modules

[kind trail]

Invalid syntax near ''. Oddly enough I'm using the exact command shown in the solutions/walkthrough section of the module.

[kind trail]

Invalid syntax near '\' Sorry, formatting

[fathom pendant]

weird

it should work ¯_(ツ)_/¯

can you see if you can log in with administrator and the password

[fathom pendant]

terminate the machine, and restart it

also restart your vpn

make sure you also have no other tunX interfaces

[kind trail]

Yeah, it's very odd. Been stuck here for a few days. Evil-winrm fails with the creds I set

[fathom pendant]

¯_(ツ)_/¯

try changing to EU vpn and repeating the steps to that point

not showing the full result @fading spoke since it would be spoiler; it didn't do require -Pn

[kind trail]

Worked on EU vpn! Thanks, much appreciated

[fathom pendant]

note: my test was with pwnbox + US-2

[tender nimbus]

Hey guys little scripting here can someone help me?

That was my test but it doesn't work i receive the don't work output..

[fathom pendant]

it's technically the last 19 characters

try with those

[tender nimbus]

Yes okej but it doesn't matter rn because i got the Don't work output so it means that the conditions are not correct right?

[fathom pendant]

correct

seems like something isn't working as you think it is

[weak shell]

Is there any white hat guy

I need serious help 🙏🏽

[fathom pendant]

with?

otherwise we're assuming that you're 1) trying to solicit work or 2) trying to get someone to do something illegal under the guise of pretending it's all legal

[tender nimbus]

But based on the question can you help me and tell me wich part of the conditions is wrong?

[fathom pendant]

i don't do bash scripting and you can likely just google this exercise and find someone that has

[acoustic owl]

Don't ask about illegal hacking activities

[weak shell]

Noted

But my situation is serious that's why I am here to take help

[acoustic owl]

You can contact the police and Facebook Support. That's all you can do

[wanton idol]

^

[tender nimbus]

@acoustic owl can you give me a hint maybe?

[lethal shard]

Hi! Doing skills assessment in Trust Attacks. Have a trouble: I can not launch Rubeus because of .NET3.5. Can not install this .NET, tried to install .exe from microsoft site. Maybe some ideas how to bypass it?

[weak shell]

I truly appreciate that but for that if the page is viral this is not good for us 🥺

[wanton idol]

well then 🤷‍♂️

[fathom pendant]

it looks like your size is wrong?

[wanton idol]

thug it out

[fathom pendant]

wait nvm

but == will not match substrings

[wanton idol]

omgg i knew ittt

[fathom pendant]

you will need to find out what operator will match a substring

[wanton idol]

i just didnt wanna seem dumb bc i dont do bash scripting 😂

[fathom pendant]

i mean

it's practially similar in most cases

that == is a direct comparitor

[wanton idol]

dont u need tk remove the "" from value and var?

[fathom pendant]

how you compare substrings depends on the language

[fathom pendant]

no

[zealous fiber]

Hello guys, could anybody help me with the OSINT Third Party Assesment. Where you need to provide the Cloud provider ? Kinda tryed everything

[fathom pendant]

but there's a few other things that could be incorrect; but I just kinda clicked on the first medium article after googling about this module

[wanton idol]

true

[acoustic owl]

try to output the last 20 characters with ||tail||

[fathom pendant]

they aren't getting any output, they are getting their fail condition "Don't Work"

[faint rampart]

I personally used a counter (count variable), works well too then perform the comparison for if the counter is greater than the value required

[acoustic owl]

oh, I see

[fathom pendant]

yeah, confusing language barrier

"Don't work" isn't really a great fail string

[hexed lintel]

I am currently solving the live engagement section from Shells and payloads module,
for this i have to use the Foothold PC through rdp
but the connection is so slow and laggy
my internet is good btw,

how to solve this
tcp connection also not fixing

[lethal shard]

the following feature could not be installed error. Could it be the trouble with specific version of Rubeus?

[faint rampart]

is ${#var} really a thing?

[fathom pendant]

change vpn region

[fathom pendant]

yes

[tender nimbus]

Okej i will try all of you advice if i cant find it i come back lol

[fathom pendant]

it gets the length of the variable

[wanton idol]

give it to chatgpt ans let it explain it to u

[faint rampart]

wild

[faint rampart]

a personal tip ||count=$(echo $var | wc -c)|| then compare the value of the count with the 113** and if it exceeds that no. of characters it executes the command in the if block.

[faint rampart]

bash is sorcery.

[fathom pendant]

that's extra

also ${#var} basically does that

[faint rampart]

I didnt spend time on that one tbh just ran with that and solved it quick, only problem I had was the number of characters that the question asks for

[faint rampart]

thank you for this

[fathom pendant]

https://tldp.org/LDP/Bash-Beginners-Guide/html/sect_10_03.html

[hexed lintel]

still same

[fathom pendant]

hey as long as you got the answer

[fathom pendant]

did you try all vpn regions? also try with the pwnbox (don't forget to close the vpn on your machine when testing with pwnbox)

If issues still persist, contact support

[pseudo kiln]

academy down or is it me ?

seems to be academy

[languid fjord]

Seems to work okay here

[raven stag]

I can't RDP to the machine, it's too slow..

...

[fathom pendant]

Press enter

[raven stag]

it does not work

[naive egret]

Hi, about this question - Retrieve the TGS ticket for the SAPService account. Crack the ticket offline and submit the password as your answer. (ACTIVE DIRECTORY ENUMERATION & ATTACKS > Kerberoasting - from Linux).
I can't get the TGS in any way, it's always says Principal: INLANEFREIGHT.LOCAL\SAPService - [Errno 104] Connection reset by peer tried switching servers, restart my machine and to spawn a new target.
Can somebody please check it out?

[next bronze]

use the eu vpns

[rustic sage]

where can I report problems from the HTB academy?

[naive egret]

Tried that already, says the same thing.

[raven stag]

try with pwnbox

[fathom pendant]

If it's a semantics or target error not related to technical issues, #1234357888114364508 otherwise, support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[naive egret]

Just tried that, I got the same error.

[raven stag]

Same for me too

[next bronze]

eu5 works

just tried it

[dim wolf]

is that DeepL?

[gray chasm]

yes

[dim wolf]

it repeated itself like three times lol

[fathom pendant]

^

Sounds like it's going insane

[raven stag]

maybe if the boxes up specifically for the user, these problems would not occur.

[gray chasm]

sorry

[fathom pendant]

They are

[dim wolf]

it's not your fault, it's just DeepL being DeepL

[fathom pendant]

You can't attack someone else's lab

[raven stag]

Is it already?

[gray chasm]

Module ----> DOCUMENTATION & REPORTING

Section ----> Documentation & Reporting Practice LabSounds like it's going insane

Can someone give me a hint about this section, I have listed users and passwords and I have valid ones, but none of them allow me to connect to the DC, I have access as Local Administrator to the machine 172.16.5.200, 172.16.5.130 but I don't see anything relevant.

[fathom pendant]

Only in cases of the docker containers can you interact with the same target

[gray chasm]

[raven stag]

In my old company, proxmox was used and target boxes were cloned specifically for the user via API.

[fathom pendant]

Ok? That's not how htb academy labs are structured

It wouldn't be conducive to learning if someone else can mess with your academy lab

[naive egret]

Worked, thank you so much!

[fathom pendant]

If that's how Enterprise structured it, that's different

But Enterprise != standard and academy != main site

Yes other users can interact on the main site labs, if it's not Release Arena

[raven stag]

I agree with you

[shadow cradle]

Hi all, I'm trying the PasswordAttackLab-Easy may I ask if after the port enmureation it's just only spread&pray to BF the right user and password or am I missing anything?

[fathom pendant]

I believe so

Though they do give you a username to start with

I believe

[shadow cradle]

yeas I'm using the provided user and pwd list

I'll wait so thx

[fallen yew]

hey guys
does HTB have any resource to learn smart contract hacking at academy or not ?

[subtle mauve]

Anyone have anything for this? it seems this problem has been going unanswered for a while now, I have done everything in the following paragraph

[eager ledge]

Hi
When using hydra or crackmapexec to bruteforce the password for MSSQL server, how do we know which authentication mode is in use by default? And if we were to change the mode, how can we do so?

