modules

[fathom pendant]

I highly suggest stepping through each command step by step

so you can really see what it's doing

[vale salmon]

So I'm working on Attacking Common Applications -> Attacking ColdFusion. I have the reverse shell and I cannot figure out for the life of me how to figure out the user running ColdFusion. Whoami and netstat and tasklist are not giving me the answer and I'm not sure where else to check. I also checked the logs.

[old bolt]

Hello, I'm currently working on the bloodhound module. I'm at the first set of questions, but it's not letting me get the info I need.

• cannot collect info with bloodhound.py like in the guides, because I cannot connect to the IP. (I'm using pwnbox)
• The questions also include BH.zip files, but when uploading to bloodhound it says they are invalid json files. (I tried on VM and host machine)
  Am I missing something? Any help would be appreciated!

[covert vortex]

should work with one of the commands u mentioned, anyways dm is open

[civic hamlet]

ive done most of it so far

cat sourcecodefile.txt | grep -E "src|href" | tr " " "\n"|sort -u| column

still some issues but im getting there

[fathom pendant]

i mean you don't need to output to a file

also for extended grep you'll need to wrap in parenthesis for or statements

Match (A|B)

[civic hamlet]

is there a grep option that allows me to query data that has a certain ammount of things?

[fathom pendant]

also i recommend one of the commands from the replies to the post

[fathom pendant]

no

[civic hamlet]

So in this case data that has src, href, and the url

[fathom pendant]

grep is an all or nothing

grep -E "(src|href|url)"

also it requires some knowledge of html coding to know what it's doing

curl -s https://www.inlanefreight.com | tr -d \'\" | grep -o -E "(href|url|src)=[^ >]+" | cut -d '=' -f 2 | grep -vE ".*(defer|\.org|google|themeansar).*" | cut -d "?" -f 1 | sort | uniq | tee /dev/stderr | wc -l

this is the command I recommend ^

see the forum article I linked for the explanation of each step

[civic hamlet]

Shouldnt I be coming up with the command myself?

but thank you ill check it out and try to understand it

ah so many different options, itll be a pain to learn them all

[fathom pendant]

this is one of the few times i'd recommend just grabbing it from the forum

[wraith pelican]

it makes me think when someone ask a simple question on stackoverflow and they get an intricate command full of pipes and special characters in return : D

[fathom pendant]

the command is explained in the forum article I linked

¯_(ツ)_/¯

i just didn't want to wall of text

[wraith pelican]

i find it fascinating

[fathom pendant]

and if you really want to see what it's doing, just pipe it one at a time

[wraith pelican]

those things get me lost [^ >]+"

well ok, debut of line, space, greater than?

[fathom pendant]

anything that's not >

within the brackets the ^ acts as a negation operator

https://www.rexegg.com/regex-quickstart.php

the + after means match everything/greedy

[^ >]+ translates to "grab every character that isn't > (until you hit the >)

as opposed to * which is 0 or more, + means there needs to be at least one instance

https://www.rexegg.com/regex-quickstart.php#anchors <--

the " at the end there is because the expression is just wrapped in doublequotes

[ocean night]

https://regexr.com/

[civic hamlet]

Going to simply use the forum command, tried and failed

cat sourcecodefile.txt | grep "inlanefreight"| tr " " "\n" | column | sort -u| cut -d"=" sourcecodefile.txt

[ocean night]

Useful tool to learn Regex magic 🙂

[fathom pendant]

because it's searching for "(href OR src OR url)=[all characters to end of bracket]"

[wraith pelican]

thanks, i'll have to give a few days studying regex, because it is still a bit obscure to me. it was one of my first academy module i remember spending quite some time playing with it, but the command i crafted didnt contain regex

[fathom pendant]

if you notice it's grabbing the html elements

[civic hamlet]

I wanted to find text with inlanefreight, sort columize it and break lines, then get rid of all text after =

[fathom pendant]

and html elements are wrapped in <>

you don't need to columnize it btw

[civic hamlet]

shouldve given me only the url

yeah

[wraith pelican]

cat htb.txt | tr ' ' '\n' | tr '>' ' ' | grep https://.*.hackthebox.com/ | tr '"' "'" | cut -d "'" -f2 | sort | uniq

[fathom pendant]

you only need to do the sort part at the end

[wraith pelican]

buit it is not as elegant

[civic hamlet]

was my idea somewhat on the nose? getting rid of all text before =

[fathom pendant]

somewhat

[civic hamlet]

after I had created line breaks

[fathom pendant]

you're just missing one key thing for html

urls are either passed in via: href, src, url (a href, a src, a url) or something like that

url is literally the term url

it's telling whatever element it's bound to that's the url it's linked to

[fathom pendant]

you know you can just do tr -d to delete elements instead of replacing with spaces yeah?

[wraith pelican]

maybe if i retry it now i would approach it differently

[fathom pendant]

it's why the command i showed uses tr -d \'\" it's deleting the quote characters

also you can just escape quotes and such with \

instead of doing '"' and "'"

[wraith pelican]

ok thats noted. thanks

[fathom pendant]

same for any special character

that way bash doesn't interpret it as " and says you're missing things

[sly trench]

Ok so it's gotta be my laptop, web stuff keeps timing me out. Nmap and privesc doesn't give me errors or anything but gobuster or whatweb and stuff like that works like 10% of times

[fathom pendant]

if you're in a vm, use bridged mode; it's likely some protection causing the packets to be throttled for bandwidth

[sterile solstice]

could also be filtering with your router? ive had some issues with this as i have filters attached to my router (mostly for DNS loaded with Firebog lists)

[fathom pendant]

i don't have a filter with my router; using NAT mode forced my bandwidth down

likely some botnet protections on the router; i mean it's not normal to send 100s of packets to a random ip and port directly

i haven't dug into the settings

[sterile solstice]

ah, right. that makes sense. my filtering was part of my homelab experiments a while ago. with private IPs its fine though, public IPs with some of our exercises it has problems.

[fathom pendant]

yeah a fair bit of the web exercises uses a public_IP:port

[sterile solstice]

hahaha yea, that would be a big abnormal. i found that using the AnonSurf on parrot helped with my problems for some cases (in others, it made it worse)

[dusky gyro]

i had similar issues until i went into my router settings, was blocking sql injection codes and hendering a lot of things

[sterile solstice]

AnonSurf for the public IP exercises, and no AnonSurf for private/VPN

[sterile solstice]

ahhhh that will do it. ive been meaning to take a deeper look into mine. i should poke around a bit more.

[fathom pendant]

for some reason routers don't want you sending a bunch of packets 🤔

though tbf most bounties will have you limit your threading anyway

[dusky gyro]

well its malware call-back functions that are being intercepted prob

[fathom pendant]

nope

[sterile solstice]

ill be upgrading my router/firewall setup in the future.

[fathom pendant]

not for fuzzing apps like gobuster/ffuf

[dusky gyro]

it affected my ffuf :/

[fathom pendant]

yeah

ffuf isn't a malware call-back

that was my point

lol

it's detecting an abnormal number of outgoing packets

[dusky gyro]

ya two seperate things, but my point is the protection was an all around thing

[fathom pendant]

ye

[sterile solstice]

i guess in these circumstances, wouldnt a VPN solve a few of these issues, depending on where your termination point is.

[dusky gyro]

depends on your router settings

[slender violet]

PIVOTING, TUNNELING, AND PORT FORWARDING > Branching Out Our Tunnels > SOCKS5 Tunneling with Chisel > Question 1
https://academy.hackthebox.com/module/158/section/1437

What do I do in response to this error? I used go build on my host pwnbox machine before transferring chisel to the ubuntu target using scp.

[buoyant void]

I'm currently stuck on the Assembly Language skill assessment, I was hoping someone could take a look at my assembly code and maybe point me in the direction where I'm going wrong.

[fathom pendant]

you'll need an older glibc version

or you'll need to compile statically/or just grab one of the old releases

[slender violet]

Ok thank you

[fathom pendant]

your glibc will not match the target glibc

[sly trench]

Sry I don't fully understand how it would solve the problem, for what I understand a bridged connecting gives the VM it's own ip but wouldn't most filtering occur in my home router? Like wouldn't the problem still occur since all the packets would pass through it?

[fathom pendant]

just trust

it worked for me and many others

it's due to how networking works

idk all the specifics of why it works

all I know is: I switched --> it worked

👍

[sly trench]

Yea yea ofc it's that I developed this mentality of having to understand every step I do with hacking/networking and stuff like that

[fathom pendant]

honestly the more you try and dive into every step the longer it'll take to learn

and some things are just not worth looking into

[sly trench]

Doesn't it give you a deeper understanding? I started doing this when learning languages and It worked why not with hacking?

[fathom pendant]

the deeper you try and dig into how it works the less you'll actually learn

most stuff is fine to dig a little into, but at some point you're diving into the bytecode and sockets where it's not beneficial to know

[mental phoenix]

Hi team! I already got shell and check what is the service user run coldfusion but Why it got wrong answer?
Is this broken or something?

[sly trench]

Got it

Thx

[fathom pendant]

it's not saying what is the service user, just what user is running the service

[mental phoenix]

Yaa, I got it. But why is still wrong answer?

