modules

[fathom pendant]

man uname

[mint gale]

It was my mistake indeed. In another session of this module, it teaches how to enumerate users and create my own list, but I had forgotten about it. I managed to figure it out here, thanks anyway for trying.

[gray shoal]

trying to find my next answer in the ip config but it doesnt show help or manual

htb-student@nixfund:~$ man ipconfig
No manual entry for ipconfig

[thorn urchin]

ipconfig is windows

[fathom pendant]

because it's ifconfig in linux

[thorn urchin]

ifconfig is deprecated

[fathom pendant]

if standing for interface

[thorn urchin]

its now just ip for modern distros

[fathom pendant]

yep

[gray shoal]

im trying to find how to answer this : What is the name of the network interface that MTU is set to 1500?

[fathom pendant]

ip a

[rotund sphinx]

i guess its not really a direct question about a particular module but starting to notice a bit of a trend in these password modules where it shows a bunch of steps of how to get a particular bit of data by rdp and then passing it back to an smb share on attack box and then using some program to parse it, which i have learnt some things from that as well as the actual info extracted

but then it goes on to say you can skip all of that and use crackmapexec to get the data instead, im starting to wonder is there a reason why i would go through the steps manually rather than crackmapexec 🤔

[fathom pendant]

multiple ways to crack an egg

sometimes crackmap might not give you the answer or work in the way you want

[supple gorge]

if you have machine access, wouldn't it be better to not mete out an "attack" through the network.

Correct me if I'm being silly pls

[fathom pendant]

mete?

many things you can do with machine access

sometimes there's plaintext creds in an easily accessible file

[gray shoal]

i found the answer with chat gpt help, it gave me this command : ip link | awk '$5 == "1500" {print $2}'

am i really was suposed to come up with that answe alone from the module?

[supple gorge]

launch out an attack thorugh the network

[fathom pendant]

there's a much simpler way without that

ip a

look for where it says MTU 1500

[fathom pendant]

it just depends tbh

[gray shoal]

but it didnt talk about MTU and then that question

[supple gorge]

that's true. depends on the attack too, and whether there is creds or not and all

[gray shoal]

how could i know its ip a

[fathom pendant]

ip a lists all interfaces and info

and ip a sure does have MTU in it

since you have the answer; look at that interface with that command and you'll find it

[rotund sphinx]

unless you have hundreds of interfaces (eg if the machine is running docker) running either ip a or ifconfig and then looking at the output it should show the mtu values for the different interfaces

as you get more used to using linux command line you will be able to filter the output of those eg ip a | grep 'mtu 1500'

(grep is very useful to be able to use not just for this)

[supple gorge]

@fathom pendant What do I gotta do to earn DM rights lmao.

Can I DM once I get answer for the CDSA exam?

Or do I gotta wait until I'm on a module and you're the only one available and there's no other option other than sending a screenshot?

[thorn urchin]

step 1:

dont be weird

unfortunately I think youve failed in that regard already

[analog dock]

https://tenor.com/view/stinky-loser-tiny-kitten-explode-gif-15623895175038521381

[rustic sage]

Anyone done skill assesment for WINDOWS EVENT LOGS & FINDING EVIL. I have found the answer, but not intended way. What I've tried, issuing a xml query to search for different .dll's through sysmon, while having the exclude option enabled. Any pointers?

[supple gorge]

I just wanted to say hi 😭 Didn't know I had to work for it lmao.

Actually, I already sent hi, but it was never answered cuz i didn't properly ask

[supple gorge]

if you've found it, and used the tools taught, that wasn't unintended. Good job

[supple gorge]

what's the question asking?

[rustic sage]

"By examining the logs located in the "C:\Logs\DLLHijack" directory, determine the process responsible for executing a DLL hijacking attack. Enter the process name as your answer. Answer format: _.exe"

Well, I'm dreading for cdsa, want to make sure I got my bases covered

more like a lucky shot that i found the right answer tbh

[supple gorge]

Not sure, try seeing if anything shows on id 8 (i'm assuming you looked over id 7)

[rustic sage]

Looking through manually doesn't seem like a good way tho :/

might be wrong

[supple gorge]

Can I send you a hi message? I couldn't get a foothold on initial target lmao /j

[supple gorge]

Feel free to dm me more details on what I did. And I can tell you my thoughts

[gray shoal]

What is the index number of the "sudoers" file in the "/etc" directory?

htb-student@nixfund:/etc$ cd /etc/sudoers
-bash: cd: /etc/sudoers: Not a directory

how can i know the index number? and why i cant go there

to the file

[fathom pendant]

sudoers is a file

you can't cd to a file

ls is the command you're looking for

[gray shoal]

how do i find it index nubmer?

[fathom pendant]

ls -i /path/to/file works

[gray shoal]

thanks i just typed man ls and saw it

[gray shoal]

thank you very much for your help it really helps to get hint or explanation instead of just being stuck.

[fathom pendant]

think of it like this

ls = list stuff

[thin parrot]

Just asking ahead if I max out HTB (all modules eventually) will I be a ‘good’ pen tester

Assuming I truly absorb, understand, and relate all concepts

Im going in blind with a Software engineer background

[fathom pendant]

i mean in theory, yes

[cursive cradle]

We’re on the same boat (still studying though)

[thin parrot]

That’s good enough for me! Thanks

[rose sable]

Thanks

[thin parrot]

I started studying in high school and just graduated with my bachelors

I have been promised many jobs and all of them have vanished 😅 I’m ditching this field in favor of security… which has been my game plan all along I guess

If I had a dollar for every job app…

[cursive cradle]

😮

Dang, I’m still on the learning path, so yea, trying to get the hand also on this field

[unborn lantern]

hello hello

I finish Linux Fundamentals

[supple gorge]

congrats, keep it up

[unborn lantern]

thanks bro

hey someone wants to help me passing Networking

[molten owl]

Hello.

[thin parrot]

If you have any questions or homework help lmk lol

[molten owl]

I suck in SQL injections.

Can someone help me?

[unborn lantern]

ok thanks

[unborn lantern]

sorry but I don't have started that lesson

but look this video for help https://www.youtube.com/watch?v=YfZqz7o6BXU

[agile torrent]

someone probably can but they're not going to want to unless you actually ask your question

what do you need help with?

[molten owl]

Some tutorials

[thorn urchin]

well youre asking the modules channel

so the answers is going to be: do the sqli modules

[cursive cradle]

:0, thx also, and nice to meet you

[molten owl]

Yes

[thorn urchin]

There was nothing to yes there. I made a statement

you should probably read #rules and #welcome you seem lost

[onyx robin]

@supple gorge sorry if i did not replied but i was trying to resolve the problem...and at the end i did it...if you are interested, everything was fine, the only thing that the module don't tell is that for the LOGON tasks Windows have policies that block normal users to run tasks, by default only Administrator can run it! Once you add an user (in Local Group Policy Editor->Windows Settings->Security Settings->Local Policies->User Right Assignment->Log on as a batch job) it works!

[supple gorge]

oh, so you need to add the user you created the task from, the permission to Log on as a batch job, to allow it to create tasks with scripts to be run? very cool.

I did not know that, thanks for sharing

Good job on keeping at it

[onyx robin]

Yes! sorry again if i did not send you a screen...but i was working hard to do it and i completely lost discord! but i'm happy to share what i achieved with others 😉

[supple gorge]

Keep it up

[sterile epoch]

I am doing user enum using kerbrute but it is not storing the user list in a file

[fathom pendant]

Yeah, the output doesn't work properly

[sterile epoch]

so any idea what to do to store the usernames ?

[fathom pendant]

I forget what I did

[next bronze]

just use some regex to parse the output, and kerbrute isn't the only tool you can use

[sterile epoch]

the task said kerbrute so I was giving it a try

[gray shoal]

is kali linux or other linux disributors, is like my workstation in the hackthebox but just the real thing?

[fathom pendant]

I mean the pwnbox is also the real thing

The pwnbox is just an in-browser solution

[gray shoal]

if i understood correctly, the terminal after i use "interact" is the pwnbox which simulates the real linux?

[fathom pendant]

It's not simulating anything

[gray shoal]

can i work with the pwn box to hack some comuter for example? or i will need kali linux

[fathom pendant]

You can however doing things outside of htb with the pwnbox may violate htbs terms of service

[gray shoal]

so whats the difference between my terminal in hackthebox and linux disriutor like kali linux?

