modules

[normal sand]

Yes

[north bramble]

is there a way to do that?>

[normal sand]

Wait, no, include the mssqlsvc also.

The entire thing.

[split glade]

You might want to try https://github.com/noraj/haiti to identify hashes, it's pretty good at identifying hashes and give you the JohnTheRipper and hashcat codes so you don't have to search them on internet

[north bramble]

okay

[normal sand]

If you look at the output when you capture the hash, you'll see it's specified there that it's an NTLMv2 hash.

[north bramble]

thanks

[next bronze]

don't use this, these are never reliable, either check hashcat examples or how you have acquired the hash is the best way to figure out the hash type

[north bramble]

its the first time it gave multiple types, quite bizarre. looks like my fault for not supplying complete hash

[split glade]

Isn't never reliable a bit much? I think haiti gives me the correct result >90% of the time, hash-identifier not so much though

[normal sand]

I'm pretty sure Xre0uS was referring to hashid.

[next bronze]

https://hashcat.net/wiki/doku.php?id=example_hashes
why use the tool when you can confirm them yourself

[split glade]

It's mostly to win time, especially since it gives you the JtR and hashcat codes. But yes before I was checking this page for hashcat

[north bramble]

so for Q2, I am supposed to login as the other user to get flag fromflagdb right?
unable to login, or do I have to do it another way?

[next bronze]

not sure about sqlcmd, try wit mssqlclient from impacket wiht windows auth

[split glade]

||impacket-mssqlclient mssqlsvc@$IPTA -windows-auth||

[north bramble]

oh

[north bramble]

I dont understand why we need windowsauth, because the host mssql db is running on windows?

[next bronze]

mssqlsvc is a domain acount

by default it wil login as a local account iirc

[next bronze]

let's not just straight up give the answer yeah 🙂 especially when it contains the password

[north bramble]

wdym by it will login as local account?

[split glade]

Yes maybe it was a bit much, but it doesn't contain the password (you get the password from cracking the netntlmv2 hash, and you still have to enter it after this command)

But yes yashfren the exercises at the end of the module will be harder so you'll probably have to work harder/take more time to understand the lessons I think

[normal sand]

Earlier today someone told me that the -windows-auth option tells it to login as local account, so which is it?

The help for mssqlclient.py just states "whether or not to use windows authentication." I'm guessing this means when we don't specify it uses the SQL server login, whereas when we specify it uses Windows authentication (domain & non-domain joined)?

[normal sand]

If I'm wrong, someone please correct me. Thanks 😅

[next bronze]

https://github.com/fortra/impacket/blob/15eff8805116007cfb59332a64194a5b9c8bcf25/impacket/tds.py#L909
windows-auth uses NTLM/kerberos which allows local/domain login, without it it will use mssql account login, I was referring to the local mssql account oops

[next bronze]

yeah this is correct

[normal sand]

Thanks a lot for clarifying. Much appreciated.

I read somewhere on the forums that sqsh is outdated or something, that's why it doesn't work properly? So it's recommended to use mssqlclient.py. Thought I'd let you know.

[split glade]

Thanks, yes I saw that the version is 2.X and it's 3.X on the pwnbox, that makes sense. Apparently ParrotOS tends to have more up to date packages than kali

[timber hatch]

what am i doing wrong? Windows Priv escaltion / Citrix Breakout

[normal sand]

What version are you referring to?

[split glade]

The sqsh versions, 2.5.16.1 for kali and 3.0 for ParrotOS (currently)

[autumn pilot]

Think of the Pivoting module, what are the limitations certain machines in X, Y and Z environment can have

[timber hatch]

my thought was also..how are my linux machine and the citrix machine connected...

[timber hatch]

can you give a bit a more specific hint?

[autumn pilot]

Yes, look into the section

Where are the tools located

[thorn hawk]

Hello amigos. I hope that everybody is OK and enjoying their challenges :D. I just started the module Server-Side attacks. I am on the first chapters and i am having difficulty in setting up the nginx server to work as a nginx reverse proxy. Would it be possible to request some assistance regarding this?

I have successfully installed docker, nginx and the AJP module. Have successfully connected nginx with the AJP module and have edit the nging.conf file, Maybe my edit of the nginx.conf file is not correct that's why I get this error or strange behaviour.

When I try to run

sudo nginx i get this message:0.0.0.0:80 failed (98 Address already in use).

edit: I have never instucted nginx to connect to 0.0.0.0 - I am instructing it to connect to the IP of the target system.

[spark spruce]

Port 98 is already in use
So first stop the service running on this port or use another

[thorn hawk]

How is it possible it ask for port 98? I never told him to go there. Is it automatic? I have asked him to connect to port 80 and check the target IP with the port given from HTB website for the target.

[hexed lintel]

why cant i login to mssql db

[spark spruce]

Can you show me SS

[thorn hawk]

I change the port to 8080 from 80. When I try to curl to 127.0.0.1:8080 i get 502 bad gateway and when i try to run again nginx i get these messages:

[shut quest]

What's your nginx conf?

[normal sand]

Were you able to figure out why?

[hexed lintel]

no

[normal sand]

Try mssqlclient.py directly instead?

[thorn hawk]

Nginx conf incoming -

everything else is comment out expect the last bracket } to close the http section

[shut quest]

Looks fine to me. You stop then start nginx?

[hexed lintel]

after login with the given credentials, i cant open the flagdb

[normal sand]

Hint: you don't have the required privilege.

[thorn hawk]

I get this behaviour when i try to stop and restart nginx

[hexed lintel]

i thought so, and tired looking for additional data i can get in other db, but didnt fount anything
any hint from here what to do?

[normal sand]

Attempt to get the hash of the service account.

[shut quest]

Instead of listen 8080, choose a different port

[thorn hawk]

I went and change to 8082 and now i go this running

[worldly pagoda]

In Active Directory Enumeration module (https://academy.hackthebox.com/module/143/section/1265) there is a very nice section on different set ups. I am however not able to understand what exactly is happening here in terms of network connections "A penetration testing distro (typically Linux) as a virtual machine in their internal infrastructure that calls back to a jump host we control over VPN, and we can SSH into." Does it mean that for example, the pen testing team has a VPN server such as OpenVPN that the Kali/ParrotOS vm from the customer's network is connecting to as VPN client?

[next bronze]

yes, if it's an internal pentest you'd have a attack host that can reach the internal network

[thorn hawk]

I did it for 127.0.0.1:8082 Now need to do it for the target system

[shut quest]

That is the target system

[fathom pendant]

???

no it's not

[thorn hawk]

is not the ip given at the bottom of the excercise?

[shut quest]

You have nginx setup as a proxy with the target as the upstream. Hitting 8082 locally is hitting the 94.xxx

[fathom pendant]

or i'm missing context and this is the module that has you proxy local

AHH

ok then yeah it's working as intended

and if the target upstream is apache then

nothing wrong ¯_(ツ)_/¯

[thorn hawk]

No way 😄

I see. When we lunch nginx succesfully is like we are proxy for the ip target we have put. Thus 127 goes to that target. OUAOU

[shut quest]

https://tenor.com/view/waynesworld-way-gif-5800555

[thorn hawk]

I need advanced notes for this 😄

[thorn hawk]

Maybe i misunderstood -- you said hitting 8082 locally will hit the 93. Meaning that we locally hit 8082 which is instructed to go fetch the info from 93. due to nginx? I though that nginx was suppose to be a server but we are using it to go connect to a server which has the AJP module (Apache Tomcat). I am a little confuse lol

[shut quest]

nginx can be used as a web server, or as a proxy.

In your conf you have the upstream setup for the server you want to access. In the server section you have ajp_pass telling nginx to use the tomcats upstream config.

[sonic wasp]

Anyone needs help with GIAC exam?

[fathom pendant]

https://tenor.com/view/what-do-you-mean-by-that-gif-10559980082154008380

||answer wisely||

also GIAC has nothing to do with htb academy

[sonic wasp]

Yes but got the certificate now learning from here and is Amazing how much you can learn

[dim wolf]

i need help with GIAC exam. please buy it for me

[fathom pendant]

[fathom pendant]

Also helping others that are actively taking the exam is a quick way to get your exam and the other person's exam revoked

[sonic wasp]

Only hints my friend not taking for them or me

[fathom pendant]

even hints for the exam can get your cert revoked you goon

[honest gyro]

sup everyone i need help on ADVANCED XSS AND CSRF EXPLOITATION-->CORS Misconfigurations
i have found the vuln page but when i set the origin to the exploit server nothing seem to happen i tried almost every exploit explained in this section yet none of them worked

im glad for any help

[bright coral]

What kind of hints do you need for the exam? Those are open book...

[torpid cove]

Guys, please how do I learn web hacking for bug bounty hunting?
Ever since I started my hacking career, I have just been learning stuffs that has not been making me money or anything, I'm starting to need money more and the more I need money, the more I'm tempted to let go of hacking and find something else to pay my bills, any ideas???