I already check on the tasklist

[fathom pendant]

make sure no extra spaces in your answer

[mental phoenix]

I do

[fathom pendant]

it also helps to include the module and section name

that way people aren't just shooting in the dark to try and help you

[mental phoenix]

Here it is the module

[fathom pendant]

also the answer is likely expecting domain\user

not just user

[fathom pendant]

it helps to type it out in case someone in the future needs help with the same thing

[mental phoenix]

I already submit that, but nothing

stil wrong answer

[fathom pendant]

so you submitted a*\t*

[mental phoenix]

wt... Ok lowercase just got me crazy

[mental phoenix]

thank you btw

[slender violet]

Got it

[fathom pendant]

after all the example tools, look into ligolo-ng

much more based

[slender violet]

Thanks, Ligolo is my favorite for pivoting and tunneling.

[fathom pendant]

you can use it for all these exercises btw

there's no strict requirement to use the suggested tool

pivoting is pivoting after all

[sly trench]

I changed the VM connection to bridged, I disabled every other network connection but my wifi from the VM and i connected to htb vpn. The websites don't load at all, and when I do whatweb <ip address> it says "no route to host"

But connection to others websites works like Amazon

[mental phoenix]

Hi @fathom pendant, can you give me suggestions about module "Exploiting Web Vulnerabilities in Thick-Client Applications".
While I'm trying to do java -cp client.jar client.jar.src......java.

I always stuck on the error "cannot find symbols". Any references for this?

[fathom pendant]

haven't done this module tbh

look up the walkthrough for fatty

that's what this lab is based off of

[mental phoenix]

Ya, I already check all of that and the forum htb, but I think other people have no issue with that.
I'm still trying to find out

[sly trench]

So it works on the workstation but not on my VM @fathom pendant do u know what it could be?

[steep sentinel]

Hyee

[pine dune]

Hi guys what is this

the high, medium, low load and why do I have to change ?

[ocean night]

It's a list of the available VPN servers.

It's showing the current load on each server, and the recommended server.

[pine dune]

yea, I wanna use EU cos im in UK but its recommending me to switch

[pine dune]

sorry what does it mean by load?

like how many ppl are on it?

[ocean night]

Yes

[pine dune]

thanks

[sterile solstice]

attacking Thick Clients in the Attacking Common Services....what a rollercoaster. lol

[sly trench]

Yo I think it was my wifi, on hotspot I have no problems

This shit is fun

[tidal mango]

in the Active Directory Trust Attacks Skills Assessment, on the last question, from everything I try I cannot get the mssp.ad or fabricorp.ad domains to show up using Get-DomainTrust -Domain mssp.ad commands, as well trying to do other things with mimikatz etc does not work. Has anyone completed this module that I can DM? It seems like something is broken but I wanted to check my commands to make sure.

[next bronze]

it should be pretty obvious, run bh on both domains and find a path

[snow garden]

Moduele : ACL Abuse Tactics

I been researching with the CTRL + F in this channel and I saw others had the same issue, I tried resetting the machine and lab and still nothing. Was wondering if anyone had any ideas on why this could be? I do know this is a user on the domain

[tidal mango]

have you done it then? I am pretty sure I have the right commands but I always get errors. Sharphound also errors on the mssp.ad and fabricorp.ad domains.

[ocean night]

Uhh, what?

[rustic sage]

YES

[shut quest]

he is a master hacker

[ocean night]

Oh dear, get ready for DMs Candy

[rustic sage]

NO

[shut quest]

😂

[ocean night]

Yeah, bye tim

[next bronze]

I used bloodhound python iirc

[cloud urchin]

Your error message is right there in red. It says wrong credentials.

did you define $damundsenPassword?

[snow garden]

yes

I am changing his password

[cloud urchin]

did you wrap the password in quotes?

[snow garden]

yes

[cloud urchin]

well it says wrong creds, so your password is probably wrong

[cloud urchin]

you also need to define two other variables

[junior flicker]

I'm working through the File Transfer module specifically the Linux section and just playing around, I already completed the questions with multiple approaches. Everytime I try to use the /dev/tcp approach, I only get this error: zsh: no such file or directory: /dev/tcp/10.129.126.22/80. I'm running Kali Linux, so I'm not sure if there is an issue with bash, any ideas?

[rustic sage]

I think the dev/tcp functionality is a bash specific functionality not ZSH

[snow garden]

Got it, I saw the problem

[rustic sage]

You need to switch to bash to use this feature

[junior flicker]

Okay, I had tested with a different OS and see that it's working now. Thank you

[ocean night]

Mention of zsh gives me PTSD

[rustic sage]

That OS probably uses a bash shell

[next bronze]

I use zsh daily

[ocean night]

#general message

[next bronze]

oh...

that's an entirely different situation

[ocean night]

haha

[next bronze]

dm if you can't figure it out

[oak ocean]

In CBBH path, the "Skills Assessment" for BROKEN AUTHENTICATION has been renewed? I can't find any hints from the entire internet.

[ocean night]

You should be able to solve it by going through the sections of the relevant module.

Try to stay away from hints, if you can. Everything you need to solve the module assessments is included in the module content.

Ask for advice if you must, but if you go searching, you may spoil more than you want

[oak ocean]

I found the entire BROKEN AUTHENTICATION module has been renewed and I have solved all without any hints. But last Skills Assessment is giving me some pain currently.

[oak ocean]

I found that I can create a new user and I can see a session token is getting generated. But I can't find an attack vector from there. Can you advice what to do? If I at least know I am on the right direction then I will try my best.

[ocean night]

I cannot I'm afraid

[formal lintel]

hello! someone can help me with this ? i tried with the command nmap -p- -sV 10.129.42.254
but is taking a lot of time and i dont recieve an output or answer

[rustic sage]

While the nmap scan is running press ctrl + v and you'll be able to get the scan stats

[formal lintel]

like this ?

idk how to resolve this

[ocean night]

You could use the -T parameter to adjust the timing template

Check https://linux.die.net/man/1/nmap

[formal lintel]

I did this but the answer is incorrect

[formal lintel]

ok i going to try

[rustic sage]

What's the question

[formal lintel]

this is

[rustic sage]

I mean you can see the port telnet is running on, in the results of the scan

Default port for telnet is 23

The question asks for the non default port, which is displayed in the scan

[cloud urchin]

Try reviewing the "Enumerating Users" section

[formal lintel]

i was trying 2323/tcp

and not tried 2323

[rustic sage]

Just 2323

[trail sail]

Try only the number

[formal lintel]

thank you so much jaja

[rustic sage]

TCP is the protocol

Lol

[ocean night]

https://tenor.com/view/well-there-it-is-jeff-goldblum-gif-14058551

[formal lintel]

that was my horrible comprension of english jajaja
first i undertand the version, not the port

and now i get it

thank you!

[ocean night]

Every day is a school day!

[rustic sage]

Yes

[trail sail]

Sigue asi amigo comence el curso de Pentester aprendiendo igual ingles, y mejore mucho gracias a eso.
Nice work!

[formal lintel]

eso me motiva!! estoy haciendo todo en ingles y cuesta un poco pero le estoy metiendo a full y de paso aprendo ingles jaja

[storm elk]

English please 🙂

[night crypt]

hi everyone, I'm having trouble with the Attacking Domain Trusts - Child -> Parent Trusts - from Windows module's lab - it seems to be showing that the target domain controller doesn't exist. I've tried rebooting instances & swapping my VPN server same issue :/ anyone able to assist please?

[cloud urchin]

try c$ instead of c:

[night crypt]

sorry that was one of my failed attempts to make it work - same issue with c$

might work with IP address

nvm same issue

[cloud urchin]

did you create a golden ticket

[night crypt]

yep

[cloud urchin]

show me what klist says

[night crypt]

what I don't understand though is I can ping the target

and even if I hadn't created the golden ticket shouldn't it show an auth error instead of just that it doesn't exist?

[cloud urchin]

well show the command that works

let me see the error there

you could try ip though sure

[night crypt]

the font is super blurry for the PS errors unsure why

so I pinged it successfully & get a different error if I try to list C: on the target with the server name vs IP address

[cloud urchin]

what if you try nslookup on the host

[night crypt]

seems to have been an issue for someone else back in Aug 2023 haha

[cloud urchin]

nslookup the host not the ip

[cloud urchin]

ok idk maybe change vpn regions

[night crypt]

as in from US to EU?

I went from US x to US y and no luck 😦

[cloud urchin]

ya us to eu

[night crypt]

trying now, let's see....

so just US is broken it seems haha

tyvm @cloud urchin ❤️

[next bronze]

just tried it on US5 and it works

[night crypt]

[tight mauve]

https://academy.hackthebox.com/module/77/section/728
the target machine is just spawning forever, where do i report issues like this?
anyone know if HTB uses crowdstrike? xD

[next bronze]

change vpn server

[tight mauve]

how do i do that? i'm on academy and there is just 1 vpn

im not talking about the pwnbox, its the target machine which is stuck spawning

[tight mauve]

that option is only for labs, i dont see it in academy

[oak ocean]

Thank you mate. I was able to progress a lot by now. Could you please tell one more thing? Is the otp 3-digit or 5-digit? I have tried 4-digit, but that did not work!

[next bronze]

huh it clearly says academy servers there

[tight mauve]

i found the setting now, thx

[cloud urchin]

that's the hardest part of the skill assessment probably. the answer is within the module i can tell you that..

