modules

[fathom pendant]

¯_(ツ)_/¯

[hexed oyster]

--data="POST DATA GO HERE"

eh, no worries. I'll keep plugging away.

[ebon storm]

hey guys ive been stuck on this question Hunt 2: Create a KQL query to hunt for "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder". Enter the content of the registry.value field in the document that is related to the first registry-based persistence action as your answer.

Can anyone help me out?

so far I've used event.code:13 as my filter alongside registry.path: Run

but im not exaclty sure what answer the question wants?

[fathom pendant]

The value

[ebon storm]

registry.value?

omg, i just went one by one and copy and pasted and then one of them worked... dead

thanks, but i would really like to know the why behind the question and answer. I've been stumped on this question for a while

[fathom pendant]

It's setting persistence

So a specific value is changed/added

[ebon storm]

I see its the only one that had the host.name with powershell as well

sorry, process.ext

[bitter meteor]

thks! I'm looking in "Job Role Paths" section...

[lucid halo]

Hey, @everyone I'm working in Linux Fundamentals Module 18, I'm stuck on the first question. I've tried using "find /etc/ -name *.log 2>/dev/null". When I use this command I'm brought back to the Command Line. I am novice, hoping someone could walk me through this question and the second.

[zinc nimbus]

in **Active Directory enumeration and attacks module section Attacking Domain Trusts - Child -> Parent Trusts - from Linux ** someone pls help idk why this is happening
it takes forever for me to get a shell and it doesnt give it

i already made the golden ticket and found the domain sid, enterprise group sid and nt hash for krbtgt but it doesnt work

[mint beacon]

Where should I begin

Somebody help

[spark charm]

target ip not spawning ???

[mint beacon]

I have no experience in hacking or programming. But I am interested in learning can somebody help

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[next bronze]

reset the target/switch servers

[zinc nimbus]

i tried that too several times

i will try again right now tho.
it's also weird that when i use lookupsid.py the output always ends in a timeout(1st img) but the output should be like (2nd img)

[shut quest]

You won't find it in the jobs role paths, it's under the skill path

[next bronze]

netbios timeout is usually bad connection, you sent a request and the server did not respond in time

[spark spruce]

module- intro to NOsql injection skill assess ||
i am unable to get right path
anyone can instruct me

[mortal locust]

New-ADUser -Name "MTanaka" : We issue the New-ADUser command and set the user's SamAccountName to MTanaka.

can anyone explain me this??

I had an idea that SAM accounts are used in Local machines, but HTB is saying that when we use New-ADUser command with a name, we are seting a user's sam account.

I m a bit confused

[cloud urchin]

you're thinking of a SAM account. they're talking about a sAMAccountName, which is a different thing

[icy marsh]

SSTI Exploitation Example 1” Server-Side attacks module

Use what you learned in this section to obtain the flag which is hidden in the environment variables. Answer format: HTB{String}

I spent a many hours but can’t find a flag. I think I did everything

[cloud urchin]

instead of tqlmap, which doesn't work, try this tool https://github.com/vladko312/SSTImap

same tool/syntax, but it actually works

i didn't write down the challenge for that, but the basic idea is identify the template engine, then inject code into that template engine based on the flow chart

[novel lynx]

I am currently in Nibbles Initial Foothold, and i am having trouble understanding this "We will add our tun0 VPN IP address in the <ATTACKING IP> placeholder and a port of our choice for <LISTENING PORT> to catch the reverse shell on our netcat listener."

is this the ip of my vm instance?

[shut quest]

It is the IP of your VPN connection which will typically be tun0. If you do a ifconfig you'll see a tun0 interface, that IP is what you'll want. Then you'll want to pick a port available on your attacking machine that will match when listening for the remote connection.

[novel lynx]

ok, so i had that right

i set the port to listen on port 9443, and also have the port set to 9443 in the image.php file, but when i try to connect with ncat it reads "Ncat: Connection from 10.129.215.86.
Ncat: Connection from 10.129.215.86:59116.
/bin/sh: 0: can't access tty; job control turned off
"

i don't know if that was right? it appears that it established some kind of connection, but i didn't get a tty, and that port number was different. I don't know if the port number being different is relavent

nvm, i'm seeing that i am moving in the right direction, and i am at the part where i need to import python

[icy marsh]

thank you

[shut quest]

That's the random high port the remote side used to establish the connection, normal and to be expected.

Looks like you're on the right track.

[novel lynx]

thank you!

[blissful zealot]

Idk if im missing something haha is there any reason I cant post in general?

[zinc nimbus]

i tried after resetting the machien and nothing changes can someone pls help

trying to fix this for hours but it keeps 😭

[cloud urchin]

which regions did you try?

[zinc nimbus]

o i only ever stay one 1 region, i should switch?

let me try that

[cloud urchin]

yes, if you're US try EU, and vice versa. many regions have been having issues recently especially with internal hosts

[zinc nimbus]

ok

[eager ledge]

Hi I am doing the Skills Assessment section of "PIVOTING, TUNNELING, AND PORT FORWARDING" module. I am using SSH dynamic port forwarding along with proxychains to discover the internal hosts. I am currently scanning 172.16.5.0/24 network. However, nmap is showing all the IP address in this network as up. Why is it happening?

[spark spruce]

Anyone help here

[eager ledge]

I am scanning again against 172.16.5.0/16 network right now, and it shows 3 hours 48 minutes as estimated time to completion.

[zinc nimbus]

omg omg omg it works omg tysm my savior if it wasnt for you i would sleep with nightmares and wake up only to be in another nightmare and have nightmares until it worked

[stark lark]

Wanted to hear your guys' take on this:

Let's say i get a rev shell that is not the most stable.

I accidentally run "python" and it is stuck inside the python cmd line

Is there any way to properly exit this when the shell is not that stable? I've tried exit() and quit() but no luck.

[spark spruce]

@ocean night

[ocean night]

Sorry, but I cannot provide support for modules etc. Please avoid pinging people randomly like this too.

[eager ledge]

@muted kindle any hints on this please?

[muted kindle]

I don’t know what is this module and highly likely I haven’t done it

[acoustic owl]

Look to the dot
It will be a blind thing 😉

[acoustic owl]

try another way. ||Check if any „neighbors“ are known||

[eager ledge]

I have not used --disable-arp-ping flag in nmap command, that means that nmap will look for neighboring hosts right?

[acoustic owl]

Try other methods without nmap

[eager ledge]

Hi can I DM you about this?

[spark spruce]

Do I need to encode it

Don't know which dot are you talking about

[eager ledge]

When using nmap within /24 network for host discovery, it shows all the hosts as up. I am trying to check for open ports on neighboring hosts. However, it also shows the estimated time to completion super high. I cannot think of how I can determine if any host is active in the network without using nmap.

[acoustic owl]

sure

but I'm not online regularly at the moment. So don't be mad if an answer takes longer

[muted kindle]

proxychains 8 hours nmap scan

[acoustic owl]

no, you don't have to encode anything

[acoustic owl]

Take a very close look at the answer

[cloud urchin]

It was Xre0uS who told you first, I think that's what he meant by changing servers. He's your savior. Glad you got it though.

[next bronze]

you did tell them to change region, I didn't

[stark lark]

**SHELLS & PAYLOADS **
The Live Engagement
https://academy.hackthebox.com/module/115/section/1139
Host-02 (blog.inlanefreight.local)

Module options (exploit/linux/50064):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   demo             yes       Blog password
   Proxies                     no        A proxy chain of format type:host:por
                                         t[,type:host:port][...]
   RHOSTS                      yes       The target host(s), range CIDR identi
                                         fier, or hosts file with syntax 'file
                                         :<path>'
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connec
                                         tions
   TARGETURI  /                yes       The URI of the arkei gate
   USERNAME   demo             yes       Blog username
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/bind_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LPORT  4444             yes       The listen port
   RHOST                   no        The target address


Exploit target:

   Id  Name
   --  ----
   0   PHP payload


msf6 exploit(linux/50064) > set vhost blog.inlanefreight.local
vhost => blog.inlanefreight.local
msf6 exploit(linux/50064) > run

[-] Exploit failed: One or more options failed to validate: RHOSTS.
[*] Exploit completed, but no session was created.
msf6 exploit(linux/50064) > set rhost 172.16.1.12
rhost => 172.16.1.12
msf6 exploit(linux/50064) > run

[*] Got CSRF token: 733fe2889f
[*] Logging into the blog...
[+] Successfully logged in with demo
[*] Uploading shell...
[-] Exploit aborted due to failure: unexpected-reply: Unexpected json response
[*] Exploit completed, but no session was created.
msf6 exploit(linux/50064) > 

What could I be doing wrong?

[eager ledge]

I can also see server name server01 in the note. So I am trying to perform DNS resolution for the server. I can see that DNS server is running on the target server. But it is not able to resolve the address. nslookup and dig is not present on the target server. I tried proxychains with dig, but doesn't work:

└──╼ $proxychains dig server01 @127.0.0.53
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
;; communications error to 127.0.0.53#53: connection refused
;; communications error to 127.0.0.53#53: connection refused
;; communications error to 127.0.0.53#53: connection refused

; <<>> DiG 9.18.12-1~bpo11+1-Debian <<>> server01 @127.0.0.53
;; global options: +cmd
;; no servers could be reached

[light sentinel]

Why can’t I talk in general

[shut quest]

<@&861185840277487616>

[spark spruce]

<b>Error</b>: Missing <i>'username'</i> parameter

this is the response
And I am really stuck what am I missing

[light sentinel]

Wym

[eager ledge]

After setting up dynamic port forwarding and proxychains, I was using proxychains nmap -v -sn -T4 -n 172.16.5.0/24 -oN host_discovery.nmap command but it showed all the hosts as active, even when they were not. Why?

