modules

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

Otherwise

https://tenor.com/view/you-need-to-leave-hayden-sistas-s4e12-get-out-of-here-gif-25985741

[young wyvern]

Yeah I’m using the Pwnbox, when trying to connect VIA SSH it should be asking me for a password but I think it’s set up for only key authentication

[wraith pelican]

have you tried to follow the course material the section you are on speaks about ftp etc

[zenith vale]

does anyone notice what am i doing wrong? im tryna send a requet to a local sql server inside it, or maybe im not supposed to , to achieve the version i cant remember how i did it tbh

[young wyvern]

It explicitly states to SSH into the target

[fathom pendant]

Perhaps the ssh key has a password for it

[north bramble]

oh. Idk then sorry, i thought you had a vpn issue

[young wyvern]

Thought so but even brute forcing it doesn’t work, and I followed every single step

[fathom pendant]

If it's set up for a key though then you'll need to find that key

[fathom pendant]

Here's a thought

And its a wild one

Are you specifying the port?

[young wyvern]

Yes 22

[minor dome]

I am struggling with Information Gatheing -Web Edition skills assessment. Spicifically what is the API key in the hidden admin directory that you have discovered on the target system? I configured the inlanefreight.htb in the etc/hosts and tried crawlers, directory enum, vhost enum, and reconspider. Nothing is bringing back any information. Any hints would be more than appreciated

[zenith vale]

in ssh its either u find and steal the id_rsa and point at it via a -i flag or u can brute it via username if u have one and paswordlist probablyy rockyou

[fathom pendant]

If it's a public ip:port, then you need to specify the port

Because it's running a docker container where the only scope is the provided port for the question

And the lower ports are generally locked down

[young wyvern]

This module is about brute forcing for the password

[zenith vale]

then brute it man 😉

[young wyvern]

It says you have to use SSH

[fathom pendant]

Brother

[young wyvern]

Can’t, don’t have a password

[fathom pendant]

Ssh isn't always on port 22

In this case it's on the port provided on the public docker container

[zenith vale]

check again hydra syntax. you can specify a specific name or a wordlist of name and same for passwords, then u can specify what type of service , in this case ssh

[fathom pendant]

I have a feeling I know what the issue is, and it's not that

If the question/target spawned is a PUBLIC_IP:PORT

[young wyvern]

I’ll try the port it gives and report back

[fathom pendant]

Then the service they are asking you to brute is running on that port

[zenith vale]

i agree , with u tottally but from what i read seems hes not even sure of the bruting part (?)

[fathom pendant]

It's like any of the web modules

[fathom pendant]

It's because he's attacking port 22... not the target port

[zenith vale]

here i am tryna help while being stuck myself 😂

[fathom pendant]

It's different if it was a private ip (10.129.x.x)

Also dude idk what module you're working on, looks like one I haven't done

[zenith vale]

doing the web server side attacks

[fathom pendant]

Well I haven't done that one

[zenith vale]

and there is no walkthrough either

im suppose to do a call to another internal service via ssrf exploitation

[wraith pelican]

yeah they are right, the course shows -p 22 but just to show you that you can specify the port. Otherwise they would not likely specify the default port

[young wyvern]

Only reason I used 22 is because that’s what port they have in the example, its usually on that port for most of the modules I’ve gone through, but also just plain connecting via SSH trying to login tells me its key auth not pass auth

[fathom pendant]

Examples aren't always 1::1 with what you'll do

[zenith vale]

ok , weird thing. the server runs on a docker. at ip:port

[young wyvern]

Just trying connecting via SSH and lmk what it says

[fathom pendant]

Not that weird

[zenith vale]

wait im getting to that

[glacial wedge]

Good afternoon. How are you? Could someone tell me if the HTB Academy videos would have subtitles available? Thank you.

[fathom pendant]

There are no academy videos

[zenith vale]

i type in parts to get my message accross. so either way the docker runs on a serverip:port- which has internal services running on sub ports??? if u get me cause they cant all run on the same port essentially the docker port acts like a gateway i guess

[young wyvern]

I just assumed since it was a beginner module

[glacial wedge]

Thanks!

[zenith vale]

so what do u specify? the docker port or the service ports

[young wyvern]

I’ve only tried 22, not at my desk atm to try the docker port

[zenith vale]

i was like wtf , there are videos and i missed them

[fathom pendant]

Docker for your request internal stuff is 127.0.0.1

Or an interface otherwise specified

[zenith vale]

thats what i did via the ssrf btw , did a loopback to the service and tried to call it

via its specific port. doesnt seem to work

[fathom pendant]

Because it's not external

[zenith vale]

mysql service isnt internal?

[fathom pendant]

It's only exposed internally

[fathom pendant]

It can be either

[zenith vale]

isnt it the same :D?

[fathom pendant]

No

[zenith vale]

so its blocked for outside communications but accepts only inside calls, from the server

[fathom pendant]

A service can be running internally but won't be able to be accessed externally

I.e. only running on localhost

[zenith vale]

but when i call it , nah fam im good https://gyazo.com/52b839b6a4cdb42258314912ecb69004

[fathom pendant]

And not on the external facing port

[fathom pendant]

Well. You're trying to make an http call to the sql server... it's telling you the error lol

Received http when not allowed

[zenith vale]

didnt work when i tried gopher either

[fathom pendant]

but I haven't done the module so I can't point you in the right direction ¯_(ツ)_/¯

Just double check the reading

[zenith vale]

cant ind anything about it either

[young wyvern]

Well the first question is about SSH

Maybe I can connect via FTP but idk

[warm mountain]

Hi, there! Would someone please help me with the Introduction to Deserialization - Skills Assessment II? I found the serialized cookie, but haven't been able to properly decode its secret key

[fathom pendant]

Ssh should be accessible via the ip:port

[zenith vale]

went throught the module again, there is only info about enumeration

and port scanning essentially

[wraith pelican]

no i was wrong just do what the module says with the correct port

[hot owl]

hello need help

[fathom pendant]

I suggest not posting the cookie

[fathom pendant]

We're not mind readers

[hot owl]

hello marcielee

how is your day going

[fathom pendant]

What do you need help with

You said you needed help, so what's the issue

If it's not htb academy related, I suggest reading #rules and #welcome

[gleaming thistle]

Hi guys, I am on the Windows Event Logs & Finding evil skills assessment. I am trying to figure out the first question with the DLLHijacking. I have configured sysmonconfig file to include event ID 7, I have made multple types of XML scripts to look for anything that might look not normal. everything from looking for images not made in sys32, to anything that doesnt have a "valid" signed signature. I am starting to think that it is not inside of the event viewer, a pointer would be helpful.

[zenith vale]

did anyone do the identifying ssrf section of server side attacks?

[hot owl]

@fathom pendant so the problem is the LDAP - Authentication Bypass test which the responce im getting from brupsuite is different from the screenshoot which are used in htb-academy

[zenith vale]

please at me as i need to go

[fathom pendant]

It typically will be different

[wraith pelican]

hey, I had no luck with xml as well, i had to use another method.

[hot owl]

it has major difference

[fathom pendant]

¯_(ツ)_/¯

[hot owl]

@fathom pendant i cannot see the location of user

[gleaming thistle]

Powershell?

My next Idea is using win-get

[wraith pelican]

well if you reverse the two words and add another one, that is a good idea : D

[gleaming thistle]

??

[fathom pendant]

Get-win...

[wraith pelican]

i just dont know how related is Winget regarding this module. But Get-Winvent is definitely in the course

[gleaming thistle]

My mistake, I meant Get-Winevent. Thank you!

[wraith pelican]

haha yeah sorry for the riddle, it made sense but just in my head : )

[gleaming thistle]

No no it makes sense in hindsight 💀

[fathom pendant]

Frustration probably plays a part in not getting it

https://tenor.com/view/jfk-clone-high-i-like-your-funny-words-magic-man-jack-black-gif-18659433

[gleaming thistle]

^ I blocked youm you can ignore I messages.

[fathom pendant]

kinda rude but ok ¯_(ツ)_/¯

[warm mountain]

I'm sorry. Would you mind giving a nudge about the deserialization SA ?

[fathom pendant]

I haven't done the module

[gleaming thistle]

How would I filter to look for DLL file within the context that it is a image loaded but I do not know the path at all?

[young wyvern]

You blocked the one person who would help you lmao

[fathom pendant]

I haven't done that module

[young wyvern]

SSH is on port 22 btw

[fathom pendant]

It's why I wasn't responding to them earlier

[young wyvern]

So lost again

Tried using the port they give but doesn’t work

[fathom pendant]

Ssh should also be running on the port they give you

"Doesn't work"

[young wyvern]

It tells me it’s not

[fathom pendant]

It should be

[young wyvern]

Tells me service not known

[fathom pendant]

Reset target and try again

[fathom pendant]

Nmap?

[young wyvern]

I already have

Just did a general scan I’ll scan just that port and let you know

[fathom pendant]

Just trust and use hydra

Or netexec

[wraith pelican]

i just redid the section, use the port they gave you

[fathom pendant]

You don't need to scan

[wraith pelican]

same here.. all is ok it will work

[young wyvern]

It worked thank you! Just got confused

[dim wolf]

you didn't have to configure sysmon since all you're doing is looking at the event log. assuming you're checking the right EVTX file, your thought process is correct and should lead you to the answer

[fathom pendant]

Whenever you're given an ip and port combination, that is a public container. Consider all other ports on that system out of scope

[gleaming thistle]

I was able to figure it out, Idk why it wasn't working through event viewer, but I managed to find it using get-winevent! Thank you for the help though!

