modules

[normal sand]

Ahh okay. After you said this, I went back and looked at the distinguished name and the krbtgt account is under Users, so makes sense why it showed now 😂

[cloud urchin]

you can also make chatgpt hallucinate

[normal sand]

It's hallucinating the majority of the time for me, I'm lucky when it's not 😂

[next bronze]

that's the thing, you'll need to know what you're doing to catch those, can't just blindly rely on it

[cloud urchin]

true

[normal sand]

Is AS-REP roasting even covered under the Penetration Tester path?

[cloud urchin]

that's the funny thing, to make use of it you actually need to already know the terms and how things work and present the question like that

it just helps speed up the process like 10000x

which is why chatgpt stronk 🦾

[next bronze]

yeah it's in the AD module

[normal sand]

Oh okay, I didn't see it as a section heading so I was wondering, it's probably under one of the sections.

Btw what's the average time a person takes to get thru the AD Enumeration & Attacks module?

[next bronze]

Idk depends on your prior knowledge

and how much extra reading you wanna do

[normal sand]

Ah ok.

My prior knowledge with AD can be summed up to the Intro to AD module and even that I don't remember the minor stuff, I remember the basics tho, mostly... (it's been a while) 💀

[cloud urchin]

if you understand windows fundamentals then it's a lot easier to grasp, it has many of the same ideas like users, groups, policies, access controls, except it automates and centralizes the resources

[normal sand]

Yeah, went through that module, so I get all the basic concepts.

[next bronze]

https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals

[ivory nymph]

Does any one know how to solve this question?
last question in the INFORMATION GATHERING - WEB EDITION module.
" What is the API key the inlanefreight.htb developers will be changing too?"

[normal sand]

They extended the module? So now I've gotta complete this for the Penetration Tester path to be considered completed?

[ivory nymph]

I'm doing this too, took me 15 minutes to finish the updated content.

but stuck at last question 😦

[signal wing]

Anybody know why my open vpn connection stats wont stay above 0 any more for more than like 10 seconds no matter what I switch to? It wont let me rdp to the IP

[normal sand]

I'm gonna finish my current module then I'll go back to this.

[ivory nymph]

Cool

[normal sand]

15 minutes ain't bad tho, it's not very long?

[ivory nymph]

Nah you just read and click complete the module, only few new exercises

[normal sand]

Ah ok.

[real delta]

redownload your vpn file

[midnight galleon]

hi

in this module https://academy.hackthebox.com/module/57/section/491 login bruteforce

i found the password but the ssh server is configured to only allow public key

is HTB trolling us?

[next bronze]

use the right port

[simple loom]

DM me if you still stuck 😄 That last question is confusing

[ivory nymph]

Yes i'm haha

DMing you

[simple loom]

sure!

[midnight galleon]

i did

[signal wing]

I've tried that unfortunately. Ive tried different servers, ive redownloaded the vpn files, changed to tcp, updated openvpn, redownloaded vpn, restarted my computer

[midnight galleon]

n't

[signal wing]

worked fine a couple days ago now its a disaster lol

[eager ledge]

Hi, I am doing Credentialed Enumeration - from Linux section of "ACTIVE DIRECTORY ENUMERATION & ATTACKS" module. It teaches us how to use ingestor and BloodHound GUI to visualize the relationships. I have run the ingestor and collected the user, computer information in json format and zipped it. I also started the neo4j service using sudo neo4j start command which started a web server at http://localhost:7474/ and another listener at port 7687. On my pwnbox, I did local portwarding to the target and successfully logged in:

[real delta]

what OS are you running on your vm or whatever you're running openvpn on?

[signal wing]

im just running it on windows and using rdp from there

[eager ledge]

However, I cannot see the bloodhound UI where I can upload the collected data.

[real delta]

why windows for openvpn?

also check your error logs

[next bronze]

you're looking at the no4j db that bh uses, the bh gui itself is somewhere else

[eager ledge]

The section text says that I have to start bloodhound. But when I run the bloodhound command on the target machine, I get the error:

[next bronze]

oh

try with sudo maybe

[real delta]

bh doesn't need sudo

[real delta]

check if neo4j is running

[next bronze]

I know

[signal wing]

i already had it installed from tryhackme I think so it was easier than creating a vm

[real delta]

make a vm

what are your error logs for openvpn?

[eager ledge]

How do I do that?

I mean it is listening at the two ports mentioned above

[real delta]

sudo systemctl status neo4j

[eager ledge]

└──╼ $sudo systemctl status neo4j
Unit neo4j.service could not be found.

[next bronze]

this is your own screen right

[plain trellis]

Anyone I can dm for file inclusion skill assessment section?

[eager ledge]

No. This is the target machine.

[real delta]

start it then

start the service

[eager ledge]

Right I can do this on my own pwnbox mahcine!

[next bronze]

neo4j start

[signal wing]

im looking in the logs on the app but im not seeing any errors

[real delta]

you should still make a vm with kali or parrot on it

use that for openvpn and for academy, it'll have everything you need

[signal wing]

I actually did create one with parrot on it to try that but maybe i was doing something wrong

sudo openvpn academy-regular.ovpn ?

[eager ledge]

When starting neo4j service on the pwnbox, I get the error:

[next bronze]

try the command I sent

did the module not say how to run it?

[eager ledge]

Yes I already did that. First I ran the command sudo neo4j start. Then,

└──╼ $sudo systemctl status neo4j
○ neo4j.service - Neo4j Graph Database
     Loaded: loaded (/lib/systemd/system/neo4j.service; disabled; preset: enabled)
     Active: inactive (dead)

Then,

┌─[✗]─[htb-ac-885875☺htb-ts2ftrlqd2]─[~]
└──╼ $sudo systemctl start neo4j
┌─[htb-ac-885875☺htb-ts2ftrlqd2]─[~]
└──╼ $sudo systemctl status neo4j
× neo4j.service - Neo4j Graph Database
     Loaded: loaded (/lib/systemd/system/neo4j.service; disabled; preset: enabled)
     Active: failed (Result: exit-code) since Fri 2024-06-21 08:18:09 BST; 2s ago
   Duration: 1.551s
    Process: 5526 ExecStart=/usr/share/neo4j/bin/neo4j console (code=exited, status=1/FAILURE)
   Main PID: 5526 (code=exited, status=1/FAILURE)
        CPU: 4.057s

[autumn pilot]

try with sudo neo4j console

[real delta]

neo4j needs sudo perms because it's starting a service

[signal wing]

damn the vm is giving me errors, thanks for the help ill just wait til support is available I guess

[eager ledge]

What does this do? This has not been mentioned in the section

[eager ledge]

I am using sudo

[real delta]

sudo neo4j start

[eager ledge]

Yes I did that

[real delta]

what's the output?

you can also use docker for bloodhound

[next bronze]

just use bh CE

[real delta]

you won't have the same features tho cause the docker version is a web ui

[next bronze]

works most of the time

[next bronze]

they've massively improved it since and it's pretty good now

imo

[real delta]

nice

[eager ledge]

Directories in use:
home:         /var/lib/neo4j
config:       /etc/neo4j
logs:         /var/log/neo4j
plugins:      /var/lib/neo4j/plugins
import:       /var/lib/neo4j/import
data:         /var/lib/neo4j/data
certificates: /var/lib/neo4j/certificates
licenses:     /var/lib/neo4j/licenses
run:          /var/lib/neo4j/run
Starting Neo4j.
Started neo4j (pid:5404). It is available at http://localhost:7474
There may be a short delay until the server is ready.

[real delta]

looks like it works then

oh, your problem was with bloodhound. Does it work now?

[signal wing]

Damn so it worked for a second and it got disconnected on the linux machine

[eager ledge]

Previously I was running neo4j on the target machine and neo4j:HTB_@cademy_stdnt! allowed me to login. However, I am running it on the pwnbox now and the credentials are not working.

What are the default credentials that I can use?

[autumn pilot]

neo4j:neo4j

[next bronze]

why do you need to login to neo4j tho if all you're using is bh

bh will do the connection

[eager ledge]

This worked!

Thanks!

It was also asking for username and password

[haughty tree]

This module took me wayyy too long

But it was really cool and fun

[eager ledge]

Indeed it is!

[plain trellis]

.. anyone?

[elder kraken]

In Footprinting Lab - Medium, I'm on the last part of the SQL Server exo. I understand that the user "alex" and "sa" are not the users to connect to SQL Server. The only other user is the admin, but I don't know how to find his credentials. Am I in the right path?

[lofty sparrow]

dm

[sly kelp]

Any guess what module is coming up next

[lofty sparrow]

can i get a hint for web attacks skills assessment? ive enumerated all the accounts, and i cant seem to reset their passwords.

[storm elk]

@lofty sparrow feel free to dm me

[sudden laurel]

You can dm me

[storm hedge]

Hello, sorry to bother you, I'm studying web attacks but my english isn't good.
In server side request forgery, litteraly means the forgery of a request is triggered on the server side?

