modules

[rustic sage]

Classic skid moves

[grim kayak]

How bro felt when he got his own ip from the link

https://tenor.com/view/hacker-pc-meme-matrix-codes-gif-16730883

[fathom pendant]

It was masked behind a "screenshot" link

[grim kayak]

oh no

[fathom pendant]

That redirected off-site

[rustic sage]

Lol

[grim kayak]

thats the worst kind

[fathom pendant]

So the message from discord was to that website, which then got redirected to grabify

[grim kayak]

XD

[fathom pendant]

[rustic sage]

Lol

[cloud urchin]

lol now this nerd came on with an alt

[fathom pendant]

No, you're not. And watch your tongue

[grim kayak]

who?

im not an alt btw

[fathom pendant]

¯_(ツ)_/¯

You just happened to join at a goofy and silly time

[grim kayak]

yeah

[grim kayak]

im making a htb account rn

[grim kayak]

awww i love cats!

[rustic sage]

Alr this Is turning into general. everyone STOP 🛑

[fathom pendant]

Kid probably can't hack his way out of a paper bag with a box cutter

[grim kayak]

crazy

[onyx rapids]

Question about Whitebox Attacks - Skills Assessement

All the code provided is in php, so there is no prototype pollution to do? Also, type juggling doesn't seem possible since there is nothing doing any kind of serializing/deserializing on the login form, so I have no idea what to do. Can someone give me a nudge in the right direction?

[zinc nimbus]

Attacking Common applications - wordpress discovery & enumeration
I'm trying to find the flag.txt but i've already looked through http://blog.inlanefreight.local/wp-content/plugins/mail-masta and http://blog.inlanefreight.local/wp-content/plugins/contact-form-7/

ive been checking around and i dontsee anymore plugins other than wpdiscuz i dont know if maybe i missed a page and there's an additional plugin

[fathom pendant]

one of those is definitely vulnerable to lfi

you can also get RCE vuln

:)

it's actually a fairly common vuln, you just need a user to log in with

[fathom pendant]

note with wpscan, you should have found a user besides admin to do a bruteforce against

it will NOT be the same user as the example

double check your output 😄

[zinc nimbus]

ok i got the lfi finally im getting somewhere and ye i found a diff user

[fathom pendant]

ye also don't be afraid to try multiple different methods :)

iirc it's vulnerable to a couple things (could be wrong though)

[night crypt]

infinite target spawn glitch happening for anybody else at the moment?

nvm right as I sent that it finally worked 😄

[safe star]

Same happened to me

[shut wraith]

File Inclusion

Basic Bypasses Section

Hello. Cany anyone help me with the exercise on this section. I tried all bypasses taught + used very extensive wordlists to fuzz for a working bypass. Nothing works ...

[fathom pendant]

you're likely overthinking it

[foggy monolith]

Getting Command 'unzip' not found in the Linux file upload section… good thing I was able to bypass this entirely by extracting on my local machine with python3 -m http.server running in my Downloads directory.

[fathom pendant]

as stated by the question it uses multiple methods, but they aren't too hard to figure out; as stated it's BASIC bypasses - no need to get fancy

[fathom pendant]

gunzip is usually a command

¯_(ツ)_/¯

[fathom pendant]

always look for alternate methods instead of just bypassing entirely

as usually there is some form of archive extraction command on a linux machine

[foggy monolith]

Wouldn't it be a .gz file instead of a zip file if gunzip was intended to be used?

[fathom pendant]

gunzip can still unzip .zip files

much like how winrar can be used for more than just .rar files like .7z

[shut wraith]

I went back and read the section. Tried to keep it simple and just redid the methods shown... But still I cant find it

Looking at the answer it says something about how basic filters wont stop lfi .. I could really use a good hint for this

[fathom pendant]

....//

Also be aware of how the file is being pulled

[zinc nimbus]

how the hell did i find a flag but it's not accepting my answer 😭

[fathom pendant]

Make sure no extra spaces

[zinc nimbus]

none

[fathom pendant]

Before or after

[zinc nimbus]

been thru too many times to know

[fathom pendant]

Refresh the page

[fathom pendant]

What section?

[zinc nimbus]

i did is it a diff flag

wordpress discovery and enumeration

ive been here for hella long bc i didnt know how to use the exploit properly turned out it was a rlly simple mistake tho

[fathom pendant]

That flag is for the next section

[zinc nimbus]

where would i find a flag accessible location 🤦‍♂️

man this is isnane

[fathom pendant]

The flag.txt is actually titled flag.txt in an indexed location

[shut wraith]

I tried a lot of payloads like these ones:

./languages/..././..././..././..././etc/passwd
./languages/....//....//....//....//....//flag.txt
./languages/....//....//....//....//....//etc/passwd``` But none are working... I'm just trying to review this module but this section seems more difficult than the assessment ...

[fathom pendant]

Don't use .languages

...

[fathom pendant]

Review the wpscan output

Technically the webroot wouldn't be an accessible location on the server

It can be found without any major rce/vuln

Hint : wp-content

[zinc nimbus]

omg finally

[shut wraith]

I redid all variations and combinations and included ur hint to use more ....// in my variations but still nothing... I hope I could learn what my mistake was here

[fathom pendant]

Just languages/

Then the payload

[shut wraith]

oh thanks. I used a . before it because the module showed that

I thought it just means that its a directory within the directory that ur in ...

[fathom pendant]

You'd use ./ in front of languages

Putting .languages is telling it to start at the nonexistent hidden directory, .languages. Remember hidden directories and files are prefixed with . In linux

[shut wraith]

Thanks. U help a lot. I'm going to bed now. Gonna keep reviewing tomorrow. Cya

[proper mountain]

Yo guys in the sqlmap essentials I think I've found the right answer for flag5 (from the table dump), but when I paste that It's showing wrong. I tried dumping the table multiple times the flag value was the same even after restarting too.

[plucky hollow]

then you are doing something wrong

[proper mountain]

Can I dm you to see if the flag I've got is the right one ?

[fathom pendant]

HTB{700..17}

[proper mountain]

yep

[plucky hollow]

no dm for helping with HTB tasks

[proper mountain]

ah okie

[fathom pendant]

Iirc this one sometimes has a weird issue where it outputs the hex of one of the characters instead of the value

I'm sure you can figure it out after a point cause l337_sp34k

Dm me the flag

[proper mountain]

ohhh

[fathom pendant]

Nah it just gave you a wrong answer for some reason

[plucky hollow]

please not DM for helping with tasks in this server

[cloud urchin]

lol

it's not against the rules to help people in dm, and marcielee helps a lot of people

[fathom pendant]

Dude. He had the answer, for whatever reason - the target spat it out wrong

Literally one character wrong

That's how close it was

[plucky hollow]

It's just a recommendation, that's why I ask the favor, although now that you explain it to me of course I don't see a problem in this case.

[fathom pendant]

The reason I requested in dm is to compare it to mine to either see if A) he somehow grabbed a different flag or B) some other issue

This module has its fair share of dumb things that happen

As I've completed the module; I know what the answer is meant to be

it'd be a different story if I was just giving away the answer, but there was sufficient proof that for whatever reason it misprinted one character of the flag ¯_(ツ)_/¯

I've also helped them in the past

So I trust they're not just asking for the answer

And if there was an alternative to achieving it, I'd point that way

[proper mountain]

Yes only one character was misprinted...

okay f let's lighten up the mood by listening to tdoss for the 100th time 😄

[fathom pendant]

Lmao

https://tenor.com/view/sleep-time-gif-25989090

[proper mountain]

https://tenor.com/view/3am-gif-25979019

[night crypt]

hi all just trying to modify the scripts suggested in the web attacks module, I've written the below and just wondering what's the easiest way to get this to only print the new line if the grep returns a result? Currently this is working but I get a tonne of blank lines which I don't need. Any help appreciated 🙂

#!/bin/bash

url="http://SPOILER_REMOVED"

for i in {1..100}; do
        curl -s $url$i | grep -i "adm"
        echo
done

[night crypt]

hey FWIW I had the exact same issue when I did this one a couple of weeks ago. The solution is to increase your timeout value by a not insignificant value to account for extra delay (I'm in OCE & had to use the EU server because NA was broken at the time :D) used 1337 5p3ak to get the answer rather than wait but I left it running in background and it eventually spat out the correct flag properly

[proper mountain]

ahh okie thanks

[cloud urchin]

put it into chatgpt itll tell you

[grand portal]

Module: Footprinting
section: SNMP

Enumerate the custom script that is running on the system and submit its output as the answer. 

I've tried onesixtyone, snmpwalk, could not find any script and community string either.

any hint?

i've carefully observed the output of snmp walk and braa, too nothing relevant was found.

