modules

[worn jungle]

Hello, I need your help with the Security Monitoring & SIEM Fundamentals module (Introduction To The Elastic Stack part)
I manage to connect to Kibana and send a request, but I can’t get the results, it gives an error.
Search Error: Batch request failed with status 0
I also unable to see SOC-Alerts Dashboard, after a while it gives me an error:
Network error, try again later or contact your administrator.
The problem is precisely in the request to the logs, since Kibana itself works without problems, but it apparently cannot receive data from ElasticSearch
P.S. I tried waiting 20-30 minutes, but the result was still the same.
Upd: Got it.
I connected from my host using firefox, the connection was successful, but for some reason I could not make a single request to the logs, although the interface was fully working.
When opening Elastic inside htb pwnbox everything worked fine

[wild sage]

Re read the question and follow along with what the module is doing

[nova forum]

Hello @slow ruin could you help me because i have created a model which has accuracy 89% but when i submit it to the url:5000 i got accuracy 0%.

[visual island]

Has anyone completed the new AI Red Teamer role? I am at Page 25 Skills Assessment and i need a little help.

[deep shore]

LFI module is WAFed or something. I'm getting reset on the very first assessment whenever an existing file is requested via the language param. Have tried all techniques, all receive connection reset.

I can also request nonexistent php files via the same param and it just re-renders the site in English.

I'm guessing this behavior is unintentional?

[valid nest]

on Advanced SQL injection module, is possible to get the jar file on my host computer? It is cumbersome to set up the lab every single time.

[nova forum]

same status

[storm elk]

you can connect over ssh no?

scp it to your machine 😉

[valid nest]

thanks. I will try again, my computer didn't connect to the target, not really sure why, maybe because it is using 10. or maybe wrong vpn i am using?

[storm elk]

If you connect to the VPN you should be able to connect to the machine over ssh to download the file

[valid nest]

thasnk!

oh gosh.

wrong vpn file!! Thank you so much!!

[storm elk]

😄 glad you solved it

enjoy!!

[valid nest]

feels so stupid. Thanks for the pointer!! have a great day

[spare dome]

who knows C programming here

ngl i feel like im not good enough for hacking

[winter schooner]

Hello, I'm on

Attacking common applications: Exploiting Web Vulnerabilities in Thick-Client Applications

I xfreerdp to machine, but i cant find the fatty.jar file, i restarted the machine. and searched for it but cant even find it.

[fathom pendant]

You don't necessarily need to know C to hack

[fathom pendant]

It's in the C:/ root

I forget which directory

[spare dome]

nah i got no device,bad at hacking,forgets shit that i learned and more

[fathom pendant]

The pentester path, for instance, barely uses any c and the only c used is to create a shared object file and is given directly to you

[fathom pendant]

Notes are important

[storm elk]

You sure you edited your hosts file @dusk yarrow

[spare dome]

can u pm me i wanna learn from you

[fathom pendant]

Dms are only open for #modules message (not free)

[storm elk]

👀

https://tenor.com/view/spanky-throwing-money-cash-money-our-gang-little-rascals-gif-7602783295867595867

[spare dome]

bruh im broke WHAHAHHAH

[fathom pendant]

I've been slowly discord search optimizing the message

[fathom pendant]

https://tenor.com/view/kermit-not-my-problem-sip-tea-time-gif-11560723

[spare dome]

dude im 12

chill

[fathom pendant]

Thanks for admitting to violating ToS

https://support.discord.com/hc/en-us/community/posts/360050817374-Age-restriction

[storm elk]

uh oh

[spare dome]

yall follow this boring stuff

why is that even important

[winter schooner]

Which directory is it in?

I checked dev, tmp and TOOLS its not in there

[fathom pendant]

Legal compliance

[fathom pendant]

Did you try Apps?

[spare dome]

bro cmon im not falling into one of those predator shi

[winter schooner]

Yup it was in there 🤦‍♂️ .
Thanks so much.

[fathom pendant]

As that one has a recent date

[fathom pendant]

It's not about that lol

Literally HTB could get in trouble for knowingly allowing someone under the ToS to participate in the server, getting it shut down

Not to mention HTB has their own age requirements

https://help.hackthebox.com/en/articles/9456556-parental-consent-and-approval-for-users-under-18

[storm elk]

Yes @spare dome you should get that parental consent form filled and submitted

[spare dome]

ok

nvm im leaving here

[dusk yarrow]

Sup

[near rock]

Yeetus the fetus

[dusk yarrow]

https://academy.hackthebox.com/module/54/section/511

I'm in this module.

Doing fuzzing of vhost and subdomain.

[storm elk]

could you check if your hosts file was setup correctly?

whats the content of /etc/hosts?

[dusk yarrow]

  GNU nano 7.2                                                  /etc/hosts                                                             
#
# /etc/hosts: static lookup table for host names
#
94.237.54.164   academy.htb
#<ip-address>   <hostname.domain.org>   <hostname>
127.0.0.1 localhost.localdomain localhost
::1                 localhost.localdomain       localhost
127.0.1.1 blackarch.localdomain blackarch
# End of file

[fathom pendant]

Q1 just wants the name like; www abc 123, it's not asking for the full domain

[storm elk]

Is that the IP you see too as your target?

[dusk yarrow]

Target(s): 94.237.54.164:37846 

Life Left: 14 minute(s)
+ 1  Run a sub-domain/vhost fuzzing scan on '*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name)

[storm elk]

whats your command

[dusk yarrow]

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:37846/ -H 'HOST: FUZZ.academy.htb'

Looks good right?

I did everything correctly right?

[dusk yarrow]

Subdomain. Right?

[fathom pendant]

Are you getting errors?

[storm elk]

Are you sure that is still up?

I can't reach that IP + port in my browser

[dusk yarrow]

 :: Method           : GET
 :: URL              : http://academy.htb:37846/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.academy.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________

:: Progress: [2560/4989] :: Job [1/1] :: 2 req/sec :: Duration: [0:20:13] :: Errors: 2520 ::

[dusk yarrow]

I've been doing this for hours. I had to change the IP address many times.

[storm elk]

Did you change your hosts file accordingly?

Because that explains your problem. That the Ip of the target does not match your hosts file

Or the port changed

[dusk yarrow]

Okay wait I just changed it again.

I got a fresh ip again.

Target(s): 94.237.54.164:51789

[storm elk]

Now change your hosts file

[dusk yarrow]

  GNU nano 7.2                                                  /etc/hosts                                                             
#
# /etc/hosts: static lookup table for host names
#
94.237.54.164   academy.htb
#<ip-address>   <hostname.domain.org>   <hostname>
127.0.0.1 localhost.localdomain localhost
::1                 localhost.localdomain       localhost
127.0.1.1 blackarch.localdomain blackarch
# End of file

[fathom pendant]

Now make sure your ffuf command is using the right port

[dusk yarrow]

:: Method           : GET
 :: URL              : http://academy.htb:51789/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.academy.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 985
________________________________________________

:: Progress: [80/4989] :: Job [1/1] :: 2352 req/sec :: Duration: [0:00:33] :: Errors: 40 ```

[winter schooner]

Now i got stuck again when recompiling the .jar file after editing. I can see the binary unfortunately, when I try to open it nothing happens, but when i open the regular file that wasn't compiled it has no issue running.

[fathom pendant]

This section is honestly a pain in the ass

[winter schooner]

If you want, use this command but just modify it for your purpose

ffuf -u http://monitorsthree.htb -H "Host: FUZZ.monitorsthree.htb" -w /home/kali/Downloads/subdomains-top1million-110000.txt

[fathom pendant]

Because you have to decompile, recompile,

[fathom pendant]

That fs thing isn't really helpful in this instance

[winter schooner]

Is it because i did something wrong? Or is it just buggy, that I'm getting this error.

[fathom pendant]

It just overall sucks

You need to make sure to remove the file hashes from the meta-inf manifest

[winter schooner]

I did, but for some reason it got stuck only being able to be executed from internet explorer,( The files logo had internet explorer), and when I couldn't change it so it could be in its default way, I just said it probably wont make a difference anyway and recompiled it, but then I got that error. Ill just reset the target try again hope it works.

[fathom pendant]

Yeah it's a terrible section in an otherwise great module

Imo it shouldn't even be in it (for several reasons)

[winter schooner]

Ok glad to know I wasn't incompetent and its just the section having its issues.

[fathom pendant]

Just know after every step you basically have to recompile

[dusk yarrow]

Ayooo btw I'm not done yet. When my problem gets solved I always say thanks so it's still fuzzing.

I don't forget who helps and does good.

[cloud urchin]

careful not to spoil content

[dusk yarrow]

I don't have the answer

It doesn't contain answer

Btw still thankx @fathom pendant @storm elk

[safe star]

https://tenor.com/view/lebron-sunshine-lebron-james-sunshine-sunshine-lebron-you-are-my-sunshine-you-are-my-sunshine-gif-509896211431970290

[devout coral]

How did you solve it

[safe star]

have you tried anything log related?

[winter schooner]

Im gonna kms this is so confusing, and I think I just messed everything up and have to restart.

[fathom pendant]

Id make sure to have the compile command on copy/paste lmao

[surreal chasm]

Hey,
I'm doing the module Attacking Common Services and i'm under Attacking FTP
The first question is
What port is the FTP service running on?
But this is my nmap scan

nmap -sV 10.129.203.6 -p- -T4
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
53/tcp  open  domain      ISC BIND 9.16.1 (Ubuntu Linux)
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

If i can get a hint what i'm missing, that would be helpful

[faint geode]

I would restart the instance. I had issues with ftp not showing up and after restart it then showed

[ancient niche]

Good Afternoon guys, I'm here in this module but i cannot find it the file for upload. The module is Aplications of Ai in infosec

[surreal chasm]

I've done that once
isnt that wierd?
Ok now I see that, thanks

[humble mirage]

i found this on the scan (AEN)
2 Dovecot pop3d
2 Dovecot imapd (Ubuntu)
2 Apache httpd 2.4.41 ((Ubuntu))
1 vsftpd 3.0.3
1 (unknown banner: 1337_HTB_DNS)
1 Postfix smtpd
1 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
1 2-4 (RPC #100000)
Thats my Host & Discovery section in the Appendix of my report. Is it correct?

