modules

[cloud urchin]

without port forwarding?

[foggy monolith]

Anyone?

[olive slate]

I used the dev box to compile the binary, ran it and caught a shell from the pwn box. Copied the exe to the pwnbox, terminate the dev box, start the target box and transfer the exe to the directory stated. I don't see why any port forwarding is needed.

[cloud urchin]

how are you encrypting the payload

[olive slate]

Anyway I'm gonna re-do it from scratch and try again

[olive slate]

AES, like in the example

[foggy monolith]

Had to rm -rf ptunnel-ng and re-clone to fix this. Not sure what was going on.

[limpid frigate]

anyong help me with Intro to Whitebox Pentesting SA2, i keep getting "code injection should not be possible, even without sanitization or validation"

[river spear]

I am currently working on the following question in the Footprinting > SMTP: Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer. I thought the following would be it: ||nmap -v -p25 -n --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY} 10.129.42.195|| However, this returns no accounts. I also tried ||smtp-user-enum -U usernames.txt -t 10.129.42.195 -m 150 -M VRFY||, but this too returned no results. Note: usernames.txt contains the same contents as the given file

[fathom pendant]

Don't know what -m does

But you might wanna increase the wait time to 20+ seconds

It's because your scanning is too fast

You may also need to attach the inlanefreight.htb domain

[river spear]

-m adds a max number of processes. I removed that, and tried adding a wait time of 20s. I'll see what happens.

Yep, an increased wait time ended up working. Why would an enumeration going too fast result in a no positive results? Does it just not have time to establish a connection, and so it times out?

[fathom pendant]

SMTP is a slow thing

[river spear]

I see. How likely am I to run into this problem with other protocols? Not very likely, I take it?

[fathom pendant]

It depends

[river spear]

Well, just one more thing to consider I guess

[spare path]

Hey currently stuck on this one any help for how to progress for the final skill assessment? I've got to the /SECRET/secret.xxx part and not sure how to progress.

[fathom pendant]

You'll learn tiny quirks of each protocol as you go

[fathom pendant]

The page tells you what paramatername to fuzz values for

[spare path]

I did see that

[fathom pendant]

So...

[spare path]

I don't understand how to utilize that info

[fathom pendant]

Recall the parameter fuzzing section

[spare path]

will review it

[fathom pendant]

I suggest taking notes as you go

[spare path]

yeah really seeing the value in that now

[fathom pendant]

The more you do it the less you'll need to rely on them

But they're definitely good for "wait what was the thing again?"

[river spear]

I might as well ask my other question. I am working on Footprinting > DNS: What is the FQDN of the host where the last octet ends with "x.x.x.203"?. I have done the following:

1. ||dig axfr inlanefreight.htb @10.129.42.195||
2. ||dig axfr internal.inlanefreight.htb @10.129.42.195||
3. ||dnsenum --dnsserver 10.129.42.195--enum -p 0 -s 0 -o subdomains.txt -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt internal.inlanefreight.htb||

However, I am getting the error that there are no nameservers. ||I have tried all different lists (as the hint says)||

[stark lark]

Do I have to enable the ZAP HUD? I don't see it in the in-built browser

[fathom pendant]

Yeah, but you can easily use burp for this

[fathom pendant]

Subdomains of subdomains

[stark lark]

For which? :-)

[fathom pendant]

To answer the questions

You'll need to do things slightly differently

[stark lark]

Figured it would be good to learn ZAP since it has the auto scan feature (for exam)

[fathom pendant]

¯_(ツ)_/¯

[stark lark]

Ah yeah already did so for one question :) Do you prefer burp community over zap?

[fathom pendant]

I used burp more but can't say I really needed the spidering feature

Also burp does cache the http requests made while it's running

Proxy > http history

[river spear]

It seems that the transfer fails for all other subdomains, which makes me think that it is definitaly a subdomain of ||internal||. However, all of the subdomains of that subdomain fail anyway... That is the main problem I was running into earlier

[fathom pendant]

It's not

Your logic is backwards

You want to attack subdomains you cant natively transfer to

Dnsenum is a bruteforce tool

[river spear]

So they would not appear in that list I was testing against?

[fathom pendant]

You don't need to bruteforce what you can already access

[river spear]

That would make sense

[fathom pendant]

One of the other subdomains from your base axfr is the way forward

But your list is in-fact wrong

You'll need a more fierce list as well

[spare path]

can I DM you the command I'm trying to see if I'm far off?

[idle sigil]

Hey, so i am working on What's the contents of table flag5? (Case #5) - Attack Tuning SQL MAP Essentials. I was initially using my kali and sqlmap keeps timing out. But when I use the same command on pwnbox, it works without a hitch.

Can someone please help me figure this out?

[shut quest]

Poor Internet? Try using tcp instead of udp for the VPN connection.

[idle sigil]

i am using tcp vpn and my internet is working fine :/

[river spear]

I have been able to find ||ns.dev.inlanefreight.htb||. I ran ||dig ns/axfr/any/soa ns.dev.inlanefreight.htb @10.129.42.195||, however, none of these helped.

[spare path]

I've tried fuzzing the parameter like this but it doesn't seem to get me anywhere. ||ffuf -u http://IP:PORT/admin/panel.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "accessID=FUZZ" -w common.txt -v||

[river spear]

I may have just figured it out...

[foggy monolith]

Pivoting, Tunneling, and Port Forwarding > RDP and SOCKS Tunneling with SocksOverRDP

Why is this happening and what Windows Defender setting must I change on the target to ensure that this actually runs and doesn't throw an error like this? Anyone? @fathom pendant?

[fossil linden]

Can't spawn a pwnbox for like 2 days anymore. Do you guys have problems too or is it a skill issue?

[river spear]

I can spawn a pwnbox whenever I want for as long as I want, but that may be because I am on a business plan

[autumn pilot]

@foggy monolith please reduce the usage of markdown syntax when specifying the module and section names

[fossil linden]

i'm on plat sub

[ionic minnow]

The file .dll is probably deleted by Windows Defender

[foggy monolith]

And again, how do I prevent that?

[autumn pilot]

you can stop defender

[vernal sphinx]

Thank you very much indeed

[fathom pendant]

Disable real time protection, Google can help

[spare path]

my recent attempt ||wenum -w common.txt --hc 200 -u "http://IP:PORT/admin/panel.php?accessID=FUZZ"|| also doesn't appear to show anything

I feel like I have all the right pieces I just don't know how to put it together

will try again later thanks for the help thus far

[fathom pendant]

I mean I'd use ffuf or gobuster instead

[west sentinel]

I'm struggling to interpret a Question from "Filter Contents - Linux Fundamentals"
"Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer."

i don't know if the Q is talking about like URL links containing "inlanefreight" or something else, but i've tried using:
curl https://www.inlanefreight.com | grep -o www.inlanefreight.com.*\" | sort | uniq | wc -l
to no avail,

[fathom pendant]

This is the only bullshit one in the module as it requires some html knowledge

[west sentinel]

lol i know some html from high school, they were talking about urls right?

[fathom pendant]

#modules message

[fathom pendant]

When you curl a website you're generally gonna get it's source code

[ember dune]

module: attack common service - RDP

[12:44:10:387] [66982:000105a7] [ERROR][com.freerdp.core.rdp] - [rdp_recv_callback_int][0x55c6cdd6c4d0]: CONNECTION_STATE_NLA status STATE_RUN_FAILED [-1] [12:44:10:387] [66982:000105a7] [ERROR][com.freerdp.core.transport] - [transport_check_fds]: transport_check_fds: transport->ReceiveCallback() - STATE_RUN_FAILED [-1]

I got username and password from ***.xml file in windows but i cann't connect to machine via RDP, getting error

[fathom pendant]

The link I shared explains it much better

[fathom pendant]

I don't recall an xml file playing a role in the rdp auth but it's been a minute

[safe star]

what error?

[fathom pendant]

Yeah tbh idk what xml file you're looking at as credentials are directly tied to the first question

[ember dune]

Error:
[ERROR][com.freerdp.core.transport] - [transport_check_fds]: transport_check_fds: transport->ReceiveCallback() - STATE_RUN_FAILED [-1]

Is there any method of connecting to RDP rather than username and password????????????

[safe star]

is this the last question on the section?

[ember dune]

yup

[safe star]

did u enable restricted admin?

i got in just fine

u probably need to restart

[ember dune]

yes, i did it using HTB credential given in the module

[safe star]

yeah try restarting the machine

[fathom pendant]

Did you use the /pth: option for using the admin hash?

[ember dune]

I do not have hash instead username and pass

[safe star]

?

[fathom pendant]

Don't know where you got that from

Check the desktop of htb-student

[safe star]

U didn’t click on the notes?

[fathom pendant]

The file referred to by the first question

[ember dune]

nope, i enumerated it (credential harvested)

[fathom pendant]

Well it's likely wrong

:)

[ember dune]

feeling same

[safe star]

How did u miss the desktop then

[fathom pendant]

There was no need at all to credential harvest

[fathom pendant]

Especially a file called directly out by a question

[ember dune]

hit me again!

[fathom pendant]

First question of the section my guy

Can't be any clearer than that to look at

Also just in case try resetting your vm

The error your getting isn't necessarily a log on error indicating bad creds

[ember dune]

I got initial foot hold and do not have admin priv, any hint?

[fathom pendant]

...

My brother in christ

https://academy.hackthebox.com/module/116/section/1171 this section yes?

