modules

[vagrant wraith]

depeneds on ur goals

[south moth]

Tnx

[torpid spruce]

I'm brand new and want to learn as quick as possible. I'm seeking a career change into cyber security.

[shut delta]

depending on what u wonna do it takes 1000s of hours its alot too learn cant really speedrun it

[vagrant wraith]

brah i finally got the flag i thought sum was wrong with the lab lmaoo

[unborn summit]

You don't need to add it to /etc/hosts for vhost fuzzing, if you specify the IP and port. I'm assuming they tell you to add it to /etc/hosts so you can visit the page after you have discovered it.

[shut delta]

Can anyone help here iv got a shell on the machine and keep looking trough logs but cant find the pass🐣

like iv dun the 3 sections after it

[echo pecan]

module

[torpid spruce]

Thanks!

[frank bloom]

Hello, I am a beginner. Can restrictions be removed from ChatGPT?

[terse bloom]

Hello people, File Upload Module --> Whitelist filters. I have managed to bypass the whitelist and blacklist filters and upload php files (various via burp intruder), but I cannot access them! I get 404, even though I should get at least something

[brave field]

How are you trying to access that uploaded php file?

[terse bloom]

Via /profile_images/shell.inc (.phar, .phps, etc)

It returns 404 for all the bypasses that had "File successfully uploaded" message. /profile_images/ comes from HTML code inspection, it has to be the same for most exercises in the module...

[brave field]

did you try the reverse double extension technique?

[terse bloom]

Yes, I am using a wordlist with different double php + image extensions, reverse and not reverse. This is already bypassed. The file is getting uploaded, I do not understand why I cannot access it in that dir

[brave field]

Maybe the server is rejecting code execution. Not all extensions will work with all web server configurations, so we may need to try several extensions to get one that successfully executes PHP code.

[terse bloom]

There is a list of 570 different double extension payloads that are processed by burp... But it's really slow. I really need to use ffuf for this to check

[gentle jolt]

Hello

How to learn hacking I'm new

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[terse bloom]

UPD: Works. With the last payloads from the list. For the love of god, please have mercy and put it at 30 or 40, i dont have that much time tbh...

[keen crescent]

oops. wrong chat!

[rain mirage]

attackig common services - hard

Once logged in, what other user can we compromise to gain admin privileges?

i have tryed lot of stuff but can figure what to do here ... i just need a single short hint ..

[swift flame]

Hey, I go through CJCA learning path and in Linux part - "Backup and Restore" there is excercise to practice rsync, and do backup to local pwn machine. What is the password for local user to ssh to 127.0.0.1?

[little terrace]

im redoing password attacks: Pass the Hash

whenever i rdp (remmina) using pth, i can only do it once, if i exit out and try again it tells me that the username\password is wrong

how do i rdp in again if thats the case

[hidden ledge]

Maybe try another RDP client

[rain pecan]

Yi

Yo guys

[acoustic owl]

Hi

Please read #welcome and #rules to gain access to #general. The Discord breach has nothing to do with the Academy's modules.

[rain pecan]

No what I mean is pls check your discords

Bc sm might be hacked

And ty but I've been in this server for almost an year

I'm usually off but I will try to be more active

[rain pecan]

Btw I did what u said and I still don't have access I did that like 6months ago

[acoustic owl]

To gain access to #general, you must verify your user account. Read and follow #welcome

[rain pecan]

Ok

Ama do it again

And see if it works

[rustic sage]

It may be out of topic, but do you recommend me finishing the ctps and then sec+ or the other way around?

[wide dove]

Where can I post jobs?

[frank trench]

Security+ is a beginner-level cert aimed at security fundamentals. CPTS is a lot more technical, hands-on, and pertinent to pentesting, akin to the OSCP.
So consider sec+ first, then move on to CPTS (although you'll probably still need more studying before tackling the latter)

[pine arrow]

Hey

[rustic sage]

Alright thanks man I appreciate it

[brave field]

user impersonation

[storm elk]

Don’t cross post @stoic heart - posted in all wrong channels - #1024429874246590575 might be better. But we’re not your homework helpers

[wild sage]

bump

Still need help

[stoic heart]

I don’t have permission to post in other channels

[storm elk]

Saw your post now in #1024429874246590575 - one place is more than enough

Also - if you want access to more channels, all the instructions you need are in #welcome

[tender nimbus]

Hey guys, I tried to figure out what the problem is and tried to fix it but I can't any idea? On my laptob it is not working I have what you can see on the screen, but on my pc home when I do a multi handler of this (like in the module) everything is good (module tunneling and pivoting section meterpreter)

[jovial robin]

OSINT: Corporate Recon | Section staff

that seems like it should be the number but it doesnt work ? ( also not working with +1 )

[rain mirage]

i cant hit finish , even though i have submitted the flag , what do i do ?

[tender nimbus]

You probably didn’t end all sections of the module

[rain mirage]

I did ... ..

[rain mirage]

The last 2nd one I have submitted the flag and it has also accepted it but... Won't let me go further

[tender nimbus]

Maybe you forgot a question to complète?

Or try a refresh of the page

[rain mirage]

Naa.. only had 1 question to submit the flag ..

[rain mirage]

Done several times

[tender nimbus]

Hmm weird maybe just an issue i guess can’t help you further ^^

[rain mirage]

Dude...

[calm abyss]

you still stuck there ?

you still stuck there ?

[pale island]

i keep getting stuck at the filter contents for linux where i need to: How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

[fathom pendant]

looks like the medium skill lab you're missing something

[fathom pendant]

ss -a is still grabbing interfaces that you may not want it to; break the question down

[rain mirage]

It won't let me even update the flag ...

It's just stuck

[fathom pendant]

did you click 'complete & next' on that page?

[rain mirage]

Ya I did ..

[fathom pendant]

otherwise reach out to support on the website

[fathom pendant]

looks like it's telling you what it wants you to do load stdapi; for whatever reason it's not loading here

[tender nimbus]

Already tried but nothing happens

[fathom pendant]

if it's not the pwnbox then there's gonna be very little help aside from advising you to reinstall meterpreter/msfconsole ¯_(ツ)_/¯

if it is in the pwnbox -> reach out to website support

[turbid kindle]

Hi all, can someone give a hint on how to solve the last challenge of the "Intruduction to NoSQL Injection" academy module? I already tried all payloads seen during the course.
I'm guessing it is Server Side JavaScript Injection but

1. I can't see any javascript on the pages
2. I can't find an oracle
   I also tried fuzzing the three requests (/login, forgot and reset) with the two wordlists mentioned in the course without any result, I'm pretty stuck 🙄 if someone could help with a slight hint that would be great 🥹

[agile spindle]

where is this thing in academy 2.0 ? 😄 do I need to open my eyes or its missing

[mint rover]

I'm guessing it's not available yet cause of beta.

[wooden fiber]

Hello, I think there is a bug on the Skills Assessment - SQL Injection Fundamentals. I managed to login to the app, and found out the supposed vuln parameter within the chat. However, it always returns 200 ok, and the chat dissapears entirerly no matter what, unless the param is just a text without any sql. At this point, I took a look through solution as I was stuck, follow the exact steps, which already did before, and have the same persistent issue. Any thoughts?

[wooden fiber]

I have restarted the target machine, and it works now as intended

[fathom pendant]

not every module has a resources button

[cold sorrel]

Hi all im new here, I have been with HTB before but decided to make a new account

[brisk flume]

Hi guys I'm stuck on SQL Injection Fundamentals: Skills Assessment - SQL Injection Fundamentals
I'm been stuck on the first question "What is the password hash for the user 'admin'? ", and I've tried all the different type of auth bypass injection for the login page, but they give me errors. The module says I need to use Burpsuite but Idk how I'm supposed to use it for this section.

[river crystal]

Hi guys, im new to ctf. May i ask how long roughly it's covered?

[rustic sage]

Can I finish ctps just with the pentester job role path?

[jade orbit]

Sorry if this isn’t the right spot. Are there groups that tackle Bug Bounties? These critical bugs have good payouts that could be divided across a team of hunters

[echo pecan]

This module is a tier 0 "free" module. What is the total cubes that will be rewarded back to you by completing it?

help me

[cloud urchin]

It costs 10 cubes and you get 10 cubes back I believe

[echo pecan]

Incorrect answer!

Error Incorrect answer! It appeared like that

[acoustic owl]

This answer is absolutely correct.

[echo pecan]

ok

[acoustic owl]

While you are working on the module, there will be questions that you have to answer. These questions will sometimes give you cubes in return. A total of 10 cubes. Not all questions reward cubes. They are distributed in such a way that when you have finished the module, you will have received the 10 cubes that you spent to unlock it.

[rustic quiver]

Is there something i'm missing about sqlplus? I"m working opn the footprinting module and its saying use sqlplus to login to the oracle db but when I try to use it in the pwnbox it wont install and when I try installing it both on the pwnbox and on my own system it says it can't be located

[limpid hemlock]

Hey can anyone help me with the skill assessment 2 for introduction to evasion techniques i tried creating a vbsvrupt and putting it on the target folder but not getting a shell

[opal shuttle]

which module

[opal shuttle]

because its available with some other name

[opal shuttle]

no worries ...verify youself to access other channels #welcome

[opal shuttle]

yes you can

[limpid hemlock]

The intro to windows evasion one I managed to find the flag couldn't get a reverse shell had to start a server and capture the flag on desktop of the user that clicks on the file

[devout lily]

Vulnerability Assessment - Nessus skills assessment
"Alternatively, use the pre-populated scan data to answer the questions below without having to wait for the scan to finish but feel free to practice configuring and running it." where can i find the pre-populated scan data?

