modules

[leaden yew]

boo

[fathom pendant]

maybe reaching out to support

[acoustic owl]

As far as I know, there is currently no solution to the problem

[fathom pendant]

or submitting to /feedback

[leaden yew]

cool will do, thanks

[torn steppe]

I am currently doing NTLM relay attacks does anyone know if it is possible to recreate the attacks throught a pivot host? (executing responder and ntlmrelayx.py)

[crude mist]

Hi everyone,
I'm doing the module "Pivoting, Tunneling, and Port Forwarding" . When I try to scan the other host with proxychains nmap -v -Pn -sT 172.16.5.19, I receive those messages:

...
dig: parse of /etc/resolv.conf failed
...

I can't complete the scan and after a few seconds, I see that my CPU and memory usage goes up to more than half. If I try multiple times, the PC crashes.
Has anyone experienced this error? Best regards and thank you very much.

[wraith pelican]

i did not experienced this error but I'm curious about it. what does your /etc/resolv.conf looks like?

[rustic sage]

Hey there lads, I just finished the Module** Fingerprinting** on Information Gathering - Web Edition

I've got the second question right but with the wrong procedure, I wonder if there would be an easier way to do it, but here's how I did it.

||Run nikto on app.inlanefreight.com after modifying hosts file, the output spits out a couple of entries related to robot.txt

Just out of curiosity I check it out with

curl app.inlanefreightlocal/robots.txt

And I can see that the CMS is there, and it's a valid answer for the question ||

I feel that I should be able to grab the CMS through this command

curl -I app.inlanefreight.local

And check the X-Redirect-By value, but it's not being redirected at all, any other options?

[crude mist]

thank you for your reply:

# Generated by NetworkManager
search fritz.box
nameserver 192.168.178.1
nameserver fd00::b2f2:8ff:fe6a:fad2
nameserver 2001:a61:a60:f301:b2f2:8ff:fe6a:fad2```

[wraith pelican]

the command is trying to resolve an ipv6 address, but why? did you add those entries in the resolv.conf file? is it something you use for another purpose?

[crude mist]

mmm no... Ive just removed all the lines and wrote nameserver 8.8.8.8 and now works. But I guess this solution will bring me later some other problems. Maybe it has something to do with proxychains.conf:

dynamic_chain
strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000
[ProxyList]
socks4 127.0.0.1 9050

[wraith pelican]

mine is:
strict_chain
proxy_dns
remote_dns_subnet 224
tcp_read_time_out 30000
tcp_connect_time_out 16000
[ProxyList]
socks4 127.0.0.1 9050

[steady torrent]

For the skill assessement of info gathering, does /opt/seclists/Discovery/DNS/subdomains-top1million-110000.txt is sufficiant to find the right VHOST ?

[wraith pelican]

did you try it?

[wanton idol]

^

[wraith pelican]

and my resolv.conf got
nameserver 127.0.0.1
and my nat address
but no external resolver
maybe it is not a reference since I messed with bind to set up a local dns for my home lab
but basically it is my nat that resolve the ip i want to reach

[steady torrent]

yes doesn't work

[wraith pelican]

can you explain what does not work? do you get errors, no results?

[steady torrent]

Ok it was the vpn which was crashing unfortunately, it works now

[fathom pendant]

Section* Fingerprinting

[wraith pelican]

i think we don't need a vpn to connect to that host

[crude mist]

Thank you for the response! I don't know what might be happening. Sometimes it connects, and other times it times out. Nmap tells me that all ports are filtered, and with xfreerdp I can sometimes connect.

[wraith pelican]

Is it a vanilla config or did you configure things for your specific use? it is hard to diagnose a config from here, i would run nmap with trace packets, wireshark... it should run pretty straight forward with proxychains, but you got ipv6 addresses in resolv.conf, something happening there. Or maybe dynamic and strict at the same time it is curious

[steady torrent]

Enumerate web page of enumerated subdomain of another subdomain... is it realist ?

[wraith pelican]

did you try it? : )

[steady torrent]

yes, I'm currently fuzzing directories without success, my only remaining question is the current API key

[crude mist]

I removed dynamic_chain, added remote_dns_subnet 224, increase the timeouts. In resolv.conf I added nameserver 127.0.0.1 and it worked 😕 , so there is no more conflic with ipv6. Anyway, thank you for helping!

[wraith pelican]

that question?: What is the API key in the hidden admin directory that you have discovered on the target system?

[steady torrent]

Sorry for the questions I have found the answer based on previous discord messages, there is so much guessing for this skills assessement

[wraith pelican]

well at least you practice some osint skills : D

[steady torrent]

yeah ! This enumeration was a little bit guessy, some steps were obvious to do, some other...

[wraith pelican]

the assessment brief tells all the steps to follow, maybe not totally in order... and the questions add another layer on what to search for. I do not know how to help if your only issue is you don't get the answers : )

[fathom pendant]

<@&861185840277487616>

[topaz fossil]

Nikto didn't work so well for me in this case. I simply browsed the site and found specific keywords. Later i realized whatweb tool works much better.

[narrow geyser]

SQLMap Attack Tuning module

What's the practical way finding the custom prefix / suffix? I had 0 idea on how to find it for Case #6, looked up the hint and solved it. Now I'm wondering, what's the way to do this without looking at the hint? The solution doesn't provide this information.

[summer lava]

anyone done with the last question on INFORMATION GATHERING - WEB EDITION - Skills Assessment

[dusky gyro]

https://tenor.com/view/inception-deeper-go-deeper-we-need-to-go-deeper-leonardo-di-caprio-gif-16756828

[wanton idol]

yeah

[quasi jungle]

https://academy.hackthebox.com/module/136/section/1291
**Try to read the source code of 'upload.php' to identify the uploads directory, and use its name as the answer. (write it exactly as found in the source, without quotes) **

Managed to read flag.txt with XXE in svg.

Tried to use XSS in XML to read upload.php
Tried to use XXE to read /var/www/html/upload.php

[oak lance]

I'm working on it now. Feel free to DM and discuss

[shut vapor]

Just a general question. When you use the 2&>1 after a command in Linux, what exactly are you doing? Redirecting stderr to stdout?

$ whatever 2&>1

[fathom pendant]

Stderr AND stdout, you generally add a file after

For instance a program might just redirect stderr to a log file, while stdout to terminal (and/or file)

[shut vapor]

Gotchya, yeah I'm more or less familiar with how it's used, I just can never remember the syntax and I'm trying to break it down.

Like, for years I've switched where the & goes lol

[fathom pendant]

https://www.gnu.org/software/bash/manual/html_node/Redirections.html

[vast geyser]

Hello If I subscribe the annual billing , I can access the module . when the annual billing has expire, Could I still access the moudle?

[shut vapor]

you maintain access modules you've completed.

[vast geyser]

Thanks!

[snow garden]

Hello I am on the Pivoting tunneling and port forwarding module and I am tunneling with Chisel and when I scp the binary over to the pivot host and try to run it I get this error. ./chisel: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by ./chisel)
I also tried another version of Chisel

[cloud urchin]

You'll want to use an older version of chisel

[snow garden]

I have tried

[cloud urchin]

well, that's the solution

looking back at my notes, i had to use v 1.7.4. have you tried that far back?

[snow garden]

I went through github and went to the releases got the source code and unziped it then built it

[snow garden]

I went as far as like 1.3

[cloud urchin]

try 1.7.4

[snow garden]

Will do

This worked for me

CGO_ENABLED=0 go build main.go

[halcyon oracle]

Good day mate👋

[night pulsar]

how much hahahah because I've expended almost 3h and nothing for while

[night pulsar]

some hint friend???

[wanton idol]

what have u done

[night pulsar]

can I text you private?

[wanton idol]

yessir

[vale salmon]

So i am working through the new content in the Information Gathering - Web Edition module. I am on the Skills Assessment, on the final question. I have found a couple of subsequent subdomains, but I can't do anything with the last one I found. It's like it can't connect to it. I have added it to my host file, I've tried resetting the VPN and the machine. I've tried FinalRecon, ReconSpider, Gobuster, and other tools and am getting nowhere. Anyone finished it recently that might be able to help?

[sterile solstice]

im doing the Pivoting/Forwarding/Tunneling module. finally a module that i can use my networking knowledge from the JNCIA training i did lol

[sterile solstice]

i haven't gone back to that module yet.

[vale salmon]

Aside from this last question it has all been relatively straightforward. This one is a doozy though.

[fathom pendant]

All for it not to matter

[sterile solstice]

ohi just noticed, it changed my name in here since identifying in the welcome channel ... interesting

haha, for what part not to matter? the JNCIA stuff? or the module?

[fathom pendant]

It's linked to your htb labs username

JNCIA stuff

[sterile solstice]

so far im a little surprised they havent explained subnetting a bit more, but i guess its not entirely needed. helps to understand networking architecture. i want to do the networking design course by Juniper. its on my list.