[tight mauve]

still, changing the vpn doesn't change the fact that the target machine is stuck spawning

it never finishes spawning and it's been like this since yesterday, if i come back it is still spawning

the button to reset the machine is also not there since it never finished spawning, so i can't reset it

[next bronze]

it worked for me , you can go to another section, spawn one there and come back again

[tight mauve]

i'll try that

I was able to spawn another target at the previous step, went back to this step and it is still spinning

[oak ocean]

It has been difficult so far, so this is even harder?!
I know it is 2FA bypass, but there should a be trick unlike the module challenge. Because after 3 failed attempts, I am getting redirected to the login page again. So I need to find an automation to do that over and over again. Am I on the right track with that mindset?

[next bronze]

welp something is broken for you I guess, contact support, in the meantime just use 94.237.59.63:41313

[tight mauve]

the ip is different for you than me i think

where do i contact support?

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[next bronze]

it's a public ip for this section so it's accessible regardless of vpn

[cloud urchin]

that's the last part of the skill assessment i can't really just tell you the answer. just try the methods in the module and you'll get it.

[jolly yacht]

In the Windows Fundamentals assessment section, step 6 mentions disabling inheritance for the Company folder. I did this, and it removed all default groups, which makes sense since they were inherited. After disabling inheritance, they instruct to specify NTFS permissions. Disabling inheritance removes all inherited groups from the Company folder (as shown in the second screenshot). Which group should I assign the permissions to? I assumed it was the HR group mentioned earlier, so I added that group and assigned NTFS permissions. However, the next step shows assigning NTFS permissions by adding the HR group to the subfolder. Since I already assigned NTFS permissions to the parent folder, these permissions reflected on the HR subfolder as well. Why do we need to assign permissions to the subfolder again if they are already inherited from the parent folder? Did I make a mistake in the process?

[wary plover]

This is modules 😛

[jolly yacht]

but Iam on the Modules channel

[storm elk]

Oops

[sterile solstice]

thats what i was thinking ... had to double heck haha

[storm elk]

Sorry 🤣

[sterile solstice]

all good. too vigilant for your own good 😉

[storm elk]

I need to get my eyes checked I guess haha

[sterile solstice]

i assume its the weight and responsibility of that blue check mark next to your name 😛

[storm elk]

No, I actually thought I was in general still 😅

Sorry @jolly yacht for the mistake 🙂

[sterile solstice]

and i'm not sure freak. im not familiar with that exercise. sorry

[jolly yacht]

No problem. Can you please give me you're insights regarding that doubt?

[jolly yacht]

okay

[storm elk]

I haven’t done windows fundamentals yet either, sorry. I’m more a web guy 🙂

[fathom pendant]

you add the HR group and assign them the permissions

read the step 6 instruction directly

Adding the HR security group to the shared Company Data folder and NTFS permissions list

the reason for disabling inheritance is because it also inherits some permissions that you may not want when creating a file

Disabling inheritance allows you to be selective with the groups instead of lazily allowing all parent groups to access the share

Think of it this way: you're ensuring that ONLY HR has access to this subfolder

because say you need to add another group to the share folder permissions; you wouldn't also want them to inherit the permissions

say you need an IT folder; Company Data → IT -- you don't want IT accessing HR shares and vice versa

Company Data → HR
Company Data → IT
in essence you want these separate,

and you don't want to add the IT group to Company shares, and then it inherits down to HR

[jolly yacht]

ohh, Now I understood clearly. Thanks for you're explaination 👍😄

[fathom pendant]

np i've studied a bit of risk management as well and basic cybersecurity concepts (these basic concepts are what you'd find in an exam like Sec+), this operates on the principle of least privilege -- only give what's needed

[wet finch]

could I get some help please?
AD Enumeration & Attacks - Skills Assessment Part II

Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.
||I have full rights on sq01 and ran mimikatz, have all hashes & default password. I've tried password spraying with the 'default' password, tried to rdp in with admin/hash but wasn't able to. Can't win-rim with admin/hash.|| I'm not sure what to do from here.

[next bronze]

there is a plaintext password you can find, look into other options in mimi

[wet finch]

I only saw 1 plaintext password

||"sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::secrets"|| am I missing something?

[next bronze]

I don't know what you got but you can try that password with that specific account

[sterile solstice]

i dont think i used mimi at all in that assessment

[wet finch]

it's not an account pass, it's "default password"

[sterile solstice]

i should've taken better notes, but from what I can see I used ||mssqlclient.py|| and then used ||enable_xp_cmdshell|| to escalate. With ||enable_xp_cmdshell|| I was able to run ||PrintSpoofer|| for a revshell.

[next bronze]

I belive they are already past that

[sterile solstice]

Oh wait, i can see mimi now. just after all that i just typed. my notes say to use mimi or CME. i used CME

[wet finch]

Yeah, that's where I'm at. I ran mimikatz after that

[next bronze]

you haven't found the right creds then, read the output carefully in the lsa dumps

[sterile solstice]

yea sorry. as i said, poor notes....lol

[wet finch]

lol np

Ty for trying. I'm gonna reset the systems (can't even connect to one box now) and try again

[sterile solstice]

did you have administrator?

[wet finch]

on sq01 yeah

[sterile solstice]

with its password?

[wet finch]

just hash, couldn't get pw for admin

[sterile solstice]

I used:
||sudo crackmapexec smb 172.16.7.60 -u administrator -p xxxx --local-auth --lsa||

well when you do, try CME next

[next bronze]

you can pth with cme

[sterile solstice]

yup. very true! I used the SQL vuln to run an exploit that forced a password change

in hindsight, PtH would've been the easier option lol!

[next bronze]

yeah hashes are as good as passwords in windows

(for the most part)

[sterile solstice]

yup when is nice and convenient. especially with the right trust domains 😉

[wet finch]

Okay, lets try this again... lol

[fringe shell]

Hi guys, I need help with the new Broken Authentication Module, specifically in the brute forcing reset tokens part. I was able to identify the live reset token since this is not a specified user attack. But when I input the token, the response is different from the response I get from fuzzing it.

[acoustic owl]

In which section for which question ?

[sterile solstice]

let us know how it goes

[wet finch]

Sorry, yeah. I'm guessing the instance was botched because I was able to ||pth evil-winrm after resetting||

[sterile solstice]

oh great. that module, and password attacks, i had a lot of issues like that.

did you get ||lsa dump|| after that for the next attack?

[wet finch]

mimi isn't giving anything new

[sterile solstice]

you can use more than mimi

i used CME, but NetExec is the better choose. Use the --local-auth --lsa

[wet finch]

yeah, I'm working through things atm. I messed something up lol

[fringe shell]

In Brute Force Attacks Section/Brute-Forcing Password Reset Tokens, the last question. Now, I get it because the token is one time use only, so when ffuf identified it through fuzzing it's as if it was used, so when I request it again in Burp or the web app, it is now an invalid token. I figured that I need to use Burp Intruder to see the requests, and just get the link of the valid token in original session, but burp community is just so slow, 1 hour, I'm in request 200+ and the valid token can be at 4000+. Any recommendations?

[wet finch]

||Inveigh gave me a new user||, so I guess I'm on the right path

[sterile solstice]

yea i got a new user and used it for the next box

i can share that username if you want to confirm? don't want to spoil it though if you want keep trying

think i used CME as i prefer to stay on linux as much as possible. if i can exploit from a linux box over a windows box, i will lol.

[wet finch]

It was the answer for the next 2 questions, so I'm getting close

[sterile solstice]

awesome

[wet finch]

Sometimes I think resetting the instance solves all my problems

[sterile solstice]

haha yea it definitely can.

its a pain sometimes though

[wet finch]

I've spent so much time trying to do something only to have to reset everything and it works. Exact same commands (copy and paste)

[sterile solstice]

yea and the AD module is prone to some of this issues

[acoustic owl]

You can do everything with cURL and ffuf. You don't necessarily need Burp

[wet finch]

oh, the assessment 1 I spent over an hour trying to just rdp into 1 of the boxes. It would keep failing, I'd have to reset instances, get back to the spot, then try again. It was a huge pain.

[sterile solstice]

haha yea. i feel you there. i hope the exam is less prone to these issues. i assume we dont share it with others

for what its worth, i havent had as many issues after that module.

[uneven dune]

guys i have a question about shte module https://academy.hackthebox.com/module/81/section/789

currently i am filtering and i got the file, but i try it and say is wrong

i mean i try to send the answer usging the namefile.typefile structure

my question is, i am not sure what i am doing wrong

[sterile solstice]

sorry, i havent done that module so i'm unfamilar. though hopefully payloadbunny or someone else can help

[uneven dune]

np ❤️

[sterile solstice]

double check you dont have any spaces/special characters in your answer. that can be an issue sometimes

[uneven dune]

yes i try a lot of differents ways, and also i wait a lot of minutes to see if there are more than one file, but is just only one, maybe i need to extract the right name i guess

[next bronze]

what's the first letter of the file name

[uneven dune]

f

[next bronze]

that's the wrong one

[uneven dune]

but currently i waiting around 30 minutes for more files over X protocol

[next bronze]

I rember that question being a pain to do so, the first letter is R

[uneven dune]

okay so i miss something, thanks for your time, i gonna keep looking what can be

❤️

[sterile solstice]

anyone good at assembly? i'm doing the attacking common services module, with the 'connecting to services' section. i have the answer but not entirely sure the why behind it lol

[next bronze]

just ask

[sterile solstice]

so this is the area that I need to insert a break:
call 0x11b0 SQLDriverConnect@plt

and doing: b *0x11b0 , won't work. But instead:
b *0x5555555551b0

the 11 made me wonder if it was 11 characters, but why 5's ?

i do plan on doing some of the CDSA courses as knowing some of this is interesting but i know very little of assembly and why this works lol.