[torpid dirge]

U can dm me

[ocean coral]

Hello everyone… new here is it possible to do the modules in a virtual machine if I’ve don’t have a paid account

[waxen totem]

Do you mean your own VM? yes of course, however the pwnbox (the provided vm) can only be spawned for 2 hours a day (iirc) for free users.

[echo pecan]

...

[ocean coral]

Yea the 2 hour limit is my issue why I’m wanting to run in a virtual machine

[waxen totem]

Yeah you can use your own vm, but target lifetimes are maxed at 6 hours per spawn. You can of course re-spawn it but whatever work you will have done is gone.

[ocean coral]

Ah I see thank you

[fathom pendant]

it's on the target

[silent palm]

hi im new to HTB. im working on one of the network fundamentals module and i wanted to do the extra skill assessment. some how i cant to ctrl-v in shell?

[fathom pendant]

ctrl+shift+v into terminal

[devout lily]

mmmh more specifically?

[silent palm]

the part im on says i have to do user anonymous ctrl+v enter enter and it just says command not found

[fathom pendant]

connect to https://target:nessusport and there should be a scan in the history

[fathom pendant]

oh

[devout lily]

The target is that one has spawned or 172.16.16.100?

[fathom pendant]

the target that's spawned, you have no way of reaching the internal network from the outside

[fathom pendant]

yeah pressing ctrl+v -> Enter MANUALLY inputs the escape character sequence for the enter key [^M]

[devout lily]

Becouse 172.16 is a pivate IP address?

[fathom pendant]

ctrl+v enters "verbose keys" mode

[fathom pendant]

no; because it's a separate internal network; 10.129.x.x is also a private ip address

[devout lily]

exactly, but ok

[fathom pendant]

the vpn only gives you access to the 10.129.0.0/16 range of targets

[devout lily]

got it

[waxen totem]

For Hack The Box VPNs treat 10.x ips as if they were public ips. Other than that you can retain the private and public classifications

[devout lily]

Another question, when i put the credentials in Nessus in Windows section, whats the goal of it?

[fathom pendant]

? wdym? for a credentialed scan?

Nessus does a wide sweeping scan; if you provide credentials, it attempts to log in and enumerate using said credentials on various services

[devout lily]

Yes, because i see that also in Assessment --> Brute force there a box where putting credentials, but i want to know the difference between this section and the dedicated Credentials section

[fathom pendant]

there's 2 types of scans (in general) credentialed and non-credentialed

[devout lily]

i have put credentials for windows

[fathom pendant]

You don't really need to do the scan yourself tbh, as was already stated there's a pre-populated scan... unless you WANT to wait like an hour for the scans to finish

[devout lily]

whats the difference?

[fathom pendant]

the credentials you provide will be used to attempt to log in to services
with a non-credentialed scan, the only attempt to be made would be for anonymous/null sessions

[waxen totem]

Brute force: You provide a list of credentials and it will try all of them but not go further
Dedicated: You provide known credentials and it will utilize them to scan the internals

[fathom pendant]

I generally wouldn't concern myself too much with learning the ins and outs of a vulnerability scanner tbh

[devout lily]

internals so?

[fathom pendant]

[unless it's actually part of your job]

[fathom pendant]

internals as in services on the system

I generally dislike this module as part of the path because it's just a dartboard module; throw stuff at the dartboard and see what sticks

vuln scanners can be useful, but they're more of compliance checklist tools than they are fully helpful, like linpeas/winpeas

[waxen totem]

I only really liked the theory parts of it.

[fathom pendant]

sure, you'll find SOMETHING but like you'd find it faster just manually enumerating

[devout lily]

is this not a phase of a pen test?

[fathom pendant]

no

[waxen totem]

It's not a phase, it's a tool for a phase.

[devout lily]

the third phase is vulnerability assessment

[fathom pendant]

Vulnerability Assessments are done in the early stages of security hardening

before a pentest is performed

[waxen totem]

Vulnerability Assessment IS NOT Vulnerability Scanning

[devout lily]

whats the difference?

[fathom pendant]

A vuln assessment is just there to tell you of POTENTIAL vulnerabilities; A vulnerability SCAN is to actually go through and verify what is/isn't vulnerable

[devout lily]

i thought that when u have perfomed Information Gathering, i have to go on with vulnerability assessment

[waxen totem]

Vulnerability Scan: Automated way of locating POTENTIAL vulnerabilities, detected in automated ways (it's a form of information gathering)
Vulnerability Assessment: Judgement of the pentester on whether a vulnerability is worth looking into and continue to exploiting and so on (chance of exploitation, complexity, and chance of damage)

[fathom pendant]

I think that's kinda incorrect w1ld as a vulnerability assessment is a form of auditing as well

[devout lily]

If this module named Vulnerability Assessment, why is not?

[waxen totem]

Well yeah, you're auditing which vulnerabilities you found are real and which are probably not applicable or out of scope

[fathom pendant]

It's a different thing entirely; A company will perform a Vulnerability Assessment PRIOR to actually hiring pentesters in order to qualify their scope

[devout lily]

i think that the using of Nessus come after the Information Gathering

[waxen totem]

The module goes over the theory behind Vulnerability Assessment, and then discusses vulnerability scanners which is a tool used to aid in vulnerability assessment (i.e. actually locating the vulnerabilities)

[fathom pendant]

A vulnerability assessment just shows potential surface level vulns that a company can harden prior to having a pentest performed.

But that's why i hate the scanners as a whole because, again, dartboards

[devout lily]

ok and the third fase of a pen test process called Vulnerability Assessment when is perfomed? And which tools are used?

[waxen totem]

yeah ngl I just realized we were talking about two different things... IMO those should be called Vulnerability Audits, rather than assessments since Vulnerability Assessment is a part of the process in Pen-Testing

[fathom pendant]

yeah; and that's what the module is actually talking about, vuln audits rather than vuln assessment imho

it's not a bad module; but it's placement just also feels lacking

[devout lily]

exactly, this is why i am confused

[devout lily]

?

[fathom pendant]

your brain

you shouldn't necessarily need automated tools in order to hunt vulns

the only time you'd need an automated tool is if you've tried literally everything else and haven't moved forward

[devout lily]

so the process is Information Gathering --> look at the results to see if something could be vulnerable (Vulnerability Assessments) --> Exploit

right?

[waxen totem]

Added an erratum, hopefully this clears up misunderstandings in the future https://discordapp.com/channels/473760315293696010/1426851885691834458

[fathom pendant]

yes

[waxen totem]

yep, Just understand that that module is talking about "Vulnerability Scanning" not Vulnerability Assessment

[devout lily]

and this is just a way to perform Information Gathering and Vulnerability Assessment using an automated tool like Nessus?

[fathom pendant]

It was honestly one of my least favorite modules because i didn't really 'learn' anything off it, just "here's a scanner that will likely provide false positives, have fun"

[fathom pendant]

even then it's not really performing vuln assessment (For info gathering) it's just "here's a ton of potential problems, and most of them are benign, oh and some stuff is marked as info but it's actually important probably"

[vagrant wraith]

hey guys silly question so ive installed bloodhound from https://bloodhound.specterops.io and followed all the steps there for how can i enable and disable ?

[waxen totem]

It's not a way to perform Vulnerability Assessment(phase) on its own, an automated scanner cannot be the judge of vulnerabilities, only the tester can.

[fathom pendant]

https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart

[vagrant wraith]

nvm my bad just found out i can do it from the tool syntax 🤦‍♂️

[devout lily]

Obviously, I meant that this tool provides you with a lot of information that can be evaluated by the tester, instead of performing Nmap against a target and searching on Google for known exploits about the service running on it.

[fathom pendant]

honestly the nmap and google strat is 10x faster; because even then the nessus thing you still need to google exploits

[devout lily]

i will proceed to delete this modulo from the Vulnerability Assessment phase so

[waxen totem]

you've done the nmap module yes? then you should know nmap itself can act as a vulnerability scanner

[fathom pendant]

--script vuln

[waxen totem]

don't think of any of these tools as the end all be all, treat them like tools in a toolbox, if one doesn't fit or work, then find one that does.

there's a reason all these modules cover multiple ways to do the exact same thing

[devout lily]

you right

[devout lily]

at this moment i have done only the Information Gathering phase, i know Nmap and little else

[waxen totem]

bro's gonna have so much fun when he's finally exploiting things

[devout lily]

so can i think Vulnerability Assessment and Information Gathering as a single phase right?

[devout lily]

i really think so

[devout lily]

@waxen totem

[turbid kindle]

Little update on NoSQL Injection: the oracle was ||Content-Length HTTP Header|| . Module completed 🎉

[waxen totem]

Well, you can do them in tandem but that becomes cluttered really quickly especially without the experience

it's better to have all the information before making a judgement is all.

[devout lily]

for example, an FTP server that can be accessed with Anonymous login is already a vulnerability, right?

[waxen totem]

yes but depending on others that you find you might want to pursue it, you might not

[devout lily]

of course

[waxen totem]

don't judge a vulnerability too quickly

[devout lily]

so the vulnerability assessment is just a phase where u study the information you got before

is it right?

[waxen totem]

You might think: Ohh this is a low impact vulnerability since it's easily fixed, but what if you have an ssh key in there? or a RootCA?

