modules

[quasi wave]

if not why would they give password away?

[fathom pendant]

You don't get any password from nmap?

Like you're not going to get anything like that from nmap I mean

[quasi wave]

an encrypted one and then it gives password away in next question

it gives sha2 salt

[fathom pendant]

??

[quasi wave]

its like a super easy question. I guess this is not password cracking module?

[fathom pendant]

It's not

And again you don't get any sort of encrypted password

I think you're misinterpreting the output

Also the creds it gives you are related to another section you've already done

You're given creds to connect to the service with, just use those to enumerate what's required

[quasi wave]

ok thanks I completed MySQL section

got everything I needed

[fathom pendant]

Literally just don't overthink it

Save the overthinking for attacking common services

[quasi wave]

ok thanks

I will do that from now on

[fathom pendant]

that's just general advice overall: don't overthink, if the module didn't make reference to - or go over how to do it, it's likely not what you're looking for

[quasi wave]

ya I have issues with overthinking things generally tbh

[fathom pendant]

the exceptions might be in some later modules where you're meant to crack a pw after obtaining the hash (but those are fairly obvious, as the Question will clearly state, what's the cleartext password for x)

[quasi wave]

ok got it

[fathom pendant]

but the later modules are later in the CPTS queue due to the fact they expect you to have a base level understanding of the stuff before it

Attacking Common Services can be seen as the Sequel to footprinting, as you footprint the available service, then attack it using various methods

[quasi wave]

ah I see ok thanks

[fathom pendant]

I.E. how are you meant to even know how to look for certain services

or do basic enumeration and recon

[quasi wave]

well that's a fairly clear explanation

[fathom pendant]

I would say, for your case, as you're learning these techniques - turn them into a checklist of sorts

[quasi wave]

ok

ya checklist could be good to organize my thinking

on another note I'm still learning but I want to be able to help other people on this server to give back to community but I don't feel I know enough. is there another way I can give back? or should I just try to do my best to help people here?

[fathom pendant]

I.E. a basic checklist for finding a vulnerable service

• Are services that allow Null Sessions/Anonymous login available?
• Is Anonymous/Null Login enabled?
• Check other services for potentially revealing info

[quasi wave]

ok

[fathom pendant]

i.e. some people might label their running server with their username

[quasi wave]

ok got it

[fathom pendant]

username's FTP server

[quasi wave]

ya I can see how that could be a problem

[fathom pendant]

then that lowers exponentially the time it takes to bruteforce

[quasi wave]

ya

[fathom pendant]

instead of an x by y list, it's a 1 by x list

[quasi wave]

no I totally get the example your giivng

[fathom pendant]

also something I always encourage for local stuff; check the user directory (/home/ or C:\Users\)

give yourself an idea of the other local accounts on the system to trim from username lists

[marsh echo]

MarcieLee i can mp you pls ?

[fathom pendant]

that way instead of using a 100 user list you narrow down to 5-10

no :)

[opal dagger]

help i need a little bone in the linux privesc module the kernel exploit exercise, i already use all the exploits that apear in searchsploit for that kernel version but no luck T.T

[mellow delta]

Hey Marcie, yesterday you said to pay attention to udp ports, but I am not seeing any open

[fathom pendant]

should be, on the hard lab, might need a less aggressive scan time though - UDP can be tricky

(i'm also assuming you're doing -sU to scan UDP)

[mellow delta]

nmap -sU -T4 -F <target>

[next bronze]

do you know what -F does?

[crystal steeple]

I don’t think i scanned for udp ports on lab hard of footprinting tho

Just do normal scan ig

[fathom pendant]

it helps

i don't believe the one port shows up on tcp

[mellow delta]

well, two minutes from the UDP scan finishing anyways

do you guys know about a note taking app called obsidian at all? I just started using it

[crystal steeple]

I prefer using notion

But a lot of ppl seems to love obsidian as their note taking app

[mellow delta]

I like the way it links and shows things in relationship

we will see as I keep using it

[crystal steeple]

I really don’t remember, i checked my note to see if i mentionned smth about that but doesn’t seem the case

[fringe urchin]

https://tenor.com/view/keemstar-im-fast-as-fuck-boi-keemstar-run-running-fast-gif-18083431

[next bronze]

problem with notion is that you don't own the data, and it gets slow if you have a lot of stuff

[fringe urchin]

Tcp shows like imaps and pop3s. So i had to scan udp to realize i need to go take a walk

[crystal steeple]

Yes i noticed notion getting slower after taking a lot of notes there , probably gonna switch to obsidian then

Its just i got too comfortable with notion now

[crystal steeple]

I see, so the udp scan was a must in that lab

[fringe urchin]

Yea. Not sure maybe you found about it via another scan?

[mellow delta]

I really like it so far

[crystal steeple]

Maybe

[mellow delta]

im walking but not getting anywhere

[fringe urchin]

You cant walk without a community

https://tenor.com/view/teletubbies-lala-po-poh-walking-gif-22092325

[mellow delta]

lol, i tried walking into the community but it wasn't ther

[fringe urchin]

You sure? I hope you didnt miss it like i did and though thats just a normal respond. Wasting an hour because i was legally blind

[mellow delta]

I am sure that's whats wrong lol. I should have my license revoked

[fringe urchin]

Did you try to get a walk? But you dont have a community string yet?

[mellow delta]

yes

[mellow delta]

not sure how to enumerate the string

[fringe urchin]

There is a tool. Reread the module

[mellow delta]

thanks

[quasi wave]

they tell you how in one of the sections but I had trouble finding it too at first. Look very carefully at each tool mentioned in module. Should be last three headers discussed in section

so three subsections one for each tool. then think carefully about what your doing

[mellow delta]

i found it, but I don't have the wordlist they are referring to

so I guess I will just use one of the ones i have

[quasi wave]

you can download wordlist

and you may already have it. its hard to find on your machine

but if you don't want to look you can download

[mellow delta]

can you assist? i know what it is, just not where or how to get it

[quasi wave]

just google the name of the wordlist and look for a github to download. I actually think its on the machine already but kind of you gotta know where to look

but if you can't find it just google to download

there's a github for it I am pretty srue

[fringe urchin]

Isnt it from the seclist worldlist?

Like seclist/snmp/snmp.txt?

[mellow delta]

/opt/useful/SecLists/Discovery/SNMP/snmp.txt

but it's not there on my kali

[shut quest]

/usr/share/seclists/Discovery/SNMP/snmp.txt

[fringe urchin]

Uszally in usr share

^

[quasi wave]

I think when I found it on Parrot in pwnbox it was in usr share

but if its your local machine just download it you will be fine

I had issues finding it too

[fringe urchin]

You can locate snmp.txt

[mellow delta]

working

[shut quest]

not sure if locate is installed by default on kali

[fringe urchin]

Thats true aswell. I dont rmemeber either

[next bronze]

pretty sure it is

[mellow delta]

got it

thank you

[past compass]

Yes

[shut quest]

TIL, so used to installing it

[past compass]

Alternatively:
find / -name "snmp.txt" -type f 2>/dev/null
I guess you could add -exec cp {} . ; as well

For easier usage.

Mobile discord doesn't like \ but it should be in the -exec as well.

[mellow delta]

so i have walked into the community but it doesn't tell me much about the HTB user. Not sure what I am looking for

[fringe urchin]

If you walked with the correct string there should have been a username and password

[mellow delta]

then i guess im in the wrong community ol

lol

[fringe urchin]

Im pretty sure there is only one community string

[past compass]

Not serious: the answer is always 42. You're looking for the question.

[mellow delta]

hmm. i need to get back up then

i am seeing a failed password change for a user, but not the HTB pass

[normal panther]

is it okay to find the answer using google?

[crystal steeple]

What answer

[heavy edge]

dude this pasword mutation section is terrible

[crystal steeple]

True

[heavy edge]

like im readiong here and on forums

[crystal steeple]

Not only that section , the whole module

[heavy edge]

the hints are all over "use force, dont use force, use these threads, "

[normal panther]

i was stuck in a module banging my head and after a google search of how to do it I tried the command and it worked and found flag so is it considered cheating or not?

[heavy edge]

" dont attack ssh but pleazse target ssh"

also please wait 30+ min for a password

[fringe urchin]

I cant wait to get to this module

[crystal steeple]

I mean its not you can just note it and keep going ,but i doubt you need to search for commands outside what really in the materials

[heavy edge]

im literally twiddling my thumbs waiting for a success

[mellow delta]

do i have the syntax right here? am i missing something? snmpwalk -v2c -c <community> <target>

[heavy edge]

yes

[normal panther]

yes exactly

[crystal steeple]

Lmao i read this one where i attacked ftp instead of ssh lmao

Since bruteforcing ftp is faster than ssh

[weak beacon]

Struggling with the VHosts enumeration with ffuf. I went to the first url in my browser and I can access the flag, but if I use curl it gives a 400 error for the same url.