[fathom pendant]

Little to none

[gray shoal]

oh

so i dont need kali linux or something like that for now right?

only after i learned some

[fathom pendant]

The reason it's recommended to download and install your own vm is because it'll give you more control over the environment, like tools

[gray shoal]

yea im trying to learn things one by one and not download and get new subjects before i learned well previus subject

[fathom pendant]

It doesn't take much to set up any virtual machine

[supple gorge]

Marcie, correct me if I'm wrong, but there's a module that walks you through setting it up right

[fathom pendant]

Kali and Parrot both have .ova files for easy import into virtualbox

[fathom pendant]

Correct. Bonus points if you can guess what it's called lol

[supple gorge]

@gray shoal

[cursive cradle]

Ye, been watching that after trying to do something on the pwnbox one, like the VIM tutorial on linux fundamentals, had some things.....

[gray shoal]

thank you

[fathom pendant]

The other bonus to your own vm: you're not on a timer

[cursive cradle]

Need to reinstall ParrotOS there cause I dont remember the password there to log in

[fathom pendant]

If you used the .ova, it's parrot

If not: skill issue

[cursive cradle]

[rustic sage]

@thorn urchin can you tell me about your exam experience? Have you seen anything come from the obtaining the cert?

[thorn urchin]

I wrote a blog post

[rustic sage]

O yes I see thank you

[thorn urchin]

tldr: I loved it, and it made crushing OSCP easy and Id consider that 'anything come from obtaining the cert'

if youre asking about job, Im searching atm

[rustic sage]

Really??! It made OSCP easy? Thats cool

Have you found employeers to recognize the cert? Are they responsive?

[thorn urchin]

Searching atm

[rustic sage]

Or is OSCP still top dawg

Got it

[thorn urchin]

OSCP is def top dawg still

cpts builds skills, oscp builds resumes

[thin parrot]

Likewise! ^^

[cyan bramble]

Hey guys, I have an issue with question 3 of the web fuzzing skills assessment. I believe that I am inputting the right answer, but the site tells me it's wrong.

it asks for the full URL of a specific page, and I have supplied that url.

Are there broken questions in some of the modules?

NVM, search function solved it.

sorry

this question's wording sucks

[tight mesa]

hello there, sorry x the silly question, but is HTB Pwned machines experiencing any trouble?, I'm trying to spawn the Lab Windows Built-in Groups and is taking so long.....

[thorn urchin]

#modules message

[tight mesa]

thanks buddy....

[thorn urchin]

np, seems to be a platform wide issue, not much new info

targets have been spawning for me but just taking like 5-10 minutes to do so

[cobalt trench]

Footprinting DNS, I performed both of these commands using multiple different wordlists to bruteforce but none of them are giving me the FQDN I need. Am I on the right track or am I looking in the wrong place?

[fathom pendant]

subdomains of subdomains

a.b.inlanefreight.htb will be the answer

[cobalt trench]

so I need to replace the inlanefreight.htb with one of the subdomains?

[fathom pendant]

replace the b part of my statement so a.subdomain.inlanefreight.htb; if you want an accurate list of subdomains from the target use a zone transfer

[cobalt trench]

I dont think Im understanding what youre saying. Im trying the dnsenum command but with different variations of subdomains for inlanefreight.htb

[fathom pendant]

that's not the correct subdomain but that's the right format; the answer you'll get will be answer.subdomain.inlanefreight.htb

so you only need to do a first order subdomain, like www, internal, etc

[cobalt trench]

So Im on the right track. Just need to keep looking

[cobalt trench]

gotcha

[fathom pendant]

you already have access to internal via zone transfer so cross that off the list

[cobalt trench]

now we're cooking with fire (making progress)

[bright shore]

Anyone know why my antivirus is telling me HTB is using a Cobalt Trojan Malware?

Trojan.PowerShell.Cobalt.a

[agile torrent]

what are you doing currently?

antiviruses get mad at quite a lot of things we do

[tranquil whale]

hi

[rustic sage]

sup

[silk tulip]

alright so, every time i try to use smbclient on a windows box i get a timeout error. i have made inbound rules for file sharing on the target machine. anyone know whats going on?

[fathom pendant]

Try putting // or \\\\ before the ip

[tidal hornet]

only i have machine issue?

i can not ping

[fathom pendant]

Not just you. It's an ongoing issue

[tidal hornet]

ah then ok

thx

[thorn urchin]

I mean it could, be you

the known issue is with spawning, not with interacting with boxes after spawn

[plucky latch]

So... Attention to detail is important "Perform a DCSync attack and submit the NTLM hash for the khartsfield user as your answer." I got his NTLM hash 3 hours ago and have spent 3 hours trying to crack it lol... I'm not happy with myself right now lol

[agile torrent]

happens to the best of us

[fathom pendant]

Reading is hard ik

[barren anvil]

Hello!

I'd like to know if someone can give me a feedback or some hint to the exercise related to get simple cms.

Is in the getting started module

[steel grail]

I need some help trouble shooting\

been stuck for a while

doing linux fundementals and its asking me to upload a php script to the website, but I keep getting an error. kinda confused

[fathom pendant]

The error may be expected

[steel grail]

yes i understand the first one is suppose to recieve an error but the second one as well>

i uploaded the listening port one

[fathom pendant]

Yes

Because you aren't uploading an image, but it still gets uploaded

[steel grail]

yes i see

i did that, reverse shell doesnt seem to be working though

[fathom pendant]

Are you running the listener?

[steel grail]

im gonna try a couple more things

before i inquire further

[fathom pendant]

You need to have nc -lvnp 9443 before calling the php

[faint rampart]

Better than spending over an hour troubleshooting why nothing is working when you had misspelt a vhost entry in /etc/hosts inlanefreight.local turned inlanefrieght.local

[fathom pendant]

It's also important to change the default ip that the example gives to your tun0 ip

[steel grail]

yes, i replaced the ip with the target machine of my own

[steel grail]

yup

[fathom pendant]

This section is also very much a step by step guide

In either the browser or using curl you'll need to visit the url that has the php

Note; the page will be hanging because it's connecting to your machine

[worldly patrol]

Anyone working on advanced xss and csrf module for a quick chat?

[steel grail]

it is i understand, some of the code may have been copied wrong

[fathom pendant]

Perhaps

[steel grail]

werid. listener doesnt respond

[fathom pendant]

Then you may have copied the wrong thing

[steel grail]

do i include the whole php script including the <?php ?> brackets ?

[fathom pendant]

Yes

[steel grail]

i did do that

hmmm

[fathom pendant]

What ip did you put in the copy/pasted script

That needs to be YOUR tun0 ip

ip a

[steel grail]

not the machines ip?

[fathom pendant]

No

How is it gonna call back to you if you don't tell it where to call

I believe the section even says to change it to yours

[steel grail]

inet 10.10.15.42/23 scope global tun0
\

[fathom pendant]

Now what part of that would be your ip

[steel grail]

10.10.15.42

[fathom pendant]

Yup

[steel grail]

is the 23 the port?

[fathom pendant]

No

[steel grail]

i assumed not. thanks

[fathom pendant]

10.10.15.42/23 is CIDR notation

/23 refers to the subnet mask

[steel grail]

woop woop got it

[fathom pendant]

Now you gotta upgrade your shell

python3 -c 'import pty; pty.spawn("/bin/bash")'

[steel grail]

nope wouldnt let me

i got the flag already

😛

so did this basically let me browse around the server?

[fathom pendant]

That's only one of them, there's still root

[steel grail]

and thats how i got the flag?

[fathom pendant]

You're moving around the server as the web user

Unless you breezed through the privilege escalation portion

[steel grail]

priv escalation is the one im at right now

i just got to it

[fathom pendant]

Have fun

(This part can be touchy. But it works)

So do everything as shown. I suggest copy/pasting the other revshell into a text editor before pasting it into the existing shell for the command

[steel grail]

explain? confused why cant i just look at the files in the content directory then?

[fathom pendant]

https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/

[fathom pendant]

You can only access what that user can access

Upgrading a shell gives you a fully interactive shell where you can tab complete

[steel grail]

so i was essentially accessing the server as an admin without having to be on their computer

[dire abyss]

having issues with the module php web shells, i hope someone can help, i know its kinda late

[fathom pendant]

As a service user

[fathom pendant]

It helps if you actually describe your issues

https://dontasktoask.com

[dire abyss]

im following everything exactly however when i upload the php the site gives me no confirmation that the php uploaded "added new vendor netven to database"

[rustic sage]

after trying to get a handle on some RL issues, I am finally back to tackling these modules

[steel grail]

Service accounts are created by installation packages when they are installed. These accounts are used by services to run processes and execute functions. These accounts are neither intended nor should be used for routine work.

?

[fathom pendant]

Then you may have missed something. You're using burpsuite to intercept the traffic?