[waxen totem]

Not just study but rate, the best example of a rating for a vulnerability is its CVSS score.

[devout lily]

Present in that module

[waxen totem]

CVSS highly depends on Impact, not just vulnerability itself.

[fathom pendant]

^

[devout lily]

experience

[fathom pendant]

also in-general, you should be able to roughly defend your CVSS score you provide.

i.e. normally this would be an info/CVSS 1.0 however, this vuln leaked extremely sensitive credentials

[waxen totem]

You mean I can't have all my 20 findings be critical 10.0 vulnerabilities?

[fathom pendant]

10.0; I was able to exploit it, and i'm terrible at this

[devout lily]

in the CVSS site liked on the module is there an explaination about the score?

[waxen totem]

TLDR: something you can exploit on it's own yes counts as a vulnerability, BUT a chain of exploits also counts as a vulnerability.

Imagine you have anonymous access to a file share with an encrypted zip file containing, ssh keys, but the zip encryption is crackable.

Weak Encryption Password- Vulnerability
Anonymous FTP login - Vulnerability

SSH Key leak through Anonymous FTP login and Weak Encryption Password - MASSIVE Vulnerability.

[fathom pendant]

CVSS deals with the CIA triad

and some other factors

i.e. how do you access this resource [can you access it externally or is it required to be on the same network]; is there some other factor involved, does it breach any part of the CIA triad

[devout lily]

of course

[waxen totem]

so do you get why you want to gather all the information before making an assessment?

[fathom pendant]

i.e. i wouldn't necessarily say something being hosted on the admin share is a vulnerability in and of itself

because, if only admins can access the share -> then it's relatively confidential

[devout lily]

making a syntex, Vulnerability Assessment can be done rating the informations i got before, using CVSS and CVE

and personal experience

[fathom pendant]

CVSS is generally better for post-exploitation

not before exploiting

[devout lily]

but it describes the impact of a vulnerability

[fathom pendant]

because an anon share can have absolutely nothing on it; thus making it more of an informative vuln like "Hey some idiot spun up a share and it was never taken down"

[waxen totem]

Yes but Vulnerability Assessments are used to figure out: Alright, where do we start in this massive swamp of vulnerabilities

[fathom pendant]

^

[fathom pendant]

you don't know the impact a vuln could have until AFTER you exploit it

[devout lily]

clear

[waxen totem]

was just using CVSS as an example on how to rate vulnerabilities, but you should be fine by just judging: high chance of exploitation, low chance of damage to systems, and low complexity

[fathom pendant]

in general after the scanning phase you want to rank the potential vulns in order of most to least likely and start there

[devout lily]

so the correct definition is: Vulnerability Assessment can be done rating the informations i got before using personal experience and google

[waxen totem]

Vulnerability Assessment is the prioritization of vulnerabilities to exploit in order, based on personal experience and google

[devout lily]

clear

really appreciate your help guys

[fathom pendant]

I like to think of it this way as well: Say you have 2 vulns presented, anon share and an SSH server that MAY BE vulnerable to shellshock; the more likely thing is anon share and you start your enumeration from that point instead of diving down the shellshock rabbit hole

https://blog.qualys.com/vulnerabilities-threat-research/2014/09/24/bash-remote-code-execution-vulnerability-cve-2014-6271

and your list could also be ranked in "how comfortable am I in attempting to exploit these potential vulns"

[waxen totem]

and you go back into info gathering when you reach that one vulnerability in the list that you really couldn't be bothered to exploit

[rustic sage]

Oh it's possible just with that?

[sand rose]

Hello guys, I need help with the SeDebugPrivilege Section in the Windows escalation module. I was able to use minikatz to make the lsass.dump file... but since im using xfreerdp3, I have no clue how to actually get it to my own system to crack it offline.

Is anyone able to help?

[fathom pendant]

xfreerdp has the /drive: option

/drive:name,/path/ or /drive:/path/,name

[sand rose]

Do I have to run it as I use it to RDP in? Or can I open another terminal and do it that way?

[fathom pendant]

yes you have to use it as you rdp in, otherwise you can start up an smb server

[sand rose]

with the /drive: name,/path/ you mentioned. I assume path is the path to where the file is... is name the name of the file I assume?

[queen dust]

reverse shelling after making it semi interactive with /bin/bash it gets stuck on some commands and takes a while before I can execute something else, any fixes?

[fathom pendant]

/path/ is the filepath on your local system

name is what it'll appear as in the file viewer; it's spinning up a share, basically

[sand rose]

So... im struggling to connect some dots here. So its spinning up a share for all intents and purposes... I'm not following how this helps me get the file on the remote machine locally.

[fathom pendant]

in the cmd line on windows it would be //tsclient/name

[fathom pendant]

the /drive:name,/path/ mounts a local filepath to the rdp client as the name you give it

i.e. an inconspicuous name like "Tools"

for instance if you want to transfer files to/from the session and don't want a dedicated folder to use you can use /tmp

so /drive:tools,/tmp/

and it will mount YOUR /tmp/ folder on YOUR linux machine

in the remote session you can drag and drop files to/from that folder to transfer files

[sand rose]

is cp or move a thing in windows cmd?

[fathom pendant]

or use the copy command

but you'll need to use //tsclient/tools/ (for example) to copy a file over

or move iirc it's move and copy; windows is more verbose in a lot of its commands

fun fact: the rdp binary in windows is called mstsc.exe -> Microsoft Terminal Services Client. that's why it's mounted as //tsclient/name

where name is whatever you decide to name it

[sand rose]

It keeps saying network name can't be found

and Im using the name I used before

[fathom pendant]

?

[sand rose]

Alright this is the command in linux I ran:

xfreerdp /drive:test, /test/ /v:$target /u:<redacteduser> /p:<redacted password>

I exported the ip into target

[fathom pendant]

does /test/ exist?

[sand rose]

yes it does

[wicked apex]

anyone encounter problems trying bloodhound-python and nxc-ldap-bloodhound around module-163(AEN)?
is this a ligolo-ng specific problem?

[fathom pendant]

and you can't find the file location in the file explorer on the windows side?

[sand rose]

when i run //tsclient/test on windows it says "The network name cannot be found"

[wicked apex]

oh also error being related to dns and ldap timeout mostly

[fathom pendant]

yeah i wouldn't worry about that

can you copy over a test file using
copy <file location on windows> //tsclient/test/

hi this isn't #general ; you'll need to follow the instructions in #welcome to gain access to typing there

[magic bone]

Miss click. Thanks

[fathom pendant]

if it's an error relating to timeout it's likely a network issue; is there a problem with running the collector directly on the machine instead of remotely?

[wicked apex]

collector also get ldap problems I remembered

though it should be the same host the module is telling me to run sharphound on,
with full access of course

[fathom pendant]

i suggest going through AEN blind especially if you've gone through the CPTS course

that means just spinning up and going from boot to Domain Admin (or highest priv level)

and not answering the questions

or reading the module

[wicked apex]

agree
I am in half the way through
Initally I tried to do it blind but I head into some roadblocks real early on so I just went lazy lol

[fathom pendant]

then you're gonna struggle hard on the exam

learn to tough it out and fight through the roadblocks instead of looking for the easiest way out

AEN blind is a test of your methodology and notes

it's not JUST about completing the module, it's about hardening your methodology and problem solving skills

it's alright to take a peak if you feel like you've tried everything, but you shouldn't be using it as a guidebook. The simplest thing to do is reset the target and see if that resolves the issue, getting back to that same point would be trivial

[sand rose]

So... it keeps saying my syntax is wrong... the command on windows: copy C:\Tools\Procdump\lsass.dmp //tsclient/test

[fathom pendant]

specify the / at the end and maybe specify the filename as well

[wicked apex]

now I just kinda memorized the methodology of passing through the first few machines
Maybe I'll take a break to reset my mind first

[fathom pendant]

wrong, you didn't memorize the methodology, you memorized the methods

[sand rose]

is lsass.dmp not specifying the file? the file name is lsass.dmp?

[fathom pendant]

as in specifying it to the file location you're copying to

[sand rose]

it also says the system cannot find the specified file

[fathom pendant]

cannot find specified file
is that on the local end? that means that lsass.dmp isn't where you think it is ig (procdump can still run even if you specify a bad file location iirc)

[sand rose]

I already ran procdump and it created lsass.dmp

The file path to lsass.dmp is: C:\Tools\Procdump\lsass.dmp

[fathom pendant]

and you can verify that it does in fact exist? :)

[sand rose]

I'm staring at it right now

[fathom pendant]

then try this: open the file explorer -> this pc -> tsclient -> test

[sand rose]

folder is empty... but it is there

ill just drag and drop it?

[fathom pendant]

ye

[sand rose]

ok. thank you so much

[fathom pendant]

no idea why it's not working via command line but also sometimes it's tricky ¯_(ツ)_/¯

i mean the alternative is mounting it as a drive using net use

[sand rose]

I was honestly close to saying screw it and spinning up a smb server and just doing it that way

[fathom pendant]

also curious if it's a direction issue

// vs \\

[sand rose]

ill try it here in a sec

let me get it to my local machine and ill test it

[fathom pendant]

but that may just be a "windows is dumb sometimes"

typically // and \\ is automatically translated with windows, but some commands can be touchy

[sand rose]

sooo... now I have a different issue

When I go to drag and drop, the rdpclient keeps flickering on and off almost... and it doesnt finish copying over.

It gets to like 40 percent and then flickers and never copies and I have to keep moving it over.