[fathom pendant]

Intro to networking is the only module that covers subnetting

[sterile solstice]

well ive found JNCIA to be helpful here and there. though it is juniper based, its far more applicable in general than CCNA imo

[fathom pendant]

In terms of being an attacker, you don't really need to do subnetting, just be aware of them

As well as defense

it's good to know but you don't need in-depth knowledge

[sterile solstice]

yea true. with the parts on why there is a jump host/pivot, makes perfect sense to me given the subnetting.

[fathom pendant]

Just know you pivot because your host doesn't have access to the internal network

[sterile solstice]

yea very true. i did my JNCIA as i thought it'd help me with moving towards purple teaming which is what i want, eventually.

[fathom pendant]

Btw after this module, look into ligolo-ng, it makes all the pivoting simple

Even defensive side

You don't do a lot of networking in offense/defense

[sterile solstice]

ive seen that name mentioned. will definitely take a look. i just got to the Socat stuff.

[fathom pendant]

That's for the Network Admin to sort out and maintain

You just hook into the infra setup

[sterile solstice]

yea true. i hope that it will serve me well when im producing real pentest reports, though. being able to identify weaknesses in infrastructure

[fathom pendant]

You're not gonna be focused on the subnetting parts; maybe the subnets of a network to identify weaknesses

[sterile solstice]

yea true

[fathom pendant]

And generally you do it on a host by host basis not full network for the report

[sterile solstice]

i have a use for the JNCIA in other areas anyway. it wasnt just for moving towards purple team

[fathom pendant]

Though what CPTS asks for there's a sample report that you can go off of

[sterile solstice]

i had a look at a dummy report from sysreptor but i havent looked at any others

have you done the CPTS yet, marcie?

[fathom pendant]

Nope

Lots of stuff piled up in life at once and halted my progress

[sterile solstice]

ah. you seem all over it, i wouldnt have been surprised if you had lol

yea i get that. im trying to do as much of this as i can, as i know i have life stuff coming my way very soon that will also grind me to a halt

[wanton idol]

so u are unable to see the webpage?

[sterile solstice]

CPTS has been harder than i thought. im wondering if i should've started with CBBH lol

[vale salmon]

The only one accessible is inlanefreight.htb and has the Welcome message and that is it.

[fathom pendant]

They wouldn't necessarily help with one another

The only thing that binds them is the surface level web stuff

[wanton idol]

make sure your hosts file is set up correctly

[fathom pendant]

That's it

Information Security Foundations is the pre-req for Pentester path though

[sterile solstice]

well i had a look at 1 of the free retired machines, and its heavy on the web exploits. but i was wondering if cbbh wouldve been better also because it is a shorter track

[vale salmon]

I have it set up with <ip>:<port> <domain>. Am I missing something there?

[sterile solstice]

well ive done some infosec stuff at work, and added to it with security+ as well. so the infosec req didnt worry me too much

[wanton idol]

yes, u do not add the port to hosts file

[fathom pendant]

CBBH focuses on surface level exploitation, boxes are meant to be rooted

[vale salmon]

Okay, I'll try that way

[wanton idol]

and any other sub domains u found you also add it to the hosts file

[vale salmon]

Yeah, that part I know

[sterile solstice]

yea. that is true. i also know a good chunk of CBBH is covered in CPTS

[fathom pendant]

Not to mention what's on boxes may not be covered by the course content

[fathom pendant]

I wouldn't say covered, its just module overlap

[sterile solstice]

thats what i meant

[fathom pendant]

I.e. you don't need to do a module again if you do both CPTS and CBBH

[vale salmon]

Looks like it was the port that was screwing everything up. Thanks!

[fathom pendant]

The hosts file shouldn't have ports in it

It's why all the examples and such still specify port after domain http://inlanefreight.htb:port

[vale salmon]

Yeah, not sure what got me putting the port in because I usually don't

[sterile solstice]

im trying to use rpivot. has anyone had any luck install python2.7 on a parrot OS VM?

[fathom pendant]

Use a venv (virtual environment)

[wraith pelican]

for python2.7 i use pyenv to manage versions

[sterile solstice]

do you have a link to how you got that done? that doesnt seem to work for me either

[fathom pendant]

Google

https://stackoverflow.com/questions/32918846/how-do-i-install-a-previous-version-of-python-into-a-virtualenv

[sterile solstice]

awesome. i went with pyenv. setting up 2.7 now

[wraith pelican]

then, with some aliases, it become pretty neat

[sterile solstice]

i followed along and added the paths t .bashrc and .profile

seems to work with just python2.7 command

[fathom pendant]

If you edit the .bashrc file you'll need to do source .bashrc or reopen the terminal to get it to register

[quick eagle]

Hey guys I am working through "ATTACKING COMMON SERVICES - Attacking SQL Databases" module and I cant connect to mssql with:
mssqlclient.py -p 1433 htbdbuser@10.129.203.12
tried adding : -windows-auth at the end to but nothing seems to be working. I get this error with TLS :
[*] Encryption required, switching to TLS
[-] [('SSL routines', '', 'no protocols available')]

Can anyone help with some hints please, been stuck on this for 2 days now?

[fathom pendant]

Is your openssl up to date?

Also no need to specify port

[sterile solstice]

now the client.py won't run on the pivot host. no relay module.

lol

[fathom pendant]

Follow the section for setting it up

You likely missed a step

[sterile solstice]

ah, send the whole directory not just the file...

[quick eagle]

I am using HTB machine so it should be. Let me check the steps all over again

[sterile solstice]

i like rpivot though thats a lot of stuff to send over to your pivot host. i'd assume it'd get noticed

cool though

[fathom pendant]

Yeah it's not working for me

Seems some packages got broken

[quick eagle]

well that sucks

[fathom pendant]

sudo pip install impacket --upgrade --break-system-packages

[wraith pelican]

I'd not worry too much about getting noticed... i got into some evasion rabbit hole around the same time in pivoting...

[sterile solstice]

i guess im thinking too far ahead for an engagement

for training it wouldnt matter

[quick eagle]

that fixed it! Thank you so muchhhhh! You saved me ❤️

[fathom pendant]

it seems something must have broken when they updated the pwnbox images

[round moat]

Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com.

Guys am confused how to do this? am using dnsenum to find the missing subdomains but am confused whether i should create the wordlist by myself or what should i do?

[wraith pelican]

have you tried it?

[round moat]

yes i did tried to do so

but am confused

[fathom pendant]

you should use a premade wordlist

like the one in {path}/SecLists/Discovery/DNS/

or whatver is shown potentially by the section/module

[oak lance]

That's exactly where I am. I've got the correct info in the hosts file (ie just the name and IP) but I can't find any vhosts or subdirectories with either gobuster or ffuf. I've tried the medium directories list and subdomains-top1million-110000.txt for the vhosts.

[wraith pelican]

you could try the command in the section

[round moat]

i did that but not getting answer

[fathom pendant]

then you're likely doing something wrong ™️

because inlanefreight.com is a live website, it's not the target

are you setting too many threads and it's just dropping all them, are you just being impatient

[round moat]

dnsenum --enum inlanefreight.com -f /usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt
am using this

[fathom pendant]

is the section telling you to use dnsenum?

[round moat]

no am only using threads to enumerate vhost using gobuster

[fathom pendant]

it also helps if you provide the module name and section name

[round moat]

yes

[fathom pendant]

and not just the question

[wraith pelican]

but they want answers

[fathom pendant]

asking questions correctly helps avoid confusion ¯_(ツ)_/¯

[wraith pelican]

yeah you are right, i was just joking

[fathom pendant]

but it seems you know the module he's on

[wraith pelican]

the section contains all you need, just try the commands

[wraith pelican]

i had to search but it is https://academy.hackthebox.com/module/144/section/1253

[fathom pendant]

the walkthrough also shows using that same command

so

[wraith pelican]

could you tell more on what's happening?

[fathom pendant]

is your host files correct (ip then domain name)

not port

[oak lance]

I can hit the server at the IP and port provided, retrieve what http server is running. The next question mentions a hidden admin directory so I've tried directory fuzzing but I just get the same welcome to inlanefreight.htb page

[fathom pendant]

just ran it and found it just fine

if you're using the pwnbox the new file location is lowercased now; instead of SecLists it's seclists

i noticed because the error i got was "make sure file exists"

[oak lance]

Same location on my Kali box

[fathom pendant]

wasn't referring to you

[wraith pelican]

just out of curiosity, the other day i tried without adding the subdomains to etc/hosts and it works for that part, we can retrieve the subdomains

[fathom pendant]

i was replying to the person regarding something else

[fathom pendant]

it depends on the tool used

[round moat]

i also corrected the same thing with the command

[fathom pendant]

ffuf doesn't matter because you throw the -H "" flag at it

[round moat]

still not getting

[wraith pelican]

paste the command you are using. do you get any errors while fuzzing?

[wraith pelican]

works with gobuster as well, but anyway we have to add the subdomains for later in the assessment so it is not a big deal

[fathom pendant]

do inlanefreight.htb:port instead of IP

[oak lance]

OK.