[next bronze]

where'd you get 0x11b0

[sterile solstice]

running disas main within gdb-peda

after setting disassembly to intel

[next bronze]

try running it then disas

[sterile solstice]

i did try that actually. run it, got back into gdb but got the same result

its alright. i should prob just do the assembly course. obviously this prob wont be on CPTS exam (for this specific instance) but thought i'd ask out of curiosity

[next bronze]

you should get the right address once you run it

[sterile solstice]

the longer memory reference is from the module, but its at the same place and calling the same function.

weird ... but good to know if i could across it in the future, i should get the right memory call

[next bronze]

I'm getting the right address once I ran the program then disas

[sterile solstice]

i just did disas main again, and got the right answer

i even left and ssh'ed back into with a seperate session and got the same answer as above ...

so confused as to why it didnt work a few times

sorry. i swear i tried a few times and was getting the different memory call. lol

[next bronze]

you probably exited gdb in between, once the program is ran initially the right addresses will be loaded

[sterile solstice]

yea, youre right. i guess in the future if i have short references in the call then its not likely the correct spot...lesson learned i guess lol

[next bronze]

the assmebly module is pretty good if you want to take a crack at it

[sterile solstice]

its already part of my favourites. will definitely take it

this whole module is a bit annoying tbh. i couldnt get exploiting web vulnerabilities for thick clients to work for me. (many hours trying.) and the PRTG assessment also wouldn't work for me either (even more hours lol)

[next bronze]

yeah it can be a bit of a pain

[uneven dune]

xre cna you

check if the module of what i asking is working fine ?

the hint says can be 3 more files on the traffic but currently i just see one

[next bronze]

does it need to be captured or it's from resources

[idle sigil]

Hey, for SOCKS5 Tunneling with Chisel module, I cannot execute chisel on the pivot's machine - i have already chmod it as well. I get this error msg :/

[next bronze]

file chisel what's the output

[sterile solstice]

make sure you have the right binary. you can download different precompiled from the git repo.

youre not on ARM

[next bronze]

well that one is for ARM, you'd want AMD64

[sterile solstice]

(well i doubt you are)

ARM is for things like a raspberry pie, arduino, etc.

[fickle thicket]

are there any modules in hackthebox academy that teaches you how to use things like dnSpy?

[idle sigil]

I always get confused - so i am using M3 with kali on vm

[sterile solstice]

you need the binary to match the architecture of the system its being run on.

but AMD and ARM are obviously close. i like to double check before downloading for that reason haha

[idle sigil]

but M3 is ARM ?_?

[next bronze]

you ssh'd into the target

you're not running it on your own machine

[sterile solstice]

this. youre running it on the system you're ssh'ing to

just as you'd have a different binary if you were setting it up on a windows machine.

[idle sigil]

ok is there any way that I can check in the future?

running uname -a doesnst show if it is amd or arm :/

[next bronze]

x86_64 is the architecture

[sterile solstice]

x86_64

[next bronze]

for all academy modules you can assume the target is x64

[idle sigil]

oh ok

doh! haha thank you guys 🙂

[sterile solstice]

haha all good mate

its confusing at first, but it all comes together.

https://academy.hackthebox.com/module/113/section/1102

Attacking Common Services - Other Notable Services.

I'm missing something. I've run an nmap scan and ahve the open ports and tried to connect to them to find the application running, but none of answers are being accepted.

nevermind. got the service. man that was annoying lol

[idle sigil]

So I've downloaded chisel (AMD) and am trying to build it, but couldnt 😦

I got the AMD version from here https://github.com/jpillora/chisel/releases/tag/v1.9.1

did I do it wrong? :/

[bright coral]

Those are built executables already...

[sterile solstice]

which would be preferable. just SCP (or similar) over to the pivot and execute there.

[idle sigil]

oh u mean i just need to chmod it and i can use it?

[bright coral]

yes

[sterile solstice]

yes. that should work.

[idle sigil]

ah okok! thank you!

[thorn hawk]

Hello guys. I am left with 1 more question for the WaybackURL part of the gathering info module. Is regarding Facebook.com and what kind of redirect this web app was giving back in March 2022. I have found the redirect which is a combination of facebook.com the letter m and ?_rdr parameter. When i include this as a https or http link for an answer I get an error. Is there something I am missing regarding this redirect name?

[bright coral]

You should read the question again

[soft stratus]

HI all I am stuck on brute forcing 2fa codes from broken authentication modulei did everything according to the proper ffuf syntax, and then tried to fix with chatgpt and at last i even tried from solution, while performing bruteforce, ffuf shows 302 on all codes, and it's really hard to figure what is the right 4 digit otp code

[thorn hawk]

is very strange it just ask for the link that page redirected back in March 2022. I have the link

[idle sigil]

still at 'SOCKS5 Tunneling with Chisel' 😦

i have changed /etc/proxychains.conf

tunnel is set up

but when i try to rdp, proxychains keep trying to connect via the 9050 port... why is that?

[bright coral]

this is definitely the wrong year... re-read the question 😉

[thorn hawk]

Ohhhhhhhhhh my loooord :D

[next bronze]

looks like it's not reading from the config file

it should be /etc/proxychains4.conf

[idle sigil]

😮 what is the difference?

[next bronze]

version 4 which is the default

[winter arrow]

Hello, I'm stack on module INFORMATION GATHERING - WEB EDITION, in the section Web Archives, on question Going back to March 2000 on www.iana.org, when exacty was the site last updated? Answer with the date in the footer, eg 11-March-99

I was on web archives and tried to answer 03-March-00, and previous dates, but it isn't correct can somebody help me?

[mint peak]

I'm hoping the thick client part of the Attacking Common Applications doesn't show back up. This part is miserable 💀

[idle sigil]

ok I have edited /etc/proxychains4.conf as well, but i still cannot rdp :/ it's still trying to connect via 9050

[next bronze]

it's still not reading the config file

look at the start of the output

[winter arrow]

I have answered

[soft reef]

Have you tried using socks4 instead of socks5?

[idle sigil]

do u know how i can fix that? have been googling for solution but havent seen any

[soft reef]

in proxychains4.conf you see socks4 is now commented out, so you remove that and comment out the socks5 line.

[next bronze]

I think they want to use socks5, the problem is that it's not reading from the config file for some reaosn

try reinstalling? https://www.kali.org/tools/proxychains-ng/

[idle sigil]

ok

[next bronze]

if it doesn't work then just -f <file>

[idle sigil]

ive purged and reinstsalled proxychains but rdp is still trying to use 9050

[next bronze]

^

[idle sigil]

which file?

[next bronze]

the config file

[idle sigil]

😮

[soft reef]

-f /etc/proxychains4.conf

[next bronze]

as it using it as a flag together with proxychains

you don't ever use -something on its own, those are flags/switches

[idle sigil]

haha yea i was like ... whaaat. --> diff error this time

[next bronze]

that's a rdp problem now

[idle sigil]

T_T

[next bronze]

check if the pivot can reach the target host to begin with

[wraith pelican]

if the target can reach, try with /timeout:200000

[idle sigil]

target host is unreachable

[next bronze]

well that's a problem then

always make sure your pivot host can reach the intended target before you start the pivot

[wraith pelican]

does ping goes thru proxychain? i thought it didnt

[zenith vale]

can someone help me in csrf - sesion attack

[idle sigil]

I assumed the target would be up cuz that's what the lab is asking for T_T

[zenith vale]

session*

[idle sigil]

i pinged it thru the pivot, so it should go thru?

[zenith vale]

i dont wanna spoil anyone o if i can contant someone in private

[autumn pilot]

question, why have you started chisel in server mode using sudo

[wraith pelican]

ah yeah sorry my bad

[idle sigil]

does this mean i should restart the lab?

[autumn pilot]

you are not specifying a port that would require root privileges to listen on

[next bronze]

idk but web01 can't reach the target to begin with

I don't remember if it's supposed to

[sterile solstice]

Can anyone help me with a hint for the last question of 'Attacking Common Applications - Skills Assessment I' .... i know the application but i can't seem to figure out how im meant to get a shell

[autumn pilot]

it is windows, so there is a high chance of not allowing icmp requests

[next bronze]

ah right

[idle sigil]

does it matter?

[idle sigil]

but my rdp isnt going thru X_X - have been working on this the whole day

[autumn pilot]

¯_(ツ)_/¯

[wraith pelican]

in the course for the reverse pivot they say to use sudo chisel

[zenith vale]

@autumn pilot can i ask u a question in private regarding a session attack module question

[soft reef]

also check where you're running the chisel client from, why is there an error there?

[idle sigil]

both connections are fine

it has this error when i try to rdp

[soft reef]

so you're running the server from your local machine and client from the pivot? Maybe thats not the way.

[wraith pelican]

hard to help if you dont give the command you used

[soft reef]

Does the chisel server need to run from your machine or the pivot?

[idle sigil]

am using the reverse chisel pivot method in the module

[spiral pollen]

37,7 1,00 в чем разница?

[idle sigil]

i'll try the non-reverse method later after taking a break lol.

Anyway, if the reverse method doesnt work, how would the non-reverse method work?

