modules

[astral inlet]

i want cpts 🙂

[hot heart]

Dude its sick😂 I feel like it instantaneously adds a level gravitas

I wish you could stack the icons, Imagine having all four next to your discord name

[astral inlet]

what for ? if you know you did it , you did it 😉

[zinc nimbus]

Im working in the active subdomain enumeration section for **information gathering module ** and im trying to find out how many zones exist on the target nameserver but i havent been able to find out at all can someone help me

[acoustic owl]

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[hot heart]

I saw that, but isn't it like a platinum or a gold subscription?

And isn't it like $500 - $1000 A YEAR?

[fathom pendant]

Only if you're buying the annual

It's a fair few hundred dollars cheaper to do like 6 months Plat and buy the voucher

[hot heart]

That's actually not to bad considering everything it comes with as well as an exam voucher, and hell of a lot cheaper than the other certs out there

[pale whale]

Working on the kerberoasting from windows module right now. I rdp into the target vm with remmina, but when I try powerview or rubeus it says they don't exist on the windows machine. I did find the account with the required SPN, but I am stuck trying to extract the ticket.. Help!

[fathom pendant]

The monthly plans don't include a voucher, gold annual is overpriced if you're only planning to do the cwee path, considering that silver annual is not worth it for the entry certs its kinda meh overall

[prisma spruce]

Isn't the same true for the cwee cert?

[pure jetty]

good day everyone can a newbie ask questions here please

[acoustic owl]

When it comes to Academy modules, then yes
Otherwise, read and follow #welcome to find better channels for your question

[pure jetty]

thank you

[mellow delta]

https://academy.hackthebox.com/module/112/section/1069 I am working on this module, I am struggling with the question regarding the zone transfer question. The hint says to give the answer in this format (Format: HTB{...))
I thought that HTB flags were given in (Format:HTB{}) is this an error or am i wrong?

[final kite]

just google it

or chat gpt

[mellow delta]

now I am fighting trying to find the answer to the last question

i have tried enumeration but only getting back three returns and none with the correspondign last octet

[mellow delta]

i meant dnsenum using the a few different wordlists from the DNS SecLists folder

I am not sure what I am doing wrong here

[small sage]

did you manage to solve this? I'm also stuck here

[dim wolf]

this is a crazy response

[short hare]

I don't exactly remember the thing but did you tried this

---

On to documentation and Reporting

Anyone body faced/facing issue with not getting the correct hash using the responder ??
I got hashes of others but not the intended one..! -_-

[mellow delta]

I am still very stuck

[mellow delta]

Did you solve this yet?

[small sage]

my post wasn't in response to your question, but for yours try to look recursively through subdomains

[mellow delta]

thanks, I am trying but not getting anywhre

[small sage]

which subdomains have you checked against? which wordlists?

[mellow delta]

i have been using the wordlists in the SecLists DNS folder

i am checking against the ips returned from when i ran the initial dig axfr command

[small sage]

which ones specifically?

you haven't found all the zones yet

[mellow delta]

I will delete that so it doesn't give away too much info, should i be using a command other than the dig axfr to find this?

i tried dnsenum brute forcing as well

[small sage]

your command was limited to internal.inlanefreight.htb

[mellow delta]

should it just be the ip?

[small sage]

maybe the x.x.x.203 is in a different zone

||I don't wanna give too much away, but you made the assumption its in internal.x.x, its not||

so look for other subdomains of inlanefreight.htb and scan against those

[mellow delta]

ok thanks, I will go keep at it

[small sage]

|| use the fierce wordlist ||

[trail leaf]

Looking at Tapping into ETW in the Windows Event Logs module- when using SilkETW to detect .NET assembly loading, where does the -uk 0x2038 come from? I know it has to do with the keywords in ETW, but is there a place you can look these up?

Or is it one of those not too well documented things that you just wing it

[mellow delta]

I am still so confused, i went back and used the dig command against the inlanefreight.htb @ip and it dumped out all those subdomains it dumps, When I use the dig against the subdomains, I don;t get any further, should I be using DNSenum with a wordlist against these domains?

[small sage]

Yes

[mellow delta]

thank you

@small sage glad you helped me without telling me the answer and how to do it. I feel like I know more now

[quick crane]

ok,thanks

[sick frost]

first question in Gitlab - Discovery & Enumeration in attacking commmon application section doesn't take the correct answer. did anyone faced the same issue

[short hare]

dm me your answer

[kindred jewel]

Module: Active Directory Enumeration & Attacks
Section: Privileged Access
Question: What other user in the domain has CanPSRemote rights to a host?

I'm struggling with this more than expected. I can't find any evidence of anyone being able to PSRemote on the target except for the user in the example, which is fine. I can't find anything in BloodHound either. Can someone please give me a pointer? In BloodHound particularly I've queried all users and groups who "CanPSRemote" but I can only find the user mentioned in the example?

[short hare]

Did you used sharphound in the cmd with Administrator level priv.?

A quick tip
if you have got hold to any user, open cmd/powershell with the Admin.. if possible

Things will be little easy

[kindred jewel]

No I did not, I used bloodhound.py remotely.

[short hare]

open cmd as admin
use sharphound
have the zip
open it on the bloodhound

there is a command in the section
run it the RAW query
look at the map what bloodhound gives

you will have all the things

[lusty thicket]

it’s case-sensitive

[short hare]

use .py version only when use have no other option

[next bronze]

sharphound and bloodhound.py should collect the same things

[kindred jewel]

Yeah I would have thought an admin session on a domain joined host is not required.

I can run the cypher query in my instance, and I get the example demonstrated in the module. I don't however, have anything else. Which is what led me to try and enumerate groups as an example, but still nothing.

[short hare]

yes
but when by mistake ran with or without admin level priv. cmd gives different results
😂
made this mistake and got thinking for long what went wrong

[kindred jewel]

My attempted queries are

#Module
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2
#Remove Shortest Path
MATCH p2=(u1:User)-[:CanPSRemote*1..]->(c:Computer)
RETURN p2
#Just groups even?
MATCH (g:Group)-[:CanPSRemote*1..]->(c:Computer)
RETURN g AS Group, collect(c) AS Computers

All three of these queries give me the same output as the module

[next bronze]

what? you only need a domain account to use bloodhound, there's no need for admin priv

[short hare]

means to say opening cmd/ powershell with as Administrator

[kindred jewel]

I've found an interesting group, that seems relevant. But apart from its name I can't prove in BloodHound that members of that group have CanPSRemote over any hosts.

[next bronze]

it doesn't matter, again you just need a domain account

[kindred jewel]

Right, now I understand. The group isn't custom and it's built-in. So perhaps its permissions are implied. But, for a similar built-in group, such as Domain Admins you can see plenty of outbound control in BloodHound. Can anyone help me understand the discrepancy?

[next bronze]

MATCH p=(n:Group)<-[:MemberOf*1..]-(m) WHERE n.objectid =~ "(?i)S-1-5-.*-512" RETURN p

should give you the answer

did you pivot? the target given is not the DC, how did you run bloodhoud.py?

[kindred jewel]

I ran bloodhound.py on a previous section of the module, perhaps I've made a bold assumption that the domain is the same for all the "training" material?

I have full data in bloodhound I'm not concerned about that

[next bronze]

did you have the spawn the target again?

[kindred jewel]

yes

[next bronze]

then yes it will be different

you'll know the enviroment is the same if you don't have to spawn it again

[kindred jewel]

https://tenor.com/view/facepalm-really-stressed-mad-angry-gif-16109475

The user I found in my group was the correct answer though? So I'm pretty sure the data must be the same? The module even implies we are using the same domain as it is a "pen test" simulation that builds on itself.

@next bronze do you mind if I DM you?

[next bronze]

maybe bloodhound.py wasn't collecting all the info, you can try running sharphound on the target

[next bronze]

if you'd have to respawn the target, the something has changed, the domain and the overall environment will be the same but it's a different image so you'd have to spawn it again

[kindred jewel]

I'll pull another copy using Bloodhound.py but even the query you shared seems unrelated to the question so I thought we might be talking past each other a bit.

[next bronze]

oh oops I pasted the wrong one

MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2

[short hare]

Anyone???

[next bronze]

try with sharphound

[kindred jewel]

good idea I'll do that instead. I'm using the community edition just to make it all the more fun 🙂 that query you just shared is from the module and I get the expected result, but no additional user! Maybe that will change in the newly pulled data.

[red locust]

if you complete the modules for the Penetration Tester Job path, how close do you get to finishing the other job paths

[grand portal]

which Ip should i put there? Source: debugging section/Malware analysis

[mellow delta]

can someone give me a hand with the last question of https://academy.hackthebox.com/module/112/section/1072 I am currently running smtp-user-enum with a large wordlist, but it's going to take forever. Is there a quicker more obvoius way to find the username that I am just missing?

[fathom pendant]

Your machine's tun0 ip... as it says

[fathom pendant]

There should be an included wordlist

[grand portal]

My own Linux vm's tune0 ip? That I will only have if I connect to openvpn.