[wraith pelican]

hey you will not get subdomains with that command

you are fuzzing for directories there

[fathom pendant]

but also that's not how you get subdomains yeah

fuzzing for subdomains with ffuf would be -H "FUZZ.inlanefreight.htb" with the discovery/dns/ wordlists from SecLists

[fathom pendant]

you'll have to check on subdomains

[oak lance]

Yeah, I've tried for both subdomains and directories

Was what I used for subdomains

[round moat]

ffuf -u http://134.209.24.248 -H "Host: FUZZ.inlanefreight.com" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt
is this correct?

[autumn pilot]

if you add the port it will be correct

[wanton idol]

^

[fathom pendant]

you need the port dude otherwise it assumes 80

[wanton idol]

make sure to add the port

[wanton idol]

if one wordlist doesnt find anything try a different one

[wraith pelican]

if you go back to the course material and try the different wordlist shown there, you'll find the subdomains

[flat parrot]

Hey! When I'm executing ReconSpider.py from the updated module (Web edition) I get this error, there is the output. Any one get the same error?

[wanton idol]

did u try http://inlalnefreight.local

[flat parrot]

I tried with https://inlanefreight.local, http://inlanefreight.local, http://inlanefreight.com, 😦

[flat parrot]

yeah all of them

[wraith pelican]

yes same here, it works nonetheless

[flat parrot]

and instructions says you need to crawl inlanefreight.com. So what?

[wanton idol]

well it still shows it ran so have u checked the results?

[fathom pendant]

check the results of reconspider

[wraith pelican]

ah i didnt see the end of your file, you got this error PermissionError: [Errno 13] Permission denied: 'results.json'

[fathom pendant]

¯_(ツ)_/¯

[flat parrot]

ok nvm ty

[fathom pendant]

it should be run on inlanefreight.com

[wraith pelican]

so it seems you are in a directory where reconspider cannot write

[fathom pendant]

not local

but yeah

[flat parrot]

thanks all for help lol my fault haha

[fathom pendant]

just did the info gathering assessment

not a bad glowup from previous iteration

[wraith pelican]

yeah the focus is different i guess

[fathom pendant]

Def would have liked them to still show whatweb off again

[fathom pendant]

also was wappalyzer also not showing the CMS for you on the fingerprinting section? I managed to get it from other means (whatweb/source/looking at page generation)

[rustic sage]

Comrades, good morning everyone, I have a problem in the password attack module, specifically in atancado sam, the question is the following: "Apply the concepts taught in this section to obtain the password to the ITbackdoor user account on the target. Submit the clear-text password as the answer." I have the share and I have saved the files as indicated in the guide but when I move them it tells me the following: The system cannot find the file specified. The command to move them I have it as follows: move sam.save \<ipattackerHost>\hashesHklm but I don't understand why it doesn't move the files to my machine

[fathom pendant]

do you have an smb fileshare open?

also with xfreerdp you do have the /drive: option to mount a drive

[wraith pelican]

yes sometimes wappalyzer doesnt show cms, if i remember correctly, sometimes it does tho

[fathom pendant]

¯_(ツ)_/¯

I knew how to find it out (it's a rehash of the previous version anyway)

[rustic sage]

@fathom pendant xfreerdp /u:Bob /v:10.129.149.175 /p:HTB_@cademy_stdnt!

[fathom pendant]

you can add /drive:share,/tmp/ to mount the /tmp/ directory and you'll see it from the shares in file explorer

[rustic sage]

Here we go again 🙂

[fathom pendant]

I also suggest doing /dynamic-resolution so you can resize the screen

also "cannot find the file specified" did you extract the sam.save to be able to move it?

[wraith pelican]

i found that extension: owasp penetration testing kit. it shows quite a lot but it is a bit cluttered

[fathom pendant]

i like my CLI tools ¯_(ツ)_/¯

they haven't let me down yet

[rustic sage]

@I extracted it as indicated and he tells me that it has been done successfully

[fathom pendant]

ok is it in the directory you're currently in to move it

[wraith pelican]

yeah whatweb is just easy

[fathom pendant]

but again my initial question wasn't answered

[rustic sage]

C:\Windows\system32>

[fathom pendant]

do you have an smbserver running for windows to connect to and drop

[rustic sage]

I got it set up and running

[fathom pendant]

that's what it's refferring to with move file \\your_tun0\sharename\file

[rustic sage]

Wait I've gotten lost again

[fathom pendant]

the \\<attacker_ip>\ is YOUR IP

[wraith pelican]

on that, i think now the module focuses more on what useful for an htb environment than searching shodan, censys, and real dns records

[wanton idol]

i thought u had to do this first net use \\your_ip\sharename

[fathom pendant]

you don't have to

[rustic sage]

move sam.save \<ipTarget>\hashesHklm

[wanton idol]

bruh ive been doing that the whole time T-T

[fathom pendant]

you can just specify the remote target

[fathom pendant]

not iptarget

[rustic sage]

tun0

[fathom pendant]

YOUR tun0 ip

\\10.10.x.x\<whatever you named the share>\

your tun0 refers to the IP given when you do ip a on your attack host

[rustic sage]

I'm going to try again when it comes

[mighty merlin]

Hello there,
I am doing linux fundamentals and i am at a point were i cant find the user's mail. I was able to discover the /var/mail and the var/spool/mail directories but didn't contain anything for the user and as such they were not passed. Any pointers...

[fathom pendant]

check env

it's where it's defined

[mighty merlin]

let me get on it. thanks

[fathom pendant]

note: it can be defined in the environment but not exist on the filesystem

[mighty merlin]

then it's just hidden with a . preceding its name..!

[fathom pendant]

nope

if i meant hidden i would have said hidden

env gives all the environment variables; MAIL is one of those variables

also make sure you're ssh to the target

otherwise you're not gonna find the answers

[mighty merlin]

yes, i have. Just trying to wrap my head around the environment variable. it must be saved somewhere on the system. I just have to find where

[fathom pendant]

brother

i'm telling you the command that will print them out

the environment variable defines the file location for it

you don't have to dig through the filesystem for it

you're overcomplicating it

[mighty merlin]

🙀shame on me. I'm back in. and i am looking at the path

[fathom pendant]

VAR=/path/to/thing

[rustic sage]

An environmental variable in Linux is a way for your computer to store information it needs to work. Think of it as a note with important details, like where to find programs or files. For example, the PATH variable tells the computer where to look for commands you type. You can see or change these variables to control how things run.

[mighty merlin]

thanks

[round moat]

inlanefreight.com NS record query failed: SERVFAIL
Guys am getting this error on Information Gathering - Web Edition -> subdomain bruteforcing
am using dnsenum --enum inlanefreight.com -f /usr/share/wordlists/seclists/Discovery/DNS/<every wordlists>

[ember fern]

sure will do, will try again soon

yeah am aware of the dot issue 🙂

haha yup did do that

[wraith pelican]

does it happens with every wordlist? I just tried with one and it works fine

[rustic sage]

Try explicitly specifying a DNS server?

[round moat]

which one did you use? i tired with every wordlist

[wraith pelican]

there is 3 wordlists used in that page of the course material, they say let's use the 5000, then the code shows the 110000 and then another example is the 20000. I think you can figure it out from there. But that does not solve your servfail issue

[round moat]

how to solve servfail issue?

[wraith pelican]

did you try what candy29 just proposed a few message above?

[round moat]

yes i tried with 110000 txt, 20000 txt and 5000 txt

still getting servfail issue

[wraith pelican]

do you think the servfail issue might be wordlist related?

just try to google the error

[round moat]

am trying

is it due to rate limit?

[wraith pelican]

me too, and i don't know really why you get that error. Did you try to specify a dns server that dnsenum will use?

[round moat]

naah am using
dnsenum --enum inlanefreight.com -f <path to wordlists?

[rustic sage]

Oh

[rustic sage]

Try specifying one dnsenum --dnsserver 8.8.8.8 --enum inlanefreight.com -f <wordlist>

[round moat]

thanks it did worked, what about vhost now
how to solve this am using
gobuster vhost -u http://<ip>:port/ -w <path to wordlists> --append-domain
am not getting answer

am using seclists wordlist

[wraith pelican]

what are you getting?

[solid moth]

i am stuck at Web Attacks - Skills Assessment. now i know a user who may be an admin but i can't change the password for him any hints？

[arctic karma]

I am having an issue on Password attacks hard skill assessment where I have the password NT hash of the Administrator from the vhd and it seems to be an empty string, also tried PtH with no success

[round moat]

am not finding anything

what should I do

[wraith pelican]

you could try to see if there is any missing flag in your command using:

gobuster vhost --help

[round moat]

can i dm you?

[wraith pelican]

yeah go on

[stone hare]

Footprinting lab - Hard
When I look up help on this anywhere, the first thing I read is about how SNMP should be looked into, my question is, how should I come to the conclusion that SNMP is running at all? My nmap scan outputs this

[tranquil axle]

you nmap scan is a tcp scan, but snmp runs on udp, so you need to perform a scan with -sU flag

[stone hare]

holy i forgot ty

[tranquil axle]

ideally you always scan both, in 99% of the cases you only care for the tcp ports though. I keep forgetting udp scans most of the time too

[wraith pelican]

did you find the issue?