[fathom pendant]

Correct

[dire abyss]

yes 127.0.0.1 8080

config on browser as suggested with burp open

i see the php upload in burp and change the content type too

[fathom pendant]

Afterwards are you forwarding the request?

[steel grail]

so its like an automated user? used by the computer itself?

[dire abyss]

correct i fwd the request

[fathom pendant]

Basically

[fathom pendant]

You may need to fwd a few times

[dire abyss]

i actually fwd until i dont have req anymore in burp

[steel grail]

oh that makes much more sense, i basically hijaked that service?

[fathom pendant]

Bingo

[fathom pendant]

Interesting. Try it again and look at each response as you forward it

[dire abyss]

i just terminated my pwnbox and restarting, i think i noticed something interesting

[fathom pendant]

You may need to reset the target too if you want a fresh start

[dire abyss]

gotcha, okay let me do that too before i get into deep

okay so i got myself a fresh start, i havent done anything except get to the vendors page and NetVen already exist

i terminated both previous target and pwnbox and got new ones

the module makes it seem as if NetVen shouldnt exist until after I successfully uploaded the php web shell

[fathom pendant]

No, it always exists

You can delete it and make a new one iirc

[dire abyss]

yeah i can delete that entry which is what i tried before reaching out

this time let me try as-is

[fathom pendant]

I don't recall it taking much effort ¯_(ツ)_/¯

[dire abyss]

i think i figured it out

when you add a vendor there's a field above "browse" asking you to name the vendor. if you dont name it, it doesnt successfully add the "vendor"

[fathom pendant]

that might be it

I remember it being something dumb

[dire abyss]

is there somewhere we can suggest edits to module? seems like they missed that step

[fathom pendant]

#858470491676737536 , it's likely an assumed obvious step

Or it is stated and we're blind

Both are plausible

[dire abyss]

lol all good, thanks for the help

[fathom pendant]

Also they do monitor that channel, sometimes you'll get a 👍 if staff sees it and fixes

Or staff will call you out for being blind

Which is equally funny

[rustic sage]

Regarding Dnscat2 What is the point of DNS tunneling if you already are connected to the victim machine in in question? Is the goal to tunnel traffic through the victim?

because in order to make it work you'd need access to the victim as it is.

[fathom pendant]

Yes it allows you to tunnel traffic and gain access to more systems

Remember it's not always/usually just one device

[rustic sage]

okay

time to try it out :.

[fathom pendant]

Fwiw ligolo-ng trumps like all the tools in the tunneling module

[rustic sage]

it works like a charm, i suppose the thing is it's quite laggy, def wouldn't be my first choice in tooling

[fathom pendant]

Dnscat?

[rustic sage]

yeah

[fathom pendant]

Yeah a lot of tools are suboptimal

[fierce veldt]

For skills assessment part 2 I have admin hash for MS01 but I cannot use evil-winrm? Is this intentional? I get the error:

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

[fiery berry]

what does it say netexec (old crackmapexec) if you check for winrm? Have you tried another access method? You have the hash you can use pth with other tools over different services

[fierce veldt]

Yeah I will either try different tools or go for privilege escalation. WinRM is available on the machine but I have the hash for SQL01 it seems and not MS01.

[fiery berry]

can you show me the first two and the last two chars/digit for the hash you have? (e.g. h5..8a)

[fierce veldt]

13..64

I got the hash using mimikatz on the SQL01 machine which is likely the issue. The hash is not valid for MS01. May try and run mimikatz on that machine but I don't believe I have a user with high enough privilege.

[fiery berry]

mmm... I don't recon this hash maybe they have changed something in the labs since I did it some time ago

[fathom pendant]

Also nt hash is diff from lm hash

I believe the pth uses nt

[fiery berry]

correct

yes maybe I got the lm hash

[fathom pendant]

The order that ntlmv2 prints is lm:nt

[fierce veldt]

That's what I am thinking. From what I can gather the previous solution was a PTH using the hash from SQL01 but things have changed.

Sounds like I may have to use the user found previously in the chapter.

[fiery berry]

Well the hash may change but the way you use it remain the same

[fierce veldt]

Seems the hash is not used at all anymore from what I can tell. Will report back unless someone who has completed it recently can confirm.

Hash gives access to admin on SQL01 which is worthless as that access was gained previously.

[fathom pendant]

You can probably dump creds using it

[fiery berry]

did you dump the creds on SQL01?

[fierce veldt]

I can try but lsadump returns the admin hash which is effectively creds.

[fiery berry]

what about the sam and system?

[fierce veldt]

They return the same hashes from lsa

[fiery berry]

can I dm you?

[fierce veldt]

Sure feel free.

[fiery berry]

look for dm

[rustic sage]

did someone do: Analyzing Evil With Sysmon & Event Logs
I have a question about the pwnbox, it doesn't let me move calc.exe, what should I do?

[rapid sparrow]

Introduction To Splunk & SPL
Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all 4624 events the count of distinct computers accessed by the account name SYSTEM. Enter it as your answer.

[rapid sparrow]

anyone have done this.. I still cannot find it

[vestal crescent]

is this normal for a htb machine?

im on the file transfer section. its optional but i was tryna just see how everything worked

[autumn pilot]

the target machines do not have internet connection

[vestal crescent]

ah okay then its not working for a different reason ill try to puzzle it out

thanks

[acoustic owl]

Read the hint

[vestal crescent]

wait if this is the case then trying to do file transfers from a raw github thing isn't gonna work right?

ill just skip it

[fierce veldt]

Going to bed but looks like they changed the lab. If anyone has any tips and has completed it recently feel free to DM or reply. Will check in the morning.

[next bronze]

is that the local admin's hash?

[fierce veldt]

Yes that was the issue. I have the mssqlsvc hash which looks to have access to MS01. I am thinking that's the new route to take.

[next bronze]

the "Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host." question?

[fierce veldt]

Yuh

[next bronze]

how'd you get local admin hash but can't get the flag

[fierce veldt]

I have local admin hash for SQL01 admin.

Still trying to get from SQL01 to MS01

[next bronze]

ah, local admin usually have different passwords, since you know, it's a local account for that machine only

dump everything on sql01

[thorn urchin]

except for real world environments that dont use LAPS 💀

[fierce veldt]

I did and just found that mssqlsvc hash can be used to access MS01.

Guess it's just privesc from there or something

[next bronze]

true you can manually set the same passwords for all of them

[thorn urchin]

browse r/sysadmin, shits common

[next bronze]

yeah I've seen a few myself

[next bronze]

check what privs that user have on ms01

[fierce veldt]

Hopefully that password is the first name and birthday of their firstborn child.

[next bronze]

it's usually something dumber than that

[fierce veldt]

Yeah back to square 1 but have a foothold on MS01 so I may quit here for the night. Have a meeting in 3 hours 🥲

[fierce veldt]

Sadly, speaking from real breaches I've seen LOL

[gray shoal]

hello, this question is not so related to htbox but i hope someone could help,
in our home, me , my mom and my brother have computers, we are all on the same lan. im trying to strength my internet settings (close ports etc) so im going to my ip address on the browser and it asks me for username and password, i dont wanna go take it from the router, how can i get this info? i tried using one of those but it doesnt work: netsh wlan show profiles
(netsh wlan show profile name="name" key=clear)

[placid edge]

anyone else having issues with really laggy rdp connections to module machines?

its actually bypassed the point of where i cant even do the modules because of it

[gray shoal]

im trying to follow a video of networkchuck

to strength the network

[next bronze]

if you want to hack somebody's wifi, gtfo

[gray shoal]

its my bro

he also has no idea our password

just the login to the internet

[next bronze]

yeah sure thing man, off topic, ask elsewhere

[placid edge]

nice, now even the whole rdp connection dies

[next bronze]

tried tcp vpn?

<@&861185840277487616>

[vernal lava]

What

[placid edge]

i am using the one that its giving me for the academy in the modules. Doesnt seem to let me choose

nvr mind

lol, was using udp

[next bronze]

yeah that can crash rdp if you have some packet loss

[spring tundra]

@gray shoal Please read the #rules . Also this channel is specifically for HTB Academy.

[gray shoal]

ok i thought if its my home its ok

[placid edge]

nope, tcp is still terrible

like not even. Horrible is more the correct word

file explorer even crashes. And it takes 5 sec per click for anything to happen

[next bronze]

that's not the rdp's problem then

pick a closer server

[languid dawn]

stop being bad boys for strangers on discord

[placid edge]

yeah might need to get myself a vip subscription to get more private labs

[next bronze]

all academy labs are private

[placid edge]

wait

so how do i see where they are located?