[fathom pendant]

Yes

[grand portal]

And I should RDP to the target machine using the same Linux?

[fathom pendant]

That's usually how it works

[mellow delta]

yeah, that's what the hint says, but I am not sure where the wordlist is. I can't find it in this module

[fathom pendant]

resources button

[mellow delta]

thank you, I'm an idiot

came back with no results

smtp-user-enum -M VRFY -U with the path to my wordlist and the IP, am I on the right track?

[kindred jewel]

Thanks @next bronze -- Let all be aware that you should run a BloodHound collector in each section of the Active Directory Enumeration & Attacks module. I'll have to go eat some humble pie! I feel like this could be an #858470491676737536 it should be mentioned. Either that or it was bloodhound.py vs sharphound

[jovial fjord]

can't find a file called "shadw.bak" in /vars/backup/ after using the command ls -la, i need the innode number of that file but i can't find the file in the first place https://academy.hackthebox.com/module/18/section/78

[next bronze]

it's /var/backups, and make sure you're running the commands after you've ssh'd in

[mellow delta]

Any pointers for me? I feel lost again

[fathom pendant]

Mess with the parameters

[mellow delta]

the parameters of the smtp enum command?

[fathom pendant]

I dont think the user has access to /var/backups but they don't need it

Iirc the backups are somewhere else accessible

[fathom pendant]

Yes

[next bronze]

isn't that what the question asked?

[mellow delta]

thanks, will try this now

[fathom pendant]

Oh wait wrong module, I was thinking of something different

I just clicked it

And yeah it's /var/backups

[next bronze]

ah okay

[jovial fjord]

oh right meant "var" not "vars" but still can't find the file in that directory

[fathom pendant]

Also you need to add i to the ls command to see inode info

[next bronze]

did you ssh

[jovial fjord]

SSH to 10.129.45.240 with user "htb-student" and password "HTB_@cademy_stdnt!" does this count??

[fathom pendant]

Yes

That's the system you're meant to run the commands on

[mellow delta]

could the parameter be that the SMTP is running on a non standard port?

[fathom pendant]

Nope

Smtp is on a standard port, adjust the wait time

[mellow delta]

will try this, thanks

[short hare]

Hey done the Documentation and Reporting Skill Assessment section??

Facing some strange issue with it

can't describe here as it may be a spoiler

[mellow delta]

adjusting the timing is to get around enumeration safeguards that might be in place?

[jovial fjord]

oh i see, i need to SSH into that one, the current terminal shows different, SSH'd into the right one and got the file finally, i see the innode number but when i type it in the answer box and submit, it still says incorrect???

[fathom pendant]

Yes. Inode numbers will differ from the pwnbox and the target.

But if you do ls -lai /var/backups you should get the inode number

[mellow delta]

I have tried 1 second, and 4 second for the timing delay, but both are producing no results

[fathom pendant]

Need more delay

Smtp is a fairly slow service

[jovial fjord]

Thanks Marcie

[mellow delta]

Thank you, that makes more sense now with regard to the hint. I will make the delay 10 seconds and make a coffee lol

[fathom pendant]

It won't take long with the footprinting list

That list is fairly small like < 20

[mellow delta]

You are an incredibly knowlegable individual. I greatly appreciate your help and patience as I learn these things

[mellow delta]

sorry, am i adjusting the query timeout or the delay between?

[fathom pendant]

The wait time

Using -h or --help should help you understand the tool more

[fair mason]

Ok, why was it determined that my nickname was breaking the rules when my nickname was merely Xyvil?

[fathom pendant]

If your name contained any non-standard characters it gets changed

[mellow delta]

thanks, got it

[mystic trench]

Are you people experiencing constant disconnects from machines in AD Module. Went to pass through AD Skill Assessment again, but can't stay logged in more than 3 minutes

[fathom pendant]

Change vpn region, use tcp

[fair mason]

Ahhhh...So I can't use my cursive format...

[mystic trench]

Did that

[fathom pendant]

Nope, as it makes it more difficult for moderation

[fair mason]

Gotcha...

[fathom pendant]

As the cursive format wouldn't show up

So if they needed to do a message history search, they'd need your username which increases the complexity

[fair mason]

How can I change my nickname to the noncursive version then because it's greyed out for me now?

[fathom pendant]

It's in the server #rules btw, also reading and following #welcome allows you to access more of the server

[fathom pendant]

You can't

[quick crane]

can I dm you?

[cloud urchin]

anyone around that knows the adcs module that can help me out?

[next bronze]

just explain what you need help with

[cloud urchin]

i'm not sure how much i can say here without spoiling it

the gist is i've tried every path and there's a brick wall at each one, seems like the thing is broken or something

it's the skill assessment

[next bronze]

explaining which question it is and what you've tried would be helpful

[cloud urchin]

compromising the dc

or ws01

[next bronze]

enumerate what you have, which esc do you think it's the most likely?

[cloud urchin]

the problem i run into there is that it saves the key and i can't approve it

i've tried all three esc's

[next bronze]

run certipy find, which do you think it's the most likely?

you need to use the right template with the right user

[cloud urchin]

yeah maybe i don't have the right user but i don't see anything obvious which is why i thought maybe i had to go through ws01 too, but the question at the end is just get the dc so i think its easier than that

neither user i have can do it

[next bronze]

again run certipy find, which esc do you think it's the most likely and what user can do it?

[cloud urchin]

i guess i'm missing creds for that account then

[cloud urchin]

should i focus on the box i did get system on and enumerate there for the other creds? thats not really covered in the module but i can't think of anything else

seems to be a lot of red herrings i've spent too much time on this

[next bronze]

yeah, just because it's the adcs module doesn't mean you don't have to run your postex routine

[cloud urchin]

so the answer is outside of the module?

[next bronze]

you're given a scenario for SA after all

treat it like a pentest

[cloud urchin]

i only got the one module seems weird to have a test on the module that has items outside the module

[fathom pendant]

I mean adcs is a tier 3 module yeah?

[next bronze]

yep

[fathom pendant]

So it's making an assumption you know skills that would be covered in lower tier ad modules,

[cloud urchin]

those prereqs dont include what you're talking about though

i feel like it's going to be specific to the subject of the module

[next bronze]

they definitely do

you also didn't tell me which question you're trying to answer

[cloud urchin]

what do you mean?

the literal question the task is asking for? "Compromise DC01 and submit the value of the flag file at C:\Users\Administrator\Desktop\flag.txt"

[next bronze]

so you've gotten the second question?

[cloud urchin]

yes

[next bronze]

then use that

[cloud urchin]

i have

i have tried every combination of command, user, target for each escalation path

each escalation path leads its own roadblock

esc10 doesn't work. esc7 doesn't work because the user doesn't have manage ca authority rights, es8 doesn't work because the user can't approve the request, and i can't get esc11 to work with any combination of machines

other tools mentioned in the module aren't loaded on the machine

[mint echo]

Hi Guys, I was asked to identify the services running on the server, and then try to search to find public exploits to exploit them.

When I run a the nmap command for this, it show this and no services. Am I doing something wrong? should I try using -Pn like nmap suggest?

this question is from the public explots section 2nd module

[short hare]

-sVC -Pn

[fathom pendant]

it seems this target in particular has been acting funky for some people

[grand portal]

until analyzing malware traffic. i've followed through steps, but i am stuck at this "entry point" where it does not follow through (2nd ss). its from debugging section from malware analysis.

[mint echo]

-sVC is like -sC and -sV combined right?

[fathom pendant]

it's exactly that

[short hare]

Yes

[fathom pendant]

also reset the target

it seems like it may be down

[short hare]

Be Pro Max bro

[fathom pendant]

note: generally when given a public IP and port - it's a web server

if it's not you're usually informed otherwise

[next bronze]

first check what group the user is in and what rights the user has

[mint echo]

I reset the target and it still showed the "seems down message", I then added -Pn -sVC to the command, it now shows this.

shouldn't there be a proper name under services instead of unknown?

[short hare]

Hey @fathom pendant can i dm you for a thing
I am in the Documentation and reporting module and I think something is odd

[fathom pendant]

haven't done that module so anything you dm me would be a spoiler for me

[short hare]

ok

Anyone ????

[fathom pendant]

give it a few minutes after spawning it

[short hare]

Anyone can help me in the Skill assessment of Documentation and Reporting ????
Responder in the ssh session is doing something odd

[next bronze]

"doing something odd" doesn't really explain a whole lot

[cloud urchin]

am i supposed to be able to add an officer? i can't do that otherwise i could approve these

[next bronze]

|| there are 2 types||

[cloud urchin]

yeah going over that again now

[low notch]

how do you hide message?

[next bronze]

|| spoiler ||

[low notch]

|| test||

thats fucking cool

chat die

[cloud urchin]

i just get failed to get dynamic tcp endpoint for certsvc

[fathom pendant]

well this isn't a gen chat so it's not uncommon for it to quiet down

[low notch]

no gn?