[haughty fiber]

stuck in file uploads module. Able to upload the php file but cant find it in the uploads directory even after the correct naming scheme

[sand rose]

nvm

We got it over.

Also direction didn't matter for me sooo I dont know what was going on there.

But we got there. I appreciate it. Thank you!

We are in fact not there yet... I'm now having issues parsing the dmp file locally... its encrypted and I don't know how to decrypt it so I can run it through hashcat.

[rustic sage]

When I finish the information security foundations, do I just jump straight into pentesting job role path or are there any other paths I should be doing or modules that you guys recommend?

[fathom pendant]

it shouldn't be encrypted, but you will need certain other files to read it properly

IIRC it's SAM and SYSTEM

[sand rose]

So secretsdump.py?

[fathom pendant]

you can jump straight to it

[fathom pendant]

yeah

[sand rose]

kk

[haughty fiber]

can someone help

[brave field]

DM me

[jovial robin]

Anyone got a pointer on this? really confused as to why the number i found isnt the correct one. (OSINT: Corporate Recon | Section staff)

[thick ice]

Hello, everyone! I am having an issue with the Password Attacks: Credential Hunting in Windows module.

I found the answer to the question “What is the default password of every newly created Inlanefreight Domain user account? (Format: Case-Sensitive)” in the script, but it is not being accepted. I would be very grateful for your response.

[red shuttle]

delete flag bro

[cunning fern]

i dont understand? both screenshots are flagged as spoilers for a reason

[sand rose]

Yeah... but still dont post them. I also believe its against htb TOS to post any kind of spoilers... especially flags for anything not tier 0.

[cunning fern]

how else do you want me to show that the only given flag is "incorrect" 😭

[sand rose]

Ask for help and see if someone is willing to have you DM them to talk in private about it

Or just say what you did and mention that the flag you saw is not showing as correct

someone who is able to help will when they have time and see it

[cunning fern]

i still dont understand whats the fuss about sincei ts clearly marked as spoiler but here ya go

[red shuttle]

point is that it is still visible u could blurr or draw smth on it to leave only format of flag

[cunning fern]

hey guys, im currently doing the network enumeration with nmap module, on nmap scripting engine there is a question "Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.". i used ||nmap 10.129.2.49 -p- -sV --script banner | grep "_banner" ||and got the result, but the found flag is shown as incorrect? not sure if it matters but im using beta

^when i didnt use ||grep|| there werent any ||banners other than what I have here||

[fiery loom]

i have problem with one modul where i need to satart a box and find how many software interface modes are awalible but it seems there are none but answer was 2

Check the driver capabilities for the interface. How many software interface modes are available? (Answer in digit format: e.g., 3)

[heavy slate]

Advice on LLM Output Attacks - Skills Assessment
Im stuck and no out of ideas to try, can someone point me toward right direction?

[floral fulcrum]

could anyone give me a nudge for advanced sql injections skills assessment question1? having trouble || dumping password hashes||

[smoky whale]

Guys

[dull solar]

"Above, we created the user JLawrence and did not set a password. So this account is active and can be logged in without a password. Depending on the version of Windows we are using, by not setting a Password, we are flagging to windows that this is a Microsoft live account, and it attempts to login in that manner instead of using a local password."

Can anyone explain this in regards to the cmd in the section above it?

Module: Intro to Windows CLI Section: User and Group Management

What is meant by live accounts, isnt the no-password login similar to a guest account?

[brave field]

Maybe it's the wrong flag and must be used with another question.

[fathom pendant]

That's a flag for a different section; look closely at the examples and draw conclusions of where to focus from there

[cunning fern]

thank you, it seemed a bit familiar

[hollow kernel]

Can somoeone help with module common attacking aplications
The submodule
Thick client applications

Can I compile java with IDE like eclipse?
Or is necessary to do commands in powershell?

[lean bronze]

You can DM me

If you're still stuck

[zealous hazel]

Sorry ik this isnt the right channel but why is this the only channel i can talk in

[maiden thunder]

I'm stuck on Skills Assesment in ADCS Attacks module
I managed to get machine's certificate dev01.pfx but it fails to authenticate
||
certipy auth -pfx dev01.pfx -dc-ip 172.16.19.3
[-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)

Though I can use -ldap-shell and set_rbcd
I can't get a ticket to proceed
getST.py -spn cifs/DEV01.LAB.LOCAL -impersonate Administrator -dc-ip 172.16.19.3 lab.local/tom:tom123
||

[low ravine]

@zealous hazel Have you verified your account?

[devout lily]

About the previous conversation about Nessus, would you insert it into the Info Gathering phase instead of Vulnerability Assessment?

[zealous hazel]

i dont think i have. do i have to verify with my phone number?

[low ravine]

No, with your HTB account (see #welcome ). I may be wrong and there is something else blocking you from posting in other channels, hope I'm right though. You can also check this https://help.hackthebox.com/en/articles/5193100-welcome

[unique willow]

Hello all, I'm having the same issue as this guy (though he didnt get an answer), aquatone is too old its completely broken I downloaded it the exact way the course shows (e.g. latest version which came out 4 years ago) the repo has been archived since 2023 and when I generate the report it's completely broken (while eyeWitness scan worked amazingly).

Requests:
 - Successful : 15
 - Failed     : 0

 - 2xx : 15
 - 3xx : 0
 - 4xx : 0
 - 5xx : 0

Screenshots:
 - Successful : 2
 - Failed     : 13

Either there's something very wrong with my setup (go/1.22) or the flag is impossible to get

What does the header on the title page say when opening the aquatone_report.html page with a web browser? (Format: 3 words, case sensitive)

Does anyone know how to skip this? (/module/details/113 -> Application Discovery & Enumeration)

[dull solar]

Module: Introduction to Windows Command Line
Section: User and Group Management
Anyone, a little help? It asks "Connect to the target host and search for a domain user with the given name of Robert. What is this users Surname?" and every time I try to filter for him, it says "Server has rejected client credentials"

[twilit fjord]

geniune question but im expected to complete the linux fundamentals module in 6hrs according to HTB academy, is this seriously realistic progress and learning?

[queen dust]

you should try to absorb the material it's really only up to you

[twilit fjord]

i feel like i can only achieve that time if i make no notes and dont practice

just confusing

[vernal tapir]

Hey, send me a pm I definitely got the answer by now

[queen dust]

do you have prior experience with linux?

[twilit fjord]

sort of (i also main arch) but im still being met with unfamiliar concepts

so ig i dont have as much as i thought

tbh idk what my experience level with linux looks like, im not too confident abt it

i think its best i open up a thread in #1024429874246590575

[vernal tapir]

Hey, send me a pm if you'd like I can help you with a nudge

[green musk]

Ya sure thanks man

[opal shuttle]

hii guys how to get sharable link of htb labs

[wooden niche]

Hello guys
Please I am new here and I needed guide and I am interested to learn cyber security

Please how can I get started??

[brave field]

It gave you creds for the other user to connect with using SSH.

[static belfry]

hi guys
who can help me to reverse ip?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[acoustic owl]

@wooden niche ^

[wooden niche]

Thanks 😊

[jovial robin]

noone that can help out on this ? 😅

[acoustic owl]

https://mxtoolbox.com/ReverseLookup.aspx

[acoustic owl]

|| A number is displayed on the website. Your reasoning is certainly sound, but the question asks for “at least.” Therefore, you do not need to add anything.||

[jovial robin]

i swear i am going mad i entered the number, without adding sth, like 5 times yesterday, and it didnt work but it just worked and now i doubt my sanity (i even entered all numbers from 1-100 manually)

well it works ... thx ! :D

[static belfry]

@acoustic owl thx for your response but it's not working

[acoustic owl]

Well, if there is no PTR record, it is not possible to determine a domain.

[static belfry]

what percentage can succeed?

[acoustic owl]

DNS is like a phone book. Without a PTR record, there is no way to resolve the domain.

[static belfry]

ok thx

[ebon minnow]

Question: Try to read the details of the user with 'uid=5'. What is their 'uuid' value?

I got the "staff_admin" cookie by going to uid 10, can i have a hint on what im missing because ive tried entering 5 in api endpoint like the hint said.

[topaz tundra]

Greetings
I have a question why is it that when I connect with a vpn I can’t get the flag but as soon as i tried it with the htb box I had the flag with the same command? It happened to me twice in different modules and I found it weird

[woeful blade]

Maybe your vpn wasnt actually connected you can Always check on settings try setting up the kill switch for more privacy

And proton vpn or surshark if you want your data nit tò get leacked:)

[ebon minnow]

Web Attacks, IDOR. But I managed I get it via curl in terminal lol. Burp wasn’t working because I got confused

[dull solar]

Depends on multiple reasons. HTB Machine is connected by default to the VPN, you may not have connected properly and therefore you were inable to connect to the target

[topaz tundra]

I used the academy VPN not any personal VPN

[dull solar]

Were you connected to it?

And were you able to ping target?

[topaz tundra]

If not I wasn’t even going to be able to ssh the target

[dull solar]

So you did SSH in?

[topaz tundra]

I was clearly in the machine

[topaz tundra]

Yeah

[dull solar]

Don't think the commands you ran were the same then.

Depends on context of cmd though, I don't know what they are.

[topaz tundra]

lol

[topaz tundra]

I happened man I’m just complaining and if you want to it was on the enumeration with nmap

[dull solar]

You wanna show me what you ran for both exactly?

If it's allowed. put a spoiler

If you want to ofc.

