modules

[sacred jacinth]

Well if breaking out of the parameters is possible you wouldn't want to worry about the parameters anymore, as there is smth else you could possibly achieve

[vocal bridge]

ah right

lemme try smth

[sly trench]

So I'm reading the question very very carefully, it's telling me to create a reverse shell on the machine I'm rdp'd in from dc01?

Because it's saying to create a reverse shell to the machine I'm connected via rdp

Im connected through rdp to ms01

Uh I don't get it

Like the question I don't understand what it's asking me

[sacred jacinth]

+1

[ocean night]

If it's command injection, please stop posting potential spoilers

[sacred jacinth]

Oh its command injection

[ocean night]

If someone wants to reach out to discuss, then do so through DM, but no spoilers for modules over Tier 0.

(not reach out to me, but if someone wants to reach out to them)

[sly trench]

Password attacks- pass the hash

[ocean night]

Sorry, I wasn't responding to you

[sly trench]

Did you do that module

[ocean night]

I cannot provide advice regarding modules over tier 0

[sly trench]

Why?

?

[ocean night]

?

[sly trench]

Aight don't answer me

[ocean night]

I'm HTB staff, I can't share information regarding paid modules

Also, please check the pinned comment here regarding asking questions about modules / sections.

[safe star]

The rdp machine has an internal network with other machines in it. Ur supposed to get a reverse shell on the dc, which u can only get from the rdp machine

[vocal bridge]

wdym +1?

[sacred jacinth]

Just check your dms, you were posting spoilers

[lunar torrent]

Like @marsh echo says use sudo and without 4. E.G.

sudo proxychains nmap

I do not understand why the training material (Dynamic Port Forwarding with SSH and SOCKS Tunneling) does not say to use 'sudo'. I wasted hours, again.

[vocal bridge]

alr srry

[sly trench]

The only thing with dc01 that I've done is dir \dc01\julio

But even if only ms01 can connect back to dc01 idk how to execute nc.exe in dc01

[quasi wave]

for the password reuse/default passwords section of password attacks, I can't get permissions to the shadow file unless I can become root user no? I found some ssh keys in one of the other users' folders. Do I need to crack those? Or would it be better for me to look up what folder MySQL login creds are stored in? Don't give me the answer I just want to know what direction I need to go in so I can google the rest.

[safe star]

nc isnt needed to send a connection back

all u need to do is listen on the rdp machine with nc and wmiexec will do the rest

[gray yacht]

I don't remember that one exactly, but maybe look for something similar to that file.

I can check my notes in a few.

[quasi wave]

yes that would be great. a hint in the right direction without giving away the answer would be very much appreciated

[gray yacht]

Oh wait, if you're in pw Reuse and default maybe try that? Try pwds you already have and known default? Again not at my computer.

[safe star]

dm me the creds

[ocean night]

Sorry, but spoilers

Please don't post such information for modules over Tier 0

Glad you got it though

[quasi wave]

ok so now I am having trouble with the Default passwords / Password Reuse section of password attacks module

my issue is I have this long default creds list and I don't know which one to use

[safe star]

@sly trench it should be the dc hostname

just tried it

[quasi wave]

I figured it out

[oak lance]

I'm still after assistance on this one, if anyone can provide a pointer please?

[shut vapor]

In the Pivoting, Tunneling & Port Forwarding > Assessment, one question asks us to identify a user who is "utilizing services in a way that exposes the user's credentials and the network as a whole". What does this mean? Has a service been setup to run with privileged user credentials?

The screen shot contains the question wording and the output from a LSASS dump. Can someone point out how to identify what the questions is asking for?

or should I be looking elsewhere, maybe, to know when a service is running as a user?

[safe star]

Look more in through the dump

[shut vapor]

I'm not picking up on it. The screen shot above is the only place the user in question appears, but I'm not seeing a difference between this user, the other user, and the computer/object's details.

The clear text password is different, but I'm not connecting that with how you "utilize services". I don't know what that means.

[safe star]

I’m not at my pc rn

Dm me tha password

[shut vapor]

Is it MSSQL? I haven't taken that module yet, but I might suggest stuff covered in the CPTS path's other modules.

To require MSSQL trickery seems like a bit much for a CME module's assessment.

That's a tier 3 though, so a little above my level. 😅
At least I bumped the inquiry.

[ocean night]

Check through the other sections of the module, don't get too focused on one service 🙂 @oak lance

If you find yourself at a dead end, it can help to take a step back and see what else you have in front of you.

[sonic ridge]

I need help with the identifying SSRF module. I tried running ffuf but get a ton of open ports back.

it says to Exploit a SSRF vulnerability to identify an internal web application.

[cloud urchin]

what module?

[sonic ridge]

server-side attacks

[cloud urchin]

ffuf shouldn't return a ton of ports, so i would double check that command against what the module teaches

you used the -fr parameter right?

[sonic ridge]

i actually copy and pasted the command from the module

i kind of did what the module showed

i created a file that has a list from 1-10000 then ran the ffuf command that it used to identify the open ports

[cloud urchin]

if you copied and pasted directly from the module that's why it's not working

[sonic ridge]

well i changed the ip

the address was changed

[cloud urchin]

well its either the target expired and you're not actually hitting it or there's something up with your ffuf command because like i said it shouldn't return a ton of results.

so i'd focus on looking into that.

[sonic ridge]

ok ill go ahead and retry it

[neon bridge]

Umm

I m new

What i m doing here

Can anyone explain?

[cloud urchin]

you want us to explain why you made the decision to join here?

are you ok?

[sly trench]

[sonic ridge]

ok your right i reran it and only a few ports open this time

dont i just connect using the http://ipaddress:port?

[cloud urchin]

i did it by doing what the module showed

[sonic ridge]

awesome that worked

why cant i just connect via http if its a web application?

[cloud urchin]

you can

use burp

[sonic ridge]

yeah i used burp but I mean why cant I just use http:ipaddress:8000

[cloud urchin]

probably because the browser just processes the request like normal

i used curl for the whole thing

[sonic ridge]

it just gives me an unable to connect

didnt try curl tho

[cloud urchin]

you'll probably get a faster response if you just explain your struggle here instead of asking for a dm

[sly trench]

#verify

[fathom pendant]

?

[safe star]

yes

[rose sage]

still in Teir 0 modules. Is this the place to ask for advice or another channel?

[gray yacht]

Yes you can ask questions related to modules here.

I recommend reading the pinned messages first.

[trim frost]

it helps to post the link to it, ask some specific questions

[rose sage]

Just need some advice or just get others experience. Currently in Information Security Foundations and in Linux Fundamentals module setting up VPS with ParrotOS with Vultr but having some issues with what it says is not enough space. Set up a personal VM with more storage to see if that is the problem but it says the same low storage after the apt update and full-upgrade of parrotOS. Is this normal? I would rather run VPS instead of internal VM on network.

I just read pinned. Thanks for the advice. Fairly new to discord and learning as I go.

[fathom pendant]

you don't need to set up a VPS tbh

also i 100% know your problem

you need to first run the installer

after installing it on the VM/VPS you then need to reboot

afterwards you can install to your hearts content

it also depends how much storage you allocated

i use 80GB for my parrot storage on my vm; and haven't run into any issues with storage space

[rose sage]

Ahhh... I see. Well I just destroyed last few VPS so let me rebuild and try this out. I just chose the $12 plan which is very little storage but it is what module recommended.

[fathom pendant]

imo i do more than the suggested

but also

VPS is NOT REQUIRED

i get you would rather do it

and I respect that

but on a personal VM you're always going to be able to access it

rather than relying on the uptime of the server hosting it

[rose sage]

Was just trying to get it so I could have more then one instance per day limit and practice as needed.

I have it on personal VM but read in pinned threads not recommended. Thought VPS would be next best thing but I see what you are saying

[fathom pendant]

????

many people use a personal VM

idk who's saying not recommended

lol

[rose sage]

ltnbob — 12/22/2021 7:55 AM
Keep in mind that if you are connecting to any of HTBs networks from your personal system where you store your personal data there are penetration testers in training on the network. Its strongly advised to use a dedicated VM, computer or Pwnbox when learning with HTB and connecting to our network environments

I know that was a while back but just quickly read pinned and saw that.

[fathom pendant]

ts strongly advised to use a dedicated VM, computer or Pwnbox when learning with HTB and connecting to our network environments

don't see where this is saying not to use a vm?

this is saying not to use your Host System

aka what you use daily

[rose sage]

Ok I think I interpreted that wrong. Thanks for clearing that up. Might just do this route instead then.

Deploying VPS now just to try it out and will be moving back to my dedicated VM.

[fathom pendant]

like using a VPS isn't a bad thing really

but it's not really there for those on a tight budget

[rose sage]

I was updating VPS and VM at same time and the lag on VPS was so bad.