[fathom pendant]

there is a gen chat

you just gotta read #welcome to find out how to unlock it

[low notch]

gn is off topic?

#bot-commands

[fathom pendant]

yes as it's a chat that isn't related directly to HTB content

you need to verify/link your HTB labs account to the discord to be able to access more of it

[low notch]

what more will i get?

[fathom pendant]

access to the rest of the server

[low notch]

yeah i get that like what is rest of the server?

[fathom pendant]

more chats like #general and #programming and #web (Note these will say No access to you)

[low notch]

okay

thx

[quick crane]

Module:MODERN WEB EXPLOITATION TECHNIQUES. Section:Exploiting SQLi via WebSockets,the url address:https://academy.hackthebox.com/module/231/section/2488.At present, I have successfully discovered the location of sql injection and obtained the version, but when I want to further obtain the flag, it always goes wrong. Is anyone willing to provide help or push? I will be grateful.

[cloud urchin]

well i think i'm one step closer i was able to issue the request but get an error trying to retrieve it (Call context cannot be accessed after call completed.) going to take a little break and come back to it, my vm ran out of time anyway

[quick crane]

this is solved,if anyone need help,all can dm me

[cloud urchin]

alright i couldn't help myself i just had to finish. thanks for the help, i was really missing the forest for the trees. got the flag.

[fathom pendant]

nice; it's usually the simple solution that ends up being the "I swear i checked that" or "no way" solution

[short hare]

Hey struggling with format of the answer
Documentation and Reporting: Documentation & Reporting Practice Lab
Question: What powerful local group does this user belong to?

I have done the rdping to the user
opened powershell
whoami /groups
and i have bunch of groups showing but i don't know the format

All the questions are being done
only this one is left

[fathom pendant]

i think there's a better command for showing groups i think it's like net localgroup or something

net user <username>

[eager ruin]

a

[short hare]

Finally ..!! Thanks @limber river @next bronze
Documentation and Reporting DONE..!
I really want to say something regarding this.
Those who don't want spoiler or something please don't read it.
If some one need to then please go through. WHY???
Because it will save a huge amount of time looking for things here and there. I think it's super important. Otherwise things keeps getting distracted from what needed to be done.

||Starting from the beginning, as mentioned in the section the responder ran with -I eth0 but when you actually ssh to the target you need to listen to the -I ens224 -v and the other one. From ens224 you will have some hashes which can be cracked with rockyou(hashcat) and from the other one you will have the idea what are the possible internal IPs, run a IP sweep (one is mentioned in AD enumeration and attacks module).
Now after having a list of the internal IPs and username and passwords, xfreerdp to using the user which seems to have high privilege by just looking at the same itself. From there you can follow what is explained in Components of a Report or do it yourself.

From the last question use net localgroup it will save time.||

[cursive oriole]

Guys I'm struck at password attack module hard lab.

|| I found J* and D* password and moved the *.vhd to windows but unable to mount it.||
since I don't know how to find user Admin password. Can anyone provide hints.

I tried dumping Sam and lsass since I don't have privilege I'm unable to dump them. Any hints would be appreciated.

[short hare]

did you used bitlocker to john?

[cursive oriole]

Yep that password didn't work for admin

[short hare]

will work but need a little modification

explaining...

[soft cedar]

Transfer the virtual disk to a windows host and mount it there

[cursive oriole]

Yeh I transferred but while mounting it asks for admin password but the bitlocker password is not admin password

[cursive oriole]

Mutate?

[fathom pendant]

well you can mount it in linux

you can find a handful of articles that have been shared about in this discord regarding mounting in linux

[cursive oriole]

Thanks a lot I'll try it out!!

[short hare]

use bitlocaker to john and pass it to say Backup.hash
||Then open the Backup.hash copy and paste it to file say newhash.txt. {Copy from $bitlocker$0$16$6..........}||
Then use hashcat to crack it with -m 22100

Then you will have everything connected

[sly grotto]

hey did you find the answer?

[fathom pendant]

there's one that's 99% braindead follow instructions 1to1 (changing only a few things)

[fathom pendant]

i think he's already cracked the bitlocker pw he just needs to mount it

[soft cedar]

not between the targets users machine but to a windows VM or your own windows machine if you are running one

[short hare]

Earlier he said the password is not the admin password so i thought might be struggling with the password thing

[fathom pendant]

context "But the bitlocker password is not the admin password"

[cursive oriole]

I transferred it to target vm and was trying to mount it there without admin access in target 😆

[short hare]

mount it on you local windows
it will be easier

[fathom pendant]

there's also like a super simple guide to mount in linux

¯_(ツ)_/¯

but whatever goats your boat

[cursive oriole]

https://tenor.com/view/how-can-i-be-so-stupid-jayden-slasher-how-did-i-not-see-that-coming-why-am-i-so-dumb-gif-25655751

[short hare]

can you pass it to me?

[soft cedar]

yup, just run with your admin privs on your local windows

[fathom pendant]

also if they're running their linux attack machine as a baremetal; it's a LOT of extra steps

[fathom pendant]

you can search the discord for it

[short hare]

ok

[fathom pendant]

discord will give you some search stuff for channels

on desktop: in:modules has:link bitlocker

[short hare]

okies

man......
This CPTS path in huge...
Finally can take a glance at it 💛

[sly grotto]

does any one solve this?
could you please help me?

[rustic sage]

hey...I'm totally new to any of this! just any hint it get started?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

thanks

[wild oriole]

Hey guys,
I'm doing Session Security - Skills Assessment, second question
I'm facing download pcap file issue, internet connection looks stable, I was able to connect to the VPN and solve the first question, but something wrong with the download file side, it says expected 4 - 5 hours and it's only 8MB

Any idea?

[cloud urchin]

In the Kerberos Attacks module under AS_REPRoasting the very first walkthrough has you enumerate accounts with dont_req_preauth and provides a response with 3 users. in the example it shows jenna.smith whose password gets cracked with rockyou. i followed the exact steps and am unable to crack the hash on the VM or on my own machine. i went beyond using rockyou and tried real passwords with rules filters, but that didn't work either. the walkthrough shows a successful crack on that account with the password. i created a password file with just that password in it, and it still doesn't work. i was able to crack the other 2 passwords in seconds. what am i doing wrong with the jenna.smith account?

[fathom pendant]

it's likely you're not meant to crack their password

:)

[cloud urchin]

strange that the walkthrough shows it though

[fathom pendant]

the module sections aren't always walkthroughs

[cloud urchin]

it tells you to run that command against the user

[fathom pendant]

just examples

[cloud urchin]

alright thanks

[fathom pendant]

idr it saying to do it specifically against that user

oh wait

i'm thinking something else

but if the question is expecting you to crack it

then there's the difference

is there a provided wordlist/whatever in a resources tab?

[cloud urchin]

yes, rockyou.txt is on the vm it has you connect to

[fathom pendant]

i meant the literally resources button on the page

(if there is one)

[cloud urchin]

i don't see that

[fathom pendant]

ah ok

[cloud urchin]

its strange because it tells you to run the command to show you and says 'see we cracked it' etc

[fathom pendant]

then maybe the hash is busted or something ¯_(ツ)_/¯

that is odd though

[shadow current]

on the windows file transfer module the module is not accepting the output of the hasher upload_win.txt command
here is what im submitting 8990089e402b00f809810659fefb5523 am i doing smthing wrong i double check the uploaded file it has the same hash as mine

[next bronze]

hash is wrong from what I have

[shadow current]

got it im reading the question wrong

😄

[spring haven]

Hi I'm new to hackthebox and new to hacking and new to kali linux. I'm on the kali linux fundamentals module. I answered the first question right but I'm having trouble trying to answer the second question as only the first question came with a hint. The rest of the questions don't have hints and I feel like a complete dumbass rn 🤦🏻‍♀️. I'm on this page: https://academy.hackthebox.com/module/18/section/70 please can anyone help me?

[fresh bramble]

Module - Linux Privilege Escalation Page 5- Path Abuse
Question-Review the PATH of the htb-student user. What non-default directory is part of the user's PATH?
These are the questions that have the opportunity to burn time!
I have done the echo $PATH on htb-student user: copy of my search:
htb-student@NIX02:~$ pwd
/home/htb-student
htb-student@NIX02:~$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/tmp
What is a default directory? – Google - https://docs.oracle.com/cd/E19455-01/805-7228/6j6q7uf0n/index.html
All these directories are default directories per the oracle.
What am I missing?
I need to focus on improving my efficiency and effective methodology in my approach to answering these questions!
Getting so close to the 10 day!! Exam!!
Thanks for your positive coaching - Update - I came back - I ran LinEnum - basically it got me focused on carefully comparing the PATH per the target box to the module - there is a glaring difference - My bad - don't read into the question more than needed - so the answer was staring me in the face!