[old oasis]

Basically you tricking the server to send a request to some type of resource that it has access to.

[storm hedge]

@old oasis Thabk you, I understand the general concept, I have done some labs, but I'm just taking notes in my native language, I want to make sure the translation is correct.
The way I understand forgery in server side forgery is that we trick the server in forging a request and sending it

[old oasis]

Yes the term "forgery" here means that the attacker is tricking the server into creating and sending a request that the server would not normally send on its own. Essentially, the attacker manipulates the server into "forging" or crafting a malicious request.

[storm hedge]

@old oasis ok, that's what I thought.
Thanks a lot.
Sorry about the stupid question, I wanted to make sure where the forgery occurs and this was right

[old oasis]

No worries. Glad I could help 🙂

[shut vapor]

I like how the VPN servers suggest workload levels. That seems new... but it's 6:45 on the US East Coast and all US servers are at medium load. ☠️

[next wind]

Hi, would anyone be available for a hint for the last Skill Assessment question - INFORMATION GATHERING - WEB EDITION: "What is the API key the inlanefreight.htb developers will be changing too?"
I'm doing the update part

[fathom pendant]

UDP scan? also reading; "This server is a backup server"

[icy kiln]

thanks

[patent spade]

Hi, can you give a hint for that question?

[next wind]

Sure DM

[upper sorrel]

how do i view hidden files? 'ls -la' does not work...

[fathom pendant]

wdym "does not work"?

[upper sorrel]

nvm im looking in the wrong place

[fathom pendant]

[upper sorrel]

starts with . apparently

[fathom pendant]

yes

hidden files start with .

if you do ls -l and ls -la you'll find that the hidden files indeed do start with .

[upper sorrel]

yeah i found it, thanks anyway

[upper sorrel]

Trying to find 'how many total packages are installed on the target system' using the given commands they have told me. I have entered the number returned however it is incorrect? What am I doing wrong?

[proper jungle]

are you sure that the command you are running outputs only the packages? 😉

[fathom pendant]

Only the installed packages

dpkg uses ii to indicate a fully installed package

[silk anchor]

Has anyone actually managed to complete 'Password Attacks' in 8 hours ?

[fathom pendant]

Probably a few

If you don't get too hung up on skill issue, and don't attack ssh

[proper jungle]

yup, but iis are not the only thing that gets outputted though

[upper sorrel]

cant figure it out

[fathom pendant]

Yes, I'm referring to how to grep for ot

[silk anchor]

Im going to need to put hashcat on windows I think, Need that gpu boost

[fathom pendant]

Nah not really

[proper jungle]

aaa gotcha

[fathom pendant]

I'm using a 10 year old cpu, and max time spent was 5 minutes, if that

It can be completed with a relatively low-spec cpu

[muted kindle]

try with single quotes ?

[silk anchor]

Maybe I am getting skill issued then

[fathom pendant]

What section?

The general flow is: non-mutated --> mutated --> rockyou

[proper jungle]

hmmm, when you use the command dpkg --list that includes some lines that are not the installed packages, aka ii, you will have to grep something to get the correct result

[upper sorrel]

when you mean grep do you mean remove

theres a command for that i think

[proper jungle]

include only what youre looking for 🙂 ||ii||

[fathom pendant]

Grep matches content you search for

[upper sorrel]

got it

[silk anchor]

'Passwd, Shadow & Opasswd'

Cracked it now with your tip, it was on the mutated list. Not rockyou as per the example

[fathom pendant]

<command> | grep "<output you're looking for>"

[upper sorrel]

dpkg -l | grep ^ii | wc -l

worked

[fathom pendant]

The mutated list gets used a lot. I also suggest saving any user:pass you come across

[proper jungle]

only in this specific module or like all modules?

[fathom pendant]

In this module

Pretty much all modules are self-contained

[proper jungle]

copy

[fathom pendant]

You won't use the resources for one module for another one, aside from the generic lists

[proper jungle]

aaa I see

[fathom pendant]

So the mutated list you generate in password attacks is just for that

Because it's a specialized list

[vague sage]

in attacking web applications with ffuf
value fuzzing

Try to create the 'ids.txt' wordlist, identify the accepted value with a fuzzing scan, and then use it in a 'POST' request with 'curl' to collect the flag. What is the content of the flag?

i created the ids.txt scanned it, got the id
but where do i use it?

i used curl http://admin.academy.htb:38633/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded'
and replaced the FUZZ with the number i got from the scan (if that would change anything but nothing)

[normal sand]

Module: AD Enumeration & Attack
Section: Kerberoasting - from Linux

What powerful local group on the Domain Controller is the SAPService user a member of?

What have I tried?

• I've tried using rpcclient to enumerate groups, but it only gave me the domain group it is a part of, not local groups.
• I've tried psexec.py, didn't work since no writeable shares.
• wmiexec.py didn't work either.
• Couldn't RDP

The only thing I've confirmed so far is that SAPService is part of the Domain Admins group.
Is my only option to use bloodhound now? Or would bloodhound not show local groups?

[fathom pendant]

Did you filter out the false positive results?

[vague sage]

yeah

-fs xxx

[fathom pendant]

You don't need the header btw

[vague sage]

oh

wait

[fathom pendant]

Also where do you think you put the value you just fuzzed

[vague sage]

forget it i already got the answer

it was at the very top
didnt see it

[fathom pendant]

You can use grep btw

[vague sage]

ye
i got it
it was on the first line of the source code
and i was looking elsewhere

[normal sand]

Could please someone nudge me in the right direction for this?

[fathom pendant]

You shouldn't need any logging in

[normal sand]

I think I've used every tool they've mentioned in the module for credentialed enumeration though, except for windapsearch, which I checked the documentation for and didn't find an option to enumerate local groups.

[fathom pendant]

The GetUsersSPN.py should output the group

You'll just need to use that user and password for the query

[normal sand]

Should output the group? All it output was the name and DN.

[fathom pendant]

There should be a cn in there

cn={group}

[normal sand]

Isn't that a domain group tho?

[fathom pendant]

The a... group.

[normal sand]

Yeah, I managed to get the group.

[fathom pendant]

cn=BuiltIn

[normal sand]

Oh? So those groups mentioned are always local groups?? Not domain groups?

[fathom pendant]

Generally yes

[normal sand]

Dang, here I always thought they were domain groups since they were part of the DN.

[fathom pendant]

DN != domain group

It's just an identifier

There can be domain groups, but if you google as well you'll find that it is a local group

[normal sand]

No, I know it means Distinguished name, but I thought the Common Name at the front was usually either the domain username for the account or the domain group name.

[normal sand]

Understood.

[fathom pendant]

Incorrect

cn is just another thing that can identify it

[normal sand]

Okay, so it could be a local group or a domain group or just a domain user?

[next bronze]

DN is just a name, and the line between local and domain becomes blurry on DC because it's the domain controller

[normal sand]

Like in this record it's a domain group since it's Domain Admins, yeah?

[fathom pendant]

Yes

[next bronze]

we're talking about AD groups not CA groups bud

but the concept is similar

[normal sand]

So essentially it's just a name?

[fathom pendant]

Just a way the DC identifies it

Like full government name vs nickname

[normal sand]

Now in this case, even though the SAPService user I got the password for was a domain admin, I wasn't able to RDP into the DC or anything. How would I usually log onto the DC in such a case if it was an assessment?

[fathom pendant]

Usually pivot

[normal sand]

Okay, gotcha, thanks for the analogy.

[fathom pendant]

Also most of the time, for DCs, RDP is disabled

[normal sand]

Pivot? But I can already access services on the DC? What's the need to pivot?

[next bronze]

probably just doesn't have RDP rights, but if you're DA you can do anything, including giving yourself RDP rights

[normal sand]

But since I can't RDP, or psexec, or anything, how would I give myself rights?

[fathom pendant]

You don't need to do those actions on the DC

[next bronze]

why can't you psexec

[normal sand]

Nmap report for reference.

[normal sand]

No writeable shares.

[fathom pendant]

If you're a DA you can write to shares

[next bronze]

are you sure that's a DA then

[normal sand]

100%, checked with rpcclient.

[next bronze]

I'm gonna check, if that's wrong I will bonk you

if the target ever spawns

[fathom pendant]

Spoiler btw, pw is an answer to a question

[little fractal]

yoo

[next bronze]

that's domain users

[fathom pendant]

That's just the group rid

[normal sand]

🤦‍♂️

[fathom pendant]

But also yes domain user

[normal sand]

I'm so sorry. I misread 🫠

[next bronze]

https://tenor.com/view/monkey-gif-26412572

[little fractal]

guyss
just made a new book related to AI
if you interested in having it it would be a great pleasure if u dm me so i give u the details
the name of it is artificial simulation it talks specific details about ai and also its intriguing and fascinating future such as mars colonisation and much more advanced and mind blowing features

[normal sand]

I didn't see any pw in there?

