modules

[fathom pendant]

just had to reactivate the sleeper agent

again

quit/exit msfconsole
restart it
rerun the first exploit
rerun the post-exploit

alternatively (or as well) reset the target

[orchid sapphire]

I did too lol even going the extra mile and restarting postgresql.service

brb

[gusty cloak]

I had 0.11

[wraith pelican]

yeah same here but it is installed via apt on parrot, i'll check on a kali box

same on kali, installed via apt and this is 0.12.0.dev1

what i do with python, i dont know if this is a good way, i first check via apt if a package is available and not too outdated. If not in apt i use pipx and install the dependecies via apt if possible (python3-packetname).. if not i use a pyenv for a local directory and install via pip

reading this, i think this is kinda messed up but it works...

[fathom pendant]

apt may not have the packages as well (usually it may)

apt is usually a version or so ahead of pip(x)

but it's also usually on the dev branch

[rustic sage]

Im starting to think i might save myself some grief just to run parrot os while i do the modules

[fathom pendant]

try changing vpn regions

[orchid sapphire]

aight

[fathom pendant]

also this is revealing spoilers so i suggest deleting

[wraith pelican]

what are you running? should be ok on any debian based stuff

[fathom pendant]

worked fine for me

[rustic sage]

ubuntu, but i'm starting to see it isn't the best idea. has been a hassle for the most part, and very heavy on resources

[fathom pendant]

yeah ubuntu really wasn't made as a hacking distro (you can install tools on it)

[orchid sapphire]

did you set payload to x64?

[rustic sage]

rookie mistake

[fathom pendant]

i didn't have to, msf set it for me

[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp

[orchid sapphire]

mine defaults to x86

hmmm

[fathom pendant]

but it still went through

¯_(ツ)_/¯

[orchid sapphire]

I literally get that same message too when using the x86, but the only reason im required to change is for post/exploit

which breaks x64 exploit

for uknown reasons

going to try something new

[fathom pendant]

throwing yourself out the window? wouldn't advise that

[rustic sage]

if i just get stock debian and install my own tools would that do the trick?

[fathom pendant]

they might not all be in the stock debian repos

kali and parrot are both Debian derivatives

[wraith pelican]

anything works, depends on if you want to install everything you might need

[fathom pendant]

and come with a fair bit preinstalled

also you're never gonna have "all the tools" there's always some new tool or something to find that does a thing you want

[rustic sage]

I like the idea of starting with a blank slate and building my own custom os sorta thing

[orchid sapphire]

Achievement Unlocked: God Speed

[fathom pendant]

have fun spending hours finding and installing the tools you want/need and troubleshooting

[orchid sapphire]

no I went and changed from TCP to UDP and vise-versa for the vpn

that didnt work either

[fathom pendant]

god speed sp0derman

[rustic sage]

i could always get parrot and customize that instead, for the sake of saving time. thx for the advice guys

[fathom pendant]

did you try restarting your vm/machine altogether?

as a note: for exploit 1; set RHOSTS and LHOST
exploit 2: LHOST and Session

[wraith pelican]

yeah i can understand that, i feel like parrot is awful visually out of the box. But it could be a side project to build your own distro. if you are on the cpts path, you may want to focus on that and not on this

[rustic sage]

great advice. project for later.

[fathom pendant]

i had fun building out my own PS1 for terminal

[orchid sapphire]

essentially i already know what i'm doing to get the flag but my sessions are dumbaf can somone just pass the flag (dm) because im just burning a hole in my brain

[fathom pendant]

:D

[orchid sapphire]

I would advise looking into shells and wrapper for them if your looking for cosmentics or functionality

otherwise parrotos is great

[fathom pendant]

nah i just wanted to do something silly

[fathom pendant]

out of curiosity what's your msfconsole -V output?

[wraith pelican]

yeah me too! it switches the ip if i got a vpn or local networks... i was quite proud of my bash scripting prowess

[rustic sage]

nice

[fathom pendant]

ah your version is ahead of mine

[orchid sapphire]

im on arch

[fathom pendant]

that tracks (parrot opts to be slower to be on latest version for stability)

kill your vpn and try with pwnbox

i would hate to be like "just reinstall msfconsole" but it might come down to it man

o7 worst case is reinstalling whole OS

[orchid sapphire]

hmmmm usually arch repo is good about release stable packages which im using the stable repo compared to their testing repos

[orchid sapphire]

lmfao i already did

[orchid sapphire]

this is my main lol thats why im frustrated

[fathom pendant]

yeah

this is why it's recommended to do this shit in a vm lol

easier to scrap and start over a VM

just backup files to Host and then fuck off :D

[orchid sapphire]

true but when i can spin up a vm on the spot my main patches the timeframe and i just got bored between im free hours

[rustic sage]

timeshift?

[orchid sapphire]

but yea this is fucky. cant because F2FS doesnt support timeshift or something about it

[wraith pelican]

man running bare metal arch but metasploit fails.... on parrot script kiddie it works,.,,, that's a good morning irony : D

tho i might not be os related, what changed since your last working msf reverse shell?

[sterile solstice]

did some of the modules go up in price? theres one I wanted to buy that i swear was 500cubes but is now 1000. unless im mis-remembering lol

[fathom pendant]

only if it changed tiers for whatever reason

but the overall module prices haven't changed

[sterile solstice]

nah, same tier. i must have been thinking about another 1 then. (I have a few wishlisted.)

[orchid sapphire]

what's the fastest way to get cubes (FREE methods)

[fathom pendant]

all modules of the same tier are the same price

[fathom pendant]

git gud

compete in the CTFs

[sterile solstice]

yea i want to eventually get the OSINT module which is tier4. it hasnt changed tiers.

[fathom pendant]

yeah t4 has always been 1k

[rustic sage]

I find the modules more than fairly priced for the content.

[fathom pendant]

that's HTB's main mission statement, they haven't even adjusted for inflation since they released certs

the subs and cert prices have been the same

[sterile solstice]

its a great price for all of it tbh

[rustic sage]

glad to be here

[sterile solstice]

ill eventually get my OSCP but the cost for OffSec is crazy...

[fathom pendant]

g0blin has said they don't plan on changing that any time soon

[sterile solstice]

thats good. ive recommended it to a lot of ppl as its good content especially for the price

[wraith pelican]

you might also want to debut it before reinstalling everything
https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html

[fathom pendant]

debug*

[wraith pelican]

thank you that recent keyboard is a mess of sensitivityy

[stark lark]

CME works fine, but Hydra is throwing errors. What could cause this?

[glass quail]

hey does anybody know why my hints won't pop-up it just resizes the screen?

[fathom pendant]

could be smbv2 issues

iirc hydra doesn't like it

[fathom pendant]

adblock/pop-up blocker?

[limber surge]

Using what you learned in this section, try attacking the '/login.php' page to identify the password for the 'admin' user. Once you login, you should find a flag. Submit the flag as the answer.

[wraith pelican]

yeah well, i'll let that there, we never know

[fathom pendant]

might be a long shot, but did you try using the techniques taught in the section to attack the /login.php page

[oak lance]

Thanks. Finally got that module complete. The hint on the API key led me off a false trail trying to do things with the hash.

[fathom pendant]

yeah ReconSpider kinda stronk (for simple things)

props to PandaSt0rm for the simple things :)

[glass quail]

Thats what I was thinking but it has worked before I will try messing with that thank you

it was set to allow this time I whitelisted hackthebox too

same result.. Is there a way I can bring it up by inspecting the page?

I can see it activating when click the button but won't show on the page

[fathom pendant]

message support

[abstract jacinth]

Hello everyone

[glass quail]

ok

[glass quail]

hello

[fierce island]

Did you solve it? I only came as far as that part yesterday. I think I have an idea of a potential avenue though.

[round moat]

After spidering inlanefreight.com, identify the location where future reports will be stored. Respond with the full domain, e.g., files.inlanefreight.com.
Am not getting any answer for this
I have used : python3 ReconSpider.py http://inlanefreight.com

[wraith pelican]

is your results.json file empty? do you get errors when using the tool?

[round moat]

yess

its results.json is empty and i did get error

[wraith pelican]

is there anything in the error messages that can help you figure out what might be the issue?