[grand portal]

nevermind, got it!

[steady charm]

The modules that are focused on brute forcing attacks are driving me crazy. The service skill assessment for the Brute Forcing module is just insane. I've created multiple username and password wordlists using the exact same theory as in the module yet not a single password hit after more than an hour...

[kind turret]

you are doing it wrong then

[steady charm]

Or I just needed to reset the machine like 3 times since the creds where the first entries in each of my wordlists

[kind turret]

dm with what you are doing

[umbral fulcrum]

Hey guys, I just did the Web Service & API Attacks section Information Disclosure (with a twist of SQLi)

In the second question I used sqlmap, did someone do it without it??

I didn't manage to run it manually & curious about it

[acoustic owl]

Since you know the position (as stated in the question), you can also query the data manually. ||OR|| is your friend

[umbral fulcrum]

I thought I did...

I guess I did it wrong ...

[red wadi]

hey guys anyone could help me to talk to real human in support ??
I subscribed to student and after 15 i got also silver subscription i got 2 right wants to refund silver so what can i do ?

@jolly cradle

@surreal rain

[autumn pilot]

be patient and someone will reach out to you

it is the weekend nonetheless

[vocal bridge]

binary exploitation module - intro to assembly, shellcoding tools
I tried encoding and generating multiple payloads and getting a payload from different sources but it still doesnt work out and i can't find the issue
edit: nvm i figured it out. I thought I had to enter a shell first but i can just put the command directly as CMD='cat /flag.txt'

[red wadi]

they will do refund or not ?

[marsh echo]

I have a question: it says in drupal 7 that the php filter module is vulnerable, but if it's vulnerable and the customer hasn't installed it, what's the use of asking the customer to download it to try to get an RCE? or even in drupal 8 it's deactivated by default, so we have to ask the customer for the right to activate this module, but what's the use, knowing that it's deactivated, so the application is "Safe"?https://academy.hackthebox.com/module/113/section/1209

[topaz dagger]

Are forums down rn?

[rustic sage]

Im trying to answer " After performing the ESC1 attack, connect to PKI (172.16.18.15) as 'htb-student:HTB_@cademy_stdnt!' and look at the logs. On what date was the very first certificate requested and issued?" for the PKI - ESC1 task. Im pretty sur e i have the correct answer but it keeps on giving me wrong answer. The answer im trying to provide is "12/19/2022"

[twilit jacinth]

guys , htb academy website down ?

cant seem to log in , onlu able to access the home page

[hot owl]

Working perfectly.

[fathom pendant]

https://status.hackthebox.com

[quaint lynx]

hi i have a question , so i dont get it if from where i can get HTB cubes

[fathom pendant]

Either a monthly subscription (preferred) or directly (more expensive)

[grand loom]

if i add a user to the administrators group. I noticed im unable to have there perms untill i restart the PC. any commands to make this happen without restarting it

[fathom pendant]

Nope

It's basically windows being silly

But a change isn't fully processed on an account until you log off and back on to the user

You don't need to fully restart

The effected user just needs to be not logged on

Via any rdp session, don't click the x to close the session, use the windows menu then --> sign off

[silk lagoon]

Information Gathering - Web Edition Skills Assessment

For the target's IP and port, is the port supposed to be closed?

Is that part of the challenge as well?

[fathom pendant]

The port shouldn't be closed?

[silk lagoon]

It shows it is and I can't connet to it

[grand loom]

[fathom pendant]

Did you add to /etc/hosts? Also possible that there's some issues going on rn. Did you try respawning the target as well?

[silk lagoon]

I added the IP and domain name, and I did respawn the target four times already and it gives me the same one

[fathom pendant]

Hard refresh the page

Ctrl+shift+r

[silk lagoon]

Did that as well

But will try again

[fathom pendant]

then ig wait a bit ¯_(ツ)_/¯

Seems like some issues going on rn

[fathom pendant]

.

[silk lagoon]

Seems good now after couple of refreshes

[fathom pendant]

👍

As to answer your other question.
Always check for subdomains
Always look for robots

Those are your two nudges

[silk lagoon]

Ty

[silk lagoon]

that was my only question ty, gobuster wouldn't connect and that was my question

[fathom pendant]

(I've probably repeated that a dozen times

[fathom pendant]

Well your question was regarding finding a hidden directory 😉

[stark lark]

Active Directory Enumeration & Attacks -> DCSync

How can I verify that this new Powershell session is indeed running as adunn?

If I just enter some random pw it still show the same..

[fathom pendant]

Generally if the pw is incorrect then it'll just launch as the user

If it's correct then you should get powershell privileges as the user you runas

Try running the dcsync commands in powershell with/without adunn creds

[stark lark]

I followed the guide but it doesn't seem as if I have enough permissions to run the command, however it still works...?

[fathom pendant]

Wdym,

Dcsync worked just fine there?

[stark lark]

Exactly, but when looking at privilege::debug it doesnt say Privilege '20' OK

[fathom pendant]

Don't focus on that lol

[stark lark]

Ah really?

[fathom pendant]

If it executes, then the user has sufficient permissions/privileges

It's likely that adunn doesn't have SeDebugPriviliges

[stark lark]

But I think it's running as htb-student (of course it must have enough perms) however, how would you validate that the new PS session is actually running as adunn?

[fathom pendant]

Try running powershell as htb-student

And running the same command

Sometimes it doesn't reflect the new user

[fathom pendant]

See; htb-student doesn't have the privileges

I wonder if you do whoami /all in both if you'd get a different result

[stark lark]

Hmm I see, just tried aswell using a random PW for adunn account, didn't work either.

[fathom pendant]

Yup meaning it fell back to using your user context

I.e. it soft failed but didn't error

[fathom pendant]

whoami /priv

[fathom pendant]

Interesting though that it didn't fetch group info, I wonder if it's using cache/tickets loaded

[fathom pendant]

And in the normal powershell?

[stark lark]

Thats weird

[fathom pendant]

And whoami /all

[fathom pendant]

Ah ok

So it's able to fetch groups

That'll be how you're sure it's successful

[stark lark]

Don't think I understand 100% tbh

[fathom pendant]

In the adunn shell, it can't grab group info

In regular shell it can

👍

[stark lark]

Yes so what does that tell me?

[fathom pendant]

... it means that the shell context isn't the user you're logged in as

[stark lark]

Understood, but it is a bit of a workaround right? In my (simple) world, it should just say INLANEFREIGHT\adunn when running whoami

[fathom pendant]

windows is dumb ¯_(ツ)_/¯

[knotty anvil]

whats the best way to upgrade a webshell on a windows machine after an sql injection?

[stark lark]

Python if available?

[fathom pendant]

Sql injection module?

[fathom pendant]

You don't

[fathom pendant]

Python generally won't be available on windows

[fathom pendant]

I wonder what happens if you type powershell

🤔

https://zweilosec.github.io/posts/upgrade-windows-shell/

But you can't upgrade a webshell

[knotty anvil]

yeah i saw this

[fathom pendant]

You can attempt to run a command

But you're not gonna upgrade a webshell

You can do a reverse tcp command, maybe

[knotty anvil]

so generally we dont upgrade webshells to reverse shells?

im really confused

[fathom pendant]

It depends

But there's a difference between upgrade to reverse, and upgrade to usable

Which is likely where your confusion set in

You'd need to do a one-liner in the webshell to get it

[knotty anvil]

ive tried revshells

[fathom pendant]

well you'd likely need to urlencode any spaces

With either + or %20

[empty belfry]

Im struggling with the javascript deobfuscation module. I have multiple different flags and none of them seem to be working correctly

[fathom pendant]

Don't work ahead of the section

It also helps to say what section you're on

[empty belfry]

The deobfuscation section, it wont let me show a picture of it tho

[fathom pendant]

Bc your account isn't linked

[empty belfry]

??? linked huh?

[fathom pendant]

Deobfuscate the secret.js, then look for flag=

[bright coral]

You specified /netonly so the credentials work only for remote access. whoami is local though

[fathom pendant]

Read #welcome

[empty belfry]

Yeah and its not working

[fathom pendant]

If it still has + in it, then it's not fully deobfuscated

HTB{1_..r!}

[empty belfry]

Or it does again after I type it manually a 3rd time? now jesus christ this whole module. There must have been some kind of white space getting in there somewhere?