[topaz tundra]

I will not I don’t to get banned

[dull solar]

If there's no flags in it it's not bannable

[topaz tundra]

And it’s ok on htb forum saw somebody complain of the same issue and from the same module

[topaz tundra]

It’s actually a flag I wanted to get

[dull solar]

No I mean in the command itself.

Just hide the actual thing you submit. Not the cmd.

[topaz tundra]

Another I couldn’t get a file from the ftp servers on the following module but the the htb box I could is it supposed to be like that just asking

[cunning fern]

yeah this was pretty cool but took a long time and a lot of scrips to run LOL

[fathom pendant]

--script http-enum I believe gets you there the quickest

[cunning fern]

yeah i saw "the thing we need" few other times while scrolling through walls of text some scripts gave me but i didnt rly think the answer was right in front of me, ngl i think this was an interesting lesson to leave no rocks unturned and i hope more modules will be like that to force that approach upon students

[dense stump]

Hello

[fringe thistle]

Hi a short question to the module "AI Data Attacks" is there a jp notebook which I can spawn. If yes where do i find it?

Ok problem solved i installed it myself on the parrot system

[fleet spear]

windows privesc well me an my AI are stupid we cant find out how you can find out what privilegie are set when you are allowed to run powershell as administrator

[strong vector]

Hi! Can someone help me with the Pass The Certificate session on the password attacks modules, i rlly cant get the administrator flag. Pls dm me

[ocean coral]

so i'm having issues getting to connecting with vm

[strong vector]

which module is it, and did u tried with the -Pn flag in nmap

also i dont think is a good thing to share flags, but idk

[ocean coral]

i'm like really new to all of this but it's the fawn

[strong vector]

starting is the thing that matters, try using the Pn flag with nmap, windows sometimes block ICMP packets

[ocean coral]

oh ok i'll see

[ocean coral]

that works but it doesn't show me the ftp version which i'm needing for the current question

[strong vector]

try again using the sV flag

[brave field]

If anyone is able to explain? Thanks.

[ocean coral]

-sV gives host seems to be down message

[strong vector]

both the Pn and sV flags?

nmap -sV -Pn

[ocean coral]

together?

[ocean coral]

this seems to have worked thank you

[strong vector]

the Pn flag assumes the host is up ( it doesn't send ICMP requests to verify), and the sV grabs the banner and run some scripts to try and verify the service and version running on the port

[ocean coral]

oh i see thank you... fawn has been pwned thanks to you, will note that down as well.

[ocean coral]

Question: is Kali or parrot better for modules

[strong vector]

idk, i used kali before switching to arch

i only use arch bcuz of ricing tho

[ocean coral]

I’m currently trying to install smbclient on parrot and having issues

[near breach]

Hi everyone! I need a help in Attacking Web Applications with Ffuf.Filltering Results lesson, it says to add the htb.academy URL to etc/hosts so I can send a request using the Host header for vhost fuzzing. Could you please tell me why I need to add the IP address to etc/hosts? Why can't I just specify the full IP:port in the ffuf request?

DNS substitutes ip instead of URL.

So, with etc/host like this:

94.237.57.115 academy.htb

These two requests will be equivalent:

curl http://94.237.57.115:49747
curl http://academy.htb:49747

So, I don't have to add a DNS record and just send the request.

ffuf -w subdomains-top1million-20000.txt:FUZZ -u http://94.237.57.115:49747 -H "Host: FUZZ.academy.htb" -fs 0

but it returns an error.
And the next request without the host header works correctly.

ffuf -w  subdomains-top1million-20000.txt:FUZZ -u http://94.237.57.115:49747/FUZZ

[waxen totem]

You have to make your attacking machine recognize the domain name so:

• It's easier to remember a domain name than it is an ip
• to have requests be accurate to what the target is expecting
• to be able to add subdomains when you do find them e.g academy.hackthebox.com, if you do a vhost scan on hackthebox.com and find academy in your ffuf output

TLDR; cos you can't make a request to: example.academy.htb:49747 using example.94.237.57.115:49747 that's not a thing

But for your fuzz command you're filtering incorrectly and you have a typo: FUZZ.academy.htb. you added a . by mistake at the end, it should be FUZZ.academy.htb

[near breach]

I tried it without . and the result was the same.

[waxen totem]

can you show what happens when you remove the filter?

[soft mural]

Module: Password Attacks
Section: Writing Custom Wordlists and Rules
hi guys, i have stucked on this section for 1 day. I have tried manually creating the password, then expand it using oneruletorulethemall, but it still not working, can someone share some tips on it?
https://academy.hackthebox.com/module/147/section/1391

[devout lily]

Hi, can someone help me to understand the CVE web site or NVD website to see the specifications about vulnerabilities?

im browsing but i didn't see nothing yet

[soft mural]

Solved

[waxen totem]

was bout to say: did you try the rule list provided in the module? hehe

[hidden parcel]

Hey, on the Nmap module, on the hard lab I wasnt able to do it and ended up looking at a writeup, but I still dont understand the solution. Is it common to enumerate all the filtered ports and try to communicate manually? Im guessing automating a tool would be useful but I want to know if this is a common practice or done in this lab because the question is to get a service's version.

[waxen totem]

Mannually communicating with a service isn't done too commonly but it is very useful to know how to do.

[lusty flint]

Module: Password Attacks
Section: Skills Assessment
Link: https://academy.hackthebox.com/module/147/section/1356

I submitted the ntlm hash for the question. It got marked as correct.
However, I the Mark Complete Option is not showing up. ( I Have completed all other sections and marked as complete too)

[naive pelican]

Module: Stack-Based Buffer Overflows on Windows x86
Section: Remote Exploitation
Link: https://academy.hackthebox.com/module/89/section/952

I think I did everything right. I get a connection from the reverse shell but the connection closes after 5-10 seconds, and I don't get the shell on the windows machine.
I used windows/shell/reverse_tcp on msfvenom
Need some help guys I am lost.

[soft mural]

Yea i did, but still not working with hashcat, maybe internet issue too slow on cracking, but then i get to do it with jtr

[hazy lance]

heyy guys

I'm having some issues with secretsdump in the Pass the Certificate section (Password Attacks Module).

$ impacket-secretsdump -k -no-pass -dc-ip 10.129.234.109 -just-dc-user Administrator 'INLANEFREIGHT.LOCAL/DC01$'@DC01.INLANEFREIGHT.LOCAL


[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[-] 'NoneType' object has no attribute 'getRemoteHost'
[*] Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter
[*] Cleaning up... 

When i use the -use-vss flag (as the output is saying) i recieve this error:

$ impacket-secretsdump -k -no-pass -dc-ip 10.129.234.109 -use-vss 'INLANEFREIGHT.LOCAL/DC01$'@DC01.INLANEFREIGHT.LOCAL


[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Cleaning up... 

I abused of the NTLM RELAY attack and now i need to dump the hashes but i'm having this error

thank you in advance.

[brave field]

Check you have a valid Kerberos ticket (since you used -k).

[fleet spear]

usally you have to split ut 'domain'/'account'@host but when secretsdump suggest -use-vss or other flags there is usally some underlying problem use -debug aswell

[fleet spear]

https://github.com/fortra/impacket/issues/1251 here is the answer why -vss flag dosent work

[unborn berry]

Guys, what should I have to apply to pentester??

[brave vine]

I am doing Pro lab solar htb, i have an issue with jail escape after accessing jupiter.solarsystem.htb machine. Any help?

[acoustic owl]

Best to ask in #1263635449335910531

If you have no access, read and follow #welcome

[acoustic owl]

It has nothing to do with the Academy modules, but just read the job ads in your area and see what requirements need to be met.
I advise you to read and follow #welcome so that you can access better channels.

[neon tinsel]

Hello, guys. Where i can find correct wordlist for this module/section?
https://academy.hackthebox.com/module/144/section/1257
I used subdomains-top1million-110000.txt but it found all subdomains except su

[hidden ledge]

Hello, in the Skill Assessment of the Password Attack module I tried to set up ligolo for pivoting but i'm new to this and there is a weird behaviour I cannot say if it comes from me or not. When the session is started in ligolo I can ping DC01 in the internal network corresponding to: 172.16.119.11 but I can't ping FILE01 and JUMP01. Do you have any idea how this is possible ? Wrong set up from me ? Or it's definitly weird and I should reset the machine? (I did this yesterday and it worked totally,)

[waxen totem]

It should be in there actually, are you sure you're brute forcing correctly?

@neon tinsel I just need the command you used, not the results, as those are spoilers

[neon tinsel]

oh, sorry.
gobuster vhost -u url_here -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain --threads 100

[waxen totem]

ok that's interesting, can you DM me with the full output of that command?

[solar vessel]

H

[inland parrot]

Anyone available for discussion regarding "Attacking Common Applications - Skills Assessment II"

[hollow kernel]

Hi
First You need to gai foothold in dmz01 install the agent, Start tunell in ligolo ans then You ar able to ping jump01 and dc

[fathom pendant]

After connecting do you have the route set? Do you have the ips and hostnames in your /etc/hosts file? Also not all devices may respond to pings

running an nmap -Pn scan may reveal info to ensure that the internal targets are operating properly

Windows targets, generally, dont respond to pings

[pastel ice]

hi guys

[hidden ledge]

So I got the foothold on dmz01, I'm able to ping DC01, but not the others, I have not changed the /etc/hosts since i'm workinng with ips (Tell me if i'm wrong). I tought maybe jump01 and file01 blocked pings ? It seems nmap work fine in fact :))

[pastel ice]

do u guys have tool for the hackthebox

[fathom pendant]

As i said a moment ago: not all devices may respond to pings :)

[hidden ledge]

Thank you :))

[fathom pendant]

Theres no one tool for hackthebox

[pastel ice]

is it only in resource links?