[round moat]

I send u on dm

[past kite]

Hey guys
I can’t open this files after download

[karmic girder]

hello guys

I'm stuff in INFORMATION GATHERING - WEB EDITION - Skill assessment

i found the path of admin but can't access this

any hints?

[round moat]

did someone solved the scrapping part from Information Gathering -> Web Edition

[past kite]

Hey guys
I can’t open REPORT EXAMPLE files after download

[karmic girder]

wwhich one?

[round moat]

this one

[robust quartz]

Maybe you should try another method of enumeration

[wraith pelican]

you should remove the directory name, because it spoils it for others

[robust quartz]

Like subdomain enumeration, vhost enumeration

[karmic girder]

okay

[wraith pelican]

did you update your /etc/hosts file with the newly discovered directories?

[karmic girder]

yes

or i must update the path admin in it?

[wraith pelican]

no

[wraith pelican]

you are nearly there if you got the directory and the correct subdomain. try to see if there is anything you can add to the address that would signal it is a directory you are looking for

[spark spruce]

If you still can't find the answer
DM

[rustic sage]

@karmic girder you're looking to find other subdomains, you will want to enumerate to find those and work from there. Basically, find subdomain, crawl the path, and work from there. If you've done enough to find something after crawling the inlanefreight.htb base domain and nothing is there, chances are there may not be something there. So look to discover new subdomains and repeat the process

[karmic girder]

another one from w.... ?

[karmic girder]

XD

[rustic sage]

👍

[lofty shore]

Does anyone else have connectivity issues working on labs/exercises? Is it normal for the platform? Like RDP session keeps dying and can't even ping the target for a few mins. And nmap scans get ruined when it dynamically adjusts it's timeouts to be massive after it keeps not getting responses back

[rustic sage]

Whats the response time when you ping the spawned target IP?

[lofty shore]

Atm I'm still not getting any response to ping

And I terminated it and spawned a new one. It worked for a minute and then died again

[wraith pelican]

target might not respond to ping requests. But did you try to change your vpn config file, change location, see if there is one with low load, use tcp, etc

[sterile solstice]

anyone have some suggestions on installing bloodhound on a parrot VM?

[lofty shore]

It does respond to pings most of the time, but then it dies and I can't ping it, can't connect to services any more, and sometimes it's just super slow/intermittent. Feels like it's been worse over the last few days and wasn't sure if it was common for others.
I'll try using tcp vpn
Thank you for your help

[wraith pelican]