[dim wolf]

yea, use powershell for looking at logs, it's 10x easier than using Event Viewer

[gleaming thistle]

I watched a video on DLL hijacking yesterday and they only used PS as well. So I might as well get comfy using it 💪

[young wyvern]

Okay I will keep that in mind, I really appreciate all the help you have given me

[fathom pendant]

I believe they touch on this on the intro to academy module

[minor dome]

I am struggling with Information Gatheing -Web Edition skills assessment. Spicifically what is the API key in the hidden admin directory that you have discovered on the target system? I configured the inlanefreight.htb in the etc/hosts and tried crawlers, directory enum, vhost enum, and reconspider. Nothing is bringing back any information. Any hints would be more than appreciated

[fathom pendant]

🤖 .txt

Also what is your vhost command?

[minor dome]

i tried inlanefreight.htb/robot.txt

[fathom pendant]

Yeah it's not there

There's a subdomain

I suggest using the bigger subdomain top1million list

[minor dome]

but when I run something like the dnsenum i dont get anything

[fathom pendant]

110000

[fathom pendant]

Because dns isn't running

Gobuster and ffuf should both work

[minor dome]

Ok ill try those. thank you

[fathom pendant]

Also your hosts file shouldn't have the port

You specify the port in your command

[minor dome]

It doesnt

[fathom pendant]

👍

So make sure to specify the port in gobuster/ffuf

[fathom pendant]

As a general hint: if you don't find it on one level, go deeper. Subdomains of subdomains exist

[clever lotus]

greetings, on module into the web proxies, burp intruder, which wordlist is used to see .html files? I tried SecLists/Discovery/Web-Content/common.txt but it dosent work...

[fathom pendant]

FUZZ.html

^

Afaik that's all I had to do

Most of that module was just following the directions

[clever lotus]

I dislike bruteforcing because its luck, if they dont provide wordlist its pain. I am running it with now so its only matter of time

[fathom pendant]

Generally the wordlist from the example is sufficient

But it should look like /admin/§file§.html @clever lotus for that section

[clever lotus]

oh I see, my regex is bad, I though that inside wordlist is .hmtl wordlist but now I see that i need to add .html in burp

thanks

got flag

[fathom pendant]

👍

[civic hamlet]

Having trouble with remote access into a windows machine (windows fundamentals)

v:10.129.158.151 /u:htb-student /p:Academy_WinFun!
[14:06:37:515] [35566:35567] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[14:06:37:515] [35566:35567] [ERROR][com.freerdp.core] - failed to connect to 10.129.158.151```

@fathom pendant

[fathom pendant]

Pwnbox? Use rdesktop

[civic hamlet]

im on my kali vm

[fathom pendant]

@glacial wedge any questions you can ask here. I don't do dms

[fathom pendant]

Try restarting your vm to fix it, sometimes it's odd

Or reconnecting to the vm

[gilded radish]

Hacking WordPress
Indexing Directories

Keep in mind the key WordPress directories discussed in the WordPress Structure section. Manually enumerate the target for any directories whose contents can be listed. Browse these directories and locate a flag with the file name flag.txt and submit its contents as the answer.

What should I do, there is a lot of plugins and directories out there

any hints?

damn

[fathom pendant]

Start simple

[gilded radish]

I just randomly opened

some dir and it was there

[fathom pendant]

Lol

[gilded radish]

yeah ahah

[fathom pendant]

The key distinction here is the key WordPress directories, so regardless of plug-ins I'd assume

Delete that

[gilded radish]

yeah

[fathom pendant]

But yeah just keep digging is the key there

[civic hamlet]

Ah, I downloaded a udp vpn file

thats why I was recieving issues related to tcp connection when trying to rdp

ahem

After restarting my vm and downloading a new connection file (tcp) it still refuses to remotely connect

alright..

[gilded radish]

don't think it's vpn file then

what the error

[dim wolf]

add single quotes around your password. /p:'Academy_WinFun!'

[civic hamlet]

always the little things eh

what exactly does that change do that allows the connection to succeed?

[dim wolf]

bash will read the ! operator and treat it as such

[fathom pendant]

Tells bash to interpret the password as literal, since ! is a special character

[dim wolf]

^

[fathom pendant]

So it doesn't try and expand it

It's part of the history command

[civic hamlet]

I see, interesting

Im continuing to recieve error messages

[14:30:37:051] [9267:9268] [ERROR][com.freerdp.core] - failed to connect to 10.129.158.151```

ill try to use pwnbox but ill have to deal with its daily limit after an hour

[fathom pendant]

You can extend the pwnbox time btw

Plus icon next to it

[civic hamlet]

(I dont have a subscription)

[fathom pendant]

Don't need a subscription

Just extend the timer before it expires

But I'd try another rdp application first

Like rdesktop or remmina

[civic hamlet]

Are the arguments the same / do they come pre-installed

[fathom pendant]

man rdesktop

And remmina is a gui application

[civic hamlet]

Getting nothing

[fathom pendant]

Wouldn't -server be the ip?

[civic hamlet]

the man pages specify the port

[fathom pendant]

¯_(ツ)_/¯

Oh

I see your error

It's not -server

It's just server:port

With server being the destination and port [optional]

[civic hamlet]

rdesktop -u htb-student -p 'Academy_WinFun!' 10.129.158.151:3389

my command line is perpetually hanging

hah, this has been quite annoying

on to pwnbox

[gilded radish]

brutforcing on pwnbox is fun haha

/twentyseventeen/404.php?cmd=cd ."

How can I change dir?

'cd .'?

it doesn't work

such a stupid question

but idk

[acoustic owl]

A webshell cannot remember a state. You can only send one command at a time
But you can, for example, list a directory like this:

ls%20/home

[gilded radish]

doesn't work

only 'ls' works

[acoustic owl]

try ls /

maybe there is no /home directory

[gilded radish]

cd%20../../%20&&%20ls

in theory

[acoustic owl]

why?

[silk anchor]

If its a webshell I always find is easier just to use the browser since firefox url encodes everything automatically.

[gilded radish]

<br />
<b>Fatal error</b>:  Uncaught Error: Call to undefined function get_header() in /usr/src/wordpress/wp-content/themes/twentyseventeen/404.php:15
Stack trace:
#0 {main}
  thrown in <b>/usr/src/wordpress/wp-content/themes/twentyseventeen/404.php</b> on line <b>15</b><br />

wait let me remove that func

nah doesnt work

[acoustic owl]

What exactly does the ls command show you?

404.php?cmd=ls

[gilded radish]

404.php
README.txt
archive.php
assets
comments.php
footer.php
front-page.php
functions.php
header.php
...

[acoustic owl]

okay, now try
404.php?cmd=ls%20/

[gilded radish]

o

it does, but why 'cd%20../../%20&&%20ls' doesnt

[silk anchor]

Try cd%20../../;ls

[gilded radish]

server died

a sec

[gilded radish]

works

thank you

[acoustic owl]

But why do you want to do this with two commands (cd and ls) when you can do it with one?

[civic hamlet]

The xfreerdp worked with the pwnbox instantly

I genuinely wonder what’s wrong with my vm

I mistakenly forgot to extend pwnbox time and it ended, to be resumed tomorrow I suppose

[acoustic owl]

Your VM must be connected to the Academy VPN. Then xfreerdp should also work without any problems

[supple light]

Hi. In the lateral movement module, the winrm chapter. I'm stuck with the second question Use Leonvqz hash to connect to SRV02. I connect to SRV01 with the password of the first user, request a TGT, pass the ticket but always get an error about a logon session sth when I try to Invoke-Command to read the flag in SRV02. I tried several ways but none worked. I had a similar situation many times and never know how to deal with it. Could you please help ? What's the intended way ?

(I connect to SRV01 with evil-winrm)

[dapper moth]

Was stumped with the same problem, you can search for my messages here and you'll find a away to execute and a good hint from @next bronze

If you are still stuck afterwards, you can DM

[supple light]

Thanks a lot. I will look for it.

[forest adder]

greetings, I'm on the skills assessment section of information gathering, I have the entry in etc/hosts, but every tool I throw at it fails except banner grabbers

oh, and dig gives me...a little

[acoustic owl]

Apply all techniques shown in the module to found subdomains as well

[forest adder]

dnsenum fails

all the tools think the host is down

[acoustic owl]

Restart the Lab and try again

[shut vapor]

after using hashcat to crack passwords from a SAM dump you get this

what is the uuid or hash that represents each user called? (e.g. a3ecf31e65208....)

I can grep those values out of the hash dump file to relate them to usernames, but is there a better way correlate usernames to passwords rather than this value?

[plucky dagger]

Is this the appropriate place for feedback on Academy course content?

[shut vapor]

Close, see #1234357888114364508

[civic hamlet]

I’ve done the former

It still isn’t working

[supple light]

Thanks man. That was helpful. For the bonus question though : Use PowerShell Web Access on SRV01 with Frewdy's credentials and connect to SRV02 using Helen's credentials. There is the double hop problem. Is there a simple solution to that ?

[dapper moth]

I guess declaring a credential object and explicitly calling it.

[next musk]

im kinda new and im under the impression that to really proggress and to fully use HTB you will have to end up purchasing something such as a membership or boxes it this true?

[sterile solstice]

at some point you'll have to get a subscription or buy cubes for the academy. as for membership for boxes, only for retired boxes. active ones are free to use.

it can all add up if you go for everything, but its a lot of content. you can easily spend only on what you need.