[last haven]

going through the attacking SMB section in 'attacking common services' module. crackmapexec fails to identify the correct password from the list when bruteforcing.
cme output:
jason:<the actual password> STATUS_LOGON_FAILURE
this is supposed to be the correct password though, and i confirmed i'm able to log into SMB with this. is this something to look out for when using crackmapexec?

[fiery berry]

Use netexec, crackmapexec is unmaintained.

[visual umbra]

Im in /using webproxies/ZAP Fuzz/ i get the flag but HTB says it is wrong?

[wild sage]

Make sure there are no additional spaces at the end of the flag

[visual umbra]

It was probebly a space.. Thanx

[wild sage]

All good, many a times I copied the flag to have an additional space find it's way into the end

[winter schooner]

I fixed it

[tranquil axle]

can I get a nudge on the Blind SQL SA Injection point? I tried the timed and error based options from the cheatsheet, url encoded in Cookies, UserAgent, post params on POST/GET login.php and index.php but I see no result. Sometimes I think I got it but then it is just the lab taking long for no reason and if I resend the same payload it is "fast" again

[winter schooner]

After i spent the whole day on
Attacking common applications: Exploiting Web Vulnerabilities in Thick-Client Applications

I got this far, but now I'm having issues with ||fatty.server.jar|| being corrupt or damaged when I'm trying to execute it.

Could anyone help me? I'm sick of this section.

[cloud urchin]

This is HTB's "Fatty" box. Many people struggle with this section of Academy, and some have had luck watching Ippsec's walkthrough of the machine, so maybe this will help you too: https://www.youtube.com/watch?v=3bvKLj0akMM

[fathom pendant]

don't spoil info for content that you had to fuzz for; i believe that module is above t0

[jade lava]

Sure, very sorry for that. I will try not to spoil anything again.

[slow ruin]

My issue was training the model on the incorrect labels. Make sure you train your model on the text and labels and make sure the labels map to the same text. Once i created a vectorizer and classifier i used the fit function with text and label as perimeters

[grim basin]

https://academy.hackthebox.com/module/113/section/2154
im 99% sure i have the correct answer for this modules question but its not working

nvm the 1% came in clutch

reading comprehension demon

[rough comet]

it has been a while since I did "Password Attacks". I am resuming my work today. But I cannot find the section with Kira's password, needed on "Protected Files". Can someone please tell me on which section is Kira's password provided?

Use the cracked password of the user Kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer.

[jade lava]

I'm stuck at Type Filters section at File Upload Attacks. I've tried all the possible things, and variations but I still get the error "the image "..." cannot be displayed because it contains errors. Not sure how to explain where I'm at withour spoiling anything

[winter schooner]

Ok nice guess ill be doing this tomorrow as well.

[fathom pendant]

you bruteforced her pw as part of one of the early sections; it's why you can't find it provided

this module reuses credentials a lot

credential hunting in linux is where you would have cracked their login to pilfer other credentials

[earnest pasture]

If you're still stuck you can DM me!

[rough comet]

Thank you . Yeah , I know is coming from another section . I just couldn’t find it . Thanks

[fathom pendant]

As a tip for future headaches, save passwords you crack/find

[rough comet]

Yeah. Doing that now actually . Forgot to take proper notes when I worked on those . Thanks

That way , I will remember or know what password to use , if I have to resume work in a week or so . I can barely remember my name after today , lol

[wooden perch]

Hi all! I'm stuck for 2 hours on the last question on Active Directory BloodHound - Skills Assessment
Q-Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78).

I have the total azusers and divided by 2 and x 100 (number of users with global admin reach). It's not accepting the answer. Open my eyes 🙂

I found the answer with a right click on global admins group

[ivory finch]

hey everyone, quick question: anyone ever run into an issue with sqlmap on Kali where the results just don't show up? just wondering if anyone's had the same problem.

[lusty thicket]

no output?

[ivory finch]

so I'm trying to use sqlmap on my own machine(kali), I'm using the command sqlmap -u <url> --data="id=1" --dump-all, but it's not even showing the information_schema. It works fine on htbmachines, though. Any ideas what might be going on? I'm stumped!

[wooden perch]

I'm stuck, need help
Windows Privilege Escalation - Pillaging
Q:Find the configuration file for the application you identify and attempt to obtain the credentials for the user Grace. What is the password for the local account, Grace?
I can guarantee that I tried everything on the lesson, even the string used on the lesson is not being cracked using the steps. Anyone?
resolved: I was silly and downloaded the git repo instead of thre python script :/

[lusty thicket]

on your own machine?

is the target vulnerable?

[last haven]

I did, same result

[ivory finch]

yup, im doing the HTB - SQL Essentials Module

[quasi wave]

I asked in pro labs section

[olive slate]

Anybody can help with the last bit of HTTPs/TLS Attacks Skills assessment?

[queen flame]

~~Intro to Academy ~~
~~Learning Process ~~
Setting Up
Linux Fundamentals
Windows Fundamentals
Introduction to Windows Command Line
Introduction to Bash Scripting
Introduction to Networking
Intro to Network Traffic Analysis
Introduction to Active Directory
Introduction to Web Applications
Web Requests

Hi Im abit confused on whether i should skip the underlined modules and start with the rest because i feel like i should focus more on diving into things that i really dont know.. i have gone through almost till the end of linux fundamentals and i felt like i already knew most of the information there although there are some new info any opinions?

[waxen totem]

I'd still skim through those modules as despite knowing things there's some good nuggets of information in them

[queen flame]

thanks

ive already written notes anyways

[fiery berry]

paste the command you're using and remove the password, otherwise dm me. Remember to use the --local-auth flag if you haven't.

[ocean night]

/feedback is a gift

😅

Or #1234357888114364508

[novel matrix]

yeah gonna do that instead.

[ocean night]

I know you know, I'm just being, well.. you know

I gotta hit up the Academy paths one day

[novel matrix]

banging my head against the desk figuring out the answer

[ember ibex]

hey everyone i had a dumb question. I am doing the question in module "Linux Foundamentals" under filter content section and the question states...How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only) I did research because i had no idea got the answer || ss -l -4 | grep -v 127 | grep "LISTEN" | wc -l || but how would one know which command to use and how to use it. (i apologize as i am still very new trying to learn). || netstat and ss || were not really touched on that much prior to this question

[waxen totem]

#boxes

[waxen totem]

Exactly how you got it: through extensive research, although a lot of it is just muscle memory and reading the manuals

Like I know for a fact a command has a function but will forget the flag or syntax for it so I'll consult the man page

[oblique dawn]

I'm stuck on that one. I ran a connect scan through ligolo and the host timed out. I tried to do ports 1-10000 and the top 10000 ports.

I'm stuck on that one too.

[analog dock]

What’s the exact error

If you can reach the target and its windows, try -Pn

[oblique dawn]

I will try that. I was able to reach the target but didn't think to try -Pn.

[craggy coyote]

Hello everybody

I was looking for help with the Dirty pipe section in linux privilege escalation module

how the heck am i supposed to do this i tried a bunch of things and still nada

any hints are appreciated

[oblique dawn]

Did you complete the winrm one with leonvqz trying to connect to the DC? I'm stuck on that one. Could use a nudge on which method to use if you wouldn't mind a dm

[analog dock]

What module is it

Didn’t make notes on many of them

[oblique dawn]

Windows Lateral Movement in Active Directory Penetration Tester. Winrm section.

[autumn pilot]

The question is pretty straight forward, simply follow the chain of exploitation and you will be dropped into a root shell

[analog dock]

Haven’t

[craggy coyote]

I did, it won't let me use the bash exploit, gives this error

and i became smart used the python one

[autumn pilot]

compile the exploit on the target

[fathom tide]

Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer. i am stuck on this

[craggy coyote]

doesn't work either idk why

[autumn pilot]

I just tried it and it worked

[fathom tide]

how to filter on wireshark

[craggy coyote]

huhhh

i compiled it on my system then scp'd it onto target

that won't work?

[autumn pilot]

You must ensure that you have the same glibc library

[craggy coyote]

idk how to do that, still a newbie

oh wait

rightttttt

can you give me a command to curl the whole directory? idk how to use Curl

[autumn pilot]

Try to do the research about that by yourself, you will benefit much more than someone giving you the command

[craggy coyote]

right thank you sm

[fathom tide]

can you help me out ser

[autumn pilot]

Which section and module

[fathom tide]

cpts > footprinting >smtp

[craggy coyote]

Thank you so much my man, I just did it!

[autumn pilot]

Use the provided wordlist from the resources and perform enumeration, it can be done using multiple tools

Just make sure you use the wordlist

[fathom tide]

yea i did that captured it with ethercap used wireshark but i cant find the command used by the tool that is VRFY

[autumn pilot]

Why ethercap and wireshark, use other tools to perform the enumeration of valid usernames

[fathom tide]

to see if i got i different response

[autumn pilot]

Search for smtp enumeration tools

[fathom tide]

i used a username bruteforcer called smtp-user-enum

[last haven]

adding the --local-auth fixed it, thanks!

[fathom tide]

i tried vrfy expn rcpt and got no results

[fervent iris]

the question:

If I wish to start a capture without hostname resolution, verbose output, showing contents in ASCII and hex, and grab the first 100 packets; what are the switches used? please answer in the order the switches are asked for in the question.

the answer: sudo tcpdump -nvXc 100.
the answer is incorrect, what is the issue?

[urban elk]

I don't think I have that module, but maybe you don't need sudo or even tcpdump, since the question emphasizes the switches

and you may want to at least add spoiler tags

[fickle crystal]

on some serious note

[fathom pendant]

switches used

Not the full command

[fickle crystal]

Using David's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\david and read the file david.txt.
did the module show how to communicate with the shared folders ?

Pass the Hash (PtH)
password attacks

[fathom pendant]

The foothold is linux yeah? smbclient

[fickle crystal]

yes it did and im absolutely trippin bags

[fathom pendant]

If it's windows, slightly different

But sounds like it's covered

[fickle crystal]

yeah my fault my eyes just saw it now

[fathom tide]

i used the metasploit tool it found the user but the other tool couldnt find it

[fathom pendant]

The device is domain joined, you just use //DC01/SHARENAME

[solemn fractal]

Does anyone able to do this? Login brute forcing module I cracked SSH and I get the password but I cannot login in with the password and I have tried to upload my public key and I can’t able to upload it too because it’s required password and the password authentication is disabled. How do I work around this?

[remote latch]

Did u specify the custom port?