[fathom pendant]

description "all domain users"

[fathom pendant]

Domain/user:password you goon

[normal sand]

Oh, passwd 🤦‍♂️

Brain ain't working rn.

[fathom pendant]

We don't care, stop spamming

Do it again and I'm pushing the red button

Read #rules and #welcome when you join a server

[little fractal]

ok

[fathom pendant]

Even if people cared, it's not relevant to this channel

[fiery crane]

I am doing Reverse Shells skills assessment, the RDP fails to connect everytime I try on pwnbox and my machine.

[fathom pendant]

"Fails to connect" elaborate

[normal sand]

Anyways, thanks ya'll for explaining the CN thing to me!

[fathom pendant]

Do you get an error?

Are you sure you're copy/pasting the username and password

[fiery crane]

yes

[fathom pendant]

Are you getting a black screen

[fiery crane]

it opens the session for 5 seconds I open cmd and it crashes.

then doesnt open until I change the target and does the same thing again.

xfreerdp /v:ip /d:HTB /u:htb-student /p:'HTB_@cademy_stdnt!' /dynamic-resolution

[vague sage]

alright
Skill Assessment Web Fuzzing
Run a sub-domain/vhost fuzzing scan on '*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name)

spoiler

[fathom pendant]

/timeout:99999 /auto-reconnect

[fathom pendant]

still spoiler

[vague sage]

ill fix it after this

[fathom pendant]

no commas just subdomain1 subdomain2 subdomain3

[vague sage]

does the order matter?

[fathom pendant]

unsure

[vague sage]

still wrong

[fathom pendant]

do it in alphabetical order maybe

but there's no commas

just a.. b.. c..

[vague sage]

ye just space

[fathom pendant]

and not the full domain as a.academy.htb

JUST the subdomain found

[vague sage]

still wrong
lemme try with commas

[fathom pendant]

so JUST A

[vague sage]

yeah

[fathom pendant]

well your answer is correct

with the 3

[upper sorrel]

i honestly can never figure out the commands, i spend a while looking through the --help, then often find nothing then just look the command up on google. is this what i am supposed to be doing??

[vague sage]

oh nvm
forgot the y in faculty

[upper sorrel]

doesnt feel right

[fathom pendant]

take a second to step back, google better

how you google determines what results you get

If you google "how do I use <tool>" you'll usually get a dozen results

[upper sorrel]

like instead of asking the whole question, i only ask a certain part like 'finding the number of unique paths with curl'

[fathom pendant]

tbh that one is just bullshit, i went to the HTB forums for that one when I did it

[upper sorrel]

i still cant do it

online ones dont work for me

[fathom pendant]

#modules message

[fathom pendant]

what does that even mean?

[upper sorrel]

the commands that some places have given me dont give a straight answer

or a correct answer

[fathom pendant]

the forum article my message links to has an answer

i definitely recommend against using chatGPT

[upper sorrel]

makes sense

[limber river]

anyone facing the sam problem Target(s) are spawning...

[next bronze]

yes

[limber river]

weird

[next bronze]

took 10 mins to spawn the last one

[limber river]

I thought I will finish the update in 20 min

now it takes 20 min just to spawn the first target

[next bronze]

it be like that

[limber river]

WTF ?

[next bronze]

what

[limber river]

read this

[fiery crane]

using rdesktop worked. thanks.

[next bronze]

yeah it's hilarious

[hexed lintel]

why xfreerdp is not connecting
but works fine on remmina

[fathom pendant]

use single quotes on the password

[hexed lintel]

didn't work

[fathom pendant]

/timeout:99999

it looks like it's timing out

also, why tf do youhave the swastika in your terminal

[slow dirge]

Could someone help me with the Advanced Command Obfuscation Section of command Injection Module.

[fathom pendant]

only if you actually ask your question

[hexed lintel]

why not?

[fathom pendant]

because people don't associate that symbol with Hindu

they associate it with Nazis

[hexed lintel]

ohh

[slow dirge]

Here is the Q:- Find the output of the following command using one of the techniques you learned in this section: find /usr/share/ | grep root | grep mysql | tail -n 1 . I tried this but doesn't work. ip=127.0.0.1%0a${LS_COLORS:10:1}$(rev<<<'dnif')${IFS}${PATH:0:1}usr${PATH:0:1}share%0a<<<$(rev<<<'perg')%09root%0a<<<$(rev<<<'perg')%0amysql%0a<<<$(rev<<<'liat')%0a-n%0a1

[fathom pendant]

wrap the command in backticks (`) so that discord makes it look neater

`like this`

[next bronze]

think dumber, try the examples in the module

[slow dirge]

done

[slow dirge]

this command show the list of Find output but doesn't filter out.

[next bronze]

yes because the answer is simpler than that

[slow dirge]

Thank you, i'll try.

[unique remnant]

Thanks @fathom pendant , I was spending 2 hours to figure this out

[misty saddle]

Hey everyone, does any one know if this is a bug or if im doing something wrong? I am at the AD attack and enumeration Priv esc.
Question:
Leverage SQLAdmin rights to authenticate to the ACADEMY-EA-DB01 host (172.16.5.150). Submit the contents of the flag at C:\Users\damundsen\Desktop\flag.txt.

I have to ssh to the IP 172.16.5.150.
I copy paste the password and I've tried following the solution but I still get the error "Permission denied, please try again."

I've been having this issue since yesterday. I've tried pretty much everything.

[bright coral]

You do something wrong. I can log in without a problem (directly and through the windows host)

[misty saddle]

That’s weird

I’ve tried resetting the box 2-3 times

I followed the whole official solution but I still get the error. I’ve seen in forums and everyone says it works so I’m not sure what I’m doing wrong

[bright coral]

You tried typing the password instead of pasting?

[misty saddle]

Yeah multiple times just to make sure

Just tried copy paste again and now it works

idk what the hell went wrong the first 30 times

but thanks anyway for the support!

[blissful elm]

Identify the following hash: $S$D34783772bRXEx1aCsvY.bqgaaSu75XmVlKrW9Du8IQlvxHlmzLc on this question i have found the ans , but when i submit its says its wrong

crack with hashcat -module

[dim wolf]

try checking the example hashes on hashcat's website

[blissful elm]

yeah i found the ans from there only

[pseudo kiln]

attacking common services module, I have an issue interfacing with the mssql service

||I can use this command to authenticate as the htbuser sqlcmd -S 10.129.247.219 -U htbdbuser||
||but when I try to authenticate at mssqlsvc user with the cracked password it fails ||
||kali@kali:~$ sqlcmd -S 10.129.203.12 -U .\mssqlsvc ||
||Password: ||
||Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Login failed for user '.\mssqlsvc'..||
not sure what to do, I could try from a windows vm, but no idea why it does not work

[blissful elm]

can i dm ?

[dim wolf]

no, i am leaving now

[blissful elm]

k

[split glade]

You can use haiti too to identify hashes, I got the answer with haiti '$S$D34783772bRXEx1aCsvY.bqgaaSu75XmVlKrW9Du8IQlvxHlmzLc'
(Assuming it got it right ;))

https://github.com/noraj/haiti

[blissful elm]

i hope its not D.....7

wao it was format error ,they should have tell that in the question thou

[stiff urchin]

Hello 👋, on the updated information gathering - web edition module i was finished the module then showed up later on there is an update and need to finish the new parts, yet at web archive section it saved my old answers and not related to this section!

And showing it is completed and can go to the next section! (With wrong answers)

[fathom pendant]

this is known

it's an issue that happens when they update modules/questions

[coral forge]

Hi :), I'm doing the knowledge check on the getting started module, and I am having troubles getting a shell manually, I can't seem to upload a php file, and if I try to upload an image it works but then I can't execute it, is it supposed to be "only done" via the pre-made exploit?

[fathom pendant]

there's another manual way, the premade exploit should give you somewhat of a hint as to what it's editing/uploading

if you're unsure: check the versions again

[coral forge]

Mmmm okok, the getSimple version you mean?

[fathom pendant]

nope

iirc the knowledge check has to do with a plugin

unless that's the plugin, it's been a minute

yes; the vhost is hosted on that IP

ip domain in your /etc/hosts

[coral forge]

Mmmmm I kinda ignored those after I saw the upload part 😅 , I'll look into it, tyty

[fathom pendant]

yeah it's related to GetSimple

[vague sage]

those nibbles modules were crazy
are there more like that?

[fathom pendant]

i mean sort of; a lot of the skill assessments are like that, but no hints on what to do

the nibbles sections (Not modules) were just a basic showcase of how you'd pwn a box

[vague sage]

not modules got it

[fathom pendant]

Modules are the overarching names of the learning content; Info Gathering - Web Edition; Getting Started, Introduction to Academy

Sections are the smaller learning segments within a module

what do you mean?

what module are you working on?