[empty belfry]

Yeah I just put that flag in about 5 times

[fathom pendant]

Probably at the end

[empty belfry]

The academy desparately needs to be less sensitive about case and whitespace. I get that you wanna be teaching people to pay attention and stuff, but its really discouraging and sometimes leads me down the wrong path when I have the right answer getting marked wrong cause the input isnt getting stripped

This is not the only time ive struggled inputting something as an answer

[fathom pendant]

Well flags specifically have to be case sensitive

I have a habit now of making sure there's no whitespace

[empty belfry]

With case sensitivity I was thinking of other modules that have words and stuff as answers

[fathom pendant]

Put cursor at end, backspace, put cursor at front delete

It's a habit you form

[empty belfry]

I mean, from my perspective, I checked the front and back of this flag and put it in and it said it was wrong. And then it said it was right after trying repeatedly, and I have no idea even what I changed to get it accepted, but as far as I could see I was putting in the same set of characters over and over until it just... worked through stubbornness?

[fathom pendant]

/feedback exists

Also sometimes the input form is just dumb

And refreshing the page makes it work

[empty belfry]

Is that a module problem or an academy problem?

[empty belfry]

Havent tried that actually. good idea.

[fathom pendant]

An academy problem

If you're 100% sure it's right, no ws, refresh the page

[empty belfry]

Still better than tryhackme but these cubes arent cheap man, I should have a dedicated chat bot on the page to gripe and complain to at least if its gonna be this frustrating! lol

[fathom pendant]

Javascript Deobfuscation is a tier 0 module yeah?

You'll get the cubes back when you complete it

[empty belfry]

I cant remember honestly

[fathom pendant]

There's a help bot in the bottom right of academy

[empty belfry]

but ive had similar problems in some of the higher tier ones on this path

[fathom pendant]

And depending on the issue. It may get raised to staff

[sterile pumice]

Hi I have been trying to do the "web fuzzing skill assessment" for 2 days
Have found "http://IP:PORT/folder/file.php?parameter"

But i fuzz as asked with common.txt and find nothing > have tested with ffuf and wenum .

Any ideas ?

[fathom pendant]

The parameter to use is given to you

Parameter=FUZZ

If you don't see it, then maybe you didn't find the right file.php

[sly trench]

Guys I'm in footprinting lab in pentester path, Lab - Hard. There's 5 ports open, one is ssh which requires both password and public key, then there's POP3, ssl POP3, IMAP and SSL IMAP.
I can connect to all dovecot servers but every single command I input is invalid and it always says error. I can't do anything with the ssh port and I tried looking up the dns of the server and it seems like there's nothing there. I have no idea what to do. Do I have to use metasploit? Even the I prob wouldn't know what to do

[rustic sage]

link videos

[knotty anvil]

allright, so my problem was that i thought it was a windows machine so my revshells didnt work.... lmao i needed a break

[still quartz]

https://academy.hackthebox.com/module/81/section/789 Has anyone else had issues with this lab portion? I walked through it step by step for the last two hours and the machines just aren't generating the traffic that contains any answers, the only image file I see is is the golden retriever at flag.jpeg after using t he ftp.request .command filter. But at no point did I see anything having to do with "a certain Tranformer Leader".

I did what the lab told me and filtered "http && image-jfif" and got nothing. I was able to find a lab write up to get the answers after 2 hours of struggle bus. I am used to the bugs on OffSec but this lab just seems to not be working correctly. I was letting the packet capture run for ten minutes at a time.

[marsh echo]

hey i found the answer via the course but when i enumerate urls i don't found the examples to find the xml file containing the admin role,https://academy.hackthebox.com/module/113/section/1090

[fathom pendant]

Perhaps that page isn't accessible on the target

¯_(ツ)_/¯

Also the role question specifically states "in the example"

[shut wraith]

so @fathom pendant on the LFI Assessment. if you navigate to http://94.237.62.126:42677/index.php?page=index you will find that the server doesnt respond at all. but if u try other pages than index, it does respond. So I want to see what other files I put that it doesnt respond to, maybe meaning that those pages exist

[fathom pendant]

I didn't have to do a timing attack for that module assessment

I think you're trying too hard for something where the answer may be simpler, like wrappers

[marsh echo]

Yet I listed the vhost and I found an examples directory thinking that I was going to find this famous web.xml file

[fathom pendant]

well it's not web.xml

the example explicitly states it as the tomcat-users.xml file

[marsh echo]

I understand good 40 minutes lost for that lol

[fathom pendant]

@sterile pumice I don't do private dms for help, especially unsolicited

[sterile pumice]

Sorry @fathom pendant . done that to not spoil what i have already done 🙂
But i understand! will look if someone other can help

[fathom pendant]

idc why you did it, it's best to ask to DM first (especially bc #rules ); you can also ask here and redact any spoilers

[cloud urchin]

There's another service you missed. Make sure to perform a full enumeration.

[fathom pendant]

also ssh doesn't require BOTH password and key, it requires password OR private key

[fathom pendant]

if you did whoami or id in your webshell you'd have known

[knotty anvil]

i did lol

[fathom pendant]

then you should have known it was linux

as with windows it's [Domain]\[user]

where with linux it's just [user]

[plucky latch]

Who do we talk to if the correct answer isnt being accepted by the question. I've reset the box 3 times, solved it, got desperate and validated my solution in "Show Solution" and it is still telling me Incorrect answer, its in Broken Authentication - Attacking Session Tokens

[surreal rain]

I can look at it in about 2 hours. Did you try submitting what show answer gave?

[plucky latch]

Show answer shows answer {hidden} I know what I am submitting is right because it is in the admin panel HTB{xxxxxxx} and I am literally just copying and pasting, I even hand typed it, and still shows incorrect

[cloud urchin]

you can dm me a screenshot and i can look if you want

[surreal rain]

Since it's paid content, please don't do that.

Hopefully I'll be at my work machine in about 2 hours and can check it out for you

[plucky latch]

Thanks

[acoustic owl]

Do you also have no spaces at the beginning or end of the string?
Have you restarted the browser?

[plucky latch]

OK, there was a space in front of the H , that I didnt notice, good now, my bad, false alarm, wasted an hour of my life over a space lol, Thanks all for the suggestions

[acoustic owl]

look on the bright side. It will never happen to you again

[surreal rain]

Thanks @acoustic owl

[sullen rapids]

I was solving a module and unable to find the flag, can anyone help me out?

[tepid hemlock]

the last bit looks like a function generateSerial

maybe if you prettiefy the last bit it might be easier to understand

[sullen rapids]

i mean I have the image, but it won't fit all the content

[tepid hemlock]

try to read the last bit of your code, and see what it does. for example why is there a split("|") what does split do?

[sullen rapids]

okay

[fathom pendant]

Javascript Deobfuscation?

Just replace eval() with console.log()

[fathom pendant]

It's easier to just have nodejs or some other tool just console.log instead of eval the script

¯_(ツ)_/¯

Also @sullen rapids try not to post things directly from the target that may have the flag

Flags won't be wrapped in quotes to submit

Just the HTB{..}

[sullen rapids]

okayy..

[fathom pendant]

You have the answer btw

[sullen rapids]

nah...I am still stuckk

[fathom pendant]

You just copied the string with quotes

You need to copy it without it

:)

[sullen rapids]

le'me try it

😦

[fathom pendant]

Make sure no whitespace before or after, try refreshing the page

This is the Deobfuscation section yes?

[sullen rapids]

yeahh

[fathom pendant]

Oh...

No...it's not

You worked way ahead

https://academy.hackthebox.com/module/41/section/441 this section yeah?

[sullen rapids]

tried it

[fathom pendant]

Dude

[sullen rapids]

yeahh

[fathom pendant]

Just read the source code of the page

:) not /secret.js

But of the spawned ip

You worked a little ahead

The hint is also in the name of the section

[sullen rapids]

yeah I noticed now

[fathom pendant]

Istg if you keep posting spoilers

If it contains the answer: don't post it

Ffs

[sullen rapids]

ohhh my badd, I am so sorry

Gonna keep that in mind

[sullen rapids]

sorry man

[fathom pendant]

If it could either directly lead to the answer or is the answer [meaning someone else could just look at it without actually putting in the work] it's a spoiler

[sullen rapids]

okayy, so posting the answer is prohibited or I can post it with a spoiler tag?

[wary plover]

Prohibited

[sullen rapids]

okayyy

Ty @fathom pendant

[fathom pendant]

No answers

As spoiler tag literally does fuck all

Some people have them turned off in their settings

[sullen rapids]

ohh..okayy..

not gonna do it next time

[fathom pendant]

If you want reassurance you have the right flag you can do HTB{12..89} as the first and last 2 characters of the flag

[sullen rapids]

okayy

[fathom pendant]

Or in cases where the flag isn't in HTB{} just the first and last 2, or the md5sum of it

I.e.

echo "flag_here" | md5sum

[sullen rapids]

okayyy

[analog urchin]

Hey guys, why does HTB usually highlights parts of the IP in their examples? Maybe this is irrelevant but I just want to confirm the intention of this

[sly trench]

Yes I'm stupid

[foggy monolith]

I've always wondered why md5sum is used in all the examples and sha256sum isn't — the latter produces output that happens to be the default format produced by PowerShell, so it plays much nicer with Windows targets.