[next bronze]

the vpn server, either us or eu

[placid edge]

yeah i have eu, but maybe i can pick a different one thats closer

[languid dawn]

I think the US ones would be us-east if you pick that, don't quote me on that though

[cedar void]

Not sure what SERVER_IP I am supposed to use for this module section since no server_IP is listed https://academy.hackthebox.com/module/110/section/1053

[next bronze]

if there's not a server that's closer then you just gotta deal with it

[languid dawn]

but in the end as long as it's not a 2000ms ping anything should be fine

[next bronze]

I have ~200 ping to the closest server, it sucks but it is what it is

[languid dawn]

hey it'll feel like real life

played cs source with 125ms for years, you can do it I believe

[next bronze]

real, dial up internet simulator

[rustic sage]

somone that did the following question:
Utilize the Get-WinEvent cmdlet to traverse all event logs located within the "C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement" directory and determine when the \*\PRINT share was added. Enter the time of the identified event in the format HH:MM:SS as your answer.
please send me a dm, I'm stuck on it

[placid edge]

its weird, since i havent had any connection issues before. but now its excruciating

[languid dawn]

might just be that particular server or module

[next bronze]

any website, just a put request, you can use htb's website ig

[languid dawn]

maybe it's a route issue, maybe it's just a question of regenerating the vpn pack

[placid edge]

i think so maybe, but this is a long module and a lot of rdp

[languid dawn]

it can be a couple little things that amount to it being very slow and annoying

[next bronze]

what module is that? windows attack & defense?

[languid dawn]

ooh it's rdp

yeah no it will be slow

[placid edge]

windows privesc

[languid dawn]

sorry you'll have to just take you time and be patient imo

[placid edge]

nah, but it crashes

[next bronze]

yea, it is what it is

[placid edge]

thats the worst part

[languid dawn]

maybe you can have it be a little be more responsive with wmi instead of rdp if that's available

[next bronze]

it shouldn't crash on tcp, never seen it happen

[placid edge]

like i cant navigate it at all. It just crashes. Goes black, then i have to reconnect. Takes 30 sec for the screen to go from black to just loading the windows desktop

[languid dawn]

it's probably a windows vm with 4gb and 1 core, it's gonna have some kinks

[gray shoal]

general question, do i need any previous knowledge when i learn tier 0 modules? does all the information needed for the answers are in the module or do i need to look for info somewhere else sometimes?

[placid edge]

yeah i recon

[languid dawn]

I'm sorry but after years of using windows you're just describing RDP on windows most of the time 😄

[placid edge]

nah, its 16 cores, 6gb of ram with 3ghz cpu

it shouldnt be that bad

[languid dawn]

jokes aside, I don't think you can improve it much more, just take your time and see what works

[next bronze]

pretty sure she meant the target lol

[placid edge]

i know

[languid dawn]

the target windows server has that much power?

[placid edge]

thats what it has

[languid dawn]

I'm surprised

[placid edge]

same lol

im gonna try using a different tool

[languid dawn]

ok well, like what was said, try to use another region for academy (so a new server) and maybe the new vpn pack will help

[silk tulip]

hey Eleana do you know why i might be having this issue with setting up a share on windows target vm

[languid dawn]

oh you're not on windows yourself? having a windows vm can really help in those scenarios imo

well it's mostly preference so don't sweat it

[silk tulip]

do you think this is a firewall issue? i put rules inbound for file transfer on the target's firewall

[languid dawn]

you're doing it with a name that doesn't resolve?

wrong workgroup for the user?

[silk tulip]

should i specify workgroup?

[next bronze]

just tried it in one of the sections, it's not crashing but the ping is very high today

[languid dawn]

probably, I don't remember smbclient args by heart, but on windows it should help, especially if the target is domain joined

because iirc by default it will try to resolve the username against the AD, so if it's a local user it won't work

[next bronze]

you need slashes for this //ip

[languid dawn]

ah yeah (also probably \\\\ rather than //)

[next bronze]

both works iirc

[languid dawn]

don't remember honestly

[silk tulip]

i think there's something wrong with my outbound routing

i can ping my machine from the target but i cannot ping the target from my machine

[languid dawn]

ip route add MACHINE_IP dev tun0 metric 100 will do the tric on your host

might want to remember to delete it afterwards

that is a quick and dirty fix, obviously your resolver should be checked so that it first uses the vpn

[next bronze]

no tier 0 is for beginners, all the info needed to finish the modules are in there, same goes for other modules, but if you want to learn more, do your research

[languid dawn]

a general knowledge of IT and computers would be a good thing to have, but honestly just knowing how to use google will suffice

[placid edge]

might be a combo for me being far away and even more high ping

[gray shoal]

thank you

[placid edge]

89% done and i still feel like idk shiet lol

thats a lie, its just a lot of windows stuff that i need further learning on

since i only have ad and windows privesc and attacking enterprise networks left for the cpts

[next bronze]

I have 100 less ping on eu1 for some reason, maybe you can try that

[placid edge]

i have tried them all 😦

idk. Ill wait and see

[gray shoal]

in the linux fundamentals module, in "navigation" it shows after typing ls it shows: Desktop Documents Downloads Music Pictures Public Templates Videos

but when i type ls i only see: └──╼ [★]$ ls
Desktop Templates

any insight ?

[rustic sage]

someone that did this mini model:
WINDOWS EVENT LOGS & FINDING EVIL Mini-Module
this part:
Analyzing Windows Event Logs En Masse

I can't seem to do it, can someone please help me?

the question is:
Utilize the Get-WinEvent cmdlet to traverse all event logs located within the "C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement" directory and determine when the \*\PRINT share was added. Enter the time of the identified event in the format HH:MM:SS as your answer.

[next bronze]

it's just different files/folders, just like how your computer might have different files than a standard new computer, don't worry about it

[gray shoal]

thank you

[ruby whale]

Module: Login Brute Forcing
We could do this bruteforcing using owaszap (burp) too , is there any added advantage to use hydra ?

[next bronze]

speed and number of protocols supported, hydra can do smb/rdp/ssh etc etc on top of http, burp free is limited to 1 req/s, zap is faster but hydra can do thousands of req/s over http

[tiny thicket]

Hi, can someone please help me find out why I can't see the /etc/passwd file.

[next bronze]

read the section again, you missed something in the lfi request

[lusty thicket]

read the section again

[lusty thicket]

faster speed

[hasty cliff]

any bug bounty hunter

[gray shoal]

in the module linux fundamentals, in section "working with files and directories" the question is "What is the name of the last modified file in the "/var/backups" directory?"

im pretty sure the answer to this questio does not apear in the module

like how am i suposed to come up with the answer?

it used chat gpt to help me , i got the command ls -lt /var/backups

its not even in the cheat sheet so how?

[next bronze]

google

[gray shoal]

so not all the info are in the modules?

[next bronze]

it's not gonna give you every single command ever, learn and apply

[gray shoal]

when i follow the current module, the instruction is Below we see two lines with short descriptions. The caret (^) stands for our "[CTRL]" key. For example, if we press [CTRL + W]

but when i do ctrl +w it closes the window, its a shortcut like alt f4, how can i change/cancel the hotkey?

[next bronze]

you're using pwnbox yeah? ctrl w is a browser shortcut which closes the current tab. in a proper terminal ctrl w will work. one reason why a vm is better

[languid wharf]

Has the machines problem been solved?

[upper timber]

Hello everyone, has anyone completed the skill assessment in the modern Web exploitation techniques? I needed 1 - 2 tips on how to get the passwords for the users admin and htb-stdnt.

[languid fjord]

should be

[kindred hare]

yeah

[languid wharf]

Great, thanks!

[kindred hare]

hello everyone , i have a trouble completing "Attacking Common Services" module - "WordPress - Discovery & Enumeration" second question " Perform manual enumeration to discover another installed plugin. Submit the plugin name as the answer (3 words)." . I tried to use wpscan and also ffuf (list of plugins for WP) but 2 plugins that were found are incorrect answers, anyone has any clue?

[stiff bone]

dm

[zealous spear]

Howdy folks,
I am struggling a little bit with the Footprinting hard assessment. I looked briefly in forums, and I see a lot of talk about SNMP. All nmap picks up for me are ssh, pop3 and imap services. What am I missing here? Should I assume SNMP by default?

[fathom pendant]

2 things: udp, and reading the engagement

The engagement contains keywords that would indicate snmp would be running

[limber river]

basically when u run nmap , you only scans tcp unless u use the -sU flag

since snmp use UDP , you will not find it

[zealous spear]

Thanks! That gives me something to bold in my notes!