[fathom tide]

Then it ain't the password

[solemn fractal]

Wow that works thanks so f very much I appreciate that @fathom tide

[autumn pilot]

When you have a public IP you must specify the port that was given upon you spawned the target

[solemn fractal]

Sounds great now how do I login to ftp do I have to brute force ftp the same as I did with ssh or I need to do it after I login to ssh

[autumn pilot]

enumerate the target

[solemn fractal]

Will do thanks so much guys I swear you guys are awesome I have been working on it all day yesterday tried everything with ChatGPT too but never mentioned access it with port as I tried to do with ftp usually

[shut quest]

Black screen after you connect?

[honest crane]

Tried rdesktop or remmina?

[solemn fractal]

Trying to specify the keyboard layout with xfreerdp /v: ip/u username/p password /kdb:0x00000409

And try xfreerdp /v: ip /u: username / gdi

Good luck how

[fair frigate]

Hi...
Anyone help u how to hack mobile phone

[acoustic owl]

Please read the #rules

[grim basin]

im stuck on https://academy.hackthebox.com/module/113/section/1097
i knowfor sure im using the right cve but its not working and i dont know what i could be doing wrong

i changed them according to the ip of my machine and the module host

[earnest pasture]

ism.bat exists?

[grim basin]

shit

wait no its still not working

but yeah that part was wrong

[earnest pasture]

Dm

[grim basin]

u goti t

problem solved if anyone was wondering

[opaque geyser]

Hey Guys,
I was trying to clarify the steps I took for the module: Tapping into ETW

Am I allowed to post the steps I took?

[fathom pendant]

@mortal basin is the new networking module going to replace the existing networking module?

[fathom pendant]

the windows event log module is tier 2 so posting direct steps would be a spoiler

[opaque geyser]

Ok can I get a reference about finding a string in a etw.json

[tired olive]

Also is this going to be put into a pathway? Like IS Fundamentals

Seems like it’d be pretty important

[fathom pendant]

^ that was part of my question

[tired olive]

Was adding onto it 🙈

[fathom pendant]

doesn't the module reference using 'strings'

[mortal basin]

No. This one is more basic, and focuses more and goes deeper into the basics

[fathom pendant]

so a bit more depth than the standard net+/subnetting in the one in infosec fundamentals?

interesting

i'll take a peek when i can

[opaque geyser]

Yes however when I was searching such a huge amount of the data the processes I ended up finding were not the ones I needed it was for a different PID

[fathom pendant]

findstr is a built in command

[opaque geyser]

I’m guessing that Would be outside of Notepad where I opened up the etw.json

[fathom pendant]

i haven't touched this module ¯_(ツ)_/¯

so i don't have any notes on anything

[opaque geyser]

Ok I was just thinking I missed a step or something of why I couldn’t find it

[fathom pendant]

you likely missed a step or something

[opaque geyser]

Yeah true thanks Marcielee!

[dim crater]

guys can i get some help for password attacks module? i dont get how to dump hashes from the NTDS.dit file locally. all of the solutions i found are remote.

[lusty thicket]

this module doesn't demonstrate secretsdump?

[dim crater]

it does, and it is remotely done with :─$ python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -ntds NTDS.dit
secretsdump.py: error: the following arguments are required: target
So this is remotely done and i did transfer the NTDS.dit file so yeah

[lusty thicket]

it has two modes

[dim crater]

yeah the LOCAL one i think youre talking about, it says something about SYSTEM hive so i guess uiim transferring that to my local machine too now

[lusty thicket]

yeah, it stores the bootkey

which is needed to decrypt the hashes from ntds.dit

won't work without it

[lament barn]

hello everyone

[harsh gorge]

So you’re the guy who made me spend hours on the bug bounty path

https://tenor.com/view/goku-prowler-stare-meme-angry-gif-14312537171363175004

[pseudo kiln]

"just 18 days btw "

[acoustic owl]

Before you get bored, just do the CWEE modules. 😉

[ancient niche]

Good Afternoon guys, I need bit help. I don't know that file , I have to upload in this Module. In IA

[harsh gorge]

Kevin Hart bunny I would

But I’m broke

[exotic jungle]

Hello to all! I'm in the module Active Directory Enumeration & Attacks, specifically in https://academy.hackthebox.com/module/143/section/1455, and the question at the bottom is "Enumerate valid usernames using Kerbrute and the wordlist located at /opt/jsmith.txt on the ATTACK01 host", but the Target is the same attacker IP (and is a Linux host). It is wrong?

[winter schooner]

Can anyone give me a useful tip? Im on

Attacking common applications
Exploiting Web Vulnerabilities in Thick-Client Applications.

I have the ||fatty-server.jar||, but for some reason its not opening, even though I can extract all the files and recompile it. I checked ippsecs walkthrough on the box fatty. And although it helped me, I'm still unsure on why server.jar isn't opening. I have been stuck on this section for 2 days now.

[winter schooner]

You have to ssh to the ip provided, and run the kerbrute attack from there to the ATTACK01. Or did I not understand your question correctly?

[dim crater]

eyah i figuered it out, cool stuff, thanks

[hollow pewter]

Hello guys, I hope all doing well. In the Server-side Attacks box, Blind SSRF the following question ( Exploit the SSRF to identify open ports on the system. Which port is open in addition to port 80?) I found all open ports, and now the question is how may supposed to put them in the answer field?

[exotic jungle]

yes, but both IP are the same, the one to ssh to, and the target IP. Is the same host. I ssh to ea-attack01 with the user htb-student. I think the target should be a windows host.

[winter schooner]

I mean just go for it i think it should work

[exotic jungle]

I did, but the target (the same attacker host) is a linux, with only ssh and rdp ports open. So kerbrute has nothing to do there

[ancient niche]

who can help me with this please?

[winter schooner]

Ok let me do it again to check

[rustic sage]

What section is this?

[exotic jungle]

Thank you!

[ancient niche]

I have the Jupiterlab open but i don't know where is the file for upload in this web

i'm in IA

[rustic sage]

Oops. Got me thinking thats something new in CPTS path..

[ancient niche]

lol

oh my good xD

[rustic sage]

Sorry mate. Someone will help you soon 🔜

[ancient niche]

don't worry friend anyway still i'm noob

[hollow pewter]

Indeed not all ports are open, I was looking for a way to filter it but, I missing something

[winter schooner]

Ok so i remembered now,

You just copy the command it provided, your supposed to enumerate the inlanefreight.local domain, and for an easy way to count the amount.

||kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt > all_users.txt|| <---- Enumerates all users and saves into a file.

||grep '@inlanefreight.local' all_users.txt | tee matched_users.txt | wc -l
|| <--- Takes all counts of @inlanefrieght.local, outputs it into another file, and counts amount of instances of @inlanefreight.local there is.

[exotic jungle]

Oh, ok, so basically don't mind about the target in the question and carry on with the examples used in the module. Thank you for your time!

[winter schooner]

You use the target ip to ssh into it, then attack whatever domain is shown in the examples unless specified otherwise,

also no problem bro.

[exotic jungle]

Great. Have a nice day!

[quartz pivot]

I am unfortunately in the same position. can anyone provide some assistance? or even just a hint so I could progress a bit

[rain fulcrum]

Hello everyone, Have problem with one of the module: Linux Fundamentals/Filter Contents. So far all example worked until I got 3 exercises at the end, none of them I can answer correct, not sure what I am doing wrong? Did anyone had same issue?

[lusty thicket]

ask

[dusk yarrow]

I'm fuzzing on a module. I found three vhosts: test, faculty archive, then I fuzzed for extensions i found: php, php7, phps. Now I'm going after recursive fuzzing to find directories and files. With 3X3 combination of sub-domains * extensions to find a forbidden page.

So far looking good?

Btw one more thing, but because it takes so much time to fuzz. So I ran out of time for the server during this process so I had to change it multiple times. So the IP and port is not consistent in the results.

[quartz pivot]

ok Figured it out... I will not give the answer, but you will need to play with the timing a bit.

[dusk yarrow]

One more thing recursive depth is 3.

[tiny frigate]

I love the new Networking Foundations module, always good for beginners in particular to review some basics!

But for the life of me, I cannot answer some of the questions, even though I'm pretty sure I know the answer ^^'

Either I'm really on the wrong track here, or I just cannot get the spelling right xD

[remote latch]

https://tenor.com/view/fiber-optic-cable-product-cable-gif-16468841

[tiny frigate]

I even tried the British spelling, I just can't get my answer to be accepted

With and without dashes, with and without the word "cable"
Perhaps just a glitch in the module?

[remote latch]

underwater sea cable

try it

[tiny frigate]

Lol, not sure if you were serious, but I did, and no, not accepted

[remote latch]

i am

damn

[tiny frigate]

Glasfaserkabel xD

nope

[remote latch]

@tiny frigate what section

[tiny frigate]

Components of a Network

[remote latch]

nvm

found it

[tiny frigate]

I mean, the other day I couldn't get a password to be accepted for like 15 minutes until I realized that I misspelled the word "Administrator", so let me know if it's the module or me ^^

[remote latch]

foumd ot uet

out it yet*

[remote latch]

found it yet?

[tiny frigate]

nope

do I need to throw a wordlist at this module? xD

[rain fulcrum]

Anyone:
"ss" and "lsof" won't show result, "ps" did but username provided was wrong answer...

[remote latch]

so far

https://tenor.com/view/thomas-wtf-hey-call-shouts-gif-17534649

[remote latch]

^

[ancient niche]

I cannot find it the flag the IA. Already That's enough for today

good night

[tiny frigate]

should I be adding this to the erratum section, or will this likely be reviewed here? not sure what the process is

[dark hedge]

if you believe there is an issue with the question, make a post in #1234357888114364508

[tiny frigate]

ok thank you!

[burnt jay]

Hi , I have a question about "Active Directory Enumeration & Attacks -> Attacking Domain trusts - Cross-Forest Trust Abuse - from Windows".
It says to "Perform a cross-forest Kerberoast attack and obtain the TGS for the mssqlsvc user. Crack the ticket and submit the account's cleartext password as your answer. " I connect to RDP server and I use this command ".\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL /user:mssqlsvc /nowrap" and I get the hash for the "mssqlsvc" user but then I can not crack it by using john (I can not use Hashcat as it crashes).
Any help ?

