modules

[fathom pendant]

Being honest, depending what kind of intern, you're not gonna reach a decent level of Competency in just a month, the cpts path itself can take ~ 3months itself

[buoyant void]

Random question, I'm doing the AD module and was wondering is there any issue with using evil-winrm to access the Windows attack host and run tools like Inveigh from evil-winrm? Instead of actually RDPing into the machine

[fathom pendant]

Inveigh sucks on cli stuff tbh

Evil-winrm also is just bad (but currently no alternatives)

But rdp is generally gonna be better for windows related tasks

[buoyant void]

Got it I tried it with evil-winrm just because RDP connection was absolutely awful, and it was decent but no interactive console on Inveigh like you'd have if you just ran it from the RDP which was annoying

[fathom pendant]

There's also 2 inveighs, the cool exe one and the ps1 script

The exe one is 10/10

[buoyant void]

yeah I tried the exe one from evil-winrm, but next time I'll just RDP to do it

[fathom pendant]

Also fwiw, if you're not already - use the tcp vpn pack

[solar grove]

Hello, I am about to finish the bug bug hunter path (90%) and then I want to continue on the Senior Web Penetration Tester path, do you think I should try to get an award in hackerone before I enter this or should I finish the SEnior web penetration tester?

[fathom pendant]

I mean the senior path is mostly an extension of the bb path

[onyx dust]

how would a h1 award help u pass the test? do they count for flags?

[fathom pendant]

If you want to practice on platforms like h1 no one is gonna stop you, and if that helps you feel validated with your learning then great!

[onyx dust]

i would suggest doing the senior web penetration path and then trying h1 because you will learn things and get to practice in a nice structured environment before trying it on h1 platform which has been publicly tested in many different ways.

it doesn't appear to me to be an extension of the bug bounty path inasmuch as it looks like htb's version of the burp cert

[thin parrot]

Even getting 20 hours a week?

[onyx dust]

dont let any1 dull your sparkle

[thorn urchin]

Go for it if you think you can, but 20 hours a week is actually pretty low for someone wanting to speedrun the course

[fathom pendant]

^

[thorn urchin]

20 hours is what I was putting in when I didnt have much study time and was procrastinating

[onyx dust]

individuals learn at different rates and don't underestimate passion and curious people who have goals

[thorn urchin]

Not wrong, but people should be realistic about their own abilities

finishing CPTS in a month without prior exp would be a legendary feat

go for it by all means tho

[onyx dust]

they said they wanted to become intern level. that means you could do both at the same time considering intern level is up to the organization and what types of education and training costs for which they've tolerance.

it's up to your experience @thin parrot. put in the 20 hrs and see what happens.

it's better than 0 hours

[thorn urchin]

I agree with that

[thin parrot]

20 hours minimum, I’m aiming for 30
But I work 30 hours a week on top of that

Keep in mind I have a cs degree so I’m not entirely out of the loop just some things I’ve never worked with. Linux for example I’ve barely touched till now

[thorn urchin]

also mb. I was reading as finishing cpts in a month, not intern level. Intern level 100% depends on the company like jinn said

interns can vary between total newbs to cutting edge research lmao

[thin parrot]

Yeah no way I’m finishing that. It’ll take me another 4-6 months to get through nearly everything

[onyx dust]

i did all of offsec labs + pg in 8 weeks then got oscp from it

it's doable if you're into it.

also that's like 10 hr a day too

[little flint]

where can i get kali linux for virtual machine?

[onyx dust]

kali.org

[little flint]

what VM do i use?

[onyx dust]

lol

🥲

[thorn urchin]

<@&861185840277487616>

[thin parrot]

I’m not sure what the abbreviations are exactly but I’m doing this to get into pen-testing

[soft cedar]

Your preference

[little flint]

recommend me some

[thin parrot]

^ I like vbox personally

[thorn urchin]

google some

[little flint]

oracle virtualbox?

[thorn urchin]

sure try that

[thin parrot]

Yes, was very straightforward if I remember correctly

[buoyant void]

Virtualbox is great for getting started with VMs, I've since moved over to fully using VMWare Workstation Pro but I never had issues with Virtualbox

[plucky latch]

I use VMWare Fusion as I find it works best with my Mac

[hot grove]

you defintely want to try either vmware workstation pro (free) or virtualbox, those are very straight forward

[fathom pendant]

<@&861185840277487616>

[thorn urchin]

oh fuck its the carpet guy

bro you never gave me the price to hack a carpet

😭 ill never learn how much it is to hack carpets

[vivid storm]

cant pass this phase while running monitor.sh on nibbles:

nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo monitor.sh sudo monitor.sh [sudo] password for nibbler:

it is asking for password. Any clue?

[fathom pendant]

use the full filepath

Your block is getting deleted because automod is seeing it as spam

If you link your account following #welcome you'll be able to post large code blocks

[vivid storm]

sorry, i have no clue on how to link my account , can you help please?

[fathom pendant]

There's directions in #welcome

[thorny hamlet]

Working on the RDP and SOCKS Tunneling with SocksOverRDP section of the pivoting and tunneling module I'm stuck - can anyone assist?

[loud pagoda]

Hey, I am new to hacking and started working on an easy box labeled Bizness. I am doing directory discovery with Gobuster. I have a decent computer and ran a discovery with the wordlist 'directory-list-2.3-medium.txt' It's been around 20 minutes running and the scan is only 23%. When y'all run discoveries, is this wait time normal?

[thorn urchin]

this isnt the channel to ask

follow the instructions in #welcome to access the rest of the server where you can then ask in #boxes

[loud pagoda]

Arigato

[vivid storm]

done, took me some time to figure it out

[vivid storm]

here is what happens after using the full path

nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
'unknown': I need something more specific.
/home/nibbler/personal/stuff/monitor.sh: 26: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 36: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 43: /home/nibbler/personal/stuff/monitor.sh: [[: not found
nc: getaddrinfo: Temporary failure in name resolution
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls -la
ls -la
total 16
drwxr-xr-x 2 nibbler nibbler 4096 Dec 10 2017 .
drwxr-xr-x 3 nibbler nibbler 4096 Dec 10 2017 ..
-rwxrwxrwx 1 nibbler nibbler 4102 Feb 2 20:37 monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$

[glass glacier]

How many modules/sections do people aim to do a day/week?

[vivid storm]

i will be happy if i can finish one module per week

[fathom pendant]

did you put your tun0 ip in the echo command to monitor.sh; and are you running the second listener

[vivid storm]

i am not running a second listener

[glass glacier]

thats a pretty good goal! Thanks for sharing. I've just started so I wanted to look to others to see what their pacing is for the academy.

[fathom pendant]

then you should; reading how the revshell works you need to replace the temporary 10.10.10.10 ip or w/e is in the example to your IP

[vivid storm]

i have the impression it gets worse

[glass glacier]

Well im looking forward to the tough stuff tbh

[vivid storm]

i have the listener in the terminal were i have the shell running on the box, and i have a second running localy listening to port 9443

[fathom pendant]

have the other one listening on 8443 as the bash revshell shows

:)

the error was in name resolution: meaning it couldn't reach the IP from the command

[vivid storm]

ohhhh

[vivid storm]

could not finish it today, but will try tomorrow again. thanks for you help. cheers

[maiden field]

Anyone having trouble spawning targets ?

[plucky latch]

Yup, been trying for 3 hours now

[harsh path]

Hi, Im doing intro to assembly language and i kid you not been stuck on "debugging with GDB" for a week now, I need guidance...Please and thank you

[supple gorge]

haven't done that, but may be helpful to straight up say your question and what you need help with

[rustic sage]

been away from Academy for too long and working back into it... I assume that purchasing say 500 cubes in a one shot is NOT possible. Is that correct?

shit nm

the giant green buttons didn't register

[supple gorge]

yeah you can... but subscription cheaper

[rustic sage]

yeah i see that... it would hold my feet to the fire to simply subscribe 🤔

[supple gorge]

if you no student, platinum best price...

[supple gorge]

You could also buy silver annual

[rustic sage]

i think i would need right around the 500 but i could see myself going into addiction levels within a few months 😄

[supple gorge]

500 = $50... plat $70 or $60 somehthing for 1000

[rustic sage]

yeah i think it'd be $70

but the one-shot silver per annum is definitely looking tempting 🤷‍♂️

[limber river]

68$

[rustic sage]

i don't need certs or pwn boxes though

i'll figure it out

i have a discipline problem i need to solve before monday 😛

n-hours-per-day / 2

[supple gorge]

same haha... but for a matrix and linear algebra test

[supple gorge]

you wanna do htb academy for 12 hours? that's cool

[rustic sage]

nice -- maths 🙂

nah i'm thinking a minimum of 4 hours per day on HTB tho

[supple gorge]

that's probably around the average

[rustic sage]

i have to code too... there's a project i want to do over the next six months. also another 4 hours per day minimum

[supple gorge]

try not to chew more than you can hold... that may not help your discipline issue... but I have no qualification to say anything

Anyways, this is a modules channel, we have strayed long enough, although it is kind of related...

[rustic sage]

bruh i'm actually thinking of drawing up a schedule that starts with 1) make bed 2) shower 3) brush teeth... 😄

[supple gorge]

whatever works for you... best of luck!!

[rustic sage]

understood

thanks

[thorny hamlet]

Weird one here dude and dudettes, rdp session to an internal pivot host keeps dying periodically with this error:
"[05:11:49:143] [10220:10222] [INFO][com.freerdp.core] - ERRINFO_DISCONNECTED_BY_OTHER_CONNECTION (0x00000005):Another user connected to the server, forcing the disconnection of the current connection.
[05:11:49:143] [10220:10222] [ERROR][com.freerdp.core] - rdp_set_error_info:freerdp_set_last_error_ex ERRINFO_DISCONNECTED_BY_OTHER_CONNECTION [0x00010005]"

I am not initiating any other connections... are the target boxes shared?

Doing the "Pivoting and tunneling module" btw

[heavy marsh]

When are the active directory labs going to be fixed? Anyone know?

[buoyant void]

are they not working right now? I'm doing the Active Domain Enumeration & Attacks module right now haven't had a problem yet but I'm guessing you mean the final assessment lab?

[next bronze]

that works too

[heavy marsh]

No, I went back to one of the ones further back in the AD section

I'm on "privileged access"

[heavy marsh]

Yeah I tried switching vpns too.