[ember dune]

[fathom pendant]

Open the file referenced by Question 1

Since you can't seem to understand anything beyond "do this"

[ember dune]

ohh, i never thought of that

[ember dune]

i do

[fathom pendant]

It's literally what me and @safe star Have been saying the past x minutes

I see a file titled that, I'm gonna click it, even if it's out of frustration of trying everything else

This module is about the basics of services, not credential harvesting or any of that

Everything is generally given in a fairly straightforward way

[ember dune]

got it

[fathom pendant]

Or just follow what the section says for the most part

If it doesn't come up in the section, it may come up in the skill assessments

[safe star]

Didn’t password attacks go over it too?

[acoustic owl]

Why? What exactly is confusing you?

[weak dagger]

Nvm it’s all sorted now

I was confused on why the 302 aren’t shown on browser

And only shown on the burp

[ember dune]

it takes time to build mindset

[fathom pendant]

Indeed

So don't try and think outside the box

Always start with simple first

Like stuff on the desktop

[ember dune]

sure, I appreciate you

[fathom pendant]

The biggest and most important thing is not discounting the simple solution to the problem given

And sometimes even asking: did the question ask me to, or did the module/section go over this

[safe star]

@uncut ocean u get it?

[uncut ocean]

tried the defender off

but still it gets deleted

[safe star]

i just copied and pasted it on to the desktop then disabled it

did you run cmd as admin?

[vivid sigil]

can i skip Pivoting, Tunneling, and Port Forwarding
if i know how to use ligolo-ng ?

[safe star]

still good to go over the module and see other methods

even if you're familiar with the subject

[uncut ocean]

still deleted

[safe star]

dm a pic

[uncut ocean]

no bro its on of the best modules it will give you idea how actually things works in background

[shell ledge]

Note to current and future students of HTTP Attacks: just solved the HTTP Response Splitting Question. If anyone in the future might need a nudge, feel free DM me. As someone stated before, I too struggled with Firefox and used Chromium instead. Then, pay attention to the Hint provided by HTB..

[rough tree]

Any nudge on how to get the second flag(on SQL01) on the Using Crackmapexec Skill assestment lab exercise?

[faint geode]

Is Real Time protection turned off ?

[next bronze]

roast

[rough tree]

Already done and found "A**l". I see no special permission in the MSSQL, so I guess ntlmrelayx?

[unique ether]

Good day

Completed half of shells and payloads

[next bronze]

check shares

[unique ether]

Could have finished more but meh

[rough tree]

I don't see anything strange on SQL01, the only share I see readable is the on DC01

[dire tinsel]

Footprint - DNS

Q1. Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain

How to find FQDN?

1. I tried this command.
   ||dig PTR inlanefreight.htb @10.x.x.x||
   ||dig A inlanefreight.htb @10.x.x.x||

2. Next, tried this command.
   ||dig axfr inlanefreight.htb @10.x.x.x||

3. Finally, found the result. but i don't understand why ||ns.inlanefreight.htb.|| can be an answer. why below can't be an answer?
   ||root.inlanefreight.htb.||
   ||inlanefreight.htb.||

Thanks.

[next bronze]

there's a share containing a lot of things you can access

[rough tree]

Thanks! My bad I was blinded by all the files LOL 😄

[next bronze]

yeah time to dig through them

[next bronze]

because the question is asking for the DNS' FQDN

[nova ginkgo]

Attacking Common Applications - WordPress - Discovery & Enumeration
Perform manual enumeration to discover another installed plugin. Submit the plugin name as the answer (3 words).

I found :
=== Mail Masta ===
=== Contact Form 7 ===

└─$ curl -s http://blog.inlanefreight.local/ | grep plugins
<link rel='stylesheet' id='contact-form-7-css' href='http://blog.inlanefreight.local/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.2' type='text/css' media='all' />
<script type='text/javascript' src='http://blog.inlanefreight.local/wp-content/plugins/mail-masta/lib/subscriber.js?ver=5.8' id='subscriber-js-js'></script>
<script type='text/javascript' src='http://blog.inlanefreight.local/wp-content/plugins/mail-masta/lib/jquery.validationEngine-en.js?ver=5.8' id='validation-engine-en-js'></script>
<script type='text/javascript' src='http://blog.inlanefreight.local/wp-content/plugins/mail-masta/lib/jquery.validationEngine.js?ver=5.8' id='validation-engine-js'></script>
<link rel='stylesheet' id='mm_frontend-css' href='http://blog.inlanefreight.local/wp-content/plugins/mail-masta/lib/css/mm_frontend.css?ver=5.8' type='text/css' media='all' />
<script type='text/javascript' src='http://blog.inlanefreight.local/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.2' id='contact-form-7-js'></script>

but incorrect

can anyone help me pls

[dire tinsel]

OMG.. my english issue 😦 thanks

[nova ginkgo]

guys....

[acoustic owl]

Have you performed a wpScan?

[nova ginkgo]

yes I found the same plugins

||[+] mail-masta||
||[+] contact-form-7||

[safe star]

Wpscan won’t find it

Try curling more pages

[nova ginkgo]

I curled index page so now Should I look for another one?

[acoustic owl]

Use whatever tool you like, but always look at all pages.

[nova ginkgo]

.....

thanks

[nova ginkgo]

then how can i find
Find the version number of this plugin. (i.e., 4.5.2)

I looked all plugins readme.txt files but there is no

[safe star]

Readme files are usually capitalized

[nova ginkgo]

it doesnt matter there has information but not for 4.5.2

[safe star]

Have u looked through the file?

[nova ginkgo]

yes

[safe star]

The change log?

[nova ginkgo]

no only readme.txt

[safe star]

Yes change log in the readme

[nova ginkgo]

did you mean log.txt ?

[safe star]

No it should be in the readme

[nova ginkgo]

bro I said I already read all readme.txt files

[safe star]

Wyd all?

[nova ginkgo]

I mean all plugin's reame

[safe star]

Did u find the plugin then type the name in the plugin directory?

[nova ginkgo]

yes I did

[safe star]

Send a pic in dm

[surreal heron]

vHosts needed for these questions: inlanefreight.htb + 1 Brute-force vhosts on the target system. What is the full subdomain that is prefixed with "web"? Answer using the full domain, e.g. "x.inlanefreight.htb"-------------------------------
Have added host to etc/hosts
gobuster vhost -u http://inlanefreight.htb -w subdomains-top1million-110000.txt --append-domain

Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)

[+] Url: http://inlanefreight.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true

Starting gobuster in VHOST enumeration mode

Error: error on running gobuster: unable to connect to http://inlanefreight.htb/: Get "http://inlanefreight.htb/": dial tcp 94.237.53.113:80: connect: connection refused
I get this error how to proccedd

This is the host added in etc/hosts file

[next bronze]

you need to set a port

[surreal heron]

to the hosts file??

[next bronze]

to your gobuster command

[surreal heron]

Should add the port number of our target ryt ?

[safe star]

Yes

[strange forge]

In the ad skill assessment

1. How to get reverse shell from webshell. I tried revshell. Not working. Causing errors

[somber fiber]

Is there anyone else facing challenge with https://academy.hackthebox.com/module/280/section/3130

Recursively fuzz the "recursive_fuzz" path on the target system (ie http://IP:PORT/recursive_fuzz/) to find the flag.

like it never reaches the end for me

i liked this module but at same time i'm hating it

it just eating so much time "i just don't know if its for good reason or not".

can someone help here?

[somber fiber]

https://tenor.com/thcfxHAYiy0.gif

[somber fiber]

like what type of vuln is it?

upload ?

[slender delta]

I'm having some trouble with the LFI Skill Assessment in the last step....

Can I DM someone?

[somber fiber]

which mod?

[slender delta]

File Inclusion

[hexed lintel]

dm me

[somber fiber]

which part

[strange forge]

Yeah its file upload. Web shell is already in the assessment. Iam just trying to get reverse shell to get started.

[slender delta]

Skill Assessment

[somber fiber]

@hexed lintel bro calling you in dm

[somber fiber]

connected to vpn or pwnbox?

[hexed lintel]

@strange forge which module and section?

[strange forge]

Ad enumeration and attacks skill assessment 1

[somber fiber]

can you dm the question?

[next bronze]

use the webshell like a regular shell, grab one from revshells.com

[somber fiber]

or drop here

[next bronze]

it's not a question, they just want to get a revshell from the webshell

[hexed lintel]

@strange forge try base64 reverse shell

Powershell#3 Base64

[gray yacht]

It didn't take forever for me. You can DM what tool and command you are using.

[strange forge]

Thanks brother

[covert vortex]

Hi there, could someone help clarify this question: "If csrf.htb.net was using SSL encryption, would an attacker still be able to alter Julie Rogers' profile through a CSRF attack?" [Session Security / Cross-Site Request Forgery (GET-based)]. In the scenario presented, where the HTTP host is used, the attacker successfully captured user csrf token by sniffing the local network traffic. I'm struggling to understand how the correct answer can be ||true||, given that with SSL encryption enabled, the attacker shouldn't be able to capture CSRF token and eventually craft form to send a valid request to the API.

[somber fiber]

it's bit lengthy you want it here?

[quiet trout]

working the bbh -> sesession attacks module. HBU?

[quiet trout]

this is trying to have you discern HTTP vs HTTPs.