[spark spruce]

Ask in #careers-and-certs

[fathom pendant]

bug bounty isn't a reliable income source

[fathom pendant]

what specifically to look at on a target

[bright coral]

I would assume that those are randomly picked from a pool (at least that's the case for the blue team practical labs).
Did not really take him seriously since only the GIAC exam was mentioned like there are not hundreds 😅

[torpid cove]

I don't have access...

[torpid cove]

Then what exactly is because it feels like I might just keep learning everyday without benefiting from it...

[bright coral]

Read #rules, #welcome and verify

[torpid cove]

I still don't have access...

[proper flax]

Hey everyone, I am stuck at wordpress enumeration, I am able to upload an image file but the reverse-shell is not working. Is there anything else I should be looking for?

[fathom pendant]

did you actually follow the steps from #welcome

[torpid cove]

Thanks Man

[delicate steeple]

Hey i there someone who can help me the footprinting smtp module? i am kind of stuck i found the user but cant seem to find the flag

[shut vapor]

I may be able to help you. I just finished that section of the module.

[delicate steeple]

i will dm you

[arctic sentinel]

Hello, anyone could give me a hand with the Linux priviledge escalation... Ive been stuck for a while in the logrotate module...

Here is a screenshot... somehow it keeps rotating

[serene hedge]

Hello, I have been doing Linux Fundamentals. In System Information part there are these 2 questions:

1. What is the path to the htb-student's mail?
2. Which shell is specified for the htb-student user?

I managed to get SSH connection and did other tasks but I could not managed to answer these 2 tasks. Can someone explain me these tasks?

[slate zinc]

if u managed to ssh into the user
u can run echo $SHELL to see the shell

[timber hatch]

someone done the windows evasion modul? i would have a qustion at the section Static Analysis, if i could send the C# code and ask a question. PM?

[haughty tree]

Why is this under the title anonymous authentication? This is the Attacking Common Network Services module in the Attacking SMB section

[slate zinc]

because if u dont know user and pass u can still connect to it as anonymous

so guest is called anonymous as in the one with no pass or username

[haughty tree]

Yeah but this doesn't have anything to do with anonymous login since it works with credentials or without kinda. that's all that's written under the anonymous login title

[slate zinc]

and for the mail part search google on what mail path works on linux

[slate zinc]

so anonymous means without creds

it says u will be anonymous by default

unless u find creds

moreover smclient into it u will understand

and if u think this is confusing feel free to make a #1234357888114364508

[haughty tree]

I mean its not that big of a deal

[slate zinc]

same

[haughty tree]

Theres a bunch of obviously misplaced stuff there that has a higher priority

[slate zinc]

u know what to do mate

[serene hedge]

Thanks so much for help

[slate zinc]

[mint echo]

Hi everyone, I was doing the "Firewall and IDS/IPS evasion - Easy Lab" in the network enumeration with nmap, the task is basically to determine OS of the system.

I spawned target and entered the following command to remain quite, determine whether a firewall is stateful, and to differentiate between filtered and unfiltered ports.

sudo nmap 10.129.189.79 -p- -sA -Pn -n --disable-arp-ping --packet-trace --min-rate 1000

but the issue is, its not showing me any ports at all...if I dont know what the ports are how will I move forward.

Please let me know if I have missed something or if there is an issue with my concepts.

[haughty tree]

Does it not say right there that it found 970 filtered ports?

or am I misunderstanding that

[mint echo]

Damn I actually did not focus on that line, my bad, but with only this info how will I know which port no. I should target to determine OS....

[haughty tree]

It's a bit easy to miss so I don't blame you

I mean do you need specific port numbers to determine OS version?

[timber hatch]

somebody good a C#?

[haughty tree]

I'm alright at C#

[mint echo]

I personally thought it would give me some sort of list like in this example

[mint echo]

hmmm I dont know what to say 🥲

[haughty tree]

Well perhaps you need to be more evaise

evasive

try going back and reading previous sections a bit to see if you find some ideas there

[mint echo]

alright I'll check it out again

[timber hatch]

can i dm you something?

[haughty tree]

You can send it here

[timber hatch]

the code is a shellcode loader written in C#, which uses common WinAPI functions to execute meterpreter/reverse_http shellcode. i did setup the http reverse handler and execute the code. i should obtaina meterpreter session, but the console does close and no meterpreter session...

[tender nimbus]

Can someone help me?

I'm pretty sure its the right awnser?

[latent eagle]

dump?

[tender nimbus]

mb but stil wrong lol

[latent eagle]

sudo tcpdump -n -v -X -c 100

[tender nimbus]

already tried, here is the hint but its what we just did

[latent eagle]

Not sure why your answer is wrong then

[slate zinc]

as in change order

[latent eagle]

no nvXc is correct

[slate zinc]

i see

[tender nimbus]

i need to respect the order of the question

[latent eagle]

remove sudo maybe?

[tender nimbus]

already did but still not good

[latent eagle]

what module

[tender nimbus]

INTRO TO NETWORK TRAFFIC ANALYSIS

tried to search on the web but there is nothing on the forums

[latent eagle]

i didnt do that module

sorry man, i provided the correct answer

[tender nimbus]

I know I also believe that its the right one but visible not the correct order or something

[dim wolf]

"what are the switches used"

so the answer should be the switches

delete that shit bruh

[dim wolf]

and this

[dim wolf]

and this

[dim wolf]

and this

[tender nimbus]

so mean 😦

[dim wolf]

can't be spoiling content

[tender nimbus]

mb

[dim wolf]

good job

[vernal hamlet]

hi guys

i need help with this question (Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.) i created a mutation password list using this command ( hashcat --force password.list -r custom.rule --stdout | sort -u > mutationPassword.list ) and then tried to brute force ssh using im metasploit and crackmapexec and hydra each tool for at least 10 min i couldnt get any thing ! Any Help ?

its password cracking module btw

[fringe urchin]

Ssh painfully slow. You should almost never attack it. There is another service open : FTP. Its using the same accounts.

[vernal hamlet]

i did what you said and brute force the ftp using hydra its past 10 min rn and got nothing + Tried To Brute force with crackmapexec but its run so fast and gives me logging error then stops for some reason

[shut quest]

Cme would be slower than hydra. Did you try adding -t 48 to your hydra command?

[vernal hamlet]

No i didnt

[STATUS] 251.20 tries/min, 3768 tries in 00:15h, 90276 to do in 05:60h, 16 active ) Should i stop the scann and add the -t 48 to it ?

[shut quest]

Iirc default is 4 threads, so yeah?

[fathom pendant]

Default ftp is I believe 4 or 16

Either way, super slow

[rustic sage]

I am about to pull my hair out. I am working on SQL injection fundamentals and I am stuck on "writing files". It seems I was able to inject the webshell, but when I try and navigate to the page I created I just get a blank screen. What am I missing?

[shut quest]

You putting the file in the correct path?

[fathom pendant]

Well is the webshell expecting an argument

Like ?cmd=<command>

[shut quest]

Oh I guess if white page prolly is correct

[fathom pendant]

Basic webshells aren't fully interactive

[rustic sage]

ill keep trying. I have read the module 5 times now and there is nothing that explains the leap in logic. I followed the module fine, but I cant get anything other than a blank screen. I feel like they are expecting some extra knowledge that I just dont have.

[fathom pendant]

Likely knowledge picked up in the shells and payloads module

[fathom pendant]

What does the php file look like

[blissful elm]

i am not able to ssh to 172.16.5.225 from ms01

[fathom pendant]

Try switching to EU vpn and trying again

[blissful elm]

k

[fathom pendant]

The US ones have been shaky on that module

[blissful elm]

but i was using pwn macihne

i don't think vpn matter

[rustic sage]

this is the entire injection that the module says to use.

cn' union select "",'<?php system($_REQUEST[0]); ?>', "", "" into outfile '/var/www/html/shell.php'-- -

[fathom pendant]

So, do ?0=<command>

So ?0=id as a test

[rustic sage]

you mean after I input this in the vulnerable field and go back to navigate to : http://SERVER_IP:PORT/shell.php?0=id.... thats what the module suggested

oh i see

ok

[fathom pendant]

😉

[blissful elm]

@fathom pendant how much cpts completed?

