modules

[sharp nexus]

now after hitting forward once I get this

Is that helpful?

rip

[fathom pendant]

Sec

[sharp nexus]

I mean I'm getting the render tab now... it's not selectable but it's there...

[fathom pendant]

Worked fine for me

[sharp nexus]

wat

how

what'd your setting with proxy look like??

[fathom pendant]

After loading page and pressing forward I got the expected html source response

¯_(ツ)_/¯

I changed no settings

[sharp nexus]

^

I know, but what settign differences do you have compared to mine

[fathom pendant]

I just clicked enable under "response interception rules"

[sharp nexus]

bruh

[fathom pendant]

I didn't select any "or" options

And yes I used the same webpage you're using

Since it's a docker container

[sharp nexus]

confusion

[fathom pendant]

¯_(ツ)_/¯

I literally only enabled response interception and pressed forward once

[sharp nexus]

ok where's that box?

Do I have the selected??

[fathom pendant]

Looks like it

[sharp nexus]

bruh

time to restart burp

[fathom pendant]

¯_(ツ)_/¯

Like I said I messed with nothing

[sharp nexus]

oop

hold on

[sharp nexus]

..

brain hurty

bruh

i'm a dumbass omg

I enable the wrong checkbox

this

is not this

🤦‍♂️

Thanks @fathom pendant

[fathom pendant]

. you had this here

[sharp nexus]

oh wait

nvm, it's not fixed

confusion

[fluid granite]

Hi guys

[sharp nexus]

hola

[fathom pendant]

Try restarting burp and taking it from step 1

[sharp nexus]

ay carumba

[fathom pendant]

All you should have to do is enable request

After that it's just grab request, make quick edits, and boom, ez

[sharp nexus]

all I'm getting is that first page

not the HTML or anything

frustration

I mean the options aren't even saving after I exit burp and reopen it

[fathom pendant]

That's normal

Saving settings is for paying customers 🙄

[sharp nexus]

uuuhhh

wut?

[fathom pendant]

That looks like your IDE crashed

[sharp nexus]

rip my IDE

[fathom pendant]

O7

[sharp nexus]

aaaaaannnnnnddddd

nothin

[cloud urchin]

https://github.com/the-useless-one/pywerview?tab=readme-ov-file#json-output dacl attacks 2, i can't seem to output to json with pywerview. is there another argument i can use?

[fathom pendant]

works for me ¯_(ツ)_/¯

I really don't know what you could be doing differently

[sharp nexus]

wtf what am I doing wrong

[cloud urchin]

when in doubt reboot the box

[inner geyser]

So I've got a question about module 'Show Solution' documentation...basically wondering if my thought process is correct and if this should be corrected? At some point early in the module, you are able to obtain the Administrator PW. Then, towards the end of the module, one of the goals is to add the 'CT' user to the Domain Admins group.

So the last 2 questions are about obtaining the flag on Administrator's desktop and submitting the KRBTGT hash. It would seem to me the goal of adding CT's user to the Domain Admins group would be so that you can get the flag and krbtgt hash as the CT user. However, the documentation completely pivots from "cracker the CT user's hash" to "submit the contents of the flag.txt file on the Administrator desktop on the DC01 host"

Obviously you would have the option to use the Administrator user to get the flag and the hash...but does it make sense to anyone else that the payoff of adding the CT user to Domain Admins would lead to getting them? The 'Show Solution' gives you the Administrator user performing those tasks instead of the CT user.

[fathom pendant]

Open webpage; make sure proxy is enabled; intercept requests and responses enabled; refresh page

Are you hard or soft refreshing? (Ctrl+r vs ctrl+shift+r)

[sharp nexus]

I mean this isn't an issue that needs fixed now because it's not an intereactive portion of the lesson, but I can't follow along with the lesson if I can't recreate the steps they're taking to help me learn..

[sharp nexus]

?

I'm just clicking the refresh button

I dunno

[fathom pendant]

If domain admin they can see local admin

[fathom pendant]

Do ctrl+shift+r

Might be some cacheing in play bypassing the response

As said in the module/section

[inner geyser]

Yeah, had to edit the end of my question to hopefully make it make more sense? Since CT is an admin you'd think the solution would have you use that account...the but examples in the solution are using the administrator account...instead of the CT account that you just added to the 'Domain Admins' group

[sharp nexus]

Omg I think that was it

[fathom pendant]

What device are you adding the CT user to domain admins from, it's certainly not the DC

[sharp nexus]

yup

that's a fucking dumb browser thing, wtf, that's so confusing

[inner geyser]

Correct, i believe it was MS01

[fathom pendant]

Eh put it in #1234357888114364508 if you want clarity

[fathom pendant]

It's a soft reset (preserve cache) vs hard reset (clear cache)

Think how annoying it'd be for a large webpage to load if it wasn't cached

[sharp nexus]

that probably should've been mentioned in the lesson to be fair. I know it said to do ctrl+shift+r but it could've explained the difference

tis whatever, I understand now, so thanks again @fathom pendant

[fathom pendant]

Np

[regal cliff]

currently stuck on broken authentication, predictable token, i haven an script, shlod work, but dont know why is not working, need some help

[static roost]

Anyone having issues with NTLM Relay Attacks Skills lab? I completed it not too long ago but I'm going back to practice and the same method I used before leads to a timeout.

[trail flicker]

is their anywhare to ask question abt Hackthebox Main website

[shut quest]

Read #rules and #welcome , verify your account to get access to the rest of the server

[trail flicker]

Ty !

[worldly pagoda]

Not able to connect through HTB Academy VPN since yesterday. Is there any specific channel to seek help on such issues

[cloud urchin]

try re-downloading the vpn file, and if you've done that try another region

[hard lagoon]

Hi all - I'm doing the Active Directory Enumeration and Attacks module, and I'm up to the page Initial Enumeration of the Domain. I'm trying to use kerbrute to enumerate users with jsmith.txt, but I'm not sure how to get the text file jsmith.txt.

Do I need to do something to connect to the internet on the target computer?

[lavish mango]

locate jsmith.txt

[hard lagoon]

thanks mate you're the best

Was going down a big rabbit hole trying to figure out if I had to do something to pull it off github

[shut quest]

They did provide the github link for the files, so you could have.

[hard lagoon]

How would I go about doing that? I was trying to at first, but I couldn't figure out how to connect to the internet on the target machine to do that

[shut quest]

pull it down to your machine then scp/ssh/nc/wget/etc the file over

[hard lagoon]

ah ok thanks - I'll keep that in mind!

[inland sonnet]

Hello all, I have completed the module, UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK. I am currently doing the assessment and stuck on the last question for a few days.

What I have Discoved : I have discovered A chain of infection but cant seem to get further or trace back this chain to understand which .exe file is being asked for, So far I have understood that :
10.0.0229:8080(IP from which RandomFile.exe was downloaded by msedge.exe) -> Randomfile.exe -> rundll32.exe -> lsass.exe -> credentials dumped.

Question : What else should I search for in Splunk to find the Infection Source... Any Ideas or Suggestions? The idea is to find some exe that came before "Randomfile.exe"

[green basalt]

I have tried so hard that I have lost hope. Who can explain my mistakes to me?

footprinting-dns-Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{...))?

[acoustic owl]

Did you read the hint?

[green basalt]

yes

[acoustic owl]

Did you also try to perform a zone transfer for each zone?

[green basalt]

I have done a zone transfer to each other but i don't know if it is the right command

[acoustic owl]

send me a dm with your command

[green basalt]

🆗

[hexed lintel]

how to fix rdp black after connected

[autumn pilot]

by waking up the computer

[hexed lintel]

esc, enter space, nothing working

[shut quest]

somewhere in the box there's a button, click around

[civic locust]

@shut quest Hey. Can I DM you about burnout topic?

[stable bone]

naur

[shut quest]

i have no idea what you are talking about

[civic locust]

I've completed the cybersecurity path and now I don't want to study it anymore cause I forced myself to do it too hardly

Maybe you faced the same problem and can give an advice

[stable bone]

i have advice for you

https://tenor.com/view/do-it-what-are-you-waiting-for-determined-angry-gif-5247874

[civic locust]

Not funny at all

[stable bone]

https://tenor.com/view/monkey-rofl-lmao-lol-laughing-hard-gif-5525141812885180069

[shut quest]

step away, relax the brain, do something else

[civic locust]

For how much time?

[shut quest]

¯_(ツ)_/¯

[stable bone]

eat a bagel and go swing at the park

[acoustic owl]

In CyberSecurity, you will never stop studying. There will always be new technologies and opportunities.

[acoustic owl]

Burnout is a serious problem. You shouldn't take it lightly

[stable bone]

menace bunny im burned out on intro to networking im still here

[acoustic owl]

Take small steps forward. Learn something new every day.

[civic locust]

I understand that. I want to study, but my brain doesn't. I've planned to complete the course and exam within 2 months but now I don't know, whether it is possible cause when I see those articles once again I can only think about other things and procrastination. The question is, how much time do I need to relax to overcome this feeling?

