstrator hash, I tried dump hashes using secretsdump with hash of ws01$ account and it didn't work

I know --ntds doesn't make sense, but I am trying what I know it is third day...

[orchid pine]

Can u put me on the context which module is this and what are u trying to do

U can dm me as well

[ebon jasper]

It is ADCS module which is about certifactes of AD and ESC11 lab

[orchid pine]

Didn’t do that module

[limpid frigate]

i'm on module password attack - network services, after mount an nfs share, i can not access it, is that the part of the lab or i miss smth

[fathom pendant]

su to root and look around

i forget the exact options you need to set to not have this happen

[limpid frigate]

yep even with root, this was my mount command sudo mount -t nfs 10.129.141.192:/JNFS/ ./nfs/ -o nolock

[fathom pendant]

i meant

you can explore it with root

:^)

[limpid frigate]

yes and i su to root but it still say no permission

[tulip parrot]

Hello still on
Windows Privilege Escalation
Windows Built-in Groups
I can not crack the hash...
I tried with john and hashcat

I can not pass the hash either

[cinder cairn]

@acoustic owl could we go in Dms ?

https://academy.hackthebox.com/module/67/section/640. I have tried with searching "password" in C:\Users. But the password from documents's file is not accepted 😦

Could anyone help me with this ?

[untold idol]

Hi everyone, I was wondering if someone could help me in PM for the Assembly skill assessment. I've done the xor loop to decode the shellcode then once I've got the decoded shellcode I can't use it on the target to get the flag 😦

[cinder cairn]

@wheat garden could you help me with this ?

[acoustic owl]

Check the module again to see exactly how to search correctly.
By the way, take another look at the #rules . Simply writing to people via dm or pinging them for no reason is not allowed.

[tulip parrot]

can somebody help me 😢

[acoustic owl]

Is this the question?

Leverage SeBackupPrivilege rights and obtain the flag located at c:\Users\Administrator\Desktop\SeBackupPrivilege\flag.txt

[tulip parrot]

yes and i got the reg save on my machine

[acoustic owl]

If so, you do not need to crack a hash or access the system via PtH

[tulip parrot]

how can I do ?

[acoustic owl]

The module explains exactly what you have to do

[tulip parrot]

thx you ❤️

[next bronze]

you're still stuck here? have you tried to dump regs of ws01?

[sleek stump]

my target was not spawaning in academy

i clicked it but not showing any url

[ebon jasper]

First I even can not find a way to login ws01 to dump hashes I will have to either password or hash(pass the hash login) right? If I follow module I am getting hashes which belongs to only "lab-dc" hostname not "ws01" I tried to dump regs of Adminstrator (lab-dc) but it was useless

[sleek stump]

i am on introduction

[next bronze]

you used secretsdump on dc, use the domain admin's hash to access ws01

[ebon jasper]

Yes, but when I type hostname command it was "lab-dc"

I tried to dump regs but still not ws01 and lab is not accepting

[next bronze]

what creds did you use to dump ws01

[ebon jasper]

Blwasp ?

[autumn pilot]

please avoid straight directions of solving an assessment

everything you need to solve anything is within the module's sections

[ebon jasper]

That creds written in lab, I hope it is not spoiler

[next bronze]

you have DA, why are you using other creds

[limpid frigate]

Export list for 10.129.138.4:
/JNFS (everyone)

i can not access even with root

help guys :((

[next bronze]

su to root and look in the share

[limpid frigate]

ikr, doesn't work

[shadow anvil]

i took a tangent myself on this one (not sure if it's intended process though).

I assume you can get onto the DC given you've answered the first question. You can use certain native commands to roll the Admin DC creds, which you can then use with secretsdump (ala https://wadcoms.github.io/wadcoms/Impacket-SecretsDump/), adjust IP accordingly.

[sly dome]

i can unlock a tier 3 module, kerberos vs adcs?

[faint rampart]

Im thinking adcs, Kerberos attacks has content you could find on the internet, but not too many well explained adcs content around talk less of all the ESCs in the spectreops whitepaper

[shadow anvil]

how well versed are you in kerb? If you understand it well enough.. I did find ADCS good and as mentioned above. not as much ADCS stuff out there compared to Kerb attacks

with that said, my brain did melt a fair bit in ADCS.. somehow made it through.. def helps going in with a decent understanding of kerb and AD

[faint rampart]

Im definitely gonna come back for this Kerberos attacks when I get the cubes 🫠

Calm down 😅 HTB academy has one of the best support teams ive seen

one of the best

[acoustic owl]

If it is a technical problem, only Support can help you. They usually don't read here in Discord.
Contact support via the green bubble

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[wanton jasper]

take it up with them, nothing we can do here

[acoustic owl]

I'm sorry to hear that, but there's nothing we can do for you here.
Support is also available via email.

We can't do anything for you here in Discord.

[sly dome]

thanks for the answers

will go for the adcs one

i will get cubes for the kerberos later on

[ebon jasper]

May I dm please? I know I might be annoying for you but this is last time I want to show one thing this might be spoiler in here

[grizzled schooner]

any one have a second to try an attempt to explain something within information gathering - web edition?

[hardy socket]

hey everyone, I'm struggling with the last question in the NTLM Relay Attacks module, lesson "NTLM Cross-protocol Relay Attacks": Use impacket's SOCKS server to hold NPORT's relayed connections and abuse them to access the MSSQL service at 172.16.117.60; query the 'flag' table within the 'development01' database and submit the flag.

[hasty cliff]

need help of modules

shall any one help me with modules

[hasty cliff]

i need some modules can u help

[hardy socket]

I can try, what are you struggling with?