[languid wharf]

Hi, I'm in Windows Privilege Escalation Module in the Critix Breakout section, I spawn the target machine and get a linux machine instead of windows:

htb-student@ubuntu:~$ uname -a
Linux ubuntu 5.4.0-88-generic #99-Ubuntu SMP Thu Sep 23 17:29:00 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[next bronze]

follow the instructions

[languid wharf]

Oh sorry, missed it. Thanks!

[languid wharf]

How do I switch to root on the linux machine? It doesn't work for me with htb-student's password

And I need to be root in order to start the smb server

[next bronze]

it does, just type in the password

[fathom pendant]

You don't need to be root to start the smb server

Sudo works just fine

[hasty cliff]

any bug bounty hunter

[chilly cosmos]

they are all red

[acoustic owl]

Are you running any VPN software?
If so, try it without.

[chilly cosmos]

No my vpn is not connected right now

Back to normal

[rustic sage]

Guys what module should i take after introduction if i have no idea of anything?

[cosmic dock]

Can someone give me a hint for CPTS - Attacking Common Services - Easy ? I've tried every command in the cheat sheet. I've only gotten a user, none of the supplied lists are giving anything

[limber river]

use the files comes with module

[cosmic dock]

I have

[languid wharf]

Try with rockyou

[fathom pendant]

Are you using user@domain?

[limber river]

no need , he just need to run it against the right service

[cosmic dock]

yep, did that as well

[cosmic dock]

I've done it against every service the node is showing

[fathom pendant]

Are you using the local-auth flag?

[cosmic dock]

No, i'm not aware of a password spraying tool (outside of nxc or cme) that would let me specify --local-auth

[fathom pendant]

Hydra I believe has a flag like that

[cosmic dock]

Maybe i'm ignorant - but I just looked through the man pages and the -help for hydra; neither mentioned it

[fathom pendant]

I believe it's -local-auth

[next bronze]

nah hydra is different

is it smb?

[limber river]

no

[cosmic dock]

No, there's no SMB

[next bronze]

then what are you spraying?

[limber river]

iirc there's no smb , you got user so no spraying

[cosmic dock]

SMTP, RDP, FTP , HTTP/HTTPS

and MYSQL

[limber river]

yes you need to bruteforce on one of them

[cosmic dock]

Yep, I'm certain

[cosmic dock]

I've bruteforced them all lol

[limber river]

weird

[next bronze]

you can specify the domain with hydra btw, don't think it's documented, found it by looking through the source code
smb2://<target>/workgroup:{<domain>}
https://github.com/vanhauser-thc/thc-hydra/blob/8c4165a83bc3126dd727244e0b5466c1a18aa67c/hydra-smb2.c#L214

[hallow kiln]

Have you used rockyou?

[limber river]

no smb

[limber river]

maybe this

[next bronze]

yeah ik

[cosmic dock]

I've only used rockyou against one of the services, killed it after 5 min

I've spent an hour and a half against an easy module, this is ridiculous, lol.

[fathom pendant]

Can you log in anonymously to ftp?

[cosmic dock]

No, that was the first thing I tried lol

[limber river]

iirc the password is super easy

[fathom pendant]

^

[limber river]

check that the labs is running correctly

[fathom pendant]

It should be if they got the user

[limber river]

I remember brute forcing for 30 mins , then find out that the lab is down

[fathom pendant]

But if they crashed the lab, yeah

[cosmic dock]

are you

fuckin kidding me

[hallow kiln]

How many threads did you specify that you killed it?

[cosmic dock]

restart the lab, ran rock you because.... sure

works immediately

[hallow kiln]

Restarting is the first thing to do when you think something should be working

[cosmic dock]

the reason rockyou works, vs the list they privde

is because the list they provide is missing a 0.

[hallow kiln]

The workflow should always be - list you find on the machine, list they provide or specify in the module, list they instruct you to make (if applicable), rockyou

[silver iris]

Been doing the AD Module for a few days now and i´m just amazed how well and clear everything is written. Big thanks to @blissful verge

[cosmic dock]

Thanks for the help either way

[cosmic dock]

Did the service hang for you after you connected to it? it is for me, even restarted the machine.

[manic onyx]

Not sure if he wrote the CrackMapExec module as well but I can’t recommend that one enough. Really enjoyed those two

CME skills challenge is also super fun

[silver iris]

Havent done it yet, but will take a look, thanks for the tip

[next bronze]

I have done 60+ modules adn it's the single hardest skills assessment

first time I had to ask for help

[hallow kiln]

I had no issues when I did that module, it was months ago though

[manic onyx]

I assume this is happening for a lot of people but is spawning targets down? Can’t seem to spawn any targets in the Kerberos Attacks module no matter what I do

Been a couple hours

[silver iris]

Had the issue yesterday, they also pinned a message about the issue. Today everything worked for me however

[worldly patrol]

Finally completed the advanced XSS and CSRF skill assessment and labs. Phew!

[upper timber]

Hello, has anyone passed the Modern Web Exploitation Techniques skill assessment?

[olive fiber]

Hello,

someone can tip me for the Skill Assessment - Broken Authentication

I am connected as one of the users

found the elevated users

but i am having this issue User cannot have requested role

got it

[midnight galleon]

hi
in the web attack module, IDOR in Insecure APIs section, i was able to get user 5 alphnumerical data, but couldn't get the uuid, looking at script.js file i see that the uuid of user 1 is hard coded, any nudges?

[cosmic dock]

Im stuck on the SQl portion now sigh

[midnight galleon]

nvm writing this sorted my thinking XD

[placid edge]

think more about leaking uuid

or maybe it was setting

cant remember which one it was more focus on

[cosmic dock]

Can I DM someone about CPTS - Attacking Common Services - Easy

[midnight galleon]

yeah i got it it was just that burp was burping too fast

[placid edge]

sure

[cosmic dock]

thank you - DM'd

[misty current]

https://github.com/scr1ptie/VHostWPort
Made this auto-conf bash script that makes it easy of not having to mention port every time for vhosts when the spun-up target is an external Ip with port.
Some of the module in the CWEE path spun up these kind of targets and so far this configuration has been working great.

[novel badge]

Guys can I learn hacking on phone?

[sonic glacier]

is it just me or the labs are really slow?

[limber river]

not just you

[sonic glacier]

cool, was driving me crazy

[sonic glacier]

can`t even nmap an ip right now

[onyx robin]

Hello everybody! in Introduction to Windows Command Line, all about Cmdlets and Module, We see an example of downloadin PowerSploit module! I tried to do this on my system, but the antivirus always block me! how can i do? i tried to select the folder in the antivirus Exclusions! but I always receive a message about a Trojan!

maybe I just need to turn off antivirus, do the job and after I finished restart it?

[next bronze]

powersploit is used for offensive purposes, so defender detects it as malware

[onyx robin]

Ok, but is useful to have it on the system?

[next bronze]

keep it in your pentesting distro, not your windows host

in general don't keep tools in your host

[onyx robin]

Thank you! So in the module of htb they use PowerSploit only as an example..

[next bronze]

you'll use it when you're actually pentesting a target, not against your own computer

[onyx robin]

OK I just tried to download it to add modules to powershell, that is the task of the asked....but i had problems for the antivirus.

[next bronze]

use the target provided at the bottom, not your own machine

[onyx robin]

Thank you!

[ivory sandal]

I think I am missing something major. For Attacking Common Applications, the second sections, where do I get the IPs for the vhosts that are listed?

[languid wharf]

Hi, I'm in the lab of pillaging section in windows privilege escalation, in the last question. ||I used the restore option to restore the system32/config snapshot, and got the system,sam and security hives. The problem is I get the following error when I run the following: Run: sudo python3 secretsdump.py -system system.save -security security.save -sam sam.save local and get [-] read length must be non-negative or -1||.
PS. they have data in them

[manic onyx]

Check hashes, happened to me to

[placid edge]

anyone here that has a toolset for windows privesc?

i lost my github repo with it and now i am depressed

dont want to make it again when i made it two days ago

like a folder that has all the tools from the htb module windows privesc

[languid wharf]

Wdym

[manic onyx]

Check file hashes to make sure it transferred correctly

That was my problem

[languid wharf]

Oh thanks, I'll check it out

[polar skiff]

Hi I’m having trouble connecting to the vpn

I did switch, and download a new one

[fathom pendant]

Did you connect with sudo

[polar skiff]

Yes

[fathom pendant]

Also what errors do you get?

[polar skiff]

Packet HMAC authentication failed

[fathom pendant]

Is your system/openvpn up-to-date?

[polar skiff]

Don’t know

I have open on 2.6.3

[fathom pendant]

Idk what latest is but you can do sudo apt update && sudo apt upgrade

[languid wharf]

Yeah, @manic onyx's suggestion helped me. I don't know why, but the files I had locally didn't have the same checksum as the ones on the box. I restarted the box and moved them again and now it worked

wpe

You're in the log poisoning?