HTTP is delivered over application layer, while a subsequent (secured) connection over SSL is handled on transport layer. The browser still renders/stores the cookies/data (mentioend in the previous sections)

i was just pondering this the other day (how a stateless protoc like HTTP deals with stateful connections like SSL/TCP), chat gpt was /somewhat/ helpful to break this down, does that make sense or do you need a more in depth explanation? @covert vortex

[covert vortex]

got it, thanks mate : )

[quiet trout]

its like the transaction occurs encrypted. not the end result? my understanding is still very precarious so barring an answer from someone who is more aware of whats going on, i think that will suffice for a basic understanding

there's a uh, module somewheres about wireshark where they have you setup a (TLS?) cert to sniff traffic between http/s connections that may help solidify the actual transmission parts of this concept. sorry i dont have a link but im 99% sure its the wireshark module on academy

like if you sniff your own https traffic its encrypted but if you set up a cert (and a key or something?) you can see whats going on, not that thats specifically helpful here but it may round out the concept

[quiet trout]

Also while we're on this topic, you have a clear differentiation between XSS/CSRF vector right? this comes up in interview questions... CSRF requires user interaction, XSS requries no user interaction (and poses a much deeper threat in terms of what can be done leveraging xss). If you're ever asked "whats the core diff between xss/csrf"

or something like that

[limpid hemlock]

Hey im doing the thick client app attacking from attacking common application here i disabled the auto deletion and checked the temp folder for a batch filr but im not seeing anything inside it

[quiet trout]

try searching this channel, i think this has came up a few times and has been answered. I dont have access to that module so I cannot be of help. Theres 2-3 other users who get active around this time though who I've seen help on this module, they should be around shortly.

[fiery berry]

This may help a bit:
https://forum.hackthebox.com/t/exploiting-web-vulnerabilities-in-thick-client-applications/276823/37

[limpid hemlock]

See i dont get any bat file when i restart the service after disabling that auto deltion

I dont see anyone properly addressing this issue in the forum

Above

[quiet trout]

did u search the channel from discord? lots of results youll need to browse them

[eager ledge]

I am doing "Skill Assessment" section of "Command Injection" module. I have found the point of injection but no matter what payload I use, I am getting "Malicious request denied".

I have tried
bypassing space filter,
bypassing blacklisted command using
character insertion,
command reverse,
case manipulation,
bas64 encoding,
hex encoding,
tried reverse and hex encoding together in the payload.

But nothing seems to work. All I get is `Malicious request denied".

[limpid hemlock]

It did mention this issue im facing but soutions isnt given there they moved onto a different problem

[quiet trout]

Yeah im seeing lots of complaints, T_T'' sorry theres no help there.

[quiet trout]

ok i think you need to try bypass + bypass (at some point)... and check your error messages carefully they change depending on which bypass method you use. If you have no single bypass working yet, go down the list from start to end of every bypass you tried in the module, and check your errors. For example one error message might say invalid extension while another says malicious... use ffuf or whatever to filter your output, burp (community edition) wont let you do this (easily)

[eager ledge]

Will try this. Thanks

[echo nova]

How do I get started with hacking?

[storm elk]

@small plover this is not the place for this

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

#modules message

[echo nova]

Thank you

[limpid hemlock]

Any help

[limpid hemlock]

.

[surreal heron]

Hey guys, iam not able to perform zone transfer can someone guide me stuck for a long time ^^ : After performing a zone transfer for the domain inlanefreight.htb on the target system, how many DNS records are retrieved from the target system's name server? Provide your answer as an integer, e.g, 123.

[quiet trout]

what cmd are you using to perform a zone transfer?

[surreal heron]

dig axfr @a.root-servers.net inlanefreight.htb

[quiet trout]

and your output?

you have the ip added to hosts right?

i think your @... might be wrong though

dig inlanefreight.htb and double check the dns server found in the results, or nslookup or w/e

[surreal heron]

its like we should add it name server ryt or am I wrong ??

[quiet trout]

no dont add the NS to /etc/hosts (if im not mistaken) but target it directly in your AXFR

[shut quest]

Link to the section?

[surreal heron]

Ok let me try

[surreal heron]

dig axfr @a.root-servers.net 10.129.25.127

; <<>> DiG 9.20.0-Debian <<>> axfr @a.root-servers.net 10.129.25.127
; (2 servers found)
;; global options: +cmd
; Transfer failed.
:<

[limpid hemlock]

https://academy.hackthebox.com/module/113/section/2139

[quiet trout]

i believe your @DNS is targeting a public NS and we need to target a private dns to the target, as its a box that does not reach the internet

[surreal heron]

now what @DNS should I use
dig 10.129.25.127 NS

; <<>> DiG 9.20.0-Debian <<>> 10.129.25.127 NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64464
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1410
;; QUESTION SECTION:
;10.129.25.127. IN NS

;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024091900 1800 900 604800 86400

;; Query time: 29 msec
;; SERVER: 10.255.255.254#53(10.255.255.254) (UDP)
;; WHEN: Thu Sep 19 18:59:06 IST 2024
;; MSG SIZE rcvd: 117

[quiet trout]

what does your /etc/hosts file look like and also what does nslookup for inlanefreight.htb return? (after verifying that its correctly added to your hosts file)

@surreal heron ^

also give me a link to the section so i can review what i did there, please

[surreal heron]

https://academy.hackthebox.com/module/144/section/1255

nslookup inlanefreight.htb
Server: 10.255.255.254
Address: 10.255.255.254#53

** server can't find inlanefreight.htb: NXDOMAIN

[shut quest]

Go over the steps again, make sure you're removing the delete rights correctly.

[surreal heron]

@quiet trout

[quiet trout]

thx, yeah for a sanity check remove the public DNS server a-root... and go with inlanefreight's IP address instead, see what happens

[limpid hemlock]

That i am doing properly

[surreal heron]

That too i tried let me show you

dig axfr @10.129.25.127 inlanefreight.htb
;; Connection to 10.129.25.127#53(10.129.25.127) for inlanefreight.htb failed: timed out.
;; no servers could be reached

;; Connection to 10.129.25.127#53(10.129.25.127) for inlanefreight.htb failed: timed out.
;; no servers could be reached

[rocky estuary]

doing attack FTP from Attacking Common Services for some reason running medusa to bruteforce didn't work this the command i ran "medusa -U users.list -P passwords.list -h 10.129.203.6 -M ftp -n 2121 "

[quiet trout]

ok leave the @... part off entirely, what do you get?

[surreal heron]

dig axfr 10.129.25.127 inlanefreight.htb

; <<>> DiG 9.20.0-Debian <<>> axfr 10.129.25.127 inlanefreight.htb
;; global options: +cmd
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024091900 1800 900 604800 86400
; Transfer failed.
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024091900 1800 900 604800 86400
; Transfer failed.

dig axfr inlanefreight.htb

; <<>> DiG 9.20.0-Debian <<>> axfr inlanefreight.htb
;; global options: +cmd
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024091900 1800 900 604800 86400
; Transfer failed.

[rustic sage]

When im on starting module the target machine is stuck on "target is spawning", so I cant see the IP. I didint click on it to start, its been that since last session when I was logged in to academy

[sick whale]

Refreshing the page doesn't solve the issue? I sometimes have this when I don't kill the instance at the end of a module

But usually refreshing the page gets things back to normal

[rustic sage]

Nope, its the same if i refresh, or well, it loads and auto starts (going to spawning machine) again

spawning target

[surreal heron]

@quiet trout

[sick whale]

I would contact support then

[rustic sage]

Thanks 🙂

[quiet trout]

are you connecting to the target from a pwnbox? reset target perhaps?

im not sure why you're having this trouble.

[next bronze]

spawn one in another section or switch vpn server

[rustic sage]

It worked, what would i do without you, my hacker daddy? 😄 @next bronze

[surreal heron]

Tried both reseting for 2 time dont know what the issue is

[plain trellis]

Does the double pivoting don't work with ligolo in Pivoting Module -> Skill Assessment section? I've tried many things and was able to setup a file server by which I can directly transfer files from my Attack host to ||172.16.5.35|| windows host. But when I try the same for double pivoting it throws an error as: ERRO[0140] read tcp 127.0.0.1:53490->127.0.0.1:11601: use of closed network connection 2024/09/19 09:33:02 [ERR] yamux: Failed to write header: EOF

[quiet trout]

ok make sure your IP matches the new target IP in your /etc/hosts file, but you're cmd looks right (either specifiy the target IP in your @.. or leave it blank, try both you /should/ get results either way... just to rule out the public dns issue you were running into earlier

[surreal heron]

ok brother thanks

[next bronze]

it does but this can happen if you have a bad connection

or your connection is unstable

[plain trellis]

but my connection is pretty stable. I tried resetting it multiple times as well but still didn't work.

[next bronze]

try with the latest stable build of ligolo

[sick whale]

I struggled the same way when I did it 2 days ago with ligolo... Ended up doing the second pivot with netsh.
Too bad because ligolo is super user friendly and easy to use

[plain trellis]

I was using 0.7.2 alpha something are you referring to the same?

[sick whale]

If it's alpha it's not stable

[next bronze]

I've been using 0.6.2

[quiet trout]

hey can anyone tell me how to handle when you either a) accidentally run the wrong cmd on a nc listener and redo it only to get target port in use (and lsof -i :9001 returns nothing) or b) when you occupy a common port like 8080, terminate the listener then need ot run burp and its occupied (and is still not listed in your lsof...) ... i run into this every so often and i have to reset the box to solve this... its frustrating.