[arctic karma]

I did not haha my internet started acting up

[wraith pelican]

what do you mean by empty string?

[arctic karma]

When cracking the NT hash found in the vhd it is just an empty string

[wraith pelican]

strange, should be a password. when i google "hashcat empty password", there is several things possible. Maybe missmatching the type? check the potfile, or output results to a file

[arctic karma]

I tried with crackstation and it also came back as empty

[wraith pelican]

is you hash like e53...22a1

[arctic karma]

na its something like 31d...9c0

also all users I found in the vhd have the same hashes

[next bronze]

you probably got the wrong hash then

[wraith pelican]

that s guest hash

[arctic karma]

The guest and the admin are both the same for me for some reason

[wraith pelican]

you must be damned

[arctic karma]

haha I'll look into it some more maybe some issue with me dumping them or mounting it!

Thank you though!

[round moat]

hey

1. Which CMS is used on app.inlanefreight.local on the target system? Respond with the name only, e.g., WordPress.
2. On which operating system is the dev.inlanefreight.local webserver running in the target system? Respond with the name only, e.g., Debian.
   am having issue on this question from Information Gathering - Web Edition -> Fingerptinting

I used curl -I http://<ip> to find the cms, whatweb but didn't find the cms
and used nmap -O <ip> to enumerate the OS still not getting anything

[old oasis]

did you add all the virtual hosts in the /etc/hosts file?

[round moat]

yes i did

am not being able to get OS

[sterile solstice]

is the site down for any1 else?

[snow ridge]

Yeah its down

[sterile solstice]

i had 1 section left before skills assessment. i wanted to get it done then go to bed, lol.

[wraith pelican]

yes, here as well

[round pond]

The site is offline?

[sterile solstice]

ok cool. good to know.

[timber hatch]

seems like that. for me also

ah now it is up again

they changed the default terminal from the parrot machines. nice..that green was always horrible for my eyes...

[pseudo kiln]

is there a way to send feedback for modules ?

[storm elk]

Via /feedback I guess

[pseudo kiln]

like in the pivoting module, when we discover IP 172.16.5.129/23 the author mentions to do ping sweep via metasploit using 172.16.5.0/23. However this is incorrect because the network address for the host is 172.16.4.0/23, not 172.16.5.0/23. This detail is pretty important imo, as with the instructions provided it could lead to missing discovereable hosts during a ping sweep.

Is the point of this to make students not bother with basic subnnetting ? big mistake if that is the case imo and should be clarified

[round pond]

Oh ok thx 🤝

[sterile solstice]

I did that section today. I didn't have any problems with that tbh. But you're right about the subbetting. I mentioned it earlier today.

Personally I think NetworkChuck does some great explanations of subnetting

[pseudo kiln]

excellent good to know someone mentioned it, hopefully they fix it

[sterile solstice]

Probably wont

Hopefully ppl take it upon themselves to learn though

[vale tusk]

Hi
I finished File Uploads: Whitelist Filters, but cant understand one thing.
In this module i can successfully upload file extension sell.php/.jpg or shell.php..jpg. What must be written in uri, for get access to this file?
I try different combinatiob http://x.x.x.x/…./shell.php, shell.php.jpg, shell.php/.jpg, but always get “Not Found”

[broken moss]

I can't get HTB to accept an answer for the Using CrackMapExec -> Basic SMB Reconnaissance module / section. The question is What's the OS version, and this is the output from crackmapexec SMB 10.129.204.177 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:inlanefreight.htb) (signing:True) (SMBv1:False), I've tried every possible combo of that version with no success

[silk anchor]

Was doing 'DNS Tunneling with Dnscat2' in the Pivoting module.

Anyone else had issues with the connections "timing out" when connecting from the windows host back to the LOCAL DNS. Dunno if its because I put dnscat2.ps1 in C:\ or something, I did manage to use it correctly as the module says but the connections didn't seems to last for very long if they were idle for more than like 30 seconds.

[wanton estuary]

Anyone done advanced sqli skill assessment that I can message about the RCE?

[rustic sage]

Huh

[elder matrix]

is it me or the target for the questions in "Windows File Transfer Methods" is EXTREMELY unstable?

[shut vapor]

It's sluggish and freezes for a moment at times... more-or-less. Apparently more for you.

[elder matrix]

yeah it kinda unf--ks itself after a while..

[keen steeple]

Hi, where can i go to for hints for CTF HTB Try out.

[fathom pendant]

nowhere

there are no hints for CTFs allowed

[fickle thicket]

anyone did the citrix section in windows priv esc module. do i just click on the launch.ica file and it will automatically connect?

[fathom pendant]

yes

[tranquil axle]

You won’t find the answer in usn journal but in the mft

[fathom pendant]

another hint i've seen floating around that one is, assume the Zone.Identifier is the same

[keen steeple]

they gave files to download and read the codes but its encrypted and im unsure whats the password to extract the files

[timber hatch]

i try that...should i open the mft in timeline explorer, read something about that in a reddit forum...

[tranquil axle]

Sure, so that and look for zone identifiers and see if you notice anything

[fathom pendant]

that's too bad, but there's no one that can help you with an active CTF

read the #rules and #welcome

if you really want to keep asking post in #1024429874246590575

[timber hatch]

nah dont get it. can you help me a bit more specific? which file o have to open in timeline explorer?

this $MFT converting to a csv and read iwth timeline right?

I've read in a lot of forums, including Reddit, that many people have trouble with this question. It seems to be poorly explained

if anybody likes to help me, just dm me!

because i am off now

i just want to end the module that i can give a bad review really...

[fathom pendant]

It's likely you're just overthinking it

[timber hatch]

1 star for sure

[fathom pendant]

once you find it you'll feel dumb more than likely ¯_(ツ)_/¯

You're already told to look for the Zone Identifier

[timber hatch]

where?

in time line explorer? when loaded the mft csv?

[fathom pendant]

In both usn journal and the Explorer. I'm assuming the section and module taught you how to look for that info

[fathom pendant]

You should have a csv for both the journal and mft

[timber hatch]

i do have that

[dim wolf]

if you have the Zone.Identifier, you can locate the renamed file

[fathom pendant]

Then search for "uninstall.exe"

[dim wolf]

the Zone.Identifier will stay the same across renames

[timber hatch]

i have this

is the answer in mft explorer or in the timeline exlporer?

[solid lily]

In the nmap module it is mentioned that nmap normally uses ARP ping, but the most reliable method is ICMP echo ping and we have to use --disable-arp-ping to do the ICMP ping, but i tried this and my nmap normally uses ICMp ping, i am a little confused here? did i understand it wrong? please help

[fathom pendant]

Nmap uses ICMP for host discovery, it's why you use -Pn to disable it when scanning targets that wouldn't respond

[solid lily]

so what about the ARP ping the module mentions?

[fathom pendant]

That's a backup method

[timber hatch]

how?

i dont know the method. are you able to help more?

[solid lily]

hmm, thnx

[dim wolf]

if the Zone.Identifier stays the same across renames, then the renamed file and the original file will have the same Zone Id

[fathom pendant]

https://nmap.org/book/host-discovery-techniques.html

[timber hatch]

and how can i search for it?

[dim wolf]

where can you find a log of changes made to files

[timber hatch]

timeline explorer

[dim wolf]

what artifact can you check for file changes

timeline explorer has a search feature, use that and you have your answer

[timber hatch]

not wihin the $J file right?

i found only this

[fathom pendant]

uninstall.exe:zone.identifier

[timber hatch]

found it

searched for uninstall.exe

not zone identifier

i still dont get what zone identifier helps...

i just searched for uninstall.exe

[fathom pendant]

Ok let's take a step back

Take a look at the journal for uninstall.exe, and look for the zone.identifier there

Then in the mft one look for that

You need to examine both

[bright ridge]

Your account number is not valid. Please update your account number.

where do i update this?

[fathom pendant]

Message support ig

[bright ridge]

i cant see the chat anymore

live chat, did they remove it?

[fathom pendant]

Disable adblock

[bright ridge]

oh ok

is it 24/7?

[fathom pendant]

No

[bright ridge]

so there is no way for me to fix this myself?

[fathom pendant]

¯_(ツ)_/¯

[bright ridge]

maybe its the card thats expired, i cant renew my student subscription

still a weird message to get

[fathom pendant]

Support is the best place to resolve issues

[bright ridge]

for sure

[fathom pendant]

Not the discord

[timber hatch]

dont know what you mean

[fathom pendant]

In both files, search uninstall.exe

In one the filename field will be different even though the zone.identifier is the same

[spare spire]

I am doing InfoSec fundamentals , I want to have skin in the game with Linux what distro would be the best I heard fedora it's good? Just to get more hands on working with Linux and getting used to Linux what do you guys suggest?