[buoyant void]

You're a bit ahead of me but so far I haven't had problems connecting to anything, a bit slower than usual on RDP one time I couldnt even connect to the RDP but other than that it seems okay. Hopefully whatever the issue is gets fixed soon

[plucky latch]

How long have they been broken? Ive been trying to do them all night

[harsh path]

" Download the attached file, and find the hex value in 'rax' when we reach the instruction at <_start+16>?" i honestly do not know what im doing here, so far i downloaded the file and linked it to the object file. run the program but im having a extremly hard time understanding debugging in GDB.

[tranquil axle]

If you set a breakpoint at _start and step through the code until you reach _start+16 you should be able to look at the rax register

If you installed gef it should show you where you are in the code and what value each register holds after each step

[quick flax]

what does "CN" mean here?

under the DistinguishedName: CN=htb

[next bronze]

common name

[quick flax]

ahhh

thank you

[real delta]

this server is english only I think

[real delta]

the first CN is common name, the second one is the container the object is in which is users

[hot agate]

How can I hack a website

I am a beginner

[autumn pilot]

Read the #rules first

[hot agate]

pls reaply

[quick flax]

press control+shift+i and delete everything under elements

[quick flax]

thanks bro. what does DC stand for?

[hot agate]

yes And then

[real delta]

Domain Controller

[quick flax]

congrats u have hacked the website

[quick flax]

thanks

[hot agate]

🙂

[real delta]

ya, no problem. AD gets confusing fast just a heads up. Everything has it's own concept and I mean everything lol

[quick flax]

yup, it's taking me days to finish this intro because i'm constantly rereading everything 😂

but eventually it all makes sense

[real delta]

ya, have you tried messing with AD in python with things like ldap3 and impacket's Kerberos utilities?

[quick flax]

nope, haven't reached that point yet

[real delta]

It's definitely a challenge lol.

[quick flax]

sounds like one 😂

[quick flax]

which path are you following?

[real delta]

I don't do academy lol

[quick flax]

damn 🫡

[quick flax]

which box is this then?

[quick crane]

In the GAME HACKING FUNDAMENTALS module, I downloaded the official Cheat-Engine tool and opened it successfully in Windows. However, when I went to load the problematic Hackman process, it could not be loaded, causing me to be unable to complete the module. Someone has encountered the same problem. Is it a problem?

[real delta]

I can't say what boxes require Kerberos cause that might be considered spoilers. I've just been working on a side project that involves AD

[quick flax]

spoilers? oh... didn't know it would be possible to spoil a box lol. Don't they give u an intro of what the box contains before u start it?

[ruby whale]

Module Password Attack - Section :Passwd, Shadow & Opasswd
I tried using mutated list and rockyou.txt both but still couldn't crack it.
Any nudge ?

[fading ridge]

How are the vpn connections?

[ruby whale]

For me I am able to spawn and interact with targets vpn-eu2.

[soft cedar]

Try rock you

[ruby whale]

I tried that one too waited for three hours couldn't crack it

This password module is the most frustating one.

[next bronze]

should be in the mutated list

[soft cedar]

Mutated wordlist is the right way

[placid edge]

So i am doing a module where i need to go the the subdomain of gitlab.inlanefreight.local. Yet when i go there i get redirected to port 8081 that doesnt have anything on it. Anyone that could help me understand why this is happening?

Fixed it by clearing cache.

[soft cedar]

I don’t think that’s the right hash.

[ruby whale]

Sanity check
Created this mutated list
.\hashcat.exe .\inputs\Password-Attacks\password.list -r .\inputs\Password-Attacks\custom.rule --stdout -D2 -d1 > .\inputs\Password-Attacks\mut.txt use same to crack another section
word list contain 187775 words

[ruby whale]

root:$6$XePuRx/4eO0Wuu....<snip> lilUw2EfqhXg.:0:0:root:/root:/bin/bash I got this one

[next bronze]

the hash should be right

[next bronze]

mutated list should contain 94044 words

try --stdout | sort -u > pass.txt

[soft cedar]

Let me see the full hash

[ruby whale]

root:$6$XePuRx/4eO0WuuPS$a0t5vIuIrBDFx1LyxAozOu.cVaww01u.6dSvct8AYVVI6ClJmY8ZZuPDP7IoXRJhYz4U8.DJUlilUw2EfqhXg.:0:0:root:/root:/bin/bash

[ruby whale]

Trying*

[soft cedar]

Alright that’s correct, it should work.
you should try saving the hash in a hash.txt file before using it in Hashcat / JtR

[ruby whale]

I am using txt file as input, as suggested by Xre0uS there is issue with mutated list. after sorting also I am getting 54550 words

[next bronze]

your wordlist seems pretty messed up, do head, what do you see

[next bronze]

hmm okay try again, you should only see english words for the candiates output in hashcat

[ruby whale]

I am not sure what am I missing, I am only getting 54550 words

[soft cedar]

You should follow the section’s command syntax used to create the mutated wordlist.

[next bronze]

nah it didn't work for them because of some igpu thing

try mutating the list on linux maybe, since it uses the cpu anyway

[ruby whale]

.\hashcat.exe .\inputs\Password-Attacks\password.list -r .\inputs\Password-Attacks\custom.rule --stdout -D2 -d1 | sort -u > .\inputs\mut_password.list
-D2 -d1 flags are related to gpu issues and not using --force as suggested by many

[soft cedar]

I see, makes sense.

[soft cedar]

try this then.

[next bronze]

yeah try in linux then transfer out to crack in windows, you should get 94k words

[ruby whale]

I cant try that on linux , I have my attack box on VM 😦 not enough memory to allocate to hashcat

I think chick3nman might be able to help

It might be unrelated issue.

[placid edge]

anyone else seen this when using ligolo?

2024/02/03 11:05:13 [ERR] yamux: Failed to read header: remote error: tls: internal error
ERRO[0000] Connection error: remote error: tls: internal error 
FATA[0000] remote error: tls: internal error     

[next bronze]

lmk when you've got it

[ruby whale]

It didnt even took 30 sec and hashcat cracked the password.

Thanks.

[next bronze]

technical issue, unlucky

give your vm a bit more ram if you can

or could've mutated the list in pwnbox I guess

[ruby whale]

I am not sure what is the issue 😦 , I was been at this for like 4.5 hours

[ruby whale]

Will try that

[ruby whale]

I think it might be related libraries and something related to gpu.

[next bronze]

yeah maybe, well at least the cracking part works

[ruby whale]

Something funny going on with my hashcat xD

[ruby whale]

I found the password in my wordlist too, but for some reason my wordlist is not working.

I hope such issues dont come during exam

[placid edge]

So i am trying to make ligolo work with a module here and i keep having issues.

┌───────────────────────────────────────────────┐
│ Interface 2                                   │
├──────────────┬────────────────────────────────┤
│ Name         │ ens192                         │
│ Hardware MAC │ 00:50:56:b9:ff:e3              │
│ MTU          │ 1500                           │
│ Flags        │ up|broadcast|multicast|running │
│ IPv4 Address │ 172.16.8.120/16                │
│ IPv6 Address │ fe80::250:56ff:feb9:ffe3/64    │
└──────────────┴────────────────────────────────┘

And i try to add the network route like: sudo ip route add 172.16.8.0/16 dev ligolo

But i keep getting this issue. Error: Invalid prefix for given prefix length.

[ruby whale]

this issues comes when to try to give incorrect CIDR range /24

[placid edge]

i dont get it. since the cidr i used was from ligolo

maybe ip issues idk

[ruby whale]

172.16.8.0/24 might work (but I dont any reasoning why it might work)

[next bronze]

you need to give the first ip of the subnet

so if you want /16 it should be 172.16.0.0/16 but that's usually way too wide

/24 is enough as mentioned above

[ruby whale]

@next bronze can I dm I have one query ?

[next bronze]

sure

[steep kraken]

need some help Exploit the target and gain a shell session. Submit the name of the folder located in C:\Shares\ (Format: all lower case) Module SHELLS & PAYLOADS . i have create a ||war|| file and uploaded it, but i cant get my reverse shell to the provided pwnbox

[next bronze]

is your lhost and port correct

[timid steeple]

Hello! I’m having a nightmare trying to get ODAT and SQLplus running on my Kali vm and was hoping someone could please help. 

Initially I did a new install gf Kali, everything updated and have all metapackages installed through kali-tweaks and get the following:

sudo apt-get install odat
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
Unable to locate package odat

I then spent the last night and all of this morning trying to install through the github page for Odat following the install instructions and despite trying several times and following the instructions I now get the following response when I try and run anything.

./odat.py all -s <target>
11:53:20 ERROR -: Impossible to load local configuration files in conf/ and to set driver_name: DPI-1047: Cannot locate a 64-bit Oracle Client library: “libclntsh.so: cannot open shared object file: No such file or directory”.

Could anyone please help guide me through getting this to work properly with library. I’ve trawled google and YouTube and no dice…

[ruby whale]

Try installing libclntsh.so

[hazy grotto]

@brisk socket Check your dms. I'll try to help quick before i leave.

[ruby whale]

@paper gust I tried creating the wordlist but it differs from the expected output, tried installing cuda but it was failure, any insight what issue is causing this? (sorry to ping you)

• Even though the word on the wordlist hashcat was not able to crack it .

[ruby whale]

output.

[timid steeple]

it's not that

[tardy aurora]

Because I can't enter your hacker box, you tell me an error, Networks

[fathom pendant]

the proper mut wordlist size should be 90k+ words

[fathom pendant]

did you install the oracle packages?

[ruby whale]

Yes Xre0us helped me with the wordlist. But on my end I am not able to generate the given size it's missing some words , it comes out around 50k

[fathom pendant]

huh. weird

[timid steeple]

I did, I followed everystep of the installation readme on github

[ruby whale]

Are you installing it on parrot ?

[fathom pendant]

the section shows a bunch of the oracle-* packages to install using apt

do you get an error with installing those

[timid steeple]

no, on Kali

[timid steeple]

No errors on installation or any step of the process. Odat will then fire up on it's own but when you add a target machine to actually use it it errors out with

ERROR -: Impossible to load local configuration files in conf/ and to set driver_name: DPI-1047: Cannot locate a 64-bit Oracle Client library: “libclntsh.so: cannot open shared object file: No such file or directory”.