[vague sage]

oh got them confused

[fathom pendant]

updated* not new

it just says new because they changed the name, then changed the name back

I guess my main confusion is what do you mean by "main" inlanefreight

Are you asking if they pass through "Inlanefreight.com"?

if so, then no

they don't "pass through" anything

no

you need to do filtering

you should notice a common size between them

the common size is what you want to filter out

because if you actually curl those
curl http://inlanefreight.htb -H "subdomain.inlanefreight.htb" on any of the ones that have the same size you'll notice something

it's being routed through the IP

to further answer your question

also just to be sure for the vhosts it's JUST the ip that goes in your /etc/hosts not the ip:port

and in this case it's http://inlanefreight.htb:port

[vague sage]

oh yeah cracking passwords with hashcat 🗣️ 💯

[outer dagger]

I'm limited with the amount of instances i can make to once a day, I can set up my own Parrot OS enviroment right? And just use that instead?

[shut vapor]

Yes.

[vague sage]

yeah
download their vpn

[fathom pendant]

you can use your own environment forever

[outer dagger]

Perfect, I thought so. I just needed reassurance. Thank you everyone.

[fathom pendant]

Ah, I see they want you to use gobuster for it, i'm not familiar with all of gobuster's filtering options

ffuf works better

[dire abyss]

https://academy.hackthebox.com/module/23/section/251

anyone have issues with this module? im following along the reading material but i swaping es.php for /etc/passwd doesnt display anything

[fathom pendant]

`ffuf -u <url> -H "<Header>: <value>" -w /path/to/wordlist -fs <response size filter>

that's odd; I just ran it and got a consistent size with the incorrect subdomains

the correct subdomains will have varying sizes

also the list i used was the 110000 list

but there's only a handful of correct ones

the correct ones are way less than 300

but the correct ones are indeed between those sizes

ok it after doing testing it looks like gobuster does filter out the unnecessary hosts

it should give around like 5-10 actual positive results

[dusky gyro]

thanks @fathom pendant been stuck on this for awhile now

[fathom pendant]

you never put ports in /etc/hosts

the only : accepted are those for IPv6 addresses

[stiff urchin]

I got there xxx1337 and stopped there! And yes I checked the xxx.txt and got the hidden path but the key i got gives me wrong answer!

[fathom pendant]

huh?

please don't reply to an unrelated comment if i helped you earlier

it's just further confusion

[stiff urchin]

You’re right, i am at the same section with @dusky gyro

[potent thorn]

Anyone else find the Active Directory Module really hard? feel like there are so many methods I've just not understood everything :/

[fathom pendant]

then the same should apply... I got all the new expected answers

[fathom pendant]

if you didn't do the Intro to AD module, then the AD enum and attacks module is throwing a lot at you that it already expected you to understand

[potent thorn]

Thanks, I will. cos man I am struggling with the skill assessments

[fathom pendant]

the skill assessments are literally just follow the steps one at a time

enum; get in; use another tool...

[potent thorn]

im not running on a lot of sleep atm so maybe thats some of my issue

[fathom pendant]

tbh though, your best bet for the first one is elevating your shell to either a reverse shell or using the Web01 host as a pivot point

[potent thorn]

yh im on the second assessment

[fathom pendant]

second one is practically the same as the first, except you start from a linux host instead

it does require a tool/technique that WAS mentioned, but wasn't showcased btw

it has to do with SQL and privileges

potatoes or printing, pick your poison

[potent thorn]

ok thanks

[fathom pendant]

if that's where you may be stuck at

the rest is fairly simple

just start from the top down from the section list LOL

[fossil fossil]

Hi, I'm doing the AD enumeration & attacks skill assessment and I've noticed that PowerView fails to execute when running from a evil-winrm terminal (on the foothold server), any idea why? This is the error. This doesn't happen in the reverse shell btw

Exception calling "FindAll" with "0" argument(s): "The specified domain either does not exist or could not be contacted.
"
At C:\temp\PowerView.ps1:5253 char:20
+             else { $Results = $UserSearcher.FindAll() }
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : COMException

Edit: This is due to double hop kerberos problem, you'd need to create a PSCredential object and pass it to powerview. Check module section "Kerberos 'Double Hop' Problem"

[fathom pendant]

could just be a weird thing with Shit-RM i mean Evil-WinRM

[split glade]

Did you have bad experiences with it?

[daring birch]

where did evil-rm touch u

[wary plover]

I mean if we take it at face value its annoying that u can't use arrow keys natively, always get bugged by the "press y to exit" and when u hit y it still doesn't kill your session, along with other things that make ur blood boil

[daring birch]

alt f4

[outer dagger]

Hello everyone, I'm faced with a problem that I'd like some advice and directions on. A straight answer isn't required.

I want to go down the path of penetration testing / red-teaming. I want to eventually be red-team simulating real-life threats without being caught. Though, when I look at the HackTheBox modules there's so many, I feel it's hard to know where to start from and what to end with.

What would you guys do?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[outer dagger]

Thank you

[fossil fossil]

There is a path named "penetration tester", that's what I'm currently studying

[jaunty linden]

Has anyone completed the updated Information Gathering - Web Edition Module? I’m stuck on finding the api key and finding where it’s supposed to be moved to

[stiff urchin]

I found an a key that didn’t work 🙂
And it shows that I already done with this part because i was finished it a few days ago so i just moved on to the next module:)

[jaunty linden]

Thanks 😂 can u dm me the steps u took to find it? I just need the peace of mind at this point💀 this updated module is driving me crazy

[stiff urchin]

Where are you stuck ?!

[jaunty linden]

Questions 3-5

I tried brute forcing virtual hosts but so far I don’t have any luck.

[stiff urchin]

Tool?

[jaunty linden]

Curl and Ffuf

[stiff urchin]

You can get it done with gobuster/ffuf and it depends on the wordlsit for sure
Use filters with ffuf.

[jaunty linden]

Okay I see, thanks! Here’s my current syntax Ffuf --w /home/kali/Downloads/virtual-host-wordlist.txt -u http://94.237.63.201:38585 -H "HOST: FUZZ.inlanefreight.htb -fs 120

I filtered out size 120 because all of those results weren’t reliable

[stiff urchin]

Add -mc all
Add the ip and the domain + sub domains to /etc/hosts
Wordlist seclists-dns-11000

[jaunty linden]

Okay, I’ll try it now, thanks again

[little drum]

Hello everyone, could someone help me with the server side attacks module in the blind ssrf part since according to what I should upload a joint file but it really appears a message "bad application"

That's all the source code

<html>
<!-- ubuntu-web.lalaguna.local & internal.app.local load resources via q parameter -->
<body>
<h1>Bad App</h1>
<a>Hello World!</a>
</body>
</html>

[fathom pendant]

That's not needed

Adding the ip to /etc/hosts is. But leaving -mc alone

-mc matches the status code, which will be 200

But default is fine

[fathom mango]

Does anyone have answer to question from Updated Fingerprinting Web
What is the API key the inlanefreight.htb developers will be changing too?

[fathom pendant]

Well if you have to bruteforce you try all found subdomains

It doesn't need to be directly stated

It all starts with a "can I?"

You can bruteforce any subdomain you find, as those would be in-scope

[dim wolf]

i don't understand how that's a cheap trick

[elder matrix]

well... its stated we could brute force inlanefreight.htb that should be enough right? nope. you have to do something not shown at all..

it caught me off guard, made me ask myself how on earth i would have come up with this?

[dim wolf]

you need outside-the-box thinking

[elder matrix]

well... its noted in bold characters now

in my notes forever

[dim wolf]

if you can brute force inlanefreight.htb, what's stopping you from brute forcing one of its subdomains

there's always more to enumerate

[elder matrix]

in my head its because theres a gap between my instance and the subdomains

[jaunty linden]

I found the vhost needed, and the secret admin directory (or where it used to be)… still no api key lol. Am I missing some steps?

[elder matrix]

im just gonna read more about it tomo... can't leave anything behind.. if dns is in the module, its on the exam...

[dim wolf]

just remember you can't expect everything that they show you to lead you to the solution

some creative thinking is necessary, in the path and in real life

[modest remnant]

did you do the vhosts exercise yet?

[elder matrix]

im only on the footprinting module

[modest remnant]

ok

I'm trying to figure out why when I use the target socket with gobuster as recommended, I don't get the vhost enumeration I need. But when I use the vhost domain they provide, it does work.

[jaunty linden]

Anyone else make it to here yet?

[fathom pendant]

explain: provide your command that isn't working, they provide a domain because that's what's required to get the answer

gobuster doesn't magically know what the domain of the vhost you're looking for

without using the domain it's just being pointed at an IP and told to just spam (single word) wordlist at it

http://a http://b http://c.....

with the domain it's actually doing http://a.domain http://b.domain ...

[modest remnant]

That's what I'm trying to resolve in my head. Even gobuster's doc says 'you probably want to use the IP here'.