[next bronze]

I just checked, web01 can ping 172.16.5.19

reset the lab

[idle sigil]

ok will try again after dinner X_X

thank you guys for ur help 🙂

[tulip dragon]

in secure coding 101 is it onlyfor JS?

or htb only made it for js only

[next bronze]

secure coding applies to every language, just that the module is js focused

[tulip dragon]

emmm

so why they only picked js

[next bronze]

because web is a very common attack vector and most web apps are writtern in js

[tulip dragon]

but most of the time in modules php was introduced i was hoping they would create dedicated php secure coding but i discovered js😔

[soft reef]

Has anyone here written a script for Injection Attacks -XPath - Blind Exploitation?

[spiral pollen]

Can anyone help?

[soft reef]

Whats your question?

[naive sage]

they already built.

[naive sage]

what?

[wraith pelican]

you should be able to ping the target from ubuntu ssh session

[tulip dragon]

almost english

[spiral pollen]

What is the difference the two numbers of the learning progress ? Numbers 37,7 and 1,00 , this question is from the academy, information security foundations

[next bronze]

module and section?

[spiral pollen]

Learning progress

[next bronze]

wait huh? isn't it just a simple minus

37.7-1

[spiral pollen]

☠️ I mixed up a period and a comma

[sterile solstice]

Attacking Common Apps - Skills Assessment 1, complete. that was way harder than i expected tbh. i found the RCE almost immedately but couldnt figure out how to execute in the context i was in ..

[storm elk]

Great job

[sterile solstice]

Hopefully I can get assessments 2 & 3 done tomorrow. I want to move onto privesc!

[storm elk]

🤞

I’m sure you will!

[split glade]

Personally I also found the 1st one to be the hardest, at least if you don't use the metasploit module to solve it

[sterile solstice]

I didn't use msf tbh

I had a learn but none of them would trigger for me

Ended up changing the python script for the CVE to execute my msfvenom revshell

Hardest part was that fuzzing gave some misleading results!

[sterile solstice]

Thanks mate. After countless hours trying to do 2 other sections of the module, I moved on. Will have to officially circle back to officially do the module. Haven't enjoyed this one tbh

[storm elk]

I know how that feels.

You’ll get there 💪

[sterile solstice]

Yea I will. I can see the finishing line for CPTS. So close. Though a while off doing the exam lol

[tired lake]

Hey guys. Just wondering when you start off a box do you do an all port nmap scan or just the default ports(as in no -p flag). And if you do an all port scan how long does it usually take?

[soft reef]

Depends on how much enumeration you want/need to do. If you use flags like -A it takes longer but with -T 5 it will go faster. I usually scan all ports because I dont want to get stuck and then find out later I missed a port.

[ocean night]

Bro going -T 5 like a boss

😄

[soft reef]

lol paid subscription ftw

[tired lake]

Im doing a -sC -sV -p- and its been going for 15 minutes. When i do ctrl+v it says about 5.68% done and 4 hours remaining 😂

[soft reef]

Ok have you pinged the target?

[ocean night]

Yeah, bump up the speed with -T 4 to start with

The limits on timeouts etc are pretty high by default

[naive sage]

-T5

[ocean night]

https://nmap.org/book/performance-timing-templates.html

[ocean night]

https://tenor.com/view/hobbit-tempt-gandalf-dont-tempt-me-gif-5609024

[tired lake]

Yupp the target is up and good

[tired lake]

Fair enough

[soft reef]

Which section are you working on?

[wraith pelican]

When doing an all port scan, Is it not better to check for open ports first, then do a service and scripts on those open ones?

[tired lake]

This is the footprinting medium lab. But honestly i have had this problem for a while 😂

[tired lake]

When doing a -t4 how is the accuracy usually? Does it tend to miss out on stuff?

[naive sage]

I won't Sir.

[wraith pelican]

T5 on all ports it seems to me, you may miss some ports, which defeat the purpose of an all ports scan

[ocean night]

T4 is my go to over public networks

Usually works well

On networks with lower traffic and latency, you could push T5

Depends on how noisy you want to be as well

[next bronze]

T5 is too fast usually, T4 is good on a decent connection

at least for htb stuff

[tired lake]

Im running on the assumption that nmap will detect the open ports first only then will it run the scripts on the open ports. Not running the scripts on every single port. Correct me if i am wrong

[soft reef]

I've ran the nmap command in medium lab and its done in few minutes.

[wraith pelican]

It seems right, but like 4 hours seems very long…

[tired lake]

Yeahh from what I have seen others do it, it doesn't take too long. What was the command did you use?

[soft reef]

I only used the -A flag

[tired lake]

Ikr. Im just curious what is wrong with my scans

Im using eu academy 6 on tcp and it says its low load

[ocean night]

What ping are you getting from the target?

[tired lake]

Avg rtt is 375ms

[ocean night]

I usually do nmap -A -T4 -v <target ip>

[next bronze]

is it stable tho? what's the jitter

[ocean night]

That is pretty high.. are you in the closest VPN server to your location?

[next bronze]

gob any plans of having academy servers in asia?

[tired lake]

Mdev is 100ms

[ocean night]

Can't comment I'm afraid, but infra is continually growing and improving

[tired lake]

Unfortunately so. Im currently back home in asia

[next bronze]

I see, it would be really great for a lot of people

[ocean night]

What about through a Pwnbox?

[next bronze]

maybe find a stable server to use, seems like you're dropping packets and that's why nmap is taking such a long time

https://gist.github.com/Xre0uS/2105986d23719cf99c271842528f48a6

[nova rapids]

Hi admin today i finish my linux fundamental module but i didnt get my cubes after finishing help i want to open another module

[next bronze]

or use a pwnbox in the server region yeah

[tired lake]

I havent tried it through pwnbox because all my tools are in my vm. But i might just run my initial nmap scan through pwnbox and continue the rest in my vm

[ocean night]

I'd recommend raising a support ticket via https://help.hackthebox.com - there is limited support capacity during weekends however, so you may not hear back until Monday.

[tired lake]

Yeahh seems like the best option

[ocean night]

The Pwnbox comes preloaded with most if not all of the tools you'll need

[digital junco]

Hello, I just wanted to say to the people who worked on updating the Information Gathering module - Web Edition
THANK YOU VERY MUCH!

This should be the default for all modules...

Simple, concise, well explained, full of important details, focused on teaching what the thing is and how it works.
I simply loved this teaching. Whoever organized this update, please do it again in other modules.

[ocean night]

I'll pass that on to the team, thank you for the lovely feedback @digital junco

[digital junco]

I'm the one who thanks you, my dear!
I love Hack the box.
This platform changed my life.

[jolly yacht]

Sorry for the Late Response but i think "Introduction to Windows Command Line" Module is most beginner friendly for a complete beginner comparing to either Windows Fundamentals or Linux Fundamentals. This is just my opinion that might help you to get started easily. Try out Linux Fundamental Module First and if you feel it had some complex term that you don't understand then go for the Introduction to Windows Command Line Module. it contains less likely terms that might feel confusing for a complete beginner from my experience, all the best for you're learning.

i saw you're Message yesterday itself but as I was doing "Introduction to Windows Command Line" Module and i thought it might be a solution for you.

[spice anvil]

Thank you. I'll give it a try.

I checked and they actually mention windows fundamentals as a prerequisite to windows command line.
And in the windows fundamentals intro they mention stuff like CMDLET and WMI classes.
Here is the para "We can use the Get-WmiObject cmdlet to find information about the operating system. This cmdlet can be used to get instances of WMI classes or information about available WMI classes. There are a variety of ways to find the version and build number of our system."

[nova rapids]

Admin i didnt find the page do you have a moderator who can help me with my problem

[ocean night]

I don't know if I can help, but DM me your Academy Email Address @nova rapids - as I said, support is limited during the weekends.

I will not be around for much longer @nova rapids

[tired lake]

Btw I have tried running the nmap scan on pwnbox with T4 and it says its gonna be around an hour. I am using the pwnbox location which is closest to me (singapore 29ms) 😂

[next bronze]

you should use pwnbox at the server regions (US/EU) otherwise you'll probably run into the same problem

[tired lake]

okay yeah thats true. it seems i will be using the pwnbox for nmap scans then. using the uk pwnbox is a little laggy for me. but the scans are fast. good to know i have not been doing anything wrong before this hahaha

[rustic sage]

hi guys, I have a problem this module INTRODUCTION TO C# Libraries
I don't know if I'm doing something wrong, but I keep getting the following error. dotnet run --> Unhandled exception. System.IO.FileNotFoundException: Could not load file or assembly 'Library-Question, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'. The system cannot find the file specified.

File name: 'Library-Question, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'

[soft reef]

@ocean night For CWEE custom exploit development will be a part of it but will HTB also teach how to write the exploits in the modules?

[ocean night]

That's not something I can answer, sorry

Not because I don't want to, or am prevented from doing so, but because I do not have the answer.

[soft reef]

Okay np.

[acoustic owl]

Yes, this is covered in the Intro to Whitebox Pentesting module

Apart from that, you will always have to write scripts throughout the path

[soft reef]

Okay thank you.