[fathom pendant]

Did you read the section iirc they give you a command to run if you get that error

[timid steeple]

I'm sorry can't seem to find that, i just looked again

[fathom pendant]

Took me half a second to find

It's likely a similar/related error to what you're experiencing

[placid edge]

how come i am in the administrators group but not allowed to view the administrator folder

[compact halo]

Running into some issue with the Password Attack module.
Specifically Remote Password Attacks > Network Services - I have the user and password but get denied when trying to view contents

[rich radish]

is anyone getting issues on the PIVOTING, TUNNELING, AND PORT FORWARDING module? the target is not spawning more than an hour already

[compact halo]

Sometimes you may have another target still up from another module. If you did previous modules, terminate the target (if you haven't) and try again or close browser, clear cache and try again

[vivid storm]

i am stuck at this point:

nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
'unknown': I need something more specific.
/home/nibbler/personal/stuff/monitor.sh: 26: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 36: /home/nibbler/personal/stuff/monitor.sh: [[: not found
/home/nibbler/personal/stuff/monitor.sh: 43: /home/nibbler/personal/stuff/monitor.sh: [[: not found
nc: getaddrinfo: Temporary failure in name resolution

any clue on how to pass this point?

[rich radish]

i don't have any target running. I just resume my module after 2 days. tried incognito as well, no luck

[compact halo]

Hmmm, might be on the HTB side then. I don't work internally so I wouldn't know where to point you. I found that solution doing some research when I had the issue. You can try a different browser as well, but I am sure you tried that too

[wild helm]

this is my first month ever using HTB and i gotta say it's been a complete mess trying to use the targets, they don't work half the time

[fathom pendant]

Try running as admin

[compact halo]

I'm having issues with the Password Attacks Module > Network Services: I get into smb but when I try to retrieve information about the dir, I get
Try "help" to get a list of possible commands.
smb: > ls
NT_STATUS_ACCESS_DENIED listing *
smb: >
I have tried the following command from outside of the smb share
smbclient \\10.129.202.136\cassie -U <pwnd-user>%<pwnd-pass> -c "ls"
smbclient \\10.129.202.136\cassie -U <pwnd-user>%<pwnd-pass> -c "dir"
both access denied since yesterday

[fathom pendant]

Here's a hint: the user should be the same as the share

[compact halo]

THanks. So the password that was pwnd using crackmapexec was wrong?

[fathom pendant]

If it's a different user: yes

Each user for the services are unique

[compact halo]

Interesting. Had no idea. Have to try a different method. THanks

[fathom pendant]

I believe the question says find the user for x service

And repeat for however many services

[hallow kiln]

Yeah, bad timing, it's been a bad couple of weeks, they've had a bunch of upstream issues with providers, been using HTB for much longer than you and it's smooth sailing most of the time

[languid fjord]

Hopefully should be improving after the maintenance we did

[snow ridge]

In module Attacking Authentication Mechanisms, skills assements. I managed to complete it with this, but I have a question about it: ||First I created account with /register endpoint then used /login endpoint to get that token. Bruteforced weak secret, edited token's isAdmin to true. Then I went back to main page / and it asks for token. So I sent POST request with token as json in post data, but it did not work. Then I sent with GET request and it works. But how can GET request take data from request body? Its kinda new concept for me or at least very unusual and I have not seen it before.
My final payload to complete it

GET / HTTP/1.1
Host: asmt.htb.net
Content-Type: application/json;charset=UTF-8
Content-Length: 279