[stable bone]

play some ranked and go yell at children you'll feel much better trust

[acoustic owl]

That depends on you. Nobody can tell you that.
Wanting to work through the course in two months is a very ambitious goal.
In my opinion, it's wrong to set yourself a time limit here. Do a little every day. But stay on the ball. This is probably much better in the long run, even if it takes longer. As soon as you set yourself a time horizon, you put yourself under additional pressure.

[stable bone]

brother its different for everyone its all up to you and how much time you need to relax... you know your potential and how much time you have just be responsible... or be like me and pop that adderall kekw

[shut quest]

but in all seriousness, it's healthy to take breaks from learning, it's healthy for repetition as well. No one can tell you how much rest you need. I take breaks from learning this kind of material for months at a time. Then the itch comes back and I go at it for 2-3 months, rinse and repeat.

[civic locust]

Sorry for asking maybe stupid questions, I am really confused because of this right now. Thank you.

[stable bone]

eat a snickers youre not you when youre hungry

[shut quest]

this is not a stupid question, and mental health is important

2 months for the CPTS path is faster than most everyone here. even 3 months is pushing it. it's a lot of material to cover even if you have been in IT for years

[stable bone]

https://tenor.com/view/on-god-no-cap-big-facts-dance-gif-25336254

[lavish mango]

I cycle between long periods of study and long periods of playing computer games to decompress. Been doing that for years. Mostly I suggest spending time outdoors and with friends and family. Eventually you will miss nerdy stuff. Watch ippsec videos every now and again to remember how fun it is. Enjoy music. Take good care of yourself. Get good sleep and exercise.

I enjoy switching to studying programming in periods. Learning C is really nerdy. I recommend the book Advanced Programming in the UNIX Environment.

Maybe go swimming in the ocean or lakes. Be in beautiful places. Relax. Have fun.

[granite dove]

I find my self with this crazy anxiety to finish what I started learning just to finish it and want to start something else. It’s a paradox -____-

[lavish mango]

Same here.

Listening to music really sparks joy for me. So go to concerts. Listen to loud favorite music. Relax.

Hell, go on a trip. See waterfalls. Go hiking. Stuff like that.

[granite dove]

Drop the nerd playlists I need to update my library plz and thank

[lavish mango]

https://soundcloud.com/x_j/sets/low-end-theory-podcast

[granite dove]

Thank you 3000

[zenith canopy]

Module - password attacks, Single Crack Mode is one of the most common John modes used when attempting to crack passwords using a single password list. It is a brute-force attack, meaning all passwords on the list are tried, one by one, until the correct one is found this paragraph is confusing, isnt this considered a dictionary attack?

[marble island]

ask ai

still confusing

Understand that you are only going to really learn how to use john by actually using it, so if these details sound daunting ,don't worry, if you can do the exercises and the skill assessment by yourself youre set

[fathom pendant]

Don't think about it too hard, if you want a correction #1234357888114364508

[marble island]

Yo i'm on the same module (again) password attacks

https://academy.hackthebox.com/module/147/section/1327 in this section they introduce crackmapexec

Crackmapexec has been archived in their github repo

[trail egret]

Hey , I just started CPTS Path

Why am i not allowed to text in #general ?

[next bronze]

https://github.com/Pennyw0rth/NetExec

[marble island]

Thank you!

I was about to send that link and ask if i should use this

[next bronze]

yes, it's the up to date fork

[marble island]

Are yall updating the module?

I'm out, continuing the module using netexec

[regal cliff]

Nobody?

[dry halo]

hey from the past few days I am unable to connect to the HTB VPN using openvpn. The internet connection is fine on my VM
It stops at establishing TCP connection. I tried changing regions and also the protocol

[uncut ocean]

Reinstall openvpn

[dry halo]

I tried that too 😦 no luck

[next bronze]

#modules message

[fathom pendant]

Read and follow #welcome

[shadow cradle]

the vpn works on your main host?

[fathom pendant]

Message support

[regal cliff]

Thank you so much🙌🏼

[dry halo]

nope 😦

[shadow cradle]

what I would do on my machine is to check the routing table and see if you can reach correctly the vpn endpoint.

[dry halo]

I am currently checking my firewall to see if I accidentally blocked anything

[shadow cradle]

from the vpn config file you can dump the ips and port where it's trying to connect

[shadow cradle]

you can also check with wireshark if you vpn handshaker exit correctly and if you receive any answer

[dry halo]

Thanks for the help I will check them

[shadow cradle]

you're welcome 👍

[dry halo]

only SYN

[winged egret]

hello guys , In the local file inclusion skills assessment... I managed to get RCE a few times however after refreshing the server several time its still getting frozen when I try to execute commands can som1 help ?

can I dm som1 who has completed this

[shadow cradle]

if you do "ip route get <vpn endpoint ip>" which interface is hits

then if you can't ping it you can try a traceroute to see if there is something in the networks

if so maybe it's a problem with the generation of your certificate and support would be the best option imho

[dry halo]

yes the packet just get timed out. I will reach support

[shadow cradle]

sorry we couldn't land anywhere better eheh

[dry halo]

Thanks for the help anyway

[olive slate]

in module Attacking Enterprise Networks - Active Directory Compromise, how can i authenticate to the domain controller? Rdp is not listening and i tried winrm but it didn't work. Is there other ways or did i miss something

Wait nevermind, i tried to pass the hash with evil-winrm and it works

[hexed lintel]

i am currently in password attack module, Password mutations section ,
||hydra -l sam -P mut_password.list ssh://10.129.68.44||
it is taking forever to get the correct credential

am i doing something wrong or this is normal

[dry halo]

try a different protocol may be there is a password reuse

[granite dove]

☝️☝️☝️ and good luck

[fathom pendant]

I mean don't forget about increasing threads

The default amount is so slow

[iron ibex]

Hello,
I am in module Linux Fundamentals section "Filter contents".
I have successfully answered this question :
Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

I used this command to find the answer :
|| curl https://www.inlanefreight.com | grep -E "https://www.inlanefreight.com\\S+" -o 2> /dev/null | tr \" ' ' | tr \' ' ' | cut -d' ' -f1 | sort | uniq | wc -l ||

My intuition is that it feels really too complex (for example regular expressions are not supposed to be known yet at this point) so I was wondering if there was a "basic/easy" solution ? 🤔

[hexed lintel]

its been more than 1hr, using -T 64 , still no result

[fathom pendant]

Use 48

64 is often too much and causes packet loss

And you often skip over what the answer would be

It should take roughly 30 minutes give or take

[fathom pendant]

This is intended to be a hard question, I looked at the forums for this one

There's one forum answer that describes the commands they used

I believe I've shared it in this channel before if not it's not too hard to find

[iron ibex]

OK I was wondering if I had missed anything that would make it very trivial (for example a curl option)

[fathom pendant]

Yeah it doesn't help that RegEx is after this one

The other thing you can do is copy the source code and ask chatGPT after a few nudges it provides the right answer

But it can't give you a curl command for it

Goofy aaah gpt

That's for a diff module

Once you get to the module my command references you'll see how it makes sense

But yeah I would say that the curl question is the toughest one as it requires knowing how some commands work, as well as knowing html coding (src= and a href=)

[zenith canopy]

Guys how do i install crackmapexec on debian

[dim wolf]

if you want cme get netexec instead

[zenith canopy]

what is netexec?

[dim wolf]

the successor to cme

it's just cme with a different name

[zenith canopy]

thanks, is the syntax same as cme?

[fathom pendant]

Yes

It's a fork of CME as the main people holding up the codebase had some disagreements with the original author (to put it mildly)

Name was changed to avoid confusion

[zenith canopy]

Thank you guys, ive downloaded it

[primal drift]

New module with C2 wow
Is it collaboration with LockBit?

[sly nebula]

Has anyone done the DACL Attacks II skills assessment? I am stuck on the first question. I'ìll share what I have tried.

[fathom pendant]

I mean the module description and announcement would say if it was

@sinful elbow I don't accept random dms, what do you want

[stable bone]

@sinful elbow yeah geez bro smh

[naive egret]

Hi guys, I'm stuck on a question in ACL Enumeration.
The question is -
What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)
Tried lots of things but none seem to work. can somebody give me a hint or something?

[dry halo]

my ISP IP probably got blacklisted lmao. I tried connecting with a different connection

[dry halo]

get the sid of the user and use the domain object acl command with whatever group you want

[acoustic owl]

If possible, skip the Proton VPN connection. The speed will certainly not be faster this way

[jaunty vigil]

hey anyone can give me a hint on sliver skills assessment first flag?

[dry halo]

The thing is the original IP is not connecting to HTB. the support asked me to test with an different connection. It's just a test. no way I am gonna use like this

[acoustic owl]

As long as it works, you can use it as it is. But a VPN connection through a VPN connection is usually much slower.

[dry halo]

absolutely yes

[wanton idol]

bros gonna be waiting an hour for a nmap scan to finish 😭

[sleek epoch]

Hey guys, is anyone hiring in 🇩🇪 Germany, into ai/ml? I have someone who is talented enough looking out for opportunities. If you have or know someone kindly let me know. Thanks once again!!