[gray chasm]

Does anyone know why this error occurs?

Contents of shadow.txt

set context persistent nowriters
add volume c: alias benib3astt
create
expose %benib3astt% z:

[graceful mortar]

[gray chasm]

Module ----> DOCUMENTATION & REPORTING

Section ----> Documentation & Reporting Practice Lab

I'm trying to dump the ntds.dit but I'm getting that error xd

[fathom pendant]

Well mssql is windows, so, local-auth is usually the case

[eager ledge]

you mean Windows authentication by default? How ca we change the mode?

[fathom pendant]

-local-auth I believe it's been a minute

[gray chasm]

Connecting by RDP and doing it from a cmd if I get to let me and not give me error, does anyone know why this happens?

[eager ledge]

In crackmapexec, if we are targeting Windows server that is non-domain joined, we use --local-auth right? Let's say in the same non-domain joined target, MSSQL server is running, and there is a user ABC who can authenticate to the SQL server using just the SQL authentication. Then, will simply using the command crackmapexec mssql {server_ip} -u abc -p {password_list} --local-auth work? Does this command work for both the authentication modes?🤔

[fathom pendant]

It generally will work --local-auth

Generally sql auth inherits windows auth

[gusty granite]

sorry if this is not the correct place to ask this but if I downgrade my HTB Academy subscription, will I be charged for it immediately or will I be charged when my current Academy subscription ends?

[eager ledge]

I am doing the hard lab of "Attacking common services", trying to escalate the privilege to admin. I have got access to the MSSQL server as user f*, after which I impersonate as user j*. When I try to check if the user has admin rights on the linked database or not using command EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [linked_db_name], I get the output as 1 1 1 1, which is not the same as it shows us in the previous learning section. How should I interpret this response? Does it mean that the user has admin rights? Or not?

[languid fjord]

Support best place to reach out

I know if you cancel, you keep it until the expiry, unsure in downgrade

[fathom pendant]

Next billing cycle

[candid night]

Sorry for the late response, yeah that was the case.
I was curious because after I build few chisel tunnels and was trying to access network D from C. I wanted to go back and access hosts on previous networks (let's say B) and I couldn't

I just finished the skill assessment in the pivoting and tunneling module, was really fun

[split monolith]

I don't know if this is the right place to ask, as I am new to HTB academy, but can someone help me with the shells module. Its not the content that confuses me, its accessing the machines.

[fathom pendant]

Wdym accessing the machines, either use your own vm + vpn, or the in-browser pwnbox

[split monolith]

Right, that I knew. But I need to spawn the attack box. which I do.

[fathom pendant]

And spawn the target

By clicking the green text "click here to spawn target

[split monolith]

But then when I try and nc, its not working. I am working in the shells module.

[fathom pendant]

Wdym trying to "nc"

What section are you working on?

[fringe urchin]

Dont remember any exercise in there was doing it via nc?

[fathom pendant]

NC isn't the only connection tool you can use

And most of that module is webshell stuff

[split monolith]

Page 4 " Bind Shells"

[fathom pendant]

And the bind shell is meant to be run from the victim machine, not your own

[split monolith]

Right this isn't new to me, just the environment

[fathom pendant]

ssh to target, create bind shell, connect to that target from the attack machine

nc -nv ip port generally

As shown in the section

[split monolith]

Yeah I got it. its just a little confusing with how it is worded.

[fathom pendant]

?

What's confusing about the wording?

[split monolith]

Like what the target vm (pwnbox) is, and client. I understand bind shells are unique. Because in this instance you have to "sign in" just to start the listener.

[fathom pendant]

Target isn't the pwnbox

The target will always exclusively refer to the 10.129.x.x

Yes, because bind shells have to be run from the victim/target

As they create a temporary persistence (until process is stopped/machine restarted)

The difference between them and revshells is that you can connect/disconnect as often as you want

[split monolith]

So when it references the pwnbox, is that the webgui/openvn connection? just want to make sure I understand the right terminology

[fathom pendant]

Correct

[split monolith]

right 🙂

[fathom pendant]

Attacker will always be your "home base" machine

[split monolith]

Perfect 🙂

Thank you for your help, it helps clear up the terminology.

[fathom pendant]

If you see a reference to a secondary network to connect to, generally 172.16.x.x, that means you're meant to navigate to it via the victim in some manner (the pivoting module teaches pivoting/port-forwarding techniques)

[split monolith]

Good heads up, thank you. I have done some of this before. And It was recommended looking at some of these courses.

[fathom pendant]

Also don't be thrown off by the need to sign in on some of these, assume the position that you have entered the network, and need to set up some persistence to connect back to later without needing to use a logged service like ssh

[split monolith]

Right, thats usually how I think. But its good at starting at very beginning.

[fathom pendant]

Some modules place you "in the middle" of an engagement, as a "your colleague found x info, pick up from there"

[cloud urchin]

they need to fire his sloppy ass i swear

[split monolith]

😜

[cloud urchin]

dude constantly half asses reports and doesn't ever finish his job

[fathom pendant]

In the ad enum skill assessment I they drop you in with a webshell, and II there's a connected linux host to start from

[fathom pendant]

Hey he got me ceil's login amd saved me 5 minutes of hydra

[split monolith]

That one is on my radar too, so thats a good heads up. I like how they kind of walk us through it

[fathom pendant]

If you're planning on CPTS I highly recommend doing it in order

Stuff you're used to, you'll likely breeze through and maybe pick up some new tech along the way

[split monolith]

Yeah, maybe I should.

[fathom pendant]

If you're new to a linux env, I tentively suggest the infosec fundamentals path

I say tentatively because the linux intro module needs a tiny tune up

Stuff feels out of order

Compared to most other modules, it's the weakest

[split monolith]

That I am not used to. I did do that one, but might have missed some stuff

[fathom pendant]

I also suggest looking up a bash cheatsheet

So you can quickly reference file stuff

Like redirects

[split monolith]

Probably should. I use bash everyday, but I use it MY way, and am self taught. So I probably have learned some bad habbits.

But thank you for your help. Much appreciated. 🙂

[fathom pendant]

Good skills are built on strong foundations

[tender nimbus]

Hey guys i already know the awnser but i wan't you perspective, what is the difference between those two?

[fathom pendant]

${#var} is the length,
$var is the raw value

[tender nimbus]

thats why my i blocked on the awnser ^^ idk why its not specified in the module but i forgot to make more research

[fathom pendant]

Nah, the coding modules encourage and require extra research

[tender nimbus]

didn't knew it in the beginning thannks 🙂

@fathom pendant lol the tel it you in the next module -_-

[fathom pendant]

(They may have expected you to do an (echo $var | wc -c)

[tender nimbus]

i did a tail -c 20

[fathom pendant]

Well yes to get the last 20

I meant to check the size

[tender nimbus]

ow yeah posssoble

[torpid cove]

Hi guys, I have a couple of questions
Running kali-linux as the host OS or on a Virtual environment, which is better?

And
is using a laptop better than using a desktop or vice versa, if so, why?

[fathom pendant]

Vm is better, common practice is to run your attack machine in a vm

[cloud urchin]

It's probably better to run it as a VM, that way you can backup/restore or easily re-deploy etc.

vmware gang

[fathom pendant]

Desktop may be more ideal as scalable specs, but most basic laptops can run most *nixOS vms just fine

As most vm require ~4GB of ram at minimum to run smooth and a lot of relatively cheap laptops run 8GB

[torpid cove]

So it really doesn't matter, no major benefits and differences?

[fathom pendant]

Just preferences

The bonus to a laptop vm is portability

[torpid cove]

Well desktop are not automobile

[torpid cove]

👍

[torpid cove]

Okay, thanks

[fathom pendant]

I'd say invest in an external drive to store vms on

That way if you ever upgrade/move on, you don't gotta re-set everything

[torpid cove]

Like a flashdrive right or can I utilize a hard-drive too for the vms??

[fathom pendant]

Definitely not a flashdrive

Flash memory is too volatile

Hard drive is fine, external ssd would be better as it can withstand a bit more punishment

[torpid cove]

Okay and can I use any of these consecutively for 2weeks or more without having any issue?

