modules

[faint gulch]

In other news, I am stuck in the AD lab Part 1 on finding the plaintext creds of ||tpetty||. If anyone has any hints, would be highly appreciated!

[fathom pendant]

i directed you to the #rules that clearly explain what is and isn't allowed here

[gilded sundial]

ok

Should I use sms bomber to disturb him...?

[upper ruin]

Oh my god.

[fathom pendant]

my brother in christ

just shut the fuck up about it

period

this server is not for anything like that AT ALL

ik you likely found this server through the discovery feature

[gilded sundial]

can you dm me the correct place to do that..?

[fathom pendant]

but in future; read the #welcome and #rules channel

[upper ruin]

Not here is the correct place.

[fathom pendant]

It's purely against Discord ToS as a whole to distribute information like that

[upper ruin]

Neither anywhere in this server.

[lusty thicket]

hecker

[gilded sundial]

Common bro you can Instagram me

[lusty thicket]

[next bronze]

you have the worng idea of what this field is about, you don't learn things to fuck with people

[gilded sundial]

Out of discord 😹

[fathom pendant]

[upper ruin]

Oh my god

Listen here mr chandra gupta

[fathom pendant]

<@&861185840277487616> since you don't wanna read

[fathom pendant]

some people did do that

[upper ruin]

U don't do that here

[gilded sundial]

I going

Bye

[upper ruin]

bye

[fathom pendant]

good, bye

[lusty thicket]

bye

[upper ruin]

See, idk if that's just QA or some sort of FIC checking the integrity of the server.

[rapid sparrow]

bye

[stiff bone]

troll

[fathom pendant]

indeed

[stiff bone]

I really don't think this semi-finished product got the wrong server.

[fathom pendant]

no idea what you're talking about, unless you're talking about that dude from a few minutes ago ¯_(ツ)_/¯

[upper ruin]

[fathom pendant]

if you are - then i really don't care lol, they're gone - it's no longer an issue

[stiff bone]

That's exactly what I'm talking about))

[fathom pendant]

i don't care and i'm dropping the issue ¯_(ツ)_/¯

as it's dealt with itself

[fathom pendant]

i did not invite you to dm

[stiff bone]

But I’m not cultured and don’t require an invitation

[fathom pendant]

You still need to ask

it's

1. in the rules
2. just generally best practice

[rustic sage]

im new, hello

[next bronze]

where's the guy that needed help with the AD module

[fathom pendant]

this guy?

[lusty thicket]

same

[next bronze]

yes thanks

[next bronze]

check what other lsa commands are there with mimikatz

[faint gulch]

I used that and obtained just the NTML of the user, the plaintext field is empty 🥲

[next bronze]

mimikatz has more than just logonpasswords

check the lsadump module

[faint gulch]

It was something from the module itself? I have gone through my notes like 10 times, so if it was there I probably have missed it. Thanks for the hint, I will research that option now!

[next bronze]

not in the module, but it's good to know more

mimikatz is also not the only tool that can do that

[fathom pendant]

secretsdump ye?

[next bronze]

yeah, and netexec

[umbral fulcrum]

someone knows what is the forum for HTB support

[frosty spade]

hey guys and gals was looking for a distro that has all the tools i need for the academy side of htb ive run both kali and parrot security and pwnbox edition but it sucks having to stop the learning to try and figure out why and how to install a tool they want me to use I get that its good practice and all but im finding a module that supposed to take x amount of days or hours is taking me alot longer due to trouble shooting error messages

[next bronze]

no there isn't. and being able to install tools yourself and get them working is an important skill, it's impossible to have every tool ever installed in a machine

[acoustic owl]

You can get support here
https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[frosty spade]

i get that xerous like i said i know its good practice getting my linux fu up but i keep hitting walls with packages no longer supported or incorrect libraries off my head the last one i needed python 2.7 but the distros ship with python3 i know i could build from source or get the deb package of the lower version but thats beyond the scope of the module i was on this being an ever evloving feild i understand that itd be tough but couldnt the pwnbox instance that you spawn have the prequistes or even everything there in that specific module that one would need

i know something like that would take a lot of time and effort

[next bronze]

generally kali carries more tools than parrot, I can't say that I spend a lot of time installing tools and troubleshooting them

[lean pine]

i'm working on the live engagement of the shells & payloads module, specificatily on the second host, the blog one, i know htb wants me to use a prewritten metasploit script but i was trying to exploit the webserver myself. there is a file upload vulnerability, there is actually a magic number check on the files which i bypassed simply appending a php payload (<?php echo "hello"; ?>) to the end of a legit png file. i managed to change its extension to php and access it on the server but the code just isn't there. i checked how the metasploit script does it and it doesnt seem any different from how i did it. what is wrong? (metasploit script https://www.exploit-db.com/exploits/50064)

[frosty spade]

thats true i switched cause i figured that the partnership with parrot that they wouldve done what ive been talking about

[cobalt trench]

When trying to connect to the server I get this error message. I already confirmed that I have mssqlclient.py installed and I even tried it on the ParrotOS web shell and I get the same error. Is this an issue on HTB side or am I doing something wrong?

[frosty spade]

Beginners in Cyber Security

If you don’t know which tools you need yet or how to set up a hacking VM/OS, this is the answer on how to start your hacking journey.

[next bronze]

either use just mssqlclient.py or impacket-mssqlclient.py

[cobalt trench]

Thank you

[fathom pendant]

Some tools only have installs from their github

[frosty spade]

marcie you think it may have been an licenseing issue

[next bronze]

licensing issue? majority of foss tools don't have licening requirements

what are you trying to install

[faint rampart]

if this is a new kali install you gotta use impacket-$TOOL.py

[fathom pendant]

Some tools do require licenses to use full functionality but most are open source and don't

Nessus, Burpsuite are ones that come immediately to mind

[next bronze]

neither of those are open source tho

burp should be preinstalled in kali

[fathom pendant]

I meant in terms of what's not open source

[frosty spade]

cme bloodhound windows exploit suggester ive made it through what ive ran into so far or found ways to do or get what i needed without them but itd be nice if when a module says use x tool to get x from user z that they where there and i didnt have to take the time troubleshooting

[fathom pendant]

Bloodhound is constantly evolving and iirc is very limiting anyway. But cme needs to be installed either via pipx or poetry

[next bronze]

pipx, poetry is for dev

it's just one command to install cme

[fathom pendant]

Ye

And netexec is the new thing instead of cme

[frosty spade]

yall get what im saying though for simplicitys sake

[faint rampart]

imo you learn from installing tools, else no one would know or care how apt,pip,poetry,npm,pipx,cargo,gem etc work since everything is readily available and ready for you to use.

[next bronze]

I mean really just read the docs of the tools and follow the steps, those work 99% of the time

[fathom pendant]

most of the pre-installed stuff is good to go. And most tools are well documented to install ¯_(ツ)_/¯

[faint rampart]

💯

[frosty spade]

not from my experiance

[fathom pendant]

some tools it's simply pipx install -r requirements.txt after cloning

[next bronze]

idk what to tell you other than either your whole OS is broken or you're doing it wrong

[frosty spade]

i get it and i have learned alot from banging my head against a wall trying to get something up and running but itd be nice not to have to

[fathom pendant]

Give an example of a tool you struggled with

[faint rampart]

Ive noticed when I struggle with installing a tool its usually due to lack of understanding of a fundamental thing like how gpg keys in apt work, or because I didnt understand what the installation docs were talking about. Its most likely the case here with him as well

[fathom pendant]

In some cases you would need to add the path to your $PATH but I think installs with pipx you can do ensurepath

[next bronze]

yeah pipx makes things piss easy, it handles all the vnevs and shit

[fathom pendant]

Most docs are well written/copy-paste. But there are a few that have been stupid

Iirc installing sqlplus or w/e was a pain, and I'm glad i got it installed with relative ease

[frosty spade]

it could be lack of understanding or a crappy readme ill look into pipx the point i was trying to make is if im learning about one thing i didnt want to have to leave that to learn about something completely off the beaten path cause by the time i got back to what i had set out to do originally i found i had to go back and redo what i had already done if that makes any sence

[drifting vortex]

I've tried starting from the beggining again and taking a day break im kinda stuck here on Oracle TNS in the footprinting module 😦

[fathom pendant]

A lot of this is just basics

[drifting vortex]

I keep on getting || bash: sqlplus: command not found || I am using the provided virtual machine from the HTB website

[frosty spade]

$sudo apt install crackmapexec
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
crackmapexec : Depends: python3-aioconsole but it is not installable
Depends: python3-lsassy but it is not installable
Depends: python3-neo4j but it is not installable
E: Unable to correct problems, you have held broken packages.