[simple stream]

Hello guys can I learn about evillginx or phishing on Hackthebox

[supple light]

Thanks. It worked. Do you ( or does anyone ) know why in that step explicit credentials work but pass the ticket doesn't ?

[warm mountain]

Hi, there! Would someone please help me with the Introduction to Deserialization - Skills Assessment II? I found the serialized cookie and its hmac key, but when I change the cookie value I got the error message "Error: authentication cookie was tampered with!"

[mint peak]

For attacking AEN blind, is it recommended blind as in spawning the machine and having scope information and that's it? How many flags might I be looking for?

[cloud urchin]

totally blind

[mint peak]

Perf, thanks

[dapper moth]

I think it has to do with the logon information stored in the session.
I had even tried crafting a service ticket and passing it in SRV01, but could not get access.
The only way I thought, since I hadn't enumerated the SRV02 host due to the combo proxychains+chisel not working in the pwnbox, was to tunel through ligolo-ng, enable the service (did not know if it was enabled or not, but that didn't matter as well), access SRV02 via this service and then execute the rest of the Rubeus procedure.

[dapper moth]

@fathom pendant have stated before that the goal would be to achieve a high level AD role/group membership (Domain Admin, Enterprise Admin)

[mint peak]

Excellent, thank you! Wasn't hoping to ask a repeated question but just wanted to make sure

[supple light]

Thanks !

[dapper moth]

I may be doing the skills assessment in a while. If you need any help, feel free

[supple light]

Thanks a lot ! Good luck !

[edgy gale]

anyone here?

wheneveri try to upload IP & Domain name in "/etc/hosts" even with sudo perms i got an error of permission denied.

[sterile solstice]

whats your command?

[edgy gale]

Screenshot is in https://discord.com/channels/473760315293696010/565584648974106634

[edgy gale]

you can check https://discord.com/channels/473760315293696010/565584648974106634

[vernal hedge]

use nano or echo "data" >> /etc/hosts (use >> not >, >> appends the data to the bottom as a new line)

[storm elk]

Just do it via editing the file. Works 100% of the time sudo nano /etc/hosts

[sterile solstice]

i do this. i dont like vim so i use nano

[vernal hedge]

yea to exit vim or do the most basic thing its "(#!%)(%)KWTEFGLWQ(:"

[edgy gale]

not working

[vernal hedge]

just do

[edgy gale]

vim is soo euwww.

[vernal hedge]

sudo nano /etc/hosts, add it then CTRL+X then Y and ENTER

[sterile solstice]

haha right! i need to actually get better at it since a lot of boxes dont have nano they have vim...but in my own env i use nano

[shadow current]

on this section:https://academy.hackthebox.com/module/204/section/2233

Injection attacks in CWEE path PDF SSRF

I have found the port 8000 and the api endpoint /users that gave me a lead that their is a /users/adminkey.txt but whenever i try to print it using iframe i get a error not found can someone give me a nudge here?

[storm elk]

More like get a masters degree first

[sterile solstice]

then just do the IP <space> vhost

[vernal hedge]

Thats just to exit vim

[sterile solstice]

masters i have, vim is difficult 😉

[edgy gale]

yeah with nano i got it

thanks.

[sterile solstice]

no problem. if you find subdomains, then add them too

[edgy gale]

yeppp added.

[sterile solstice]

sometimes you can just add a space after the FDQN (like metapress.htb in my screenshot), and othertimes ive found its better to just do a new line all together

[vernal hedge]

I use a tab, my /etc/hosts looks like:

 ⚡ root@kali  ~/htb  cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       kali
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

# HTB Machines

10.10.11.24  ghost.htb <snip>

[edgy gale]

If we run a recursive ffuf scan on admin.academy.htb, we should find http://admin.academy.htb:PORT/admin/admin.php. 

i am trying to find this from 3 hours but didn't find it.

[storm elk]

What’s your command

[edgy gale]

ffuf -u http://admin.academy.htb/FUZZ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -recursion -recursion-depth 3

[sterile solstice]

https://www.phrack.me/tools/2022/07/06/Ffuf-cheatsheet.html

[vernal hedge]

you can use feroxbuster --url <url> its recursive by default unless you supply --depth 1 (this is if your really struggling with ffuf)

sudo apt install feroxbuster -y

[sterile solstice]

i only used feroxbuster yesterday, its far easier to use.

[storm elk]

Seems to be missing the port too

[vernal hedge]

yea its my favorite, sadly no sub domains but I use wfuzz for subs

[edgy gale]

is ffuf and feroxbuster are same?

[vernal hedge]

feroxbuster is faster in my opinion, only things I like more about ffuf is the "FUZZ" keyword you can supply

[edgy gale]

and feroxbutser do it auto?

[vernal hedge]

what do you mean

[edgy gale]

means we provide FUZZ keyword in FFUF

so any keyword for feroxbutser?

[vernal hedge]

I just got warned lol

but no, not that I know of

[edgy gale]

ok

[sterile solstice]

feroxbuster -u http://10.129.190.61 -x php

[edgy gale]

Alright it can also do all work that ffuf can do right?

[sterile solstice]

nothing wrong with ffuf though. like a lot of programs it can be picky with arguments.

[edgy gale]

Alright!

[vernal hedge]

It cant search for sub domains and doesn't have the FUZZ keyword

[sterile solstice]

well, i cant speak for that. it will do a good job.

[edgy gale]

Oh Thanks i got my point.

[sterile solstice]

if its in the module follow through with ffuf but try out feroxbuster too if you're interested.

[edgy gale]

hmm with writing port i got it, Thanks mate

[storm elk]

Glad to hear (it did mention it in the question)

[edgy gale]

HTB Community is awesome

[sterile solstice]

we're all trying to learn too

[edgy gale]

honestly no port written in question.

[sterile solstice]

ive spent hours on a question only to have it pointed out i had a type/wrong port/wrong FUZZ by someone here. lol

[edgy gale]

i think so htb must have to be more clarity at some points 🙂 for new learners.

[storm elk]

this is what you wrote:

If we run a recursive ffuf scan on admin.academy.htb, we should find http://admin.academy.htb:PORT/admin/admin.php. 

:PORT

[sterile solstice]

oh i agree. at times its kills me to read a question and wonder 'wtf is it even wanting from me'. if there is something particularly bad, try putting it in #1234357888114364508 for the staff to have a look it.

[edgy gale]

i have made a forum on this kindly react if anyone agree.

[pseudo kiln]

any idea why from HTB perspective \n is URL encoded to %0a ? In burp suite I get %5c%6e when I use the decoder tab to URL encode it

hmmm apparently I needed to press Enter in burp for a new line, then it encoded it right, while when it sees \n it interprets it as a literal string and not the newline character

[wraith pelican]

that's good to know. the problem is it is sometimes tedious to select the invisible Enter when encoding a payload

[shut wraith]

Hey guys what do u think about my master hacker roadmap?

[sudden laurel]

How long is it going to take you to do that

[solemn granite]

https://bytebreach.com/posts/what-certifications-should-you-get/

your time is the most important resource you have, don't waste it

[low vine]

DIGGING DNS - CPTS

I did this many months ago and im working back through it and starting towards my CPTS but im extremely confused with whats going on here. My naswer points to cloud30 but when I run dig - x <ip> i do not get that at all and I'm thuroughly confused and would love a little explanation :)(

looks like it should be inlanefreight.com but I just want to make sure i'm not understanding something

[fathom pendant]

The decoder is encoding the \ and n characters separately, while %0a is the new line character

[fathom pendant]

What module exactly is this?

Digging DNS is a section name, not a module name

And CPTS isn't a module, it's a path

[fathom pendant]

They updated the module. So answers don't line up

You'll need to update your notes to reflect changes if you plan to refer to them

[stark lark]

Howcome I be able to dump lsass process manually through RDP connection and then download it through meterpreter, but not dump it directly through my meterpreter session which was ran on the same user account?

The account has administrator rights

[low vine]

yea thats what I finally figured out was just trying to double check

caused slight bit of confusion, thanks for the clarity

[wraith pelican]

i never used that module so i can't really tell you why.
What happens if you try with mimikatz?
https://www.offsec.com/metasploit-unleashed/mimikatz/

[uneven oracle]

Nmap vs ffuf
Do you need both or is it a preference?

[fathom pendant]

they do different things

idk why you're proposing it as a vs really

[fathom pendant]

nmap scans ports; ffuf scans websites

[uneven oracle]

Ok, maybe I was confused or thinking of something else.

[shell glacier]

Hi all, im stuck on the linux privilege escalation (environment enumeration), I know i need to sudo with lab_adm. HOWEVER i cant figure out how, i tried sudo -u lab_adm /bin/ncdu, but that give me permission denied, I tied sudo -l -u <command> nothing works permission denied. What am i supposed to do ? to get into the lab_adm accounts?, I tried sudo -i -u lab_adm <command> , and essentially any combination of sudo + switch + lab_adm you can think of. nothing is working?

[stark lark]

I also don't understand how the password can be there in plaintext when dumping it. I tried cracking the ntlm pw but that didn't work and then I saw it was there in plaintext...

[fathom pendant]

because sometimes it's stored as plaintext

simple as that

[fathom pendant]

it's insecure and usually that's disabled but we're not here for secure environments ¯_(ツ)_/¯

btw you can hex decode that password string iirc

[wraith pelican]

i can't figure out what's going out in that screenshot, sorry. there is so much going on i can't follow what's actually happening

[stark lark]

So it is really a feature of AD

[fathom pendant]

(un)fortunately

specifically it's a function of kerberos

[stark lark]

The lower half is just error gibberish.

