modules

[left stirrup]

🙏

[cloud urchin]

you can create port forwarding rules from the target machine to the pivot machine, and then from the pivot machine back to your machine

[left stirrup]

there's an update after almost 3 hours and half...

[cloud urchin]

there's a way described in the module to force frames i believe

[left stirrup]

I've tried a deauth attack

[brave scroll]

time ☠️

[rustic sage]

I'm still a bit confused with the --reverse flag on Chisel. Is that not helping the internal host get a route to my machine through pivot?

[cloud urchin]

you're scanning a shitload of hosts

[brave scroll]

yeah 1st i have to scan which host is up

[left stirrup]

I've got an error when I try to use aireplay-ng (test mode).
I don't get any EAPOL packet with this methods for idk reason.

[brave scroll]

but when i do this, it tell me all ports are open.

[rustic sage]

ChatGPT says "In this case, the reverse tunnel is enabling the internal network (172.16.6.50) to access your attacker machine (10.10.16.6)."
I'm so confused atm

[cloud urchin]

In a standard Chisel setup:

• The server listens for incoming connections.
• The client connects to the server and forwards traffic.

With the --reverse flag:

• The client becomes the listener, accepting incoming connections.
• The server connects to the client and forwards traffic.

[cloud urchin]

did you read the text directly after that command?

[brave scroll]

yesh

[cloud urchin]

it explains it right there

[brave scroll]

sorry but i can't understand what are u trying to say.

[cloud urchin]

you're getting the expected result, what's wrong?

[brave scroll]

actually i want to know which host is alive but the scan saying all hosts are up.

🙃

[left stirrup]

welp, I'm gonna sleep chat.
Don't hesistate if you have any clue about my problem with the wifi pen basics.
My DMs are open if needed.
gn

[cloud urchin]

idk what else to tell you.. you're getting exactly what you should be getting, if you want to know more the page explains it all

[brave scroll]

ok mate.

[vague dust]

Lol

[quiet heart]

me too from 56 to 6 week

[rough violet]

so 0 = 7, cuz it's 6 days + 0th or 7th day

i guess 7th will skip a week right

[tulip hearth]

hello i need help. everytime that i close my pc, then i open it again. the openvpn config stops working

then ill have to download the vpn file again to make it run. but now, its just not running and im receiving a fatal error

[dark hedge]

probably should ask in #1024429874246590575

[valid forge]

Okay, so I got a weird one, maybe there's just something obvious I'm not seeing.

For the question part of the module for "Introduction to Bash Scripting", for the "Comparison Operators" section

here is my code:

first off, I thought it was kinda scummy that they didn't cover the " " thing, but whatever. My issue is with that last "tail -c 20" bit

putting that into terminal and running it doesn't do the tail, it just runs all of it:

So I mean, I got the answer, I just manually counted the last 20 or 19 characters or so, and was solid. But I still want to get "tail" working, and am clueless as to why it's not working...

[valid forge]

Looking at it some more, what it's doing is printing 'line 10' reporting an error, which coincidentally has the answer in it anyway. So that tail -c 10 is probably fine, but what is wrong with line 10 then? Right now it's:
if [[ $var == "$value" ]] && [[ $var -gt 113,450 ]]

I've tried it with & without those central ]] [[ bordering the &&

[viral patrol]

@outer silo You mind if I DM you? I have some questions about a question you had before.

[void kayak]

i am stuck as well. I have multiple working xss payloads but nothing seems to trigger them :/ Im at loss. Any luck for you? I will try harder tomorrow anyway.

[unborn summit]

can i dm someone about ad enumeration and attacks skill assessment 2? I have a quick question about some of the steps

[pine dune]

Hi guys

anyone know why I cant cd to root?

it keeps me in the same directory

(sqlmap - os exploitation)

[vague dust]

whats another way to get into root?

[pine dune]

the only 2 ways ik are traversing the directories and also cd /root

[vague dust]

whats the other symbol for root?

[pine dune]

ahh

[cloud urchin]

my guess is you're not in an interactive shell

[pine dune]

/

[pine dune]

I am when I do ls it gives me the output of the current files

[cloud urchin]

yeah upgrade to a fully interactive shell then try

[pine dune]

any idea how I can do that? the module didnt cover that

[cloud urchin]

there are lots of ways but it depends on what your current shell is. you also may not need it, you can just cat the full path or something

did you do the shells and payloads module? i think that talks about it, or you can google some ways too

[pine dune]

I cant remember if I did that but rn im on the cbbh module and im pretty sure that module isnt on here

[unborn summit]

you can use full paths like so

ls /
ls /root
cat /root/flag.txt

e.t.c.

[pine dune]

since this is a php reverse shell Ill google how to upgrade an php shell

[pine dune]

thanks ill try this

[pine dune]

gives me permission denied for the last one

[unborn summit]

are you the root user?

[pine dune]

i dont think so, im just using an os shell from sql map

[unborn summit]

is the question asking you to get a flag in /root?

[pine dune]

it said common directory so im assuming root

[unborn summit]

thats a very big assumption to make

it looks like the flag is already in your current directory

or am i mistaken

[pine dune]

that was the old one

[unborn summit]

you can try something like

find / -name flag.txt 2>/dev/null

Im not sure whether it will work in a non interactive shell, but you can try it

[unborn summit]

it will just search the entire file system for all files called flag.txt

[pine dune]

ok thanks, let me try this

[pine dune]

gave me too much permission denied

[unborn summit]

you did the 2>/dev/null as well? 😕

[pine dune]

yeaa

copy pasted ur command

also i tried upgrading the shell but it doesnt have python

[unborn summit]

thats pretty weird then

[pine dune]

ik

[unborn summit]

lemme check the sqlmap module

[pine dune]

thx

the question says "try to find another flag within the host" so im assuming u have to traverse

but for some reason its not letting me

[unborn summit]

its because its not a real shell. each time you run a command its doing something like "bash -c 'your command here'"

so every time it resets your execution path

[pine dune]

ohh thats weird

is it a mistake on my part or did the module not clarify that? because from what i assume is that we are a real shell

[unborn summit]

its not a mistake on your part, thats just how the sqlmap os shell works. a lot of web shells are like that

[pine dune]

ahh I see

[unborn summit]

from what i can see it should be in the base directory

as in /

[pine dune]

i tried cating it

ahh it worked

thank u so much

[unborn summit]

the flags aren't always called flag.txt, sometimes they are called a random string to make sure that you actually have code execution and not just file reading

[pine dune]

idk why we couldnt traverse there

[unborn summit]

glad i could help

[pine dune]

could u pls elaborate 😅

[unborn summit]

sometimes you might be able to exploit a vulnerability that allows you to read files on the system, like file inclusion for example

in which case you could just read /flag.txt

but if the goal of the task is to get command execution (a shell) then they'll call it something random so that they force you to run ls, ensuring you actually have the ability to execute commands

[pine dune]

ahhh I see

thank you for explaining, that makes sense 😄

[unborn summit]

no worries 🙂

[pine dune]

im on the skills assessment now and the website is completely different. How do I check which parameters are vulnerable? As the previous websites were straightforward and only had one obvious paramter to check for 😅

[fathom pendant]

Inspect everything. And keep the network tab open

[unborn summit]

or if you are stuck you could try brute forcing for parameters, which i think is explained in the module?

[pine dune]

sounds a bit complicated 😅 I remember when there was something similar like this for my uni assessment but that was a long time ago and I forgot 😭

[fathom pendant]

If it's the sqlmap module, no

[pine dune]

I thought there was an easier way of doing this

[unborn summit]

oh ok

[fathom pendant]

The method for figuring it out was explained in the module

Basically click on everything with network tab open until something sticks out

[pine dune]

ok what should stick out?

[fathom pendant]

You'll know it when you see it, otherwise it wouldn't stick out

[pine dune]

alr cool

thanks

[unborn summit]

can i just ask the question and then delete it afterwards to avoid spoilers @fathom pendant

[fathom pendant]

Tbh i barely remember it

[pine dune]

also just to let u know it gives way to much unneccessay stuff like this

[unborn summit]

alr fair enough

[fathom pendant]

I'm aware what it gives you

Again you have to use your brain a bit

When you click a button, what happens, and things like that

That's engaging with a hacker mindset

[pine dune]

ok cool let me try

[fathom pendant]

Since you know theres a vulnerability, click everything on screen you can see

[vague dust]

make the beep boops

[fathom pendant]

Also maybe consider the type of website this appears to be

[pine dune]

ok thanks

[red fable]

hi

[pine dune]

Hey @fathom pendant did the Sqlmap module cover this? In the skills assessment u said to use the network tab and afaik we haven't had to use that at all. So is there a section u could point me towards in the module please 😅

[fathom pendant]

I don't recall the exact section

[hasty mango]

Had a question in the Penetration Tester path, Getting Started Module in the Public Exploits section. Are there any known issues with the exercise at the end? I've followed along with the msfconsole solution and tried the searchsploit exploit for good measure and know I am doing the exploit correctly, I'm just not getting any response from either and want to make sure it's not an HTB thing and a "it works on my computer" thing

[pine dune]

Ahh I see

[fathom pendant]

Again something to consider: what type of website is it

[pine dune]

Ive realised in the skills assessment they usually expect us to know things they haven't taught us :/

[fathom pendant]

There has to be a way to track something you do

[fathom pendant]

It was definitely taught to some degree

[pine dune]

Its a shopping website last I remember (not at my laptop rn) but its just bothering me xD

[pine dune]

Ahh Ill have to recheck

[fathom pendant]

And did you try doing something you'd typically do on a shopping website?

