modules

[tranquil copper]

I think I've only used netexec that one time so far, I'm only a little bit ahead of where you are currently though. crackmapexec has worked for me in the past on pwnbox so I'm not sure if this is a new thing or what

[fathom pendant]

#1234357888114364508

[brisk meteor]

ahh thx!

[fathom pendant]

Don't spoil answers

The simple thing is replace scanning for a specific port with scanning for all ports

[safe adder]

?

[fathom pendant]

:)

[safe adder]

Thank you for doing nothing to help 🙂 I'll go ask elsewhere.

[fathom pendant]

I'm saying your question revealed spoilers for a skill assessment

Sometimes nmap doesn't gather all the info, and you'll need to connect more directly

[acoustic owl]

You can ask for help here at any time. But please do not post solutions/spoilers for modules

[safe adder]

This is helpful. Thank you. I get you point but in this was a simple banner grab and I pinpointed down to the issue being with time out. But nmap for some reason is failing so I wasn't sure where to look from there.

[fathom pendant]

Using netcat can get you the banner

[safe adder]

I know. But that's not the point of the Lab. It's about nmap.

[fathom pendant]

Even the nmap module tells you nmap can't always get you everything

I suggest going over the reading, you'll see more in the evasion reading that netcat (or ncat) was used in the example

nmap can only go so far

[untold dock]

Hello all!

Currently I'm facing a strange issue with nmap. I tried to run an nmap scan (no spoilers) with the -sC flag to run all default scripts gives me the intended result in the in-browser VM. The same command does not run any NSE scripts on my own VMware VM

[fathom pendant]

You can likely play with nmap timings to get it to work

[untold dock]

Already tried with apt-get update, and then upgrade nmap

[fathom pendant]

No idea for your issue, likely something slightly different enough to matter

[safe adder]

Could be a bug. I'm also revisiting this module. If you do everything right, flag should be in the banner. I remember the last time spending hours with a werid problem just to come back the next day to see it disappeared.

[urban elk]

what do you get with ls /usr/share/nmap/scripts/ |wc -l on each machine ?

[untold dock]

Interesting, maybe it's just one of those things

[untold dock]

I get 606 on both, so they should have the same scripts

[safe adder]

Thanks marcielee, I've went over it again. I get your point but in the module, it also says it's just checking the intended results by connecting with netcat. For banner grabbing, namp should suffice. I'll investigate more. Thanks for the help.

Otherwise, it doesn't make snese if we had thousands of hosts to scan.

[fathom pendant]

Timeout suggests you need to play with script timings

I believe it's like --script-args or something like that

[safe adder]

I did have it in my script. --script banner --script-args "banner.timeout=30". It indeed wait for 30 seconds. Then this connection refused for some reason.

[urban elk]

try this:

$ grep "dns-nsid" /usr/share/nmap/scripts/script.db 
Entry { filename = "dns-nsid.nse", categories = { "default", "discovery", "safe", } }

if it's in the default category also on your VM, no idea what's going on

[untold dock]

Appreciate it! It's in the default category in both VMs, so yep, might just be a bug

[urban elk]

sure thing 🙂 weird indeed

you could try --script-trace to see if it is at least executed but maybe not turning up anything

[untold dock]

it looks like it's being executed, but still no result

[urban elk]

dunno how far you want to debug this, but according to the script, "This script performs the same queries as the following
two dig commands:

• dig CH TXT bind.version @target
• dig +nsid CH TXT id.server @target

[urban elk]

so I guess you could try them manually, I suppose they should turn up different results too

[untold dock]

thanks a lot, I'll give that a try

[fathom pendant]

Can you redact the target port? 😉

[untold dock]

in the end, I reset my VPN connection and the script worked as it should!

maybe IPS, maybe a bug

[urban elk]

odd! Glad it works now

[rustic sage]

hey guys, does anyone having problems with the windows priv escalation module? i do everything the module says and view my account in the localadmin list but still get an Access Denied. anyone knows about that?

[cloud urchin]

did you escalate your account?

[rustic sage]

as i said i could see my account on the localadmin list

[cloud urchin]

did you log out and back in?

[rustic sage]

yup

shutdown -l

and it happened to me almost in every section not sure what im doing wrong

[cloud urchin]

then it sounds like the user you're running as doesn't have permissions

[rustic sage]

i log in with whichever account the lab gives me, i’ll have a look again

[fallen talon]

I’m having trouble looking for the unique domain record that’s supposed to be in double quotes. I have tried everything i know and still can’t figure it out

[indigo mirage]

Hello, I'm stuck and I can't find the answer. The answer gives me 34071 but it is not correct, can someone help me please?

I can't take a screenshot it's the bash scripting loops module

[ocean night]

https://help.instagram.com/374546259294234/

[thorny sluice]

I'm on command injection skill assessment does anyone have a useful tip I've been attacking the URL? I'm just getting a big code base to come back to me

[cloud urchin]

comb the site with burp to see what each button does. command injection is about injecting a command into the operating system, so try to find some place where you see something like that going on.

[thorny sluice]

I'm not really seeing anything interesting just a bunch of status code 302s redirections OR status code 200 OK

[cloud urchin]

try to think about what each button actually does on the back end, something that may run a command

[rustic sage]

Guys I'm in password mutations, I have done the mutated file from the .zip in resources. It's been one hour and a half it still didn't crack the password for sam

Its not the first time I do this module. I contacted HTB support and they told me to try to crack ftp but it's not doing much

The first time I tried doing this module I tried ssh, same thing

I have extended the life time of the box to 300 minutes should I let it run

[cloud urchin]

it should be less than 30 mins

use -t 48 if you aren't

[rustic sage]

I'm using netexec

Hydra doesn't like me

[cloud urchin]

oh idk then. i used hydra.

[rustic sage]

@ocean night what should I do?

[ocean night]

🤷‍♂️ I can't provide support right now, sorry. Ask and see if someone else can provide any more advice.

Alternatively reach out to support again tomrrow I suppose

[rustic sage]

Ok thx

[ocean night]

..butI find it really unlikely something would take that long to bruteforce in a module

What do you mean by "Hydra doesn't like me"?

[rustic sage]

It says connection error

Netexec doesn't say that, machine responds to pings

[fathom pendant]

Netexec doesn't necessarily rely on pings for connection testing

[rustic sage]

No no it was just to tell him the machine is alive

[fathom pendant]

¯_(ツ)_/¯

[rustic sage]

Do u know what I should do

[ocean night]

Is your target still up? IS it within the VPN or not?

[fathom pendant]

Obtain skill [joking]

Try resetting the target

[rustic sage]

Yes target is up and life is up to 300 minutes, yes vpn

[gusty carbon]

Please pm me

[fathom pendant]

You were here asking before

And no, no one is gonna help you with server hacking

[rustic sage]

But I don't think it's abt the target bc it's not the first time I try doing this module

[ocean night]

[cloud urchin]

you may want to figure out your hydra issue, i don't know but i would wager hydra is faster that netexec since it's specifically designed for authentication stuff

[rustic sage]

I had the same problem the last time

[rustic sage]

Ok

Lemme see

[cloud urchin]

if your syntax is right it should work, you can also try it on the pwnbox

[rustic sage]

How am I supposed to paste in pwnbox

[cloud urchin]

in the right hand corner there's a clipboard you can paste things into

it shares the clipboard with the pwnbox

[rustic sage]

Hydra keeps saying "error all children were disabled due too many connection errors"

[thorny sluice]

Still kinda lost I know what doesn't work though which is attacking the tmp folder and files nor the help parameter

[rustic sage]

And its even written grammatically wrong

[cloud urchin]

check your command syntax, sounds like it's probably wrong. check the ip/port

[cloud urchin]

proxy the site through burpsuite, turn on the proxy, click on every single button/link you see on the whole site. review what's happening with each button/link.

[rustic sage]

hydra -l sam -p mutated.list ftp://<ip>

It starts

But then after like 10 seconds it says that thing

[cloud urchin]

wrong syntax, check your syntax.

[winter schooner]

yeah i was at the same spot a bit ago, if hydra just does not work at all, just use medusa

but try not to make too much threads or it wont work

[rustic sage]

Bro netexec has been running for 2 hours now

[winter schooner]

yeah netexec is not answer im pretty sure

[rustic sage]

Mmmmm

[winter schooner]

hydra -l sam -P mut_pass.list ftp://<$target_ip> -t 48 -v

use this command and if hydra still doesnt work then use medusa, the mistake u made is lowercase p, which specifies single password not wordlist.

[rustic sage]

Ok I got netexec medusa and hydra running all the same thing

Ig I'll just let my computer lay there and power it on tomorrow morning

[winter schooner]

dont run multiple brute forcing on one target

their gonna interfere with eachother and its gonna get messy and just not work, im speaking from experience

[winter schooner]

you can shorten the wordlist alot using this command

sed -n '/^[[:alnum:][:punct:]]{11,}$/p' mut_password.list > mut_pass.list

and the password is not too far down the wordlist, it will still take around 30 mins though.

[fathom pendant]

I don't suggest changing the wordlist that they have you generate

[thorny sluice]

Did that and somehow I'm still in the same place

[unique heath]

I am stuck in the web attacks module of chaining idor Vulnerabilities question is Try to change the admin's email to '[e-mail]', and you should get the flag on the 'edit profile' page. Can anyone guide me on the steps I should follow to get the flag? Please reply

[cold star]

Hey guys, dropping this message again
I am stuck in active directory Enumiration module under bleeding edge vulnerblities there in print nightmare there is no cve.py avliable in the machine I have rested the machine many times

[final shale]

Just use MSF

or get the python script from github its a know vuln.