[lusty thicket]

yes

[grizzled schooner]

How would you determine in this if there was a vhost?

and further down the line, there's a wordlist that's used to enumerate possible vhosts... are those names only used for vhosts? or can those be actual servers as well?

[snow ridge]

In PIVOTING, TUNNELING, AND PORT FORWARDING, and section SOCKS5 Tunneling with Chisel. I can't run chisel on target host I get this error: ./chisel
./chisel: error while loading shared libraries: libgo.so.22: cannot open shared object file: No such file or directory
Is there a way to solve this? Or did I understand something wrong in the section

[lusty thicket]

i don’t understand what you mean.. it’s a wordlist

[lusty thicket]

you can fuzz the host header and analyze which request serves different content

[grizzled schooner]

yeah so what I mean is that wordlist with vhost names within it, can those names only be used for a vhost, or could they be used for an actual server

[sly dome]

?

[lusty thicket]

[sly dome]

wth is an "actual server"

a vhost can act as an actual server

[sly dome]

compile it statically

[lusty thicket]

a virtual host could allow a physical server to act as if it were multiple servers

to the best of my knowledge

[lusty thicket]

think of it as a virtual server

[tulip parrot]

Hello again,
In Windows Privilege Escalation
DnsAdmins
I leverage membership in the DnsAdmins group to escalate privileges but I can not access to the flag

[sly dome]

in windows OS you need to log out and login again to get changes in groups reflected

[tulip parrot]

I did it. I Unconnected myself and connected again, I don't know how to do in an other way

its okay I successed to sign out

[snow ridge]

Thanks!

[faint rampart]

you could also use a reverse shell payload too for the dll, just figured that works too.

[charred fable]

Can I not do the starting point exercises without connecting to the pwrbox in the LAB ? or do I have to use the 2h I got ?

[fathom pendant]

There's a starting-point vpn

[charred fable]

@fathom pendant
yes I tried to use it , I typed open starting_point_TTT.ovpn on VM

it only opened a window

with alot of text

[lusty thicket]

same

[shell ore]

anyone here done the common services module?

need help at the SQL Databases section

NVM

it was a syntax error 😭 😭

[winged elm]

In the SQL Injection Fundamentals skill assessment, is it possible to obtain a reverse shell? I have command execution, but when I try to establish a reverse shell the website just hangs which leads me to believe a firewall might be in the way?

[fluid basin]

In the Attacking NTDS.dit section of Password Attacks, HTB mentions that if we are using xfreerdp 'all we must do is copy and paste into the RDP session we have established.' I googled a bit but could not really figure out how to make this work so I ended up using my notes from the file transfer section to answer the questions. I am interested in learning this method though if anyone coule explain?

[silver iris]

Does somebody know if the box is broken?
Still cant connect to it.
Been stuck for 3 days now.

[silver iris]

Could you connect to the box? If so, how did you do it?

[shell ore]

after some suffering i did

its sooooo laggy

[silver iris]

I just get connection timeout all day 😄
But mssqlclient.py y -p port user@ip is right?

[royal sigil]

hello i make the brute forcing module (service authentification brute forcing ) i take a lot of time to brute froce and i have this

[shell ore]

yeah but are u trying w the first user?

if yes then wrap the password in quotes

for the special characters

[silver iris]

wait how do you mean, i get prompted like this:

Then still in quotes?

[shell ore]

oh

i didnt use this no

[silver iris]

what did you use?

[shell ore]

impacket-mssqlclient -u htbdbuser:'pass'@ip

smth like this i remember

[subtle mauve]

Anyone can give a nudge for Predictable Reset token in the Broken Auth section? I cannot figure it out to save my life. I have modified the script to convert to epoch time, changed the interval from -1 - +1 and even made sure htbadmin was prepended and the times were synced with the server, I have skipped this section multiple times and I really need a nudge so I can put lessons learned in my notes and move on.

[acoustic owl]

+/- 1 second = 2000 milliseconds

[full nimbus]

Hey Guys, what do you recommend between bloodhound-ce and old bloodhound ? I feel like the ce version is more modern and fluid, but seeing the AD Modile screenshots, I've got the feeling it also has less features

[next bronze]

sure but can only get back to you in a bit

[silver iris]

Unforntunately i get
"Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication."

[shell ore]

.\

Add this before the username

[silver iris]

Then i just get "Login failed for user '.htbdbuser'."
:/

[shell ore]

Ughhh my brain is not braining

Wait lemme brain harder I really forgot😂

[storm hedge]

Can anyone help me please with the crackmapexec skills assessments, I'm struggling with the 2 last questions Ccache share and DC01

[weary lily]

I'm on the Digital Forensics skills assessment, but every time I try to launch a hunt for Windows.Memory.Acquisition, it keeps saying "While resolving github release Velocidex/WinPmem: Get "https://api.github.com/repos/Velocidex/WinPmem/releases/latest": dial tcp: lookup api.github.com: no such host." what's going on?

[royal sigil]

hello i make the brute forcing module (service authentification brute forcing ) it take a lot of time to brute froce and i have this

[static roost]

Can anyone help with the module "Active Directory BloodHound" section "BloodHound for BlueTeams"; the first question has me stumped. Tried multiple angles here, and I still get wrong answer. No clue what I'm doing wrong.

okay nvm....still working out how that number got generated.

[crystal steeple]

how do u authenticate to that account in nessus skills assessement im confused

[fathom pendant]

https://ip:nessusport

[storm hedge]

Anyone?

[crystal steeple]

thanks

[median kettle]

for anyone curious, i managed to pop windows section for the dnsadmin group

what worked is running gpupdate /force then logout/login

may have to try a few times but it will work

[shrewd hazel]

i got the answer right but dont know how. how do i actually tell with concrete certainty the number of zones on the target name server? i got like 15+ items here

[fathom pendant]

hint: localhost

[shrewd hazel]

i dont get it lol

[fathom pendant]

the NS one is well the nameserver

[shrewd hazel]

so server and address, thats how i get the 2?