[fathom pendant]

it helps to ssh to the given target

[cursive oriole]

Finally completed Password Attacks module 🥹 😭 Thanks for the assist @fathom pendant @short hare @soft cedar

[spring haven]

The second question asks: What is the path to htb-student's home directory? I put ssh as the answer but it's incorrect

[fathom pendant]

because ssh isn't the answer

[astral inlet]

bcoz it is wrong

[fathom pendant]

you can get the answer by using ssh to connect to the target

[spring haven]

Oh I see OK I'll try that thank you

[fathom pendant]

the two things needed: the target (click to spawn target) and credentials

which is given above the first question

you just got lucky that the pwnbox has the same machine hardware name

[spring haven]

I think I got confused with the question bc it asked for the "path"

[fathom pendant]

path just means

/path/to/location

i.e. /home/user/desktop

note: this path only exists in an environment variable for the mail question

[astral inlet]

do ~ and then type pwd

[spring haven]

Ok

[fathom pendant]

^

for a handful of questions they exist as environment variables

which you can see with the env command

some require the uname, some require other commands that's listed in the section

[spring haven]

So all I type is ssh first?

[west spindle]

Did you solved it?

[fathom pendant]

it helps to read the section

[rustic sage]

what do I do if a target machine isn't spawning... it just says target spawning with the circle keeps spinning

[astral inlet]

f5

[fathom pendant]

change vpn region

[spring haven]

Oh I see ok

[rustic sage]

even if I'm using the attack box?

[fathom pendant]

yes

the pwnbox is somewhat independent of the vpn region

[rustic sage]

ok, thanks. I'll give it a shot

[fathom pendant]

pwnbox region =/= vpn region

pwnbox region ONLY dictates where the pwnbox spawns
vpn region ONLY dictates where the target spawns

pwnbox just natively connects to the vpn

[rustic sage]

that makes sense. Thank you

[fathom pendant]

👍 it's not quite as obvious as it seems for some

[rustic sage]

I still seem to be having an issue. I cleared my cookies and tried all three US vpn connections

ah, nevermind

just spawned finally. Thank you!

[quick crane]

Module:USING CRACKMAPEXEC Section:Finding Kerberoastable Accounts url:https://academy.hackthebox.com/module/84/section/807 , I dont't know what's wrong,who can help me

I have tried resetting multiple times but to no avail. Same problem.

[analog dock]

Can you show me your hosts file?

[quick crane]

# As a result, if you wish for changes to this file to persist
# then you will need to either
# a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl
# b.) change or remove the value of 'manage_etc_hosts' in
#     /etc/cloud/cloud.cfg or cloud-config from user-data
#
127.0.1.1 upcloud-capture-droplet upcloud-capture-droplet
127.0.0.1 localhost

# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

127.0.0.1 localhost
127.0.1.1 htb-1x1zh1gylk htb-1x1zh1gylk.htb-cloud.com
10.129.92.137 dc01.inlanefreight.htb```

[quick crane]

can I dm you

[fathom pendant]

is dc01 on that ip?

[quick crane]

yeah

[analog dock]

Try adding it in caps as well, and add inlanefreight.htb as well

Also in caps

[quick crane]

Can I dm you

[analog dock]

Why

[next bronze]

[fathom pendant]

your screenshots in Chinese so I can't really understand the extent of what you're showing me

[analog dock]

He’s showing the ip I guess

[fathom pendant]

ye

but that doesn't mean that that's the DC01 address

[quick crane]

What I am showing is a Chinese-English translation.

[fathom pendant]

¯_(ツ)_/¯

[analog dock]

Did you do this?

[quick crane]

you mean echo DC01.INLANEFREIGHT.HTB in /etc/hosts and use in crackmapexec

[analog dock]

Well no need to echo it, just type it in lol

And also add INLANEFREIGHT.HTB and inlanefreight.htb

[quick crane]

ok

[analog dock]

Yes, what does it say now

[quick crane]

ok,thanks,it is successful

[analog dock]

[fathom pendant]

yeah machine and domain names are one of the few things that windows cares about being capitalized

[analog dock]

Mostly Kerberos that can be annoying with it

[next bronze]

nah it's cause the domain name is missing, capitalisation doesn't matter

[analog dock]

But I think the main issue was not having inlanefreight.htb

[next bronze]

for kerberos you need both the fqdn and the domain name on dc

[analog dock]

As it was trying to connect there at 88

[analog dock]

At least looking at the last line here

[quick crane]

ok

[final kite]

• 0 How many partitions exist in our Pwnbox? (Format: 0)

anyone know how to find this

[fathom pendant]

lsblk is a good way to find out

another is fdisk -l

[final kite]

ah ty found it

[teal path]

Same issue. Did you manage to solve it?

[ruby whale]

10 more to before I attempt to claim the glorious sword.

[astral inlet]

https://tenor.com/view/doja-cat-star-wars-gif-25078126

[misty current]

MODERN WEB EXPLOITATION TECHNIQUES - DNS Rebinding: SSRF Filter Bypass
What's the password for Webmin?
I'm trying a few things and I'm not getting it. Is it part of the exercise challenge to figure out the password?

[autumn pilot]

there is no password

[opal dagger]

hello there, i need some help with the module ''ATTACKING COMMON APPLICATIONS" chapter "Attacking Thick Client Applications" basically i have limited understanding of what im doing but the main issue is that following the steps as in the module i did change permissions on the temp folder and generate the bat file then edit the file so it wont delete the other files generated, at this point i go to program data to check the files but i only have the ps1 file and txt file, i cant find the exe file that is suppose to be executed be the ps1 file

[tranquil gull]

Can someone assist with the AD capstone part 2

Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.

[rustic sage]

Hi I am also at the Pentesterpath 😄 Right now the chapter Web enum gives me some trouble, not in solving the task, but in accelarating I could use some help. As beginner I guess my notices are okay but not complete and not comprehensively explaining the topic. Is someone there to support with this?

[analog dock]

Create a userlist, and password spray common weak passwords

[tranquil gull]

Okay yeah I did create the userlist and I tried Password1 and Welcome1 I will try a more comprehensive list thanks

[analog dock]

The latter of those 2 should work

I guess there’s something wrong with your user list

[steady dust]

SQLMap Essentials - Skill Assessment i can't find the attack vector

Do you have any idea?

I saw that there is a contact form with a POST method, but it's not working.

[astral inlet]

anyone can tell me what i am doing wrong please ?

https://academy.hackthebox.com/module/136/section/1288

DM welcome

[tranquil gull]

Im using the jsmith.txt wordlist ive used the 10million one in seclists. Am I missing something

[analog dock]

You already have credentials, you can enumerate users with that

[floral crow]

@steady dust I think I have found the vector, but struggling to find the payload

[rustic sage]

Anyone else getting booted off the labs

[spring haven]

Is anyone here subscribed to htb? As I'm new I'm a free user but I can only use 1 spawn per day. I signed up to learn to become a bug bounty hunter but the prices to subscribe are very expensive

[rustic sage]

I swear every time I have an RDP based lab it constantly boots me off endlessly

[minor dome]

macie what is your level

[acoustic owl]

If you are a student, then there is a special subscription for $8/month
You can also use your own VM, then you have no restriction on the usage time

[spring haven]

How to use my own VM?

[acoustic owl]

https://academy.hackthebox.com/module/details/87

[spring haven]

Yeah I'm learning through the academy

[acoustic owl]

The Academy shows you how to use your own VM

[spring haven]

I'm in the Linux fundamentals module rn

[indigo locust]

ATTACKING COMMON SERVICES: Attacking SQL Databases
Question: What is the password for the "mssqlsvc" user?

can someone help me understand the error below:

sqsh-3.0 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
Open Client Message
Layer 6, Origin 8, Severity 5, Number 3
ct_connect(): directory service layer: internal directory control layer error: Requested server name not found.```

I have also tried connecting to to it through ```mssqlclient.py``` but can't enter queries and have no much use. I did try running responder with Target IP but it does not print anything. Any advise on right directions with steps please?

[fresh bramble]

Good Day - the ONLY way I got through this page is the following video - for a box that is open for walkthroughs - https://www.youtube.com/watch?v=3bvKLj0akMM&t=1066s - Seriously - I was LOST! This walk-though pulled me out of the deep despair of trying to figure this out - it is a LONG walkthrough!! Best Wishes -

[dim wolf]

you are viewing the source code of the page

[astral inlet]

yes

after it did not work to show what i did

[dim wolf]

try echoing the output

[restive sentinel]

Please how to configure htaccess apache2

[floral crow]

I just finished this skills assessment, DM me

[rustic sage]

hi

[deft escarp]

Im in the RDP and SOCKS tunneling with SocksOverRDP section of the pivoting and tunneling module. The issue im having is that the last ip im supposed to get to.:172.16.6.155 (jason:WellConnected123!). Isnt reachable from the windows host we have access to. Also the host used in the example, is reachable but has seperate credentials that i dont have.

[tranquil gull]

Could you reccomend a tool to use to export the users easily to passwordspray them

[analog dock]

Netexec

[raven lagoon]

Hello, im doing that question in Active Directory Enumeration & Attacks Module

What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)

both of them give me error, are the wrong rights?