[haughty tree]

Hey so in the Passwords Attacks module under the Password Mutations section we are asked to create a mutated wordlist and use that to find credentials for SSH, my question is, is that suppossed to take a lot of time? I know cracking attacks take time but usually we get a small wordlist/ a word early in the wordlist gets chosen so it does not take a lot of time to get the answer to questions.

[limber river]

it will take a very long time

[haughty tree]

Okay, thanks

[fathom pendant]

You're not gonna get an answer here, read and follow #welcome there's a #careers-and-certs channel as well as #job-postings

[fathom pendant]

Don't attack ssh

Scan the target and see if another protocol would be better to attack

Ssh is an extremely slow protocol for hydra/cme/nxc to crack

[haughty tree]

Yeah true

I thought about maybe trying to find another serivce and trying that but I ended up being like "nahh I can wait" but i'll try

[fathom pendant]

48 is the magic number of threads for the service

[fathom pendant]

Also if you're waiting for ssh, it could probably take longer than the target lifetime

You'd have to constantly extend the lifetime until max and pray

The logical thing is;
See ssh would take forever
Think that there must be another way
Scan

[haughty tree]

It was about to take like 2 hours

So I just extended the lifetime a bit and it was enough

but yeah

[main bolt]

Hi is anybody created htb machine on hackthebox and submitted it to them

[fathom pendant]

Not the channel bro, read and follow #welcome and you should be able to access more channels. Though you might have to just ask in #1024429874246590575

[candid night]

Hey, so I can't really grasp the concept of running a shell in a context of a different user. How does that differ from just using the victim's account? Say I got a NTLM hash. Why does mimikatz start a shell in the context of a user and not just log-in with it to the account?

I know that hash is not a password, but we still use it to authenticate as an account so what is the difference under the hood?

[next bronze]

wdym by login? mimi opens a shell as the user, it is logged in as the user

[eager ledge]

I had the same question. The answer I got was "since you access the contents only that user is allowed, you know you are working on the context of that user"🙄

[eager ledge]

If I remember correctly, I had tried whoami command on the shell, and it still gave the previous user, not the one on whose context the shell was running. @candid night can you try the command?

[candid night]

Per my notes from the PtH section - after authenticating to a user and executing a cmd.exe with this command
mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit

"Now we can use cmd.exe to execute commands in the user's context. For this example, julio can connect to a shared folder named julio on the DC"

And now, when I'm working on kerberoasting the same separation of using a domain account and using a shell in the context of a domain account appears

[strange forge]

Anyone who passed the CPTS certification, are the user/pass list from different modules beneficial in the exam?

[fathom pendant]

The NTLM hash is derived from a user's authentication

So it, in essence, is the user's login

Yes rc4 is the same

[candid night]

I'm not in the section about it right now but I tested the same thing that you did and I also had the same results

[fathom pendant]

It's weird visually

The point is, since the command actually ran successfully-- it worked and you're in the cmd prompt as that user

Otherwise mimikatz would throw some error at you

I do agree that the text could be clearer about it

[candid night]

'Aight, so essentially. "running a shell in the context of a user" just means "running a shell as the user". Meaning, when we do a PtH with mimikatz we just get a shell that is the same as we would get if we knew clear text password and just sshed to that user?

[fringe urchin]

Yea you get the perms from the user but it still shows as the prev user. A bit wierd. I was confused aswell till supernuts explained it
#modules message

[fathom pendant]

Basically, yes

You basically (for all intents and purposes) are the user you pass the hash with

[umbral merlin]

MimiKatz impersonates the user by using their network token letting you use it for network authentication but when you run whoami, that is not network authentication so it shows your local user on the shell and not the person you are impersonating

[candid night]

Okay, thanks a lot guys. That cleared a lot of confusion for me

[eager ledge]

Thats interesting. Is there any way I can determine which user I am impersonating, may be some commands?

[umbral merlin]

run "klist" and it shows it edit: only works if u have a kerberos ticket

[eager ledge]

Thanks!

[next bronze]

klist only works if you have a kerberos ticket

if it's ntlm only it won't show

but generally pth is best used from a linux host or a c2

[umbral merlin]

ah ur right, forgot about that

[stark lark]

CPTS -> Information Gathering | Web Edition
https://academy.hackthebox.com/module/144/section/1257

I'm trying to automate virtual host discovery but seems like I get all output from the command, for each name, however in the guide it only shows those that are valid.

ffuf -w SecLists/Discovery/DNS/namelist.txt -u http://10.129.254.237 -H "HOST: FUZZ.inlanefreight.htb" -fs 612

[sleek moss]

why dont this work
┌──(sam㉿kali)-[~/Desktop]
└─$ gobuster vhost -u inlanefreight.local -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50 -k -q
Found: 1 Status: 400 [Size: 436]

Attacking Common Applications - Skills Assessment II

[stark lark]

Can you provided som more insights? Also, what is the purpose of vhost in your cmd? Mode?

Have you added the domain to you dns /etc/conf file?

[sleek moss]

i aded it to /etc/hs10.129.78.178 inlanefreight.local

10.129.78.178 inlanefreight.local
to /etc/hosts but none of the vdomains pop up

to get subdomains

i ltierally copied it from the answer solution

cause ik the freaking answer was in ther and it still not work

[stable bone]

i have a question

about cyber things

[haughty tree]

try adding the --append-domain flag at the end of the command

[haughty tree]

Don't we all

[stable bone]

can you help me with my questioin about cyber things

[dim wolf]

why don't you just ask the question

[ocean night]

https://dontasktoask.com

[fringe urchin]

Can i go to the toilet?

[ocean night]

Well.. can you?

That's a question only you can answer

[fringe urchin]

idk thats why im askin

[ocean night]

Off topic, ability to go to the toilet is not covered in Academy modules, sorry.

[fringe urchin]

💀 ok let me go to oscp and pay 1000€

[autumn pilot]

Do you still need help?

[fiery berry]

did you copy and paste the command?

[stark lark]

Yes but ofcourse - changed the necessary parameters such as IP and domain + wordlist location

[fiery berry]

but not the length, am I right?

Well, it's the same as the one shown so the answer is not

[stark lark]

My cmd:
ffuf -w SecLists/Discovery/DNS/namelist.txt -u http://10.129.254.237/ -H "HOST: FUZZ.inlanefreight.htb" -fs 612

Academy:
ffuf -w ./vhosts -u http://192.168.10.10 -H "HOST: FUZZ.randomtarget.com" -fs 612

I mean maybe the output is correct but I dont think I'm supposed to be spammed completely with requests

[fiery berry]

No, you didn't get what I said. Could you please check again the response length for a non-existent domain?

Are you completely sure it's the same as shown from the command you copy/pasted?

[stark lark]

You are referring to fs 612... correct?

[fiery berry]

Indeed

Even from the screenshot you pasted I can see something different

[stark lark]

Yes, they respond with 200 but from what I know that means it is accepted/open right?

[fiery berry]

The 200 OK means that the request is successful it doesn't say that the domain exists.

Can you check the response length of a false positive?

[stark lark]

Hmm considering there is so many 200's, they can't all be valid, so could it be false positives?

[fiery berry]

Sorry I need to repeat myself, the response length not the status code. The option fs in ffuf is to filter response size as the man page says.

Now, are you sure 612 is correct?

[stark lark]

Thanks! Got it now. I still get a lot of info, do you know why? Almost if I had verbosity enabled.

[fiery berry]

remove the screenshot please is not needed

[granite idol]

Hey I'm fairly new to HTB and pwnbox in general. I'm doing the Detecting Windows Attacks with Splunk module because I'm trying to get as much practice in with Splunk as possible for my BTL1 cert exam and one problem I'm having is that it tells me to:

"Let's now navigate to the bottom of this section and click on "Click here to spawn the target system!". Then, access the Splunk interface at http://[Target IP]:8000 and launch the Search & Reporting Splunk application. The vast majority of searches covered from this point up to end of this section can be replicated inside the target, offering a more comprehensive grasp of the topics presented."

The problem is that I don't see a target ip anywhere in the module. I know that typically I can get to Splunk with 127.0.0.1:8000 but doing that in Mozilla in the Parrot OS lab doesn't seem to work and I'm trying to workout where I'm going wrong and no target ip seems to be listed anywhere in the module...
tying "sudo systemct1 start Splunkd" in the parrot terminal doesn't seem to help either as I get a "Unit Splunkd.service not found" error

[dim wolf]

Pwnbox doesn't have Splunk installed. you need to spawn the target and connect to it

scroll down to the bottom of the section, click on "Click here to spawn the target system"

[granite idol]

Yeah I did that

[dim wolf]

once it's ready, you'll get an IP address and port

connect to that in your browser on the Pwnbox

[granite idol]

I'll try it again, mustve missed the ip address and port

[dim wolf]

or connect to it with your own VM

[fiery berry]

Just one last advice do not copy and paste blindly 😁.
This should be valid for everyone really.