I am confusion

[heavy edge]

thast what i found out. but it literally says attack SSH

[crystal steeple]

Yeah if you attacked ssh you gonna wait for eternity there

[heavy edge]

ftp is already taking forever

[crystal steeple]

Real

[heavy edge]

they need to just give a smaller list

gawd damn

[crystal steeple]

Did you add the vhosts to /etc/hosts file?

[heavy edge]

BREH

[weak beacon]

I did

[crystal steeple]

Did you specify port in curl?

[fringe urchin]

You do. Check the whole output

[weak beacon]

just tried that and got a 400

[mellow delta]

I read through the output several times now. It only seems to mention a failed user passwrod change

[crystal steeple]

Lemme try that im opening my computer in 10min and i will see if it really doesnt work

[heavy edge]

i hate this

[crystal steeple]

Lemme check the answer so i can give you a hint

[fringe urchin]

Can you paste the output in here?

[heavy edge]

the output isd halfway down

with the name t

[weak beacon]

└─$ curl -s http://10.129.66.163:80 -H "Host: http://inlanefreight.htb/"
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at localhost Port 80</address>
</body></html>

[heavy edge]

".sh

[past compass]

It takes about 1-2mins. The dictionary you use is bit arbitrary.

[fringe urchin]

Yea its there

[heavy edge]

what are you using for it to take 1-2 mins

[fringe urchin]

There is a name and password in there

[mellow delta]

I am dumb then. I don't see any mention of HTB

[heavy edge]

yeo i see it too

[heavy edge]

ive timed out on t 48 3 times

[past compass]

Don't remember but it's a mutation of the password list provided or fasttrack.txt

[fringe urchin]

The file is talking about a user tom that got changed. The HTB user is deeper into the lab

[past compass]

Then don't use t 48

[mellow delta]

ah, this is just a step on the way

[heavy edge]

im using the mutation lol its 94k pw's

[next bronze]

it needs to be the mutated list, but that looks like a connection problem, reset your vpn or switch server

you can remove the first 14k entries

[past compass]

There's a way to cut down on the number of lines. I honestly don't remember but the clues are in the module. The shitty thing about the module is the dictionary randomly changes without any indication or reason.

[next bronze]

that's not how you use curl, you're confusing it with the ffuf syntax, you should curl the vhost that you discovered directly as the url

[next bronze]

it doesn't? the mutated list is used throughout

[weak beacon]

ok I need a sanity check here because this is off the cheatsheet on the module

[crystal steeple]

That’s what i was about to say

[crystal steeple]

What module is that ? I got different cheatsheet lol

[weak beacon]

https://academy.hackthebox.com/module/144/section/1257

wth

[next bronze]

I mean your syntax is wrong regardless, there shouldn't be http in the header. and once you've added to the hosts file there's no need to do that anymore

[fringe urchin]

Special Treatment

[next bronze]

use it directly in the url or with curl or browser

[heavy edge]

sooooooooooooo Fasttrack does not work

[crystal steeple]

if i remember the password start with b

[past compass]

Do a mutation of the provided list.

[crystal steeple]

or it was for other question

[heavy edge]

ive done a mutation ive had it time out 3 times

[past compass]

I'm not home so can't check.

[next bronze]

that's a connection problem, nothing to do with the wordlist

[past compass]

Honestly, try using pwnbox.

If it's a match, then you know it's a connection problem.

Do the mutation.
Run the command.
Try without -t

If it's a connection problem going fast only makes it worse.

[mellow delta]

so now that I have this users creds, i can't ssh or telnet in because i don't have the public key. Not sure where I should focus now

[heavy edge]

enumeration friend

[crystal steeple]

check your connection

• the password starts with B, reduce your wordlist to let it containn only passwords that starts with B and run hydra again

should save you some time

[mellow delta]

am i looking for a dove?

I found the users ssh private key and was able to ssh in

[novel hinge]

can anyone help me get around this? trying to install odat.py

i tried apt install python3-cx_Oracle and still giving me an error

[heavy edge]

still cant find how to sort to letter b only reduced it down to 0-c on pwnbox which is 8255

[next bronze]

grep -E '^B'

[heavy edge]

oh

well thank you sir

[next bronze]

<@&861185840277487616>

piss off scammer

[heavy edge]

i already work on the corner for soemone else

shes pretty mean about it too

[mellow delta]

Just finished the footprinting labs. Thank you everyone who has helped me for the help and the patience with me. I feel like I have learned so much about how to think doing this and thanks to everyone here.

[heavy edge]

do them 3 more times blind in 1 week

[rustic sage]

scemmer

[tired rain]

I am Noob Here can you suggest me where I need to start in the hack the box

[upbeat island]

I’m stock in foot printing section “connect to the mssql instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server”

[heavy edge]

getting started

[tired rain]

Yes

[heavy edge]

no thats where u start

[rustic sage]

kinda just skipped over the whole getting started module lol

[tired rain]

But what I need to do ..

[rustic sage]

you need to get started!

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[upbeat island]

I’m stock in foot printing section “connect to the mssql instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server”

[tired rain]

Oky

I will try my best 😺

[rustic sage]

break a leg

and a pelvis

[heavy edge]

or your brain

[tired rain]

Hahahah

[rustic sage]

I think the command for that is mssql <ip>

[heavy edge]

mssql user@ip

[rustic sage]

does anyone really use mssql these days? I thought everyone ditched nosql and stuck with oracle/mysql/postgres

[heavy edge]

its somewhat in use for older systems

[upbeat island]

I run the command, the thing is to list the non-default database present on the server

[heavy edge]

i quit man

this is on pwnbox

[rustic sage]

mutate the list

[heavy edge]

its been mutated and dwinwdled down to only B passwords

FROM WHT I READ on forums. its one of these unless they changed it since december 2023

[rustic sage]

i know which one it is it's in there

[heavy edge]

so why isnt PWNBOX picking it up

[rustic sage]

ive seen people have this issue before both on their own machines and on pwnbox. idk why this happens the last guy this happened to quit htb

[cloud urchin]

if you look at your error, it says 5 targets did not resolve or could not be connected, which indicates it has nothing to do with your list but instead some kind of network problem. i'd double check your IP addresses and the command.

[heavy edge]

i see i see

[cloud urchin]

yep, and your command has the wrong ip.

[heavy edge]

the issue

im a dumbass

[cloud urchin]

anyone who said it didn't happen to them is lying

[heavy edge]

i think i was c/p-ing commands as frustration, but really wondering why it wouldnt work earlier on my vm. thanks for the help sorry for the annoyance and frustration

[rustic sage]

god you are in for quite an infuriating journey my friend.

may the lord of the whales be with you always.

[heavy edge]

if this was this annoying i can only imagine

[rustic sage]

its only level 3 of pain you haven't gotten to lvl 20 yet 😄

[heavy edge]

https://tenor.com/view/yoda-star-wars-lighting-much-to-learn-you-still-have-gif-16584148

[rustic sage]

I think I'm gonna stop using pwnbox and start using my kali vm

[mellow delta]

i hated the pwnbox and only use my kali vm

[rustic sage]

it's not that bad

I actually do love the convenience, it's just that I'm paying $18 a month for it.

i dont remember if on a free acc you can extend the time for targets

[mellow delta]

with your kali vm, it will always be set the way you want it with your tools where you want them and how you are used to your environment

[barren root]

Any ideas why the AD environment in Documentation & Reporting Practice lab seems to have f'ed up LDAP?
None of the tools that I usually use work there. Am I doing something wrong and not recognizing something about the enviroment or is it just not there?
I m leaning towards the other since AD Webservices aren't set up there either.

Also interestingly enough, the provided report says that ASMITH as AS-REProastable however the .zipped bloodhound output from the same report conflicts with that It doesn't, it's DHAWKINS that's roastable. Doesn't change the fact that either LDAP is not there or I'm too tired to notice my mistake

bro you might wanna change that name

Just server rules shrug

you do you. ||not minimodding just a friendly reminder||

<@&861185840277487616>

ngl kinda takes you outta the immersion. Shame the lab isn't... properly constructed (?)