[fathom pendant]

yep (basically)

[shrewd hazel]

because when i use just inlanefreight.htb it responds back with way more

[fathom pendant]

yes

because that's showing all the records that exist

on that server :)

[shrewd hazel]

and for the question it specifies the nameserver only ohhh

[fathom pendant]

it does not mean that's all the zones

[shrewd hazel]

okay okay that makes sense

but for the nameserver, that is all the zones

[fathom pendant]

you're missing another one

(localhost got you thinking of the ns one, look for another one there)

[shrewd hazel]

what do you mean?

nslookup -query=AXFR ns.inlanefreight.htb (IP)

got me the answer of those 2 zones

[fathom pendant]

i'm staring at one of your screenshot

and there's two localhost ones

ns and another

[shrewd hazel]

internal.inlanefreight.htb?

[fathom pendant]

are you asking or telling

[shrewd hazel]

thats the one with localhost ip

[fathom pendant]

[shrewd hazel]

but thats not a zone for ns.inlanefreight.htb

[fathom pendant]

[lusty thicket]

[fathom pendant]

it's a zone for the provided IP

(which also happens to be the ns

[acoustic owl]

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[shrewd hazel]

so then are all those other name and address combos zones too for the provided IP?

[fathom pendant]

they can be but they don't necessarily have to be

[acoustic owl]

Read the DNS topic carefully again.

[full nimbus]

For those interested, I used the latest SharpHound collector, not the one present in the HTB boxes, and data is much better now

[shrewd hazel]

thank you, feel a bit lost on this based on what HTB academy provided (not to be that guy)

[fathom pendant]

DNS can also be a bit tricky tbh

[acoustic owl]

Read the pages on Cloudflare. DNS is actually explained quite well there

[fathom pendant]

^ that's the best explanation of DNS i've read so far

https://www.cloudflare.com/learning/dns/what-is-dns/

this is also a good read

[rustic sage]

dig

[lusty thicket]

think of them as resource records for that zone

[rustic sage]

im getting this error:

└──╼ [★]$ sudo php -S 0.0.0.0:80
[Tue Jan  9 21:07:18 2024] Failed to listen on 0.0.0.0:80 (reason: Address already in use)

running sudo netstat -plnt gives the following

└──╼ [★]$ sudo netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/init              
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      4305/python2.7      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      3703/sshd: /usr/sbi 
... ```

if i try to kill the python process with ``kill -9 4305`` it just restarts again. what should i do? i tried listening on the server with port 81 instead but i dont think that works for this module.

i also went to /etc/systemd/system to see if there was a service restarting it but there is no mention of "python" in the folder

[fathom pendant]

port 80 on the pwnbox is what's serving you the vm to the browser

[rustic sage]

the module says port 80... pretty weird for them to do that if you literally cant use it

[fathom pendant]

you can use 8000,8080

those are common alt ports for http

[rustic sage]

this is in the session hijacking part of the xss module, where we attempt to get <script src="http://OUR_IP/script.js"></script> to run on the server side, would running with port 8080 still work for that?

[fathom pendant]

you'd need to add the port after OUR_IP

(OUR_IP:port)

[rustic sage]

yeah i did that

must be somewhere else im going wrong then

thanks for the help

[maiden field]

Understanding Log Sources & Investigating with Splunk
Using Splunk Applications

Access the Sysmon App for Splunk and go to the "Reports" tab. Fix the search associated with the "Net - net view" report and provide the complete executed command as your answer. Answer format: net view /Domain:_.local

I found the command || sysmon process=net.exe (CommandLine="net view") | stats count by Computer,CommandLine || but it's not really related to the question I think I don't understand the question correctly

[winter arrow]

I’m stuck on the footprinting easy lab idk what to do any advice

[fathom pendant]

enumerate

find open ports: figure out what you can do with those

[lusty thicket]

scan both tcp & udp

[rustic sage]

read @fathom pendants bio

[median kettle]

on windows privilege escalation module for the server_admin portion, are you suppose to crack the administrators password hash?

[rustic sage]

Have anyone of you guys went through all the Fundamental modules despite working in industry already? I am just doing it right now, refreshing some knowledge and making sure that I know the basics. Curious if someone else has done it.

[median kettle]

ive gotten through most of it

[timid comet]

Yeah i did it but their linux module sucks.

[tawdry vapor]

anyone can help me with ATTACKING COMMON APPLICATIONS - PRTG - Attack the PRTG target and gain remote code execution. Submit the contents of the flag.txt file on the administrator Desktop.?

[charred fable]

In starting the point
How do I submit the root flag ?? 🤔

[fathom pendant]

#starting-point is it's own section

but there's a text field in it

usually the last question of a machine

[charred fable]

when I nmap -v "ip nr"

it says its down

[fathom pendant]

what is "nr"

unless you're just referring to the IP

you don't need to specify saying "IP number"

[charred fable]

IP

sorry

[fathom pendant]

some windows machines don't respond to pings so needing to do -Pn

[charred fable]

I tried but it gets stuck or something I have to cancel

[fathom pendant]

"gets stuck"

[charred fable]

maybe not stuck but didnt finish

[fathom pendant]

some scans do take a few minutes

you just gotta have patience

[charred fable]

ok

[tawdry vapor]

anyone? 🥹

[silver iris]

you can press space to see progress

[fathom pendant]

you'll get more flies if you actually ask your question

[charred fable]

I remember u told me something about VM switches off , did you mean that I loose connection when I switch to Discord or other softwares or what ?