[fathom pendant]

yeah that's the other thing

[rose sage]

took 10mins for VPS and 2 for VM

[fathom pendant]

with VPS you're very much limited to their network and connection

so it's harder to diagnose an issue

in general with security research, such as pentesting, you want to be in control of as many aspects as possible

[rose sage]

I see the pros and cons. Also I was using ParrotOS just because of recommendation but used to Ubuntu and Debian 12. Is that ok to use as well instead of ParrotOS

[fathom pendant]

generally it's better to use an OS that's more oriented towards this type of thing

as they'll generally have the tools or libraries in their repos

[rose sage]

so Parrot or Kali recommendations?

[fathom pendant]

i prefer parrot due to it being more lightweight on launch than Kali as Kali comes bundled with a lot of pre-running services

but it all comes down to preference

¯_(ツ)_/¯

[rose sage]

Perfect.
Anything that helps me learn. Im sure there will be a learning curve involved.

[fathom pendant]

not to mention with distros like Parrot or Kali they'll have some of the more popular tools that are used installed

saving lots of time when it comes to potentially needing to reinstall the OS due to some unforseen accidents/troubles

i.e. somehow your OS bricking yourself after an update but works fine on a fresh install

there was a kernel panic associated with a driver error in parrotOS when upgrading from 5.x to 6.x because for w/e reason it wasn't properly removing it

[rose sage]

oh wow!! I see what you are saying. The easier the better.

[fathom pendant]

whenever something like that happens i backup and transfer my /home/user/* to my host then transfer and unwrap it in the fresh install

[rose sage]

Good to know. I'll take that as some good advice that I will definitely keep in mind for future use.

[fathom pendant]

the other big mclargehuge thing; take notes!

[rose sage]

Im currently taking notes with Notion. It helps quite a bit for me.

[fathom pendant]

i did the AttackingEnterpriseNetworks blind and because i was lazy at some points in my learning path I had to relookup from the relevant pages some tool syntax

i prefer obsidian myself

[rose sage]

Obsidian is new to me. I can look that up as well.

[fathom pendant]

markdown support and plenty of extensions

if it doesn't natively do that: There's a plugin for that

or there's a plugin to do a native function better

[rose sage]

https://tenor.com/view/spongebob-smile-fading-unsmile-smile-and-unsmile-spongebob-meme-gif-21902324

[fathom pendant]

i.e. there's a templater plugin that makes the native template plugin look like a joke

as it allows you to set the filename

and some other fun stuff

[rose sage]

cannot wait until I get to that point

[fathom pendant]

for the most part for notes you don't need templates

[rose sage]

Ok... went through installer and even setup new user via bash and apt update and upgrade with same low storage notification. Reboot system and it sends me to install menu again for a clean install. Weird!!!

Tried to reboot a couple of time with same outcome of clean install option.

[winged osprey]

I am doing the foot-printing module, and am up to the FTP section, I have got the flag, but the first question at the end of this asks for the banner, I am unsure what it wants. the question asks for the whole line, so I tried copying in the whole line. and have tried all the different variations I can think of, but none of them are right. can anyone give me advice on what specifically the question is looking for?

[rose sage]

Use templates only for the ease of organization. Other then that, probably wouldn't need the template

[safe star]

did you remove any trailing spaces?

[winged osprey]

yes

[fathom pendant]

make sure not to include the status code

[winged osprey]

That was my issue, thank you

[fathom pendant]

a lot of services provide a Status Code alongside the delivered message or just before the output of something

[winged osprey]

Thank you for the help

[fathom pendant]

if you want to dive into different status codes you can always google "<Service> Status Codes"

they all follow a general similar structure though

2xx == positive message
3xx == resource moved
4xx == resource error of some form
5xx == server error of some form

some status codes for services even indicate an even more deeper meaning into the second digit

[amber sapphire]

Hello all,
i have been stuck on attacking trust for like 3 days now i can't solve it the question number 2 Gain access to the DC03 (Apexcargo.ad) and submit the contents of the flag located in "C:\Users\Administrator\Desktop\flag.txt" from question 1 i abused acl to get admin on the DC and from DC and DC03 there is forest trust i tried sid history injection but its work can any one done this module help

[fathom pendant]

If there's a forest trust can you not log into the DC03 or are you saying you only have localadministrator on DC01

[fathom pendant]

please don't share any screenshots or spoiler info for modules above tier 0

someone that's done this can likely point you in the right direction though

[cloud urchin]

it would really help if you said what module/section you're on.

[amber sapphire]

im stuck on skill assessment i tried every thing from the course it did not work

[fathom pendant]

i'm not seeing an attacking trust module in the search

[amber sapphire]

Active Directory Trust Attacks

[fathom pendant]

ah

that's why it didn't show up as "Attacking Trusts"

[amber sapphire]

i feel like its a wasted 500 cube

[cloud urchin]

i think it's a good module

i learned a lot

[fathom pendant]

nah looking at the overview it looks promising

[amber sapphire]

me too but the labs setuped for skill assessment so had for learning phase

[fathom pendant]

?

[cloud urchin]

its a challenge for sure

[fathom pendant]

that's how all the modules are set up to provide a learning curve for the skill assessment

so that you are better prepared to tackle it

[amber sapphire]

You finished ?

[cloud urchin]

i haven't done the skill assessment yet or i could give you some advice

[amber sapphire]

the First question its so good

with enumeration you can see the path

[cloud urchin]

i'm sure the method is provided in the module, i'd go through each section again and just try everything that's in the module

[amber sapphire]

i tired all of them

[cloud urchin]

remember sometimes tools like bloodhound/adalanche can't see everything and you just have to manually enumerate, if you didn't do it manually

[amber sapphire]

some of them require python on machine i eliminate them since i cant install python on the dc

[cloud urchin]

well its probably not that then

i can tell you every time i thought there was something wrong with the module or i had to reach outside the module contents to move forward i was wrong

probably don't want to talk about specifics about the skill assessment

[amber sapphire]

i got it

[cloud urchin]

ya sorry maybe someone who did it can provide you some guidance but like i said i haven't done the SA yet

[amber sapphire]

i hope so

[oak lance]

I recommend looking at Ippsec's playlist on using Ansible to automate rebuilding a Parrot install https://www.youtube.com/playlist?list=PLidcsTyj9JXJVIFqyHBHzrRYKPpZYFjM8

[fathom pendant]

you're assuming i care about that kind of thing

it doesn't happen often enough for me to need to automate it

[oak lance]

I am. It's also just throwing it in here if anyone else was interested in building machines. I think he says that he builds new for every client but I'm yet to do this for work, so I'm not yet worried about leaking info between clients.

[fathom pendant]

well yeah for client -- client basis you want a clean machine

as some clients may want an exported image of your machine

[uncut ocean]

thank you broo

 sudo proxychains xfreerdp /v:172.16.5.129 /u:user /p:pass           
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:9090  ...  172.16.5.129:3389 <--socket error or timeout!
[10:30:33:158] [10308:10310] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[10:30:33:159] [10308:10310] [ERROR][com.freerdp.core] - failed to connect to 172.16.5.129

here why its not running but??

anyone face same problem in Dynamic Port Forwarding with SSH and SOCKS Tunneling

?

[solid wadi]

whats the proxy chains config?

i mean, the line where you specify the socks connection

like socks5 127.0.0.1 9050

[vagrant sentinel]

Hey guys

[solid wadi]

hey

[solid wadi]

hey, still need help?

[uncut ocean]

9090

[uncut ocean]

ya bro its not running

[ocean night]

That's illegal Vasy.

You will not get help for that here, and please stop asking.

[solid wadi]

whats your SSH command?

[ocean night]

Read #rules

[vagrant sentinel]

Okayyy

[uncut ocean]

ssh -D 9090 ubuntu@10.129.145.208

[solid wadi]

you trying to pivot through SSH?

[uncut ocean]

yes

[solid wadi]

the ssh command is wrong

[uncut ocean]

Dynamic Port Forwarding with SSH and SOCKS Tunneling this module

[uncut ocean]

its given in the theory part

[solid wadi]

it is?

lemme check, i dont remember that

[ocean night]

@vagrant sentinel instead of trying to cheat your way around what went wrong, speak to your tutor.

[solid wadi]

sometimes the only payload we need is a chocolate and an apology

[vagrant sentinel]

Hahaha

[solid wadi]

damn ur right, then i dunno, but try using -L

[uncut ocean]

as you can see nmap is working

[uncut ocean]

bro thats for port forwarding and i am doing pivot

[solid wadi]

i gotta redo the module damn

[solid wadi]

anyways, try connecting with netcat first

check if the remote port is open, just to discard possibilities

[uncut ocean]

everything working expect this xfreerdp command

[solid wadi]

oh wait

[solid wadi]

does the nmap shows port 3389 as open?

[uncut ocean]

sudo proxychains nc -vz 172.16.5.129 3389

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:9090  ...  172.16.5.129:3389 <--socket error or timeout!
172.16.5.129 [172.16.5.129] 3389 (ms-wbt-server) : Connection refused```

[autumn pilot]

you have the wrong ip

[uncut ocean]

sudo proxychains nc -vz 172.16.5.129 80  

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:9090  ...  172.16.5.129:80  ...  OK
172.16.5.129 [172.16.5.129] 80 (http) open : Operation now in progress```

[safe star]

is that the skill assessment?