i'm not connected to any box at the moment. Sometimes rdp can be slow, there is ways to reduce traffic from xfreerdp like:
```xfreerdp /u:anonymous /p:<password> /v:192.168.1.0 /dynamic-resolution /auto-reconnect /cert-ignore /timeout:200000 +clipboard /network:modem /compression -themes -wallpaper /audio-mode:1 ````

[wraith pelican]

there is a version in apt repos, and there is the community edition directly from specterops.

they are not quite the same last time i checked

[rustic sage]

If you're using your own VM, download a different VPN connection file and choose TCP instead of UDP for the connection. See if that helps

[sterile solstice]

i was trying to install the python version and kept going in circles. apt for the main GUI repo worked

[wraith pelican]

you are speaking about the collector from a linux host

this one? https://github.com/dirkjanm/BloodHound.py

[sterile solstice]

yea

one of the supporting modules throws a python version error. unsure how to install it using my pyenv that has 2.7

[wraith pelican]

you can set any version of python with pyenv

[sterile solstice]

yea i get that, but how do i do that with "pip install bloodhound" ?

[wraith pelican]

I used pipx to install it and i think, if I remember correctly, installing the dependencies using apt python3-<packagename>

[wraith pelican]

you can set pyenv local <pythonversion> when you are in the folder

[sterile solstice]

is pyenv local only for that specific folder youre in?

[wraith pelican]

yes

[sterile solstice]

i tried setting it to 2.7 and still get errors for python version lol

[wraith pelican]

i think so

you dont want 2.7 for bloodhound-python

the 3.11, i guess is ok, must be the one you got in your system

[sterile solstice]

one of the dependencies requires it

pipx worked

[wraith pelican]

yeah like a charm usually

[sterile solstice]

thats a new 1 for me. i havent used it before

that was a nice detour hahaha

[wraith pelican]

the thing is when you use normal pip after that, it might say: no i dont want to install because you use an externally-managed-environment

[sterile solstice]

ah, good to know

on another note, bloodhound looks pretty cool. i thought i was going to ahve to use draw.io . this looks much better haha

[wraith pelican]

yeah, it is really cool, just looking at those edges, then all the commands to exploit a path, it is really well done

[sterile solstice]

yea definitely. pretty good for FOSS as well

im sure the enterprise version is just a nicer gui haha

[wraith pelican]

with gold handles... i found there was less options in the latest CE then the one in the parrot/kali repos, but maybe i'm mistaken and i've not checked it in a few weeks

[sterile solstice]

interesting

it could be the case

i the skills assessment for AD Attacks a long one?

[wraith pelican]

i'm really not the good person to answer that question as i'm always taking way more time than what was announced on the module : )

[sterile solstice]

i did with password attacks

took me 3 long days lol

[lofty shore]

Thank you

[lofty shore]

👍 thank you

[rustic sage]

Working better now?

[sterile solstice]

i hate doing anything rdp due to the connections. if you can, try using evil-winrm. i uch prefer a cli lol

[lofty shore]

Yes I was using the Pwnbox VM they provide but seems much more reliable when I use my own

[sterile solstice]

fyi, i will sometimes switch. sometimes the pwnbox is better, othertimes my own VM

[rustic sage]

cool 👍

[wraith pelican]

for the cpts exam if that's what you do, it is better to have your own vm with all the stuff installed

[sterile solstice]

thats why im trying to use my VM as much as possible

so i dont have to troubleshoot missing tools/stuff missing.

well, that is post training i'd like to have a VM to actually do things lol

[wraith pelican]

yeah and in pwnbow i had to switch wallpaper and colors... that can also take some time : D and then there is the tmux conf and so on

[sterile solstice]

hahaha whys that? didnt like the scheme?

[wraith pelican]

haha i havent seen it in a long time but it was quite flashy if i remember correctly, green on black or something, and yellows

[sterile solstice]

yea. i actually thought it was alright. but each to their own i guess haha

[wraith pelican]

yeah totally! it s not that i found it ugly or whatever, it is just that so much screentime was killing me at the beginning of this cyberstuff journey. Now it is fine tho

[sterile solstice]

ahhh, yea that makes sense. im used to all the screentime so it doesnt worry me tbh

[candid lily]

lol new questions old answers

weird i cant submit new answers

[rustic sage]

Hi guys. Just a short question to the Navigation (Linux Fundamentals) Module. I’m stuck at the first question (it says “what is the name of the hidden history file in the htb users home directory?”) probably I’m just to dumb but I did:
SSH (successfully)
Found the file (it’s .bash_history, right?
Tried to cat it (gave an output but was a wrong answer)
And I tired to ls it (but there wasn’t any name there)

[wraith pelican]

hello : ) maybe re-read the question, or your message. It seems to me you already got your answer

[rustic sage]

ls -la

[rustic sage]

Yep already tried that

[wraith pelican]

what is the name of the file you found?

[rustic sage]

what is your current directory

Nah guys my bad

My god, I already got my answer

[wraith pelican]

[rustic sage]

Embarrassing

lmao

[wraith pelican]

that's a good one\

i'm thinking about screenshooting that

[rustic sage]

Dude I just sat here for half an hour

i didnt get it at first too when you mentioned catting that out

[rustic sage]

I thought I would need something different than the file name

Genius incoming

[wraith pelican]

and they say when you formulate a question you might click on what you are missing.... haha

[rustic sage]

Well at least I got it now

It literally says name of the file in the question

[wraith pelican]

it should be pinned

[rustic sage]

Pin it

[rustic sage]

As I said. Genius incoming

[wraith pelican]

yeah on my wall for the sad winter days... lol

[rustic sage]

Consequences of overthinking

¯_(ツ)_/¯

[wraith pelican]

that's your first question ever on the academy?

[rustic sage]

That’s me

[rustic sage]

Nah. But I think like something around the fifth

[wraith pelican]

but i feel you, the simpliest question may be hard to answer because i would think: it could not be that answer it is too simple

[rustic sage]

That was actually overthinking hardcore edition

Well thanks for your help though

[wraith pelican]

no please, thank you for the good moment : D

[wraith pelican]

this : #modules message

[muted jacinth]

@next bronze Hey dude you around?

[next bronze]

sup

[muted jacinth]

how are you?

got them DCs exept for the last one, any hints?

[next bronze]

last question?

[muted jacinth]

yeah the fabricorp DC

[next bronze]

dump things in the previous dc and check for gpo

[muted jacinth]

dump things?

[next bronze]

yeah, when you get admin on a host, dump the usual stuff and look for creds

[muted jacinth]

ty

[kind arrow]

Ahoyhoy, I am pretty new to this stuff but having fun with the Linux fundamentals. But there is a point where I try some stuff while SSH to HTB and the command-line becomes stuck? It vanishes and there is only a blinking cursor. Tryed Ctrl Z, Ctrl C and \ but nothing helps. I feel quite dumb xD

[wraith pelican]

you are still able to type?

[kind arrow]

no nothing

[wraith pelican]

i have not really experienced that, but i would think that the ssh connection died. Is there particular stuff you were trying before it happens?

[kind arrow]

last thing I tried was: htb-student@nixfund:~$ more /etc/passwd | sort

and it happened a lot when I tried ls -la in large folders

and all that happens is a blinking cursor on the far left without anything (like the htb-student stuff)

[next bronze]

you probably have a bad connection, choose a closer vpn server and use tcp

also ~.<enter> will close the ssh connection if you're stuck

[kind arrow]

I will try, thank you all

[candid lily]

why isnt this working

[wraith pelican]

is your vhost added in /etc/hosts?

[candid lily]

no

but im mentioning the ip right

[wraith pelican]

yes you did. so maybe it works like that, i don't know mate

[kindred dawn]

Hey I have a question on the metasploit module in the Evasion section (Firewall and IDS/IPS evasion). In the end it talks about archiving payloads and stuff. But if I archive it and manage to transfer it to a windows machine. I will need to unzip it on the windows machine and execute it? Im kind of lost here. I dont get what is the point of bypassing av just to transfer the file if it is going to get detected when you want to execute it... Unless if executing the archive would exec the payload. PLS help thanks...

[kindred dawn]

add vhost to hostlist

/etc/hosts

[glass quail]

server side attack skill assesment isn't as fun as the module lol

[next bronze]

it's just to keep it undetected in storage

[rustic sage]

If i am running an Ubuntu host off of a persistent usb drive and then from there run a parrot os vm to do my modules, am I asking for trouble or will this technically go smoothly?

[fathom pendant]

yes

it will likely be messy

USB is already a shaky thing to use as a storage media for your OS

as it's not meant for constant R/W and often has a lower R/W than SSD/HDD

[rustic sage]

thx for the feedback. was trying to find a shortcut, but looks like im starting from scratch

just another quick question. do I need a windows install handy to do the modules or can it all be done from linux? Thinking of maybe ditching windows and be done with the nonsense

[fathom pendant]

most of the stuff is done from linux

but i wouldn't recommend doing it on your host system

doing pentesting from your host is a recipe for trouble

[next bronze]

I'd highly recommend having a windows vm available, makes it much easier to test things

[rustic sage]

just want to set this up properly, sorry to bother with noob stuff

[next bronze]

use windows servers btw, those consume way less resources

[wraith pelican]