[slender shoal]

Thanks

[barren root]

oh cavalry is here !

np

[wise tartan]

philosophical programming

'the greek tragedies are being played out on Github'

[next bronze]

is it a different subnet

[heavy edge]

got it done thanks for the help

[dim wolf]

for anyone who wants to install volatility 2.6.1 on their own parrot os vm but can't because trying to install python2.7 is a pain, try this: https://github.com/volatilityfoundation/volatility/issues/768

[barren root]

I ran it inside the domain

I also tried proxying impacket through a pivot

[barren root]

so no, it was the right subnet

heck, the "DC" even has DNS on it's 53

[next bronze]

and?

[barren root]

same result lol

[next bronze]

what's the error

[barren root]

connection error

I m using a dynamic SOCKS proxy with chisel

me - SOCKS -> pivot -> domain

[next bronze]

did you try resetting the lab

[barren root]

I don't wanna sound like a dick but I wouldn't be here if I wasn't absolutely sure something is wrong

yes I did

[next bronze]

if you did then it's probably not the labs problem

[cloud urchin]

you're getting a connection error, read the error and follow it

[next bronze]

no one else ran into it from what I've seen

[barren root]

Is it okay if I explain my "attack path" since it's documented in the mock half-finished report anyway?

[barren root]

Come on dude you seem like you just might be able to either help me or prove I'm right

[next bronze]

checking

works for me

[barren root]

hm, what user did you run this as*

[next bronze]

doesn't matter, any domain user can kerberoast

[barren root]

explains the local part since I was running Rubeus under NT / Service

I must have messed up the proxy

[cloud urchin]

i'm deobfuscating your picture and cracking your hashes right now

[barren root]

but cme works fine through it

[next bronze]

well yeah, that can't be used as a domain account

only SYSTEM/local admin can be used to get similar rights as a domain user

[buoyant void]

Can anyone give me a nudge on the web attacks skill assessment? I feel like I've gotten through the difficult part and elevated privileges, but now I've tried every XXE payload that the modules covered and nothing seems to be working

[normal panther]

anybody in IPS/IDS evasion hard lab?

[barren root]

the... DC... seems to be down in my lab... but other hosts are fine...
I solved the issue then... thanks Xre0uS

[rustic sage]

I need help with the skills assessment for the file upload attacks module I am stuck because I'm not sure how to get upload.php to come out as base64 when uploading. I've tried:
-altering the html
-inserting a fake jpg
-inserting a real jpg with a php filter
-uploading a jpg but in the request adding an XXE payload to read upload.php

if anyone has any hints i'd appreciate it

oap I just got it, looks like there was a typo on my payload

[normal panther]

EVASION NMAP HARD LAB:
can anybody point out what's wrong with this command?
nmap <TARGET_IP> -p- -sV -Pn -n --disable-arp-ping --source-port 53 -v

Getting banned before getting full port scan done
I have tried other evading techniques as well to no avail.

I already got the flag(which is of no use if I didn't get it myself) by searching around the web what's the higher port number was but I wanted to find that port number by myself as well that's the issue I'm not getting halfway through the whole full port scan thing.

[mellow vector]

Hello hackers i need some help

I need help
In my kali linx , home directory there is a folder which is empty and if i remove it, it appears again on every reboot at same position

[dreamy yew]

Module: Password Attacks, Section: Protected Files, Question: Use the cracked password of the user kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer. I have been trying to use hydra to crack the password of user Kira, either using rockyou.txt, password.list (given in resources) or mut_password.list. Am I off the intended path by a huge difference, or i just need to let hydra run longer?

[next bronze]

kira not Kira, lowercase k

[dreamy yew]

yep i used lowercase haha

[next bronze]

are you missing the password or the ssh key password?

[dreamy yew]

I am missing the password to Kira

[next bronze]

mutate loveyou and bruteforce with the list, I think it was mentioned in a hint of an earlier section

[dreamy yew]

Ohh ok, i think i recalled it in one of the hints

thanku

[dreamy yew]

Why does ssh2john.py not work haha. The error: Traceback (most recent call last):
File "/usr/share/john/ssh2john.py", line 193, in <module>
read_private_key(filename)
File "/usr/share/john/ssh2john.py", line 103, in read_private_key
data = base64.decodestring(data)
AttributeError: module 'base64' has no attribute 'decodestring'

[novel hinge]

what note tool is that!

[dreamy yew]

obsidian

[novel hinge]

ty! looks very clean compared to my cherrytree xd

[dreamy yew]

[shut quest]

Assuming you're running nmap as an unprivileged user? If you sudo your nmap you'll be able to do a TCP SYN scan vs only doing a TCP connect scan which is lighting your scan up.

[next bronze]

use python2/2.7

[dreamy yew]

I managed to run using python2.7, could i ask is it because base64.decodestring is deprecated for other versions of python?

[shut quest]

Yes since 3.9

[dreamy yew]

[novel hinge]

i just installed sqlplus, ran it successfully once but needed to close terminal. now im getting this error when trying to run it

any help?

[shut quest]

./sqlplus assuming it's in your current directory?

[novel hinge]

ahhhhhh brain fart its so late here, thanks man!

[normal panther]

no I was running it with root privileges also tried -sS by the way and IDS/IPS pick its up pretty quick.

[sick shale]

Hello everyone, I'm stuck at the "Attacking SQL Databases" module. I cracked the first question and got the password for the mssqlsvc user. But when i'm trying to connect to the database with this user i have this error : ERROR(WIN-02\SQLEXPRESS): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. I tried both authentication method (Mixed and Windows authentication mode) but I always have the same error. Did I missed something here?

[limpid holly]

It seems that no module involves Redis...

[rustic sage]

is anyone else not able to download the vpn file for each exercise?

[sick shale]

you just need to download the file one time, and use the same file to connect to vpn each time you need to

[rustic sage]

oh

nice ty

[patent oak]

Hey guys, I'm on part 2 of the active directory enum attack assessment. Question 9 at the minute. I have hash for the Admin account on MS01 and am trying to get an admin shell on it (I think)

The only idea I have now that I think of it is another shot with mimikatz

[dreamy solar]

Hey man how to transfert file on my windows serveur and my linux attack machine? I have a cookie.sqlite -> linux plz

[patent oak]

On which machine is the file now? To which machine would you like to send it?

[dreamy solar]

it is located on windows (cookies.sqli) and I have to send it to my linux machine (I have already tried scp it does not work port 22 is closed)

[patent oak]

Found a way forward 🎉

[patent oak]

Do you know about the thing where you right click a folder and go into properties and set up a shared folder over smb

I think

[cloud urchin]

smb server is going to be the easiest to xfer from windows to linux imo

[sick shale]

have you tried setting up a simple.server with python on your linux machine?

than you can upload your file using powershell

or you can setup a smb server as well with python "python3 smbserver.py -smb2support"

[dreamy solar]

I don' t have admin access and I don't have python3 ^^"

[sick shale]

you need to set it up on your host machine (I assue it's your linux machine?)

[analog dock]

If you have rdp you can use /drive:

And you can try sswws

[sick shale]

then on the windows machine you need to use powershell to upload it on your linux host

[next bronze]

you're at winPE, you should be very familiar with various file transfer methods by now, I suggest revisiting the file transfer module

[amber ore]

Need help with ADVANCED SQL INJECTIONS - Skills Assessment - Last flag, trying to do RCE. I'm currently at the moment when py script lunches CREATE FUNCTION command, but it doesn't work and I cant figure out the reason. I used SELECT lo_put instead of INSERT to upload shellcode to large objects as INSERT didn't work as well.
5 days no result. Has anyone managed to get the last flag? 🙂

[solar grove]

I'm stuck in the CL.TE section of the HTTP ATTACK module. I cannot run the CL.TE headers that it gives as an example and give an error.

@amber ore Dude, I can't help you, I'm behind, but can you help me?

[dreamy solar]

I find I must to use a other user

thanks

[acoustic owl]

What kind of error are you getting?

[amber ore]

Yes. On which flag are you?

[solar grove]

Try to use what you learned in this section to exploit request smuggling to force the admin user to reveal the flag.@amber ore

@acoustic owlI'm trying to create request inconsistency between reverse proxy and web server but I can't do it, both requests go smoothly

I cannot detect the presence of CL.TE.

[azure fog]

Did you set up a chunk size?