[uncut ocean]

?? 80 is showing open

[uncut ocean]

yes

[autumn pilot]

read the question again and you will find the correct ip for the rdp session

[safe star]

yeah rdp didnt work for me either, i just used winrm

[safe star]

unless i did something wrong

[autumn pilot]

take a 2-3 minute pause and try again

[solid wadi]

xfreerdp tries to connect to the remote windows machine through port 3389 but its closed, try restarting your target

[uncut ocean]

its been 2 days

[solid wadi]

dayum

[uncut ocean]

i did bro

[safe star]

the 3 times i did it rdp didnt work eitther

[autumn pilot]

again, read the question

nothing wrong with the target, there is no need to speculate what he needs to do and if the target is broken

[uncut ocean]

Apply the concepts taught in this section to pivot to the internal network and use RDP (credentials: victor:pass@123) to take control of the Windows target on 172.16.5.19. Submit the contents of Flag.txt located on the Desktop.

[hollow ibex]

the ip you are trying is wrong

[fathom pendant]

.19...

[solid wadi]

no way

[fathom pendant]

typo

[uncut ocean]

bruh ?? but the ip showing in ifconfig is other

[fathom pendant]

the .129 is likely the internal IP of the host you ssh into

[fathom pendant]

that's the ifconfig of the host you are going into

it's another NIC that allows access to the internal network

which 172.16.5.19 is on

[autumn pilot]

you can revisit the networking module

[safe star]

wait why didnt rdp work for me tho 😭

[fathom pendant]

yes; systems can have multiple NICs/Network Interfaces

[fathom pendant]

did you also try rdp to .129?

¯_(ツ)_/¯

[safe star]

is that the pivot host ip?

[fathom pendant]

yes

the .129 is the pivot host internal ip on the 172.16.4.0/23 network

[solid wadi]

@uncut ocean did you manage to do it?

[safe star]

nah i excluded that ip from the info i got

weird

[fathom pendant]

¯_(ツ)_/¯

proxychains just sucks overall

[uncut ocean]

but the main idea of this module is to pivot into the another machine internally and we have to check the other ip with ifconfig and here i get that ip and i ping it its working so according to the module i have to rdp into that part bec i am going to pivot that ip which is showing in the ifconfig

[solid wadi]

guys i love this server, i could stay awake all night just for the fun of talking with yall

[fathom pendant]

here you're directly given the internal IP

[autumn pilot]

you got the concept wrong

[fathom pendant]

also the ifconfig is NOT showing another host on the system

it gives insight onto other networks the host potentially has access to

[safe star]

gotta ping sweep

[autumn pilot]

my advice would be to revisit the networking module and the first sections of the pivoting module

[fathom pendant]

in this case the ip is directly given, but yes ping sweep

[uncut ocean]

okk i am going to check this first

[fathom pendant]

it's 1000x better if you can use a pivoting tool that allows ICMP; because then you can use fping

[uncut ocean]

what is the command of timeout in rdp??

[autumn pilot]

xfreerdp --help

[fathom pendant]

/timout:

[uncut ocean]

Thankyou guys for clearing my doubts

[fathom pendant]

reading is the key to success

[solid wadi]

how to lockpick success

[uncut ocean]

ya but like in real world scenerio i get into host and i have to move further so how can i check that which host can the compromised system can communicate to pivot?

[autumn pilot]

¯_(ツ)_/¯

[solid wadi]

pinging i think

[fathom pendant]

I believe the module provides a ping sweep command

which varies on host

but the general format is just supplying a loop command that loops through 1..255 and sends a single ping and looks for a response using the shell language's command that can do that

[autumn pilot]

let him read and finish the module and he will understand, don't push him 10 steps forward

[fathom pendant]

i.e. findstr/select-string/grep

[uncut ocean]

okay a bash script to ping a subnet

[fathom pendant]

it's not required for this question

just focus on what's given to you first

[solid wadi]

local enumeration for config files containing other ips is also a possibility, since sometimes firewalls block ping requests

[fathom pendant]

that's beyond the scope of the module

[solid wadi]

stills good to know

[fathom pendant]

either way

beyond the scope

and let's not muddy the waters

[solid wadi]

alr

[fathom pendant]

what's important to answer the question is directly told by the question

[unique ether]

Another day

[clear wharf]

Hey

[storm elk]

Hi

[clear wharf]

Hey
Wht is this server Abt
Can anyone tell me ? I’m new here

[storm elk]

www.hackthebox.com

[clear wharf]

What’s that ?

[uncut ocean]

[echo pilot]

hey i need help with with finding the path to mail in a htb workshop

when i try the "mail" command it cannot be found

how do i fix this?

[autumn pilot]

from which module and section is that?

[echo pilot]

module 18 section 70

in linux fundimentals

[autumn pilot]

check the environment variables of the user

[echo pilot]

thank you

[marsh echo]

🌞

[unique ether]

Going to bed

🗣

[odd olive]

hey, i have issue on module 23 section 252 for the "Try to use a different technique to gain RCE and read the flag at / "

[marsh echo]

I've been up for 1 hour ahaha

[fathom pendant]

it helps if you use the actual module and section name

[odd olive]

its File Inclusion at section Log Poisoning

i follow all the command for this question but i dont have result

[unique ether]

I stopped being a .... and went to gym but I'm going to bed after this its getting late

[marsh echo]

You're right, physical activity is important for the body (even though I haven't done anything for 6 months now because of the CPTS ).

[limber surge]

could someone guide me with xss skill assessment. i go the [200] GET /myscript.js followed by a closing.

i incldue the script in the comment and the website textbox

[marsh echo]

in the language parameter you target this file ? /var/log/apache2/access.log

[marsh echo]

do you replay the request in Repeater and do you attack the user agent?

[marsh echo]

to see the result you need to reset the user Agent inital Mozilla/ ....

[marsh echo]

I advise you to create a php server and to put an xss in all the fields with the name of the field to know which is the vulnerable field.

"><script src=YOURSERVER:PORT/name_field</script>

[tiny brook]

HELLO WORLD

[smoky snow]

Has anyone here done the dacl2 module ? spn-jacking first question, I feel like I don't understand the question, even read the "answer" provided in the gold annual writeup but it's the same as i did? https://academy.hackthebox.com/module/255/section/2911

[odd olive]

i access it

[odd olive]

yes and after when a go to "access.log?cmd=id" i dont have a result

[safe star]

Wouldn’t it be &

[odd olive]

its same

i have test ? and &

[next bronze]

iirc just find SPNs without without a corresponding computer object

[safe star]

U changed ur user agent too?

[odd olive]

yes

[safe star]

Send another request with the user agent and try again

[smoky snow]

Yup, that's what I found but no variation on the computer name seems to work

[odd olive]

first i send normal request after i send request with payload in user agent and after i send request access.log with command but dont work

[junior helm]

Have you solve it yet?

[safe star]

Are u able to see the logs without the cmd?

[ionic minnow]

Yup, I reset the box and vpn

[next bronze]

hmm I have the name but didn't submit the answer, and it's not working for me either

[odd olive]

yes

[smoky snow]

May I DM you to compare ? 😄

[next bronze]

sure

[safe star]

Dm me a screenshot

[marsh echo]

@limber surge we can exchange here for xss i can give you hints ( i think i gave you an excellent hint ) we are not allowed to exchange private answer information

[marsh echo]

maybe the format and pay attention to the space between id and HTTP/1.1 and as I said don't forget to put the user agent back to normal

[marsh echo]

I put the absolute path of access.log

[empty trout]

hey in the overview module in privesc section . it says if we have shell on a user then we can put our ssh public key in authorized hosts i dont see any use of this bcz we already have access to the user with reverse shell and can upgrade shell then why???

[sacred jacinth]

reverse shells aren't really persistent

we need to trigger the shell, but what if there is a better backdoor?

[empty trout]

yeah but how it helped in privesc

the authorized_key file will not accepts any public key added by another user

[muted kindle]

It will privescc if you could write to root user’s authorised key file

Otherwise it’s to ensure you can login whenever if you lose the shell

[sly field]

guys, I have two question? (Please no hate, I'm a noobie) From Information Security Foundations there is a course called Setting up and under Linux section there is VM Setup, should I also create a VM with ParrotOS? Since we already have a My Workstation with ParrotOS already?

[autumn pilot]

if you would like to have a local vm, then go for it

otherwise you can use the workstation

[sly field]

Thank you!

[dusty spire]

Hello, I managed to do it in two stages. The first stage was to compile on a virtual machine with Ubuntu 2.40 (the same GLIBC version as the pivot machine). Then, I manually installed the missing SSL on the HTB pivot machine. With these two parts, it should give you an idea of how to proceed. 😉

[spring lily]

ok my bad, this is a very good exercise, it forced me to think.