[rustic sage]

it is confusing because even using =id it should show something other than a blank screen

[fathom pendant]

Like 60% been busy

[fathom pendant]

Then you likely did something wrong

[blissful elm]

but u completed AD i think

[fathom pendant]

Yes, a while back

[rustic sage]

well damn.... i dont know what i could be doing wrong

[fathom pendant]

Restart the target and try again

[rustic sage]

i have 5 times now. When i inject the code it responds as the module says it should for a successful injection, but navigating to it just shows a white page.

yep... just a white screen again. i dont get it. I even broke down and read a spoiler. Everything I input is correct. Still nothing

i tried reading the page source thinking maybe the info is not displayed... nothing

[fathom pendant]

Check page source

[rustic sage]

i did

[fathom pendant]

I don't recall having this issue

Also is it O or 0

😉

[rustic sage]

its a zero. still nothing

this is demoralizing. I felt bad breaking down and reading a spoiler and it didnt even matter. I still cant get the damn answer

im not cut out for this

[fathom pendant]

Are you sure the command and your input are 0

Or is it meant to be an O

[rustic sage]

i tried both

[fathom pendant]

Replace it with "cmd"

And see if you can pop it that way

By it I mean your into outfile command

[rustic sage]

just a blank white screen

[fathom pendant]

Also are you using enough spacers

[rustic sage]

i tried so many different combinations

[fathom pendant]

Replace the "" with numbers

[rustic sage]

tried it

[fathom pendant]

weird if you're getting nothing ¯_(ツ)_/¯

[rustic sage]

i have been stuck on this for 7 hours now.

if i have to just take the answer from the spoiler to move on then I am clearly not cut out for this. I think I am putting this down for awhile. I will subscribe again when I feel like I know what I am doing. this is pointless

[fathom pendant]

This is a sign to take a break

Come back after a bit

And checking the guide is fine if you're 100% sure you're doing it right

[rustic sage]

how can i be sure of that though. I am doing exactly what the spoiler says and still cant get the result.

[shut quest]

There's times where I try to take a simpler approach, just write a file that says "hi mom" for basic sanity check, also walking away for an hour or day helps too.

[fathom pendant]

Are you ending your injection with -- -

[rustic sage]

yes. the ending is the two dashes followed by a space

[fathom pendant]

Are you using the htb-student password?

[blissful elm]

HTB_@cademy_stdnt!

[fathom pendant]

Copy/pasted?

[blissful elm]

yes

[fathom pendant]

From the section that gives creds on it?

I forget if that host has a diff password

[blissful elm]

yeah first paragraph gave the password

i used those creds only still error

[fathom pendant]

Are you doing ctrl-v?

[blissful elm]

tried both ctrl-v and right click

[rustic sage]

doing that was part of the module. I had no problem until the end. I created a .txt file no problem

[blissful elm]

vpn was not the issue

[fathom pendant]

Did you try a blank copy/paste into the terminal to see if it's on the clipboard

[blissful elm]

its working

[shut quest]

It's been a long while since I've done the module.

[blissful elm]

but not ssh

[fathom pendant]

Weird

[blissful elm]

really

i'll try later moving on

[fathom pendant]

A lot of stuff uses the internal linux host

[blissful elm]

maybe its common mistake i can't see but i will try later rn i can't see that mistake

[fathom pendant]

I'll spin this up in a bit and see

[rustic sage]

by all accounts the result I am getting should not happen. i just dont get it

this module was going so well too. I was starting to feel like I understood.

[shut quest]

I can't at the moment but some time later today or tomorrow (depending upon timezones) I can chat with you if you'd like. See if we can get it resolved.

[rustic sage]

right on. I appreciate that. I just input the answer from the spoiler because I am 90% sure I was doing things correctly, but I would love to chat and see if we can figure it out. No rush at all and I appreciate you.

[shut quest]

Kk, I'll let you know when I'm available.

[rustic sage]

finally finished footprinting wooo

10/10 module

[fathom pendant]

Typing it out worked fine for me, and doing the right-click paste worked

Weird ctrl-v doesn't

[blissful elm]

Oh

[blissful elm]

Thx

[fathom pendant]

Did you type this out in the search or copy/paste

Because I just did it with no issues

[rustic sage]

i typed it and copy and paste

[fathom pendant]

Then it should work

I just spun up 2 targets

And both worked

[fathom pendant]

Note if you tried typing, then tried the copy/paste, you'll have to change the filename at the end

For instance if you already have a shell.php, shell2.php

[rustic sage]

i must have typed it wrong once and then tried again in the same instance. I can now get the expect response to ?0=id. I just need to solve the problem now. I at least have something happening

[fathom pendant]

Yep just use other *nix commands to find it

[rustic sage]

@jolly cradle hi

[jolly cradle]

Hello

[rustic sage]

took me awhile to figure out how to cat the file, but I got it...... thank you so much for the help.

[rustic sage]

i finally figured it out.

[fathom pendant]

Gg

[west canopy]

Any time i have an RDP session on a windows target, i will open Notepad. Then copy paste into notepad, then copy paste from notepad into cmd/powershell/whatever

[lapis tangle]

Hey everyone, i'm stuck at footprinting (DNS) module on the question:
What is the FQDN of the host where the last octet ends with "x.x.x.203"?

i've tried all subdomain lists in SecList
plus zone transfers as well
Also used DNSenum

[fathom pendant]

Did you do a zone transfer to the base domain to get a basic list of subdomains you can start with

dnsenum isn't limited to just example.com

It could bruteforce hacked.example.com and give a result such as
got.hacked.example.com

[shut vapor]

Is anyone available to talk about the Footprinting > MSSQL questions? I am having a heck of a time connecting to the MSSQL service with the given credentials with mssqlclient.py, nmap's mssql scripts and even sqsh.

oop... ok... got it maybe?

yup, nvm. Got it. The instance is being glitchy. 😒

[cloud urchin]

Having trouble spawning machines in both eu and us regions..

[neon wadi]

Been trying for 30 mins. Can't spawn anything anywhere!

[shut quest]

Nice

[lapis tangle]

Yes I’ve tried

I got basic list

Internal, dev, app, mail1, ns

Applied zone transfer with all these

[spark spruce]

can anyone explain
why this payload is working
" II true II ""=="

and not this
" || ""=="

[lapis tangle]

That’s done now. Thanks

[shut quest]

You need to provide more detail like which module and section, the rest of the payload. Wrapping code in back ticks will make it easier to read.

`.... || true || ""==" ....`

[spark spruce]

Nosql Injection

server side javascript injection

[wanton ore]

Does any one know why this doesn't work?

I'm studying the model footprinting currently in the section IPMI. I want to get the password hash for the admin using metasploit (ipmi_dumphashes aux), now, when I use the metasploit's default ipmi_password it gives me the hash but not the cleartext password, when I change the pass_file to rockyo list it takes about 5m and then kills the whole process, where metasplolit prints "Killed" and crashes.

I used rockyou with hashcat and it worked.
Also I don't think it's a problem with my machine, the same thing happend with the Pawnbox.

[wise vault]

hi

in easy lab of attacking common services. how to use curl for geting shell. i tried the way from docs.txt which i downloaded from ftp. i found flag with mysql. but want to learn second method.

anyone?

but curl mentioned in docs.txt and from exploit-deb cmd not writing the test.php file

[wise vault]

you will never get cleartext password. you have to crack it with hashcat or with other tools

[spark spruce]

I am stucked on NoSql skill assess II
can anyone help me?

[split glade]

You just upload a php file with a php function that will execute system code on the target, instead of a txt file, eg
<?php echo '<br><pre>' . shell_exec($_GET['cmd']) . '</pre><br>'; ?>
then
file.php?cmd=<your command>

[wise vault]

will try thank you

[rustic sage]

y cant i chat in general

[wanton ore]

I read that I can get a cleartext if I change the pass_file in metasploit, looks like that person was mistaken.
Thanks

[wise vault]

hmm maybe

ok

[timber hatch]

windows privilege escalation / Interacting with Users, i have a question to the screenshot. the script i have to save as what , ps1 file? at my linux machine?

[fallen tusk]

How do I resolve this when RDP'ing into WS001 in module "Windows Attack and Defense"? I've respawned the VMs and waited 20+ minutes multiple times, with still no luck RDP'ing in as bob:

[lavish mango]

I believe that machine has a weird bug. Respawn it until it lets you log in. It took me 2-4 times respawning as I recall. This is also mentioned as a solution on the forum.

[fallen tusk]

Ahh... unbelievable. But ok, thanks

[lavish mango]

Yeah it's a weird one.

[fallen tusk]

Yeah, it worked now. I literally have been at this for hours and it worked on the 5th or 6th respawn. Frustrating

[lavish mango]

The labs can be frustrating at times especially from a latency perspective but I have grown more to appreciate how well they pair the learning material with seriously testing our comprehension. They really always go the extra mile to grind your comprehension. I guess a little latency and jankyness can be forgiven considering.

[quartz cloud]

Hey ! Could someone help me please ? im getting an hard time with that nmap exercice :

[fallen tusk]

Thanks! Yeah, that's a good perspective

[bold sinew]

There is a script you need to use with your scan. If you've done it right the output of the nmap will contain the flag.

The script in question is discussed in the module's content. If you don't know what you need to do you need to re-read it.