[acoustic owl]

ask in #boxes
If you have no access, read and follow #welcome

You are in the wrong channel
This channel is about modules in the Academy 😉

[cold star]

In the attack machine there is no internet so I can not clone the repo

But yea I just looked it up it can be performed using metasploit

[acoustic owl]

If I remember correctly, the required tools can be found on the machine under C:\Tools

#boxes

[cold star]

Linux Attack Machine It Is.

[final shale]

You can pivot from your host

[cold star]

How can I? I have tried researching about this but to no avail

[unique heath]

I am stuck in the web attacks module of chaining idor Vulnerabilities question is Try to change the admin's email to '[e-mail]', and you should get the flag on the 'edit profile' page. Can anyone guide me on the steps I should follow to get the flag? Please repl

[final shale]

There is a module for pivoting in the academy i recommend reading.

[cold star]

Thank's For The Tip, I would do it after completing this module

[hard phoenix]

I’m on the burp intruder section of the using web proxies module. I want to know if I’m doing this right. I have common.txt as the payload and added .html suffix. It’s taking forever to get through it and I’m wondering if this exercise was meant to be this long

[cold star]

Same problem here also

[final shale]

Uh oh nothing is ment to be too long in the academy. The goal is to learn and not wait for brute force or fuzz

[hard phoenix]

Weird. It went through the whole 90 minute time and didn’t even get through the lowercase a’s lol

[final shale]

there is no file in that directory

[cold star]

but there is no other directory which contain tools

• I can not download becuase no internet

[hard phoenix]

What am I doing wrong?

[autumn pilot]

that doesn't prevent you from having tools on the system

[cold star]

How can I do that? Becuase the tools are not preinstalled

[wide moth]

DId anybody solve JSON module in Advanced Deserialization Attacks? All my payloads dont work. Could anybody give me a hint?

[fathom pendant]

Transfer the tools

[autumn pilot]

last time I checked the tools were there

[cold star]

I am sorry, how can i do that

[cold star]

I have tried resetting the machine atleast 5 times but no good luck

[autumn pilot]

there is a module dedicated on file transfers

[fathom pendant]

I suggest looking into the file transfers module, there's a plethora

[autumn pilot]

Resetting the target won't move the files or change your current working directory

[cold star]

Also terminated and started new machines

[hard phoenix]

I’m still super stuck on this

[tulip bobcat]

how do you know the tools are not on the machine? did you search for them?

[cold star]

Yea searched in every folder but not present

[tulip bobcat]

how did you search? please tell me 🙂

was it grep? was it find ?

[cold star]

checked in all thes folders but not any file ehre

[tulip bobcat]

that's not searching in linux... use find... it will be something like find / -name blablafile 2>/dev/null

[cold star]

okay lemme try

[tulip bobcat]

you should do linux fundamentals before going into a ny windows/ad attacks

[cold star]

I am really dumb, So so sorry for wasting your guy time

[tulip bobcat]

it's fine taht's what this server is for 🙂

[cold star]

Thanks

[hard phoenix]

Someone please ;-;

[tulip bobcat]

i've not done that module but if you can give me a bit more context and please upload a screenshot not a phone picture then i may be able to help

[hard phoenix]

I'm supposed to find a .html file in the /admin directory of the site

[autumn pilot]

neither of the steps from the screenshots you've shared indicate searching for html files

[tulip bobcat]

why are you skipping the names that start with a dot ?

[hard phoenix]

Then I don't know how to search for html files based on the information in the section

ive tried without doing that

[autumn pilot]

check the hint

[tulip bobcat]

no no no you are doing good about html files

you are using the payload processing right

[hard phoenix]

But I can also just add the .html as a suffix right?

[tulip bobcat]

i'd say your problem is or can be that you skipp the words startigwith a dot and you grep for the wrong output. what's ithat file ?

[unique heath]

I am stuck in the web attacks module of chaining idor Vulnerabilities question is Try to change the admin's email to '[e-mail]', and you should get the flag on the 'edit profile' page. Can anyone guide me on the steps I should follow to get the flag? Please reply

[hard phoenix]

I've gone through the payload without skipping also

it was taking foreeeever

[tulip bobcat]

set the grep match like this:

[hard phoenix]

lets see if that works. running it now

[tulip bobcat]

i just started the lab now 😄

ok i found the flag.. but i'm using zap

[hard phoenix]

what the

[tulip bobcat]

how slow is that burp comunity ?

did it finish yet ?

[hard phoenix]

It goes through like 1 line a second

or more than 1 second

[tulip bobcat]

yeah... that's slow as hell haha

[hard phoenix]

damn

[still fractal]

hello guys! Can someone help me in a box?

[storm elk]

@still fractal This channel is for Academy modules. Please check the channel directory for the box you seek help for. If there is no channel, #boxes would be the place to ask. If you can't access it, please follow #welcome

[hard phoenix]

are you able to give me first letter of the file so I can just see if I'm doing this right? or is that not allowed. or would it be different for us anyways

[tulip bobcat]

it won't be different. however i think you are doing the right things. how are you looking for the results ?

[hard phoenix]

well there haven't been any. It's all just 404

and time runs out before I can get through the payload

its infuriating

[tulip bobcat]

expand the time, give me a screenshot of the results please also with the request sent

[hard phoenix]

there isn't a button to expand the time for me

[tulip bobcat]

ah yeah there isn't one for me either on this one ah.. show me your results and the requests so i can see what's wrong

[hard phoenix]

Yeah just had to start up another one so I'm restarting and I'm just gonna let it get through as much of the payload as possible

[tulip bobcat]

are you sure it's making the right request ?

[tulip bobcat]

look at the results, click on any of the 404 and aon the buttom you should see the request it made... please screenshot that

[hard phoenix]

gotcha

[tulip bobcat]

yep it will never work 🙂

[hard phoenix]

what

[tulip bobcat]

something is wrong somewhere...

remove your payload encoding if there is any

[hard phoenix]

mmk

[tulip bobcat]

you see the payloads? that's wrong. they should simply be wordfromwordlist.html

[hard phoenix]

Like this?

[tulip bobcat]

yes

also remove the last / from the request

[hard phoenix]

alright NOW lets see

lol

[tulip bobcat]

found it now ?

[hard phoenix]

no

It's slow

[tulip bobcat]

when you done with this and go to zap you will love how fast zap is haha 😄

ook has anyone done the footprinting module ? i've finished it all but the host based enum DNS ... i can't find the answer for this one: What is the FQDN of the host where the last octet ends with "x.x.x.203"? hint doesn't help i've literally run all of the wordlists

[hard phoenix]

gonna take a nap while it runs is what imma do

[tulip bobcat]

you should've got it by now..

[hard phoenix]

just got to 1992.html in the payload

not even in the letters yet

[tulip bobcat]

jeeeeezzz that's slow as helll.. but you are close

[acoustic owl]

@tulip bobcat take the smallest list. If you don't find anything, use the next bigger one

[tulip bobcat]

no no no don't stop it now you are close

[acoustic owl]

Lists with 5000 entries or more are too large

[tulip bobcat]

yeah i've tried the small ones already 😦

[hard phoenix]

oh my god

[analog dock]

And probably faster to do with ffuf than burp intruder on community edition

[acoustic owl]

Have you found all the zones?

[hard phoenix]

i fouond it

[tulip bobcat]

he needs to learn burp hence why i've not suggested other tool

[analog dock]

Better to learn with other things

Don’t use intruder on community edition

It’s too slow

On burp pro it’s fine

[tulip bobcat]

i believe so 😄

[hard phoenix]

welp. I'm very aware of that now haha

[tulip bobcat]

jump onto zap now, you will love how fast it is

it's gone through the common list in a couple of seconds for me

[analog dock]

Ew zap

[hard phoenix]

Yeah I like burp just not for intruder lol

[acoustic owl]

Send me a DM with the zones you have found

[tulip bobcat]

hey everyone is free to like any tool haha 😄

[hard phoenix]

Goodnight all thanks for the help I was going insane

[tacit bay]

anyone able to point me in the right direction for sliver skills assessment? I'm struggling to pivot effectively.

[dapper moth]

Sure

Where are you at?

[tacit bay]

can I DM? dont want to spoil

[dapper moth]

Sure

[tulip bobcat]

thx man, i've finally managed to finish my footprinting module 😄

[sly kelp]

Hello I'm working on Attacking WI-FI protected SETUP module and inside.

Online pin Brite force using reaver section

The question is what is WPA PSK for cor-vpn

It is running for last 2 hours

The same question for Another network took only 1 minute I tried resetting the lab but still

Any help will be appropriated

[dapper moth]

Is that the second flag?

If it's running too long, your approach is wrong

Try something else

HTB Staff wouldn't create something that required you to run a tool for 2 hours

Or would they 👀

[sly kelp]

Yeah it is second Question and I ran out of all my possibilities to solve this

[dapper moth]

There are 3 "uses" of reaver detailed in that section and 3 flags

Since you got 1 already and the last one is by itself in the question, why not try the last technique?

[sly kelp]

My stupid head Lol

Just found out now

Thanks

Your discord tag helped me here

[obtuse horizon]

Hello, guys, hope you day is going well!

I am currently trying to solve Login Brute Forcing - Web Services lab. It asks me to brute force SSH using Medusa. Issue is that I am using 2023-200_most_used_passwords.txt wordlist and I as a username I mention sshuser (as represented in the lab). I mention HTB generated IP and HTB generated PORT. It takes medusa up to 10 minutes to finish but it doesn't show me the password. What is it I am doing wrong?

I would appreciate any help regarding this 🙂

[tulip bobcat]

what is the command you are using ?

[obtuse horizon]

sudo medusa -h 83.136.254.158 -n 42786 -u sshuser, admin -M ssh -t 5 -P 2023-200_most_used_passwords.txt

[tulip bobcat]

well that sounds right, might wanna check a different wordlist ?