[granite idol]

Ah thanks, I think I realize what I did wrong now, definitely user error as usual hah

[fiery berry]

I'll dm you about the filtering since I can see only valid sdomains listed.
Remember to filter by size with -fs.

[stable bone]

hey chat i have a question

[barren timber]

Hey french are here?

[fathom pendant]

?

[fathom pendant]

https://dontasktoask.com

[stable bone]

can i ask a question?

[stable bone]

uoi uoi baguette

[fathom pendant]

Just ask it nerd

[stable bone]

is name calling your love language

awww you lil silly flirt you

[fathom pendant]

It's how I express frustration

[stable bone]

damn 💀

[fathom pendant]

Usually before I actually block 😄

[stable bone]

what no we've been through so much 😭

[fathom pendant]

Yeah, and I was nice enough to do it free of charge

[stable bone]

:(

well

are you nice enough to do it one more time bro

[fathom pendant]

Fuckin ask your question I swear to God child

[stable bone]

child??? im older than you?? ... i think maybe...

[fathom pendant]

Doubt that

[stable bone]

im 20

[fathom pendant]

27

[stable bone]

https://tenor.com/view/dead-my-honest-reaction-damn-skull-skeleton-gif-15885937969029652188

anyways why does binary now have letters in it in the IPv6?

[fathom pendant]

Because IPV6 uses hex

[stable bone]

so would all the rules we learned yesterday be the same? (like range and broadcast address)

[fathom pendant]

2 rules of IPv6
You can short any string of 0000:0000:0000 to :: once, and you can omit leading 0s

[fathom pendant]

IPv6 doesn't use broadcast

[stable bone]

idk wdym by "::"

[fathom pendant]

Most practical application of subnetting occurs within IPv4

AAAA:0000:00000:0000:0000:0000:0000:BBBB is shortened to AAAA::BBBB

[stable bone]

but what about the 1s?

[fathom pendant]

Brother

[stable bone]

thing

[fathom pendant]

If you wanna calculate the binary for hex values, be my guest

[acoustic owl]

https://networklessons.com/ipv6/shortening-ipv6-addresses

[stable bone]

hey hey the intro lesson says asking the right questions is a sign of wisdom and intelligence

so basically im fuckin ghandi

[fathom pendant]

Yeah, but you're converting a VERY large number

[stable bone]

or einstein

[fathom pendant]

Remember 1111 in a hex system means
1 x 16^3
1 x 16^2
1 x 16^1
1 x 16^0

As you can see, hex numbers get very big

[stable bone]

so it uses 4 bits?

[fathom pendant]

Way more

[stable bone]

but 16 means 4 octets

[fathom pendant]

16 bits

And nope we aren't in octets anymore

FFFF = 65535 = 1111 1111 1111 1111

[stable bone]

where tf did you get F from

[fathom pendant]

That's hex baby

IPv6 is written in hex

It's 8 sets of 16 bits

128 bits total

Compared to 32 bits of IPv4... it's exponentially larger

Hex uses 0-9 then A-F which represent 10-15

[stable bone]

ok but why use IPv6 instead of IPv4 whats the difference?

[fathom pendant]

Much more space

Because of the limited space of IPv4, IPv6 was invented

[stable bone]

wdym limited? doesnt it have like 4.3 billion combinations??

[fathom pendant]

Lmao and that's not enough

[acoustic owl]

https://www.juniper.net/gb/en/research-topics/what-is-ipv4-vs-ipv6.html

[fathom pendant]

Consider; how many humans exist

[stable bone]

bro menace bunny got all the connections

[fathom pendant]

Or just used google

[stable bone]

not more than 4 billion 😭

oh wait

[acoustic owl]

Google is my friend 😉

[fathom pendant]

Brother

[stable bone]

go easy on me its 2200

10pm for you simpleton americans

[stable bone]

i wanna be a fwb with google ong id be rich fast as fuck

[compact patrol]

https://letmegooglethat.com/?q=What is the difference between IPv4 and IPv6?

[fathom pendant]

Blocked

[stable bone]

THERES A GOOGLE COMMAND THAT IS FIRE

[fathom pendant]

You're fired

[stable bone]

you dont mean that

[fathom pendant]

Cooked

Roasted into a congratulation

[stable bone]

marcie what are you on rn 😭

i need wtv youre smoking fr

[fathom pendant]

You need to focus

Fuckin 5 second attention span headass

[stable bone]

my adderall wears off around 3pm every day

sometimes sooner

[fathom pendant]

Learn constructive ways of managing it then

[stable bone]

and im on 40mg xr daily

[stable bone]

nahhh i got a 5head

[fathom pendant]

meds only get you so far ¯_(ツ)_/¯

Anyway

[stable bone]

you sound like my mom rn 😭

[fathom pendant]

Well maybe she got a point

[stable bone]

nah she pisses me off

[fathom pendant]

The sooner you learn to manage yourself without meds the better off you'll be

[stable bone]

last time i tried to be off of them i got into a car crash and broke ribs so no thx im ok

[fathom pendant]

Such as, not saying everything that comes into your head

[stable bone]

I DONT??

[fathom pendant]

Didn't say to quit them headass

I said manage when you're off them

You should never drop prescription meds flat out without consulting your doc

[stable bone]

alr gn im going to bed

[granite idol]

So I'm at the beginning of the Detecting Windows Attacks with Splunk module and I gotta admit my Splunk skills are coming up short on the same question. It's wanting me to modify the search so that it'll show all process names that made LDAP queries where the filter includes the samAccountType=805306368 so that I can enter the missing process name from a list given in the question.

I've tried adding "AND ProcessName" to the search filter, tried to specify the names of the relevant processes of it and I've also tried adding Event Id 1644 (seeing as Event 1644 is the LDAP performance monitoring log) to the top line of the search query but none of this is working.

I'm not wanting anyone to give me the answer, I'm just wondering if someone could give me a hint that would put me in the right direction for solving it...

I'm definitely not equipped to help with that directly but I would say maybe be quite specific about what you're asking for with it? You're more likely to get responses if it doesn't come off as a "please do my homework for me" type of request if you know what I mean....

[dim wolf]

it looks like your modifications to the query only make your results more restricted

[granite idol]

Yep, the default query has one result and whatever I do it seems to result in zero stat responses so I'm definitely not going about it the right way

[dim wolf]

look at what the query is, and see what it is that's restricting the results

the obvious freebie is the timeframe but you will need to modify it further

[granite idol]

@dim wolf thanks, I think I need to take a small break and look at it again later. At least the more time I spend with Splunk in general the less foreign it'll feel in the BTL1 exam

[onyx halo]

👍

Probably vm mem management... Not sure why it would jump from 0x0000... to 0x5555...

[fathom pendant]

Just how mem works my dude

[final kite]

i need help on this one One of the pages you will identify should say 'You don't have access!'. What is the full page URL? Skill assesment web fuzzing i fuzz with all 3 vhosts i got but i get ton of pages not sure how i should find the one i need

[fathom pendant]

I believe you can filter content with ffuf to have that string

Also don't forget the file extensions

[onyx halo]

why would it operate in so much higher range 0x00005555511b0 and then jump down to much lower range od addresses: 0x00005555555551b0

[final kite]

but how do i know which page to choose from bunch of them i get

[fathom pendant]

¯_(ツ)_/¯

[fathom pendant]

Brother

There should only be one response from the right subdomain, extension, and response text

If you're getting too many, maybe you're at the wrong spot

Make sure to be recursive

Oh and don't forget the size

Remember with ffuf
f is filter out
m is match

[final kite]

would that mean filter out ones with size: 0 bcs i keep getting those

[fathom pendant]

What does your match string look like

Including flag

(Flag is argument tag)

[final kite]

ohh mb

so i gotta include like match for HTB{

[fathom pendant]

No

What does the question say you're looking for

[final kite]

oh riht

[fathom pendant]

I'm meaning flag in the context of running a command, a flag is also known as an argument

[final kite]

you dont have acces to

[fathom pendant]

It's case sensitive

But also, show your command where you have the string

Including the -argument

Technically it's matching regex

[final kite]

u mean this one part ? -mr "You don't have access!"

[fathom pendant]

Yep

Try with single quotes instead

Also, you do need to be recursive it's not at http://subdomains.inlanefreight.htb/file.ext

[final kite]

ye i put all that

it just takes so long

[fathom pendant]

It'll take a minute

Here's another hint, use the subdomain that you found all the extensions for

[final kite]

smart

[fathom pendant]

Your -e is revealing an answer btw

[final kite]

oh bm

[fathom pendant]

Also. Turn on verbosity

Whenever you do recursion, verbosity helps

When you run it btw, is your ffuf requests dropping really low? If so, try changing to bridged networking in your vm

Something with NAT and your router causes issues

[final kite]

i am doing it in their instance

[fathom pendant]

Ah

Then it should be fine

[final kite]

library gonna close soon

hope i can find it

[runic inlet]

hello everybody
can someone help me with ssh-keyggen, a day ago i generated keys and imported to authorized keys, it worked properly, but when the machines reseted it required me to regenerate the keys again to connect back, but this time its prompting me to the password

[fathom pendant]

what module?