[fathom pendant]

it's not error gibberish lol

https://learn.microsoft.com/en-us/dotnet/standard/security/how-to-use-data-protection <--

dpapi is .NET data protection API

[wraith pelican]

it was about the other screenshot

[fathom pendant]

https://blog.netwrix.com/2022/10/11/wdigest-clear-text-passwords-stealing-more-than-a-hash/

oh the other screenshot is just error goofiness

meterpreter isn't really all too smart

especially if you are running through a pivot system

[wraith pelican]

it is the pivot skill assessment right? your user in your meterpreter session is ml**** ?

[stark lark]

Yup

[wraith pelican]

if so, that user has administrative rights but when you are in RDP session, you have to click on UAC prompt

I tried to bypass UAC via different methods in metasploit but i couldnt figure it out. What worked for me is to run the msf payload as admin

then getsystem worked, etc

[eager ledge]

Finished the Active Directory Enumeration & Attacks module!🥳

[sterile solstice]

congrats! i really enjoyed that one, though it was also infuriating in parts haha

[oak girder]

Can someone tell me what is (https://academy.hackthebox.com/module/51/section/1590) this breakthrough? Is it sudo or CVE? I tested them all. No results

[fathom pendant]

It's related to sudo so try all methods shown

[oak girder]

hI

[fathom pendant]

Read the policy bypass section. The sudo list explicitly states you can't run as root (!root)

[sterile solstice]

https://gtfobins.github.io/gtfobins/ncdu/

[glass quail]

hey does anybody know how to stop the target from spawning mine is stuck on loading

[sterile solstice]

switch VPNs can sometimes help

the target will spawn based on what VPN youve been using.

[glass quail]

Ok thank you

[oak girder]

ok, it is a CVE-2019-14287 bug, I didn't understand it at first, I understand it now

[glass quail]

still isn't stopping or loading properly will have to contact support I think

[oak girder]

No

[sterile solstice]

tried different region?

[oak girder]

The VPN needs to be switched or the zone updated

[glass quail]

Yes

[sterile solstice]

ah ok. then it may just be down. it happens sometimes

[glass quail]

This is the first time its happened to me I guess today is my lucky day

[sterile solstice]

well it usually happens to a few ppl

what module are you trying to spawn a target for?

[glass quail]

Web services and API

[torpid thistle]

Question regarding to the IPMI Mdule (https://academy.hackthebox.com/module/112/section/1245):

I obtained a IPMI users password hash. Shall I really hashcat that now? hashcat is mentioned in the module. i only use the remote pwnbox form htb and it would take forever to crack it on this vm

[glass quail]

Ya its called Web services and API attacks

[sterile solstice]

oh, cool, looks like a good module.

im seeing if i can spawn a target now.

[glass quail]

ok thanks

[sterile solstice]

target spawned for me

[mint peak]

Currently blindly going through AEN. Honestly a lot of fun to not try to rush for initial foothold, but rather just poke around and try literally everything to see what works 😄

[glass quail]

Thanks I might just be my instance I tried remove cache and such

[sterile solstice]

no problem. im on eu5 for what its worth

[sterile solstice]

ive been doing ippsec walkthroughs for cpts prep before AEN. though im itching to do it.

always a lot of talk about it, almost as much as the exam. lol

[mint peak]

I finished the reporting module yesterday, figured id jump into AEN blind. Such a wicked amount of enumeration to do! It's fun though, just important to not get frustrated

Im honestly trying to go super slow and practice good notes. Also testing note structure to see how I like it

[sterile solstice]

i tried doing the reporting module but my connection was so slow that i could barely look at the notes to figure out their attack path

so i rage quit and did some retired boxes lol

[glass quail]

I'm US I have tried both US and just tried EU didn't work 😦

[fathom pendant]

gtfobins not needed for this one

[mint peak]

Definitely have already found some of my weaknesses though, that's for sure haha

[fathom pendant]

again read the policy bypass subsection. it shows directly what to do

[sterile solstice]

im a bit weak on web attacks. at least with the boxes that ive tried. though boxes aren't cpts.

[mint peak]

Yeah, that's where I am weak as well. Enumerating web, and all things web attacks. Just much slower for me

[sterile solstice]

doing Forest was good though. i hadn't touched anything AD for a while. im going to review the AD module and then try AEN

[fathom pendant]

ctrl+shift+r to reload the page and clear cache and try again

[mint peak]

Web attacks are just so delicate. One character off on anything, or one tiny tiny thing missed and you won't see anything.

Easy to get discouraged

[sterile solstice]

yea i made that mistake with checkig SQLi. didn't seem vulnerable. then spend hours not getting anywhere to finally look up some hints to find i had mistyped my SQLi probing lol

i found the module easy though. but applied it outside of the walkthrough has obviously prooved difficult 😛

[fathom pendant]

not remembering the space in the mysql comment can be pain --

[sterile solstice]

i know right!

[sleek moss]

nagios@monitored:~$ python -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'
nagios@monitored:~$ ^Z
zsh: suspended nc -lvnp 4444

┌──(sam㉿kali)-[~]
└─$ stty raw -echo

┌──(sam㉿kali)-[~]
└─$ fg
[1] + continued nc -lvnp 4444
reset^M

[fathom pendant]

(it's why the SQLi module shows the -- - portion btw)

[sleek moss]

hi guys how come reset wont work? i follow instruction to upgrade

but its stuck on rset^M and i have to exit terminal

[sterile solstice]

yea, which helps a lot.

[fathom pendant]

you need to do stty raw -echo and fg on the same line

stty raw -echo;fg it's a quirk of zsh

[sleek moss]

ohh i see dankeschone

[sterile solstice]

and you cant always rely on sqlmap. any kind of waf (even using the corent --tamper) will prob yield few results (or a lockout depending on how agressive)

[fathom pendant]

btw this question has been asked dozens of times in #1024429874246590575 and other places

[shadow current]

can someone help on injection attacks skill assessment i found a ssrf and a internal application already and i think its vulnerable to xpath injection but havent proven it yet can someone advice me?

[sleek moss]

└─$ stty raw -echo;fg
[1] + continued nc -lvnp 4444
reset
reset: unknown terminal type unknown
Terminal type?

ok sorry

[fathom pendant]

well generally that means it doesn't know what terminal language to use, bash/sh/zsh...

https://techtitbits.com/2010/10/resolving-unknown-unknown-terminal-type-error/

you'll want to set the TERM variable

export TERM=xterm-256color

how do you get that TERM var info? it's from YOUR Term var; so in a new tab do echo $TERM

that way you can set it

[tender radish]

if i purchase the annual silver subscription, it unlocks all modules only for the duration of the subscription? or they remain unlocked forever?
Like if I buy them with cubes they are unlocked forever, right?

[shadow current]

only the modules you finished will be remain unlocked

[tender radish]

oh, that's cool

[sterile solstice]

if you unluck with cubes i believe you still have them. or if you finish them

[tender radish]

what are CPE credits?

[sterile solstice]

some certs require ongoing education to remain certified, called CPE

depends on the org, but usually needs to be related to the certificate. i.e. my CompTIA Sec+ requires a certain amount every few years + an exam re-take of some kind.

I believe HTB allows for the sycning of CPE with ISC2

<@&861185840277487616>

[wraith pelican]

dude got graphs in his bio, must be legit

[sterile solstice]

agreed. with stacks of money emoji, definitely legit.

[fathom pendant]

CPE credits are for certifications that require continued evaluation

https://help.hackthebox.com/en/articles/6009966-cpe-allocation-htb-academy

[wraith pelican]

You might want to have a look at that video which explains what's happening when you upgrade a shell
https://www.youtube.com/watch?v=DqE6DxqJg8Q

[tender radish]

thanks for your answers everyone

[sleek moss]

danke

[west rampart]

german spotted

[sterile solstice]

was my thought too 😂

[west rampart]

we're not so much

[sterile solstice]

haha

[fathom pendant]

https://tenor.com/view/fed-spotted-goku-son-goku-meme-gif-13306343723370401392

[tender radish]

me? 😄

[stark lark]

Does blind mean no hints and looking at course material or also personal notes?

[fathom pendant]

blind means: no hints or reading the questions

[mint peak]

No, only using my notes and course material. Not looking at questions or using hints

And lots of Google

[fathom pendant]

you can reference your own notes, and previous modules

[stark lark]

Ah that makes sence. Should've done that from that start

[mint peak]

And a wee bit of ChatGPT for quick script writing 😛

[stark lark]

Wha.. not reading the questions? :D xD

[mint peak]

Because im lazy

[fathom pendant]

as a note @mint peak only one of the things on AEN wasn't covered; but it isn't required for full domain compromise

[fathom pendant]

yeah, as the questions are leading and pointing directly to things

you get full compromise then go back to answer questions

[stark lark]

Damn thats nice

[mint peak]

Finally got an intial foothold after about 6 hours 😄 finding lots of vulnerabilities beforehand tho haha

[fathom pendant]

that's what full blind means

[fathom pendant]

https://tenor.com/view/bye-alice-rabbit-hole-gif-10924271

[fathom pendant]

always keep this mantra in mind: "Keep It Simple Stupid"

[west rampart]

i guess you're not german 😛

[sterile solstice]

nah, just a lone aussie trying to find his way in this crazy world.