[obtuse horizon]

Also checked most 20 passwords used for ssh. I will continue my investigation and keep you posted. Thank you 🤝

[tulip bobcat]

actually i've just run it and it found the password... it's inm the same wordlist you got

medusa -h 83.136.254.158 -n 34260 -u sshuser -P /usr/share/seclists/Passwords/2023-200_most_used_passwords.txt -M ssh -t 10

[obtuse horizon]

maybe the machine is malfunctioning, I shall restart the instance

Also I've read that when you increase the -t it can drop some passwords, is it true?

[tulip bobcat]

yes it's true

but i think t 10 is fine in this instance

[elder hearth]

Anyone give us a nudge for the VNC password question on SA for Windows Lateral Movement module?

[dapper moth]

What session have you got?

[elder hearth]

I got the WSUS update to work and got admin on support but stuck on VNC password.

[dapper moth]

You will need admin privs in the VNC Server.

[elder hearth]

yeah I guess the server is on the DC?

[dapper moth]

Have you port scanned the Hosts? If you port scan DC you'll see that it's somewhere else

[elder hearth]

gotcha

[dapper moth]

VNC runs in port 5900

[astral ravine]

My life has become htb theme

Even I use htb theme in obsidian

[unique heath]

I am stuck in the web attacks module of chaining idor Vulnerabilities question is Try to change the admin's email to '[e-mail]', and you should get the flag on the 'edit profile' page. Can anyone guide me on the steps I should follow to get the flag?

[gray yacht]

Like you've done everything you think is necessary and yet you didn't get the flag?

[median gale]

Fellow friends, i was wondering how do you organize your tools for Win when there is not such all in one toolset such as kali for win targets. Currently keeping a folder of all the tools given to me in the modules by HTB and was wondering if there is a smarter way to tackle this.

[fallen merlin]

Good morning, everyone! How's it going? I'm starting my journey in hacking and have begun studying with HTB Academy and labs. I’m currently practicing with the Starting Point exercises, too. Honestly, I feel a bit lost about what to focus on first. Do you have any tips for a beginner on where to start? I’d like to work in Red Teaming, and right now I’m following the bug bounty path on the Academy and practicing with HTB lab’s Starting Point. Thanks!

[reef hazel]

There actually is, give CommandoVM a try:
https://github.com/mandiant/commando-vm
I personally would use a VM platform like this instead of holding onto tools on my host machine.

[dapper moth]

Download them as needed 😂

Just get your notes for whatever you'll need and the commands and urls will be quick accessed

[fervent siren]

help me with this https://academy.hackthebox.com/module/19/section/103

what to put in answer ?

[rustic sage]

Guys I'm in password attacks> password reuse/default password. I am inside ssh from the previous module but I don't understand how to login mysql . I tried the default password but its letting me in

[shut quest]

read the section again, all the way through slowly, there's some good stuff in there

[fervent siren]

https://academy.hackthebox.com/module/19/section/108

[cyan arch]

no tengo acceso a ese modulo :/

[shut quest]

#general message

[fervent siren]

bro fix this thing i can't get the flag https://academy.hackthebox.com/module/19/section/108

[fervent siren]

your cpts yooooooo

[fathom pendant]

Nothing is broken

Nmap is only one part of the puzzle here

[fervent siren]

i am not a pro bro i am noob tell me which port to look for

[fathom pendant]

I'm not telling you exactly what port to look at.

[storm elk]

Maybe it’s best to go over fundamentals

[fervent siren]

bro you don't make any sense

there is 7 ports

[storm elk]

We won’t hand you the solution

[fathom pendant]

Start with the obvious, fundamental, ports

[fervent siren]

idk obvious ports

[fathom pendant]

Also in your basic/standard scan include -sV so you can get some understanding

[fervent siren]

bro it will show SERVICE VERSION

i know nmap i am not new in it

but i can't just find the flag

[fathom pendant]

Well that section says using NSE, meaning use nmap scripts

[storm elk]

Read the section again maybe

Try some stuff out

[fervent siren]

but which script

[storm elk]

The solution is in the section

[fervent siren]

thank you guys to help i appricate that hope god help you guys too

[fathom pendant]

We aren't giving you a direct answer because that would defeat the purpose of learning, but try the commands shown and you might have luck

[fervent siren]

it will help alot thank you

[dim wolf]

some amount of critical thinking is necessary. we can't do that for you

[fathom pendant]

And even then nmap will only give you a place to look

[fervent siren]

thank you guys to tell these things i appricate that a lot thank you

can anyone tell how will the flag look ?

i don't want to miss flag

[storm elk]

Like most other flags

[fervent siren]

idk how the flags look

[storm elk]

HTB{yapyap}

[fervent siren]

ok

hope i get it

[rustic sage]

I read it again

I don't get jt

[fervent siren]

me too

[rustic sage]

It's saying most services come with pre configured passwords

[rustic sage]

R u in the same module?

[fervent siren]

no man

[fervent siren]

but try default passwords hope it works

[fathom pendant]

There's a pw cheatsheet

[rustic sage]

Yes I already tried those credentials

[shut quest]

The blue links within each section are worth checking out

[plain shuttle]

Hey guys

[fathom pendant]

There's specifically a default credentials cheatsheet

[rustic sage]

Yes I tried it but there's no mysql

[teal sparrow]

https://academy.hackthebox.com/module/109/section/1037 stuck on the lab here my payload is ip=127.0.0.1%0aecho%09${PATH} i get invalid input but soon as i remove echo it goes fine so echo is prolly blacklisted but idk how im supposed to read the path without echo

[fervent siren]

bro do ls

[fathom pendant]

There is, it's running internally

[rustic sage]

I don't understand are you talking about the cheat sheet or the machine?

[fathom pendant]

Why are you trying to read the path?

[plain shuttle]

I am trying to get into forensics. My college at work who is on our forensics team gave me a challenge: figure out how to get into an excel sheet he provided. From what I have gathered excel uses aes-256 encryption but I gotta do more research on this specific file version.
My question are some ideas on what tools I could look into or more reading material to further go down this path of learning. I don’t want the answers just direction so I can find them on my own.

[fathom pendant]

The machine

[fervent siren]

i am just stuck so bad at https://academy.hackthebox.com/module/19/section/108

[fathom pendant]

It's why the first instruction is to ssh

[fathom pendant]

Use one of the script types shown in the example

[fervent siren]

you know that your helpful

[rustic sage]

Yes I logged into ssh and I tried different command with mysql. I tried different default passwords to login to mysql but it's not working. I opened the cheat sheet in the module but I'm searching mysql with ctrl+ f and there's nothing for mysql there

[fervent siren]

i think you just said

[fervent siren]

bro there is written cheat sheet

but my hint cheat shit or nothing works just submit button and spawn target

[rustic sage]

Are you in the same machine I'm doing?? Do you know what we are talking about?

[fervent siren]

bro it is simple

there is cheat sheet

[rustic sage]

Can you answer me

[fervent siren]

look

[rustic sage]

Are in the same freaking module? If not pls stop, you can't talk about something you don't know

[teal sparrow]

idk but when i try to do like ls then the ${PATH:0.1} for the slash and then home i get nothing im clearly being an idiot but my brain just aint switched on rn

[viral lotus]

Password attacks skills assessment - easy lab - is the password cracking usually a long process on it? and other than increasing the thread count what else can I do? It has been running for over an hour right now

[teal sparrow]

shouldnt take that long

[fathom pendant]

It's not 0.1 it's 0:1

[fervent siren]

bro every module have cheat sheet

[shut quest]

there's your problem, review the list, think of things related to mysql

[teal sparrow]

thats just a typo

[fervent siren]

wdym

[teal sparrow]

not u

[rustic sage]

Mssql?

[fathom pendant]

Please stop trying to give them advice tbh

[rustic sage]

Yes pls stop

[teal sparrow]

@fathom pendant that was just a typo in my payload its a colon

[fervent siren]

i am trying every script on every port nothing works

[fathom pendant]

Yeah ${PATH:0:1} will/should be /

[shut quest]

no, but if you think of what mysql is, you'll get it!

[fervent siren]

tried everything nothing gives me flag

: (

[viral lotus]

I figured that I used the mutatated list from the resources and I am running Hydra with -t 48 but doesnt seem to be doing much

[fathom pendant]

You can run like --script <type> without specifying

[fervent siren]

wdym

[fathom pendant]

It's told to you in the section

[fervent siren]

/usr/lib/nmap/nmap: option '--script' requires an argument

[rustic sage]

Uhhhhh it's a database?

[fathom pendant]

I meant specify the type my guy

[fervent siren]

agggg ok

[fathom pendant]

Replace <type> with the type of script

You don't need to specify a port

But one may seem interesting

Knowing what default ports map to is important

[fervent siren]

ok

[shut quest]

oh i just looked at the list, yeah you should be able to find it as mysql >.<'

[fervent siren]

port or script ?

[rustic sage]

Tffff

Ill send a pic

[shut quest]

just dm

[fervent siren]

man your elite level i mean elite is kinda my favourite rank on everything

[teal sparrow]

@fathom pendant
ip=127.0.0.1%0als${PATH0:1} this works and lists style.css and index.php but when i do
ip=127.0.0.1%0als${PATH0:1}home i get just the ping results

[fervent siren]

anyone pls help about https://academy.hackthebox.com/module/19/section/108 i need nothing just pls help me in this

[empty trout]

i am doing windows file transferes and in upload operations we can upload file from powershell with wsgidav cheroot python module by running this server and copying the files on this server from powershell and cmd but i cant list that share on windows machine

[fervent siren]

pls

[rustic sage]

Dmd

[rustic sage]

Bro u keep spamming the link just say what room ur in and describe the problem

[fervent siren]

i just can't find the flag

[rustic sage]

Jesus ghrist this fuyt

[fervent siren]

YOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

IFOUD THE FLA

FLAGGGGG

[empty trout]

-sC -sV

[fervent siren]

IFANLLLYLYY

[empty trout]

anybody

[fervent siren]

i knew this will be in that shit port

but why didn't i checked it beofre

i am so stupid

wait is htb trolling ?

it says my flag is wrong

HTB{******}

[empty trout]

remove white space

[fervent siren]

ok

[fervent siren]

still

[fathom pendant]

Try, perhaps, something like "h"o"m"e

[empty trout]

.