[pine dune]

Ill give it a go rn, just came back home

[pine dune]

yea when I try the checkout, nothing happens :/

[fathom pendant]

That's not the only thing you can do

[coarse cargo]

Guys I need help

[fathom pendant]

https://tenor.com/view/that-is-incredibly-unhelpful-isaac-goodwin-sex-education-that-doesn't-help-me-at-all-that-is-useless-gif-12372771945317590256

[vague dust]

do we need a ouija board?

[fathom pendant]

If it's with an academy module, ask away. If not read #rules and #welcome

[coarse cargo]

Not academy module check dm

It’s another stuff

[vague dust]

you should read the rules first before sending that

[fathom pendant]

I didn't ask to be dmed

[analog cedar]

help ！I encountered this situation and modified it to -pbkdf2, but this error still occurred.

[vague dust]

https://tenor.com/vniC.gif

[fathom pendant]

And since that's the case I'm gonna assume you're asking for something illegal

[fathom pendant]

You don't need to modify anything g

[coarse cargo]

Ok sorry

[fathom pendant]

Make sure your code isn't adding things like a newline with echo

[pine dune]

have also tried adding to cart and contact page but nothing crazy happens or out of the ordinary

[fathom pendant]

Nothing out of the ordinary should happen... but the network tab should show something happening

[pine dune]

thats what I meant, ill have another look tho

[fathom pendant]

Something you do causes a popup/notification on screen

[fathom pendant]

Think about requests

You can do this with burp as well

[analog cedar]

Can you check the code for me?

[pine dune]

yea many GET requests from the website and also when I click submit Im expecting a POST request in the tab but nada. Also I have too many Google notifs there and apis from google

[fathom pendant]

Did something you do tell you you added an item to cart

Since you seem to need to be hit in the head with a brick to get it

[pine dune]

let me try with burp

[fathom pendant]

@coarse cargo jfc you could have just asked in the chat and I could have pointed in the right direction

@analog cedar we don't share attempted solutions here.

You can also try looking up solutions to this section online to see where maybe you went wro g

[pine dune]

ok this is weird but I reloaded the target IP and it seems to be clearer now

[fathom pendant]

@coarse cargo read and follow #welcome to ask in #1263635449335910531

[pine dune]

it wasnt showing that notification initially

[analog cedar]

Okay, I'll search for it

[fathom pendant]

You likely navigated to a different subpage that wouldn't

[pine dune]

I think I found the correct parameter now, thanks for your help

[naive cedar]

i have completed most of the module but still cannot find the answer to the Discovery Indexing section, please help me.

[pine dune]

if u dont mind, may I please DM u regarding my questions regarding how all this would work in a real life scenario? 😅

[fathom pendant]

Not accepting dms

[pine dune]

ok np

Im just overwhelmed by this, like for example if an huge website like ebay or facebook gave me permission or bug bounty program, how would we use sqlmap for such compex websites

[naive cedar]

i think reading the source code to find the source-sink, then exploit it manually and use sqlmap

[fathom pendant]

It's not so much reading the source code

Rather just messing around with features you'd normally use

Then identifying whether or not sql is used on the backend

That's the real thing about it, and why I approached helping you the way I did

[naive cedar]

hmm okay, but i still think reading source code is essential if you want to exploit a large website

[fathom pendant]

It depends, and not everything will be directly available

You won't always have or be able to access the backend code that performs the function

[naive cedar]

i mean read the front end code and guess how the back end processes it

[fathom pendant]

sometimes you gotta press the 'i believe' button and mess around ¯_(ツ)_/¯

[fathom pendant]

I'm not sure if there's anything in the front end that would indicate what's going on for this exercise

[naive cedar]

i even just answered the above question without knowing what the "exercise" you mentioned was

¯_(ツ)_/¯-

[fathom pendant]

?

Not sure what you "answered" exactly

The exercise I'm referring to is the sqlmap module. The broad answer will always be it depends

[naive cedar]

okay

someone please help me with the Discovery Indexing section in the Wordpress module

[fathom pendant]

But again not sure the page source would have indicated anything special. The type of website can be more informational than the frontend

[rustic sage]

Am i doing smth wrong here?

[naive cedar]

..

[fathom pendant]

I.e. something has to track and hold data

[fathom pendant]

Import-module ./powerview.ps1

You have to specify the relative current path with ./

[rustic sage]

Ohhh makes sense, so that's for everywhere right, or just evil-winrm

[fathom pendant]

Because by default powershell searches it's module repositories

[rustic sage]

OK! Thanks!!

[fathom pendant]

So it literally searched the powershell module store for "powerview.ps1"

[rustic sage]

I just typed in ./mimikatz.exe on my evil-winrm and got spammed by this loop:

Any idea what could of gone wrong?

[autumn pilot]

evil-winrm

[fathom pendant]

Yeah that happens with tools like that

mimikatz.exe "command to execute" exit

[rustic sage]

so I have to make a one liner for everything or sequentially run mimikatz "cmd"

[fathom pendant]

You can do it on one line

[rustic sage]

Alright, thanks heaps!

[hasty mauve]

when you do it in one line the same thing will happen, just scroll up and you'll see the result.

[rustic sage]

I'm curious, why does this happen though?

[fathom pendant]

Because win-rm isn't directly using powrshell

It's using http/https to pass the shell and commands through

[rustic sage]

so that makes it an infinite loop somehow? Shouldn't it have some x number of repetitions?

[fathom pendant]

Nope

You expect Microsoft to be competent?

[rustic sage]

Lol, makes sense. Thanks!

[fathom pendant]

Also, it's not meant to run interactive tools

Just basic [r]emote[m]anagement operations

[rustic sage]

Hi again, I can evil-winrm onto internal host but can't rdp even though both ports are open.

any help

nevermind, the delay was huge. I fixed it with /timeout option

sharphound would give me the domain data while in on proxychains rdp, but wont give when im on proxychains winrm.

any potential reasons? I'm able to ping DC from both

[naive cedar]

i don't understand what's going on with this server, please help me

[tulip hearth]

how long does 1000 port scan last at average? like if i used -T5 -sV -sC

[waxen totem]

https://tenor.com/view/well-now-that-all-depends-alastor-hazbin-hotel-gif-16978035

[digital sigil]

Depends on the network connectivity, and how many ports it fins as open and therefore need to execute scripts towards

[rustic sage]

Is it well known issue with SharpHound that I can't get Bloodhound to upload the zip data generated via SharpHound.exe?

https://github.com/SpecterOps/BloodHound-Legacy/issues/700

Is there any workarounds?

[waxen totem]

you could use nxc to get the data

[rustic sage]

Right, using that now

[undone narwhal]

You have to download sharphound that is compatible with the version of bloodhound you are using

[rustic sage]

Yeah found out that the compatible one is 1.10 smth

thanks

[small basin]

Any idea why hydra doesn't find the MSSQL credentials?

||$ netexec mssql 10.129.203.10 -u fiona -p creds.txt
MSSQL 10.129.203.10 1433 WIN-HARD [*] Windows 10 / Server 2019 Build 17763 (name:WIN-HARD) (domain:WIN-HARD)
MSSQL 10.129.203.10 1433 WIN-HARD [-] WIN-HARD\fiona:Windows Creds (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth')
MSSQL 10.129.203.10 1433 WIN-HARD [-] WIN-HARD\fiona: (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth')
MSSQL 10.129.203.10 1433 WIN-HARD [-] WIN-HARD\fiona:kAkd03SA@#! (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth')
MSSQL 10.129.203.10 1433 WIN-HARD [+] WIN-HARD\fiona:48Ns72!bns74@S84NNNSl

$ hydra -l fiona -P creds.txt 10.129.203.10 mssql
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-30 04:17:00
[DATA] max 7 tasks per 1 server, overall 7 tasks, 7 login tries (l:1/p:7), ~1 try per task
[DATA] attacking mssql://10.129.203.10:1433/
1 of 1 target completed, 0 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-12-30 04:17:00||

[tacit bay]

anyone free for a nudge on MSSQL, Exchange & SCCM skills assessment?

||Trying to move laterally from DB01 --> DB02, Get-MSSQLLinkPasswords isn't returning anything - wanting to know if this is expected.||

[icy dagger]

Hello! I am practicing the "Advanced CSRF and XSS Exploitation" module, but I got one question on the lab set-up regarding the CSRF: in order to get my user promoted, how do I contact the admins? Is it via the xss vulnerable page?