{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNjViZTU0MjY2YmEyYWQ3YWI1ZjlkYjZmIiwiZW1haWwiOiJhM0BhLmNvbSIsImZpcnN0X25hbWUiOiJhIiwibGFzdF9uYW1lIjoiYSIsImlzQWRtaW4iOnRydWUsImlhdCI6MTcwNjk3MjE5OCwiZXhwIjoxNzA2OTc5Mzk4fQ.W-ZX4q3Sl7WazBUGKLP6c1ARhuIPDbcpJRvZ6pl9r4U"}
```||

[inner parrot]

Sup hackers, I'm in the Java Deobfuscation module, in the first part "source code" I retrieve the flag but the answer its not accepted, I'm pretty sure I have the right flag, HTB{flag} (to avoid spoilers I'm not pasting the real flag), I already try to clean any spaces at the beginning and in the end, any clue what's goin on?

[snow ridge]

Check if you have spaces in start/end of the flag

[inner parrot]

done my dude there's no spaces in the start/end of the flag

[snow ridge]

Can you dm me the flag so I will check if its same?

[inner parrot]

yeah sure

[tranquil axle]

its all a matter of how its programmed, in php for example there are variables for $_GET, $_POST, $_COOKIE and $_REQUEST. REQUEST holds the value of all other 3 combined, so if the handler for the get request uses $_REQUEST instead of specifically $_GET then they will also get stuff from the body

[inner parrot]

Thanks for your help!

[snow ridge]

Thanks, for clarifying. Something new learned again.

[manic onyx]

Doing the intro to assembly module. How come I am able to access the value of RAX with the registers command but not manual inspection?

Actually.. is it attempting to load the content of the RAX as a memory address? How do I reference the register itself?

[topaz latch]

SOC Analyst Path
Windows Attacks & Defense
PKI - ESC1

I RDP'd into the kali machine and from there RDP's into the WS001 machine.
Trying to replicate the attack scenario but facing an error when executing this command: .\Certify.exe request /ca:PKI.eagle.local\eagle-PKI-CA /template:UserCert /altname:Administrator
The error is [X] Error sending the certificate request: System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
I checked services.msc and RPC service is running

Any help on this would be much appreciated

[tranquil axle]

you can do print /x $rax, I think "x" you used always translates it to an actual address

[potent ermine]

That happened to me a couple of times. I resolved it by respawning the target a couple of times. I had to try a couple of times before it worked, unfortunately.

[topaz latch]

Interesting
Thank you for the reply
I'll try doing that now

[cobalt osprey]

im doing the nmap module and am tryiing to nmap a ip with all port flag (-p-) but it is taking forever, what should i do?

[late galleon]

anybody interested in studying for the OSCP with me hardcore?

[compact halo]

try nmap -T5 -p- <ip> -v | grep 'Discovered open*'

[onyx dust]

I can help you study

My old oscp training partner hacks for Tesla now. I'm good for it.

Lmk if you want to do some proving grounds boxes sometime

[topaz latch]

Can confirm this works.
Thanks!

[compact halo]

Remote Password Attack (Password Mutation and password reuse):
the command given to mutate the password list in the resources file has over 94K lines once mutated. Instructions say to run mut_...list. Is this list intentionally supposed to be long in cracking the password for "sam" or did I do something wrong? Been running for about 25 minutes. Not sure if this is intentional or maybe I am doing something worng

[ruby whale]

94k is the correct length

Try cracking ftp service ssh is slow

[compact halo]

Thanks. I'll shoot for that

[late galleon]

Dm me

oh not accepting friend requests

[late galleon]

yeah message me

I tried it once a couple years ago and failed

but im intent on becoming the best hacker I can be

so I need that cert

[compact halo]

Remote Password Attack (Password Mutation and password reuse):
Tried ftp and got loggin errors with crackmapexec and hydra dropped out disabled too many errors - any suggestions
my syntax:
hydra -l sam -P mut_password.list ftp://<ip>
crackmapexec ftp <ip> -u sam -p mut_password.list

[late galleon]

@onyx dust cant send you a friend request

[onyx dust]

must be F8

[late galleon]

oops

one sec

ok go for it @onyx dust

[onyx dust]

all set

[plucky latch]

Looks like a rule violation to me

[chilly cosmos]

Not related to modules

@muted seal read #rules #welcome

[next bronze]

<@&861185840277487616>

[chilly cosmos]

@next bronze I use that next time.

[next bronze]

yes please do

[topaz latch]

Same here lmao

[proud notch]

Currently working through password attacks on the following question "Examine the target and find out the password of the user Will. Then, submit the password as the answer." While waiting for my password search to go through I took a look at the hint and saw the SSH login for Kira. I was just wondering was anybody able to get this login using Hydra or through another method because bruteforce takes forever for me currently.

[compact halo]

Which sub module is examine the target?

[fathom pendant]

2 things:
lowercase
Mutated

[compact halo]

Remote Password Attack (Password Mutation and password reuse):
Tried ftp and got loggin errors with crackmapexec and hydra dropped out disabled too many errors - any suggestions
my syntax:
hydra -l sam -P mut_password.list ftp://<ip>
crackmapexec ftp <ip> -u sam -p mut_password.list

[warm portal]

anyone else unable to get their targets to spawn today?

[proud notch]

It's the Credential Hunting In Linux submodule.

[proud notch]

So I used the same mutation that was given in the earlier section for Remote Password Attacks ||hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list||

[fathom pendant]

Yes, you reuse that list throughout the module

Also, save passwords you find. They are helpful

[topaz latch]

SOC Analyst Path
Windows Attacks & Defense
PKI - ESC1

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.0.1

[*] Action: Ask TGT

[*] Using PKINIT with etype rc4_hmac and subject: CN=bob, OU=EagleUsers, DC=eagle, DC=local
[*] Building AS-REQ (w/ PKINIT preauth) for: 'eagle.local\Administrator'

[X] KRB-ERROR (16) : KDC_ERR_PADATA_TYPE_NOSUPP```

Tried manually copying the .pem and .pfx files between linux and windows, tried resetting pwnbox, tried doing it on my own VM (EU server). Nothing worked. I got the .pfx file, copied it from Windows to Kali Linux.

[proud notch]

I have been doing that. I was wondering if it's possible to get a response when the mutated list through Hydra to find the SSH creds for the Kira account as I have yet to see anything find the password in a timely manner.

[topaz latch]

And on top of that the Kali Linux machine is super laggy, unresponsive, disconnects over and over. SUPER frustrating.

[fathom pendant]

Don't use ssh

Use a different available service

Ssh is super slow with hydra/cme

[fathom pendant]

Always scan targets. You're usually given an end-goal, that doesn't mean it's the first step

[proud notch]

I had gotten other services, but when looking at the hint, and seeing that I wasn't getting a response I thought I had to refocus strictly for SSH.

[fathom pendant]

Nope

Also second part of my hint

lowercase

Don't use "Kira"
use "kira"

[upbeat island]

I’m struggling in two question of hack the box Footprinting. In SMTP section I have use all wordlist to know Which users exist and also the version , when I summit the answer is incorrect

[maiden field]

If you find tell me I'm on this since yesterday and I have the same problem

[rustic sage]

trying to escape a string to execute command

said program runs

sh -c /usr/bin/sqlite3 /var/www/DoodleGrive/db.sqlite3 -line 'UPDATE accounts_customuser SET is_active=1 WHERE username="test";'

user can specify the username which is put in the username field binary is setuid and runs as root

[fathom pendant]

What module is this for?

[rustic sage]

its for a box actually not a module

I cant ask anywhere else because I do not have access

[fathom pendant]

This channel isn't for help with boxes

[rustic sage]

Ive tried using the bot to identify but its broken

I know it isnt but if anyone can help just do so instead of "just wait till you can use a propper channel" 💀

[fathom pendant]

"It's broken" did you message a mod/admin to get it sorted?

[rustic sage]

I have and just did once more

[fathom pendant]

Then just be patient: this channel's explicit purpose is for academy modules. There's channels for #boxes {boxes} and #challenges {challenges} once you're connected

[rustic sage]

if that is your way of saying you do not know then alrighty

[fathom pendant]

It's my way of saying you're not gonna get answers here

[rustic sage]

sure

[fathom pendant]

@slender shoal ^ can you help verify this mans

[tawdry vapor]

anyone can help me with Attacking Thick Client Applications?

[rustic sage]

appreciate it

[fathom pendant]

Look up a walk-through for "Fatty" this section revolves around a retired insane machine

[slender shoal]

@rustic sage dm me

[tawdry vapor]

hmmm

I've come this far

but i can't find this

[cobalt trench]

Completed the footprinting hard lab with little to no help at all. Small achievements

[sharp bluff]

Nice man! Well done!

[patent oak]

Nice! I did alright on that one just now. Apart from I was looking for a hint towards the end and saw the simple thing I needed to do so kinda cheated , Seemed easier than the medium

[shadow chasm]

Hello, idk if im asking this in the correct channel but i just made a HTB account and it says i have to verify my email i didn't get any email and clicked resend and waited a few minutes but still got nothing, is there any way to fix this?

Oh nvm i just got it rn

[shell nexus]

i am in the intriduction sequence and have reached the "interactive part with taregt", yet when typing in the ip it keeps telling me it took too long to load, what do I do?

[fathom pendant]

If it's a public ip with port: you need to include the port

http://ip:port

[shell nexus]

it has the port included

[shell nexus]

the docker target in the intruction i was given, which i assume is the same for everyone is http://157.245.40.149:30655

[fathom pendant]

Reset the target

[shell nexus]

thanks that seemed to fix it

[manic onyx]

Can SeBackupPrivilege be abused to dump the NTDS remotely? Or will you need an active session on the DC?

[hollow furnace]

am i allowed to ask questions about retired boxes here?

[soft cedar]

You can ask here #boxes

[hollow furnace]

I dont have access to that unfortunately

[fathom pendant]

Then read and follow instructions in #welcome

[inner orchid]

which pro lab do you recommend to prepare for the CPTS exam?

[fathom pendant]

<@&861185840277487616> slipped through the cracks

Usually the links are auto yeeted by the bot/automod

[slender shoal]

[chilly cosmos]

@slender shoal Hello, Can i dm for a question

[slender shoal]

Sure

[buoyant void]

Why would password spraying with rpcclient result in more hits than when I do the exact same user list and password through crackmapexec? I know there's probably a simple reason for this

[hot oyster]

My discord account was unfairly disabled what I do ??

someone help me please

[fathom pendant]

Contact support

If an account was disabled ain't shit anybody can do for you

[upbeat island]

Enumerate the smtp service and summit the banner, including its version as the answer. // struggling

[fathom pendant]

Well one way to get a service's banner is with netcat

Another is to just connect to it

[upbeat island]

Enumerate the smtp service even further and find the username that exists on the system summit it as the answer // struggling.

[fathom pendant]

Repeating it won't get you an answer faster

[hot oyster]

I've done this and said my account violated the terms and guidelines of Discord

[fathom pendant]

Use the techniques shown in the section

[upbeat island]

Let me try and repeat it

[fathom pendant]

Well there's nothing we can do for you here

[upbeat island]

Thanks.

[hot oyster]

sorry

[fathom pendant]

This server doesn't do any "account recovery" stuff.

That kind of thing breaches discord ToS as a whole

[hot oyster]

Is there one that does ???

[fathom pendant]

And anyone who sells you that service is likely scamming you

[slender shoal]

Contact Discord support. We cannot help you.

Discord support are the only ones able to help.

[fathom pendant]

If Discord said your old acct broke ToS then there's nothing that can be done

[hot oyster]

But it was unfairly !!

[slender shoal]

@hot oyster I'm going to ask that you do not continue this. Contact support, as they are the only ones with the ability to help.

[fathom pendant]

Ok? Then appeal and ask for proof. Many people say they're banned unfairly

But aside from that then literally no one can help you.

I'm not skirting around some ToS by telling you: no one can help you

Anyone that offers that help is a scammer

[hot oyster]

oh ok

[buoyant void]

https://support.discord.com/hc/en-us/community/posts/16191655766679-Discord-Account-Appeals-What-you-need-to-know

There that's discords official support response to this issue, good luck it can be a hassle from what I've heard

[valid osprey]

Hello everyone, could anyone help me with a window lifting exercise?

Other Files

1. find the cleartext password for the bob_adm user on the target system.