[sick whale]

Last stable is 0.6.2 indeed

[plain trellis]

I'll try with one too

[limpid hemlock]

See i dont get any bat file when i restart the service after disabling that auto deltion in attacking thick clietn apps section

[sage rapids]

Hello everyone I am a first-year student, and I have a difficult choice: I want to become a pentester, or rather, a specialist in reverse engineering or web pentest, but the training, of course, will be very difficult, and I want to first study to be a DevOps engineer, then work for DevOps and eventually switch to pentest. What would you recommend to do?

[somber fiber]

1 thing i learned go where the heart takes its your choice not ours

work is fun as long as you make it fun

not after that

[dim wolf]

i think DevOps experience will help with securing an IT job, but this would be better discussed in #careers-and-certs

[median gale]

Any idea what the second IP is for?

[dim wolf]

if you don't have access to the channel, please verify your account by following the instructions in #welcome

[quiet trout]

you're young enough that if you put in the effort you can try them all, get your ducks in a row then work a year doing this and a year doing that and see what you like

youll never really know unless you put time into trying it

[somber fiber]

must be related to module

[median gale]

No wonder Sherlock !

[quiet trout]

prob a DC and a host on the domain

or two DCs perhaps

or a DC and a DNS/DHCP server, you'll need to connect and see

[median gale]

Cant connect though get the log in prompt and the pass isnt valid

[somber fiber]

explore and take a sip of every drink and find which you liked the most in serial you have time to explore so take your time

[quiet trout]

xfreerdp? try a vnc instead?

oh i see you're using xrdp, unfamiliar with that one you should try xfreerdp

your user name may not be FQDN, being rejected by login prompt. xfreerdp ful full syntax should resolve this as a sanity check

[median gale]

xfreerdp i am using

[sage rapids]

Thank you all for giving me the advice💚

Just to hack something, you need to know how it works and I thought that DevOps would be a great option, I would know how databases and SQL work, etc

[median gale]

I disagree

[patent sky]

There is a problem in the module ATTACKING COMMON SERVICE, section ATTACKING EMAIL SERVICE, i am doing the right command but it's not working anymore, it worked once on pwbox and never on my vm , any hint ? The command is smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t <ip adress> also to crack the password it's not working... hydra -l m*****@inlanefreight.htb -P password.list -f <ip adress> smtp

[median gale]

Are you connected to vpn right?

[patent sky]

I am

[median gale]

What isnt working the user enum or hydra?

[patent sky]

Both

user enum worked once

[median gale]

What error does each one print ?

[patent sky]

None, it's just saying nothing was found...

[median gale]

Ping to the ip does it work?

[patent sky]

But the user enum worked once and i changed nothing soo

Ping does work

[somber fiber]

it take time

[patent sky]

It says it doesn't find anything

[median gale]

No...

[patent sky]

It goes to the end

[median gale]

Try enumerating users with other tool

[somber fiber]

ok

[patent sky]

I ll try what you said

[somber fiber]

you are enumerating the user right?

[patent sky]

Yes, i want to find the username

[somber fiber]

dang it i droped the spoiler

[patent sky]

I find it since the command worked once

[somber fiber]

insted of RCPT try use VRFY

[somber fiber]

you are working on footprinting module?

[patent sky]

No, i am on the attack common services, email section

[sage rapids]

With what?

[patent sky]

did it work on your side ?

[somber fiber]

yes

it did

[limpid hemlock]

Hey could someone help me out with the attacking thick client applications section in attacking common services module

I have disabled the auto deletion of files in the temp folder and again run the .exe file in that section and checked the temp file for the mentioned bat file that was supposed to be in the temp file now since that have turned off the auto deletion part but i dont see that bat file in the temp file

[patent sky]

The hydra too ?

[somber fiber]

got the user?

[patent sky]

Yes

[somber fiber]

try hydra with that.

[patent sky]

looks like it's working again, gonna try to hydra

everything is working just fine, they did something or maybe it was lagging but i didn't change anything in what i typed

Thanks for the help ❤️

[somber fiber]

lovely

[vale island]

Did i miss something? We have macOS modules now?

[jolly yacht]

It's already been there.

[vale island]

Didnt see that before, lol

[fathom pendant]

smtp is a slow service

[fathom pendant]

Been there for ages

It requires having access to a MAC

[somber fiber]

thats why i said it takes time

[jolly yacht]

Really?

[fathom pendant]

...yes

It's kinda hard and less than legal/easy to emulate a Mac

The MacOS isn't really available

And if you do find it, you'd need an ARM chip

[jolly yacht]

Yeah, I remember downloading mac os iso and trying as a VM and really had a bad time lol.

[fathom pendant]

Yeah

A lot of Apple stuff is proprietary so...

[jolly yacht]

Understandable

[rustic sage]

Hi HTB Folks. I am working on the Whitebox Attacks - Type juggling assessment and I could really use a nudge. Anybody on who might be able to help?

[fathom pendant]

https://dontasktoask.com

[rustic sage]

In the Whitebox Attacks - Type juggling assessment am I supposed to stick to the Sha256 magic hashes and am I correct that the username has to include 'admin' in it, but it cant be at the beginning? I've been working on this for 3 days and I am not sure what else to try

[limpid hemlock]

Any help

[somber fiber]

haven't pulled enough money to unlock this module same for mac one

sorry

[somber fiber]

can someone give me hand to run one command and give me the result of it?

[shrewd bolt]

#rules keep it legal

[quiet trout]

Anyone have trouble spawning targets

[storm elk]

That would be illegal

[limpid hemlock]

Any one knws why the bat file isnt shown here

This is from the thick client attacking in attacking common services

[shell ore]

did anyone here faced problems setting/downloading sliver?

[shut quest]

Go through the steps to make sure you're setting permissions correctly. I just did this seconds ago to confirm.

[limpid hemlock]

Ivde been doing this

From yestrday no idea what im missing

[shut quest]

All I used were the steps in the module

[limpid hemlock]

Mm

[uneven cairn]

sdfadfasfdosajfopaejfioewjpfoiewjewfpoiqwjefopwjoiwjfeiqw

[limpid hemlock]

I thought i disabled the auto delete stuff but i dont knw if its still deleting

[fathom pendant]

Bless you

[fathom pendant]

You just need to disable the delete perms for your user

[storm elk]

Did your keyboard have a stroke? 😅

[limpid hemlock]

I did

Thats whats troubling i did many times but still i think the bat file is getting deleted

[shell ore]

hi cat

[fathom pendant]

then you didn't disable it properly after turning off inheritance

[limpid hemlock]

I disabled it clicked on edit on cybervaca and turned the tick off on

[shut quest]

If you did it correctly the bat file will be exactly where is says it will be

[limpid hemlock]

Clicked ok apply ok and then again run the exe

But i did get this error

[fathom pendant]

Hit continue

Some things you can't apply it to

Since you're basically trying to cascade the permissions

[wanton jasper]

I am working on the sqlmap section Q: What's the contents of table flag4? (Case #4). This one wants to use JSON but I am not sure how to copy the request as JSON?

[fathom pendant]

The module should show you how to copy the request

[wanton jasper]

Yes I can copy as curl but not as JSON.

[limpid hemlock]

Ya after all this i ran the exe but still the bat file is geting deleted i think

[fathom pendant]

Did you hit continue until no more errors?

[limpid hemlock]

Yup

[granite slate]

For the Sliver C2 module, I'm running into issues with generating a stager on my local attack box which works on Pwnbox when repro'd.

The following command times out with this error:

sliver > generate stager --lhost 10.10.X.X --lport 8443 --format csharp

[!] Error: rpc error: code = Unknown desc = exit status 1 - Please make sure Metasploit framework >= v6.2 is installed and msfvenom/msfconsole are in your PATH

However, running the equivalent msfvenom command directly will generate shellcode

## Command
$ msfvenom --platform windows --arch x64 --format csharp --payload windows/x64/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=8443 EXITFUNC=thread

## Environment
$ msfconsole -V
Framework Version: 6.4.20-dev

$ which msfconsole  
/usr/bin/msfconsole

$ which msfvenom  
/usr/bin/msfvenom

$ which sliver
/usr/local/bin/sliver

$ sudo systemctl status sliver
Active: active (running)
CGroup: /system.slice/sliver.service
        └─<PID> /root/sliver-server daemon

For further context, I installed sliver with the provided one-liner & reinstalled metasploit-framework via apt. Anyone with troubleshooting advice or experience with this one? Also if needed, I can repost this on #1024429874246590575 for futher outreach. Thanks!

[fathom pendant]

sigh when you copy the request (not as curl or anything) it also copies the data type, like json

[limpid hemlock]

Still no bat file in the folder

[fathom pendant]

¯_(ツ)_/¯

i didn't have any issues with it

[limpid hemlock]

Im having i dont knw why the temp file is getting

Delted for me

[fathom pendant]

i'm assuming you're going to the user's temp folder and not C:\temp

:)

and disabling the permissions there

[limpid hemlock]

I was going to c users cybervaca appdata local temp

And disabled perimisons there

In temp

[fathom pendant]

The file you're looking for may not be under \2

Look through the other folders

[limpid hemlock]

Yaa

I dont have anything inside 2 justched file and hyperfdata cybervaca file nothing else however outside in the temp folder i got all thees files

[fathom pendant]

Dude

The d52e.bat...

Check that

The batch file name is random each time it's ran

[placid quest]

@granite slate Same issue happening to me since yesterday 😪

[limpid hemlock]

How did u check the contents of bat file

[fathom pendant]

Right-click > edit or in powershell cat [file].bat

[limpid hemlock]

Yaa

[fathom pendant]

The important bit is towards the bottom

That's the top, sir

[limpid hemlock]

Yes

[fathom pendant]

I said towards the bottom

[limpid hemlock]

Got the bottom delted it and saved

[fathom pendant]

... why did you delete it?

