modules

[rocky estuary]

yeah also tried to use import-module for like powerview and that doesn't work also

[wary plover]

You don't need to import it in powershell the binary is enough

[rocky estuary]

can u explain ?

[wary plover]

I explained it here

[rocky estuary]

yes this i get i thought you talking about importing powerview

[wary plover]

I said you didn't need to import it into Powershell

And the binary on its own is enough

[rocky estuary]

.\powerview.ps1 "Get-Domain" like this ?

[wary plover]

Are you still talking about mimikatz or that you can't import powerview?

[rocky estuary]

forget about mimikatz i mean using powerview

i think i need sharpview

[wary plover]

You import powerview and that will give you access to methods like Set-DomainObjectAcl

You only import it once after that you don't need to invoke the script again

[rocky estuary]

yeah this is what i'm mean importing its not working for somereason

after importing when i use like get-module i can't see it there

[next bronze]

make sure that your copy of powerview is good

[rocky estuary]

it worked now thanks maybe bad transfer thanks

[old oasis]

@potent lotus Please, ask for permission here before DM'ing as per #rules nr. 8 and include the reason.

[quiet trout]

im on a diff module but currently using powerview, after import there doesnt appear to be a way to get it to return the included commands, get-module has an empty exported-commands (or w/e its called) and the get-command -module powerview.ps1 also returns empty, do you just refer to a readme on the github for the full list of uses?

or is there a better way?

im checking for a man page, perhaps but my target is respawning

not holding my breath, however

[next bronze]

get-command works
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-command?view=powershell-7.4

there are also a lot of docs on powerview functions

[rocky estuary]

i get this error with powerview commands
Exception calling "FindAll" with "0" argument(s): "An operations error occurred.

[potent lotus]

Sorry

[next bronze]

what are you trying to do

[rocky estuary]

Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName

[next bronze]

you're getting all domain usres and their spn, probably just timing out because there are a lot of users

there are better ways to kerberoast if that's what you're trying to do

[rocky estuary]

i tried mimikatz and rubeus both didn't work

[next bronze]

mimikatz doesn't do kerberoast

I'd recommend reviewing the kerberoasting section if you're having trouble

[rocky estuary]

i used it for listing didn't find anything

[next bronze]

huh? mimikatz straight up does not have the ability to do kerberoasting

[rocky estuary]

i understand now i can use it after running setspn.exe which will loaded it to memory , i tried to run setspn.exe its not working

[next bronze]

kerberoasting with rubeus is just 1 command

[rocky estuary]

i tried Rubeus.exe kerberoast i get this error LDAP query failed, try specifying more domain information or specific SPNs.

[foggy monolith]

Problem solved; turns out the word "PORT" in the hint was for submission, not for fuzzing. Hint should make that distinction more clear.

[next bronze]

have you considered maybe there's nothing to kerberoast?

[next bronze]

the hint has never instructed you to fuzz the port, you've already been provided one

[quiet trout]

yeah you'll see that in the modules PORT <PORT> IP, etc... be aware of another http://STMIP:STMPO/... i forget what the acronym means totally but its something like Target machine IP and target machine PORT

[manic bramble]

Hi there, I'm having an issue with module: Information Gathering - web edition - Creepy crawlies; reconspider.py is giving an error; scrappy module not imported

[next bronze]

did you install it according to the steps in the module

[manic bramble]

yup.. want me to send a screen shot?

[next bronze]

yes

any errors

[next bronze]

how is your pip broken on kali too 💀

try this #modules message

[manic bramble]

i think it was already install from apt

but thanks i'll try this

[next bronze]

uninstall the apt version then

[manic bramble]

kk

i'm trying to locate it

no luck

[next bronze]

meaning?

[manic bramble]

i think i found the package

[covert wyvern]

hey guys, i recently completed the AD enum & attacks modules but it gave me some trouble when trying to import powerview

[manic bramble]

bingo! thanks

[covert wyvern]

now that i've done it i figured i could ask if anybody else is going thru the same

i mean the assessments are perfectly doable without powerview, but i wonder what was wrong with the lab that no matter what i did after doing Import-Module .\powerview.ps1, i just couldn't use any PowerView command (Get-DomainUser for example)

other tools where usable (not going to say which ones since that could spoil something)

[wary plover]

did you make sure your installation was good?

[pseudo kiln]

get-module, is the module actually imported after you did import module ?

[next bronze]

if I had a penny for every person with this problem today I'd have 3 pennies

[covert wyvern]

lol

[wary plover]

millionaire

[covert wyvern]

so it's not just me then haha

[covert wyvern]

i don't really remember

[next bronze]

the previous two have problems with the file, make sure you've downloaded the correct one and transferrd properly

[covert wyvern]

i did it from a evil-winrm shell tho if that has anything to do about it

[wary plover]

nope

unrelated

[pseudo kiln]

well you can always go back and check

[covert wyvern]

i tried various .ps1 files from different github repos, https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 and https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

i also tried different transfer methods and checked the hash sum to verify it didn't get corrupted or smthin

[next bronze]

did you download the raw file

[covert wyvern]

uhh yea(?)

i recall doing that yes

[covert wyvern]

will do later

[next bronze]

hmm recheck the steps, it should work

[covert wyvern]

i mean the module is already done but i was wondering why that happened

[iron oar]

hello, anyone have experience with the module Windows Lateral Movement -> WinRM? I'm stuck on the last question and was hoping for clarification on a couple things

[rocky estuary]

AD skill assessment i'm stuck i got access to ms01 but i couldn't find anything there the question says weak creds so i did some enum on the password policy and found that the minimum password length is * so i thought of password spray but what could be the pasword i could use ?

[analog narwhal]

I'm working on the session hijacking module with blind xss and I've been hitting my head up against a wall for awhile now... I found the injectable field, crafted the .js file and .php file to run on my local server. I get back cookies but none of them work for the login.php form on the server. One of the cookies I get back looks like a flag but that doesn't work as the answer to the exercise. Any help is much appreciated!

[covert wyvern]

try with commonly used wordlists aaand be patient

[next bronze]

there are some in the passsword spray module you could use

[next bronze]

just ask

[iron oar]

Okay I have a PSRemote session on SRV02 as Leonvqz, I understand there is a kerberos doublehop issue here but when creating a new ticket with rubeus its still not letting me run Invoke-Command. I know we can also use ps-credential objects but we only have the RC4 hash for the user Leonvqz and it doesnt crack so I dont think you can create a new credential object for that user.

Inside SRV02:

[SRV02.inlanefreight.local]: PS C:\Tools> .\Rubeus.exe asktgt /user:Leonvqz /rc4:A35289033D176ABAAF6BEAA0AA681400 /ptt
...
[SRV02.inlanefreight.local]: PS C:\Tools> klist

Current LogonId is 0:0x54447

Cached Tickets: (1)

#0>     Client: Leonvqz @ INLANEFREIGHT.LOCAL
        Server: krbtgt/inlanefreight.local @ INLANEFREIGHT.LOCAL
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
...
[SRV02.inlanefreight.local]: PS C:\Tools> Invoke-Command -ComputerName DC01 -ScriptBlock { whoami } -Authentication Negotiate
[DC01] Connecting to remote server DC01 failed with the following error message : Access is denied. For more
information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (DC01:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionStateBroken
[SRV02.inlanefreight.local]: PS C:\Tools> Invoke-Command -ComputerName DC01 -ScriptBlock { whoami } -Authentication Kerberos
[DC01] Connecting to remote server DC01 failed with the following error message : WinRM cannot process the request.
The following error with errorcode 0x8009030e occurred while using Kerberos authentication: A specified logon session
does not exist. It may already have been terminated.

We have creds for helen and helen can authenticate but flag is under Leonvqz's directory (question also states to authenticate to DC01 as Leonvqz).

[SRV02.inlanefreight.local]: PS C:\Tools> $SecPassword = ConvertTo-SecureString 'RedRiot88' -AsPlainText -Force
[SRV02.inlanefreight.local]: PS C:\Tools> $Cred = New-Object System.Management.Automation.PSCredential('inlanefreight\helen', $SecPassword)
[SRV02.inlanefreight.local]: PS C:\Tools> Invoke-Command -ComputerName dc01.inlanefreight.local -Credential $Cred -ScriptBlock { cat C:\Users\Leonvqz\Desktop\flag.txt }
Access is denied
    + CategoryInfo          : PermissionDenied: (C:\Users\Leonvqz\Desktop\flag.txt:String) [Get-Content], Unauthorized
   AccessException

[covert wyvern]

well i just checked:

*Evil-WinRM* PS C:\Users\user\Documents> ls


    Directory: C:\Users\user\Documents


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        10/1/2024  11:05 AM         770279 PowerView.ps1


*Evil-WinRM* PS C:\Users\user\Documents> Import-Module .\PowerView.ps1
*Evil-WinRM* PS C:\Users\user\Documents> Get-Module

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Manifest   3.1.0.0    Microsoft.PowerShell.Management     {Add-Computer, Add-Content, Checkpoint-Computer, Clear-Content...}
Manifest   3.1.0.0    Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object...}
Script     0.0        PowerView


*Evil-WinRM* PS C:\Users\user\Documents> Get-DomainUser
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
Exception calling "FindAll" with "0" argument(s): "An operations error occurred.
"
At C:\Users\user\Documents\PowerView.ps1:5253 char:20
+             else { $Results = $UserSearcher.FindAll() }
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException
*Evil-WinRM* PS C:\Users\user\Documents>

[pseudo kiln]

get-executionpolicy, just in case ?

seems to imported right

[rocky estuary]

there's nothing about wordlist there

[next bronze]

if I remember right for that part you do need to use a credential object

[next bronze]

that's a different problem, probably timing out because you're querying all the users, try a simpler command

[next bronze]

there are common password examples there you can use

[covert wyvern]

*Evil-WinRM* PS C:\Users\user\Documents> Get-ExecutionPolicy
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
RemoteSigned

[pseudo kiln]

it should be bypass, try to set it with set-executionpolicy bypass -scope process

[iron oar]

how do you get PScredential object for Leonvqz with only the rc4 hash?

also shouldn't you just be able to ptt with rubeus? I'm not sure why that would fail but pscredential object would work

[next bronze]

why don't you pth with rdp then Enter-PSSession

[iron oar]

I was under assumption that you could use WinRM for all steps involved 😭

[analog narwhal]

Maybe I'm trying the wrong login page to use the cookie on? Trying wp-login.php and also tried a login.php under a different directory from the injection.