[soft cedar]

You’ll need to use PowerView for this

[lament surge]

Afternoon everyone,

I am currently going through the Windows Fundamentals module and when I use freerdp to attempt to connect to a windows machine my connection keeps timing out and I have tried adding a timeout of 20 seconds but no luck.

I am using a Kali VM through VMware and OpenVPN is running with the TCP VPN connection file.

I should add that I can connect via rdesktop, but the connection is painfully slow.

Disregard, must have just been some kind of connection issue with HTB, it finally worked.

[deft escarp]

PowerView?

[soft cedar]

ACL privileges are not the same as ObjectAceType

[soft cedar]

Sorry I was replying to someone else
In your case you have to double pivot

[soft cedar]

You’ll need to use PowerView for this

[deft escarp]

Im confused. Im on the pivot host, so i should be able to rdp into the hosy its connected to

But i cant even ping it

No box can see the final host

[stark vortex]

the host in the example is where you pivot again. you should have the credentials for it when you used it previously as your pivot host

[fathom pendant]

a --> b --> c is the answer
and you should have credentials for it, it's in the section

the credentials given in the question are for the final host

if you do ipconfig /all you'll see that the initial host isn't on the 172.16.6.0/24 network

[deft escarp]

The ip in the question isnt reachable. But the host from the example is. The issue with that host is that only the username is given

[fathom pendant]

yes

[deft escarp]

Wheres the password at

[fathom pendant]

it's given in the section

this module is one of the ones where it's a literal step-by-step guide

[deft escarp]

Can you show me where its shown, i must be blind xD

Ive redone this box soo many times, following the example

[fathom pendant]

it's literally the second paragraph after it has you load the dll

[deft escarp]

Lemme see

[fathom pendant]

the paragraph starting with "Now we can connect to 172.16.5.19"

[crystal steeple]

if i remember well, that ip you mentionned is not the ip of final host

[fathom pendant]

already being worked through ;)

[crystal steeple]

nvm

[fathom pendant]

and it is the final host

lol

[crystal steeple]

i thought he was talking about skills assessement lol

my bad

[astral inlet]

no thx

[stark vortex]

hey everybody, I'm currently doing the AD skills assessment II and I'm encountering some technical issues I'd like to discuss and try to resolve but I can't really go into detail without spoilers, so I'd like to discuss in DM so if anyone is cool with that please reply to this message.

[fathom pendant]

<@&861185840277487616>

[quasi wave]

hi I did the previous two SNMP questions for the SNMP section of footprinting module and I have been stuck on the third question for a while.

can someone give me a hint on how to enumerate the custom script that is running on the system in the first place?

I tried snmpwalk, braa, onesixtyone and nmap scripts and I think I'm going in the wrong direction

I have the email of admin and the customized version of SNMP server

just having trouble with the third script

[fathom pendant]

Doing the walk you should see a [script].sh in the output, follow that

You're not executing the script. Just finding it, and it's output

[acoustic owl]

Thanks 🙏

[quasi wave]

now I've found the folder the script is in but I don't know how else I would get output besides running script. is it something else I can do in snmpwalk?

[astral inlet]

sure

[quasi wave]

I found the flag script I'm just having trouble finding the output

can someone give me another hint without giving me answer because I found the path to the file but I don't know how I would get the output from a script without running script unless its saved somewhere

I was thinking I could use the community string for that but I am unsure if that will even help

do I use another SNMP tool besides walk?

[fathom pendant]

Literally just once you find the script just follow it a few lines down to the output

[soft cedar]

you can use snmpwalk to find all 3 answers to the questions.

[quasi wave]

ok thanks

[fathom pendant]

It's all in the snmp output

[soft cedar]

^

[fathom pendant]

There's no need to do any attempts to rce or revshell

[quasi wave]

found it

got flag. now moving onto next section

Thank you this was much simpler when I outputted it to a text file and just found the script for the flag with ctrl-f and looked a few lines down that way. Tho I guess I could have used grep with first part of community string.

lmao I was just a little confused tbh

but now I totally get it

[fathom pendant]

snmp is extremely simple

[quasi wave]

ya

[fathom pendant]

[Simple] network message protocol

[quasi wave]

I was definitely overthinking it for a while ya

maybe I should come here sooner for hints

I was rereading for days and it turned out to be so simple

[fathom pendant]

Nah, working through it is better until you run into a hard wall where nothing you've tried works

[soft cedar]

wouldn't recommend that.

[quasi wave]

ok

[green dawn]

There is value in struggle, you learn a lot more

[fathom pendant]

Considering your message history: you need to work on being able to solve problems and think critically to resolve your issues.

[quasi wave]

ya ok got it I agree

point taken

[soft cedar]

there is joy in tribulations and suffering 🙂

[quasi wave]

ya I will struggle through it then ya

ok so now I'm onto MySQL

[fathom pendant]

Not trying to be mean, just a pattern I've seen

[quasi wave]

got it

[formal jetty]

Hello, is there a way I can get a hint for Perfection box?

[green dawn]

You're a lot farther ahead than me. I just finished the Nmap-module and the labs forced me to go back and read through the module and it made me understand how nmap works a lot more than if I'd just googled or asked for help

[fathom pendant]

In #1213545829172776980 [read and follow #welcome]

[soft cedar]

yup. that will be your only friend in the exams.

[formal jetty]

Thank you

[rustic sage]

cool

[astral inlet]

finally i am not stuck anymore ... in the end it was too easy :/

just understand what they mean is sometimes .... difficult

[modern epoch]

The module Advanced Deserialization Attacks is pretty fun guys.

Congratulations to all involved. The explanation of how to generate valid exploits manually and all the concepts is really helpful and interesting. The skill assessment shines in reversing to bypass the restrictions 🙂

[dim wolf]

fantastic module, a great refresher on assembly + learned a lot of new stuff. skills assessment was awesome

[floral crow]

Can I ping someone for the last question on Advanced command obfuscation in the Code Injection module? i have tried just about everything I can think of, and I don't want to put spoilers in here https://academy.hackthebox.com/module/109/section/1039#questionsDiv

[dim wolf]

it awaits

[indigo locust]

any assistance on this question?

[soft cedar]

Check if you can reach the server. ping the IP.

[soft cedar]

What do you mean you can’t enter queries?

[indigo locust]

Yes Im able to ping

[indigo locust]

it doesnt allow me run sql commands to navigate

[fathom pendant]

sometimes it's dumb

you might need to reset the target

iirc someone else had a similar issue recently

you're using impacket's mssqlclient?

[soft cedar]

Could you elaborate on the please?

[indigo locust]

Hmm Im not sure I used mssqlclient.py

[fathom pendant]

mssqlclient.py == impackets mssqlclient

[soft cedar]

thought you said you did but it’s not allowing you to run queries. no?

[fathom pendant]

yeah someone else had a similar issue where when they typed a query and hit enter it did nothing

but when they used the pwnbox it worked fine

¯_(ツ)_/¯

[soft cedar]

Alrighty.

[indigo locust]

yes thats what i meant

[soft cedar]

did the reset work?

[indigo locust]

checking

[fathom pendant]

you might also need to reinstall impacket

[indigo locust]

you know what I'll just try to do this in my local vm, hopefully works

[upbeat oak]

Hey guys new to the community I'm stuck on getting started web enumeration. I used Gobuster dir to enumerate and find a robot.txt file but when I try to navigate to the page Im unable to connect and see its contents any advice?

[floral crow]

figured it out

[indigo locust]

yup even worse in my own vm. queries dont print anything.

[upbeat oak]

I inputted target ip:port/robot.txt And get a unable to connect to URL page however I'm showing a 200 code on go buster die scan for /robot.txt

[fathom pendant]

are you using http://?

[upbeat oak]

Yes I am using that

[marsh echo]

Hello, I'm doing the skill assement for shell and payload and I'm having a lot of trouble. I have several questions:

1. if tom cat's connection information wasn't provided, how could we find the information in the hint?
2. i crafted a payload with war extension because elf files are not supported but it doesn't work why i ?
   https://academy.hackthebox.com/module/115/section/1139

[floral crow]

what happens when you curl that url?

[upbeat oak]

I tried that too and I get the same message

[fathom pendant]

have you attempted looking at the desktop

[fathom pendant]

the war extension can be used with the java payload

[floral crow]

can you netcat to ip:port?

[fathom pendant]

i mean netcat won't be much as it's a web service

[marsh echo]

ahhhh okok thx i undestand and no I wasn't curious enough to look at the desk, but it seemed obvious, sorry.