what do you have at the moment?

[rustic sage]

i was running ubuntu off a usb drive and it was going great installing my own tools but yesterday i got stuck trying to run mssqlclient, tried everything. so now i figure might as well just run parrot and save myself trouble with tool installs

[wraith pelican]

so you have a windows host? why not a vm?

[rustic sage]

i thought running off a usb was safer, but maybe I'm wrong?

[kindred dawn]

Although it will be detected once unarchived right?

so its only usefull for file transferring malware

[next bronze]

yes

[kindred dawn]

Alright. It's kinda pointless then 😦

I need to do the new module windows AV evasion 0_0

looks so nice :p

[rustic sage]

I was worried about someone trying to escape the vm into my host, thus running off usb

[wraith pelican]

yeah for what we do, like ethical hacking stuff, a vm is safe enough i guess

[next bronze]

running off usb would be way easier to move to the host compared to a vm

[rustic sage]

geez, looks like i was dead wrong then huh

i thought it would containerize it

[next bronze]

stuff in the usb are just regular files, stuff in the vm are contained

[fathom pendant]

^

[rustic sage]

really appreciate it guys, gonna act accordingly

[wraith pelican]

bah we may read to run tails on usb stick and move places every day... but... it is not for the same purpose

[frosty parcel]

hello, is an admin here please ? can i dm ?

[fathom pendant]

why do you need an admin?

do you mean staff?

[rustic sage]

Why?

[fathom pendant]

if you mean staff --> message support

[frosty parcel]

bc my kaspersky alerted me of trojan download on command injection module

[fathom pendant]

well if you're downloading a file onto your host instead of in the vm lots of things will trigger alerts

heuristics btw

[frosty parcel]

i'm not, i only try to go on the page

[fathom pendant]

well whitelist academy

there's nothing inherintly malicious on webpages

it's likely detecting a code block on the page as a backdoor code

meaning it's doing technically what it's supposed to

[next bronze]

it's just a standard powershell payload, the AV scans the website for potential threats and alerted you

[fathom pendant]

if you whitelist *.hackthebox.com/ on kaspersky you're fine

but discord admins aren't staff

[wraith pelican]

is it possible your AV is reading the page content?

[fathom pendant]

yes, it is

it's a similar thing to taking notes and your AV detecting your notes as having malicious code

it's detecting the text itself as malicious code

which is funny

[frosty parcel]

ok i will, thanks !

[candid lily]

i cant find any subdomains or pages

[fathom pendant]

are you using ip:port?

or inlanefreight.htb:port?

what does your /etc/hosts look like

[candid lily]

ip:port

[fathom pendant]

try adding the ip to your /etc/hosts

[candid lily]

how does that make any difference

anyways i have it in my hosts file

[fathom pendant]

then do -u 'http://inlanefreight.htb:port'

is the port in your hosts file, if so don't

I also suggest re-doing (at least for mental sake) the other questions

since they have changed

[candid lily]

okay

the problem is i cant verify if my answer is correct

[fathom pendant]

well yeah

but the point is it'll still help build up to the final question

[candid lily]

should there be a robots.txt file?

cuz i dont find it

[fathom pendant]

that's in the first subdomain you find

i used the subdomains 110000 file to find it

[candid lily]

from DNS or from ffuf ?

[fathom pendant]

from ffuf

[candid lily]

lemme try dns jhadix

[fathom pendant]

you don't need to use any tools besides what's shown in the module

@candid lily just spun up a host and got the subdomain

[candid lily]

uh

[wanton idol]

see if it finds anything if not use a diff wordlist

[fathom pendant]

i used the subdomains-top1million-110000.txt as shown multiple times throughout the module

[wanton idol]

^

typically you should go for that first then other wordlists

[candid lily]

im trying that now

[fathom pendant]

i think the wordlist you showed was the 20000 list or a different smaller one

[candid lily]

dns jaddhix has 200k

[fathom pendant]

not all wordlists are created equal

the word that's in the one list might not be in it

ran a quick grep on jhaddix, and the word is not in there

[candid lily]

ooh got it now

unexpected name

[fathom pendant]

yeah only 2 wordlists contain it, and the other wordlist that has it is 600k words long

also don't forget about subdomains of subdomains that may exist

I will say ReconSpider is super helpful

as you can cat results.json and read the key values with jq

jq -r '.[key]' so jq -r '.links' for links

[wraith pelican]

at this point you might as well give the answers : D

[fathom pendant]

*the one from the Creepy Crawlies section

[fathom pendant]

nah just to avoid repeating questions

If i wanted to give answers i'd just tell explicitly what to look for

¯_(ツ)_/¯

[candid lily]

damn thanks never would've expected

[fathom pendant]

i predicted the next question "I still can't find the thing"

[candid lily]

how does some questions give cubes still

[fathom pendant]

because of the changes and additions

¯_(ツ)_/¯

[rustic sage]

no complaints here

[candid lily]

is it extra cubes or they changed from tier1 to tier 2

tier 3 modules should be reduced to 250 cubes, even with platinum sub its like just 2 modules per month

[fathom pendant]

it's just the additions to the module itself

they didn't change the tier afaik

i don't think it was tier 1 previously

[storm elk]

Tbh. I think 1000 isn’t too high. The content is great. Especially the cwee ones

[wraith pelican]

Maybe if we compare to other training platforms it is not that expensive.

[fathom pendant]

500 is t3, 1000 is t4

[storm elk]

Right. Ooops. Even better value 🤣

Sorry

[fathom pendant]

what section?

are you using the right creds?

what's the error you're getting?

[muted jacinth]

if i can give tips, don't use windows rdp it's laggy and inconsistend, you can actually do everythings from your linux host and if you need some file from a host, just dld them in your box and do it from here

[viral lotus]

first section on windows event viewer where you are tasked with drilling down into logs to gain info xfreerdp /u:Administrator /p:'HTB_@cad3my_lab_W1n10_r00t!@0' /v:10.129.205.123 /dynamic-resolution and it would error not connecting

it would attempt to I just closed my VM I will try again after

[muted jacinth]

and the vms from htb usually work fine, so if you can't connect try to reset the box

maybe a syntax, does the password contain characters such as !@$?

try to '' everythings

[fathom pendant]

put the /v: first

[fathom pendant]

single quotes tells bash to interpret as literal string

she has the pw in single quotes

[muted jacinth]

i was trying to say 'string' everythings

[fathom pendant]

nah it only matters in the pw

[muted jacinth]

right

[fathom pendant]

the whole password is wrapped in singlequotes

[rustic sage]

Bro is playing a game not even in chat to read the support messages 😭

[fathom pendant]

which is fine

[fathom pendant]

they literally said they'll come back to it later

xfreerdp /u:Administrator /p:'HTB_@cad3my_lab_W1n10_r00t!@0' /v:10.129.205.123 /dynamic-resolution so it's easier to see @muted jacinth

my only other thing would be asking if you were connected to the vpn

(if using pwnbox, don't worry)

[muted jacinth]

did not see that when i wrote my message

[fathom pendant]

generally, wait at least 5-10 minutes after asking a question before AFKing

that way you can test feedback before giving up and doing something else

otherwise people will be waiting for you to try the thing and seeing if it worked

or at least tell people "thanks i'll do these later"

otherwise most assumption is you tried the feedback and it worked and problem solved

or you end up re-asking the question that others had already spent time to answer

[wraith pelican]

just 2 cents, rdp can be sluggish but if you have to wait like 5 minutes there is another issue

i can't even wait for 2 minutes tbh

[fathom pendant]

sometimes it's just backend

HTB recommends to wait a few minutes for the environment to fully spin up

[viral lotus]

thanks, I was mostly asking if others had an issue with the RDP I terminated the box to try again after I also have more than one device with VMs on so I can be working as well, but it's cool ignore the question lol

[fathom pendant]

he wasn't ignoring the question lol

just adding onto things with his own thoughts

[wraith pelican]

friday troubleshooting, not much other thing to do... haha

[viral lotus]

no I am saying I retract my question

[fathom pendant]

since no other meaningful attribution aside from what's already been said

Ah ok

¯_(ツ)_/¯

[wraith pelican]

you want help? you got help lol

[fathom pendant]

no need to delete though, in the event someone else asks the same question

[wraith pelican]

overwhelming help

[rustic sage]

[viral lotus]

no not overwhelming help I am aware this is a busy forum and didn't want to keep it busy with something as noted is not being addressed by me right now

[fathom pendant]

as long as you come back to it it's fine ¯_(ツ)_/¯

you posed a question and said that you won't be working on it right now

you set expectations that any help offered wasn't going to be immediately addressed

it's not like you posed the question. went AFK for 3 hours. Came back and reasked the question

(which does happen)

[viral lotus]

yeah I am fully aware questions get asked again without any intent on trying it out for themselves, I deleted it so it didn't crowd the busy forum

but thanks @fathom pendant I will try moving v:/ to the front of my syntax when I try it later

[fathom pendant]

again you don't need to delete

[rustic sage]

This got way too complicated for no reason

[fathom pendant]

people are free to ask questions whenever, you shouldn't be afraid to "Crowd" the place ¯_(ツ)_/¯

that's literally what this channel is for, helping people

[viral lotus]

ikr

[wraith pelican]

this is the problem when you unleash a few weirdos with odd connected brains on a helping channel... but i try to not add anything to this