[soft cedar]

Set the vhost

[acoustic owl]

@spark spruce Just enter a username and password. ||You can find a potential username on the website.
See what happens if you change the username so that it is guaranteed not to exist||

[shut quest]

Your credentials are wrong, see the hint for the second box.

He's wanting hacker for hire and deleted his message after I pinged rule break

[ocean night]

Ah, ok

I missed that, sorry then @next bronze

[next bronze]

idk what happened but it's all good

[light sentinel]

Wait so this is a cybersecurity server not hackers

[shut quest]

You nailed it

[light sentinel]

Dammit

[ocean night]

There are hackers, and there are hackers. You're in the wrong place buddy.

[light sentinel]

Dam

[stark lark]

msf6 exploit(linux/50064) > set vhost blog.inlanefreight.local
vhost => blog.inlanefreight.local
?

[stark lark]

Thanks! How would I know this if I hadn't used the hint? :-)

[shut quest]

Not sure off the top of my head, don't have it in my notes. I would assume from the first host?

[spark spruce]

got it
thanx

[viral night]

Hello, I'm doing the windows fundamentals module, and have a question about the behavior I'm seeing.
Whenever I create an SMB share on "C:\Users\htb-student\Desktop\Company Data", and then enumerate the SMB server's shares (smbclient -L), instead of seeing the sub folder I shared I just see \Users, why was the entire \Users folder shared and not the specific folder I shared?

[timber hatch]

today i have to do everything over the clipbaord...that kind a suck...why is that?

[inland sonnet]

Does anyone else feel like the RDP machines have been very slow for the past few days?

[spark spruce]

Do I need to use script for password hunting ?

[acoustic owl]

Well, a script is certainly helpful in such a situation. But you can also carry out what feels like 1000 requests manually

[spark spruce]

I have tried SSJI payloads in password field
" || (this.password.match('^.*')) || ""=="

But invalid credentials
Is there any other payload need
Or
I am getting something wrong

[acoustic owl]

You're on the wrong track. So, once again
||Find the difference when you enter a username.
Look at the dot||
Use this knowledge to get more data.

[gritty jetty]

guys i need some help

ive been stuck at the msfconsole module for ages now

it keeps telling me Msf::OptionValidateError The following options failed to validate: RHOSTS

and yes i type RHOSTS

[tulip perch]

Guys if i purchase a module with cubes do i get access to it lifetime?

[digital hollow]

Hello I am currently on the footprinting module smb I entered to the smb server and I can't find the flag.txt.

[bright coral]

What section are you in and what do you set RHOSTS to?

[gritty jetty]

im in getting started and then the public exploits

[gritty jetty]

i set the RHOSTS to the target ip

[burnt owl]

Could you send a screenshot of your options in msfconsole?

[gritty jetty]

send you in dm

[bright coral]

Did you connect to the share from the previous question and look around there?

[spark spruce]

I found that there is difference of dot when i enter wrong and correct username
but I couldn't relate this with password

[quaint dagger]

anyone else having problems spawning a pnwbox atm?

[digital hollow]

@bright coral I connected and I just don't see the flag.txt

[acoustic owl]

Look at this sections again
https://academy.hackthebox.com/module/171/section/1685

https://academy.hackthebox.com/module/171/section/1686

[digital hollow]

@bright coral it is the third question when it is says find flag.txt file

[spark spruce]

already looked but confused bcoz it is in json format and aslo my payload is not working

[bright coral]

you have to explore the share a tiny bit

[fathom pendant]

it's on the jump host they give you

[dense pewter]

Is anyone here CURRENTLY doing the AEN module?

[acoustic owl]

In which field do you see a difference?

[spark spruce]

there is dot difference

[acoustic owl]

So why are you trying the password field? 😉

[spark spruce]

bcoz you did tell me to again look for difference after getting username

[digital hollow]

@@bright coral hello how what are the commands I am currently sees only
Profile
Contents
Bash_logout
bashrc
No flag.txt

[fathom pendant]

doesn't sound like an smb share to me; but look around

also what module are you working on

[acoustic owl]

Take another close look at the sections.
To retrieve data, you must see a difference in the result when entering it. Either by time or by an output.
In this case it is the output.

[bright coral]

Those are the contents of the share. One of those "files" is not like the others 😉

[digital hollow]

So what is the solution for this @bright coral

[fathom pendant]

bro

ngl use your brain

just look around

that's all you gotta do

dir/ls, cd

just... look

[digital hollow]

@fathom pendant thank you for some reason I don't find it

[fathom pendant]

well you're dropped into a base directory

with other directories in it

what logical place might flag.txt be in

[spark spruce]

to get the difference, payload should work
but here it is just missing error
if it not work then how would I get error difference

[fathom pendant]

if you're unsure, just cd to all the directories in there

and look

[digital hollow]

Still can't find it I tried to look at every one but no such file as flag.txt I can't understand why@fathom pendant

[fathom pendant]

there is definitely a flag.txt

where have you tried looking in smb?

[digital hollow]

Like I said my friend there are this
Profile
Contents
Bash_logout
Bashrc@fathom pendant

[fathom pendant]

one of those is not a file; and is a directory

[digital hollow]

Yes I know I will check again

[fathom pendant]

which you can cd into

like you would on any Windows/Linux machine

[digital hollow]

No one this it the problem

[fathom pendant]

?

[digital hollow]

I can't send photo to show here can I send you a message

[fathom pendant]

you can cd into the directory that has the flag.txt in it

that's as much as I can lead the horse to water, so to speak

[acoustic owl]

Why the password field? That is completely wrong

[spark spruce]

then how did I get the password
I already have username so I cannot attack on username
I only need password

[fathom pendant]

no

you see how when you do dir/ls in smb there's a letter next to filesize? that indicates if it's a Directory/Hidden/Not Hidden

i just spun up the lab myself and was able to cd to the directory

the reason you can't find it is because you haven't listened to what @bright coral or I have been telling you

is that there's another layer to look in

[digital hollow]

But how to look it if it is hidden I don't know can you please tell me @fathom pendant

[fathom pendant]

brother

idk how more clearly i can say this

one of those is a DIRECTORY

as indicated by 2 things

the filesize being 0; and the dir listing as D

[fathom pendant]

there's no hiding files, smb shows all files

but again you have the answer to move forward in what you can see

i've told you at least twice now that what you're looking for is a Directory

and 2 stop dming me

I highlighted the specific letter for a reason

[digital hollow]

Man I understand but I will tell you again when I am doing ls it not giving me the content of the directory

[fathom pendant]

D = directory
H = hidden
N = Not hidden
in a normal OS the H files would not show up under a normal ls/dir

[fathom pendant]

because you need to cd to it

ls with no arguments just lists the current directory

same thing with cd

[digital hollow]

Ohhhh I see I forgot it thank you for you help and time appreciate it💪

[fathom pendant]

you can just CD to it

and then ls

and boom it works as intended

you vastly were underthinking it

[rustic sage]

can't even terminate it!

[dense pollen]

I currently can't start any exercise, tried different browsers although i am connected via vpn

[fathom pendant]

yeah that's the thing with the docker instances

[fathom pendant]

give it like 10 minutes

[dense pollen]

awesome, ty! appreciate it

[fathom pendant]

sometimes it takes a bit; also connected via vpn has no bearing on target spawning

it's not like the labs site

you can spawn a target without being connected

[dense pollen]

I somehow can't, the button to Start the target is not there. It just says "Waiting to start"

[rustic sage]

they use to have terminate button...

[fathom pendant]

the "Waiting to start" is for the pwnbox instance my guy

if there's no "Click here to spawn target" Button, then the questions solely relate to the reading/research you do

[dense pollen]

oh yeah thats true lol.
Yeah the "Click here to spawn target" button is missing. It used to be right there like 2 months ago. Maybe because I already completed the exercises?

[fathom pendant]

or this section doesn't have a target instance

[dense pollen]

😭

[dense pollen]

its to early for me

[zenith canopy]

Module - footprinting (smb), why am i not able to access the share anonymously after having 'guest ok = yes' in smb.conf, i have also changed the permissions of mnt and exampleshare folders

[haughty tree]

Try using -U anonymous and no pass

[fathom pendant]

smbclient -U "" -N //ip/share

[haughty tree]

Perhaps since your user exists it tries to authenticate you

[fathom pendant]

^

but also; you don't need to set up an smb share for this

the provided target has all the stuff

[zenith canopy]

yes i was just trying to setup and learn the configuration better

-U anonymous doesnt work as well

[fathom pendant]

-U ""

smb doesn't use anonymous

it uses Null/Guest Sessions

[zenith canopy]

right, -U "" -N outputs the same error

[fathom pendant]

did you try -U guest?

[zenith canopy]

yes i did!

[fathom pendant]

¯_(ツ)_/¯

[zenith canopy]

didnt work

[fathom pendant]

i'd say just move on with this

since technically setting it up is out of scope

did you restart the smb service is my last question

[zenith canopy]

yes i think is should, i wasted a lot of time in this

[zenith canopy]

yes

[fathom pendant]

#homelab-sysadm may also be just a better overall place

[storm elk]

Is there a way to locally redirect to port 80 while doing academy courses? I now got an external IP with a port, but I'd rather have it on port 80

[zenith canopy]

alright, thank you 🙂

[fathom pendant]

?

like redirect the pwnbox?

[storm elk]

I am doing some web modules. So I don't have to add the port each time

[fathom pendant]

that whole sentence kinda confused me ngl

[storm elk]

yeah sorry lol

[fathom pendant]

oh

no there isn't

as the ports and such aren't controlled by you

[storm elk]

yeah that's what I thought :d

[acoustic owl]

Read through the sections again.