[fathom pendant]

@west canopy 🤔 <3

https://academy.hackthebox.com/achievement/667914/289 good module @sick fulcrum and @west canopy a few quirks here and there with some stuff being case sensitive (or me being dumb); i'd say it's pretty decent Net+ level material without being overbearing

@tiny frigate with ftp anonymous; when it asks for name type in anonymous then password type literally anything and it should log you in

[tiny frigate]

yep that works! I was trying the netcat commands, maybe I misunderstood the assignment there or something. will play around some more 🙂

[fathom pendant]

there's an ftp command 😉

ftp <ip>

[tiny frigate]

yep! but that's too easy now! xD

[fathom pendant]

i mean it's the best way to connect to an ftp instance as it uses the correct protocol language

[tiny frigate]

ikr?

[fathom pendant]

like how curl for http/s;
smbclient for smb;
openssl for imaps/pop3s

(last one is if you don't wanna use an email client)

[dark hedge]

nice try

youre getting deleted

[fathom pendant]

https://tenor.com/view/you-just-got-absolutely-obliterated-barton-get-owned-destroyed-dominating-you-gif-20803863

[burnt jay]

what about me ? 😢

[fathom pendant]

if hashcat is crashing that's sad; but it sounds like you got a hash so not sure what else to tell you

[burnt jay]

Well you are right , but I can not complete the section's question ...

I am curious also if I have the right hash , because for the next section's questions john works normally and I can crack the other hash

[fathom pendant]

it's above t0 so it would be spoiling to post too much here, my DMs aren't open for general help

i would say run the command again and see if it gives something else

[burnt jay]

Yeah I know about this and thank you at first for responding (you are the only one <3). I am just at a dead end, that's all

[lusty thicket]

try the pwnbox

[tiny frigate]

Why does Hashcat crash? I had to tweak some settings in my VM to give it more RAM, where John just breezed through the cracking without issues. Seems like Hashcat is more resource intensive, without having looked into it much myself yet

[lusty thicket]

vms are not real machines

hashcat was made for bare metal

even with proper pass through vms just add layers of abstraction that slow things down

[tired olive]

working through information security fundamentals -- theres a good bit of super specific tool configuration in here (like configuring containers through multiple different services). would you guys recommend notating and going deep into each of these topics? or rather read to understand the concept and explore them when the need to use them arises

[lusty thicket]

no

when it's time to get into the configs of kubernetes or podman rootless mode

you google it like everyone else

[tired olive]

hm yea

[tiny frigate]

(has someone already kicked the person that just "sent me a guideline"? was about to ask where I should report)

[tired olive]

realized i had spent way way more time on linux fundamentals than i had realized

[burnt jay]

Thank you , I found the flag by getting the hash using the commands from my Linux terminal which for a reason gave me different hash value and I cracked it using john.
I tired earlier today to crack it again from PwnBox but again I couldn't.

[burnt jay]

I do not know to be honest. I am using hashcat from my machine not a VM. It was working normally buy one day it decided to take rest and "core dump". I tried to trouble shoot it but it didn't work.

[tiny frigate]

got it, might have to look into setting up a full device myself sometime, for more resources (:
Might pick y'alls' brain at some point about recommendations. Got an old laptop floating around, already cleared it from Windows and installed Mint at some point, might as well make this an HTB device ^^

[fathom pendant]

you basically get limited by your CPU

[lusty thicket]

for certain hash types

[fathom pendant]

i meant in VM

most (if not all) is done via CPU on VMs; and if you have a shit CPU, you're gonna be limited memory is mostly there to help manage the threading and processing but the CPU (or GPU) does the heavy lifting of actually doing the hashing

[lusty thicket]

vms are only cpu limited if you fail to set up gpu passthrough properly

and ram is also important, in the case of working with large hashlists

[fathom pendant]

yes

it's a combination of factors

[gaunt temple]

yo how are you guys? can someone plz help me with the SA for DACL Attacks II ? currently stuck on the first question, I got an attack path but it doesn't seem to work for some reason

[nova pivot]

Hey there guys! Just finished Footprinting-Medium, which was really nice, easing us out of the box just a tiny bit, but I have a question 👀
At one point in the box, a query is sent to the server, and you have to select...from a database. I accessed the GUI and saw the different databases on the server, one of them being "accounts". However, the query "select * from accounts" doesn't work, and we have to be a bit more precise.

1. Why doesn't it work with the "general" database accounts ?
2. How are we supposed to find the "detailed" path of the database ?
   I'm starting out SQLy wise, so that might be why, but I'm kind of perplexed 🤔

[safe star]

Was “accounts” a database or a table?

[nova pivot]

I'm pretty sure that it was a database!

[safe star]

I don’t think select * works on databases

Only tables

By checking the database🤷‍♂️

[nova pivot]

Like in the tree ? Because there was no "dbo" (...table ?) underneath "accounts" (...database ?)

Neither :/ at least I think so, I don't have it in front of me anymore

But I might have been wrong, I'll check again tomorrow! Thanks for the pointers!

[fathom pendant]

cough spoilers cough

[rugged bolt]

I had a question about using hashcat if yall don't mind. I've found a hash that is similar to 'admin:3372646:3457388...' When create the file to run HC against do I include the full hash string or remove the username 'admin' from the beginning.

[fathom pendant]

Full hash

Iirc you may need to include --username

But it's been a minute

[safe star]

i didnt even know about --username 😆

[fathom pendant]

Did you know you can output to a file? :)

[rugged bolt]

If I include full hash with 'admin' in beginning I get an error as if the hash format is wrong. I tried without admin in beginning , it begins to run but estimate time of recovery is 3 days

[safe star]

i would assume you can but i just never used it ngl

just checked the potfile if ever needed

[fathom pendant]

are you using the right mode?

[fathom pendant]

the time estimate isn't the actual time it would take

btw

only if it fully exhausts a list

[rugged bolt]

hmm I'm using -m 7300 which was listed in module, also tried 7400 but good idea ill peep further into modes

[fathom pendant]

that's the right mode

are you using the provided wordlist?

[safe star]

actually on that one i think the password wasnt in the resources lol

i know rockyou worked tho

[rugged bolt]

hmm yeah I don't think theres a provided wordlist for hashcat for this module/section. I checked resources and just the footprinting wordlist is there. Can probably use something in SecLists or rockyou though as mentioned.

I was using hashcat -m 7300 ipmi_hash.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u which is what was shown in this section

[echo ember]

hey all, I am currently enrolled in the CDSA course. Should I take the modules in order from top to bottom or is there a specific order that someone would recommend? (I have 4 years of IT experience)

[rugged bolt]

I haven't done CDSA but I think HTB teaches in a way that builds upon previous modules and sections, so I think it would be best to go in order from top down.

[echo ember]

ty.. just was curious.

[tiny frigate]

You may assume that I did not setup anything "properly" xD I'm happy I got it to work pretty smoothly (minus Hashcat, but so far John saved my hide in those handful of cases), had been using Pwnbox until recently, slowly working my way up (:

[rugged bolt]

Maybe check with peeps over in #cdsa they might have a better answer

[echo ember]

I posted the same question there too

ty for the quick response tho

[fathom pendant]

the paths are constructed in a way that the knowledge builds on each other (in most cases); for instance in the cpts path, the Common Services module is after footprinting because in order to identify a common service you need to learn to footprint/identify it

[tiny frigate]

(careful with the double posting though)

[echo ember]

noted. I have been a member of HTB for a while but this is my first time posting in the DC

ty for the feedback

[tiny frigate]

Oh no worries, I just recall that the moderators sometimes comment on that, I'm sure you're good 🙂
And welcome on the Discord

[fathom pendant]

the thing with double posting is it leads to cases where someone answers your question to your satisfaction in one channel, then someone in the other channel (not knowing it's been answered) answers you again

[pine dune]

Hi

I have a question regarding this file upload stuff. So I remember when I was asking Tlattice for help in Dms he told me not to use the slashes

The slashes request, but it gives a response of file uploaded successfully and i got this payload from payloadallthings on github, so if i did want to utilise these extensions in the real world (with the slashes) what would I need to do?

[fathom pendant]

\x00 is hex null byte

everything after will be ignored

[lusty thicket]

some functions interprete everything up to \x00

[pine dune]

thanks

[pine dune]

thanks

[fickle crystal]

i see why evil-winrm didn't allow me to get the shared folder its because it cant fully make a authentication tokens like we do in via rdp so it has limitations ,,,,

[safe star]

Yeah I think its just http requests

[fathom pendant]

yup

[unique ether]

Login brute forcing module brute force attacks page assessment issue running the script it just hangs

Anyone?

Script is taking too long

[honest crane]

Which section?

[unique ether]

Login brute forcing

Brute force attack page

[rustic sage]

why is this site so busted?

Tried all the flags also, --help, -h, ?, etc etc.

[unique ether]

There might be space before ftp

Remove it

[rustic sage]

ftp --? worked

wtf...

doesnt work in terminal but worked on the site, weird.

[honest crane]

Yeah, the script should work just fine, just change the parameters and let it run'

[ocean fog]

Hi everyone! I have the following question - I'm currently on vacation in Indonesia and I planned to start my Penetration Tester job path while I'm here for the next 2 weeks.

I went to the billed annually option and it was 490$ (incl. VAT). But when I select my home country (located in Europe) in the billing address dropdown the price changes to 588$ (incl. VAT).

If I sign up with Indonesia as my current location and pay only 490$ will there be an issue with my access once I'm back to my home country? Obviously I want to take advantage and pay the lower price, but don't want to mess things up because of the different locatons 🥲

Thank you in advance!

[minor zenith]

Hello
i am doing the fuzzing module

in vhost fuzzing filtering result even when i add to the /etc/hosts the ip with academy.htb and use -H 'Host: FUZZ.academy.htb'

[ocean fog]

not sure if this is a question for this channel or HTB: Off-topic channel. Apologies if I messed is up

[minor zenith]

it works but then when i filter -fs 986 i get no answers

[minor zenith]

idk one time i asked in cbbh i got redirected in #modules

[rustic sage]

Is this group for learning hacking ??

[acoustic owl]

VAT is calculated according to the country of origin. To determine the home country, things like your address, bank details, credit card, etc. can be used.