[covert wyvern]

*Evil-WinRM* PS C:\Users\no_spoilers\Documents> set-executionpolicy bypass -scope process
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
*Evil-WinRM* PS C:\Users\no_spoilers\Documents> Get-ExecutionPolicy
Bypass
*Evil-WinRM* PS C:\Users\no_spoilers\Documents> Get-DomainUser
Exception calling "FindAll" with "0" argument(s): "An operations error occurred.
"
At C:\Users\no_spoilers\Documents\PowerView.ps1:5253 char:20
+             else { $Results = $UserSearcher.FindAll() }
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException

[covert wyvern]

which command do u suggest i try?

*Evil-WinRM* PS C:\Users\no_spoilers\Documents> Get-DomainTrust
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
Exception calling "FindOne" with "0" argument(s): "An operations error occurred.
"
At C:\Users\no_spoilers\Documents\PowerView.ps1:6330 char:50
+ ... $PSBoundParameters['FindOne']) { $Results = $CompSearcher.FindOne() }
+                                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException
Exception calling "FindAll" with "0" argument(s): "An operations error occurred.
"
At C:\Users\no_spoilers\Documents\PowerView.ps1:19691 char:24
+                 else { $Results = $TrustSearcher.FindAll() }
+                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException
*Evil-WinRM* PS C:\Users\no_spoilers\Documents> Get-DomainGroup -UserName "no_spoilers"
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
Exception calling "FindAll" with "0" argument(s): "An operations error occurred.
"
At C:\Users\no_spoilers\Documents\PowerView.ps1:6663 char:20
+             else { $Results = $ObjectSearcher.FindAll() }
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryServicesCOMException
*Evil-WinRM* PS C:\Users\no_spoilers\Documents>

[next bronze]

ptt with rubeus should also work, but I might need to open a netonly session since it'll conflict with other tickets in kerberos

[pseudo kiln]

If I am thinking this right, you might be facing the double hop problem. Like you try to request information from the DC, but there is no credentials cached for evil-winrm to use; try creating a $cred object then provide it to the -credential argument with powerview commands

[next bronze]

huh how is that a double hop? the winrm host can reach the DC directly

[next bronze]

which host is this

[pseudo kiln]

hmmm, could be been a while since I did this, but I usually just throw fixes at it until one sticks

[covert wyvern]

damn that worked

*Evil-WinRM* PS C:\Users\spoil_user\Documents> $SecPassword = ConvertTo-SecureString 'spoil_pass' -AsPlainText -Force
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
*Evil-WinRM* PS C:\Users\spoil_user\Documents> $Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\spoil_user', $SecPassword)
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:5985  ...  OK
*Evil-WinRM* PS C:\Users\spoil_user\Documents> Get-DomainUser -Credential $Cred


logoncount             : 40
badpasswordtime        : 4/21/2022 4:29:52 PM
description            : Built-in account for administering the computer/domain
distinguishedname      : CN=Administrator,CN=Users,DC=INLANEFREIGHT,DC=LOCAL
<SNIP>

so it was a evil-winrm issue then?

[next bronze]

which lab and machine is this

[covert wyvern]

this is AD Enumeration & Attacks skills assesment 2

i'm trying now with MS01 but i was facing this from other hosts of the environment as well

[pseudo kiln]

Basically windows is complex when it comes with authentication. For example lets say you authenticate to that machine using psexec or RDP. Your credentials are getting cached on the Windows target. When you try to query the DC from that machine, windows will use the cached credentials in memory and provide them to DC to complete the request. With powershell remoting (evil-winrm), when you authenticate to a windows machine, the windows machine does not cache the credentials, so when you try to query the DC the windows machine has no credentials to present to it.

But like Xre0uS said, if your machine is directly connected to the DC, the problem is not there. The problem appears when you winrm into a windows machine, and from that windows machine you try to do actions that require credentials.

[covert wyvern]

alright

i'll add that to my notes to remember it whenever i use winrm

thank you guys

this was bugging me throughout the assesment even tho i managed to do it in other ways

[uneven cairn]

im not going to wait what is the answer: + 2 After successfully brute-forcing the PIN, what is the full flag the script returns?

[dim wolf]

no one is giving you the answer

[uneven cairn]

im not going to wait

[wary plover]

Yeah that plan won't work

[uneven cairn]

you telling me i have to wait 40 minutes for a simple task flag? are you seriously?

[dim wolf]

hacking is not instant gratification. do not expect answers to be handed out on a whim. not to mention it is also against the rules and ToS

[wary plover]

If you'd explain your problem a bit more people are more likely to help you

[gray yacht]

Which module/section are you working on?

[uneven cairn]

Login Brute Forcing

Brute Force Attacks

im just waiting for a succesfull pin but omg just too much time

[uneven cairn]

I know but a proof of concept should be less time consuming

[autumn pilot]

It doesn't take 40 minutes nor 10 minutes

It is around 3-5 minutes at the worst case scenario

[analog narwhal]

Just re-posting this if anyone is available to help w/ the blind xss / session hijacking module. Thanks!

I'm working on the session hijacking module with blind xss and I've been hitting my head up against a wall for awhile now... I found the injectable field, crafted the .js file and .php file to run on my local server. I get back cookies but none of them work for the login.php form on the server. One of the cookies I get back looks like a flag but that doesn't work as the answer to the exercise. Any help is much appreciated!

[gray yacht]

I don't think it will take that long.

[rocky estuary]

i created a list with kerbrute and i used all the passwords in the module using crackmapexec nothing worked

[uneven cairn]

I'm on my 3905th attempt, so they confirm that something is wrong and I should try again before restarting?

[next bronze]

what userlist are you using

[rocky estuary]

jsmith.txt

[next bronze]

why are you using jsmth?

you can get a list of all the domain users

[uneven cairn]

nope

[autumn pilot]

I did the exercise and I know how much it takes

[uneven cairn]

then you know you are wrong is more than 3-5 minutes as you say

[autumn pilot]

¯_(ツ)_/¯

[gray yacht]

I don't recall that being in the module, so it was likely updated. I would switch things up, i.e., vpn, reset the machine, etc.

[uneven cairn]

I already finished it, everything was correct, but it takes about 10-15 minutes

[rocky estuary]

ohhhhh bro i forget about that but even if i got the user and i got the password how i'm supposed to get the password like in a real test or exam ?

[old oasis]

DM me

[raven obsidian]

Guys I'm new can anyone be my teacher and teach me how to begin with it

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[next bronze]

can't tell you what's in exams but doesn't hurt to try spraying one or two passwords in the background while you work on other things

[uneven cairn]

@raven obsidian Don't send me DMs again without prior permission, this will be the last time, I'm not reporting you because you're new but so you keep it in mind

[dim wolf]

very few teach others. you are better off teaching yourself: #modules message

and also please read #rules

[raven obsidian]

Oh sorry guy

Thanks for ur replays btw

[vernal tapir]

Hey guys, am I allowed to ask for help here if I'm stuck on a part in the CPTS path (Academy)?

[wary plover]

Yes

[vernal tapir]

"After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer."

Now I'm using --script dns-nsid and have tried lots of possibilites. I've googled the answer and the command that gave him the answer doesn't do the same for me, I'd like to somehow figure out where and what I'm doing wrong, considering I tried the exact same command someone else did to get the answer

[nova wharf]

hey qq I got the flag for question one In the "Sqlmap Essentals - Attack Tuning" section but, its saying that its wrong.

[next bronze]

this is one of the few times where you should use pwnbox

[vernal tapir]

The command used: sudo nmap -sSU -p 53 -v --script dns-nsid 10.129.83.209
Response:

53/tcp open  domain
53/udp open  domain

NSE: Script Post-scanning.
Initiating NSE at 12:38
Completed NSE at 12:38, 0.00s elapsed

Oh for real is that my issue? I'm on kali

[next bronze]

yeah try pwnbox for this module

[vernal tapir]

Ugh if that works I'll be quite annoyed. Spent 6+ hours just on this question alone.

But, thanks so much dude.

[next bronze]

run it again, time based sqli ccan be inaccurate sometimes

[vernal tapir]

Yep.. that worked. 😦

[old oasis]

nice 😄

[nova wharf]

I think I see the problem the answer in the table has extra caraters that are not in the retrieved field

[vernal tapir]

Hopefully someone on HTB sees this and might make a note to use PwnBox, that would save others from wasting time for sure.

[nova wharf]

nope still saying wrong

[old oasis]

I use pwnbox as default then use VPN incase pwnbox fails me. But that rarely happens

[nova wharf]

Idk what to do here it the only answer I'm getting for Case#5 can I share the answer I'm getting I'll mark it as spolier

[opal nexus]

I have a question about 'Using Crackmapexec' module Skills assessments - throughout the module i used 'Ligolo' instead of chisel+proxychains because the proxychains doesn't work on the pwnbox. now on skills assessments it seems i have to use chisel+proxychains. is there a way i can bypass it instead of using my own attacking box +VPN?

[vernal tapir]

Yeah I like using pwnbox, but the specs and hardware of my laptop overpower the speed of pwnbox so I like to use my kali

[next bronze]

no for the beginning part you'll need to use chisel, you can switch to ligolo once you get a shell

proxychains does work on pwnbox though. you can use your own attack box but you'll still have to use chisel

[opal nexus]

Well for me it doesn't works. I've never figured why so i just went to 'Ligolo'

[next bronze]

underscore instead of \x03!