[fathom pendant]

From what many have said, the pitfalls they ran into have been overthinking the problem

[mint peak]

Oh for sure, a couple times I was looking at things and reality checked myself like, im looking at something waaaay to deep

[sterile solstice]

https://tenor.com/view/alone-all-by-myself-playing-alone-gif-6856262228128042127

[sterile solstice]

i think. and i hear this all the time. and i know ill fail and think theres a trick to it .... i think im more worried about doing AEN blind then the exam hahah

[mint peak]

As a personal preference, I always force myself to change vectors if I am unreasonably stuck on something for too long or can't make any progress. Seems to help me a lot. Go outside, reset, reattack with a different perspective

[fathom pendant]

that's not too bad

[sterile solstice]

probably healither then me who will just keep trying and wont leave the computer until i get a breakthrough haha

[mint peak]

Of course some things are definitely tricky and hidden in there, but at this level its usually not that

[fathom pendant]

my workflow currently through modules and skill assessments specifically, is to track what i'm doing in canvas on obsidian

[mint peak]

Just swapped over to Obsidian after taking entire course notes in VSCode. Certainly a nice change

[sterile solstice]

oh, and ive been improving on that (though I dont use canvas yet). do you also use something like gitlab to sync notes with obsidian?

[fathom pendant]

i.e. sniff the foothold → test A ❌ → test B ✅ → exploit B

[fathom pendant]

nah i should set it up for my cpts notes though

[sterile solstice]

i used sublime for 80% of the course and now also need to change completely to obsidian

[mint peak]

You don't NEED to change. Use what you personally prefer

[fathom pendant]

^

personal preference and comfortability will be the kingmaker for your notes

[sterile solstice]

i need to look up all of obsidians actual benefits. im using it more for notes on boxes.

[fathom pendant]

the canvas feature is nice because it allows a flow to be made

This is an example of my flow for the XSS skill assessment

[sterile solstice]

oh, 100%. obsidian is nicer and easier than sublime. im liking the code blocks and tags, and the hierachy.

[mint peak]

I use Obsidian to graph networks

[sterile solstice]

oh. nice!

[mint peak]

Just a personal preference for visualization of a network

[sterile solstice]

oh interesting. ive only done that with draw.io

[sterile solstice]

with canvas as well?

[mint peak]

I do not use canvas

Only .md files for notes, and Obsidian graphing

[stark lark]

So like network diagram?

[mint peak]

Learning Markdown syntax has been a game changer for organizing notes

[sterile solstice]

well thats something else ill look into then!

[fathom pendant]

nah more like my attack path

also you can export the canvas as an image

[sterile solstice]

is that what this is?
https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg

ive wondered how they did their mindmap

[fathom pendant]

mindmap is different

[wraith pelican]

likely xmind

[fathom pendant]

a mindmap is a general flowchart that you'd use

as opposed to the workflow is what you actually did

[wraith pelican]

there is a cool plugin i tried for obsidian Enhancing Mindmap
i gave it a go just for nmap, it is quite nice
it doesn't work quite well if I throw it a whole file...

[fathom pendant]

eh that looks like a mindflood to me

trimming some branches

I don't like things throwing too much info at me tbh

i like being able to quickly parse what i'm given

it's why i dislike LinPeas/LinEnum

[wraith pelican]

yeah you are right, i was just trying the thing, i do not plan to use it anyway

[sterile solstice]

installed 😉

[sterile solstice]

yea i agree. i end up ignoring 95% of it.

[thorn hawk]

Hello amigos. If we have SSL encryption, we know the CSRF token which is passed through the URL and not the body of the request with a GET request. - Would it be possilbe to have a CSRF vulnerability if the victim visits the attacker website even if we have SSL encryption? The answer is YES but i dont understand why? We have SSL encryption normally everyhing should be encrypted isn't it? So normally the CSRF token is also encrypted thus we can not get it which makes this attack obsolete?

[fathom pendant]

SSL doesn't inherently block CSRF

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

https://portswigger.net/web-security/csrf

both of these use examples that include https (SSL)

https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

[wraith pelican]

The problem with those kind of attack maps is what you leave out and also the maps become quickly too big for the screen so it is loosing the whole point of having all laid out in front of you. If I have to scroll and zoom here and there, it does not give me a better idea. But your use for actual attack chain on what you tried is nice, linear notes can become quickly messy, even more when you look at them after 3 months and wondering wtf is going on there...

[sterile solstice]

yea i agree.

[fathom pendant]

It's why I detail and label the cards/images

Use groups to put things together

I.e. if everything is on host A, then detail what's on host A and have them as one group object

[wraith pelican]

thanks for the advice. Sometimes when i'm trying stuff, I find it quite hard to take a step back and take detailed notes on the fly as I don't want to lose the thread. But at some point, I'll lose the thread of what I already tried lol There is some find line I still need to figure i guess.

[next bronze]

download it from the github repo

[sterile solstice]

https://github.com/ParrotSec/mimikatz

[next bronze]

that's just a clone tho, the actual repo by the guy who wrote it is https://github.com/gentilkiwi/mimikatz

[ember fern]

you guys make some serious notes, you're scaring me

[next bronze]

notes are good

[sterile solstice]

dont be too impressed. mine are scattered and i still use google or HTB search function more than my notes hahaha

[wraith pelican]

we are just speaking about good notes

[wary plover]

Wait until you see my obsidian graph

[sterile solstice]

yea, for me its more aspirational hahaha

[wraith pelican]

• what do you do in life?
• taking good notes
  no wonder why you are all alone : D

[tender radish]

is there a way to 'gift' subscription or something like that?

like if the company i work for wants to buy a subscription for me, how would that work?

will the redeem a gift card work for subscriptions too?

[sterile solstice]

ive wondered that too. as far as i can tell, they'd have to buy a giftcard and email it to you

i dont believe they can directly buy memerships/subscriptions. likely something in the enterprise accounts but nothing outside of that, as far as im aware

[next bronze]

you can just buy it and claim the cost?

[tender radish]

no, they have to buy it with company card

[sterile solstice]

theres a prolabs room

[modern talon]

Why cant i see it

[spare fossil]

module web attacks/Insecure direct object reference/ mass enumeration.... the following is not showing the same as on the course, hence the rest of the content dont seem to work, http://94.237.59.63:47517/documents.php?uid=1 , it does show documents, please help ?

[tranquil spire]

Sup 🤙

[sterile solstice]

i see it in the 'archive' section of the server, down the bottom. unless you need the Fullhouse prolab

[modern talon]

Dont see it actually

[sterile solstice]

#1263635449335910531

[modern talon]

It says No Access

[sterile solstice]

oh, then you prob need to verify

[modern talon]

Oh snap

[tranquil spire]

Um….how long does it take to for the target to open port?

[sterile solstice]

#welcome

[sterile solstice]

once the target is spawned the port should be open

[modern talon]

I need some special access or what

[tranquil spire]

Yup….um…target isnt allowing ping, arp, nmap, telnet 😤😭

[sterile solstice]

i believe its moved to #1263635449335910531

[sterile solstice]

make sure youve got the right vpn connected, and if not download a new connection file. switch vpns if you need. and/or its possible the target needs to be reset

[tranquil spire]

Aight let me re-download…I already tried resetting

Is there preference on tcp or udp?

[sterile solstice]

i usually go tcp, though its slower

but more stable

[tranquil spire]

Lolz…didn’t work

[sterile solstice]

whats the module/section?

[tranquil spire]

Meow

Basics of pen testing

[fathom pendant]

Meow isn't an academy module

Read and follow #welcome and ask in #starting-point

Basic ts, are you using the starting-point vpn

[tranquil spire]

Yup openvpn

[sterile solstice]

but is it the vpn for Starting Point?

the vpns are different for endgames, prolabs, machines, starting point.

[tranquil spire]

Yup…it is

Iet me try “/identify” on #bot-commands

[sterile solstice]

i can see youre verified now. go to the #starting-point channel and show some screenshots of your process

[tranquil spire]

Aight

[latent frigate]

Module: Kerberos Attack
Section: Unconstrained Delegation - Users

User callum.dixon has Unconstrianed Delegation set + carole.rose has genericwrite over Callum
Goal: Compromise domain

I am having problem with krbrelayx.py. I use it with the NTML hash of Callum
sudo krbrelayx.py -hashes :3E7...

And then I call the printerdebug.py using the user carole.rose
The listener of krbrelayx.py fecthes no TGT in case.

What I may have done wrong here? Could someone help me

[mint peak]

FINALLY got a reverse shell on a box I have been working on for hours. Such a wonderful feeling

[next bronze]

you can list accessible shares

[fathom pendant]

also you might be able to access \\DC01\david\

[next bronze]

make sure you're using the right hash, and run it a few more times, also try using the other tool, demetor or something

[fathom pendant]

generally you access a share via the \\<host>\share

[latent frigate]

With the NTLM GEnerator:
C@lluMDIXON:3E7C48255206470A13543B27B7AF18DE (NTLM)

[mint peak]

Only to find out about 2 minutes later I literally didn't need the reverse shell at all

[sterile solstice]

mate, there is no way im clicking on a random whatsapp link...

[silk anchor]

Surely nothing bad could come from this?