[lusty thicket]

idk

[candid maple]

Guys, I stuck on skill assessment of Broken Authentication. Password seems to be uncrackable, cookies also seems random . What do any hints

[digital pendant]

hey! ive just done this module, are you on this question?

if so, show your /etc/hosts & the command you're using. See if it differs from mine (could be why you're not getting the same results)

[quasi wave]

hi so I'm on the easy lab for the attacking common services module. there's only one question. I gotta log into the server and get the flag. I'm trying to crack my way into the server. I nmapped it in order to see that ports ftp, pop3, imap4, and smtp are open. I found an smtp username with smtp-user-enum. I am trying all of these different syntax with hydra and they aren't working:

   76  hydra -l 'fiona' -P pws.list -f 10.129.203.7 smtp -t 64
   77  hydra -l 'fiona' -P pws.list -f 10.129.44.4 smtp -t 64
   78  hydra -l 'fiona' -P pws.list -f 10.129.44.4 pop3 -t 64
   79  hydra -l [e-mail] -P pws.list -f 10.129.203.7 smtp -t 64
   80  hydra -l fiona -P pws.list -f 10.129.203.7 smtp -t 64
   81  hydra -l fiona -P pws.list -f ftp://10.129.203.7 -t 64
   82  hydra -l fiona -P pws.list -f 10.129.203.7 smtp -t 64 -D inlanefreight.htb
   83  hydra
   84  hydra -l fiona -P pws.list -f 10.129.203.7 smtp -t 64 server inlanefreight.htb
   85  hydra -l fiona -P pws.list -f 10.129.203.7 smtp -t 64 --server inlanefreight.htb
   86  hydra -l fiona -P pws.list -f 10.129.203.7 smtp -t 64 -h inlanefreight.htb

I got all that from my history but every time I try attacking smtp from kali it says it completed attacking the one target but no password found. I also attacked ftp and it still wouldn't work.

so all that's left is try imap4. I actually tried more iterations than just that portion of my history.

but I think that history snippet will give you an idea of what I have tried.

I tried ftp several times tho not listed above and it didn't work

[digital pendant]

be careful discussing modules above t0 @quasi wave I dont have the answers for you sorry not quite got here. But no spoilering anything above T0 (not saying you have, ive just made that mistake a few times)

[lusty thicket]

skill issue

[quasi wave]

ok so what am I doing wrong? that doesn't help since I thought I am doing CPTS to gain skills

and just saying skill issue isn't specific

are you saying to focus on FTP?

[quasi wave]

I get it I'm trying not to spoil but my answers are the wrong answers and I'm clearly doing something wrong with it

[quasi wave]

if you have constructive criticism I would love to hear it

wait hold on I had wrong IP some reason let me try IMAP again

I'm gonna keep trying I gotta get it

[digital pendant]

what mode is your smtp enum in?

[quasi wave]

smtp-enum found a user

[digital pendant]

gotcha, know where you are.

[quasi wave]

I'm not using that anymore because that's not the issue. the issue is getting the password for that user

I got the user yesterday

[lusty thicket]

use a different list

[quasi wave]

I'm trying an FTP attack again but with right IP this time

[digital pendant]

yeah hydra can be a pain.. needs specific settings before it can work smoothly. What command are you using ?

[quasi wave]

but I used the only list in the resources

[digital pendant]

(strip out any references/variables obv)

[quasi wave]

┌──(kali㉿kali)-[~/Desktop]
└─$ hydra -l fiona -P pws.list -f 10.129.44.4 ftp -t 64 

[digital pendant]

You know when you scan and fuzz a website, threads speeds up things - can sometimes cause issues... well Hydra is the same. Play around with that!

[quasi wave]

I did. well, -t 64 gives me maximum threads. are you saying that can cause an issue?

and if so does that mean I am doing the right thing focusing on ftp?

[lusty thicket]

it's not in there

[quasi wave]

then do I get a list from kali's default list? would rockyou work better?

[lusty thicket]

yeah

[quasi wave]

I gotta go to sleep

I'll try tomorrow good night everyone

[high citrus]

Hi guys i just started the CPTS course, im actually stuck in "gettins started" module in public exploit, using metasploit
I have to identify the services with nmap, done that i dont know what kind of exploit found by metasploit i should use, i found that smtp is running, tought it would be the vulnerability

[brisk ingot]

can anyone help me in Constrained Delegation from Linux (Kerberoasting Attacks)?

i get error when i run:
psexec.py -k -no-pass INLANEFREIGHT.LOCAL/administrator@DC01 -debug

[fathom tide]

1 select "INBOX"

• OK [CLOSED] Previous mailbox closed.
• FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
• OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft *)] Flags permitted.
• 0 EXISTS
• 0 RECENT
• OK [UIDVALIDITY 1636414280] UIDs valid
• OK [UIDNEXT 1] Predicted next UID
  1 OK [READ-WRITE] Select completed (0.001 + 0.000 secs).
  1 fetch 1 all
  1 BAD Error in IMAP command FETCH: Invalid messageset (0.001 + 0.000 secs).
  what am i doing wrong?

[candid maple]

What is the best module for 500 cubes?

[acoustic owl]

they are all really good

[waxen totem]

Depends whatever sort of knowledge you wanna gain

[waxen totem]

did you do a script scan? it's not snmp

[candid maple]

Did you get correctly, if I finish all exam related modules I will get 2 exam vouchers?

Or I have to pay 200 bucks anyway

[analog dock]

You need to buy the voucher

Unless you have silver annual

[fathom pendant]

#starting-point

[fathom pendant]

single -? btw

[rustic sage]

I already got it. Its a multi-answer question that should accept both -h and -?.

[fathom pendant]

nope

either way not related to htb academy

if you wanna suggest a change to it there's support chat

[high citrus]

I did a search exploit on SMTP, but honestly i dont understand the choice of the exploit, cause i get at least 10/20 different exploit

Idk if i explained myself, i mean that on metasploit, i did "search exploit smtp", i got 27 different exploit, and here i dont understand which one i should pick

[fathom pendant]

you're over thinking

i suggest visiting the given webpage

[ancient niche]

Good Afternoon guys, I'm stuck here with this module in IA. I don't know where is the file for upload this page of the browser.

Module AI sorry

[fathom pendant]

enumeration modules

[pseudo kiln]

hmmm, alrighty I will look into it

[fathom pendant]

naming scheme may give it away

[ancient niche]

really?

[pseudo kiln]

what ?

[fathom pendant]

they were responding to me

not you

[ancient niche]

ok sorry

[fathom pendant]

file
open
?

[ancient niche]

nope this say that i have to path the file and upload but i don't know where is

i'm reading the manual but i'm trying still find it

[fathom pendant]

it'll be wherever you saved the file

¯_(ツ)_/¯

[ancient niche]

but I haven't downloaded any xD

[candid maple]

I am stuck on skill assessment of sqlmap essentials. Found working payload and found final_flag table but there are only two columns id and conyeny and no flag . What to do any helps

[acoustic owl]

@solemn fractal Please do not spoil answers to module questions

Which module is this from?

[solemn fractal]

Oh I’m so sorry I didn’t mean to I will never do that again here is the question again, can someone please tell me what wordlist I should use for skills assessment part 2 in login brute forcing I tried 2023-200mostusedpassword but didn’t work out

[fathom pendant]

you need to complete the first assessment to be successful

the webpage from assessment one logging in gives you the parameters for crafting a wordlist for assessment 2

[solemn fractal]

I did complete the first one @fathom pendant

[fathom pendant]

so you logged in to the webpage for assessment one where it gives you a whole bunch of info

[acoustic owl]

Which payload did you use?
You can send it to me by DM.

[solemn fractal]

Yes but what’s the wordlist for the password to brute force the ssh @fathom pendant

[fathom pendant]

you craft one

:P the module teaches you how

[solemn fractal]

Thanks I able to get into ssh now what exactly do I need to create the username based off name like do I have to use Jane smith or who’s name for the ftp username I have the password I really appreciate you Mr. @fathom pendant you help me with the last one now what should I do with ftp username so I know how to generate username used username-anarchy but don’t know what the name of the person is can you pinpoint it

[fathom pendant]

i believe all the info should be apparent

i'm not walking you through everything

this is why i have a paid tutoring service

[solemn fractal]

Please for the last time just tell me what the name of the person should I use @fathom pendant

[ancient niche]

ey guys i have to this file in jupyter lab but gives error. I don't know why

[solemn fractal]

I got it on the report Mr. @fathom pendant no worries I still appreciate your help thanks now I got the information for the person I need

[gray yacht]

Enumerate

[acoustic owl]

Have you adapted the URL in the script to the target URL?

[ancient niche]

in theory is the vm machine of vpn but have error

look at this

[acoustic owl]

Read the error message
It cannot find the file you are trying to upload.

[ancient niche]

i know but i don't know why

[acoustic owl]

Does the file exist?

When I look at your directory tree on the left, there is no such file

[ancient niche]

already that there is not file but i don't know which one it is xD

[fathom pendant]

they changed the SAs from the last time I did this, so i had to redo it for my own sanity check.
Used to give you a user <bill gates> and a list of password complexity requirements

[ancient niche]

i know is that but i don't know where is 😦

[acoustic owl]

I have not yet solved the module. You probably have to create this file first.

[ancient niche]

yes but It is supposed to be in this module but I'm rereading but i cannot find it oh my good

[acoustic owl]

I really haven't solved the module, I can only make assumptions. Maybe you created this file in one of the previous lessons.

[ancient niche]

nope this is the first exercise anyway thanks

[sinful narwhal]

anyone plz help me in module Windows Privilege Escalation > Weak Permissions

on Replacing Service Binary

[ocean knoll]

Any hint for assessment attacking authentication mach ,I know it is jwk but I tried everything I learned nothing correct wz me

[atomic tide]

Has anyone complete Windows Privilege Escalation and can helps me with "Pillaging" cause amb so lost with it. Please DM or response

[sinful narwhal]

anyone plz

[narrow sky]

Hii, im having a problem in the reverse shell section in the Shells & Payloads module, im putting the right payload and cmd returns me some errors

[ancient niche]

ey guys someone can help me with this?

[heavy dome]

Hi, in module attack common service; in the last lab HARD last question: find flag in admin desktop; it’s all day i try to find the way… thx for hit

[tiny frigate]

I feel like I'm staring right at it, but I'm just not seeing it...

In the Metasploit module, section "Payloads" is a target that you're supposed to exploit Apache Druid on. All fine and dandy getting the exploit going with MS, but what I'm not quite seeing is, how I would know to even look for a vulnerable Apache Druid version? All nmap has give me so far is some mostly DoS susceptible Jetty version

I'd like to understand how I would have had to enumerate this target to get there.