[acoustic owl]

@amber ore You need to create a ||PostgreSQL extension || and then upload it to the server using the script from the module

[solar grove]

@azure fog first request
POST / HTTP/1.1
Host: 94.237.54.170:42716
Content-Length: 13
Content-Type: chunked

0

HELLO
second request
GET / HTTP/1.1
Host: 94.237.54.170:42716

[marsh echo]

someone known how resolve this problem ? on the pwnbox the command line works but on my virtual machin doesn't work :/

[azure fog]

Probably you are just too late with those requests, if you are on the first CL.TE section, you don't have to create 2 tabs in burp, try to send your first request 2 times in a row

[solar grove]

@azure fogthe logic you said is correct I sent the request but I got 200 get in both requests

[azure fog]

I also used GET method

[amber ore]

This is exactly what I'm trying to achieve. But script doesn't work at the stage of 'CREATE FUNCTION'. I understand it because I put select pg_sleep(6) to freaze for 6 seconds each request and also see it in wireshark, CREATE FUNCTION - doesn't freeze. I feel like there are no writes for CREATE FUNCTION for user, I tryed to give writes but it doesn't work

[solar grove]

@azure fogDude, I tried get and post requests but no result

[naive wadi]

I just completed skills assessment one in attacking common applications, can I PM someone as my route to the flag seems strange, just wanted to see what other people did

[past jungle]

I am facing problem connecting VPN using OpenVPN in windows and as well as in kali

how do i troubleshoot

[azure fog]

Send me a DM

[naive wadi]

redownload and switch from tcp to udp or vice versa

also reduce complexity etc, are you running any other vpns on your host that would be interfering, e.g. vpn in vm & vpn on host

[sick shale]

^^

[past jungle]

No I am not running any other VPN

[naive wadi]

redownload and switch from tcp to udp or vice versa

[patent oak]

AD Enum & Attacks complete. 🥲

[acoustic owl]

Send me a DM

[marsh echo]

is this the hardest of the modules?

[crystal steeple]

now you can get back to your pace since the next few modules are far more easier

[crystal steeple]

not the hardest, but probably the longest and you gonna learn so much stuff, you need time and good notes to digest all informations

[patent oak]

I haven't done them all yet but it was a big step up for me. I can't say that I did it off my own back as I needed a lot of hints. But I feel like I started to map out AD somewhat now.

[marsh echo]

i see ... I'm going to shit I'm sure lol

[patent oak]

Thank God for that. I need a few chill modules now

[patent oak]

There's just so much new stuff. And then when you have to chain it together its easy to get lost. A good time to build a system and deffo take good notes

[crystal steeple]

i really had the same feeling when completed AD haha

[marsh echo]

when you say set up a system, do you mean install an ad with services on a virtual machine? and practice on it?

[granite thistle]

Hello

[patent oak]

I was only doing a bit each day so it seemed like it dragged on for weeks

[granite thistle]

Need hacker

DM

[patent oak]

I just mean that you can't just wade in and start throwing attacks at AD. You sorta have to form a process where you know what privs each user you capture has and what they can dump and stuff. It gets quite spaghetti like at times. You need to be organised. I use cherrytree so I can nest my notes and stay on top of things

[marsh echo]

i can't really use cherrytree i'd have to learn how to use it i use notion for my notes but thanks a lot for the advice I appreciate

[dreamy solar]

Hey man

[fathom pendant]

can you run powershell as admin

(ignore needing admin hash for a moment)

sometimes the provided user they give you for these exercises is an admin

[rustic sage]

hey

it seems that this setting up module is also linked to learning process module

[fathom pendant]

also: i would also advise trying to restore maybe with a directory your user can directly write to rather than at filesystem root

[fathom pendant]

maybe vaguely

but not directly

[rustic sage]

So should I read learning process module first?

[fathom pendant]

you don't have to

This module is really just a collection of references that may help you in the future

hence: setting up

[rustic sage]

But does it not have some relation with setting up

[fathom pendant]

dude

you're reading too much into it and thinking too hard about it

[rustic sage]

ok

[fathom pendant]

don't think too hard about what module relates to what

[rustic sage]

ok

[fathom pendant]

if they do, they do and it'll be fairly obvious

imo it's mostly a waste of time to ask whether or not two modules relate to each other at this base of a level

[rustic sage]

hmm

[fathom pendant]

when both of them are just info modules

[rustic sage]

understood

[fathom pendant]

you wasted time asking the questions rather than just reading through and doing both to make the connections yourself

[rustic sage]

I was reading btw

[fathom pendant]

• and doing both

[marsh echo]

I've found a solution for anyone working on a VM to upgrade to a lower version of openssl and ruby.

[fathom pendant]

going to a lower version is called downgrading

also having just reinstalled and upgraded my system: that isn't the full issue

[dreamy solar]

I think to find can you to send a captur in pv ?

[fathom pendant]

as i was able to get evil-winrm to install/work just fine

[fathom pendant]

no i haven't done this module myself

just offering some ideas

[marsh echo]

thank you I couldn't find the word in english

[dreamy solar]

no problem I have a Hash admin

[marsh echo]

seriously :0

[fathom pendant]

just remember up is generally higher version down is generally lower :)

[fathom pendant]

ye

[marsh echo]

thx 🙂

[fathom pendant]

i'd have to double check and spin up a module that has me use win-rm but i had to reinstall anyway because ruby/gems were being stupid overall

[marsh echo]

I struggled for 2 hours to find the package that pwnbox uses to put it on my VM and get it working.

[fathom pendant]

pwnbox is using a slightly outdated version of parrot anyway

but also it looks like you manually installed evil-winrm

so your situation is different

[marsh echo]

lol I reinstalled ruby and gem but nothing :/

[fathom pendant]

by manually installed i mean you downloaded the repository and installed it that way

[marsh echo]

but at least it works now lol

[fathom pendant]

there is the gem install evil-winrm

(though you might need to add sudo at the start)

that way whenever you update your ruby gems (gem update it will also update evil-winrm)

[dreamy solar]

I must to take only nthash?

because it is not okay

[fathom pendant]

that would be the correct hash; by this point in the modules you should be able to identify which parts of the hashes are necessary

[dreamy solar]

This is obviously a rhetorical question, I tested it doesn't work

[fathom pendant]

I'm saying is administrator the right user

[marsh echo]

I tried both ways firstly with gem install evil-winrm but I'll try to reinstall it with the recent versions, because in fact there was an encryption problem I think openssl takes polus in charge RPC4 that's why I can't reach john david and julio last night with evil-winrm

[fathom pendant]

i see 2 other accounts

lab_adm and lab_admin

[fathom pendant]

¯_(ツ)_/¯

[dreamy solar]

I tested too

[marsh echo]

just to see if you have time you can look on this section if you can reach john here is the command:

[fathom pendant]

remove the hash as it's something you have to dig for

[marsh echo]

https://academy.hackthebox.com/module/147/section/1638

[sage whale]

hi im new here can someone recommend module for me to learn?

[fathom pendant]

as that question is optional, i never performed this attack

[marsh echo]

sry I made a mistake

[crystal steeple]

depends if you are a complete beginner or you already have some experience in the field

[crystal steeple]

you from france?

[sage whale]

in programming i have basic but in cyber im new and what is the most cost effective way

[marsh echo]

no but I mean in general with other users you manage to connect with?

[dreamy solar]

I tested too but it is not okay

[marsh echo]

yesss lol my english is is too bad I'm using a little help from google translation

[fathom pendant]

i assume you managed to get it to work with the other users in this excersize?

in which case the issue wasn't win-rm rather - the hash you were using

[marsh echo]

yess I succeeded, I just wanted to understand why with the new version of openssl and ruyby it works for you and not for me.

[crystal steeple]

a lot recommend the information security foundations module to most ppl who are new to the field as it covers what's you should know to get started

[marsh echo]

aaahhhhh

[crystal steeple]

you can try after that to enroll in CPTS path imo

[crystal steeple]

can i dm?

[fathom pendant]

but i could be wrong on your issue

[marsh echo]

yes 🙂

[marsh echo]

no I tested all the hashes with winrm and it focused what I couldn't do with the new version openssl and ruby but it works with what I've been able to modify

[sage whale]

i just check it cost 180 i only have 60 cube

[crystal steeple]

you can get HTB academy for 8.4eur/monthif you are a student and you get access to all beginner/intermediate modules

[analog dock]

Tier 0 modules are free

[midnight crow]

Anyone else have trouble with the SOC Analyst Elastic path?

I can't seem to get onto any of the boxes to display the webapp, always times out in my browser

[sage whale]

Cost 10 but can earn 10 cube

[analog dock]

So free..