[pallid jay]

Hi, anyone solve stylish? I already obtained the token and can approve my CSS, but I need references or hint on the sql injection part…

[wraith pelican]

you got better chance to get help in #boxes

[pallid jay]

I don’t have access

[wraith pelican]

you have to follow the steps there #welcome

[pallid jay]

thanks man

[next bronze]

why not

damn how is it also broken on your own machine

uninstall both and try installing using pip only

ah

#modules message use this

generally you shouldn't do it

[next bronze]

^

[zenith vale]

is it just me or the boxes in the modules wouldnt spawn

[midnight galleon]

Hello
What would you recommend for someone who finished the pentester path for the tier 3 modules?

[zenith vale]

my connection is fine , and im tuned via the vpn and all

itsjust tryna spawn a machine for like a year now

[midnight galleon]

I am thinking Attacking Authentication Mechanisms or the Sliver C2 modules but i am not sure

[native turtle]

no Im not using burp

by the way now it seems work... so I think its some VPN trouble

[hot owl]

Hi

Has anyone done XPath - Blind Exploitation part?

[next bronze]

those two are very different stuff, choose the one that's the most interesting ig

[dim wolf]

i'd do the evasion module

[fathom pendant]

I suggest not revealing info about the AEN module as many do it blind

[native turtle]

Im sorry I deleted the message

[acoustic owl]

Yes, some people have completed this module. To be precise, 416 people have completed the Injection Attacks module.

[hot owl]

Ohh so

Have you?

[acoustic owl]

Just ask your question

[hot owl]

I have exfiltrate the 2 users

Admin and htb-stdnt

[acoustic owl]

Have you exfiltrated all the data?

[hot owl]

So my question is how to apply this methodology to all users and their properties to exfiltrate the entire data set.

@acoustic owl

[acoustic owl]

Read these three sections again. Everything is explained there

[hot owl]

Blind exploitation

Okay

[acoustic owl]

All three sections explain how to extract data.

[hot owl]

Okay

[naive sage]

https://tenor.com/sJ6iYaZHvSx.gif

[limber wasp]

what's up everyone. im working on the api attacks module. i'm not sure if im missing something here, or it's an error or what. the first lab scenario <Broken Object Level Authorization> it states: Because the account belongs to a Supplier, we will utilize the /api/v1/authentication/suppliers/sign-in endpoint. ok makes sense.then on the next lab, broken authentication. it states: Because the account belongs to a supplier, we will utilize the /api/v1/authentication/customers/sign-in endpoint im not understanding the correlation i guess. can any one help me understand this?

[fathom pendant]

Likely a typo

[limber wasp]

Ok, i thought so. I just didnt know if i was missing something. thank you. it doesnt make sense right?

I was just about to dm u, and ur message came through... l

[fathom pendant]

Submit to #1234357888114364508 with screenshots

[fathom pendant]

I don't do private dms

[limber wasp]

awesome thanks. that was my next q! ur so on it.

[fathom pendant]

Too many people wanting and then? step by step

Critical thinking is crucial in this field

¯_(ツ)_/¯

It's useful for surface level stuff, and then digging into manual testing

[dim wolf]

there's a difference between vulnerability assessment and penetration test

[fathom pendant]

^

[dim wolf]

using nessus falls in the former

[fathom pendant]

Vuln assessments are just that, they assess potential vulnerabilities

It's why they have different predetermined scan types for different regulatory authorities

¯_(ツ)_/¯

It's not that bad tbh

Nessus UI is better than OpenVAS

[limber wasp]

yes it is. I rarely come here, and usually when i do its just to be a lil nosey. i dont want anyone to tell me step by step. i love that feeling when u finally get something to work, or solve a lab. i dont get that feeling if i get someone to tell me step by step. but i don't feel like finding a blog post on how to pull something off is the same thing. what do u think?

[fathom pendant]

It depends. Blog posts that further explain a topic can be helpful

Different view points and all

[limber wasp]

👍 thanks... stay sane

[tidal mango]

Ok I'll give that a shot, even using the show solution button if I follow that exactly I got errors. But let me try again today, maybe I will have better luck, thanks!

[fathom pendant]

It takes a minute for all the modules for nessus to load, btw you need to do the scan from the target machine anyway

(There are preloaded scans on it)

Yeah the targets have preloaded scans so you don't have to spend the 40+ minutes waiting on the scan to finish

[digital vessel]

https://academy.hackthebox.com/module/details/23

file inclusion the last part of " Skills Assessment - File Inclusion "

i CANNOT get this to work if i scan i get 9 ../ but i have tried from 1-12 (i already have the answer cuz i looked it up. but the box just will not respond to burp sweet can somebody else test this pls

how can you tell how many ../ you need? did you / your box stop responding im on box num 11 and counting all same issue same spot.

[cloud urchin]

your answer lies within the "Basic Bypasses" section

you can't really tell, it's all just trying stuff out

i have specific notes about the skill assessment telling me i didn't use that method to get the answers, so you may be barking up the wrong tree in the skills assessment

[forest glen]

Hello
Does anyone know companies that offer graduate programs for recent graduates
That also take international candidates?

[fathom pendant]

You'll need to research on your own but this isn't the channel for that conversation, read and follow #welcome and ask in #careers-and-certs

[tidal mango]

@next bronze I tried bloodhound-python with both the HTB-Student user and the Administrator with the hash but both fail. Which user did you use to do that part?

[next bronze]

that's the last question? you should use the users you have from the previous domain

either bh python or sharphound should work

[tidal mango]

Yeah last question, I just didn't have any passwords for users from the prior sections, I got all three of the first questions done just using the CHILD-DC.child.inlanefreight.ad machine and powershell... I will see if I can get a password out of another user.

[next bronze]

huh? you can't do question 3 without a local shell

either way you should have domain accounts for mssp if you've done q3

[fathom pendant]

we don't do that here

read #rules

[still stag]

She's not into security

[fathom pendant]

doesn't matter too much as it's not relevant nor legal

[still stag]

Daymn, sorry will be careful next time

[fathom pendant]

let's not @cloud urchin (as comical as it can be)

[fathom pendant]

best bet is to just turn it off

[still stag]

If u have suggestions jus pm me

[fathom pendant]

there's nothing you can do

report to the authorities

and move on with your life

[cloud urchin]

my suggestion is if you think her account has been compromised is to reach out to the company who is providing the service, that's your only recourse

no one here can help you and anyone claiming they can is probably just going to scam you out of money

[still stag]

Ya ik, will do my best

[swift cloak]

i dont get what am i supposed to put in Submit root flag?

[cloud urchin]

without more details the best answer i can give you is: the root flag...

the flag that can only be accessed by the root user or user with root privileges

[fathom pendant]

the root flag of the machine..

usually found in /root/root.txt

[swift cloak]

i must be missing something XD

[fathom pendant]

what academy module is it related to?

[swift cloak]

first one

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

Name

[swift cloak]

xdd

[cloud urchin]

the "first one" is the one you pick to start first lol

[swift cloak]

Meow

[fathom pendant]

oh

that's not an academy module

that's a starting-point machine

[swift cloak]

😛

[fathom pendant]

read and follow #welcome and ask in #starting-point

[silver iris]

Hey guys,

i´m doing the "Attacking Common Applications" Module and i´m stuck on the last question of the "Attacking WordPress". I got access to the admin panel, but i can´t update the source code. It always takes forever and says it didnt work.

[slender violet]

PIVOTING, TUNNELING, AND PORT FORWARDING > RDP and SOCKS Tunneling with SocksOverRDP
https://academy.hackthebox.com/module/158/section/1439

I am only able to RDP into the internal node if the /etc/proxychains4.conf file is set to SOCKS5 and port 1080 on my Pwnbox (Parrot OS).

Why does the configuration on Parrot OS matter when Proxifier is running on the pivot machine (htb-student)?

[fathom pendant]

because you're bouncing between Attacker → A → B → C

iirc

and that's how it's set up to work

the proxifier setup you do uses socks5:127.0.0.1:1080

[slender violet]

Got it. That tripped me up for a while.

Thanks

[idle python]

What is the API key in the hidden admin directory that you have discovered on the target system?

[fathom pendant]

subdomains of subdomains exist

wait this exists on a single subdomain

not the double

so this one is actually just: 🤖 will lead the way

[idle python]

for long time i still didnt find any thing

[fathom pendant]

are you using the right wordlist?

[idle python]

yap

[fathom pendant]

you should be using the wordlist used a lot in this module; subdomains-top1million-110000.txt

[idle python]

ok

[fathom pendant]

after that it should become clear where to look

🤖 is always an interesting file to check for

[tidal mango]

Well yeah, but I just used Enter-PSSession to do it and a kerberos ticket. I just find it odd even the solution provided does not work. But I am going to revisit it and see what I missed, thanks for the tips!

[idle python]

let me check which subdomains

[silk prism]

anyone know if its possible to gain a foothold on the Linux PE skills assessment lab with the tomcat portion? i know its optional but i will like to get it

[silk prism]

nvm found my way in

[tidal mango]

ok... well that was really hard! but I got it done finally.

[civic hamlet]

is it not useradd -d? or am I not understanding the question

[civic hamlet]

yeah dont even mind me

10 seconds of reading later I found it

differnce between creating and using

[spark spruce]

Module - Advanced XSS and CSRF attacks
Section - Bypassing CSRF Tokens via CORS Misconfigurations

Question - Identify a CORS misconfiguration and exploit it to conduct a CSRF attack and obtain administrator privileges.

I am trying same as section did but i cannot make sure that its Origin header is misconfigured

Just I did same but in my case origin shows null

Any hint??