[pine dune]

Hi, on the sqlmap skills assessment, I have the right answer but htb isnt accepting it

[storm elk]

Make sure there are no spaces at front or back

[pine dune]

yea there arent :/

keeps saying incorrect answer and ive checked for spaces too

[storm elk]

Dm me the flag you have and I’ll check with my notes

[pine dune]

ok thx

[dawn tiger]

hi, I am stuck with automating the blind ldap inection script. anyone can help please? my script does not iterate properly not matter how I edit it.

I have been stuck for 3 days.

[dapper moth]

Use Impacket

I tried using PowerUpSQL and it didn't give me auth even

And since you don't have a SSMS in the Exchange Server, you are pretty much locked

[tacit bay]

thanks - I've been modifying the original powershell script for hours as the required registry keys didn't even exist on the machine to begin with

[dapper moth]

When you use Impacket to connect to the RDBMS you'll will see that the path to the flag is pretty easy

[tacit bay]

can I DM?

[dapper moth]

Sure

[clever topaz]

i solved Windows Privilege Escalation Skills Assessment - Part I 1,3,4 questions but left "Find the password for the ldapadmin account somewhere on the system.", anyone can give me a hint

im only able to get it when im SYSTEM, is this the intended way? or this is any other method using a low priv access

[wooden marsh]

hello im facing an issue on file upload attacks skill assessment when i click submit on /contact no post request is done

[fathom pendant]

do you have burpsuite running catching the request?

[misty current]

DM

[misty current]

You have an endpoint that sends the exploit to the victim

[icy dagger]

Yes I saw it! Thanks!

[toxic apex]

is anyone able to use RDP for the sliver c2 module? It just throws a logon failure despite a reset 10 minutes of wait time. Even the solution tells you to just RDP in the first machine.

[dapper moth]

What error is returned?

[toxic apex]

[09:01:25:355] [64953:64954] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[09:01:25:355] [64953:64954] [WARN][com.freerdp.crypto] - CN = SRV09.sde.inlanefreight.local
[09:01:25:556] [64953:64954] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[09:01:25:556] [64953:64954] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[09:01:25:556] [64953:64954] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[09:01:25:556] [64953:64954] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

This is just a logon failure right? wrong password + user combo?

[fathom pendant]

no

[dapper moth]

It looks like

[fathom pendant]

actually could be

[toxic apex]

SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE this right?

[fathom pendant]

didn't see the STATUS_LOGON_Failure

did you wrap the pw in single quotes?

[toxic apex]

yes

tried smbexec.py aswell and that also give a logon failure

winrm is not open

[dapper moth]

You got right to the cert verification failure, didn't you? 😂

[dapper moth]

Is it in the SA? If not, what section?

[toxic apex]

yes

[dapper moth]

Let me check if I can get a session

[toxic apex]

i got it this reset.

3rd time the charm i guess?

[fathom pendant]

it just pushed it to the next line and i can't read

[dapper moth]

It opened up straight out

[toxic apex]

yes

[severe inlet]

i am currently on the Footprinting module in DNS section

i was able to answer all the questions except the last one

What is the FQDN of the host where the last octet ends with "x.x.x.203"?

i tried doing all the commands that i was taught on every subdomain i got
including trying to brute-force all of them but nothing worked

any hints?

[fathom pendant]

subdomains of subdomains

are you sure you found every subdomain?

did you do a dig axfr to the base domain?

[severe inlet]

yes that provided me with some answers

but none of those had the 203 at the end

[fathom pendant]

did you then try and bruteforce on one of those subdomains?

the answer will be a.b.inlanefreight.htb

[severe inlet]

i don't know why but only the base domain giving me results on my brute force

the rest of the domains give me error

[pine dune]

its taking 20 years to load the flag 🙄

[fathom pendant]

just have patience on them

[fathom pendant]

yeah time-based does that

[pine dune]

ah ok, funny thing was is that i somewhat got the flag earlier but there was an error in the flag so having to do it again after clearing cache

[severe inlet]

should i use a different wordlist or the one provided in the module?

[fathom pendant]

i believe there's a hint that should help you

not sure what wordlist you're using so i can't necessarily say if you should use a different one

[chrome dew]

Hey guys doing CBBH Hacking WordPress and one of the Capstone questions is not clear to me. I am reposting the question to this channel as I was informed to do so. I was not able to find the flag value.

[pine dune]

is there any way to speed it up? the connection reset on me and it didnt end up giving me the flag as it was reset

[steady dust]

Resetted the target, changed the VPN server.

[fathom pendant]

not have it do time based

[fathom pendant]

do you have foxyproxy enabled?

[pine dune]

ok cool

[steady dust]

it's disabled. 🙂

[fathom pendant]

or if you do, do you have burp running

:)

[chrome dew]

Got it

[fathom pendant]

i take it you killed and reconnected to the vpn after changing server?

[steady dust]

Tried all possible combinations. Usually, I wait like 1-2 minutes, after each operation (reset server or change vpn server).

[severe inlet]

i don't know what im missing i started getting subdomains in the form a.b.inlane...
but still none of them of 203 at the end i will try different lists i guess

[fathom pendant]

something fierce if i recall

[severe inlet]

tried the 3 wordlists that are called default.txt , 5000.txt and 20000.txt
none of those worked

[fathom pendant]

my hint was more direct than you think

[severe inlet]

my god i finally finished it

my only problem was the wordlist i guess

i thought it would've been another subdomain so i was trying every single one

i feel like maybe they should've given that as a hint?
since its just a wordlist

[fathom pendant]

i thought it was in the hint button

[severe inlet]

it just says that not every wordlist gives the same results

but i feel like they shouldve been more specific about which list

since ive never heard of the fierce or whatever its called before

[fathom pendant]

ah

could have sworn it used to be different

but that hint has been given plenty of times for this section in this chat

regarding the right wordlist

i believe if you sort by size in that directory it's one of those you'll get there as you try different lists

[severe inlet]

true

and i feel like its those moments where you take hours on a question that you learn the most from it

so im kinda glad that we dont have an answer list or a video explaining lol even tho its fraustrating

[whole vale]

hey sorry i am looking for some help on a simple issue(i am assuming) i am trying to run a scan on burp, but when i got to target to run a scan on the address it simply wont work when i right click, i know thats not the best description but i see the scan option but its grayed out showing i am not able to use it, but i am wondering why i cannot

[fathom pendant]

some burp features are locked behind pro version

¯_(ツ)_/¯

[whole vale]

dam

[fathom pendant]

without knowing which module or section you're working on that's the best i can answer with

zap can do it for free

[whole vale]

yeah sorry i forgot to add the module and section, technically i am supposed to use zap but i just like burp better

[fathom pendant]

¯_(ツ)_/¯

there's likely a burp plugin that allows you to scan

but i cba to google/search for you

[whole vale]

cause i am in a easy course, the web proxies, zap scanner, but when i tried using zap it never worked(idk how to describe it) cause when i opened fire fox with zap to have the whole gui menu, when i ran it on the website none of the gui worked(again idk how to describe it), all i know is there was the debug menu saying there was a error and when i tried to spider it, it didnt do nothing, and when i manually tried, it was weird cause i am supposed to get a "high level vulnerability" which i am ment to use to get the flag, but when i manually scan it wont give the the "high level vulnerability", sorry for the yap i just dont know what to do tbh, so its just the gui that wont work and the manual wont get what is needed ig. so thats why i used (tried)burp

[spring trellis]

Hi, I am trying to do the Skill Assessment for "Pivoting, Tunneling, and Port Forwarding" but whenever I try to set a pivot the SSH connection would break or be too slow. I am trying to study from a Cafe and usually get somewhere around 9-15mbps.

Can the internet speed be an issue ?

yes a few times

[fathom pendant]

i just used the actual zap menu, not the zap plugin

[whole vale]

so no gui

[fathom pendant]

use tcp instead of udp vpn; that low of speed shouldn't be *much * of an issue

[fathom pendant]

i didn't need it when i ran through the module ages ago

[spring trellis]

Thank you, will try it out

[fathom pendant]

tcp is more stable of a connection

[whole vale]

ok, sorry to keep asking stuff but may you have previously encountered the same error i mentioned with the high level vulnerabilty not appearing, and any fixes?