[fathom pendant]

It's just how syntax highlighting works for bash/sh

[fathom pendant]

md5sum is more ubiquitous, and usually is only used for checksum verification

And also generally faster

[cloud urchin]

not stupid, it's a learning process and this is to reinforce the learning.

[fathom pendant]

Failure is falling down and not getting back up and learning

[shut wraith]

Hey @fathom pendant I'm on the LFI assessment and I have LFI using the filter that u know, but I am limited to the web root directory. I tried many traversal payloads with all filters but no payload allows traversal.

As u know it disallows .. so u cannot do ../../ . It also URL decodes it before assessing the 2 dots so that doesnt work either, inputting base64 with the decoder filter to decode it also doesnt work.

[fathom pendant]

look for resources

Perhaps there's something hiding that doesn't get reflected to the actual page, like a comment in the source code that won't get sent to the user

[shut wraith]

Thanks successfully reviewed the LFI module now

[heavy slate]

Im doing Windows Event Logs & Finding Evil -> Tapping Into ETW

im doing something wrong so that sysmon dose not load event id 7 events (did change event id to exclude)
and at the end etc.json has no info about ManagedInteropMethodName.

Any guidance would be great. ty

[frosty geyser]

Hay

I have a problem, does anyone help me?

[heavy slate]

@frosty geyser https://dontasktoask.com

[frosty geyser]

I have problems in module on HTB

[fathom pendant]

Ok just ask your question

If it's a hint you need it helps us help you to tell us what module and section (chapter) you're on

And what you're struggling with

We can't read your mind on what you need help with

[frosty geyser]

Attack password

[frosty geyser]

In you on private

[fathom pendant]

I don't do private dms

Just ask here

[frosty geyser]

I have problems in module password attack Lab 6

[fathom pendant]

Lab 6 tells me nothing

What's the section name

[frosty geyser]

Remote password attacks

Password Reuse / Default Password

[fathom pendant]

👍 and what have you tried?

[frosty geyser]

I didn't understand

🙄😊

[fathom pendant]

Use the credentials database they linked, search for mysql

Use that to try default credentials

[plucky hollow]

please be specifyc when you are asking for help

[fathom pendant]

You need to first ssh to the machine using creds you found in the previous section

[frosty geyser]

I didn't understand how to use Mysql

[frosty geyser]

Ok sorry bro

[fathom pendant]

If you're doing the pentester path. The footprinting module is earlier in the path which details how to connect to a mysql instance

[frosty geyser]

I just want the method

[fathom pendant]

mysql --help

[frosty geyser]

I mean, enter ssh data in mysql ?

[fathom pendant]

No

First: ssh into the spawned ip with the credentials

Then from the ssh session, you connect to the mysql instance

[frosty geyser]

I mean, how did I connect from ssh to mysql

[fathom pendant]

????

you're not connecting to ssh from mysql

...dude

it's like connecting to something from your own machine

the ssh connection just connects you to a remote machine with a user on the remote system

[frosty geyser]

I mean, how do I solve the method?

[fathom pendant]

??????

wdym how do you solve the method?

i literally told you the 2 steps you need to do to try

there's a resource provided in the reading to a default-cred-cheatsheet

in that; search for mysql and try those username and password combinations while in the ssh session as sam

if you run mysql --help in your terminal, and look you'll see how to pass a username, and password to authenticate with

i've basically given you half of what you need, the other half is utilizing that squishy thing in your skull called a brain

[plucky hollow]

I think you should start by doing the most basic modules if you have trouble understanding the module you are currently on.

[frosty geyser]

Ok thank for your time

[worn knot]

nah he must study basics first as sec + and network+ and pts

[fathom pendant]

nah

sec+ and net+ aren't needed

[worn knot]

nice

[fathom pendant]

but if he's doing the Pentester Path on academy, he skipped a few

[worn knot]

oh

[fathom pendant]

as there's a module called "Footprinting" earlier in the path, which literally details the bare bones basics of connecting to a lot of common services

[worn knot]

ye

[rustic sage]

Im trying to answer "Windows Attacks & Defense/ PKI - ESC1 / question 2". Im pretty sure i have the correct answer but it keeps on giving me wrong answer. The answer im trying to provide is "12/19/2022". Any help is appreciated

[rustic sage]

Has anyone solved question number 2 of the Notetaking & Organization section of the DOCUMENTATION & REPORTING module?

[fathom pendant]

it's given in the reading

or at least it should be

it's related to using tmux yeah?

[dry totem]

guyyyyssss iii goooottt a first Zerrrroooo Dayyyyy CVE YYYYaaaaaaaaaaYYYYYYYYYYYY

I'm very happy

[fathom pendant]

congrats

but this isn't a gen chat

if you read and follow #welcome you can access #general

[rustic sage]

I don't know what I'm doing wrong, but I have more than 6 hours alone on that question... possibly it's some nonsense I don't know, but how tiring so many hours already alone on that question.....

[fathom pendant]

command prefix then the other combo

all [key1] + [key2] +[key3] + [key4]

[rustic sage]

the prefix is the part I don't know what it is because I can't find it, that's why I have this problem with the correct answer.

[fathom pendant]

... ctrl + [<Another Key here>]

it's given several times

you can also probably google "tmux default command prefix"

[rustic sage]

This is what I have been doing [Ctrl] + [B] + [Shift] + ["] because when I put it in the pwnbox it creates the vertical division, but when I write it as an answer it does not validate it....

[fathom pendant]

That's a horizontal division

[rustic sage]

I used this other one [Ctrl] + [b] + [Shift] + [%] and when I put it in the question it doesn't give it as valid either, I don't know what other key I need to put.

invalid I meant

[fathom pendant]

Did you put % in?

Also try capital B

[rustic sage]

yes I did

[fathom pendant]

And capital B

[rustic sage]

Yes, when I type it in the pwnbox Ctrl + b + Shift + % it displays the screen vertically, but as an answer in the question it is not valid.

[fathom pendant]

Reach out to support then ig

[fathom pendant]

It worked for me

¯_(ツ)_/¯

Make sure a space between each [key] + [key]

[rustic sage]

Do the brackets have to be right ?

[unique peak]

Hello, I’ve been trying to go through the questions here and I just can’t figure them out. I went through all the modules prior quite easily and haven’t been able to figure out the first question even for the “C:\Logs\DLLHijack” question. I know to filter events by ID 7 but from there I’m struggling on what to do, I’ve been trying to manually go through the logs but it’s been very time consuming. Any tricks or tips would be greatly appreciated. Thank You!! Windows event logs and finding evil skills assessment.

[jade latch]

yes brackets

[jade latch]

just capitalize B and brackets. check whitespace

[rustic sage]

At last it helped me, if I was doing it right, but it must be that sometimes the fields of the questions give problems because it is not the first time that I notice these failures... I thank you for your support my friends...

[jade latch]

yeah some questions are dumb

[fathom pendant]

Yes

[rustic sage]

Yes, as I imagined, it was possibly something silly, but it took me hours.... But thank you very much for guiding me to have a better vision.

[unique peak]

Here is the question? By examining the logs located in the "C:\Logs\DLLHijack" directory, determine the process responsible for executing a DLL hijacking attack. Enter the process name as your answer. Answer format: _.exe.

[plucky hollow]

hi

How many Pen Testing Labs did HackTheBox have on the 8th August 2018? Answer with an integer, eg 1234.

it redirects me to another page

so i cant get the answe

[spiral spoke]

Thanks man! I think the problem is the latest version of Impacket, because I tried with the 11.0 instead of 12.0-dev and it worked!

[civic hamlet]

man, is every module as thick as the introduction to windows command line?

granted im reading closely and taking notes but its a bunch of infromation

[safe star]

Yeah majority of them are thick

I just got used it after a few modules

Previous knowledge helps tho

[jade latch]

it's rated 4 days. there is one that is 7 days, but 4 is the higher end

[civic hamlet]

I see

[steady dagger]

Can someone show me where I’m going wrong in virtual host and subdomain fuzzing?

When attempting to use gobuster to fuzz the vhost via url “inlanefreight.htb” I’m getting “no such host”, when I use the target IP, it will run but only output status: 400.

I’ve tried running the url with provided port# but “no such host”.

I can see in my /etc/hosts that the specified vhost was added. Really not sure what’s going on.