[fathom pendant]

Yes

Generally ssds are meant to have a long r/w lifespan

[torpid cove]

👍

[earnest imp]

hello everyone

after to solve an exercice in a module, is it possible to have an official solution?

[fathom pendant]

Only if you have an annual sub, there's an official writeup/guide for each module

While I disagree with it, it is a thing

[earnest imp]

ok so it is exists with the annual sub. Thanks!

[fathom pendant]

And is available without needing to complete the module

Hence why I have a partial bias against it

[olive slate]

While I admit at some moments when I was deeply stuck i wish something like this would exist, but in hindsight I'm glad it wasn't

at least not for free

[fathom pendant]

It's ok if you're truly stuck, and have tried every avenue to move forward. I.e. re-reading, asking here

My main gripe is that the answers aren't hidden/obfuscated in some way in the guide

[olive slate]

Ish. Seems like an oversight. I've started writing write-ups myself that is mostly only meant to be read by myself and even I obfuscated the answers

[fathom pendant]

Yeah, I've submitted feedback on it

Seems like some bug with the formatting

[gusty zinc]

footprinting - dns - What is the FQDN of the host where the last octet ends with "x.x.x.203"?
Can anyone help me with this question please?

[acoustic owl]

you have to find all the zones

[shut quest]

You'll need to be fierce about it

[gusty zinc]

Yeah, im using the right wordlist, and i've found some of the subdomains

cant seem to find the .203

[glad coral]

I Absolutely love the red team experience from Parrot security on a VM…

[acoustic owl]

remember that not every zone allows a zone transfer

[fathom pendant]

The right initial subdomain might not be in the fierce list, start first with a basic transfer

[tulip dragon]

sometimes using two ovpn at the same time work fine and sometime it conflicts like if 1 work other don't

what to do so that they don't conflict each other , i know they can work at the sametime but don't know how to do it manually

[dim wolf]

don't have two vpn connections simultaneously

because they don't work simultaneously

[fathom pendant]

Yeah, you should only be running one ovpn connection to htb at a time

[dim wolf]

the traffic will be routed very weirdly

[fathom pendant]

Otherwise you get collisions and dead drops

Where the vpn router doesn't know where to send the traffic back

So it just drops it

[tulip dragon]

that what i use to think but sometime they work both at the same time thats why i thought their would be setting that i am not aware of

[dim wolf]

there is no such setting

[tulip dragon]

ok

[sterile epoch]

Hi its been more than 40 mins and I have retried a few times within that time span after almost every 10 mins I cannot spawn the citrix target from windows priv escalation

This one is spawning for more than 15 mins

any idea what should I do??

finally it spawned

[tulip dragon]

it will happen in future also , next time use that 40 min on other place

i also wasted when it happened to me first time

[sterile epoch]

yea I was making notes for the previous modules I missed

[green basalt]

footprinting-dns-Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{...))? anyone can help me

[eager ledge]

Yes the user has admin rights! I was not able to execute other commands due to conection issue.

[pseudo storm]

Hello Bhaiya

[cerulean grail]

Hi everyone! In the Footprinting SMTP module I used Metasploit to enumerate SMTP users and find the existing user on the system. This technique was not shown during the module, and I completely understand that not everything is spelt out and some digging is required on our end. How should I approach these situations moving forward? I wouldn't want to find an "easy" way out that would undo the techniques I've learned throughout the module. How should I tackle this?

[cloud urchin]

What do you need help with?

[cloud urchin]

I believe the module also talks about smtp-user-enum

[green basalt]

i tried many time but i don't knwo what is the wrong with me

[cloud urchin]

does your command to return subdomains work?

[green basalt]

yes

let me send it

dig axfr <domain.tld> @<nameserver>

this one and i tried all typies zone

[cloud urchin]

Did you try brute forcing?

[green basalt]

one time let me do it again

[cloud urchin]

look in the DNS discovery wordlists for seclists, start with the smallest list and work your way up.

[civic locust]

Hey! At this point, we should be able to leverage our new group membership to take control over the adunn user. Now, let's say that our client permitted us to change the password of the damundsen user, but the adunn user is an admin account that cannot be interrupted. Since we have GenericAll rights over this account, we can have even more fun and perform a targeted Kerberoasting attack by modifying the account's servicePrincipalName attribute to create a fake SPN that we can then Kerberoast to obtain the TGS ticket and (hopefully) crack the hash offline using Hashcat.
The question is: Why do i need to assign SPN? Why can't I use the default one?

[cerulean grail]

It does not. I just CTRL+F'd to see if I missed it.

[cloud urchin]

An SPN is required to generate a ticket in Kerberos. If there is no SPN you cannot kerberoast the account.

[civic locust]

But why can't i get user SPN? Isn't it assigned by default to every user?

[cloud urchin]

No, SPN is a Service Principle Name and are specifically associated with service accounts not general user accounts.

[civic locust]

Oh, okay, thx

[cloud urchin]

You can learn more here https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names

[green basalt]

i do it

it is give me three subdomains

[cloud urchin]

what wordlist did you use

[green basalt]

subdomains.list

[cloud urchin]

where did you get that, is it in the resources section?

[green basalt]

😮‍💨 the terminal closed

[cerulean grail]

It doesn't mention it, but I'm wondering how to best approach these situations moving forward? I'm assuming we're learning a lot of different techniques that are more difficult to utilize than just running a tool out there and I'm having trouble identifying how I was supposed to know that I should use msfconsole here

[green basalt]

i will do it agein

[cloud urchin]

I guess they expect you to manually do it or find a tool yourself

i think i used smtp-user-enum which is just a built-in tool for kali

[cerulean grail]

So just Google "user enumeration smtp" and see what comes? It's just... it doesn't have much to do with anything we've learned din the module

[cloud urchin]

You can do it with the module itself manually

[cerulean grail]

What module?

[cloud urchin]

it teaches you how to telnet in and check the user

the footprinting module

[cerulean grail]

Well, it shows ue how to check the user using VRFY, which doesn't work unless you already have a user in hand

Also - after I obtained the username via Metasploit I checked it using VRFY and still got a 252 response code meaning that I got no indication whether it actually exists on teh system

[cloud urchin]

It does provide you everything you need to complete it

[cerulean grail]

So I couldn't enum the user using the techniques we learned in the module

[cloud urchin]

using a tool is faster, otherwise just manually verify

check the "resources" section for the wordlist for the module

[cerulean grail]

I don't think you're understanding what I'm saying. I tried verifying manually using VRFY after connecting via telnet but I had no username to verify.
Then I looked it up and used the wordlist in the resources section to find the username using Metaspolit, but even the username I got doesn't show up as verified after I use VRFY on it

So I'm not sure how I could have known that this was the username by manually checking it

[green basalt]

Brute forcing with /home/htb-ac-1143937/subdomains.list: in this section

[cloud urchin]

Try using something more fierce and hot from seclists

[green basalt]

like what ?

[cloud urchin]

like i said before, go into your seclists directory under dns discovery and look at the lists available. start from the smallest list and work your way up.

[cloud urchin]

You should edit out the answer to the question here. Just for you I went and tested it myself and manual verficiation works.

[cerulean grail]

Could you elaborate? I use VRFY on the username and get 252 (meaning Cannot VRFY user, but will accept message and attempt delivery)

[cloud urchin]

that sounds correct. try VRFY on a user that doesn't exist, you'll see there's a difference

That's also how the VRFY section shows existing users with that 252 line

[cerulean grail]

I used it on "antispam" (which doesn't exist) and it responds with a 252. DO you see the problem? I can't tell what actually exists.

[cloud urchin]

252 means the recipient's email is valid but not verifiable

that's not what i get when i put a bad user in mine

[cerulean grail]

Wasn't the whole point verifying? Shouldn't I get a response saying that the recepient's email si both valid AND verifyable?