[cedar void]

I don't know what part of the output of this command (view-source:||http://94.237.53.113:41835/index.php?language=/var/lib/php/sessions/sess_pe5tsqscr937shm045cem83je1&cmd=pwd||) Im supposed to submit as an answer in the first question for the following module section. I tried multiple attempts:

https://academy.hackthebox.com/module/23/section/252

"Use any of the techniques covered in this section to gain RCE, then submit the output of the following command: pwd "

[timber hatch]

i just have made the csv file out of the mft file. searched for Zoneidentifier=3

and that's it. but i dont know...i thought at he beginng this hasn't worked...

[rustic sage]

Debian

Or Arch

[fathom pendant]

Fedora is Redhat, not as common. Debian distros are more common like Kali or Parrot

[timber hatch]

anyway. thx

[fathom pendant]

Don't do zoneidentifer=3

[timber hatch]

i am off

[fathom pendant]

Just ctrl+f for uninstall.exe

[sour jungle]

question about the "Kerberos Attacks - Unconstrained Delegation - Users" module. Working on the krbrelayx portion and curious how you're supposed to get the hash to use for the exercise? I've tried to just use "-p" to set a password and auth to it that way. but nothing seems to be working

┌──(testing㉿kali)-[~/tools/windows/krbrelayx]
└─$ python krbrelayx.py -p jasmine
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Running in export mode (all tickets will be saved to disk). Works with unconstrained delegation attack only.
[*] Running in unconstrained delegation abuse mode using the specified credentials.
[*] Setting up SMB Server
[*] Setting up HTTP Server on port 80
[*] Setting up DNS Server

[*] Servers started, waiting for connections
[*] SMBD: Received connection from 10.129.205.35
[-] Could not find the correct encryption key! Ticket is encrypted with keytype 23, but keytype(s)  were supplied
[*] SMBD: Received connection from 10.129.205.35
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'
[*] SMBD: Received connection from 10.129.205.35
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'

getting the above error

[safe yoke]

can anyone help me with the last two questions from information gathering skill assessment

[sour jungle]

┌──(a㉿kali)-[~/tools/windows/krbrelayx]
└─$ python3 printerbug.py inlanefreight.local/carole.rose:[e-mail] roguecomputer.inlanefreight.local
[*] Impacket v0.11.0 - Copyright 2023 Fortra

[*] Attempting to trigger authentication via rprn RPC at dc01.inlanefreight.local
[*] Bind OK
[*] Got handle
DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Triggered RPC backconnect, this may or may not have worked

printbug exploit

[tranquil axle]

dont you need to provide the user here too?

[sour jungle]

sigh... yup that was it

thanks

[cedar yew]

hello all,

AD attack and enum
ACL abuse primer question2

" Which ACE entry can be leveraged to perform a targeted Kerberoasting attack? "

does not accept my answer

[fathom pendant]

What did you put?

[rustic sage]

I am extremely disapointed with one of the mods

poor communication and just locked down my erratum ticket

said to seek help here which is not the case

[fathom pendant]

If you have an issue with mods reach out to an admin

But if your question was related to an academy module, ask here

[rustic sage]

but I will ask my question here I guess
Module Name: WINDOWS ATTACKS & DEFENSE
Section Name: Credentials in Object Properties
Event 4771 does not get populated thus not able to answer the last question

[fathom pendant]

It was closed because it's not a reproducible error

[cedar yew]

dacl -_-

[rustic sage]

yeah that is fine

[fathom pendant]

Are you looking at the right server?

[dim wolf]

DACL isn't an ACE entry

[rustic sage]

but I need the event id 4771 to answer the questions

[fathom pendant]

It's more Generic

[fathom pendant]

Yes. But are you looking at the right server for the event

[rustic sage]

I am

[clear zephyr]

Hey the Windows Evasion module, I am trying to generate an IV using this command:

for ((i = 0; i < ${#hexRandom}; i+= 2)) do echo -n "0x${hexRandom:i:2},"; done | sed 's/.$//'; echo

but I keep getting this error:

zsh: unrecognized modifier `i'

[rustic sage]

looking on DC1

[fathom pendant]

The event gets logged on the key server

[clear zephyr]

Do I have to set 'i' as a variable?

[rustic sage]

Connect to DC1 as 'htb-student:HTB_@cademy_stdnt!' and look at the logs in Event Viewer. What is the TargetSid of the bonni user?

this is the question

[fathom pendant]

In the for loop you need to call the variable with $

[fathom pendant]

It's set in the loop generation, you're just not calling it

It's not like python where naming a variable makes it implicit wherever the variable is called

Bash/zsh requires a variable to be called with $

So in this case $i

[clear zephyr]

I tried that and got this error: zsh: bad math expression: lvalue required

[rustic sage]

also you cannot even rdp into a PKI server

just powershell in

also the questions specifically says DC1 that is why I am looking on dc1

so either I am trippin or the question is wrong or this is actually an erratum issue

[fathom pendant]

Did you attempt the bonnie login?

[autumn pilot]

Carefully go through the material in the section and you will get the answer

don't rush through it

[fathom pendant]

4771 is an auth failure

[rustic sage]

I have gone through it like 3 times

[fathom pendant]

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771

[rustic sage]

you really think I am rushing through it

[fathom pendant]

Well it wasn't reproducible

[rustic sage]

XD

[fathom pendant]

So message support ig

[rustic sage]

that is fine that is supposed to be the event id

[fathom pendant]

Since others aren't able to reproduce the case where the event id isn't populating

[rustic sage]

4771 but it is not populated and he sent me a screenshot and covered the date

like I also have 4771s but they are from the old date

and are mostly dc2 related

so I dont know if his are from the newer date or older date

[fathom pendant]

@autumn pilot ease this man's worries

Since he's convinced he's being psyoped regarding this

[autumn pilot]

hint - keep it simple

[rustic sage]

I am not convinced but like why the poor communication I dont get it, keep it simple is not a hint I have followed every single step of the instructions, anyways

[autumn pilot]

Erratum is channel created to report issues within the content, the topic you raised in #1234357888114364508 is not an issue with the machine

[fathom pendant]

Mods aren't staff and aren't obligated to give you any hints

[rustic sage]

alright anyways

[autumn pilot]

Additionally, you can use the discord search feature to look for students that have had similar questions related to the exercise/section which you can use for your advantage

[rustic sage]

it is what it is

[autumn pilot]

Currently you are not accepting neither the feedback, nor the hint to keep it simple and that won't yield you with anything to solve the exercise

When you get stuck with a question/exercise a rule of thumb is to ask an appropriate question on how to get yourself unstuck

The more one pushes himself into developing a question and expressing what he has tried will result in getting unstuck and running through the exercise

[sharp pike]

looking for some help on the "Using Metasploit Framework" modules - on two different questions & machines msfconsole is failing to launch the exploit, nmap & ping scans fail to get any traffic back. I have respawned the machines several times & tried on various different days - am I missing something other than a technical glitch?

[rustic sage]

the problem is the same question was asked by others

and was also not helped with in a helpful way

like I am trying to get unstuck

I look in the security logs of windows

and nothing, I followed every step

[wraith pelican]

kinda hard to say... which sections? most likely if the problem persists even after respawns and several days interval, it should not be an infrastructure issue

[sharp pike]

module/39/section/415

[wraith pelican]

deargod, i need a map now

[fathom pendant]

Module name is better than the endpoint uri

[autumn pilot]

If you are not finding the event, then you are missing a step

[sharp pike]

sorry new to this

[rustic sage]

okay, so I copy and pasted the script, I imported it as a module

[sharp pike]

Using the Metasploit Framework > Sessions & Jobs

[rustic sage]

I ran the function

it gave me the password

I rdpd into the machine with bonni

and the password

[fathom pendant]

I just did it and it worked for me

¯_(ツ)_/¯

[rustic sage]

what the heck man

[sharp pike]

i set all my options appropriately, i alos cant even navigate to the webpage for the machine

[fathom pendant]

S...4 Is her password

[rustic sage]

yes I know

I rdp

with that password

[wraith pelican]

i'm spawning the box...

[fathom pendant]

Did you spell her username right? bonni not bonnie

[rustic sage]

yes bonni

[fathom pendant]

¯_(ツ)_/¯

[rustic sage]

I will send you a screenshot

[fathom pendant]

Well it worked on my machine

I right clicked security, filter view entered in 4771 and boom there it was

[rustic sage]

as you can see, about to do it again

[fathom pendant]

After it fails, switch the user to htb-student and then log in?

[rustic sage]

yes

and go to security event of microsoft

I mean windows logs

[fathom pendant]

idk what to tell you man ¯_(ツ)_/¯

[rustic sage]

so now I go to the events

[wraith pelican]

from here i see the webpage

[sharp pike]

yeah i just DL a new VPN pack, cant even connect now

this is the issue i'm having on multiple MSF modules

[fathom pendant]

Did you close your old vpn connection?

[sharp pike]

yes

and restarted the machine

[rustic sage]

as you can see nothing for today's date

and not of these are for bonni

[wraith pelican]

did you manage to look at the webpage source code to know which exploit to use?