[fervent siren]

anyone help

[teal sparrow]

ill try and if that works thats dumb as hell 😭

[fervent siren]

i got the flag but it says it is wrong

[teal sparrow]

ur clearly just copying it wrong

[fathom pendant]

I believe that method is gone over

[fervent siren]

bro how to copy it rightly

[fervent siren]

@fathom pendant

[teal sparrow]

windows yuck

[fervent siren]

yep

@fathom pendant help

[teal sparrow]

make sure u dont got any spaces before ur flag or after or it wont work

[fervent siren]

HTB{*}

it just don't work

@empty trout help

[teal sparrow]

are flags the same for everyone?

[fathom pendant]

It should be, if I'm not mistaken, be in a specific .txt file

[fervent siren]

yep i guess

[fathom pendant]

Yes

[compact harness]

Any hackers ?

[teal sparrow]

@fervent siren dm me ill check its right

[compact harness]

I am an Aspirant

[fathom pendant]

That's not the right flag

[empty trout]

its wrong

[fervent siren]

why ?

[fathom pendant]

Because that's not the right flag

[empty trout]

try one more time there is nother maybe that is not the one bcz

[fathom pendant]

There's a different service with the flag expected

[empty trout]

its not machintg with my flag if all the flags are the same

[teal sparrow]

yh we all are here

atleast most of us

[fathom pendant]

It's hinted at within the section which port to look at

[fathom pendant]

#rules and #welcome

[fervent siren]

i can't open hint my just don't work

[empty trout]

hey resolve my issue tooo........

[fathom pendant]

I'm not talking about the "hint" button

[empty trout]

are u using brave pop up will not appear in brave

[teal sparrow]

sounds like ur htb connection just dead then just refresh ur page and stuff

[fathom pendant]

I don't know how to fix ur issue dude

[fathom pendant]

Likely adblock/popupblocker

[teal sparrow]

what module is it i dont think i done it yet

[empty trout]

windows file transferes

[teal sparrow]

nah tbh mine does that all the time and i always have to refresh

[fathom pendant]

You don't have to use the described method, you can use another

[teal sparrow]

yeah i did that but i aint got no notes cuz im an idiot what section is it again?

[empty trout]

i am trying on a local vm i am not using rdp

[fathom pendant]

From what I heard wsgidav is just a PITA

[empty trout]

yeah but everythingi s working fine but i wnna try this one its very new to me

[empty trout]

i mean in file transferes module in windows file transfer section

https://academy.hackthebox.com/module/24/section/160

[teal sparrow]

alr im spinning up the machine see if i can get it to work

[empty trout]

yeah

[compact harness]

U are a hacker ... Nice to meet u

Well me too kinda ... But still learning ... Thats why aspirant

[cerulean gust]

trying to preform windows.memory.Acquistion using Velociraptor

keep getting this error becuse the machine is isolated from the internet

Checking WinPmem64: While resolving github
release Velocidex/WinPmem: Get
"https://api.github.com/repos/Velocidex/WinPmem/releases/latest": dial top: lookup api.github.com: no such host

[fathom pendant]

This channel is for help with the academy modules on http://academy.hackthebox.com

[teal sparrow]

never stop learning in this industry trust me

[compact harness]

Yeah

I love this Industry ...

What Recon Tools are ur fav ?

[fathom pendant]

This isn't an idle chatter room

[teal sparrow]

depends what sort of recon ur doing lmao

[opal nexus]

Has It ever happened to anyone that while having reverse shell from windows, attempting to run exe/powershell scripts wont return in output (when it most likely results in error, probably permissions based errors)?

[fathom pendant]

Read and follow #welcome

[compact harness]

Any Recon ?

[compact harness]

Like OSINT

And why the Hell was my Username changed to Ari McVerify 😭

[fathom pendant]

#welcome <--

[teal sparrow]

dont really do osint lol

for penetration tests its good but rn im just doing labs and working on bug bounty

bug bounty has some osint tho

[fervent siren]

Please just tell me the port or i am not using htb Academy anymore

I am not in pc too

[fathom pendant]

It's one of the ports you've found

[fervent siren]

Currently on phone

[fathom pendant]

I'm not telling you directly

[teal sparrow]

oof

[fervent siren]

It id common sense

[fathom pendant]

Web will be the only hint

[fervent siren]

You mean 80 and 455 port ? Or the weird 33 something elite called port

I found the flag at the weird port

[fathom pendant]

455 isn't web

[fervent siren]

I see nothing in 80

[fathom pendant]

Also 445* smb

[fervent siren]

I see nothing in 80

[fathom pendant]

Well then manually investigate what the scripts, like vuln, may reveal

[fervent siren]

Ok tommorow i will not today thank you for telling that that i already knew

But isn't it troll to put a fake flag at elite port

[teal sparrow]

im running the scan now ill help u out just give it a min

[fathom pendant]

It's a flag for a different section

[fervent siren]

Ok

[fathom pendant]

It's why I said earlier, stick with fundamentals

[fervent siren]

Bro thank you but just relax let me learn

[teal sparrow]

yeah im not gna give u the answer lol

welcome to the club what bike?

[fervent siren]

Sister see already i saw another flag so i am so confused

[empty trout]

@teal sparrow have u tried

[fervent siren]

You can dm

[teal sparrow]

nah i installed ubuntu like 2 days ago and i have 0 tools 😭

[fervent siren]

Bye guys

[fathom pendant]

Lets keep the chat on topic

<@&861185840277487616>

[teal sparrow]

done

[empty trout]

i can list the directories on web but why not on terminal

[spare fossil]

Intro Sliver C2, Anyone knows if sliver still supports multiplayer mode ? I can't get it to work

[opal nexus]

anyone has an idea?

[dapper moth]

It does

[spare fossil]

To make a new operator, do you use that new-operator command??? It doesn't seem to recognise it, nor does it recognise the multiplayer command.... did you encounter that?

[dapper moth]

Are you making sure to run the commands in the Sliver Server bin!?

[spare fossil]

I'm just typing sliver in my terminal 😅

[dapper moth]

Are you doing the module!? Check again.... The Module's content, it looks like you are running stuff in the Client and not the Server

[*] Generating new client certificate, please wait ... ```

It should be preceded by [server]

[snow briar]

Hello everyone, I've been having an issue on the following question in the Wifi pentesting module: Decrypt the file located at /opt/decrypt.cap using airdecap-ng. Look for sensitive data indicating a user is attempting to log in to a website with a POST request. What is the password entered during this login attempt? (The WPA key for ESSID named CyberNet-Secure is Password123!!!!!!)
So I already decrypted the capture file using airdecap-ng and opened it using wireshark, I then used the display filter: "http" on wireshark to see the http conversations, after following the TCP stream of the POST request using Wireshark, I was able to to find the username which allowed me to answer the first question, I was also able to find the password, the problem is that the question is marked as wrong in HTB even though I'm a 1000% sure that its the correct answer because there is only ONE post request and only ONE login attempt in the entier capture file, so i'm left wondering if this is a mistake on the platforms end, because like I said there is only one POST request.

[spare fossil]

I don't have the module yet🥲 I am doing it for a project... I'm running it from the server rn

[dapper moth]

You can DM me what you got. I can tell you what might be messed

[rich wraith]

wifi pentesting basic skills assessment, question 3: I cant connect to the wifi

[snow briar]

Hey bro i just sent you a DM

[dapper moth]

There may be something stopping you from accessing

[spare fossil]

The problem that I've been having

[rich wraith]

but what? my config file for wpa_supplicant is correct

[dapper moth]

The device you are trying to connect to

You can do it easily with GUI in a non hidden wifi network

[rich wraith]

but this wifi is hidden

[dapper moth]

And there is one not hidden

[spare fossil]

That's how you start the server right ?

[snow briar]

Thanks B5null

[spare fossil]

I should use the binary!!!!!!!!????

[dapper moth]

wget -q https://github.com/BishopFox/sliver/releases/download/v1.5.42/sliver-server_linux; chmod +x ./sliver-server_linux

[spare fossil]

Thanks for the client let's get to work, send over the cfg 🤣

Thanks mate. I think it's gonna work now

[dapper moth]

You'll need to set the Server too

[spare fossil]

Alright

[rich wraith]

but I cannot connect to it

[midnight galleon]

shouldn't dev user have SeDebugPrivilege?

[dapper moth]

There may be something stopping you from accessing

[spare fossil]

Well well well @dapper moth I appreciate your help mate... days of frustration

[dapper moth]

Probably one thing you haven't since you aren't connecting

Read the last sections again

If I give you more than this it would be too much spoiler

[storm elk]

That’s not how it works 🙂

What’s the point of that?

[quasi flint]

Can I ask a question about a retired machine here, or is there a better place?

[storm elk]

#boxes

[quasi flint]

thanks

[sacred garnet]

might be that I am too tired, but I am going through "Information Gathering - Web Edition" - The "Creepy Crawlies" section, where it tells me to reconspider the inlanefreight.com domain, but there is ip/dns info? I have app.inlanefreight.local and dev.inlanefreight.local from a previous task, but not inlanefreight.com - what am I missing?

[tropic pasture]

I havo no acces to this... how do i fix that?