[next bronze]

it def works, plenty of people are using proxychains no pwnbox

again you can use your own vm if you want

[nova wharf]

Thanks

[opal nexus]

Can I DM you with screenshots? maybe you can help me troubleshooting?

[next bronze]

I'm hopping off soon, you can just send them here, someone else will come around

read #welcome to get verified so that you can send screenshots

[visual umbra]

Hey. Im in Login brute-forcing / Custom wordlist and have some problem with the task with grep: i use: sudo grep -E '^.{6,}$' jane.txt | grep -E '[A-Z]' | grep -E '[a-z]' | grep -E '[0-9]' | grep -E '([!@#$%^&].){2,}' > jane-filtered.txt but get : zsh: permission denied: jane-filtered.txt

[upper ruin]

Jull.

You aren't supposed to use Jane's info.

Read the start of the section again.

• hydra gives out false positives, might wanna try out medusa.

[upper ruin]

chmod ugo+rwx

[fathom pendant]

Btw

[upper ruin]

Hi marcie

[fathom pendant]

The > at the end

Is only for the last command

Which isn't being run with sudo

Piping commands doesn't inherit permission level

[upper ruin]

Lemme note that down.

[visual umbra]

Than. it was The > at the end

[opal nexus]

well the right terminal is the relay initiation, and the left is /etc/proxychains.conf

[upper ruin]

Can you help me out if you complete the section, cuz I tried hydra yesterday with Thomas Edison's info and got a lot of false positives.

[autumn pilot]

Try with sudo

[visual umbra]

i let you know

[upper ruin]

Ty, man.

Gotta finish attacks on common applications and go onto Linux priv esc.

I am so slow, didn't think it would take a year to complete the path.

[stoic basalt]

Is inlanefreight.com down right now?

[opal nexus]

It works. Thank you

[thick hatch]

Is anyone else having problems spawning targets in HTB Academy?

[loud dagger]

mine is working

[visual umbra]

Get the same error like you..

[loud dagger]

hey will i ever have to re-enumerate previous labs from the same section for something like credentials
like credentials you can find in the first lab but aren't used until the second lab
is that a thing in academy

[fathom pendant]

Wdym?

You mean for skill assessments? Or overall

The answer to both is it depends

[loud dagger]

yeah for skill assessments

shit

[fathom pendant]

You should always save credentials found

But the skill assessments are generally independent

[loud dagger]

yeah i'm saving the ones i've used so far and none of them work

because i found a list of like 200 credentials in the last lab

[fathom pendant]

I.e. you won't need credential info from the module sections for their skill assessments

[fathom pendant]

? What module

[loud dagger]

footprinting
second lab enumerating an mssql server and found a giant list of credentials, only one of which i actually needed
third lab enumerating an MX server, none of the credentials i've used work

[fathom pendant]

Yeah they won't

You'll need to start each as a blank slate

[loud dagger]

ok that's a relief

[fathom pendant]

There's more on the server than mail

[upper ruin]

.. someone is trolling

[loud dagger]

yeah i know there's a few other services running

[fathom pendant]

Iirc that one also relies on a udp service

[fathom pendant]

?

[loud dagger]

snmp is running but i got no luck with that yet

[upper ruin]

came into the vc heard someone use troll soundboard

[fathom pendant]

Did you run the enumeration tools?

[upper ruin]

X_X

[fathom pendant]

Reach out to admins

I'm not a mod/admin so I can't do shit

[upper ruin]

Nah, it's good, wasn't harmful, but made me jump out of my chair.

Waiting for a guy to join the Vc so we can comment the custom wordlist section.

[uneven cairn]

hi marcielee

[fathom pendant]

For which module?

[loud dagger]

yeah i need to read more about snmp because i still have almost no idea what it actually is

[upper ruin]

Login Bruteforcing? I am pretty sure it's that one.

[fathom pendant]

All the tools you need to enumerate are given to you

[loud dagger]

yeah i know

[fathom pendant]

What's your exact issue?

[fathom pendant]

Don't overlook your outputs

[uneven cairn]

skill issue

[fathom pendant]

You can get the community string

[upper ruin]

Hydra giving out false positives on Thomas edison's creds. Tried the pwnbox which gave no results instead of a false positive. I might try and use the long list of passwords.

[uneven cairn]

if you are not sure if is false positive you can try it manual

[fathom pendant]

Ah it's part of the new content, haven't touched that yet

[upper ruin]

I tried it manually, that's how I confirmed it's FP.

[fathom pendant]

False positive on a web page means your fail string is incorrect

[upper ruin]

Fail string?

[fathom pendant]

If it's an http post form

[upper ruin]

Oh..right.

[fathom pendant]

I don't know Medusa syntax, I generally use hydra

[upper ruin]

That's the false positive.

[uneven cairn]

if you rerun it still getting that FP?

[upper ruin]

Gives out different passwords.

None of which are correct.

[next bronze]

space in the password, probably messed up the request and triggered a different response

[upper ruin]

You are saying that in the wordlist there might be a space?

[fathom pendant]

You're missing the :F btw

[upper ruin]

Yeah it was on the other module but not here.

[fathom pendant]

I also wonder if they changed it to no longer show the sed syntax in the module

[next bronze]

isn't that a space in the password

[upper ruin]

Nope.

[normal sand]

Module: Windows Privilege Escalation
Section: SeImpersonate and SeAssignPrimaryToken
Link to section: https://academy.hackthebox.com/module/67/section/607

The following statement is taken from the section. What file transfer method would be ideal here (if you're connected using msssqlclient.py)?

let's first download the JuicyPotato.exe binary and upload this and nc.exe to the target server.

[plush solstice]

in windows attack & defenses after SSH to kali and trying to RDP to WS001 I get 14:03:39:776] [968:968] [ERROR][com.freerdp.client.x11] - failed to open display:
[14:03:39:776] [968:968] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

what am i doing wrong lol

[upper ruin]

Help them out, ima try different things.

[next bronze]

don't run as root

[upper ruin]

Try rdesktop or remmina.

^

[next bronze]

either http or smb is fine, xp_cmdshell is still a shell

[fathom pendant]

Nah their issue is running around as root

[plush solstice]

i havent used sudo at all.. it seems unsual to be root as default

[dim wolf]

welcome back

[next bronze]

wait, you're trying to rdp in ssh?

how'd you expect to see anything

[autumn pilot]

perhaps you've switched to the root user

[plush solstice]

i mean idk lol

[autumn pilot]

switch back to a normal user and try again

[plush solstice]

it says to ssh to kali and rdp to ws001

[uneven cairn]

to connect ssh just type man ssh

[plush solstice]

im just trying to learn i didnt make these modules

[dim wolf]

you can ssh with X11 forwarding and then RDP to WS001

should pop open a RDP window on your machine

[next bronze]

you're probably more familar with that module, but isn't ws001 directly accessible with another ip?

[normal sand]

By HTTP you mean like IEX / Invoke-WebRequest? And I'm guessing SMB would be using the copy command?

[dim wolf]

it depends on the section, sometimes it is and sometimes it isn't

[next bronze]

I see

[next bronze]

yep

[uneven cairn]

step by step if you dont understant some topic start first by those explaining what you dont understand well yet

[dim wolf]

as slow as it is, you're probably better off just RDPing to Kali then RDP to WS001

[plush solstice]

sometimes you dont know what you dont understand

[plush solstice]

yea i will just go back to doing that

[dim wolf]

or you can try X11 forwarding. i didn't do that when i did the module; maybe it's better

[plush solstice]

thanks

[fathom pendant]

Weeb spotted

[dim wolf]

🙌 ya got me

[upper ruin]

how is that weeb acitivities

Btw, marcie, the 'F' thing appears to be working, cuz I ain' got results yet, so I hope it gives out smth. Weirdly enough they missed the F in this section, but on the login forms is there.

[loud dagger]

OH I FOUND MYSELF SOME CREDENTIALS

i think i was really tired when i was taking notes on snmp so i just reread the academy page about it and i found what i was missing

[fathom pendant]

Probably a typo then, #1234357888114364508

[fathom pendant]

Yup

[next bronze]

hydra defaults to fail string if F: is not spcified tho

[loud dagger]

does anyone know if there's any language i can use for code blocks in obsidian to make my nmap outputs look nicer because right now it's all just one color

[dim wolf]

no language for Nmap

[loud dagger]

yeah i know, i just meant an alternative that might make it look less gray

i'll try a few, i know there are some languages that highlight numbers

[dim wolf]

you could try bash

[loud dagger]

lmao instantly deleted

bash looks pretty alright

[fathom pendant]

unfortunately no, bash is best tbh but unless you look into plug-ins, natively it's not the best for outputs

[loud dagger]

bash looks pretty ok

[uneven cairn]

you can output to html it looks great

[loud dagger]

still gray with html :(

[uneven cairn]

change the color lol

[loud dagger]

hey anyone been having issues with vmware lately? drag and drop and bidirectional clipboard haven't been working for the past few weeks and i can't seem to update vmware either

[uneven cairn]

like virt-clipboard?

[loud dagger]

yeah

can't copy and paste from vm to host anymore

[verbal galleon]

someone here to give me a bump on the Skill assessment - Injection attacks CWEE path?
found the internal page and insertion point, but i can't get the data right 😦

[uneven cairn]

have installed virt-clipbord on both?

[loud dagger]

yeah

it worked when i first installed and it appears to have stopped working

i would uninstall and reinstall vmware but i don't want to break anything with my kali vm

i doubt it would happen but just in case

[next bronze]

you can try reinstalling open vmware tools in kali

[loud dagger]

yep tried that

it's pretty low on my priority list rn tbh, i'll put more effort into it another time

python http.server and nc work fine as a temporary replacement for drag and drop and clipboard, respectively

only takes a few extra seconds

i honestly think i just need to update vmware workstation but for some reason i can't update vmware workstation

[uneven cairn]

i prefer virtualbox

or qemu

[fathom pendant]

Bc there's the new 'free' pro version

[loud dagger]

yeah that’s what i’m using now

[uneven cairn]

Someone recently got a remote shell on my system because I had outdated software.