I believe it's doing the PSSLite technique, but the Set-ExecutionPolicy Bypass -Scope Process command showing in the session doesn't work, is this the right way to finish, or is it mapping the files in search of the password?

[cobalt trench]

Information Gather - DNS "What is the first mailserver returned when querying the MX records for paypal.com? "

Im gathering the MX record and inputting what Im finding but Im not sure if the format is correct. It keeps saying incorrect.

[soft cedar]

what is your MX query? and what answer are you getting?

what question is that?

[cobalt trench]

the command im using is|| dig mx paypal.com @192.168.52.2|| and the answer im trying to use is ||mx2.paypalcorp.com||

[fathom pendant]

mx1

:^)

nslookup may give you the result in a diff order

[cobalt trench]

It was technically the second BUT i can see why thats the answer lol

[fathom pendant]

critical thinking

[soft cedar]

do you get diff results without adding the dns resolver?

[cobalt trench]

idk I completed the section and moved onto the next one

[fathom pendant]

always good to double check but if you're satisfied and want to move on go for it ¯_(ツ)_/¯

[cobalt trench]

youre right

[cobalt trench]

Yes it did. It came up in the correct order

[tawdry vapor]

anyone can help me wiht Exploiting Web Vulnerabilities in Thick-Client Applications? I can't download fatty-server.jar

[tawdry vapor]

anyone??

[fathom pendant]

@fickle sparrow your messages are getting yeeted by automod

you'll need to link your htb labs account following #welcome to post textblocks/images

[fickle sparrow]

Thank yuou!! done

[fathom pendant]

also for formatting textblocks

put ``` in front and behind the block

what module is this for

also are you sure you can write to the directory you launched ftp from

usually it gives you a local: permission denied message but idk about Passive mode

you also didn't answer: which academy module is this for

if this is for a starting-point machine then --> #starting-point

[fickle sparrow]

thanks

[fathom pendant]

also be wary of posting info from machines: as they can be considered spoilers

it could be that you intentionally can't download that file

[marble raft]

Has the spawning targets issue been fixed? I'm doing the updated part on Windows Privilege Escalation - Citrix Breakout and i'm having some troubles spawning the target you're supposed to RDP in

[fathom pendant]

it seems like it's still intermittent; better than before - switch vpn regions

[marble raft]

will do, if it doesn't work i'll call it a day and try it again tomorrow, no reason to hurry

[minor dome]

i hop everyone you become good person and hapy

[cobalt trench]

Active subdomain enumeration - I added the IP to the hosts file with the DNS name and used nslookup to get the FQDN but it says unable to connect to server

[marble raft]

Can you show you /etc/hosts file?

[tawdry vapor]

i'm stuck here for 3 hours

[fathom pendant]

you still need to specify the ns for it

using the IP works fine

[fathom pendant]

what's in the Tools directory

that the lnk points to

[cobalt trench]

||nslookup -type=NS 10.129.28.180|| ||nslookup -type=NS inlanefreight.htb|| both these commands give me the same error

[fathom pendant]

sir

you need to do nslookup -type=NS inlanefreight.htb ip

[tawdry vapor]

this

[fathom pendant]

[fathom pendant]

i haven't done this module so i can't guide you; also as a sidenote - don't dm without asking

[ruby whale]

One dumb question but how do you exit xfreerdp full screen 😅

[fickle sparrow]

what is this module?

[fickle sparrow]

esc?

[fathom pendant]

i never do fullscreen xfreerdp i always do /dynamic-resolution so i can resize

[cobalt trench]

I didnt know you could do xfreerdp full screen

[fathom pendant]

yeah; it's one of the many options

[ruby whale]

No it doesn't work 😭 I had to terminate session to exit

[fickle sparrow]

Ctrl] + [Alt] + [Enter] try this.. @ruby whale

[cobalt trench]

thought full screen only worked on rdesktop

[short hare]

Stuck on:
ATTACKING COMMON APPLICATIONS: Attacking Thick Client Applications
Question: Perform an analysis of C:\Apps\Restart-OracleService.exe and identify the credentials hidden within its source code. Submit the answer using the format username:password.

With x64db done this as per module.

But when I use strings it says

Can anyone help with this section. It's really something that is wired

[fathom pendant]

like +clipboard to ensure clipboard functionality

[ruby whale]

VMware goes into full screen mode

[cobalt trench]

https://tenor.com/view/ryan-gosling-critics-choice-awards-side-eye-confused-clapping-gif-14741917063569043913

[short hare]

@tawdry vapor Have you done the thick client section?

[ruby whale]

From now onwards using Dynamic resolution

[fathom pendant]

it's likely ctrl or alt is bound to be the host escape key

[ruby whale]

Yes

@fathom pendant have you completed the whole path ?

[fathom pendant]

no

been busy with life

[buoyant void]

Would there be any reason I'm suddenly having trouble connecting to any machine via RDP with xfreerdp? I'm currently in the Active Directoy Enumeration & Attacks module and I haven't been able to RDP using xfreerdp at all, the authentication happens and then I just get a black screen. Remmina is working perfectly though so I'm wondering if theres some setting in xfreerdp I should be including since the machines I'm trying to connect to are part of an AD environment?

[short hare]

Fixes:

1. in case of pwnbox--> reset targets and try again
2. in case of VM---> try downloading openvpn file with TCP not UDP. then try connecting

Apart from those in AD there are specific sections where things get really odd.

[short hare]

Anyone ???

[buoyant void]

Yeah I'm using TCP for the VPN, issues only started when I switched to the EU servers the other day when I was having trouble spawning targets. Maybe I'll try going back to the usual server I would be on

[short hare]

Okay..!

[heavy marsh]

AD Enumeration & Attacks - Skills Assessment Part I Target is not spawning.

Any news on when they are going to fix the AD labs?

Or does anyone know which servers work?

[tight mesa]

anyone can connect to the pwned machines?

I'm receiving this error message :
[21:32:07:799] [8606:8607] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe [21:32:07:799] [8606:8607] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [21:32:07:799] [8606:8607] [ERROR][com.freerdp.core] - freerdp_post_connect failed

[fathom pendant]

what academy module is this for?

[tight mesa]

Windows PrivEsc

[fathom pendant]

it also just looks like xfreerdp being dumb, sometimes that happens

[tight mesa]

I tried with remmina same result

[fathom pendant]

idk then reset target ¯_(ツ)_/¯

[tight mesa]

LoL I tried from my Kali VM and my host with no success....

maybe today is not my study day, LoL

[tawdry vapor]

Attacking common applications

[tawdry vapor]

Dm me

[heavy marsh]

AD Skills Assessment Part 1, cd command does not work

what am I supposed to do with this web shell?

[fathom pendant]

you generally can't cd with a webshell

but you sure can dir C:\

<@&861185840277487616>

[marble raft]

For future reference in the Scripting AoB section of Game Reversing and Modding the last script doesn't work, and it does not work because the provided pattern on the AOBScanModule is not universal, you need to generate your own, following of course the examples given in the module. It's very important to read the Relative & Absolute Addressing section because without it you won't know how to spot the pattern needed.

[slender shoal]

Thank you

[fathom pendant]

so what you're saying is you need to read the section and not just copy/paste a script

[heavy marsh]

None of the AD modules in AD Skills Assessment Part 1 webshell are working.

Where do I even start here!?

Looking back at the material I can't find anything about an Antak webshell

Can someone point me to that?

[fathom pendant]

is powerview.ps1 in the C:\ directory?

also why not work to upgrade the shell from a web to a full shell or enabling rdp

[heavy marsh]

I got the first flag by using the type command

[fathom pendant]

ok? that's not what i said though :P

[heavy marsh]

Don't know where to start with this one though.

[heavy marsh]

how?

I can

t even CD with the webshell

[fathom pendant]

create a revshell

use like msfvenom or grab one from revshells.org and upload it to the webshell

webshells suck and are very limiting

[heavy marsh]

That's why I am confused. This is very different than the end of module questions thus far

[fathom pendant]

i mean my dude, there was a whole module on shells way earlier on

not to mention there is a way to kerberoast SPNs i forget exactly which section, but there was a whole ass bit regarding SPNs

[heavy marsh]

What would lead me to this conclusion so far?

I've barely just got the first flag!

[heavy marsh]

Yeah, didn't work

[fathom pendant]

"Kerberoast an account with the SPN"

it literally gives you the SPN

but i think first and foremost: getting a better shell is more of a priority

[heavy marsh]

NOPE! lol

[fathom pendant]

for christs sake dude: read the error -> command not found

meaning whatever powershell module that would load the command isn't loaded in/imported

It's literally yelling at you that the command isn't found

[shut quest]

reviewed my notes for that module, slow down and read what marcielee is saying, you really should get a reverse shell from that web shell

[fathom pendant]

My first question once I saw where you tried to import the powerview module: is it in the C:\ directory?

just because you didn't see an error doesn't mean there wasn't one: webshells lack a lot of visual clarity for things

normally the error line would be deep red

[fathom pendant]

you can just nab a simple revshell from the revshell site yeah?

[heavy marsh]

Yeah, because it's loaded but I can't cd into C:

[fathom pendant]

that... wasn't... the... question

is ActiveDirectory loaded?

[heavy marsh]

I have no idea

How do I check that?

[fathom pendant]

ah you uploaded one

[fathom pendant]

basic powershell

[shut quest]

yeah, i've learned a lot, totally would have done it differently now knowing as much as i do now

[fathom pendant]

https://learn.microsoft.com/en-us/powershell/module/powershellget/get-installedmodule?view=powershellget-3.x

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-module?view=powershell-7.4

[heavy marsh]

I am not following in any way shape or form.

[fathom pendant]

2 ways of using basic powershell to get the loaded modules :)

but imho step 1 should be just getting a reverse shell instead of working with a clunky web one

[heavy marsh]

I'll try to get a shell first

[fathom pendant]

👍 you can use an msfvenom reverse tcp payload

[ruby whale]

I wonder if julio.txt has any text root@linux01:~# smbclient //dc01/julio -k -c 'get julio.txt' -no-pass getting file \julio.txt of size 0 as julio.txt (0.0 KiloBytes/sec) (average -nan KiloBytes/sec
Password attack one the most annoying modules :p

My bad I might be missing something

[fathom pendant]

it happens

[ruby whale]

Doubt - why listing files on share show size 0 ?
maybe by trying what I missed I will be able to access the files, but not sure reasoning behind it

[fathom pendant]

maybe manually connect to it and don't run a command

[ruby whale]

Yes I figured this out.

But why cant we list it using the commands

[fathom pendant]

the text file shouldn't be empty

also are you sure the ccache isn't expired?

[ruby whale]

No its not

[marble raft]

pretty much yes. The question doesn't do a very good job at making this clear, since in that section you're provided a "finished" AOB Injection script, it should be worded more clearly in the sense that you're supposed to make your own. Not just follow blindly the example

[somber lagoon]

I have a question. In the scenario below, was it possible to do a PtT instead, rather than waiting for a successful paswword crack?

Scenario 1 - Waiting On An Admin

During this engagement, I compromised a single host and gained SYSTEM level access. Because this was a domain-joined host, I was able to use this access to enumerate the domain. I went through all of the standard enumeration, but did not find much. There were Service Principal Names (SPNs) present within the environment, and I was able to perform a Kerberoasting attack and retrieve TGS tickets for a few accounts. I attempted to crack these with Hashcat and some of my standard wordlists and rules, but was unsuccessful at first. I ended up leaving a cracking job running overnight with a very large wordlist combined with the d3ad0ne rule that ships with Hashcat. The next morning I had a hit on one ticket and retrieved the cleartext password for a user account. This account did not give me significant access, but it did give me write access on certain file shares. I used this access to drop SCF files around the shares and left Responder going. After a while, I got a single hit, the NetNTLMv2 hash of a user. I checked through the BloodHound output and noticed that this user was actually a domain admin! Easy day from here.

[soft cedar]

Weird, have you tried resetting the target.