[rustic sage]

Weirdos?

[pseudo kiln]

is ptunnel-ng sometimes unstable for anyone else ? like works for a while then suddenly drops and you have to reconnect it ?

[vapid zodiac]

Which modules in the SOC Analyst paths have practicals (i.e use of workstation) as opposed to pure theory?

[fathom pendant]

All of them

Pretty much all modules have a practical lab portion

[wild sinew]

maybe it's me but ive done everything in the new info gathering module but i cant find any subdomains. i used ffuf, gobuster, and AutoRecon and its not giving me anything

[wanton idol]

can or cant

also it depends which wordlist u use

[wild sinew]

can't... sorry
i am using the sub...top1million-110000.txt

[wanton idol]

and what is the command u are running with ffuf

[wraith pelican]

if you scroll a bit up, you got all the answers

[wanton idol]

or do that 😂

[wraith pelican]

not very far away

[fathom pendant]

Yeah

[wraith pelican]

very not not far away

[wild sinew]

i did lol

[fathom pendant]

What's your ffuf command

[wanton idol]

so what is the command u running

[fathom pendant]

[wild sinew]

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u 'http://94.237.51.241:48481/' -H "Host: FUZZ.inlanefreight.htb"

[wraith pelican]

do you get any errors?

[wanton idol]

and dont fprget to filter size

[wraith pelican]

if you got errors, likely the server crashed

[wanton idol]

if no erros

[dusky gyro]

you add ip to /etc/hosts?

[wanton idol]

^

[wraith pelican]

the best thing to solve this is asking yourself: "What would ippsec do?

[wild sinew]

i do

[wild sinew]

lol

[wraith pelican]

yeah yeah you lolz and all but.... i know i know

[dusky gyro]

maybe check your spaces?

[wanton idol]

make sure your hosts file u didnt include the port number

[wraith pelican]

so... what would ippsec do?

except of typos of course

[fathom pendant]

It's not required to add the ip to hosts when using ffuf

Just ran it against his target from my pwnbox and it worked just fine

[wraith pelican]

• and gobuster

[fathom pendant]

gobuster is better to add to /etc/hosts

[frail walrus]

hey team,
before posting this question i did attempt to scrub thru discord. also some chatgpt action. when running nmap scan, i only get "1000 scanned ports are in ignored states" " 1000 filtered tcp ports (no response)". i tested turning off my host firewall, then tested with enabling icmp echo requests in the firewall. stuck on what else to try.

[fathom pendant]

What academy module are you working on?

[wraith pelican]

what would ippsec do?

[fathom pendant]

If it's not an academy module, read and follow #welcome to access more of the server

[fathom pendant]

I take it you're using pwnbox?

Because it all works fine on my end

so unsure what's going wrong ¯_(ツ)_/¯

[dusky gyro]

isn't pwnbox file structure dif?

[wraith pelican]

errors, maybe ffuf got 9503errors

[wild sinew]

i am using the pwnbox

[fathom pendant]

I'm using my pwnbox so any issues should be replicable

[fathom pendant]

Make sure to run ffuf in full-screen or with -s

Ffuf doesn't like non-fullscreen

@wild sinew did you try capitalizing HOST?

[frail walrus]

Just the first starting point meow excersise .

[fathom pendant]

There's a #starting-point channel

[dusky gyro]

I haven't used it in awhile, thought I saw some modules with a diff file structure and some with /Seclists/ instead of /seclists/

[fathom pendant]

Default is SecLists, but ig pwnbox is normalized to lowercase

[wild sinew]

nope

[fathom pendant]

Just checked, it doesn't matter

Make sure no spelling errors

[wraith pelican]

screenshot your ffuf output

[fathom pendant]

I've had brainlet moments of inlanfreight, inlanefright

They can't share screenshots unless they verify/link account

Following #welcome

[wraith pelican]

if you have set a -fs flag, not the 110000 lines

[jade shale]

I heard there is a software with algorithmic predictions about the future, can I get information about it, I want to learn

[wraith pelican]

the middle part of inlanefreight is typing in a satisfactory manner

[jade shale]

@wraith pelican

Is it real?

[wild sinew]

i just messaged you @wraith pelican

[wraith pelican]

mh hard to say what's real brother

[fathom pendant]

This isn't the channel

[wanton idol]

i can do the same thing i predict in 100 years from now we all are gonna be five feet under

[fathom pendant]

Read and follow #welcome to access more channels

[wraith pelican]

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u 'http://94.237.51.241:48481/' -H "Host: FUZZ.inlanefreight.htb" -fs 120
try with fs 120

[jade shale]

@wanton idol Here we have two and a half meters 😂

[fathom pendant]

I'd rather explain why the filter size

[wraith pelican]

it should work

[fathom pendant]

Rather than just do this filter

Common link in filesize response

[wraith pelican]

because he sent me a screenshot

[wild sinew]

does that exclude all that includes the size of 120?

[fathom pendant]

I meant the reason as to why we are using that size filter

[fathom pendant]

fs means you are getting rid of all responses that match that size

[wild sinew]

understoood! thats the switch i was looking for

[wanton idol]

which will only show other file size that will be your answer

[fathom pendant]

It's not gone over in the module because this module uses gobuster

[wraith pelican]

so when you see ffuf output all the same kind off line, you should look at what is common between those lines. Here we see the size is 120, so we may want to filter the ffuf output. Thus we are applyting the -fs120 size to our command

[wanton idol]

used to use gobuster alot but then once i learned ffuf i have never turned back since 😂

[wraith pelican]

we might also add the flag -ac, for auto calibration, so ffuf filters out all by itself. But that's not a silver bullet, sometimes it might filters things we want

[fathom pendant]

@wild sinew ffuf --help will give you the help output that explains a lot of the flags

So you don't have to rely on others to read the manual for you

man <tool>, <tool> -h/--help are 2 commands you should get familiar with to help explain tool functions

[wild sinew]

thank you for the assitance

[wraith pelican]

did it work?

[wild sinew]

sure did

[wraith pelican]

you got the command right in first place though, the -fs120 doesnt change anything but the output we see

[fathom pendant]

^

You just weren't providing enough info for us to push in the right direction

Don't forget to add any found subdomains to your /etc/hosts

[wraith pelican]

and then refuzz for any sub-subdomains

[wild sinew]

the first thing i did

[wild sinew]

👍

[fathom pendant]

No, you provided minimal info

If you had said "I got a bunch of results, but none are right"

That points to where to help you

Even without a screenshot

[wraith pelican]

I guess it is more a repetition thing, i'm just active on this discord for a few days and it is all the same questions about the same module. All the answers are there, a bit to scroll up, somewhere, a search away. It is kinda astonishing, for me anyway, I barely used discord during the cpts path, and i find it really curious.

[fathom pendant]

Well most people don't know about/utilize discord search feature

[viral lotus]

it's me again, so I re-tried the rdp (I downloaded a new vpn config and as academy 2 was really busy I moved to academy 4 I changed the syntax it worked and I connected via RDP now it is timing out ill attach the screenshot

[fathom pendant]

Make sure you only have one vpn running

[viral lotus]

yeah I do, I had the session running was about to open event viewer and then connection dropped so I just tried to pick it up again

[fathom pendant]

Reset the target

[fathom pendant]

Wait a few minutes

Then try again

Also try using the tcp vpn

[viral lotus]

ok will give it a run, thank you

[crimson warren]

guys, I try to do the modules (CPTS) without using PwnBox but my own VM through VPN (academy vpn)
but I cant ping the target
The target can be ping'ed, I did earlier when I was doing the module through PwnBox

[fathom pendant]

Is the pwnbox still running?

[crimson warren]

yes, it is (115mins left)

[wraith pelican]

you can try to sudo killall openvpn, then reconnect
you also can try to add some flags to your command, some might be useful
xfreerdp /u:<user> /p:<password> /v:192.168.1.0 /dynamic-resolution /auto-reconnect /cert-ignore /timeout:200000 +clipboard /network:modem /compression -themes -wallpaper /audio-mode:1

[crimson warren]

and my tun0 interface has IP from the VPN

[fathom pendant]

Terminate the pwnbox

[crimson warren]

on kali VM

[crimson warren]

Tried it once, will try again

[fathom pendant]

You do not need the pwnbox running to use the vpn

[crimson warren]

no, the pwnbox is not running, the target is

[viral lotus]

thanks I will pop that in my notepad file

[fathom pendant]

Reset the target

Try changing vpn regions

Reach out to support

[wraith pelican]

what would ippsec do? no?

lol sorry

[crimson warren]

worked after 3rd spawn

[wraith pelican]

the try harder thing wasnt so stupid in the end

[fathom pendant]

https://tenor.com/view/vinyl-records-record-collection-warped-vinyl-playing-music-record-player-gif-21484870

[wraith pelican]

it seems like a normal record to me

[languid galleon]

The way I overcomplicated the updated Web Recon Assessment question smh ... at least I got to dig through ReconSpider tool

[fathom pendant]

Yep

Comments are great

I recently redid it (all the questions, not just the last one)

[iron ibex]

When you do a 'get .profile' in a remote share while forgetting to switch directory from ~... 😅
Imagine IF the module's author were evil 🏴‍☠️

[languid galleon]

it was a good reminder for me to just do the simple stuff

[fathom pendant]

K.I.S.S. method never fails

[wraith pelican]

most of the sections, if you follow along the examples you got the answer

sometimes with a twist but really reasonable

[fathom pendant]

"Hah it wasn't my fault"
2 seconds later
"It was my fault"

As long as you understand the underlying material