[limpid hemlock]

Hey in the attacking splunk lab they say we need a bat file that will run when the app is deployed and ececute the power shell one line

Ivd modified a .conf file and put in run.ps1 inside it other than that i also modified the powershell script with attavking ip and port now what all do i have to do further

[gray yacht]

That sounds about right. After that it should just be uploading it and catching the shell.

[limpid hemlock]

Ya

I dont understand this echo part where does that go

[gray yacht]

That should all be in your bat file.

[gray yacht]

If you don't understand what that is I would do a little research to understand what it is you are doing, unless it is explained in that section.

[limpid hemlock]

No it isnt that properly explained

I understood up to that part where u out ur payload into that bin file then we modify this config file to make splunk run that payload

But where does this echo command come in that i didnt see there or i didnt understand that part alone

[gray yacht]

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/echo

[timber hatch]

i am at the second windows priv escaltion skill aseesment...and i cannot find the damn left behind cleartext privs....
i used:
Get-ChildItem -Path "C:\Path\To\Search" -Recurse -Include *.config, *.xml, *.txt |
Where-Object { $_.FullName -notmatch 'C:\Windows\' }

[gray yacht]

You can DM what you have done up to this point.

[limpid hemlock]

I uploaded it but shell not recueved in listner

[gray yacht]

Double check your stuff, make sure the machine is still running, and even reset it if you have verified everything is correct and not working.

[limpid hemlock]

The echo command

[limpid hemlock]

where is this enterd

[gray yacht]

Send me a DM

[narrow meadow]

hello, im in "Network Enumeration with Nmap", in "Host Discovery". the question is - " Based on the last result, find out which operating system it belongs to. Submit the name of the operating system as result."?
i tried to read the hint, and still didnt understand, can help me?

[shut vapor]

What is the last paragraph in the reading material discussing?

"identify its system" could be read as "identify its OS"

[empty trout]

when i did the privesc questions and in the second que i executed the command find / -readable i didnt get the /root path in that maybe i cant readanything in /root but i can in .ssh and it didnt show up .

why

[shut vapor]

Can you even do a directory listing in /root/?

[empty trout]

no

is that the reason

[shut vapor]

Yes. So you're saying you can't ls /root/, but you can ls /root/.ssh/ ?

[empty trout]

yeah

[shut vapor]

If so, yes, that's the reason. find is looking at each directory discovered and observing the permissions. If it can't list anything in /root/ it can't know there's a .ssh directory.

it (or you) could only guess what directories are there and hope they not only exist, but you have some kind of permission for them.

[empty trout]

bcz of it i thought of another things to escalate

[frank sun]

hey guys!
https://academy.hackthebox.com/module/158/section/1434

I am following exactly what is being taught in this section but, i cannot browse the ip via proxychains. Am i missing anything or overlooking?

[cloud urchin]

nope i followed the steps and it works so you're probbaly missing something

[frank sun]

i started the server, ssh'ed with -D 9050 and connected via client script, now when I open the ip via proxychains, it won't load at all.

please delete this message if I am giving too much info

proxychains4.cfg - has the 127.1 9050

should I change the file name to proxychains.conf instead?

FYI - I am using my personal machine

[cloud urchin]

no need to change proxychains config file name, just do it like the module says

[frank sun]

I followed exactly and tried atleast 3 times, still no luck on opening the IP

I also tried opening both discoverable IPs (ping-sweep for-loop script)

is the web running on non-default port?

do I have to perform the nmap for the IP?

[shut vapor]

you can try following the instructions exactly in pwnbox for a sanity check. proxychains4.cfg sounds weird, what OS are you using?

[frank sun]

tried resetting the target, tried on pwn box too

[frank sun]

kali with zsh

[austere hazel]

MODULE: Advanced SQL Injections
SECTION: Reading and Writing Files

Could someone tell me what am I supposed to do to get the flag? I already completed the task.

[shut vapor]

I don't know what you're on about with proxychains4.cfg. That's not in the guide at all.

and it's not a kali thing

[frank sun]

I'll try renaming once

[shut vapor]

keep in mind ping won't work through proxychains

[frank sun]

performed ping-sweep scan from jump host (ubuntu)

[shut vapor]

ok, that's cool, but not being able to ping through proxychains threw me off is all I'm saying. full tcp connections only.

[frank sun]

I did not perform any scan, as soon as I discovered the IP (same as shown in the example explanation), browsed through proxychains

[frank sun]

renaming to proxychains.conf worked

[shut vapor]

Weird. I can't imagine how you got a file called proxychains4.cfg. ¯_(ツ)_/¯

[gray yacht]

The file you should be editing is usually found at: /etc/proxychains.conf

[frank sun]

I never touched until this module/section

[dapper moth]

Create a file in that directory and after you do it, access that URL to get the flag

[austere hazel]

Ahh got it! thanks. Was expecting the data in the filesystem 😛

[narrow meadow]

this

[shut vapor]

Yes, and below it is a sentence that suggests you can identify an system [OS] by the TTL.

[narrow meadow]

right

but where i can see the TTL in the pic?

[shut vapor]

On the far right you can see the ttl= field, but the value is obscured by the box's size. You need to scroll.

[narrow meadow]

thx!

[shut vapor]

Is hacking largely about squinting your eyes and scrutinizing indecipherable jibberish in the computer outputs?

Not very hollywood.

[loud socket]

Who said Hollywood was right?

[echo pilot]

how do i find the index number of the sudoers file? I've been stuck on this for 30 min

[stiff bone]

Hello everyone! I'm stuck on Introduction to Windows Evasion Techniques SA1. I have two different but similar developed trojans, I scanned them with both the ThreadCheck tool and YARA with the crime_wannacry.yar and apt 17 rules, and a number of other rules that I found on the Internet for msf and microshell. My trojans are not detected, they were checked for virus total, there were 7 static ML triggers. If anyone has completed this and can advise what the problem is, please write to me in DM, I've been trying to solve this task for a week now

[untold mortar]

I am having an issue with this question Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

[fathom pendant]

man ls and look for the word 'index'

[fathom pendant]

What issue are you having also there's a forum that answers this question if you google, and it explains the commands

[untold mortar]

ok

[viral lotus]

When going through the academy paths how much is it recommended to mix up the structured work with ctf boxes on the htb site? As it drops you into situations that are closer to scenarios we may come across? Was just a thought the last 2 questions in the footprinting imap/pop3 had me stuck for a bit and thought I’d like more scenarios to help understand more

[fierce dock]

Any recommendations for OSINT geolocation tools?

[fathom pendant]

Google

There's an OSINT module but geolocation doesn't sound like a passive OSINT recon

There is a corporate OSINT module though

[viral lotus]

You can do reverse image searches through google which can help get rough locations

[fathom pendant]

exiftool can grab geotagged data if it's embedded in the image

Or data

[viral lotus]

Isn’t that less effective on more recent images/devices?

[fathom pendant]

Well

In general by default a lot of stuff is tagged, and you have to turn it off

[viral lotus]

Oh ok, I remember studying a bit on it a while ago, the amount of info you can get from an image is scary

[fathom pendant]

Even then there are just people who can identify you by the color of grass

Or the tree

Plenty of correlational data

[viral lotus]

Yeah or location of the bin in reference to a door 😂

[fathom pendant]

Have you seen rainbolt's geoguesser games?

[viral lotus]

Yes I have, it’s interestingly fun

I also played a game can’t remember the site but they show you a picture and you have to drop a random pin and closest to it gets the points I played it with my work team

[wet plume]

Hi all!
Please tell me, I'm currently going through the Linux Fundamentals module, and now I'm in the Network Configuration part. I'm trying to Configure SELinux to allow a single user to access a specific network service but deny access to all others. I made 2 SELinux policy modules - one allows a user in the staff_t group to connect to the SSH service, and the user_t and unconfined_t groups cannot connect via ssh. But for some reason all groups can still use SSH. Please tell me where to dig?

[fathom pendant]

You don't have to configure SELinux that's heavily optional

[foggy monolith]

Genuinely curious as to what I'm doing wrong here.

[fathom pendant]

https://linux.die.net/man/8/ssh_selinux

[foggy monolith]

Proxychains refuses to connect RDP (left) through the SSH tunnel (right). Module: Pivoting; Section: Dynamic SSH/SOCKS

Anyone?

[fathom pendant]

Try adding /timeout:9999

Or running proxychains with sudo

[foggy monolith]

Still nothing; trying proxychains with sudo next

[foggy monolith]

error: XDG_RUNTIME_DIR is invalid or not set in the environment.

[fathom pendant]

Ah

¯_(ツ)_/¯

Try with remmina

[foggy monolith]

Not KRDC?

[fathom pendant]

I kinda purged a lot of proxychains info since switching to ligolo-ng

I don't recall having many issues with this

But I believe the question states authenticating to

Not necessarily rdp

Unless I'm misremembering

[pseudo kiln]

could be nothing, but can you access the host via psexec or powershell remoting and check if HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin is set to 1 ?