[cloud urchin]

i suppose you can figure it out with deductive logic. i used the smtp tool i mentioned earlier on the module myself, but if i did it manually i would have reasoned the one single response that was different from the rest is the valid account. plus that's what the link the module gives says.

you may be able to ask the creator of the module the thought process or the 'right' way to do it

if you're a subscriber you can also enable a walk through which shows you how the module creator did it (it doesn't really explain it but shows you the steps from what i understand)

[normal sand]

Module: Password Attacks: Attacking Active Directory & NTDS.dit

I'm on the last question of the section and I've managed to obtain the ntds.dit file the target and now I have a copy on my attack host. How do I dump the hashes? It's not mentioned in the section. The only mention of dumping the hashes is when crackmapexec gets the ntds.dit file from the target and dumps it automatically.

[fringe urchin]

You can use secretdump.py from the prev sections to dump the hashes

Thats the way where you need to manually get the hashes and crack it. Its easier with crackmap, but id suggest trying out with the secretsdump

[normal sand]

Would I need LOCAL in the command?

python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -ntds 
<path_to_ntds.dit> LOCAL

[fringe urchin]

Yea but you missing SYSTEM

[normal sand]

I thought that wasn't necessary, I don't really understand the syntax of the command in that case.

[normal sand]

Why is it needed?

[fringe urchin]

System has the key for us to decrypt the ntds file

[normal sand]

I see. So I'd need to extract the system hive as well?

[fringe urchin]

From the machine? Yep

[normal sand]

Thanks

[fringe urchin]

A quick google search will give you the location where its located

Or i think prevs sections have it aswell

But yea i remembered i googled that

[normal sand]

Yeah, it's there in the previous section.

[north bramble]

Hello, I am on skills assessment for attacks webapps with ffuf. whenever I try to go to http://academy.htb/ it becomes https on its own. where did I mess up?

[cloud urchin]

Sounds like it's using https

[north bramble]

how do I get it to load then? also afaik, all the academy stuff uses http mostly

[cloud urchin]

in my experience they mostly use https

[north bramble]

okay so what seems to be wrong then?

[cloud urchin]

for this module it may use http though

[north bramble]

am I supposed to include the port?

no, as far as I remember

[cloud urchin]

not in /etc/hosts

which question are you stuck on, the first one?

[north bramble]

yes, just adding the ip and the academy.htb to etchosts first

[cloud urchin]

you're not supposed to visit the site, the question says to fuzz the subdomains/vhosts

[north bramble]

but how will it fuzz if it cant redirect? will just get erros

[thorn hawk]

Hi to all. Would it be possible to request some input? I am on the File upload module in the type filters section and have successfully bypass the image extension, content-type and MIME magic byte. When I try to reach the file I can only do that through curl otherwise I am getting the below error. Thorugh curl I can see the PHP webshell but this is not run as interted. Any thoughts?

[cloud urchin]

Read the vhost fuzzing section again

[cloud urchin]

I did it with a different bypass filter and different extension

[north bramble]

okay thanks. I got it. getting a bunch of hits

[cloud urchin]

make sure to filter out bad results

[signal bane]

does anyone know how i can figure out which os it says

ive tried reading up and down the module but cant find anything showing me how to determine the os from that code

the module is rated easy too (im cooked)

[storm elk]

Check the TTL from the response

And use that on Google for OS

[signal bane]

ahhh okay thank you

👍

[storm elk]

TTLs are different for all the OS’s

[snow ridge]

Anyone else having problem spawning machine in new module "INTRO TO C2 OPERATIONS WITH SLIVER" and section "Probing the Surface"? I have been trying to spawn that for over an hour and tried it many times. I think there might be some problem with that module

[autumn pilot]

On which VPN server are you, I have tried to spawn the target on us-academy-2 and I got an IP

[hollow ridge]

Anyone?

[snow ridge]

I tried EU1 and 4 I think. Ill try US then

[gusty zinc]

stll no luck

after initial axfr when i brute force all subdomains usi8ng dnsenum and a fiercly long wordlist against all subs from the zone trans - i get nothing

query failed: refused

[acoustic owl]

then you are doing something wrong. Which name server are you using?

[hollow ridge]

@hexed lintel you solved this one?

[gusty zinc]

pm'ed

[hexed lintel]

yes

[hollow ridge]

Cann you tell/show me how you have done this one

[hexed lintel]

dm i will give some hints

[sterile hinge]

Anyone else having targets not spawning? "Target is spawning.."

[hexed lintel]

working fine for me

[sterile hinge]

Changed VPNs, and now it's working 👍

[north bramble]

still on the attacking webapps with ffuf skills assessment
question3

is there a problem with my command?

[fathom pendant]

Are you including the found file extensions?

[north bramble]

yes. and from some writeup I know that its .php7

[fathom pendant]

Try changing your vm to bridged networking

[north bramble]

Okay

[fathom pendant]

NAT can sometimes cause issues that force your network to crawl

[tawny solstice]

can someone explain to me how to do this

Try adding a new city through the browser devtools, by using one of the Fetch POST requests you used in the previous section.

[hoary pulsar]

AEN target Server is really unstable no? especially when already testing internally? unable to fully load the web-site for like an hour already. No hope in having a stable south east asia server. :<

[fathom pendant]

I suggest not including screenshots of the AEN module, as many do it blind

[hoary pulsar]

aight deleted the pic my bad

[fathom pendant]

Try changing vpn region

Yes even with pwnbox vpn region matters

[finite abyss]

Hi
I think there is something wrong in academy content. How to report.

[fathom pendant]

If you believe it to be a technical error: support
If it's an error with content: #1234357888114364508

[finite abyss]

Cool, raised request
https://discord.com/channels/473760315293696010/1243959974942605332

If walkthrough the right tag for HTB academy content issue.
It is apt one out of the three

[rough lagoon]

hello everyone
I'm currently working on 'file upload' module and i have a question which i can't figure it out.
on the white list section when i fuzzing the extensions with the wordlist in the module i have different results. some of the results writes 'Only images are allowed' and some writes 'Extension not allowed'
why do i observe different results?
i do understand that the backand code relate differently to each extension and some are a belong to a white list. but i don't understant if the other results belong to a blacklist

[jaunty vigil]

anyone here did the supply chain attacks module and can help me out with the last bit

[finite abyss]

Which section

[rough lagoon]

white list section

[jaunty vigil]

figured it out!

[gusty flicker]

Hi guys, I am hoping to get some help. I am doing "Attacking Common Applications" model and for each page, the target is an IP address (with no port). The problem is that I cannot connect to any of the targets, and on the rare occasion it connects its soo mega slow. I tried regenerating VPN keys to different locations, I tried pwnbox rather than my own vm, and still same error persisting :/ Any ideas?

It seems like the problem is only in this module

[fathom pendant]

Does the ip adress happen to start with 10.129?

[gusty flicker]

Yes exactly!

[fathom pendant]

Then no port will be provided

Maybe if the reading specifies a port, then you'll need to use one

[gusty flicker]

Well, if it does connect on the rare occasion it seems to be default port 80 so port is most likely not an issue

I think for all rooms its port 80

[fathom pendant]

http://ip:port

Did you scan it?

[fathom pendant]

*labs not rooms

Rooms is thm terminology

[gusty flicker]

Yup, all filtered when I force it with -Pn

[fathom pendant]

Then message support

If you've tried all basic troubleshooting and nothing is working

My only other assumption may be you somehow have multiple openvpn connections running

If you do ip a and see multiple tunX interfaces

Then you have multiple running

[gusty flicker]

It wouldn't explain not working on pwnbox :/ I am nearly finish with whole CPTS path, just AD and this module missing and all others were ok

[fathom pendant]

Then message support

[gusty flicker]

Oki thank you! :/

[fathom pendant]

Idk what more you were expecting tbh

Exhaust all troubleshooting and still fucked? Support

[gusty flicker]

I was expecting to get info if anyone else is having this issue within the community. I know support is there, there is also a reason why Discord server was set up to have community to ask questions, no need to be pedantic

[fathom pendant]

if multiple people are also experiencing the issue, bringing it up to support allows them to look into the backend and see if it's their providers being dumb again ¯_(ツ)_/¯

[pearl kiln]

hi

[wooden perch]

Password Attacks Lab - Easy

sudo nmap -p- --min-rate 10000 10.129.202.219 -> ports 21 and 22 open
OS - Ubuntu
FTP - vsftpd 3.0.3
SSH - OpenSSH 8.2p1

with the provided resources on the lab (Password-Attacks.zip) I've:
1- used hydra (for ssh and ftp services) with the original users and pwd list -> no results
2- generated a mutated list using custom.rule and used hydra again -> no results

next step MSF console or am I missing something?