[fathom pendant]

for rdp this is a sample command from the help article: https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn
xfreerdp /u:username /p:password /v:TargetIP /cert-ignore /bpp:8 /network:modem /compression -themes -wallpaper /clipboard /audio-mode:1 /auto-reconnect -glyph-cache /dynamic-resolution

[spring trellis]

the issue more of is that whenever I set a port forward with metasploit to do this, the connection dies

stays on for a bit then gone

[fathom pendant]

¯_(ツ)_/¯

[spring trellis]

(╯°□°)╯︵ ┻━┻

[fathom pendant]

i genuinely wouldn't be doing this on an open wifi

[spring trellis]

Just internet issues at the house so no options for a bit

[fathom pendant]

as you don't know if the Wi-Fi you're connecting to is safe

¯_(ツ)_/¯

[spring trellis]

I have tried using my phone as a hotspot for it but doesn't go as well

so this the best option for me atm

[calm abyss]

BaseUrl localhost:5001

Running delete 127.0.0.1 and leave the second option

did you finished the module ? I am working on it

[sullen jay]

Hello !

I am doing the

Module: Cross-Site Scripting (XSS)
Topic: Session Hijacking

I keep getting "The connection has timed out" whenever i submit a blind xss payload.
I submitted the same payload in the field (provided in the solution)
The same happend in the Phishing (XSS) lab also

Can someone help here please ?

[iron sigil]

Hello everyone. I am working on the last section of Getting started where I have to gain a foothold on the target IP. I have connected to the VPN. My issue is that whenever I open the IP in a browser, the page will not display until I disconnect the VPN, neither can I explore the webpage, but I can 'curl' any page on that IP while being connected to the VPN. What should I do to fix this?

[fathom pendant]

are you doing http://ip?

depending on the browser; you may need to disable the automatic upgrade to https in settings (google is your friend)

[fathom pendant]

i'm assuming you adjusted the payload to work with your IP

[sullen jay]

yes im using the vpn (tun0) ip with http://

[raw ivy]

Hi everyone, I’m having trouble with the skills exercise in the module Injection attacks. Can i dm somebody?
I have xpath injection but I’m not able to get the flag

[fathom pendant]

i wasn't talking to you with the http://

[sullen jay]

ahh my bad
but yes i was using correct ip

[stark lark]

Windows Local Privesc

https://academy.hackthebox.com/module/67/section/601#:~:text=Extracting Credentials from NTDS.dit

Am I missing anything? I don't seem to be able to grab the bootkey from SYSTEM

[iron sigil]

I was not using it and I just tried it with http:// and I am facing the same issue.

[fathom pendant]

are you sure your browser isn't automatically making it https?

[iron sigil]

Yes I am sure. The browser indicates that it's an insecure connection

[raw ivy]

Were you able to solve this?

[fathom pendant]

1. That's illegal
2. #rules

[raw ivy]

Were you able to get this?

[fathom pendant]

I suggest not doing that and being patient

[raw ivy]

I’ve been stuck on it since before the weekend 😄

I don’t want the answer. I just want to know what I’m doing wrong

[fathom pendant]

you literally only just asked for help like 5 minutes ago + it's near new year holiday; so many people may not even be thinking about their computer lol

[uneven pecan]

Sadly not, I’ve moved on for the time being. Gonna go back through the module at some point. Hopefully I’ll see what I’m missing

[fathom pendant]

it's moreso i don't wanna get pinged for something I wrote 2 days ago, let alone a month ago in some instances

so idk how others feel about that

[iron sigil]

I just tried it on chromium, it takes like 3-4 minutes to load the page, is it supposed to take this long?

[fathom pendant]

it shouldn't

[rotund sphinx]

hi, trying to get back into this and feel like i am doing something wrong, currently on the easy lab for password attacks module, i have found 2 open tcp ports for known services.
tried hydra against both using the username + password list from the course resources, but after letting them run for a few mins they were both giving eta ~2 hours
currently trying to run an all port scan but that seems to be hanging (its been at 31% for 10mins so far)
i dont necessarily want the answer, but am i way off or is my machine misbehaving or is there really a multiple hour brute force for an easy lab?

[fathom pendant]

it shouldn't take multiple hours

but ssh is super slow, so maybe don't attack that

[rotund sphinx]

i tried attacking ssh at first then i remembered that ssh was probably slowest so i tried ftp instead but that was almost as slow

[fathom pendant]

you can increase threads with -t

[rotund sphinx]

i think it was running 16 threads by default but guess i could try increasing it

[fathom pendant]

48 is stable from what i recall

[rotund sphinx]

48 threads is still giving me eta of 45mins, guess i will just let it run though

[fathom pendant]

it won't take that long

eta != actual time

that's just the time it'd take to go through the whole set of lists

[charred canyon]

Hi, im searching for someone who knows a bit of HTB to help me and teach me, and also we can be friends

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

how this reads: "i want someone to teach me without providing any actual value to them"

[charred canyon]

Unfortunately I can't offer anything, I just want to learn and if I get a friend along the way that's what I get

[fathom pendant]

the friends i have that helped me learn things i was friends with already before considering asking them for any help

htb academy teaches you a bunch of skills that can be used

[rotund sphinx]

ye i guess that is if its the last user/password combination, but knowing my luck that is how these work out :p hopefully its nearer the start

[fathom pendant]

HTB won't give you something like that; at most 30 minutes is a good baseline

the pw attacks module is all about patience

[rotund sphinx]

ye thats why i thought i must be doing something wrong, like i get they take a bit of time but 2h felt crazy for a single question

[charred canyon]

Sorry bro

[tranquil axle]

Just hang in there, password attacks is pretty bad with how much time it makes you waste waiting, the course gets better after

[fathom pendant]

Eh. It makes it slightly more realistic

Not everything is gonna have instant gratification

[hasty mauve]

though the intent of the course is to teach pentesting, not patience

this module was giving me a hard time lol

[fathom pendant]

Pentesting requires a level of patience

[unkempt basalt]

a lot of patience actually

[fair yacht]

guys can I get some help for intro to assembly skill assessment, task 2, that is the only one I need now

[hasty mauve]

I'm aware of this, but they should not be testing your patience when you're just trying to learn a new technique.
they should've just had a module called "having patience is key" or smth like that

[tranquil axle]

The password attacks module successfully taught me to attempt online password brute force only as last resort

[fair yacht]

the shellcode doesn't executes I tried 2 different versions

I optimize the clode then extract the shellcode from it

and it just doesnt works

[unkempt basalt]

the earlier u develop your patience, the better it is for u later on

[fair yacht]

the whole hacking stuff is "having patience is key" module btw xd

[hasty mauve]

exactly, in one of AEN's parts, I did a challenge in a specific way that was not intended, when I looked back at the walkthrough for the part that I did, I saw that the intended way was brute forcing lol.

[fathom pendant]

Part of learning is tempering expectations

[fair yacht]

wtf I wanted to reply to this

olliz can u help please?

I have been stuck for like 5 hours

[marsh thicket]

sudo find /home/htb-student/ -type f -name *.conf -newermt 2020-03-03 ! -newermt 2020-03-04 -size +25k -size -28k

?

[blissful timber]

Hello guys I have a question like this "Before you run your page fuzzing scan, you should first run an extension fuzzing scan. What are the different extensions accepted by the domains?" would extensions be like for example .php .html etc ?

[earnest pasture]

sudo find /

[marsh thicket]

same error :/

[fathom pendant]

I take it you're ssh to the target?

[tranquil axle]

You can dm me what you’ve tried and I can check in a bit

[earnest pasture]

Run it without sudo

[fathom pendant]

Just find should do

Also 2> /dev/null

At the end

Sends errors to the void

[marsh thicket]

this outputted nothing

[fathom pendant]

Find /

[marsh thicket]

wait

[fathom pendant]

[fair yacht]

the dev null is to redirect errors into the void

[fair yacht]

lmao damn I was late

[marsh thicket]

it still outputted nothing :/

[earnest pasture]

You are using a negation operator, you are looking for files that were not created and the question says to look for files that were created X day.

[fathom pendant]

Yeah no idea where that ! Is coming from

[marsh thicket]

yeah it was the ! that wascausing he problem

[fair yacht]

OMFG

I got the flag man

I literally got the flag than an error message xd

[iron sigil]

I finally moved on from the browser to the terminal and got one of the two flags. Thank you for your help.