[quartz cloud]

Got it, i confused 2 argument thanks you

[bold sinew]

No problem 🙂

[real pond]

DOES ANYBODY K HOW TO FIND THE ADMINISTRATORS PASSWORD ON MY LAPTOP

🥺🥺

[muted kindle]

Reset it

[real pond]

no like somebody esle controls my laptop

💀

[dim wolf]

who has your laptop

[muted kindle]

??
What

[real pond]

sercret

[muted kindle]

[real pond]

but how do i find out that password

i can't download games and stuff its

[dim wolf]

ok well you're never going to know

[real pond]

likeput in admins password

[dim wolf]

this is also wrong channel

[real pond]

RLLY????????

[real pond]

SORRY

[muted kindle]

Ask whoever is “controlling” your laptop

[rustic sage]

My brain hurts when I see these posts

[dim wolf]

seems pretty illegal to me so i'm not gonna help you

[muted kindle]

Maybe someone set parental lock 😂

[pallid monolith]

How to get access to the off htb off-topic channel

[analog dock]

#welcome

[next bronze]

welcome @analog dock

[analog dock]

[rustic sage]

welcome @analog dock

[analog dock]

[burnt owl]

Anybody has a clue why bloodhound doesn't want my ingest?

Been trying for hours now with netexec bloodhound ingestor, bloodhound.py, sharphound exe,sharphound ps, v1, v2

[night bear]

1. A screenshot of a spreadsheet with various websites listed on it, including The Verge and Huffington Post. 2. The image is from the perspective of someone looking at the list of websites. 3. There are multiple rows in the table, each containing a different website name. 4. The table has a header row that includes labels for each column, such as "Website," "URL," and possibly "Date."

[burnt owl]

I am running Bloodhound CE through Docker Desktop on a windows machine but it has worked before. So I am really confused

[timber hatch]

windows priv escalation / interactign with users, should'nt i be able to save the .scf file within the departemtn shares?

[burnt owl]

Can this guy get banned how useless are those responses? talking about @night bear

[analog dock]

What module are you doing, what command have you tried etc

Right now your question is as bad as his response

[fading spoke]

Firewall and IDS/IPS Evasion. Find OS name. Cant find it. I tried: -D RND:5, -S 10.129.2.200 -e tun0, --source-port 53
The hint says neighbouring sub is blocked.

[burnt owl]

All the different version of "-c All"

[analog dock]

What module

[fading spoke]

0x56 you an offsec neutron, also working here now?

[burnt owl]

AEN

[analog dock]

I’m not an offsec neutron, and I’m not working here

[fading spoke]

you work for offsec

at least change your acc when your shilling lmaooo

[analog dock]

I do not

[fading spoke]

keep it up lmaooo

[analog dock]

I’m a community companion there, I do not work there

[fading spoke]

so go there

[analog dock]

What’s your problem lmao

[fading spoke]

advice people how only pen100 and pen200 is sufficient to pass the oscp whilst you study the cpts lmaooo

[analog dock]

Wtf are you talking about

[fading spoke]

fakes

hustler s

[analog dock]

I literally recommend everyone there to do the cpts path before starting oscp, just like I did

[burnt owl]

Maybe keep it on topic ?

[fading spoke]

thats illegal and you can lose your job for that

false advertising

[fading spoke]

you guys are sooooo dumb its unbelievable

[analog dock]

The only dumb one here is you

[burnt owl]

Agreed

[autumn pilot]

chill

[analog dock]

I have no fucking clue why you’re even coming at me out of the blue

I don’t even know you

[next bronze]

where's your oscp smart guy

[rustic sage]

Could I get some help with the verify bot? I deleted my old verified discord

[cloud wigeon]

now you know who i am

[cloud wigeon]

workin on it loser

[analog dock]

Oh dear fucking lord, not you again

[cloud wigeon]

oh yes

[burnt owl]

Well my bloodhound is working I think saying the fix spoils part of AEN so if you want to know DM me

Ban evading?

[next bronze]

quit yapping and go study then

[cloud wigeon]

lolll

[analog dock]

He has learn unlimited, instead of using the resources he got he prefers to act smart to others while failing his exams

And is extremely arrogant

[next bronze]

[analog dock]

Anyways I’m glad you got it sorted

[burnt owl]

Well even if he gets his OSCP any normal job opportunity will see right through him and not hire

[analog dock]

Probably has wasted half his sub already, if not more 😂

[next bronze]

if only there are other courses that can help

[fading spoke]

could I get some advice pls?

[analog dock]

Sure after the way you act all the time I’m so happy to help you

[fading spoke]

loll

definitely not meaning you

kid

[burnt owl]

He tried to add me xD

[fading spoke]

add?

lol

sayin you know me is add?

lmaooo

talk big off chat then

[burnt owl]

Yes cuz you have to send a friend request

[fading spoke]

?

[burnt owl]

I don't know you, I know people that behave like you.

[fading spoke]

why on this earth would i want to befriend you?

ah projecting

nice

[analog dock]

I would recommend an adjustment in behavior, especially since you’re in need of help so often. There’s many smart people here and in the offsec server, but if you continue to behave in a toxic manner no one will want to help you

[fading spoke]

Ahh I see what Offsec is doing. All the students that failed the OSCP recently have gone to the CPTS. And to make appear there are some overlaps between the two companies so as not to lose custumors they send the same employees to the competitiion.

I will contact HTB about this and ask if this is acceptable, messing up customers from a different platform.

[autumn pilot]

keep the normal tone in the conversations

or I will take it from you

[fading spoke]

is it acceptable to be attacked when asking a question by the competition in the chat from the course were i pay for?

[autumn pilot]

I can see that you attacked him after he asked the module you are working on

[fading spoke]

i have issues with this shill from offsec and they try to bring it here

[analog dock]

Worse, I wasn’t even asking him what module he was working on, just got attacked out of the blue

[fading spoke]

i do not prefer to be helped by offsec emplyees at htb

[analog dock]

Nor am I an employee for offsec

[autumn pilot]

Move on @fading spoke , and don't bring arguments/fights from other servers

[analog dock]

Nor am I a shill

[fading spoke]

agreed, if you can guarantee this person will leave me alone

[analog dock]

If anything I’m a shill for cpts, as I recommend everyone to take cpts before starting oscp

[analog dock]

You’re the one attacking me???? I didn’t even know this was you

[autumn pilot]

Take the timeout as a break for you to cool off

0x56 leave him alone and don't bother

[analog dock]

Will do👍🏼

[marsh forge]

Yo

[lavish mango]

I don't want to be helped by Capricorns.

[rustic sage]

Get CBBH from HTB Academy and do some CTFs!

watch some nahamsec/xssrat and stuff!

why?

[olive slate]

Hey guys, I was redoing the "AD Enumeration & Attacks - Skills Assessment Part I". On question 5 and 6 I was able to get the answers using crackmapexec with the --lsa flag. However, i remembered the first time I did this, i achieved the same results using mimikatz on an rdp session in MS01. But I couldn't for the life of me recreate the result using mimikatz. I used lsadump::secrets and found the cleartext password, but the output does not explicitly tie it to the tp**** user. Does anybody know how i can solve this just using mimikatz?

[sacred ermine]

if anyone did the kerberos module Pass-the-Ticket section, can someone tell why am I not getting the ticket while dumping the luid?

.\Rubeus.exe dump /luid:<0xdeadbeef> /service:krbtgt /nowrap ?

[rustic sage]

has anybody done the
OSINT: Corporate Recon module

is it really worth 1k cubes

[sacred ermine]

it suppose to print out the ticket, but rather just imports to current session, I can see it when I am checking klist command

my bad, appears its not even importing to klist...

[limber river]

iirc /ptt

to add it to the klist

[sacred ermine]

no, that should not be the case, in fact, I dont need to just import it to klist, its just confirmation that I imported the ticket, I need to renew it anyway, so it has to display the ticket

[limber river]

I jsut check my notes , the command is correct , just make sure the luid is correct

try triage again

[sacred ermine]

only 2, and none of it is working

I guess the lab is broken

[limber river]

weird should dump the ticket

[sacred ermine]

yeah, maybe I might report it somehow to the support, is there any ticket that I can raise?

[fathom pendant]

message support if it seems like a technical error

if you can get it some other way then #1234357888114364508

[limber river]

try reset the target first

[sacred ermine]

btw, let me try to change the vpn, maybe that will help)

[limber river]

just re-spawn it

[sacred ermine]

did it few times already

[limber river]

just for check try to dump other user TGT

[sacred ermine]

alright

works perfectly fine

[limber river]

so there's problem in the previous ticket

[fathom pendant]

¯_(ツ)_/¯

[sacred ermine]

I will stop it right here, will check it later or tomorrow have some work to do, thanks for the help!