[stable bone]

i ate too many donuts omg

can i get help with subnets

[fathom pendant]

I literally just refreshed myself on subnets last night what's up?

I also gave some advice in this channel a while back regarding subnet calculations

[stable bone]

im stuck on calculations in intro to networking modules

its for noobs but i dont get it

[fathom pendant]

What exactly are you struggling with?

[stable bone]

i keep rereading how to calculate but i need it explained like im kindergarten 💀

[fathom pendant]

Ok, so first question: since we know that an IP is 32 bits in 4 octets
We can simply divide the CIDR notation (27) by 8 (octet) you'll get n and some remainder, the n would be the number of "full" octets. Adding up to 255

The remainder is how many "left-justified" bits are in the mask

Since we fill a subnet mask left to right you fill in the remainder bits then 0s

So with /27 its 11100000 --> 128+64+32

[stable bone]

https://tenor.com/view/huh-rabbit-cute-gif-15676652

[fathom pendant]

So the decimal notation would be 255.255.255.x

[stable bone]

yeah im cooked

[fathom pendant]

Ok let me break it down easier

An octet is 8 bits, correct?

[stable bone]

yeah thats easy

[fathom pendant]

Ok

An ip address is 4 octects

[stable bone]

so 8x4?

[fathom pendant]

Yes

[stable bone]

and what does that number (32) represent?

[fathom pendant]

So when we divide our cidr notation we do not resolve the decimal, we just leave it with the remainder

32 would be a full IP

Or full mask

Let's break each 8 individually

[stable bone]

ohhh

ok but how do you convert each octet into 1s and 0s (binary)?

[fathom pendant]

So. With the example, we do not care about the 10.200.20.0 portion

For the subnet mask we only care about cidr

/27

[stable bone]

so the /27?

yeah yeah

[fathom pendant]

Yes, cidr notation is how many bits from left to right there are

[stable bone]

ok so you take 32 and divide by 27? or subract 27?

[fathom pendant]

Divide by

You get 3 and 3/8

[stable bone]

bro no?? 32/27 = 1.185

[fathom pendant]

Sorry misread

We divide 27 by 8

Since we are in sets of 8

[stable bone]

OH OH OK OK

3.375

[fathom pendant]

Don't resolve 3/8

The remainder number is important

[stable bone]

wdym resolve?

[fathom pendant]

Divide

We don't want the decimal representation of 3/8

This is important

[stable bone]

wait dude where did you get 3/8?

[fathom pendant]

This means that the left 3 out of 8 bits of this final octet are flipped on

3 remaining

[stable bone]

oh ok

[fathom pendant]

Then it's just converting 11100000 to decimal

[stable bone]

yeah but how

[fathom pendant]

It helps to just create a chart

|128|64|32|16|8 |4|2|1|
|  1|1 | 1| 0|0|0|0|0|

[stable bone]

so anything over 8 = 1 ?

[fathom pendant]

?

[stable bone]

so anything over 32 =1 ?

[fathom pendant]

Write it out yourself

Don't worry about what is or isn't 1

I don't have a paper on me to write it out myself

[dim wolf]

  2^7 2^6 2^5 2^4 2^3 2^2 2^1 2^0
  128  64  32  16   8   4   2   1
  -------------------------------
    1   1   1   0   0   0   0   0
= 128 +64 +32                     = 224

[stable bone]

| 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
| 1 | 1 | 1 | 0 | 0| 0 | 0 | 0|

[fathom pendant]

Yep

[stable bone]

yeah so anything over 32 = 1

[fathom pendant]

Then you add together anything that's a 1

[stable bone]

and the 224 represents what?

[fathom pendant]

The last part of the mask

Basically it identifies the network

[stable bone]

so my answer to question one would be...?

11100000/224?

[fathom pendant]

Well the first 3 octets are full

It's asking for decimal not binary

And no

We combine the concept that we got a whole number (3) and that those represent the full octets and what you just calculated

[stable bone]

so 3 full octets?

/24

[fathom pendant]

Yes

Which is 255.255.255.0

And you add on what you just calculated for /27

Which is the .224 ending

[stable bone]

HUH

how did all the 1s turn into 255 💀

[fathom pendant]

Math

[dim wolf]

11111111 is 255 in binary

[fathom pendant]

^

[stable bone]

whats the conversion

[fathom pendant]

128+64+32+16+8+4+2+1

[stable bone]

OH FOR EVERY 1 ??

[dim wolf]

  2^7 2^6 2^5 2^4 2^3 2^2 2^1 2^0
  128  64  32  16   8   4   2   1
  -------------------------------
    1   1   1   1   1   1   1   1
= 128 +64 +32 +16  +8  +4  +2  +1 = 255

[fathom pendant]

^

[stable bone]

omfg you guys are goats

it clicked

[fathom pendant]

The second question is a bit more of a work through (kind of)

[stable bone]

so my final answer is 255.255.255.27?

[fathom pendant]

No

[stable bone]

shit

i was so confident too 😭

[fathom pendant]

We just converted the last portion

11100000

[stable bone]

aint no way

all this just for the /27?

[fathom pendant]

it's why it's easy to remember shortcuts ¯_(ツ)_/¯

[runic depot]

what modules got subnetting like this

[fathom pendant]

Every 8 bits is 255 until you can't do 8 anymore

[stable bone]

introduction to networking ---> subnetting

[fathom pendant]

The broadcast is the last address in a specified subnet range.

[stable bone]

yeah im not worried about that tho just calculating

[fathom pendant]

The range is determined by 256 - the last number in the subnet mask

[dim wolf]

NO!

[stable bone]

get outta here i got important shit to do no life

[dim wolf]

2 mutual servers??

you're in my HTB team discord????

wtf???

[fathom pendant]

Skill issye

[lucid gyro]

Ye

[dim wolf]

GTFO

[stable bone]

whats that?

[lucid gyro]

Say this to your mum

[stable bone]

i wanna join a team ik nothing tho kekw

[lucid gyro]

Something that is for smart people

[lucid gyro]

U wan a team ??

I can get u in a team

[stable bone]

no thanks youre an embarassment

[lucid gyro]

Wut

Why is it

[stable bone]

idk you give off cuck vibes

[lucid gyro]

Fine

I had a team

[stable bone]

emphasis on had i can see why they left

[fringe urchin]

[stable bone]

mb i dont wanna get banned i'll chill

[fathom pendant]

<@&861185840277487616>

[fathom pendant]

Ping here if you need more help after

Also https://www.youtube.com/watch?v=pITq64bSbMQ

[stable bone]

yes yes i get it

the /27 converts to 224, right?

[fathom pendant]

Yes

[stable bone]

because 128+64+32

so my answer is...

255.255.255.224/27

[fathom pendant]

Nope

[stable bone]

WHAT

[fathom pendant]

Don't need the /27

[stable bone]

255.255.255.224

[fathom pendant]

/27 is only used on the IP to indicate the type of network it's on

[stable bone]

now broadcast address time 😎

[fathom pendant]

That ones not as hard

The following questions require some logic

[stable bone]

ik im scared

boutta shit out the donuts from the festival

[fathom pendant]

https://tenor.com/view/brother-ew-ew-what-is-that-whats-that-brother-gif-14318384540422820315

[stable bone]

ok so how is it found

[fathom pendant]

It's the last address before the next range

It's why a device can't be assigned that ip

[stable bone]

this is all it has not even how to calculate it

so our range would be 0-224?

[fathom pendant]

No

[stable bone]

the address is literally 224

[fathom pendant]

Range is 256-224

That's the subnet mask

Subtract 224 from 256

And that will be your range per network

[stable bone]

okkk

so each subnet will be 225.255.255.224-256

[fathom pendant]

Wrong

[stable bone]

kms

[fathom pendant]

The subnet will describe each range

This method they show does work btw I just manually checked it

You just have to adjust for whatever your / is

For /27 you place it after the 27th bit

10.200.20.0 -->
0000 1010 . 1100 1000 . 00010100 . 00000000

So the spacer they use is after the 3rd 0 in the last octet

[stable bone]

https://tenor.com/view/blue-cry-sad-bad-day-gif-10315802272088746122

[fathom pendant]

000 | 00000

Flood that with the 1s on the right

00011111

Convert that to decimal

(For some networks you would need to figure out which segment it's on to find the broadcast)

Or my method, take the range and subtract one (for this case)

[stable bone]

wait bruh

the broadcast address

is literally just 31 at the end of the CIDR

[fathom pendant]

?