[earnest pasture]

I think it depends on what you have listed if it is an Apache you should probably look for .php extensions and then pages like index.php

[fair yacht]

I HATE assembly so much

[spring trellis]

@prime tangle @fathom pendant I was able to get a relatively stable connection with another tool, but man this is slow

[whole vale]

hey does any1 know what "heigh level alert" your supposed to use in the using web proxies, zap scanner module cause i have 3, and i dont know which to use or if there is supposed to be a certain one, cause its taking a long time to scan and its only 40% done and i wonder if there is more, or if it scanning to much by accident

wait now there is 4

[fathom pendant]

It takes patience. But honestly this one was just dumb

[whole vale]

lol

[fathom pendant]

It's way faster if you start from the certain tool and it'll identify it

[whole vale]

i feel like after 50% it went by way faster so i am assuming starting from a point that was after that which is probably the tool your refering to, but i think i got it thanks👍 but it probably would of went way faster if i wasnt playing elden ring in the background

[forest ginkgo]

Hi

[storm elk]

We can’t help you recover accounts. Please contact support from the service you lost your account from

[wheat plaza]

Hello I'm newer

[dark hedge]

please stop asking, we cannot help you.

[simple zephyr]

Module: Using CME
Section: BloodHound Integration

Did anyone here have problems with AV? I could start looking to obfuscate my collector, but I am just trying to follow the guide within the module

[dapper moth]

Try changing the method

--exec-method {atexec,wmiexec,smbexec,mmcexec}

[simple zephyr]

thanks, working now. Do you happen to know if you can configure NXC to work with Bloodhound CE?

[dapper moth]

You mean the built in NXC collector? I don't
Might be a couple of tweaking though

[simple zephyr]

yeah

looks like its still trying to work with neo4j

[dapper moth]

If you are remotely running Sharphound you can run the newer version collectors though

I mean.... Like what you did there

[simple zephyr]

yeah I was able to execute the collector and get it to work

just wanted to test the built infeatures

[dapper moth]

You are scripting right?
You can set a bunch of commands to upload the collector, unzip it, run and retrieve the output files

Tbh I've never ran the NXC/CME BH collectors

[simple zephyr]

yeah, I actually have a script built that will put a file, run a file and then remove it.

I built it initially for ligolo and setting your agents, but realized i can also use it for any file.

its also configured to generate a json config file so you can just enter the machine ID and it will run at what ever creds you have stored.

[calm abyss]

i just finished the module

I just finished Game reversing and modding Skill Assessment.

If somebody is stuck i can lend a hand.

[lilac roost]

are you got de correct command?

[fathom pendant]

I'm sure

[calm abyss]

I finished the module. I used ChatGPT to sift through the garbage code and than is just MITM and you should be getting the flag.

I finished the module

[simple zephyr]

The CME and Bloodhound Modules are really solid. I would even recommend people taking CPTS to look into them if you have extra cubes.

[lilac roost]

Im try this commad: nmap -f 10.129.54.71 -p 25,21,80,22 --source-port 53 -n -Pn --disable-arp-ping --scan-delay 3 -sV -T 2
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-30 14:24 CST
Nmap scan report for 10.129.54.71
Host is up (0.065s latency).

PORT STATE SERVICE VERSION
21/tcp closed ftp
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
25/tcp filtered smtp
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
two ports are opens an i able to see de version, but all version arent the correct answer

[fathom pendant]

why aren't you scanning all ports

:)

[lilac roost]

oh, I going use -p-

[fathom pendant]

also sometimes the version scan won't hold all the info you need

[lilac roost]

what's that mean?

[fathom pendant]

it means exactly that

sometimes you'll need to directly connect to a port

the version scan isn't anything sophisticated

[lilac roost]

i tried connect in open ports using ncat but no working again. "ncat -nc --source-port 53 TARGET 80"

[fathom pendant]

because that's not the port that's gonna give you answers

if you've scanned all ports, there should be one that stands out

[lilac roost]

I got you

Thanks to yours suggestions

[fathom pendant]

i'm assuming you replaced "TARGET" with the actual target IP as well

[lilac roost]

Yeah i know that i need change that options

[ornate smelt]

Hy guys

I am a little confused

The 4th question of AD skill assessment part 1

Where it requires u to rdp internal machine

[fathom pendant]

mhm

https://tenor.com/view/if-you-think-of-an-gif-20132469

:)

[ornate smelt]

With the compromised user is not mentioned to rdp to that machine in blood hound

[ornate smelt]

I did that already

[ornate smelt]

I am asking about the logic behind that

[fathom pendant]

bloodhound doesn't always catch everything

i don't recall using BH all too much

[ornate smelt]

Hmmm

[fathom pendant]

also

q4 doesn't say anything about RDP

[ornate smelt]

I think one of the questions

I left my office

[fathom pendant]

https://academy.hackthebox.com/module/143/section/1278 <-- yeah?

nothing on here about rdp being directly mentioned

[ornate smelt]

But it was pivoting and rdping

[fathom pendant]

q4 is just "Submit the contents of the flag.txt file on the Administrator desktop on MS01"

pivoting, sure

[ornate smelt]

[fathom pendant]

but rdp is only one way of connecting to a machine

https://tenor.com/view/life-has-many-doors-ed-boy-ed-boy-many-doors-yes-gif-20774500

[ornate smelt]

I tried psremoting

[bitter hollow]

Morning! Where do I report issues with one of the modules?

Found a question that appears to be out of date, as the file/service it asks about doesn't exist on the VM

[fathom pendant]

there's also winrm

[ornate smelt]

BTW I did the pivoting part with meterpreter

[fathom pendant]

#1234357888114364508 my i'm assuming it's the Linux fundamentals dconf.service module?

[bitter hollow]

That's the one!

[fathom pendant]

your method of pivoting doesn't necessarily matter

[fathom pendant]

there's already a post about it #1323022693456543897

[ornate smelt]

I know it was too slow for me

Could u suggest faster alternative

[fathom pendant]

i use ligolo-ng

[ornate smelt]

I read about it

[bitter hollow]

Awesome, thank you!

[ornate smelt]

I am a little lazy to install it

[fathom pendant]

¯_(ツ)_/¯

well you asked for a faster alternative

[ornate smelt]

I will complete the lab with it

This is ur second time helping me, tnx buddy

[fathom pendant]

https://tenor.com/view/it-will-probably-cost-more-gill-engvid-it-will-be-expensive-it's-not-gonna-be-cheap-gif-9037379894260820247

[ornate smelt]

I think I will spend terse in the exam

[terse quiver]

Hi there; I'm currently doing Wordpress Hacking skills assess, and they asked me to identify the only non-admin WordPress user. I found three user with wpscan and one of them has author id 1(so it's an admin account). what about the others ? how to know which is an admin user ?

[red kraken]

any help for this error im stuck on PASSWORD ATTACKS -> Attacking LSASS ... pypykatz not working

[fathom pendant]

i don't recall running into that error tbh

are you sure the file didn't get corrupted in transfer?

[red kraken]

that makes sense

will try again

[lost storm]

Stuck on cme skills assessment last question 1745. Have ccache file but it's not getting me anywhere. Could I get a nudge?

[dapper moth]

Or the way you dumped LSASS

[ashen pollen]

@dapper moth can I DM you about the skill assessment of windows lateral movement?

[dapper moth]

Sure
Just redid this SA a couple of minutes ago

[dim ridge]

Hey all. First question on Web Fuzzing skills assessment has me confused -
https://academy.hackthebox.com/module/54/section/511

It says "Run a sub-domain/vhost fuzzing scan on '*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name) " Which sounds like it should just be one that comes back
I get more than one, i provided each one and none are correct

Attempt:
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:50365/ -H 'Host: FUZZ.academy.htb' -fs 985

[fathom pendant]

it's gonna be multiple

and it's gonna be sub1 sub2 sub3...

not sub1.academy.htb

[dim ridge]

right no spaces nothing?

[fathom pendant]

spaces between each name

[dim ridge]

ok haha, wish they mentioned that, trying

ty!

golden, done, thank you!

[fathom pendant]

why wouldn't you separate the names?

🤔

[dim ridge]

haha first time i've seen that format in a flag submission

[fathom pendant]

well it's not a flag

it's an answer key

[unreal sinew]

Just wanted to stop by and say the Pillaging module for Windows PrivEsc of CPTS is fantastic. Great work team.

[dim ridge]

its the first time ive seen it in an answer key submission

[fathom pendant]

¯_(ツ)_/¯

also for the second question, similar to the first .ext1 .ext2 .ext3

[dim ridge]

https://tenor.com/view/terrified-gif-20945782

[fathom pendant]

@runic lynx don't share passwords or cracked info

re-ask your question without spoiling information

[runic lynx]

Understood -

[fathom pendant]

don't want someone else just copy/pasting when you did the hard work 😉

[runic lynx]

I get it, so it's the first time posting here I think I should read the rules first 🙂

[dim ridge]

this is a nightmare haha, it has to be in the right order too all the extensions accepted by the subdomains and there is more than one subdomain that comes back with different extensions accepted

[fathom pendant]

all the valid extensions

On all subdomains

[dim ridge]

in what order though

[fathom pendant]

I don't think order matters

Should be 3 total

[quasi wave]

I think the password I cracked is for an SMBClient connection but I'm having trouble logging into any SMB share. When I use crackmapexec with the password I cracked, it says its a valid username and password. This is for the medium password lab for Password Attacks Module. I mean the username I got and the password that that username and crackmapexec shows it as valid username and password. Am I on the right track and why won't my attempts to log into SMB client work?