Any hints or tips appreciated, thanks.

[quiet trout]

terminal output please

@steady dagger ^

[storm elk]

And command

[quiet trout]

+1

[heavy slate]

I have problem with module Windows Event Logs & Finding Evil -> Windows Event Logs & Finding Evil
event viewer has no logs of event id 7 and ETW has no ManagedInteropMethodName.

configured sysmon to detect Event IDS 7's (include -> exclude)
opened powershell and CMD in administrator privileges
started SILKETW command in CMD
ran SeatBelt in powershell (while silk was running)
went to ETW.json to look for the answer

im missing something but im not sure what?

[quiet trout]

have you tried going thru the logs via powershell get-event i think the cmdlet is, or something like that? also get-eventlog and get-winevent check out the docs pages for those and figure out which one will let you search by event id and see if that helps

[oak girder]

Hello

Why is it different from the content of the results he obtained? Can someone help me?

[final shale]

they are showing you the format of the flag on the first screenshot. The second screenshot is the actual flag.

[minor zenith]

Hi, I need help in the hard lab of Firewall and IDS/IPS evasion pls

im scanning and i get only 2 open ports and idk how to continue the lab ( port 80 and port 22)

[final shale]

which module was that one?

aha found it. Try using -g 53 on nmap when scanning

[umbral fulcrum]

Hey Guys I have a question on Web Service & API Attacks ==>> Server-Side Request Forgery (SSRF)
did someone did that question hands on ?

I know I can do the inner port scanning, but I didn't managed to do it ...

[formal sail]

hey guyz i m stuck with the question During our examination of the USN Journal within Timeline Explorer, we observed "uninstall.exe". The attacker subsequently renamed this file. Use Zone.Identifier information to determine its new name and enter it as your answer, in Rapid Triage Examination & Analysis Tools

i found this file with file name
amd64_dual_mdmtkr.inf_31bf3856ad364e35_10.0.19041.1_none_ed481a2e40b7b510.manifest
but its incorrect can anyone help me through the walkthrough please. 🙂

[fathom pendant]

You need to compare 2 journals and search for uninstall.exe

[azure bough]

Hola!

[umbral fulcrum]

the only way I found is to do it using **burp **on that specific port I get a delay response & on other ports that isn't open I get error response quickly...

is this the intended way?

[misty current]

Normally it would be time delay or differentiating the response for SSRF port scanning. That is the intended way.

[umbral fulcrum]

then if I didn't know that specific port the enumeration would be impossible?

[misty current]

Whole point is to find ports that are active

[umbral fulcrum]

cause some ports where fine some error and some are time delay ...

[shut wraith]

Btw u can use a burp extension for filtering responses with delays

[misty current]

You fuzz all the ports and based on time based technique or response based techniques, you figure out which one is open and which one is closed

[umbral fulcrum]

not in that example

some where website regularly some r time base and some r closed ...

[formal sail]

solved, thanks

[umbral fulcrum]

that y I'm not sure

if they have another way ...

[misty current]

If it gave too much irregulars on whichever technique, mostly don't go for it

You don't get much false positives on the time based enumeration right?

[umbral fulcrum]

well I guess

[umbral fulcrum]

thanx on it ...

[misty current]

Then that's the way. I'm also pretty sure that's the intended way

[umbral fulcrum]

thanx

[shut wraith]

Enjoy. Time based attacks on HTB are "advanced" so good to start getting familiar now

[glad sand]

hello , im in Pass the Ticket module, but i cant rdp to the target with the given credentials

command:
xfreerdp /v:10.129.xx.xx /u:Administrator /p:AnotherC0mpl3xP4$$
xfreerdp output:

[06:36:16:754] [10083:10084] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[06:36:16:754] [10083:10084] [WARN][com.freerdp.crypto] - CN = MS01.inlanefreight.htb
[06:36:16:956] [10083:10084] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[06:36:16:956] [10083:10084] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[06:36:16:956] [10083:10084] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[06:36:16:956] [10083:10084] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

[vestal pecan]

Yo

Anyone know about a virus that attacks ram

I have 8gb ram but it’s showing 2 in task manager

[fathom pendant]

Wrap the password in single quotes

$$ is a variable call in bash calling the PID of the current shell

[glad sand]

Thanks

[fathom pendant]

👍 it's important to know special characters and their purpose in bash and any programming language

[glad sand]

thanks for the advice!

[pseudo kiln]

I have question which is more a curiosity regarding the AD Enumeration module. Here I see that we have 2 ways to abuse GenericWrite or GenericAll permission over a user object:

• populate the SPN field with a fake one and kerberoast
• enable the "do not require Kerberos pre-authentication" setting to request the encrypted TGT and crack if offline

But I have not really seen these methods compared. Are there any pros and cons for each ACL abuse method ? So far I would say populating the SPN sounds better as you may be able to force RC4 encryption on older Window Servers, while the TGT comes AES encrypted anyway I think. At least the module did not touch on its encryption.

[fathom pendant]

each way poses different risks, and either way you're triggering a log event

with the second method you're altering security settings, which may be disallowed by the company that contracted you

generally you want to go with the least intrusive way of acheiving your goal

[pseudo kiln]

yeah in that case seems like populating the SPN is safer, and proably easier to clean up after, when you can choose both that is

[fathom pendant]

mhm :) path of least resistance

in either way you'd obviously log that you did them

just in case you either forgot or for some reason couldn't revert changes

[lime night]

Question:

I'm trying to get through the Setting up - Linux module rn.

I've been going at it for several hours following the instructions. I get to the part where I have to run this command : "sudo apt update -y && sudo apt full-upgrade -y && sudo apt autoremove -y && sudo apt autoclean -y"

And it just absolutely eats up all the allocated space for the disk and throws out several errors. I started with a 40gb disk, and ended up trying with a 120gb disk. No matter what it just completely ruins everything and i can't continue 😦

Am I doing something wrong? I'm following the instructions to a point. Does it make sense to even do the manual setup of a pwnbox or is there something that outdated with the module?

[fathom pendant]

it's safer to use an 80GB disk size tbh

for general everyday user stuff 40 is normally fine, but you have to consider that a LOT of tools will eat up a LOT of space

:)

try running the commands one at a time

perhaps something else is going on that you don't see

also are you allocating a fresh vm? or did you add size after?

if you added size after setting up the disk, you'll need to repartition the drive to add the space using a tool like gparted

[lime night]

Fresh VM after each time that it filled the disk up

I basically started over completely each time

Which is why I'm suprised it even went so far as to eat up 120gb, I went in first 40 - 80 and finally 120

[fathom pendant]

and you went through the install process for the OS before running the commands

[lime night]

yup

[fathom pendant]

so when you boot up it asks you to log in to your user/password you set up?

just making sure

because currently running parrotOS in a VM @ 80 just fine myself

[lime night]

Actually, no I set up a password but it doesn't ask me to log in

[fathom pendant]

did you unmount the install ISO after the install step?

[lime night]

Unmount? 😮 Didn't see anything instruction about that

[latent meteor]

Hello, the PtH academy module targets are not spawning..been waiting for almost 20 mins for them to spawn. Any help? Thanks

[fathom pendant]

yep

[fathom pendant]

Refresh the page

[latent meteor]

Did that

Quite a few times.. -.-'

[pseudo kiln]

change the vpn location, sometimes that does the trick for me

[lime night]

How does the unmounting work? Seeing as there is no instrution at all for it.. :/

Is it the boot loader location? Switching that from the Master Boot Record of VBOX HARDDISK into the System Partion?

[fathom pendant]

basically you want it to prioritize the hard disk

but you can just click on devices --> optical drives --> the iso

[latent meteor]

Thanks it worked

[lime night]

Thanks for the help, I have it figured out now and it works like it's supposed to 🙂

[lime night]

Running into my next problem though, as I try to do the "Cat tools.list" command, it just tells me. "No such file or directory"

Do you have an idea of what is wrong this time?, tried to run the previous command again but nothing extra happened

[fathom pendant]

because there is no tools.list file on your system

:)

it's that simple

you need to create that file in order for it to be found

[lime night]

I'm just wondering if I don't understand the module "Setting Up" at all then, since they there imply that the file already exists if you follow the the module

[plucky hollow]

i cant add time to my target ip

[candid night]

Coming back to work on the modules after 3 weeks of PTO feels like 🫠

[plucky hollow]

@west rampart

[fathom pendant]

the target is a publicip:port isn't it?

not a 10.129.x.x target

[plucky hollow]

yes is publicip:port

[fathom pendant]

then no; you can't extend the timer

it's a slight limitation of it being a containerized instance

2 hours should be more than enough tbh

[plucky hollow]

That's exactly what I was saying, I was recommending that they add a way but this guy came to tell me that it already existed

[fathom pendant]

because the assumption was for the vpn academy targets

again it was a miscommunication of intent

[plucky hollow]

sorry, what means tbh?