[wraith pelican]

i haven't done this module. But your example shows a .htb origin, then you use a .com. What if you use .htb as the example?

[spark spruce]

I have used .htb too and many types url but it shows null only

even if I type real origin it shows null

[wraith pelican]

if you try in your request origin: "null" ?

[digital vessel]

i followed a how to video, still does not work lol i had 2 other ppl try again so far does not work i get to the point i enter the burp suit command stuff and the box just stops responding period. it will just spit out jibberish after this point its why im asking. i got screen shots i wish i could get a mob just find out wtf is going on.

again i have ../ ( 9 times ) via my scan but i have tried every version on 11 boxes all same results all freezes the very same spot. same way to it will work right up to the repeater then just dies (reguardless of commands)

[fathom pendant]

Message support then

[spark spruce]

null

[wraith pelican]

ok... sorry, that's all the tricks i got for this morning

[acoustic owl]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

[wraith pelican]

yeah and that one too: https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null

[cloud urchin]

see my other messages there

[spark spruce]

Yeah but tried all possible but I think section's guide would be different then question's solution

In the first scenario where the Origin header is invalid, the server likely recognizes the origin as invalid or untrusted, resulting in the Access-Control-Allow-Origin being set to null.

In the second scenario where the Origin header is removed, the server sets Access-Control-Allow-Origin to the actual URL of the site because the request is considered same-origin.

So it is not possible to attack on origin

I think there is another way to solve the question.

[uncut scarab]

hi, anyone has done the API attack module? I don't know how to solve this question: "Exploit another Broken Authentication vulnerability to gain unauthorized access to the customer with the email '[e-mail]'. Retrieve their payment options data and submit the flag."

[spark spruce]

I just want to know that
does question's solution is same as section is guiding or need to find another hint instead of attacking on origin header??

[acoustic owl]

The section is not a guide. It explains the misconfiguration and how you can take advantage of it. The task is not 1:1 as described in the module

[spark spruce]

Yeah thats what I wanted to know

but can you hint me any another way to find misconfiguration?

[acoustic owl]

Have you looked at the hint? If so, you know which endpoint you can exploit

[acoustic owl]

You have already found the misconfig

[uncut scarab]

hi, I did see the hint. But still don't know how to use it

[acoustic owl]

What have you already tried?

[spark spruce]

But I did't realise it
where

[acoustic owl]

#modules message

[spark spruce]

Bro
I have tried to check Origin but did't found anything

[acoustic owl]

You see it in front of you
|| Access-Control-Allow-Origin: null ||

[uncut scarab]

I tried use /email-otps to send a new PASSWD to the email and then use /reset/password to enumerate the newly set PASSWD

[kind turret]

Wrong thinking

[uncut scarab]

what's the right one?

[kind turret]

When you do an OTP reset usually, what does the company send you?

[uncut scarab]

send a one time pwd to my email

[kind turret]

There you go

[cloud urchin]

there's more to that section than just the CORS misconfiguration.

[kind turret]

Try to attack that

Not enumerating passwords

[uncut scarab]

I cannot login to the email

it

[spark spruce]

should I use Iframe to the script to make it null

because previous section says this

[kind turret]

You are not supposed to login. You are supposed to hijack the account although you dont have its password.

[spark spruce]

section is showing that

it accept any url as origin and then using a script it can promote user to admin

but in my case the origin is not accepting any url , just showing Access-Control-Allow-Origin: null

if I reutilise previous section
there is null exploitation topic saying to use Iframe sandbox

[uncut scarab]

I don't get it

[acoustic owl]

Try it 😉

[spark spruce]

okay

[cloud urchin]

ok so did you bypass csrf then?

[spark spruce]

I am just looking to bypass it
that's why trying to check origin as vulnerable or not.

[acoustic owl]

#modules message

Pedant has told you what you have to do

[uncut scarab]

I use /reset/email-otps and then /reset/password to set a new pass. {
"SuccessStatus": false
}

the success status always be false

[cloud urchin]

you don't need to look at the previous section. this section goes over what to do.

[spark spruce]

so does it mean that Origin header is still vulnerable?

As I have tried as section did but got null instead of url

[acoustic owl]

You send three parameters. ||Two of them are fix. One of them is variable...||

The rest is as shown in the module

[uncut scarab]

this is what I sent

and it's from Broken Authentication in the API attack module

[acoustic owl]

I deleted this because it contains spoilers.
||Look again what OTP is||

[cloud urchin]

This section isn't about CORS misconfigurations. It's about bypassing CSRF via CORS misconfiguration.

[spark spruce]

does it mean
I have to look on csrf token?

[cloud urchin]

considering the whole section is dedicated to bypassing csrf, yeah maybe you should look at that

[uncut scarab]

that's enough, I don't think it's my problem. because, the otp is only one variable which is the email

[spark spruce]

I sent you DM

[spark spruce]

sure

[acoustic owl]

No, it is not email

[spark spruce]

bro
question is Identify a CORS misconfiguration and exploit it to conduct a CSRF attack and obtain administrator privileges.

so first I have to identify CORS then CSRF??

[cloud urchin]

you already identified it

[night crypt]

hi everyone having some trouble with AD Enumeration & Attacks - Skills Assessment Part I, I'm at question 4, have the credentials for the user from steps 2 & 3 but I can't for the life of me figure out what to do next :/ I've been trying to get a tool onto the initial host to pivot from but every time I try to upload different tools through the provided webshell it just errors out, similar issue if I try drop them on using a reverse PowerShell or CMD session. Any tips please would be super appreciated!

[spark spruce]

is this
Access-Control-Allow-Origin: null

Vulnerable??

[cloud urchin]

idk man. do you think the skill assessment would not be vulnerable?

[spark spruce]

maybe I am missing something

You said that I have already identified it
and same @acoustic owl have said that Access-Control-Allow-Origin: null is the misconfiguration

but I don't know how to exploit it as whenever I use script it shows nothing .

[cloud urchin]

they provide a sample payload in the section

[acoustic owl]

You've already given yourself the answer
#modules message

[spark spruce]

this is my payload
and it is not working

[wraith pelican]

well, the 4th question tells you what to do next, you are on the right track with your pivoting. I had the same issues, i found it was easier to get an interactive session to pivot

[cloud urchin]

@acoustic owl can i dm you?

[acoustic owl]

sure

[spark spruce]

bro I have used in iframe in my script
but didn't get it
#modules message

[cloud urchin]

you have an error in your script

[idle sigil]

Hey, for module 'ICMP Tunneling with SOCKS' i am getting this error msg for ptunnel 😦 I cannot find anything relevant for this on google

[night crypt]

thanks, I think I may have finally managed to take the next step, do you mind if I DM you quickly please just to try understand why this has worked for me now?

[fathom pendant]

Syntax error in the script it looks like

[spark spruce]

what type of error
is it word/spelling error or something other

[fathom pendant]

I suggest taking this to dms

[wraith pelican]

yes i can try to answer, sure DM

[cloud urchin]

yeah should probably delete your code from here

[spark spruce]

okay sure

[cloud urchin]

my suggestion is throw it into chatgpt and ask what's wrong

[spark spruce]

yeah

[idle sigil]

this is per example given tho

[spark spruce]

okay

[fathom pendant]

¯_(ツ)_/¯

All I can tell you is what the error says. Perhaps try downloading a new binary/recompiling it

Also I'm referring to the script itself, not the command you're running

[spark spruce]

I got it
Actually my script haven't any error
I just need to wait for couple minutes to get response from my victim and I was not being keeping patience 😄

Thanks for your help and @acoustic owl thanks to you too.

[echo bobcat]

Hello guys. I am stuck in "Interrogating Network Traffic With Capture and Display Filters"(INTRO TO NETWORK TRAFFIC ANALYSIS)
I use the Pwnbox but can't finish any task on it. After searching for any Q&A and discord, I still don't understand how to finish it.
I had stock here for over three days. Did I miss any beginner's Guide?
Please help me.

I am a 100% newer for HTB.

[wraith pelican]

sorry for asking as it may be obvious. but did you check the answer there to help you?
Also it depends on your background but this module is not easy if you do not have the prerequisites

[thick viper]

i am stuck at wordpress part for long on cybernetics can someone help, give some hint, just some hint..?? on cybernetics prolab

[wraith pelican]

you have better chance of getting help there #prolabs-zephyr

[thick viper]

"No Access"

[wraith pelican]

you have to follow the steps at #welcome

[thick viper]

i am getting this error "Identification error: please contact an online Moderator or Administrator for help."

[wraith pelican]

i cant help with that, check with mod or admin

[night crypt]

anyone else having trouble getting target boxes to spawn in HTB Academy atm?

[rustic sage]

Change VPN

[night crypt]

already swapped from US to EU & back again

(i.e. tried it 3 times haha)

[rustic sage]

Lol

[night crypt]

specifically AD Enumeration & Attacks - Skills Assessment Part II

maybe it'll fix itself after dinner 😄

[rustic sage]

Could be some kind of technical issues going on tbh. Give it some time and try again like you said

[night crypt]

perhaps something struck by the crowd 😛

[echo bobcat]

Thanks for your reply.
Yes, I checked the answer.
But I don't know how to import the .PCAP file into the virtual machine.
I finished Google IT support and Google cybersecurity before, so I think the problem is the lack of familiarity with this platform.