[sage whale]

Really? Where can i acces it

[sage whale]

[hollow quarry]

Hi do I need to use inetsim in malware analysis to answet this question?
Examine the communication patterns of the malware and provide the domain it interacts with as your answer. Answer format: .._

[fathom pendant]

you need to change the email on your academy account to a student email, and you should be able to access it via the billing page

[hollow quarry]

It turned out i didn't need the inetsim

[alpine umbra]

hi

[night crypt]

hello everyone, does anybody know if one of the US regions is on the west coast & if so which one is it?

[sage whale]

Does student account free or need paymen?

[fathom pendant]

A student email is provided to you by your educational institution i.e [firstinital][lastname][numbers]@[schoolname].edu

so [e-mail] would be an example

the school has to be recognized by HTB (if it's not, you have to submit a support ticket for them to look into and verify the school)

[sage whale]

I do have student account but some website only offer discount for learning and not free + special privilage

[fathom pendant]

as the person stated earlier: it's a discounted subscription

$8/month for acess to all modules up through and including tier 2

[mint lodge]

https://academy.hackthebox.com/module/160/section/1500
i cant get this Arbitrary file upload to work on web service & api attacks
I'm 100% sure I'm doing everything right and im getting no output

Is this just broken or what?

[fathom pendant]

so i'd say that's a pretty good deal considering it's (almost) equivalent annual sub is several hundred dollars

[lofty cobalt]

is there any appropriate channel to ask for som hints on hackthebox academy sock path? been stuck on a module for days xD

[fathom pendant]

this channel is appropriate to ask for help with #modules irregardless of path

each path is a collection of modules

so just ask your question and someone may help

[lofty cobalt]

https://academy.hackthebox.com/module/214/section/2285
question 2:
Stuxbot uploaded and executed mimikatz. Provide the process arguments (what is after .\mimikatz.exe, ...) as your answer.
https://academy.hackthebox.com/module/214/section/2287
In the skills assesment there are also 2 questions i have not figured out.
Hunt 2: Create a KQL query to hunt for "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder". Enter the content of the registry.value field in the document that is related to the first registry-based persistence action as your answer.
here the hint said to use event code 13. i filtered it down and thought i had the correct one. when i didnt find it i tried every registry.value that is under event.code 13 and still no luck

[potent ermine]

For Hunt 2, notice it wants registry.value and not registry.key. I got this wrong because I was inputting the key. Another hint is find the event with the key in the boot/startup *\CurrentVersion\Run\* and once you find the correct record, look at the registry.value

[lofty cobalt]

thanks, that was actually pretty helpful!

found the other one aswell, tried the same answer multiple times, not sure why it worked today!

[fathom pendant]

Sometimes copy/pasting can lead to weird extra spaces/whitespace characters

[spark walrus]

hello everyone may i ask what apps did you used in taking notes? 🙂

[soft cedar]

Obsidian

[spark walrus]

how about the others? 🙂

[soft cedar]

This is what I use; others use cherry tree, notion, one note and whatnot.

It’s all about personal preference.

[patent oak]

50% done of CPTS path. All downhill from here...right?!

[patent oak]

I dig cherry tree. Cause it just clicks with me. Super easy. Other peoples notes look pretty though in Obsidian

[soft cedar]

Not really there are still some pretty stacked modules like Windows privesc and Attacking common applications.

[solar grove]

I got stuck in the TE.TE section in the HTTP ATTACKS module, I used all the techniques he mentioned but I got no results. Where do you think I am making a mistake sample code
GET / HTTP/1.1
Host: 94.237.54.170:48475
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,ru;q=0.8
Connection: close
Content-Length: 10
Transfer-Encoding: chunked

0

HELLO

I keep sending the request for 15 to 20 seconds but I don't get any 405 error. If I find the right payload I will do the same as before and get the flag.

[soft cedar]

But you should breeze through the web modules

[patent oak]

[patent oak]

Yeah the web stuff seems easy. I'm a full stack dev so I guess that helps with the Dom and stuff

[soft cedar]

GGs then.

[astral inlet]

this was pure fun

[fringe urchin]

Notepad

[astral inlet]

sublim3

and obsidian and joplin 😉

[fringe urchin]

Im cureently with cherry but gonna switch to obsidian in couple of days

[patent oak]

Is Obsidian worth the change then? I just stuck with cherry tree cause it was so obvious how to work out of the box

[next bronze]

I use obsidan and it's very good but, if you find no reason to change then there's no need to

[fathom pendant]

^

Use whatever is most comfortable for you

[fringe urchin]

Im switchinz over because of the astetic aswell. Like i want to have good looking notes and maybe more things explained with text and colors

But yea ppl use what they most comfortable

[fathom pendant]

Obsidian has tons of plugins to make things look nice

and even themes

you can even make your own custom theme with CSS

[fringe urchin]

Yea. Cherry is great and all but its plain

[soft cedar]

It’s not bad at all.

A lot of people still use it; to pass cpts, oscp and others.

[fringe urchin]

Yep. I mean im using cheery tree still but slowly gonna try to move to another.

[soft cedar]

That’s completely fine, especially if aesthetic is what you want.

[dusty plover]

crafty is very annoying, is there any way of doing it without minecraft?

[drifting urchin]

I have an AD question. How can I figure out a password, when I already have the domain name, and the username to access it?

[dusty plover]

theres a ton of ways you can do it, that isnt very specific

[drifting urchin]

well all I have is the IP, the username and the domain, but in order for me to continue with this step I can't figure out how to crack it, I don't have any hint how to do it.

[next bronze]

yes, but also spoilers and ask in #boxes

[next bronze]

that is very vauge, is it a module? give the module name and section pls

[solar grove]

Stuck in the HTTP ATACKS module (TE.TE)
Can anybody help me?

[fathom pendant]

considering the whole attack type: yes

as the box author had told someone "Just do more research"

[rustic sage]

Detecting attacker behavior with spunk based on TTP. Question is asking find through SPL searches against all the data of the password utilized during the activity. Enter it as your answer. I don’t understand the answer format and what needs to be provided.

Is it just asking what the password is?

[fathom pendant]

seems like it

though likely it's asking you to perform detection based on the information provided to you so far/section

[rustic sage]

The answers are sensitive just wanted to clarify. This question is written very awkwardly.

[fathom pendant]

some tend to be that way, some of the authors aren't native english speakers so some translations get mixed up

or wording is more EU centric than US

[rustic sage]

Is it that obvious I’m a yank lol

I’m a yank from the “ayyyy im walkin here !“ region

[fathom pendant]

nah, i'm from the US as well

I'm also just used to UK/EU grammar/wording so it doesn't throw me off as much

[rustic sage]

Centre

[fathom pendant]

You just get used to it

[granite thistle]

Hello

Need hacker for iPhone

[rustic sage]

Figured it out

[dreamy yew]

Module: Password Attacks, Section: Password Attacks Lab - Medium, I am struggling to find the local mysql after logging in as J (for ssh). I have tried to find all database files, but none of them has info on how to get D creds, might need a nudge here

[granite thistle]

DM

[fathom pendant]

looking around the db afaik was how i moved forward; my notes explicitly state "Navigated SQL to find creds for user d*"

[rustic sage]

For those that are having trouble with “open the search and reporting application and find through the SPL search as against all the data the password utilize during the PSEXEC activity”. Translation: find that password used in splunk, they have it in there, so do a search and figure it out .

[dreamy yew]

yes i am trying to find the mysql database files that contains the creds, but to no avail

this was the command i used: @skills-medium:/$ for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc|lib|headers|share|man";done

[rustic sage]

Used my north easterner explanation hopefully someone will understand me lmao

[fathom pendant]

that's gonna be incorrect

"navigate" being the keyword here; maybe a look at history will show you how to log in

but you really gotta just log in and look around

[dreamy yew]

hmmm i took a look at bash history for J and deny permission for bash history for D

[fathom pendant]

well according to documentation; there should be a server running

think how you would authenticate to a server

it's likely right in front of you and you're looking over it as something simple

[dreamy yew]

yes, i was trying to figure if i needed to add the target ip to etc/hosts because the documentation contains a URL to the mysql

[fathom pendant]

it's running locally; not exposed to the outside

you need to access it via the user you have

[dreamy yew]

thanks for this good nudge, successfully accessed the mysql

[fathom pendant]

👍 the rest should be mostly straightforward: just always keep one of the basic questions in mind: "why?"

[dreamy yew]

okie thanks for the heads up!

[fathom pendant]

np

it definitely made me think about it for a bit

[fathom pendant]

until it clicked "wait.. why is.."