[fathom pendant]

This section sucks. But if you could explain your issue more it'll help us point you in the right direction

[fathom pendant]

Add --fix-broken

[fathom pendant]

You need to install it

[frosty spade]

sudo apt install crackmapexec --fix-broken
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
crackmapexec : Depends: python3-aioconsole but it is not installable
Depends: python3-lsassy but it is not installable
Depends: python3-neo4j but it is not installable
E: Unable to correct problems, you have held broken packages.

[fathom pendant]

Weird

[faint rampart]

Just go to the github and follow the docs

[fathom pendant]

Try just sudo apt install --fix-broken

[faint rampart]

a simple clone of the netexec repo and pip3 install . would fix all of that

It downloads dependencies as well iirc

[fathom pendant]

The docs are even simpler

It's like 2 lines iirc

[frosty spade]

the sudo apt install --fix-broken didnt work

[faint rampart]

because they are python lib dependencies and I dont think those are all in apt directly

[fathom pendant]

The pipx install method should work

[drifting vortex]

@fathom pendant I just get a 404 not found error when I run the download commands provided in the section

Got any ideas on how to get around it?

[fathom pendant]

Weird

[drifting vortex]

I know 😦

[fathom pendant]

You're on the pwnbox and have paid for cubes yeah? Or still free

Bc free has limited internet access

[drifting vortex]

Someone on here told me that because im trying to run python in a parrot OS its causing issues, Could that be it?

[drifting vortex]

I paid for the whole thing

[fathom pendant]

Thats the dumbest reason

[drifting vortex]

I bought all the cubes and paid for it all

[frigid marlin]

i can't unlock any modules anyone know what's the problem is ?

[drifting vortex]

I'm glad im not going crazy

[fathom pendant]

I can run python in my parrot just fine

[fathom pendant]

Turn off ad-block

[frigid marlin]

k

[next bronze]

what are you trying to install

[fathom pendant]

Likely sqlplus

[frigid marlin]

thx bro

[frosty spade]

pip3 install
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
python3-xyz, where xyz is the package you are trying to
install.

If you wish to install a non-Debian-packaged Python package,
create a virtual environment using python3 -m venv path/to/venv.
Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
sure you have python3-full installed.

If you wish to install a non-Debian packaged Python application,
it may be easiest to use pipx install xyz, which will manage a
virtual environment for you. Make sure you have pipx installed.

See /usr/share/doc/python3.11/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

[fathom pendant]

The module gives you a whole script

[fathom pendant]

Add --break-system-packages

[next bronze]

just use pipx

[fathom pendant]

That too

pipx might also throw that venv error

[next bronze]

damn even the wiki is down for cme

https://www.netexec.wiki/getting-started/installation/installation-on-unix

[fathom pendant]

^

[drifting vortex]

I guess in this case sqlplus

[frosty spade]

pipx install crackmapexec
Fatal error from pip prevented installation. Full pip output in file:
/home/liquid/.local/pipx/logs/cmd_2024-01-27_12.04.27_pip_errors.log

Some possibly relevant errors from pip install:
ERROR: Could not find a version that satisfies the requirement crackmapexec (from versions: none)
ERROR: No matching distribution found for crackmapexec

Error installing crackmapexec.

[fathom pendant]

Did you copy/paste the script from the section?

[fathom pendant]

Just install netexec

It's the same as cme but better

[next bronze]

pretty sure the last time I check it those things aren't in the parrot apt repo

[fathom pendant]

They may have been pulled

[frosty spade]

i cloned the git

[fathom pendant]

I'd have to ask palinuro about it

[frosty spade]

this is an example of what ive run into

[fathom pendant]

They were when I installed it

[drifting vortex]

yep

[fathom pendant]

Follow the instructions from the netexec wiki

It'll save you a whole bunch of time and effort

[frosty spade]

is the command structure the same as cme

[drifting vortex]

obviously the only thing I would have changed would be IP address but they dont ask for that.

[fathom pendant]

It's literally the same

[fathom pendant]

There's an install script yeah?

[fathom pendant]

The main contributors forked cme into netexec

[frosty spade]

cool ill follow your suggestion but do you see my frustration

[fathom pendant]

Due to disagreements with the main dev/owner

[drifting vortex]

We are talking about this right?

[fathom pendant]

¯_(ツ)_/¯

[lapis pelican]

Why are you always online?

[fathom pendant]

Yes

https://tenor.com/view/you-can-sleep-when-you-die-jonny-cota-making-the-cut-get-to-work-all-nighter-gif-16988026

[drifting vortex]

I'll re run it again :/

[faint rampart]

theres no beating that 🤣

[lapis pelican]

That's a very wrong way of putting it.

[frosty spade]

I gUeSs IlL JuSt TrY HaRdEr

[lapis pelican]

Yes.

[faint rampart]

try smarter

[fathom pendant]

I mean you were told a dozen times to just install netexec

[lapis pelican]

Don't try at all. Read writeups lol.

[fathom pendant]

Buy exam writeups

[faint rampart]

Might as well switch to baking as a profession 💀 . Never skill depereciating to read Receipes lmaoooo

[frosty spade]

i didnt get my grade 10

[fathom pendant]

?

[frosty spade]

baking is not simple my friend

[lapis pelican]

Are you okay?

Take a break.

[faint rampart]

But you can always read a receipe if you're stuck 😉and it would actually make you better at baking lmao

[lapis pelican]

I read and watch recipes but never actually bring them to existence lol.

[next bronze]

it's not in the apt repo for parrot

[fathom pendant]

At least for pwnbox

Which is dumb lol

So Pali or tissy must've pulled it for some reason

[faint rampart]

Now that I think of it, its a pain installing sysreptor because of this exact thing
I just used Bookworm's apt repo lmao

[next bronze]

yeah adding another apt source should fix it but that's a pain

[lapis pelican]

I didn't have to go thorough all this pain because my parrot got corrupted and I installed Kali Linux. Simple! 😄

[fathom pendant]

Funny thing is it worked on mine

So thats the confusing bit for me

[faint rampart]

I use kali as well but I faced the same issues until I switched to bookworm

[lapis pelican]

Personally I like parrot, it runs so smooth on my machine as a VM. Kali Linux is not that smooth but still playable.

[fathom pendant]

The pwnbox is on 6.0 yeah? Does installing -t lory-backports add it?

[frosty spade]

which leads to the question of why the partnership with parrot if another disto is better supported

[midnight coyote]

can i create horror fps games with unreal engine 5 ? (c++)

[fathom pendant]

Probably, but this server isn't for that

[frosty spade]

anyways i love and appreciate yall if i run into any thing ill be sure to reach out

[next bronze]

idk I just booted pwnbox and ran the command

[faint rampart]

may I dm you?

[fathom pendant]

I'm not at mu computer to check

XD

[midnight coyote]

ik i justed wanted to know thanks 🙂

[midnight coyote]

sure 🙂

[faint rampart]

I think you can.

[midnight coyote]

okay

[lapis pelican]

I used Unreal Engine for creating grass.

[drifting vortex]

Its when I run this command ||sudo apt install oracle-instantclient-basic oracle-instantclient-devel oracle-instantclient-sqlplus -y||
I still get the error

[fathom pendant]

It's worked fine for me

[drifting vortex]

So Idk how to progress

[fathom pendant]

Try adding -t lory-backports

[fathom pendant]

Also this

[drifting vortex]

To the end?