[ocean night]

If the machine was reset, you'd need to add your public key to the authorized keys file again. A reset means the machine is restored to a "clean state"

[runic inlet]

i added my keys again, chmod 600 authorized_keys, still not working

[fathom pendant]

Well chmod 600 authorized keys won't do anything

You need to use the id_rsa to sign in

[ocean night]

Ah.. yeah, if using pwnbox the id_rsa would not be there any more..

Question is then, are you using Pwnbox, and if so do you still have the same instance as last time you worked on the machine?

Which port are you listening on?

Oh

You said Kali.. you forwarded the port to an external IP?

Module instances are hosted on public IPs and ports. In order for the module instance to reach your Kali instance you're running locally, you'd need to expose your Kali instance (port 80) to the internet

Hm ok, nevermind then. So the Kali machine is connected to the VPN, and you can reach the target from you Kali VM?

No if the target is on a VPN you shouldn't need to

Perhaps try a different port, like 8080. I'm not fully up to date on firewall rules for those instances, but it's worth a try.

So you'd connect back to your VPN IP from the module instance (which I guess you have a shell on)

I should be in bed, I'm gonna regret this.. hit me up in DMs

First time I've had that reaction

Thank you

No come on, let's do this

One more problem solved before sleep

otherwise it'll tick me off lol

o_0

You sure you're not still on the kali vm lol

Otherwise gg

Sorry, dumb question, but gotta ask them

Noice

nn then 😄

Rubber ducky debugging 🦆

Cheers!

[twin ocean]

I am doing the Windows Fundamental course. Is there a plan to update it with info on Win 11 in the future?

[next bronze]

windows still work the same between 10 and 11, there's not really much to update for fundamentals

[ocean night]

Ahhhhh 😄

A facepalm sometimes feels good.

[proud pine]

In a business setting for servers, you are mostly going to be dealing with Windows Server, rather than 10/11. Still, even if your scope includes workstations, the content of the CPTS course should be fine for both 10 and 11.

[ocean night]

They just added one

/s

[runic inlet]

i didnt just chmod authrorized_keys, of course i added keys into to it then i did

[fathom pendant]

Classic PEBKAC

[fathom pendant]

Well yes but you still don't use the authorized_keys file to ssh with an rsa

You use your private rsa key

Problem exists between...

[runic inlet]

the thing is i connected to this machine before, i know how to connect by ssh, but the problem is i use the same technique i cannot connect

[fathom pendant]

Idk how you used the authorized_key file to connect

[fathom pendant]

Also what module are you working on again?

If it's a #starting-point machine or lab #boxes you're in the wrong channel

[runic inlet]

i genrated keys by ssh-keygen, i copied key.pub to authorized_keys in htb machine

[fathom pendant]

Yes and you use your private key to ssh in

That's how ssh keys work

[runic inlet]

yes i did, it worked

only in my first attemp

[fathom pendant]

Again though you're not answering my initial question

what module are you working on

[runic inlet]

its box

[fathom pendant]

Then wrong channel

[fathom pendant]

.

If it's a starting point machine: #starting-point
If it's a regular box: #boxes

This channel is and the other academy channels are for assistance with HTB academy. This one in particular, is for the academy learning modules

[stray prairie]

does anyone able to spawn a target machine for this module INTRODUCTION TO WINDOWS EVASION TECHNIQUES

[ocean night]

For Assessment 1 or 2?

In fact, for which specific section?

[stray prairie]

I was able to spawn now it was just slow.

[ocean night]

Yep.. it can take some time for instances to spawn, especially Windows instances

Good hunting 🙂

[stray prairie]

just wondering, will HTB release more for evasion modules ?

[cloud urchin]

Working on AD Trust Attacks, Trust Account Attack section. It's asking me to proxychain ssh into the DC which I can do without issue, the problem is when combining proxychains with ssh it seems to stop scrolling the screen. so when I run a command like mimikatz it just updates the last line on the screen making it impossible to read. is there a way to make it scroll or do I just need to use tmux and log it all or something?

[sterile epoch]

Hi I am in windows priv escalation module miscellaneous section, I am trying to do CVE-2019-1388 but i cannot get the browser to open as SYSTEM is it patched in this target?
I did right click on hhupd.exe tool and run as admin > clicked on the hyperlink and then tried to view from task manager but the user column was empty

[cloud urchin]

it's not patched

[normal sand]

Could someone please explain what this means?

Note: If you are using Impacket tools from a Linux machine connected to the domain, note that some Linux Active Directory implementations use the FILE: prefix in the KRB5CCNAME variable. If this is the case, we need to modify the variable only to include the path to the ccache file.

Module: https://academy.hackthebox.com/module/147/section/1657

[cloud urchin]

The FILE prefix in the env indicates the Kerberos credential cache is stored in a file. Without the FILE prefix the variable directly points to the file path of the credential cache.

[normal sand]

I'm afraid I still don't get it 😅
Could you please provide an example?

By FILE prefix, do you mean KRB5CCNAME?

[cloud urchin]

KRB5CCNAME=FILE:/tmp/krb5cc_0 means the credential cache is located at /tmp/krb5cc_0, and the prefix FILE: specifies the storage type.

KRB5CCNAME=/tmp/krb5cc_0 simply specifies the file location without indicating the storage type. Some tools (like impacket) may require the path without the FILE: prefix to function correctly.

[normal sand]

I see. Thanks, that was very helpful.

[cloud urchin]

no, KRB5CCNAME is the variable itself

it's the environmental variable

the FILE prefix would be part of the value of that variable

i think you got it though

[normal sand]

Got it 👍

Yup, thanks.

[shut quest]

Based on title alone I would assume they are

[cloud urchin]

gimme dat edr evasion module

[quick ingot]

Need help in Advanced SQL Injections skills assessment. Anyone free?

[sterile epoch]

?

[vernal falcon]

Hi im currently going through the pivoting module, at the rdp and socks section you need to transfer SocksOverRDP binaries to the target. the target identifies the binary as a virus and immediately deletes it. anyone knows how to solve?

[sterile epoch]

try using ligolo

[sterile epoch]

btw can you send the link to the section so I can look up what u are asking?

[vernal falcon]

https://academy.hackthebox.com/module/158/section/1439

[sterile epoch]

are you talking about the dll file for this regsvr32.exe SocksOverRDP-Plugin.dll command??

[vernal falcon]

yeah

[sterile epoch]

I am spawing the machine wait a sec

[unique remnant]

I think I posted my question to a wrong channel accidently earlier:
can someone who has active Pwnbox give me the Powesrhell version number from $PSversiontable? Thanks

[autumn pilot]

is there something preventing you from spawning it

[sterile epoch]

disable the defender

[oblique sedge]

hello not having access to the pwnbox channels I would ask my questions here if that suits you, I have a problem with my virtual machine and also that of hackthebox I cannot manage to 'fatal: unable to access' https:// github.com/Hackplayers/evil-winrm.git/': Failed to connect to github.com port 443 after 130180 ms: Couldn't connect to server" how to resolve this problem thank you for your understanding moreover being French and to facilitate me the task reply to me by pressing the arrow above a message to mention it

[vernal falcon]

oh ty i thought its off but the real time was on

[sterile epoch]

go to #welcome and follow the steps

[oblique sedge]

I'm in the process of doing this but can you please help me in the meantime?

[sterile epoch]

is it related to academy or main boxes?

if its academy stuff can you send the link to the module

[oblique sedge]

https://academy.hackthebox.com/module/18/section/72

I try to download evil-things for the optional exercise but I can't do it all the time, errors even with the different download methods

[unique remnant]

maybe you can remove the whitespce from the address before github?
also check out whether you can access any other githubpage

[oblique sedge]

what is "whitespce", how to find projects with the possibility of downloading them thanks to git clone thank you for your help I am just starting out with cyber security and I have never used github

[unique remnant]

remove the SPACE character from the address

[oblique sedge]

I'll try I'll tell you again

[oblique sedge]

so regarding my problem I fixed it on my personal machine in any case, I just had to generate a github token and that fixed everything

[flint ore]

Hi everyone!
Can someone give me hint? I'm stuck on DACL I Attacks Modules - Granting Rights and Ownership.

We have access to lilia account, she have owns rights on Manager group. I try abuse with owneredit, but have some issues:

BH show edges:

And if check DACL rights on chap user use Managers with lilia creds, we detect WriteOwner rights:

Task:
Lilia is owner of the Managers group; abuse her privileges to gain access to the shared folder \\DC01\Managers and submit the contents of flag.txt as the answer.

[hallow fable]

fuck

it

[flint ore]

[snow ridge]

If I remember right, you can be owner of the group but you might not be group member. So check that. I have notes about this but currently not on my computer

[flint ore]

Yes, i'm not in group. I try add lilia in Managers group via net rpc group addmem 'Managers' lilia -U inlanefreight.local/lilia%DACLPass123 -S 10.129.205.81 but access denied and other users i can't add to group

And via addusertogroup.py can't add user:

[snow ridge]

I just checked and the owneredit should work

[flint ore]

Can you show command?