Oh, I didn't notice, sorry. There's a blog post of someone who exploits it on a regular htb box, have you seen it?

I've used it, but nonetheless it was tricky and didn't worked more times than it did

Do you want me to dm the link?

[empty lantern]

Hi guys.

In CDSA, the exercise "Use the "cobaltstrike_beacon" index and the "bro:http:json" sourcetype. What is the most straightforward Splunk command to pinpoint beaconing from the 10.0.10.20 source to the 192.168.151.181 destination? Answer format: One word" ,

First I tried with the typical commands about intervals and times, then I tried with the commands in the reference query, then I searched here I tried with all of them (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/ListOfSearchCommands) as it is said

Even I tried another way with all commands:
I catched the request from POST HTB Academy by BurpSuite then I created the req.txt from it, I watched the answer was in base64,
so I transforme all commands to base 64
#!/bin/sh
rm -rf ./todos_comandos_splunk_b64.txt
while IFS= read -r line; do
echo "Text read from file: $line"
echo "$line" | base64 >> ./todos_comandos_splunk_b64.txt
done < ./todos_comandos_splunk.txt

And Finally I launched the request for all Splunk commands in base64:
ffuf -request req.txt -request-proto https -w ./todos_comandos_splunk_b64.txt

But not successful

If it was an interesting problem, I would straggle with it, but after spending 2 hours with this exercise, I think it's too much for it.
Even the exercise in the Skill assestments for detect beaconing in malware only takes 1 minute for solving
"
Use the "empire" index and the "bro:http:json" sourcetype. Identify beaconing activity by modifying the Splunk search of the "Detecting Beaconing Malware" section and enter the value of the "TimeInterval" field as your answer.
"

Could you please send me a DM about how to solve it?

Thank you in advance

[ruby finch]

hey guys, I am going through the Linux Fundamentals module, in the Regular Expressions sections there is a practice task stating "Search for all lines that contain a word that starts with Permit." I find the wording a little bit confusing (English is not my first language though). Are they asking for the lines that start with the word "Permit" OR the lines that contain and start with "Permit"?

[fathom pendant]

it's the words that start with Permit

(because there are no lines that start with Permit)

[ashen herald]

so not "whatever Permit asdasdas" but "whatever Permitasdasdasd"

[fathom pendant]

^

[ashen herald]

well the first might be included too

[ruby finch]

oh okay thanks I understand better now

[fathom pendant]

it's not

[ashen herald]

"is Permit a word starting with Permit" ? yes, it is .

[fathom pendant]

the excersize is looking through a conf file

[ashen herald]

btw, just stick a wildcard in the end 😄

[fathom pendant]

the proper way would be [^|\s]Permit.*\s

[ashen herald]

aaaaaaah regex :° allways a bloodbath

[fathom pendant]

yes regex

literally what he stated at the start of his question LMAO

[ruby finch]

Okay I was a little bit confused because I did find 2 lines starting with "Permit" and a few other lines that conatined "Permit" in them

[ashen herald]

it was a 'vocative|nostalgic' aaaaaah 😛 not a surprised one

[ruby finch]

But I think I get it now

[fathom pendant]

Regex is (not) fun

[fluid basin]

in the pivoting tunneling and port forwarding module I am trying to follow the example of port forwarding via meterpreter, however when I attempt to set up my socks proxy it starts up and stops right after. How do I fix this?

[harsh swan]

Hi, I'm having a problem with the excercise on module Web Requests section GET, the one which asks to make a cURL request using basic authentication,

I've followed all instructions an the answer I've getting from the request is "Please use cURL%", well I'm, in fact, using cURL but it keeps giving the same response, I've even tried to put that ("Please use cURL%") as the answer to the question to solve the problem and pass the module, but it fails.

[fathom pendant]

it's better to ask using module and section name

[harsh swan]

Fixed, thanks @fathom pendant

[fathom pendant]

wdym by "same response"

that's also really vague

[harsh swan]

"Please use cURL%" <== the same response I mentioned some words before

Any way to send a screen capture?

[buoyant escarp]

I dont get it

[fathom pendant]

yes take a screenshot and put it in the chat

if you're using curl http://ip:port but i've never heard of curl% unless it's something talked about in the section

[harsh swan]

I sent you a DM @fathom pendant didnt find a way to send the ss here

[fathom pendant]

@harsh swan i meant send it in this chat

[harsh swan]

cannot send pictures in here

[thorn urchin]

you should be able to

[fathom pendant]

you should be able to send it in the chat, your account is verified/linked

[harsh swan]

well, I tried but cant

[thorn urchin]

your account is verified which is the only req for academy chat

unless a mod fucked up the settings

[harsh swan]

oh sorry, now I can lol

[thorn urchin]

Damn you ruined my next joke

[harsh swan]

xD

[thorn urchin]

I was gunna say, "quick marcie, youre not an idiot, send a test image"

[harsh swan]

lol

ok I'm that idiot but help me please :/

[thorn urchin]

thats a response from the webserver

guess is they dont want you faking the user agent

[harsh swan]

yes, well in the excercise it asks you to use cURL to get the "flag" then when I do that the only thing I get is **Please use cURL% **

[fathom pendant]

curl has it's own user-agent

[harsh swan]

mmm

[thorn urchin]

which youre overriding

[fathom pendant]

but you shouldn't need to fake/spoof the user-agent

[thorn urchin]

so like dont do that and see what happens

[lusty thicket]

use curl why copying the whole req

[fathom pendant]

that too

like that's the WHOLE header request

[harsh swan]

oh, fuk... Im such a noob, thanks guys I'll fix that right now

[native turtle]

guys can you spawn target on Remote/Reverse Port Forwarding with SSH?

because it's the third day that I have problems with this module

I already contacted supports

[thorn urchin]

#modules message

delete. dont spoil flags

[fathom pendant]

why are you sending the whole request with headers btw

[harsh swan]

oops, well I followed instructions so...

[fathom pendant]

why not just curl http://ip:port/search.php?search=flag

[harsh swan]

which would a better way? only headers?

[thorn urchin]

eh full headers can be good practice for replicating clients

[harsh swan]

I was asked to send with auth params

[fathom pendant]

well it depends tbh

if the section says to do it i'm not gonna tell you you're wrong

[lofty wave]

This comment is more of a slap my own face one. The XSS module, oof, man, attention to details. Pay attention to the actual cookie name when looking for the flag. Been banging my head for like an hour wondering why in the F is this not working 😂 .

[harsh swan]

maybe its just for practice and learning purposes, dunno Im very fresh at this

[dreamy solar]

Hello I realise the "Command grep" with grep -r for this question but I don't find HTB{] ! Can you help me plz?

[thorn urchin]

who said that was the format

follow the instructions instead of trying to cheese it

[fathom pendant]

your clue here is Linux environment if it's what I'm thinking of

[dreamy solar]

I followed them all, it didn't work

[limber river]

Why, I don't have this "request help" button?

[fathom pendant]

silver annual perk

[limber river]

Aaah okay

[limber river]

Read the env carefully

[dreamy solar]

It's actually been done for a while, I was going in circles a bit, hence the fact that I tried a grep command

[delicate kernel]

is there a normal chat?

[gray shoal]

im trying to install centos 9 on oracle virtual box, im having many troubles, because instead of running it says "aborted" and doesnt open command line, any knows?

[thorn urchin]

only if you can read

(#welcome)

[thorn urchin]

modules channel isnt tech support

[delicate kernel]

I’m a lil special

ok so I looked under HTB: OFF-TOPIC and just saw the bot commands channel

???

[rotund sphinx]

there is "general" and "magical-tunes" in there for me

[delicate kernel]

mehhh it’s good dw I’ll just find out later

[thorn urchin]

maybe you could try reading

#welcome

Yes because you havnt tried reading yet

#welcome

[rotund sphinx]

maybe your turn to try reading

[thorn urchin]

Not well apparently because youre still an unverified account

[delicate kernel]

HTB: OFF-TOPIC

[thorn urchin]

you need a verified account to access general

I did: #welcome provides the instructions

[delicate kernel]

yeah but when I asked all u had to say was that

[thorn urchin]

I did: read #welcome

This channel is for module discussion only, stay on topic

Do you read? Stay on topic. Youre spamming the channel at this point

I did answer your question. Its not my fault if you cant read.

Youre still unverified

follow the instructions in #welcome if you want to access other channels

<@&861185840277487616> some peeps that are being off topic.