[glass quail]

it finally let me through 🙂

[fathom pendant]

@dreamy spade we don't share group links here; read #rules and #welcome

[gilded radish]

Hacking WordPress
Skills Assessment - WordPress

I try to scan a site with wpscan, but I get "Scan Aborted: The remote website is up, but does not seem to be running WordPress."

and there is nothing in source code about wp

[glass quail]

we don't do that here

[daring wraith]

@glass quail im not looking for a beginner

[gilded radish]

AHAHAah

[glass quail]

we don't take illegimate jobs

[daring wraith]

@glass quail i think u need to spell the word illegitimate correctly first before u blame me

[mint peak]

Dawg the #modules is not the place to try and hire someone to help break into a smartphone

Dare I saw this whole discord

[daring wraith]

Dawg, i cant type into other channels so not my problem.

[solid quarry]

Lol

[daring wraith]

Just dont read it

[next bronze]

<@&861185840277487616>

[gilded radish]

<@&861185840277487616>

oh, okay, you did it first

[glass quail]

It doesn't matter how I spell or look this is not a black hat recruitment center

[next bronze]

too slow

[gilded radish]

[surreal rain]

kicked the user

[gilded radish]

Hacking WordPress
Skills Assessment - WordPress

I try to scan a site with wpscan, but I get "Scan Aborted: The remote website is up, but does not seem to be running WordPress."

and there is nothing in source code about wp, could be a problem on server side?

Okay, will repeat, cuz too much spam from that guy

[solid quarry]

I don't remember 100% of this module but did you ran a gobuster / fuff? Maybe wp is in another dir

[gilded radish]

hm, no, I didn't
Let me try

[next bronze]

you don't have to run the tools, just explore the site

[gilded radish]

ah

[sinful pilot]

Hey you guys,
Module: Linux Fundamentals
Challenge question: What is the name of the last modified file in the "/var/backups" directory?

I am logged in as user htb-student on the HTB server computer (I used the username and password given at the beginning of the module, using ssh[username]@[vpn]) and I'm facing a challenge regarding the question above. The dir is: /var/backups

ls -la -i command is not displaying the file name whose last mod was on 3rd of AUG, 2021. inum is 262151.
Was the file deleted? Or am I missing something?
PS:
ls -lai /var/backups
returns nothing. Bc it returns the same thing I'm tryna crack:
What is the name of the file modified on 3 of AUG, 2021?

[gilded radish]

/var/backups ?

[wraith pelican]

hey, if you take a look at man ls , you'll find clues on how to resolve the question

[sonic plume]

i think you also could filter date with some command

[sinful pilot]

That's the path, yes...

[sinful pilot]

Thank you, trying

[wraith pelican]

you can also have a look at the man page for find command, there is also a possibility there

[sinful pilot]

I tried that using:
find . -type f -newermt 2021-08-03 ! -newermt 2021-08-04

See, the funny thing is that to move to that directory (whose name is a blue dot, apparently) means using the command cd .
But cd . also refers to the current directory, so if you are already in /var/backups, cd . will not change your current directory but will confirm that you're already there. So what now?

[fathom pendant]

The . Is just current dir

[sinful pilot]

ion follow...

[fathom pendant]

What section exactly are you working on?

[sinful pilot]

Working with Files and Directories

[fathom pendant]

Yeah the question itself doesn't refer to the inode

Unless you're referring to the second question

[sinful pilot]

True, I just needed the index to try and find the file that corresponds bc issa unique identifier.

[fathom pendant]

In which it's asking for the inode number of a specific file in that directory

[sinful pilot]

No, already answered

How would you go about the first question

[fathom pendant]

The first question has nothing to do with inode

[wraith pelican]

the dot . refers to the current directory but not a directory in particular. So each time you change directory to another, the directory you are in is symbolised by the dot .

[sinful pilot]

@fathom pendant

[sinful pilot]

Oh oh yes ok

[fathom pendant]

You don't need to index anything for the first question

Many ways to sort by modified time

ls has a way, so does tree

[sinful pilot]

ok

So what did you use

[fathom pendant]

My brain

I told you 2 commands that have a way to give you the information

man ls, man tree, ls --help or tree --help can help you find what arguments to use

[sinful pilot]

I'm sorry, should I have mentioned I'm just starting out? mb

[fathom pendant]

And I'm telling you how to find information

I'm not going to spoonfeed you every step

Run any of those 4 commands to see what their respective tool can do

man <toolname> gives you the man page (if available) of the toolname your provide

And a lot of commands have a --help or -h option for a more brief list of things

[sinful pilot]

resourceful. ty

The dots were confusing me. I overthought them to be some sort of hidden files. Correct answer was NOV 12, 2020: apt.extended_states.0

[wraith pelican]

lol... now they are typing... and wondering what just happened...

[fathom pendant]

No, the correct answer is the file name

[sinful pilot]

well...

[fathom pendant]

As that's what the question asked for

[sinful pilot]

You brutal, I'll give you that

Suits a hacker

[sinful pilot]

Thank you, again.

[shut wraith]

Broken Authentication

Brute-Forcing Password Reset Tokens

• Takeover another user's account on the target system to obtain the flag.

1. I tried to fuzz for usernames first but I am not getting a different error for a correct username:

ffuf -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -u http://94.237.59.63:41162/index.php -X POST ...SNIP... -d "username=FUZZ&password=a" -fw 756

2. I tried fuzzing the token with the password as password for whichever user it is reseting but I cant find a valid token or the token scheme:
   ffuf -w tokens.txt -u http://94.237.59.63:41162/reset_password.php?token=FUZZ -X POST ...SNIP... -d "password=password" -fw 595
   Any help would be appreciated

[solid pewter]

Question for anyone that can help. I got the Student plan now from the Platinum when I started the CPTS path for pentesting. I am at 30 cubes now and from what I understanding with the Student account we have access without cubes. Please help 🙂 thanks.

[next bronze]

yes that's correct, you can just access the modules

[solid pewter]

That is what i was thinking. I cant its asking for cubes still. 😦

[next bronze]

is it a tier 3/4 module? you'll only get access to tier 2 and below

[fathom pendant]

student sub only gives access the t2 and below modules

[gilded radish]

Hacking WordPress
Skills Assessment - WordPress

Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.
I found a FLI, but what file should I download, how may I find it

"...pattern.php?ajax_path=/etc/passwd"

[solid pewter]

yeah i am getting this on Web attacks which is Tier2

[gilded radish]

then you still on non-student sub

[solid pewter]

i have the student account

[gilded radish]

then message to the support

[next bronze]

it's not active yet, has your previous billing cycle ended?

or have you been charged the $8?

[acoustic owl]

Try logging out and back in again

[solid pewter]

good question, ill have to check that out

i guess its for a month

[next bronze]

it won't be active until you've been charged

[acoustic owl]

And check your Status in the Dashboard

[solid pewter]

so I will have to wait for the platinum month ended? I cant end that now and move to the student account to keep going

[limber goblet]

Hi I am having trouble with the Command Injections module. The 'Bypassing Space Filters' question does not have the right answer possibly. The question is what is the size of index.php, I ran an ls -la and it seems to be 882. I tried 7056 in case it was in bits. I don't know what's up, could someone who has done it before check if the answer has changed since then?

[fathom pendant]

correct

[solid pewter]

Thanks. I wondering if i can end it early and move to the student so i dont have to wait

[fathom pendant]

as the "downgrade" is less money it won't go through until the sub would roll over to the next month

[fathom pendant]

you'll have to message support for that

[solid pewter]

Yeah ill try and connect support

[fathom pendant]

as upgrades are a simple matter, pay the difference -- downgrades aren't as simple

[limber goblet]

could you have a look at this if you have done the cpts or command injections module on academy

[fathom pendant]

be patient

you literally just asked

[silk anchor]

I did this a week ago and my index.php was a different size. Are you sure you are in the right place?

[limber goblet]

well there isn't really any other place to be

[next bronze]

I just tested and I got the expected size for the right answer

[limber goblet]

i ran pwd I am at: /var/www/html

[next bronze]

you don't even need to run pwd

just ls -la will do

[limber goblet]

yeah I attached the screenshot for the ls -la, it is 882 for me

[silk anchor]

Are there not multiple examples in this section of different versions of the same page? Maybe you are in the wrong one

[next bronze]

did you spawn a target for that section or are you reusing the previous one

[limber goblet]

yeah that was the issue I had to respawn the target

I thought it would have stayed the same

Thank you 🙂

[silk anchor]

Each page has different filters which is why the index.php is a different size even though the tool is the same

[wraith owl]

Is there any bug system or official way to report bugs/issues with modules?

[next bronze]

#1234357888114364508

[normal sand]

Module: SQL Injection Fundamentals

Note: The data types of the selected columns on all positions should be the same.
Link: https://academy.hackthebox.com/module/33/section/806

Can someone explain what they mean by this? Because when I performed a UNION Injection in the exercises in this module, and even when I performed a regular UNION query in the database server they provided, I can just use any integer in the dummy columns, regardless of the data types of the corresponding columns in the original query. For example:

cn' UNION SELECT 1, @@version, 3, 4 -- -

[fathom pendant]

it means the amount of data from your union command should match the amount of data of the original query

[normal sand]

The number of rows?

[fathom pendant]

columns

[normal sand]

I understand that the number of columns should be the same, but the note talks about "data types"?

[fathom pendant]

data types; like integers, strings, tuples

it's saying "they can make any of the values of the remaining columns whatever they want"

because the example is basically col1, @@version, col3, col4 which matches the amount of columns the query pulls from

where it's inserting the @@version command in col2

[next bronze]

I think their question is that why did the module say the data types must be the same

[normal sand]

Yes

[fathom pendant]

they didn't

[next bronze]

?