[wraith pelican]

i guess sometimes answering the questions obscure the material

[fathom pendant]

When trying to outsmart the question ends up outsmarting yourself

[twilit otter]

hi

[wraith pelican]

yeah maybe, for me it is more like an embarrassing thing to answer and when it is done there is room to try to figure out stuff

hello

if I had to work helpdesk they would be afraid to have me on the phone lol

[fathom pendant]

Yeah you'd be fired day 1 "have you even tried restarting it"

[wraith pelican]

i think I would help them so much it would be awkward

[fathom pendant]

Most help center call times are 10-15 minute calls (give or take what's being supported)

[wraith pelican]

from what i can gather, it is likely to be "add it to /etc/hosts", i could be super efficient perhaps

[fathom pendant]

It depends

ffuf doesn't require it to be in the hosts file as it's pulling the header from the supplied -H flag

[wraith pelican]

lol you are telling me this!! we debated about il! : D

I even tried both ffuf and gobuser through burp and wireshark to prove myself i was right

[fathom pendant]

Either way. We're derailing the channel

[wraith pelican]

ha

[wild sinew]

sidenote.... i love burp.

correction... i love burp PROFESSIONAL

[fathom pendant]

Lol lucky

[cerulean grail]

Hi can anyone please help with running mssqlclient.py in the "Footprinting MSSQL" module of "Pentester" job path? I keep getting the same error and some Googling shows that it likely requires a reinstall of Impacket, but whenever I try to add or remove the existing Impacket on my Parrot it just says that it's an "extremely-managed-environment". I'd appreciate any help!

[sharp pike]

anyone have experience fixing this issue?

[cerulean grail]

For reference, here's what I keep seeing:

[fathom pendant]

You don't need to specify python3 and the filepath btw

sudo pip3 uninstall impacket --break-system-packages && sudo pip3 install impacket --break-system-packages

[wraith pelican]

if you re on parrot just try to run impacket-mssqlclient, no python whatsoever

[fathom pendant]

That's just msfconsole saying you don't have a db connected

That works for the apt installed version

[sharp pike]

tracking on that - ive run through the troubleshooting stuff in the module for MSF Databases to no avail

[fathom pendant]

What module?

Btw at the end there it tells you created a db

[cerulean grail]

This worked for me. Thank you!

[fathom pendant]

You also don't need a db to use msfconsole (unless you're planning to use it's db related features)

[sharp pike]

yeah but its not connected - its module Meterpreter from Using the MSF section on CPTS academy path

[fathom pendant]

Can you run msf commands?

[viral lotus]

This is Going to probably be a very simple answer, so I have investigated the event and I get to the XML view but the only executable is services.exe, there isn't much else am I in the right place? any hints would be great

[fathom pendant]

Do the same investigation tactics as shown in the section

[next bronze]

those still use python btw, they're just installed with apt

[fathom pendant]

Hint: it deals with the Logon ID

[wraith pelican]

i mean no need for python3 before the command and no need to break packages

[fathom pendant]

I mean it's already installed in pwnbox to not need the path either

[next bronze]

should use pipx to install impacket, that's the recommended way

they will set up the venv for you

[fathom pendant]

Don't think pipx is on the pwnbox

And going with least troubleshoot effort

[next bronze]

it is on pwnbox

[sharp pike]

this is what I get when I run a db cmd

[rustic sage]

is it ok if i ask for feedback on my setup again?

[wraith pelican]

on parrot it is installed with apt and their command wasnt right

[fathom pendant]

Before launching msfconsole did you run sudo msfdb init?

[sharp pike]

yes & reninit

[next bronze]

I'm saying impacket should be installed with pipx and that is on pwnbox

[wraith pelican]

maybe this:
systemctl start postgresql
systemctl enable postgresql
msfdb init

[wraith pelican]

do they have the rights to do this on pwnbox?

[sharp pike]

still not connecting to the db

[next bronze]

yeah, you have root perms on pwnbox, it's just a vm after all

[wraith pelican]

i'd rather try to use the correct command and then re-installing if that doesnt work but that just me

[next bronze]

is the msf problem also pwnbox? why not just reset it

ah nvm it comes like that

[sharp pike]

yes, it worked initially but after starting a new instance after stepping away for a few it wont work anymore

[next bronze]

I'd just use my vm tbh, even if you fix it now you'd have to do it again every time you spawn it

[wraith pelican]

inside msfconsole:
db_status

db_rebuild_cache

[sharp pike]

well i would bc i prefer Kali, but I'm also unable to connect to the VPN (have a whole other ticket submitted for that lol)

[fathom pendant]

Are you using sudo?

[sharp pike]

when i launch msf, yes

db_remove

shoudl i try that & redo the db?

[wraith pelican]

could try anything on a vm, why is it msf5 though

[sharp pike]

no clue lol its pwnbox

[wild sinew]

is anyone experiencing any errors when using ReconSpider.py? it doesnt give me an output file when completed

[fathom pendant]

No results.json?

[wild sinew]

nope

[fathom pendant]

worked fine for me ¯_(ツ)_/¯

It's either results or Results.json

I forget if it's capital or not

[wraith pelican]

like they said earlier, maybe just restart the box as you will not be able to upgrade it

[fathom pendant]

It's likely a message that's meaning as of msf 5 it's deprecated

It's using msf6

[sharp pike]

this shit makes me want to drink lol

[wraith pelican]

what doesnt? : )

let say you dont want to run db_nmap

[sharp pike]

ok

[wraith pelican]

i mean is there a way to run that without connecting to the db and you can still go on with whatever task you are doing

[sharp pike]

for sure, i'm just trying to follow the material so i cna use it later - im taking copious notes

not a bad idea to finish the module & move on

[rustic sage]

could it be done with an nmap --script?

[wraith pelican]

just type nmap and it work inside msf

i got the same thing actually

[sharp pike]

what is the weirdest thing to me is it was working fine until I launched a new instance lol

stupid work meetings lol

[wraith pelican]

it works

sudo systemctl start postgresql && sudo systemctl enable postgresql

[sharp pike]

i got all the same result except "Database not connected" lol

manual nmap is almost done I'll probably just take your suggestion & finish this one the boring way lol

[wraith pelican]

and a dumb: nmap localhost, do you see a postgresql port?

[sharp pike]

nope

[next bronze]

nah just do ss -tunap | grep "127.0"

if you don't see postgres it's not running

[sharp pike]

so what is this telling me?

[next bronze]

seems like something is just really broken

[sharp pike]

hahaha yeah no doubt

[cerulean grail]

I submitted a correct answer but I'm not sure why it's correct - or if I even reached it the "correct" way. It's obviously spoilers so I won't write it here, but would anyone be willing to please go over a quick thing with me regarding the Footprinting module in private?

[wraith pelican]

when you google search for the issue it appears quite a bit. there is solutions or things to try

[fathom pendant]

what module?

[wild sinew]

this is what i get when i ReconSpyder.py

[fathom pendant]

bro

it means you can't write to the directory you're in

[cerulean grail]

It's the Footprinting module

[sharp pike]

thanks, ill play around with those - do any catch your eye?

[fathom pendant]

yeah the one answer is indeed, not a default MSSQL database

[wraith pelican]

i would try anything that seems to make some sense
this is always more or less about the database, depending on what you can do on that box

[fathom pendant]

read the subsection: MSSQL databases to see what the default ones are

[cerulean grail]

I know what the answer is, I just have no idea if I got it the "right" way or why it didn't show up when I used other methods

[fathom pendant]

that's literally all the question is asking "of the listed databases, which one isn't there by default

[fathom pendant]

wdym "right way"

there's multiple ways to enum

mssqlclient.py comes with some built in tooling

but the method shown in the module also works

select name from sys.databases

if you got the answer, it's a way to do it

there's no 1 exact perfect way

the only wrong ways are the ways that don't get you answers

[cerulean grail]

So I was trying to use the method they showed us during the module but I got no responses from the server (I'm not sure why) as you can see in the screenshot.
Eventually I went through every command in "help". I tired using enum_db but got no response, then I used enum_users and got kicked out repeatedly (both of which I have no idea why)
Finally I used enum_impersonate which changed "master" to the answer but I'm not sure what that did or why that matters

[fathom pendant]

that's just mssqlclient being dumb

[sharp pike]

this may be a dumb question but what do i do if the local host is refusing connections on the port?

[fathom pendant]

pipx uninstall impacket && pipx install impacket

[cerulean grail]

Meaning what? I just don't get why none of the methods I tried first worked, or why the random thing I ended up doing DID work. Like I answered the question but I feel I've learned nill

[dim wolf]

mssqlclient can be borken maybe

[fathom pendant]

basically sometimes mssqlclient/impacket breaks

[dim wolf]

if it's not giving you any output

[fathom pendant]

and reinstalling generally fixes

[wraith pelican]

it breaks when you install it with break-system-packages : D

[dim wolf]

that's why you use pipx

[wraith pelican]

that s why i use it yeah

[cerulean grail]

So using "SELECT * FROM master.dbo.databases" SHOULD have worked if mssqlclient.py wasn't lame?

[wraith pelican]

but no impacked is apt installed

[dim wolf]

on parrot it is iirc

[fathom pendant]

generally yes

but you'd want to use name instead of *

[cerulean grail]