[sudden wind]

Hi everyone Am new Here
My name is kryb

[uneven cairn]

If there is something you cannot update, it is best to reinstall it until you can do it, security updates are really important

[fathom pendant]

This isn't a gen chat, if you need help with an academy module ask, otherwise read #rules and #welcome

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[loud dagger]

on a virtual machine or your host machine?

[verbal galleon]

nvm got it 🙂

[fathom pendant]

Let's limit the off-topic talk if we can

[uneven cairn]

host 😦

[loud dagger]

wow

[uneven cairn]

antivirus just detect it but anyways i wouldnt expecting that

[loud dagger]

alright i guess i'll uninstall and reinstall vmware later and just export and re-import the vm and hope nothing gets lost

i don't really have anything important on my kali vm anyway

[old oasis]

Take it to DMs guys this channel is reserved for academy module questions. @loud dagger @uneven cairn

[plush solstice]

anyone have trouble using openssl to convert cert.pem to cert.pfx? I get "could not read prive key from -in file from cert.pem. When I Cat the file two hidden characters are at the beginning of the private key and i think theyre preventing openssl from reading the key but im not sure how to remove.

[sudden wind]

Greetings guys
Am new here

[plush solstice]

��-----BEGIN RSA PRIVATE KEY-----

like this

[loud dagger]

didn't someone just tell you to move to a different chat

[sick whale]

I just did exactly that to move to the pro version and it was very smooth.
I see some perf improvements too

[storm elk]

welcome but please, as Marcie said, not gen chat. Please read #welcome and #rules

[uneven cairn]

#general

@sudden wind you were just told to read the rules, you can't send me FR without prior permission

[sudden wind]

No one told me

[loud dagger]

they did actually

[storm elk]

Yes, they did #modules message

[sudden wind]

Please can you tell me the chat to move to?

[loud dagger]

dude

[sudden wind]

Huh

[loud dagger]

anyways i got a really stupid question, when imap and pop3 are both running on a remote host, they're both connected to the same email server, just accessed with different protocols, right?

[old oasis]

[loud dagger]

i'm gonna go ahead and take that as a yes

[uneven cairn]

yes i mean they send request to your smtp server

[sudden wind]

So am accepted to join you guys right?

[loud dagger]

ok i just wanted to make sure because i don't feel like enumerating imap and pop3

[sudden wind]

Hi

[uneven cairn]

dude just stop

#general

[sudden wind]

Yeah that's true
Please pardon me

[loud dagger]

why don't you go ahead and pardon yourself to #general then bud

[sudden wind]

Please am trying to be nice

[loud dagger]

go be nice in #general then

[sudden wind]

I just want to be friends with you Guys

[loud dagger]

go make friends in #general

[uneven cairn]

not with me go to #general if you want friends

[loud dagger]

this server is full of assholes anyway you're not going to make many friends here

[sudden wind]

What happened making friends here

[plush solstice]

yea this dude is deff a scammer or something. Just sent me a friend request. Its not normal to join a chat and immediately start friend requesting everyone,

[loud dagger]

yeah it is i see idiots do it all the time

[uneven cairn]

<@&861185840277487616>

[uneven cairn]

me too

[plush solstice]

it may be normal in the sense it happens a lot but its not normal in the sense normal people do it. Scamming is very normal in the sense it happens frequently

[loud dagger]

hanlon's razor

[acoustic owl]

@sudden wind Please read the #rules

[loud dagger]

i guarantee it's not a scammer and it's just a kid who for some reason can't read and/or has no respect for anyone else

[acoustic owl]

You are not allowed to simply dm another people

[loud dagger]

i'm not defending him, i'm just saying it's almost definitely not a scammer

i saw the exact same thing in the kali discord

idiots who come in here with no respect or patience

[unique ether]

Hello

[loud dagger]

i especially got a TON of unsolicited friend requests, way more than anyone else there, presumably because i'm a woman

[plush solstice]

actually people who are new to cyber/IT are perfect victims as they are savvy enough to walk through a scammers steps but still easily tricked. Especially in chats like these where someone could be "helping" you by walking you through steps that screw you. However lets get back to important topics

could anyone help me with the last section in windows attacks/defenses

[loud dagger]

sometimes i would accept the request and give the person the benefit of the doubt and 99% of the time it was either "i just want to get to know you" or just a dick pic immediately

[uneven cairn]

please all going to #general here only to specific modules question please

[unique ether]

Aight enough discord for today

[loud dagger]

yeah that's why i'm not being nice to him
ok i'm done

[gentle owl]

Does anyone experience that 10.129.42.253 is down? I am trying to conduct an Nmap enumeration. Module: Getting Started; Section: Pen Testing basics

[sudden wind]

Am sorry
Guys

I won't try it again
I just went to read the rules

[uneven cairn]

that is a private address

[sudden wind]

Please you all forgive me 🙏

[loud dagger]

jesus christ this channel today

[gentle owl]

10.129.42.253

[uneven cairn]

???

[acoustic owl]

From the PwnBox or from your VM?

[gentle owl]

PwnBox

[old oasis]

The best thing you can do is to drop it and move on

[loud dagger]

yeah i'm closing discord anyway because my productivity tanks by roughly 90% when i have it open

[dapper moth]

If anyone can help me out in the Response Splitting section of the HTTP Attacks module, I'd appreciate.

[acoustic owl]

restart the target and wait a few minutes. Then try again

[dapper moth]

I'm able to see my crafted XSS payload and make a request to my HTTP server, but when I change the payload to make it locally it doesn't trigger by setting it to the admin to check

NVM!

[uneven cairn]

So it's not XSS reflected but blind?

[plush solstice]

how to fix the trust relationship between this worksation and the primary domain failed?

i have reset all machines and its still not trusted

[sacred gull]

Bump

[sacred gull]

I don't think its the module because others have obviously completed it but I get [10/01/2024 14:06:21] C:\Alpha\Static\app.exe - OK - Undetected by Microsoft Defender Antivirus but no flag.txt

[dapper moth]

Contact support

Had the same problem

[sacred gull]

Support told me they dont deal with issues for modules lmao

[dapper moth]

Another user who have contacted me on the forum also had it

[sacred gull]

But I will again

[dapper moth]

Haha Nice HTB!

For me they've told me they couldn't test it because they had problems with their RDP at the time

[sacred gull]

ahh ofc

[dapper moth]

And resolved it in a not usual way

[tired olive]

How is the malware analysis module here? Does it prep for real world malware analysis?

[gilded radish]

#1234357888114364508

[sacred gull]

Yeah idk if its actually a module issue or if its me

[gilded radish]

hehe

[loud dagger]

is everything you need to know for the knowledge checks stuff you’ve already learned in academy? or is there a point where you need to start doing research

because i’m at a complete loss right now

specifically the end-of-module labs

i don’t remember if i’ve had to do that before

[safe star]

95% of the time, skill assessments can be completed with just the module content

what module you talking about

[thorn basin]

anyone who did the attacking common applications online?

i wan't to discuss the tomcat section

[safe star]

🙋‍♂️

[thorn basin]

can i dm you?

[safe star]

ye

[dapper moth]

Might be worth... I thought what the hell right!? Might try! Got the issue as well

[sacred gull]

Yeah okay support is offline so I'll bring it up when they come back lmao

[fast delta]

I'm new when it comes to Linux and with that said I'm trying to go through the Linux Fundamentals but there are questions that the end of the section that wasn't even covered on how to do and the cheat sheet doesn't help much from a beginners perspective. Is it supposed to be this complicated?

[plush solstice]

yes the gaps are on purpose. You have to research and trial/error

some things are broken not on purpose but as a newbie you wont be able to tell. Thats kind of part of the learning. dealing with the constant frustrations

[fast delta]

Ok I thought I was missing a portion of the training materials and that was the issue.

[plush solstice]

the hackthebox forums have been very helpful for me. Just look up the module youre on and id bet someone has discussed the same issue

[versed escarp]

Hello everyone

[cloud urchin]

how are you obfuscating the payload?

[dapper moth]

It's a custom C# code.

[cloud urchin]

ok did you try the code from the module?

[dapper moth]

I've finished the module, but I've had issues with this section as well.
And no, not using the AES encryption code they have for that section.

[cloud urchin]

i was able to do it with what the module provided

[dapper moth]

But it shouldn't be an issue nevertheless as it is just a static analysis of the code

Also another user has contacted me on the forum about the same issue

[cloud urchin]

not sure what your custom code contains, but the code from the section worked for me so maybe try that. i'm not exactly sure how it's detecting the code, it may not even be defender really doing it but something else they made.

[dapper moth]

I think not. I could get some of the scripts after gaining the shell, but since this one is only static and would not execute, I wasn't able to get the automation behind
And this module was pretty tight! Every exercise had one user account to execute it!

I guess @sacred gull code is the same as the module anyways

[sacred gull]

Yeah mine is the same as the module, only part changed is shell code

[dapper moth]

🤷‍♂️

[cloud urchin]

did you also add to the code to allocate memory, copy the shellcode into the allocated space, make it executable, and then execute it?

[dapper moth]

@cloud urchin

[dapper moth]

Same custom C# code as the Dynamic Analysis section but passing the IP and Port directly

[cloud urchin]

yeah that doesn't mean much to me, plenty of people struggle with plenty of different modules

i had some difficulty with this one too, but i got it working

[dapper moth]

Just telling you, man.... More people having the same problem 🤷‍♂️

Anyways... Best is to contact support....

https://forum.hackthebox.com/t/introduction-to-windows-evasion-techniques/322348

[cloud urchin]

well that guy definitely didn't read the instructions

you can remote to the dev machine to build the project and then transfer it to the evasion machine

Not what this discord is about

then go to the police

[rustic sage]

Please teach me

[rustic sage]

Its too expensive

[cloud urchin]

police cost money in your country?