[ruby whale]

I did try two ways

1. updating KRB5CCNAME on svc_workstation as root and get julio.txt
2. getting /tmp/krb converting it to julio.krb and then using Rubeus.exe to get same results
   Let me try resetting target

[tranquil axle]

You need the TGT for pass the ticket, but in the scenario they only acquired the TGS, that’s only good for cracking

They are both called ticket, so it can be a bit confusing

[soft cedar]

I don’t think the ccache is expired otherwise it wouldn’t let you impersonate as Julio so reset and redo the steps, btw which PtT/PtH section is this?

[ruby whale]

Pass the Ticket (PtT) from Linux

[somber lagoon]

Okay, that makes sense

[ruby whale]

I was playing with ligolo tried replicating this proxychains impacket-wmiexec dc01 -k gives [-] [Errno Connection error (dc01:445)] [Errno -2] Name or service not known any one tried to use this with ligolo?

[soft cedar]

With ligolo, you don’t need proxychains

[ruby whale]

I didn't use proxychains just impacket-wmiexec dc01 -k it was not able to resolve dc01

[somber lagoon]

did you map dc01 in the /etc/hosts file?

[sleek moss]

guys my hcakthebox lab wont spawn target

how do i fix

[soft cedar]

Change your vpn server and spawn the target

[sleek moss]

shud i connect ot vp

beofre i clcik spawn??

[soft cedar]

switch in between us and eu. and spawn the target.

[sleek moss]

ok is wiced from us 1 to us 3 t

[soft cedar]

yes and you would have to re-download new vpn file for that.

[sleek moss]

i c

[ruby whale]

Ah yes there was a typo 😔

[sleek moss]

ty

ir worked

[ruby whale]

@soft cedar resetting worked

[ruby whale]

Finally after going it at it for 4 hours + completed the section, resetting does help. 🙂

[patent oak]

Guys, on the Active Infrastructure Identification in Info Gathering. Working on VPN. Could grab the header with curl,so it's up. Can ping it but when I try to whatweb I keep getting connection refused for both IP or the .local domains it gives. I could see other people use the same command and get results on forum. I think I'm missing something about the setup here. I think I'm on UDP VPN if it matters. Help please 🥺

[ruby whale]

Could be share the command and output? before logging off I will try to help

[patent oak]

Hang on, i think I'm onto something with the hosts file

[patent oak]

Thanks for offering to help. I think I'll try harder for now

[sleek moss]

in on oass the ticket password attacks and how do i get ccache for linux

linux01

[somber lagoon]

@tranquil axle you can. To achieve it you need to dump the NTLM hash with mimikatz, forge a ticket with the NTLM provided, and perform PtT attack.

See https://www.varonis.com/blog/kerberos-attack-silver-ticket#:~:text=With a Silver Ticket in,to do some major infiltration.

[next bronze]

silver ticket and kerberoasing are tow completely different concepts, to be able to get a NTLM hash of a service account you'd generally need system/admin level privilege on a machine

[sleek moss]

in on oass the ticket password attacks and how do i get ccache for linux
can someone help

pass the ticket

[somber lagoon]

Yeah, from this scenario there is a system level access.

I have a question. In the scenario below, was it possible to do a PtT instead, rather than waiting for a successful paswword crack?

Scenario 1 - Waiting On An Admin

During this engagement, I compromised a single host and gained SYSTEM level access. Because this was a domain-joined host, I was able to use this access to enumerate the domain. I went through all of the standard enumeration, but did not find much. There were Service Principal Names (SPNs) present within the environment, and I was able to perform a Kerberoasting attack and retrieve TGS tickets for a few accounts. I attempted to crack these with Hashcat and some of my standard wordlists and rules, but was unsuccessful at first. I ended up leaving a cracking job running overnight with a very large wordlist combined with the d3ad0ne rule that ships with Hashcat. The next morning I had a hit on one ticket and retrieved the cleartext password for a user account. This account did not give me significant access, but it did give me write access on certain file shares. I used this access to drop SCF files around the shares and left Responder going. After a while, I got a single hit, the NetNTLMv2 hash of a user. I checked through the BloodHound output and noticed that this user was actually a domain admin! Easy day from here.

[next bronze]

well @tranquil axle has already answered it, you need a TGS/service ticket to PTT

also, silver ticket doesn't necessarily give you more access, since you need the NTLM hash to be able to forge one, it's more of a stealth/persistence thing

[somber lagoon]

with system access you can run this command to get the NTLM hash.

#use Mimikatz to dump all users Kerberos encryption keys
mimikatz.exe "privilege::debug" "sekurlsa::ekeys"

See OverPass-the-hash Attack module

Yes, I know silver ticket doesn't give you more access. I was thinking of other methods

@next bronze thanks tho.

[tulip bobcat]

Any updates on the connection issues?

[shell nexus]

I'm attempting an ssh login on a target, yet when it asks for the password i can no longer type any characters into the console? what do i do?

[civic zenith]

Does this one liner work for you(you may need to install "sshpass" to make it work) ? :
ssh username@<IP_ADDRESS_OF_THE_MACHINE> -oKnownHosts=<(printf '%s\n' 'yes')> | sshpass -p <YOUR_PASSWORD> ssh username@<IP_ADDRESS_OF_THE_MACHINE>

Alternatively try this:
Generate an SSH key pair on your local machine:
ssh-keygen -t rsa -b 4096

Copy the public key to the remote machine:

ssh-copy-id username@<IP_ADDRESS_OF_THE_REMOTE_MACHINE>
After you've copied the public key to the remote machine, you can now SSH into the remote machine without a password:

ssh username@<IP_ADDRESS_OF_THE_REMOTE_MACHINE>

[shell nexus]

all i get is an error saying missing file specifications

[next bronze]

you can't see the password being typed but it's still being entered, it's a security feature. just copy then ctrl shit v to paste

[civic zenith]

oh right^

[shell nexus]

does it ever explain that?

[civic zenith]

completely forgot about that

[shell nexus]

1. copying from my machine into pwnbox isn't working as it never gives me the option to paste
2. typing it out manually just tells me permission denied

[civic zenith]

fullscreen the vm and look in the bottom right corner

It allows you to copy commands over

[shell nexus]

thank you

[civic zenith]

No problem 🥳

[shell nexus]

i'm struggling with finding the way you can have all directory paths displayed as for my device it is dir

am i missing something?

[broken lichen]

.

[hasty solar]

Do u mind if I dm you I'm stuck there? In the DNS rebind portion of the lab

[topaz locust]

sure, i'm leaving now but i'll answer when I have time

[fathom pendant]

use all the tools mentioned in the section

[hasty solar]

Thx!

[lavish mango]

Active Directory Bloodhound Skills Assessment Hint
Question: Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78).
||MATCH (a:AZUser)
RETURN count(DISTINCT a) AS TotalAzureUsers

Looking up GLOBAL ADMINISTRATOR in Bloodhound and right-clicking 'Shortest Paths to Here' yield n Azure users.

(n/TotalAzureUsers)×100||

[naive relic]

hello ive just launched hack the box for the first time yesterday, and im doing one of the easy difficulty machines

anybody have advice or some sort of link to a tutorial i could use?

[fathom pendant]

2 things: there are no official/allowed tutorials for active machines
Second: this isn't the channel to ask for nudges on active boxes - #boxes is for that (read and follow #welcome to find out how to access more of the server)

[naive relic]

alright makes sense

[lapis delta]

Attacking WordPress module.

Problem: I'm attempting to use Metasploit in conjunction with the WordPress admin account to carry out the exploit. However, I'm encountering an error that halts the process. The specific message I receive is: "Exploit aborted due to failure: unexpected-reply: Failed to upload the payload."

Request for Assistance: Has anyone faced a similar issue or does anyone have insights on how to resolve this? Any hints or suggestions on alternative approaches to successfully upload the payload would be greatly appreciated.

[frozen mesa]

how to solve this: harry.potter@94.237.56.188: Permission denied (publickey).
Skill assesment - login brute forcing

[fickle sparrow]

Did you setup the correct parameters on Set using metap ? @lapis delta

[lapis delta]

i i did not it would not authenticate no?

[frozen mesa]

RHOST contains RPORT also

[fickle sparrow]

yeah, two different ports

[faint rampart]

Mimikatz allows you only extract an nt hash from memory, and that would be possible if the account (service account) in this instance was a local account or has had a previous log on onto the machine, from my existing AD knowledege I dont think you can request an NTLM hash of a domain user just because youre system on a domain joined machine(unless of course you have the user's password you could get a ticket). You NEED the NT hash of the service account to be able to craft a silver ticket which is basically still a TGS that allows you to access the service whenever in a stealthy manner. In this scenerio the tester kerberoasted with SYSTEM to retrieve a domain account service ticket, that would only be good for cracking, and not in any way passing the ticket. We are really not the tester, and were not the ones doing the test haha so we wouldnt know other variables to factor in but the emphasis on the story was the use of custom rules to mutate wordlists and be persistent with cracking I believe.

[rapid sparrow]

I want to ask this one...

you found them on the two collection zip file from desktop?

[chrome lotus]

Hey! As far as I can remember, I only ran the VADs collection, rest were on desktop. Although I could be forgetting. I also remember there being useful collections relating to the registry in Velociraptor

[vale blade]

Can you help me with advice on where to look in ABUSING HTTP MISCONFIGURATIONS Skills Assessment - Hard? I can't find the cache?

[unique remnant]

I have the same problem with the svg file upload.
I could trigger XSS but no XXE, I tried everything, even tried remote DTD, checked Hacktricks and PayloadsAllTheThings
I found the images directory by fuzzing so I am triggering it well (hence XSS works)

[unkempt ether]

PIVOTING, TUNNELING, AND PORT FORWARDING-RDP and SOCKS Tunneling with SocksOverRDP
i cant load SocksOverRDP-Plugin.dll because regsvr32.exe is detecting it to be a virus
i can't find the file exclusion list any other solutions beside disabling the windows defender?
im gonna go to bed now i will on this tmr

[tacit jacinth]

Has anyone ran into an error with Julio's flag on the Linux PtT module? Specifically the question "Check the /tmp directory and find Julio's Kerberos ticket...". I have retrieved the flag two different ways now, and the flag is never accepted. I see there was a comment made by another user last February complaining of the same thing.

[mystic light]

theres like 3 steps to this if i recall correctly from my notes. you dont just go from svg to shell, you have to check out what file types are filtered on upload. svg could get you the source... but you need to investigate the source to get to the next step. dm if you need.

[tacit jacinth]

Yes

I have ensured there are no whitespaces or any other special characters. It is very clearly the flag. The module directs me to \DC01\julio\julio.txt (and i retrieve this file). It is as if the flag changed or is mistyped (or i'm seriously missing something)

[soft cedar]

Disable the windows defender first before you transfer the binary over to the target and make sure to run PS as administrator before loading the plugin. 👍🏼

[fathom pendant]

Alternatively, download and learn ligolo-ng

[unique remnant]

Thanks. I had to make a reload after the uploaded svg on the MAIN page and not the /images directory to trigger the XXE, now I can get something with file://

[mystic light]

ahhhh i misunderstood the issue. nice work. dm for moral support.

[wheat sinew]

Where can one report typos on the page?

[mystic light]

#858470491676737536

[wheat sinew]

Cheers

[fathom pendant]

#858470491676737536 is for academy modules, there's no fix suggestions channel for starting point machines, read #welcome and follow instructions to access more of the server

[wheat sinew]

Will do.

🎉

[unique remnant]

BTW it would have been nice to mention in the Upload/SVG/XXE student material somewhere that when we try to get something with php filter look for the result INSIDE THE SOURCE CODE after a reload and not on the screen
#858470491676737536

[mystic light]

That messed me up too.

[fathom pendant]

Actually post it in #858470491676737536

"Tagging" #858470491676737536 doesn't do anything

[topaz latch]

An HTB Academy team member reached out to me regarding this
He tried doing the lab and got the same error
They're looking into it

[naive relic]

how to fix armitage exploit "connection with 'host ip' timed out"

[rapid sparrow]