[fathom pendant]

Well yeah

[sharp pike]

not when my VPN was working - page unreachable

[fathom pendant]

Change vpn regions, reset the target, try again

[rustic sage]

got you

will do that, should I try American servers?

or EU will do?

[wraith pelican]

first thing is to get your vpn working so you can connect to the box.

[sharp pike]

tyring the pwnbox now

[autumn pilot]

Use FQDN instead of IP

[fathom pendant]

That can go in vhosts

But it doesn't have an fqdn for this section

Just ip (10.129.x.x)

[sharp pike]

yep

sorry yall, I guess Elon is clogging all my traffic today, its taking forever for a pwnbox to spawn

[fathom pendant]

¯_(ツ)_/¯

Pwnbox usually takes a few minutes

[dim wolf]

thanks obama

[wraith pelican]

maybe also try to killall openvpn

[sharp pike]

no processes found still getting hung up on the link remote - I think I'll just try again later

seems to be some issue with my connection

[rustic sage]

yeahhhh I give up

I just changed servers

did everything

and still nothing

wasted way too much time on this, idk how yall got it but kuddos to you

[fathom pendant]

Weird that it's not working for you

I literally just did the steps

[rustic sage]

me too

idk

[fathom pendant]

Signed in as Bob--> attempted to sign in as bonni on DC1 --> signed in with htb-student

[rustic sage]

exactly

that is what i did

which vpn server are you on?

[fathom pendant]

Eu 1

[rustic sage]

I am doing it through pwnbox

and I am on UK

so literally almost the same

[wraith pelican]

but still you can connect here so... maybe try udp or tcp, change region

[fathom pendant]

I did it on my own vm, but I'll spin up pwnbox just for you

[rustic sage]

thank you, it it is the pwnbox issue I hope I dont crash out XD

[fathom pendant]

I even reset the target so it's not just pulling from what I just did

[rustic sage]

thank you XD

[fathom pendant]

Gonna have to call it skill issue buddy... UK pwnbox, Eu1 academy server, fresh instance

[rustic sage]

what am I doing wrong

[fathom pendant]

You're specifying DC1 in the connection and not the IP correct?

[rustic sage]

I AM SUPPOSED TO BE SPECIFYING DC1?!

[fathom pendant]

YES

[rustic sage]

I am specifying the IP of DC

[fathom pendant]

You're literally told to authenticate to DC1

[rustic sage]

DC1 172.16.18.3

[fathom pendant]

Use the name

Not the IP

[rustic sage]

what is the difference tho

[fathom pendant]

Brooother

[rustic sage]

they are related

literally each points to the other

[fathom pendant]

The way that they're routed even though they resolve.

You're told DC1 use DC1 not the IP

Otherwise it might generate a different error

[rustic sage]

I hate it

I SPENT more than 2 hours

on this'

[fathom pendant]

In short: when they tell you a hostname to use: use the hostname

[rustic sage]

just for the thing to be DC1 like bro in the document it says DC1 ip is 172.16.18.3

I am done

thank you, I appreciate it

this is the weirdest thing I have had to deal with

[fathom pendant]

Note that it didn't even do the "connecting to"...

[rustic sage]

it really did not

anyways, I would like to appologize to the mod @autumn pilot for being rude, I know you were trying to be helpful, these kind of things are just frustrating and you closed the ticket out of nowhere so I got frustrated, I am sorry for being rude to you

good night yall

thanks to everyone who helped

May God reward you all and bless you abundantly

[earnest imp]

hello everyone

[fathom pendant]

It's just how authentication is handled with Kerberos. When you specify DC1 you're specifically requesting access through auth protocols to DC1, when you use IP it is using basic authentication

[earnest imp]

I'm doing the "Working with IDS/IPS" modules and I'm blocked in the "Snort Rule Development" chapter

I checked in the forum for some help: https://forum.hackthebox.com/t/working-with-ids-ips-snort-rule-development/305483

however, it seems I need to do a lot of guessing to find the good keyword.

[fathom pendant]

It's generating a logon failure instead of an audit failure

Instead of going through Kerberos, it's going through NTLM

[earnest imp]

I understand the key is inside the user agent but I tried someone without success

[cedar yew]

hi all,

I'm trying to get all domain information from the terminal with bloodhound, but my command doesn't work.

[wanton idol]

whats the error

[cedar yew]

my command

bloodhound-python -d INLANEFREIGHT.LOCAL -u user -p 'password' -c all -dc ACADEMY-EA-MS01.INLANEFREIGHT.LOCAL -ns 10.129.152.122

[cedar yew]

Traceback (most recent call last):
File "/usr/bin/bloodhound-python", line 33, in <module>
sys.exit(load_entry_point('bloodhound==1.7.2', 'console_scripts', 'bloodhound-python')())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/bloodhound/init.py", line 308, in main
ad.dns_resolve(domain=args.domain, options=args)
File "/usr/lib/python3/dist-packages/bloodhound/ad/domain.py", line 698, in dns_resolve
q = self.dnsresolver.query(query, 'SRV', tcp=self.dns_tcp)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 1364, in query
return self.resolve(
^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 1321, in resolve
timeout = self._compute_timeout(start, lifetime, resolution.errors)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 1075, in _compute_timeout
raise LifetimeTimeout(timeout=duration, errors=errors)
dns.resolver.LifetimeTimeout: The resolution lifetime expired after 3.105 seconds: Server Do53:10.129.152.122@53 answered The DNS operation timed out.

[wanton idol]

do u have the ms01 in your hosts file?

[cedar yew]

10.129.152.122 INLANEFREIGHT.LOCAL

[rustic sage]

makes sense

thanks for explaining

[next bronze]

Read the error message, it says dns timed out

check -h on the relevant arguments to dns

[quasi wave]

hey I solved two questions out of three. I went back to do updated information gathering web edition module stuff that got added. It turns out I was able to solve questions one and three of the fingerprinting section. The thing is I need to know why the following is not working

┌─[✗]─[htb-ac-605555@htb-vcrprdkg31]─[~]
└──╼ $curl -I http://10.129.190.67
HTTP/1.1 200 OK
Date: Thu, 27 Jun 2024 21:09:04 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 16 Aug 2021 18:15:18 GMT
ETag: "b8-5c9b12f02857c"
Accept-Ranges: bytes
Content-Length: 184
Vary: Accept-Encoding
Content-Type: text/html

or this

─[htb-ac-605555@htb-vcrprdkg31]─[~]
└──╼ $nikto -h 10.129.190.67 -Tuning b
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          10.129.190.67
+ Target Hostname:    10.129.190.67
+ Target Port:        80
+ Start Time:         2024-06-27 16:10:08 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /: Server may leak inodes via ETags, header found with file /, inode: b8, size: 5c9b12f02857c, mtime: gzip. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
^[c+ OPTIONS: Allowed HTTP Methods: POST, OPTIONS, HEAD, GET .```

etc. It will not give me content management system

and its not wordpress. I tried curl -I http and curl -I https

[topaz zenith]

are we allowed to ask a question about the Pentesting Exam?

[quasi wave]

can someone give me a clue as to what I'm doing wrong?

[quasi wave]

depends. if its for someone to help you with actual exam then no

[dim wolf]

you can ask, but the responses will depend on what you're asking

[topaz zenith]

Not even gonna waste my time

[wraith pelican]

did you visit the website?

[quasi wave]

yes

which is http://10.129.190.67

it won't connect to app.inlanefreight.local

I tried app.10.129.190.67 and app.inlanefreight.local

only thing that returns a web page is http://10.129.190.67

not http://10.129.190.67, not https://10.129.190.67

not http://10.129.190.67/app

and so on and so forth

I tried dirb on it and couldn't find anything

[next bronze]

did you add it to your hosts file?

[quasi wave]

no how do I do that? should I just google it?

[wraith pelican]

If I remember correctly, just have a look at the website and you’ll find the cms.

[quasi wave]

ok

[next bronze]

he didn't add the vhost to the host file, this won't help

[next bronze]

brother

how many modules in the path have you done

[dim wolf]

isn't this like

Information Gathering - Web Edition stuff

[dim wolf]

you're taught how to add vhosts from that module iirc

[quasi wave]

four or five

[quasi wave]

ok I will look that up then since it sounds like I just need to review it

[dim wolf]

which module is this

[wraith pelican]

You are right. I wasn’t remembering it well.

[next bronze]

it's this

[dim wolf]

huh

[dim wolf]

yeah it should teach you then

[next bronze]

@quasi wave review this section pls

[quasi wave]

solved it

thank you

[timid tangle]

module/112/section/1066
footprinting

can't find the login for the ftp

[next bronze]

pls provide the section name instead of number

[dim wolf]

should be Footpringgle

[timid tangle]

figutred it

[next bronze]

Footpringgle

[timid tangle]

don't worry i found out what it was

[next bronze]

ok nice

[dim wolf]

nice

[next bronze]

footpringles?

is that a new flavour

[zealous rune]

hi. I am reading Pass The Hash section in Password attacks. In the subsection "Pass the Hash with Powershell Invoke-TheHash(Windows)" subsection I com accross this sentence:
Local administrator privileges are not required client-side, but the user and hash we use to authenticate need to have administrative rights on the target computer

It's not clear to me why the hash we passing must have admin rights...? Is it just to do with the commands we want to run- i.e. add users into local admin or use a socket to connect back with reverse shell?

but surely we can just run cmd.exe regardless of whether the hash we authenticate as has admin privs?