[frosty spade]

cause you the best marcie

[zealous raptor]

any easy way i can get gpu support on my vm or should i just switch to qemu

[lapis pelican]

You are frustrated, yes?

[fathom pendant]

Yes, I asked as well in the parrot discord if they pulled it

Mostly bc I know it worked previously, bc I installed it

[drifting vortex]

Comes up as || 'lory-backports' is invalud ||

[fathom pendant]

Hmm

[next bronze]

maybe install from source but it's some oracle crap so good luck

[lapis pelican]

Did you try adding sudo 🙂

[drifting vortex]

Yes

[lapis pelican]

I heard that sudo always works.

[fathom pendant]

take out the oracle bits first and just install the lory-backports

[drifting vortex]

lmao I mean its just not pulling the SQLPLUS

[fathom pendant]

See if that resolves

Sqlplus is oracle stuff

[drifting vortex]

I'm not a fan of oracle 😦

[fathom pendant]

Only oracle I like is vbox

[drifting vortex]

Like this? || sudo apt install -t lory-backports ||

I did not get it to work that way either

[zealous raptor]

does qemu come with gpu support out the box?

[fathom pendant]

I'm not familiar with doing via pwnbox tbq ¯_(ツ)_/¯

[drifting vortex]

ahhh shucks 😦

[zealous raptor]

dont know why but after i installed the guest additions my parrot vm bricked on me

[fathom pendant]

Most virtual software requires you to do pass-through

[fathom pendant]

Sounds like you may have done something weird in install

[lapis pelican]

works on my kali machine

[fathom pendant]

Funny

[zealous raptor]

nah ive used the gui upgrade function so i suspect not

[fathom pendant]

Idk about qemu or any software for macs

[zealous raptor]

qemu works on windows

[fathom pendant]

parrot works on my machine ¯_(ツ)_/¯

[zealous raptor]

crazy

[fathom pendant]

If you have an Nvidia card parrot has docs on how to get them to work properly

[lapis pelican]

This is what happens when you don't sleep.

[zealous raptor]

ive got integrated graphics on my cpu but even then its slower than my dead grandfather

[fathom pendant]

How many resources does your host system have, and how much are you giving the vm

If you give too much, everything shits the bed

[frosty spade]

let the hate flow through you my friend

[fathom pendant]

Hate?

[misty current]

[frosty spade]

try dual booting it gpu installs tend to brake cause the host is already using it in my personal experiance

[zealous raptor]

8 out of 12 cores, 5gb of ram out of 8

im not very good but maybe try spoofing?

[frosty spade]

might have to be in the tools directory

[rustic sage]

sup

[placid edge]

anyone else keep getting issues like these when using proxies? channel 6: open failed: connect failed: Temporary failure in name resolution

Breaks the proxy and takes a while to get it working again

prob shady shitty ssh proxy

might need to do more ligolo-ng to get it smoother

[cosmic obsidian]

.

[hollow furnace]

Hi, I am having trouble understanding something. My nmap scan that has the flag -p- does not discover port 50000 but my scan of port 50000 works. I am assuming its due to some kind of IDS/IPS? The flags on both scans were "-Pn -n --disable-arp-ping"

[fathom pendant]

2 things, syn scan and source port

The Syn Scan should see it, -sS

[hollow furnace]

Ok thanks, I'll try. I was just wondering why it didnt show on the -p- but did on -p

[fathom pendant]

Because you're specifying the port, so it'll do it differently

[hollow furnace]

Got it, thank you!!

[fathom pendant]

If you look at the ids/ips evasion, dns proxying part if you replicated everything except the direct port scan, (switching it to -p-) you'd see it

[hollow furnace]

Thanks, I did get the flag for all 3 boxes but I remember the last box my scan took forever. I am going through them again to write-up more detailed notes and I was trying to side step the long scan so I implemented the -p- to save time and the question struck me.

[fathom pendant]

Np taking notes on alternate ways of doing things definitely helps

[placid mural]

i want help

[fathom pendant]

With?

[manic onyx]

Are servers exploding rn or something? When I spin up a VM I get about 15 seconds of alive time then just 2024-01-27 13:39:20 read UDPv4 [EHOSTUNREACH]: No route to host (fd=3,code=113) forever from the VPN output. Can't seem to access anything on any hosts, have tried in both US and Europe vpn

[lusty thicket]

[snow zodiac]

hey im doing htb starting point and my ping is high nmap scan takes too long. what can i do?

[hollow furnace]

Same... Nmap scans on their servers are unworkable

[snow zodiac]

my internet connection is good but in my opinion its the openvpn slowing it down

[lusty thicket]

#starting-point

[rustic sage]

Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all 4624 events the count of distinct computers accessed by the account name SYSTEM. Enter it as your answer.

SPL i used: index=* sourcetype="wineventlog:security" EventCode=4624 Account_Name=SYSTEM
| stats dc(Workstation_Name) as Distinct_Computers

got an answer of 1, but its wrong. can anyone help?

[buoyant escarp]

ive changed my vpn to eu1 today then it worked

[potent ermine]

I used a different command, in the reading there's a command to remove duplicates, thus effectively showing all the distinct computers.

[dreamy trail]

I'm having issues with connectivity too. Exercise needs me to RDP on to target and it keeps dieing or badly lagging. Are there still VPN issues?

I'm hoping this isn't typical - I signed up last weekend and the labs have pretty much been unusable for most of the week!

[fathom pendant]

this is definitely atypical, seems like the infra took a hit and hasn't fully bounced back yet

[bleak lantern]

Anyone that Already did "INTRODUCTION TO DIGITAL FORENSICS" wanna share some ideas? I just ended the module assessment but I am pretty sure I did in a way not intended by the Module Creator

[blazing juniper]

In the file transfers module, in the first section I solved every questions, and there is an optional question where we can simply train the techniques that were taught in the section.
I managed to solve the previous questions, but 80% of the section talks about setting up quick servers on the attacker host and I don't know how to do it.
When I try for example to set up a FTP server it seems that it creates it only locally, so when I try to reach my FTP server from the victim host it seems unreachable. When i search how to make it reachable it seems to come with a lot of problems such as "port forwarding" ( haven't seen this yet ) and lots of warnings related to "openning my computer to the internet". any help ?

[tranquil axle]

are you making sure you use the correct ip assigned to your by your vpn? You won't be able to reach your ftp server via your "internet" ip, but you and the other host are connected via the vpn and should be able to reach each other via the vpn ip without any port forwarding

[blazing juniper]

in the course section, when setting up the FTP server it says "starting FTP server on 0.0.0.0:21"
but on the victim side, when downloading the file they call it using the command : (New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt', 'C:\Users\Public\ftp-file.txt')
And I don't understand how they got that IP since it says that the FTP server is set up locally ("0.0.0.0" IP)

[next bronze]

0.0.0.0 is all interfaces, not only local

[tranquil axle]

yea it means "all ips you are assigned to", you can type in ifconfig and check your (probably) tun0 ip, thats the one that should be reachable from the victim machine

[blazing juniper]

well, from the victim, i can ping the attacker, so i guess it's there, but when i try to run the command shown in course i'm getting
PS C:\Users\htb-student> (New-Object Net.WebClient).DownloadFile('ftp://<vpn attacker IP>/upload_win.zip', 'C:\Users\Public\ftp-file.txt')

Exception calling "DownloadFile" with "2" argument(s): "Unable to connect to the remote server"

i'm probably missing something obvious, but it's such a new concept for me

[tranquil axle]

and you are sure the ftp server is actually up and running? can you connect to it from a different terminal on the attack host?

[blazing juniper]

yep, and i got all the files i'm expecting to see in its directory when loging as anonymous

[fathom pendant]

^ the ftp server does need to run

[tranquil axle]

and you connect to it using the same ip you used on the victim host? and not 127.0.0.1 or something like that

[blazing juniper]

yes, starting by 10.10.15.XXX

[tranquil axle]

hm, that sounds right so far, I'm not sure where the problem is :x

[blazing juniper]

maybe i'm explaining things poorly, it's difficult only with text haha x)

[tranquil axle]

well I think I understand your problem, it shouldn't say "Unable to connect to server" if the server is in fact reachable. You say it can be pinged and from another terminal you can reach the ftp server so all that sounds fine

[thorn narwhal]

I know nothing about hacking

can somebody give me the basics >

and tell me what to do

and what it is used for

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

I'm having trouble scanning through a pivot host using proxychains, for some reason I can't even ping/nmap the interface with the internal network through proxychains, let alone ping sweep the network, is that normal? I'm working on the assessment for the pivoting, tunnelling and portforwarding module.