[dim ridge]

i hope not 😢

[quasi wave]

it says I have read permissions for users share

[fathom pendant]

Is smb running? :p

[dim ridge]

ok i must be doing something wrong i got like 8

[quasi wave]

hold on

[fathom pendant]

Also why not just use smbclient to connect instead of cme

Also use netexec in replace of cme

[runic lynx]

Hi everyone,

I'm working on this challenge:

"Extract the hash from the attached 7-Zip file, crack the hash, and submit the value of the flag.txt file contained inside the archive."

It's related to cracking passwords using Hashcat. Here's what I've done so far:

Downloaded the ZIP file and extracted the 7z file.
Generated the hash of the 7z file.
Successfully cracked the hash to get the password.

The problem is when I try to submite the password, the form says it's incorrect.

Am I missing something? Any tips or suggestions would be greatly appreciated.

[fathom pendant]

You're not asked to submit the password

Read the question again

[runic lynx]

Yeah it's a little confuse because says "submit the value of the flag" but I don't the flag.txt file there :/

[fathom pendant]

You cracked the zip file hash, so use it

Yeah, it's in the password protected archive. Which you just got the pw for

[runic lynx]

So I'm lose just right there because I don't know how or where to apply because I'm not getting like a pop-up or message where to put the password.

[fathom pendant]

Lead a horse to water, i swear

Try to unzip the archive [7z]

[quasi wave]

I have been using SMB client but its not letting me into the shares

[fathom pendant]

https://superuser.com/questions/406915/extract-7z-files-with-standard-linux-tools

Can you list the shares with the creds?

[runic lynx]

OMY, thank you -

[quasi wave]

its not letting me into any of the shares even after I run smb as that user

[safe star]

What does the command look like?

[fathom pendant]

If a share has spaces in it, you need to wrap in quotes

But "not letting me in" is incredibly unhelpful

Are you receiving errors, if so what's the error

[quasi wave]

┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ 
└──╼ [★]$ smbclient -L <IP-address> -W <SHARE> -U <USER> -P <password>```

[fathom pendant]

-L exits

[quasi wave]

oh shit

[fathom pendant]

-L runs the command to list shares then exits

Also you can just do //ip/sharename

It's also advisable to put username and password first

A case of RTFM

[quasi wave]

└──╼ [★]$ smbclient -U <USER> -P <Password> -W <SHARE> <IP>
Failed to open /var/lib/samba/private/<SNIP> 
_samba_cmd_set_machine_account_s3: failed to open secrets.tdb to obtain our trust credentials for <SHARE>
Failed to set machine account: NT_STATUS_INTERNAL_ERROR

it still won't work regardless of how I order it

[fathom pendant]

Wtf is your syntax lol

//ip/sharename is the common syntax for smb

-W btw is for workgroup

Not share

[fluid lantern]

Been looking thru all the comments in this discord regarding wsgidav. I've gotten all the other commands / alternatives to work in the File Transfer module EXCEPT wsgidav 😭

[fathom pendant]

Fuck wsgidav

Just don't bother lol

[fluid lantern]

part of me overthinks and one of those thoughts was "what if it's the only file transfer method that works in CPTS/OSCP"

but fair enough I'll settle for the other methods

[quasi wave]

I'm getting closer. Now its not giving me an error but its not logging me in

[safe star]

Do you have permission to access it?

What error

[quasi wave]

┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ smbclient -W Users -U <USER> //10.129.74.49/                    
Password for [USERS\<USER>]:
┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ smbclient -W shells-winsvr -U <USER> //10.129.74.49/Users
Password for [SHELLS-WINSVR\<USER>]:
tree connect failed: NT_STATUS_BAD_NETWORK_NAME
┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ smbclient -W Users -U <USER> //10.129.74.49/Users
Password for [USERS\<USER>]:
tree connect failed: NT_STATUS_BAD_NETWORK_NAME
┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ smbclient -U <USER> //10.129.74.49/Users
Password for [WORKGROUP\<USER>]:
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

[safe star]

Make sure the share name is correct

[fathom pendant]

You don't need to supply a workgroup

[quasi wave]

the closest I come is this because no error message:

┌─[us-academy-1]─[10.10.15.85]─[htb-ac-605555@htb-tbricfhhoo]─[~]
└──╼ [★]$ smbclient -U dennis //10.129.74.49/  
Password for [WORKGROUP\dennis]:

I specify any share and it gives an error

wait I got into one

[safe star]

You didn’t specify a share

[fathom pendant]

How much you wanna bet he was trying to get into the special$ shares

[quasi wave]

I got into one of the shares

now logged in but no commands work

[fathom pendant]

dir

Remember, smb is a windows protocol

[quasi wave]

ok I know

smb: \> dir
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*

[safe star]

Was it ipc?

[quasi wave]

yes

[fathom pendant]

Ah

Yeah.

Nothing useful is there

[quasi wave]

ok

what am I missing I tried every single share?

wait, do I need to log in as root and not the the user I had earlier?

is this root's password?

[viral snow]

Hi, were you able to complete this one? I'm really confused about nc. The instructions are not really clear on what I'm supposed to do about NC. Any help, please?

[fathom pendant]

Root? On my windows machine?

At least if I'm thinking right

[quasi wave]

wait hold on

[fathom pendant]

Unless it's a linux machine, then disregard

It's been a hot minute

[quasi wave]

when I sshed in as the other two users, it turned out to be linux

ya

[pine dagger]

iirc, the medium password lab was harder than the hard one 😄

[quasi wave]

have you guys done the challenge yourselves?

[quasi wave]

well, that's good to know

[pine dagger]

Which module name are you doing?

[quasi wave]

Password Attacks

this is the medium lab

[pine dagger]

Ah that was the module that made me take better notes

[quasi wave]

same here

[safe star]

@quasi wave did you get an ssh key?

[quasi wave]

yes

a public one and a private one. I also cracked the private one yesterday

the issue is I tried logging in as root with ssh public key and it won't work either

and smbclient won't let me into any other share besides IPC

[pine dagger]

Is that the final question?

[quasi wave]

there's only one question for medium lab

I have the cracked private key but I don't know what to use it to log in as

other than I know the user who's folder it is so I assume I have username

but the question is what can I log into with that informatoin

ssh? because that's not working

[safe star]

have you tried it on another user?

[quasi wave]

hold on I can try

wait a sec there's only one other user so give me one minute

ya this password won't work on either user

and I know that its not ssh password for either user

and its not ssh password for root and I found it in the ssh folder for one of the users

[fathom pendant]

Oh yeah you were on the last steo

[quasi wave]

and my goal is to become root so I can get the flag in the root folder

[fathom pendant]

Literally abstract thought here mark

why was the key protected

[quasi wave]

I hear you I just am having a lot of trouble figuring it out. I'm gonna need to bang my head against the wall for a while I guess.

[fathom pendant]

All you need is in front of you

[pine dagger]

Last note I have is the password for the root ssh key

[fathom pendant]

You have the final piece of the puzzle

Just slot it in

[safe star]

yeah i just logged in

[quasi wave]

does it have to do with the other user not getting the key?

like for privilege escalation?

if so wouldn't the username be root?

[fathom pendant]

Separation of duties, why give an employee the super user account

[fathom pendant]

Not necessarily

[quasi wave]

Ok

[fathom pendant]

Think about one of the section names, and abstract it

[quasi wave]

Ok

I will do that

[fathom pendant]

https://tenor.com/view/teamupforimpact-teamup-recycle-daur-ulang-gif-25294183

[Hint btw]

Only other thing I'll give at this point that "seems stupid"

Like why

But it works

[gray yacht]

You can just install ZAP and run it.

[dim ridge]

I did this one yesterday using ZAP and the in built Chrome browser it found the vuln. Make sure you're following all the steps and doing ALL the right scans

[dark leaf]

Hi

[simple zephyr]

For the CME Skill Assessment Question 1, I got the answer for it, but I felt this was more painful then it should have been. ||my user list was over 3000, and I removed all groups and machine accounts from the list|| Is there a way to make this more effecient or do you just have to weather the storm.

[solid quarry]

You could use other tools to make the same attack, cme / nx to get a user lists and then kerbrute to speed things up

[tranquil axle]

Did you bruteforce them?

Having a long list is normal, what you do as a next step is important

[unborn summit]

hi im struggling with AD Enumeration & Attacks - Skills Assessment Part II on the question "Obtain credentials for a user who has GenericAll rights over the Domain Admins group. What's this user's account name?"