[tawdry vapor]

I created a notification like the one in the module, then I tried to run crackmapexec, but it didn't work

[fathom pendant]

?

when you shut the vm down you need to reconnect to the vpn when you turn it back on

it has nothing to do with switching software

[charred fable]

ah ok because I keep loosing the connection on HTB lab, dont understand why ..

[fathom pendant]

then message website support/change vpn region

[tawdry vapor]

I don't know what I'm doing wrong

[charred fable]

when I nmap -Pn It says all 1000 are in ignored states
tcp no response ...

[storm hedge]

Anyone regarding my question for crackmapexec please?

[next bronze]

where

[fathom pendant]

ps aux |grep openvpn if you have more than 1: then you're running multiple

also #starting-point is for the starting-point machines

:)

[winter arrow]

I meant actually helpful advice

[fathom pendant]

i mean if you included what you've already tried, we can give you more pointed advice

otherwise it's a skill issue; the links in my BIO are for some good reads

https://dontasktoask.com is a good read on how to ask questions in a forum

[storm hedge]

@next bronze reharding the last 2 questions for the skill assement

[silver iris]

If you cant tell where and how you are stuck, you asking other people to think for you

[fathom pendant]

the most advice we can give with 0 info is: enumerate

double check the sections on revealed ports and how to get at them in a meaningful way

[next bronze]

yes what is your question

[fathom pendant]

we're not gonna tell you to "well do this first, then that, then this" because that defeats the purpose of you supposedly having learned this stuff from the module

[tawdry vapor]

🥺

[storm hedge]

@next bronze I can't answer the last 2 questions

[livid zephyr]

do we have a troubleshooting forum for academy? I have being experiencing connections issues during different exercises. I did re-download the VPN file just in case and didn't work.

[winter arrow]

I scanned the box and I’m trying to find a way to dump the private key

[storm hedge]

Ineed some help hints, ....

[charred fable]

I had only 1 =/

[winter arrow]

Nmap won’t give me a version on 2121

[next bronze]

how am I supposed to give them when I don't know what you have and what you have tried

[fathom pendant]

you don't need version

[storm hedge]

@next bronze Can I post here or is it spoiling?

[fathom pendant]

ftp supports a command like "get"

[next bronze]

just tell me what users you have, put it in spoiler tags

[lusty thicket]

scan both tcp & udp

[storm hedge]

||james, juliette,intern30,svc_devadm,atul||

[next bronze]

spoiler tag is || at both ends but check ||gmsa||

[winter arrow]

roger that

[storm hedge]

@next bronze I have that service account

[manic onyx]

Is there a reason I can't find the High Level Alert with ZAP Scanner for the Web Proxies module? I had to manually find the vulnerability and exploit it myself. I tried using active scans with full complete settings enabled on both my local machine and the pwnbox and got zero high alerts.

[next bronze]

oh right, check what interesting programs is installed that can be abused

[manic onyx]

I reset the instance multiple times as well

[storm hedge]

@next bronze ok, I will try, thanks
I searched for keepass briefly but haven't found it, i will retry tomorrow

[hardy socket]

guys & girls, need help with the last question of NTLM Relay Module, lesson "NTLM Cross-protocol Relay Attacks". I've run: 1. sudo ntlmrelayx.py -tf relayTargets.txt -smb2support -socks (#after suod su -); 2. started the Responder 3. proxychains -q mssqlclient.py INLANEFREIGHT/nports@172.16.117.60 -windows-auth -no-pass (#this errors out as connection refused). Can someone point out to me where i went wrong?

[next bronze]

that should be pretty obvious what you need to do, read the sections again

[livid zephyr]

i am working the web proxies module and I experiencing connectivity issues trying to access the exercises. Had you have any issues with them?

[fathom pendant]

read carefully: you do have creds

[manic onyx]

I haven't had any issues connecting

[fathom pendant]

if it's the one with 2121

[livid zephyr]

thnaks, I guess is something in my end then.

[rustic sage]

that's why i said read their bio, it will help you to ask the right question

[winter arrow]

ah my bad g

[next bronze]

you should target mssql specifically in your relay targets

[storm hedge]

@next bronze thanks,
I probably missed somethingin the course

[hardy socket]

I tried that as well. I have also tried doing all://ip after switching responder's servers off, but both to no avail

[next bronze]

try to follow the steps in the module, and make sure the username is right

[hardy socket]

this is my command: root@ubuntu:~# sudo ntlmrelayx.py -t mssql://INLANEFREIGHT\NPORTS@172.16.117.60 -smb2support -socks and the output is this: Connection from INLANEFREIGHT/NPORTS@172.16.117.3 controlled, but there are no more targets left

[fathom pendant]

flip the \

[next bronze]

pretty sure you're supposed to put only proto and ip in the ntlmrelax target: mssql://172.16.117.60

[hardy socket]

that's how it's taught in the lesson but I've tried both ways and still nothing

[hardy socket]

tried that as well but the only response is SMBD-Thread-67: Received connection from 172.16.117.3, attacking target mssql://172.16.117.60
[-] Connection against target mssql://172.16.117.60 FAILED: [('SSL routines', '', 'no protocols available')]

[hardy socket]

I've been at it since yesterday and it's slowly driving me crazy. Every other question went fine.

[next bronze]

hm let me check it

[hardy socket]

Thank you, it might be something completely stupid on my part but I'd really like to know what it is then

[median kettle]

for the server_adm section, are you suppose to crack the windows ntlm hash to get admin access?

for windows privilege escalation module

[next bronze]

I just copied the 3 commands and it worked

[next bronze]

you can always pth

[dim girder]

Hello all - im doing xpath blind exploitation.
I have xfiled the nodes name but when i start exfiltrating the number of child nodes im confused by what I am reading. I know i have the right number of child nodes. But what does it mean we can return the the previous step? none of the previous steps do a successful message sent prompt when i try what i am told to reveal the schema

[dense crag]

What is all this related to?