[fathom pendant]

they're on the target, and the scope of docker containers is solely the ip:port

[storm elk]

a local tunnel from localhost:80 to docker:port perhaps

[fathom pendant]

yeah but you'd have to set it up EVERY SINGLE TIME

and at that point it's just faster to copy/paste --> http://<paste>

you do know you can click the spawned IP and it copies to clipboard yeah?

[storm elk]

Yeah. But these CSRF XSS module sections use 3 vhosts

but port 80 is taken on pwnboxes

I will just have to remember putting in the port 😄

[bright coral]

You should be able to bend all the traffic to IP X with port 80 to IP X with port Y with iptables 😉 but remembering to use the port is probably easier

[storm elk]

ah yes

[spark spruce]

Okay I will try my best

[spark spruce]

In this section
When it uses regex payload
It shows some result
But when I try to enumerate the password using regex
It shows missing password parameter
It means this parameter is sanitized well to avoid this payload.
Now I don't know which type of payload should I use?

[acoustic owl]

The module shows you other payloads apart from regex

[wild helm]

On the Windows Logs and Finding Evil Pg 2, Sysmon was already installed so I just ran the config file, then replicated the DLL attack yet I still can't get Event Id 7 to generate in Sysmon. I have no clue what I'm doing wrong

[spark spruce]

Let me use each of payloads

[wild helm]

Nevermind I figured out my mistake, smh lol

[cinder mortar]

For advanced XSS and CSRF exploitation module, can anyone explain to me why sometimes the line xhr.withCredentials = true; is needed and sometimes it isnt needed in the payload? i've reread the section multiple times but i still dont get it

[spark spruce]

No one is working
instead some paylaods shows internal error
what does it mean?

[civic oar]

hey

anyone could give me a hint for third question on Sliver's skill assessment?

thank you so much ^^

I've tried Kerberos delegation and DACLs but I can't see any path to DC

[empty imp]

Am I the only one that can't seem to get DNS working with inetsim (in my own vm)?

The DNS service just does not start up. Everything else starts up.

[shut vapor]

Is it that in these cases you are soliciting a victim's browser to make requests to the server at an endpoint base url which is also not of the "same-origin"?
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials

Setting withCredentials has no effect on same-origin requests.

[acoustic owl]

You are still using the password field.

[surreal quiver]

Anyone knows how to break family link in phome without the parent noticing

[spark spruce]

There are other 2 web pages which also I have tried
Token field in /reset
And username field in /forgot

Now where should I use it?

[surreal quiver]

Can anyone give me mc apk phone link

Dm me

[sullen trench]

Any idea where to find a feedback channel, having some issues with a dedicated module.

[shut vapor]

#1234357888114364508

[sullen trench]

thx a lot 🙂

[limber surge]

└──╼ [★]$ xfreerdp /v:10.129.202.136 /u:{username}/p:{pass}
No protocol specified
[15:05:09:586] [32311:32311] [ERROR][com.freerdp.client.x11] - failed to open display: :0
[15:05:09:586] [32311:32311] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

any1 know how to fix this issue?

[storm elk]

use remmina

[analog dock]

What are you trying to rdp to, and from where

[limber surge]

pwnbox to the IP Address mentioned. i ahve the credential

[next bronze]

don't use root

[storm elk]

$ means he's in a user terminal?

[limber surge]

can work alr. after i close all the terminal n run again

[lucid halo]

Hey, @everyone I'm working in Linux Fundamentals Module 18, I'm stuck on the first question. I've tried using "find /etc/ -name *.log 2>/dev/null". When I use this command I'm brought back to the Command Line. I am novice, hoping someone could walk me through this question and the second.

[acoustic owl]

Neither. You have found the vulnerable field. Now you just have to read out the data accordingly

[spark spruce]

Source code?

[acoustic owl]

Which field shows you whether the entry is correct or incorrect?

[spark spruce]

Username

[acoustic owl]

If you get stuck, send me a DM.
But I won't be able to reply until later. I'm off again for a while

[spark spruce]

Okay

[storm elk]

Anyone else experiencing issues with the module "ADVANCED XSS AND CSRF EXPLOITATION " that you have to press the deliver to victim button a few times before even 1 request comes through?

[shut vapor]

Are you sure you're looking for .log files?

[earnest raven]

Hey did you ever solve this question? I've been stuck on it for a few hours? Thanks.

Hey did you ever solve this question? I've been struggling with it for a few hours?

[cinder mortar]

ah okayy thanks

[north bramble]

hello
stuck on https://academy.hackthebox.com/module/116/section/1512

have added subdomain and domain to /etc/hosts

[storm elk]

perhaps you need to define a server you're querying

[shut vapor]

I hope that clears it up. I don't have the full context to say for sure. And, full disclaimer, XSS is a weak point for me so if someone else has a clearer explanation please speak up.

[north bramble]

what do you mean?

[storm elk]

I am saying, read the page

you forgot part of the command

for your dig command you'd need the @

[north bramble]

ah, ok

it had failed before on that but I think I understood my mistake

[storm elk]

try it out and let us know 🙂

You know you've done too much frontend stuff for the day when you keep writing xhr.widthCredentials

[storm elk]

what's in your hosts file? did you put in the right ip?\

[north bramble]

should I remove the subdomain?

wait lemme remove and try

didnt work lol

[storm elk]

the @ means that you will query that server, so in thise case you'd need it to be in your hosts file

so what happens when you keep on using subbrute and enumerate the subdomains?

[fringe urchin]

Isnt it @ for dig for nameserver?

You dont need to specifiy @ with nslookup but with dig you have

Ah already got answered vy sparkling

[north bramble]

I know this seems to be the valid one, it was a hint on the forums

[north bramble]

I should nslookup the subdomain?

[storm elk]

so try to dig that one

[north bramble]

okay on it

thanks bro got it

thanks for the help

[storm elk]

the reason your nslookup couldn't find it is that that subdomain isnt in your hostsfile

[fathom pendant]

With nslookup you just put the ip/nameserver after

Also spoilers

[north bramble]

deleted. sorry

[north bramble]

I havent exactly understood dns it seems. need more revision.

[fathom pendant]

Your other screenshot with the subbrute output

Nslookup queries nameservers

[north bramble]

done

[fathom pendant]

Iirc it has to be in resolv.conf

[bright coral]

If you still need a nudge: Look around in directory of the user you've compromised to answer the previous question 😉

[cinder mortar]

so just to clarify if the Access-Control-Allow-Credentials is set to true, i would then need the withCredentials set to true so that my payload will be sent?

[shut vapor]

Yes, that looks to me like it would be a good indicator. Again, you're way ahead of me in the material. I've only got some experience with utility-grade webapp development so thinking of things from an attackers POV isn't a strong-point yet.

[cinder mortar]

Okay im q new to all these advanced web attacks too hahas

[lucid halo]

I was under the impression that I was. Again, I'm very green. I was hoping that someone with load it up and walkthrough it

[tulip dragon]

why does it ask for sign in 2-3 time a day

before it used to ask sign in after 1 month

[fathom pendant]

Just take the L and click sign in with htb account

And click remember me

[tulip dragon]

i did many time in last 7 days but

[fathom pendant]

But on a real note. Reach out to support

[tulip dragon]

it always ask everyday

[fathom pendant]

that's not something any of us plebs can answer ¯_(ツ)_/¯

Could be a backend misconfig not storing the cookie properly

[shut vapor]

Try a sanity check. I know /etc/ often contains .conf files. Does the command you're trying to run work if you search for something I know exists under /etc: .conf files?

$ find /etc/ -name *\.conf

If yes, then the logical conclusion is that there are no .log files in /etc. Are you looking for log files somewhere else or is what you're searching for wrong (i.e. .log)?

I won't do you the disservice of walking you through it, but I'll point the way. 🙂 Maybe someone else will though.

[lucid halo]

I'm going to try it out and you are right that is the logical explaination for why I'm not receiving an output. The question asks me to find all files with the .log extension.

[fathom pendant]

Are you connected to the target?

[fathom pendant]

Well the first question isn't a .log is it?

Also section name is gonna be better than page #

[sacred ermine]

anyone who can I ask for help on Kerberos Attacks Skills Assessment? I guess the last question is broken, tried many ways to leverage it, could not manage to get it still.

the reason why I am making such assumption is bc pass-the-ticket was broken as well, after I messaged the support, they fixed it, so wanted to know if its me or the final part is broken, thanks

tried to reboot the target and many many attempts, still no results

[next bronze]

it worked when I did it, if you're on US servers try switching to EU

[sacred ermine]

I am on eu 5 or it was 4 I guess

[sacred ermine]

can I dm you?

[cinder mortar]

Anyone can help for Bypassing CSRF Tokens via CORS Misconfigurations section under ADVANCED XSS AND CSRF EXPLOITATION? I think i have the correct payload but im unable to get any response

[polar haven]

Hello
how can i get a permession to talk in general chat ?
and
can i delete my payment methode in the academy website ?

[fathom pendant]

Read and follow #welcome

Second; you gotta message support to get it removed

[polar haven]

i will
thanks sir

[burnt oasis]

Hey hope your having a good day! Working in the Information gathering module and in the Active Infrastructure Identification section question two asks which cms is in use for app.inlanefreight.local as you can see im attempting to use the whatweb -a3 command but i keep getting an error. Is my syntax wrong or is it issue with connection?

[next bronze]

iirc it's just KUD

[fathom pendant]

Is app.inlanefreight.local in your /etc/hosts?