[fathom pendant]

<to be honest>

[plucky hollow]

ohh ok

[fathom pendant]

or if it's tbqh <to be quite honest>

[plucky hollow]

ok

thank you

[formal mantle]

hello

[rustic sage]

ts is crazy tbh idrk how he didn't know that

[storm elk]

Hello

[fathom pendant]

¯_(ツ)_/¯

[unique peak]

Here is the question? By examining the logs located in the "C:\Logs\DLLHijack" directory, determine the process responsible for executing a DLL hijacking attack. Enter the process name as your answer. Answer format: _.exe.

Hello, I’ve been trying to go through the questions here and I just can’t figure them out. I went through all the modules prior quite easily and haven’t been able to figure out the first question even for the “C:\Logs\DLLHijack” question. I know to filter events by ID 7 but from there I’m struggling on what to do, I’ve been trying to manually go through the logs but it’s been very time consuming. Any tricks or tips would be greatly appreciated. Thank You!! Windows event logs and finding evil skills assessment.

[fathom pendant]

are you loading the logs from that directory?

[shut vapor]

sounds totally legit 🤨

[pseudo kiln]

Question regarding AD Enumeration and Attacks, Cross-Forests trusts. The author mentions that if we own domain user that can authenticate to the trusting domain, we may able to kerberoast across forest trust. Question is, how can we enumerate which users from trusted domain A can authenticate to trusting domain B ? Maybe I missed it, but I have not seen it the module

Or maybe simply having an inbound/bidirectional trust with the trusting domain is enough for any account in the trusted domain to authenticate to the trusting domain ?

[young flume]

hey team, is someone knows how to delete a operators in sliver?

[fathom pendant]

<@&861185840277487616>

[fathom pendant]

generally bloodhound can sniff it out

[alpine ingot]

hey can someone help me out with this backup.vhd thing on the password attacks hard lab.
I have tried to use the bitlocker2john on it but it is not converting, it keeps turning into a txt file with no signatures

Im actually so lost rn

[fathom pendant]

it shouldn't be converting the file itself to anything

when you throw the hash into john does it error?

or are you making an assumption that it's not working

[alpine ingot]

i tried mounting it and i cant figure out the mounting, for some reason it doesnt think that the /dev/nbd0 exists

Its not even creating the hash

[fathom pendant]

did you ensure that it exists?

it could be an older version of bitlocker2john that requires python2

[alpine ingot]

Yeah, i used fstab -l and it was there, but its not getting picked up when i try to do anything with it

[fathom pendant]

bitlocker2john requires the -i parameter

[alpine ingot]

im trying to show you what im doing but it keeps getting removed, i will just type it out:
bitlocker2john -i Backup.vhd > bitlock.txt
Error while extracting data: No signature found!

cat bitlock.txt
Encrypted device Backup.vhd opened, size 8MB

[fathom pendant]

literally just did it myself and it worked just fine

[alpine ingot]

yeah, i know its not a problem with the syntax

[fathom pendant]

md5sum Backup.vhd 
271bd3a710ae92848c22a6c719b513f9  Backup.vhd

^ checksum

[alpine ingot]

ohhh

i see the problem c5a1274fb98a216feb283ad526592b21 Backup.vhd

[fathom pendant]

:) potentially a corrupt download

[alpine ingot]

it keeps getting corrupt lmao. I downloaded it like 3 different times

[fathom pendant]

what method?

[alpine ingot]

smbclient mget

[fathom pendant]

use a different method

lol

iirc i used an http upload server

[alpine ingot]

ok 😢

[fathom pendant]

you can also mount a local share onto an rdp session with xfreerdp /drive:

but smbclient has been known to be wonky with it

[alpine ingot]

I did that to get the keepass thingy, i should have stuck to it with the vhd transfer

[fathom pendant]

also

Get-Filehash -Algorithm MD5 C:\Path\to\File

just to be sure that for whatever reason mine isn't different from yours

i don't recall if i messed with it or not

[fathom pendant]

powershell*

[alpine ingot]

heres a previous message of this

[fathom pendant]

ye

ls -lah btw will show the file size in human readable context

instead of 1313131313

[wanton ore]

I'm currently in the vulnerability assessment module the CVSS section.
Can someone explain to me what's the difference between the CIA impact in the modified base metric and the CIA requirements?

[fathom pendant]

Does the vuln affect any of the Triad is the short answer

Modified Base Metrics is just a fancy way of saying "where you are at the start" vs what's expected

[wanton ore]

ok, but why did they add the CIA requirements if we have the CIA impact?

[fathom pendant]

Requirements = What's required to be there
Impact = what's actually impacted

what specific section, don't recall a CVSS section

[wanton ore]

oh, thanks you made it easy for me.

[fathom pendant]

btw

it's EXPLAINED IN THE READING

[alpine ingot]

I think i found the problem, i kept cutting the download off before it finished. My dumbass realized this when i saw the hash changing every 5 seconds 😂

[fathom pendant]

The Modified Base metrics represent the metrics that can be altered if the affected organization deems a more significant risk in Confidentiality, Integrity, and Availability to their organization. The values associated with this metric are Not Defined, High, Medium, and Low.

The Environmental metric group represents the significance of the vulnerability of an organization, taking into account the CIA triad.

😄

[alpine ingot]

271bd3a710ae92848c22a6c719b513f9 Backup.vhd
Mucho better

[fathom pendant]

GL you're on the final hurdle :D

[alpine ingot]

thank you for your help

[wanton ore]

which reading?

[fathom pendant]

of that section

literally under the subheading "Environmental Metric group"

that's where I pulled that text from

Each of the Metric Groups has their own subheading which explains them :))))))))))))))))))))

[wanton ore]

here?

[hallow sentinel]

Has the option to download the .ovpn for modules academy been removed? I'm probably missing something painfully obvious but I cant find it anymore.

[fathom pendant]

yes lol

[naive sage]

https://academy.hackthebox.com/vpn

[fathom pendant]

if it's a publicip:port for the question, it's not required

only sections that require the vpn to connect to the target will have the vpn download option

[hallow sentinel]

Ah thank you. I knew it would be something plainly obvious like that. Cheers folks

[foggy monolith]

Who else is literally needing to use while [ $? -ne 0 ]; do xfreerdp /<SNIP>; done to force PwnBox to work properly re "Shells & Payloads > Reverse Shells"?

[fathom pendant]

that's extremely unnecessary

lol

if it's dropping; just add /timeout:900000

[grand loom]

any tips or command to speed up rdp vm

[fathom pendant]

cry

[grand loom]

[fathom pendant]

generally it's not that the rdp machines are slow; it's that your connection is shit

use the tcp vpn download

[grand loom]

i use openvpn

[fathom pendant]

yes

there is a button

to download a tcp connection

instead of udp

[grand loom]

yeah i use tcp

[fathom pendant]

ok

then try other regions

¯_(ツ)_/¯

[grand loom]

there was a module about make the sceen less clear therefore making it faster

[fathom pendant]

eh

[grand loom]

idk i forgot about it

[fathom pendant]

it depends on the root cause of the issue

[grand loom]

oh well

life ig

is the exam machines faster

[plucky hollow]

please help me im stuck

After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail].

Information Gathering - Web Edition

Page 19
Skills Assessment

I've already tried with spiderfoot, with scrapy and with reconspider and nothing

[novel lynx]

also need help. I'm in the password attacks module Attacking Active Directory & NTDS.dit, and i don't know where to find the fasttrack.txt file, is it supposed to be on git? i tried both and they didn't work

[plucky hollow]

When I scan with Reconspider I don't get any information, it tells me that no page has been scanned.

[cinder monolith]

guys help i was on internet and i got a virus installed without my consent(.msi file) but i didnt executed or opened it i just deleted after it was installed,is my pc safe?

[plucky hollow]

It depends, the virus could have planted persistence

[plucky hollow]

Even with the fact that it was installed on your computer, it could have already collected all your data.

[cinder monolith]

but like it just went into download folder,i didnt executed or gave him admin permission i just deleted it

it downloaded from those scam pop ups while i was trying to download smthing

[novel lynx]

i feel like this question should be posted in #general or somewhere else

[storm elk]

You’re right.