I found another way to solve it, I launch a reverse shell in Velociraptor, and use the powershell

Skills Assessment - Introduction to Digital Forensics
this is how to solve without using collections

[solar zodiac]

wow the relaying module is really good

🙂

I wonder if there will be any cloud modules

[maiden field]

Perfect keep me updated with this plz

[shadow chasm]

If I have the free version of HTB i can only use the web based parrot linux for 2 hours only and then cant use it again without VIP?

[fathom pendant]

For the main platform yes.
You can also just download/install a vm and use the vpn for unlimited time. This channel isn't for main platform, it's for htb academy - read #welcome

[shadow chasm]

Ahh I see, and my bad

The issue is that i got a chromebook so is not possible for me to get a vm

[fathom pendant]

You can absolutely install a linux OS on top of one though

Chromium is just a shitty linux

[shadow chasm]

Ahh I see, ima see what I can do

[kind turret]

@maiden field @topaz latch Hello guys. I've spoke with our Labs Engineer and he told me everything works fine. You only need to wait 7-10 minutes before requesting any certificates.

He also informed me that he will try to reduce the waiting time by changing the configuration of this lab.

[rustic sage]

HTTP Attacks from CWEE Path
Log Injection (CRLF)

I'm having trouble with the exercise, can't get the server to accept %0d%0a even though it's supposedly an introductory exercise with a very clear path to solving it. Any clues?

[languid wharf]

Yo, are there problems with the labs again?

[coarse mauve]

I'm having quite a difficult time with the Advanced Javascript Deobfuscation exercise in capturing the flag. I captured the hidden flag in the code but HTB states my answer is wrong. It has to be right based on the instructions followed in the exercise. Confused?! 🤔

[marble raft]

This is a really really interesting module, really makes things going but it's noticeable different than others. Not harder per se, but requires some knowledge in C#.

[languid wharf]

Check for trailing spaces maybe

[rustic sage]

Finding this super odd, have gotten a friend to help and he couldn't figure it out either. Has anyone actually done this module?

[quasi wave]

I am doing DNS section of footprinting module. I'm on question 2. So my AXFR queries show its possible to get zone transfer but I am having trouble finding the text for the text record. Can someone help me out? Please don't just give me the answer.

[fathom pendant]

you might need to dig an extra level deeper

[rustic sage]

Hey guys

[sleek moss]

can someone help with password attacks

• 0 Use the cracked password of the user Kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer. idk where kira password is

Protected Files

[fathom pendant]

you got it from an earlier section of the module

Credential Hunting i believe

take this as a note: always save credentials you find

[sleek moss]

i cant find it do u have her pw

[quasi wave]

solved

[fleet moth]

So I just finished the "Introduction to Windows Command Line" module. It is really really cool, however there is one detail that makes it average. Last skill assessment question is:

" What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack? The flag is the name of the user account."

There are not that many ID 4625 Events on the host so I used:

Get-WinEvent -FilterHashTable @{LogName='Security';ID='4625 '} | Format-List -Property *

to check them in detail. I used all user account names that were mentioned in any of the events and none of them worked.

In the end the answer was a user whose user account name does not pop up in any of the Events on the host. 😡

[fathom pendant]

you didn't get her password as an answer

you used her password to do the credential hunting for will

:) easy recrack though if you wanna just throw the mutated wordlist at ftp

[sleek moss]

ic ok thank

[fathom pendant]

are you running it on the domain controller?

the question explicitly tells you to run check on the domain controller; not on the initial host

[upbeat island]

I’m stuck in a single question, they said “enumerate the custom script that is running on the system and submit its output as the answer”. How do I know what is the output // that is for SNMP

[fathom pendant]

use the snmp tools provided by the module

you'll see script:: output

basically

script.sh
lines
lines
lines
output

[upbeat island]

Let me try once again.

Thanks.

[fathom pendant]

i believe braa might cut out the part where it shows the script being run

and just show

script.sh
output

[upbeat island]

Nope, It show me “message cannot be decoded”

[quasi wave]

now I'm on the last section of DNS

can someone give me a hint? I think I need to find another wordlist

am I wrong?

[fathom pendant]

are you using the community string?

[quasi wave]

this is for last question of dns section of footprinting

[fathom pendant]

what's the question?

is that the one where it has you use the tool?

[upbeat island]

Yessss I got it now. Thanks a lot

[quasi wave]

What is the FQDN of the host where the last octet ends with "x.x.x.203"?

[fathom pendant]

if so: fierce wordlists are your friend

yes; subdomains of subdomains is your other hint

[quasi wave]

ok thanks

[sleek moss]

is chatgpt allowed for cpts exam

[fleet moth]

There is only one host provided for this task, so i assumed that is the Domain Controller. The events with specified ID are there etc. It is just the events that should provide the answer are missing.

But anyways with Get-ADUser -Filter * one gets the list of all potential answers so it is not that bad.

I just write it here, so that the mods will update it someday. And so the peps struggling with this one, can get their answer.

[fathom pendant]

it is not; one of the questions on the Windows CLI skill assessment even gives you an internal host to connect to

[fleet moth]

There is only one such question. And i can also see a reason why only one.

[fathom pendant]

and it explicitly tells you that it's the Domain Controller in that question (172.x.x.x)

[fleet moth]

For this one you are asked to connect to the specified host. The host is a part of the AD so you can get domain information from its console. If it was as you say, they would ask again to connect to the X.X.X.X host to do the task.

[fathom pendant]

except it tells you and says explicitly "What account on the Domain Controller"

meaning you need to connect to the DC (Domain Controller)

[fleet moth]

You are right mister, I just checked it. Thanks for explanation. For my defense, this question should be rewritten ;d

[fathom pendant]

it really doesn't. It explicitly tells you where to look for the answer

just because you misread it. doesn't mean it's written poorly

[fleet moth]

i am not a native sorry

[quasi wave]

I think I have solved the last DNS question I just have to wait for it to finish loading

[fathom pendant]

the answer will be in the format a.b.inlanefreight.htb {a being the one that has the .203, b being the subdomain you bruteforced}

[quasi wave]

ya I get that part

just waiting for it to show up

[fathom pendant]

ye

sometimes it's silly

[quasi wave]

I know its taking a while so I'm gonna maybe watch some TV or something while I wait for the thing to load

[fathom pendant]

it shouldn't take more than a few minutes btw

[quasi wave]

ok what if its taking 20 minutes or 15 minutes

wrong word list?

should I try different word list?

I tried both fierce wordlists and one was taking forever and the other one didn't have the answer

[fathom pendant]

like 5-10 minutes

should be the max

[quasi wave]

ok thanks

[fathom pendant]

the targets for academy seem to be acting weird

so it might take longer: but tbh if you're going at the wrong subdomain you're gonna get no answers anyway

[quasi wave]

ok got it well I am trying the for-loop one for the specific IP address

how do I know I got the right subdomain?

[fathom pendant]

dig axfr inlanefreight.htb @ip

do that first

[quasi wave]

ok

[fathom pendant]

because you're likely looking over one of the subdomains to bruteforce

:)

[sleek moss]

Howd o I login + 0 Use the cracked password of the user Kira, log in to the host, and read the Notes.zip file containing the flag. Then, submit the flag as the answer. password attacks

[quasi wave]

do I need to use the IP of subdomain or can I use same IP?

right now I am using the FQDN of a subdomain I think is it. I narrowed it down to 2 subdomains

[fathom pendant]

you have to use the same IP

[quasi wave]

ok thanks

[fathom pendant]

i mean ftp works, ssh too

[quasi wave]

and how do I know which word list to use?

is it same wordlist as previous or fierce wordlist?

[fathom pendant]

the fierce wordlist is used for this part

[sleek moss]

it dont work

[quasi wave]

ok thanks

[fathom pendant]

"it don't work" isn't an error message that I know of

[sleek moss]

it says password incorect

[fathom pendant]

then you copied her password incorrectly

[sleek moss]

||L0veme||

not work

[fathom pendant]

if you just copied it from the hint in the Credential Hunting section: then yes it won't work

[sleek moss]

no i cracked the new password from the file

[fathom pendant]

it should work then ¯_(ツ)_/¯

[sleek moss]

Protected Archives

[fathom pendant]

so you have the .zip and cracked that password?

[sleek moss]

wait nvm i used the wrong pw

[fathom pendant]

:)

[sleek moss]

i thoght i had to use the cracked password from prev section smh thank

[fathom pendant]

then what would be the point of cracking the zip file?

[sleek moss]

it just for prev section to crack file encrypted i thought iw as new pw

[fathom pendant]

2 steps when examining things

1. try a pw you already know
2. bruteforce

[sleek moss]

ok thanks

[quasi wave]

ok solved the DNS section

[minor dome]

marcy u have good pfp

[fathom pendant]

ty i commisioned it a while back

[glad citrus]

I’m working through the foot printing medium box rn.

Stuck on something, but I think I’m close

[celest haven]

Hi Guys i'm stuck on this question on three days.Examine the target and find out the password of the user Will. Then, submit the password as the answer.|| Sometimes, we will not have any initial credentials available, and as the last step, we will need to bruteforce the credentials to available services to get access. From other hosts on the network, our colleagues were able to identify the user "Kira", who in most cases had SSH access to other systems with the password "LoveYou1". We have already provided a prepared list of passwords in the "Resources" section for simplicity's purpose.|| So far i've tried|| hashcat --force password.list -r custom.rule --stdout | sort -u > mut_pass.list|| and ||hydra -l kira -P mut_pass.list ssh://10.129.202.64 -t 64 and hydra -l kira -P mut_pass.list ssh://10.129.202.64 -t 48`|| I still don't get any match.Could someone give me some hint?

[glad citrus]

I found the NFS share, mounted to my local machine, but when I try to cd into the folder it says access denied

Is it a configuration issue on my end?

[celest haven]

No it' not.LoveYou1 won't login.

[sleek moss]

u need to mutate

[fathom pendant]

move around as root

[sleek moss]

a specific word and then maybe try to crack into using adiff service

[fathom pendant]

this is one of the few times su to root is actually a thing

[glad citrus]

Oh ok, I thought it was on my end. Good to see I’m on right track here.

Haven’t su to root on the htb parrot vm. Anything special to do it

[fathom pendant]

nope

just sudo su

you might get a bunch of strange letters

but that's just a weird thing in the bashrc file

[minor dome]

ill need more context

[glad citrus]

Thanks @fathom pendant

[fathom pendant]

lowercase kira

also

don't attack ssh; attack another service

services can limit your threads btw

[sleek moss]

Password Attacks Lab - Easy hint? i just use hydra on ssh using the pass mutated list right

[fathom pendant]

ssh is a slow service

try other exposed services

[celest haven]

Thanks mate.Right now i attacking ftp am i in the right track?|| hydra -l kira -P mut_password.list ftp://10.129.202.64 -t 48||

[fathom pendant]

should get you there in a few minutes

[celest haven]

Thanks you very much.😀 I was stuck on this three days😂

[fathom pendant]

step 1) enumerate the target

also as a note: you'll want to save any and all credentials you find for this module

[celest haven]

Thanks mate I will do that

[fathom pendant]

48 is generally a good bet for ftp threads

[sleek moss]

also shud i attack the easy lab with mutated passwords or no

[fathom pendant]

i believe the mutated list should work

[sleek moss]

i c ok thank

[cursive cradle]

so on the windows fundamentals module, on the "NTFS vs. Share Permissions" it says "Once the proper inbound firewall rules are enabled we will successfully connect to the share.", they don't say which ones so had to look for them, idk if it was intended that we knew by hand before but well, Ig is part of the learning to look for , maybe I didnt read something

Already did that part only wanted to know

[frosty spade]

AD Enumeration & Attacks - Skills Assessment Part I
how do i get a shell from the webshell wget doesnt work

[mossy bison]