[rustic sage]

No

[cloud urchin]

ok then go to the police

[rustic sage]

I mean yes, like 1000 dollars

[cloud urchin]

well sorry no one here can help you, only the authorities can

[rustic sage]

Because when I call 911 it cosrs 1000

[cloud urchin]

911 doesn't cost 1k, it doesn't cost anything

[rustic sage]

It does man.

[cloud urchin]

sure it is, you're asking people to commit federal crimes and risk prison for you

go to the police, that's your only recourse

[rustic sage]

I will try man, thanks.

[cloud urchin]

Just did it again, no issue

Just make sure you're following it exactly like the module says, with the correct project settings etc

[dapper moth]

I'm retrying at the moment

[pine dune]

Hi guys, Im on the password attack module, specifically the Password mutation section and Im having a little trouble understanding it

[cloud urchin]

which part are you struggling to understand

[pine dune]

there are a few parts Im having a little difficulty, I am given to understand that password mutation is basically using tools to generate mutated passwords

but in this case Im having trouble understanding the question in this sense because for example cewl, it has a "-d" flag, now if I was to use this flag, what would be the minimum length of letters I'd need for ssh, I could enter -d 11 but the password could be of 8 character lengths long

[cloud urchin]

that's not what -d is for, -d is for depth

-m is for minimum length

[pine dune]

what is depth? and yea the same basically applies to "-m" right?

[cloud urchin]

no they are two totally different parameters. just like the module says -d will set the depth cewl searches on the website. for example blah.com/depth1/depth2/depth3/

[pine dune]

oh so like the subdirectories you mean?

[cloud urchin]

yeah depth in how far it goes into the website

its' the depth to spider to

[urban raptor]

Anyone for advanced xss and csrf exploitation - xss filter bypasses ? Able to bypass the filter, struggling with data exfil

[cloud urchin]

data exfil code is pretty much going to be the same code used through the module

[pine dune]

thank you, could u pls clear up my doubts on the "-m" flag 😅

[cloud urchin]

-m is the minimum length of the words it looks for to use

[urban raptor]

Any other information? Using the same payload as the rest of the modules of double xml request. Getting stopped by cors

[cloud urchin]

try man cewl

[pine dune]

ok thanks

[cloud urchin]

I don't think there are any special protections here since the section is focusing on XSS filter bypassing

[pine dune]

does the password mutation task take a while to do? ive been on it for the past 5 mins and no success

[cloud urchin]

like the command to mutate the password list itself? no i think it only takes a few seconds.

[pine dune]

nah the enumeration

[cloud urchin]

you mean the brute force?

[pine dune]

yea sorry brute force

[cloud urchin]

yeah it can take a while, but should be less than 20~30 mins

[pine dune]

did it take u that long?

[cloud urchin]

it's been a while since i did it but i think it was under 20 mins or so

[pine dune]

because usually htb doesnt make it so long

ahh ok

[cloud urchin]

htb staff has stated they don't want people just sitting there for 30+ mins etc, so it should be less time than that for sure

[pine dune]

ill share the command i used

[cloud urchin]

right exactly

no need really, just make sure you have a good amount of threads (48)

48 is the sweet spot

[pine dune]

i didnt put threads

how do I add threads without interrupting the process 😅

[cloud urchin]

don't think you can

[pine dune]

ahh damn

[dapper moth]

Yeah, with the AES encryption worked.
It runs MpCmdRun.exe in the file with a custom scan.

[cloud urchin]

yup

[simple ruin]

I've got to be close....Ahhhhh

[cloud urchin]

A lot going on there. Looks like your lhost isn't set to your vpn adapter. also that rhost looks wrong. on top of this, your run command and exploit commands are both wrong.

[simple ruin]

Okay thanks..... So I need to figure out proper syntax I'm thinking

[cloud urchin]

you can use the command ip a to find your VPN's IP, or just use 0.0.0.0 and it will listen on all adapters

make sure rhost is the target spawned, and to launch the metasploit module just use run or exploit and nothing else is needed

[simple ruin]

ohhhhhh I see now that I am Re entering the path...wow

I'm over complicating...lol

exploit

so I am not using vpn... I have been using my own machine just for HTB... Maybe I need to restart and spawn HTB Instance???

[cloud urchin]

not all modules need the vpn, you didn't say which module you were on so i just assumed

[simple ruin]

I'm just getting started module

[cloud urchin]

so tun0 isn't valid, as you can see. is 94.237.54.201 the target IP you spawned for that module?

try set lhost 0.0.0.0 instead, that listens on all

also type options, itll show you other settings like the port. you may need to change that too.

[rocky estuary]

guys i'm doing the AD skill assessment and i'm stuck at "Locate a configuration file containing an MSSQL connection string. What is the password for the user listed in this file? " i found the creds for BR--- and his passwords but i can't do anything with it i tried winrm but thats didn't work i tried also to use snaffler to find the config file and also findstr from password attack modules to hunt for it and didn't find anything , i saw the hint for question but i can't use BR--- to login

[simple ruin]

Thanks friend... I'm pretty sure it has something to do with using HTB vpn... it's actually part of the mod.... about 4 hours in... bedtime for my old a$$ lol..... Thanks again , it helps to get my mind shifted...lol

[cloud urchin]

the rhost ip you targeted is public, you wouldn't access it via the vpn

[sick whale]

use the creds to enum, not necessarily to login

[hard matrix]

just curious about SQLMap skill assessment -
I have the injection point and have successfully enumerated the database, but ultimately having issues actually --dumping the table. curious if anyone has any nudges. the time-based technique might be the problem but changing techniques results in sqlmap believing the parameter isn't injectable

[unique ether]

Close yet so far

I need to finish

These pages

[flint marsh]

can someone help me understand the robocopy command?

im confused on my it was written twice in the modle

[sick whale]

Quick question on the fuff module, in the skills assessment.
1st and 2nd question, they ask for subdomains and then extensions, but they don't specify how the answer should be given.

I found 2 extensions, and somehow spacing them or putting a comma in between doesn't work...

Can someone help with the format of the answer?

[storm elk]

Just the letters

But there’s more

[sick whale]

Yeah I don't know why I excluded the one giving a 403 answer

All good thanks

[storm elk]

Great job

👏

[normal reef]

Hello can we make the emulator like our own real phone that have camera?

How to access the camera on emulator :)) also

[acoustic owl]

For which Academy module?

[normal reef]

Noo dont have module here but I just wanna know I think possible but idk how to access the camera back and forward from out laptop / screen cam

[pine crag]

when looking at modules i see option for , threat spotlight and targeted cyber ops

and they dont show anything when i press on em, do i just unlock them after i finish more modules or they empty for now

[normal reef]

Ohh we cant scan / do anything hum

[sick whale]

I hope #moderators get some psychological support, must be a tough job sometimes 😅

[cloud urchin]

this discord is all about the hackthebox platform, and this channel specifically is their academy (educational resource), no one in this channel can help you with what you're asking for

[normal reef]

Okeeii sorry

[flint marsh]

wait so i would eventually have to pay for cubes?

[storm elk]

yes

[grand portal]

for password attacks module, should i use pwnbox or my own machine? i heard its dependent on gpu, better gpu = fast cracking

[vivid sigil]

Is it better to finish Cracking Passwords with Hashcat module before going to password attacks module ?

[nova ginkgo]

hello everyoone can someone help me pls

Attacking Common Applications : other applications

Enumerate the application for vulnerabilities. Gain remote code execution and submit the contents of the flag.txt file on the administrator desktop.

[nova ginkgo]

I found cve and payload but how I don't know how to use

in payload :
exploit.py [victim ip] [victim port] [path to ysoserial] [JRMPListener ip] [JRMPListener port] [JRMPClient]

I dont understand what is ysoserial and JRMPClient

[dim wolf]

it's not necessary, but it will give you a better grasp of hashcat's capabilities

[rustic sage]

Hello guys,
I installed htb edition of parrot os and now i came to know that anonsurf is not installed. Can some one tell me how to install anonsurf for parrot os (htb edition)

[acoustic owl]

https://parrotsec.org/docs/tools/anonsurf/

[royal beacon]

Hi All, I have stuck on one of the questions on the academy can anyone help me with it?

[autumn pilot]

just ask your question

[rustic sage]

I have tried it now but the third command which is

cd anonsurf/

make build

make install

Is not working.
I dont know why

[analog dock]

It throws error messages most likely

If you verify your account you can post pics

[royal beacon]

What is the FQDN of the host where the last octet ends with x.x.x.203?
On the footprint course
I tried to use
for sub in $(cat /home/xman/Desktop/HackTools/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @10.129.24.49 | grep -v ';|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done
But it does not work

[sacred jacinth]

did you dig around the server?

except for the bash script

[royal beacon]

Yes I did,
It show me a lot of ips but no one end with 203

[sacred jacinth]

it does, try all the techniques that the module have taught you up till now

[royal beacon]

The answer it the provided example on the module?

In*

[sacred jacinth]

no. try the methods you were taught

[royal beacon]

I see some people says that I should change the world list
But I use all the world lists for the dns in seclist file

[royal beacon]

OK thanks

[sacred jacinth]

try a fierecer list

[opal nexus]

I would like some assistence in 'Using Crackmapexec' skills assessments first question? I've obtained the usernames, but it seems it doesnt works when i attempt to asperoat. any idea how to proceed?

[vocal rover]

I'm solving some task and there is ssh connection. username and password is given but it is throughing an error.

user1@94.237.51.124: Permission denied (publickey).

Machine is pinging correctly.

[storm elk]

did you use the correct port?