[storm elk]

We can’t really help you in this channel as it’s for help with Academy content. My suggestion would be to run a virus scan

[cinder monolith]

ok thanks

[plucky hollow]

please help me

[novel lynx]

bump

[storm elk]

I’m sorry, not at my computer do can’t check my notes

[pallid spindle]

hi, i need help. i am currently doing "Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.". I came up with a command curl https://www.inlanefreight.com | tr " " “\n” | cut -d"‘" -f2 | cut -d’"’ -f2 | grep www.inlanefreight.com | sort -u | wc -l but its not working. only thing i get in result is this ">" sign

[cerulean grail]

Does anyonne know why I keep getting this error in the hard Footprinting lab? Just trying to normally see the databases and it either returns an error or just shows me nothing

[pallid spindle]

okay got it somehow

[storm elk]

@plucky hollow can I dm you?

[plucky hollow]

yes

[storm elk]

Cool. Check your dm

[fathom pendant]

Because your syntax isn't correct you're leaving an open '

In your cut -d "'" with cut -down "\'"

You need to escape that quote

[novel lynx]

if someone could help with mine it would be greatly appreciated, currently banging my head against a wall trying to figure out where this fasttrack.txt wordlist is supposed to be

[fathom pendant]

Module?

find / -name "fasttrack.txt"

Or locate fasttrack.txt

Might be under SecLists

[novel lynx]

Attacking Active Directory & NTDS.dit

Password Attacks

[fathom pendant]

.

I'm assuming pwnbox?

[novel lynx]

yes, i do not see it anywhere already downloaded

[fathom pendant]

2> /dev/null at the end

They recently updated the pwnbox

So file locations have changed

[fathom pendant]

/usr/share/seclists is the new location of the seclists download

[novel lynx]

let me check

[alpine ingot]

WOHOOO! I am finally done with the password attacks module.

I got severely burnt out on that module.

[fathom pendant]

Check under. /usr/share/wordlists

[storm elk]

Great job

[novel lynx]

i don't see it, maybe i should restart the pwnbox

so i shouldn't have to download anything though right? like it should already by loaded onto the pwnbox?

[fathom pendant]

You might need to download it. Did you run the find command?

find / -name "fasttrack.txt" 2> /dev/null

[jade latch]

try without semicolon and try 'show schemas'

[quasi wave]

can someone give me a hint? I need to establish a shell session with the target OS here for question 5 of assessment for shells and payloads section

[fathom pendant]

Mysql statements need to end with a ;

[quasi wave]

I am thinking of trying to get a PHP shell?

like via file upload no?

[fathom pendant]

What target is that for?

[quasi wave]

blog.inlanefreight.local

[fathom pendant]

You can do it manually, but there's an exploit already available

[jade latch]

i remember that a command didn't require the semicolon, but i may be wrong

[fathom pendant]

See the next question

[novel lynx]

nope not there

[fathom pendant]

So you'll have to download it

¯_(ツ)_/¯

[quasi wave]

what's the exploit already available? I looked at MetaSploit and couldn't find it

[fathom pendant]

Read one of the followup questions about a .rb file

You can just use it

[quasi wave]

ok thanks

[novel lynx]

i've wasted like an hour and half on this, the ones that i have downloaded have not worked

@alpine ingot you just finished this section, did you have any issues finding the fasttrack.txt wordlist?

[jade latch]

if you've downloaded it it's probably something wrong in your methodology

[novel lynx]

how do i know that's it the right list???

[quasi wave]

I tried downloading the .rb file but I end up with this.

I think its because this device is on a private IP?

and not connected to Internet?

[fathom pendant]

https://raw.githubusercontent.com/drtychai/wordlists/master/fasttrack.txt

[fathom pendant]

You don't need to download it you donut

In msfconsole

Just type use 5xxx.rb

[novel lynx]

thank you, i will try and make this work, i've used this one already but i'll start over again and try to see what i'm doing wrong

[quasi wave]

I couldn't identify the exploit in msfconsole. I searched for exploits and didn't see it.

[fathom pendant]

Don't worry about the search part

I'm literally telling you what to do

[pallid spindle]

yea i got it

[quasi wave]

msf6 > use 5xxx.rb
[-] No results from search
[-] Failed to load module: 5xxx

it doesn't have the module

wait got it

never mind I'm an idiot

msf6 > use 50064.rb
[*] Using configured payload php/meterpreter/bind_tcp

I got a meterpreter

ok got flag

[jade latch]

i know you solved it, but over rdp you will need to file transfer with a webserver and wget, or use the rdp file share in xfreerdp

[bold sluice]

Hey

[zealous rune]

hi, struggling a little on the skill assessment for the pivoting module

[cerulean grail]

I had to restart the MySQL connection and it worked guess it was just acting funny

[zealous rune]

I want to enumerate the internal network via the foothold provided (webshell). I decided to go with uploading chisel to the foothold. executing chisel server on the foothold and connecting from my atttack host using chisel in client mode specifying socks proxy option.
Then running proxychains fping -asgq 172.16.0.0/16 not sure traffic is getting across and back

[cerulean grail]

But more importantly - I finally finished the Footprinting module. It was extremely time consuming since I jotted down every little tip and method but it was well worth the effort!

[quasi wave]

I'm now getting host 3's hostname which I don't know what it is and I assume that since normal nmap scans aren't working that I need to review Nmap documentation? Am I wrong?

[zealous rune]

gonna bash away a bit and then use ligolo-ng i guess

[zealous rune]

not sure what u mean

[quasi wave]

I tried a scan including pings which got ignored and tried with the -Pn option and ports are in ignored states

[hasty rune]

Hello

[quasi wave]

should I review nmap to play with the scanning a little? is this kind of thing so I don't forget nmap skills?

[storm elk]

Hi

[zealous rune]

scanning one host?

[quasi wave]

ye

[zealous rune]

yeah u might try fiddling with nmap scan options

-Pn good so it doesn't check if host is up

u scanned for all ports?

[quasi wave]

I scanned default port scan

which I think is the common ports

[zealous rune]

try all ports

[jade latch]

-A should work fine

[zealous rune]

-p-

[shut vapor]

@quasi wave You're on the metasploit module and what host are you trying to nmap?

[quasi wave]

I'm on the shells and payloads module on assessment question 6

[jade latch]

and always do -T5 since you don't care about detection

[quasi wave]

ok

[quasi wave]

on a real engagement don't I care?

[zealous rune]

if anyone has any advice or thoughts on my approach

[shut vapor]

Carry on 👍

[novel lynx]

Thanks so much @fathom pendant finally got it to work, finding the right wordlist often ends up being the biggest time-sucks for me

[jade latch]

probably just do the normal nmap since you don't want to bring down their servers in a real non-evasive engagement

or go lower than T3, i don't know how they work

[zealous rune]

ok different question... is there any point in bashing around with chisel and prrrrrroxychains when we ccccan just use ligolo-ng... i get the tunneling via dns or icmp, but ligolo-ng just seems far superior to other tools

[jade latch]

stick with ligolo

[zealous rune]

unless we doing living off the land e.g. ssh port forwarding and we dont want to upload stuff to the foothold

[marsh echo]

Hello how do you enumerate the subnet of the 2nd network card if you don't have access to the machine? I don't know if it's possible through the webshell provided, but my advice is to find a way of accessing the machine (for example, identification information in a file or a private ssh key), then you can connect using proxychains and use your tools to pass the flow on to the other network.

[zealous rune]

i do have access to the machine via the webshell

i'm uploading chisel and trying to forward traffic through chisel running as a server on the foothold

in theory it should forward traffic on to any networks in knows about

it's not wokring for me so I'm moving on to using ligolo-ng which is a bit more intuitive and is effectively a straight netwwwork layer vpn

similar to the openvpn except it uses userland network stttttttttttack

[jade latch]

did you verify with ipconfig/ifconfig that that is the right network? i only remember ever needing /24

[zealous rune]

yeah it's the right network

it's a /16 according to the network card

ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.5.15 netmask 255.255.0.0 broadcast 172.16.255.255

[jade latch]

maybe try the same fping command with 172.16.5.0/24

[zealous rune]

mmm

i actually tried just ping the 172.16.5.15 address from my machine via proxychains also no good

[marsh echo]

my advice is to find the ssh key on the web shell and connect with Dynamic ssh -D port forwarding of course with proxychains and then ping sweep to find the other ip and enumerate its port and connect according to the protocol found.

[zealous rune]

i think the forwarding is not work

[jade latch]

well that interface is only open to the internal network, so it is correct

[zealous rune]

@marsh echo thankssssssssssssss i'll try that

[marsh echo]

he work for me

[zealous rune]

yeah but if i run proxychains ping 172.16.5.15 and chisel is doing it's job i expect it to towrk

but it might be that ICMP doesn't get forwarded

and it's tcp layer that will work

[marsh echo]

well, dynamic port forwarding is on your attacking machine, not on the webshell 🙂

[zealous rune]

yes i understand

i think icmp doesn't get forwarded across the socks proxy provided by chisel

but good idea to use the ssh dynampic port forwarding no need to upload any tools

[marsh echo]

if I understand correctly, you managed to transfer chisel client to the target via webshell without even having access to the remote machine without ssh?