[fathom pendant]

You can run cmd as any user, however some commands can only be run as admins

[zealous rune]

thx. thats what i figured. The sentence is a little confusing. It seems to imply that you need to have captured the hash of an admin user in order to use the tool on the target. But I'm guessing I can pass it a hash of a normal user as long as i am not trying to run something on the target that requires admin privs

tool in question is Invoke-TheHash

[fathom pendant]

No

Not that I'm aware of at least

[zealous rune]

i'll see if i can test

[fathom pendant]

But it also depends on what subprocesses are required

[zealous rune]

yeah maybe the tcp-connect socket perms

[next bronze]

specifically the techniques used in that repo to get shells do require admin

[fathom pendant]

Impersonation shenanigans

[next bronze]

generally all the exec methods need admin

[fathom pendant]

Runas (but better)

[zealous rune]

ok that makes sense

now the sentence makes sense

so the functions used by Invoke-TheHash requires admin privs

thx for clarifying

[next bronze]

only the *exec methods

those are used to get a shell

[zealous rune]

Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username julio -Hash <..> -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose

looking at this. Invoke-SMBExec is a function being executed on the client and not the target?

obv. the command "net user... " requires admin privs

[fathom pendant]

The /add part requires admin

[wary tendon]

hello does someone have a moment to tell me why this password is not working i can screen share if someone doesnt mind. pillaging chapter in window priv esc module

[zealous rune]

yeah that for sure given it's the admin group

[wary tendon]

question 5

[fathom pendant]

It's being run on the target ip

[zealous rune]

but we can replace that with cmd.exe and wonder if it works

[wraith pelican]

“Administrative rights are permissions granted by administrators to users which allow them to create, delete, and modify items and settings"
Found that here, wasn’t clear for me either reading that sentence : https://kb.iu.edu/d/army

[zealous rune]

yeah the command is run on the target machine. think best i play with it

[quasi jungle]

Asking again.
https://academy.hackthebox.com/module/136/section/1291
Try to read the source code of 'upload.php' to identify the uploads directory, and use its name as the answer. (write it exactly as found in the source, without quotes)

Managed to read flag.txt with XXE in svg.

Tried to use XSS in XML to read upload.php
Tried to use XXE to read /var/www/html/upload.php

[rustic sage]

if you try to curl it do you see source code?

[quasi jungle]

I see the html on the main page.
visiting /upload.php returns "Only SVG images are allowed"

[rustic sage]

Im new so this was the idea i had, but can't really help more than that. Hope you figure it out.

[next bronze]

they're asking for a hash, not a password

[rustic sage]

bro did you try to load the page in your browser and right click/view source?

[fathom pendant]

Then upload a "svg" image

But also can you visit upload.php directly?

[quasi jungle]

Yes

[quasi jungle]

I did and then it redirects to home.

[quasi jungle]

Yes, it just returns a error "Only SVG images are allowed"

[fathom pendant]

Can you catch the requests?

[rustic sage]

maybe this help?

[fathom pendant]

Note this is an ai generated response

So mileage may vary

[rustic sage]

correct

[oak hollow]

hey! were you able to get any nudges? Im stuck on the otp portion right now

[quasi jungle]

Already tried.

[grizzled schooner]

shells and payloads - infiltrating linux: trying to find a way in, --script=vuln threw an RCE for apache my way, but when loaded in metasploit it tells me that it's not vulnerable?

[fathom pendant]

You're focusing too wide

[next bronze]

you can use xxe to read flag.txt, change it to read the source code

the other payload in the section is useful

[grizzled schooner]

focusing too wide?

[fathom pendant]

Yes

[grizzled schooner]

I saw that lol

[fathom pendant]

Apache isn't what's vulnerable here

Did you look at the webpage?

[grizzled schooner]

Honestly, no... lol - I've been trying to get into a habbit of not using metasploit for everything and instead looking for what --script=vuln returns as a download and read through the configuration and use it as opposed to being a "script kiddie"

but I'll give that a look

[quasi jungle]

Tried to read /var/www/html/upload.php and /var/www/upload.php

Didn't exist

[next bronze]

how do you know that that's the full path?

[fathom pendant]

Just relying on nmap --scripts=vuln is also being a script kiddie

[next bronze]

why not just use relative path

[fathom pendant]

You need to be able to figure things based on multiple tools as nmap's output even tells you it can be wrong

[quasi jungle]

Going to try that, in the other challenges the flag was usually placed at root so presumed it to be the same

[fathom pendant]

Or it can throw some vuln at you that's entirely unrelated

[grizzled schooner]

oh no absolutely marcie, it's just the first step of a mental "process" that I've been trying to get myself into, sort of developing a methodology that works for me and makes sense

Idk if I explained that right though

[fathom pendant]

Things to note: what ports are open. Always start investigating those

80/443? Let's look at it in a browser

[next bronze]

full path also works, just tested

[grizzled schooner]

usually, I'll do nmap -sCV -T4 <ip> as a base, and then run --script=vuln, if nothing comes back I'll navigate to the website and wappalyze for a version to look up and go from there, guess that's why this one threw me off

[oak hollow]

@fathom pendant im gonna be like you when i finish this course and exam and just help people i feel like this is a huge way to learn yourself and give nudges to others youre so helpful

[fathom pendant]

Well it sounds like you didn't even look at the website

Always think: "if it's complicated, is there a simpler way"

I.e. if it's a wide vuln (i.e. apache as a whole) then there must be something simpler

If you see an underlying web service is the vuln thrown back: assume that's not the path forward (unless specifically tomcat, but tomcat is special)

[quasi jungle]

Yeah now it worked.
Probably was doing a stupid mistake at the time like having an extra /.

[wary tendon]

so i was able to get to where the sam and system file are but i cant copy it over

asks for destination

[wary tendon]

Copy-Item -Path C:\Windows\System32\config -destinaton \10.10.14.122\fismathack

[fathom pendant]

Your error is saying positional parameter not found

You basically gave it 3 parameters

[wary tendon]

what should it look like?

[fathom pendant]

Your command here and what you showed are 2 different commands

[wary tendon]

tht was an example i had to fill in my own info

but destination was in there and im not sure what im supposed to put

[fathom pendant]

Copy-Item -Path (path to thing you want to copy) -Destination (your remote share)

If you can't see what's different between your command and what's expected take a minute to read

[sterile solstice]

i need some help on the Socks RDP part.

i have the following chain:

me --> pivot1 (win) --> pivot2 (win) --> victim.

i have the SocksRDP dll running on pivot1, and I'm in pivot2. i need to get the SocksRDP-server.exe to this host, but i'm stuck on the best way to transfer it?

nevermind, i used a base64 string generated in my VM, then copy/pasted into the RDP session....was one hell of a string given its size lol

im very interested in how others do it as i'm not sure that'd always work (particularly if clipboard is disabled)

[random crater]

at the risk of sound dumb, I'm not sure the public exploits intro module works.

but i'm all ears if anyone has ideas.

[dim wolf]

it works

[oak hollow]

if someone has done the broken auth module skills assessment can I PLEASE get a nudge - i went through forums and got a nudge but I think I just am missing a SMALL piece to get the flag.. and this is the LAST skills assessment before i 100 percent the course hehe

or im dumb idk take your pick - super close or super dumb - never really know with these skills assessments 🥲

[random crater]

@dim wolf - Was your "it works" directed at my comment?

[dim wolf]

yea

[random crater]

Could I dm you quick?

[dim wolf]

nah i'm doing the exam rn

[random crater]

good luck

[oak lance]

I'm still on INFORMATION GATHERING - WEB EDITION Skills Assessment.
I've fuzzed vhosts and found another subdomain and added it to my /etc/hosts file. I've just tried fuzzing both the parent and subdomain to find the hidden admin directory as mentioned in Q3 but I can't find a wordlist that works. I've tried directory-list-2.3-medium.txt which was in the FFUF module, as well as raft-small-directories-lowercase.txt which was mentioned in the old cheat sheet for this module. Does anyone have any suggestions as to a suitable wordlist? I can't see any examples of directory scanning in this module (other than using the Scrapy module which turns up nothing).

[blissful elm]

oh boy pwnbox is updated

[fathom pendant]

think about robots

[vast forum]

but there is not update in my pwn

[fathom pendant]

what question are you asking for?

Q3?

[vast forum]

what's going on here??