Yeah, that's what they said too. Is it because using * would just output everything stored on master.dbo.databases and not just the database names?

[wraith pelican]

you should post the entire command you use to call impacket etc

i know the course say to use mssqlclient.py but it is likely you could have to use: impacket-mssqlclient

[fathom pendant]

also master.dbo.databases isn't an object

try with sys.databases

usually it would send the error and tell you it's not an object

[fathom pendant]

just did it with the quick reinstall of impacket with pip and it works fine for me

¯_(ツ)_/¯

[wraith pelican]

i cant figure out why reinstalling stuff that would be installed and working out of the box

[fathom pendant]

it's an error that likely happened when pwnbox was updated

[viral lotus]

are there any good resources out there for building XML queries? I have asnwered both questions for the sub section of Windows Event Logs & Finding Evil but I stupidly terminated the box before re-tracing my steps. I will go through it again tomorrow but wanted some material to help understand how they are built to read/watch before bed

[forest tree]

I believe there is an error in the new Information Gathering - Web Edition inside the Web Recon - Skills Assessment section
Can anyone confirm? Cant even ping the vHost

[rustic sage]

I got parrot os installed and I am on the footprinting Oracle TNS module and section. I was asked to run a script to install odat, which I did. I then went into the odat folder and added the execute permission to the file with chmod +x and ran the command specified in the section to test the install. I get the result output in the picture

[fathom pendant]

here's a microsoft article

[sharp pike]

did you add the vhost to your /etc/hosts?

[fathom pendant]

is odat.py in that directory? is the simple question

[rustic sage]

yes you can even see it listed in the pic i provided at the top

i had run ls right above the screenshot

[viral lotus]

Yeah I read through a lot of them around the event viewer, the first part made sense once I knew what I was looking for but the second question where you use the previous event to build the XML query to find the desired event is a bit hazy, but you suggest the mucrosoft documentation is the best point of call?

[fathom pendant]

ok so following the section, they use the unique Logon ID to filter the query which is drilled down through the EventData tag

[wraith pelican]

you have to chmod +x odat.py if you wanna run it with ./
or you use python odat.py
you see the error: bash cannot execute. Because you want to execute it with python and not bash

[rustic sage]

i did the chmod prior to the result i posted and even verified to make sure it is indeed executable by owner

[fathom pendant]

the way that the Event Viewer xml files are named it's under Event Data --> Data Name; since multiple sections have a "Data Name" Tag we use @ to specify which Data Name we want

[rustic sage]

when i run the python command i get module error standby for output

[fathom pendant]

import cx_Oracle

[viral lotus]

Sorry if I am taking up time, I am going through cancer treatment so sometimes I get mind tired and ask dumb questions, I have read your below comment as well and I will put that in my notes and I will try a re-run tomorrow I need to sleep its GMT +1 here thank you

[fathom pendant]

pip3 install cx_Oracle

[rustic sage]

it wants to force me into a venv

[wraith pelican]

odat is intalled by default on parrot, i think. what if you type just:
odat

[rustic sage]

lol, just my lucky day

[fathom pendant]

no problem just think of it this way [Tag1[Tag2[@Name='Text tag']='filter']]

[rustic sage]

at least i got the mssqlclient to run... baby step..

[next bronze]

This part describes how to install instantclient, CX_Oracle and some others python libraries on Ubuntu in order to have the ODAT development version. Don't forget that an ODAT standalone version exists at https://github.com/quentinhardy/odat/releases/: It is not required to install something for use the standalone version

[fathom pendant]

it's in the repos as well btw

sudo apt install odat

[rustic sage]

niiice

it's installing, fingers crossed

[wraith pelican]

at this point we need human sacrifices

[rustic sage]

works!

[fathom pendant]

i believe they added it to the repos relatively recently

[viral lotus]

Thank you

[rustic sage]

thanks. but fr i just followed instructions in the module exactly, so not sure if this should be modified to just run sudo apt install odat instead of that script

much appreciated

[fathom pendant]

the module was created before it was added to repos

[rustic sage]

fair enough

[fathom pendant]

but it could also not be in all distros

¯_(ツ)_/¯

installing from script also worked just fine for me

[rustic sage]

user error i suppose, although i did check and triple check before coming here

[cedar yew]

hello guys,

AD attack enum module
ACL attack enum

i dont understand this explain

So, to recap, we started with the user wley and now have control over the user damundsen via the User-Force-Change-Password extended right. Let's use Powerview to hunt for where, if anywhere, control over the damundsen account could take us.

i have the permission for damundsen but i dont change passwd

how to check ACL controls with damundsen account bcs we dont take this account

[dim wolf]

convert their samaccountname to sid, then use powerview to filter for that sid

[cedar yew]

I don't quite understand how it works in the background

[dim wolf]

i believe that section shows you how to do it

[fathom pendant]

you don't need to worry about how it works too much in the background

[cedar yew]

This section shows that we have privileges over the user, but I don't understand how we can perform queries with their privileges without changing their password.

[cedar yew]

oky

[cedar yew]

oky

[fathom pendant]

in short though: it looks up the Object then sees what SIDs are attached to it

[dim wolf]

you are not querying with their privileges. you can query what privileges they have

[fathom pendant]

^

you're asking "hey what can this guy do"

[cedar yew]

understand

[trail sail]

Hi

I need help with the "Attacking Domain Trusts - Child -> Parent Trusts - from Linux" section of my lab. I've been stuck here for quite some time and am unsure if my approach is correct.

I'm attempting to extract the NTLM hash for the user bross using secretsdump.py. Here is the command I'm using:

secretsdump.py INLANEFREIGHT.LOCAL/htb-student_adm@172.16.5.5 -just-dc-user bross

I need to know if this is the correct way to obtain the hash for the user bross from the parent domain (172.16.5.5 INLANEFREIGHT.LOCAL

[next bronze]

follow the steps in the section

[fathom pendant]

^

[trail sail]

Yeah, that is what I did for the last two days. This is pretty much the last step to get it, but I have not been able to get the hash. That is why i need to know if this is the correct way to do it. Because there is no mimikatz in PS of the machine i get she SYSTEM shell

[fathom pendant]

start with a child; then use the administrator

the raise child gives you some interesting things

[trail sail]

But how to get the hash of bross from administrator System shell

[fathom pendant]

look at the output of raiseChild

it's right there

you're not using the admin shell

you're using the admin hash

[next bronze]

you got shell on the parent domain?

[fathom pendant]

it's what raiseChild.py does

[next bronze]

I mean there are multiple ways of dumping domain hashes then

you don't have to use mimi

[fathom pendant]

the official guide tm shows using raiseChild to grab the admin hash, then using that with secretsdump to grab the hash for bross

[next bronze]

yeah that's one way to do it

[trail sail]

I understand now. Thank you very much, Marcie and Xre0uS. I appreciate it. I got the hash now

[fathom pendant]

i mean is the other method you're thinking extracting SAM/SECURITY/SYSTEM hives?

since... admin?

[trail sail]

I did that, and I received a lot of output, but I did not get any hashes of bross.

[next bronze]

or extract ntds

[fathom pendant]

that's the one

ntds

the method they want you to use is secretsdump

but many ways to crack an egg

[next bronze]

this could work, machine hash is in security and use that to dcsync, but that's exta steps since you would already have admin hash

[fathom pendant]

yeah the main point that's focused on is the DCSYNC aspect

[sterile solstice]

anyone good with DSQuery and ldap filters? lol

ive tried a few i thought that'd give me my answer but not getting any returns

[cloud urchin]

All the LDAP filters you need brother https://ldapwiki.com/wiki/

[fathom pendant]

https://gist.github.com/jonlabelle/0f8ec20c2474084325a89bc5362008a7 and these

[fathom pendant]

found a cheatsheet recently; bless up

[sterile solstice]

thanks team

im still strugling to get the answer i need

I need to find the flag hidden in the description field of a disable account, with admin privileges

[cloud urchin]

chatgpt is great for creating ldap filters

[sterile solstice]

found it!

i was missnig the right attribute flag

that too so long lol

[cloud urchin]

that's what she said

[sterile solstice]

lol

[rustic haven]

Can I please get an admin or someone who works for hackthebox for assistance

need to change emails on my account as I'm locked out, if thats possible

[sterile solstice]

no one in this particular channel will be able to help you with that

i'd suggest using the support option on the site, and submit a ticket

[junior flicker]

I'm working on the IPMI section of the Footprinting module and am struggling with obtaining the cleartext password. I did the ipmi_dumphashes and hashcat wants to take days to complete. I am using mode 7300 as the IPMI section speaks to and just waited almost an hour and a half with no results, then hashcat decided to keep running with an end time of Sunday. I used hashcat -m 7300 <fileName> -a 3 -S -w 3 -O. Where am I going wrong?

[sterile solstice]

https://hashcat.net/wiki/doku.php?id=example_hashes

check you've got the right mode

[zealous summit]