Also http, not https

I don't recall these using https

Also your syntax for curl was bad

[sacred ermine]

yeah, I was trying the user j. and an. both did not work, also tried the spooltrigger and SharpSpooltrigger, seems they are not designed for a computer KUD, only users are allowed

[fathom pendant]

You can just use ip, you don't need to do ${...}

[next bronze]

hmm I don't remember about that, but it should be pretty straightforward

have you tried using coercer?

[sacred ermine]

I mean, those tools act as a coercer, I got error executing those 2, so I think coercer will not work as well, but I will try it

[next bronze]

coercer does more than just printerbug

sorry I don't have more notes than this, all I have is just "kud, coerce auth from dc, ptt"

[sacred ermine]

thanks!

[wraith pelican]

hello all, i've finished the 'retrieve hardcoded credentials' in thick-clients from Attacking Common Application module. I liked it but I got a lot of whys as I go through my notes and trying to generalise if I have to do it with another one.
Some things remain kinda obscure or too magical like: 'Checking the memory maps at this stage of the execution, of particular interest is the map with a size of 0000000000003000 with a type of MAP and protection set to -RW--'.
Ok I understand the words but if it wasn't told 'look, there!', I don't know how i would have found it. Do we search for MZ magic byte and explore all MZ pattern? Or we search for memory type MAP with RW protection owned by user, then we explore each one with strings until we find something? I mean what's the key here, what's the process? How do we know to set breakpoint solely at exit? Now I feel I have to follow this vulnerable thick client rabbit hole to satisfy my curiosity but if someone has some quick insights, I would be grateful!

[fathom pendant]

Tbh the thick client applications is a one-off

It was added extremely late, and from out of nowhere

[wraith pelican]

Ow ok thanks! that's too bad, it feels like too less. I'll check other sources anyway, that's sometimes tricky to stay on cpts path without getting lost

[fathom pendant]

The thick clients/java/mem stuff is not likely to come up again in CPTS path

[north bramble]

https://academy.hackthebox.com/module/116/section/1173

I have the credentials, how to login into email?

[fathom pendant]

Did you even read the section?

[wraith pelican]

yeah ok, that's good to know, thanks! i just checked the skills assessment for that module and it seems the 3rd is about a hardcoded cred into a dll so that will be one more

[fathom pendant]

Actually mb connecting is covered in the footprinting module @north bramble

[fathom pendant]

Could be unrelated to the Java bit

[north bramble]

okay thanks, I dont remember as I solved it months back.

[fathom pendant]

This is why notes are important

So I suggest going back to footprinting > IMAP/POP3 and seeing how to connect via imap(s)/pop3(s)

[north bramble]

yeah mb once I am done I am going to go through the whole path once again

[north bramble]

on it

[fathom pendant]

I suggest going back now and doing notes

Even if you don't go through the provided labs for them

[sacred ermine]

sorry for bothering, how did you manage to set up the coercer? I cannot run it on rdp attacker host, bc it can't install the libs, did you set up the port forwarding tool? like ligolo or any other tool?

[next bronze]

yeah I used ligolo

[digital hollow]

Identify if its possible to perform-a-zone-transfed-submit-the-TXT record as the answer. (Format: HTB. What they are wanting I don't understand can someone try and solve this it is footprinting module

[shut quest]

Plenty of folks have solved it. What part is confusing and what did you try?

[fathom pendant]

It wants you to perform a zone transfer, and submit the contents of the txt record of a subdomain

[digital hollow]

Manged to answer it the other question is problematic

What is the ipv4 address of the hostname DC1

[digital hollow]

Someone please

[sacred ermine]

I dont know the answer maybe you need to dig further, but thats just an assumption

[fathom pendant]

That is indeed part of the digging

[fathom pendant]

You have the answer with digging, it sounds like you just want your hand held through the whole thing

[dire abyss]

having a bit of trouble with the first question about case 5. SQLMap gave me the flag however inputing to it answer field, it says its wrong.

https://academy.hackthebox.com/module/58/section/526

[fathom pendant]

It's a bugged q you get some \xv or something like that in the middle yeah?

[dire abyss]

theres a { in the middle

[fathom pendant]

Well the whole thing is HTB{7..7}

[muted lotus]

I have a problem with the module Windows Attacks & Defense, on this sub-module PKI - ESC1, im trying to log in to the RDP to WS001 , but im getting a black screen, is not loading the system.

[fathom pendant]

Press enter

[muted lotus]

i did, but is not loading

[fathom pendant]

Try clicking around the lower 2/3 of the screen then

Otherwise chat with support

[dire abyss]

correct, the table i get in response is HTB{7..{..7}

[fathom pendant]

Well it's l337 speek for the most part

So I'd take a stab at what you think the whole phrase would be given what you see

This is a known thing with this

[dire abyss]

cool, i cheated a bit on this one question and lookup the solution, i see what it should be

the 1337 phrase makes sense now

i thought i was doing something wrong

[fathom pendant]

All good, I think Jared said he spent like 5 hours with someone on this previously

[stable bone]

ik whats wrong with it

aint got no gas in it

[fathom pendant]

https://tenor.com/view/offense-texas-gif-23053045

[viral lotus]

just a quick one and I guess its a preference question, I am running trough the CREST Path, when doing the web request module obviously you can use burpsuite etc but I am assuming the ideas is to manually run through it as if I haven't got access to it etc? thanks

[weary torrent]

deleting this cus i got it

[stable bone]

marcie boo wsggg im in a pickle rn

[fathom pendant]

I believe the web req module doesn't require burp and goes at the underlying theory

[fathom pendant]

https://tenor.com/view/spongebob-skill-issue-skill-gif-24485644

[stable bone]

yeah just make sure you test the thingy first

[viral lotus]

tthanks, thought so, I completed it manually. I thought burp was cheating in the circumstances I was just checking as some will go for the easiest path rather than the one most knowledge to be gained

[viral lotus]

test the thingy? elaborate? I have it completed but that's very vague haha

[stable bone]

dude everyone knows about the before the when you run the but only after the yk?

music taste fire tho btw @viral lotus

[viral lotus]

thanks

[viral lotus]

not sure what that was supposed to say, but I am sure you meant well

[stable bone]

i didnt i was trolling you now i feel bad 😭

[viral lotus]

its cool lol

[fathom pendant]

Ignore the kid, he's got squirrels in his brain

[viral lotus]

They are alright no harm done haha

[little bear]

And I'm a caffiene crackhead lmao (all in good fun)

Turns out I will be using EU to complete the skills assessment afterall.

[fathom pendant]

Just need to slow down every now and then

[past kite]

hi, i can't connect to mysql server. Intro to MySQL. ERROR 2002 (HY000): Can't connect to MySQL server on '94.237.49.212' (115)
Why?
mysql -u root -p -P 3306 -h 94.237.49.212

[little bear]

Slow every bow and then

Instructions not clear, troops invading jk

Yeah, there was quite I bit I spent yesterday walking through, but now I understand the issues I had. Appreciate the time contributed Marcie!

[shut quest]

Is that the port that was provided?

[past kite]

yes, it's default port

[burnt oasis]

ok thank you I will try command with http. In the module example they use https and on the cheat sheet under Active Infrastructure

[shut quest]

Yes that is the default port, but is that the port that was provided to you?

[fathom pendant]

https is if it's running port 443/http over SSL (HTTPS)

[past kite]

I'm sorry, guys. I forgot about hint

[fathom pendant]

Most only run http

[past kite]

"Make sure to specify the non-default MySQL port in your command."

[fathom pendant]

Mood

[dire abyss]

im having a bit of hard time understanding prefix in sqlmap module. well to be clear is how to find what the prefix should be, any tips?

if i run "sqlmap -u 'http://targetip:port/case69.php?col=id' -v 3" i see the payload gives a hint but idk if thats the best method or if theres a better way of checking this

[soft plume]

Hello I am once again asking for assistance on the "Skills Assessment" lab for the "PIVOTING, TUNNELING, AND PORT FORWARDING" module. The command: proxychains xfreerdp /v:IP /u:creds /p:"creds" /cert:ignore /drive:smbshare,/home/kali/smbshare works fine in the pwnbox but when I use it on my VM it doesn't complete. The reason to why I'm not using the pwnbox, is that every time I get to the RDP section the connection will consistently crash/disconnect/freeze. So I am back to my VM and I'm trying to figure out how to bypass/use another tool for RDP. I tried ```proxychains rdesktop IP -u creds -p "creds" -V 1.2 -r disk:smbshare=/home/kali/smbshare

[fathom pendant]

Your commands are revealing answers

[soft plume]

fixing rn

[fathom pendant]

Also your screenshot is missing a character

Iirc there's a ! at the end

(For pass)

Also case sensitive

But yeah checked, you're missing a char in your pw in the screenshot

(Which is also spoiling btw)

[soft plume]

sorry Im trying now but whenever I try to put the ! in the password it'll just delete the quotation

yea ill delete

[fathom pendant]

Wrap in single quotes

[soft plume]

ahh right

[fathom pendant]

! Is a special character

[soft plume]

welp it worked, Im a dumbass like usual, sorry for wasting your time

[fathom pendant]

It happens

Slowing down and double checking often does wonders

[soft plume]

yep I've always had the problem of tunnel vision

[dim wolf]

tunnel vision in tunneling module

[soft plume]

😭 😭 😭

[fathom pendant]

The irony

[smoky pumice]

I just finished the ZAP Scanner section of Using Web Proxies Module. I had to find the answer in a write up because no matter what I did ZAP would not find the 'high-level vulnerability' referenced in the question. I have two questions 1. Is anyone able to get the scan to reveal the correct vuln at this point? 2. Is anyone willing to DM me another path to finding the flag I could put in my notes for future reference should I run into this situation again? I would prefer to learn something even if the platform isn't working as designed. TIA.