[fathom pendant]

you'd likely run some additional enumeration beyond just nmap

nmap doesn't really do web enum stuff

[tiny frigate]

yeah, this module didn't specify how the enumeration part would've happened, but this is something I still want to learn to do better, so I'm curious how I should have done that ^^

[fathom pendant]

because this module is focusing on the using metasploit aspect

i wouldn't worry too much about it

[tiny frigate]

ok thanks 🙂

[fathom pendant]

likely visiting the ports using netcat and other ways to enumerate

[tiny frigate]

might poke around a bit more on this target just for the fun of it (:

[ancient niche]

someone has completed the module AI?

[sinful narwhal]

hello ??

[gray yacht]

On the Replacing Service Binary part of the section or the skills assessment?

[sinful narwhal]

yes, Replacing Service Binary part

[gray yacht]

Does the section say to follow along in the lab env? I don't recall.

[gray yacht]

I don't mind looking over what you are doing. You can DM.

[atomic tide]

Any idea with Grace questions?

[warm rover]

Hi,

currently I'm doing the shells & payload module and in the last part of it.

I've been stuck with the pivoting method (to access the internal networks through the compromised rdp from my device)

[earnest pasture]

Send me dm !

[gray yacht]

Did you get the answer to the first question? If so, review the section and enumerate that where you can.

[fathom pendant]

You don't really need to pivot

[warm rover]

Yeah, I think so. But while connecting with the RDP, seems very slow 🙂 that's why. though solved host3 related problems.

Now just trying to solve the host1 & 2. but that compromised rdp has no browser.

[fathom pendant]

Yes it does

firefox in terminal

[warm rover]

Ah I see, thanks! why not brain isn't braining... (cricket noise)

[heavy dome]

Attacking Common Services - HARD: last questions... any hit please

[earnest pasture]

send me dm !

[glossy cloak]

hi, started windows fundamentals and I have a problem:
PS [10.10.14.2] /home/htb-ac-1698620 > Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber
Get-WmiObject: The term 'Get-WmiObject' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

[safe star]

<@&861185840277487616>

[fathom pendant]

you're running powershell on the pwnbox, this is why

wmi isn't a linux thing

[glossy cloak]

yes, where to run powershell? my parrot os doesnt have PS

[coarse stone]

Need help with :**Attacking Common Applications Attacking Thick Client Applications **. Anyone who has completed penetration tester path help me with this please

[earnest pasture]

Send me dm!

[fathom pendant]

there should be a target to spawn and connect to to run the commands

windows fundamentals
that should be your clue that you should be on a windows machine

spawn instance != spawn target
instance == pwnbox
target == target machine to connect to

[tired olive]

anyone know what the module completion times are based on?

[earnest pasture]

I believe they are based on the time in which a person can complete the module.

[tired olive]

😭 😭

well yea

but what defines that time? was it people to tested the module? maybe just read time?

[earnest pasture]

But this is a statistic that will not always be the case depending on experience and how each person internalizes the concepts.

[tired olive]

bros day 1

[tired olive]

yea - was just wondering what it was based on

thanks haha

[fair slate]

Now im day 1680

[tired olive]

actually wild

feel like im talking to a ghost

[fathom pendant]

testers and averages assuming 0 complications

[tired olive]

ok thank you

[tired olive]

what do you guys do that gets you community contributor? do you make challenges?

[fathom pendant]

nope challenge and box creators have their own roles

I just yap and help a lot

[tired olive]

damn

this guys a volunteer W mans

[fathom pendant]

It's what pushed me to go private; too much for free

[tired olive]

do u got a website?

or is all ur stuff private

[tired olive]

ur talking about your course right

or the tutoring idk if u got a course

[fathom pendant]

mentorship yes

and tutoring

it's not a course

just private help with the pentester path

[icy cove]

You help a lot

[thick steppe]

Hey guys, I am doing the filter content section of linux module, and the question they have after the module completion is

How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

and they dont have any content related to port scanning in this section, we aren't even their yet so why ask this question since I have to google it and rather than giving me something related to filtering content which would make much more sense.

Am I doing it wrong or its just not making sense for everyone else as well.If the section is on filtering content then why ask port scanning at the end, thats just silly

[ornate smelt]

Hello
Does sharphound results differs from user to another

I other words
If I collected data using domain admin is it the same as any other domain joined user ??

When viewed in bloodhound ??

[fathom pendant]

They give you a list of commands in one of the sections one that's useful for listing network statistics

[thick steppe]

but aren't they supposed to give us questions related to modules we just completed. Its like you tell me a story and ask me a question about another story which is written in a book in public library

[fathom pendant]

Well you still need to filter the results of netstat

[thick steppe]

thats just complete nonsense, atleast tell me beforehand, at first I literally I thought I am the biggest noob in the world

[safe star]

That happened to me in the cdsa 😭

[fathom pendant]

and you were given a set of criteria to figure out

[fathom pendant]

The module gives a list of relevant commands in one of the sections

[safe star]

Asked me a question about something they introduced next section

[fathom pendant]

And a brief description of the command

Taking good notes you'd be able to refer and see what command may be useful

[thick steppe]

Yea I just saw it, its in the cheat sheet. Still annoying since I didnt wanted to cheat

[fathom pendant]

Part of learning in cybersecurity is getting comfortable reading and looking up the man pages

[thick steppe]

I am taking notes in obsidian

[fathom pendant]

Cheat sheet isn't cheating

But that's not what I'm referring to here

[thick steppe]

It isnt but its a shortcut

[fathom pendant]

Cheat sheet is just a summarized list of info

¯_(ツ)_/¯

[thick steppe]

I have taken shortcuts before and didn't learn everything eventually so I have decided not to cheat or take shortcuts in this thing

[fathom pendant]

https://academy.hackthebox.com/module/18/section/70 <--

This section gives a list of commands

[hollow shell]

has anyone done the introduction to digital forensics and can help me pls for a class, i've been stuck on a question for almost an hour

[fathom pendant]

It's in how you use the info, not that you used it

Note down what each of the switches do
netstat --help or man netstat if you wanna read some documentation

[thick steppe]

THANKS ALOT

I asked in CPTS and a guy told me to message here since its not a module of CPTS pathway but I am like its still a part of infosec pathway which is a prequsite to CPTS.

Well tbh I havent used discord, I am fairly new so no point in aruing something which I dont know about

[fathom pendant]

it's just because module questions go here

general questions and discussion about cpts go in CPTS

(same for the other certs)

[thick steppe]

what if its a module in cpts, still here?

[fathom pendant]

still here

it's still a module

[thick steppe]

ohhhhh I seee

[fathom pendant]

and there's the discord search feature as well

which makes potentially finding the answer 10x easier than reasking the same thing

[thick steppe]

I have no Idea, let me check

[glossy cloak]

yes, I have a target, and user and pass, but when I try to connect with xfreerdp, I get error, doing nmap works, but ping doesnt

[fathom pendant]

Are you running pwnbox and vpn at the same time?

If so: that's where your error is [user error]

[glossy cloak]

no, pwnbox is terminated

[fathom pendant]

Are you sure you're connected to the vpn, and only have one vpn connection running?

sudo killall openvpn then restart the vpn process

[gaunt forge]

I've been stuck on the skills assement 2 for active directory enumeration for two days now, could anyone help me?

I can't figure out how to get past question #7, where I need to gain access to the admin desktop on MS01

i used mimikatz to get the hash of the admin user on sql01, but it just gives me the local admin user so I can't really do anything with that

[honest zodiac]

Has anyone solved OnlyHacks?

[tawny widget]

Hi! Any hint for Log Injection from HTTP Attacks module? I can't find a way to bypass the character sanitization

[earnest pasture]

Have you tried analyzing network traffic?

[gaunt forge]

yeah, thats how i got my foothold

I have an admin shell on SQL01

[safe star]

https://tenor.com/view/are-you-sure-about-that-the-rock-you-sure-gif-24604462

[gaunt forge]

yes will send ss soon

[safe star]

Password reuse exist

[gaunt forge]

yeah so this should work, right? maybe i should try with another username?

[safe star]

I don’t think that’s the hash

[gaunt forge]

but it works for admin account on sql01?

[safe star]

Was it changed?

[gaunt forge]

I don't think so, i got in with msfconsole and used getsystem to escelate privs

[earnest pasture]

try running lsa again in sql01, if you have already done so, you should see what data you get

[gaunt forge]

just did lol

should i restart the lab? is this wrong?

[earnest pasture]

try sekurlsa::logonpasswords

[gaunt forge]

i dont even get the administrator user when i do that

[safe star]

Is Same with sam?

[gaunt forge]

wdym?

[safe star]

Sam command

Might have to restart cause that should’ve worked ngl

[gaunt forge]

sorry idk what the sam command is in mimikatz but its the same hash when i do hashdump in meterpreter

ok restarting lab thanks

[gaunt forge]

whats the sam command though?

oh im so dumb its lsadump::sam

got the exact same hash again

restarting lab didn't work

[glossy cloak]

I am positive, even the vpn I want to be open is not LOL

[fathom pendant]

Now start it up again and pray lol

@gaunt forge please stop posting images with hashes. Those are spoilers

[gaunt forge]

the hash is wrong lol

[fathom pendant]

Even still; spoilers with what you've done

I suggest taking to dms if someone wants to help

[glossy cloak]

the prayers doesnt help lol
it gets stuck here

[glossy cloak]

it says "Initialization Sequence Completed"

[fathom pendant]

Thats exepected

[gaunt forge]

alright, could you help?

[fathom pendant]

No

[fathom pendant]

Open a new terminal ans should be good to go

[earnest pasture]

Try scaling priv manually in the sql and run mimikatz manually

[gaunt forge]

ok will do thanks

ill just try with the method getsystem used that should work

[glossy cloak]

yees! how I forgot that!!??
ok, connected trough xfreerdp
ping still doesnt work
Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber DOESNT WORK ;/

[safe star]

Alr dm

[glossy cloak]

ok, maybe it doesnt work with all those errors lol

[fathom pendant]

those errors look like nothing

though it looks like an interrupt signal was sent somewhere

xfreerdp /v: /u: /p: /drive:./,IT /dynamic-resolution /cert-ignore +clipboard my boilerplate xfreerdp command

[glossy cloak]

ok, dont do facepalm again lol
copy/paste xfreerdp /v: /u: /p: /drive:./,IT /dynamic-resolution /cert-ignore and add credantials?