I managed to get the target internal network host address using a one liner, but i would imagine that's not the appropriate approach.

i mean I figured the one liner would have to be the last resort option

[fathom pendant]

Icmp doesn't play nice with proxychains

[fathom pendant]

Why would it be a last resort if you have access to that host

[rustic sage]

well I thought the cool/professional way to do it was to nmap through the proxychains.

there's also other tools too. but hmm...

[tranquil axle]

The cool/professional way is ligolo-ng, sadly that’s not in the path

[fathom pendant]

There's no one true way

[rustic sage]

lol I'll keep that in mind

[fathom pendant]

And ligolo-ng works way better than the tools showcased, it's new as-of when the module was written

[rustic sage]

kali has this tool called netdiscover too

[tranquil axle]

You can try it on the module, it trivializes a lot of what you just learned

[fathom pendant]

Maybe once it hits 1.0 they'll update the pivot module to include it

It's really simple and trivializes a bunch of the weird stuff you do for the others

[rustic sage]

I would've never guessed to use the one liner by the way, I guess the psychological factor comes into play, only thing is im not sure why nmap/ping doesnt work, you mentioned that proxychains doesn't play well with icmp but idk why that is, I was able to xfreerdp into the target afterwards

i'll make sure to check out ligolo-ng wrote it down

[fathom pendant]

Xfreerdp doesn't use icmp

It's because it works on a similar network layer level and conflicts with the traffic

[rustic sage]

ah i understand 🙂

[thorn urchin]

proxychains only works for tcp. it doesnt support udp or icmp

note socks5 proxies CAN support udp. proxychains just hasnt updated to include them yet

[thin parrot]

Does anybody take thorough notes on a seperate document?

I have a massive doc with screenshot examples with every concept/command I learn so I can always reference it very quickly but I feel like I'm moving at a snails pace because of it lol

[cobalt trench]

I take notes on commands/attack chains. Anything I need to read I just leave in the module

[thin parrot]

I'm still on Linux basics, I'm just doing it in anticipation once I've moved on from tier 0 and into the higher tiers it might be annoying trying to find where some information is... but I dont even know if I'll have that issue or not

In other words I'm asking if this is a waste of time or not, I can't tell due to my lack of experience with this field

[next bronze]

using a proper notetaking application would help a lot, give obsidian a go

[cobalt trench]

From my experience, I can find information pretty fast. It's the commands/how to fix an error that gives me issues. Thats why I only notate that portion. But everybodys different

[thin parrot]

I'll give it a shot after linux basics so all the newer notes are on there, seems good from my brief search

[thin parrot]

For programming I usually know everything I need to look up but yeah I think I may be taking it a bit too thoroughly

[next bronze]

it's fine to be thorough as long as it has the information you want and you can find it easily. but taking notes is very important

[cobalt trench]

very true

[thin parrot]

Thats how I have structured it

[rustic sage]

gotcha

[thin parrot]

CTRL+F with a keyword will usually pull what I need with screenshot examples from my own practice or the modules

[next bronze]

as your notes grow in size, ctrl f would find a lot of duplicate results, I would suggest splitting them into different notes with different headings

[edgy frigate]

Heya, can anyone help me answering the second question in intro to bash scripting? I'm certain I've got the right answer/gotten the script to print the required result but it's still not accepting?

Answer I gave is ||redacted|| is this a formatting issue on my part or am I just way off?

[next bronze]

input the full command

[edgy frigate]

OH

I'm dumb

[cobalt trench]

whats the command show a cracked hashcat hash again?

I keep forgetting (see this is why you need to notate commands)

[thorn urchin]

--show

[rustic sage]

having issues waiting for targets to spawn for the Pivoting module, taking a long time, hasn't spawned yet (I'm on US EAST). Just noting this isn't the first time it's happened for a sitrep

[unkempt prawn]

It happens to me too, I think it's a target problem, try logging in again and restarting the VPN
If the issues persists, send an email to support

[rustic sage]

after 15 min it spawned ;c

going back to the proxychains nmap thing i was able to scan the target with the -sT option of nmap figured TCP is better than using straight icmp with -sn

[unkempt prawn]

nmap has many options, I don't know your context but you can look at firewall evasion and silent scans if your target is protected
man nmap

I don't remember -sT but -sn identifies devices in the subnet but i don't have a PC in this time 🤣

[glad lichen]

-sn isn't a ping sweep arg why do you compare it with -sT lol

[crimson moon]

How long did it take to complete “Information Security Foundations” path ?

[rustic sage]

what does takes blood mean in the channel blood

new to htb btw

[rustic sage]

-sn: Ping Scan - disable port scan <--- this is in the help idk what you mean by it's not a ping sweep arg, unless there's another im not aware of?🤔

[wooden palm]

I'm doing the nmap module, working on the easy firewall evasion lab.
I'm wondering if I found an unintended solve for it, and am curious as to the intended solve.
||Wappalyzer browser extension in firefox|| simply gives you the answer without you having to use nmap in order to figure it out.

[tranquil axle]

Those are the first people to solve a newly released box or challenge

[rustic sage]

oh really, thats impressive considering how many people work on them

[wooden palm]

Any reason why the alert page on nmap module firewall evasion just randomly increments even when you aren't scanning anything?

[wooden palm]

No

#rules

I highly recommend deleting this, unless you want to get banned for it.

[cerulean orchid]

Demmnnnn

I though this is an hacker group💀

[wooden palm]

It is, you can find a pile of hackers here, but it's not a place where you're going to find people doing illegal stuff.

Right place to learn to hack. Wrong place to ask for help doing things that will get people sued.

[fathom pendant]

it's unintended

[wooden palm]

Did the intended solve use ||netcat to connect to the ssh port to get the banner with the OS version? Nmap couldn't identify the fingerprint, only that it was linux.||

[fathom pendant]

i believe the nmap i used was like -O and -sC

but it's been a minute

[wooden palm]

I see.

These are some pretty fun challenges they have at the ends of the modules.

[midnight coyote]

is it possible to hack instagram accounts with linux, only knowing the username ?

with nmap or metasploit or smth

(i just want to hack my own acc )

to practice

[lapis pelican]

lol

[fathom pendant]

#rules ; even if it's your own account it's still illegal

[midnight coyote]

what if i create an account and want to hack it ?

[fathom pendant]

still illegal

[midnight coyote]

how

[fathom pendant]

you don't own the account, Meta/Instagram does

[real delta]

you don't own instagram, you cannot hack it and if you try you will be caught

[fathom pendant]

(which is why they can just ban you for being a fuckknuckle)

[lapis pelican]

And ofcourse, hacking Instagram is not something you can do with nmap lol.

[midnight coyote]

there is a german youtuber he got hacked by an darkweb user a few months ago and im pretty sure he wasnt caugth

[fathom pendant]

i hack instagram with my samsung smart washer

[lapis pelican]

Unethical

[fathom pendant]

"Hacked" or social engineered

[real delta]

that sounds fake af lmao

[lapis pelican]

True lol.

[midnight coyote]

he had access to his instagram

[fathom pendant]

there was a fairly common Social Engineering trick to get people to download a malicious file which stole web tokens and shit

[lapis pelican]

It's called social engineering

[fathom pendant]

it's been floating around for AGES

[midnight coyote]

so he clicked on hsi link to gain informations

?

[fathom pendant]

he clicked on a malicious file which looked innocuous to the avg person, but ran a bunch of scripts in the background and sent data to a C2 server

[midnight coyote]

tmm

kek

[fathom pendant]

either way: this conversation doesn't belong here

[lapis pelican]

What are you upto btw?