[fathom pendant]

It honestly took like 10-15 minutes

It was literally just running the scan from the section and just waiting

[smoky pumice]

Shoot. I tried that and waited at least that long three times. I’ll try again tomorrow. Thanks!

[loud dagger]

i know PoC stands for proof of concept in this field but i cannot stop reading it as person of color in my head

[dim wolf]

https://tenor.com/view/ironman-tony-stark-forge-gif-10677756

[olive slate]

Just a quick question. Using fileless method to download and execute using IEX, does that only work for powershell files? Does it work with exe?

[fathom pendant]

PoC 69420

[fathom pendant]

it works with any file that can be downloaded and executed, the trick is that it executes it in memory instead of on-disk

fileless can also be a misnomer, if it creates persistence, for example, it has to create/edit a file to do so

[olive slate]

Thanks @fathom pendant. Helpful as always

[fathom pendant]

https://www.crowdstrike.com/cybersecurity-101/malware/fileless-malware/

as shown in the first paragraph, it basically uses native tools

[brittle crest]

I hope everyone is well! I'm hoping that someone can explain how something works. I am working on the skills assessment for the command injection module. I already solved it but want to explore different solutions to it.
$(tr '!-}' '"-~'<<<[)
$(tr 'set1' 'set2'<<<input)
How does this work exactly
I know tr translates the input such that the chars that are in the input and also in set1 are replaced by set2
In the example, the input does not contain any chars from set1 so there is nothing to convert the input to from set2, so how does this shift the character to the right by one?

[fathom pendant]

magic

https://explainshell.com/explain?cmd=tr+'!-}'+'"-~'<<<[

[brittle crest]

@fathom pendant lol thanks!! This site will come in handy!!

[fathom pendant]

in short it does some funky stuff that shifts it

you could probably find a lengthy article explaining it

[brittle crest]

cool cool, I found this https://stackoverflow.com/questions/6441260/how-to-shift-each-letter-of-the-string-by-a-given-number-of-letters
and then I pulled up an ascii table and noticed that set1 '!-}' is a range of chars from ! to } and set2 is the same, just right-shifted by one. So when the input is passed in, it matches it to set1 and since set2 is right-shifted by one it replaces it with the right-shifted character. At least that's how I understand it. Better than before cause it was legit just magic for me for a bit lol!!! thanks again @fathom pendant

[karmic knoll]

Has anyone here done and/or finished Intro to C2 w/ Sliver? I’ve been stuck for a bit on the first question of the assessment. I’ve tried seatbelt, winpeas, kerberoasting, no luck so far. I appreciate any nudge or pointed in the right direction to look! Thanks

[limpid field]

Is the vulnerability assessment module out of date? The vm does not have nessus pre installed and there's no scan file for me to use if I don't want to wait for it to finish like the module says

[ocean night]

Nessus is running on the target, but have a read back and pay attention to port numbers 🙂

Fair to be said, perhaps that port number should be included on the target string provided

Note that the Pwnbox you spawn is not the target - down where you fill in the answers, there is another Spawn button to spawn the target

[limpid field]

Forgot about that

[cloud urchin]

just tested, it is indeed running on the default port (the port mentioned in a previous section) on the target

[ocean night]

Yup me too, and got the answer (go me)

[cloud urchin]

great job g0blin, maybe one day you can be a pentester too 😛

[limpid field]

The module says to run the scan against the windows target so do I ssh to the target and run it on the Windows machine or run nessus on the parrot machine against the target

[ocean night]

You don't need to run a scan - the results will be there waiting for you within Nessus once you have logged in

[cloud urchin]

Nessus is running on the target, from the target you attack the specified IP

[fathom pendant]

You can run a scan

[cloud urchin]

the scan takes a long ass time

[fathom pendant]

But there's one already populated, so you don't have to wait the 40+ minutes for the scan

[cloud urchin]

i was going to do it but just ended up using the prefilled data

[limpid field]

How do I remote in to the nessus session running on the "target" not that it's spawned in, cause the lab gave instructions for running it myself like I would access it from the normal desktop environment

[cloud urchin]

navigate to the target's nessus web interface, attack the attack target from there

vm/pwnbox -> target box (the thing you spawn that provides an IP) -> internal ip to attack

nessues is running on the taret which you can access from the pwnbox/vm, and also has a 2nd network connected to the internal network for your victim box

[fathom pendant]

https://target_ip:nessus_port

[limpid field]

I got it

[fathom pendant]

From there you're connected to the spawned 10.129.x.x nessus service

And the 10.129.x.x device has an interface, as Nut said, that connects it to the 172.16.x.x or w/e internal ip

[limpid field]

I just got back into working through the modules now that college is slowing down for a bit and i forgot how htba has a different way of conveying instructions than I am used too

[cloud urchin]

understandable, most of the time you use the vm/pwnbox to initiate attacks

or scans

[limpid field]

Do targets get stuck spawning sometimes the openVAS target has been spawning for almost 20 mins

[cloud urchin]

you can CTRL+F5 and try again, however recently there have been problems all over, especially with modules that have another internal network and boxes. if refreshing with ctrl+f5 doesn't allow you to spawn it, try changing your region entirely (eu -> US or US -> EU)

[limpid field]

Ctrl f5 refreshed my attack vm and it cancelled the target so I'll wait and see what happens

[cloud urchin]

yeah probably a region issue then

[round moat]

What version of the SMB server is running on the target system? Submit the entire banner as the answer
Why every answer of this is wrong

i tried smbclient -L -N //<ip>

i got SMB V3.1 but it says answer wrong

InFreight SMB v3.1
isnt this a right answer?

[shut quest]

It's asking for the version that nmap outputs

[round moat]

i also used nmap,
nmap --script banner <ip> -p 445

and nmap --script smb-os-discovery <ip> -p 445

[shut quest]

There's an example in the section that will provide the result you're seeking

Also future note, it makes it easier to provide the module/section that you're working on

[round moat]

do i have to reset the ip and try again?

[shut quest]

Make sure you don't have any white space before or after your answer

[round moat]

okay thanks

[shut quest]

Also delete this as it is a spoiler

[round moat]

okay

thanks for your help

[sterile epoch]

Hi how do I compile this git project using vs code
https://github.com/itm4n/UsoDllLoader

[acoustic owl]

https://code.visualstudio.com/docs/languages/cpp

[sterile epoch]

thanks

[next bronze]

use the big boi MSVC in visual studio to compile

[stable bone]

excuse me? we can go lil bro

also random but what is github? and how do i work it

its just a long list of files idk what to do

[acoustic owl]

https://en.wikipedia.org/wiki/GitHub

[normal sand]

Module: INFORMATION GATHERING - WEB EDITION

I was on the main HackTheBox platform working on a medium machine, trying to perform subdomain enumeration. In the module I've mentioned it talks about subdomain enumeration and vhost discovery. Under the active subdomain enumeration section of the module, it uses the tool GoBuster. And in the following section it uses ffuf for Virtual host discovery.

Can someone explain the difference between the two to me? From my understanding vhosts and subdomains follow the same format (<subdomain>.<second-level-domain>.<tld>) and vhosts have the same IP address as the domain but subdomains may not. Please correct me if I'm wrong.

[stable bone]

oh hi menace bunny... bruv i dont need the entire history just how to do the file thingys

[acoustic owl]

https://www.youtube.com/results?search_query=github+tutorial

[stable bone]

nvm its over an hour long i'll figure it out

cant focus that long

[acoustic owl]

The term vHost or virtual host refers to the practice of running more than one website on a single server. This is often done on a name basis, i.e. with a subdomain.
A subdomain is an address that is easy for people to remember.

[acoustic owl]

I recommend you spend several hours playing with Git and Github. You will need it again and again

[normal sand]

Thanks, but what's the difference between the functionality of ffuf and gobuster? Like when do I use what?

[acoustic owl]

Both are fuzzers. Use whichever you like better.

[normal sand]

Please correct my understanding if I'm wrong. gobuster uses a wordlist to generate subdomain URLs and then confirms their existence with the use of DNS? Whereas fuff uses a wordlist to generate subdomain URLs and then confirms the existence by making a request to the URL?

[normal sand]

dnsmap can also be used for subdomain enum, right?

[acoustic owl]

DNS has nothing directly to do with vHosts.
You can enter various subdomains in the DNS, but these do not point to a website.
For example, a subdomain could be ns1.example.com. This subdomain would then presumably be assigned to a name server.
For a mail server, you could enter a subdomain such as mail.example.com in the DNS.

Depending on what you are looking for, you can query DNS or vHosts

[eager ledge]

Hi I am doing Pivoting Skills Assessment exercise. I have access to a domain joined Windows server. The domain is INLANEFREIGHT.LOCAL. From this Windows server, I am trying to find the domain controller. I have tried echo %LOGONSERVER%, Get-ADDomainController -DomainName INLANEFREIGHT.LOCAL, nltest /dsgetdc:INLANEFREIGHT.LOCAL, but none of these give me the Domain Controller.

[normal sand]

Got it.

[eager ledge]

Can anyone help me on how I can find the domain controller

[normal sand]

I'm just trying to perform subdomain enumeration on a HTB machine. Am I not supposed to use gobuster's DNS mode for it?

[next bronze]

those should do it, what did they give you

[eager ledge]

The exercise is not asking for it. I am trying it on my own

[normal sand]

Cuz under the man file it states "DNS subdomain brute-forcing mode" which I don't quite understand what it means by that.

[acoustic owl]

It depends on which services are running and which ports are open

[eager ledge]

So you mean the above commands should give the domain controller? I am logged in as a local user. May be thats the reason I am not getting the domain controller?

[next bronze]

the computer itself will have to be domain joined at least

[normal sand]

I've been told that it's on the default port 80 that I should perform subdomain enum.