[fathom pendant]

I suggest reading #welcome and #rules to see what the server is about @pastel ice

[fathom pendant]

?

[pastel ice]

things where u can do cyber stuff

sorry kinda new to the environment

[fathom pendant]

As i said, theres no one tool to rule them all. And this isnt #general

[pastel ice]

ok wait a bit

[fathom pendant]

In order to gain access to chat there, youll need to link your hackthebox account to the discord server

[pastel ice]

ah oka thanks

[zealous hearth]

Hi guys, I’m working on the web attack section of the web pentester path. In the bypassing basic authentication section of http verb tampering, it says we can use curl -i -X OPTIONS http://SERVER_IP:PORT/ to see which methods are allowed, but this actually does not show the options in practice as it does with the module. Is this on purpose or does my lab have some form of error ?

[pastel ice]

one last question pls

[green musk]

Hii i have like submitted 2-3 requests in this group but the thing is no mod or support member does even try to reply
Why we are having discord community when the mods can’t even help or try to reply
Tagging you cause I only saw you reply to others having problem

[little terrace]

after pivoting to a machine with ligolo, is there a way to get the sudo responder -I <int-name> -A working from my host? seems like i HAVE to rely on the linux attack host that they provide to use responder

[fathom pendant]

Not everything you see will be replicable

[fathom pendant]

The best way to get website support is by contacting support via the website, not by asking in the discord.

[zealous hearth]

Ok thanks. I was just wondering how I’d check on the exam

[fathom pendant]

I cant tell you that info

[fathom pendant]

Not without a lot of portforwarding shenanigans

[green musk]

Website support take 1-2 days to solve a single error that’s why I posted my queries here

[zealous hearth]

Not that I want you to tell me, but if the method being thought is not working then I’m assuming they will teach other methods ?

[fathom pendant]

Also you didnt say what your issue was. I get youre upset but depending on the issue not sure what can be done on this end

[green musk]

#modules message here it is please just nudge me

[fathom pendant]

It just depends. It could be configured or it couldn't, consider everything taught to be possible on the exam and dont focus too hard on details like that

[zealous hearth]

Ok thanks

[fathom pendant]

Log off and log back on

Also: website support doesnt help with content problems if the issue is not technical (lab is broken/not spawning/etc)

This server is more focused on community help, not everyone has done the module you're on

Log off of the account, then log back onto the account after setting it

That's literally the solution to your problem

Closing the rdp session doesnt log you off btw

Also deleted the message because its a spoiler

[green musk]

Yes I got thanks but I’m just asking is it possible to bypass uac without logging of I’m trying various methods like DLL auto elevate to build my methodology

[waxen totem]

There are also some modules/section that no one will even touch again, let alone help someone with.

*ehem* thick clients *ehem*

[fathom pendant]

No: because the relevant rights weren't set yet

[green musk]

Now I got it

[fathom pendant]

You're asking for help with something thats out of scope for what's being asked of the module

[green musk]

Thank you @fathom pendant appreciated your help

[fathom pendant]

I do hope you're doing AEN blind and not answering the questions and reading the module

As that will help strengthen and reinforce your methodology more

[green musk]

No I’m doing it blind and preparing pentest report so was trying various methods I learned within cpts path

[fathom pendant]

I suggest first completing the attack chain [getting to the highest privelege in the domain] before going and trying different methods

Afterwards, the module basically becomes simple to read and go through and see what methods the author used instead

Getting hung up on one step before completing it is just going to be a detriment, especially in cases where you may actually be on a timed test

[green musk]

I’ll go with this approach now
Thank you and also thanks for suggesting something useful

[fathom pendant]

No problem; its easy to get in the mindset of "how can I do this differently" but its also important to complete the objective first, then return. That way you dont get the other feeling of "oh god, I spent x hours on this, im cooked"

[green musk]

One last request just to be confident whenever I’ll complete my AEN pentest report can I dm you and send the report then you can give me feedback if possible?

[fathom pendant]

No, thats actually against the rules. It was ruled so by the arbiters (staff)

In general; just stick as close to the sample report as possible and be consistent in your labeling

[waxen totem]

It used to be allowed, why they banned it is beyond me 😭 It's such a good way to know if you're on the right track for documentation since that module was so shite

[fathom pendant]

Technically; sharing content above tier 0

[waxen totem]

but the template is public for the exam anyway on systreptor

speaking of sysreptor highly recommend also use a LOCAL INSTALL, there's been times when the site goes down and you don't want that to happen during the exam.

[green musk]

But still if someone can read and get me the genuine feedback would boost the confidence as I cannot just give myself the feedback you know what I’m saying it’s just slightly a benefit of doubt

[fathom pendant]

I forget the bts convo where it was decided you can probably look at the chat in #lounge-staff or #moderation

[fathom pendant]

You can maybe message support on the website to see, but thats as far as I know

[waxen totem]

You'll get pretty detailed feedback on the report anyways after your first attempt if you do fail. Which is why I highly recommend not submitting a blank report. Even if you know you'll fail (i.e. not enough flags) at least prepare your report to the best of your ability so that you can get good feedback.

[fathom pendant]

Imo one of the more important things with AEN is solving where your weak points are

[green musk]

I can try for second attempt but I mentally prepared myself to get it achieve within the first attempt but yes let’s see how my report goes as if getting 12 flags but cannot output the desired report would also fail me 🥲

[waxen totem]

Hard truth is: you won't know until you try, yes doing AEN blind is a massive undergoing, and that alone deserves respect. But CPTS is MUCH HARDER than AEN. and unlike AEN, there is a very short time limit in respect to how long it actually is.

[fathom pendant]

AND you dont have a convenient guide to cheat with

[cunning fern]

Why is that?

[waxen totem]

Because that section, or some sections, are just so hard, that even after doing them, and gaining deeperknowledge and skill in those areas, people won't be willing to provide help for it, at least not for free

[cunning fern]

Oh i understand, so you have the high tier ones in mind

Understandable

[waxen totem]

understand that module tier != module difficulty. There are some tier 4 modules I'd imagine would be quite easy

[cunning fern]

Hm i always used their set difficulty as an info source though id imagine some might be easier to handle, but im nowhere near them rn

[fathom pendant]

module tier moreso relates to the required underlying knowledge more than difficulty

tier 0 -> you don't know shit
tier 1 -> you kinda know shit
tier 2 -> ok now you know a bit of something
tier 3 -> wtf it goes deeper?
tier 4 -> now you're just fucking with us

[bold niche]

While it’s understandable that encountering issues with the cloud version during an exam is inconvenient, it’s important to view this in context. Over the past 90 days, we’ve maintained an uptime of 99.936% (see status.sysreptor.com), which translates to only a few hours of total downtime. Today’s interruption was caused by an incident at our server provider’s data center. unfortunate and naturally, it’s when people notice most and complain.

That said, I don’t fully agree with the suggestion to “highly recommend the local installation.” Running a local setup comes with its own significant overhead. keeping everything running smoothly, handling updates, handling the database, and preparing for unexpected failures. Users must also manage backups and test recovery procedures. We’ve seen many cases of users losing their encryption keys because they forgot to back them up, resulting in data loss. We receive a fair number of support requests about this though you don’t often see those issues here on Discord.

In the end, choosing cloud or local is a personal decision both have pros and cons 🙂

[cunning fern]

Lmaoo thats such a great explanation

[fleet spear]

this question is driving me crazy in the windows prisec module, how do i enumerate im allowed to run as administrator...

[fathom pendant]

Please dont @ me directly. Im not staff nor am I required to actually respond. Also you gave not enough info to help you

[fleet spear]

ok sorry

i will take it to erratum

[fathom pendant]

Erratum is for reporting module errors, not for asking for help

[fleet spear]

well i find it to be an error to not explain

[burnt path]

Evil Twin Attack on WPA2
I'm completely stuck on this module. I have already recovered the handshake, but inside the module's VM there is no wordlist to crack the handshake and obtain the answer to the question: "Perform the evil twin attack as demonstrated in this section. What is the discovered value of the WPA PSK?"

[inner juniper]

Hello everyone. I am stuck with module "ATTACKING AI - APPLICATION AND SYSTEM", its about the 'Model Deployment Tampering' task. When I am trying to replicate the attack and execute the last curl cmd on the page, then I get error '{"code": 500, "type": "NullPointerException", "message": "Cannot invoke "java.util.Map.entrySet()" because "modelsInfo" is null"}'. Does anyone know how to fix it?

[slender stirrup]

can someone help me in how do i get permission so i can taljk in general and the other chanels

[fathom pendant]

Instructions are in #welcome

[slender stirrup]

thank you so much

[fathom pendant]

It sounds like you need to supply "modelsInfo" in your curl request, given the error

[weary coyote]

Is thre any methods to root xiaomi phones without bootloader access

[pale island]

for this taks i have to find what type of service the dconf service is. the only problem is i can't seem to find it and keep getting blank outputs. does anybody have an idea? also just searching for it using systemctl gives me no result. EDIT: found the file but it smeems to have an empty type. TYPE:

[fathom pendant]

i don't recall if that one specifically has a target you can ssh into

[pale island]

it does not give a target ip and is a module you can finish on the HTB VM itself

[fathom pendant]

it helps to know the module and section name btw

[pale island]

my bad, it is the Task Scheduling from the linux fundementals

[fathom pendant]

you might need to dig into the systemd directories for dconf.service

[pale island]

Thank you, i found it. so it is not possible to find it via systemctl?