[fathom pendant]

"regardless of data types"

unless i'm misunderstanding

[next bronze]

there's a quote from the module

[normal sand]

I was saying that I was able to perform the union statement regardless of data types of columns which contradicts what's written in the module.

Hence, my confusion.

[next bronze]

either way iirc mysql will do conversion for union queires

[fathom pendant]

OH

they're just talking about sql tables in general

as in all the data of a NORMAL TABLE in a column will be the same type

[next bronze]

so ints will be casted to strings if they're different or something

[normal sand]

Oh, that's prolly why it worked.

[next bronze]

when you do union queries conversions will be done to present the data for you

[normal sand]

Do most of the popular DBs convert? Or is it a MySQL thing only?

[next bronze]

all sql like DBs do I think but it's been a while since I've worked with them

[normal sand]

So if it converts... why the note in the module? Isn't it sort of redundant? (unless there are DBMS' that don't)

[next bronze]

that I don't know, extra info I guess?

[normal sand]

I see. Guess it's a good thing to know incase I ever come across some DBMS that doesn't have the conversion feature.

Thanks @next bronze @fathom pendant

[fathom pendant]

I beleieve the note was mostly referring to if you're combining 2 different tables

[normal sand]

Regarding this, iirc at the exercise at the end of the section, you interact with 2 tables: employees and departments. One of these tables had a date column and I was able UNION strings into that column.

[fathom pendant]

¯_(ツ)_/¯

[normal sand]

So I don't think the note applies to MySQL if Xre0uS is right.

[fathom pendant]

it's been a minute

[normal sand]

Hahaha alrighty. Thanks

[fathom pendant]

if anything throw it in #1234357888114364508

[late moth]

does the password attack final assesment - hard have a stupid long passwork spraying portion? just taking forever, and want to make sure i'm not wasting time because I'm stuck

[fathom pendant]

I don't recall spraying being part of the password attack hard assessment

I remember bruteforcing at the start

[dapper moth]

Does anyone know if netexec/crackmapexec works with IPv6?

[fathom pendant]

i don't see why not

but that's outside the scope of module content

[late moth]

well password spraying for a specific user. Maybe i'm not misusing the terminology. have 1 user and a long pre-made list of passwords, trying every password against that one specific user.

[fathom pendant]

password spraying is 1 password against many users

my notes say I used the mutated list

[late moth]

aye thats what i'm using. Just taking a long long time.

[fathom pendant]

i don't recall if i cracked it against smb or rdp

but it shouldn't take more than 20 minutes

as the password isn't that far in the list

[late moth]

doh, im trying agaist smb

[fathom pendant]

i mean smb should work i believe

[late moth]

im around the 40 minute mark and still going. made my mutated list based off the rules given in the module resources.

[fathom pendant]

the rules and password list from the given resources should be enough

[late moth]

i got the first user that way. I was trying for a 2nd user on the box. first one i got pretty quick just came to a dead end so i started bruteforcing another user on the box

[gilded radish]

@late moth if I'm not wrong brute force shouldn't take more then 5 mins in modules

[late moth]

thanks for th eheads up. i'll take a look again

[gilded radish]

all used password should be in rockyou list

[fathom pendant]

yeah you're not gonna brute a second user

the second user has a password that isn't in either mutated list or rockyou

you have to find it another way 😉

[late moth]

got it, think i know the avenue just gotta figure out how to do it lol

[fathom pendant]

2john is valuable

[fathom pendant]

this assessment is a lot of back and forth

[wet finch]

What am I doing wrong?
File Upload Attacks - Type Filters
||I found that I can upload .phar.png, .phtml.png, .phtm.png, .pht.png (or .jpg/.jpeg) and I have uploaded with different mime types (png/gif) || I'm able to upload the files no problem, but I haven't been able to successfully execute php on any of them.

[wraith pelican]

you don't necessarily need to execute your command from the url, if that's what your are trying.

[wet finch]

Okay, I'll give it a shot. Thanks

[wraith pelican]

there is no need to give the solution

[warm mountain]

It was a suggestion, not a solution

[rustic sage]

Hello, everytime I reboot my vm(VirtualBox) I get asked to re-install ParrotOS and it does not save any files from when I had it on, anyone know why? I'm using the HTB Live .iso

[wraith pelican]

i will not even argue on this

[wraith pelican]

hey, you have to actually install the system. Live iso is usually done for removable medias.

[dapper moth]

Bumping on the same problem here.
I used both ligolo-ng and proxychains with chisel but nmap says there isn't any port open for the ipv6 address. Tried passing the address directly, adding it to the hosts file and calling it but both just didn't return anything

[warm mountain]

I'm sorry anyway, I'll pay more attention to that.

[wet finch]

The frustrating thing is, I did all of that multiple times to no avail. For some reason it worked this time and not the others.

[dapper moth]

I can also verify that I get ipv4 connection with nmap but not ipv6.
Tried a github bash script to enumerate ipv6, it returned a 'xerox' device but none in the internal address

[dapper moth]

You install it and then you have to unmount the installation media.
You can get a couple of videos on how to do it in youtube.

[silk anchor]

I found that it was quite specific about the files it would accept.

[wet finch]

I have run through the same extensions, file types, mime types, and php, I have no clue what's different this time than all the rest

other than me resetting the box 85 million times lol

[wraith pelican]

it is fine by me, I just think it deprives others from learning stuff.
I get this is tempting to just push people to a working solution and also it can be tricky to help without saying too much.

[stark lark]

Anyone who have recently done Pivoting Skills Assessment?

[dim wolf]

systeminfo

domain-joined or not, which machine to move laterally to depends on what you've enumerated, any credentials you've gathered, ...

[left needle]

Sir in Windows Fundamentals NTFS vs Share Permissions I am unable to use smbclient , in module it is written to follow along but I am able to use xfreerdp but unable to use smbclient. smbclient -L 10.129.47.105 -U htb-student
do_connect: Connection to 10.129.47.105 failed (Error NT_STATUS_IO_TIMEOUT)

[dim wolf]

ping sweep, nmap to find open ports on machines, enumerate accordingly

you'll learn more in the AD attacks module

[gaunt surge]

In SQLMap, it apparently makes a difference what value I pass as parameter. I did 5 tests to verify it (module SQLmap essentials ( What's the contents of table flag6? (Case #6))).

Ex:
...?col=1 -> no result
...?col=id -> dumps database

Is there any value that i can use that 'always' works? otherwise you would have to test all kind of types?

[silk anchor]

Is this not because 1 is not a valid column name for the table?

[gaunt surge]

oh yes... ugh! thanks 🙂

[normal sand]

Module: SQLMap Essentials
Section: Attack Tuning
Section link: https://academy.hackthebox.com/module/58/section/526

I'm currently attempting the following question:

What's the contents of table flag6? (Case #6)

I've tried the following flags with my command: ||--level=5 --risk=3||

It took a LONG time but it gave a result but it's still ongoing (see screenshot). I had a look at the hint and there's a prefix it suggests. I'm still waiting for this command to finish running to see if I can get it without specifying the prefix but it's insanely slow since it seems to be a time-based blind injection.

That aside, the hint specifies the following:

||Use the prefix ')'.|| Does it mean ||``)||? And if so, I'm guessing SQLMap doesn't have this prefix as part of its testing by default so we have to specify it? If I didn't have this hint though, how would I go about solving this? Would I have to use the flags I mentioned above and just hope for the best?

[sonic plume]

for me, i did it without the hint. but i remember #6 and took me 1,30-2hrs to get the flag

[gaunt surge]

if you fuzz it, you find an erorr on the backtick ```
`

[normal sand]

A wordlist you'd recommend?

[sonic plume]

just try special characters

[normal sand]

There a wordlist for that? Or I gotta manually input special characters? 😂

[gaunt surge]

https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/special-chars.txt

[normal sand]

Thanks!

[normal sand]

Btw do you happen to know if SQLMap extends the prefix you specify? Like if I just specified the prefix as

--prefix="" would it find that you actually need to use ) to escape the user input limits?

Or will it strictly adhere to just ` ?

[vague tundra]

What are we supposed to learn from this? I concluded that evil-winrm is more reliable than impacket-psexec

[normal sand]

Do I need to escape the "`" character somehow?

[dapper moth]

If your output is this.... There should be something left opened. A single double quotes or single quotes somewhere

[normal sand]

I tried removing the ` character from the prefix and the command ran so I'm pretty sure I need to escape it somehow.

[silk anchor]

You do not need 95% of the stuff that you have in this command.

[dapper moth]

Try using a single quote instead of double with the parameter...

[normal sand]

I actually just copied did Copy as Curl from the browser. I didn't type all that out.

[dapper moth]

You can try to save the request to a file and sending it to sqlmap with the '-r' flag

[silk anchor]

Doesnt matter, keep it simple

[dapper moth]

Get the request in Burp, right click it > copy to file

and then sqlmap -r file

[shut wraith]

Hello can anyone help me in DMs for Brute-Forcing Password Reset Tokens

[silk anchor]

If you still cant get it the command in my notes ||has 3 flags and the scan took 2 minutes to complete. You can probably reduce this by being a bit more specific with them.||

[zenith hawk]

Hello I am stuck on question 2 of information gathering - web edition skill assessment. And I try to brute force vhosts by using gobuster but 403 error occured. And when I try to open website it so forbidden.

[acoustic owl]

What is question 2 and what have you tried?

[zenith hawk]

Skill assessment

[acoustic owl]

What did you try to do to find the answer?