[next bronze]

if you have the domain name you can try nslookup

[normal sand]

This is the command I used.
||```
ffuf -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -u http://10.10.11.13 -H "HOST: FUZZ.runner.htb" -fs 154

[eager ledge]

When running Get-ComputerInfo command in powershell, I get the output:

CsDomain                                                : INLANEFREIGHT.LOCAL

This means that the computer is domain-joined right?

[acoustic owl]

Then search for vHosts

[glass quail]

Module: Broken Authentication
Section: predictable Reset Token
I have translated the time that it shows me to epoch time with the milliseconds then hashed it with md5 and tried the script that comes with the section none of them are working. Do I have do something with the script?

[normal sand]

So nothing's wrong with my command? I just need to use a different wordlist. Thanks

[eager ledge]

But it will lookup the global domains, won't it? I don't believe INLANEFREIGHT.LOCAL is registered globally

[acoustic owl]

if -fs 154 is correct, it should work

[next bronze]

well if it's domain joined then it will use the domain's DNS server, and it will reply with usually the DC's IP

also nltest should do it

[normal sand]

Sorry, but could you confirm something for me? This command has the same functionality as my previous ffuf command?
||```
gobuster dns -q -d "runner.htb" -w "/usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

[eager ledge]

Can you please give me the command? I have tried it but it gives me error ERROR_NO_SUCH_DOMAIN

[normal sand]

I'm pretty sure it should be since I got a bunch of output that was that size. But I'll double confirm thx.

[next bronze]

it's just nslookup domain.name

or just nslookup and it should tell you the DNS server

[eager ledge]

Is it possible that I am not getting the domain controller due to connectivity issue?

Like the Windows server I am currently accessing is not connected to DC at the moment?

[next bronze]

maybe

if all else fails, sweep the subnet

[eager ledge]

How do I "sweep the subnet", you mean like ping sweep?

[next bronze]

ping, nmap, netexec, etc

[civic oar]

thanks mna

[next bronze]

read #welcome so that you can post images

[slender wraith]

Can anyone help me with an error i encounter while trying to do the Print Spoller and NTLM Relaying, please. I want to use the impaket-ntlmrelayx followed by dementor but when i try to do so the output from the impaket-ntlmrelayx is the following: ^^^. Thanks!

[next bronze]

can't give more info without the commands you used, but "wrong password"

[normal sand]

I'm doing a box on the main platform and currently trying to perform subdomain enumeration. I used the following ffuf command and found a subdomain.

ffuf -w subdomains.list -u http://10.10.11.13 -H "HOST: FUZZ.box.htb" -fs 154

Does anyone know how I can do the same using gobuster and/or dnsmap?
I have tried the following gobuster command but it did not output the subdomain. I have confirmed that the subdomain I'm expecting in the output is part of the wordlist (subdomains.list)

gobuster dns -d box.htb -w subdomians.list

[acoustic owl]

better ask in #boxes

With your ffuf command you check the vHosts.
But with Gobuster you want to query DNS

This is not the same thing

https://hackertarget.com/gobuster-tutorial/

[bold sinew]

Module: Attacking Web Applications with Ffuf > Skills Assessment - Web Fuzzing

Currently on question 3, which states "One of the pages you will identify should say 'You don't have access!'. What is the full page URL?"

I am struggling to find it. I have plenty of valid urls which return 403 Forbidden but they apparently arent the correct answer.

This is the command I am currently using to try and find this: ffuf -w /opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://archive.academy.htb:35303/FUZZ -recursion -recursion-depth 2 -e .phps -v

Am I doing anything wrong here?

[normal sand]

Thanks for clarifying.

What other tool would you recommend for subdomian enumeration?

[timber hatch]

in the module windows priv escaltion pillaging i need to transfer the file cookies.sqlite to my host. i tried scp and sftp but it does not work. how can i transfer the file?

[autumn pilot]

use one of the methods from File Transfers module

Also, if you are on a windows host and neither SSH/FTP related service is installed why would you rely on them?

[timber hatch]

the fuck is lagging, just awful...

[acoustic owl]

Swearing doesn't make the machine go any faster. If you have problems with the performance, contact support

[acoustic owl]

To find vHosts, I would use ffuf.

[timber hatch]

i try to trasnfer it with smbshare. but it does not work. i started the share, try to copy after the command the file has size 0 at my windows machine and at my linux machine also size 0

not my strenght to transfer files😂

[muted kindle]

copy what

[muted kindle]

Uploading local file to share
When you copy \\IP\share\file This is downloading the file from the share and output to current directory

[timber hatch]

you are right, lol missed the file. stupid 😉

[cunning cape]

having trouble transferring shadow.bak and passwd.bak to my attack machine. struggling as the host doesn't have simple-server, uploadserver etc on the machine. I'm connected via ssh but it keeps timing out when I try to use scp to transfer. I figured I could just take the code for simpleHTTPserverwithupload.py from github and using vim save it on the machine as simpleHTTPserverwithupload.py and then move it to /usr/bin/python3 but I don't have the permissions to move it there. any ideas?

Edit: Got it, I had been using scp on the victim machine instead of my attacking host

[rustic sage]

I'm revisiting the pivoting skills assessment. I can't figure out why this wont work from my VM but tested with support via pwnbox the proxychains RDP worked. I can proxychain scan the target box. Everything is setup through msf and is in line with solutions for it to work
proxychains nmap 172.16.5.35 -Pn -sT -p3389 PORT STATE SERVICE 3389/tcp open ms-wbt-server

xfreerdp fail even after accepting the cert

Anyone have a similar issue?

[past kite]

how to tell the admin about error? Login Brute Forcing, last Skills Assessment, I can't connect to ip-addr. I tried on my VM and PWNBox

[bright coral]

You can try to increase the /timeout and/or set /network:modem. Should be mentioned in one of those sections too

[rustic sage]

I'll try that, thanks

[bright coral]

Wrong port again? 😛

[iron solar]

Hi All, for the Windows Privilege Escalation - Citrix Outbreak. I am getting "An error occurred while making the requested connection. " When starting the Default Desktop. https://forum.hackthebox.com/t/htb-academy-windows-privilege-escalation-citrix-outbreak/314777 has anyone faced this before?

[past kite]

No))) it’s web)))

I simply copy and paste

[next bronze]

what's the address that you put in your browser

[bright coral]

It's not. Read the lines below the IP ... And the question also specifies the type of server...

[dense pollen]

Are links to modules/paths broken for anyone else?

[bright coral]

Works here. Any extension blocking scripts?

[rustic sage]

@bright coral /timeout:10000 /network:broadband
works

What a headache this has been

[dense pollen]

I checked that but I get the same behavior in incognito. I'll need to check if my pihole is maybe blocking some stuff

[past kite]

Try it yourself and see for yourself

[next bronze]

@past kite this

[past kite]

@bright coral https://academy.hackthebox.com/module/57/section/516

[hexed lintel]

can anyone help me,
session creates for a second and then powershell gives error

[bright coral]

Please read the last sentence of the first question. You cannot access that with a browser.

[shut quest]

I will eat a hat if you can get a web page to load for that skill assessment only from spawning the target.

[past kite]

ahahahah, okay, thanks. brothers))

[worthy tartan]

hello, total noob here. Anyone can tell how I can find the TARGETURI to set on metasploit ?

[shut quest]

What module and section is that?

[hexed lintel]

DNS Tunneling with Dnscat2 from Pivoting module

[worthy tartan]

Knowledge check in the getting started section

It's the getting started module*

[fathom pendant]

you don't need to change the URI

it's fine at its default

but in general to set an msfconsole option for an exploit it's set OPTION value

a lot of times you only need to worry about;

[worthy tartan]

doesn't that mean I need to set it?

[fathom pendant]

RHOST, RPORT, LHOST,LPORT

[fathom pendant]

The URI is already set

if it was blank, it wouldn't be set

/ means http://10.129.9.76/ is the base path

[worthy tartan]

oh ok sry I thought you'd need to have the name of a directory of some kind. I'm gonna try going forth with that. Thank you very much for your clear answers

[fathom pendant]

if you set /pages/ then it would be http://10.129.9.76/pages/

[fathom pendant]

the module is all about keeping it simple

nothing beyond surface level digging

[worthy tartan]

What should I type to change the LHOST adress in the payload?

Is it "set payload LHOST 'adress'" ?

[fathom pendant]

LHOST is YOUR tun0

you can simply do set LHOST tun0

[worthy tartan]

Ok thanks !

[fathom pendant]

and metasploit will do the rest

L = listening

R = Remote

[worthy tartan]

understood

[inland radish]

Hello all, I am in the “Network Enumeration with NMAP” module in the medium lab section. My initial scans were being filtered and I took some time to research issues I was having with spoofing the source IP. About 45 minutes later I returned to find that my scans are no longer being filtered and I answered the question for the section. Was this intended at the beginning or did I glitch it out by waiting somehow?

[worthy tartan]

I have another question, i've been running a -p- nmap and it's been half an hour, is this normal or did something bug ?

[fathom pendant]

don't spoof

[fathom pendant]

add -T4 to your nmap scan

[shut quest]

I'm not seeing anything wrong with your commands. Are you running PowerShell as administration?

Have you tried restarting the box or possibly a different VPN server?

[worthy tartan]

will do

[fathom pendant]

with Syn-scans they can get caught in loops and auto-readjust their retry and timers

on default

-T4 sets a limit iirc

but it's more aggressive timing overall

[hexed lintel]

yes i am running as administrator

[inland radish]

I got that off of the Google results. I was confused because my original scan “sudo nmap <ip> -p53 -Pn -n” was filtered when I first tried, then 45 minutes later was giving me the flag.