[fathom pendant]

Well that doesn't sound like the issue tbh

If it was he'd still connect but then be shown the message regarding restricted admin

[pseudo kiln]

yeah I usually get a different error when the registry key is set and I try to rdp with non rid-500 account, but who knows

[foggy monolith]

victor is not the admin on the box, so that wouldn't make a difference.

[pseudo kiln]

it's the other way around, if that registry key is set only built in RID-500 Administrator account can log in via RDP, any other user cannot regardless of their privileges

but it's prob not the issue as marcie said, this concept is later introduced in the AD module IIRC

[fathom pendant]

I believe the question states "authenticate to"

Authentication isn't always rdp

[foggy monolith]

No, it's Apply the concepts taught in this section to pivot to the internal network and use RDP (credentials: victor:pass@123) to take control of the Windows target on 172.16.5.19. Submit the contents of Flag.txt located on the Desktop.

[fathom pendant]

Wait is this the socksoverrdp section?

[foggy monolith]

The ssh -D section.

[fathom pendant]

Weird that it's giving a no route to host error though

Change vpn regions and respawn the target

I suggest reaching out to support

[foggy monolith]

Yes, I know. What's especially weird about this is that using nmap -PR over proxychains was causing the 172.16.5.x IP addresses to resolve to some weird qarestr.sub-172-16-5-*.myvzw.com domains, so it might be an ISP issue since I do use Verizon 5G Home Internet.

[fathom pendant]

Wait

Is your home network a 172.16.x.x network?

[foggy monolith]

No, it's a 192.168.0.x network

[fathom pendant]

So it shouldn't affect anything

Try just restarting your vm

Is your vm in a 172 network?

[foggy monolith]

I'm not using a VM. I'm using Garuda Linux + pacman -S blackarch on a physical host.

[fathom pendant]

Ah

That's beyond my depth

Reach out to support

[foggy monolith]

Going to try this module over PwnBox in the meantime.

[fathom pendant]

G0b isn't support

Reach out to support via the bubble on the page

G0b is actually CTO iirc

[foggy monolith]

Well it works fine in PwnBox. Yeah, not sure what the problem is from my end.

[polar ravine]

Hello guys I’m an soc analyst but I’m really interested in penetration testing can anyone help me in how to start pentesting?

[fathom pendant]

@bright pivot consider filters. But you should be able to figure it out

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[bright pivot]

with fs -900?

[fathom pendant]

Whatever size is most common that you see

[placid edge]

I have the flag for the XPath - Blind Exploitation on injection attacks module but it wont let me submit 😦

can people verify that the flag should be a 33 character length?

[acoustic owl]

The flag should be in the format ||HTB{....}||

[old oasis]

its not

[placid edge]

alr, i found my mistake. Thanks guys!

@old oasis can i dm, or @acoustic owl can i dm?

im struggling to locate the flag if you get what i mean

but i dont want to post my path here

[acoustic owl]

sure

[frosty ferry]

I cant ssh to the server

[fathom pendant]

have you tried asking the server nicely?

[frosty ferry]

ssh: connect to host 10.129.4.64 port 22: No route to host

Shows this error

[frosty ferry]

Yes

[fathom pendant]

no route to host

[frosty ferry]

I am using vm instance

[fathom pendant]

is that the target for the question you're on? you said vm instance, you mean pwnbox?

or your own vm

if your own vm, are you connected to the vpn?

[frosty ferry]

Pwnbox

[frosty ferry]

Yes

I tried connecting from my own vm using vpn it showed the same error i tried pwnbox still shows the same error

[dry cloud]

are you able to ping the machine?

[frosty ferry]

Yep shows host is unreachable

[lyric ingot]

Are there known issues with xfreerdp sessions to windows vms dropping frequently? Sessions are failing after less than five minutes. Very frustrating.

[frosty ferry]

Should i reset the target?

[dry cloud]

well thats why you can't connect to the ssh

[dry cloud]

i dont think that will make any difference, its probably about your connection with the VPN :/

[frosty ferry]

I am getting the same problem in pwnbox too

[dry cloud]

that's odd

[fathom pendant]

use tcp vpn

[fathom pendant]

do you have the vpn running on your host machine/vm?

if so turn that off

[frosty ferry]

Aight

[lyric ingot]

I'm currently using the academy-regular.ovpn file with openvpn to connect. Are you suggesting using a different means of connecting to the vpn?

[fathom pendant]

there's a tcp and udp download option

for the vpn config

[lyric ingot]

Where can I find that? I just followed the link in the course, which doesn't differentiate.

[fathom pendant]

scroll up

where it says "choose vpn location"

[lyric ingot]

...and there it is. Thank you!

[fathom pendant]

rdp and udp aren't a good combo

as rdp generally wants a connection-oriented protocol

[lyric ingot]

Makes sense.

[fathom pendant]

other than that changing the region altogether can also just fix it ™️

[lyric ingot]

Cool. Good data. Thanks again!

Well, just disconnected again.

Might try changing region if it persists.

[raven sentinel]

is pwnbox ever 100% needed?

[fathom pendant]

only in a handful of cases like where it explicitly asks for a path in pwnbox

or where for whatever reason it just works ™️ in pwnbox

[inner juniper]

Hello

[warm wyvern]

a

[clear rover]

the hints should be visible after youve solved it yk, maybe i just wanna know they got to say 😢

[hollow jasper]

Hello

[shut vapor]

refresh the page... hints appear to visible for me when I revisit old modules I've completed.

[dapper moth]

Anyone for a nudge on the RCE part of the Advanced SQL Injections SA?
I got a Python script that executes a query to the DB, which is validated by changing and retrieving some of the data in the DB.
Also tested the RCE in other Section with valid results.

[marsh echo]

someone can refresh my memory please, i can't remember the name of the tool that allows you to generate a list of users from a username for password pulverisation i can't remember which section it was given in the cpts

[shut quest]

Login brute forcing is the module. Username anarchy is the tool.

[marsh echo]

you're a boss thanks man

[clear rover]

ooo thank you sir

[pine dune]

Hi

I'm on skills assessment for shells and payload and having a little trouble enumerating the password and username for the apache tomcat website on host 1

[lucid grotto]

Good days lords hackers , I want to ask is there ways to pause academy subscription have been busy for the pass 2 months I can’t do any module and my subscription is running out is there a way to put a pause on it

[shut quest]

Not that I'm aware of and have never heard of anyone obtaining extensions for their annual sub. Reach out to support on the site.

[pine dune]

anyone have any idea 😅

yea they are check this out

[safe star]

Can’t send spoilers bro

[pine dune]

As u can see I put the credentials the first option and it still didnt work

[pine dune]

do u have any tips

[safe star]

Why did u have a wordlist?

[ocean night]

I'd take it to DM if you want to nudge 🙂

[pine dune]

Its default auxillary scanner

can I dm u @safe star

[safe star]

Ye

[pine dune]

thx

[soft mango]

ill also mention when i use -o flag to output to a file it comes up empty so i had to grep > file.txt to save the output

[pine dune]

sorry, may I dm u as well 😅

[ocean night]

No, sorry - I can't directly advise

T2 module, please don't share screenshots like that Sedan

[soft mango]

okay i blocked the answer out but my bad

[pine dune]

ok could u give me some tips here if possible

[pine dune]

Hi

I'm on skills assessment for shells and payload and having a little trouble enumerating the password and username for the apache tomcat website on host 1. Is it possible I have to change the wordlist?

[acoustic owl]

I completed the module a long time ago, but maybe I can help. You can send me a DM

[pine dune]

thanks

[amber sapphire]

@muted jacinth Hey man can i ask you pls

[unkempt rune]

will do, thanks!

[weak dagger]

Attacking web applications with FUFF:

Parameter fuzzing

Question:Using what you learned in this section, run a parameter fuzzing scan on this page. what is the parameter accepted by this webpage?

I've been trying this for a while but taking too lng could anyone give a hint here
ffuf -w /opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:44121/admin/admin.php?FUZZ=key

[coarse aspen]

Just read the challenge description again, try to understand it and then make researchs on api reponses........you'll basically need to analyse the JS code firstly

[safe star]

Did you filter correctly?

[weak dagger]

What do I filter with?

[safe star]

What were u filtering with before?

[weak dagger]

I did'nt use any filters how do I figure out what to fitler for?

Am I missing something?

[safe star]

filter by a common occurring size

The example also showed it

[weak dagger]

I'm actually lost, what is the common occuring size ?

[safe star]

Exclude the size that’s shows up the most

Didn’t last section show the filters?

[weak dagger]

I dont get any results in the first place

to even make an filter based on content size

[safe star]

Did u wait for it to complete?

[cloud urchin]

you do get a result

you have 80 errors

can you resolve and ping that target?

[weak dagger]

oh lol I had to restart the machine it's working now thanks 🙂

[foggy monolith]

Up to the first socat section of the pivoting module — why is it saying "Connection refused" when I literally copy and paste the command from the module onto the pivot box?