Hey guys how should I start Bug Bounty ?

[sterile solstice]

in what way?

as a job? or the training?

[cloud urchin]

what wordlist?

[cloud urchin]

you did something wrong, probably wrong wordlist. i cracked it in 1 second.

[zealous summit]

for training

[cloud urchin]

don-t use -a or -s or -w, just -m and -O

[junior flicker]

I hadn't used one, but I've used rockyou in the past. Any recommendations?

[junior flicker]

Okay

[cloud urchin]

rockyou is pretty standard, try that

[junior flicker]

Okay, I'll give that a go tomorrow. Thank you for the help, hashcat is clearly not my strength

[cloud urchin]

brute forcing is going to take forever, just use a wordlist like rockyou

[sterile solstice]

have you enrolled in the CBBH path?

i heard portswigger academy is also great (and free)

[fathom pendant]

message support

[sterile solstice]

yea i found eary parts of the pathway to be difficult using it too. but its been getting easier

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[zealous summit]

No, I will not register with CBBH

[sterile solstice]

ok. but if you want to do bug bounty, then wouldnt the bug bounty path be the right way to go?

[zealous summit]

Yes, it is

[fathom pendant]

the path is good for base foundations

[fathom pendant]

#cwes message this message explains what CBBH is and what the path is

this channel is for help with the HTB academy learning modules; if you want to access more channels -- read and follow #welcome

[junior flicker]

I get that, I first used hashcat in a bootcamp back in 2020 and haven't used it much since. I have some rust to shake off.

[fathom pendant]

there's a whole module and the sections that involve using hashcat generally detail what to do

also if you read hashcat -h you'll see what all the different options are

[zealous summit]

Yes, but I don't know where to start

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

you start with the basics

[sterile solstice]

thats why the path is good. it gives you a layout.

[fathom pendant]

you don't have to take the cert to have gained knowledge

[sterile solstice]

starting with the skill paths is also good.

[sterile solstice]

exactly. you can do the training and not take the cert. the cert is a just a standardised way to represent a certain (presumed) level of knowledge

[rustic sage]

You need a cert for a job tho

Most of the time

[sterile solstice]

or at least for an interview

i agree that you should get a cert. i've always been a proponent of getting that piece of paper. though not everyone wants to bother.

[rustic sage]

I feel like Cyber Security is just knowing about computers as much as possible, unlike other IT related fields where you just get better at your particular field.

It's just so vast

[sterile solstice]

yea theres a lot of that i think. i thought i knew a decent amount, though i was shocked by how much i learned doing this pathway

most ppl i know are more on the management side as well though, not the technical. more the CISM/CISA side of the house.

[zealous summit]

Cybersecurity is a broad field

[sterile solstice]

very. my sister asked me how to get into the field, for a career change. was a hard question....its enormous.

[wooden perch]

Hi All,
Im stuck on module SQLMap module > Attack Tuning labs
I got flag5 flag but the htb form is not accepting it (weird, already restarted the machine)
was not able to get flag7, trying this: $sqlmap -u 'http://94.237.63.201:53409/case7.php?id=1' -T flag7 -D testdb --batch --dump --level=5 --risk=3 --union-cols=12 --technique=U

[fathom pendant]

one of the flags outputs weirdly from what I recall

it's l337sp34k so you can likely guess what it's meant to be

[fathom pendant]

that's a lot of columns

idk why you have that many

did you even look at the case7 page?

[wooden perch]

yes, columns arent the characters total for a field? or just the total columns on the table (5)?

[fathom pendant]

just the total number of columns

since when has columns been for the total characters for a field?

especially in relation to SQL

[wooden perch]

I might be thinking too much about terminal columns 🙂

[fathom pendant]

yeah, remember you're dealing with SQL where columns and rows are data fields

even the reading for the section reminds you of this

[wooden perch]

assignment complete, needed to run the command a couple times for flag5, and after reboot the target I got flag7. Thanks!

[fathom pendant]

yeah sometimes it breaks

[iron ibex]

Module : Footprinting
Section: SMB
URL : https://academy.hackthebox.com/module/112/section/1067
Question : What is the full system path of that specific share?
Does SMB protocol provide a way to know the local path of a network share ? 🤔

[cloud urchin]

yeah

[iron ibex]

May I ask a hint toward the command or SMB function to use ?

I see .profile and .bashrc files in the remote share so I would guess the path is /home/XXXX but I don't know the user name

[cloud urchin]

Review the RPCclient section

[distant island]

hey i am in the cpts FOOTPRINTING medium task i am already in the mysql as admin but cannt find the HTB pass

[solar zodiac]

hi everyone! Anyone for a nudge on the Advanced SQL injection skills assessment? I think I've found a vulnerable api point

not sure how to proceed - I'm only able to get past someof the filter

[sterile solstice]

sorry guys, i suck at SQL ... wish i could help

[solar zodiac]

you'll get better! the sqli modules in academy are great

I think the hurdle im having to overcome is java

[sterile solstice]

im definitely going back over them. i struggled so far in the CPTS path

im unsure how ill go with java lol

[solar zodiac]

haha this advanced sql module is great

you'll do great!

[sterile solstice]

i just had a look at the module reviews. only 3 but all very positive about it

[solar zodiac]

the other sql modules are really good too

[sterile solstice]

yea ill get there. i see its part of the senior web pentest route.

[solar zodiac]

I thought the blind sqli module was neat

it teaches how to write python scripts to dump the database, like sqlmap does

[sterile solstice]

im not rushing there. but i do plan on buying a few modules once im done with the CPTS

[solar zodiac]

based on boolean/timebased stuff

[sterile solstice]

oh nice, i gotta do better with my python

[solar zodiac]

yeah python is neat!

[sterile solstice]

ive learned it on and off over the years but never had a project to dedicate time too

[solar zodiac]

ippsec videos are great for learning 🙂

[sterile solstice]

so never really consolidated anythhing

there is a DNS enumeration with python module that is also in my crosshairs.

[solar zodiac]

I havent tried that module yet

the last 2 modules i've done have been dacl 2 and windows evasion I think

[sterile solstice]

oh nice. t3 modules. above me right now 😉

[solar zodiac]

😄

academy is awesome! I love that there is just so much good content

im an academy addict lol

[sterile solstice]

yea been doing it every day for 2weeks now

43% way through CPTS. its great content

https://academy.hackthebox.com/module/details/27

[solar zodiac]

thats awesome!

[sterile solstice]

thats the DNS + python module

[solar zodiac]

ah

I really like that they made game hacking modules

those were pretty neat

[sterile solstice]

yea i did briefly see that!

[solar zodiac]

I cant wait for more windows binexp modules

maybe one day we'll see windows kernel stuff 😄

[sterile solstice]

im actually interested in more wifi based stuff, and possible phones. unsure if they have modules for that stuff

[solar zodiac]

there is a hardware attacks minimodules that discusses things like bluetooth attacks

[sterile solstice]

when i can, ill be going on a buying spree at hak5 haha

[solar zodiac]

and I think there is a module that talks about ssl stripping

which is a pretty common wifi attack

[sterile solstice]

yea i did see that briefly. didnt look like a lot

[solar zodiac]

I think its the https/tls attacks module

there are also some good traffic analysis modules

which honestly I need to do

[sterile solstice]

well improving my wireshark is on my list

[solar zodiac]

my wireshark skills are awful lol

[sterile solstice]

i can read well enough to pass my JNCIA but thats it lol

[solar zodiac]

lol you're probably ahead of me

there are some neat things you can do with wireshark though

[sterile solstice]

meh, read outputs. i am lost looking at a pcap

[solar zodiac]

like decrypting some traffic, or dumping raw output as hex

so you can replay it on the wire with modifications

[sterile solstice]

yea so ive heard. i was looking through my homelab and saw a docker container for wireshark. i downloaded it but havent used it yet.

[solar zodiac]

nice

[sterile solstice]

yea that stuff seems pretty good. keen to learn about it eventually

[solar zodiac]

yeah I just love that there is so much content

its like an endless library 😄

[sterile solstice]

i understand why HTB doesnt really have it though. doesnt fit into their ecosystem too well, i.e. their labs

[solar zodiac]

yeah I think there is some stuff that the labs cant host

[sterile solstice]

hahahaha it is. though thats dangerous for me as i have the urge to finish it all. and who has that time lol

[solar zodiac]

like MITM6 attacks... really cool stuff, but I think its hard to replicate a test environment

[ruby ginkgo]

Hi, I'm facing a problem with the Web Attack module (Blind OOB XXE). I have followed all the steps exactly as in the module, but I couldn't get the request to my PHP server. can someone help me?

[sterile solstice]

well i am super keen to try my hand at a machine but i still dont know enough to do that yet. i tried the free 2mil machine and its mostly web based vectors and i havent got there yet. lol

[solar zodiac]

I can try but I havent done the module in a while

[sterile solstice]

yea exactly!

[solar zodiac]

you can msg me if u want

[sterile solstice]

@solar zodiac have you gone through any other certs? im wondering if completing the CPTS path and then trying another cert as practice is a good idea. ive heard CPTS pathway is more indepth than other vendors