I forget if that's a step

[limpid hemlock]

Ya ut was a step

[fathom pendant]

But was it a step to delete everything

[limpid hemlock]

The code was delteinh a service exe

So i removed that part and saved it l

[fathom pendant]

Or just the parts removing the additional files

:)

Reach out to support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[uneven cairn]

Does anyone know how I can list the contents of a directory? sqlmap http://ip:port/dashboard/dashboard.php --data "search=a" --batch --level 2 --risk 2 --random-agent --cookie="PHPSESSID=pj3po8630q4ohs78mo1ma3cfv6" --file-read "/root/flag.txt" --output-dir "/tmp/memehp3"

[fathom pendant]

The step in the reading stated modifying the batch file to only remove the parts regarding deleting files

[fathom pendant]

What module and section is this for?

[uneven cairn]

SQLMap Essentials skill assesment

i cant get web shell for the permissions for the current db user

i just almost got it but dont know how spot where the flag is

[fathom pendant]

Why do you need to read a file? That's not what the skill assessment is asking for

[uneven cairn]

lol

[fathom pendant]

Also are you sure that's where you're meant to be injecting?

the sqlmap essentials module SA is asking you to get the contents of the table final_flag ¯_(ツ)_/¯

No idea why you need a shell or anything for it

[uneven cairn]

Yes, you are right, well seen for some reason it was in the skill assessment of another module xd

[fathom pendant]

¯_(ツ)_/¯

This is why you only focus on one module at a time

[storm elk]

Marcie, did you use codecademy before?

[fathom pendant]

probably breifly

[storm elk]

Ah okay. I am thinking about following a python course lol

[uneven cairn]

@fathom pendant i still having the same question but for:
SQL Injection Fundamentals

Skills Assessment - SQL Injection Fundamentals

Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Submit the contents of the flag as your answer.

[young smelt]

Hi, I have a question about Windows Lateral Movement - Skill Assessment. I cannot enumerate internal network. I'm using proxychains + nmap and don't get any open ports... I did try some powershell scripts for it but it will take ages until done. Can you give some hint? What techniques did you use to find hosts and open port in internal network?

[fathom pendant]

Root directory of filesystem != /root

[uneven cairn]

sqlmap by itself search for common root directories like /var/www/html

[fathom pendant]

Well you said you have a working webshell

And sqli fundamentals doesn't require sqlmap to complete

[uneven cairn]

im trying get one

[fathom pendant]

Recall the steps in one of the module sections

Also you don't need something fancy just a basic php shell will get the job done

[limpid hemlock]

Hey i try to run powershell cmd but powershell doesnt load anytime

Pwershell.exe

[fathom pendant]

Run as admin

There's some gpo that doesn't allow it to be run as regular user

[limpid hemlock]

That too crashes

Once it opens it closes then itseld

[rocky mist]

""#poetry install
Installing dependencies from lock file

Package operations: 112 installs, 2 updates, 0 removals

`` • Updating pip (23.0.1 -> 23.2.1): Failed

Error

g-io-error-quark: The connection is closed (18)

at /usr/lib/python3/dist-packages/keyring/backends/libsecret.py:134 in get_credential
130│ Otherwise, it will return the first username and password combo that it finds.
131│ """
132│ query = self._query(service, username)
133│ try:
→ 134│ items = Secret.password_search_sync(
135│ self.schema, query, Secret.SearchFlags.UNLOCK, None
136│ )
137│ except GLib.Error as error:
138│ quark = GLib.quark_try_string('g-io-error-quark')“ "

why do i get error installing poetry

[uneven cairn]

the problem with using --batch the cookies of a non authorized user was taken by sqlmap and merged there just solved manually telling for no to do that

[rocky mist]

poetry run crackmapexec Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python3.11/importlib/__init__.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "<frozen importlib._bootstrap>", line 1206, in _gcd_import File "<frozen importlib._bootstrap>", line 1178, in _find_and_load File "<frozen importlib._bootstrap>", line 1149, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 690, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 940, in exec_module File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed File "/home/aesliex/Desktop/CrackMapExec/cme/crackmapexec.py", line 3, in <module> from cme.helpers.logger import highlight File "/home/aesliex/Desktop/CrackMapExec/cme/helpers/logger.py", line 5, in <module> from termcolor import colored ModuleNotFoundError: No module named 'termcolor'

how can i fix this?

[shut quest]

Slightly unish related question, what module are you working on?

[rocky mist]

module/147/section/1327

password attacks in pentester path

[shut quest]

Password attacks, what section? Numbers don't mean anything to anyone here.

[rocky mist]

network services

[shut quest]

So you're trying to install cme from source?

[rocky mist]

i installed it using gitclone, but when i do poetry run crackmapexec it doesnt work

i tried apt-get install -y libssl-dev libffi-dev python-dev build-essential but it didnt work

it said this error - apt-get install -y libssl-dev libffi-dev python-dev build-essential
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package python-dev is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
python-dev-is-python3

[rotund plover]

Question so I am doing the Active Directory Enumeration Attacks and I am suppose to get the password policy from inlanefreight.local you are giving the outward face host ip and SSH credentials. I ssh into the host and search the /etc/hosts to see if inlanefreight.local is there and it is. I tried to ping its assocaited address and get host unreachable. I also wanted to comfirm with nslookup inlanefreight.local to see if it could get resolved and nothing showed. Why would the hosts be unreachable?

[shut quest]

I'll save you some potential heartache. Netexec is the replacement for crackmap

https://github.com/Pennyw0rth/NetExec

[rocky mist]

oh tyy

[analog dock]

Module Injection Attacks, section Exploitation of PDF Generation Vulnerabilities. How do you properly enumerate the internal web application? The payloads in the section mostly show errors for me

[tender nimbus]

Hey @fathom pendant i have a question for you, i want to be a pentester in the future, on the platform, do you recommend to do first all the general moduls?

@analog dock you can also give you meaning ^^

[analog dock]

why are you randomly pinging people

🥲

[tender nimbus]

its not random its bcs i see you guys helping a lot so i concluded that you have more knowledge and probably beter advice to give ^^

[analog dock]

Im rarely in here

[tender nimbus]

hmm rare i saw you a few times, so do you have a lot of knowledge? I mean what should you suggest

[median gale]

How do we display these edges on Bloodhound?

[analog dock]

Theres literally a pentester path on academy

So idk what else you want tbh

[tender nimbus]

i know i also doing it but the thing is that in this path they also give you modules to do where you don't immidiatly have acces to like tier IV modules so what is the point for going further by skipping modules you can't do

[uneven cairn]

SQLMap Essentials

Skills Assessment please give me a hint, i have looked in all the page and i cant find yet what form sends a request

[paper lance]

-- skip_ssl at the end should fix this

[fathom pendant]

Look for a button that triggers an event

Have the network tab open the whole time too

[mortal mirage]

Hey

[rustic sage]

anything like crackmapexec but for windows. i got a user and want to run creds across whole ad subnet.

[safe star]

I meant wydm 😂, but that’s cool, just trying to finish the the cpts path myself

[fathom pendant]

What academy module is this for?

Read and follow #welcome to access more of the server

[rustic sage]

ad enumeration and attack skill assessment. also asking for general purpose too

[fathom pendant]

I mean powerview is a good tool

But in general you want to use pivoting techniques where you can

My strategy for tools to use are grabbing them from the target boxes from the module

:]

Also netexec >> crackmapexec

[safe star]

Doesn’t netexec have a windows version?

You should be pivoting like marcielee said tho

[rustic sage]

Need something for windows. Powerview requires scripting (will see this). Asking one other thing about approach. so i got creds with kerberoasting. now i want to check which machine the creds belong too. is this the right approach. I dont know which machine will get unlocked by the creds.

[rustic sage]

Thanks. I dont know which machine (dont know ip or name of host) i can get access to using creds. so checking full subnet

[safe star]

U need to use a pivoting tool and u can do it from Linux with crackmapexec

[safe star]

U can do a ping sweep

[rustic sage]

pingsweep gives list of active hosts. Bruteforcing part is stil the same. lets try using netexec. Also am i doing this right? (asking as per methodology)

[safe star]

Where are u getting bruteforcing from?

Why don’t you just do everything from your Linux machine?

[rustic sage]

apparently the internal ad seems not to be accessible from the outer machine. nxc or any other linux tool gives "Failed to create connection object for target 172.16.6.59, exiting... "

[safe star]

Yes, we said to use a pivoting tool to get access to that like 3 times

Why do u keep ignoring the pivoting part of my sentences 💀

Do you know how to pivot?

[rustic sage]

not ignoring. reading about pivoting rn.

[safe star]

Learning pivoting is a whole lesson itself

It’s recommended to do pivoting then the ad module

[rustic sage]

Going for it now. Thanks a lot brother

[jovial mural]

Hi, recently subscribe to the Silver Plan where you get 200 cubes each moth is it accumulative or does it clear each month??? Thanks in advance.

[old oasis]

its accumulative

[uneven cairn]

@fathom pendant I already found the parameter, I don't understand why automated tools don't detect it

[river marsh]

about to get started on my HTB journey, i understand its a more hands on approach which i enjoy, but does anyone have any tips/best practices theyve found when it comes to note taking of what i should make notes of as i procedd?