[next bronze]

worked for me

[night crypt]

hopefully mine will be fine when I get back from dinner too then, ty

[next bronze]

importing into where? wireshark? https://www.wireshark.org/docs/wsug_html_chunked/ChIOOpenSection.html

[echo bobcat]

The Pwnbox...?
I supposed the tasks should be done on it?

[next bronze]

yeah download the pcap file onto pwbox and import it into wireshark

or tcpdump, whichever the question asked for

[echo bobcat]

Yes, that's the point.
I downloaded the pile on my PC, but I don't know how to import it into Pwnbox.

[next bronze]

should've mentioned that to start with. just copy the download link to the pwnbox and download there

unless you're using the free plan

or if you have wireshark insalled elsewhere you can just use that, it's the same thing

[echo bobcat]

Sorry for the lost background information.
Yes, I use HTB Academy with the free plan.
I am a newer one and only use HTB for a few days.
I also have wireshark on my PC but I just want to familiar with tcpdump in this chapter.
Because that's the core of this module for me.

[next bronze]

hm do you have a linux vm you can use?

[fathom pendant]

Wireshark should already be on pwnbox I thought

[next bronze]

yeah but they can't get the pcap files from resources to pwnbox

[fathom pendant]

Also the free pwnbox is limited but htb resources should be whitelisted

[next bronze]

is that how it works?

[fathom pendant]

Yes

[next bronze]

ah cool didn't know that

[fathom pendant]

I believe gh is also whitelisted

[echo bobcat]

Not yet.
I check the Q&A and try to install it.
But the information there is outdated.
The download website looks totally different.

[next bronze]

get resources link of the file you want and download on pwnbox

[fathom pendant]

Generally should be able to right-click -> copy link

From there it's as simple as wget

[fathom pendant]

Try and install what? Many flavors of linux out there

ParrotOS and Kali are fairly popular in the industry

Unless you mean vmware, in which case that's due to broadcom buyout

I use virtualbox personally

[echo bobcat]

I just wanna ask that.
You completely predict my question.

[echo bobcat]

Thanks for the answer, I will try it tomorrow.
(wait for the spawns recover)

[fathom pendant]

https://tenor.com/view/the-chosen-os-escolhidos-los-elegidos-jonathan-roumie-jesus-the-chosen-gif-5665344780803353145

[fathom pendant]

If you use your own vm, you don't gotta wait

[next bronze]

if you don't wanna wait, set up your own linux host, way more control and convenient

[rare swan]

Anyone else having trouble connecting to: https://academy.hackthebox.com/module/144/section/1311

Just wont spawn

[fathom pendant]

Refresh page; try changing vpn regions

[rare swan]

When refreshing page it fetches status and then trying to connect automatically?

[echo bobcat]

Yes, I also try that yesterday.
But the different websites of VM make me don't know how.
It's just too on chance.

[next bronze]

smbserver.py

impacket-x stuff is installed via apt

[next bronze]

there are many videos on setting up kali/parrot on vmware/virtualbox, look it up

they're the same just installed differently

[echo bobcat]

Okay, I am trying for that.
Thank you guys.
Everyone is so nice here.

[idle python]

Recently HTB has modified this module and I am stuck on the last question of the Skills Assessment. What is the API key in the hidden admin directory that you have discovered on the target system? Can anyone give me a hint to find the solution?

[rare swan]

@Soule Are you able to start this module - because i cant?

[wraith pelican]

the biggest hint is in the assessment intro, check the bullet points and see if it is anything you havent explore yet

[idle python]

I'm almost finished

[rare swan]

@idle python me too - but unable to spawn this module somehow - annoying

[rare swan]

@fathom pendant vpn is connected - just having problem with this specific section - others work as expected!

[idle python]

that is not easy!!!

[rare swan]

@idle python ???

[idle python]

yap

[idle python]

how many questions do you have left?

[rare swan]

none

just redoing skills assessments - but as you said, answers have changed...

@idle python just lacked to document those... - so i have to reinvent the wheel...

[idle python]

i still search hint

[rare swan]

Is this really the last question? - just wondering

[idle python]

What is the API key the inlanefreight.htb developers will be changing too?

[rare swan]

@Soule - just saw i didnt answer the last question too - but unable to try because i cant spawn the machine... - its just spwning forever

[next bronze]

I can spawn it fine

[rare swan]

@next bronze - the problem is as soon as im going to this section it fetches status as supposed - but afterwards its trying to spawn automatically - without any interaction???

[next bronze]

it's probably stuck at spawning and it's a docker container so there's no way to reset it

[next bronze]

just take this for now 94.237.55.105:37436, it's the SA instance

[rare swan]

thx

[wraith pelican]

when i had this case, i just tried to hard refresh with ctrl-shift R
if it does not work, disconnect from platform, reconnect,
or clear htb browser cache
it finally worked

[surreal orchid]

Hello, is there any issue with the wordpress component from Attacking common component ?

Just trying to modify a php file i get :
Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means, such as by using SFTP.

And the msf module from the course doesn't work either .. 😦

[+] Authenticated with WordPress
[] Preparing payload...
[] Uploading payload...
[-] Exploit aborted due to failure: unexpected-reply: Failed to upload the payload
[*] Exploit completed, but no session was created.

[candid lily]

why does it display 3 ports lol

[split glade]

Try selecting an other theme

[surreal orchid]

I was on twenty twenty 😦

[night crypt]

that feeling when your target clearly didn't actually extend when you clicked the button 🥲

[rare swan]

@next bronze can u give me another ip please - thx

host isnt reachable anylonger

[next bronze]

is it still broken for you 94.237.59.199:31954

you should contact support if you run into this again

[rare swan]

yes - thx

[wraith pelican]

The given path's format is not supported

[next bronze]

missed a slash

[night crypt]

is anybody able to please give me a hand validating whether an error is a me doing something wrong thing or potentially something buggy in my module? I've read a few walkthroughs & even watched a guide for this step and I don't see how what I'm doing is wrong.

Module is AD Enumeration & Attacks - Skills Assessment Part II

||```
└──╼ $kerbrute passwordspray -d inlanefreight.local --dc 172.16.7.3 users.txt Welcome01

__             __               __     

/ /_____ / / _______ / /
/ //_/ _ / / __ / / / / / __/ _
/ ,< / __/ / / // / / / // / // __/
//||_// /.// _,/_/___/

Version: dev (9cfb81e) - 07/20/24 - Ronnie Flathers @ropnop

2024/07/20 09:52:08 > Using KDC(s):
2024/07/20 09:52:08 > 172.16.7.3:88

2024/07/20 09:52:13 > [!] [e-mail]:Welcome01 - NETWORK ERROR - Can't talk to KDC. Aborting...
2024/07/20 09:52:13 > [!] [e-mail]:Welcome01 - NETWORK ERROR - Can't talk to KDC. Aborting...

[next bronze]

codeblock pls
```
like this
```

can your host reach the dc?

[night crypt]

yep, I can ping it - I've also tried this direct from the initial SSH box, from my Kali machine through the Ligolo-tunnel

and even on the RDP connection to the first box after the initial jump box

[next bronze]

check if port 88 is open

[night crypt]

it is

┌─[htb-student@skills-par01]─[~/Downloads]
└──╼ $sudo nmap -p 88 172.16.7.3                                                                                                                                                                                     
Starting Nmap 7.92 ( https://nmap.org ) at 2024-07-20 10:04 EDT
Nmap scan report for inlanefreight.local (172.16.7.3)
Host is up (0.00036s latency).

PORT   STATE SERVICE
88/tcp open  kerberos-sec
MAC Address: 00:50:56:B0:6A:0E (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

idk if it's just been me having bad luck, but I've had an absolute hell of a time with Skill Assessment Part I & now II labs having to just be reset to work with the same steps

[next bronze]

switch vpn region

[night crypt]

I had to do that just to get the damn lab to even spawn haha

[high reef]

Hello

[next bronze]

what server are you on

[night crypt]

US Academy 5 atm

[wraith pelican]

a clock skew issue with kerberos?

[next bronze]

when I checked a couple of days ago it works fine

[next bronze]

no

[wraith pelican]

ok

[high reef]

i'm doing this skill assessment, i have username:password but when it comes to 2FA i'm alil lost. it doesn't tell me the length of the 2FA but i did seq -w 0 10000

[night crypt]

I'll just try resetting it first, if this doesn't work probably gonna just call it

but ty all for the help

[next bronze]

i'll check rq

[night crypt]

it's all G I've got it resetting atm

on the plus side, I've gotten a lot more comfy setting up Ligolo-ng this evening 😄

[next bronze]

nice

well it's not spawning for me

[night crypt]

☠️

[next bronze]

ok it spawned and it works

[night crypt]

you're able to Kerbrute the DC?

I'm still getting the exact same error

(after it respawned)

[next bronze]

yeah on us 5

[night crypt]

ah well

I'm gonna try tmr haha

[acoustic owl]

The module shows you other methods besides Bruteforce

[spare fossil]

I dont know how do I ask this without showingmy command.... what is usually the issue, when ffuf gives you an insane about of matches though you specified -fr ? the regex filter string seems to be fine. i dont know what else to do

[viral lotus]

Hi I have been running through the ippsec vm build video (youtube) for parrot OS as I have been using kali until now I am currently at this error, I tried to look through the commits to see what to do but am stuck. Is this a known issue? and what steps need to be taken to finish the build?, thanks