[snow ridge]

I just noticed it, your target is wrong

Otherwise its right

[flint ore]

May be i just use owneredit with target chap?

[hexed lintel]

smbserver is not running , any solution

[flint ore]

Try -smb2support share .

[flint ore]

May be some problems in impacket packages?

[hexed lintel]

how to find the problem related to impacket packages

[civic oar]

hey

anyone could help me with task 3 of getting the password of ftpsql in the NTLM Relay skill assesment?

I have a clear text cred for a local user called sql_ftp_test but I have no access with that account to any share

[limber river]

try to use impacket-smbserver

[hexed lintel]

now working
what was the reason for not working in my screenshot

[limber river]

it seems like this is lib not binary (not sure tho)

[sweet girder]

Hi everyone. I have a question. I'm actually following the module "Setting up" and I just read the section "Organization", but I'm scared to not remember all the organization this section talk. Any advice ?

[normal sand]

Take notes on the important stuff (applies to all modules).

Anything you're afraid you won't remember and may need in the future, take notes.

[sweet girder]

Okay thanks !

[zenith canopy]

trying to connect to the host using evil winrm

[lavish mango]

https://forum.hackthebox.com/t/evil-winrm-error-on-connection-to-host/257342/3

Always check GPT, search engine, Discord, and the HTB forum. When it comes to Academy you'll likely find your answer this way.

[strange forge]

In the attacking common applications under PRTG Network Monitor section. the reverseshell is not executing commands.

[inland sonnet]

Why is the Connection being refused? I am using attackbox to connect to the target.

[hexed lintel]

module is teaching about Pypykatz
now mimikatz is available on linux also,

so any recource to learn mimikatz in linux

[autumn pilot]

does the machine have port 22 opened

[inland sonnet]

I believe it is, because we are required to connect to the kali machine to solve this module
https://academy.hackthebox.com/module/176/section/1778
The target is spawned, I can even rdp to the windows machine, but cannot ssh to the kali one.

[autumn pilot]

If you are going to use the kali machine just to crack the hashes, better use the workstation instead

[inland sonnet]

Makes sense, thanks. I feel kinda dumb now lol

[open snow]

Hi, i think question in Identifying Filters section in Command Injection module has a bug, there are multiple answers to the question, both (the one from solution, and the other one), are not accepted.. even though application seems to be responsive to the provided command injection.

[inner oyster]

Hi everyone, I have a simple question (i hope it is the correct place to aks it) do you know if it is possible to perform pth attack with Remmina ? In order to access a machine with RDP

[honest gyro]

i think u need to put here #1234357888114364508

idk

[open snow]

will try, thanks Volter

[unique remnant]

dunno
but you can do it with xfreerdp

[honest gyro]

ur welcome

[sacred laurel]

Hi guys, I'm on file upload attacks skills assessment but I'm unable to progress. I was able to read the source code of contact/upload.php with SVG/XML payload but when I decode the base64 I don't see anything about where it uploads my file to

[open snow]

make sure you copied entire base64 string, if you just highlighted part of the string it will not decode full code, only part of it... happened to me

[icy marsh]

#broken_authentication reset token question 1,

I'm using a python script that generates md5 hashes using username htbadmin and the time . but can't get the matched token .... any help ?

[sacred laurel]

Can I dm real quick if you don't mind?

[open snow]

sure

[unique remnant]

check out the source code where it is gonna be uploaded, you will find it there

[icy marsh]

#broken_authentication reset token question 1,

I'm using a python script that generates md5 hashes using username htbadmin and the time . but can't get the matched token .... any help ?

[sacred laurel]

I did but it's no where to be found in the source code when I decoded the base64 or I just can't interpret it

[unique remnant]

it is very straightforward so make sure you will get the full source code b64 encoded as suggested above

[sacred laurel]

Just dm'ed you if you don't mind

[icy marsh]

please reply mine

#broken_authentication reset token question 1,

I'm using a python script that generates md5 hashes using username htbadmin and the time . but can't get the matched token .... any help ?

[acoustic owl]

Without knowing exactly what your script is doing, it will be impossible to help you.

||Your script must be based on the time specified.
Plus minus one second
Create a token per millisecond and send it to the web server||

[honest gyro]

guys i am stuck at INJECTION ATTACKS -->Exploitation of PDF Generation Vulnerabilities i think i have the multiple working ip and port but im unable to get any file when i send my payload i just reseve the title and the note is just empty i tried using the xml req and then encode it with base64 and it didnt work i dont get it

any help?

[acoustic owl]

Send me your payload via DM.
As soon as I'm home (about 1 hour), I'll take a look at it

[mossy tiger]

Anyone having issues with AD attacks and enumeration - bleeding edge vulnerabilities? the exploits keep failing with "remote host timed out" for both noPac and PrintNightmare

[icy marsh]

i've sent my code snippets to you... along with my problem... please see DM

[true marlin]

guys I want to ask if I have "currenti plan silver" and I want to open "student plan" without end of the month, can I do it or should I wait until the "silve" plan ends?

[pastel lava]

Probably just wait

[true marlin]

okey thx

[fiery berry]

If you go to the "/opt" folder over the pwnbox you can find the "noPac" exploit directly there to use it

[mossy tiger]

So when i try that, it gets hung up on "requesting S4U2self" and then failes with a "connection reset by peer" error

I'm not sure if i'm missing something silly, or if the DC01 box is having issues and needs to be bounced

[fiery berry]

You may want to remove the screenshots since I don't remember if the passwd for the user is already disclosed by the module. Give a me sec to re-verify everything myself or possibly you want to restart the target

[fathom pendant]

It's an answer to a question in one of the other sections

[mossy tiger]

my bad

[fathom pendant]

Yeah this module is a grey area since like the entire lab is reused throughout

[final kite]

Hey for the yesterday's task it still doesn't work I fuzzed now with faculty and . php7 and I get nothing expect index.php7

[fiery berry]

Tried and it works flawlessly

[fathom pendant]

Weird you should find a subfolder that has the expected answer

[mossy tiger]

Interesting. I feel like something in my lab env is screwed up but who knows

[final kite]

I even fohnd the answer somewhere

But I dont get it

I cant even open it in mozilla

[mossy tiger]

Youre using forend user correct?

[fathom pendant]

Recursion and verbosity helps

[final kite]

Some issue I put them all in etc/hosts so its not that

[fiery berry]

Probably you can just reset the target and try once more

[mossy tiger]

I'll try that again. was having same issue last night so not sure

thanks!

[fathom pendant]

You don't put the uri in /etc/hosts just the domain/subdomain {a.inlanefreight.htb...} or I think they use .local

And you do still have to specify the port even if it's in your /etc/hosts

[final kite]

Ye i know I put like ****.academy.htb

[fathom pendant]

As you don't specify port in that file

[final kite]

Finally it worked

Think I missedspelled port since it wasn't written in fuzz output

[burnt oasis]

Hey how’s everyone doing!? Quick question about hascat. Everytime i try i use —force because of kernel autotune failure but it never finishes. Last night said estimate of 1hr i woke up and its not saying 25 days. Is this because im using a virtual machine or because host machines gpu isn’t good enough?

[dim wolf]

use your host machine. not a vm

[limber river]

if you are using haschat from a virtual machine it's gonna be slow , because it don't use GPU

• why using this --force ?

[timber hatch]

windows priv escaltion module / kernel exploits, why is this CVE-2021-1675 a kernel exploit? when i read it, it is a Windows Print Spooler Remote Code Execution Vulnerability?

[limber river]

becuase it exploit the kernel as simple as that

[night pumice]

yo im new here, where can i ask about a machine?

[acoustic owl]

#boxes

If you have no access, read and follow #welcome

[fathom pendant]

It uses the windows spooler service to exploit the kernel

[wide river]

wait, they take away the tutoring service on academy now ?

[dim wolf]

it's been replaced by step-by-step solutions

[wide river]

im doing C2 with sliver module

and maybe the module still new

so there's nothing on the solution yet

[fathom pendant]

Usually the walk-through for new modules is like a week after release

[wide river]

make more sense now, i will wait until then

[fathom pendant]

or you can just ask your question and maybe someone can help

Instead of waiting however long

¯_(ツ)_/¯

[wide river]

module: "INTRO TO C2 OPERATIONS WITH SLIVER "
section: "Probing the Surface"
description: I created ||staged.txt|| and made a payload with msfvenom. But I might do something wrong when replacing the payload from ||staged.txt|| to|| sliver.aspx|| because i don't have any sessions return

[burnt oasis]

Ok thanks for that used pwnbox and all worked. When it comes to exam is it best to use pwnbox or virtual machine? Or should i just use both to be prepared @dim wolf

[dim wolf]

whatever you're more comfortable with

if you want to have tools at the ready, use a vm

[snow ridge]

Has anyone done "Domain Reconnaissance" section in INTRO TO C2 OPERATIONS WITH SLIVER. Im constantly getting errors like this when I try to run SharpView ```[] Output:
[Get-DomainSearcher] search base: LDAP://DC=child,DC=htb,DC=local
[Get-DomainObject] Get-DomainComputer filter string: (objectClass=)
An error occurred: 'System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.

at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne)
at SharpView.PowerView.Get_DomainObject(Args_Get_DomainObject args)
--- End of inner exception stack trace ---
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at SharpView.Program.Run(String[] args)
at SharpView.Program.Main(String[] args)'``` Its basically impossible for me to do exercises, I have already switched to different VPNs tried both UDP and TCP. Rdp is not also working on that module. I can connect once and then I disconnect and then cant connect to it anymore. I even submitted ticket to htb because machines were not spawning with EU vpns, but they fixed it today.