[unique ether]

I used the command to disable av in the windows infiltrating exercise but when I went to setting it's still on

I solved the lab but I was wondering why that happened

[shut quest]

Whatever style of notes that work best for you . Everyone is different. Some like taking huge chunks from the material, others like rewording the material into a way they understand. I like doing a little walkthrough for each section capturing commands and output.

Bare minimum document every user/credential/hash/key you come across, you never know when another section in the same module will use the previous findings.

[river marsh]

def dont wanna deal with my hand writing for that, do you just use a word doc or do ya have a note taking app youd reccomened?

[shut quest]

Most around here use Obsidian, but there's notion, cherrytree, one note, Joplin, and more.

[river marsh]

ive heard of obsidian before, will give it a look. thank you!

[jovial mural]

Thanks @old oasis

[fathom pendant]

If you're doing the pentester path. Pivoting comes before ad

[river jetty]

I'm having trouble with this question: Some PowerShell code has been loaded into memory that scans/targets network shares. Leverage the available PowerShell logs to identify from which popular hacking tool this code derives. Answer format (one word): P____V___.

I currently filtered for powershell.file.script_text and ranged it in between the dates of the intial breach. Then I searched for P*V within the text block

Any help would be great

[fathom pendant]

Well your issue is trying to directly look for the broad tool name

Instead of identifying what the code does, and identifying what invoke/get/whatever command is used and correlating that to the tool

[river jetty]

Without something to lessen the load then I'll manually be looking at 100s of logs.

[silver lantern]

Hey guys,
I just started the pentest path and I’m using a local machine with openvpn. Connection is successful but on the module, I’m not able to reach the IPs they are using. Any idea how I can fix this issue? For instance I’m told to run nmap 10.0.0.5 but the host is down when I try it locally

[fathom pendant]

What module and section.?

[fathom pendant]

Well that's an example ip, so it won't be reachable

[river jetty]

Threat Hunting & Threat Intelligence Fundamentals
Hunting for Stuxbox
Question 3

[silver lantern]

Oh😂. Thank you. I thought those ips were live

[fathom pendant]

Only the targets spawned by "Click here to spawn target!" Are live

Also the scope of internal ips is 10.129.0.0/16 iirc

Aka only start with 10.129.x.x

[fathom pendant]

Did you try googling some of the log entries?

[silver lantern]

Thanks!

[fathom pendant]

Just copy/paste into google

[river jetty]

Welp

That was 10 secs to the answer

Thanks a lot lol

[fathom pendant]

¯_(ツ)_/¯

Overthinking gets us all

[shut quest]

#rules 5 keep it English

Also not the place for that see #welcome

[latent relic]

règle n°5, restez en anglais, vous n'obtiendrez pas de réponse en français. @mortal mirage #welcome

Just in case they don't speak English

[fathom pendant]

A silly little skid video

[dim wolf]

please don't promote your content here

[limber river]

french ew

[fathom pendant]

Voice mod as well making it barely audible, even for french

[rustic sage]

Hoping for some guidance of those who have completed this section. In the Whitebox Attacks - Type juggling assessment am I supposed to stick to the Sha256 magic hashes and am I correct that the username has to include 'admin' in it, but it cant be at the beginning? I've been working on this for 3 days and I am not sure what else to try

[mortal mirage]

Please🙏

[ocean night]

The hell is that link

[shut quest]

Again?!

[ocean night]

@mortal mirage give it a rest, read #rules

[sweet jewel]

there was a link? can I click on it?

[ocean night]

..and you got a thumbs down

[sweet jewel]

oh, it was just a YouTube link that's lame. i thought it was a phish

[rustic sage]

In the Ad attack skill assesssment 1. How we are supposed to transfer other tools from linux to windows. It only allowed rubeus.exe and mimikat.exe. other than that no other outside exe are allowed or is getting filtered by. I'am trying to upload the ligolo-ng to the windows. So far i have tried the upload method in the web shell as well as the pythohn server and the impacket- smbserver. Apparently the server i have access to does not allow http protocol.

i even tried exe2hex, but somehow it also get filtered by the av too.

[limber river]

no need for all off that

you should be able to transfer files using one of the method you mention

[shut quest]

Keep it simple, and build up from there

Also there's no av in that module

[rustic sage]

BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

Unable to complete transfer.
ERROR CODE: 0x80200013 - The server does not support the necessary HTTP protocol. Background Intelligent Transfer Service (BITS) requires that the server support the Range protocol header.

[limber river]

never seen this before

[rustic sage]

even the python http server is not working too.

[limber river]

you are trying to upload from your machine (linux) to the target (windows) right ?

[rustic sage]

yes

i have a windows reverse shell. if that matters

[shut quest]

You try wget or curl.exe?

[limber river]

or maybe just smb

net use ....

[tender nimbus]

Hey guys im stuck on file transfering

I started an ftp server on my local machine but my commande on the remote host doesnt work any ideas?

[fathom pendant]

Is your ftp server hosted on your filesystem root?

[tender nimbus]

No from user

[fathom pendant]

Then why are you trying to specify the /home/user, from the perspective of the ftp connection its looking for /home/user/home/user... from your request

The other thing not being able to connect to your server

But I'm assuming that 10.0.2.15 is your tun0 ip

Though usually I've seen those ips as 10.10.x.x.

[tender nimbus]

no its my enp0s3 ip

[fathom pendant]

Well that's why it can't connect

[tender nimbus]

Okej thank you just need to find the right path know 🙂

[fathom pendant]

The spawned target doesn't have a route to your enpos ip

Use the tun0 ip to connect back to

:)

[limber river]

tun0 is usually the interface used by the vpn

[fathom pendant]

^

Your enpos ip is your own local network

[tender nimbus]

Okej but i don't really understand what you mean with the file path? Should i not right the whole pwd?

[rustic sage]

not working

[fathom pendant]

Yes

Whenever you host a fileshare, the share starts from where you're sharing from

It would be kinda scary if you could arbitrarily grab any file from any arbitrary Share point

[shut quest]

I'd assume your command is wrong but without providing anything to go off of ¯_(ツ)_/¯

[limber river]

if your ftp is hosted in /home/user , and you did like ftp://ip/home/user , it will go to /home/user/home/user which is not the right path

[tender nimbus]

Ow okej get it thank you guys

[fathom pendant]

You specify the relative filepath from where the share is hosted

So Downloads/upload_win.zip

[rustic sage]

On the receiving end running,

nc -l -p 1234 > out.file

will begin listening on port 1234.

On the sending end running,

nc -w 3 [destination] 1234 < out.file

used this btw its blocking outer tools like ligolo-ng and not rubeus. I think it has something to do with htb.

[tender nimbus]

Got it thank you for the information

[rustic sage]

@shut quest

[limber river]

there's no AV, so nothing is really blocked

if you can show us , which cmd you running

it will be easier to debug it

[rustic sage]

unable to send image here

[limber river]

#welcome

[shut quest]

Doubtful, why not try setting up a simple python http server from your machine and assuming you have powershell on the remote end using wget ip:port/file -o file

[rustic sage]

worked. if i use wget http:// it doesnt work. Thanks a lot.

[wanton jasper]

whats the deal with sqlmap "What's the contents of table flag5? (Case #5) " it keeps giving what looks like parts of a flag. Have restarted several times

[rustic sage]

Hello, I'm completely new to all of this and want to get into cyber security Eager to learn anything and everything. I need guidance/mentor
Dms are open

[safe star]

u still on this?

[fathom pendant]

You'll need to repeat it a few times to piece together the fill flag

[wanton jasper]

No, I took to the forums and saw several had to keep restarting the lab and eventually got it to work. I hope the exam is not that buggy lol

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

Unless you're willing to pay me $1k/week I don't do mentoring

And even then I'm underselling myself

[limber river]

[rustic sage]

ways to transfer tools to the internal pwned machine when pivoting.

[limber river]

check transfer files module

[steady valve]

what the hell am i looking at

the sudden jump from finding a flag with the find command to this is crazy

i dont understand a thing this section told me (linux privilege escalation > special permissions)

[cloud urchin]

re-read it then

[limber river]

then re-read it

[steady valve]

ive tried, what i understood is that some files can only be executed/read/modified/whatever by a certain group with permissions to do so or to do it as another user with those permissions

but i feel like its so briefly touched upon

[cloud urchin]

that's pretty much it what don't you understand?

[limber river]

check linux fundamentals Permission Management section

[steady valve]

what the question is asking me and i guess a breakdown of the commands they gave me

find / -user root -perm -6000 -exec ls -ldb {} ; 2>/dev/null

[shut quest]

Did you visit any of the links on the page that you read?

[cloud urchin]

ask chatgpt to break down the command

[steady valve]

like i get most of this, but -6000 is whats throwing me off

[limber river]

-6000 it's a SGID

[steady valve]

i did, but its still not clicking for me

[limber river]

it allows you to run binary, as the group who own it

[cloud urchin]

as far as the questions, there are binaries with the setuid and setgid bit set and it just wants you to find them with the find commands that locate them

chatgpt will tell you exactly what each part of the command means

[steady valve]

so if im part of the group with SGID 6000 i can run that binary?

[steady valve]

worth a shot honestly, didnt cross my mind

[safe star]

how does ur htb look like that?

[steady valve]

how else is it meant to look

[shut quest]

From one of the links

Unlike the setuid bit, the setgid bit has effect on both files and directories. In the first case, the file which has the setgid bit set, when executed, instead of running with the privileges of the group of the user who started it, runs with those of the group which owns the file: in other words, the group ID of the process will be the same of that of the file.