[minor stag]

This makes absolutely no sense to me. 840 isn't even listed on the chart, neither is 113556. I don't understand where these numbers are coming from.

The explanations aren't really helping either.

[dim wolf]

they are decimal values. once you convert them to hex, it should make sense

[minor stag]

I answered the question that referenced this technique, but I have a feeling that this is gonna take some work to fully use

[next bronze]

the number can be added together to represent multiple flags
https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties

[dim wolf]

oop i read your question wrong

sorry

[minor stag]

I sort of figured that out, but if I want, say, "Normal User Account" at 128, how do I specifically choose one that has "Account is disabled"?

[dim wolf]

128 + 2

[minor stag]

So it's just adding? I line it up with the attribute I'm filtering and then add the values to it?

[dim wolf]

yea so if you want to represent a normal user account who is disabled, you write 128 + 2 = 130

[minor stag]

Okay, that simplifies it quite a bit

[dreamy yew]

i have managed to gain root access, but i'm curious why id_rsa for user D was the key to access to user R, is it based on the fact of password reuse?

[minor stag]

I was trying to work out all the numbers in the command "userAccountControl: 1.4.8 etc." when it's just the "=130" at the end that matters

[next bronze]

https://www.techjutsu.ca/uac-decoder

or you can write your own script to parse it

[fathom pendant]

Perhaps D* is an admin

[marsh echo]

someone can explain for what doesn't , i mutated it and i try with passwords mutated find but nothing I do not understand why freerdp not workingfind but nothing

[fathom pendant]

Single quotes around the password

$$ is a variable call to the PID of your current shell

[marsh echo]

you're my fucking hero thank you very much

😂

[fathom pendant]

Single quotes tells bash to interpret it as a literal string, instead of a combined string

[marsh echo]

I didn't think $$ would be a problem, but now I understand better.

thank 🙂

[fathom pendant]

Whenever you see a special character, just wrap it in single quotes

I.e. !! runs the last thing in your bash history

![n] runs the nth number in history, and ![-n] runs the nth number from the bottom of history

[upbeat oak]

hey I'm trying to use wget -m –no-passive ftp://ceil:qwer1234@[Target IP]:2121 it says I downloaded files but I see nothing in the created directory

[fathom pendant]

Why not just manually connect with ftp

ftp ip port

[upbeat oak]

Yeah ls is pulling up nothing

[fathom pendant]

Tfw he doesn't la

You forgot about hidden files

[upbeat oak]

wait hold up both of those acronyms are foreign to me

[fathom pendant]

Tfw = that face when
la are flags with ls

That will show all files and list them

[upbeat oak]

tf lol that wasn't in my notes hold up

[fathom pendant]

-l and -a are separate flags

But can be conveniently combined

[upbeat oak]

Ok a little confused still but i'll google that

[limpid hemlock]

Hey anyone knw in the attacking common service module attacking ftp section how to connect to the ftp of the target I try to connect to ftp using ftp ip -p 2121 but it isn't connecting

[fathom pendant]

man ls

[fathom pendant]

Don't use -p

Ftp you just specify the port after the ip

[limpid hemlock]

Ohk

[upbeat oak]

ok i'm tracking now

[fathom pendant]

https://tenor.com/view/tracking-marine-understand-you-got-gif-22519541

[upbeat oak]

devil

[fathom pendant]

You had it but didn't know huh

All because they hide

[upbeat oak]

sure got me

[fathom pendant]

https://tenor.com/view/theyre-just-hiding-hiding-hide-smoke-when-im-gone-lani-rose-gif-15069850

[crystal steeple]

i have a question , when doing union in sql , its does have to be same columns yes, or we can find our ways around it, but should the elements we union have the same data type?

[fathom pendant]

Generally, yes

[crystal steeple]

since in the union section , both departments and employees has same columns but union select * doesnt work until i union only who have the same data type

[crystal steeple]

thanks !

[fathom pendant]

There's ways around like adding a blank column iirc

Been a minute

[crystal steeple]

but they already have the same columns

[mystic light]

really pay attention to how sql unions and joins work.
a union is a horizonal addition, adding more columns.
a join is a vertical addition, adding more rows.
so unioning 2 sets gives you more columns to work with.

BUT to reveal specific columns on your target, generally the types must match because php (or whatever) is trying to extract specific data types out of the db, and convert those to a displayable format.
some data types have whats called implicit conversion, which does the dirty work for you. language and db dependant.

after you have your mass of column names, its up to you to pick which ones to display, with the right types, and the right NUMBER of columns to fill up whatever data structure is on the backend of the php command.

[minor stag]

This AD module is never going to end

[fathom pendant]

Mood

I've delayed it for so long

[past jungle]

Facing this problem when connecting to VPN

it stops here

can someone help ?

[crystal steeple]

got it ! i understand now why the union select * didnt work

thanks man

[upbeat island]

I’m still lost in this question “Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.” I made everything and list the databases, but HTB does not accept any answer

[upbeat oak]

you listed the databases?

[upbeat island]

Yes

[mystic light]

what module is is

[upbeat oak]

footprinting

[upbeat island]

Footprint

[upbeat island]

Yes

[upbeat oak]

I just finished that section of footprinting if you listed the databases the answer is there just try all of them

or the one that isn't a normal database kind of like the example in the notes

[upbeat island]

I try all of them, but hack the box does not accept the answer or maybe I’m doing something wrong

[upbeat oak]

did you use this select name from sys.databases? @upbeat island

[fringe urchin]

Can you show commands?

Htb is in the databse, there are like 5 different databses there, 4 of em are default, and one is the needed one

[upbeat island]

enum_db

[fringe urchin]

Ok brb let me go get my notes

Is that medium lab?

[upbeat oak]

no it's mssql

[fringe urchin]

Ah

[upbeat island]

Is just a module mssql

[mystic light]

get a shell with mssqlclient.py
then simply|| select name from sys.databases;||

[fringe urchin]

Thats not the name of the correct databases?! I donz even see it of being one of the other ones

[upbeat oak]

That's what I said

There's so much stuff open on my enum for the footprinting medium lab I honestly don't know where to begin

[fringe urchin]

You need a hint?

[upbeat oak]

lol yeah I'm guessing smb since that's relevant to what we just went over but i'm un sure where that will tie in next

[rugged valley]

Hey, I hope this is the right channel for this, but I'm having trouble with the Password Attacks Module (Network Services portion: https://academy.hackthebox.com/module/147/section/1327) and was hoping I could get some guidance.

I'm trying to brute force the winrm username/password using the username.list and password.list files but I keep getting no results.

I've tried multiple times with both crackmapexec and netexec but nothing crops up. Is there another tool I could try? Or a different work list other than the ones provided.

[fringe urchin]

I think smb is needed a bit later. But the stuff can be accessed via other stuff later so you dont even need to touch anything in smb

[upbeat oak]

well shit lol

[fringe urchin]

There is another service running that should peek your interest

⛰️ (-ain)

[upbeat oak]

Would it be in my notes?

If I guess had good notes lol

[fringe urchin]

Yes 100% everything is taken from the modules!

[fringe urchin]

. Maybe a hint

[upbeat oak]

oh I get the hint now lol I'm slow

[fringe urchin]

[upbeat oak]

which section was that

[fringe urchin]

NFS

[upbeat oak]

lol

[fringe urchin]

Wait not nsf

Lol NFS

[upbeat oak]

Okay bet

[fringe urchin]

[fathom pendant]

it's connected

[fathom pendant]

use the mutated list

oh wait nvm

not at that part yet

some of the tools might require you to specify -local-auth or -windows-auth (i forget for nxc/cme)

[green smelt]

could anyone help me on this :
so zone.identifier might not change but i dunno where is file located for analysis

module Intro to digital forensic - Rapid Triage Examination & Analysis Tools

[tranquil axle]

you dont get access to the file itself, but you have access to the USN Journal file that you can parse and then investigate with timelineexlorer

its usually called J$

[dim wolf]

$J

[green smelt]

oh so like parse it to .csv

[tranquil axle]

yep

[green smelt]

and then investigate with timelineexploerer

[rugged valley]

I'll look into this. Thank you!

[green smelt]

wait but i am confuess

the machine had given file is MFT-backup.csv right

so could use that

[tranquil axle]

the question asks about usn journal, so I'd go for that tbh. Could be that this information is also in the mft.csv, but doesnt sound like the intended path

[upbeat oak]

how do you get around the permission for viewing the nfs share in the medium lab footprinting?