[fathom pendant]

it depends

since it's a docker instance, public nameservers don't know what .htb is

.htb isn't even a valid tld for all intents and purposes

so even trying to route it doesn't know

but what's "recommended" isn't generally the "do this all the time"

in vhost mode you need a domain for the wordlist to attach to

[modest remnant]

Thinking through it, my first step was adding the vhost and IP to hosts, and using the domain with gobuster. That got what I needed. Then I tried with the IP like the module and help both recommend and, not surprisingly, it didn't work and I was just left wondering so I've been experimenting with different options.

[fathom pendant]

otherwise it's just spamming words without a domain

and it will give errors

[modest remnant]

right. haha

[fathom pendant]

the alternative is using FFUF with the -H "HOST: FUZZ.inlanefreight.htb"

[modest remnant]

so why in gobuster vhost mode would you ever use the IP instead of a domain?

[fathom pendant]

it depends

if it's a publicly routable ip that maps to a domain, it'll do just fine

because DNS knows what it's looking at

[modest remnant]

I tried FFUF but just had "Host: FUZZ", thanks for that clarification

[fathom pendant]

and what it's querying

[vale salmon]

Hi! I'm working on Modern Web Exploitation Techniques -> Second-Order LFI and for the question, I have attempted several different pathnames, including root, admin, and tmp, with ../../, but am still not able to grab the flag. I'm wondering if I'm just missing something about the username, or the pathing?

[fathom pendant]

the host header is allways gonna be the subdomain.domain.tld

the important bit here is also using the port

otherwise http:// defaults to port 80

[modest remnant]

yeah, realized that too

[fathom pendant]

and since the websites aren't on port 80...

[modest remnant]

thanks, @fathom pendant

[fathom pendant]

base point is: if you're explicitly given a vhost to use, use it

don't worry about what's "recommended" because then you end up driving yourself crazy trying to get something to work that might never work

[modest remnant]

so true. this isn't the first time. haha

[fathom pendant]

there's nothing that makes it inherently more special

it's just a thing that can be done

I also suggest refrain from actually dropping the subdomains, as it'll spoil it for others

the point is you don't know what can be bruteforced or not, and it just so happens that the one that works can be

it's not some magic formula that you can use to figure out why it works

[elder matrix]

i was looking for a cue or a sign.. there are none. which makes it more interesting! thanks!

[fathom pendant]

what I did when just goofing about was 2 stages: create a subdomain list from the initial zone transfer dig axfr inlanefreight.htb @ip then do a for loop to go through each subdomain until it hit

¯_(ツ)_/¯

[junior flicker]

I've been working through the Footprinting Medium Lab and have hit a wall. I've enumerated NFS, SMB, WinRM, & RDP and the common denominator seems to be I need a login to access either the computer via RDP or the TechSupport share. I know the hint talks about MSSQL, but the port is closed on the target, so not sure how to use that information. The hint also speaks of the local administrator account, so I tried logging in using that with some common weak passwords to no avail. Any ideas I'm not seeing?

[fathom pendant]

the share is the first step

MSSQL comes after; as it's running locally

and no you don't need a login to access the share

[dusky gyro]

hey @fathom pendant , im not sure why the domain I got isn't working for creepy crawlies in web edition from the comments

[fathom pendant]

I haven't done that section

planning on tackling that over the weekend as I redo the module to revamp my notes, since sections and answers got changed so to will my notes so I can at least be accurate with them

[dusky gyro]

okie dokie, will keep workin at it

[fathom pendant]

all of these are new additions to the module

literally went from 100% to 50% that's how much they added

[junior flicker]

Really? Whenever I mount the share, I get access denied to get into the TechSupport folder

[ocean night]

How do you feel about additions to modules like that marcie?

[fathom pendant]

switch to root, it's like the only time you'll have to use root to browse

[junior flicker]

Noted, I'll give that a try, thank you

[fathom pendant]

As frustrating to others as it can seem, this is definitely one of the modules i felt was lacking information, and even the Virtual Hosts section revamped I feel (at least just looking at the diagram) it explains how vHosts work instead of just "here's a definition, and basics of how it works." And I can also get some other people's frustrations as when they added the Thick Clients section to Common Apps, it was pretty much a universal negative response. I enjoy that it's expanding on concepts, and introduces a section dedicated to just explaining DNS since previously it was weakly explained, or at the very least needed a LOT of clarification from others to get why the tool works

TL;DR - Change Good

[cloud urchin]

@ocean night one thing lacking with the modules is the ability to reset them. my guess is we can't because once you complete the module it's unlocked forever and resetting it may reset that flag too? it would be nice and many people mention it. especially for those modules that get reworked.

[rustic sage]

help

[ocean night]

Worth chucking in to /feedback 😉

[rustic sage]

I cant find the flag and i filtered all the files for flag

[fathom pendant]

to add on, if a module section is changed with answers changed it definitely needs to be wiped

[ocean night]

If I were a user, I'd want a soft reset, as it were

Retain completion, but have the ability to run through again

[dusky gyro]

@ocean night can u confirm the answer for the creepy crawly Q is correct? the hint helps find it but... not sure if i should be hitting that with anything

[fathom pendant]

I wonder if it has some backend meta-data to section number 🤔

[ocean night]

I cannot help with answers, sorry

[dusky gyro]

not with answer, just want to know its in-scope

[ocean night]

I cannot advise on content

[dusky gyro]

kk

[rustic sage]

guys help im doing using web proxies > repeatiung requests

when i filter all of the files

[fathom pendant]

the scope of the question is just to find the subdomain

[rustic sage]

for flag only one appears, and there is supposed to be a second

am i an idiot or is something wrong

[fathom pendant]

inlanefreight.com is a real (fictional) website hosted by HTB

it's used in a fair bit of the academy engagements when a live target needs to exist

[dusky gyro]

its referencing aws s3 bucket

[fathom pendant]

this section? https://academy.hackthebox.com/module/144/section/3079

[dusky gyro]

yup

[fathom pendant]

Don't see anything regarding anything crazy; the hint is regarding an html comment

like <!-- Work in progress -->

or <!-- future content will be moved to subdomain.site.com -->

[dusky gyro]

yup but the TO-DO: part I can scan and nmap and stuff?

[fathom pendant]

well the idea is to crawl it

not scan it with nmap

it's a website

it's a "live" website

you can browse to www.inlanefreight.com at your leisure and check it out if you want a silly laugh

[dusky gyro]

this is after the crawl, the future reports in To-Do

[fathom pendant]

well then look for other pages that you may find it in

either that or the live site hasn't been updated for the new content

[dusky gyro]

it gives a url but its for a s3.amazona

[fathom pendant]

¯_(ツ)_/¯

[fathom pendant]

did you try inputting that as the answer?

if that's the answer, then that's the answer

[dusky gyro]

yup tried the various ones

[fathom pendant]

well i plan on tackling this over the weekend, if you still need help ¯_(ツ)_/¯

otherwise though I'd reach out to support to confirm it's not an issue with the live site missing something

I also suggest using the showcased tool, reconspider

[dusky gyro]

yup thats what i used

[fathom pendant]

then idk ¯_(ツ)_/¯

[rustic sage]

Doing using web proxies > Repeating requests
I filtered all of the files for flag and only the origional one appeared, while there is supposed to be a second

Am i doing this wrong; is it hidden elsewhere?

[fathom pendant]

brother... read the comment carefully, maybe make your terminal screen larger

check what's before the s3 part 😉

[dusky gyro]

time to uninstall

[fathom pendant]

did you check the filesystem root?

another way to potentially find it would be injecting find+/+-name+flag.txt+2>+/dev/null

[dusky gyro]

was actually the size cutting off .htb perfectly but still pinging and dig nslookups still worked without it

givenin me an ip and all

[fathom pendant]

tends to be the case but as soon as I saw it cutting off i was like "oof... can't read... neither can I"

[dusky gyro]

you the best

[fathom pendant]

np; got my curiosity peaked enough to run the silly little tool

and added it to my list of basic web recon tools

[rustic sage]

whats that

(im kinda new if you couldnt tell))

also is there a reason why tree doesnt work

[fathom pendant]

tree isn't a linux command afaik

oh wait

tree just checks the current directory

it doesn't go backwards

[fathom pendant]

do linux fundamentals

filesystem root is the base of the filesystem, the beginning of all filepaths

like how C:/ is for windows / is for linux

any directories and files you add to the system are added after

[rustic sage]

i did that one a while ago but i forgot most of it

[fathom pendant]

ls -la is the better command in linux

[rustic sage]

ty though, im doing it rn

[fathom pendant]

then you should have taken notes

[rustic sage]

yeah

[fathom pendant]

¯_(ツ)_/¯

there's no shame in taking notes, even on the basics

[rustic sage]

ㅡㅇuㅇㅡ

[fathom pendant]

in fact it's how I "know" so much, just a lot of notes

[rustic sage]

thanks for the advice

[fathom pendant]

and almighty google ¯_(ツ)_/¯

if you're unsure -- google

[rustic sage]

will do

[fathom pendant]

but tbh before hacking you should know basics of filesystems

for instance with linux you need to know:
what ~ is, what / is, what /root/ is, what /tmp/ is and how to see/find hidden files

[rustic sage]

thank you

[fathom pendant]

if you want to be somewhat more familiar with linux navigation commands, there's a terminal/text based 'game' called bashcrawl

it teaches you the basics of bash and filesystem navigation

[rustic sage]

thanks!