[steady valve]

unless its dark theme and it syncs to systems settings and ive never known there was a light theme

[limber river]

just re-read the page in the link

[fickle topaz]

hello guys

please i need help

[shut quest]

Goblin please my eyes

[ocean night]

😅

[steady valve]

woah the fuck

thats sick

[fickle topaz]

in password attack hard lab i am trying to transfer a kdbx file form the windows target machine to my attack machine

[shut quest]

https://tenor.com/view/spongebob-squarepants-movies-animation-nicktoons-nickelodeon-gif-16452379

[ocean night]

javascript: (
function () { 
// the css we are going to inject
var css = 'html {-webkit-filter: invert(100%);' +
    '-moz-filter: invert(100%);' + 
    '-o-filter: invert(100%);' + 
    '-ms-filter: invert(100%); }',

head = document.getElementsByTagName('head')[0],
style = document.createElement('style');

// a hack, so you can "invert back" clicking the bookmarklet again
if (!window.counter) { window.counter = 1;} else  { window.counter ++;
if (window.counter % 2 == 0) { var css ='html {-webkit-filter: invert(0%); -moz-filter:    invert(0%); -o-filter: invert(0%); -ms-filter: invert(0%); }'}
 };

style.type = 'text/css';
if (style.styleSheet){
style.styleSheet.cssText = css;
} else {
style.appendChild(document.createTextNode(css));
}

//injecting the css to the head
head.appendChild(style);
}());

[cloud urchin]

that should be a serious rule break

[shut quest]

What's your question?

[ocean night]

What, light mode?

[cloud urchin]

ya lol

[ocean night]

Because if so.. yeah... it burns

[steady valve]

i hate light mode, but the creme color is really selling me

[limber river]

it hurts even with black glasses

[latent relic]

https://tenor.com/view/eyes-burning-my-eyes-spongebob-gif-5183364

[vocal river]

any hints for command injection skill assessment cbbh ?

[shut quest]

My hint is to go over the module.

[vocal river]

Finally yessssssssss 👍 Solved it

[hoary depot]

did you ever solve this?

[safe star]

what module

[spare path]

this is web fuzzing

final skill assessment

[fathom pendant]

It's suid + sgid

@spare path why are you filtering out 200 response code?

[spare path]

it floods the terminal if I don't

I guess that's my mistake

[fathom pendant]

Use a different thing to filter out

[spare path]

ok will investigate thank you

[fathom pendant]

As 200 response code will also be what the actual valid response will give

[spare path]

I did wonder that

regex would be my next guess

[fathom pendant]

Perhaps size may be a better filter

[spare path]

ah

[oblique dawn]

How are the exploit development modules in htb academy?

[cloud urchin]

i don't think there are any

[fathom pendant]

Yeah there's not really a maldev academy module

[cloud urchin]

i'd recommend maldev academy

[safe star]

have u tried a get request instead?

i remember seeing a -X POST in your command

[spare path]

ah I have not yet

[safe star]

get request shouldve been the first method you tried

[spare path]

trying this command will take a while to complete is this a sensible way to fuzz the GET? ||python3 api_fuzzer.py http://IP:PORT/admin/panel.php --timeout 5 -o||

[cloud urchin]

are you literally using IP:PORT or did you replace those with the actual ip and port?

[spare path]

I did replace

so the last lead I was following is the parameter ||accessID|| which the page will spit out to you if you do a basic curl I'm trying to figure out where to fuzz that param or how

[midnight galleon]

sqsh isnt returning any output for basically any comand

[safe star]

What is api fuzzer?

Did u try panel.php?accessID=

[spare path]

it's searching for valid endpoints

[safe star]

Wydm just use ffuf

[limber river]

ig you need ;

[cloud urchin]

i think i remember having issues with sqsh too and just used sqlcmd, worked great

[limber river]

I perfer msssqlcient

[midnight galleon]

this is mssql not mysql

[midnight galleon]

yeah i ended up using it

[limber river]

sorry my bad

[midnight galleon]

i found the pass of the mssqlsvc user, but auth with it isnt working

[limber river]

remember there's two ways of authentication

[spare path]

WOOOHOO I found it thanks folks!

everyone's advice was helpful in the end used most of it

[midnight galleon]

i guessed so but does this mean i have to rdp and go from there?

[limber river]

nah you can use -windows-auth

idk if this is the right name of options but check the help

[midnight galleon]

interesting

i wonder how does this works

[safe star]

Mssqlclient is great

Can just type a command and it does it for you

Like enable xp_cmdshell

[midnight galleon]

how does the windows auth part works?i thought that the mssql server authenticate from the context of a loggedin user

[limber river]

authenticate against the machine , instead of the domain

like local-auth in nxc

[midnight galleon]

but if for example the rdp port is closed, how are u still able to auth?

[cloud urchin]

re-read the section

d0s3nt literally gave you the answer

[limber river]

has nothing to do with rdp

[safe star]

Rdp isn’t only for domains

[midnight galleon]

What i understand is that, it uses your already loggedin session to authenticate you against the sql server

[limber river]

you know the difference between SAM and NTDS ?

[cloud urchin]

you don't need to post contents of the module

[midnight galleon]

yes

but this machine isnt domain joined right?

[limber river]

so local-auth authenticate against SAM

[cloud urchin]

you can authenticate against services if they have their own username/password scheme or you can authenticate against other things like windows

[midnight galleon]

i understand the concept, i want to know how it is done technically

[cloud urchin]

you've spent all this time asking about it over and over instead of just reading the section again

plus d0s3nt gave you the answer

[limber river]

the only way to know more is to open mssqlclient and read the code

[midnight galleon]

[lusty thicket]

[cloud urchin]

did you do the footprinting module already?

[tame gyro]

hello

[empty trout]

i was doing footprinting module and in domain enumration it is sending request to shodan to find moreinfo . when i tried it there is access denied (403 forbidden) i initialized my api key

[storm elk]

Hi

[empty trout]

then i was thinking maybe my credits are empty so i created new acc and then tried same error

[cloud urchin]

there's another parameter you need to add to your command to change it from service authentication to windows authentication, it's that simple.

[empty trout]

??

[cloud urchin]

403 means you don't have access to that resource

https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

[empty trout]

yeah i know but how come i dont have credits in shodan when i created new account

[cloud urchin]

403 doesn't necessarily mean no credits. it means the user you authenticated with doesn't have access to that resource. https://help.shodan.io/the-basics/credit-types-explained

i think the command is something like shodan info to see how many you have

i forget exactly but use the help option to find out

[spare path]

So I've found the subdomain and I'm just kind of pulling a blank on what to do next with this info. When I try ||ffuf -w common.txt -u http://subdomain.fuzzing_domain.htb:PORT/FUZZ -e .php,.html,.txt,.bak,.js -v|| I just get a bunch of errors piling up

I've replaced the exact port and domains etc for spoiler purposes

also where I can ask about help for VM networking?

[safe star]

its a vhost not dns record

u have to fuzz the host header

[spare path]

ok let me think on this

[safe star]

capture a request with burp and look at the host header

[unique ether]

Almost finished

[rustic sage]

Looking for a decent wifi hacking antenna on amazon and need some advice. Which one should I get?

[shut quest]

wrong channel #rules and #welcome

[spare path]

so I've found the vhost and now you're suggesting I look at the host header using burp suite? I haven't had to use burp in this module not too familiar with it.

I used the incorrect terminology earlier

[safe star]

dont bother with it rn if not familiar, i was just tryna give u a better look at the host header

[spare path]

I see

I don't really recall using the vhost for anything in the earlier lessons in the module kind of stumped now with what to do with it lol

I did see that it accepts xml?

so perhaps I could craft an xml post fuzz

[safe star]

they did go over vhost

[spare path]

yeah I reread the vhost section but don't see how it would apply to my situation yet

[safe star]

u just did

u found the subdomain

[spare path]

yeah gobuster gave me the subdomain by fuzzing the vhost

my apologies if I'm a bit dense on this still early in my learning process

[safe star]

yeah now add that subdomain to ur /etc/hosts

[spare path]

ah ok I did attempt that but didn't notice any immediate results will try again

[shut quest]

make sure you're adding to your hosts file correctly, ip sub.domain domain

[spare path]

aha I've progressed

thank you again

[spare path]

oh I see I think I may have incorrectly done it.
should it be:
IP subdomain.domain domain
or
IP subdomain.domain
IP domain

on separate lines

[shut quest]

all on one line

[safe star]

IP sub.domain

[shut quest]

if it's a different ip, then that's a new line

[spare path]

got it

[safe star]

u can also add it like this for multiple domains <IP> sub1.domain sub2.domain

[spare path]

neat and it's just a space to separate? I think I noticed tab was more ideal when separating the IP from the domain

[shut quest]

doesn't matter, whatever looks prettier to you

[spare path]

Completed Web Fuzzing! Thank you so much for all the help I was close to giving up.
https://academy.hackthebox.com/module/280/section/3140

now to go back and note down how I got there

[wispy pumice]

Is anyone good with Evilginx and how to create phishlet

[fathom pendant]

That has nothing to do with any academy modules that I know of

Read and follow #welcome to ask in #web

[limpid hemlock]

Hey in the attacking thick client applications im at x64 debugger place and i need to find the magic bytes from a type of map and protrction set to RW but inside that i dont seem to find the magic bytez MZ IN THE ASCII COLUMN

[fathom pendant]

Did you set the breakpoint to only the exit breakpoint?