[hardy socket]

I just retried it and still not capturing socks with nports

[dense crag]

Coding?

[next bronze]

ah ok I see the problem

ntlmrelayx.py -t mssql://INLANEFREIGHT\\NPORTS@172.16.117.60 -smb2support -socks

[next bronze]

computers

[lusty thicket]

technology

[fallow snow]

Looking to get some help if possible. I'm going through the Web Enumeration section, within the

[dense crag]

Ohh

Like all u guys want to be hackers?

[fallow snow]

Looking to get some help if possible. I'm going through the Web Enumeration section, within the "Cracking into Hack the Box". Trying to do a whatweb on the target, curl and a goBuster is all failing/timing out.. Would anyone know why?

[dim girder]

failing and timing out? make sure the target is active as silly as that may sound if i understand your question

[fallow snow]

Target is indeed active, showing 80 minutes of life left. :/

[lusty thicket]

can i see your command?

[fallow snow]

whatweb 83.136.253.251
ERROR Opening: http://83.136.253.251 - execution expired

Do i need to include the port? The example above didn't..

[lusty thicket]

whatweb http://ip:port

try

[fallow snow]

yup, that worked. Assuming that would be teh same for Gobuster?

[lusty thicket]

yes

[fallow snow]

gobuster dir -u http://83.136.253.251/ -w /usr/share/dirb/wordlists/common.txt

Error: error on running gobuster: unable to connect to http://83.136.253.251/: Get "http://83.136.253.251/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

ah yeah, adding the port fixed it. Thank you @lusty thicket

[hardy socket]

ok, i deserved the frustration. I tried this exact command but when i did with the domain and the user I misspelled the username (used the question spelling which is NPORT and not NPORTS)...

[hardy socket]

Thank you, it was kind of you

[dim girder]

has anyone done the senior web app module?

im stuck and its not a technical thing but odd wording in the doc

im doing xpath exfiltration

[next bronze]

happens, but check the usernames next time, both ntlmrelayx and responder output the usernames, also the first thing I asked you to do

[fathom pendant]

Hackers can't splel

Likely the step just above. Or the previous section

[dim girder]

it...doesnt work

i dont understand why whoever wrote this document didnt add an example..."step" there are none and you want me to plug this in where and how much of my payload to change?

2 days

[fathom pendant]

I mean is it not the XPath code just above the image?

[dim girder]

correct

and I added the /users/*[2] but in place of users i used the account i exfiled. i get user does not exist error

[fathom pendant]

Try changing the =1 to =2

Which is what the image shows

Don't use brackets

See if you get info that way

Also discord is formatting your messages

[dim girder]

count is a function

[fathom pendant]

To prevent this. Wrap in backticks (`)

review the example image

Do what it's doing

[dim girder]

yes if you mean the 1 and 2 are not after asterix also tried that

right?

[fathom pendant]

I haven't done this module, just walking through how I'd approach it ¯_(ツ)_/¯

[dim girder]

yeah

[fathom pendant]

Just review what it's taught so far

[dim girder]

will do just annoyed its because the writing is weird

[fathom pendant]

It looks like it wants you to put that code into the bracket, not just the direct number

[dim girder]

day 3

i have

its succssful but i dont get what it says

[fallow snow]

I'm back for more help.. I'm now on the Exploits section for Cracking into HTB and trying to nmap my target, although it comes up with the following..

$ nmap -sV 83.136.250.104
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-09 23:58 GMT
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.20 seconds

I then try to add the -Pn Flag and it fails to provide more info..

$ nmap -sV -Pn  83.136.250.104
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-09 23:59 GMT
Nmap scan report for 83-136-250-104.uk-lon1.upcloud.host (83.136.250.104)
Host is up (0.0070s latency).
All 1000 scanned ports on 83-136-250-104.uk-lon1.upcloud.host (83.136.250.104) are in ignored states.
Not shown: 915 filtered tcp ports (no-response), 85 closed tcp ports (conn-refused)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.51 seconds

I'm trying to get the versioning of the services running on the domain, and I believe I should be using the -sV flag to pull this right?

[fathom pendant]

You're given a public ip and port

Nmap won't be useful

[fallow snow]

Ah ok, so would nmap only be useful when you have just an IP and no port?

[fathom pendant]

Explore different enumeration methods, i.e. visiting the page in a browser

[fathom pendant]

Well. To be more specific, public ip = not internal - so throwing Nmap at it is like scanning a random website

[fallow snow]

Oh, so I've completely mis-understood the use case 😄 nmap is for internal IP's and Web Enumeration is for Public IP's?

[fathom pendant]

If you want accuracy with Nmap in these cases you would be -p port

[fathom pendant]

Basically, 99.999% of public facing ips are websites

And in the case of htb: it will almost always be one, unless directed otherwise

[fallow snow]

okie doke. Thank you! I'll keep plugging away at it! 😄

[fathom pendant]

I suggest the intro to networking module

[fathom pendant]

Also fwiw the module is called Getting Started, not Cracking into HTB (that's the name of the path you're doing)

That's how I know where you're at

[fallow snow]

Ah, my bad. I'm providing the path name

Appreciate it!

[fathom pendant]

Module is generally in the title of the page or all the way at the top, then section name is well what part of the module you're doing

A lot of paths share modules

[fallow snow]

Ya, apologies. At least next time I'll be more accurate in telling people where specifically I'm asking for help. Thank you again!