[cloud urchin]

that means the port is closed

[foggy monolith]

Which port? 8443 on the target or 8080 on the pivot?

[cloud urchin]

the port on the server you're attempting to connect to on that port

[foggy monolith]

Well I'm trying to pivot, not connect to a port, so I'm not sure what you're talking about.

[cloud urchin]

yes and one computer is the server and one is the client in this case

the server is the host that is listening for the connection

it tells you exactly which IP is refusing the connection right there in your screen shot

[foggy monolith]

Which is, again, what? 10.129.121.16 or 172.16.5.19?

[cloud urchin]

read the line that says "connection refused" and try to find an ip address

[marsh echo]

where is the chanel for help box lab ? i've got a problem with bloodhound ... I launch toput correctly but the zip file does not extract and remains at 0%.

[cloud urchin]

so it would seem the target is not listening on that port, or the port is blocked for some reason. some obvious things when it's not listening would be that the server isn't running the app/service that is supposed to listen on that port, or maybe a firewall is blocking traffic.

[cloud urchin]

there are multiple versions of sharphound/bloodhound etc. and they are incompatible with each other. whenever i've uploaded to BH and it was 0 bytes it was because i was using the wrong version. i may also recall one time because i had the .zip with root only permissions and wasn't running bh as root. so i'd check those two things.

[marsh echo]

ah I thought he had a problem thank you

[lucid grotto]

Thank you ! 🙏

[foggy monolith]

Update on this: so I was able to get proxychains to work by running ssh htb-ac-<ID>@htb-<KEY>.htb-cloud.com "cat /etc/proxychains.conf" | sudo tee /etc/proxychains.conf to effectively clone the proxychains settings off of PwnBox onto my personal host. Not sure what else needed to be set though besides what was mentioned in the module.

[pine topaz]

In the module: "Learning Process" section:"Documentation" There are reference to a tool called "Flameshot".

After Downloading the .msi version from the the Github repo and running it in Virustotal I get some what mixed results.
It passes the scan but community responses say it's most likely malware. Anyone else having encountered this? 🙂

[cloud urchin]

yeah probably just download it from their official website, flameshot.org. or use sharex.

0A9C7D8E2AD89BB46D998B095235EB03 is the md5 hash i got from their website, 0 detctions on vt

[pine topaz]

Alas the same response, but I'll detonate it in a Sandbox or use REMnux to analys it.

[pine topaz]

Yes 0 dectections but a bunch of community warnings. I'll investigate it a bit more in a Sandbox. Thanks for the help! 🙂

[muted mulch]

Obtain a session cookie through a valid login, and then use the cookie with cURL to search for the flag through a JSON POST request to '/search.php'

post web request xan some one help me i type the falg in this box but it marks it as rowng

[gray yacht]

Try to refresh the page and resubmit it and if that doesn't work, reset the machine and try to submit that flag again.

[muted mulch]

ok thanks

[muted mulch]

can i use the same commands as kali linix in windows powre shell

[gray yacht]

You don't have to redo it, just try the flag you got again and see if it accepts it.

[muted mulch]

ok

[fathom pendant]

curl syntax in windows is gonna be different, especially powershell

as curl is an alias of invoke-webrequest i believe so it has some other interesting quirks

[muted mulch]

ok ill keep that in check

[shut quest]

curl.exe is not the same as curl which is an alias

[fathom pendant]

ye

[shut quest]

Also windows curl.exe requires a -F where on Linux it's lowercase.

[safe star]

This makes so much sense now

Tried using curl on windows and the syntax was insane

[light otter]

anyone ran into this issue while on the Public exploits on Getting started:
found the exploit and ran the path in msf .
] File saved in: /home/htb-ac-680000/.msf4/loot/20240913213839_default_94.237.59.63_simplebackup.tra_442010.txt

however when i concatonate the file theres no mention of flag.txt or even a file within the directory its mentioned in.
i just get output of backup w/ no flag.

edit: found the issue reading matters

[muted mulch]

Doesn't does anybody know why I don't have the option to send images to the channel I checked in other channels and I do have it but not in this one

[dim wolf]

to send images please verify your account -> #welcome

[balmy tartan]

Im stuck on "Hunting for Stuxbox" in "Intro to Threat Hunting and hunting with elastic"

I have the cmd args after mimikatz, but it doesn't work?

[split socket]

Hello everyone

[safe star]

Yo

[split socket]

I want to learn Hydra anyone who wants to help me dm me

[safe star]

There’s a module for that

[split socket]

I’m new can you guide me

[safe star]

You have an academy account?

[safe dock]

Can I able to remove my card details from the update payment method option ?

[storm elk]

You’ll need to ask support to do this

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[cloud urchin]

lol

have you completed the cpts path?

[normal sand]

Module: Attacking Common Applications
Section: Web Mass Assignment Vulnerabilities
Link to section: https://academy.hackthebox.com/module/113/section/2160

I just finished reading the section, but I'm afraid I still don't understand the whole "Mass Assignment"?

From what I can see and understand, since we have the source code, we know of a hidden parameter during registration that we can set that allows us to bypass the registration checking step.

Where does the mass assignment come into play here? Is it something in the framework that allows developers to mass import data?

[fathom pendant]

yep

basically some extra variables that can be set

[normal sand]

It's defined as:

Several frameworks offer handy mass-assignment features to lessen the workload for developers. Because of this, programmers can directly insert a whole set of user-entered data from a form into an object or database.

But that just sounds like any other form to me? 🤔

[fathom pendant]

it allows assignment of parameters that may not be known to the user

also the key thing here is "database or object"

[normal sand]

So this can be the case for pretty much any form? Having hidden parameters that aren't protected, it doesn't just have to be "certain" frameworks?

[fathom pendant]

it's not really "hidden parameters" it's parameters that don't exist anywhere visible to the user

[normal sand]

Not sure I understand what you're trying to say?

[fathom pendant]

in the example you assign a value to X which any value in that X category just forces it to be true

since it's being directly input into a database, you're manipulating the data in a way that forces it to behave in certain ways, such as creating an "unverified" user

[normal sand]

Yeah, because of the way the code is written.

What I still don't get is where the "mass assignment" comes into play?

Are they just saying that such vulnerabilities exist because the devs were more focused on ease of import of data?

[normal sand]

So, the only way then to identify these "parameters" is to obtain access to the source code.

[fathom pendant]

or send a request to the api after creating a user

[normal sand]

You saying the API may reveal one of these "parameters"?

[fathom pendant]

yes

[normal sand]

And then we just try bypass it by guessing what to change the parameter's value to?

[fathom pendant]

not necessarily guess

like yes it's a guess, but it's calculated based on various factors

https://www.vaadata.com/blog/what-is-mass-assignment-attacks-and-security-tips/

https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html

https://owasp.org/API-Security/editions/2019/en/0xa6-mass-assignment/

[normal sand]

So... basically the form field input names match that of the object and are directly mapped. Assuming we have access to the source code, we can then identify other parameters that were not part of the front-facing form that we can take advantage of? Am I understanding that right?

[fathom pendant]

in the owasp link there's no access to the source code required

[normal sand]

I see. Thanks for the helpful references.

Wasn't sure how to put an explanation in my notes, these references gonna be good tho.

[crystal ruin]

I'm on Password Attack - Hard. How long is the cracking for initial foodhold expected to take. Can't tell if I'm down a rabbit hole at this point, been waiting for 20 mins.

[fathom pendant]

i hope you're not using rockyou :)

[crystal ruin]

I'm using the provided wordlist with the custom ruleset

[fathom pendant]

and what service are you targetting?

[crystal ruin]

trying SMB

[fathom pendant]

also the assessment gives you a name to start with

[crystal ruin]

yep that's the username I'm targetting

[fathom pendant]

if you're not getting it then try other services

[crystal ruin]

Alright I'll try that next. Longest I should wait on these challenges should be 20 mins?

[fathom pendant]

between 20 and 30 minutes

[vocal bridge]

File upload attack module, Blacklist filter section. I hid the extension to not spoil anything. why does my shell get printed in plaintext instead of doing its functionality?

[spring lily]

just a heads up in "CORS Misconfigurations" section's challenge. I got different behavior from Firefox (+ FoxyProxy) and Burp's Chromium. Burp's Chromium worked as intended, whereas Firefox just redirected me back to the login page, couldn't access the profile page.

[stiff bone]

Who can I contact for help with SA 1 on the Introduction to Windows Evasion Techniques module?

[safe star]

have u tried other file formats?

burp repeater is ur friend here

[vocal bridge]

php2-7,pht,phtml

the ones that aren't blocket display in plaintext

[safe star]

there is more than php

[vocal bridge]

isnt the website php based tho?

I could try asp

[safe star]

you and i know its not asp based

[vocal bridge]

yea but if php doesn't work what do i do?

[safe star]

take a look at limited file uploads again

[vocal bridge]

that comes later in the module

[safe star]

wait my fault 💀 💀

i thougt u were dong skill assessment

lemme see

@vocal bridge have u checked all extenstions?