[delicate kernel]

Alr guys, Delete ur messages here including you @rustic sage and @thorn urchin delete them.

[languid wharf]

Hi, can someone help me in the wpe first lab? I'm stuck on privesc ||I can't get the correct CLSID for juicy potato even though I ran their script, it found nothing||

[fathom pendant]

didn't realize reading was such a skill issue

[delicate kernel]

yeah I’m a little slow but as I said we’re new to this so we don’t really know how to verify yet

[thorn urchin]

if only there was a channel that explained it

[delicate kernel]

mad r u really going to drag this on

[thorn urchin]

https://tenor.com/view/no-yes-giga-chad-giga-chad-gif-23156898

[novel matrix]

Whats going on?

[fathom pendant]

people not reading

[delicate kernel]

ok guys he posted giga chad he wins

[thorn urchin]

people crying about verification instead of discussing modules

[lusty thicket]

i think he’s trying to say you can access other channels once you verify your account

[novel matrix]

Lets keep this channel for module discussions please

[thorn urchin]

👍

[delicate kernel]

yes serrrr🫡

[rotund sphinx]

but arguing about who can read or not was so much more interesting

[rustic sage]

word custard

[dire abyss]

for the shell and payloads, live engagement module, is there a built in browser on the foothold? cant seem to find one other than tor which fails to install or update

or am i supposed to install one

[fathom pendant]

firefox

you can't install one because the jump host/foothold doesn't have internet access

[dire abyss]

i was digging for a browser, couldnt find one but using the command "firefox" starts it up, thanks

[rotund sphinx]

anyone else having connection issues to targets atm 😦 i remember having issues when i first started but then its been fine but today im having issues again and its making it very tricky to know if im doing something wrong or just an intermittent issue 😦

[delicate kernel]

yeah I am to

[thorn urchin]

@rotund sphinx @delicate kernel #modules message

[delicate kernel]

you linked us to a channel we’re in???

[fathom pendant]

click the link

[thorn urchin]

christ

[fathom pendant]

and it'll show a message that's explaining the issues

[rotund sphinx]

ok i guess not just me then at least

[delicate kernel]

mb it’s not working rn it’s slow for me

[rotund sphinx]

hopefully its sorted soon

[delicate kernel]

yeah hopefully

[thorn urchin]

almost like I link things because they provide useful information addressing the situation at hand 💀

[rotund sphinx]

sometimes

[delicate kernel]

some of us are new to the app, We don’t all have knowledge you do so calm down.

[thorn urchin]

which is why I provide the information lmao

[delicate kernel]

Since we’re not in general or smth I’m not arguing with you here.

But thank you for the information.

[thorn urchin]

np

[delicate kernel]

Hope we good now.

[chilly cosmos]

[rustic sage]

[languid wharf]

Yo, if there's someone who solved the WPE first lab the intended way, pls dm me.
I solved it by first getting system and after that got the ldapadmin creds

[rustic sage]

Job fair tomorrow ;c but I have no cert apart from my CCNA lol

should be interesting

[thorn urchin]

what does this have to do with modules?

[rustic sage]

your MOM @thorn urchin that's what it has to do with modules, your mom!

[thorn urchin]

You should read and follow instructions in #welcome

[rustic sage]

i hate you

[thorn urchin]

<@&861185840277487616> off topic

[west rampart]

ok

but you should avoid this kind of language

[delicate kernel]

@thorn urchin ik this is “off topic” but next time you should say “good luck out there, but please refrain from talking about other things besides modules in this channel.”

[thorn urchin]

no

[delicate kernel]

Then it’s on you if they hate you.

[thorn urchin]

👍

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[buoyant escarp]

[lusty thicket]

good luck

[rustic sage]

thx

[median vine]

Hello, im stuck no the Server-Side Attacks, Nginx Reverse Proxy & AJP
When trying to setup the proxy/nginx on the Pwnbox, I keep getting the error

nginx: [emerg] "location" directive is not allowed here in /etc/nginx/conf/nginx.conf:57
I searched for similar doubts here on Discord, but I couldn’t fix this error
someone can help me?

[rotund sphinx]

im not up to that module but the error message sounds like you got your nginx config file wrong

iirc location blocks need to be direct children of server blocks

[median vine]

here my config file, idk im doing wrong

[thorn urchin]

looks like your server directive isnt inside the http directive

[rotund sphinx]

did you comment out the other server block or was that just there as an example?

[fierce veldt]

sorry that no one cares ab ur job fair :3

[rustic sage]

I never asked anyone to?

[thorn urchin]

can always chat about it in general after verifying your account with the instructions in #welcome

[fierce veldt]

^

[thorn urchin]

there was no reason to bring it back up though either, esp after mod already addressed it

[fierce veldt]

Ah thought I could reply since it wasn’t deleted :3

[rustic sage]

that's the first helpful thing you've ever said to me madf0x ty,

[thorn urchin]

I already told you to read #welcome but ok

[drifting vortex]

Could I get some help with the Foorprinting? I'm in section "Oracle TNS"

I need to download || sudo apt install oracle-instantclient-basic oracle-instantclient-devel oracle-instantclient-sqlplus -y ||
But the issue is there is when I run that command I cant get || sqlplus ||

I can provide screen shots if need be

To be more percise it says || Unable to locate package oracle-instantclient-sqlplus ||

[median vine]

now working, thanks for help! i forgot to comment "}" ahhh

[next bronze]

are you using parrot? those packages aren't in the parrot apt repo iirc

there's another tool you can use, forgot the name but search this channel

[drifting vortex]

It is in the parrot OS, im using the VM supplied by HTB

[drifting vortex]

So what tool would that be?

[next bronze]

search the channel

[bleak lantern]

are we having any connection issues today? I can´t keep a connection between pwnbox and a remote machine through xfreerdp or remmina on Introduction to Digital Forensics

each minute I spend like 30 seconds reconnecting

[ivory sandal]

Hey guys, im working on Attacking Common services Attacking Tomcat section and I have the reverse shell, but I am unable to find the flag for tomcat_flag.txt. I have a root shell, can I get a push towards which directory to look?

[loud fiber]

Cant get a reverse shell on the auto repair website. Just says timed out

[next bronze]

you can search for it

[ivory sandal]

Yeah im using ||find / -name "tomcat_flag.txt" 2>/dev/null|| but It doesnt give anything

[languid fjord]

Yes we're aware

our team is still working on the problem unfortunetly

Its mostly around spawning, though

[rustic sage]

try locate

[bleak lantern]

ok Thanks.. So, I will try it later.. Thank you for the answer

[ivory sandal]

||locate tomcat_flag.txt|| gives me an internal server error

[next bronze]

internal server? are you still using a webshell

[ivory sandal]

mind if I dm?

[thorn urchin]

how come https://status.hackthebox.com reports everything fine when its clearly not.

[languid fjord]

🤷 not sure

Ill mention it to them again in the AM

[thorn urchin]

a status into page should probably reflect the status of the core offered services of the platform lul

[next bronze]

this command will find it, use a revshell

[cunning marsh]

are you guys getting labs? for 3 days I can't spawn any lab

refreshed the page and everything

[next bronze]

has been working in the past day for me

[cunning marsh]

weird pwnbox works just not the lab. trying to do AD skills I

[bleak lantern]

I can spawn Labs, just can´t keep connectivity to it. But @languid fjord just answered above they are aware of the issue

[cunning marsh]

sounds good thanks

[bleak lantern]

np

[ivory sandal]

I uploaded a revshell with msfvenom and I still cant locate it

[next bronze]

look in the tomcat dir in opt

[ivory sandal]

Thank you so much I got it

[marsh echo]

heyy i dont understand why is don't work https://academy.hackthebox.com/module/144/section/1256 for thrid question

[final rose]

i keep getting the error even in the eu vpns

[potent ermine]

Same for me when I tried with Pwnbox - UK region.

[final rose]

guess we shoud move forward

[potent ermine]

Yep, I just skipped it and will come back to it at the end. Hopefully the environments and connections are more stable then

[unique grail]

Hi all, can I have a nudge for advanced xss and csrf exploitation - xss bypass please? I managed to inject a xss payload and it worked with exfiltration for my local account. However I never got interactions from “admin” user using it. Any hints would be appreciated.

[cobalt trench]

Hello everyone

For this question, under footprinting SMTP these are the results I came up with but none of these are the correct answer. Looking for a hint in the right direction please

[rustic sage]

currently having issues with the skills assessment for pivoting module under pentesting, looks like it's lagging out been waiting 45 min so far for the target to spawn

[ruby whale]

Check hint section it mention something about wordlist

[cobalt trench]

the footprinting wordlist that was provided but I dont see any wordlist provided by the module

[ruby whale]

You will find it below cheatsheet button

[jagged prairie]

should I make a report that I can't spawn anything? or is that not needed as its a global thing?