Hey, so im having a problem with module 19 section 103, where i have to enumerate the ports and their services fine the service that cant be fully scanned and find the flag. Sometimes the port scan doesnt ever load but i have found a work around for that as it sometimes works and i can just write down the port status's, hopefully its a connection issue w me and htb or im just running to many enumerations and canceling them when packets drop?

[fathom pendant]

you should only ever need to run one nmap scan at a time

[mossy bison]

the issue here is that the nc -nv ipaddress port just times out

[fathom pendant]

my brother in christ

the answer is right there

[mossy bison]

the 220 htb thing?

[fathom pendant]

it times out due to inactivity

yes

220 is a status code :)

[mossy bison]

im try that again but a couple days ago i copy pasted it like 3 different ways and it was wrong

[fathom pendant]

2 things:
Delete the screenshot
the only thing that matters is the HTB{..} bit

make sure you don't have any spaces before and after

[mossy bison]

no spaces ok. thanks

[fathom pendant]

yep

220 isn't important; that's literally a response code, that generally means "I received your connection"

A 220 code is sent in response to a new user connecting to the FTP server to indicate that the server is ready for the new client. 

[celest haven]

Hi mate I wait until finished still not found match.

[fathom pendant]

try resetting the target; it's likely your attempts to bruteforce ssh with 64 threads ddosed it

[celest haven]

Thanks mate I will do that

[ruby whale]

Last Password attack Lab to go , then I will be done with this evil module.

It is satisfying to solve password attacks lab after toiling through the sections.

[celest haven]

Hi mate after reseted the machine i runed for while still not getting the password.Are you sure is for attacking ftp on this one becuase this is for Credential Hunting in Linux not the Password Mutations becuase i remember on Password Mutations is use this method to attacked the ftp.But this for the question of Credential Hunting in Linux.So far all the hint is talk about the attack the ssh https://forum.hackthebox.com/t/password-attack-academy-credential-hunting-in-linux/267992

[fathom pendant]

Yes: I'm sure

[ruby whale]

Hey @celest haven which section are you working on ?

[fathom pendant]

The module has you reuse that mutated wordlist

[soft cedar]

what section is that?

[celest haven]

Yes i did use the same password list from the Password Mutations

[ruby whale]

For kira you don't require whole mutation list, you need mutation of specific password.

[celest haven]

I'm working on Credential Hunting in Linux under the PASSWORD ATTACKS

[fathom pendant]

It's still included in the whole list

but mutating the given info with the custom.rule from the resources works too ¯_(ツ)_/¯

[celest haven]

I used the same list from the Password Mutations

[fathom pendant]

Yes: and I'm reiterating that her password should be included in that same list of 90k + passwords

[ruby whale]

If you are trying to use mutated list @celest haven have patience it will take time.

[soft cedar]

I mutated the password provided in the hint, using the whole mut.txt takes a lotta time.

[soft cedar]

and I think you should attack ssh.

[celest haven]

Do you mean mutated the LoveYou1 only

[ruby whale]

Yes

[celest haven]

Thanks for hint I got the password instantly this time

[celest haven]

You are right is the SSH

[fathom pendant]

why? ssh is generally slow to attack

[celest haven]

Becuase the world list only have one word LoveYou1 to mutated

[fathom pendant]

That wasn't my question

:)

[soft cedar]

yes you're right, but iirc, included in the hint, it stated that the kira had ssh access to the system.

[fathom pendant]

Yes: but the hint also refers to the fact she uses a variation of that password

Much like earlier in the module referring to getting the ssh password for "sam" but it's more efficient/better to attack a different service

[celest haven]

At this case doesn't matter which service as along the wordlist short.It's kind of the same speed i just tested ftp and ssh both of them,Almost the same speed.

[fathom pendant]

Also, hitting ssh with a high number of threads isn't generally advisable

[celest haven]

-t 48?

[fathom pendant]

normally ssh restricts the number of threads allowed

[soft cedar]

that's why we mutated it🤷‍♂️ , that was my understanding of the question

[fathom pendant]

Yes but it can be used to attack a more responsive service

Attacking ssh should generally be a last ditch effort

[soft cedar]

oh yeah^^

[fathom pendant]

Because in the case where ssh is configured to only allow 4 threads: this would take exponentially longer

Or in the worst case: DoS the server

[celest haven]

Thanks if for the ssh -t 4 will be the maxium right

[soft cedar]

||do you still get the flag in ftp?||

[fathom pendant]

Her password is the same

The hint points to her also not being security conscious about her passwords

[soft cedar]

yeah but i mean for finding the password of will

[fathom pendant]

Hit a responsive service -> get creds -> check for reuse

[fathom pendant]

||ftp comes into play in a different section||

[soft cedar]

I understand wym^

[fathom pendant]

Yup. Its more that I'm advocating best practices rather than straight up saying not to do it

[soft cedar]

that's totally understandable

[little bear]

B33n w0rk1ng 0n W3b Pr0x13s l8l7 😉

Soon, I will not be afraid of the 1337 and will accept it. Trauma it shall be no moar.

[fathom pendant]

You'll be seeing b64 in your dreams

[little bear]

That itch I just can't scratch 😂

[sterile epoch]

I am in dcsync in ad enumeration. I am stuck at dumping lsa using both mimikatz and secretsdump
secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5

[rustic sage]

heyyyy we on the same question :> waiting on target to spawn tho

[sterile epoch]

great tell me if it works on yours please

[sterile epoch]

any updates?

[rustic sage]

I'm trying to use mimikatz instead of sshing into the linux machine on the network im too lazy for that.

but for some reason mimikatz is not loading it gets stuck with no prompt >,< so i guess ill try the linux method

or maybe use proxychains .....nah too much work

yep im gonna use proxychains for some reason cant ssh into the linux machine either

[quasi wave]

hi where do I find the footprinting wordlist provided as a resource in the SMTP enumeration section of footprinting module?

I just need to know that and then I am gonna try to figure out the rest myself

[soft cedar]

Check under the cheatsheet button.

[quasi wave]

I just see another button that says "download VPN configuration"

[sterile epoch]

use ligolo-ng

[sterile epoch]

did it work?

[rustic sage]

nope but i got mimikatz to work as adunn with cmd

[soft cedar]

No, look at the top right section on the page. where they list table of contents, it’s on top of that

[rustic sage]

I was able to get the cleartext pass with mimkatz in cmd

gotta use the user from the first question

powershell for some reason is dodgy

[sterile epoch]

I wanted to try the example ones cuz we found the creds to adunn in the last section

[rustic sage]

well adunn is just to do the DCsync

you use the DCSync to get the pass for the user from the first question

[sterile epoch]

but to use secretsdump you need creds for the account you are attacking as

ie inlanefreight/adunn

[mystic light]

i dont know how you all are setting it up, but if im attacking a DC via any bastion, i tend to opt for chisel.exe and proxychains from my kali machine.
just tried secretsdump, works great.

[rustic sage]

yes for secretsdump you were doing it correctly

[sterile epoch]

I used both tools mimikatz and secretsdump

[soft cedar]

Ligolo is pretty simple to learn and easy to set up

[rustic sage]

but it said access is denied my guess is the password you typed was typed wrong

prolly typed it too fast

[mystic light]

definitely good. chisel was my first love so it just stuck 😄

[sterile epoch]

I cannot even copy paste the damn command

[quasi wave]

how do I use a word list to enumerate users in Nmap or do I not use Nmap?

[rustic sage]

try the command again and go slow when you type the password.

[quasi wave]

I googled it and I am getting results like smb-enum-users script

[sterile epoch]

wordlist for nmap? what are you trying to do?

[rustic sage]

because it says rpc_access_denied figured that only comes from incorrect user/pass.

[sterile epoch]

I figured so lemme try again

[soft cedar]

What are you trying to do?

[quasi wave]

I'm trying to enumerate the SMTP service in order to find the username that exists on the target system

its for SMTP section of footprinting module. 2nd and last question of section

[soft cedar]

Then you’re on the right track with smtp-user-enum script.

[sterile epoch]

whats the question?

[quasi wave]

ok thanks

[sterile epoch]

k i got it

[sterile epoch]

still the same

can you try on yours?

[rustic sage]

i cant ssh into the linux machine

[sterile epoch]

how

[rustic sage]

for one reason or another im not bothering to find out why lol

[sterile epoch]

you need to use the windows machine and use ssh like in linux

[rustic sage]

i did or let me try with cmd

instead of powershell

ok im in

dammit my life expired hang tight i gotta redo stuff

[sterile epoch]

bruh

[rustic sage]

its okay its the pwnbox that expired not the target

[sterile epoch]

increase the lifetime of both

[quasi wave]

I think I found answer but there's some silly syntax here I'm not getting:

┌─[us-academy-2]─[10.10.15.70]─[htb-ac-605555@htb-t8infzsaqy]─[~]
└──╼ [★]$ nmap --script smtp-enum-users.nse -p25 -MVRFY -U foorprinting-wordlist.txt -t 10.129.152.249
Argument to -M must be at least 1!
QUITTING!

[sterile epoch]

try using default scripts -sC

[quasi wave]

ok

[fathom pendant]

Just use smtp-user-enum tool

[rustic sage]

so...it works but there is an issue

if you use the -just-dc flag it will spit out all the accounts like it should. But if you use the -just-dc-user flag it doesnt work for some reason

[sterile epoch]

whats the command you using?

[fathom pendant]

Because they are fundamentally different flags

They serve different purposes

[rustic sage]

||secretsdump.py -outputfile inlanefreighthashes -just-dc-user syncron INLANEFREIGHT/adunn@172.16.5.5||

sorry it is hard to work with copy/pasting stuff here

[quasi wave]

ok I have a list of users do I just try each of them until I get it or is there a methodical way of doing it?

nmap gave me the users

in the form of a list

[fathom pendant]

Nope, the right flags with smtp-user-enum will only spit out one answer

[rustic sage]

it is resetting my connection although i think it's because using secretsdump was putting out too much information via ssh

[rustic sage]

oh no I got it sorry I got it to work using that command from before ^ that I spoilered

oh crap it's 1:26 AM im going to bed. time flies when you havin fun

[quasi wave]

the closest I can get is this:

└──╼ [★]$ nmap -p25 --script smtp-enum-users.nse --script-args smtp-enum-users.methods={VRFY} 10.129.152.249
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-05 06:33 GMT
Nmap scan report for 10.129.152.249
Host is up (0.0053s latency).

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-enum-users: 
|_  Couldn't find any accounts

Nmap done: 1 IP address (1 host up) scanned in 10.02 seconds

Now I know if I use the -U and -t flags for the wordlist and IP address respectively that it should work but it doesn't.

[fathom pendant]

Stop using it with nmap

There's literally a normal tool called smtp-user-enum which works 10x better than nmap

And you don't gotta fight with figuring out script-args

[quasi wave]

ok thanks

well now that I started with the smtp-user-enum tool I'm making progress thank you

I'm gonna give it five or ten minutes to load

the scan yielded 0 results:

└──╼ [★]$ smtp-user-enum -M VRFY -U footprinting-wordlist.txt -t 10.129.152.249
Starting smtp-user-enum v1.2 ( http://pentestmonkey.net/tools/smtp-user-enum )

 ----------------------------------------------------------
|                   Scan Information                       |
 ----------------------------------------------------------

Mode ..................... VRFY
Worker Processes ......... 5
Usernames file ........... footprinting-wordlist.txt
Target count ............. 1
Username count ........... 101
Target TCP port .......... 25
Query timeout ............ 5 secs
Target domain ............ 

######## Scan started at Mon Feb  5 06:41:42 2024 #########

######## Scan completed at Mon Feb  5 06:43:27 2024 #########
0 results.

[fathom pendant]

Might need to adjust the wait variable

[quasi wave]

I adjusted it to 10

we'll see if that does anything

[fathom pendant]

Maybe 15-25

[quasi wave]

ok hold on

10 still didn't do it I'm gonna try 20

its taking a while but that's what you'd expect from a 20 second per username wait time

found it it worked!

thank you so much

[fathom pendant]

It's because the service is slow to respond

[quasi wave]

are you still gonna be online in a couple of hours?

[fathom pendant]

Probably not

[quasi wave]

ok