Wdym the 31 at the end of the cidr?

[stable bone]

because the 4th octet is /32 and you just minus 1 for the range

[fathom pendant]

It doesn't always work that way

[stable bone]

oh well it worked 😂

[fathom pendant]

There's very few conveniences

Take for instance if it was a /29, that wouldn't work

As the range is different

[stable bone]

you would just add 1 if the 4th octet is below /32

[fathom pendant]

Nope

/29 has a range of 8 (6 usable hosts per)

[stable bone]

oh so it would be 36 at the end

[fathom pendant]

Nope

Stop thinking in terms of the cidr notation

[onyx halo]

Anyone managed to make fatty server work with Module section: Exploiting Web Vulnerabilities in Thick-Client Applications?
I confirmed that I am connecting on the right IP: 172.16.17.114 (that's already the one set in hosts and un-modded java client tries to connect to). I modded the java client to reflect correct port 1337, getting some response but after app hangs and wireshark shows syn/synack/ack then tls1.2 client hello, ack from back from server, then 'tcp previous segment not captured' thats it.
I have watche ippsecs video on fatty, he's doing socat to redirect, but obviously there is no socat on win vm.

[fathom pendant]

Side challenge. Find the network address, broadcast ip, and subnet of 10.10.14.33/28

[stable bone]

mf i didnt even get the method right for the broadcast address 😭

[fathom pendant]

Ik that's why it's a side challenge

You know the range yes?

[stable bone]

i gotta split this network 4 times first 😭

[fathom pendant]

What's 4 in terms of 2^x

Shift that many bits to the right for your mask and start from there

X being the number of bits

[stable bone]

https://tenor.com/view/kill-me-drink-bleach-gif-22890796

[fathom pendant]

So we know that /27 is 11100000; if we need to divide by four (fill in 2 bits as 2^2 = 4); the mask becomes 11111000 at the end

[stable bone]

which would make it be (let me type)

1 = 256+64+32 =255

[fathom pendant]

Where did you get 256 from?

Huh??

[stable bone]

cuz of 255 then just add 1

[fathom pendant]

https://tenor.com/view/wrong-drumpf-trump-stupid-gif-6220235

[stable bone]

marcie is my new mom holy shit 😭 wrong wrong wrong

[fathom pendant]

We know /27 is 224

[stable bone]

yeah...

[fathom pendant]

We are adding the next 2 bits in sequence

Again it might be handy to make a small table to fill on

[stable bone]

1 = 128+64+32 = 255

[fathom pendant]

So we add 16 and 8 to 224, since we are adding two bits to the left

[fathom pendant]

.... thats... not how math works

How the fuck are you getting these numbers

[stable bone]

i mean the binary 1 equals that combo

[fathom pendant]

No... it doesn't

11111111 = 255

[stable bone]

OH THE WHOLE THING IS 255

I THOUGHT IT WAS EVERY 1

[fathom pendant]

...

Brother

You know what binary and bits are, yeah?

[stable bone]

binary is 1s and 0s

bits are for IPs

[fathom pendant]

.

Bits are a combination of ones and zeros, 8 Bits to a byte

A number in an ip is an 8 bit number

They are called octets because they are grouped in 8s

An ip is made up of bits, but not all bits are IPs

Binary is just the mode of counting, like how decimal is for normal counting systems

Bi meaning 2 states, 0 or 1

Off or on

[rough lagoon]

hello everyone
I'm currently working on 'file upload' module and i have a question which i can't figure it out.
on the white list section when i fuzzing the extensions with the wordlist in the module i have different results. some of the results writes 'Only images are allowed' and some writes 'Extension not allowed'
why do i observe different results?
i do understand that the backand code relate differently to each extension and some are a belong to a white list. but i don't understant if the other results belong to a blacklist

[fathom pendant]

Nope

White-list is more restrictive than blacklist

You either use a or b

White-list means exclusively allow these things

[stable bone]

can you join vc?

[fathom pendant]

No

Bits are the building blocks of computers that only speak and interpret binary

[stable bone]

ik what bits are

[fathom pendant]

Anyway

The other important thing for subnetting is starting at 0 for your hosts, then counting up

[shut quest]

Hey, this is an English speaking discord

[stable bone]

Ja aber darum geht es hier nicht

Es ist ein sehr langer prozess dies zu erklären

[fringe urchin]

Read #rules . Its illegal so it shouldnt be discussed here

[fathom pendant]

English #rules

[stable bone]

sorry i am trilingual

[fathom pendant]

Not the point lol

It's an English only server

[stable bone]

es ist nicht legal

[stable bone]

i can translate for you i just told him its a long process to explain that not exactly legal

[fathom pendant]

I suggest pulling the convo into English

All you needed to do was tell him to type in English

[stable bone]

geben sie auf English ein @craggy cove

[fringe urchin]

[craggy cove]

Ich kann kein English@stable bone

[stable bone]

@fathom pendant he doesn't know english tho :(

[fathom pendant]

Too damn bad

[fringe urchin]

Google translate or deepl exist?

[stable bone]

💀

[fathom pendant]

<@&861185840277487616>

Since it sounds like the convo is leaning illegal anyway

[stable bone]

google translate sucks ngl

[fringe urchin]

It gets the job done lol?

[stable bone]

no no i was telling him its not legal 😭

[fathom pendant]

K

[fringe urchin]

You aint translating a diploma lol

[fathom pendant]

And that's where the convo stops

[shut quest]

Gpt is free along with self hosted llms trained on translation, those should work probably better than Google translate

[stable bone]

alr fine im sorryyy i'll go back to my subnets

[fathom pendant]

if they continue, and refuse to speak English, then they can be removed ¯_(ツ)_/¯

[stable bone]

like ollama

[stable bone]

dont bro :\

[shut quest]

ollama is not a LLM, just software that you can use to interact with an LLM. Mistral, gpt, llama2/3 are llms. Anyhow this is off topic.

[fathom pendant]

Not you, the other guy

[stable bone]

holyyy bro i thought i was about to get banned 😭

[fathom pendant]

https://tenor.com/view/lawrence-fishburne-get-back-to-work-boss-gif-15075204

[fringe urchin]

[stable bone]

https://tenor.com/view/sir-yes-sir-yes-sir-gif-21589754

how it feels learning from marcie

[acoustic owl]

thanks, I have taken care of it

[stable bone]

oh the menace bunny is a mod 😂

[acoustic owl]

and can speak German 🤷‍♂️

[stable bone]

ayooo bro is dope af too

i only learned it cuz ive been here a while but im from mericuhhh

[shut quest]

What can't the Swiss do?

[stable bone]

make good chocolate

[acoustic owl]

I think we have the best chocolate

[stable bone]

nahuh my grandma does

[fringe urchin]

https://tenor.com/view/toblerone-silly-lift-rage-gif-7198145

Well we sold it away

[umbral wasp]

Attack the PRTG target and gain remote code execution. Submit the contents of the flag.txt file on the administrator Desktop.PRTG Network Monitor

Page 23
Privileged Access

Privileged Access

[rough lagoon]

no argue about it. it just that in this module i can observe two different responses and i want to understand why

[fathom pendant]

This is why. Lol if it's not on the White-list it's denied

[rough lagoon]

hey, i just send you a message on private convo so i won't annoy here everyone

[fathom pendant]

I'm not accepting dms

[elder citrus]

yo

[rough lagoon]

ok
so i actually can't understand your explaination.
i use burp intruder with a payload within the module.
i can observe 3 different results:

1. succeed
2. Only images are allowed
3. Extension not allowed

the 2nd and the 3rd actually means the same. but if we'll relate to the sentences themselves we can see a different. which cause by a code in the back-end that relate to different extensions differently. All i try is to understand if the difference between the negative results can point on a vulnerabilty in some of the paylods(e.g if a payload gets the 2nd result it might be blacklisted and the 3rd might be whitelisted)

[limber river]

not really

ig the difference between 2&3 is related to the mime type and content type

[fathom pendant]

It's white-listing specific image types

[limber river]

just use the list created in the module to bypass the whitelist filter

[fathom pendant]

So, you get "only images are allowed" then "extension not allowed" means that generally the image extension you're trying to use is not working

For instance it could be set up to only accept pngs but not jpegs or other image formats

White-list .png

[limber river]

yeah that possible too

[fathom pendant]

¯_(ツ)_/¯

[sacred laurel]

Command Injection - Other Injection Operators. Found the answer but it rejects since the format isn't correct. Can someone tell me the correct format?