The hint says||Think about how you obtained your initial foothold in the domain. which makes me think i need to use responder?? but only the hash of AB920 is being captured ||

I've been rereading the module for a few days but still completely lost as to what to do.

I can see the user is CT059 from bloodhound but no idea how to get the hash.

[earnest pasture]

To get the hash you should do LLMNR Poisoning on one of the servers

[unborn summit]

im confused, isnt that what responder does?

[earnest pasture]

Exactly, but you should try to do it on another server that you have compromised with administrator permissions.

[earnest pasture]

Remember that there is also Inveight which does the same as Responder but from Windows.

[unborn summit]

I dont quite understand, i have root on the attack box, why would running it on one of the servers be different? 😕

[unborn summit]

I'll try running inveigh

[quasi wave]

@fathom pendant is the section name I’m looking for in a different module?

[fathom pendant]

. Nope

[quasi wave]

Ok

Thanks

[fathom pendant]

Told you the recycling logo was a bit of a hint
Reduce
Recycle
Re---

[safe star]

Run it on the first machine

That part of the skill assessment doesn’t make any sense

[unborn summit]

inveigh captures the hash for C**** on all three windows machines, inveigh on linux doesnt capture anything, responder for windows doesnt capture anything, WTF is going on

[fathom pendant]

Don't reveal usernames

[dapper moth]

Inveigh is the Windows counterpart to NBT-NS/LLMNR poisoning

[fathom pendant]

Spoiler text does fuck all

Best to first letter*

Like C*

[dapper moth]

It does actually

[earnest pasture]

I think it may be something due to network limitations but as the partner says it is something that does not make sense...

[safe star]

wouldnt we be able to catch the user on the linux machine tho?

[unborn summit]

inveigh for linux doesnt work though

[fathom pendant]

The linux machine isn't domain joined

[dapper moth]

You might poison and spoof any mistyped name resolution request or capture a specific name resolution to a machine

[dapper moth]

If it is mistyped

If it just wants a name resolution to a machine that exists, that specific Host might respond

If you are running one of these tools, you might capture that request

No… cause you are running a poisoning tool

A user might mistype a name while inputting something in a browser or a Windows explorer address bar

[safe star]

yeah but the linux machine is on the same network running responder.

[dapper moth]

The tools will then answer to that mistype request saying that it is the machine/address it’s searching for and will capture that request

[safe star]

im going off of htb explanation

when LLMNR/NBT-NS are used for name resolution, ANY host on the network can reply

seems kinda hard to simulate 2 poisioning attacks

[unborn summit]

I would be curious to see the HTB annual gold solution walkthrough for this step

[safe star]

it would make sense if one of the domain machines had another interface

[dapper moth]

If you send a request to a Host that you already now the name and address there shouldn’t be any NR
You can just capture that request

[unborn summit]

so what, during an internal penetration test i should be running inveigh on every single windows host i have administrator on just in case someone connects to that machine? 😕

[dapper moth]

Idk depends on where and what you find yourself into

[ocean night]

Any port in a storm 🤷‍♂️ (I don't know)

[dapper moth]

Should you always capture network traffic once you get system!?! Hell if I know

[ocean night]

If it were me.. that'd be a hell no

..unless the time span for the engagement was until the end of time

Specific protocols? Aye

[dapper moth]

Hahahah exactly

I’d just move on… enumerate other hosts… services…

[ocean night]

Via AD / logs you'd surely get a map of hosts of interest too

But maybe I'm just yapping bs

(context, I have no direct knowledge of this module, just speaking from my own assumptions)

[unborn summit]

so then its sending a request to all three windows hosts? because inveigh captures the hash on all of them

[ocean night]

Feels like this might be a "go to DMs" kinda thing

[dapper moth]

Sure

[ocean night]

❤️

Yes, I'm still a killjoy. Let's see what 2025 brings.

[signal pike]

Do I need to finish the module to see the recommended/related boxes?

[ocean night]

I.. don't think so, if you're talking about that recommendation map page

[signal pike]

Okk, thanks!

[dapper moth]

Felt a bit rude on my part for the joke, sorry

[ocean night]

It's fine

I've said worse

..and I took it as what it was

[marsh thicket]

How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

i feel like again none of what was on theory section so far covered how to answer this question? https://academy.hackthebox.com/module/18/section/80

[fathom pendant]

netstat is useful

[marsh thicket]

yh the theory hasnt mentioned this at all what does this do ?

[fathom pendant]

Google is helpful

[ocean night]

Or man <command>

[deep pier]

hi all im new to this server is it possible if anyone can tell me the website for this discord server

[fathom pendant]

Read #welcome

[safe star]

how?

[unborn summit]

wdym how

i dont understand it either ☹️

[safe star]

are you running it in winrm?

[unborn summit]

psexec

why?

[safe star]

i just found the batch scripts and its just like i imagined

can i dm

[unborn summit]

sure

[gloomy lichen]

Anyone has a min for a quick sanity check on the "Parameter Logic Bugs" Skill Assessment? I seem to have unlocked all modules but I don't see what I'm looking for.. surely I'm missing something

[safe star]

they used an ip for ms01 i knew it

[marsh thicket]

yeah i am scratchign my head on this

i managed to output the source code using curl but bruh how am i meant to filter out all paths?

[fathom pendant]

By far the only bullshit one, I used the forum to help answer this

[cloud urchin]

Did you forget about attacking thick clients? lol

[simple zephyr]

I solved it, it just took forever to run. I was able to narrow down the list to 1400. Just takes forever running through chisel

[tranquil axle]

But did you realize you were supposed to asreproast the list?

Cause that shouldn’t take forever

[fathom pendant]

No. But at least thick clients actually told you how... in a roundabout way

[dapper moth]

So there wasn’t any name resolution

[dapper moth]

Basically this case

[safe star]

Yeah

[dapper moth]

I was going to spin up the lab for it but was too lazy
Spent the whole afternoon going through some of the material again

[safe star]

Yeah I can send you it

It is

[dapper moth]

Sure

[viral mica]

@red kraken it works fine you just need to use another file transfer method other than smb

[green minnow]

I was wondering at the time of doing that if the whole point is it was written confusingly on purpose to simulate a stupid client.

Like "We heard a client talking about XYZ"

Is this real life? Do clients give out confusing details irl?

It's such a jarring change of language to normal academy modules that use specific language to tell you how to proceed.

Maybe not specifically this question but I remember some of the inlanefreight stuff using jarringly different and unclear cryptic language to what you're used to. But it's been a while since I did it.

Like "the client wants you to see what you can find out".

[fathom pendant]

You're given prior context to "just figure it out"

[viral mica]

There's people back when I used to work IT that didn't even know how to put a password in to login because they used Mac instead of PCs; also people i know who made passwords like tacos4me

[green minnow]

don't macs have passwords?

idk never used one

[viral mica]

...yes...it's just like Linux

[green minnow]

One of the things I wondered about is if people irl have such bad passwords as on HTB machines or academy. But apparently this is accurate irl

[fathom pendant]

Derivative of unix

[fathom pendant]

People are lazy

[viral mica]

yes, a resounding, yes

[fathom pendant]

As someone that's worked IT, I've had to talk people out of providing me their password

[quasi wave]

that's insane can you tell me stories?

[fathom pendant]

No

[quasi wave]

ok

[fathom pendant]

Mostly NDA reasons

[viral mica]

To add people into the domain they had to give us the passwords they wanted to set for their accounts, so I got a whole whiff on how little people care about their passwords

[fathom pendant]

I worked OEM tech support

[green minnow]

There's a funny image on Reddit where someone posted a form at work saying "who wants their password changed? Leave name, old password and new password"

It had several entries

[fathom pendant]

https://tenor.com/view/it's-that-simple-col-nathan-r-jessep-a-few-good-men-it's-as-easy-as-pie-columbia-pictures-100-gif-2330765135657900726

Always bet on the dumbest user

[viral mica]

The passwords module goes over how to create wordlists out of OSINT, and it was pretty eye opening for me

[green minnow]

Some people even wrote their non work passwords like Facebook on it

[viral mica]

Well a lot of the modules were, you should've seen my face when I hacked nibbles

[viral mica]

[viral mica]

I mean at the end of the day it keeps us in business. But for your own sake oyu know advise people you care about to exercise strong passwords

[green minnow]

Hacking in movies: "ok I've reconfigured the ssid and exploited into the mainframe and run the ssh to get the encryption key"

Hacking irl: "hello I'm the password inspector".

[viral mica]

I think it was ippsec who detailed in one of the modules that he was just password spraying and got a hit with Welcome1! or Password1! something like that

[fathom pendant]

Yep; typical in corporate environments

[Season][Year]!