[fathom pendant]

as has been stated a bunch of times

AEN is done blind; as the module itself is the walkthrough

if you're truly stuck, then keep trying

most use AEN as a practice exam

also FAIL parameters are tricky

you want to use something unique to the body, as stated in the brute forcing module

perhaps inspecting the actual login form itself using browser tools will help

[clear tide]

Hi All
is qwinsta.exe removed from Win11 ? for some reason I am not able to find it in C:\windows\System32

[fathom pendant]

what module does this relate to?

doing a quick google

[clear tide]

sorry I missed that,
its AD Enum and Attacks,

[fathom pendant]

afaik none of the hosts are windows 11

[clear tide]

thanks @fathom pendant , I thought it was something stupid, I did the google but missed this part,

[fathom pendant]

again you're already revealing a lot for what you're on

as stated AEN is done blind by many

so even posting your hydra command spoils it for many

and no, spoiler text doesn't do anything

people can just as easily click it

well if you tried with hydra and you failed to, then make an assumption on your own

:) if you already checked and the method used was manual, move on

[fading spoke]

Firewall and IDS/IPS Evasion. Find OS name. Cant find it. I tried: -D RND:5, -S 10.129.2.200 -e tun0, --source-port 53
The hint says neighbouring sub is blocked.

[normal sand]

Module: Attacking Common Services

Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer.
I'll be honest, I'm completely lost when it comes to DNS. I understand what the queries are but don't know how to use them properly.

I've managed to solve DNS in the modules before, it's just that I've forgotten. I tried going back but... it didn't help.

If someone could point me in the right direction to start with I'd greatly appreciate it.

I know I have to add the target IP address and the domain inlanefreight.htb to the /etc/hosts file but just don't get why.

[fading spoke]

domain name resolution

inlanefreight is the domain name

[cloud urchin]

when you visit a website, like google.com, you're not really going to a website. you're going to an IP address. your computer will reach out to a DNS server to resolve the hostname and turn it into an IP address for you. the reason you need to add the hostname and associate the IP in your hosts file is because it's a private network and the public DNS servers your computer calls to won't know what it resolves to because it's not on the internet.

[normal sand]

Sorry, and thanks a lot, but before ya'll continue, I get how DNS works. I completely understand all the theory behind it.

It's the practical aspect I'm struggling with.

[fading spoke]

i think supernuts explained it well, what are you struggling with?

[normal sand]

I also understand the purpose of the /etc/hosts file.

Well, in the question they've given me the IP address, which I'm told is the DNS Server? And I've been given a domain.

Let's assume they didn't give me the domain though, is there a way to obtain it?

Would it be using this command?

nslookup -query=PTR <ip_addr>

[fading spoke]

if its not public, i think not

thats why you need to add it yourself to the /etc/hosts file

so your /etc/host file is the dns

i think

[normal sand]

But why? Don't I have to query for inlanefrieght.htb on the target DNS server?
So wouldn't the command be:

dig any inlanefreight.htb @<target_ip>

I know this is wrong cuz I ain't getting any output.

[cloud urchin]

when you use dig, the @ indicates that's what it will use as the nameserver

dig any inlanefreight.htb (the host you want to dig) @<name server>

[normal sand]

The host I want to dig?? I thought there were only two params: the nameserver and the thing you want to query, which in this case would be inlanefreight.htb

This part, how to use the dig command is confusing me. Is the target IP given to me the nameserver?

[cloud urchin]

you could simply dig any inlanefreight.htb, because that's a private address your DNS server won't resolve it. That's where the @<name server> comes in, that tells dig to use a specific name server, ie. the nameserver on the private network

correct

[normal sand]

In that case, why doesn't the command from this earlier message return any records?

[cloud urchin]

i mean i don't know for that particular module, but for the modules that call for you to use @<ip of the vm you spawn on htb> then yeah it's probably a nameserver

[normal sand]

Nvm, I'm so sorry, it does, I missed the @

[fringe urchin]

From what i remember dig needs the @ and nslookup doesnt

[normal sand]

Alright, the only thing I don't understand now is why I need to add the target IP to the /etc/hosts file?

[cloud urchin]

you don't

[fading spoke]

only to being able to resolve it by name

[normal sand]

Also, when I ran the command, I got this output. The IP addr for ns.inlanefrieght.com says its 127.0.0.1, so it's the localhost, as in the target IP or my attack host?

[cloud urchin]

that's an A record https://support.google.com/a/answer/2576578?hl=en#zippy=%2Cconfigure-a-records-now

above you see SOA and NS records

[normal sand]

Yeah, I understood, so since the A record points to the localhost IP, it's referring to the server itself? So the target IP in this case aka the nameserver?

[cloud urchin]

i'm not sure what oyu mean by target ip. it's the address record of the host displayed in your picture, ns.inlanefreight.htb

[normal sand]

By target IP I'm referring to this IP

[cloud urchin]

i believe that IP acts as inlanefreight.htb and is also ns.inlanefreight.htb, so yes

[normal sand]

What I'm asking is if 127.0.0.1 here means my attack host or the nameserver.

[normal sand]

Oh ok

The hint tells me to use subbrute, so I need to add inlanefrieght.htb to the hosts file for that, right?

[fathom pendant]

hashcat should work you do not need to use the mask given by the module, but the mode is correct

[fathom pendant]

127.0.0.1 is relative to the record

[fathom pendant]

nope

[normal sand]

So this?

[fathom pendant]

just specify the ip in the resolvers.txt file

[fathom pendant]

you can specify them both in the same line

btw

[normal sand]

Resolvers.txt file?

[fathom pendant]

yes for subbrute

look at the tool and you'll see

[normal sand]

I actually downloaded the binary for it.

[fathom pendant]

didn't realize it had a binary

[normal sand]

I wasn't able to install it properly on the pwnbox using the cli.

[fathom pendant]

?

[normal sand]

Got it under releases on GitHub.

[fathom pendant]

it's just git clone --> cd to subbrute --> run tool from there

[normal sand]

I couldn't find the file when I downloaded the repo

[normal sand]

In which dir is it?

[fathom pendant]

that's subfinder

not subbrute

[normal sand]

Oh damn, my bad.

[fathom pendant]

that's probably why there's a difference

[normal sand]

Sry, brain dead already.

[fathom pendant]

there's even a direct link in the module/section

[normal sand]

So I just add the same records I added in the host file to the resolvers?

[fathom pendant]

nope

[normal sand]

The resolvers.txt file seems to be filled with IP addresses? There doesn't seem to be any domains in there.

[fathom pendant]

just the ip

all the IPs are public domain servers

[normal sand]

Alrighty, but why does the example in the section show them appending a domain name to the file?

[fathom pendant]

the example is using a .com domain

[normal sand]

Ahh, it's appending the dns server my bad.

[fathom pendant]

so it has a public name server

so it can use the fqdn with no issues

also it's not appending

it's just basically rewriting the .txt to only have that in it

> replace
>> append

[normal sand]

So once I get the subdomains I just perform an axfr query on them to find the flag?

[fathom pendant]

basically

yeah

[normal sand]

Btw do you have any idea how the subbrute script is able to find these subdomains?

[fathom pendant]

¯_(ツ)_/¯

i didn't read the script

[normal sand]

Welp, maybe I'll dive into the source code ltr.

Thanks Marcie and SuperNuts.

[fathom pendant]

it's likely just bruteforcing the names and returning the positive results

[normal sand]

You sure about that cuz the section says it can be used on hosts that don't have access to the internet?

[fathom pendant]

i mean you can likely just for name in $(cat names.txt); do dig axfr $name.inlanefreight.htb @ip;done

[normal sand]

Maybe cuz it only uses the dns server on the lan.

[fathom pendant]

and it's not using the internet

[normal sand]

So it's only using the local dns server?

[fathom pendant]

well more specifically

it's using the servers you specify in resolvers.txt

it's likely running a handful of for loops

unsure if it does for x in names.txt and for y in resolvers or the reverse

¯_(ツ)_/¯

[delicate steeple]

Hey i am stuck at footprinting the service IPMI at the last question 'What is the account's cleartext password?'

i have found the hash made a txt but couldnt get the pw with the metasploit console and hashcat, can someone give me a nudge ?

[normal sand]

Any idea how long this script takes to run?

[fathom pendant]

it can take a few minutes

[normal sand]

Do I just perform axfr queries while waiting for more results?

[fathom pendant]

i gave you a nudge earlier

[fathom pendant]

yep just try any results you get while you wait

iirc the names.txt is like 100k words long

so if you're waiting for it to finish...

[fathom pendant]

hashcat should work

[normal sand]

Also, correct me if I'm wrong, hopefully I've finally got this DNS thing down but the command will be:
||

dig axfr <subdomain>.inlanefreight.htb @<nameserver_ip>

||

[fathom pendant]

that is correct

since you have it in your /etc/hosts you can also do @ns.inlanefreight.htb

¯_(ツ)_/¯

[normal sand]

Ahh okay, nice. I think I finally get the whole command syntax thing.