[shut wraith]

Hey @acoustic owl can u help me with my question please

[zenith hawk]

Yeah, via brute force vhosts. So that I can get a new subdomain, where a I can find a softeware.

[floral talon]

i actually have a similar problem, all of the subdomains are 403, i even tried to grep only with status 200 which didnt give me anything

[zenith hawk]

I don't why hack the box has got a problem. When I try to open website via IP address that has been given by htb academy. It will so forbidden 403.

[fathom pendant]

That module works fine for me

[acoustic owl]

I'll be offline for about 1 1/2 hours.
but after that I'll have more or less the whole night to help.
write me a dm

[fathom pendant]

Did you add the required domain to your hosts file?

[normal sand]

I just got back to my laptop and gave it a go. I had left it running previously with a \ to escape the character and it worked. I tested with single quotes and it works without having to escape the character. @dapper moth thx for the single quote tip.

I get the reasoning for extracting the request from Burp to keep it simple but since I wasn't documenting this and didn't want to start Burp, I just copy-pasted 😅

[fathom pendant]

ip domain

[floral talon]

yes

[fathom pendant]

And you didn't include the port in your hosts file? :)

You should be able to call it with http://domain:port/

[dapper moth]

Some of the other binaries present some weird behavior with single and doubles as well.... Whenever you find something like this, try both.

[fathom pendant]

And fuzzing is simple from there

[normal sand]

Understood, thanks.

[floral talon]

do you have to add the port to the hosts file too? i read something that you shouldnt add a port to it

[fathom pendant]

No

[floral talon]

in that case, i have not added the port

[fathom pendant]

But when you visit the web server in a browser, for instance

You need the port

Or when using a fuzzing tool

[silk anchor]

Nice one, For future reference you can just use the url directly. Instead of using curl or burp.

[fathom pendant]

Like gobuster or ffuf

[vital zephyr]

hello everyone, I am in the active directory section, in the Living Off the Land module, I am not able to answer the third question (Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.
) because I am not able to understand what type of filter to use (dsquery + ldap), I tried these:

[floral talon]

i have done that, i add the port to the domain when doing commands

[vital zephyr]

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))" -attr distinguishedName userAccountControl

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512))" -attr distinguishedName userAccountControl

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2))" -attr distinguishedName userAccountControl

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=512))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2048))" -attr distinguishedName userAccountControl

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2050))" -attr distinguishedName userAccountControl

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2048))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.804:=2050))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.804:=2))" -attr distinguishedName userAccountControl sAMAccountName

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.1941:=2))" -attr distinguishedName userAccountControl

[fathom pendant]

What's your command

[vital zephyr]

can someone give me a hint?^

[normal sand]

Isn't it better to use curl or to use get the request from Burp cuz y'never know if maybe a header could be vulnerable? On a blind assessment I mean

[fathom pendant]

Can you not flood the chat like that, or at the very least wrap in triple backticks so it's easy to parse

[floral talon]

so for example the question:
What http server software is powering the inlanefreight.htb site on the target system? Respond with the name of the software, not the version, e.g., Apache.
I do

[fathom pendant]

You mean ad enum module, living off the land?

[heady vine]

Is the Skills Assessment for "Information Gathering - Web Edition" working ok? The target that spawns seems not to be running the software expected. No vhosts found from topmillion-11000. The web server that is not the one that matches the correct answer (I guessed since there are only a few web servers). I've tried a re-spawn, but no luck.

[vital zephyr]

yes

sorry, I just wanted to be thorough in saying what commands I used

[floral talon]

for the subdomain enum, i do

gobuster vhost -u http://inlanefreight.htb:51445 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain | grep "Status: 200"

in all cases they return a 403 code

[zenith hawk]

I also done but status show 403 requests only

[heady vine]

Try using the IP address instead of the domain

[floral talon]

alright, will try

[dapper moth]

Think I might be dealing with some problems routing traffic out to an IPv6 enabled interface. Does anyone know what would happen if I set two different routes to the same subnet over two different interfaces?

[fathom pendant]

That won't help for gobuster

[fathom pendant]

Collisions

[heady vine]

Might be a waste of time, though, since I didn't get any results myself. It did go throught the list without any false positives.

[zenith hawk]

I am unable to send photo on discord chat.

[shut wraith]

Hey @fathom pendant Can u please help me with this question I posted earlier?
https://discordapp.com/channels/473760315293696010/774040263278592041/1268200645773496422

[fathom pendant]

Haven't done this module

[dim wolf]

verify your account -> #welcome

[wraith pelican]

it will not work with the ip if you do the same command. it will work if you add --domain <domain-name>

[fathom pendant]

In order for you to find the admin your admincount must=1

You're on the right track of looking for a disabled account

[dim wolf]

reread the section again. there is no need for you to fuzz for usernames

[dapper moth]

They would collide if they were sent to both IF. In this case the machine would send to both interfaces? Wouldn't there be a parameter to choose to which IF to send?

[vital zephyr]

dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=1))" -attr distinguishedName userAccountControl this, right?

[fathom pendant]

Not always

[fathom pendant]

No

[shut wraith]

I understand. But even afterwards I fuzzed for the token parameter using numbers from 1 to 999999 and there was no hit...

[fathom pendant]

Look at the attribute cheat sheet, :=1 is login script

[floral talon]

do you have to do the subdomain enum? i have done directory bruteforcing and found the admin dir which also returned the 403

[silk anchor]

I don't think that is in scope for the module and you would do that by saving a burp request which comes up later in the module (if not already covered)

The command you were using isn't going to be looking for sql injection in the headers you are supplying.

[fathom pendant]

You have the right attribute in your ldap part, you just need to have admincount=1

I googled a bit to find the answer

[heady vine]

Thanks I'll give it a go

[dim wolf]

why would you fuzz six digit tokens?

[dapper moth]

So, if there are double route entries they would be sent to both then?
I had removed the entry for one IF, but only got working chaining dual tunneling tools to achieve connection

[normal sand]

Oh, I see. Thanks for letting me know. I assumed it would work cuz in an earlier exercise the curl method worked for the cookie header.

[dapper moth]

Using one route

[dim wolf]

you're given an example email. read it, then try again

[vital zephyr]

could you be a little clearer?

[wraith pelican]

if in doubt, you can give a look at gobuster help, you'll see the option and some explanation

[fathom pendant]

https://gist.github.com/jonlabelle/0f8ec20c2474084325a89bc5362008a7

[fathom pendant]

Your OID Match

1 is logon script, 2 is disabled user

[shut wraith]

Sorry but where am I given an example email?

[dim wolf]

in the section

[silk anchor]

You need to specify a custom injection point if you want to do something like that. Its covered in Running SQLMap on a HTTP request -> Custom SQLMap Requests.

It will only target the HTTP parameters by default.

[pseudo kiln]

Regarding command injection module, section evasion tools, has anyone figured out how to use bashfuscator to base64 encode paylods ?

encoder is the only mutator that I cannot get to work
`bashfuscator -c 'cat /etc/passwd' --choose-mutators encoder/base64

[ERROR] encoder isn't a valid mutator type`

other mutators like below work

bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --layers 1 --no-mangling --choose-mutators token/forcode

[shut wraith]

Hey. According to this I simplified my ffuf command to this

But still no hit. Can u put me on the right track please

[silk anchor]

Why not just pipe your command into base64?

[dim wolf]

filter using regexp and not response size

[pseudo kiln]

yeah that works, but I was trying to figure out this tool, not much info on it

[dim wolf]

and make sure you prepended your tokens with 0s -> seq -w 0 9999 > tokens.txt

[shut wraith]

Thanks @dim wolf I got it

[normal sand]

I'd completely forgotten that I had specified the custom injection point. Thanks!

[fathom pendant]

Run it and find out

Deleting bc spoiler

[heady vine]

I still get no results with gobuster vhost -u http://94.237.49.33:52439 --domain inlanefreight.htb -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 60 --append-domain | grep "Status: 200"

[vital zephyr]

i run that script but it dont show me the flag

[floral talon]

Module: INFORMATION GATHERING - WEB EDITION
Section: Skills Assessment
Section link: https://academy.hackthebox.com/module/144/section/1311

I have added the given IP and the domain to the /etc/hosts file, i have done subdomain enum, directory bruteforcing, but everything returns me to the same 403 error

[vital zephyr]

what going wrong?

[fathom pendant]

Don't grep for anything

[heady vine]

Then I just get 11,000 403s

[fathom pendant]

Did you grab the description attribute?

[floral talon]

can vouch

[heady vine]

I'm sure its just that I haven't used gobuster for vhost enumeration, but scouring the gobuster help hasn't given me any clues so far.

[fathom pendant]

If all else fails, reset the target

[floral talon]

ive done that a few times too

[vital zephyr]

''&''' this here is to say that all conditions must be satisfied

right?

[fathom pendant]

That's not what I'm referring to

I'm referring to the -attr part

[heady vine]

Same here. I've reset that and the pwnbox. Different IP, but looks the same otherwise.

[wraith pelican]

it works with encode/base64
https://bashfuscator.readthedocs.io/en/latest/Usage.html#advanced-cli-usage

[pseudo kiln]

awesome that worked, much appreciated

[floral talon]

i have honestly tried everything at this point, resetting the box, trying out different commands but that 403 haunts me :DDDDD

[fathom pendant]

make sure you're not spelling anything wrong or typing anything wrong ¯_(ツ)_/¯

[heady vine]

I appreciate the attempt anyway.

[vital zephyr]

and which attribute should i use? after -attr should i add this: (adminCount=1)?

onestly i dont understand