[next bronze]

it's not necessarily true, nmap is good for probing what ports are open and what services are running, in this case you were given one port so it's less effective. it all depends on the situation, you'll learn more on how to use it as you go further into the path

[fathom pendant]

Not in the Cracking into HTB path. AFAIK that's only a few modules

[next bronze]

ah right, meant the cpts path then

[fathom pendant]

I dont think it includes network enumeration with nmap

[fathom pendant]

After this module: highly recommended the information Security foundation path

The linux one can be a little frustrating

[tough coyote]

Has anyone attempted the Supply Chain Attacks: DevOps not so secret Module?

[fallow snow]

Ok, thank you. I'll be sure to check that out!

[fathom pendant]

Just ask your question.
https://dontasktoask.com

[fathom pendant]

I will say, you did a good job of providing what you've done so we can guide you better

[tough coyote]

I need assistance or guidence on this.

[fallow snow]

Thanks, I have an IT background. So fully relate to the pain of someone asking for help and providing little to no information.

An update, I have managed to find out a version and now seeking an exploit 🙂

[fathom pendant]

OK. But you haven't actually stated your question, what you've done/tried

We can't help you if you don't provide us more than just "I'm stuck"

[fathom pendant]

It's pretty simple from there if I remember

[fallow snow]

Now you've done it, watch me stuff it up! 😄

[fathom pendant]

You'll find I tend to word things with a purpose

[tough coyote]

I trying to send a screen shot

[fathom pendant]

To avoid spoiling as much as possible while still nudging

[fathom pendant]

You need to link your main htb account to send screenshots #welcome

[fallow snow]

Its appreciated 🙂

[fathom pendant]

It's this way to prevent skids and dumbasses from posting troll images

[fathom pendant]

Not to mention. 9 times outta 10, the info is right in front of you

[shrewd hazel]

omg @fathom pendant and @lusty thicket i think i get the dns nameserver zone thing so when i typed in this: nslookup -query=AXFR inlanefreight.htb 10.129.87.222 and got that big list, we have the ns on that ip address and then there is a localhost address with ns in it as well, meaning there are 2!

does that sound accurate? sorry, just had a break through lol

[fallow snow]

For sure, sometimes you (I) end up overcomplicating it in my head

[fathom pendant]

👍

[fathom pendant]

"It can't be that simple"
Narrator: it was

[limpid peak]

ok still at a lost

[chrome osprey]

sooooo.... new to HTBA. I am stuck in the windows event logs and find evil - looging basic. Trying to find the executable that triggered the event with ID 4624

[fathom pendant]

follow instructions in #welcome to link; you'll need an HTB Labs account to link it

there is no account identifier for academy

[tough coyote]

took a while with my southern education lol

So this is what I have so far

[fathom pendant]

replace the ip from the example with the ip of the spawned machine

:) if you didn't spawn the machine: then that will be why

[tough coyote]

How you spawn it

[fathom pendant]

i suggest you do the "getting-started" module

and "introduction to academy" module

that explains how to interact with academy

[fathom pendant]

but in short: green text that says "Click here to spawn target"

[fallow snow]

ngl, I'm struggling to find the right exploit to use... 😄

[fathom pendant]

visit the webpage; it's kinda hard to miss

[fallow snow]

Ok, so im on the website, assuming it's a ||plugin exploit?||

[tough coyote]

yes

[fathom pendant]

bingo

[fallow snow]

I just tweaked the search. I think I got it now.. jesus it's too late 😄

[fathom pendant]

i'm not reading this for you

the spawn target is gonna be above the questions

[fallow snow]

I must be actually stupid, the exploit is failing because auth failed to the target.. Do I need to do multiple exploits here?

[fathom pendant]

you don't need auth

it's only one exploit

[fallow snow]

This is the one I'm trying to use ||exploit/multi/http/wp_plugin_backup_guard_rce 2021-05-04 excellent Yes Wordpress Plugin Backup Guard - Authenticated Remote Code Execution||

oh my

I am so sorry....

[thorn urchin]

well if the exploit says it needs to be authed and you dont have auth, then its not gunna be it

¯_(ツ)_/¯

[fallow snow]

I was just searching the wrong thing for the past 30 odd minutes...

[fathom pendant]

simple

it's part of the plugin's name too

[fallow snow]

I told you... 😄 I was searching ||Wordpress|| not the bloody || plugin name||

[tough coyote]

Ok I am at this point trying to get Jenkins creditials

[fathom pendant]

did you add the gitea and jenkins .inlanefreight.htb to your /etc/hosts?

[fallow snow]

And done, that was the hardest challenge yet. But at least I know how to use MSF now 😄

I really do appreciate the help @fathom pendant 🙂

[fathom pendant]

np

[thorn urchin]

yeah general advice with wp is that vulns are almost always going to be just plugins or themes. WP core vulns are pretty rare.

[fallow snow]

Awesome, thank you!

[shrewd hazel]

another dns zone to check essentially?

[tough coyote]

yes, now trying to go str8 jenkins

[fathom pendant]

because it's 127.0.0.1

also careful with your screenshots as they can be spoilery

while you did block out the answer in the one, the answer is still contained in the other screenshot @shrewd hazel

:)

[shrewd hazel]

deleted 🙂

but what does it being localhost address have to do with it?

im confused on that seperation of dns zones here, or maybe thats the whole point why it was different lol

bc that was the give away to further investigate that one with the localhost ip

[fathom pendant]

the IP controls 2 zones :)

and generally a zone will be tied to the same machine

[tough coyote]

its been added

just at app1

[last tiger]

Hi - wondering if anyone can help. I'm trying to load the Pass The Hash Target, and it keeps hanging at Target Is Spawning. I've tried logging out fully and logging back in. Any ideas?