[fathom pendant]

¯_(ツ)_/¯

dig is simple syntax

[delicate steeple]

i do not see anything 😮

[delicate steeple]

i have been trying no succes :/

[normal sand]

I was just over-complicating things in my head 🤦‍♂️

[fathom pendant]

well you deleted your previous question

[fathom pendant]

what is your hashcat command, i likely know what you're doing wrong

you're likely adding the mask (which isn't correct for this scenario)

the metasploit module uses a small wordlist to try and crack the pw; if not it will output the hash as username:hash

the mask given is only for very specific scenarios that the exercise doesn't fall under

you can use the given wordlist i believe for this, or rockyou

[delicate steeple]

hashcat -m 100 hash.txt /usr/share/wordlists/rockyou.txt

in the hash.txt i put the hash2 after the admin(hash1):(hash2)

[fathom pendant]

wrong mode

[delicate steeple]

i have tried 0 and 5300 too

[fathom pendant]

those are also wrong modes

[delicate steeple]

😦

[fathom pendant]

it's the same mode as the mask one

as it's IPMI

just using a wordlist instead of a mask

idk where you got 0, 5300, or 100 from lmao

https://hashcat.net/wiki/doku.php?id=example_hashes

[delicate steeple]

i went to the htb forums

[fathom pendant]

well those people were wrong

[fathom pendant]

do a search here for IPMI

[delicate steeple]

oke 7300

for sha1

[fathom pendant]

now go crack it

first place to look when unsure is RTFM

and thank goodness hashcat has a whole list

I believe you can just do hashcat hash.txt and it tries to auto identify it

also 0 and 5300 are both MD5 related

[grave rose]

Hey I'm in the WORKING WITH IDS/IPS room, Suricata Rule Development Part 1 page
What is the minimum offset value that can be set to trigger an alert?

I searched for the first content and i found that it is in the offset 0x500, but when i submitted that value it didn't work, but it generates log ( i found the correct answer to the question but i don't understad why) can some one help me with that?

[fathom pendant]

is it expecting 0x<hex> or just the <hex>

[grave rose]

it takes both

[fathom pendant]

is it higher or lower than you expect

[delicate steeple]

when i use the 7300 i get separator unmatched , no hashes loaded but with 100 i get exhausted

[grave rose]

it was way lower than 0x500

[fathom pendant]

did you do admin:hash in your hash

[fathom pendant]

and did you test with that offset?

[grave rose]

yup

[fathom pendant]

¯_(ツ)_/¯

[fickle thicket]

bought the oscp 2 days ago but it starts in july instead. Just started on the attacking common application module. 🤣 abit worried about passing oscp 🤣

[fathom pendant]

OSCP is cake comparatively

the biggest thing is avoiding msfconsole modules if you wanna prep for OSCP as well

[fickle thicket]

Anyone knows how does OSCP AD exam compare with htb AD module skills assessment?

[heavy edge]

i may do oscp for the resume cred tbh

[fickle thicket]

Is it easier or harder?

[fathom pendant]

i've heard it's fairly simple

but the exacts can't be discussed, obviously

[heavy edge]

like thats the only reason i see forking up 1650

[fickle thicket]

Just for the cert 🤣😂 but knowledge wise is still CPTS ftw

[heavy edge]

thats what im saying

id only do it for the resume bufff

then never again lmao

[fickle thicket]

I got the urge to do oscp immediately after completing windows privilege escalation WITHOUT doing any boxes beforehand🤣 but it is a huge gamble

[heavy edge]

dude i feel like GOAD lab is like such a good lab to do

3 forests 5 machines

[normal sand]

GOAD?

[heavy edge]

i just finished Goad-Lite and gonna do the full next then the nHA

[heavy edge]

https://github.com/Orange-Cyberdefense/GOAD/tree/main

its an AD lab that, when i did the LITE edition, was kinda based off the CPTS course

[delicate steeple]

i used the hash identifier complete with admin:hash1:hash2

gave me a not found
with just hash2 i got that its sha1

[heavy edge]

there was ALOT that i found from cpts course

[fathom pendant]

weird

there shouldn't be a hash1:hash2 from what i recall

just username:hash

(the example hash the first hash is the username)

[analog dock]

It’s easy after cpts path

[fickle thicket]

Btw do u guys use

nmapAuthomator.sh?

Or just nmap alone

[fathom pendant]

spoilers dude

but just remove the admin: part

[delicate steeple]

is it ? sorry :/

and yes i did that

[fathom pendant]

but i'd delete the hash you posted

[delicate steeple]

i deleted the message

[fathom pendant]

yeah considering it's part of the module and reveals information

but anyway

i literally just did this

hashcat -m 7300 ipmi.txt /usr/share/wordlists/rockyou.txt my hash had the username: removed

you copied the whole thing yeah?

i was mistaken when i didn't see the other : for the pw

[delicate steeple]

aaaahh

i finally got it thank you so much!

i was so stuck not copying the whole thing because the identifier did not give me anything

[fathom pendant]

yeah the identifier can be hit or miss

especially if there's no specific signature like $b5$<hash>

[limpid frigate]

i'm having a problem on Citrix Breakout (Windows priv esc)

i can't download the default desktop after login the site for rdp

it keep saying " An error occurred while making the requested connection. " when i click the default desktop

[long orchid]

i tried this, but says permision denied

[fathom pendant]

sudo fdisk -l then

[long orchid]

lsblk is the right one since fdisk -l says permision denied, ty

[fathom pendant]

i mean both work

as you might learn multiple tools do similar things

[fathom pendant]

permission denied = try with sudo

[sacred ermine]

how can I make that green bubble pop up, I dont have any extension that blocks it

[fathom pendant]

ad-block

if you have a dns adblock like a pi-hole then it could block it

for w/e reason adblocks don't like intercom

[sacred ermine]

no, I dont have any installed extensions except vpn(and I have not enabled it)

[fathom pendant]

¯_(ツ)_/¯

could be the browser

[sacred ermine]

the issue I was talking about earlier still remains, so I wanted to let them know

[fathom pendant]

just email them then

[sacred ermine]

might be, but I dont think that chrome blocks it

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

try going to it in incognito mode and see

[lyric inlet]

Hello anyone for a question about dacls attacks 2 skill assessments ?

[fathom pendant]

Just ask your question as long as it doesn't spoil it

If it might spoil, redact usernames with first initial* i.e. f*

[eager siren]

Guys, i need some help, in footpriting IMAP/POP3 i am connecting to imap using openssl and then i am trying to list all the direcrories using the LIST "" *, i tried mutliple approaches but nothing seems to be workign i always get Error in IMAP command receiced by server

A1 LIST "" *
A1 BAD Error in IMAP command received by server.

[fathom pendant]

A1 List "" * iirc is the command

spacing is important

also it's backticks/grave to mark code
`like this`

[eager siren]

A1 List "" *
A1 BAD Error in IMAP command received by server.

i still get the following result

[fathom pendant]

are you logged in?

A1 login user pass

then try running the command again

[haughty tree]

What does this attack have to do with time...?

[eager siren]

i am trying to login but i get Authentication failed, i tryed with user:pass, username:password, user:p4ssw0rd and nothing

[fathom pendant]

brother the syntax

[eager siren]

A1 LOGIN user pass this si how i am trying to login

[fathom pendant]

and you're given a username and password to boot

A1 Login <username here> <password here>

read the last paragraph of the section, it gives you a user:pass to login with

[eager siren]

Yes i didnt read the last paragraph

thanks hahah

[fathom pendant]

https://tenor.com/view/shocked-reading-gif-18060591

[eager siren]

[wheat hemlock]

Looking for help on sherlock ultimatum stack without a clue

[fathom pendant]

wrong channel; #sherlocks; read and follow #welcome to access it

[dense pewter]

Unless I'm missing something, I think the LDAP service is broken on Attacking Enterprise Networks. I can't run SharpHound because it throws an error regarding LDAP authentication (despite the walkthrough doing so without issues). Also, I can't Kerberoast because NetExec also throws an error regarding LDAP.

Would really appreciate if someone could verify if they are also having these issues. I want to finish this module ASAP so I can take the exam

[fathom pendant]

try changing VPN regions

[dense pewter]

Will do

[fathom pendant]

that should be one of your first steps if you suspect issues

if changing VPN regions doesn't work, just reach out to support

it's literally their job to deal with technical issues

[vague tundra]

Will a student subscription unlock me all the Penetration Tester Job Role Path modules ?

[dense pewter]

Yes

[shut quest]

Yes, it will unlock all tier 2 and below, the pentest job role path is at most tier 2

[vague tundra]

sounds good, that's the path that prepares you for CPTS right?

[shut quest]

Correct

[vague tundra]

I need to finish it in a month

[shut quest]

Best of luck? Hopefully you have already started it. I'm not personally aware of anyone completing it in less than three months. I think most take about half a year.

[vague tundra]

Huh? doesn't it say the following

[fringe urchin]

Thats 8hoirs a day/ not getting stuck anywhere

And you need to understand the material aswell and not just rush through it

[shut quest]

It does say that, but like I said I'm not aware of anyone completing it that quickly. You get stuck, you have a life, and grinding that hard can cause burn out.