[fathom pendant]

I suggest reading #rules and #welcome

[midnight coyote]

what you do eab

what do you mean

[midnight coyote]

ok

[fathom pendant]

anything re: illegal activities is strictly disallowed

[midnight coyote]

im just asking no one said im gonna do it

[fathom pendant]

we don't do benefit of the doubt here

[midnight coyote]

tamami

[fathom pendant]

not to mention since you don't know what you're doing, you're quickly gonna ask for an IP ban from Meta/Insta if you even try

[midnight coyote]

ok lets say

[fathom pendant]

if you wanna actually learn

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[midnight coyote]

whats gonna happen if a would hack instgram

is it even possible?

[real delta]

https://tenor.com/view/yazarkeolog-gif-19419563

[fathom pendant]

but hacking websites without explicit permission: is a quick way to get banned, and have the police sent to your home

[midnight coyote]

what if i hack fbi

[fathom pendant]

lmao if you hack fbi they might consider hiring you

hi Payload

[midnight coyote]

what if hack us government

[fathom pendant]

either way: this conversation stops here

[acoustic owl]

Wrong channel for such question

[modest mica]

hey help me with introduction to windows comand line skill assessment last question i not able to find it pls help me

[fathom pendant]

this channel is for questions regarding htb academy modules

[midnight coyote]

hey help me with introduction to windows comand line skill assessment last question i not able to find it pls help me

[fathom pendant]

not asking skid questions

[fathom pendant]

skill issue

[midnight coyote]

alr alr im gonna stop really know

chill out kek

[modest mica]

where i seek help

[fathom pendant]

anyway what have you tried, and what are you stuck on

this question requires you to be on the Domain Controller

and run commands there

[modest mica]

i can get event id 4625 but it gives me many i dont find out which is question ask about

[fathom pendant]

ah i believe the module talks about getting a windows event log info

[modest mica]

yes

[fathom pendant]

so use that, just don't filter it with system accounts

the answer will be start with j

[sinful olive]

IN ATTACKING COMMON APPLICATIONS - Exploiting Web Vulnerabilities in Thick-Client Applications - I do the following steps:

• Add to hosts: C:\> echo 10.10.10.174 server.fatty.htb >> C:\Windows\System32\drivers\etc\hosts
• Extract files from fatty-client.jar
• Edit the file - beans.xml: change port 8000 to 1337.
• In META-INF/MANIFEST.MF - remove all hashes (file must end with new line)
• delete the 1.RSA and 1.SF files from the META-INF directory.
• Compile files to a new app: C:\Apps\fatty-client>jar -cmf .\META-INF\MANIFEST.MF ..\fatty-client-new.jar *
• Open fatty-client-new.jar with creds - **get login failed. **
  tried multiple times and restarted machine.. anyone please?

[fathom pendant]

?

[real delta]

ah my bad lol, I thought that was one of the boxes lol

[modest mica]

i wont be able to find name with flag in it

[fathom pendant]

Read the Fatty walkthorugh

[acoustic owl]

Checkout the Video from Ippsec

[fathom pendant]

wait is that the one with the name with a flag?

[modest mica]

yes

okay wait i type question here

What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack? The flag is the name of the user account.

[fathom pendant]

yes username

it's not asking for a flag like htb{..}

[modest mica]

nono

username

[fathom pendant]

and like i said

j* is gonna be the answer

[sinful olive]

thanks I'll try

[modest mica]

no pls tell me procedure pls

i do all but i stuck here i do go online about it but i cant find it

[fathom pendant]

in the logs section it shows how to expand properties of the log

so it'll show the full thing

[modest mica]

but in powershell how you expand

[fathom pendant]

as i said

the logs sections show you how

[acoustic owl]

Look at the log files on the domain controller, not on the client

[modest mica]

i didnt understand

[acoustic owl]

What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack? The flag is the name of the user account.

[modest mica]

yeah but its shows many name

[fathom pendant]

yes

and you should just be able to scroll through it to find it

it'll be fairly obvious once you see it

[modest mica]

what that many name like 70 or something

[fathom pendant]

that's really not a lot

especially since you only need to read the username part

[modest mica]

okay thnk for great help

[fathom pendant]

you can also google

there's like a dozen articles

[modest mica]

ok last help can you send me command for event log id 4625

[fathom pendant]

nope

you should be able to find it by looking back through the module

[modest mica]

ok bye

[fathom pendant]

good luck

i'm not a hand holding type person

most of the info is there in the module itself

[modest mica]

ah i see

ok ok

[acoustic owl]

The idea of the Academy is that you learn independently. If you get stuck, you can ask for help here and you will be given tips to guide you in the right direction. That's exactly what Marcie tried to do.

[modest mica]

hey i want to ask about something but its photo how i should upload here

[fathom pendant]

you need to link your htb labs account following #welcome

[modest mica]

nah nah

[fathom pendant]

unlinked accounts can't send photos; it's an anti-spam/troll measure

similarly; large codeblocks also get removed

[modest mica]

i have photo of my event log but in that how should i take which is username

[urban linden]

when I ssh to target from kali VBox machine, it just times out?

[fathom pendant]

the one that obviously relates to a username

[fathom pendant]

try changing vpn regions

[urban linden]

how do I find student I.D.?

[modest mica]

isit account name?

[urban linden]

thanks

[fathom pendant]

each timestamped log has a few sections of username

[urban linden]

In virtual Box?

[fathom pendant]

from the academy page

if you're not running the academy vpn: well that's your problem

[modest mica]

ok i got it now

and how should i identify if which is indicative of a password brute forcing attack

[urban linden]

so I open downloaded VPN with Kali virtual machine?

[modest mica]

openvpn cmd

[fathom pendant]

with openvpn, yes

[fathom pendant]

a bunch of failed attempts in a row

[modest mica]

okay

[midnight galleon]

In the linux privesc module, Linux Services & Internals Enumeration
it asks for the latest python version, i found that version but it says incorrect

[modest mica]

Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: administrator is this username right
Account Domain: GREENHORN

[midnight galleon]

is there any specific format?

[fathom pendant]

something like that

but yes it's the account Name: portion, for which each log will have a few

[acoustic owl]

Check the system to see which versions are installed. You can install several versions in parallel

[modest mica]

ok

[midnight galleon]

i checked the binaries and the installed ones, i found two versions ,but still WA

[modest mica]

its not in the table i look into whole table

[fathom pendant]

the answer isn't administrator btw

if you scroll through you should be able to see it

[modest mica]

i know i check whole there is no flag name (The flag is the name of the user account.)

[fathom pendant]

the name of the user account that is being bruteforced is the name of the flag

there's no section that's called "Flag name"

[modest mica]

i know but there is only administrator,user1,user0,and other how i find diff one

[urban linden]

I must be doing something wrong for this vpn?

[fathom pendant]

each log has 2 sections for account name

so you're on the right track; but missing a step

[fathom pendant]

wdym?

[modest mica]

yeah but there no other name

[fathom pendant]

it's just
sudo openvpn /path/to/academy-regular.ovpn
note* replace /path/to/ with wherever you have the vpn file downloaded

[fathom pendant]

yes, there is, i'm looking at it right now

it's after "account for which logon failed"

in each section of the log

if you do | select-object timecreated,message | before the format-table command you can see the timestamps

and more accurately/better split each log

[modest mica]

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} | Select-Object -Property * i type this

[modest mica]

it gives me nothing

[fathom pendant]

you just need to manually review

it'll take a few minutes

you don't need to select all propreties

also add |Format-table -Wrap

like i said you're really looking for the section after "Account for which Logon Failed"

the "subject" doesn't matter

[modest mica]

can u give one last hint

[fathom pendant]

tbh i've given you as much as i possibly could

it's all there, you just gotta look

[modest mica]

i m looking but theres no flag

[fathom pendant]

ok, what do you mean by there's no flag

because we might be misunderstanding each other

because i said previously that the answer isn't a flag format

it's just a username

[modest mica]

ok how i find that username beacuse heres too many

earlier i type all name but it got wrong answer for evry name

[fathom pendant]

again if you look at the logs you're looking for the "account for which Logon Failed" section

not the "subject" section; and no, you didn't type every username :)

because i'm looking at the right name on my screen

[modest mica]

i am looking them again

[devout hatch]

I'm having the same issue, it puts quite a tight time limit on getting an answer, I'm just sat refreshing the status page without doing anything and it gets to 100 in like a few minutes . Did you manage to find a solution?