[fathom pendant]

No, I think that the one running in systemctl is using a different config

[pale island]

okay got it. thanks a lot for the help

[boreal raven]

Hi Can you help me out the answer of the first question, i tried all the possible combination but it does not accept the hash. Have solved other task but this one is being a pain

[torpid dirge]

dm me, I can help

[wheat tiger]

Hello Everyone,
i was wondering if anyone could help me with „Terminate Pwnbox to switch location“.
I googled and watched youtube videos, also read the help to Pwnbox, but the button mentioned there is nowhere to be found on my page.
My location is set to UK, but i need it to be DE since im from Germany.
Also, if i press „Start Instance“, there is a popup in the upper right corner of my screen which says „There are no available instances. Please try later“

[pulsar kiln]

same problem im having

[past void]

+1

[fathom pendant]

Reach out to website support

https://status.hackthebox.com

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[lone talon]

+1

[lean bronze]

@swift dove thank you for recommending Google Colab, especially in trojan attacks section in AI Data Attacks, helps a lot

[tiny frigate]

seems very much like an issue on the entire platform? having this for a few hours now

[blazing nova]

New here! Does anyone know how to obtain more Pwnbox instance spawns? I didn't see anywhere to "purchase" more spawns?

[fathom pendant]

you can't purchase instance spawns; on academy if you've spent any amount of money you get infinite. on the main platform having more pwnbox time is directly tied to having a subscription

[blazing nova]

Ok! Thank you! 🙂

[fathom pendant]

but it appears plenty of people having spawn issues with the pwnbox, could be an upstream issue with their provider

[dull badger]

good evening everyone, about AI red teamer: LLM output attack: Function calling 3, could any one drop some hint for this? e.g., is it SQL injection or? Totally clueless for this one -3-

[tame nimbus]

Howcome i cant talk in general

[cloud urchin]

You didn't link your HTB account

Make sure to read the #rules and then #welcome which shows you how to link it

[tame nimbus]

Ohh luv bro

I jus wanna ask questions im stuck lol

[winter schooner]

Hello, can anyone help me on server side attacks skills assessment?

[torpid dirge]

you can dm me

[ivory umbra]

How come grep prints some lines starting with random numbers (red) but when I pipe it into sort it removes the random numbers?

Linux foundations module

Last screenshot was grep with -o, heres the output for normal

[fathom pendant]

Its likely something to do with terminal printing progress, try with -s

[fathom pendant]

Yeah its progress printing shenanigans see the 100 22266 lines and it matches similarly to the progress output

[ivory umbra]

Yess that was the issue, thank you

[fathom pendant]

I just spotted the pattern

[strong vector]

I cant use rdp with proxychains in the password attacks skills assesment, could someone help me

[fathom pendant]

ligolo-ng avoids the need for proxychains; but errors tend to help more. did you try running proxychains with sudo?

[vestal sorrel]

@strong vector

[strong vector]

i changed to socks 4 and it worked

thx

[vestal sorrel]

U welcome

[naive pelican]

anyone able to help with this?

[swift dove]

Most welcome ! 🙏

[fervent gale]

Hi - I have completed the AI Red Teaming Track and am left with 9 flags overall. If someone who can help pls ping me so I can connect for any hints to complete the track

[strong vector]

hey, im 2 days deep in the password attacks skills assesment and i dont have enough money to continue my academy subscription so i can't waste any more time, if someone could dm me to help i would be gratefull ^^ (i rlly need help )

[ruby lintel]

I have finished the Advanced Deserialization attack. I don't see where can I review/feedback to the module, so I think I will write it here.

I hope this module should add more content to it such as reproduce custom gadget in old CVE and sharing the road to it as the same approach in the module. As my point of view, it's not "advanced" too much as the title (the current content).

Anyway, the module provides additional idea, how to approach the issue and more deep understanding the well-known gadget. It will be helpful if you doesn't work with this kind of vuln before.

[brave field]

In the module: Command Injections, section: Advanced Command Obfuscation, subsection: Reversed Commands there is a tip given:

Tip: If you wanted to bypass a character filter with the above method, you'd have to reverse them as well, or include them when reversing the original command.

I want to know how would this work against the character semi-colon ( ; ). Thanks!

[dull spruce]

hola

[digital ore]

hey can I DM you for the SA, I'm stuck here and I need a nudge

[ruby lintel]

Okay sure, you can dm me

[sacred herald]

hello guys, i am doing web proxies module in that zap scanner and i got stuck like how we can get the flag like i got 1 dir called devtools there is ping.php

can someone help me in this please

[waxen totem]

I cant recall but I'd probably go straight to check for command injection

[sacred herald]

ok brother

[sacred herald]

got it

thanks man

[soft mural]

Modules: Password Attacks
Section: Network Services
Link: https://academy.hackthebox.com/module/147/section/1327

Hi guys, I am stucked on the rdp part for few hours, where i tried bruteforcing with the username.list and password.list given, with -t 4, but it still not working, i did found some credentials but those are for winrm only, can someone provide some tips on that?

[lapis plinth]

u can bruteforce smb first, and then use cracked credentials directly to rdp

[slow flare]

Does anyone play dab

Steal a Brainrot

[final shale]

New HTB Academy design sucks and its too heavy on my old laptop.

That is my feedback

[soft mural]

eiii, i cant do it jn

i think cuz i put /u: and /p: with space

ahhhhhhhh

[soft mural]

thank you!

[lapis plinth]

perhaps u need xfreerdp3 instead of xfreerdp, I also cant use it

[slow flare]

Can anyone DM me?

[opal shuttle]

for what?

[opal shuttle]

yeah

[hazy comet]

Advanced SQL Injection module - The error for failed compilejava for fernflower. To fix this update to JDK 21 install rather than 17 mentioned in the module. 👍

[little terrace]

is there a good stable reverse shell that isnt meterpreter? i still want to use multi/handler but entirely remove my usages of meterpreter

[spare fossil]

https://github.com/brightio/penelope

[quiet halo]

when you exports ticket with rubeus, how do you guys decode the base64

I tried using online decodeers and also linu cli but it outputs gibberish

[cyan veldt]

Hello, is introduction to Python3 enough to write my own tools ?

[waxen totem]

echo -n '<base64 here>' | base64 -d > <ticket name.kirbi>

[waxen totem]

Well, a tool is a broad description, but for simple automation yes.

Should you expect to write something like netexec? probably not

[cyan veldt]

Would it be enough to continue on CWEE path

[waxen totem]

Do you already have CWES?

[thin horizon]

general suggestion

as green is the "dopamine" button to pass next stage, I think submit should be green and show solution blue as I always accidentally click on show solution instead of submitting to continue

[cyan veldt]

I’m learning it ATM but I was wondering if python3 is enough for CWEE after CWES ofc

[waxen totem]

I'm not too sure but I'm assuming it's just a bit of automation needed for CWEE.

[waxen totem]

It's not meant to be data you can read.

[cyan veldt]

Should my knowledge in Python be beyond that module?

[quiet halo]

oh

[waxen totem]

Whatever's included in the path is all you need for said path. If it's all that's in CWEE for automation, then it's all you need

[cyan veldt]

Okay thanks

[waxen totem]

You'd have to first convert it into a ccache file then you can check it using MIT KRB

https://notes.benheater.com/books/active-directory/page/kerberos-authentication-from-kali

[quiet halo]

I was hoping to get the ticket descriptions sort of how it is with mimikatz

[waxen totem]

As I said, you can convert it into a ccache file then check it using MIT KRB tools on linux.

Use: impacket-ticketConverter.py to convert the ticket and klist to check the ticket description

Read more in the article

There's also probably a way to pass it straight onto mimikatz but I prefer using remote tools on linux

Welp, a little google searching shows you can get the info straight from Rubeus

https://www.hackingarticles.in/a-detailed-guide-on-rubeus/

[devout arrow]

I'm having a little issue with an academy module.
In the Intro to Network Traffic Analysis, Networking Primer - Layers 5-7 I've answered all of the questions and I can't interact with the answers, but it won't let me mark it as complete. I've tried other browsers and incognito mode

[waxen totem]

Have you tried a full refresh? Ctrl+shift+R

[devout arrow]

CTRL+F5, no luck unfortunately

[unique field]

i need a help on NEW -module-Web Fuzzing-Validating Findings , after fuzzing target system using directory-list-2.3-medium.txt i find few directories i am afraid if im going on the right track .

[waxen totem]

Contact support

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[devout arrow]

thank you

[viral cobalt]

can someone help me with Attacking Thick Client Applications, Im not understanding how to complete this section of the Attacking Common Applications module

[opal shuttle]

hahahaha

but you have to solve byyourself at the end

[terse bloom]

The proxy server is refusing connections. (non-VPN machine) Anyone else experiencing the same?

[waxen totem]

Check your web proxy, and maybe start burp or whatever web proxy you use

[terse bloom]

nice, forgot to turn it off yesterday bruh

[brave field]

@waxen totem may I DM you regarding a module? Thanks.

[waxen totem]

https://dontasktoask.com

You don't have to ask about a module in DMs

[brave field]

In the module: Command Injections, section: Advanced Command Obfuscation, subsection: Reversed Commands there is a tip given:

Tip: If you wanted to bypass a character filter with the above method, you'd have to reverse them as well, or include them when reversing the original command.