[vague tundra]

dang it now sounds like a money trap

still gonna give it a shot though

[fathom pendant]

People who complete it that quickly are already in the field, that timer is meant more for businesses not individuals

[fathom pendant]

This is also dependent on you understanding the fundamentals

[fringe urchin]

You can buy plat and gold and you get enough cubes to unlock all modules/ or you have student sub which is 8 per month. I havent done any modules in a month or two and still dont feel like its a waste of money. Life came in the way

[shut quest]

I have no doubt there are people here that can and have, but for those it's a refresher not really learning material.

[fathom pendant]

Yep

And for other people they just paid attention and know how to adapt

[vague tundra]

I am glad I asked here, thank you all for saving me from a bit of shock.

[fathom pendant]

Comparing to other people's timelines is cringe anyway

Go at a pace that's comfortable to you

[fringe urchin]

^
Some ppl have knowledge already in some areas and will have it much easier then someone with a fresh start.

And aswell burn out can happen

[fathom pendant]

Or life events rearranging priorities

[shut quest]

Anyhow everyone is saying to set a realistic timeline for yourself. If you're completely new to the field there's a lot to learn, soak it in, don't speed run it. Keep yourself happy.

[haughty tree]

And I was thinking that I was going in a slow pace since theres no way im completing it in 43 days lol

[fathom pendant]

Again 43 is just there for businesses

That's it lmao

[haughty tree]

Some modules that say 8 hours took me a week to complete since I went in depth into anything mentioned there

[fathom pendant]

Unexpected issues happen, especially between keyboard and chair

[little bear]

Update: Im getting timeouts when leveraging transfer tools with files above 10K.
Progress: Have SQL01 NTLM hash, but exhausted with xato and rockyou

May I have a nudge? I thought it could be a pivot issue, perhaps I also didnt enumerate the db, certutil certainly wants to work, and it hits the http server, but I'm missing something... very interesting

[fathom pendant]

Change vpn regions?

[zealous rune]

hmmm i've not got to that module but i had a similar issue on another module and switching vpn locations helped

🙂

[little bear]

I have

Im thinking about using ms01 to access sql01, but Im wondering if that is the intended way

Otherwise, Im about to hamer down on some offline cracking lmao

[fathom pendant]

If it works

¯_(ツ)_/¯

[little bear]

sigh that is tru

[zealous rune]

I've recently discovered that the end of module screen contains a list of machines recommended. I find some of the machines a bit "strange." for example end of footprinting module it suggests Sekhmet and a few other Insane machines

That doesn't seem to correspond with the content in the module.

or am i missing something

[fathom pendant]

Because footprinting is the building block for all machines

[fringe urchin]

Me moving to diff country and not bringing my computer with me, so have to do it on phone till he arrives

[fathom pendant]

Recommended just means the box in some form has something to do with what you learned, even if only a fraction

[sterile hinge]

Anyone having issues with targets not spawning?

[zealous rune]

ah ok so not expected to "root" the machines

[fringe urchin]

Well footprinting is gonna be used to get a footprint on many machines. And yea you usually cant get root woth it since it gives the initial access to it. Maybe some easy machines have some root flags in smpt or samba etc but its not common

[zealous rune]

ok thx

[fringe urchin]

Some windows machine tends to take a while to spawn

[buoyant void]

Finally 💪🏽

[hexed oyster]

Almost at the end of the SQLMap essentials and I just have a side question: is it common for "modern" dbms' to ship without the FILE privilege enabled on useres? Am I understanding that correctly?

[fathom pendant]

Generally it's default unless specified sorta thing

[hexed oyster]

@fathom pendant so typically on by default or typically off by default?

[fathom pendant]

Typically off iirc

But gotta check docs for that tbh

[hexed oyster]

That makes more sense from a security standpoint

[hexed oyster]

of course

[fathom pendant]

Sec standpoint and default standpoint often are misaligned

[hexed oyster]

@fathom pendant Oh, I know that all too well...

https://tenor.com/view/stewie-rocking-shocked-trauma-family-guy-gif-3629549

[fathom pendant]

Default AD is insecure

[hexed oyster]

@fathom pendant there's a certain section of the population that would argue that AD is the vulnerability.

[vague tundra]

I am wondering why the Windows Privesc needs around 12 times more time than the Linux Privesc?

[fathom pendant]

More to do in Windows

Also not 12x

Just 4x

1 day in context is 8 hours

But as said previously, ignore the timers

[north bramble]

true, takes me 4x of whatever they say. 3 months in and done barely 50% of pat thats supposed to take 1.5 months

[fathom pendant]

You also have brain damage /s

[sick frost]

Is anyone facing issues with connecting to the Internal machines on Attacking Enterprise Networks module. There is a lot of delay in my case why accessing those webservers. I don't have any problems with proxies and stuff. I previously did the same module with no issues like this. I'm not doing anything different this time.

had the similar issue while working on Exploiting Web Vulnerabilities in Thick-Client Applications.

[fathom pendant]

Change vpns

Yes this can affect

[sick frost]

I was using tcp and I tried to use udp vpn. Still no luck.

[sick frost]

might as well try different servers.

but I'm worried that it might increase the latency

[fathom pendant]

It would be negligible

[gray glen]

S

[sick frost]

still no change. Can I DM you? I don't want to spoil the lab for others?

[fathom pendant]

No

I'd message support

I haven't done this lab myself

[sick frost]

oh. No problem. Thank you.

[fierce mason]

im getting this error while doing the sudo 0-day section in linux priv esc:
./sudo-hax-me-a-sandwich: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./sudo-hax-me-a-sandwich)

i tried compiling on the target machine but it doesn't have gcc installed

[zealous rune]

does glibc 2.34 exist on the box?

[fathom pendant]

Well you need to compile statically likely

[fierce mason]

how do i do that

[fathom pendant]

google ¯_(ツ)_/¯

Or figure what library is needed for it and compile it with that

[calm talon]

Hello everyone, I keep getting this error when trying to run the smbclient command in the Introduction to Windows module.

do_connect: Connection to 10.129.163.52 failed (Error NT_STATUS_IO_TIMEOUT)

I made connection when I xfreerdp the windows, and I created the new file and did the share they asked for and then it wanted me to smbclient for a list. and that is when I get the above error message. I been working on this for two days now. May I please get a little hint what I might be doing wrong. Thank you in advance.

[fathom pendant]

Timeout means it's taking too long to respond

What is your ping to the lab?

[calm talon]

32 packets transmitted, 0 received, 100% packet loss, time 31421ms

[fathom pendant]

Try 1) resetting target
2) changing VPN region

[calm talon]

thank you I will try those thank you thank you thank you will let you know what happens

I reset the target and this now happened
ping 10.129.163.52
PING 10.129.163.52 (10.129.163.52) 56(84) bytes of data.
From 10.10.14.1 icmp_seq=10 Destination Host Unreachable
From 10.10.14.1 icmp_seq=11 Destination Host Unreachable
From 10.10.14.1 icmp_seq=12 Destination Host Unreachable
From 10.10.14.1 icmp_seq=13 Destination Host Unreachable
From 10.10.14.1 icmp_seq=14 Destination Host Unreachable
From 10.10.14.1 icmp_seq=15 Destination Host Unreachable
From 10.10.14.1 icmp_seq=16 Destination Host Unreachable
^C
--- 10.129.163.52 ping statistics ---
17 packets transmitted, 0 received, +7 errors, 100% packet loss, time 16208ms
pipe 4

[fierce mason]

that worked, thanks

[fathom pendant]

Eh that doesn't generally mean much tbqh

Try walking through the steps again

[calm talon]

okay thank you

[fathom pendant]

Since it's windows, it could just be blocking the pings

[calm talon]

could be thank you

okay reset target and changed the VPN
walked back through the steps and coming up with the same error when I try to use the smbclient command
it lets me do the xfreerdp command and create the new folder and apply the share settings to the folder.
but then it will not let me do the smbclient command unless I am using the command wrong.
smbclient -L 10.129.201.57 -U htb-student is the command I am using

[candid night]

Hey, could someone help me understand output from this command? I struggle to get my head around AD section

PS C:\Tools> Get-ADDomainController -Filter *
ComputerObjectDN           : CN=ACADEMY-EA-DC02,OU=Domain Controllers,DC=LOGISTICS,DC=INLANEFREIGHT,DC=LOCAL
DefaultPartition           : DC=LOGISTICS,DC=INLANEFREIGHT,DC=LOCAL
Domain                     : LOGISTICS.INLANEFREIGHT.LOCAL
Enabled                    : True
Forest                     : INLANEFREIGHT.LOCAL
HostName                   : ACADEMY-EA-DC02.LOGISTICS.INLANEFREIGHT.LOCAL

I'm looking for a DC name and I got it in the "Domain" row but I don't know what are all those DC entries in "ComputerObjectDN" and "DefaultPartition". I mean I know those are AD objects but what is their purpose, why do they spell out the DC name section by section?