[vocal bridge]

I think i checked all extensions

[safe star]

check the extension links in that section and fuzz

[rugged turtle]

Hey everyone. I'm not here for anything in particular, just to commemorate the 2 hour waste due to a missing letter in a command making me run in circles.
Thus, to everybody, always try something twice before leaving it for done because it's really likely that you missed a goddamn "-h" in your mysql connection command

[safe star]

isnt that the most important part of the command

[vocal bridge]

I changed wordlists for fuzzing from seclist to payload all the things

[safe star]

did u get it?

[rugged turtle]

actually, I've used the host, of course, just missed that "-h" in front of it.
To me, at least, it comes with extreme confusion that any tool has its own namings, how comes sometimes I do need to express an user as "-u" sometimes as "-l" sometimes without flag

[vocal bridge]

yup

[safe star]

thats just how it is sometimes

help command usually has the answer

¯_(ツ)_/¯

marcielee classic

[rugged turtle]

yea, I think the main issue, at least at the beginning since I'm still kinda new, is the fact that once you try a command and it clearly returns you an access denied error, you assume that then this must not be the right way. Then you notice the goddamn flag's missing

[safe star]

yeah, that happens to everyone, but it helps us never do that mistake again

[ember dune]

CPTS - password attack lab - medium

I have got initial acces to target as J***on but I tried my best to escalate privileges.
can anyone help me!!

simply use: get file_name

[crisp nacelle]

anyone who completed osint corporate recon module?

i want to know if its worth it for 1000 cubes

[crystal ruin]

😉 look back at the documentation you got

[ember dune]

I got credential from documents and get access to garget via SSH

What service i have to look for?

[crystal ruin]

The service is mentioned in the document

[ember dune]

it is mysql, i tried but no luck

don't have credentials

[shut vapor]

you don't? (sorry, my first reply went to wrong line)

[ember dune]

sorry, did not get it?

[normal sand]

Module: Attacking Common Applications
Section: Attacking Applications Connecting to Services
Link to section: https://academy.hackthebox.com/module/113/section/2154

I'm getting the following error when attempting to solve the question at the end of the section:

(gdb) run
Starting program: /home/htb-ac-773541/octopus_checker 
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0x****

I've tried running gdb with sudo privileges, and I'm still receiving the same error. I'm pretty sure I've got the right memory address.

[shut vapor]

I accidentally replied to your first inquery about the the password attack lab then deleted it, becase "you don't?" was referring to you not having credentials for the service. Sorry I'm confusing. I just woke up.

[crystal ruin]

Have you tried accessing mysql once you're onto the box?

[ember dune]

yup, it is giving me error

error "access denied"

just got access to mysql db

[ember dune]

super thanks

[silent falcon]

i cannot access skill assessment ip, why? i can access other modules labs but not for skill assessments

[shut vapor]

try switching to a different region and redownloading the VPN.

[silent falcon]

it doesn't work

[acoustic owl]

What do you mean you can't access them? Not every machine can be pinged

[silent falcon]

i doing wordpress and xss modules. labs are accessible but not skill assessment. i can ping ip but can't browse

[ember dune]

You may need to check your browser DNS settings

[acoustic owl]

This is from the XSS Module

Are you trying to access this endpoint?

[silent falcon]

yes

[safe star]

It’s the wrong address then

[normal sand]

This is the address: ||0x11b0||

[safe star]

Run and disass main

[normal sand]

Run before disass main?

[safe star]

Yes with the main breakpoint

[acoustic owl]

This is from the pwn box.

[normal sand]

Just did it in this order, still didn't work...

gdb-peda$ set disassembly-flavor intel
gdb-peda$ run
gdb-peda$ disas main
gdb-peda$ b *0x5555555551b0
gdb-peda$ run

I still received the error.

[safe star]

It didn’t stop on the next BP?

Try c for continue after u set it

[normal sand]

Nvm, it worked. I just put the incorrect memory address. The address changed after I ran it first. Thanks @safe star

[pseudo kiln]

I have question regarding windows priv esc module Kernel Exploit section. In the examples they shown, there is access to a .sln file which makes compiling the exploits pretty easy. But what do you if that file is not present ? Do you try and compile it with mingw32/64 on linux, or compile it with cl.exe on a windows vm with visual studio ? A bit lost when it comes to windows exploit compilation without when the author does not provide the .sln file

[dapper moth]

Since there isn't many comments on directions.
Anyone stuck on the final SA for the Advanced SQL Injections Module, I can help out giving some directions
https://academy.hackthebox.com/achievement/799850/188

[rough comet]

hello folks

can someone please help me with this question: What OU is the Help Desk group managed by

LDAP module, AD path.

I do not see any attribute regarding someome managing that OU. Having said that, I entered all Members of that OU, and still is not accepting the answer.

[quiet trout]

explore all the OU's its in there... its buried but its in there

[quiet trout]

also do you know how to search ADUC? right click the DC (or click the little magnifying glass thingy... i never use that) and click "search objects" i think its called. Also while you're at it, use the powershell cmdlets to search AD as well, this will be more helpful as i think the labs want you to answer some ?s in the form of their canonical names (CNs) and that wont really be revealed in AD's search feature (easily)

im recalling a bunch of this from memory so forgive if theres an errant click or menu item name here or there, but thats the gist

[rustic sage]

Module: shells and payloads
Section: Skills Assessment
Question: Exploit the target and gain a shell session. Submit the name of the folder located in C:\Shares\ (Format: all lower case)

Im confused on how to actually craft the payload and exploit it

[hushed sail]

i haven’t done this module, but it looks like you’re trying to upload a shell to the target with msfconsole?

set rhosts to target IP, launch a nc listener on your local machine with port 4444, and hit run on metasploit and see if it connects back?

[silk anchor]

The citrix breakout part of the Windows Priv esc module was very fun.
Ended up doing some janky stuff but it worked 🤷‍♂️

[limber river]

no need for nc listener , msfconsole will do that

[rustic sage]

i was going to say this

[hushed sail]

okay. there’s not a lot of context in the screenshot, and without having done this module yet i wasnt sure if he was trying to trigger a separate shell from metasploit, which ive done on live machines before lol

thinking too much into it i guess

[rustic sage]

myself but however, i will give more context rq

[quiet trout]

there is no crafting, its all syntax/cmds... in addition to the help cmd you want to add to your notes show options (which should show you how to config and run the payload info which shows details about the attack set which lets you set the configs then exploit|run which fires it off

[limber river]

maybe you need to upload it in other place

[quiet trout]

is it a l4j attack? looks like it might be l4j.

[rustic sage]

yeah theres a browse option to upload the file, my issue is i dont know what im supposed to really do here, cause it's asking me for zip files, i've never worked with zips for something like this

just thought probably metasploit would have something for me to do the upload

[limber river]

idr but just play with it , try to upload a zip and see how the web app deal with it

[quiet trout]

have you found RCE or SSRF in the app? you may need to upload a zip, figure out a way to bypass extension reqs (file upload bypass) or some such, then RCE it

[rustic sage]

I am in legacy which is retired
I use msfconsole but i didn't work
i just follw the walkthrough
some one help me

[quiet trout]

if you have an SSRF you may not need to figure an upload bypass

[rustic sage]

theyre' using apache tomcat i just know it's a file upload

[limber river]

the module teach you how to craft basic payload to get shell , I don't think there's ssrf

[rustic sage]

yeah no ssrf on this one

[dim wolf]

access #boxes after verifying your account -> #welcome

[quiet trout]

hmmz, ok are you interecpting the upload request? have you tried an extension bypass?

[rustic sage]

no we're not dealing with intercepting anything, nothing related to burpsuite

[quiet trout]

right, but you're uploading a file

[rustic sage]

yes

[quiet trout]

and you have an extension requirement

and your payload in a zip will not execute

whats this upload do? is it a plugin?

[rustic sage]

its supposed to give me a reverse shell

[quiet trout]

no no no

whats the application do, what is the reason for the upload?

think about this not from the attack forward but from the application backwards

we're trying to manipulate the application to give us access... if this upload installs a plugin module or something, then we need to organize our attack from that manner

if this upload stores a zip archive for file sharing, etc. etc.

[rustic sage]

holdon

[quiet trout]

look at me acting like i know what im doin

i guess the academy does work?

this upload form might be a red herring as well, so explore the application for attack surface

check out versions (and any associated CVEs) for all tooling used on the application

[rustic sage]

thanks for your.help

[quiet trout]

Hey here's a simple one, maybe im not firing on all cylinders here... im working the BBH -> LFI -> PHP Filter section

https://academy.hackthebox.com/module/23/section/1492

and its discussing a parameter vuln to LFI that does not return any data with a payload like ?lang=config.php but DOES return the data when you base64 encode it first (with the php://filter)

why would it be vuln to one manner but not the other? weak sanitization/filtering? bypasses were discussed in a previous section, some filter bypassing techniques etc but the payload does not utilize any bypassing teks other than the base64 encoding filter, im kinda at a loss for why the simple payload returns nothing but the encoded one does

nvm this may be due to how config.php does not have any print statements? i guess?