[zealous rune]

yes

i just ran an http server on my attack host

and wget from webshell

but i have ssh access as well

no issue

[quasi wave]

Nmap scan report for 172.6.1.13
Host is up.
All 10001 scanned ports on 172.6.1.13 are in ignored states.
Not shown: 10001 filtered tcp ports (no-response)

[fathom pendant]

God the Exploiting Thick Clients section was like pulling teeth with how unintuitive/poorly explained things were

[zealous rune]

although ligolo-ng is still a superior solution given that with proxychains you can't forward partial connections thru the socks tunnel

[fathom pendant]

because -Pn doesn't necessarily mean the host is up

could very well be that you sent blanks to a server that wasn't even talking

[fathom pendant]

oh

found your typo btw

it's 172.16.1.13

172.6.1.13 is a public IP

[zealous rune]

thick clients. which module is that by the way?

[fathom pendant]

:)

[fathom pendant]

Attacking Common Applications

[zealous rune]

hmm

[fathom pendant]

while the section is a guide. holy shit it was pulling teeth to actually get it right

[marsh echo]

ah yes, you're definitely going to make me want to do it again! 🤣

[fathom pendant]

there are things that aren't intuitive to know

[zealous rune]

ah u a few modules ahead of me

[fathom pendant]

like recompiling at different stages

:))))))))

https://tenor.com/view/lost-my-marbles-gif-10902317

[zealous rune]

lolol

[marsh echo]

it's not a race, my friend, the goal is to succeed in different ways in order to fully understand. pivoting was hard for me.

[fathom pendant]

https://tenor.com/view/ahead-of-you-gif-18442352

[marsh echo]

me to it was really hard for me

[zealous rune]

indeed

[fathom pendant]

it wasn't so much hard

[zealous rune]

u r right

[fathom pendant]

as it was deciphering what was actually right/wanted from the module

vs what was being presented as just info

[zealous rune]

but pivoting i felt was finnnnnnnne, just that the doubleeee pivot section coullllld have been written better

and the whole module could benefit from some good network diagrams

[marsh echo]

i agree

[fathom pendant]

like there was a whole bit about downloading the server to check the source code of it which i understand for the specific vuln but then it refers to editing Users.java ... which is both in the SERVER and CLIENT decompiled sources

it wasn't until it came to recompiling that i saw they used client and not server

[foggy monolith]

Just curious so I know how much of a rabbit hole this is when I come to it, how effective would nc -ulnvp 53 be on any of this?

[marsh echo]

Do you talk well with the chisel tool? yes it’s true that at the beginning it was not three clear understood or had to ask the client or the server but after fortunately that the schema in images have helped me, I do not know for you but for me its the case

[fathom pendant]

never used chisel

¯_(ツ)_/¯

i was referring to the common apps module

and the section i was working on

[zealous rune]

i used chisel

[marsh echo]

ahhhhhhhh

[zealous rune]

part of the issue with chisel and proxychains

[marsh echo]

my bad

[fathom pendant]

chisel doesn't like sending icmp traffic

[zealous rune]

is that the traffic being tunneled is at a higher level of the nework stack

[fathom pendant]

once i found ligolo, i stuck with that

[zealous rune]

therefore icmp won't get forwarded

[fathom pendant]

it depends

as with anything you learn

[zealous rune]

ligolo-ng is superior because it creates a network layer vpn using tls

so for applications it's literally just transparent

[marsh echo]

ligolo is cool but I don’t think you need it for the it’s better to do things manually

[fathom pendant]

??

[zealous rune]

well u r doing it manually

[fathom pendant]

ligolo works far better than most of the other showcased tools, and you do have to do things manually with ligolo

[zealous rune]

it's just having annnnnnn understanding of the limitatioooooooooons and strenghts of the different tools available

[fathom pendant]

unless you're a gigachad and automated the setup and teardown of ligolo

[zealous rune]

keep hearing gigachad yet to understand what this tool is used for

[marsh echo]

Are we talking about the skill assessment of pivoting? because I didn’t use ligolo-ng to find the flag

[fathom pendant]

you can use whatever pivoting tool you want to find the flag

there's no check saying you have to use xyz pivot tool

[zealous rune]

you can use chisel and proxychains. but it gives u less visibility of the internal network. cos you will have to do a blind nmap. with ligolo-ng. i can do an enumeration ofhosts theeen do a precise nmap on hosts found

i mean enumeration of live hosts using ping

u can't do that using proxychains and chisel

or ssh dynamic ports and chisel

[fathom pendant]

you don't need to do a blind nmap

just do a ping sweep from the machine

using a for loop

[zealous rune]

true

[marsh echo]

ah yess Why did I say it? because a friend having to pass dante made me ennormement of praise but he told me for the skill assessement it is better to use the tools of the course

[fathom pendant]

eh

for certain cases that's true

however if there's a better/more efficient tool out there then use that

[zealous rune]

the bash for loop if i set time out for 1second will take roughtly 18 hours to ping all hosts on a /16

[fathom pendant]

ligolo makes use of some fundamental knowledge of port-forwarding and such if you're looking to do any kind of multi-pivot scenario

[fathom pendant]

just do a /24

[marsh echo]

with a sweep ping learned in court I can find the ip I want according to network but yes I see what you mean

[fathom pendant]

but with ligolo, if you're connected to a host, you can just fping <internal ip>/cidr -g

[zealous rune]

exactly

[fathom pendant]

no need for messy loop syntaxing

[marsh echo]

yes you’re right

[zealous rune]

which is whhhhhhy i think ligolo-ng is superior

[fathom pendant]

and; no proxychains

[zealous rune]

of course i can parallelize the for loop some

but then fork of death

[zealous rune]

this is the best

[fathom pendant]

https://tenor.com/view/deal-damn-good-deal-good-deal-id-make-that-deal-gif-27676387

[marsh echo]

well you’re right I’ll test it ligolo 😈

Too bad it is not evoque in the yard ...

[fathom pendant]

ntm you don't need any fancy admin permissions or other client software (like Proxifier)

[marsh echo]

ntm = not to much rigth ?

[fathom pendant]

not to mention

[zealous rune]

indeed

supercool that u can pivot without having root on the foothold

[marsh echo]

ah ok thx 😅 I don't know all the English shortcuts

[fathom pendant]

super fun :D

[wispy spruce]

My favorite part of this Linux Fundamentals module is how the module teaches you so much about how to use and navigate nano, but for vim basically all you get is how to open the file and how to quit.

I agree with whoever wrote this. The only important thing to know about vim is how to quit.

[marsh echo]

vim great love story lol

[zealous rune]

lolol

[fathom pendant]

vim is my goto quick file editor

¯_(ツ)_/¯

[wispy spruce]

more power to you if your brain works that way

[fathom pendant]

anything for bigger stuff i might use pluma or vscode

it's literally not that hard

¯_(ツ)_/¯

[esc]x20 ":wq"

[viscid horizon]

I have question about pro lab

Can someone help what they ared

I need help with these

[fathom pendant]

for the 100th time

read and follow #welcome

then create a post in #1263635449335910531

https://tenor.com/view/spongebob-how-many-times-do-we-need-to-teach-you-old-man-slow-thick-gif-12272188

[zealous rune]

does each module have an aassoicated cube cost ? if so where do i find the cost in cubes for a module

i can see the cost iiiin cubes for the whole pentester path but not for individual modules

[fathom pendant]

cost is by tier

[fathom pendant]

https://help.hackthebox.com/en/articles/5272936-introduction-to-htb-academy

[zealous rune]

thx

[jade latch]

i use vim and all i know are 5 functions

[viral snow]

Hi y'all! I'm in Password Attacks, Network Services.

I'm at the last question, "Find the user for SMB service..."

Well I'm in SMB, I tried to ls, but nothing is pulling up. All I'm getting is NT_STATUS_NO_SUCH_FILE listing *

Any help?

[fathom pendant]

For those getting a blank output for egrep -r ^transf /usr/share/wordlists/ | sed 's/^[^:]*://' > /tmp/list.txt in IIS tilde enumeration for the Attacking Common Applications module, just add a * to the egrep command ; egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt

[fathom pendant]

wdym you're in SMB but don't know the user?

i don't recall there being a null session for this

what was your command to connect?

[viral snow]

smbclient \\<target ip>\IPC$

I then entered the password

smb: > ls

Then after that I get the aforementioned error message.