[glossy cloak]

boilerplate? this is the first time I see this word LOL

[fathom pendant]

credentials and target

boilerplate/baseline

as a note with the /drive: option it mounts a share under \\tsclient\sharename

i got myself in the habit of using inconspicuous names as the sharename to at least pretend to be stealthy (before blasting mimikatz and sharphound)

iirc tsclient stands for terminal services client that's actually the underlying exe behind rdp, mstsc

[fathom pendant]

i spy with my little eyes a windows rdp session in the back there

and in your tray 😉

[glossy cloak]

hawkeyed 😉

[fathom pendant]

also pinging a windows machine isn't 100% reliable as typically ICMP Echo Requests (ping) are set to be ignored by default on firewalls on them

[glossy cloak]

is there something I need to do with that window? i just want to get this command to wooork

Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber

[fathom pendant]

brother

my brother in christ

go to the rdp session and open powershell

[glossy cloak]

OMFG I didnt see that little icon on tray!!!

my brother in christ, You have a beer on me!

g2g now! thank you!

[astral meteor]

hello

[rustic sage]

Hi

[tired olive]

windows fundamentls / windows security

in the pattern description in the code block, it says sa1, sa2, etc

will sa2 always be that 3 block string (674899381-4069889467-2080702030), followed by sa3 being the relative id?

i interpreted it as sa2, sa3, sa4, then sa5 being the relative id

since everything was already split up by -

[fathom pendant]

yes

[tired olive]

so there is no (etc), its just sa3

[fathom pendant]

well etc is anything beyond

[lusty thicket]

if the code is split up by - then sa2 is getting chopped to multiple pieces

that means sa2 isnt a single entity

[fathom pendant]

it's not getting "chopped up" necessarily

[tired olive]

what could follow?

[lusty thicket]

it's just part of a longer set of numbers

sa3 and sa4 are just natural results of that split

[fathom pendant]

sa2 just identifies to which device something belongs

everything that follows is more direct information about what's being identified

[lusty thicket]

then it's a single entity

[fathom pendant]

yep

it relates to the device (or domain) that created the entity

that way any searches will say "hey this entity is part of x.local, let's search their SID db for info"

[lusty thicket]

thats why the 3 block chunk remains constantfor all sids created on the same system or domain

[fathom pendant]

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers

[tired olive]

is there an actual name for sa2

[lusty thicket]

yeah

[tired olive]

domain identifier!

[tired olive]

thanks 🫶

[lusty thicket]

nt authority in stand alone systems

[fathom pendant]

*System

[lusty thicket]

that's vague

[fathom pendant]

not really

System is the highest level of authority you can have on a (local) windows machine

nt authority\System

nt authority is just the delegator

[lusty thicket]

that has absolutely nothing to do with sa2

[fathom pendant]

¯_(ツ)_/¯

just saying it all depends

[sly sorrel]

Someone can help me with task?

[tired olive]

battle of gods

[lusty thicket]

yeah, i also just realized sa2 is not really a formally named field

[fathom pendant]

what module and section?

if it's not related to htb academy read and follow #welcome to access more of the server

[sly sorrel]

Penetration Tester / Footpriting

[fathom pendant]

Footprinting is the module name

Penetration Tester is the path name

[sly sorrel]

Oracle TNS

[fathom pendant]

and what exactly is your issue

if it's an issue with installing; i suggest going through the install script line by line instead

[sly sorrel]

Can i dm you?

[fathom pendant]

~no~

my dms are currently only open for #modules message <--

[tired olive]

would someone mind pointing me to the starting point in this diagram?

User Account Control flow char

cant tell where its starting from

[waxen totem]

left most blue box

user performs operation requiring privilege

[tired olive]

ah perfect thank you

dont know how i missed that one there

[mild plover]

Hi everyone! I'm new here, and new to this world of hacking. I am on HTB Academy module "Getting Started." I'm trying to do the walkthrough of the Nibbles box, but already at the nmap scan it appears the box may be down. I understand that it's retired. Am I not actually able to do the box? Any advice would be great. 😊

[safe star]

Are you connected to the vpn?

[mild plover]

Using the pwnbox in the module

[safe star]

What about with -Pn?

[waxen totem]

Did you spawn the target?

👀

[mild plover]

So first, because it was a retired box, I didn't realize at first that I needed to spawn anything. Was using the IP in the screenshot. 🤦🏻 But now that I've scrolled to the bottom of the page and clicked "spawn target" it's just spinning and not spawning.

I'm a noob 🤦🏻

After exiting the page and going back it's still spinning though.

[normal sand]

It takes a minute (not literally, maybe sometimes 💀 ) to boot up.

[mild plover]

Fair enough. It's been a few though lol

[normal sand]

There's a couple things you could try in that case. Try Ctrl + Shift + R. Try clearing your cache.

[mild plover]

Well, it's just not doing it tonight. I've done everything else in this module. I'll move on to a different one and come back to this later. Thanks everyone.

[waxen totem]

Literally recently done that module and it does take forever to spawn

I didn't have to... cos I already do labs anyway but if I were you I'd read all through the nibbles part and just do it all at once after getting it to spawn

Also the gettingstarted box at the end of that module is pretty fun

nice and easy but was a little annoying to exploit cos I was tryna be fast and fucked up the shells a lot

@mild plover https://0xw1ld.github.io/htb/2025/02/14/Nibbles.html

yet another writeup, just in case you wanted to see my perspective on it

[mild plover]

Sweet! Thanks. Always looking for more information and perspectives.

[flint moth]

Look for other areas where you can.

[ember ibex]

can someone please explain explain to me how to set up this question from linux fundamentals, filter contents section: Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths (https://www.inlanefreight.com/directory" or "/another/directory") of that domain. Submit the number of these paths as the answer.

i googled it, got the correct answer but imcurious as to how they got the answer. if that makes sense what im asking. I wanna know how to not just keep going to Phd Google hahahah

[waxen totem]

#modules message

Read the RegEx one, might shed some light onto it

also RegEx is the next section, go figure

[ember ibex]

willdo! thank you. i feel like i have came across some questions like this where they ask you something that hasnt been really talked about yet hahahah

[calm abyss]

Hello guys i got a problem with Attacking WPA/WPA2 Wi-Fi Networks
Module Reconnaissance and Bruteforce

Perform the WPS brute-force attack as demonstrated in this section. What is the discovered value of the WPA PSK?

So i followed the module and executed reaver but i get the following message

sudo reaver -i mon0 -c 1 -b D8:D6:3D:EB:29:D5

Reaver v1.6.5 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner [e-mail]

[+] Waiting for beacon from D8:D6:3D:EB:29:D5
[+] Received beacon from D8:D6:3D:EB:29:D5
[!] Found packet with bad FCS, skipping...
[!] WARNING: Failed to associate with D8:D6:3D:EB:29:D5 (ESSID: HackTheWireless)

I did everything correct, We will use Reaver to brute-force the WPS PIN. However, due to a known bug, setting the interface to monitor mode using airmon-ng can cause Reaver to malfunction. To avoid this, we'll first stop the interface in monitor mode with airmon-ng. Then, we'll use the iw command to add a new interface named mon0 and set its type to monitor mode.

[red cliff]

anyone getting username or email already exist on onlyhacks

[red cliff]

worked

[nova knot]

pentest job path/ service enum, i'm unable to get the password for smb share bob

[safe star]

Don’t they give it to you in the section?

[calm abyss]

I managed to slove the problem using ChatGPT, for anybody who will have this problem in the future do this steps:

sudo nano /etc/NetworkManager/conf.d/default-wifi-powersave-on.conf

change wifi.poversave to 2

[connection]
wifi.powersave = 2

sudo reaver -i mon0 -b D8:D6:3D:EB:29:D5 -vv -d 5

Worked for me.
Power management On can cause problems with Reaver so you just turn it off on all of the adapters.

[ornate fable]

Hey guys! I'm working on the Network Enumeration with Nmap module and Firewall and IDS/IPS Evasion section. There's an example on Scan by Using Different Source IP, and I don't understand how we received a response from the target when the Source IP was changed. Shouldn't the target send its response to the specified source IP instead? If that’s the case, why does the example show a scan result?
I might be missing something, so I’d really appreciate any help!

The scan is:

sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0

[bright ridge]

nmap forges packets to make it look like they originate from the specified source ip (-S)

so the fake source ip is routed back to you

also If you and 10.129.2.28 are on the same network, there’s a chance the network sees 10.129.2.200 as being tied to your MAC address. That would mean responses still get sent back to you, even though you’re using a spoofed IP

[ornate fable]

If I use a spoofed IP, the target can't send the response directly to me. So either I am sniffing traffic to the source IP and intercepting the response, or these two IPs are associated with my MAC address, right?

[nova knot]

no

they gave the hint bob have a weak password

i tried brute forcing usinf default pass for services.txt

no use

[bright ridge]

you’re not “intercepting” traffic in the sense of directly receiving it. Instead, you’re capturing the traffic on the wire that is destined for the spoofed IP

[ornate fable]

Got you, thanks

[fathom pendant]

what module and section, "pentest job path" isn't a module name

getting started - service enumeration?
^ if it's that one then yes the reading provides you with bob's password in the format user:pass

[nova knot]

hmm lemme share it to ya

List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file.

[fathom pendant]

that's the question...

ctrl-f is your friend

[nova knot]

hmm i thought above case is just an example

so it's the simillar password

[vocal beacon]

What’s everyone’s thought process for escaping a docker container when you have a shell inside one? Usually creds hunting or finding something you can pivot off of?

[fathom pendant]

this is a basics module, they're not expecting you to bruteforce

[nova knot]

got that thanks....... I was banging my head

i'm new to parrot so, i'm even clueless with the wordlists

[fathom pendant]

nothing to do with being "new to parrot"

it's literally just there in the text; the text doesn't talk about bruetforcing so you shouldn't have to

[nova knot]

any idea how to 94.237.55.157:40909 scan this one
for webapp enum

[acoustic owl]

What exactly do you want to scan? You only have one port available. So a port scan is not necessary. But otherwise it's exactly the same

[woeful lake]

Finally Ad module for cpts path, the first skill assessments i could handle, buy the second i have to review to understand things that i half-get in the past, but i learn a lot though

[nova knot]

Try running some of the web enumeration techniques you learned in this section on the server above, and use the info you get to get the flag.

the section is Getting started/Web Enumeration

[bright coral]

What about you try the techniques from that section?