[vocal rover]

My command is this;

sudo ssh user1@94.237.51.124 52027

[storm elk]

yeah thats not right you need -p

[vocal rover]

let me try

[vocal rover]

Done. thanks man @storm elk

[opal nexus]

Now I would like some assistence please (if missed due to recent conversation)

[storm elk]

havent done that module, sorry

[opal nexus]

that's ok. Anyone who had done the 'Using Crackmapexec' module?

[next stone]

Exploiting XSS via WebSockets
Can some body help me with this section in the Modern Web Exploitation Techniques module?

The hint says The admin uses a firewall that prevents you from exfiltrating the cookie directly.
So it can't access my local or on the internet listener to exfiltrate the admin user cookies (from the XSS vuln), I tried exfiltrating back to the WebSocket but it doesn't seem to be working 😦

[storm elk]

@astral gyro please do not post random links

[stone jolt]

hello everyone

i am currently doing the enumeration module and running into some trouble with the odat tool

is it normal that it takes a lot of time to enumerate the SID and username/password

?

[heady blaze]

Hello, i'm on Attacking Common Services
Attacking SQL Databases
The flag is not displaying well

[plain cosmos]

hi can anyone give a hint on skill assessment for Advanced XSS and CSRF Exploitation modules, i get that there is an misconfiguration in "header" but cannot manage to bypass it for the admin.

[grand portal]

module: password attack:
network services section

Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.

upon using netexec, even tried crackmapsec in pwnbox, the bruteforce is taking just time, idk if its the proper way or not.

[fiery berry]

Which wordlist are you using? Did you download the one provided in "Resources"?

[opal nexus]

I dont remember how much time it takes, but it works if you use the correct user and password lists

[grand portal]

username.list and password.list, provided by module resources.

[grand portal]

im using correct ones, i guess it was provided from the modules resources.

[opal nexus]

those are the correst lists.

[grand portal]

can you check from your end? i think htb might be messing up, it had happened to be once, i wanna confirm.

[opal nexus]

Not at the moment I'm afraid.

[grand portal]

okay.

[opal nexus]

just use the lists and crackmapexec on winrm and you should be fine.

[stable jasper]

hi i've a small problem, i wanna use my kali vm to do a module but when i ping the ip provided it's not working, but i've no problem on the pwnbox, any solution ? thank you !

[quiet trout]

are you connected to htb ovpn?

yknow, your kali machine.

[stable jasper]

that's probably this, i need to go now but i'll for sure check later, thank you for your time !

[grim nimbus]

attack common services easy lab is not so easy after all, but I finally found both ways to get the flag. this sure is exciting and gained amazing knowledge

[quiet trout]

yeah easy is a relative term. if you're new to security and have no schema in broader tech you're prob gonna struggle a bit, but the security fundamentals does help to remediate that quite a bit.

[grim nimbus]

yeah, had some issues chaining some attacks. Besides the attacking, HTB machine had problems, because I had to respawn the machine 4 times. Only then I successfully enumerate the user with the exact same command that I ran the previous 3 times 🤣

[quiet trout]

yeah definitely remember to do that first, reset, it happesn quite often invariably.

[glacial minnow]

im having some trouble with nmap IPS lab medium

trying to get the dns service version

like i know what service is running and the fact that it's running on udp port

but cant get the version number, my nmap flags were sudo nmap 10.129.45.204 -p 53 --script banner -sV -v -D RND:6 -sU -Pn, i also tried several scripts like, dns-discovery, dns-nsid

Completed Service scan at 14:17, 0.07s elapsed (1 service on 1 host)
NSE: Script scanning 10.129.45.204.
Initiating NSE at 14:17
Completed NSE at 14:17, 0.00s elapsed
Initiating NSE at 14:17
Completed NSE at 14:17, 0.00s elapsed
Nmap scan report for 10.129.45.204
Host is up (0.72s latency).

PORT   STATE SERVICE VERSION
53/udp open  domain  NLnet Labs NSD
 

[tender nimbus]

Hey guys i stuck here can anyone help? i tried username bruteforce to find a user name with enum4linux and crackmapexec and i got nothing

also tried to bruteforce winrm with random creds but also nothing

[grim nimbus]

what module is this?

[rustic sage]

H

[vocal river]

On what do password recovery functionalities provided by web applications typically rely to allow users to recover their accounts?

its a theoretical question not practical from broken authentication section CBBH need help

[tender nimbus]

Password Attacks

network services seciotn

[glacial minnow]

i had to use pwnbox to get the flag, vpn is cooked.

[candid lily]

i just finished exploit pdf generation vulns, and wondering if its possible to do this with fetch instead of xhr

<script>
x = new XMLHttpRequest();
x.onload = function(){
document.write(this.responseText)
};
x.open("GET", "file:///etc/passwd");
x.send();
</script>

[tender nimbus]

also did this but i receive an error but PASSWORD is not required in options

[grim nimbus]

use crackmapexec with the provided lists in resource. I used that and got the answer

you may need to respawn the target machine multiple times, like I did in a different module. I ran the exact same command multiple times, only succeeding on the 4th respawn

[tender nimbus]

list fro; seclist you maen

[grim nimbus]

no, from the module resources.

[olive ingot]

Hey guys. I managed to get the flag for Server-Side Attacks - Skills Assessment - https://academy.hackthebox.com/module/145/section/1346 - However I am confused as to why the payload works.

Basically you can use file:// to get LFI through SSRF, but the URL absolutely must end with "&" which indicates start of new query param i.e. - api=file:///flag.txt&

I cant understand why that is...

[tender nimbus]

do you know what the custom.rule is?

cd i

[glacial minnow]

i need help with nmap hard

i found an unusual port starting with 5, trying nc ip + port

with nlv nothing :/

is this the right port?

[foggy monolith]

Think about what types of public-facing services process large amounts of data, as the hint suggests. -p 1000-9999 should suffice for this.

[tropic tundra]

hi there, i'm learning linux fundamentals, and I can't manage to find out how to get to htb-student's path to mail

[loud socket]

Might be /var/mail

[tropic tundra]

incorrect unfortunately :) , also I can't seem to find where I should be supposed to read about that in the section

[loud socket]

/var/mail/htb-student?

[tropic tundra]

oh

[loud socket]

Usually mail is /var/mail/username

Also a simple Google search would've given the answer to this

[tropic tundra]

thank you, but what's mail's purpose in Linux ?

[tropic tundra]

I prefer asking rather than googling and finding a wrong answer

[languid fjord]

https://www.hackthebox.com/blog/when-easy-isnt-easy

[loud socket]

I mean googling is also asking. But whatever floats your boat I guess

[tropic tundra]

thank you for your help either ways

[loud socket]

To that I don't have a answer

[tacit bay]

anyone able to point me in the right direction for 2nd question in NTLM relay skills assessment? - BACKUP01

[tender nimbus]

hey guys im still stuck at the same question haha

[tender nimbus]

i used the lists from the resources, also used other lists from seclist but nothing

[chilly echo]

Module Information Gathering - Web Edition, Virtual Hosts. added the ip with the domain without the port in etc/host file and ran gobuster still no hit

[chilly echo]

When domain name is used in the command instead of IP its working

[viral lotus]

Just seeking clarification, I knows in theory it can be done on any machine in the right circumstances but for: File Transfers - Miscellaneous File Transfer Methods, optional exercise is the ide to use the pwnbox to mount the drive or use our own vm or does it not really matter?

[rustic sage]

J

[viral lotus]

are you following the same thing as your screenshot above?

[tacit bay]

nvm got it, feel free to DM me if you get stuck

[safe star]

need to see the command

[safe star]

does not matter

[viral lotus]

yeah I gathered its just a poc of how you would use those methods in an assesment isn't it? as most quick wins are pretty locked down

I need to remember LOLBAS better

[safe star]

yeah

[tender nimbus]

hey guys im locked here, the flag should be here but i only have acces to IPC$ and there is nothing in there

[storm elk]

What module and section?

[tender nimbus]

password attacks

network services section

[vital zephyr]

Good evening all my friends, I am at the last question of the second AD skills lab, the question says: Submit the NTLM hash for the KRBTGT account for the target domain after achieving domain compromise.

now from my kali I managed to load mimikatz.exe
but as soon as I start it, it gives me this error,
.\mimikatz.exe "lsadump::dcsync /user:inlanefreight\krbtgt" "exit"
why?
Any help?

[shell ore]

what error?

[vital zephyr]

C:\Users\CT059\Documents> .\mimikatz.exe "lsadump::dcsync /user:inlanefreight\krbtgt" "exit"
Program 'mimikatz.exe' failed to run: The specified executable is not a valid application for this OS platform.At line:1 char:1

• .\mimikatz.exe "lsadump::dcsync /user:inlanefreight\krbtgt" "exit"

At line:1 char:1

• .\mimikatz.exe "lsadump::dcsync /user:inlanefreight\krbtgt" "exit"

•   + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

[shell ore]

ur connecting over evil-winrm?

USUALLY i find a hard time running mimikatz w it tbh

if ur DA, and have a hash/password, try to do it remotely

[vital zephyr]

yes, with evil

with xfree?

[shell ore]

no no, secretsdump

[vital zephyr]

now i try

@shell ore what should i do?

dont run

can someone help me please????

[shell ore]

hey back, had to go, delete the pics please, they contain spoilers

to avoid more spoilers, DM me please

@vital zephyr

this one too

[trail ingot]

can anybody help me

[shell ore]

gitlab? attacking common application?

[trail ingot]

yes buddy

[shell ore]

ok delete the message cuz it have somewhat of a spoiler 😅

[trail ingot]

sorry

it my fualt

[shell ore]

its okay, so you solved the first question

now for the second, i dont beleive u need a password

lemme see rq

[trail ingot]

okay

[shell ore]

yes u dont need

[trail ingot]

then how you rce

[shell ore]

it is taught in the module

[trail ingot]

it authenticated right ?