[urban elk]

read #rules and #welcome

[urban elk]

if you mean that there is no ip info, inlanefreight.com is reachable on the internet, try it out

[dusty cape]

I pinged the host, it's active

[storm elk]

As mentioned by others, follow instructions in #welcome

[sacred garnet]

Thanks a lot.. didnt think to check the internet 🙂

[thin citrus]

nodemon

[tribal wolf]

Is there someone who is knowledgeable about AD penetration?

I've gone through the AD Section, but doing the skills assessment section, I feel like I dont think I understood it well

[lusty hearth]

hint?

[dapper moth]

Have you restarted the target?

[naive steppe]

Yo guys, i am trying to complete this LFI/RFI Module, and when i spawn the target machine and i start working on it, and it just keeps crashing. Like it is working just fine, and then sudenly i just get connection timed out, and i cant ping the ip, i cant trace it not even scan with nmap nothing. So i have to spawn new target machine, then it starts working for like five minutes, then it crashes again. How can i resolve this??

[dusty cape]

yes multiple times, also my vpn connection

[dapper moth]

Easier to ask your question

[iron oar]

confirmed same for me

[dapper moth]

Were you able to connect to the Hidden one!? I got some errors with wpa_supplicant but I think something in my conf file is wrong

[tribal wolf]

I guess it wasn't really a specific question but I'm on AD Enumeration & Attacks - Skills Assessment Part I at:

Submit the contents of the flag.txt file on the Administrator desktop on MS01

And I guess maybe I'm just too tired to really think about how to proceed from the previous section but when I looked at the hint, it said I needed to proxy over to the MS01 via the Web Application host and I don't really understand how I would have figured that out

Idk if it was just obvious, or what I would have need to have done to figure that out

[lusty hearth]

Api Attacks: Broken Object Level Authorization
Can I get a hint here?

[dusty cape]

If I remember correctly there was a 5G Wifi to which you can connect via GUI. But there is a catch, you can't connect directly.

[dapper moth]

This path I've done it already

[dusty cape]

I think i wasn't able to connect ot the hidden one

[dapper moth]

I'm trying to get to the alternative path

[dapper moth]

You can "arp -a" or once you get a session to a host, check it's ip configuration, see if there is any other ip address and subnet and then tunnel to scan for different targets

[tribal wolf]

that makes sense.

I guess I'm just too overloaded with life rn to be focused on the HTB Course. Think I'll take a bit of a break and come back with a clearer head

[gray yacht]

Yeah, you can DM.

[small sage]

If you’re still stuck check which login credentials you’re using, they’re different for the question than in the example

[sacred gull]

Adapting Sealtbelt.exe to not be detected by Windows Defender. What is threatchecker calling out here?

[hasty light]

Has somebody finished OSINT: Corporate Recon? Stuck with Cloud Storage and tried a bunch of ways, but nothing worked for me... bit desperate

[lusty hearth]

perfect, that was it. ty

[rustic sage]

Guys for credential password attacks> credential hunting in Linux I have to use the mutated password list from a few modules before this right?

[shut vapor]

Yes, that sounds right to me. This module has some tricky bits like you describe.

[rustic sage]

Uhh hydra is saying it's gonna take 7 hours

[shut vapor]

hang on I'll poke at my notes and see if you're off course.

[rustic sage]

Thx

[shut vapor]

You're on the right path, but my notes don't indicate what tool I used, only that I attacked the services I could access.

It obviously shouldn't take 7 hours. Either adjust your tool settings, try something different, or consider if your lab is bunk and give it a restart.

My notes do suggest this one was "frustrating" particularly because, AFAIK, you must look at the hint to have any clue as to where to start.

[rustic sage]

Yesterday i was doing another other room and hydra took like 3 hours. Idk why, I got the -t 48 flag

My cpu is at 5% on Kali VM and I have 4 terminals open all cracking different services. Hydra always gave me problems idk why it's not showing high CPU usage

[gray yacht]

Did you open it with ghidra or similar tool to check out that offset? FYI, I haven't done the module you're working on, just what something I would do when running stuff through threat check.

[sacred gull]

I am compiling the program it's checking

@gray yacht

[iron lintel]

Someone here solved Linux Special permission section? Do I have to go to every directory en do ls -l and see what is missing in the output of the commando they gave me?

[last spruce]

i just got here

[gray yacht]

You can DM if you'd like.

[sacred gull]

Yes please

[unique ether]

can someone give me a hint for password attacks lab medium im already in the machine as a user

[iron lintel]

Someone?

[last spruce]

hey um

what do i do

it looked cool but i think its more than just talk about nerd stuff

from looking at the rest of this

[sacred gull]

What do you need help with @last spruce

[ocean night]

Nerd stuff? Nerds make the world go round 😆

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

Can someone help me check my gpu? Idk why but cracking stuff always takes hours even when people here say it takes 20 minutes max for a module

[sacred gull]

Are you using hashcat on your host or in a VM?

[viral snow]

Were you able to get it figured out? I ran into the same problem. I could use help, please.

[north bramble]

Yeah. Dont compile it on the host/pwnbox. Transfer the .c file to target and then compile with gcc. The gcc versions on pwnbox and the target dont match.

[shut wraith]

Select functions and files through search. This technique is much faster and quicker, though it is not as comprehensive and may lead to many missed opportunities. We can search for certain sensitive functions through the code base (e.g. with find/grep or text-based search). For example, if we were dealing with a PHP web application, we may consider searching for functions that execute system code, like exec, system, passthru, and others, as we will see later in the module.
Hey guys. Why is it difficult to find key functions in a whitebox test? Dont developers have some way to like organize all functions into one place to manage their development of the app ? It seems very disorganized

[ocean night]

Why is it difficult? There are different frameworks and structures developers use. How are you struggling exactly?

If it's a whitebox test, you have access to the source and are able to navigate the codebase and are aware of sensitive methods etc, it should not be too difficult

[shut wraith]

I dont want to spend time enumerating for key functions in a whitebox test. Things like VScode should have a method of organizing all functions for me -- developers should be using such a method to develop better

[ocean night]

And how would you have it organise functions?

[rustic sage]

Vm

Hydra too

[ocean night]

At the end of the day, developers will code appliances as they see fit, following a framework, or not

[shut wraith]

It takes all functions and puts them in a table with all their relations and what they call and everything

[ocean night]

That's called static analysis

As part of a whitebox test, it's your opportunity to understand the underlying logic of the appliance, and then to understand what mechanisms may be abused, what unsafe functions may be called and how you could potentially reach them in order to abuse them

The style of the project, while sure you could scrutinise a developer for, is not part of the job 🙂 There are modules out there which provide static analysis features for various languages in VSCode, I'm sure

(like GitHub provides when selecting classes, function calls, etc)

[viral snow]

Boom! Thank you! Phew, that was scary! 😆 I appreciate your help 🙏🏽

[ocean night]

But as static analysis goes, that's basic stuff

[shut wraith]

Thanks I will try to develop my own method to automate as much as possible

[north bramble]

Glad I could be of help.

[ocean night]

Sure.. just, don't spend more time developing your methods than is required to complete the white box task 😉 Easy to get caught in that rabbit hole of "surely I could just.."

Going down the road of static analysis, variable taint paths, that kinda thing.. it really is a rabbit hole

Fun though 🙂

[sacred gull]

On vm it will always be slower

[supple lotus]

Any of the Pentest modules focus on code review? I need to get much better at doing them. Specifically Java code review

[shut wraith]

Yeah there is

The intro to whitebox (im doing now) and the whitebox attacks, and the javascript obfuscation modules

And if u want to get better at code review, replicate the web apps u attack and then review their code and match the vulnerabilities with the code

[supple lotus]

Thank you much!

[shut wraith]

There is also one project u can do

Make a website -- add many functions to it, like input fields and logins, then slowly remediate vulnerabilities

[rustic sage]

Bro I'm not kidding u it's been like 2 hours now and it's still trying to crack one hash and one hydra

[sacred gull]

running hashcat on host will be quicker. Depending on the protocol there isnt really anything you can do for hydra

[cloud urchin]

no module takes more than ~30 mins to crack anything, and 30 mins is on the high side

[fallen talon]

I’m having trouble looking for the unique domain record that’s supposed to be in double quotes. I have tried everything i know and still can’t figure it out#

[rustic sage]

Nah bro I'm telling u

Theres something wrong with my pc

[fathom pendant]

Did you do a zone transfer or anything? It helps to say the module and section you're working on

[shut wraith]

What module teaches zone transfer?

[fathom pendant]

Axfr is a part of one of the early cpts modules iirc, it's been a minute

[barren crystal]

where can i check when my current sub expires?

[ocean night]

I'd imagine you can find that information here https://academy.hackthebox.com/billing

I don't have an active subscription so cannot confirm I'm afraid

[barren crystal]

yeah mine has reactivate, but doesnt give me the date that it ends

[ocean night]

Did you cancel your subscription?

(but it's not expired yet)

[barren crystal]

yeah, trying to work out how long i have to finish this module tho, since will have to wait a fortnite from today minimum to renew again

[ocean night]

Yeah, can see in source if it's in the cancelled state it doesn't show the end date

One sec..

[barren crystal]

appreciate it

[ocean night]

Sent a DM

[normal sand]

Module: Documentation and Reporting
Section: Notetaking & Organization
Link to section: https://academy.hackthebox.com/module/162/section/1534

Under the sub-section "Artifacts Left Behind", it states it's recommended to provide the client with file hashes of web shells, payloads, or tools that we upload to their hosts.

If I'm moving all my tools at once in a ZIP file, do I provide a file hash of the ZIP file or the file hashes of the individual tools once unzipped? I'm guessing the individual tools?

[marsh echo]

I just need the path to the directory where all the tools will be stored and the zip hash before unzipping.

[onyx fjord]

ok dumb question; im doing the SOC Analyst path and got to the windows event viewer portion > when launching the target is says 'RDP to Target' .... Am I using my own RDP program or one within the pwnbox?