[urban raptor]

did you ever solve this? i am stuck on this assessment

[dapper moth]

That one is pretty easy tbh

[cedar ocean]

nah, im give up =)))))

[viral mica]

I've been having issues viewing the sharphound results on bloodhound recently on both the AEN and AD enums and attack module. for some reason the zip file generated with Sharphound doesn't upload. I tried on both my kali vm and on the site's pwnbox

gonna try re-making things with the .ps1 collector

[tranquil axle]

The issue is that you used a version of sharp hound that is made for the blooodhound community edition and you are using bloodhound legacy

You need shaephound before version 2.0 for it to work with the legacy version

When you start sharphound it should say “this version of sharphound is to be used with bloodhound ce 5.0” or something

[viral mica]

alright let me check it out

[viral mica]

I see now; the version of bloodhound kali repo still uses by default is older than the one the current release of sharphound uses.

okey dokey time to fix

[safe star]

you will need a very old sharphound or bloodhound-python

to work with the built-in bloodhound

[viral mica]

got it working now thank you guys

[long kestrel]

For the Information Gathering - Web Edition, one questions says:

After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail].

But the domain only has index.html with no links so there isn't anything to crawl. I've also tried subdomain and directory bruteforcing and haven't found anything so far using the lists mentioned in the module for those sections

[steady dust]

can you be more specific? what section?

[long kestrel]

In the Skills Assessment

[alpine ingot]

im having issues with the ACL abuse section, im trying to change the password for damundsen but i need to know wleys password, i have no clue how to get this password.

[steady dust]

as far as I know tree doesn't show files 🙂

[dark hedge]

type C:\Path\To\flag.txt

[steady dust]

I can't understand why I have connectivity problems. I tried all EU VPN servers, both UDP and TCP, but the problem still persist. The connection is slow, and many times I can't even reach the target. From pwnbox, the target is reachable.

[long kestrel]

okay I finally found a subdomain after finishing a top1million wordlist

[toxic apex]

It's much worse than that. It usually also includes various default passwords.

[whole sundial]

Hello @tranquil axle I m having issue on Skills Assesment 1 of Intro to assembly language
I get the code in registery. The 14 value join them together but doesnt work with loader.py dont get a flag

[acoustic sparrow]

it does

[acoustic sparrow]

there is no flag on the desktop

confirmed it by rebooting the machine twice

[steady dust]

The domain is incorrect. I think it is inlanefreight.local

You can see this also if you read the error. 🙂

[alpine ingot]

Its a direct copy paste from the module

gave the same error when i changed it to local

[steady dust]

go directly to Desktop and list the files.

[acoustic sparrow]

i am...

ive a rdp session open

[steady dust]

show a printscreen 😄

[steady dust]

I encounter this issue many times, and always was my fault. 😄

[acoustic sparrow]

i bet it is but iam on the right system and there is just none

[alpine ingot]

it just doesnt let me create a fake spn for adunn

idk why, i have done everything the module tells me

[long kestrel]

got it

[alpine ingot]

omg, i think i found out why it kept messing up, i genuinely think that the $SecPassword variable set in powershell was getting mixed up when used the second time, the new variable should be named $SecPassword2 or something in the module, because i thought i was doing something wrong. Following the guide messed me up for an hour because of this.
When i changed the variable name it worked flawlessly.

[long kestrel]

tree only shows directory structure unless you use /f

[acoustic sparrow]

yes thats true should have added that only use it like that

[undone narwhal]

Can you share a screenshot of the issue?

[daring cliff]

• 1 Analyze the event with ID 4624, that took place on 8/3/2022 at 10:23:25. Conduct a similar investigation as outlined in this section and provide the name of the executable responsible for the modification of the auditing settings as your answer. Answer format: T_W_____.exe

Regard

[dim ridge]

you might need to follow the steps in the welcome channel

[fathom pendant]

Did you complete an investigation as outlined by the section?

[daring cliff]

yes for sure

i have follow the protocol on top

[fathom pendant]

so you started at 4624 and went through the whole process detailed by the section to get the information?

[daring cliff]

yeah

after i search the tim

but the process name i have found is not good

[fathom pendant]

and did you do a more thorough investigation after?

as outlined by the section

[daring cliff]

yeah i go in details mods

for have a list of informations

[fathom pendant]

what module is this again?

[daring cliff]

Windows Event Logs

but i remake the modules afternoon

i think i have make a bad manipulation for sure

[fathom pendant]

you're just likely misunderstanding the instructions because 4624 won't be the only logs you look at

[daring cliff]

yeah there are some

and after you search the good time

[fathom pendant]

the module shows you how to create a query to narrow your search down

[left stirrup]

Hiii,
I've got a problem with the skill assesment of the wi-fi penetration testing basics.
It seems that I'm not capable to see a lot of frames from the access point HTB.
I need to capture the EAPOL to actually crack the passphrase.
I'm also not capable to do a deauth attack to the target.
Does anyone had an idea of where the problem could came ?
PS : there's an update after almost 3 hours and half...

[fathom pendant]

make sure you also look at the right date after applying filters

[daring cliff]

✅

[glad patio]

Hello, everyone! I'm studying malware debugging (https://academy.hackthebox.com/module/227/section/2496) now and there's part about InetSim, which I'm struggling with.

I've connected to HTB VPN and then started InetSim on my own VM. In configurations I put tun0 address, afterwards I couldn't connect to Windows target so I launched HTB PWN box and connected to it. Now, I've specified DNS ip address of my InetSim instance in IPv4 adapter settings but it still doesn't have connection to internet and doesn't load any pages. Is it supposed to be so at this part of the module (for shell.exe analysis?)

I suppose I shouldn't have specified tun0 interface, or is it something else?

UPD: I've changed it to enp0s3 -- still not connected

[zealous plinth]

Hello I want to root my android help me

[fathom pendant]

have you tried googling

[zealous plinth]

Yes but the methods are not working

[fathom pendant]

well this isn't the channel to discuss this; i suggest reading #welcome and #rules

since you clearly only searched "hacking" and found this discord

[zealous plinth]

So where should I talk about this?

[fathom pendant]

if you read and follow #welcome you might be able to find a more apt channel

[zealous plinth]

So is this group not for help? If you can help, please do, otherwise at least keep quiet.

[fathom pendant]

if only there was a channel that explained what this server was about

this server isn't about helping people root their phones

this channel in particular is for help regarding the HTB academy learning modules

you'll have more access to the server if you;

1. Create an HTB account
2. follow #welcome

anyway, keep the channel on topic

:)

[zealous plinth]

Is it illegal for a person to have full access to their own device?

[fathom pendant]

not the point

lmao

keep the channel on topic, or you can leave - since you don't want to follow simple instructions

[zealous plinth]

Ok I'm wrong you are right 👍 bye

[fathom pendant]

literally all i'm telling you is this isn't the right channel, and i can't send you to the right channel because you don't follow instructions to verify

even if i linked an apropro channel it'd just show up access-denied

[zealous plinth]

I am verified user

[fathom pendant]

gotta link your hackthebox account

[acoustic owl]

It has nothing to do with the HTB Academy. Please keep the channel on topic.

[fathom pendant]

because this is a server revolving around the hack the box service

if only there was a a channel to explain this

[zealous plinth]

I just need to download NetHunter on my device. I am a beginner, please help me in DM 🙂

[fathom pendant]

it's fairly obvious you're a beginner, you don't need nethunter

lmao as a beginner nethunter would probably be the most frustrating thing to use

as hacking from a phone/tablet is tedious and requires some level of existing knowledge

[zealous plinth]

Using chatgpt 🙃

[fathom pendant]

that's your first mistake

[zealous plinth]

I am also reading books 📚

[fathom pendant]

if you don't know anything, chatGPT could be telling you utter bullshit and you wouldn't know

[acoustic owl]

Guys, please keep the channel on topic.
Mobile hacking is not covered by the Academy yet.

[fathom pendant]

either way using a VM on a PC/Laptop is less frustrating of a learning curve ¯_(ツ)_/¯

[ocean night]

Who pinged 0_0

[fathom pendant]

and doesn't require you to root your device and potentially void warranties on your device because you decided you needed nethunter

[zealous plinth]

ChatGPT was just passing time with me, so I came to ask for help on Discord.

[fathom pendant]

if you want to learn hacking in an actual reasonable way https://academy.hackthebox.com

it has a combination of practical labs alongside reading

so you can practice what you read

be warned, it does require some abstract thinking to go from the examples to the practice

as not everything is 1-to-1

[zealous plinth]

Thanks sis for your help

[fathom pendant]

also don't call me sis

i don't know you like that

[zealous plinth]

You are a boy

[fathom pendant]

no

just don't call me sis, is that such a hard concept to grasp?

[zealous plinth]

Ok I am just a old soul

Are you an experienced cybersecurity person?