[shell ore]

the || username enumeration || you did was through the || register || page, so use that

[trail ingot]

yeah i dumb as fuck

sorry i have not reading it proper

some time little details get missed

[shell ore]

its okay

uhm, <@&861185840277487616> idk if applicable or not tbh 😂

[loud socket]

That's a mute

[shell ore]

his message still there, idk it should be reported or not, i did anyway

[loud socket]

I got muted for a day for something like that

[shell ore]

huh smth like what

[loud socket]

Seriousrulebreak

[shell ore]

well u see his message bro, what should i do 😭

[loud socket]

Idk 🤷‍♂️

[urban raptor]

Anyone for advanced xss and csrf exploitation - xss filter bypasses ? Able to bypass the filter, still getting stuck on cors policy. Using 2 step xhr payload. Can’t get withCredentials to get a valid response

[sour hemlock]

when i tried to download files from rsync it says "connected to machine". but i can't get any. sometimes i eve can't list what's inside. can someone tell me what's the issue and how to resolve it?

[rough comet]

Need help withe PhT question on the "Attacking RDP" - Common Services module.

The question asks to connect via Admin (RDP) with the hash. But I am not able to dump the hash using || crackmapexec||

That command is not even explained there but I tried anyway.

I also tried to RDP as || lewen with his hash || and it did not work either.

[safe star]

why do u need to dump the hash?

[rough comet]

because I don't have it

[safe star]

have u tried using rdp first

[rough comet]

but "htb-user" is local admin

[rough comet]

I am able to RDP yes. But this is for Q#3

[safe star]

do they not have the hash on the desktop?

[rough comet]

The third question is for RDP, but as Admin with its hash

[rough comet]

I do not see it, let me RDP again

[rough comet]

Jesus Christ

[safe star]

where did u get that name from

[rough comet]

Hit me with a pan

[rough comet]

what name

[safe star]

htb-user

[rough comet]

is provided

let me try what you said initially

[opal nexus]

has anyone had done 'Using Crackmapexec' skills assessments question 3? i am stuck after obtaining 'j***' credentials.

[chilly echo]

What is the API key in the hidden admin directory that you have discovered on the target system? Im stuck here completed other questiones (Skill assesment) can i dm anyone?

[sick whale]

Currently doing the login bruteforce module...

After letting the first script run for 20 min not realising that I wasn't on the VPN (thanks for not throwing any timeout error 😄 ) I started it again, I'm currently in the 7.2k and still no answer...

Whyyyyy isn't the module over a 1000 range rather than 10k, the concept is identical haha

Can someone tell me if I already passed the right PIN and something is wrong?

[shell ore]

what section exactly?

[sick whale]

Brute Force Attacks / Brute Force attacks

[chilly echo]

I thought its not allowed for modules above tier 0?

[sick whale]

Giving you straight the answer isn't allowed. But we need the command to know what you've potentially done wrong

[chilly echo]

Can i dm you regarding the skill assessment if that okay?

[shell ore]

shit, this is the new section after updating the module 😅 lemme test it rq to check whats happening

[sick whale]

Yeah it's also pretty slow to run on my box somehow

[safe star]

dm me it

[sick whale]

Omg it concluded hahaha

Whyyyyy do they put the pin so effin far hahaha

[shell ore]

still going for me lol

[sick whale]

Yeah it took 30+min for me

[shell ore]

💀

[sick whale]

Which leads to another question: Can you open another section and spawn the next section's instance at the same time or not?

I hate not being able to pipeline these kind of things

[safe star]

yeah if its a public ip machine

[shell ore]

i was searching for a way to see if i can speed it up somehow

wrong reply, lol

[sick whale]

I was this close to ffuf-ing it to be honest haha

[shell ore]

ACTUALLY

thats a good idea! wait 1 minute 😂

[sick whale]

I know, I just want to do things the way the author meant them, because I also write education manuals hahahaha

Let me know how fast doest ffuf make it

[rough comet]

I cannot believe I missed that. Thanks

[opal nexus]

I resend due to recent conversation. (So the message will not dissappear).

[sick whale]

And then the script with the dictionnary didn't work (the file wasn't being transferred through github somehow) so had to download the file and get the script to pull from my own http server...

Weird

[shell ore]

i have not done that module unfourently

[dusk haven]

Newbie here. Trying to get through Q3 under Service Scanning in PenTester role - List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file. Followed all guidance but can't get bob's password. Any suggestions plse ??

[sacred jacinth]

Mention module name, and section name if you want help

[sick whale]

Without looking at the module:

• Was bob password used earlier in the module? Some modules reuse creds
• Do you need bob's password? There might be an option to connect without it

[dusk haven]

OK Thnx. Thot module was pentester and section was Service Scanning. Will go check

[rustic sage]

hello

[dusk haven]

Thnx HaTxx. Will go see

[storm elk]

Please read #welcome and #rules it will explain how to get verified

[rustic sage]

ok, i was looking for that

[cosmic tide]

Hello everyone, I'm working on https://academy.hackthebox.com/module/143/section/1275 now.
I spent quite a long time figuring out the ACADEMY-EA-ATTACK01 machine's credential for ssh login...
I think it's missing in the module page. I managed to find the credential here tho.

[rustic sage]

I am verified now, thanks

[storm elk]

Welcome 🙏

[dusk haven]

Module is Getting Started. Section is Service Scanning https://academy.hackthebox.com/module/77/section/726#questionsDiv

List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file. Followed all guidance but can't get bob's password. Any suggestions plse ??

[cosmic tide]

Have one more question regarding AD modules...
I'm working on AD enumeration module, and went through several AD machines including Forest, Active..
And I think that there's a huge gap between what we are learning from the module and what we need for the actual AD machines.
The amount of learning in the module is overwhelming for now.. How do I have to study all these stuffs?
Any strategy? Is it enough to go through 1~2 times to be familiar with the module so that I can find where to refer to the command lines? Throughout the whole path, I think that AD is the only module that makes me feel overwhelmed. Any advice will be appriciated.

[sick whale]

AD is a HUGE knowledge area, and the module is cramming everything you need for CTPS exam.
I think yes, do it a couple times (remember it's the module saying it is a week long module! Took me a good two weeks!!!) and if you can refer to it, have good notes about the attacks learned etc...

But there is a reason they now released a whole AD path... It's big haha

[shell ore]

still need help?

[dusk haven]

Yup fraid so 🙂

[shell ore]

ok lemme check rq

[dusk haven]

Thnx

[viral lotus]

Something I previously done was setup my own AD environment, as a lab and simulated different things, it is also really good to know how it is set up if you never had to do it before - just my 2 cents

[shell ore]

the password is in the module content, re-read it

[rough comet]

Does the Q2 of Commno Services - RDP have a bug?

Not taking || DisableRestrictedAdmin ||

I even tried the full reg key path

That's the key we have to enable to allow PtH with RDP.

Indeed... something weird was happening. It took it now but it was not before.

Ohh well...

[patent sky]

Hello, i am doing the module ACTIVE DIRECTORY ENUMERATION & ATTACKS, section LLMNR/NBT-NS Poisoning - from Windows, i can't connect to the machine using xfreerdp, i did change the vpn and reset the machine quite few times. It worked once so i don't know where is the problem. If someone can help troubleshooting with me

[dusk haven]

Hmmm interesting. I thot I had found it in the module content but got a fail on the one i entered. Thnx for help I will go chase it down

[shell ore]

its right there directly, u maybe had a tyop or smth, good luck!

[patent sky]

I used Remmina trough the pwnbox, it worked 30 sc ... Server issue ?

[rough comet]

do you mind posting the command?

[patent sky]

Sure

[rough comet]

did you try resetting the box?

[patent sky]

yes i did

xfreerdp /v:<ip adress> /u:htb-student /p:Academy_student_AD!

And i did try going in using remmina too

It's working like 30 sc then it disconnect me

I changed the vpn few times, i did reset the machine few times too and i did try to go in going trough pwnbox

[shell ore]

whats the error ur getting?

[patent sky]

Nothing seems to work

[shell ore]

in xfreerdp, not remmenia

[rough comet]

add those two? see what happens

but sharing your error may help. The fact that you can connect but log you out, sounds more like latency or network issue, and not auth

[shell ore]

yep

[celest sigil]

Hello, i am having trouble with this question: Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. on "attacking common services > attacking DNS. Whenever i try to use the "dig axfr inlanefreight.htb" command I get an error message. Any tips on this one? Been stuck on it since last night lol

[patent sky]

it's working rn so i have no error, it just disconnect me again and again, if it does that again i ll put the error and try what you said

But i can't even ping the machine from my own vm

[shell ore]

and more specifically, these days i think there are some connection issues on the academy

at least w me in RDP stuff

[shell ore]

what the error u getting from dig?

[patent sky]

It disconnected me again, i ll try what you said

[rough comet]

You are right

[celest sigil]

; <<>> DiG 9.18.24-1-Debian <<>> axfr inlanefreight.htb
;; global options: +cmd
; Transfer failed.
I tried to screenshot but it's not letting me but this is the message I am getting from dig

[rough comet]

I had to reset a box 3 times the other day. I ended regenerating the VPN key and picking a "better" server. Then I could RDP.

[shell ore]

so transferring is not allowed, what other methods we can discover subdomains?

[shell ore]

i hate RDP for a reason

[celest sigil]

would it be subfiner? This command did nothing as well " ./subfinder -d inlanefreight.com -v "

[river marsh]

can i connect my own VM to htb vpn rather than using the pwnbox?

[patent sky]

I have a black screen using /compression and /auto-reconnect

[shell ore]

oh wait

[celest sigil]

this was the error for subfinder ./subfinder: The term './subfinder' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again

[patent sky]

I am trying only auto-reconnect

[shell ore]

u tried to do ./ (launching from the current directory so its not there probably)

maybe try another tool to get what you want?