[fathom pendant]

sometimes it's just dumb

but spoofing isn't required

i didn't have to spoof at all

it came back filtered because you got "blocked" which sets like a 5-10 minute timer to try again

[inland radish]

Ok cool, so I didn’t circumvent the lab’s intent. Thanks!

[fathom pendant]

even the official guide doesn't spoof

although it may have helped to do -sU

[marsh echo]

hello why i've a black screen in this section ???https://academy.hackthebox.com/module/143/section/1360

[fathom pendant]

press enter

for the hundreth time regarding this

[marsh echo]

thx

[warm portal]

SQL injection module might need a look. Skills assessment took 3 resets to get a system that had a non-empty flag file

[bold sinew]

Still stuck on this if anyone is able to point me in the right direction 🙂

[hexed lintel]

@fathom pendant can you help on this

[fathom pendant]

nope

i don't think i ever messed with the socat one

[worthy tartan]

does anybody know why it won't let me wget linenum ?

[fathom pendant]

or if I did i blocked it from my memory

[fathom pendant]

because you're trying to write it to filesystem root

[west dove]

Hey can anyone help with the web attacks advanced file disclosure? Not sure how to create the dtd, I've read through the module sooo many times I dont get it!

[warm portal]

you might want to check your extensions; also 403 is not the same as a page saying you dont have access.

[fathom pendant]

/ is the root of the filesystem, it is a write-protected access

[worthy tartan]

how do I know where I should write it ?

[fathom pendant]

well /tmp/ is always world writeable

[worthy tartan]

ok thanks i'll try that !

[warm portal]

meant to hit reply, my bad

[bold sinew]

Will try some other extensions 🙂

[fathom pendant]

you can match regex to match the string

also as Rad said, your ext list is missing some extensions

[bold sinew]

👀 I'll have to see if I can figure out how to do that, im assuming its in the previous text of the module?

[fathom pendant]

it's not hard

just -mr "Text/regex"

[bold sinew]

https://tenor.com/view/cojestprawda-gif-2084691180186616053

[fathom pendant]

since you have the text you're looking for...

[bold sinew]

should be able to filter results by that then

[fathom pendant]

also as an fyi

whenever you get a bunch of results

you should probably be filtering out those response sizes

since they're all gonna be the same size, it can be safely assumed it's a default page of sorts

[worthy tartan]

when I am here, is there a way to search for a file called user.txt through a command line instead of having to explore each directory ?

[bright coral]

man find

[worthy tartan]

thank you !

[urban fable]

in the pivoting skills assessment, what did you guys use to crack the NTLM hash of user vf...., I got the lsass.dmp file, tried using rockyou.txt and mutated password list from the password attacks module, also tried xato-net-10-million

[bright coral]

I don't think the password is part of the common lists. You might have look into the different commands for mimikatz 😉

[fathom pendant]

sometimes it's right in front of you and you miss it

[urban fable]

hmmmm

found it lol

I just had to re read the pypykatz output

[bright coral]

@jolly trout

[steady plume]

Hi there! I am working on Cracking into Hack the Box skill path and I got stuck at Public Exploits exercise. Is this a correct place to ask for direction to help me get unstuck? 🙏

[fathom pendant]

what module?

getting-started?

if so: just view the webpage 😄

then from there you should be able to search for an appropriate exploit 😉

[steady plume]

Yes Getting Started Cracking into hack the Box...Topic is Public Exploits

[fathom pendant]

as I said

just view the webpage

and go off that info

You don't need to specify the path you're doing btw

just module name and section are enough

as modules aren't directly tied to their paths

you can even do a module without being enrolled in a path

[steady plume]

ok, thanks! Will try to go off from here. Because I used nmap, whatweb and curl to get some info, so I could search the exploit using msf, but I couldn't get anywhere

[fathom pendant]

well because you're likely looking at the wrong thing

the webpage directly tells you what plugin is being used

[fathom pendant]

web browsers are also a tool you can use

[fierce mason]

in the dnsadmins section on windows privilege escalation, i had gotten the netadm user into the domain admins group, but i wasn't able to read the flag.txt until i opened another session using evil-winrm, is there a reason for this

[gilded patrol]

For the error when using hashcat:
'CL_BUILD_PROGRAM_FAILURE' and 'Device #1: Kernel /usr/share/hashcat/OpenCL/shared.cl build failed.'

I found this comment on a page and it worked for me:
Using Hashcat on a VM with your AMD CPU, you just need to install POCL by using the following command : sudo apt install pocl-opencl-icd. It works just fine!!

[steady plume]

So, I have figured out that I need to use simple backup file read exploit, which when I set with correct host and port it downloaded for me simplebackup.txt file

[bright coral]

For interactive sessions the group membership is evaluated during logon - so in order to access local resources that require a certain group membership you have to relog

[fathom pendant]

well if you read the file it should seem interesting, don't forget to check the options of the msfconsole exploit you use

[steady plume]

There are some interesting things, but I am trying to figure out what to do with them 😅

[fathom pendant]

well, read the file it downloaded -- and figure out what you might need to change

the question tells you where the flag is

[sly nebula]

Use the VM in the "Introduction" section (EVASION-DEV).

[steady plume]

oh, of course...I forgot to put .txt when setting path :/ Thanks for directions really appreciate it

[sly nebula]

I am having this exact problem. Did you find out what is wrong?

[sterile epoch]

I installed gcc compiler but I need some more help compiling this project
https://github.com/itm4n/UsoDllLoader

[fathom pendant]

potentially your AV is deleting the EXE as it's detecting it as malware

just a thought though

given the error being "file.exe" does not exist

[sterile epoch]

can I compile it in pwnbox?

[fathom pendant]

¯_(ツ)_/¯

it looks like it's meant to be compiled in windows

i suggest adding the file(s) to an exclusion list for defender

[sterile epoch]

ok

I added the folder to the whitelist but the result was same

[fathom pendant]

you may have to re-download the files

or save and try and recompile

[stable bone]

literally 70

[fathom pendant]

¯_(ツ)_/¯

[fathom pendant]

bro how have you not finished this

[stable bone]

its a lot of reading and my attention span averages a few minutes

[slate zinc]

oh my god

[fathom pendant]

i can tell

[slate zinc]

its 70

[rustic sage]

Bro they are credits

[stable bone]

THANK YOU

told you it was 70

[slate zinc]

one small issue

[rustic sage]

Not boxes

[slate zinc]

they are cubes
not boxes

[fathom pendant]

cubes

[stable bone]

oh so whats a box

[rustic sage]

Whatever

[rustic sage]

A machine

[fathom pendant]

boxes are the main lab site's machines

[rustic sage]

Made purposefully vulnerable

[fathom pendant]

that's what's referred to as a box

[rustic sage]

For you to hack

[fathom pendant]

https://tenor.com/view/doboz-szia-integet-zonad-rajz-gif-16269320

this is also a box

[stable bone]

mine doesnt show machines... do i have to pay or sum

[slate zinc]

bro please spare us some slack and watch a introduction to htb video

[rustic sage]

No

[fathom pendant]

different site

[rustic sage]

You need to sign into HTB machines

[slate zinc]

marcie how do u do it 😭

[fathom pendant]

https://app.hackethebox.com has the machines
https://academy.hackthebox.com has the learning

[stable bone]

slash google

[slate zinc]

https://app.hackthebox.com/

[stable bone]

guys i already knew this ik everything remember

[rustic sage]

Yeah

[fathom pendant]

then finish networking module

[rustic sage]

Wait is this free? The academy?

I never tried the academy

[fathom pendant]

it's free* to a point

tier 0 modules are the free modules

after that it's a pay to learn system

[rustic sage]

Oh ok

[fathom pendant]

relatively affordable compared to most other platforms ¯_(ツ)_/¯

[stable bone]

gayyy

[sterile epoch]

I tried both, the result is the same I am downloading visual studio to see if it makes any difference

[fathom pendant]

that's homophobic

[rustic sage]

Do you increase your rank by doing academy as well?

[stable bone]

me fr

[stable bone]

thats what im wondering

[fathom pendant]

no, only active machines and challenges increase rank

[rustic sage]

Oh ok

[fathom pendant]

they are separate sites, so progression is not linked in anyway

rank on HTB is a reflection of %active content you've done at some point

[stable bone]

marcie use your skills to link them

[fathom pendant]

not something I can do ¯_(ツ)_/¯

[stable bone]

arent you a mod?

[fathom pendant]

that's up to HTB if they even want to implement something like that

even if I were mod, still nothing I can do

[stable bone]

yh so go tell them

[rustic sage]

" ¯_(ツ)_/¯" I am saving this

[fathom pendant]

mod != staff

[fathom pendant]

it's just /shrug

[stable bone]

bro just use slash shrug

(╯°□°)╯︵ ┻━┻

[fathom pendant]

┬─┬ノ( º _ ºノ)

[rustic sage]

¯_(ツ)_/¯

[fathom pendant]

calm your tits my dude

i thought you were gonna go play Valo

[stable bone]

did you just unflip my table

[slate zinc]

hey its serious discussion for off topic move to #general

[stable bone]

you just assumed my gender

[fathom pendant]

https://tenor.com/view/very-undudish-gif-18736661

[rustic sage]

╱╱▏┈┈╱╱╱╱▏╱╱▏
▇╱▏┈┈▇▇▇╱▏▇╱▏
▇╱▏▁┈▇╱▇╱▏▇╱▏▁
▇╱╱╱▏▇╱▇╱▏▇╱╱╱
▇▇▇╱┈▇▇▇╱┈▇▇▇╱

[fathom pendant]

everyone's a dude

he's a dude, she's a dude

[stable bone]

dude thats deep

[fathom pendant]

anyway, we're straying far off-topic

[rustic sage]

Back to #general I go. This isnt my territory

[icy marsh]

footprinting - DNS - What is the FQDN of the host where the last octet ends with "x.x.x.203"?
i'mn stuck in this question. I'm bruteforcing subdomains for 30 minutes using wordlist /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt but that one not came ?