[cobalt trench]

Thank you

[urban linden]

i am having trouble connecting via ssh. got logged but the password is wrong and denied access. Can someone please help out?

[cobalt trench]

Is this a result of the connection issue or am I still doing something wrong here?

[fathom pendant]

Increase the timing

[steel grail]

I got a flag all by myself with no help !!!

Now to escalate to root privileges

[valid prism]

Is anyone familiar with OpenVpn?

[fathom pendant]

https://dontasktoask.com

[urban linden]

can someone help me with the Linux fundemental module?

[fathom pendant]

Just ask your question read the link I posted above

[agile torrent]

as above, just ask your question

[steel grail]

I just finished it, go ahead

[urban linden]

I ssh to spawned machine, it asks for the password and the given password is denied?

[valid prism]

Alright so, I am having an issue with Openvpn and connecting it to HTB this is the 1st time this error is showing up since using it:
Error Code: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)

So, does anyone know how to fix this I have already tried a clean install and ran it with sudo commands.

[cobalt trench]

sudo openvpn <path to vpn file>

or if youre already in the directory containing the file then its just sudo openvpn <file name>

[valid prism]

Still shows the same error

[cobalt trench]

Everything I find regarding that error code says to use sudo to fix the issue

[valid prism]

Right. That is all i could find as well and for some reason this is not fixing the issue. So, I don't know if i need to do something else or what lol

[fathom pendant]

Run as sudo should do it

[ruby whale]

In SQL Module, we can use LIKE name = "NA%" % to consider for letters beyong NA Is there in any similary functionaity in using operators. For example in name field I want to checks for engineers and engineering . So is it possible to do something in SELECT * FROM table_name WHERE id >100 || name ="engineer"

[valid prism]

tried that still got the same error bud

[cobalt trench]

maybe switch to root?

[valid prism]

I could try that

[fathom pendant]

Sql uses literal words, idk if bitwise || will work as OR

[agile torrent]

are you specifying the user? from memory it'll be htb-student or something similar

[fathom pendant]

You're using your own vm, yeah? Not the in-browser one?

[steel grail]

Hi Marcie

[valid prism]

yeah I am using my own VM, until i get back from my trip to use my designated computer

[fathom pendant]

But yeah, sudo should work for running openvpn as root. Unless something got messed up in your installation

[cobalt trench]

You sure you dont already have the VPN on?

[fathom pendant]

If you already have the vpn running it'll just create another tun interface

[valid prism]

I don't think the installation is messed up it was working this morning. I don't think i have it on.....

[fathom pendant]

Try turning it off, and turning it back on again

[valid prism]

I did just try using Root and i don't have an error this time it just froze

[fathom pendant]

"Froze"

Did it get to "initialization sequence completed" in the last few lines?

[cobalt trench]

It's thinking

[valid prism]

no I got the exit policy in the last line

[fathom pendant]

last few

[valid prism]

ummm let me check again i just restarted VM

so i am gonna try it again

[fathom pendant]

Try with sudo first

[valid prism]

Understood

[fathom pendant]

You should almost never be root unless absolutely necessary

In the event you run a dangerous command by accident and delete something you shouldn't

[valid prism]

Right! So, i did try to run the openvpn again using sudo but, it did nothing again. I would show the image but, discord is denied me access to do so

[fathom pendant]

You need to link your main lab account #welcome

It's there to mitigate trolls

[valid prism]

oh lol i missed that

This is with the sudo command

[fathom pendant]

Yeah, its connected dude

4th line from bottom

[valid prism]

okay.... Then why can i not launch a machine

Oh shit I see it now

[fathom pendant]

On academy?

There's a known issue with spawning atm

On the main lab platform: it's also a known issue. It can take a few minutes to recognize you're connected

[valid prism]

Okay well I am gonna try to spawn one and see if i can even connect to it

[cobalt trench]

Click the spawn button then read through the module. by the time youre done reading it should be up and running

[fathom pendant]

Read the section*

[cobalt trench]

yes section*

[fathom pendant]

Module is the word for the whole thing, section is for.. well the section you're working on

[valid prism]

I really appreciate the help i was just being stupid.
everything is working perfectly

[cobalt trench]

It's not stupid. We all started somewhere (I make worse mistakes)

[valid prism]

lol thanks

[urban linden]

can we use our own VM in academy to do modules?

[cobalt trench]

yes

[fathom pendant]

Yes

[urban linden]

thank you

ok 1 more, Do I have to use the VPN download file on my VM?

[cobalt trench]

Download the VPN, copy it to your VM if you havent already, open it in your VM

[urban linden]

ok thanks

[ruby whale]

Check Setting up module its not in the path but it helps.

[cobalt trench]

That's enough hacking for me tonight

Untill next time everyone

[hot grove]

ifconfig and check if you got a tun0

[wanton idol]

Hello, i am doing the first skills assessment for AD Enumeration & Attacks. Is PowerView suppose to be blocked bc it does not run at all when i try to import it there is no error it imports it successfully but when i try to use a powerview command it says its not a command

[mossy patio]

Hi i am stuck on question 3 on the Network Services in the academy. I tried hydra and did all other questions but cant login via rdp. (Used the crедентиал)

[misty current]

Give us more context, like what kind of shell are you trying to import the PowerView on?

[visual pollen]

Is anyone else having trouble joining RDP sessions due to bad password or black session errors?

[next bronze]

if you see a black screen hit enter

[visual pollen]

Thank you very much! It works! What is this due to?

[next bronze]

the display going to sleep

[visual pollen]

thank you!

[next bronze]

dw you're not the first, also if you have login problems, warp the password in single quotes

[visual pollen]

Yes, I had already tried single quotes. But since RDP isn't very stable and often gives me errors, I assumed it was some connection problem. That's my fault

[limber surge]

hi, i need help with tapping with etp. can pm me thank you

[shell ore]

can i get some help in the pvioting module, rpivot section?

i kinda dont understand, why to use rpivot exactly, and it's commands are kinda obscure and not really getting in details to what they do

[acoustic owl]

The chance of getting an answer is higher if you ask your question here

[shell ore]

is there some source or smth i can see where it exlpain this in more details guys? 😅

[next bronze]

https://github.com/klsecservices/rpivot

[shell ore]

i am already there 🥲, like the main thing is why the attack host is running server, and pivot host runs, client, i want kinda a bit more "networking" details of what happens

[next bronze]

wdym? why not? it'a reverse proxy

[shell ore]

oh

i forgot that detail 😶

[limber surge]

i figured out already

[midnight galleon]

what tier 3 module do you recommend after HTB Pentester role path ?(with the cashback cubes:),or should i stack more for the osint one?

[next bronze]

depends on whether you want to do web or ad

if it's ad I can recommend kerberos attacks and adcs

[midnight galleon]

and if web?

[next bronze]

haven't done them, check with someone who has

[midnight galleon]

ok thanks!

[barren salmon]

i gotta ask, is every link you find via htb okay to snoop around in? i mean i doing the las box in getting started module. im running a namp, and ses that theres af webservice running. i check the web via curl, and see some links to other pages from the taget ip. well i look at thoes links and find a dev named chris. He has his own page, so i think to myself, maybe there's a way for me to get foothold via the developer. looking at his stuff using curl and gobuster, it seems like a legit developer visit card page and im like, should i be here? is this a part of the box?

[midnight galleon]

if someone did he osint one i hope if can provide feedback, 1000 cubes make mee feel like it is S tier module that after you are done with u can know if you osint any company u would know if the employees are in bathroom or not

[next bronze]

... I don't think that's what osint is about

[thorn urchin]

if the links go to non-htb domains, youve probably gone outside the bounds of the box lol

remember boxes will use real software which sometimes means real links

[barren salmon]

it can sometimes be difficult to tell what's box's boundaries.

well i stopped what i was doing and started over

[thorn urchin]

it shouldnt be difficult at all

pay attention to the domains

if its not .htb or .local or such STOP

unless a module specifically tells you to do something on the real internet, a box wont have anything relevant with the real internet

[barren salmon]

Well webpage looked htb like. simple page one image and some liks. quit boring so i thought is was a part of the game. but i didnt break anything just snooped around.

[thorn urchin]

dont rely on page looks

know what domain youre on

[barren salmon]

yah you're right. one of the links ended with .htb tho

[thorn urchin]

then that was part of the challenge 🙂

[barren salmon]

maybe that's another way in, but not at the level im on.

anyway, thanks for answering. ill pay more attention to the domains