[patent sky]

It's not working at all now, i have this error :

[dusk haven]

Yup Typo twas. Not in password tho ! More ATD required !! Thnx for guidance 👍

[pale crow]

After the modules, I will get certificate from HTB? Or unless I pay for certified certificates?

[shell ore]

modules dont give you certificates, the way to get certificates from HTB is to complete a job role path, and get an exam voucher for the exam associated with the path, and pass it

[pale crow]

Ohkay thank you, hope it's easy to pass

[analog dock]

It’s not

[shell ore]

let the man have some hope bro

[gleaming chasm]

Should I buy student plan on academy or HTB vip?

[analog dock]

I’d go academy

[shell ore]

depends on what you want, if you want to learn specific stuff and get a cert maybe, academy is best, if u want to spend all time on boxes main platform then, for me, i would prefere academy

then after a while i would go to the main platform

[patent sky]

When you are deep down in the content you know it won't be easy to pass damned, so much knowledge

[gleaming chasm]

Do you think that modules tier 1 and 2 are enough to find a job?

[shell ore]

depends on what kind of job/level

[gleaming chasm]

Junior job like SOC

[shell ore]

but i think i heard some poeple getting hired after CPTS or CBBH (which consist of modules up to tier 2)

[gleaming chasm]

Many people say that CPTS is very hard, harder than OSCP

[shell ore]

well, nth cant be learned so

[patent sky]

I guess i ll have to wait them to do something, i think it's a server issue, even trough pwnbox i get disconnected every 20 sc, it's painfull, happens 😄

[carmine delta]

Hello, I'm doing the lfi automatic scan exercise
I discover a get parameter which is “view” that allows me to make an lfi as on the screen

does this mean that the legitimate view value loads a file present on the server?

[gilded radish]

yes

you basically loaded(requested) a file on server

/etc/passwd is a file

[carmine delta]

is it possible to have lfi attacks in directories like ip/index.php../../../../etc/passwd

[tender nimbus]

hey guys anyone know how to accelerate the proces?

[grizzled hazel]

Got a shit noob question but it has to be asked somehow.

I've seen this ( https://academy.hackthebox.com/billing/ ) but I'm sorry if this is already anwered anywhere on the site because I can't find that much information. I had 100 kubes. I'm currently at 70 (I think I did the first modules and it did cost me 30),

Is there any way to earn kube without obviously paying ?

Sorry again and thanks for asking this I feel embarassed.

[tender nimbus]

By doing free modules you earn cubes ^^

[grizzled hazel]

I only see modules where I can enroll

[tender nimbus]

here if i awnser right i get 0 but on some you get one

you student?

[viral lotus]

Not sure if anyone replied but yes this is fairly known its directory traversal, if you know how far down the hierarchy you need to go it can give you information if not set up well. Seen it on CTFs before

[carmine delta]

thanks 🙂

[astral badger]

Hello

[sick whale]

Target another service, one faster to bruteforce

[tender nimbus]

i have to do ssh ^^

i mutated the password file and there are 90000 passwrds -_-

[sick whale]

No you don't. You have to find which password gets you into SSH

And most users have the same password for all services

[tender nimbus]

okej gonna try on smb

[sick whale]

UDP services are much faster than TCP to bruteforce

[tender nimbus]

idk if there a udp services where i can bruteforce on

[tender nimbus]

i saw online that like you said trying the ftp port but why is it faster to bruteforce?

and for ftp i receive this

[sick whale]

I think it's because FTP is very basic, must have less auth steps or something...
I don't actually know exactly why.
Maybe someone more knowledgeable can clarify

[grim nimbus]

I don't know if that's the correct list, I used this one from the module page

[shut vapor]

At the very least FTP is not secured at all while SSH performs a dance to exchange crytpographic keys before starting the authentication steps. You could probably observe this with wireshark pretty easily.

ssh in that challenge also seems artificially slow, tbh

[edgy crater]

Aloha everyone, I am trying to sign up for the bug bounty hunter path. But when I click on “paths” it doesn’t take me anywhere. I completed the intro and pwned a few boxes. Is there something I need to do?(subscribe, hit a certain amount of cubes, etc)

My b moving this to another thing

[shut vapor]

Looks like this for me when I click "paths". Javascript or Ad blocker running? If not maybe someone else has ideas or support could help.

I would expect you should be able to enroll if you're not a subscriber because modules can be bought piecemeal with cubes.

[dapper moth]

Would anyone care for a quick hint on the HTTP Attacks Skills Assessment? Just not to go into a rabbit hole.
I could get part of it to work without CRLF injection via the technique in the Vulnerable Software, but when I do, WAF keeps picking the CRLF injection.

[simple ruin]

AHHHHHHHH

I feel so close

[cloud urchin]

it said it ran, but then a session wasn't created. that's also not an exploit i recognize. are you sure that's what you're supposed to use? what module/section are you on?

[simple ruin]

hacking into HTB ...Getting Started

[simple ruin]

the hint is look for plugins

[cloud urchin]

specifically what section

public exploits?

[cloud urchin]

Public Exploits? Visit the spawned target in your browser, then search for the plugin you see installed there. You're using the wrong exploit.

[quick eagle]

Hey guys has anyone here finished 'DnsAdmins' section on 'Windows Privilege Escalation' module. Been stuck here for a while even though I followed every single step from the section and it shows that I became part of Domain Admins group but I am unable to read the flag. Any help is appreciated.

[simple ruin]

cool, there must be more than one plugin...

[next bronze]

there is only one plugin, you'll just have to use the right exploit

[simple ruin]

Think I,m closer...lol

[cloud urchin]

type options, remember rhost is the remote host (target), make sure the ip/host and port are correct

[simple ruin]

getting closer...I think

[quick eagle]

nvm I just completed it.

[sick whale]

Quick question on the medusa part of the login brute forcing module.

neither hydra nor medusa want to work...
[ERROR] target ssh://94.237.49.214:22/ does not support password authentication (method reply 4).
ERROR: No supported authentication methods located.
[ERROR] all children were disabled due too many connection errors

Trying to run a scan of the IP to see if the ports are non-standard but it's taking ages, which is weird too...

halp. :p

[next bronze]

check what port you're supposed to use 😄

[sick whale]

Grmbl so they put SSH on the given port AND they put FTP on non standard?

Really want to make me paste cmd and not skip steps huh 😄

Nope, still doesn't reach the host

Nope

Not that I can see

[sick whale]

Where am I being stupid?

[next bronze]

reset the target then if that's the port given

[sick whale]

I'm on my 4th target hahaha

[next bronze]

just spwaned one and it works fine for me

[sick whale]

Dammit, it's half buggy here look:

[simple ruin]

Mannnnn ...lol

[cloud urchin]

Type "options" to see all the things you may need to fill out. Probably missing a port. lhost isn't used for this.

[sick whale]

Ok apparently complaining helped. Thanks, managed to get somewhere!

[simple ruin]

so far

[cloud urchin]

match the RPORT with the port of the target

don't use wget, or cd, this isn't a linux terminal, you're inside msfconsole so you have to use metasploit commands

set rport, then set filepath to read the flag instead of /etc/passwd, then use run to run the exploit

[simple ruin]

Definately got it but now can,t find it on comp...LMAO

[marble zodiac]

Guys I just started jr penetration tester anyone wanna teamup?

[storm elk]

#1225791307256168448

[cloud urchin]

Look at the line that says "file saved in"... looks like it grabbed that file and saved it on your vm.

[cloud urchin]

type exit to get out of msfconsole and cat your file

[simple ruin]

MANNNNNNNNN... I've literally been in to this for one week... That's alot of "Remembering" !!! I would have never ... LMAO... You're good my friend!!!

[cloud urchin]

yeah that module is a pretty big hill to climb when you're starting. the rest of the modules really break down each individual aspect a lot more in depth.

[simple ruin]

I'm lovin it though... I have a really good memory, I believe that will help in the long run... I would have never got all hat on my own...

[cloud urchin]

take good notes, there's no way to remember it all

[simple ruin]

its looking like metasploit is probably a MAIN tool

Definately notes!!!

I try for hours before I ever hint for help...lol... Head swim

[dim wolf]

metasploit is good when you're first starting

but i think everyone eventually moves away from it

if not using it infrequently

[simple ruin]

Wow!!! I would think thats a heluva tool!!!

But i guess alot of people would be well gaurded from it???

[cloud urchin]

it's more of a tool that automates certain things. it uses exploits it has in its database, but you can manually exploit that stuff with other tools. to really understand what's going on you'll want to do a lot of manual stuff. plus it doesn't have everything, it's missing a lot of exploits for example.

[sick whale]

Other question on bruteforce login module, skill assessment, part 1.

Is there a way (maybe I don't understand the question well) to reduce the attack surface to bruteforce the basic auth login?

I have 5.4M combos which according to hydra will take 24h... so I assume I have it wrong somewhere 😄

[next bronze]

http bauth should be pretty quick, use more threads

[sick whale]

64 is max isn't it?

hydra giving me 3k/min

[next bronze]

you can go higher

[sick whale]

[ERROR] Option -t needs to be a number between 1 and 64

[cloud urchin]

just run 65 separate processes

[sick whale]

I'm just baffled, that can't be the way... There is absolutely no point in bruteforcing something that big for an easy module -.-

I mean yes I can fork hydra per username and go bonkers... but what the hell 😄

[shut quest]

If you can figure out the username that should cut your combinations down significantly (I haven't finished that module yet) or you can use ffuf, should be able to get 36k/m but you might take the service down.

[sick whale]

the thing is, the question is a one liner, they give you two wordlists (user/pwd) and they say "good luck" pretty much 😄

"What is the password for the basic auth login?"

Now, earlier in the module, they ran the examples with "basic-auth-user" as username...
So out of curiosity, I will bruteforce that one right now just to see, but that's just a blind gamble that would have no logic behind

[autumn pilot]

There is a logic

[sick whale]

Well, that one didn't work