[turbid crest]

is the academy module Password Mutations lab question supposed to take quite long to crack like 30 min or longer? Or am I on a somewhat wrong track?

[fathom pendant]

It takes ~30 minutes yeah, as long as you're not attacking ssh, and you use like 48 threads

[turbid crest]

the question is ssh :
Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.

[fathom pendant]

And ssh is painfully slow

[turbid crest]

ok, thx make sense

[fathom pendant]

Step 0) enumerate

Step -1) the questions often give an end goal, not a start

[turbid crest]

ok i see

[fathom pendant]

Also for this module the windows and Linux labs get reused

So enumerating users from C:/Users/ and /home/ (and root) will give you a more concise list for the sections up until the skill assessments

[heavy marsh]

For the Linux Privilege Escalation Wildcard section, what is the purpose of the line --checkpoint=1

This doesn't make any sense

The first line is to add everyone to sudoers? After that I'm definitely lost.

[cloud urchin]

the module explains it

[heavy marsh]

Not very well. What is checkpoint=1 supposed to do?

I'm assuming the second line tells tar to execute the root.sh that was created.

The third line seem unnecessary

[cloud urchin]

its required

[heavy marsh]

All it says is that it displays a progress message

What does it actually do?

[cloud urchin]

what does what do

[heavy marsh]

the --checkpoint=1 command

[fathom pendant]

well if you're unsure if it's necessary or not, run it with and without

[heavy marsh]

There's no lab for this one

[cloud urchin]

https://www.gnu.org/software/tar/manual/html_section/checkpoints.html

[fathom pendant]

you're basically redirecting a bunch of file descriptors

[cloud urchin]

"A checkpoint is a moment of time before writing nth record to the archive (a write checkpoint), or before reading nth record from the archive (a read checkpoint). Checkpoints allow to periodically execute arbitrary actions."

By creating files named --checkpoint=1 and --checkpoint-action=exec=sh root.sh, and then using a wildcard to include these files, these filenames are interpreted as additional command-line options by tar. The --checkpoint=1 option sets a checkpoint after the first record is processed, and --checkpoint-action=exec=sh root.sh specifies that the sh root.sh script should be executed at this checkpoint. If tar is run with elevated privileges, the script will also execute with those privileges.

if you don't include --checkpoint=1 then it won't hit the checkpoint therefore will not perform the action.

[heavy marsh]

Makes sense now, I was starting to wonder what this had to do with wildcards! The * essentially just takes every file and archives it with tar?

Is that right?

Does it automatically run --checkpoint=1 first? How does tar know what order to go in?

[tacit stump]

ello there i'm doing the module hacking with wordpress and i'm in the skills assesment page and i'm stuck with injecting the vulnerbility, is there anyone who can help me sort that out?

[fathom pendant]

the first line adds htb-student to sudoers; and says that you can execute all commands as root with no passwd for all files btw

well it makes the root.sh file do that

[heavy marsh]

Yeah, I realized I messed that up, thanks!

So if I'm looking at this right now, the --checkpoint file names don't get read as filenames to be archived, they are just appended to the command as a modifier?

So that's why it doesn't matter what order they're in?

[fathom pendant]

basically

[rustic sage]

I can't access general chat to talk to people

[fathom pendant]

it's one of those sort of weird quirks of file descriptors

[fathom pendant]

read and follow #welcome

[tacit stump]

@fathom pendant can you help me?

[fathom pendant]

https://tenor.com/view/confused-no-nope-gif-5413974953753901704

[cloud urchin]

* is just a wildcard for any character(s), so when you tar a whole directory like sudo tar -cf archive.tar *, the * wildcard will include all files in the current directory. The shell expands the * wildcard to match all files in the current directory, including special files like --checkpoint=1, effectively turning them into an argument for the tar command because the tar command interprets the files as part of the command itself.

[fathom pendant]

^

[heavy marsh]

Roger! Thanks!

[cloud urchin]

as for the order, you'd have to test i don't know. i'd imagine it would work either way because they are arugments for the single command being ran but maybe not.

[tacit stump]

i need help with completing a module would be thankful if anyone can help?

[dim wolf]

ask your question and someone may help

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[tacit stump]

i'm stuck in the module "hacking with wordpress" where they ask for "Submit the contents of the flag file in the directory with directory listing enabled."

[fathom pendant]

i haven't done wordpress module

[dim wolf]

what is your exact issue. what have you tried, etc.

[fathom pendant]

so i'm of no help here but ^

[dim wolf]

section name

[tacit stump]

i took access of the wordpress admin panel

https://academy.hackthebox.com/module/17/section/64

this is the one

[cloud urchin]

I haven't done that module, but it looks like you'd probably find the answer in the "Directory Indexing" section?

[tacit stump]

i'll try it out

[heavy marsh]

On the Linux Privilege Escalation Escaping Restricted Shells section, the command here makes no sense

It doesn't work in the lab or on my machine

It says that it's supposed to execute the pwd command after the ls -l command but I don't see how that would even work

[cloud urchin]

so when you run that command it doesn't list the contents of the directory? works fine in my kali box

[fathom pendant]

it runs ls -l on the output of pwd

`<command>` is an archaic version of $(<command>)

[heavy marsh]

yeah, ls -l works, but not pwd

only on my machine, not the lab

[fathom pendant]

works fine to me ¯_(ツ)_/¯

it's not running them one after the other

[cloud urchin]

what error do you get when typing ls -l `pwd` in your terminal

[fathom pendant]

just do `pwd`

[fathom pendant]

ah

rbash is treating it weird then

it works fine in normal bash

[heavy marsh]

pwd is the one that it's not allowing

ls -l is supposed to run

[cloud urchin]

rbash is restricted bash

try regular bash, not restricted

rbash will restrict commands to enhance security

[fathom pendant]

rbash seems to be limiting what can be done

[cloud urchin]

yup, don't use rbash

[fathom pendant]

so either the goal is to escape rbash or you're missing the point

¯_(ツ)_/¯

maybe the point is to show that rbash enhances security

[dim wolf]

you can escape rbash

[heavy marsh]

That's what the module is trying to show: How to escape the restricted shells

[fathom pendant]

ls -l `pwd` == ls -l $(pwd)

[heavy marsh]

The
ls -l pwd
command doesn't make any sense

[cloud urchin]

it does make sense

[heavy marsh]

what is $(pwd)

[fathom pendant]

¯_(ツ)_/¯

[dim wolf]

it's an example

[fathom pendant]

$(pwd) gives the output of pwd as stdin

[cloud urchin]

pwd is print working directory, and it's piping the working directory path instead of using the letters pwd when using pwd in the command

[fathom pendant]

$(<command>)

[dim wolf]

the question is asking you to use different approaches

[fathom pendant]

^

[dim wolf]

so just do your research

[heavy marsh]

I know what pwd does, I just don't see how that command works.

[cloud urchin]

https://tenor.com/view/bart-simpson-the-simpsons-pipe-bubbles-gif-14556539

[fathom pendant]

it takes the output of pwd and use that as the argument for ls

[uneven oracle]

I would really love to hear how others solved the last question on:
Getting Started > Knowledge Check

I have an initial foothold but cannot escalate privileges.
I get an error when attempting to import LinEnum.sh

(I eventually found a solution on Google, but wth? How would I have known that?

[fathom pendant]

look at the spawned webpage

[dim wolf]

"permission denied"

[heavy marsh]

Couldn't I just use ls -l since I'm already on that directory?!