[cloud urchin]

Doesn't matter. If your host is connected to the VPN you can use your Windows RPD, otherwise use whatever VM you're using to connect to the VPN. Alternatively you can use the pwnbox.

[onyx fjord]

oh i see. i got it now! thanks!

[grand loom]

general question any commands to check what hosts are alive in a subnet? most of the time icmp ping are disabled so ? using proxychains

[shut quest]

Most everything in academy can be pinged so from your jump host you can do a sweep. Also from your jump host you can try to view arp, but that won't always paint a full picture. Alternatively you can do nmap scan on common ports 135/139/22/445/3389/5985.

[grand loom]

yeah was a general question mainly regarding if i encounter a situation where its disabled

all i can think of is this proxychains nmap -sT -vvv -Pn --top-ports=10 172.16.113.0/24

when i did this i got Nmap done: 256 IP addresses (256 hosts up) scanned in 252.77 seconds

[shut quest]

If you can, ligolo would allow icmp and faster scans with nmap

[grand loom]

fuck im stupid

i forgot ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215 doesnt support icmp

socks doesnt allow icmp

the thing with ligolo is i have timeout issues with douvle pivot meaning my other agent cant connect to me

[shut quest]

Should be able to. Just need to stop the first session and start the second session

[grand loom]

shouldnt it connect first then stop the first tunnel one

[shut quest]

Yes

But you need to port forward

[grand loom]

yeah u do listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 --tcp

then connect ur other agent

[shut quest]

listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601

Then have the second agent connect to the ip of the first agent

[grand loom]

yeah i just get timeout issues was unable to verify agent

etc

[ocean night]

Running that proxychains method as root PrinceAli1?

[grand loom]

no i use -sT i believe if u use root it does -sS and that can lead to issues am i correct?

[ocean night]

Just asking as IIRC proxychains like that tor2socks or whatever the command was hooks methods used for initiating connections, which could be the reason for the false positive all open ports

torsocks, that's the one I was thinking of

[grand loom]

no idea what torsocks is

[ocean night]

If sticking with proxychains and nmap, try using the --unprivileged flag with nmap?

Proxychains (kinda) but for hooking connection methods for applications, routing through Tor (again, via SOCKS)

What module or lab is this regarding btw?

Bit late to ask.. lol

[grand loom]

stil lots of false positives

[shut quest]

Running nmap as root (-sS) should provide a faster scan so would -T4

[grand loom]

its just me playing around lol

[ocean night]

#red-team might be better to discuss then, as this is a channelf or module discussions 🙂

[shut quest]

You using the internal IP of the first agent?

[rocky estuary]

the Thick-Client Applications section really making me pull my hair i'm at this step "Rebuild the JAR file by following the same steps and log in again to the application" the instruction here isn't clear should i recreate all the previous steps (compile ,create new folder , and extract etc..) really confusing

[shut quest]

Sorry it was slow here.

[grand loom]

yes yes

anyways break my head is getting clustered with this running around

i do have a way of making nmap work

but it would be netcat script

proxychains bash -c 'for i in $(seq 1 254); do nc -zv -w 1 172.16.113.$i 445; done'

like this

[shut quest]

If you step away from it and come back and do it again I feel that helps.

[rocky estuary]

my ego refusing

no clue but its working now

[shell kindle]

Hello everyone .. I'd like to ask yesterday I completed my misc chall and I submitted on htb wanna ask when may they respond to me ?

[grand loom]

[Agent : confluence@confluence01] » ERRO[0637] could not register agent, error: connection write timeout

this is what i get lol

database_admin@pgdatabase01:/tmp$ ./agent -connect 10.4.113.63:11601 -ignore-cert
WARN[0000] warning, certificate validation disabled     
INFO[0000] Connection established                        addr="10.4.113.63:11601"
2024/11/05 06:37:54 [ERR] yamux: keepalive failed: connection write timeout
2024/11/05 06:37:54 [ERR] yamux: Failed to write header: read tcp 10.4.113.215:59648->10.4.113.63:11601: use of closed network connection
ERRO[0040] Connection error: keepalive timeout          
FATA[0040] keepalive timeout

[spare fossil]

Does sliver only works with its own stagers, implantes or beacon.... i cant have a reverse shell through a vulnerability back to the Sliver server ?

[fervent siren]

sup i am back

[storm elk]

weclome back @fervent siren

[fervent siren]

how are you doing man ?

can anyone help with https://academy.hackthebox.com/module/19/section/108

[storm elk]

If you're asking for help, please post the full module name and section. So that people on their mobile don't have to click it (for me, opening this link on my phone will open discord browser and then when I move to my default browser, I just end up on the homepage). You'll get more responses this way

[fervent siren]

ok

module 19 section 108 idk how to get the flag

[storm elk]

Please, I said full name

not number

[fervent siren]

Module : Network Enumeration with Nmap Section :Page 7 Nmap Scripting Engine

[spare fossil]

just a quick question mate @dapper moth

[fervent siren]

isn't anyone here good at hacking enough to help me ?

[storm elk]

Feel free to dm me and I will have a look in a bit when I have time. Send me everything you've tried.

But as I mentioned yesterday, the answer to get there is within the section really

[dapper moth]

You can use other triggers, but eventually have to use its shellcode

The Academy Module has a section on this

[spare fossil]

I saw, I still dont have enough any cubes for it, my sub does not cover that painfully

[spare fossil]

I see, thanks

[pulsar berry]

Yo dudes, I am stack on Skill Assessment last question of DACL II module. Anyone free to discuss what I am trying to do and not working?

[shut wraith]

@ocean night

[analog dock]

Why are you pinging him for this?

[shut wraith]

We were talking about finding functions during whitebox

[analog dock]

Do you need help with a module or something?

[shut wraith]

When I need help with a module, I will tell you that I do. So don't annoy me any further

[analog dock]

Dude you’re in the #modules channel, that’s where people ask for help with modules

If it’s not related to a module and only for goblin, just dm him

[shut wraith]

Shut up

[analog dock]

tf is wrong with you lol

[storm elk]

Now, be nice please

[analog dock]

[storm elk]

If it’s meant for g0blin only, I agree, best to dm them.

[normal sand]

Should I be running Inveigh/Responder on every host I compromise on a network?

[regal ruin]

can some one help me with Exploiting Web Vulnerabilities in Thick-Client Applications(in Attacking Common Applications) ...............??? i am hard stuck in this part of the module

[shut wraith]

Whats problem? Give summary of what you tried

[regal ruin]

i have already updated the invoker.java file but when i am trying to compiling it ... it give me errors

[idle marsh]

lets say i have a nc shell open, and there is a file i want to take from inside there into my machine. whats a good way to do so?

[urban elk]

https://academy.hackthebox.com/module/details/24

[shut wraith]

Message me ur commands to compile it and Ill show u errors

[fervent siren]

but i am blind

[lucid grotto]

Any ideas of interesting forums to learn and see what is going on secretly

[unique sun]

Hello I need assistance with exploiting Sysax FTP Automation 6.9.0 in Attacking enterprise module for privilege escalation. I'm trying to add the ilfserveradm user to the local administrators group using this exploit, but I'm stuck. The solutions provided by Exploit DB and Hack The Box material have not worked for me. If anyone has experience or guidance on this, your help would be greatly appreciated.

[kindred cypress]

are the servers ever bad? when I ping my target its responding well but when I nmap it, it wont give me anything back

[fervent siren]

@everyonejust help me in module Network Enumeration with Nmap section Nmap Scripting Engine

[acoustic owl]

What exactly is not working?

[fervent siren]

i can't find flag i found a flag on a port and when i submited it says wrong so then i heard that is another section flag so i know i should scan 80 but how ? i am trying everything but can't find anything

[acoustic owl]

Did you use the scripting engine?

[analog dock]

@unique sun @fervent siren don’t try to ping everyone

You would’ve annoyed 265k people if it worked for you

[fervent siren]

bro some people did so btw sorry

[storm elk]

That ping doesn't work for you

[analog dock]

Thankfully

[storm elk]

yes

[regal ruin]

can some one help mee with java compilation error ......

fatty-client-new.jar.src\htb\fatty\client\methods\Invoker.java:144: error: unreachable statement String response = "";

[quiet trout]

prob gonna need to see a code snip. looks like line 144 prob missing a terminating ' or semi

you're using a code editor with line numbering right?

[regal ruin]

no. it is just a notepad

[quiet trout]

ok, are you using pwnbox?

[regal ruin]

my own kali

i can send u if u want to help

[quiet trout]

ok, uh, install sublime or vscode or something

yeah go ahead and send it im happy help

then we need to get you squared away with a more effective editor

[regal ruin]

i have send u

[cedar lynx]

Hi!

Can someone teach me hacking?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

@cedar lynx #modules message

and please do not repeat your post if nobody responds immediately

[fervent siren]

what are you doing brother ?

can anyone help with this medium difficulty thing ? : https://academy.hackthebox.com/module/19/section/118

[quiet trout]

Anyone done the SOC Path: Rapid Triage Tools:

https://academy.hackthebox.com/module/237/section/2612

Im wondering how they came up wtih --de 0x16169 the location of the $MFT dump details without having shown a way to parse them prior to identify it

i tried just running mftcmd or whatever its called on the kape output and browsing some json atm but unsure where to begin looking (other than grepping for the already known string itself)

ok grepping for the friggin whatever the hell that is, 0x16169 returned nothing...

so who knows where it came from...

nvm found it vis grep "16169" instead of 0x16169

oh nvm, i see its pictured in hex data from a screenshot but still... this is odd

[iron lintel]

can you help me with this one

[halcyon vapor]

Hack The Box Walkthrough: Academy

please help me. I downloaded Academy image and I used reverse shell php from but I have still: nc -nvlp 1234 is till listening nothing changed

I am stuck there

[fathom pendant]

That doesn't tell us what module you're working on

[rustic sage]

hey, im having problems with the Windows Privilege Escalation : Interacting with Users module, I managed to find the share that was mentioned in the hint created a scf file there, when i run responder "sudo responder -wrf -v -I tun0" i got errors. when i run this "sudo responder -w -v -I tun0" it works but i got no response, anyone knows where do i wrong?