[limpid hemlock]

How to get access to ftp in attacking common services attacking ftp section I'm clueless here

[raven lagoon]

Anyone with Command Injection Skills Assessment? Not able to find the vector

[fringe urchin]

In the nfs module its explained somewhere, make sure to read it! Its like that: if you have the user name or uids or guids you can create them on system and you can read. Example if the files can be accessed woth root, then just sudo it

[mint lodge]

https://academy.hackthebox.com/module/160/section/1500
Can i get some help on this module I'm doing everything according to the module and I'm getting no out put from the python script for some reason

I followed it step by step i feel like something is broken

[upbeat oak]

so it's normal I can't cd to the directory?

[fringe urchin]

cd is a shell builtin. sudo only works with executables.
You could type sudo su and then cd or just sudo ls ./TechSupp

[upbeat oak]

tracking now

[crystal steeple]

run as sudo

[mint lodge]

https://academy.hackthebox.com/module/160/section/1500
im doing everything right on this module and when I'm trying to get output from the py script this is the result:

nothing

I DONT GET IT

[minor stag]

I'm working through the ACL Abuse exercise in the AD module. I'm following along with the exercise and none of the commands they're running work for me. I can't answer the question because of the last one not working, specifically.

[dim wolf]

have you checked your creds

[minor stag]

I followed the module exactly so I'm not even sure what to change. I'm guessing I should switch the default for my login creds for the RDP

Oh, I see. I was supposed to use credentials from like 8 modules previously

[next bronze]

make a habit to keep a list of the creds you have

[minor stag]

It's still not working unfortunately

[fathom pendant]

then somewhere along the line you fucked up

[minor stag]

Most likely

[fathom pendant]

I don't recall having any issues running through this when I ran it; just set the environment variables as expected

following the examples

[minor stag]

I've authenticated as the wley user but when I try to change damundsen's password it tells me the "user name or password is incorrect"

[mint lodge]

anyone that did cbbh help me out porfavor

[fathom pendant]

is that the right password or creds though

does wley have those perms that you need

[minor stag]

The exercise says he does, so I'd assume so

[mint lodge]

I think this module is actually bugged at list on the pwnbox

I cant get it to work

[fathom pendant]

all modules have been tested to work with the pwnbox

[mint lodge]

Well I'm 100% sure I'm doing everything right and i already encountered stuff that dont work well on the pwnbox and i had to use my own VM so...
I just cant do it on this one because i dont have open vpn on it

This part of the module is just copy and paste its not even hard but not working

[fathom pendant]

wdym "don't have openvpn" on it

[fringe urchin]

Isnt it preinstalled?

[fathom pendant]

you can install openvpn with a few clicks or is preinstalled with many distros

[mint lodge]

Nope

[mint lodge]

Will do i guess

[upbeat oak]

Need another hint, if I was able to find smtp credentials but on my nmap scan I don't see port 25 open can I even do anything with that?

or I suppose the credentials might be able to be used for other protocols

[fathom pendant]

smtp is often used with other protocols

also if you're able to find smtp creds: smtp is running

[mint lodge]

Not working even on my VM

:/

[old vector]

I’m on openvas scanning in vulnerability module. I use https://target:8080 get brought to greenbone login page. Use username htb-student pass HTB_@cademy_student! And it says login failed invalid username or password. Why is this I am copy pasting so I know it’s right

It says to use these credentials on getting started with openvas page

Anyone

[shut quest]

Restart the instance? You double check the script? IPS are correct? Ports are correct? No weird white space anywhere?

[buoyant void]

Alright I'm at the end of my rope with the web attacks skill assessment, I've tried every single XXE payload that was taught in the entire module and nothing works. I'm able to verify the XXE vulnerability is there if I just put in a random entity with some text, but can't get it to do anything else that I need to get the flag. Can anyone point me in the right direction

[mint lodge]

Tried to restart and everyting is right 100%

The output is just blank

[shut quest]

And how do you know everything is 100% correct?

[mint lodge]

Look at the module its basicly copy and paste

[latent sigil]

can someone explain me more in depth why we need to create a fake SPN for a targeted kerberoasting attack

[shut quest]

Then if it's 100% you should be able to send a ping back to yourself and capture it through tcpdump

[next bronze]

to request a service ticket, the accoutn must have an SPN set

[mint lodge]

With wireshark?

[latent sigil]

so in the case of ttimons, he didnt have one?

Attacking Enterprise Networks Active Directory Compromise

[next bronze]

if you have to set a spn, probably not

standard accounts usually will not have a spn, only service accounts do

[latent sigil]

ok

thank you

[shut quest]

What entity did you try?

[spark thunder]

Please guys I'm stuck on the introduction question and answer

[mint lodge]

well i created backdoor.php with vim instead of with echo > backdoor.php and it worked now

2 hours of my time gone💀 🤣

[spark thunder]

Can you help me out on the first introduction question

[faint rampart]

elaborate.

[raven lagoon]

try harder

bakal have you done command injection skill assessment?

[shut quest]

So your script wasn't 100% correct?

[buoyant void]

I've tried using SYSTEM to to either base64 encode the flag and retrieve it, and used SYSTEM to try to read the file. I can read /etc/passwd just fine but if I try to get the flag I'm just having no luck I have no clue what I'm doing wrong

[mint lodge]

I'm dead

[shut quest]

You're close, did you try b64 /flag.php?

[buoyant void]

I tried every variation I could think of including that, and I just realized why nothing was working, I wasn't closing the statement with a >, I can't believe I spent hours getting frustrated over a freaking typo smh

Yup I got the flag now lol

Appreciate the assistance it at least made me look at the code closer and figure out what the issue was

[spark thunder]

What is the name of the first section of this module? If you are using a translation solution while studying, please disable it temporarily to enter the first section's name in English.

[autumn pilot]

Look at the page and paste the name of the first section in the module

[fathom pendant]

tfw i almost get stuck ad AD enum skill assessment 1 then realize other tools exist

[next bronze]

[shut quest]

Have you not done it yet?

[spark thunder]

I'm still stuck 🥹🥹🥹🥹

[fathom pendant]

nope

[faint rampart]

Try Harder.

[shut quest]

On the right side of the page there will be a table of contents listing each section

[fathom pendant]

first figure out what a Section is; and they conveniently tell you what it is

[fathom pendant]

QQ regarding the assessment: I should be able to import the AD module yes? (via the import-module cmdlet?)

before I start runnin around figuring shit out

[shut quest]

No

[spark thunder]

Have input interactive section but still saying incorrect

[fathom pendant]

got it so gotta fuck around with tools

TY

[shut quest]

Is that the first section?

[buoyant void]

That was the most annoying part of the assessment, I spent so long trying to figure out how to import the AD module

[fathom pendant]

you'd think it'd be included

[faint rampart]

case sensitivity

[fathom pendant]

so that literally knocks powerview off the table, since it uses AD modules

[buoyant void]

That was my assumption as well

[shut quest]

You'd think but you'd be wrong since they aren't installed

[buoyant void]

It really made me appreciate how useful Powerview is lol

[fathom pendant]

thank you though for the answer so I'm not thinking the lab is busted

it's just my lack of skill that's the issue LMAO re-reading how to do a certain thing [not saying because it's an answer to a question, and I kinda just guessed bc it made sense]

[shut quest]

Use your tools they have been training you with

[fathom pendant]

ye

I just wanted to be a lazy fuck LMAO

(i also mostly only used powerview, which imo - was my fault)

[shut quest]

I mean I tried too lol

[fathom pendant]

tries to use powerview
sees it uses an AD cmdlet
cry

[next bronze]

just don't use powerview having to get a local shell is cringe

[buoyant void]

Even after I figured out I couldn't use powerview I kept trying to import the module out of sheer frustration lol

[fathom pendant]

surely this time it works

[fathom pendant]

oh i already have a pivot going and doing it that way

[next bronze]

this is the way

[fathom pendant]

ligolo my beloved

[shut quest]

I need to redo the ad enum module, used so many tools and looking back at my notes I would do it so differently.

[astral inlet]

which module / assessment ?

[fathom pendant]

AD enum Assessment 1

[astral inlet]

ah ok

[fathom pendant]

lmao it also doesn't help some of these sections i did like several DAYS apart from each other

[faint rampart]

you couldnt use powerview in the AD Assessment??