[acoustic owl]

for example:
instead of curl http://10.10.10.10 you now just do curl http://yourip:yourport

[nova knot]

yea, i was using "htpps" instead of http, no wonder i'm getting the conection errors

[vital moat]

Hey guuys anyone to help on Windows Lateral Movement skills assesment . I am having trouble with question 2. I got the creds and successfully RDP to the target by there is no flag in the desktop. I also tried to use those creds to get access to wsus on different services, tried a bunch of no default ports as well

[acoustic owl]

look on the bright side. This kind of mistake will never happen to you again, or you will realize it very quickly.

[nova knot]

yeap thanks!!

[ancient niche]

Good Afternoon guys someone has completed the module of AI?

[dry falcon]

https://media.discordapp.net/attachments/1306917019303677957/1340660113702260766/image.png?ex=67b32a87&is=67b1d907&hm=7fd84d36e745b3f62bcf7d2a8402c70d88ccdd3c5c9329679d11dfd47738e276&=&format=webp&quality=lossless

https://media.discordapp.net/attachments/1306917019303677957/1340661280331268158/image.png?ex=67b32b9d&is=67b1da1d&hm=a05bcd241a9dedfd2357e48169511b81d055c8593075d60483378dec83f258da&=&format=webp&quality=lossless

why ls not working .

[old echo]

Ironically, even after restarting the lab target systems twice, I'm in a situation where http://172.16.5.135:80 is inaccessible.

With NMap scans, via Proxychains, it shows up as "filtered" and even from the lab systems themselves (with curl from the pivot box, or with iwr from the RDP system), the target does not respond as expected.

I'm about to terminate and restart the targets a third time and then I'll give'm at least five minutes, before trying anything.

[old echo]

The error message is pretty clear: the user in question does not have read access to the share you accessed.

Your smbmap command confirms this.

[dry falcon]

so how to get the flag ? they say in smb their is flag 😭

[fathom pendant]

that's not John's flag

https://tenor.com/view/yoda-there-is-another-star-wars-jedi-gif-5140031

each service on that section has a different user

[ancient niche]

ey guys i'm find stuck here

[old echo]

Yup, there seems to be something really wrong with the RPivot lab right now. On my third lab restart, the target remains inaccessible.

The pivot box itself should be capable of targeting the 172.16.5.135 box, but:

ubuntu@WEB01:~$ curl http://172.16.5.135
curl: (7) Failed to connect to 172.16.5.135 port 80: No route to host

I hate that I had to open the spoilers to grab the flag from there. But no, the target simply refuses to become available.

[fickle crystal]

And that’s not ur fault

[old echo]

What are you stuck on? The syntax you're showing here is incorrect Python. You can't just plonk down a URL in the middle of a script.

[slender pendant]

(footprinting - IPMI question 2) found this hash and im trying to crack with hashcat its not working, i tried with rockyou and still nothing found anyone has an idea?

[ancient niche]

why?

[old echo]

What do you mean, "why?"

Any programming language, including Python, has rules for how to write. Our own spoken languages have rules too: grammar, spelling, syntax.

What you did on line 5 in that script is similar to me looking at you and saying "Hamburger amazon"... it means nothing, the context is wrong.

If you want to define a variable with that URI as its value, you need to use the right Python syntax for it.

If you want to do something else with the URI, again, use the right syntax for what you want to do.

[old echo]

I couldn't tell if you were sarcastic or friendly. So I'll take it as the latter and say "thanks" 🙂

[ancient niche]

and how i use if haven't not knowledges in python xDDD

[old echo]

That's the whole point of these trainings, no? Learn and research. Many training companies who teach pentesting also want you to (self)-learn how to read and adjust existing scripts, in many languages.

Which module in which path are you working on?

As a spoiler, I think you want this:
||url = "http://10.10.15.11:8000/api/upload" ||

[fickle crystal]

If hashcat dosent work use another tool

[acoustic owl]

Maybe study this module first
https://academy.hackthebox.com/module/details/88

[old echo]

There we go 😄 I knew it...

[ancient niche]

AI xd

[ancient niche]

thanks

[old echo]

Now that a mod is here, my post above about RPivot might be a bug report worthy

[ancient niche]

don't worry 😛

[acoustic owl]

Which module is this?
When I have worked through the module, I can look in my notes to see how I solved it.

[rustic sage]

Did you ensure you are on the right VPN?
I ran up a similar error, and surprisingly it was just a VPN issue on their end

Try alternative VPN

[old echo]

It's this one -> https://academy.hackthebox.com/module/158/section/1434

The whole lab works as expected, but that one IP remains uncooperative.

[old echo]

Huh... that'd be interesting. I've been using the same VPN connection (EU Aca 6) for at least two weeks now. Why would that differ? ... let me go see.

EDIT:
I downloaded the VPN definition and md5'd the new one vs the one I was using... it's the exact same file. So, you're suggesting using something else than EU 6?

[rustic sage]

Yes.

Give it a shot

[old echo]

I will, once I've finished this next lab... I'm assuming that there are unique target labs for every VPN connection? Or do they use the same pool of VMs, regardless of VPN ingress?

[rustic sage]

I had a target spawned, and changed VPNs and connected to the same lab, soo I think it might be the same pool

[acoustic owl]

Also try switching between UDP and TCP. Proxychains uses TCP. Try it with a TCP VPN

[rustic sage]

Upvote, try TCP

[old echo]

I wasn't using proxychains and the problem is not my proxy or the port forward. The problem is that the actual target itself isn't up and responding. You would expect that you can curl port 80 on the target from the pivot host (as a ways of testing if the host is up) and I cannot.

The pivot host itself is perfectly reachable and both proxychains, sshuttle and a port foward all work fine. It's that the actual "deep" webserver that has the flag in the title bar is not available. The pivot host itself cannot reach it (which of course is required, if you want to pivot on the... you know... pivot host 😉 ).

[acoustic owl]

Once you have established a connection with rpivot, you will need proxychains to reach the website.

[old echo]

I realize that. And so far, to make sure the lab is up and working, I also login to the pivot host itself, to see if that can reach the final destination.

Up until now it could not. Now on my fourth restart of the lab, the final target does respond.

The problem was not my proxchain or the forward, it's that the pivot itself could not reach the final destination. It was like asking my son to ask their mom to pass the salt, but mom wasn't there.

[rustic sage]

I have been able to successfully pivot and ping the target internal network.
Not sure if its a target issue

[old echo]

That worked fine for me too. The problem is that I cannot reach 172.16.5.135:80 from the pivot host, as per the lab instructions. It's unresponsive.

[rustic sage]

Hi, I just got the flag. Its working as expected for me

[old echo]

And for me, now, it is too... after the fourth restart... before that, the actual target was unresponsive... 🤷‍♀️ Moving in 🙂

Thanks for verifying / helping me test.

[rustic sage]

All good! Glad it worked

[wide wagon]

just to be sure module Shells & Payloads -> Skill assesment. The "attacking host" has no browser I can use? I pwned the first maschine with ligolo tunnelling, not sure if this is intended as pivot and tunnneling was not known before

[ancient niche]

I'm mega stuck with AI xD

[harsh swan]

Looking for someone who managed to pass the Module: API Attacks / Section: Broken Authentication, I'm stuck on it... I managed to get the password changed and logged using the new credentials, then I tried to retrieve the information that is needed to get the flag and I got "Unauthorized" as response... thanks in advace for any enlightment.

[stone shoal]

Hi any hacker here ?

[analog dock]

Nope

[stone shoal]

Why

[near rock]

What do you mean by ‘any hacker here’?

[analog dock]

Because

[ancient niche]

xD

[fathom pendant]

sometimes changing vpn region pushes it along

[fathom pendant]

ligolo allows you to add routes from within the app btw

(granted you start it with sudo)

[candid juniper]

Hey, I was going through the Pentesting Basics > Service Scanning section of the Getting Started module and tried to do the exercises from memory. When running the commands from a VM through VPN I was lacking the crucial output to answer the questions, while running the same command from the built-in instance provided it easily.
Is there anything I'm possibly overlooking that reduces given output when running from a VM+VPN setup compared to the built-in instance?

[fathom pendant]

try doing a banner grab

[foggy monolith]

Question for HTB staff: Is there a certification planned for the AI Red Teamer role path?

[fathom pendant]

if it's a job role path then yes there will be a cert

they partnered with Google

so it would be weird to have it be a job role path and not just a regular path

[foggy monolith]

Was asking because even though it is a job role path there's only 3 modules in it.

[fathom pendant]

the path itself, however, isn't completed yet

i'm sure some agreements they made with Google forced their hand to have the path drop without actually completing it

[candid juniper]

Consistently returns "No route to host", not an expert in networking or the usage of VPNs in Linux. Does the following line in OVPN influence this?

net_route_v4_add: 10.129.0.0/16 via 10.10.14.1 dev [NULL] table 0 metric -1

[fathom pendant]

yes

it adds a route to the lab network [10.129.0.0/16] via the router [10.10.14.1] which is the vpn router

however dev [NULL] is interesting

i suggest restarting your vpn connection

[old echo]

yeah someone else suggested that too... it's a very odd thing though... why would my VPN ingress make a change to a backend system in a lab?

[candid juniper]

It keeps returning that same line, so I'll try to redownload the config file. Otherwise I think it's on my end.

[fathom pendant]

labs are dumb sometimes; and the labs are spawned on the region you select

[fathom pendant]

ip route

[sinful narwhal]

pls help me anyone on module: Windows Privilege Escalation > Kernel Exploits

getting error on Meterpreter : [-] Send timed out. Timeout currently 15 seconds, you can configure this with sessions --interact <id> --timeout <value>

[candid juniper]

It does define the tun0 device there.

10.10.10.0/23 via 10.10.14.1 dev tun0
10.10.14.0/23 dev tun0 proto kernel scope link src 10.10.15.34
10.129.0.0/16 via 10.10.14.1 dev tun0
AFAIK there is nothing wrong with this no?

[fathom pendant]

nothing wrong

is your vpn the same region as the target? head academy-regular.ovpn

[ancient niche]

guys if someone has completed the module AI, what say me pls

[candid juniper]

How to check the region of the target? (Sorry if this is a not thought-through question)

[fathom pendant]

that's the region in the box that you'd select to download your vpn from

also: when you change regions make sure to
terminate --> spawn

to ensure it spawns in the correct region