[rough comet]

What magnifying thing ? I’m doing this command line . I’m avoiding using the GUI

[quiet trout]

ok so whats your cmdlet look like?

you should be using powershell for this and not the deprecated stuff

in case you were using like net or whatever the old stuff is

[rough comet]

1 sec

[rough comet]

Get-ADGroup -Identity "Help Desk" -Properties *

Then trying to visually look for it.

[quiet trout]

Ok so in the earlier sections it talked about the different kind of AD Objects, did you take notes on that?

[rough comet]

Yes

[quiet trout]

we're looking for an OU an organizational unit, not a group.

[rough comet]

shit , true

good point

[quiet trout]

Luckily powershell has a handy cmdlet that will burst fire across all objects with Get-ADObject its syntax is a little more verbose but you only have to remember one command

[rough comet]

Get-ADOrganizationalUnit

[quiet trout]

yes thats an option as well

[rough comet]

Probably

[quiet trout]

i would use that one and also use the get-adobject youll prob find with time you prefer the latter so you dont waste precious space in your brain for every granular powershell (ad) cmdlet

[rough comet]

Thank you

[quiet trout]

No problem, use chat gpt to provide the get-adobject cmdlet with the required syntax to find OU's "like" name , its a little trickier than the more granular cmdlets but you should see how its used as well

[rough comet]

Yeah, I’ve used it before for some nxc flags and stuff . Good tip

[quiet trout]

OU was buried no?

[tender nimbus]

hey guys im stuck on fingerprinting module, i saw on the web that we have to find some credentials but i "think" i tried all the other ports but i have nothing ands i can't go in the TechSupport dir

any help pls ^^

[quiet trout]

can you share a link to the section you're on?

[tender nimbus]

https://academy.hackthebox.com/module/112/section/1079

Footprinting Footprinting Lab - Medium

ooooh find something

wait a minute --

[stiff urchin]

What the hek is going on with the modules and the latest update when try (show solution) to check where is the missing part of understanding the question it doesn’t show the answer
Yet i have been trying for whole night and the answer was the same as the one I tried first time but for some reason didn’t work at first nor the 2nd time and tried many different answers until i back to what I believe and tried first answer and it was correct this time
Module BROKEN AUTHENTICATION

I’m stuck with this question now for couple hours no answer is correct!

[tender nimbus]

im in ^^

[quiet trout]

oh goodness i dont have access to that one, thought i did. wish i could be more of help

right on

[nova knoll]

hi everyone

if someone got time , im a noob trying to finnish linux begginer guide x0 im stuck at this question : What is the name of the network interface that MTU is set to 1500? i type an ifconfig and check the interface who was ens3 or tun0 but both of this respond doesnt work for going further x) if someone got a clue im open.

[limber river]

which section ?

[limpid hemlock]

Hey anyone know how to search for password in git lab

Example project??

[storm elk]

What module are you talking about?

[limpid hemlock]

Attacking common applications module Gitlab discovery and enumeration section

[tender nimbus]

Hey guys im back, i got some credentials but i can't connect to the sql server anyone know why?

[wet valve]

Good evening, I have the impression that there is a question that is a bit incorrectly phrased in the module "Windows Event Logs & Finding Evil," chapter: "Windows Event Logs."
I have found the answer, but the question did not provide the correct information. The answer is located elsewhere, and I found it by chance. I am referring to the first question.
And I would like to know if it is intentional, and if so, why.

[shut vapor]

That looks familiar and it threw me off for a good while too. Keep looking for other ways.

What module/section is it again?

[tender nimbus]

footprinting meduim lab

tried to connect with the sa creds with rdp but not working

[shut vapor]

I don't have any insight as I have not done that module, but you can search for or lodge the issue in #1234357888114364508.

[rough comet]

Found it, Thanks!

[shut vapor]

That sounds like a pretty good idea.

[charred egret]

Possibly a stupid question. Just finished my part time cybersec degree and looking for hands on/practical learning now, hence HTB academy. The x days for a path, what is counted as a "day"..8 hours learning, 24 hours, etc? Just trying to formulate a realistic study plan for SOC fundamentals and the CDSA

[limpid hemlock]

Hey anyone know how to search for password in git lab in exzmple project in gitlab

[dim wolf]

1 day is 8 hours

[charred egret]

Brilliant, thanks for the response!

[tender nimbus]

i know but it don't work haha

[shut vapor]

you can share the command you're using if you'd like.

@tender nimbus ^^ Sorry to @ you but I'll be stepping away from my deck in like 10 minutes.

[limpid hemlock]

Hlo

[tender nimbus]

np so here where i'm stuck, i gained acces to the pc of alex with xfreerdp, i grounded acces by mounting a share that i found, by using the same credentiels i mounted another share where there was other credentials of a database, but those credentials don't match. I saw on the web thet there is another user who i need to connect on bcs alex don't have acces to the db, here is my rdp command.

[limpid hemlock]

Hey anyone know how to search for password in git lab in exzmple project in gitlab in Attacking common applications module, Gitlab discovery and enumeration section

[tender nimbus]

omg okej

that was a tricky one

[shut vapor]

lol. ok good. got it?

[tender nimbus]

yes

[shut vapor]

I was trying to think of how to lead you there without giving you any more of a hint 😅

[tender nimbus]

oepsie

[shut vapor]

😉

[shut vapor]

Sorry, @limpid hemlock I don't mean to keep aging out your request. I haven't completed the module in question so I don't feel qualified to offer specific help. I have used git for some years so I might suggest: can you pull the project locally, print all the logs to stdout and do any filtering for password/username mentions?

[fathom pendant]

Just click around the various things

[frozen sage]

hey so I just started and I was wondering about the instance. It says you can only have one per day but I used it yesterday. Does it take the time all the way till the exact time that you lost it for it to recharge?

[fathom pendant]

I believe so

[frozen sage]

Oh damn thank you

[fathom pendant]

I've generally used my own vm so it's not been an issue ¯_(ツ)_/¯

[frozen sage]

VM?

[fathom pendant]

Virtual Machine

[frozen sage]

oh yeah of course how would I spawn targets into that though

[fathom pendant]

You don't spawn targets in your vm

There's a separate button that spawns target (and isn't limited/day)

You connect to the targets generally through a vpn connection to htb

https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

[frozen sage]

so for the lesson I'm doing rn I dont have to use the box at all?

[fathom pendant]

Generally no, there's a handful of times where the specifically call out something on the pwnbox

But everything is doable from your own setup, more or less

[frozen sage]

Oh so iv been overcomplicating things thank you so much this makes it way easier and makes more sense. I did the intro stuff a year ago and just started actually doing modules

I still dont get where the target is spawning though how can I "find all TCP ports on your target. Submit the total number of found TCP ports as the answer." If I cant acess the tarket or system at all

[fathom pendant]

No spoilers

[fathom pendant]

.

[fathom pendant]

Spawn target and spawn instance are two separate functions

You can access the targets from your own vm utilizing the vpn download and openvpn

[frozen sage]

So I have to set up my own VM in order to do this?

[fathom pendant]

Yes as I said earlier

If you are using linux as your base OS you can do it but generally not recommended to do it on your host OS

[frozen sage]

welll that makes sense because thats what I was doing before. thanks

[stable sparrow]

Hi,
My first interaction here (english is not my first langage)
I am a data engeenering student (quite new at cybersec), and I am doing the Network Enumeration with Nmap module
Currently stuck on the before-last exercice, "Firewall and IDS/IPS evasion - Medium Lab" where I am supposed to find the Target's DNS server version
I am trying not to spoil anything so I don't think I can say what I did this far, but I don't realy understand the hint ; During the meeting, the administrators talked about the host we tested as a publicly accessible server that was not mentioned before.

For context : there was a previous exercice that required to find the hosts OS, with a relatively permissive IDS/IPS (but still existent)

[fathom pendant]

On the dns

Consider each target of the skill assessments independent

[stable sparrow]

ok

[bright pivot]

why i cannot open this page?

https://academy.hackthebox.com/module/54/section/490

from this module

[fathom pendant]

Did you press enter?

I'm assuming you don't have burp running

Which may have proxy turned on

[bright pivot]

do you mean burpsuite?

[fathom pendant]

Can you curl the website

[fathom pendant]

Yea

Oh wait

Even simpler

You need to specify the port

[stable sparrow]

I understand even less the hint then, why is it referring to something not mentionned before ?

[fathom pendant]

?

They are proposing the skill assessments as different levels of security maturity

[bright pivot]

So,are my /etc/hosts settings correct?

[fathom pendant]

Yes

You need to specify the port in the url

[fathom pendant]

Look at the example

It calls out admin.academy.htb:PORT

[autumn pilot]

what if the target is running http instead of https

[fathom pendant]

Http not https