[cloud urchin]

usually when you transfer a file over you need to chmod +x the file so it's executable

[fathom pendant]

also; you're in another user's home directory

[fathom pendant]

AS STATED EARLIER it was an example

[dim wolf]

they can't write to the file

[cloud urchin]

ahh yeah misread that

[fathom pendant]

because they're trying to write to a user's file that they don't have permission to

[dim wolf]

yea

[uneven oracle]

That wasn’t the issue…

[cloud urchin]

as a general tip /tmp is usually writable by all

[fathom pendant]

instead of maybe a world writeable dir, like /tmp/

[uneven oracle]

Right. That’s the first thing I had to do.
How would I have known?

[cloud urchin]

Experience

[fathom pendant]

it's general knowledge and experience

[uneven oracle]

What do you mean?
What’s on the page?

[dim wolf]

leave it to marcie to rip the words out of my brain

[fathom pendant]

¯_(ツ)_/¯

and tbh

[heavy marsh]

Okay, I looked at the solution to the restricted shells, it basically says GOOGLE IT?! lol

[fathom pendant]

you can get it w/o LinEnum as i believe up to this point you learned how to sudo -l

and other stuff

[dim wolf]

i just looked at the section and with the limited information that they give you, it's not really surprising

[heavy marsh]

Had nothing to do with anything in the actual module

[cloud urchin]

^ yup. sudo -l is the very first command i run when i connect to a linux box, always

[uneven oracle]

🙄
General crap. I wouldn’t know that lol…

[fathom pendant]

i mean up until that point they had you do sudo -l previously

[uneven oracle]

Figured that out…

[heavy marsh]

Yeah, the examples were pretty weak. I was already on hacktricks just looking at that instead. The one they link to is pretty good too though!

[fathom pendant]

and as well; it's basic Linux

[cloud urchin]

This doesn't apply to just Linux. This applies to any computer, any IoT device, everything. Certain users have permission to write to certain folders/files etc.

[fathom pendant]

I suggest going to the Information Security Fundamentals path

as they teach you the basics of Windows/Linux and some common stuff

[uneven oracle]

But then, how would you know what to do with that usr/bin/php folder?
Wth?

[fathom pendant]

Linux intro module though is a bit rough at points

[fathom pendant]

they give you a link to gtfobins in one of the sections

[cloud urchin]

you can use the ls command to show permissions

[oblique tusk]

Wow I do NOT need this kind of negativity in my life smh. nano works just fine for a lot of tasks.

[fathom pendant]

skill issued

[cloud urchin]

Targeted hate speech

[fathom pendant]

me seeing jared is talking 👀

[west canopy]

its completely normal to ask questions as your are reading the module's sections, or any of the information provided. Do not expect to just read a few paragraphs and completely grasp the information they are trying to convey. So do not hesitate to take a pause, google or ask ChatGPT your question, and then move on . This process takes significantly longer than just trying to copy/paste commands and get the flag, but its about the understanding. For example I am familiar with the basics of object oriented coding, but for this Intro to Binary Fuzzing module, i had to learn about all about C/C++ , pointers, memory allocation, freeing of memory, etc. Take your time, it is normal to ask questions . In fact i would argue that the more time you spend on a section, the better off you will be.

[fathom pendant]

^

[oblique tusk]

tbh I expected to catch more flack from someone who uses the emacs operating system.

[fathom pendant]

if someone uses emacs we just take them behind the barn, to see the rabbits

[vale island]

I would search how to use php in terminal

[dim wolf]

uff

[uneven oracle]

Not sure what you mean…

[fathom pendant]

that's not the point

[fathom pendant]

gtfobins is a popular site all about privesc through popular binaries

[dim wolf]

in the Privilege Escalation section
--> GTFOBins

[cloud urchin]

The man command is great. try man php

[west canopy]

I remember when I first started using Linux. When an error popped up I would just give up... until I realized, reading the error message often led to the solution to my problem

[uneven oracle]

How the heck would I have known to do this??

[fathom pendant]

https://gtfobins.github.io/gtfobins/php/

[fathom pendant]

gtfobins

[dim wolf]

GTFObins

[uneven oracle]

There is something on the page that would have led me there?

[cloud urchin]

bookmark that page you'll be using it a lot

[fathom pendant]

in one of the sections there's a link to gtfobins

i don't recall what specific section

but I know it's referenced in that module

[west canopy]

the ultimate skill is learning to ask the right question. Because the question IS the answer.

[uneven oracle]

Wow… I’ll review.
Smh

[vale island]

Modules dont give you all what you need, you have to search and it will get more and more as you progress, but you will get used to it

[dim wolf]

ripping this straight from the module

Once we find a particular application we can run with sudo, we can look for ways to exploit it to get a shell as the root user. GTFOBins contains a list of commands and how they can be exploited through sudo. We can search for the application we have sudo privilege over, and if it exists, it may tell us the exact command we should execute to gain root access using the sudo privilege we have.

[uneven oracle]

Hm… ok ok.

[fathom pendant]

https://academy.hackthebox.com/module/77/section/844
Subsection

Privesc Escalation checklists

[west canopy]

its tough because for people just starting out, most of the info stated during the section reading doesnt actually mean anything. As they do not have any context.

[uneven oracle]

Thanks for the feedback Gang…

[fathom pendant]

if there's a link, click it

even if it might not be useful NOW it'll definitely be useful at some point

[uneven oracle]

Yea, I skip most links…

[dim wolf]

yeap. i suffered too, but keeping notes helped here

[west canopy]

Yep, but a big issue is for beginners, a module might cover 5 brand new topics, each of which you try to research. But for every question you find the answer to, just leads to more questions

[fathom pendant]

if you're using parrot, i believe gtfobins is in the default bookmarks bar of firefox

if not i might bring it up with them to add

[uneven oracle]

I’m on Kali.
And got the official one now. 😉
Seems to be working smooth so far.

I’m gonna check out this gtfobins article. Thanks.

[fathom pendant]

gtfobins isn't so much an article

as it is a repository of knowledge

it contains a bunch of stuff with very little reading

https://gtfobins.github.io/

[west canopy]

Yes, basically one of the main ways to check for priv esc on Linux is to check for sudo permissions. See what programs the user is allowed to run as sudo. Depending on the program, if the user is allowed to run it with sudo (i.e. in the context of the root user) , there might be a way to use it to escalate to full root privileges on the system

[uneven oracle]

I see… so where is the answer for the usr/bin/php issue… 👀

[cloud urchin]

did you search php on the website?

[fathom pendant]

it's in the gtfobins php page i linked

[fathom pendant]

https://gtfobins.github.io/gtfobins/php/#sudo

[cloud urchin]

search the command, then look under the functions section to see how you can abuse the binary

[fathom pendant]

https://tenor.com/view/tolarian-community-college-kyle-hill-magic-the-gathering-i-hate-your-deck-reading-the-card-gif-22381436

you're not always gonna be hand-fed how to get the solution

[west canopy]

It could be under "Shell", or under "Sudo" . You might have to test several to find out

[uneven oracle]

Figuring out how to maneuver and understand this site… 👨🏽‍💻😒

[fathom pendant]

it's... not really that hard

search the binary

[west canopy]

its not a matter of navigating a website. It's a matter of asking the right question 😉

[fathom pendant]

if you're unsure which action applies to it just read the whole page and see what applies to your situation

[uneven oracle]

It’s hard for me Marcie… 😑
It’s like a new language.

[fathom pendant]

i mean you have a lead on what to look at

especially since you already got the answer

also

it's /usr/bin/php

the leading / is important

[west canopy]

just so you know, this it intended to be difficult .

all of the content here

[uneven oracle]

I’m getting it, I’m getting it…
At least I did crack the box myself this time. 😊

[fathom pendant]

yep

[west canopy]

even "easy" or "fundamental" content

[fathom pendant]

take notes

[fathom pendant]

imo; the worst section of the linux fundamentals is the one to get all unique paths on inlanefreight.com

[dim wolf]

THAT was BS.

[west canopy]

yea thats quite challenging for someone new to linux

[fathom pendant]

i believe it's partially because it comes before the filtering contents section

oh no it's because it's before Regex

which would vastly improve how people may derive the answer

[west canopy]

right