(my vpn is connected as well. I'

*I'll try re loading another VPN connection file

[next bronze]

change vpn servers

[last tiger]

will do

[molten sequoia]

Hello 👋

Kindly can I have some help regarding injection attacks module assessment challenge I’m able to retrieve the local files but not able to access anything via http, I thought that the solution in combination between xpath injection and ssrf but cannot understand or think how to perform that as I tried some ways but no luck so any help please

[supple gorge]

Can anyone explain the following from the Web Requests mofule (POST section):

"as would be the case with a file uploaded through a GET request."

Can you upload a file through a GET request? Is it like, exfil through a GET request's field?

[molten sequoia]

Kindly can help @misty current

[molten sequoia]

@round sable kindly can u help

[last tiger]

tried switching to new VPN, from udp to tcp, target still won't spawn

[supple gorge]

maybe change region to EU or some others?

[last tiger]

I've also rebooted both my pc and vm

[last tiger]

I'll try that

[next bronze]

it can by encoding the file and sending it as a url parameter, but it's strange that it's included in the post section

[supple gorge]

It's comparing why POST is "better" than GET for file upload... so that can be done, cool beans thanks :))))

[last tiger]

EU/TCP finally worked, maybe there's maintenance going on US servers

thanks for the help

[rustic sage]

waiting for the target to spawn after 30 whole minutes......

[molten sequoia]

Yes

[misty current]

What do you mean by not being able to access anything via http? Have you retrieved the source of the internal application?

[inland mesa]

Down for me too. Their systems are down it usually takes a few hours to fix 😭

[molten sequoia]

When using js code like the following to access the internal application, it always responds to me with ||host not found or connection refused on the other ports ||

<||script>
xhzeem = new XMLHttpRequest();
xhzeem.onload = function(){document.write(this.responseText);}
xhzeem.onerror = function(){document.write('failed!')}
xhzeem.open("GET","http://127.0.0.1:80");
xhzeem.send();
</script>||

||<iframe src=http://127.0.0.1:80></iframe>||

||But I was able to retrieve the /etc/passwd||

[misty current]

Ah, you haven't found the right ||port|| I believe nothing is running on 80

Also, make sure to cover sensitive information with spoilers

Don't want to spoil others yaknow?

[molten sequoia]

Ah got it, many thanks bro and will make sure to cover sensitive info

[misty current]

There are two approaches you can take to find the ||serivce port||. I'll let you think about it. You can let me know if you are still stuck.

[misty current]

Nice, you can directly edit it and hide them with spoilers

[rustic sage]

It has returned the prophecy can continue!

[inland mesa]

Not for me rippppp

[lethal lava]

There is a URL payload that executes XSS due to prototype pollution.
I have identified an operation that the administrator can execute, but I can't think of a way to exploit it. Is there a way to...
The question is Client-Side Prototype Pollution in the Whitebox Attacks module.

[misty current]

Haven't done the module but, if you got XSS, first thing that comes to my mind is CSRF.

[misty current]

But, again. I haven't done it and I'm giving you ideas.

[tawdry vapor]

can anyone help me??

[heavy marsh]

ACL Abuse section, I'm getting an error:

This is following the lesson verbatim, with the exception of picking my password for the wley user

Ignore teh first error.

[thorn urchin]

really?

[heavy marsh]

The machine is slow

[heavy marsh]

I entered the command twice

[thorn urchin]

"I followed everything except I made up a password for the user im authenticating as, why am I getting an error that the username or password is incorrect?"

[heavy marsh]

So the second error in red is the one.

[thorn urchin]

Im aware

why would you enter a wrong password for wley on purpose

[heavy marsh]

This is all it showed. I thought I picked a password based on the <PASSWORD HERE>

[thorn urchin]

you dont pick a password

you use the correct password

[heavy marsh]

Am I somehow supposed to know wley's password

[thorn urchin]

yes

from earlier sections

[heavy marsh]

Good to know thanks, I'll go dig for it.

[thorn urchin]

read what $Cred is doing for you here

youre not making up credentials, its how you authenticate as a different user for a powershell command

so the credentials have to be valid

[heavy marsh]

I don't see the wley password in the previous modules.

Do you remember what module it was?

I have forend, sgage, and vmware

[next bronze]

did you run the notification

[thorn urchin]

it doesnt tell you outright, you find it as part of the labs

iirc

wley might be early enough that it just told you but idr for sure

[next bronze]

it actually does tell you outright, look harder

[heavy marsh]

Ah, found it, thanks

Is there a reason I got this error and it still added damudsen?

[fathom pendant]

read carefully what the error is

[marsh echo]

hello everyone? which wordlist should I use to find the host that holds the byte I'm looking for? for the last question ? because i can't find 😦 https://academy.hackthebox.com/module/112/section/1069

[fathom pendant]

2 parts of this, make sure you're looking at the right subdomain; 2 it's a very fierce list

the final answer will be like a.b.inlanefreight.htb

[marsh echo]

okay thanks 😉 I'll test and get back to you here

it's weird can't find the domain with the ip ending with 203 :/ i did all the zone transfer of the domain

[acoustic owl]

Remember that a zone can be configured to only allow zone transfer from specific servers.

[fathom pendant]

using the bruteforce tool that's shown in the module should be how you get it

[marsh echo]

thanks 🙂 I'm doing a brute force on the internal subdomain I don't know if it's useful but we'll see.