If someone knows a fix or how to make sliver connection better, let me know. My network is fully stable fiber with hight speeds so its not my internet and this is the only module I have ever had issues like this.

[candid night]

How exciting!

[fathom pendant]

Not all questions award cubes

¯_(ツ)_/¯

The sum total of cubes you get from the module will be 20% (or 100% for tier 0) of what you spent

[candid night]

Yea I think I read that somewhere before. Still, it's a funny pop-up

[shut quest]

Can you run any other commands?

[fierce mason]

on skills assessment for web attacks, ive managed to reset the password for all users up to uid 100, but i seem to be stuck at this point

[loud dagger]

is it worth doing the basic toolset path before i start the cpts path just so i can start getting some ctfs under my belt

[fathom pendant]

Ctfs won't help with cpts

[grave kiln]

https://academy.hackthebox.com/module/54/section/490 - i ran the recursive scan but i cannot find the admin folder. just only blog and forum. i tried to again spawn the target. same results. Can anyone give a clue.

[snow ridge]

Yes, I think its some kind of timeout problem but not 100% sure about that. For example this ran successfully ```sliver (http-beacon5) > execute-assembly /home/kali/SharpCollection/NetFramework_4.5_Any/SharpView.exe "ConvertTo-SID -Name websec" -t 240 -i -E -M

[*] Output:
S-1-5-21-2749819870-3967162335-1946002573-<SNIP>```

[cloud urchin]

You should have obtained the admin's creds if you reset all the user passwords up to user # 100

[fierce mason]

does the admin have their username set to admin

[loud dagger]

that’s not what i asked

[cloud urchin]

DM me

[cloud urchin]

I don't think it can hurt, most of that path is covered by the Pentester's path (CPTS path) already. The only modules not included in the Pentester's path that are in the Basic Toolset path is: Cracking Passwords with Hashcat and Intro to Network Traffic Analysis.

[loud dagger]

think i might do that then

i know ctfs won’t help with cpts, i just want to start doing ctfs because they’re fun

[dim wolf]

intro to network traffic analysis is covered in infosec foundations

[loud dagger]

yep yep

[cloud urchin]

it's not part of the pentester's path though

[loud dagger]

i finished it already

[dim wolf]

infosec foundations is the prerequisite to pentester path

[loud dagger]

i just finished infosec foundations

[cloud urchin]

I was able to complete just the pentester's path without doing any other path.

[loud dagger]

that’s cool but i still already finished infosec foundations

[dim wolf]

yes but it is highly recommended to do so for beginners

[cloud urchin]

sure i agree but the question was specific to the pentester's path

[dim wolf]

the pentester path assumes you've completed infosec foundations anyway

[snow ridge]

SMB         10.129.205.234  445    WEB01            [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:child.htb.local) (signing:False) (SMBv1:False)
SMB         10.129.205.234  445    WEB01            [-] Connection Error: The NETBIOS connection with the remote host timed out.``` I had to run this 3 times before it worked, so I think theres definitely some problems with the machine and not in sliver. But the thing is that I have already restarted it 3 times 😄

[cloud urchin]

add the argument '--smb-timeout 5' to your command

[snow ridge]

I use 240 second timeout with sliver and commands are still failing, except when the output is only one line

[cloud urchin]

ok but you showed me cme, not sliver

for cme, add that argument and it probably won't time out

[snow ridge]

I was just testing where the problem might be

[pine fjord]

Hi

[next bronze]

hashcat is not in the pentester path?

[dim wolf]

no :(

[next bronze]

huh what

that's such a crucial tool

[pine fjord]

What is this server about

[dim wolf]

#welcome

[loud dagger]

wdym what is this server about why did you join

[cloud urchin]

i think when hashcat comes up they just kinda give you the command, but yeah agree hashcat is pretty crucial lol

[pine fjord]

My friend invited me

[loud dagger]

yeah i thought it was weird that hashcat isn’t included in cpts

[fathom pendant]

It's lightly covered in Password Attacks

[dim wolf]

also covered a smidge in AD enum and attacks

but like, that's just a review

[loud dagger]

and you didn’t ask the person who invited you what the server is about?

[pine fjord]

No😅

[dim wolf]

if you read #welcome it will tell you what the server is about

[pine fjord]

Oooo ok

[loud dagger]

people confuse me

[median gust]

can soemone help me with nibbles in nmap enumeration htb academy

slide in dms

[dim wolf]

just ask your question

people will be cool enough to help you in this chat

[rustic sage]

in "Getting Started" section in CPTS path, in bind shell section it says
"Note: we will start a listening connection on port '1234' on the remote host, with IP '0.0.0.0' so that we can connect to it from anywhere.".
can someone explain why use no ip address in reverse shell or bash command. ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 1234 >/tmp/f"),
does it mean we can connect it from any IP address?

[fathom pendant]

Generally yes

However since it's an isolated environment

You can only access it via the vpn connection

[rustic sage]

i see, thank you

[stable bone]

erm why does my parrot say duplicate launchers

[hexed lintel]

i cannot find the file with flag.

what am i missing

tried looking into all the shares

[fathom pendant]

Well because you're not connected to the right share

Also as a note; each service has a different user

IPC$, C$ Are system shares

You need to connect to the actual share broadcasted

smbclient -L -U "user" //ip/

-L will list all shares

Once you know the share that's not a system/default it's just connecting to that

[hexed lintel]

there is one non system share
i am connected to that but

[cloud urchin]

you're either in the wrong share or the user you're using doesn't have permissions to access it.

[fathom pendant]

^

Could be that your password enumeration net a false positive

Hence flags like -local-auth or --windows-auth are used in some instances

[limber river]

which module is that

and I perfer to use smbmap since it gives a better output and cleaner info than smbclient

[fathom pendant]

Password attacks

[hexed lintel]

got it

crackmapexec stopped after getting 1st correct username and password

there were more user

[keen cairn]

Hi i was just wondering is there a way to reset your progress back too the start on HTB Academy i have been away for a while and would like to start some of the material from the begging any help would be apriciated thanks 🙂

[limber river]

you still use crackmapexec ? try netexec

[sweet girder]

Hello again. I have a problem with my parrotOs VM. I use Virtualbox, and during the first installation, I allocated 20 go of space to this VM. I tried to update the OS with this command :
sudo apt update -y && sudo apt full-upgrade -y && sudo apt autoremove -y && sudo apt autoclean -y
but I get the error
insufficient space in /var/cache/apt/archive

I tried to allocate 20 more Go, but I still get the error
I followed the instruction in the module Setting up, section Linux
I used LVM during the installation of the OS
Any advice please ?

[dim wolf]

i had created a 40 GB Parrot OS VM when i started

when i finished CPTS, it was completely full

so i created a new one and gave it 80 GB of storage

that's overkill imo

[cloud urchin]

on top of that you don't want to run a full upgrade before doing an update

[next bronze]

you made a fresh vm instead of just increasing the partition size?

[limber river]

skill issue

[dim wolf]

i needed a new one anyway

[next bronze]

fair

[dim wolf]

it was already a year old and i couldn't update sh!t

[sweet girder]

Okay I will remember to add more space

[next bronze]

you'll need to extend the partition too, it's pretty easy with lvm

[dim wolf]

you can just increase the partition size

[sweet girder]

I don't know how to do that. I tried google but I'm lost. It's the first time I use a VM

[loud dagger]

hmmm

[cloud urchin]

depends on your hypervisor

[next bronze]

increase the disk space for your vm (google how), then increase the partition using lvm (also google how)

[sweet girder]

I already increased the disk space. I will do more search to increase the partition using lvm. Thanks !

[dim wolf]

i had to do the same thing when my game server ran out of space

[loud dagger]

at long last i am finally enrolled in CPTS

[pine dagger]

Just adding more HDD space doesn't automatically grow the OS's space. If you check the disk space with something lsblk you'll probably see the space is unallocated, and you need to grow the disk to use the free partition. A tool like gparted will probably help.

[sweet girder]

Okay thanks I will look into that !

[pine dagger]

https://suwandaru.wordpress.com/2020/07/02/increase-disk-parrot-os/ may help, was my first Google hit.