[fathom pendant]

nope: because the AD module itself doesn't exist so it can't be loaded

idk if this was an oversight or on purpose: but other tools work

[buoyant void]

I'm guessing it was intentional

[shut quest]

Some powerview commands you can use

[fathom pendant]

not the ones that i was using to get the first few answers or at the very least enumerate with

[faint rampart]

I dont believe it works like that cause I used it

[fathom pendant]

i likely then missed something or my powerview is messed up

both are plausible

[shut quest]

That screen shot is the same as mine

[faint rampart]

depends on how you get a shell sometimes
ive seen some really weird ass stuff on some windows shell

[fathom pendant]

brother i'm in a full on RDP session on MS01

[next bronze]

you can import with

Install-WindowsFeature RSAT-AD-PowerShell

I have been saying for a while how you import the ad module depends on the os

[faint rampart]

Including the wallpaper 💀 ??

[faint rampart]

thank you for this gem

[shut quest]

Wtf?

[next bronze]

#modules message

[cloud urchin]

oh shit you guys go through the modules before doing the challenges?

[shut quest]

Thanks now I really need to go back through that module.

[fathom pendant]

-_- this user should have the D* rights... but yet mimikatz is yelling at me

i swear to fuck

[drifting urchin]

I have a question in AD:Enumeration: Let's say you did LLMNR poisoning, and cracked an NTLM hash. However when you try to the SMB relay with ntlmrelayx, it fails with the found user for which I cracked the hash and got the password. How can I find the SAM hashes, tried to run secretsdump, crackmapexec, but to no avail..

[raven lagoon]

skill issues

[fathom pendant]

truly

[buoyant void]

well this would have been useful to know a month ago

[next bronze]

this makes no sense, if you can crack the hash, why do you need to relay? and whether you can dump the reg hives depends on the priviledges of the user, the user must be a local/domain admin

[fathom pendant]

figured it out. just did runas with the user and mimikatz directly

idk if that was the full fix but it surely just worked ™️ for me

[mint lodge]

Is there a tool that looks at the wsdl file and can convert it to http request ready for burp suite?

[drifting urchin]

well I need to find a way to dump out the SAM hashes of other users, and I only have this user to work with, thats the issue

[next bronze]

then you need to find another user who has the rights

[hollow lake]

WSDL Wizard

it's a Burp suite extension

[mint lodge]

Thanks

[hollow lake]

you are welcome

[upbeat oak]

hey doing the medium lab and the credentials I'm using for the password for smbclient and enum4linux are not working and I don't think I'm spelling it wrong

I'm getting a bash !mD event not found ?

[fringe urchin]

What does that "username" stand for?

[fringe urchin]

Do single ' instead of "

[upbeat oak]

I'm not using quotations at all at least thats not what the help page for smbclient says

ahh nvm got my question via google

[fringe urchin]

Smb try escaping it via backslash?

[upbeat oak]

thats what google said

[fringe urchin]

Im pretty sure tho that you dont need to login to smb anymore if you found the creds from Important

Tell me what you tried? You were rdp into alex machine?

[upbeat oak]

so far got alex username and password for smtp and used enum4linux to get more information

[buoyant void]

After a frustrating end to the web attacks module here I was hoping the next module is a chill one and I see 3 skill assessments

[fringe urchin]

Oh the !mb is alex password? Yea then there is a file somewhere, you can find it via smb with alex apperently or just enumerating the computer from alex

[fathom pendant]

correct

[upbeat oak]

okay will try that

[upbeat oak]

what do you mean by enumerating the computer specifically or is that already to big of a hint?

[fringe urchin]

Well since you have creds for alex you can rdp in right!
Then its just clicking on files and folders rill you find something Important

[upbeat oak]

makes since makes since

[soft shard]

Hey, is there any way to reset a modules progress

[next bronze]

nope

[upbeat oak]

I swear there's so many things I have to keep downloading into my parrot machine vs my kali

[opal storm]

for those who have finished the yara/sigma module, did you have trouble getting into the lab machine for the splunk part? there are no credentials to RDP into the host with

[upbeat oak]

of course now I can't connect to xfreerdp lol

[spiral crypt]

I'm trying to test ms17_010_eternalblue on the Blue machine, but it fails. I've set the LHOST to my tun0, but it still fails. Not entirely sure if I'm doing something wrong here, or what's happening. Any tips to check?

[cloud urchin]

sometimes you have to use another exploit (i didn't do that module though)

[next bronze]

that's a box

ask in #boxes

[fathom pendant]

POG i found the fix to OPENSSL digest error

[spiral crypt]

Ah, sorry about that. Thanks @next bronze

[fathom pendant]

https://github.com/NixOS/nixpkgs/issues/255276#issuecomment-1865838291 i edited my /etc/ssl/openssl.conf to uncomment out/add these lines

[upbeat oak]

When you use Remmina do you need to put the server or can you just log in with credentials?

I don't know why the server part is confusing me

[fathom pendant]

and I got through that with minimal hints to get it goin

[upbeat oak]

oof

[fathom pendant]

i've used remmina a bit and for the server you do need to include the IP as the server

that's what it means by "server"

it means the server hosting the rdp login service

[upbeat oak]

wow I'm all sorts of stupid today

[upbeat oak]

ty

[fathom pendant]

can't rdp to a device without knowing where it is

[novel hinge]

anyone familar w/ hashcat?

[faint rampart]

I need cubes I lost 9 streaks

[faint rampart]

I believe we all are, ask your question

[next bronze]

I've been cheesing it for a couple of weeks now

[novel hinge]

found this hash using msf, how do i incorporate hashcat to get the password? i tried this hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u which was given in the module. but idk how that relates to that hash. do i need to vi edit ipmi.txt and add that hash?

[faint rampart]

Im gonna cheese it out too, cheese for me == submit 2 flags to a tier3 module every week for 18 weeks, see how that works

[next bronze]

yep I've been doing that

[fathom pendant]

that's the incorrect method to crack that hash

[fathom pendant]

fun fact: hitting "mark as complete & next" counts for that streak

[novel hinge]

whats the correct way to crack that hash? is it through msf?

[fathom pendant]

that mask (?1?1?1?1?1?1?1) is only for specific IPMI devices

which this is not; the hashcat mode is correct

but you just need to use a wordlist instead of a mask

[next bronze]

did the module tell you to use a mask? 8 digits with 36^8 combination is gonna take forever

[fathom pendant]

(there's one provided with resources)

[fathom pendant]

it's from the footprinting module; IPMI - there's a short subsection that details a specific type of IPMI device and using that due to it's default being a Random String of 8 Digits

source: it tripped me up @ first too

[novel hinge]

ahhh okay okay let me give it a shot giving what you said. thank you guys

[next bronze]

ah okay

[rustic sage]

Can anyone help with this

[fathom pendant]

https://tenor.com/view/adventure-time-demon-cat-i-have-approximate-knowledge-of-many-things-wise-wisdom-gif-4593239

[fringe urchin]

The one in module would take around 3days and 12 hours on my machine

[fathom pendant]

also love that most of what I had to do in AD enum 1 was covered in the module (except PTH, but that's something i merely had to refer to the notebook for)

[novel hinge]

@fathom pendant just to be clear that hash i found using msf im going to need to use right?

[fringe urchin]

You need to crack it yea

Hashcat example

With a wordlist

[astral inlet]

tried hashcat -h | grep -i 'ipmi' ?

[sonic ridge]

I have a question thats somewhat related to one of the modules im doing with command injection of the operating system can someone help me

[novel hinge]

:< do i need to do something different with the hash i found? i pasted it into ipmi.txt

[next bronze]

the mode, why is it 0 now?

[novel hinge]

isnt set that for md5?

[next bronze]

is it md5?

[faint rampart]

youre cracking an ipmi with md5? the mode is 7300 I believe

[novel hinge]

ohhh let me try for SHA1

[next bronze]

the mode is given in the module, or you know,

[fathom pendant]

yes

i also said earlier that the mode was indeed correct

the method however was not :p

[novel hinge]

sorry all, im just very confused about this tool. i appreciate all your help first time using it today

[fathom pendant]

you'll learn a fair bit about the tool and use it alongside johntheripper (aka john) in the Password Attacks module

https://hashcat.net/wiki/doku.php?id=example_hashes is very nice to keep on hand as well

[sonic ridge]

if I inject a command into the url like /ip=127.0.0.1%26cat+%2Fflag.txt%26 how can I inject additional commands into the url. Like if I wanted to first change the directory and then use ls to list the contents of that directory?

[dim wolf]

you can just do ls [dir]

[tranquil axle]

You don’t, but „ls /path/to/dir“ is a valid command

[dim wolf]

also i don't think you can actually cd in a cmd injection

[tranquil axle]

Actually, I guess you can just chain commands normally

As long as they are in the same injection

[sonic ridge]

so by using an additional %26?