[fathom pendant]

sometimes the docker containers are just a bit wonky

[floral crow]

validates connectivity to l4 port

might have to restart excercise

[fathom pendant]

well yes, i'm just meaning these labs have been extra funky lately

[floral crow]

indeed

[upbeat oak]

mmm no and it's honestly just seeming like a connection issue or something else is going on since it's pretty obvious the flag is in the robot.txt file

I only have 5 minutes left on this target machine so i'll maybe try to restart everything and try again

[floral crow]

respawn it

[upbeat oak]

Yeah that worked

[clever topaz]

anyone know how to solve oracle- footprinting? ive run otad for 1 hour yet no result, still searching for sid

and IPMI as well, ive run auxiliary/scanner/ipmi/ipmi_dumphashes module but no result

[fathom pendant]

well otad is just to get creds

and it's easy to miss; IPMI dump should get you a hash

since the IPMI result isn't in the default list: it doesn't crack it

[marsh echo]

i dont uderstand for one question into this section, I know the vulnerability for the blog but when I search the exploit (50064) on msfconsole I get nothing, I even tried to take the exploit on the given base and update the base it doesn't find it.

I tried to connect to the blog as well but it doesn't work.

[fathom pendant]

you can just use 50064

it'll work fine

[clever topaz]

yes

[fathom pendant]

it'll work even if it doesn't show in the search

[clever topaz]

i know otad is to get creds and the module is to dump hash but both i dont get anything

my otad still searching for sid and the msf module dont return me the hash

it just say execution completed

[fathom pendant]

you likely overlooked the result

check the example for the oracle section

and it'll show you what you're looking for

[clever topaz]

msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > run

[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed

[fathom pendant]

that's for the ipmi section?

let's stick to troubleshooting one section of the module at a time

automod detects large blocks of text as spam and autodeletes

[clever topaz]

i see

[fathom pendant]

ipmi is not needed for the Oracle TNS section

[clever topaz]

./odat.py all -s 10.129.145.138
[+] Checking if target 10.129.145.138:1521 is well configured for a connection...
[+] According to a test, the TNS listener 10.129.145.138:1521 is well configured. Continue...

[1] (10.129.145.138:1521): Is it vulnerable to TNS poisoning (CVE-2012-1675)?
[+] Impossible to know if target is vulnerable to a remote TNS poisoning because SID is not given.

[2] (10.129.145.138:1521): Searching valid SIDs
[2.1] Searching valid SIDs thanks to a well known SID list on the 10.129.145.138:1521 server
[+] 'ASDB5' is a valid SID. Continue... | ETA: 00:07:31
[+] 'ASDB6' is a valid SID. Continue...
[+] 'EARTH' is a valid SID. Continue...

see its just searching for sid

[fathom pendant]

weird

idr needing to do anything extra for the odat

[clever topaz]

i know but ive been stucked at these 2 module for 2 hours already

[fathom pendant]

yes: but when requesting help - do it for one section at a time

[clever topaz]

okok sorry hahahaha

[fathom pendant]

that way you don't get wires crossed

and miscommunication doesn't occur

the ipmi one should just be as simple as setting the RHOST correctly and running it

idr needing to set an lhost or anything

[clever topaz]

RIGHT

but idk why it just wont run

i reset the machine few times already

[stone zenith]

Can someone please help me with the skills assessment for command injections

[marsh echo]

so I just have to use 50064?

[fathom pendant]

yes

i forget the command in msfconsole to reload modules and check new ones

[mellow shell]

why the academy boxes are so laggy?

[fathom pendant]

but it's still there even if search isn't finding it

@clever topaz just loaded up one and ran the scanner for IPMI and it works fine, try changing vpn region then

[clever topaz]

[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> run

[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed
its the same using htb instance

sad

[grand portal]

Debugging section/ Malware analysis, my rdp machine disconnects abruptly as soon as I do "sudo inetsim"
Tried, both cases, using my own vm, hackthebox pwnbox as well.

[marsh echo]

thx i find, and for reload reload_all

[fathom pendant]

@clever topaz don't forget you do need to do ./odat.py all -s $IP

[clever topaz]

yes this is what im doing

[fathom pendant]

i just sanity checked both: and they both worked fine on my end

¯_(ツ)_/¯

[clever topaz]

btw im able to get the hash already when i run the module with "exploit" instead of run

zzz i tot its the same

[fathom pendant]

i mean i used run when i used the scanner module

and got it just fine

[clever topaz]

ok im crying ahahahahaah

[fathom pendant]

¯_(ツ)_/¯

[clever topaz]

i literally stuck at few modules because of this kind of bug

[marsh echo]

into vhost i specified blog ?

[fathom pendant]

yes

this is one of the times where specifying the vhost is necessary

don't forget to set the username and password of course

[marsh echo]

yes 😉

thx a lot

[fathom pendant]

all i can say is; idk why yours isn't working but it works on my machine

¯_(ツ)_/¯

[clever topaz]

i also dk

[fathom pendant]

just sanity checked to see if broken: both intended methods worked fine for both modules you're stuck at

[clever topaz]

sometimes i have to restart few times to make it work

[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> run

[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> exploit

[+] 10.129.200.203:623 - IPMI - Hash found: admin:hash

[fathom pendant]

yep

now crack it with hashcat and the provided wordlist

[marsh echo]

I have filled everything in but I notice a bug the RHOST is linked when I put the host ip it also changes the target ip

i've got this error:

[fathom pendant]

reset msfconsole and set it again

it's dumb like that sometimes

[marsh echo]

always the same mistake ...

[fathom pendant]

when I ran into issues all i had to do was reset it and it worked ¯_(ツ)_/¯

so idk

[agile torrent]

for academy modules, sure

ask away

[marsh echo]

i give up 😦 after sleep I'll have clearer ideas

[mellow shell]

anyone having issues with pwnbox/freerdp connection? i mean even the rdp doesnt want to stay connect to its own pwnbox in the server

[marsh echo]

i use rdesktop

[mellow shell]

i trie don my own machine too with remmina and freerdp, no dice. switched to pwnbox no dice

[marsh echo]

use rdesktop he work 😉

[mellow shell]

switched vpn servers, pwnbox instances, reset, the all lot, no dice. shame cos i really want to get the cdsa done

[mellow shell]

which openvpn do you use? im from australia (yes i know), i have only EU or USA to connect to with academy openvpn

[next bronze]

US should have lower ping, and use tcp for your vpn

[marsh echo]

I use openvpn uk

[clever topaz]

its been another hour but my ./odat.py all -s 10.129.24.217 still searching for SID instead of possible hash

[thorn ferry]

Why didn't I get a reward after refering my friends,they finished the first module

[bold plaza]

That is always the line in information technology

[solar zodiac]

Hi everyone! I was wondering if the Intro to Whitebox testing covered dangerous functions in more than just node js

or links to resources to find these dangerous functions 🙂

I think im going to get it, but was curious if the scope was just node js or whether it expanded on more languages

looks like a really neat module! 😄

[mellow shell]

👍

[simple socket]

Hello, Currently I am on the exercice "DCSync" I connected into RDP to the first machine and after that I connected to the machine "172.16.5.225" with the SSH protocol. I executed the "secretdump.py" and I extracted the NTDS content. After that on the first machine I executed the command "Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like 'ENCRYPTED_TEXT_PWD_ALLOWED'} |select samaccountname,useraccountcontrol" And get an error as this command not exist.

By the way I continued And tried to execute the command with mimikatz With the user adunn, I used the password begin by Sy..........7

and got this error "ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege". I not understand if someone can help me thank 🙂

[next bronze]

Get-DomainUser is a powerview command, you'll need to import that first, or you can use

Get-ADUser -Filter 'userAccountControl -band 128' -Properties userAccountControl

[quick crane]

anyone can help me to solved the MODERN WEB EXPLOITATION TECHNIQUES-Skill Assessment last queation?I know this website have ssrf exploit,but I test so many all not have successful.

[simple socket]

Thanks

[simple socket]

Thanks for your help but I not understand I executed on the linux server the command "Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like 'ENCRYPTED_TEXT_PWD_ALLOWED'} |select samaccountname,useraccountcontrol" but inside the file "cat inlanefreight_hashes.ntds.cleartext" But inside in the file I have no content.

May be I forgot something.

[simple socket]

Sorry I tried against may be i got a connection issued

thanks

[soft cedar]

What do you mean you executed on the Linux server ?
Did you run it from your attacking machine?

[simple socket]

Hello Thanks for your response. But Finally I identified my error, it's was an error during the command "secretsdump.py" I got lot of time network error but finally i got the password

thanks

now I am on mimikatz

[soft cedar]

Great.

[simple socket]

I tried to execute mimikatz with the new account found may be it's will work 🙂

[limpid hemlock]

Anyone knw how to solve this last question from pass the hash section

Using Julio hash perform oaas the hash atak launch powershell console like that a question

[soft cedar]

you can use Powershell base64 rev shell for that
https://www.revshells.com/

[limpid hemlock]

Powershell 3 base64

[soft cedar]

yup

[limpid hemlock]

I did it

But not connecting to the netcat listner

[junior oxide]

under Passwd, Shadow & Opasswd section in password attacks do i need to use the mutated list i used in previous sections or the password.list or the rockyou.txt to brute force the hashed password

[limpid hemlock]

No use mutated alone no need of rockyou

[grizzled mulch]

I am not able to use pwnbox section where can I ask questions about dual boot parrot os htb edition

[soft cedar]

what IP did you use?