[limpid hemlock]

Yes

[fathom pendant]

Did you start the program before or after only setting that

The map they want you to see is at exactly the same position, relatively

If you set it after loading the thing then you need to restart it

[limpid hemlock]

I started the program only after i went to options preferences and only makrked exit breakpoint

And in the result i only see one rw with map type but when i check it by double clicking i dont see the magic bytes in ascii

[fathom pendant]

There should be several if you did it right

Double check the settings

[limpid hemlock]

Yaa i only see one

With map rw

Mm

[fathom pendant]

Size should be 3000

[safe dock]

Guys my netcat is not grabbing the banner

All the time it's showing unknown ip portno , no route to host

[limpid hemlock]

Mm i dont thnk i find it im doing something wrong but no idea what us wro.h

Wrong

[fathom pendant]

Are you running the exe from the programdata folder?

[fathom pendant]

It helps to give your command syntax, what module and section you're on.

If there's no route to host; are you connected to the vpn

[limpid hemlock]

nop i wasnt i was running it from apps

[fathom pendant]

Basic netcat syntax is
nc ip port

[fathom pendant]

Run the one generated in programdata after all the other steps

[safe dock]

Yes I am connected but in every scan nmap shows host is down i guess it is because of the firewall , but I am unable to connect with nc unknown ip , no route to host

[limpid hemlock]

Ya in order to get a new exe they say we have to run a monta.ps1 script in program data i double clicked and run with powershell that monta.ps1 script but not new exe is gotten in that folder

[safe dock]

@fathom pendant I got it bro it was all that academy vpn , I downloaded it again and tried then I got it

[short sentinel]

Hi, anyone has face 403 error while trying to login to splunkbase from HTB acadamy lab? I am getting "03 ERROR
The request could not be satisfied.
Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.

Generated by cloudfront (CloudFront)
Request ID: uQYs5Yiu4F9gjvDk2NIn4294Exa2B91MuJoxWdxzVMOqiJvxhcjcCw==
" error

Thanks. I grab it from https://github.com/MHaggis/sysmon-splunk-app

[short sentinel]

I grab it from https://github.com/MHaggis/sysmon-splunk-app and it is working.

[somber fiber]

got it https://academy.hackthebox.com/achievement/badge/104300d5-7732-11ef-864f-bea50ffe6cb4

[fathom pendant]

One day they'll have an image for it

[somber fiber]

hope i don't have to use this achievement to look for that.

[spark spruce]

I am just waiting for day
when it will be added to CBBH path

[normal sand]

Module: Linux Privilege Escalation
Section: Containers
Link to section: https://academy.hackthebox.com/module/51/section/1588

I'm working on the question at the end of the section. I managed to import the container, initiate the image, and even started the container. However, the following command doesn't work for me:

lxc exec privesc /bin/bash
Error: Command not found

[unborn plaza]

Hi guys. When do you plan to put the video lessons in the academy? just reading is more stressful to learn

Anyone else think like me?

[normal sand]

I thought maybe it had to do with the location of the bash binary, so I checked:

which bash
/usr/bin/bash

So I tried the following command, but it still didn't work:

lxc exec privesc /usr/bin/bash

I then finally tried this command and it worked, but I didn't get a fully interactive shell:

lxc exec privesc sh

Would appreciate some insight into this. Thanks.

[somber fiber]

try any of this if it works

lxc exec privesc -- /usr/bin/bash -i
or
lxc exec privesc -- /bin/bash -i

we can try forcing him to open shell as intractive

maybe it will work?

[normal sand]

Neither of this works, and I just figured out why. Inside the image, there's no bash binaries located at either of the paths.

[somber fiber]

so its zshell?

[normal sand]

The reason the command below worked was because there was a sh binary in one of the PATH's folders.

lxc exec privesc sh

[somber fiber]

still you can try -- as a signal for end of command

try if this works

[normal sand]

Wdym?

[somber fiber]

-- This signals the end of command options for lxc exec, and everything after this is passed to the container's shell.

[somber fiber]

i tried it somewhere don't remember but it worked that time

[normal sand]

Yeah, I tried it in your commands.

I'm 100% sure it didn't work because the image in the exercise doesn't have a bash binary present in the image's system.

[somber fiber]

insted of bash use sh

lxc exec privesc -- /bin/sh
or try this
lxc exec privesc /bin/sh

does it have any login?

[normal sand]

Yeah, this works since that's the location of the sh binary in the image's fs.

[somber fiber]

so you got unblocked ?

[normal sand]

Unblocked??

[somber fiber]

now you can intract with shell ?

[normal sand]

Yeah

[somber fiber]

corporate lingo

[safe star]

yes this is why

[normal sand]

Thanks for the confirmation.

[patent sky]

Hello there ! Attacking common services Easy Lab, So, so far i found f**** credential, i tried to connect to ftp and i found nothing, when i try to connect to mysql doing : mysql -u f**** -p9******** -h 10.129.203.7 i get : ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it Am i on the right path ? I did something wrong ?

[safe star]

is it mysql or mssql?

[somber fiber]

there is one flag for this check an try that

not sure if that can get you through the SSL check

[patent sky]

it worked just fine, damn i am soooooooooooo bad

Thanks a lot

[safe star]

thats weird. I never got that error for the module

[somber fiber]

🔥

[limpid hemlock]

Ya in order to get a new exe they say we have to run a monta.ps1 script in program data i double clicked and run with powershell that monta.ps1 script but not new exe is gotten in that folder

Im doing the attacking thick client app in attacking common services any help somebody

[lofty phoenix]

does anyone else get netbios timeout errors when they run the spider_plus module from crackmapexec?

[slate axle]

hey guys, i'm doing Exploiting SSRF section in server-side attacks module, and the exercise wants me to download this tool using python 2.7 but the problem is this version of python is no longer exist in the machine also i can't find it anywhere, any suggestions on how to solve it ?

btw if i used any other version of python i got an error from the tool

[fiery berry]

I didn't need to use Gopherus to solve the lab, just to say that you can do it without it or by using any alternative tools you like.

[slate axle]

okay i'll see what i can do without gopherus

[acoustic owl]

You can try to install Python2

Download the Python 2.7 source tarball from the official Python website.
Extract the tarball: tar -xzf Python-2.7.x.tgz
Follow the installation instructions in the README file or use the following commands (no guarantees):
cd Python-2.7.x
./configure
make
make install

[slate axle]

it worked

thanks ❤️

[safe star]

did u block the file from deleting the exe?

[limpid hemlock]

took 2 days darn but finaly finieshed that mate thansk for everyone who droped in there pointers here it all helped tons

[safe star]

Was that just the powershell part?

[limpid hemlock]

Attacking thick client that section actualy people 2 points sometimes the initial bat file isnt spawned in the /2 directory ittl just be in the /temp directory
Next thing i got a bit stuck was at the debuging section i ran the restart service exe in the apps folder itslef but i need to do some stuff mentioned in the module and run a new restart service inside a programdata folder

[safe star]

That was the easy part unfortunately 💀

gl on the second part for that section

[limpid hemlock]

No i got stuck at two places i mentioned above that dragged me a bit

[safe star]

I’m talking about java reversing next section

[limpid hemlock]

Oh i havnt stared that yet took a breather will start it soon

[rough comet]

I did , lol

[quiet trout]

im not fully awake this morning, someone mind helping me better understand here on the Session Attacks module:

https://academy.hackthebox.com/module/153/section/1449

the site is vuln to csrf and we manip the email param, we use it to make a call back to our nc listener, and the listener receives a get req and turns over all the url params (prob cookies, need to check request), why is it doing this, and not just doing a GET on the (somewhat invalid) resource itself?

i have no javascript to return cookies/params to the nc listener in the POC

oh wait its the page source

... sorry, havent had my coffee yet... just came thru funny looking.

[next bronze]

is the target ip correct

[dawn fog]

i don't know why 4444 is there but the rest is correct

[next bronze]

well your rhost and lhost is the same

[dawn fog]

i'm guessing there not meant to be

[next bronze]

unless you want to eternal blue yourself, no

[dawn fog]

do i need to remove the end part after :

[next bronze]

put the ip only

[safe star]

remove the port number

[next bronze]

also don't bother with eternal blue, it's not gonna be that

[safe star]

arent those ips a bit diffrent from the other machines

[next bronze]

what module and section? are you just trying random exploits?

[safe star]

i dont think u can get rce on the 80-97 ip machines tbh

[dawn fog]

getting started public exploits

[dawn fog]

simpler terms please 🙏

[next bronze]

what makes you think that it's gonna be eternal blue

go to the ip given in your browser and take a look

[dawn fog]

like do you mean to do a nmap?

[safe star]

no

just open it in firefox

[dawn fog]

oh, even i can do that

what next?

[safe star]

look at the question

[dawn fog]

Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

okay sorry to ask, but how do i identify the service running

[safe star]

look for version numbers and try to find an exploit

the example isnt going to be the exact same

u had a version number on the webpage

[dawn fog]

okay so your saying that there was a version number in the target i spawned

and if so, how do i find such thing

[pseudo kiln]

anyone knows how they get the terminal output to show nicely like this in obsidian ? from the reporting module

[next bronze]

that is not nice at all, the columns are not aligned

[safe star]

just looks like a code block

[safe star]

open firefox and its right in ur face

[pseudo kiln]

when I do code block it looks like this

for comparison

it's some white text on a greyish background, but theirs looks much better

[safe star]

it depends on your theme

[next bronze]

there's a code styler plugin