[fathom pendant]

doesn't sound like an academy module

if it's a box; #boxes , if it's a challenge; #challenges, if it's a starting-point machine #starting-point

[rustic sage]

all i see is no access

[fathom pendant]

you need to read and follow #welcome to access more of the server

[balmy shuttle]

you right

[rustic sage]

i forgot my password and it wont send a password change link so i camt verify

im waiting for the support email i sent to respond

[ocean night]

Which platform (URL) did you try to reset your password for?

[rustic sage]

https://account.hackthebox.com/password/forgot

is this what youa re looking for?

[ocean night]

Have you signed in to that before?

Anyway.. support will come back to you in the morning 🙂 They'll get you sorted

[fathom pendant]

just drag mick out of bed to help him /s

[ocean night]

🙈

Oh.. right.. it's Saturday

You may have a delay in response then fork. But yeah.. have you ever signed in to account.hackthebox before?

It's separate to your academy account

..but you can link your academy (and other HTB service) accounts to it - it's our SSO service

[fathom pendant]

@grand loom tbqh; if you're doing the web proxy module with zap and identifying a vulnerability with the spider, it's a high level vuln, i think it took around 15 minutes or so to get to it

so it definitely takes time

a lot of the requests stuff through burp/zap will just take time as they're checking a LOT of things

but I can confirm the vuln they're looking for is a high severity one

[grand loom]

i see i see do u have like a small list u try for each type of injections until u figure it out?

[fathom pendant]

idk what module you're working on so I can't give much, i'm just going off vague context

in order for people to be able to help you, you need to provide context

module name
section name
social security number
what you're stuck on, what you've tried

[grand loom]

the question is vague about how could i figure out a vulnerability with a list of them existing for a form

not for any mod or box

[fathom pendant]

ah then I misunderstood

you'd just run automated tools like zap or sqlmap

there's no magic wand or list that will find everything, just the most common ones ¯_(ツ)_/¯

[grand loom]

oh so i try the most commons one in order and btw u run all of them automated to "find" the vulnerability?

cause i know some people just do

[ocean night]

Google sqli polyglots 😉 Some have put together strings that try to cover most injection techniques in one or few strings

[grand loom]

', ' admin -- -, admin' --

if this dont work they go on to the next one for injections

[fathom pendant]

' admin or 1 == 1 --

either way it sounds like you're trying to overcomplicate it

while yes there's "thousands" of different strings you can do to exploit a vulnerability, you want to first even test if it exists

[grand loom]

yes i think so too

[fathom pendant]

of which there's a significant fewer amount

of which you can google, and the HTB modules have plenty of test examples

basic logic stuff that generally work

[quasi wave]

hi information gathering web edition added additional material. I'm thinking of completing that before trying file transfers again as its necessary to complete the path. I feel like it would give my brain a break to work on other material because I'm having trouble getting my focus up for file transfers you know? Since they literally just added ten sections to the Information Gathering Module, wouldn't this be a smarter idea? I'm coming from a perspective of wanting to not waste time staring at a screen because of some recent events that have gone on.

I think from a learning idea this would be smarter when getting back on track with HTB Academy and then I could go from there.

especially since I can't complete the CPTS path until the current, whole thing is completed at once.

not at once sorry

until there's nothing left I haven't already done in path

[indigo shuttle]

Can someone help me with XPath - Blind Exploitation challenge

[solar zodiac]

can anyone advise on the skills assessment for broken authentication? I'm having some trouble with the 2fa

[normal sand]

Module: AD Enumeration & Attacks
Section: Kerberoasting - from Windows

Under the semi-manual method, it states the following:

We will focus on user accounts and ignore the computer accounts returned by the tool.
Why do they choose to ignore the computer accounts that have SPNs?

[stiff urchin]

The redirect will back to plank page, make sure the port number with the URL all the way.

[spice flint]

[flat parrot]

looking for initial foothold for hard lab of password crack module

[haughty tree]

So it seems like the questions in the skill assessment of the Information Gathering - Web Edition were changed but since I've solved the older questions, it marks those questions as solved with my older answers

[next bronze]

machine accounts passwords are not set manually and it's 120 characters on rotation, and they will usually always have SPNs set for their services, so if you don't filter out machine accounts, you'll just get back a bunch of junk when kerberoasting

[idle sigil]

Hey, so Im doing Password Attacks Lab - Hard. Ive been trying to download the file from David's smb share but I keep getting 'NT_STATUS_IO_TIMEOUT' message 😦 What should I do?

[normal sand]

How do I filter out the computer accounts? Also, aren't the 120 characters on rotation only when LAPS is activated?

[bright coral]

increase the timeout? 😛

[next bronze]

nope LAPS is a separate mechanism, that only takes care of the local admin account

all the tools that does kerberoasting will filter those out by default, you don't need to manually do it

[idle sigil]

i've added '-t120' to my command but it is still giving me the same error msg (NT_STATUS_IO_TIMEOUT) 😦

[normal sand]

Ah okay. Understood. I forgot that LAPS was local accounts only. I looked up the documentation for setspn.exe but didn't see any flag to filter. I'm guessing since it's a native Windows binary, there isn't a way to filter out computer accounts? So, I'll just have to use one of the other tools mentioned in the module to filter?

[next bronze]

you can use objectCategory=person in powershell

but just use the tools

[cosmic tartan]

Hi all,
Is this the right place to ask about an error regarding the funnel box in starting point?

[bright coral]

well then you might try another client, reset the target or try via pwnbox

[bright coral]

#starting-point

[cosmic tartan]

Its redirecting me here for some reason. Thanks tho for replying I'll figure it out

[bright coral]

read #rules and #welcome (including the verification part ;))

[cosmic tartan]

Makes sense thanks man really appreciate it

[brisk leaf]

I want to install Kali Nethunter on my Redmi 9T phone without rooting it. Can anyone guide me on how to do this?

[normal sand]

Alrighty. I'll use the tools, but just for knowledge. Could you please provide an example of the command using objectCategory=person?

[acoustic owl]

You are in the wrong channel. It's best to ask in #homelab-sysadm
If you have no access, read and follow #welcome
This channel is about the HTB Academy modules

[next bronze]

https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1
https://github.com/fortra/impacket/blob/master/examples/GetUserSPNs.py

[haughty tree]

Has anybody done the finished skill assessment on the updated Information Gathering - Web Edition?

[faint rampart]

Its literally impossible to crack a machine account password, so its a waste of time requesting a ST if a machine account has an SPN attached

Out of curiousity, is it possible to request a ST with GetUserSPNs with a nopreauth user just like its possible with Rubeus

I tried to, but it fails
I was hoping the next section in the "Kerberos Attacks" module for kerberoasting from linux would show that but it didnt, but there's an option for -no-preauth

[next bronze]

this? https://www.semperis.com/blog/new-attack-paths-as-requested-sts/

[faint rampart]

Yess, I followed this
It would be really cool if it's possible from linux, imagining an attack chain where you found an asreproastable user but they have a complex password, so instead of cracking you could request for a TGS ticket for a service account that could be cracked using the no preauth user (or I'm trippin lol)

[wraith pelican]

i'm poking at it but i can't figure it out, it seems like there is nothing to crawl.

[haughty tree]

Same lol

[robust quartz]

The new skill assessment in information gathering - web edition is little bit harder 😂

like "Is what I'm doing right or not? Because the results aren't coming out." but in the end you will realize that 🤣

[next bronze]

does't it work here

[wraith pelican]

yeah it is really frustrating as i thought: ok i'll go for it a in hour or two just to update my notes and now i'm troubleshooting stuff

[covert vortex]

__Windows Privilege Escalation : SeImpersonate and SeAssignPrimaryToken __ no output when using impacket mssqlclient cmdshell, can someone help ?

[faint rampart]

oh no it didnt, thats a list of tgs tickets with the export-csv function I transferred over. Included to show I used the correct SPN

if you try others and it doesnt work, just use BadPotato lol

[next bronze]

I think I've got it to work before but it's been a while

but that edge is so specific you would probably never see it irl

[faint rampart]

hmph, okay okay

thanks!

[next bronze]

imagine not using godpotato

[faint rampart]

Its GodPotato I wanted to type actually 🤣

theres so many potatoes 💀

[next bronze]

time to write another one

[faint rampart]

I typically just use PrintSpoofer or Godpotato, too impatient to play around with CSLIDs

[faint rampart]

Do blog about it when its done

[next bronze]

I'm saying you should do it

[wraith pelican]

I just tested right now, it works for me. Maybe restart the box?