Guys hashcat is still trying to crack the ntlm hash after like 15 hours

It's one hash

I'm thinking there's something wrong with my laptop tbh

@fathom pendant do u know what it could be?

Hydra also takes basically half a day to run

[fathom pendant]

Don't ping me randomly

[rustic sage]

Dude I'm asking for help

Wtf

[analog dock]

Yeah and don’t ping people for that, just wait till someone responds

[gusty salmon]

Good evening, alll

I have referred 3 friends in HTB, the site shows that I have referred 3 friends but I don't see any cubes earned for the referrals

[fathom pendant]

Yeah and I wasn't engaged in your conversation

I'm not an on-demand helper

[rustic sage]

Ok

[fathom pendant]

They need to complete the on boarding, also t2+ modules

[rustic sage]

Someone woke up with the wrong foot ig didn't know asking for help was so offensive

[hardy plover]

Hi

I got a question about fuff scan

🙂

[urban elk]

legend has it you'll ask it someday

remember to include which module and section it's about. If it's not about a module, please read #rules and #welcome , you may need to ask elsewhere

... when you get around to it 🙂

[hardy plover]

Legend also has it that if you’re not willing to help or advise, refrain from replying with robotic answers

My question mentions “ffuf” in plain text. It’s a tool , my good sir. 🙂

[urban elk]

on the contrary, I'm very willing to help if I can. Surely I need to know the question first, though. Still waiting 🙂
(tone doesn't come across well. Sorry if I sound like a ***. It's encouraged to just go ahead and ask here. I just have too much time on my hands at the moment so I'm being verbose 🙂 go ahead and ask on your own time.)

[finite violet]

GM

[hardy plover]

You don’t sound like a 3 asterisks. 🙂
Go ahead and asking is a fine arrangement but I personally believe in setting the stage first to make the conversation most fruitful. And I appreciate the fact the your are willing to help

[hardy plover]

Morning 🙂

[solar granite]

For sqlmap essentials case 6, how do we even find the prefix without looking at the hint? I noticed that a certain character gives an error, but I can't think of a way to actually find the prefix without the hint.

[hardy plover]

Module is “attacking web apps with ffuf”. There’s vhost/subdomain fuzzing part.
To fuzz for vhosts, that are not in public dns records, we are manipulating the headers. (FUZZ.web.com). The thing I don’t understand is that why are we are still getting 200 OK.
As I understand is that, server first opens the header, look for subdomains, and fetch the response from subdomain mentioned in the header. I mean why we are getting 200 OK.
Does it mean that if subdomain doesn’t exist, domain is responding, ignoring the headers?

[solar granite]

https://dontasktoask.com/

[sand rose]

Hello guys. I'm not sure the best spot to put this, so I hope here is ok: On the Parrot OS website, there is a ISO file for the pawnbox version of Parrot. I went ahead and downloaded it so that I can use it through my VM. For some reason, I'm not getting persistent storage like I do other OSes I use on virtual box, and even after going through the Advanced options and selecting persistence, on each reboot it's needing to reinstall, and I'm not getting the persistent storage.
I'm giving it: 8 gb of RAM (I have 16), 8 Cores (I have 20 if i recall), and 150 gb of one of my hard drives.

Any ideas why I might be having issues with persistent storage?

[solar granite]

For this you need to understand how exactly the Host header works. In that case you can think of it as "multiple servers in one server", it's not entirely accurate but gets the point across. So you could have "web.com", and "test.com", which let's say is the testing environment for it, so the same app but without the production data. Depending on how the server is configured, it may or may not take the host header into account, and there may or may not be more "servers in one server" (this is actually called a "virtual host")

This entirely depends on the configuration of the server, you can't make any general statements about how a server will behave with a valid/invalid request host header

[urban elk]

what is your issue with the 200 OK response, exactly? What do you undestand by it, and what would you expect instead ?

[twilit elk]

How can I verify my profile?

[solar granite]

Not sure what exactly you downloaded, there's no "pwnbox" version of parrot on their website. Your persistent storage issue seems like you're opening the ISO instead of the installed VM. Also your setup is insane man, 20 cores is a lot lol

[urban elk]

I think the answer to your question may lie there. When you fuzz vhosts, you are asking an HTTP server if it's serving a vhost under that name. It's the HTTP server that replies "200 OK" or otherwise. When you fuzz subdomains, you are making DNS queries. If one comes back positive, then you may query an HTTP server, who will then reply "200 OK" or otherwise

[sand rose]

@solar granite https://parrotsec.org/download/ Heres the link... there's an htb version of Parrot that I downloaded to try to use. xP.

So even after arranging the boot config and removing the optical drive entirely, it for some reason isn't installing properly on the hard drive and quite frankly have no a clue as of to why. I haven't had this issue with the standard Parrot Security version, or any other linux distro, which is the perplexing thing here.

[hardy plover]

I understand that 200 OK means existence of requested resources and it was delivered.
I expected the response only if subdomain exists.

[tawny solar]

Heelo! About the wifi penetration Test Basics, how I connect RDP? I need help with this part

[hardy plover]

Header was set to FUZZ.web.com and request was made to web.com

My question might be silly because im new

[solar granite]

Seems like you've downloaded the wrong thing. Did you download the "Live" -> "HTB" version? If so that's supposed to be like you're describing. I'm not very well versed with VM so can't help with persistent storage, but your use case of it is wrong tbf, that's not what it's intended to be used for. Try downloading the security edition under virtual and see if you have more success with that.

[solar granite]

As I said it completely depends on how the server is configured. If you see it responds with 200 OK for everything, find another difference between the responses, if any

[sand rose]

It was under the live... I was having issues with the .ova file from the virtual... might need to be what I do though. I kinda just got lazy and didn't feel like diagnosing it so I went for the iso... but I haven't had issues with an iso and persistence at all until now. I'll just use the regular security version and call it a day. Thanks 🙂

[urban elk]

or run the installation procedure with the live version

[sand rose]

The first option is "Try/Install" and then each time I boot it, I go through that option... I also tried the advanced option with persistence, but for some reason it doesn't seem to actually be installing, but yet I'm able to use the OS perfectly fine otherwise.

[urban elk]

I don't remember what it looked like, but you need to install while trying, if it makes any sense. So you boot "try/install", then explicitly install (I think there's an installer on the desktop?), otherwise indeed you'll just be booting the live version

[solar granite]

@sand rose if all else fails you can always go back to kali, or even install the tools on a Debian/Ubuntu VM, or whatever OS you choose. Honestly it doesn't really matter what you use, as long as you're comfortable with it

[storm elk]

Please read #welcome and #rules it will explain how to get verified

[terse sedge]

Is there a subnet that I can whitelist in a firewall to alleviate any connectivity issues with the HTB content?

[prisma zealot]

Hello,
Someone could help me on the Login Brute Forcing module ?
I'm stick on Login Forms with Hydra.
I think typing the right command and no passwords
I think my fault is on the params of http-post-form.

[sand rose]

I'll poke around, thanks!

[sand rose]

It's simply just something that feels a bit more intuitive for me to navigate outside of the terminal is the only reason why I'm trying to get it to work :).

[urban elk]

to be clear, are you getting a 200 OK response for ALL attempts, or only for valid vhosts?

[hardy plover]

Alterations in response I understand.
It’s the response code. Does it mean that response codes are relative to the server and not universal. I.e i can configure a server to respond with 404 in case of bad gateway

[hardy plover]

All of them. However valid ones are different ones than the rest.

[urban elk]

well yes, but most likely in this scenario what is happening* is there is a rule on the webserver saying *.example.com -> example.com, which then gives 200 OK.
*(I missed the possibility that you're getting 200 OK for every fuzzed word, which is what I'm assuming now here)

[urban elk]

right, yeah. I didn't understand that at first, thanks for clarifying

if you have a chance to look at a webserver config with vhosts (in some box or some module), have a look. It might help

[hardy plover]

Makes sense. Thanks 🙂

Confused the crap outta me

[urban elk]

happy it helped 🙂

[gusty salmon]

They completed the onboarding process, and from the referral page, I saw 30cubes for the referer when the referee completes the onboarding process

[fathom pendant]

Reach out to support then

[gusty salmon]

Alright, thanks...
Where can I get the mail address??

[fathom pendant]

There's the green bubble on academy, bottom right

Also

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[trail egret]

how to say responder to not skip previous captured hash

[*] Skipping previously captured hash for INLANEFREIGHT\lab_adm

[gusty salmon]

Thank you, sir

[fathom pendant]

If it's a previous hash, then it'll be in the logs

[rustic sage]

I'm in password attacks > pass the hash.
Question 5
Using David's hash perform a pass the hash attack to connect to the shared folder \dc01\david and read the file david.txt
I found David's hash through crackmapexec --lsa command but as you can see in the pictures it's not letting me access the folder.

Also another question, I solved this room a while ago and now the hash for David changed, is it normal or did I search for the hash in the wrong place?

[prisma zealot]

Have you find the answer because I'm in the same situation and doing the same thing (mistake ?) ?

[plain trellis]

The hash seems to be different. Try dumping the hash again with mimikatz.

[rustic sage]

Targets aren't spawning : (

[plain trellis]

switch vpn maybe

[rustic sage]

Same thing

[plain trellis]

machines not spawning or same hash?