[fathom pendant]

go through each subdomain until you get the answer ¯_(ツ)_/¯

that's all we can really do; 90% of the way there, just gotta use the right one

[marsh echo]

yes that's what i did with dig axfr but nothing i'll try again surely i missed some information

[fathom pendant]

axfr won't get you far

this is why the hint for the question references wordlists

[marsh echo]

I still don't see what I'm doing wrong :/

[fathom pendant]

dnsenum

you need to/should be using that tool

like i said it's directly mentioned in the section

also fierce hostlist misses on some of the actual subdomains present on this host

[fathom pendant]

since you can already zone transfer to inlanefreight.htb; why not build a subdomain list based off that first

then use that to determine how to attack the problem

[rustic sage]

god it took me, 7 hours to get through 3 sections of the password attacks module

only...6 more sections and then i reach the final skills assessments. 😭

XD

[exotic bison]

How do I learn to hack machines?

[rustic sage]

just happy i did everything mostly without help

[exotic bison]

I am learning a lot of stuff but seems like they are in disarray

Where can I find topics in order that will guide me towards hacking machines?

[rustic sage]

lol dude you just need to do the modules.

the pentesting path

[exotic bison]

no money in pocket

capitalism already robbed me

[fathom pendant]

as i said; that wordlists skips over a very important subdomain

[rustic sage]

viva la resistance!

[exotic bison]

Ai, maaaate!

[fathom pendant]

information security foundations path and cracking into htb path

first do a regular dig against that subdomain and you'll see what you missed

[exotic bison]

could use some free resources for now

[fathom pendant]

the tier 0 modules ARE free my dude

[marsh echo]

ahhhhhhhhhhh okok sorry my brain is starting to burn it's 7 o'clock I'm starting to get saturated lol but I'll figure it out before I go to sleep

[fathom pendant]

once you complete them you get the 10 cubes back

[rustic sage]

I would suggest but this is HTB talk only

[exotic bison]

can I DM you or is DMing not allowed here?

[fathom pendant]

my strat was dig axfr inlanefreight.htb @ip | grep -E "\bA\b" | cut -d "." -f 1 | sort -u for my list to start with

[rustic sage]

nah; I don't trust your intentions, wouldn't tell you personally.

[fathom pendant]

then you can either manually sub each subdomain in with dnsenum; or do a loop

[rustic sage]

you plannin something illegal i can smelly

[fathom pendant]

Google is a free resource :) the starting-point machines have walkthroughs which you can use to study

[exotic bison]

My intention is only to take control of your credit cards and crypto wallet. I don't want anything more than that. You have my words on that, bro

[rustic sage]

I knew it! >.<

[exotic bison]

I was always a man of pure intention

[exotic bison]

that's right

but the problem is things are disorganised

[fathom pendant]

well yes, there's a lot of assumptions made in starting-point. i.e. you have a working knowledge of linux basics

[rustic sage]

It's 1AM where I am, I want to finish pth stuff, but my eyes are stinging

[exotic bison]

I know Linux command line basic, basic networking like tcp/ip, a little bit of nmap and wireshark, web vulns like sqli, xss, command injection and getting reverse/bind shells. What should be my next topic to start hacking machines?

it seems like i am learning stuff but cannot see how they fit in the big picture

[fathom pendant]

like i said: do starting-point to gauge your knowledge

[exotic bison]

that's what's giving me "I am not going anywhere" feeling

[fathom pendant]

but this isn't the chat to really have this conversation: read #welcome

[exotic bison]

okayy

[fathom pendant]

attempt an easy machine, see how you feel about it with your current knowledge

google the gaps that come up

[rustic sage]

remember nibbles? xD

crazy little rollercoaster nibbles was on the getting started module i'll never forget it

[fathom pendant]

¯_(ツ)_/¯

looking back it makes sense

[rustic sage]

using tools like gobuster and uploading exploits then the last piece of the puzzle

never heard of anyone adding sudo privileges on a program to a user though. I didn't even know that was a practice

[fathom pendant]

sticky bits/suid bits

when did i tell you to do it against internal?

my command was explicitly for inlanefreight.htb domain

:) btw dnsenum can take subdomain.domain

[marsh echo]

aaaaah

my bad

[fathom pendant]

since internal.inlanefreight seems to be a dead end; STOP GOING AFTER IT

that's the problem; you think there's more to gain - when there's not

[exotic bison]

really cool privEsc stuff

[fathom pendant]

gtfobins is goated

[exotic bison]

After learning it I was having some evil thoughts 😈 My college PCs don't have admin privileges. I was thinking of PrivEscing and getting admin 😂

Then finally I would be able to install and play some games during my class breaks 😴

[fathom pendant]

careful with that :) likely to have disciplinary action if caught

[exotic bison]

I wouldn't do anything to cause harm. Just would have some fun during my break time

so I guess I should be safe

[fathom pendant]

it's still likely against policies

just do what people in my school did to install halo: find a writable folder to install into :P

[exotic bison]

Yeah. But I don't think our admin is skilled enough to spot me

[fathom pendant]

99.99% of the time, they know

also the admin isn't gonna be the tech person

[exotic bison]

Even our website is super buggy and easily gets down under small visitor load

[fathom pendant]

i.e. my school had a "tech liason"

most school websites are built like ass

either way

[exotic bison]

I guess I need to clear the logs then?

[fathom pendant]

not the place to discuss this; read #welcome on how to access more of the server

there's places like #general and #starting-point

[rustic sage]

🚓

[fathom pendant]

also instead of just doing something silly like installing some shit software; why don't you learn how to make their infra better :) and offer to help as a school project

[thorn urchin]

bro thats still a crime

that you could face jail time for

[exotic bison]

They are not welcoming

[fathom pendant]

Then imagine how they'd react if they found out you installed a game :)

[exotic bison]

I am already in a jail named "Capitalism"

[next bronze]

not causing harm still doesn't mean it's the right thing to do

[fathom pendant]

cringe

[exotic bison]

No!

[thorn urchin]

bro idgaf, its your life to fuck around and find out with not mine