[limpid hemlock]

Ah .5

172.16.1.5

[soft cedar]

okay, did you open another terminal to catch the connection?

[soft cedar]

can you share the commands you used?

[limpid hemlock]

Yaa

Commands invoke wmiecec target domain username hash then the command the powershell script I got got from revshell .com

[soft cedar]

the whole command from your screen, maybe a ss

[limpid hemlock]

I can't share images in this group that's why I can't share it

[soft cedar]

you can verify your acc here #welcome

[timber kestrel]

[astral inlet]

hi 🙂 how do i access my file ?

||-----------------------------11747533910843235883379297494

Content-Disposition: form-data; name="uploadFile"; filename="minishell.php\x00.jpg"

Content-Type: application/octet-stream

<?php system($_REQUEST['cmd']); ?>||

i always get this :

https://academy.hackthebox.com/module/136/section/1289

[limpid hemlock]

How to find the account identifier to put in to identify my account

I can't see the identifier in my htb page

[acoustic owl]

Read #welcome

The Academy has no identifier. You must use the app.hackthebox.com account

[fathom pendant]

for now*

[dry halo]

one hell of a module lmao. feels a lot better to complete

[limpid hemlock]

How much time it takes to identify us

[soft cedar]

Instantly

[raven lagoon]

i have other 9 sections 💀 is the Skill Assessment difficult?

[remote latch]

the cve sections are just straight up tiring

but its not that bad

[remote latch]

its like big terminology

[dry halo]

The assessment doesn't deviate from the material but there are some places you need to think out of the box; even that is covered. The thing is you need to kinda trust your intuition

[fathom pendant]

i mean the major recurring theme for the assessment is proper enumeration

[raven lagoon]

alright

[dry halo]

1 had one blocker in assessment the answer was staring right in my face and the second assessment was easier for me actually

[fathom pendant]

from everyone that's asked for help: a lot of them were pointed in the right direction by just enumerating better

[remote latch]

it covers stuff like nessus and openvas

i recommend it only bc of the tools

[raven lagoon]

it doesnt seem that hard with BloodHound imo

[fathom pendant]

bloodhound doesn't always show the full picture, it's nice to have though

[raven lagoon]

alright

[dry halo]

bloohound straight up gives everything. coz the scale of the assessment is small

[raven lagoon]

i dont think it would be the same for the exam then XD

[fathom pendant]

wouldn't be a tough exam if bloodhound trivialized it

[raven lagoon]

kinda scary thing

[fathom pendant]

the modules prep you for the exam ¯_(ツ)_/¯

[dry halo]

I did the entire Active Directory twice. this stuff is totally new to me. I spent about a week learning these concepts

[fathom pendant]

and it's not like you can't go back and read the modules again if you get stuck in the exam

if your notes fail you: the direct source of your info isn't a bad fallback plan ¯_(ツ)_/¯

[raven lagoon]

yep if really the path covers close to everything watching the modules while doing the exam should be cool asf

[raven lagoon]

tf, you did the module twice in 1 week?

[oblique tusk]

The exams aren't proctored, right? The FAQ doesn't mention it.

[fathom pendant]

not proctored

if it's not mentioned in the FAQ it's safe to assume it's not proctored

you can also just check the exam pages themselves for the info

[dry halo]

yep. I mean i am doing this full time. solid 6-7 hrs a day

[oblique tusk]

That's one of the reasons why I'm leaning towards taking one of the exams one day. Proctored exams suck because they do not replicate real world conditions where I can look up as much info as possible to get the result that I need.

[fathom pendant]

i mean the exams span several days

[oblique tusk]

When I'm at work, nobody is watching to make sure I don't check a man page or Google something.

[soft cedar]

I don’t think that’s the point of proctoring:)

[fathom pendant]

^

[oblique tusk]

Yes, they also want to verify identity.

[raven lagoon]

the problem is another one ahahah

[fathom pendant]

proctoring is meant to prevent cheating i.e. using a prohibited tool or asking another person for assistance

[soft cedar]

Imagine doing cpts or oscp without googling/ notes

[fathom pendant]

or even pulling up a walkthrough

[fathom pendant]

compTIA exam ahhhh shit

[soft cedar]

Lmao

[oblique tusk]

The CompTIA exams are pretty easy at least, but Googling for a result also isn't always helpful because they give you four possible answers where 2-3 would work, but they expect you to pick a "best".

[raven lagoon]

mrb3n is the only one who read the report?

[fathom pendant]

no

there's several people that review exams afaik

idk if they assign one person to read your report

but there's at least a small handful of people that review the reports

[soft cedar]

think that's the same with CEH right?

[fathom pendant]

wouldn't know, haven't taken

[oblique tusk]

HTB exams also don't expire, right?

[fathom pendant]

the cert doesn't expire

any half-decent cert doesn't expire

[oblique tusk]

[laughs in CompTIA] Really though I wish more certs were perpetual. It's annoying to keep up with my CompTIA certs just to keep them on my resume.

[fathom pendant]

i mean you only have to renew the highest level one

¯_(ツ)_/¯

[oblique tusk]

Yeah. I just end up getting a higher level cert every 2 years.

[fathom pendant]

i mean most employers don't actually check if your compTIA certs are still active

[oblique tusk]

True, but I don't want to risk it. Some workplaces are very strict. i.e. federal work they require Security+ or equivalent.

[chilly kindle]

this really helped, :/

[noble hazel]

Hi all, I am working on Module: Advanced XSS and CSRF Exploitation. Section CORS Misconfigurations. Found that /index.php,login.php and profile.php have a CORS misconifguration. I am trying to send a post request in the following way https://paste.offsec.com/?88db23989b5f8e48#L9VbWpPPFJMdc35K6D9rsDD2U83Vq1qpby8D2yL9EDw= but is not working. Any help will be appreciated.

[clever topaz]

why someone else nmap is super fast but mine is so slow

[spark charm]

Me too.

[misty saddle]

Are you using PwnBox or your own VM?

[clever topaz]

both also slow

my server is just <100ms

[misty saddle]

100ms is still a bit high. Try to find a server closer to you and if that isn't possible try to eliminate the target-IP and start it again. That's just my guess 🙂

[clever topaz]

its the closest already ;(((

wonder how i enum in exam

[misty saddle]

Good question. Hope you find a solve!

[clever topaz]

AHAHAHHA

[acoustic owl]

Try it via the ||HTTP header and the exploit server||

[marsh echo]

Why is it that even after modifying the LHOST it doesn't change? into module :https://academy.hackthebox.com/module/115/section/1139

[soft cedar]

Try with setg <lhost>

[marsh echo]

thx a lot

[clever topaz]

😭

tried all wordlist but ntg come out

footprinting-hard

nvm everything fixed when i switch server region zzz

[quick laurel]

Hi folks!
I’m stuck in a XSS phishing exercise, I think I understood the exercise and it’s not difficult. However my php server won’t listen when I try to test it.
What am I doing wrong? I search the internet and try many things but nothing worked.

Thank you for your time

{!}
[I’m new to hacking, the exercise it’s part of cbbh path I’m on “Cross-Site Scripting” module in “phishing” lesson.]

[acoustic owl]

What do you mean, your PHP server is not listening?

[quick laurel]

Well I do [sudo php -S 0.0.0.0:8080 press enter then I go to the page and try a login with user:test pass:test

And it just don’t show any info

However if I turn on foxyproxy it shows so maybe I’m doing something wrong or missing a step

[fathom pendant]

That should be the right one if not there's just the snmp.txt I believe

[acoustic owl]

To test your web server, you should call it up directly.
http://<yourip>:8080
Does this give an entry in the web server log? If so, your web server is running normally. If not, the web server is not running correctly

[clever topaz]

ya im inside ssh now not sure what to do

[fathom pendant]

I believe history is important

[clever topaz]

haha thanks for the hint

[quick laurel]

It gave an entry on server

I’ve followed 2 different writeups in attempt to figure out where I was wrong… can’t find any flaw… but it seemed to me the problem was the comm between site and server

Even if I do port 80 instead of 8080

[acoustic owl]

Now that your web server is obviously running, your attack seems to be faulty. But I can't judge that because I don't know what you did.

[alpine umbra]

i am stuck on footprinting lab hard want to guide someone who completed it

[acoustic owl]

Just ask your question. I'm sure someone will be able to help you.

[alpine umbra]

i find ssl certificate and generate public key according to it but i found public key error

[acoustic owl]

If you find an SSL key, try to use it.
ssh -i file.key user@10.10.10.10

[quick laurel]

I’ve done this basically

And I made sure to take my time, read it follow it understand it

[alpine umbra]

try this and show same erroe

i use id_rsa as a file and target ip as a ip

[quick laurel]

I even altered some strings in firewall and turn off tracker blockers and stuff

[soft cedar]

Did you set permissions?