[rustic sage]

Not spawning with new vpn

[plain trellis]

I guess only support can help on that

[lofty whale]

in the shelld and payload bind shells section and just keep getting can not assign address requested. and thoughts?

shell*

[gray yacht]

Add a -v for verbosity and it should display previously captured hashes.

[fathom pendant]

Look into what -l does :)

[sacred gull]

Hey interested in anyone who modified sealtbelt how they got around the import system management callout from defender. I ended up using a tool to obfuscate so interested in how others did it

[lofty whale]

will do ended up going with a different shell code and got in to get my answer

[rustic dew]

Does anyone know if Kerbrute can be forced to continue scanning even after finding a username/password (password spray) match? Similar to crackmapexecs '--continue-on-success'

hmmm... maybe it's something to do with kerbrute, just moved one of the accounts kerbrute wasn't finding to the top of the username list, and then kerbrute found it... not really an answer but it works I guess...

[tranquil axle]

looking at github that seems to be default behavior no?

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

2019/03/06 21:37:29 >  Using KDC(s):
2019/03/06 21:37:29 >   pdc01.lab.ropnop.com:88

2019/03/06 21:37:35 >  [+] VALID LOGIN:  [e-mail]:Password123
2019/03/06 21:37:37 >  [+] VALID LOGIN:  [e-mail]:Password123
2019/03/06 21:37:37 >  Done! Tested 2755 logins (2 successes) in 7.674 seconds```

[rustic dew]

Is it???

It's not even scanning half of the accounts on there, the scan showing "2 successes" was after I moved one of the valid usernames it wasn't finding to the top of the list

[analog dock]

Well the last screenshots has 21 instead of 19 usernames

Are you sure you’re using the right list?

[rustic dew]

yeah, I pulled the names using kerbrute, stripped all the fluff, and then ran it... and that number changes with virtually every scan, examples attached, also cat all the usernames in the file I'm running the command with, along with the total number of lines within that file (56)

[solar granite]

So you understand "Alterations in response" but not "alterations in response status codes"? Status codes are part of the response 😉
Edit: what I mean by this is that the may or may not differ, just like the rest of the response

[rustic sage]

In password Attack > pth what is DC01? Another computer on the network? An smb share?

[fathom pendant]

DC01 is the DC on the internal separated network on the machine

If you check the hosts file you'll see how it maps

[tranquil axle]

maybe it runs on several threads and as soon as one thread finishes with a valid login it also stops all the others, and depending on how fast the threads work you get different numbers of results

[worthy tiger]

Please does HTB have an interface to practice ATO? Most web logins or apps

[fair mural]

I'm stuck on Credential Hunting in Linux in the Password Attacks Module. I've got into kira's machine via ssh and I've found the shadow.bak file. I've tried installing ||Firefox Decrypt, since it was found in the bash history||, on kira's machine but it is stating it is not able to resolve github. Also tried to scp shadow.bak onto my host machine but I'm getting permission denied. Not sure what else try.

[verbal dagger]

i'm getting this person's issue minus pulling my hair out and existential crisis. i would appreciate any help. it's sql injection fundamentals in the writing files. i'm able to write files and read them by navigating to them. the webshell returns a blank page or, sometimes, just the number 1. i've tried the variables 0, O, and cmd. 0 is always a blank page. when navigating, i go to http://ip:port/shell.php?0=[command like id or ls].

[fathom pendant]

you'll need to transfer the tool over

the targets don't have internet access

[rustic sage]

Is the tryhack me server?

[fathom pendant]

does it look like the THM server?

#welcome would really reveal a lot, and the name

[fair mural]

@fathom pendant You just saved me grey hairs.

[rustic sage]

I'm in password attacks > pass the hash in Linux
For the last question about Linux01, I found all flags but I don't understand why it's the last ticket is the one located in /etc

I ran linikatz.sh but the ticket in /etc wasn't my first choice. Even if I ran ls -la in that directory nothing gave a clue abt that file having anything to do with Linux01. Anyone cares to enlighten me?

[fathom pendant]

because it needs to be a more static ticket as the linux01 ticket is the machine ticket

[rustic sage]

Wdym by more static? Like if you are looking for a file that helps you solve the last question what makes you think the one in /etc is the right one?

[fathom pendant]

as in it needs to be stored in a different place

which is why it's not /tmp/

since /tmp/ gets reset, basically, on a restart

[rustic sage]

Oh okay, so the one in /etc is the only viable one for this question bc all other ticket files are in tmp?

I don't have the terminal open rn I'm just trying to remember

[fathom pendant]

it's because it's the one that links to the Linux01$ ticket

[dapper moth]

Anyone for a few nudges on the Advanced CSRF and XSS Skills Assessment?
Are we supposed to send our payload via file upload or exploitserver.htb/deliver?

[visual dock]

Guys i really need help someone hacked my account i really need it back can someone help me

[cloud urchin]

yes

[cloud urchin]

reach out to support on the website

[dapper moth]

Yes to which option? File upload in the vulnerablesite or exploitserver/deliver?

[visual dock]

They couldn’t help thats why im here

[cloud urchin]

no one here can help you, only support on the site can

[cloud urchin]

depends on where you're at

[visual dock]

Ow euhm okay …

[dapper moth]

Beginning

[cloud urchin]

then use the exploit server

[crimson moon]

Wasn’t able to download/install CME on pwnbox is there an issue in it?

However, when I try to type crackmap<tab> it autocompletes probably I’m missing something dumb?

[trail egret]

Tq

[cloud urchin]

it comes preinstalled on Kali, i'd be surprised if it didn't on the pwnbox. if not you can always just use netexec instead... if the pwnbox has it.

[dire lily]

I am solving the WEB REQUESTS - CRUD API question and I don't understand it when I look at the solution.

The steps as i understand them are as follows (i am writing in python).

1. save all city_names via reqeusts.get
2. change all city_name to flag via requests.put
3. delete all saved city_names from (1) via requests.delete
4. access target.ip:target.port/api.php/city/flag via requests.get to resolve the issue

When I wrote and executed python for the above 4 steps, the result is {“city_name”:“flag”,“country_name”:“”}.

If this is a community violation, I will delete the question.

====================
I solved the problem.
The question was misinterpreted by the translating and I went in the wrong direction.

[crimson moon]

it said cme command not found. Netexec did the trick , thanks

[long flint]

hi, is the module Introduction to NoSQL Injection, section server side javascript bugged?
trying to do what the course teaches me, but every potential working payload just causes the server to hang. even the script given by the course causes the server to hang. Am i making a mistake trying to use the payloads to follow along the course?

[tacit bay]

not sure if im missing something, but for the windows evasion module - are we suppose to have both the DEV & TARGET machines up at the same time? Bit of a pain to keep spinning each other up & down (It's not letting me have both on)

[dapper moth]

Unless you have one Win VM in your own machine, you'll will be switching between each for developing the exploit and getting the flag

[tacit bay]

fair enough - ill spin one up

[normal sand]

Module: Documentation and Reporting
Section: Components of a Report
Link to section: https://academy.hackthebox.com/module/162/section/1535

In this section, there's this command:

.\Rubeus.exe dump /luid:0x1a8b19 /service:krbtgt

Isn't that a mistake? Shouldn't the luid be 0x1a8ade?
Refer to the code snippet before this command (the one that does triage).

Please let me know if I'm wrong and why. Thanks!

[finite abyss]

It seems none of my posts at #1234357888114364508 are checked. I haven't got any comments. It's been three or four posts consecutively with no comments

[visual umbra]

Hey. Im in the module about Hash-Cracking with HashCat.. The module tells me to use hashid to get what hash it is.. But i think hashid is not good, it gives me alot off possible hashes and makes it hard to get the real one. So is there a tool (not online like https://hashes.com ) i can use instead?

[tidal thicket]

hello everyone!
i have a question about the student plan, i am a student but i am about to graduate soon, like next month
supposing i buy the student plan now, then for each month, do i need to have access to my student email ? (maybe for some verification idk)
i am trying to understand if there will be problems for the following months when i wont have access to my student mail
i mean, do i need access to my student email only during purchase or throughout the whole period i pay for?
thanks in advance

[worldly badger]

Module: AD Enumeration & Attacks - Skills Assessment Part II. Task 3-4. While im connected to Parrot os machine via SSH and trying to RDP from it to Internal Network 172.16.7.50 MS01 machine i got a trouble:

[07:20:06:351] [2621:2621] [ERROR][com.freerdp.client.x11] - failed to open display:
[07:20:06:351] [2621:2621] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

ChatGPT said that i need to connect to Parrot OS machine via SSH using "-X" option to enable X11 redirection. I did this and everything work, but performance is terrible. Next tasks involve working on this host, but It barely open Desktop with this RDP connection and its impossible to work with this host via RDP further because of the performance. what should i do? nothing was said about it in "Show solution" section.

[winter schooner]

Need help on password attacks

• 0 Using David's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\david and read the file david.txt.

i have davids hash but what does it mean connect to shared folder

[normal sand]

Is anyone else having trouble extracting the sample report from the Documentation and Reporting module? Once I download it, it fails to extract.

[junior marten]

anyone can help me how to solve it

[autumn pilot]

lowercase json

[junior marten]

i tried it no change

[autumn pilot]

additionally json uses : instead of =

[junior marten]

so what i need to do

[solar granite]

he literally told you, replace = with :

[junior marten]

oo got the flag bro thanks

that = i knownly typed

[shut wraith]

Why cant I see what the Active Scan is finding on Burp while its scanning

[analog dock]

Ask in burp discord

[neon furnace]

Advanced SQL Injections Skill Assessment, is remote host not the same env and code as the workstation VM? I can run my exploit locally, but remotely, the results are completely different... Very annoying lab setup to not be able to run local and remote instance at the same time

[dapper moth]

Different permissions

[neon furnace]

makes no sense for the unauthenticated part

[dapper moth]

Check the forum
There are a couple of good hints