[fathom pendant]

smbclient -L //ip/ -U "user"

Or smbclient -L \\\\ip\\ -U "user"

[little bear]

Update, xp_cmdshell has become nc powershell

Anything (file transfer) bigger than a set size (lets arbitrarily believe 1k) hangs the connection, so now it's about grabbing the file whether into memory or copy... all PE files... are too big... or maybe Im still misunderstanding something

Small progress and small win tbh which Ill take

Any ideas?

[fathom pendant]

I had no issues downloading and running files

¯_(ツ)_/¯

Though for sql01 admin you'll want to print something or maybe think about potatoes

[little bear]

Bruh 🥲

Hmmm

[fathom pendant]

😉

Those both relate to the same priv

Which yes was mentioned

[little bear]

Ye Im like looking at file sizes for all of those xD

[fathom pendant]

It has nothing to do with arbitrary file size limits

I was able to download both

[little bear]

Beats me, but I press on no less

Should I just be extra extra patient perhaps? (Thinking about all those 30 mins times Ive sat around)

(Making humor)

[calm talon]

for this one I get the same error
do_connect: Connection to 10.129.201.57 failed (Error NT_STATUS_IO_TIMEOUT)

[fathom pendant]

I forget the timeout flag for smbclient

But change vpn regions and respawn the target

[bitter meteor]

Hey guys, someone knows how to enroll for "Information Security Foundations" path?? I try to see in the path section, but i dont find it...

[calm talon]

sorry for wasting your time if I would have continued to read instead of trying to make it work, I would have noticed that the windows firewall is blocking access due to me using Linux and it being on a different workgroup. 🤦‍♂️

[shut quest]

If you click on paths then skill paths you will see it and can click on the enroll button

[clear bison]

I am at module Password Attacks/Pass the ticket on Linux/question 7 : "Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio" I have obtained a valid ccache for julio, and used it according to instructions in the module. But when I try to list julio's shared directory, I keep getting the error message: gse_get_client_auth_token: gss_init_sec_context failed with Miscellaneous failure (see text): encryption type 0 not supported
gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/dc01 failed (next[(null)]): NT_STATUS_LOGON_FAILURE
Could someone give me an idea what I am doing wrong?

[shut quest]

what steps did you take?

[clear bison]

I found the ccache files for julio in /tmp after getting root from svc_workstations.

there were two ccache files. from klist, one expired in 2022 and one expires in 2070 - same as svc_workstations one

I exported the valid one to the KBR5CCNAME variable and checked with klist - it succeeded and the principal is now julio

I tried to list julios share files using the smbclient command with kerberos authentication, no password,

I keep getting the same error

[shut quest]

what exactly did you type in?

[clear bison]

smbclient //dc01/julio -k -c ls --no-pass

[shut quest]

what happens if you do it without the -c ls ?

[clear bison]

don't know. will try

well darn. the pwnbox closed out while I was here. hang on a minute please, going to have to reconnect

S---T! the whole connection to the VM closed out.

Gotta love htb academy VPN

[fathom pendant]

Really only an issue with the browser pwnbox

[fathom pendant]

Yeah if pwnbox runs out of time it fully closes

[clear bison]

Still had 68 minutes according to the timer

[fathom pendant]

Eh the timer can "freeze up" on the page and not be accurate

At least for pwnbox

Also pwnbox timer and target timer are different

[clear bison]

Anyway, I opened a new pwnbox and a new VM and I am logging in as svc_workstations --> root again

[shut quest]

gotta get those reps in ;'D

[fathom pendant]

this is why I use my own vm ¯_(ツ)_/¯

[shut quest]

command history and saving scripts is worth it alone

[clear bison]

The problem is that with the VPN I am using - student - it freezes up constantly and takes forever. the real price of being too cheap to get premium

So pwnbox is less likely to freeze up on me

[fathom pendant]

Paying doesn't change anything

The vpn regions are all the same regardless of subscription tier

The freezing is more likely due to misconfigured vm settings rather than vm

Unless you're in Asia/not close to vpn servers and have to use like the SG pwnbox

[clear bison]

Nope. in USA

[fathom pendant]

Then it's likely misconfigured vm

[clear bison]

Ok, back in business. I am now back to being root and have exported the valid ccache to the KBRCCNAME variable

[fathom pendant]

KRB5CCNAME

[clear bison]

let me try gubarz's suggestion first and just use smbclient without the -c ls

[fathom pendant]

Make sure it's the right variable

[clear bison]

yes, that last was a typo. It is in the KRB5CCNAME variable

[fathom pendant]

https://tenor.com/view/sweaty-sweat-heat-hot-wipe-sweat-gif-17716050

[clear bison]

exactly!!

AND......c--p -same error

any suggestions? I'm stumped

[shut quest]

what does klist say

[clear bison]

root@linux01:~# klist
Ticket cache: FILE:/root/krb5cc_647401106_kkpsKh
Default principal: [e-mail]

Valid starting Expires Service principal
01/01/70 00:00:00 01/01/70 00:00:00 krbtgt/[e-mail]

[shut quest]

that's not the right ticket

[clear bison]

well, that would explain it. I thought that was the problem, but logging out and logging back in after a a long while (a fix for getting the correct ticket to appear in /tmp found in the forums) only produced the two tickets I tried. This one has a valid ending date, but I see starting date is also in 2070. did I say S--T already?

any suggestions for getting the right ticket to appear?

or is this a matter of searching for it in unlikely places that it would never appear in the real world?

[shut quest]

you're looking in the rihgt area, but you're looking for valia starting and expiring dates

[fathom pendant]

@clear bison use the EU vpn

[fathom pendant]

Nah it's an issue with the target spawn

The correct ticket in this instance is being spawned with an invalid date, defaulting to 0 epoch

Aka 01/01/1970

The properly invalid ticket is like 10/20/2022 or something

[clear bison]

there are only two ccache files in /tmp for julio. I have tried both of them, and one is obviously expired. This one has a valid expire date but doesn't work. So what to do?

[fathom pendant]

. This

Switch to EU vpn and reset your pwnbox and target

Not EU pwnbox

And yes it makes a difference

Even when using pwnbox

[clear bison]

OK. Will do. I love repeating stuff. Lets me do it without thinking

[fathom pendant]

But yes, you're looking in the right spot

[clear bison]

"target is spawning"

and......"target is spawning"

using eu-academy1 VPN for target

Well, I am getting worse freezing up with the eu VPN than I did with the US one. Can't even get the pwnbox instance to remain stable for more than 30 seconds or so before it terminates.

No wait, that doesn't make sense, the pwnbox isn't on the eu VPN. Sorry.

Switching the Pwnbox VPN to UK - shortest lag listed

Well, packing it in for the day. Now I can't even get the pwnbox to initiate. keep getting "Request validation failed"

[fathom pendant]

Just have patience bro lmao, not everything is immediate validation

[clear bison]

but I'm American! It has to be NOW! NOW! NOW!

[fathom pendant]

https://tenor.com/view/skill-issue-urge-resist-cat-gif-25536160

[clear bison]

of course it's a skill issue, don't pop an eye out

!

That's why I'm here. To learn skills. Try to remember in your distant past what it was like to be a padwan, master Obi-wan

https://tenor.com/view/thats-why-im-here-obi-wan-obi-wan-kenobi-star-wars-gif-18535648

[fathom pendant]

Or I'm just making a joke

¯_(ツ)_/¯

Don't gotta take it seriously

[clear bison]

And you are very funny. Really, I'm not being sensitive, just trying to also tell a joke.

[fathom pendant]

https://tenor.com/view/you-should-take-a-nap-pete-davidson-pete-davidson-turbo-fonzarelli-it's-advisable-that-you-take-some-time-to-rest-netflix-gif-8303575284615506315

[clear bison]

Always my go-to solution for many of life's frustrations. I'm glad we see eye to eye on that

[fathom pendant]

Smoke a fat doink and take a nap

[clear bison]

Doinks are denied me, da--it. Medical reasons. partly why I believe we are all already in hell, or at least me. So, whenever I can once again get to the target box, should I just keep logging in until I get the correct ccache to appear in /tmp?

[fathom pendant]

Spin up box, wait a few minutes, connect, pray

The EU ones have been more reliable with it

[clear bison]

you fill me with confidence and inspiration. I shall go forth and spit up boxes... uhm, whatever

[hexed oyster]

Anyone have a moment to chat about SQLEssentials Final Assessment?

Found a page that makes a post request, I just wanted to verify that I'm on the right track.

[fathom pendant]

Try and see

[hexed oyster]

I'm getting some results, but it keeps coming back with [CRITICAL] all tested parameters do not appear to be injectable.

https://tenor.com/bTQ6D.gif

[fathom pendant]

Then try manually selecting the injection point

¯_(ツ)_/¯

[hexed oyster]

🤣

roger that!

[fathom pendant]

Sqlmap uses * as the injection point

[hexed oyster]

@fathom pendant yep, got that in there. 🫤