[fathom pendant]

subdomains of subdomains

make sure you have an accurate list of base subdomains to go with

[wicked oxide]

Yes i was using the wrong template in visual studio

[fathom pendant]

dig axfr inlanefreight.htb @target_IP < start with this to get your subdomain list

[wicked oxide]

You must use the template with .net framework in the name

[icy marsh]

then ?

[fathom pendant]

Use that list with dnsenum

[finite acorn]

hey y'all. i'm waiting for the support team, but I figured throwing my question in here may help as well. I'm on starting point, Tier 2, Archetype and trying to execute the sudo python3 -m http.server 80 and getting an OSError: [Errno 98] Address alrady in use. Any way to get past that without killing the machine?

[fathom pendant]

It's that simple

[fathom pendant]

Wrong channel

[icy marsh]

ok sir

[finite acorn]

crap, sorry. where would be the right channel?

[fathom pendant]

#starting-point ; read and follow #welcome to access

[fathom pendant]

Also to cut time, it's because pwnbox serves vnc on port 80, use an alt port like 8080

[sly nebula]

OK, Thanks. I am using the right template, then. I'll dig further into this. Did you use the same payload as in the lecture?

[fluid basin]

In the 1st skills assessment for Attacking Common Apps I managed to get to basic command execution via following a blog post, however my shell only executes the dir command. I tried specifying the full paths of the binary I want to execute, however nothing of that nature works for me. Any tips would be appreciated

btw I also have tried url encoding my payloads

[oak hollow]

Erm, I think I might’ve found an error for the flags on vhosts inside of information gathering, where a flag 4 string is actually submitted and marked correct on flag 3. So the flag actually has the HTB{flag fourSOMESTRINGHERE} should I put it in erratum even tho it would share the flag?

[fathom pendant]

This is a known thing and just funny

It's not really an error since you found it on the flag 3 host

Most people don't pay enough attention anyway

[oak hollow]

Ah yeah it threw me off - cause I submitted to flag four thinking the string was a true flag 4 flag

the goof - thank you 🙂

as long as its intentional!

[unreal seal]

Investigate all records for the domain "inlanefreight.com" with the help of dig or nslookup and submit the one unique record in double quotes as the answer.

I am trying to solve this question.
I have found that is ||SPF|| record.
but it is not being accepted as answer.

Am i missing something? i have enumerated all other records and found nothing interesting.

[fluid pine]

can yall help me?

https://discord.com/channels/473760315293696010/1248332180115951616

in here

[wicked oxide]

Yup

[fathom pendant]

Not enough info given, also looks like you're using the GUI on Windows?

[fluid pine]

yes

i just got connected with starting point vpn

[fathom pendant]

Well generally you want to connect in a linux vm via the command sudo openvpn <file>

Also this channel isn't for starting-point machines

[fluid pine]

oops

[fathom pendant]

There's #starting-point for that

[fluid pine]

im sorry

[fathom pendant]

There's also a help article related to getting connected

[fluid pine]

oh

i couldnt connect the one for machines

[fathom pendant]

https://help.hackthebox.com/en/articles/5185687-introduction-to-lab-access

[vernal hamlet]

Hi

[soft plume]

@fathom pendant sorry for ping, but is there any way I can make the xfreerdp connection not be so bad? I've tried pwnbox, different regions, new vpns. Every single time it'll first start blue screen windows tghen freeze and close after like 20 minutes, then it';ll open and freeze on desktop. It just keeps freezing and disconnecting.

[fathom pendant]

Tcp vpn

Otherwise contact support my guy

[vernal hamlet]

im in Attacking LSASS Password Attacks and im trying To Solve This Question ( Apply the concepts taught in this section to obtain the password to the Vendor user account on the target. Submit the clear-text password as the answer. (Format: Case sensitive) ) i tried everything Possible after Creating dumpFile For The LSASS and Transfer it to my Local Machine i tried to use pypykatz to extract The Credentials im only Getting Errors even after reinstall the tool

i only get few lines of INFO Then alot of errors

[split glade]

If you want anyone to potentially help you you really have to give more info, like a screenshot of the errors

[vernal hamlet]

i dont think i can share a screenshot

How Can i share a screenshot ?

This is the command i used ( pypykatz lsa minidump /home/kali/Desktop/htb/HackTheBoxAcademy/Modules/PasswordAttacks/AttackingLSASS/lsass.DMP )

[fierce mason]

how long is AEN blind supposed to take on average

[split glade]

On discord you can just copy paste an image or drag & drop it in the chat, and if it's about taking screenshots there are many tools, ksnip is one of them if you use linux

The command is the right one, although I see .dmp in lowercase

[vernal hamlet]

i tried i use light shot

[vernal hamlet]

i cant send the full commnad here for somereason , i will send it to your dm

[fathom pendant]

You can't share screenshots since your account isn't linked see #welcome

[wanton idol]

for detailed walkthrough in the report do u also include the way u got a foothold into the internal network instead of starting from the internal network?

[soft plume]

yea it aint work, I'll have to contact them, thanks for the help tho.

[fathom pendant]

Well a foothold is necessary, no?

[wanton idol]

yeah it is, i was just following the cpts format and they didnt say include the foothold or anything

[fluid pine]

hey i dont get how to work this question: Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.

[wanton idol]

just straight into internal

so i was double checking

[fathom pendant]

NSE-- nmap scripting environment

Aka use nmap scripts

[fluid pine]

--script vulns

?

[fathom pendant]

¯_(ツ)_/¯

Don't ask. Just do

I will not give a yes/no answer, work it out on your own

[rustic sage]

https://tenor.com/bVsNJ.gif

[fluid pine]

i got an "answer"

[fathom pendant]

Try, fail, ask better questions

Also sometimes some environments work better in pwnbox than vm

Same exact syntax, tools, etc

[fluid pine]

so i did smth and i got smth like this http-enum: /robots.txt

nmap 10.129.165.146 -p80 --script vuln <--this is what i did

this was my output: ```Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-06 20:00 BST
Nmap scan report for 10.129.165.146
Host is up (0.075s latency).

PORT STATE SERVICE
80/tcp open http
| http-enum:
|_ /robots.txt: Robots file
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-vuln-cve2014-3704: ERROR: Script execution failed (use -d to debug)

Nmap done: 1 IP address (1 host up) scanned in 37.97 seconds```

[sterile epoch]

How do I gain a ssh shell to my pwnbox instance? before the credentials file used to have the host address now I cannot find it. I want to transfer binaries from my local machine to pwnbox

[fluid pine]

im lost 😭

idk where to go from that output

[sterile epoch]

thats part of the journey

[fluid pine]

true 😔

[sterile epoch]

when you are lost calm your mind

look at the task at hand

then think what you need to get the answer

[fluid pine]

ok i need to find a flag that one of the services contains. now how do i look and see which one has the flag

[sterile epoch]

whats the task?

[fluid pine]

Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.

[sterile epoch]

well when you do not know what to look for try looking into everything

[fluid pine]

idk how to look in them

[sterile epoch]

now that you have to ask google

[fluid pine]

oh

ok well ill come back to this later then

[fathom pendant]

Well did you try visiting the webpage /robots.txt?

[fluid pine]

?

[fathom pendant]

Port 80 is default http yeah?

[fluid pine]

yh

[fathom pendant]

So

Did you try visiting the page itself

Since it's saying there's a robots.txt page

http://ip/resource

[fluid pine]

so for me... http://10.129.165.146/robots.txt??

[fathom pendant]

Don't ask me

[sterile epoch]

marcie any help?

[fathom pendant]

Do it and come back if it doesn't work

[fathom pendant]

ip a

[sterile epoch]

i tried using the public ip

[fathom pendant]

And did you use the creds in the pwnbox credentials text file?

[sterile epoch]

yes

[fluid pine]

FINALLY

thank you so much Marcie

[fathom pendant]

¯_(ツ)_/¯

[sterile epoch]

any other way to transfer binaries to pwnbox

[fathom pendant]

You're sure the password is on your clipboard when you paste it

[sterile epoch]

let me try again

[fathom pendant]

Just download them

[sterile epoch]

for the skill assessment of windows priv esc I have to build them

using visual studio

[fathom pendant]

Well; the creds on the desktop should work

¯_(ツ)_/¯

If not then message support, I can't help you with this my guy

[sterile epoch]

https://github.com/RedCursorSecurityConsulting/CVE-2020-0668

any tips with this exploit?

this was the one shown in the module

[fathom pendant]

No idea

Haven't done that module

[sterile epoch]

ohk

[neon wadi]

I had the same issue. When I use "proxychains xfreerdp ...", I see the traffic sent across my VPN tunnel (tun0). However, when I use "proxychains nmap ..." I see the traffic sent over my external (eth0) interface. Not sure why that is happening.

[fathom pendant]

Is your proxychain set up properly?

Also using msf as your proxy connection is a pain

Is msf using your tun0 ip for it's listening/forwarding?

[neon wadi]

proxychains msf sends the traffic over tun0: [*] 172.16.5.19:3389 - Detected RDP on 172.16.5.19:3389 (name:DC01) (domain:INLANEFREIGHT) (domain_fqdn:inlanefreight.local) (server_fqdn:DC01.inlanefreight.local) (os_version:10.0.17763) (Requires NLA: No). proxychains xfreerdp connects over tun0 through the Ubuntu jump host to the Windows host. The only thing not working is proxychains nmap.

[fathom pendant]

¯_(ツ)_/¯

Nmap sucks over proxy anyway