[wooden palm]

No, but did finish the module.

[devout hatch]

OK, good to know. Maybe I'll come back to you for some hints 😉

[modest mica]

ok so start again i set my connection with ssh user10@ip and then password of previous question answer the start powershell and then i type this

[fathom pendant]

btw you can do ctrl+shift+f to do a search in the terminal; and search for "Account for which Logon Failed" you'll need to scroll down a bit to see username

[modest mica]

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} | Select-Object -Property * | select-object timecreated,message |Format-table -Wrap

[fathom pendant]

you don't need to do Select-Object -Property *

[modest mica]

ok

[fathom pendant]

2 things you need to keep in mind

successive, meaning if another username breaks it up: then you stop counting and start fresh

patience

[modest mica]

yeah thats why i am doing this for 3 hours

[acoustic owl]

Read the question again. You have to log in to the DC and look at the logs there

[fathom pendant]

also ^

you need to be on the DC for you to even get the right answer

[fathom pendant]

are you ssh into the domain controller from the earlier question?

[modest mica]

ok

[fathom pendant]

bc tbh reading the instructions is really crucial to answering questions

[urban linden]

i cannot get it to open\

[modest mica]

no

[fathom pendant]

elaborate, you don't need to open it with anything

[fathom pendant]

then do that: that's the crucial part of this whole thing

as stated in the question

[urban linden]

i cant start the vpn

[fathom pendant]

can't start

thx great troubleshooting :)

[urban linden]

how do I find student id for username?

[fathom pendant]

you mean for linking your account?

academy doesn't have an ID to link with; it's only on labs atm

[urban linden]

for username to ssh to target

[fathom pendant]

oh

[modest mica]

hey i forgot how to that dc thing where i can learn again

[fathom pendant]

usually it's given in the question/instructions

[urban linden]

if I spawn it gives it to me

[fathom pendant]

the dc ip is given in one of the earlier questions

[urban linden]

htb-student?

[fathom pendant]

yes

[modest mica]

yes there is

[fathom pendant]

then just ssh with your current user/password

¯_(ツ)_/¯

[urban linden]

"with user "htb-student" and password "HTB_@cademy_stdnt!"?

[fathom pendant]

yes

if you're not connected to the vpn, you won't be able to connect to the IP

[modest mica]

but how do we use that ip from earlier question

[fathom pendant]

[urban linden]

why I am trying to figure out how?

[fathom pendant]

ssh user10@ip

from your current ssh session

[modest mica]

so ip from where

[fathom pendant]

ok you're gonna need to slow down and stick to one question at a time

[modest mica]

which we generate or earlier question one

[fathom pendant]

so: first you ssh to the target IP with the user10; then ssh to the Domain Controller IP from the earlier question

[modest mica]

but there no password

[fathom pendant]

it's gonna be your current user password

how did you manage to do it earlier

[modest mica]

hehe

find it

thnk i lot today

learn*

[fathom pendant]

key takeaway: read the instructions

[modest mica]

yeah

[lapis pelican]

MarcieLee

[urban linden]

so how do I riun the VPN download file? How do I know if it is running?

[lapis pelican]

Where are you from?

[fathom pendant]

i swear i slept

[lapis pelican]

I can't agree.

[fathom pendant]

sudo openvpn /path/to/file.ovpn

[urban linden]

do I have to use sudo as root?

[fathom pendant]

if you're already in the folder that the ovpn file is in; then
sudo openvpn file.ovpn

[fathom pendant]

i will whack you with a newspaper if you su to root on a regular basis

[urban linden]

lol

[fathom pendant]

you rarely, if ever, are actually required to su to root

[modest mica]

yes first go to that folder where your vpn file stored at

[fathom pendant]

that's the WHOLE REASON sudo exists

to prevent people from accidentally running a malicious command that requires root permissions

i.e. rm -fr / --no-preserve-root < - running this as root will nuke your system

[urban linden]

maybe I will just switch!

[modest mica]

before starting anything go learn setting up module its free

[fathom pendant]

whoever/wherever you learned that you need to su to root for things is wrong

i will not stand for continued stupidity

[next bronze]

wrong

I do, fight me

[fathom pendant]

difference: you have braincells

[next bronze]

also wrong

[fathom pendant]

but also

[next bronze]

I don't

[modest mica]

this cmd dont run warning

[fathom pendant]

🗞️

[fathom pendant]

my brother in christ

[acoustic owl]

https://x.com/seclilc/status/1643670546675113988?s=61

lil c (@seclilc) on X

The simple Linux trick all noobs should know!

Twitter · Apr 5, 2023, 5:42 PM

[next bronze]

[fathom pendant]

I TOLD YOU that the command is malicious

I TOLD YOU that it will nuke your system

[urban linden]

lol

[modest mica]

na no christ

[fathom pendant]

yet you still ran the risk

[modest mica]

i didnt i search guuglu

[fathom pendant]

normally people meme that command as "this will improve your computer by removing the french language"

[lapis pelican]

Listen, writing down such dangerous command is not a joke. I did rm -rf /home once and my system broke.

Since then, I never switched to root user.

[modest mica]

thats good for lazy ones

[fathom pendant]

¯_(ツ)_/¯

[lapis pelican]

Some people think they're smart, but they're not.

[fathom pendant]

if you know what rm is; and know how to do bare minimum of research you can find out how things are

[next bronze]

that's kinda on you if you ran the command tbh

[fathom pendant]

rm - remove
-r recursive
-f force
/ root of the filesystem

[next bronze]

especially when it's said don't do it, it's bad

[fathom pendant]

i think most fs now warn you about it

[lapis pelican]

fs?

[fathom pendant]

most

fs- filesystem

i should say OS

but i'm too lazy to edit

[lapis pelican]

Are you human or ChatGPT sponsored human AI?

[fathom pendant]

neither; just an idiot

[lapis pelican]

Do you think having too much knowledge is harmful? What do you think?

[next bronze]

why would having knowledge ever be a bad thing?

[lapis pelican]

You say it, because you don't have it?

[fathom pendant]

knowledge is power, power corrupts

[urban linden]

home/kali/Downloads/academy-regular.ovpn

[faint rampart]

sometimes ignorance is bliss.

[fathom pendant]

also knowing is half the power

[urban linden]

didnt work

[modest mica]

its not bad but people can manuplate it and serv as dangerous

[fathom pendant]

you need to have the leading /

[urban linden]

ohh

before home?

[next bronze]

maybe, but not towards the things that I want to know

[fathom pendant]

yes

otherwise it just goes based off the current working directory

[modest mica]

just do cd to it and open new tab for other commands

[fathom pendant]

once you get it to run, you should see near the bottom "Initialization sequence completed"

after that, just open a new terminal and you're good to go

[lapis pelican]

Congratulations! You know openvpn!

[urban linden]

sweet

[fathom pendant]

i open a whole new terminal when i run openvpn, to prevent me accidentally shutting it off

[urban linden]

finallythanks

[modest mica]

hey i am getting this in vpn error : Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #4788 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

[fathom pendant]

sometimes it does that ¯_(ツ)_/¯

[modest mica]

same i do as well

[fathom pendant]

especially if you temporarily lose connection

even if it's just for a moment

[urban linden]

so how do I find htb-ac-<number/i.d>?

[modest mica]

bro dont go every where

just learn free module first the u get hold of it

[urban linden]

my username is BubbaClutch, but it never works, and they make it htb-ac-numbers

[modest mica]

my man how you explaining looking like u flying deathstar

solo

[next bronze]

My name is Inigo Montoya

[next bronze]

why do you need the number? it's just assigned when you spawn pwnbox, doesn't affect anything

[fathom pendant]

if you're using your own vm, you don't need to worry about that

also: big tip -- don't run the pwnbox (in-browser vm) and your vpn at the same time

otherwise you're gonna have a bad time

[urban linden]

well I just the number for pwnbox last time, it worked and that is nowhere on account

[fathom pendant]

you're using a kali vm now; you don't need to worry about any pwnbox details

[urban linden]

so I ssh to target, asking for the password and says access denied

[fathom pendant]

yes: the target has it's own credentials

[urban linden]

use what username?