[normal sand]

objectCategory=person is to be used as part of an LDAP filter, right? With dsquery?

[normal sand]

Oh, it's meant to be used with this (GetUserSPNs.py). My bad. But it can be done with dsquery and an LDAP filter too, right?

[next bronze]

what does dnsquery got to do with this?

[muted kindle]

im pretty sure u will not see any output from this unless the command resulted in errors

[blissful elm]

hashcat -a 3 -m 0 md5_mask_example_hash -1 01 'ILFREIGHT?l?l?l?l?l20?1?d' in the module hashcat and mask i can't understand the use of -1 and 01 can someone explain it , i have read from other source still getting confused

[next bronze]

it's explained in the module, what do you not get?

[normal sand]

Nah, I just recalled that when using LDAP filters with dsquery, there's a parameter objectCategory=person as well. So I was just wondering if that could be used to query for service accounts with SPN set.

[next bronze]

probably but again using tools to kerbroast from linux is much better since you don't have to worry about extracting the tickets from LSASS

[normal sand]

Noted on the tools. LSASS? Are you talking about having to extract the ticket from memory using Mimikatz?

[next bronze]

yeah but that depends on which mimi commands you run

[midnight galleon]

how do i know which prefix/suffix to use in sqlmap?

do i just increase the level and make the server cry for its life?

[timber quail]

someone, tell me

I am wondering if I should start HTB Academy. Is this a good service?

I am studying for my OSCP.

[shut vapor]

I landed here because I was interested in obtaining the OSCP but many people suggested HTB CPTS was more difficult and, so, basically prepped you for the OSCP. Since I don't have hands on with OSCP material I can't say for sure, but the material is good so far and the price is right compared to the OSCP.

i'm about 20% through

[sullen talon]

HTB is one of the best places to learn ever, cost every spent penny

[rustic sage]

Technically yeah lol

Well you could also refine your payload with specific prefix and suffix options, adjust other SQLmap options like --risk, and manually analyze application responses for clues on injection points and techniques....

[midnight galleon]

yeah i am exactly asking on how to i know which boundary to use. in the sqlmap module they just hint you to use this a prefix and they don't explain where did they bring that prefix from

[shut vapor]

haha, deleted my question if anyone saw it. I'm a doofus.

[vivid frigate]

[shut vapor]

Microsoft stuff makes me irrationally angry sometimes

[old oasis]

it all depends on what you value more, HR Clout or Knowledge.

[shut vapor]

that was my conclusion as well, and I don't expect I'll land a readteam job but HTB stuff makes me better almost anything else IT related. I figure if I get the redteam opportunity and need the OSCP I'll let them pay for it.

[shut vapor]

for real though, if anyone read some primer-tutorial on PowerShell that made them go "Ahhh! It all makes sense now!" please link me. I can not understand why Microsoft designed PS almost with an intention of making it impossible to comprehend any pattern to their command structure.

[old oasis]

Have you tried this? https://www.youtube.com/watch?v=UVUd9_k9C6A&t=1s

[shut vapor]

No, but I will now. Thank you for the link!

[old oasis]

The guy who made powershell is in it. I found it very easy to follow. Good luck 🙂

[vague sage]

fuck

man

[midnight galleon]

how do i force logrotate to rotate as non root user?

linux priv esc module

i don't have write permission on /var/lib/logrotate.status

and ofc can't just logrotate -f

maybe i should wait a full day?

[rustic sage]

help i cannot find my account identifier but i cant message in any channels but this one

[acoustic owl]

Read and follow #welcome

[fathom pendant]

It's on https://app.hackthebox.com

Academy doesn't have an identifier

[midnight galleon]

any help would be great

[acoustic owl]

Have a look in your user directory 😉

[lone pendant]

I am doing the Info Gathering web edition, on Skills Assessment task 3, I can not seem to find the the admin hidden directory, I have used gobuster with the medium-2.3 list (from SecList). I also used Zap. Still nothing is coming up. Any hints. I also burtofroced for any subdirectories, still nothing comes up. The only thing that I see is this.

[midnight galleon]

i know the log i need to rotate

how do i rotate it?

fill it with junk?

[midnight galleon]

you have an ip address, not a domain
there is a section that discuss bruteforcing that

[acoustic owl]

you have to find out when the file is rotated. So write something in and see what happens.

[quasi wave]

hi is is worth it to go back and finish updated information gathering path?

before doing file transfers?

I thought I had finished info gathering but they added a bunch of sections

[wary tendon]

good day everyone is someone available to tell me what im doing wrong on this module its the citrix breakout one and for some reason i cant import bypass-UAC.ps1. even after seting the execution policy

[fathom pendant]

Yes

[wary tendon]

can i send you a video call

[fathom pendant]

https://tenor.com/view/im-sorry-do-i-know-you-christina-applegate-jen-harding-dead-to-me-gif-17811424

My reply wasn't to you

[wary tendon]

oh you didnt respond to me my bad

[fathom pendant]

I also don't do private calls

[wary tendon]

well actually its a screen share

would you be willing to assist?

[midnight galleon]

ok got shell but it dropped instantly

[quasi wave]

would you say if I'm having trouble doing file transfers I can go back and finish those updates then try file transfers again? I'm confident my issue is my focus and not something related to being able to understand file transfers.

so maybe will give my brain a break from reading same thing again

[fathom pendant]

File transfers is independent of those skills

[acoustic owl]

Try another way to read the file than getting a shell...

[quasi wave]

right exactly so its different skills

[fathom pendant]

Same answer: no

[quasi wave]

so could give my brain a break from file transfers skills for a while before trying again

what do you think?

[fathom pendant]

If you can't explain what's going wrong, then you're not gonna get much help

[fathom pendant]

That's up to you dude

[quasi wave]

ok

[wary tendon]

well its alot to type and i figured it would be easier to see it

[fathom pendant]

Copy/pasting the error is also effective

And if you want to post screenshots, instructions to verify are in #welcome

But I don't do dms for a reason

[fathom pendant]

Path not found, you're inserting a .\ for some reason

[wary tendon]

even after Set-ExecutionPolicy Bypass -Scope Process

[fathom pendant]

You only need .\ if you're calling it from the current directory without the full filepath

That's part of your issue

[wary tendon]

its in a different directory and i cant copy it to system 32

i get denied

[fathom pendant]

Top of your screenshot "path not found"

So whatever you were trying to run before wasn't run properly

Reading comprehension is the first step in fixing errors

[fathom pendant]

Look in your filepath you're trying to import from as well

[wary tendon]

tells me the execution of scripts is diabled

i got the right path

[fathom pendant]

My point was you did c:/path/to/.\file.ps1

When that just... isn't correct

[wary tendon]

what would be the correct way

[fathom pendant]

Without the .\

[fathom pendant]

But also it looks like you didn't actually disable the execution bypass

[lone pendant]

what should I bruteforce, am I looking for a subdomain or a domain reverese lookup

[wary tendon]

Set-ExecutionPolicy Bypass -Scope Process

yea im not sure why its not working

[midnight galleon]

this section couldn't be more annoying

at the end i just cpped the flag

[fathom pendant]

Shouldn't it be -ExecutionPolicy Unrestricted?

As part of the command

Bypass isn't a keyword afaik

Nvm it is

[next bronze]

specify the scope, it's taught in the module

[lone pendant]

can someone help with this, I still do not know what to do

[rustic sage]

i cant ssh off my vm

and i have the vpn on for the module 😦

'port 22: no route to host'

and when i ping it dont work

maybe i should use the htb vm not parrot for security

im talking to my self i swear im losing it

[fathom pendant]

Are you running the vpn?

no route to host
Means that it has no route to the 10.129 ip

[rustic sage]

yeah i ran the commands

it connected me to ton1 or something like that

[fathom pendant]

tun1 and it sounds like you have multiple running

As it should be tun0 (if that's your only vpn running)

ps aux | grep openvpn

sudo killall openvpn then rerun the connection command

[rustic sage]

holy god

i had a few

ok ty

[fathom pendant]

Nah the command itself runs like 3 processes each time afaik

[rustic sage]

oh i see

there was still two different ones tho ty

also im taking notes now 🫡 🀄

[fathom pendant]

You don't need to run the vpn for every target, just once per learning session you are doing

[rustic sage]

yeah

but fo like different modules and stuff i do, correct?

[fathom pendant]

No

All modules will use the same vpn config

[rustic sage]

oh ok

[fathom pendant]

*if it's needed

[rustic sage]

alr tysm

ok it worked your actually my favorite person marcielee

i nominate you for htb discord user of the year

[vestal wing]

try some of the other techniques covered in the module, not everything can be solved with bruteforcing 🙂

[inner geyser]

Have a question on Web Attacks --> Chaining IDOR Vulnerabilities.