[alpine umbra]

no i could not change it

i think i miss that part

[soft cedar]

You have the private ssh keys right ?

[alpine umbra]

yes

[soft cedar]

Copy the keys and save it in a file (id_rsa)

And set permissions;
chmod 600 id_rsa

[alpine umbra]

ok already done

yah i did it

[soft cedar]

Now you should be able authentic to the service.

[alpine umbra]

i authentic using those stuff but get an public key error

[analog dock]

If you have the ssh key you should be able to ssh to root with that

[soft cedar]

what was your command?

[analog dock]

Are you sure your key is in the correct format?

[alpine umbra]

sometimes it shows invalid format

[analog dock]

So I guess not

Make sure you properly copy it from the mail

[alpine umbra]

yah i proper copy it begin to end

but no luck

[analog dock]

What command are you doing

[soft cedar]

^ should include --begin private key-- and --end private key--

[analog dock]

And a whitespace at the end afaik

[acoustic owl]

Since this writeup violates the ToS, I am deleting the link
https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[alpine umbra]

manually copy paste

[cloud urchin]

Working through the Kerberos module on unconstrained user delegation. One of the steps says to start krbrelayx.py with the compromised user's NT hash, but it doesn't explain how to obtain this hash. secretsdump with the two accounts provided doesn't work, what am i missing here?

[analog dock]

Share the command you’re using to ssh..

[alpine umbra]

yes

[cloud urchin]

should i just use a hash generator with the password?

actually, that worked. nm.

[alpine umbra]

ssh tom@[ip] -i id_rsa

[analog dock]

In other words you did not listen

[cloud urchin]

the module doesn't cover this though, did i miss something or am i just expected to know?

[analog dock]

.

[quick laurel]

Yes I just read about it I’ll remember next time

[alpine umbra]

i use root to all commands

[analog dock]

Bruh

Ssh to root

And you should definitely not run everything yourself as root

[acoustic owl]

It's not your fault. You have not violated the ToS
But I generally recommend that you solve the modules without writeups.

[soft cedar]

I think I used tom ¯_(ツ)_/¯

[alpine umbra]

oh i will try it as non root user

[analog dock]

I’m 99.9% sure I ssh to root

[soft cedar]

hard lab right ?

[analog dock]

Yes

[alpine umbra]

yes

[analog dock]

Yup I definitely ssh to root

[analog dock]

ssh -i id_rsa root@ip

[alpine umbra]

ok i'll try

[soft cedar]

tom worked for me @analog dock

[analog dock]

Root for me 😄

[soft cedar]

well it makes sense since the assessment doesnt end with you rooting the box

you're giving too much away lol

[quick laurel]

Totally agree however I spent 3 days and can’t find the issue here so I study that writeup hoping to find my flaw still nothing though

[analog dock]

My bad, thought that was stated in the question

[devout thorn]

For anyone struggling with this one ("Golden Ticket" module), you need to use "rocky" account

[acoustic owl]

If you do exactly as described, you should be able to get the flag

[dim wolf]

that's from Windows Attacks & Defense, not Active Directory Enumeration & Attacks

[alpine umbra]

hey should i make id_rsa.pub file

[dim wolf]

unless i'm mistaken

[analog dock]

No

[dim wolf]

there was no Golden Ticket section when I did it..

[analog dock]

Where exactly did you get the key from?

[alpine umbra]

ok wait

[analog dock]

Screenshot the key

[soft cedar]

^

your format could be wrong

[quick laurel]

I’ll try again, thank you for trying🤩

[alpine umbra]

hey asking root password but i found tom's password

[analog dock]

🥲🥲

Show the key…

Screenshot it

[alpine umbra]

how to add ss to this chat i am noob on discord

[acoustic owl]

Read and follow #welcome

[soft cedar]

You’ll have to verify your acc

[urban wadi]

on avarage how much does it take to complete 1/2 tier modules?

[soft cedar]

^

[analog dock]

Wasnt this channel open to send pics either way?

[alpine umbra]

ok

[urban wadi]

like personal opinion

[dim wolf]

what exactly do you mean, like time wise or cost wise

[devout thorn]

My bad, I've encountered the same issue in "Windows Attacks & Denfese" and wanted to share it 😅
Too bad @buoyant void didn't tell how the issue was solved...

[analog dock]

It shows the avg in the module overview

[acoustic owl]

You must always be verified to post pictures

[urban wadi]

im buying student plan and all modules i complete get to keep, how much time does the people that do 1 or 2 tier modules need to do it

personal opinion

[urban wadi]

not time provided in the module

[analog dock]

Then what are you asking

[urban wadi]

ik it differs from person to person but how much does it take for those who did 1 or 2 tier modules

[analog dock]

In the end it always depend per person

[dim wolf]

it takes however long it takes to read through, practice, and do the skills assessments

i can't really provide a time estimate because each module is different

[fathom pendant]

It can take between 4-8 hours

[urban wadi]

im asking how much time did it took you PERSONALLY to complete 1/2 tier modules

[acoustic owl]

Sometimes more, sometimes less time than specified in the module

[fathom pendant]

Some modules are also quite lengthier than others

[analog dock]

Depends on the module

[urban wadi]

tbh its rush against the student plan lmao

[analog dock]

So like I said look at module overview

[fathom pendant]

Why?

[urban wadi]

alr

[urban wadi]

all modules you didnt complete get lost

from the student plan

and you get to keep those who you complete

[fathom pendant]

Ok and? Student plan is billed monthly

[urban wadi]

ye

[dim wolf]

i just did Intro to Assembly Language and that took me 2 days (what it said on the module)
before that i did Understanding Log Sources & Investigating With Splunk and that took 3 days (module said 8 hours)

[fathom pendant]

Are you saying you want to blitz through a bunch of modules in a month?

Which imo will only hurt your learning

[urban wadi]

if i could understand faster it would have been better lol

[dim wolf]

i'm telling you right now DO NOT blitz through the modules

sincerely someone who did just that

[urban wadi]

was assembly hard(i like it for game mods)

[alpine umbra]

hey how to get my acc identifier

[fathom pendant]

If you're looking to only complete modules in a month, then you're only seeking solutions and not understanding

[analog dock]

app.hackthebox.com

[fathom pendant]

Read #welcome

[dim wolf]

moderately difficult

[analog dock]

Make an account there and get it from your profile

[fathom pendant]

The account identifier is only on the app.hackthebox.com site

[dim wolf]

but my prior knowledge of assembly helped

[urban wadi]

nah, i wanna undestand it

but always wonder how many i can do in month, while undestanding them

[urban wadi]

[fathom pendant]

Well cram studying and learning is not good

[alpine umbra]

i change my mail to university mail shows some credential issues when i am logging labs

[fathom pendant]

Trust. The moment you stop using it, you will lose it

[dim wolf]

it comes down to:

• how much time you have
• your learning speed
• the difficulty of the content in each module

[urban wadi]

i suck at learning hard and complicated things yk?

[fathom pendant]

Then you're likely not gonna get a lot done in a month

[urban wadi]

-_-

[fathom pendant]

but it also depends how you define "hard" ¯_(ツ)_/¯

[urban wadi]

idk, how you define it?

[fathom pendant]

I mean, I'm not gonna sugar coat it bro

[dim wolf]

you also have to take some time to practice the things you learned so that you don't lose that knowledge

[urban wadi]

i do that

[fathom pendant]

My definition of hard likely differs from yours. Hard for me means it requires engaging my brain to solve a complex problem

[urban wadi]

its the one thing im good at, practicing

[analog dock]

Make an account there, it’s not the same as academy

[alpine umbra]

ok

[urban wadi]

same

tbh hard and complex are different things tho

something can be very simple but not easy

[fathom pendant]

That's a personal definition

¯_(ツ)_/¯

[analog dock]

If something is very simple, it’s easy for that person..

[dim wolf]

the best way you're going to know how much time you should expect to take in a month is to do htb academy for a month

[urban wadi]

simple != easy

[analog dock]

Whatever lol

[urban wadi]

its just the straightfowardness of a task

[fathom pendant]

I mean you're asking extremely open ended and very much "it depends" type question my guy

[cloud urchin]

Kerberos module - unconstrained user delegation. How did they obtain the NT hash for the sqldev user? It doesn't explain how they got it. For the challenge they provide the password, which i converted with a string to ntlm hash converter online so I was able to complete this, but the module doesn't cover how they did it. did i do it right or did i miss something?

[dim wolf]

it's $8, try it out, gauge how much you've learned at what pace, and you'll have a real answer

[fathom pendant]

Like not everyone here is gonna have the same personal definition of things

^

[urban wadi]

ye, cuz we are all extraordinary

[urban wadi]

that price doubles bc of my country currency so its more like 16 for me but i will for sure take it in the following days

[dim wolf]

i can expect the intro to malware analysis module to take a week to complete

[onyx dust]

no

[dim wolf]

3 days... 3 days is not enough for my small brain