[fathom pendant]

read the question and it'll tell you

and usually it's right above the first question if it's necessary

[urban linden]

i gor the password what it says to use

i know

[fathom pendant]

also to paste into a terminal -> ctrl-shift-v

[urban linden]

what username do I use ? kali vm username?

[fathom pendant]

no

[urban linden]

it says use htb-ac-student

[fathom pendant]

no, it doesn't

it says htb-student

ssh htb-student@ip

[urban linden]

how do I terminate current ssh ?

does it matter

[fathom pendant]

wdym current ssh

what module and section are you working on?

[urban linden]

linux fundementals

[fathom pendant]

still didn't clarify current ssh

once you ssh into the target once; you don't need to do it again during that session

[urban linden]

asked if I wanted to connect, typed "YES" and said the ip has added

but i did with a completelhy different username

[fathom pendant]

i feel like there's a language barrier

or you're misunderstanding

[fathom pendant]

if you do it with an incorrect username it'll still ask you to add the ip

then tell you no after you fail to login

[urban linden]

htb-ac-111144450, is the username it allowed me access with?

[fathom pendant]

no

not at all

not even remotely correct

read the question

[urban linden]

so enter closes the connection

[fathom pendant]

read it very carefully

[next bronze]

I think they're mixing up spawning pwnbox vs ssh'ing into the target

[fathom pendant]

they give you credentials to use

[fathom pendant]

likely this

Spawning target is when it gives you usually a 10.129.x.x ip or a public_ip:port

the "spawn instance" is for the pwnbox

they are functionally and completely different

this is what you click to spawn the target

you should

1. terminate the pwnbox instance
2. read instructions

[urban linden]

wasnt in pwnbox, thanks , im in!

[fathom pendant]

you never need your htb account id for any module excersizes

[urban linden]

i was understanding it like I had to put my student id in place, I didnt relize username was that vague

[fathom pendant]

you are always either
a) given a username/password to use
b) given a username to bruteforce a password list with
c) given the tools/knowledge to get a valid username/password

[urban linden]

i think to much into it, it is not that complex

[fathom pendant]

it's not really vague, it's just you misunderstanding

username is the name of the user you're connecting as

very little to be vague about

especially when you're given the credentials (creds)

[severe eagle]

hey everyone anyone complete the intro to assembly language Im having bit of issues with loops has anyone completed? thank you in advance

[next bronze]

explain what issue you have and what you have tried

[long crypt]

I'm having an issue with the File Inclusion module. When you have to find the user who begins with the letter b, I know you have to put /etc/passwd after language= but it's not working for me

I've seen other people do the exact same thing but It doesn't work for me

I've tried using curl too

[severe eagle]

xreous is that for me or Lamp

your message?

So i edited the loop.s that u download to mov rax, 5

[next bronze]

how can I reply to a message that has not been sent

[severe eagle]

instead of 2

runned the debugger

all hexes are wrong

then tried to run it without cause the rcx is 5 on loop already? maybe i reading the source wrong but the loop at the bottem with imul rax, rax I am not sure if i have to adjust that or the rax above

[lapis pelican]

Finally MarcieLee slept.

[next bronze]

look at the value of the rax register

[severe eagle]

is that through the debugger gdb

[next bronze]

yes, that's where you find the answer after the loop as been run 5 times

[severe eagle]

so im doing it right change the rax to 5 from 2

[next bronze]

no, you just loop it 5 times, don't change anything else in the asm code

[severe eagle]

so i dont have to edit the code

[next bronze]

you have to edit the code to make it loop

[severe eagle]

so the part of the code im editing is the in the loop: part or above in the _start: part?

thats what im asking?

cause the source information above says u can change that number to loop it or am I reading it wrong?

[next bronze]

read the section again, what is the loop counter? has it already been set to 5? if it already is, how do you make it loop?

[severe eagle]

thats where im having trouble mate and I have read it more then enough times

thats why im asking

[next bronze]

then you're not understanding the section, read what I have asked

[severe eagle]

lol ok

anyone else on here done it that can actually help me and not give vague answers that state the obvious

I have read that mate and the previous over 4 hours now before asking on here

[next bronze]

bro really out here just waiting for the answer to be given instead of understanding the materials

[severe eagle]

Im not a time waster so all good will ask someone else

not waiting for the answer

asking for help so i can understand how to get to the answer

but you do you mate i will ask someone else

whats the point in wasting time just to get the answer without understaanding these modules unless your learning are pointless

[rough flame]

Need help with Common Session Variables (Account Takeover) section in Abusing HTTP Misconfigurations module, missing a step in bypassing ||MFA||. Can I dm someone?
Edit: nvm, finally figured out.

[severe eagle]

Hey XreOus go on to the page with loops mate have read yourself it says mov rccx, x Sets loop (RCX) counter to x
loop jumps back to the start of loop until counter reaches 0

lol making it loop and have I read it now can you understand the fustration of getting vague replies like read the materials mate when I told you above I tried that and didnt work?????

[next bronze]

this is the closest I can go without giving you the answer, what is the loop counter set to?

[severe eagle]

thats the counter for rcx though so would rax need to be changed???

cause the question says loop it 5 times but needs the rax value

so wouldnt u want to loop the rax 5x I dont understand it

in the loop section I changed it to
loop loop

under imul

[next bronze]

then just run the damn thing

you say I'm giving you "vague" answer but that's because you don't understand these sections, I'm not gonna teach you what's already been taught in the sections

[severe eagle]

lol ok mate so cause I have tried your answers and explained it why thats no good ok mate

if i didnt understand how have i completed the other sections

cheers for stating the obvious of the material though mate 🙂

[lapis pelican]

How do we confirm that a zone transfer was actually done?
https://academy.hackthebox.com/module/144/section/1256

I can see this section in the zone transfer query response. Is this something we did or was it something already in? I need more explanation on this.

[severe eagle]

I have completed this module a while ago

I remember i had alot of issues running these commands with my own virtual machine even with /etc/hosts added

run it through there machine

[fathom pendant]

when you perform the zone transfer; it'll tell you

zonetransfer.me is a public site; no need to add it to an /etc/hosts

[lapis pelican]

What about the gibberish text I shared in the screenshot?

[fathom pendant]

that's just the responses based on subdomains

[severe eagle]

Hey MarcieLee have you completed the introduction into assembly language by any chance

[fathom pendant]

no

[severe eagle]

no worries 🙂

[fathom pendant]

i suggest stepping away from the module for a bit and you might be able to get it

[severe eagle]

Oh i cant its kiling me I have spent hours and hours on it

[lapis pelican]

Take a break

[fathom pendant]

when you step away and do other things it allows your brain to background task thinking about it

and in the middle of you doing something else you might have a revelation

of "oh, i'm dumb"

[lapis pelican]

Sometimes, these scenarios make me wonder. The target IP is the DNS server IP or inlanefreight.htb IP?

[fathom pendant]

yes

[lapis pelican]

What kind of response was that?

[fathom pendant]

in some cases they're both

[lapis pelican]

Oh wow.

Thank you for not sleeping when I needed you.

[fathom pendant]

but the question is asking you to pull the nameserver of the inlanefreight.htb domain

so -> query that

[lapis pelican]

Which means the domain name of nameserver, yes?

Confirm me one thing. nslookup is used to find the name server, right?

[fathom pendant]

domain: youtube.com
Fully Qualified Domain Name: www.youtube.com

[fathom pendant]

yes

everything you need to figure it out is given in the section

:) all the syntax is there

[lapis pelican]

and nameservers are ... dns servers?

[fathom pendant]

they can be

a nameserver is a server that points to other records a domain may have

[lapis pelican]

Alright, I am gonna test a few things. Don't sleep for the next 1 hour.