I was able to get the flag, and hopefully this isn't really a spoiler, but wondering what causes the 'Edit Profile' page to populate with information that allows us to make changes to it. In the previous section, IDOR in Insecure APIs, the info is already pre-populated, and is referenced at the beginning (and really throughout) the Chaining IDOR Vulnerabilities section as if we should just be able to go in there and edit/update the profile but that's not the case. Once you do the initial legwork that will allow you to change the admin's email, that edit profile page populates with info...but I don't really understand the trigger that makes that happen

[smoky gyro]

hi guys, what is the matter with Footprinting Lab - Easy ? any hints ?

[fringe urchin]

where are you stuck?

[smoky gyro]

got the key and give it the premisson and still can't login

[fringe urchin]

did you use the correct username or the key?

let me go check my notes to be sure tho. i dont quite remember details

[smoky gyro]

it is on the ||ceil ||directory, and i used ||ceil ||as the user name on ssh with -i key that i got from ftp

[fringe urchin]

give me 2 minutes im walking to my PC to look at my notes

[smoky gyro]

i removed ||authorized_keys|| too from ftp and put my own one key.pub

[lone pendant]

nth is working, I think that I must be doing somthing wrong

[fringe urchin]

sorry took longer then expected. had to find it in my old notes:
well did you download the ssh key from the authorized folder?

[smoky gyro]

yup

[fringe urchin]

well then ssh ceil@IP -i <Name> should work

[smoky gyro]

not working

[fringe urchin]

md5sum both files and see if numbers match

if not you copied something too much or too little

[smoky gyro]

can i do md5sum in ftp ?

[fringe urchin]

yea

[viral lotus]

not to butt in but are the permissions on the key right?

[smoky gyro]

chmod 600 key, that's what i made

[fringe urchin]

from this message i assume so

[viral lotus]

just wanted to double check

[smoky gyro]

what command ?

[fringe urchin]

[fringe urchin]

go into your authorization_key directory

and type
md5sum filename
this will give you some numbers

and you do the same for the file you trying to log in with on your host (they pub key from ceil)

example (did on my ovpn file)
but that shows if the 2 files are same

or you copied something wrong

@smoky gyro you can aswell send me the screenshot of the auuthorized key since i have is saved and how you trying to login

[silent dome]

Need a nudge for fingerprinting web API KEY ?

[ocean night]

Are you offering a nudge, or asking?

[silent dome]

asking

[ocean night]

Right, I misunderstood your previous messages then. Sounded like you were offering nudges, my bad.

Didn't make much sense to me, someone offering nudges

[silent dome]

oh i was wondering my messages are getting deleted sorry for mis understanding . I will be clear from next time

[ocean night]

Like, the question mark makes it sound like you are asking if anyone needs a nudge

[silent dome]

😅

[ocean night]

🙂

[tender vine]

Is anyone doing the updated INFORMATION GATHERING - WEB EDITION? Have you gotten ReconSpider to work? It needs API keys, but I can't sign up with ipstack without a credit card, so I'm not sure how to move forward

[fathom pendant]

I downloaded and used the one from the wget command. Didn't require an api key, just installing scrapy

I take it you're on the question "where will future reports go?"

[tender vine]

Thanks! I finally got it. I just executed the commands on the parrot pwnbox and it worked. I originally was working on my local Kali machine but couldn't figure out why it wasn't working.

[fathom pendant]

I didn't try in my own vm so I'll have to double check, if it actually requires a paid API key, ooof. ¯_(ツ)_/¯

[tender vine]

Yeah, I was pulling my hair out for 2 hours and I couldn't figure it out. So you pointed me in the right direction. Lol

[fathom pendant]

We're referring to a different section; the creepy crawlies section

[silk anchor]

Finally finished password attacks, that hard lab is wild

[vale salmon]

I'm working on the Modern Web Exploitation -> WebSocket Analysis in Burp module and I am not really understanding how it wants me to modify the info to grab the flag. The directions aren't super clear.

[next bronze]

read the source code included

[rustic sage]

i cant find mail and if done find tree and averything

(linux fundamentsls - Where is the htb-student's mail (path))

[next bronze]

include the section name next time. it's not a file, try the list of commands given at the start of the section

[vale salmon]

I checked the code and see /what/ will get me the flag. I think where I am confused is how to properly modify the websocket traffic to get it to give it to me. I tried changing /echo to /admin, but that doesn't seem to do it.

[next bronze]

you'll need to include a parameter

[vale salmon]

OMG. It was literally in front of my face the whole time. Thanks.

[fathom pendant]

Environment variables are useful

[rustic sage]

thats all the stuff that appears when you use --help right

[fathom pendant]

No

[rustic sage]

uh oh

[fathom pendant]

--help just tells you what flags (options) a command accepts

The module gives you a list of commands and a brief description

note environment variables are always caps

[rustic sage]

noted

[fathom pendant]

Like echo $HOME will get you the home environment variable, while echo $home will not

[rustic sage]

marcielee you are my saving grace

you still remain my favcorite person in the server

[fathom pendant]

https://tenor.com/view/calm-down-chill-martin-freeman-interview-breathe-gif-5362498

[rustic sage]

I cant embed but pertend i am

[fathom pendant]

Yes you can

[rustic sage]

i can?

[fathom pendant]

You can embed here

[rustic sage]

https://tenor.com/view/ryan-gosling-gif-16676209875535545747

NO WAYY

They dont teach you that in #general

[fathom pendant]

In #general it's locked behind rank

(Or being cool)

[rustic sage]

Aw so im not cool or ranked enough

[fathom pendant]

Hacker rank is minimum for embed

[rustic sage]

so i have to become less of an idiot first

[fathom pendant]

Rank in labs isn't tied to academy progress

[rustic sage]

is it like a message system

[fathom pendant]

No

Its tied to the labs site

[rustic sage]

oh the machine

is it like the noob>kiddie progression thing

[fathom pendant]

https://help.hackthebox.com/en/articles/5185158-introduction-to-hack-the-box

There's a popular frustration point

[rustic sage]

i gatchu now i see

[tepid crag]

@fathom pendantthanks btw. I thought I was connected but turns out I misclicked or sth and the vpn file had never been downloaded so I used the starter point's one instead of the academy's one. When I connected to the right one, the ping worked just fine. ty for pointing out it wasn't normal taking that much time

It seemed weird anyway that's why i asked for the time taking to do a simple task

[rustic sage]

[vast geyser]

Could anyone give me some hint of intro to deserialization attacks Skills assessment 2?
How to use secret key to change the cookie?

[timber quail]

Thank you so much!! I have never heard of HTB CPTS before, I will try HTB Academy for HTB CPTS before OSCP.

[timber quail]

Thank you! I agree with you. I am working on the lab and learning a lot. i will start and look at HTB Academy!

[vestal wing]

You whatnow? I have no idea what ipstack is or what is has to do with the spider lol

the hell did you download O.o the spider is just a simple scrapy python script I threw together to collect bits of info

did you copy the scrapy install commands? wondering if someone is typosquatting on pip

[rustic sage]

I used pip3 install scrapy, extracted the ReconSpider ZIP, ran it and was all g

[vestal wing]

I'm concerned because someone mentioned something about rate limits earlier to me, which I was pretty confused about lol

[rustic sage]

I didn't see anything related to what others have said about ReconSpider at all

I got my answer in results.json

[vestal wing]

yup thats what should happen

[rustic sage]

🤔

[vestal wing]

guess I need to pull a kali image and check

[rustic sage]

FWIW i did it through pwnbox this time, usually I'm doing tasks from my own kaliVM

[tender vine]

Ok, I got what I did wrong... I was trying to run "python3 ReconSpider.py http://inlanefreight.com" as sudo because it was in my /opt. So it was throwing all sorts of weird errors. So I tried to download reconspider from github (https://github.com/bhavsec/reconspider). That's the one that was asking for APIs.

I tried to do the commands in the module just now as a regular user, and saved everything in my home directory and it was all good.

[rustic sage]

The one I'm having an issue with is finding the API key the team is moving too, the last question of the skills assessment. I tried a few things and couldnt find anything around that

[rustic sage]

Yep, it's against the .htb domain

[vestal wing]

Ohhh yeah no, the reconspider.py in the module isn't anything you will find online, its just something I threw together for the module

[rustic sage]

You Pythonic beast you

[vestal wing]

(tho it will work pretty generally outside the module too so keep it handy lol)

Was starting to get very concerned for a minute, because 2 people talking about similar issues means there is smoke, and where there is smoke there is a fire 😛

[vestal wing]

spider should help you find it 🙂

[rustic sage]

ill rerun it again, but maybe my approach wasnt the correct method

It was likely in front of me at some point and I wasn't looking for it at the time

[vestal wing]

it was 😛 there aren't any "gotchas" in the "easy" modules

especially if you answered the 3rd question

[dusky gyro]

im stuck on 3rd 4th 5th, not sure if my enviroment is messed up or what