[oak lance]

Yes. I've found that now. Thanks. I only need to answer the final question as this is a re-do with the updated module but trying to work through the full assessment

[fathom pendant]

ah the final question

[limber river]

don't overcomplicate thing , the tool you need is in the module with the suitable wordlist , enumeration is an iterative process so you may need to redo the technique to find new things

[fathom pendant]

you said you found a subd of a subd?

spider that second one

[limber river]

re-do it from scratch

[fathom pendant]

and since it's meant for future; it'll be in a comment

you can actually cat the json file and pipe it to cat results.json | jq -r '.comments'

(jq -r '.key')

[limber river]

smart

[fathom pendant]

ReconSpider (HTB) is a nifty tool

[oak lance]

I was doing the assessment from scratch, but I can't enter any answers except for the final one. I'd looked for robots on the parent domain but had forgotten to retry after discovering the subdomain. That HTB ReconSpider (I'd searched online and found another tool of the same name), is going in my toolbox for future crawling.

[limber river]

I know , I was in the same situation

[limber river]

if you can't find the robots.txt in that domain , then you are in wrong domain (the question guide to look for robots.txt)

[fathom pendant]

The GH one by the same name is completely different and requires a paid API key from what people have said

[fathom pendant]

that's for Q3

[limber river]

that's for the whole assessment

[fathom pendant]

i mean using robots.txt is pretty standard for most web related hunting anyway

but is there a robots .txt in the other one?

[oak lance]

No

[fathom pendant]

it's just a chain of clicks

with a surprise in the comments on one of them

[oak lance]

That's what stumped me. I'd got that hint and looked on the parent domain. Forgot after I found the subdomain because it had taken some time.

[fathom pendant]

yeah ReconSpider (HTB) makes quick work of crawling it's way through the silly links

[limber river]

👀

[random crater]

if I give htb money, will the vm performance improve?

or is it always like using dialup?

[cloud urchin]

what?

[random crater]

give htb money*

[cloud urchin]

no, all the environments are the same as far as i know

[random crater]

so its always this slow?

[cloud urchin]

i haven't really experienced that so not sure what you're talking about

i've seen services down once in a while, but nothing i would consider slow for what it is

what module are you working on?

[random crater]

there's a noticable 1-2 second lag between key presses.

[cloud urchin]

oh yeah i don't have that idk

[random crater]

I just started. the public exploit one.

[cloud urchin]

not sure which module that is

many modules contain public exploits

[random crater]

yea. sry. its called 'public exploits'

[cloud urchin]

that is not a module on the academy platform

this channel is for academy, are you talking about a box on the other platform?

[random crater]

module/77/section/843 in the academy

[cloud urchin]

you should just link it or say the actual name of it

i have no idea what module that points to

[random crater]

https://academy.hackthebox.com/module/77/section/843

[fathom pendant]

are you referring to the Getting Started Module; Section Public Exploits

[random crater]

^^

[cloud urchin]

how long did you wait before trying to connect?

[random crater]

idk. I didn't pay attention.

[cloud urchin]

it can take ~3-5 mins for the environment to fully spawn, and sometimes more i think depending on the module and how big the env is.

[random crater]

its up and running. just terrible lag

[cloud urchin]

you can try changing regions maybe

[random crater]

but, from the instance url, looks like im proxying through uk cloud instance

[fathom pendant]

changing pwnbox regions can have an impact on your perceived performance

the pwnbox region will display estimated latency in ms next to its location

[random crater]

I don't see a way to change regions

fml. disregard

ty.

from ux/ui perspective, I'd moving these things closer together.

but... i know now.

[fathom pendant]

well there's 2 things, vpn region and pwnbox region

they are separate things

[random crater]

yup

I'm used to using a tool a called 'immersive labs'. have adjust to this.

[fathom pendant]

you can also just use your own vm (if you have the resources) you can install parrot with as little as 5GB RAM

[random crater]

can I use kali? have that already in a vm.

[fathom pendant]

Yep

you just need to download and run the ovpn file (for the modules that require it); if the module is a public_ip:port, it doesn't require it

you only need to run the openvpn file once per session. You don;t need to run it for every module, and you can reuse it until you change regions due to some issues

[clear zephyr]

fixed it my VM was just out of date

[fathom pendant]

that can also cause issues lol

just rememebered to run my monthly update

[rustic sage]

https://github.com/fortra/impacket/blob/master/examples/mssqlclient.py is this the same mssqlclient as the one that is included with parrot os?

[fathom pendant]

yes it's the impacket one

[rustic sage]

ty

[clear zephyr]

In the module the command needs to be changed to this:

for ((i = 0; i < ${#hexRandom}; i+= 2)); do echo -n "0x${hexRandom:$i:2},"; done | sed 's/.$//'; echo

It was also missing the ";" before the "do echo"

[fathom pendant]

put it in #1234357888114364508 ¯_(ツ)_/¯

[clear zephyr]

Oh is that what that channel is for? I mostly put in here just incase someone get's confused and they search it in discord

[fathom pendant]

If it's in erratum academy staff can see and fix it so it doesn't get drowned out

[rustic sage]

In footprinting module mssql section I connected to the server with provided credentials but when I try to enumerate the databases with enum_db i just get an empty output and return to prompt, is this normal or a technical issue i have to figure out? this is using mssqlclient.py and i did install requirements.txt

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/158

now for AD Enum & Attks .... 7days for that module....damn

[fathom pendant]

mssqlclient should already be installed if you're using the pwnbox

if it's behaving weirdly try sudo pip install impacket --reinstall --break-system-packages

[rustic sage]

I am running it on another distro, maybe cuz it's in a venv, i tried running that command but it's not recognizing the syntax. Definitely seems like a me problem, gonna keep trying to figure it out. As long as i know it's a technical issue I'm cool with debuggin

[fathom pendant]

is your venv running a different python version?

[rustic sage]

Python 3.12.3

[abstract jacinth]

Hello everyone

[warm lynx]

Hello everyone!

[gusty cloak]

am i cooked, why isnt this showing me the databases?

[rustic sage]

i have same problem exactly wtf

[fathom pendant]

reinstall impacket?

[gusty cloak]

already did

[rustic sage]

same

[gusty cloak]

academy low key pissing me off with all these little issues

[fathom pendant]

also you can do pip install impacket instead of installing from repo

[gusty cloak]

i have used pip and grabbed the python version from github

[rustic sage]

i did that and even recreated a whole new venv

I followed the instructions from impacket readme, hard to go wrong

[fathom pendant]

works on my machine

[gusty cloak]

i just remoted into the machine with RDP

to get it, what a joke

[rustic sage]

alright will keep working on it

[rustic sage]

curious that we have the exact same issue, wonder why

[rustic sage]

ah am using Python 3.12.3 this might be the prob

can try

[fathom pendant]

if it is it's an odd problem, but not unheard of ¯_(ツ)_/¯

[gusty cloak]

same version of impacket, trying your exact version of python now

[rustic sage]

aye it should be backward compatible

[fathom pendant]

python isn't always backwards compatible

[gusty cloak]

spent an hour thinking i was an idiot

[fathom pendant]

even between same major versions

something that works in 3.11.x might not work in 3.12.x

[gusty cloak]

rdp works

same issue oin python 3.11.2

[rustic sage]

strange

[rustic sage]

when you try to run enum_users does it crash?

[gusty cloak]

yes

[rustic sage]

same

problem with a py file in the libraries

[fathom pendant]

sudo pip uninstall impacket
sudo pip install impacket ?

it's weird issue though and can't replicate on either pwnbox (which has it's own issues) or my own vm

are you running kali?

[rustic sage]

/lib/python3.12/site-packages/impacket/tds.py is the precise file that crashes

printColumnsHeader is the function

[gusty cloak]

sudo pip uninstall impacket

[rustic sage]

i tried a completely fresh virtual environment and same

[gusty cloak]

works after a reinstall🤦‍♂️

[rustic sage]

wtf?

[gusty cloak]

but didnt work in a virtual env

wonder if somehow switching to that specific version of python and reinstalling fixed it

[fathom pendant]

well if it's a base problem it's likely something up with the base pip environment

when you use a venv it defaults to basically copying your current pyenv

[rustic sage]

noted, i need a coffee for this

[fathom pendant]

when you uninstall then reinstall it basically calls to redownload the files

[wraith pelican]

Maybe use pipx?

[gusty cloak]

no idea, too much of a headache to figure it out lol

cpts gonna take a year at this rate

[rustic sage]

how can i get permisson to msg genrel

[gusty cloak]

I wish going through the pen tester path wasnt required to take the test

[wraith pelican]

I think that’s why I’m packet is already installed on parrot and kali, it might be in the repos? I would have to check that…

[gusty cloak]

I used the latest from python script from github though

[fathom pendant]

read and follow #welcome

[fathom pendant]

i believe there is a version you can download via apt

and you backgrounded the session, not closed it

[wraith pelican]

Maybe latest is not always best ? I see impacket 0.12 dev. It doesn’t feel like it is quite a finished product : )

[orchid sapphire]

correct

hense the session still being available

[fathom pendant]

double check with sessions -i 13

otherwise my suggestion is to close msfconsole then reopen it

basically soft reset and it'll clear any weird cache