[fathom pendant]

1.1.1.1 and 8.8.8.8 are public DNS servers for instance

1.1.1.1 being cloudflare, 8.8.8.8 being Google

[lapis pelican]

Just for an example, see the below pic.
The DNS server which responded to the query was 10.100.0.1 and the query result is the nameserver (which can be a DNS server too). Is that correct?

[fathom pendant]

yep

[lapis pelican]

Perfect.

[fathom pendant]

the #53 is just how it formats the port

[lapis pelican]

Yep, understandable.

[fathom pendant]

it responded via port 53 (the known default DNS port)

[lapis pelican]

You are no less than GPT.

[fathom pendant]

as you can see in the other part of the request: nameserver =

meaning both of those nameservers can be used

sometimes there's only 1

the reason for multiple is load balancing

:P so that there's less chance of huge traffic bricking it

[lapis pelican]

So, should I add that IP in /etc/hosts file ?

[severe eagle]

/etc/hosts for local ips

[fathom pendant]

^

[lapis pelican]

Yes, it's a local ip.

[fathom pendant]

the target ip and domain should go in your /etc/hosts file

[lapis pelican]

but what if it's a DNS server I mean.

[fathom pendant]

so
ip inlanefreight.htb

you can add the nameserver to the /etc/hosts file once you find it

[severe eagle]

I just found the key to mine hahaha

[fathom pendant]

¯_(ツ)_/¯

[lapis pelican]

I already did it. But as you said that it can be a DNS server as well. So in the case, adding the ip in hosts file could be problematic or no?

[fathom pendant]

nope

(because that's not how this works)

[lapis pelican]

Mind explaining the working which I guess I don't know?

[fathom pendant]

No

there's plenty of resources out there you can google

[lapis pelican]

okay

[fathom pendant]

all you need to know for nslookup is that you can use ip in place of the nsx.domain

so like nslookup -type=AXFR inlanefreight.htb ip

nslookup is very much positional oriented

you need to specify domain before the nameserver

with a tool like dig (which isn't showcased here) you just need to have teh @nameserver somewhere

[lapis pelican]

I just use dig for that reason.

[fathom pendant]

nslookup is fully capable of doing zone transfers

and in some cases it's less visually noisy

[severe eagle]

got the answer 😄

[eternal ridge]

hey guys, when I type "sudo -l", I get the "(ALL : ALL) NOPASSWD: /usr/bin/php". But when I type"sudo php -r "system('$CMD');", nothing happend

[lapis pelican]

Use full path of php.

[eternal ridge]

Oh, I just found I have a mistake! When I type "sudo php -r "system('$CMD');", I have get the root, but the cmd hasn't hit me

[fathom pendant]

did you set CMD="/bin/bash"?

when you type whoami it shows you as root?

[midnight galleon]

any welp?

tried writing full line, version only, version with name , etc

[fathom pendant]

3.x

[midnight galleon]

wow didn't really try without python

[fathom pendant]

i think is the format it's looking for

[midnight galleon]

yeah solved
i hope if the format was specified

[fathom pendant]

other plausible reasons: Skill issue

[midnight galleon]

Now in the previous section, apparently i searched the whole box yet didn't find the flag

i tried every single command in the section, read through all the "interesting" files, but i can't find it 😦

[urban linden]

i ssh successfully to target. i log in, even change directories, but then i see this.......

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

[candid lily]

need help on this

active directory attacks skills assessment 1

i tried a lot of ways but im not sure how to connect to DC01

[next bronze]

do you have the admin hash

[candid lily]

yes

i have its pass

i mean the t** user not admin of DC01

[next bronze]

yes, "What attack can this user perform?" as per the second last question

[candid lily]

oh

[candid lily]

dont i need to access to DC01 to do that attack

[next bronze]

no, it can be done from any domain joined machine or remotely

mimikatz or secretsdump

[haughty elbow]

I am stuck on the Attacking Tomcat assignment. I have found the correct user (by simply guessing on the question on HTB) and have now run atleast 5 different password lists with that user (including Xato top 100000 and about 500k lines of rockyou) but I am unable to find the correct password. I also tried two different tools: burp intruder and the metasploit module but nothing. I am unsure where to go from here. Can anyone give me a hint?

[next bronze]

try the tomcat default wordlist

[candid lily]

im so confused, whose password should i get from that attack

[next bronze]

you don't need a password, pass the hash

[haughty elbow]

The one set as default by the Metasploit module?

I tried that ;s

[candid lily]

ohhh

[next bronze]

tomcat_mgr_default_pass.txt, if it doesn't work then you're probably bruteforcing it wrong

[haughty elbow]

I guess I try again, thanks

[candid lily]

hmm rdp seems to be disabled

[echo sonnet]

Bro, how can i start with bug bounty hunt?

I have 0 experience and i down know what do i need to learn and where do i learn

[haughty elbow]

This worked, still dont know what I did wrong before, but thanks

[candid lily]

DC01 doesnt have rdp or remote management, how do i connect?

[unkempt ether]

hydra -l marlin -P pws.list 10.129.32.50 pop3
hydra -l marlin -P pws.list 10.129.32.50 imap
hydra -l marlin -P pws.list 10.129.32.50 smtp
can anybody tell what am i doing wrong i can't brute force the password
attacking common services email services
nvm i found out im autistic

[candid lily]

bruh target ended just as i got cmd execution

[midnight galleon]

what is the intended for Escaping Restricted Shells section? i feel like i solved it in the most dumb way

[limber river]

why this keep giving me syntax error ?
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

[echo sage]

the targets are sooo sloooow! Especially rdp. No matter what VPN Region or RDP Client i use. They need to do sth.

[magic mulch]

Not sure if it will work, but try with -H ldap://IP, -h is deprecated

[limber river]

thanks it works , I tried the -H before but without ldap
thank you

[lusty thicket]

depends, how did you solve it?

[candid lily]

how to do this??? i tried everything i know

ahh help

[slender shoal]

@prisma walrus read #welcome and #rules to verify your account and be able to post images.

[midnight galleon]

|| sshed to noprofile bash, python tty exit python enjoy broune again shell ||

[limber river]

I did it the same way

[cedar void]

anyone else having trouble spawning their machine target IP today? my machine has been spawning for like 5 minutes even after a restart.

[tulip bobcat]

no problems spawning them but they can't be reached even from the htb boxes 😂

[cursive cradle]

Have you done the “information security foundations” skill path?

At the academy, like a good start is getting to know how to handle on the environment so yea, that skill path is a good beginning

[fathom pendant]

Tbh the windows and Linux fundamental courses are a bit rough

[placid edge]

in this module here. https://academy.hackthebox.com/module/67/section/2502

Its telling me to import ps1 files. But i am not able to because of the execution of scripts is disbabled for the user in question.

Any tips?

[fathom pendant]

Can you turn off the execution policy?

[cursive cradle]

I’m taking the Linux one and also watching videos to get a bit the hand (as someone who never touch Linux before…..)

[tulip bobcat]

your environment/targets are working ???

[fathom pendant]

The module is just a fair bit disjointed

[tulip bobcat]

respanwed my box and target a few times still can't reach the target lol 😂 htb please fix this

[cursive cradle]

Agree

[placid edge]

nope. I have tried to use commands such as Set-ExecutionPolicy unrestricted but i get the following error. Access to registry key is denied

[fathom pendant]

Counterpoint: can you run as admin?

[cursive cradle]

Was confused starting also with the workflow and then after the whole sections of that part it just started to tell me about SSH

[placid edge]

nope

[fathom pendant]

Ssh is your friend

[placid edge]

barely lol

slow af but yeah

[next bronze]

either
Set-ExecutionPolicy Bypass -Scope User or
Set-ExecutionPolicy Bypass -Scope Process

[placid edge]

Thank you!

[prisma walrus]

jup.... been bashing my head into a wall for 90 minutes trying to solve a broken target T_T

[cedar void]

Still having this issue too unfortunately

[prisma walrus]

I figured I wasnt suppose to be able to reach the index page so just kept bashijng my head into the wall lmao