[sweet girder]

Thanks !

[next bronze]

you don't need to use gparted with lvm

[pine dagger]

True. But if they're struggling with expanding a disk it'll probably be easier for them to understand. 😄

afaik, its actually lvextend, not lvm though /shrug

[next bronze]

well they said that they've configed the system to use lvm and gparted doesn't support directly managing the partition
https://askubuntu.com/questions/277399/how-to-unlock-partition-in-gparted/349677#349677

[pine dagger]

Well, hopefully they'll have the sense to snapshot before attempting to mess with the disk at all 😄

Otherwise... it'll be a learning experience \o/

[next bronze]

or maybe the comment is wrong, either way just use the lvm commands directly lol

take a snapshot before you mess with the disks

[haughty jetty]

Quick question for the Module "Footprinting" - Section "SMTP"

How do I increase the 'wait time' for pentestmonkey's smtp_user_enum perl script?
According to the help file, it should be '-t <seconds>', yet -t is already used to define the target IP - seems odd.

Setting -t twice (first for the IP, second for the wait time) does not seem to work, as I cannot get it to actually find the correct user name (which I already know and am explicitly searching for).

./smtp-user-enum.pl -M VRFY -u ||robin|| -t 10.129.233.90 -t 100

Any idea what I am doing wrong?

[pine dagger]

It used to be -w

[haughty jetty]

-w is not working, sadly.
"Unknown option: w"

I could try to edit the script and change it to -w, maybe that'll work 😄

[pine dagger]

lol, I just noticed the -t is in there twice

You could try the ported Python script? https://github.com/cytopia/smtp-user-enum

[plush urchin]

please what’s the difference between remote port forwarding and a reverse shell.

From what I have gathered, local port forwarding is when traffic from an application/service attached to a port on my local machine is sent to that same application on the same port on another computer through a tunnel. While remote port forwarding allows applications outside your network to connect to an application running on a port within your network/computer

And is port forwarding only possible using ssh, I saw a YT video on how to set up port forwarding within a router. It sounds like remote port forwarding.

[cloud urchin]

Port forwarding is simply forwarding ports from one device to another. For example, incoming traffic on port 80 to your home's connection may be forwarded to a computer you have on your network running a webserver on port 80. This is forwarding the port from your router to the computer. A reverse shell is a binary that connects to a remote server.

[compact patrol]

https://letmegooglethat.com/?q=difference between remote port forwading and reverse shell

[cloud urchin]

chatgpt can break this down more into more granular explanations if you need more details

[pine dagger]

Awww dammmmmn, they dropped a lmgtfy

[haughty jetty]

Thanks for the suggestion 🙂

Turns out the SMTP server itself doesn't even recognize the user, which the module is looking for.

VRFY ||robin|| returns code 252 (user does not exist).

Not sure what's going on here, but I'll just shrug it off and continue I guess.

[open summit]

used this as shown and it says file ot found

[pine dagger]

Well... the username was correct from my notes 😄

[haughty jetty]

Yeah, it should be correct.
The IMAP / POP3 section also mentions it (which is where I got the answer in the first place) 😛
Feels like something is broken.

[open summit]

doesnt make sense to me why does it say passwords not found

[fathom pendant]

Is that file in that folder in your vm?

[haughty jetty]

Are you sure your SecList is in that exact directory?

[open summit]

im using the integrated vm

[wide river]

what module and section is it

[open summit]

LOGIN BRUTE FORCING - login form attacks

[fathom pendant]

Can you ls /opt/useful?

Or just locate SecLists

[open summit]

whats happened here?

i found it but it has an X on it

[autumn pilot]

If you can't find it take use of the commands in linux to find the file

[wide river]

sudo chmod 777 <filename>

[open summit]

i just used file rockyou-75.txt

and it worked

[wide river]

sweet

[fathom pendant]

Just chmod SecLists dir

As I belive it'll recursively chmod

[open summit]

okay

[dim wolf]

you only need 644 perms

[shut quest]

Looks like it. I'd try a different VPN server see if that helps.

[strange forge]

attacking common applications- skill assesment. unable to find initial foothold. what i tried is using ghostcat but it failed too. i have website- backup thou. unable to fing anything in it. can anyone hint what i should be looking for in it?

[pine dagger]

Skill assessment 1 or 2?

And which question

Be more precise

[strange forge]

easy one. trying to get initial foothold.

[strange forge]

1

[pine dagger]

So you're stuck on q1?

[sweet girder]

Just to be sure. Do I need to install Python2.7 ? I've seen it reached end of life since 2020

[pine dagger]

Only if you have some python 2 scripts. I'd avoid it if you can help it.

[strange forge]

yeah.

[sweet girder]

Okay. I just started so no I don't have script. Thanks

[pine dagger]

You're jumping ahead without doing the basics. Follow the standard methodology:
Recon <--- you are here
Enumerate/Scan
Gain Access <--- you're jumping to here
Priv Escalate
Cleanup/Cover Tracks
Report

Start with the basics, nmap. Find services that are hosted. Dig into them. Then go from there.

[fathom pendant]

Some of the 2john scripts used to extract password hashes from files use python2.7

[pine dagger]

Python 2 is 😱

[sweet girder]

Oh okay. I will find a way to install python2.7 just in case. Too bad I can't install it with apt install. I will find a way

[fathom pendant]

Virtual environments (venv)

Or docker

[urban fable]

@fathom pendant do you know of some way to mount a VHD file in linux ?

[pine dagger]

parrot uses apt iirc, so should be able to install it with apt install python2, but definitely go with MarcieLee's suggestion of venv's. If you dont know them, learn them first before installing python.

[fathom pendant]

There's plenty of links in this chat

Once you identify the filesystem on the vhd, you'll know what to look for

[pine dagger]

For password attacks? https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

[sweet girder]

Thanks I will look into that

[urban fable]

yup lol

[fathom pendant]

I was encouraging the use of discord's search feature

Since a lot of common questions can be likely answered by a quick search

[urban fable]

I always use it lol just this time... I didn't quite understand a blog that was here so I asked lol

[fathom pendant]

The blog is fairly straightforward

[urban fable]

I didn't understand how to use dislocker and got an error with losetup

[fathom pendant]

Just read

[urban fable]

was not this one

[fathom pendant]

¯_(ツ)_/¯

[pine dagger]

Sowwy 😄

[fathom pendant]

Losetup is a similar thing to the article

Just using lo-device instead of npm

[urban fable]

I keep getting an error with it

👍

[fathom pendant]

well have you tried with sudo? ¯_(ツ)_/¯

[urban fable]

yup

[fathom pendant]

Most half-baked guides assume root

[pine dagger]

half-baked, haha

[open summit]

i wanna use a -P william.txt file on hydra

but it cant find the file and i cant either

LOGIN BRUTE FORCING - Service Authentication Brute forcing

am i meant to use the william.txt file for my -P flag

[urban fable]

got it now

took me quite a bit to understand it lol

[fathom pendant]

You create the file

Following the steps

Either in that section or a previous section

[pine dagger]

Its in the section right before: https://academy.hackthebox.com/module/57/section/512

[fathom pendant]

In general this module walks you through creating the necessary files or how to for most of the module

And emphasizes using the flag that loops through users first

[fading oracle]

@proud pine i dm-d you if you dont mind!

[open summit]

how can i tell which port is open

[fathom pendant]

Subdomains of subdomains

[fathom pendant]

If it's listening, there's a port #

It doesn't want ipv6

It only wants ipv4 and not localhost btw

[open summit]

so port 80

[fathom pendant]

Ph wait

There's port 80 and ftp

I forgot you were on the brute force one

[open summit]

ye

so i want port 21 for ftp

[fathom pendant]

You gotta chain. Basically

And yes

[open summit]

wdym by chain so i tried using the rocky-10txt file didnt work

[fathom pendant]

It should

I just mean doing it from the host you just ssh into

[open summit]

ah

[fathom pendant]

Since it's only listening internally you can only access it internally

[open summit]

so hydra -l m.gates -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou-10.txt ftp://94.237.57.173:80
wouldnt work

[zealous rune]

hi, really struggling with the end of module engagement on shells module

[fathom pendant]

Docker containers are only accessible via one port

[zealous rune]

I managed to successfully exploit 1 machine

[fathom pendant]

But they can be running stuff on localhost/loopback

[fathom pendant]

If you're looking for creds: check desktop

[zealous rune]

but the machine with the address 172.16.1.11 I am getting stuck

thanks I got the creds

[fathom pendant]

Blog?

[zealous rune]

I exploited the blog that machine i got shell no issue

it's the "first one"

running tomcat service

[fathom pendant]

it's all about enumeration ¯_(ツ)_/¯

[zealous rune]

I also investigated smb

[fathom pendant]

Something about war never changing

The smb one is the easiest

It's eternal

[zealous rune]

🙂

thanks

i'll try both the smb and tomcat ones

basically i figured that the metasploit modules don't work out of the box for the tomcat

so far that's as far as i got

then i started poking at smb