I want to know how would this work against the character semi-colon ( ; ). Thanks!

[waxen totem]

ngl no clue, the most command obfuscation I ever needed was to use base64 encoding

[tulip urchin]

I put links as answer and for some reason it isnt correct

[brave field]

Funny since you mentioned that, the question section in the same section also only solves by that technique. The other techniques don't work, however they tell us to use one of the techniques learned in the section.

[waxen totem]

Try all the techniques, which-ever sticks, sticks

[tulip urchin]

so anyone gonna help me with my question, cuz for some reason "links" isnt correct

even tho thats the correct answer

[waxen totem]

which module and section is this from?

[tulip urchin]

introduction to networking

from network foundations

[meager yacht]

Hello everyone!

I'm stuck on a question from the "Introduction to Command Line" module in the "Managing Services" section, and I have used the two possible answers so far.

The question is: What command string will stop a service named 'red-light'? (full command as the answer).

I answered sc stop 'red-light' and it's marked as incorrect. Then I tried the command Stop-Service -Name 'red-light' and it's also being marked as incorrect.

I need your guidance.

[devout lily]

Hi everyone, the File Transfer module is more indicated for exploitation phase or post-exploitation phase?

[tulip urchin]

nvm Ill watch a youtube video

[waxen totem]

Looks like that's the correct answer, maybe check for leading/trailing spaces and try different capitalization forms

[devout lily]

?

[waxen totem]

I'd say post-exploitation, because you usually only ever transfer files if you already have a foothold

[devout lily]

In the penetration tester path this module appears after the Vulnerability Assessment

[waxen totem]

They never said that the modules were in the order of the process

[devout lily]

they have called it "path"

[waxen totem]

Active Directory Enumeration and Attacks is before Web Attacks but more likely than not you'll have access to Web first if it's a fully external test

[waxen totem]

because they put it in the order they think is best to learn, not in the order in which it's actually done.

[devout lily]

got it

[meager yacht]

Guys

And I also tried with net stop and nothing

[brave field]

Remove the single quotes from your first answer and then try.

[meager yacht]

Thanks a lot.

[brave field]

In cmd, you should use double quotes " instead of single quotes when your service name (or any argument) contains special characters or spaces. Single quotes ' don’t work the same way they do in Linux shells like Bash.

However, if you’re in PowerShell, both quotes work fine.

[meager yacht]

I see

i'm going to write that down

[slate matrix]

Hi new here

[fossil jacinth]

You need credentials for that one

[scenic arrow]

Oh, I have the creds, but I just can't seem to be able to actually use the exploit within msfconsole 🙁

[fossil jacinth]

Hmm ... did you set the vhost ?

and the rhosts

[fossil jacinth]

Ohh ... Actually you can't "use" the module itself. My bad
You need to reload_all in msfconsole - to reload all modules

Or as an alternative, you can specify the folder (I believe it's saved somewhere on the box itself - or maybe you have it in your kali) with -m /home/FolderPath and then search with the filename

[scenic arrow]

Ahh, okay sweet. Thanks!

[fossil jacinth]

😉

[fathom pendant]

module is above tier 0 also don't share info about skill assessments @scenic arrow

[scenic arrow]

Apologies! Will know for next time.

[calm abyss]

Try OneShot

YOu still need help with this one ?

I finished today, you still need help ?

[limber dawn]

Hey guys, trying myself with module getting started n having some troubles with Public Exploits, mb someone could help me with understanding of finding services?

[fathom pendant]

You're over thinking it, youre given a public ip and a port. That is the only port you need to concern yourself with

[limber dawn]

okay, ty

[uneven lava]

Anyone up for a quick question on ai evasion - foundation?

[cyan arch]

Hi, stuck at bopla / mass assignment one in api attacks, I can create order but I get error when creating items, and really can't figure what's wrong here?.

[wintry sonnet]

Make sure you're populating the right OrderID and ProductID, the OrderID is the ID of the order that you created (obviously) and the ProductID has to correspond to the correct product in /api/v1/products

[lyric agate]

Guys, how to learn unethical hacking?

Blackhat hacking*

[acoustic owl]

I think you're on the wrong server. Please read #rules.

[rich salmon]

Hi guys. I'm currently doing the malicious document analysis and i'm currently at the analysis of XLL Add-ins. After 6 hrs i somehow managed to get the bin file but when i try to run speakeasy i keep getting the "invalid instructions" error. I've tried speakeasy with different options but i still get the same error. Can somebody help pls?

[grave jackal]

If anyone is free I could use a nudge on Attacking Common Services SMTP, I've been trying to get q2 for a few hours, and with a lot of experimentation, I still don't have the creds for the found user.

[fathom pendant]

Adjust the wait time

[grave jackal]

that did it thanks!

[fathom pendant]

@drifting hazel thats illegal, and we dont do that here

[twilit cipher]

Has anyone complete the "Jailbreaks II" module in "Prompt Injection Attacks" module? I have tried everything in the module, read the papers it references and tried a few things from there as well. Any help would be appreciated.

[zenith canopy]

Module name: Attacking common services. When we enumerate users on SMTP or POP3 with the USER command or VRFY, does a returned name like john refer to an email address for that domain or OS level account?

[fathom pendant]

It refers to name registered in the email, such as john@domain

SMTP/POP3/IMAP are all mail protocols, so i wouldn't make broad assumption that its an OS level account when the account could just be somewhere in the system

Its hard to make sweeping generalizations as well

[zenith canopy]

Okay, so it refers to an email account for that domain. I was confused because in the module they brute force the POP3 service using just john instead of [e-mail]

[fathom pendant]

That could be how its set up on that service, and the @domain could be appended on the backend portion instead of being required on the front

[woeful topaz]

Can anyone help me out a but, right now I am own my penetration tester path but In the module of pivoting and tunneling, I am sending one dll file for socks over rdp but it's gettting deleted by AV even the thing is mentioned in the module course, but machine is deleting it, and I am not able to solve the challenge.

[fathom pendant]

As i said in #cpts, its real-time protection thats running - gotta disable that first

Google should be your first stop if you're gonna ask how

[woeful topaz]

not that dumb, but thanks!!

[zenith canopy]

thank you!

[woeful topaz]

But tell me one thing, are we allowed to turn it off during our exams?

[fathom pendant]

Do what is required to get what you need done. You will be given a scope that tells you what you can't do

[woeful topaz]

Cool, Thanks!!

[worthy condor]

Hey I am having problems with this question in network foundation, I am pretty sure the answer is p2p but it doesnt seem to work in any way

What type of architecture allows nodes to act as both client and server?
https://academy.hackthebox.com/module/289/section/3242

There was another person in the past having problems with another question in this same module, I am slowly losing my mind on this

[fathom pendant]

it's not asking for the shorthand it's asking for the full word-for-word

[twilit cipher]

Nevermind, I got it, but I am not sure it was the intended way...

[twilit cipher]

Just for funsies, along with the flag, I got the lab to write a poem about HackTheBox Academy with "flowery" language:

In a field of beauty, where petals sway,
A rare bloom of knowledge, in a special way.
HackTheBox Academy, a place to explore,
Where flowers of wisdom, forever bloom more.
With every petal, a lesson is learned,
And in its center, a hacker is yearned.
A flower of knowledge, that's what it is,
HackTheBox Academy, a place to grow and rise."

[worthy condor]

I must've mistyped it and dismissed that, it worked now, thanks

[frosty crescent]

Not sure if this is the best place to ask, but I have the student plan on HTB academy, does the VIP plan on HTB Labs add an extra $18 a month or does it include the student plan

[twilit cipher]

Pretty sure it's extra. But not positive...

[frosty crescent]

makes sense

[dire lily]

Hello, I have a quick question about Wappalyzer.

In the HTB module screenshots, Wappalyzer shows the Web Server and Programming Language, but on my VM, it only detects the CDN and jQuery for the same target.

I also noticed nmap shows the ports as filtered. Is this filtered status the reason why Wappalyzer isn't showing the backend tech details?

[cloud urchin]

Academy and Labs are two different platforms, two different subscriptions.

[frosty crescent]

thanks

[viral yoke]

Just daily reminder you don't have to be working on academy like a regular high school day your brain retains information if you were to work for an hour and then take a break for about 30-50 mins maybe total work time a day 3-4 hours give your mind more time to think on it

[unborn stream]

@everyone I hope someone is up and available to help me with an issue i am having. about answering a question in the "Linux Fundamentals"

[cyan arch]

Yeah, guess I was sleepy yesterday. Started again today and realized we could see the products. Thanks mate 👍

[daring wigeon]

Hello can y'all hack servers

[rustic quiver]

anything i did wrong? enabled ssh and everything. And I tried connecting with th http server but it refuses to connect back to me.

[autumn pilot]

You have a typo, look carefully at the end of your command

[rustic quiver]

Thank you so much

[civic sinew]

Hi everyone, I'm taking the SQL Fundamentals Skills Assessment in CWES. I found the hash for the admin, but when I submit it as answer, I get that the answer is not correct. I even looked at the solution, and it's seems the correct hash. I checked the spaces before and after it and also removed the first part of the hash. Could someone help me with this? I am afk for now and will look later. thank already!

[junior halo]

how u got that hash, any hints . I tried all the paylaods but failed

[civic sinew]

@junior halo yes, start with || ')|| and then follow the course material to get table data etc.

[wicked apex]

Domain Compromised in AEN!
Is there more than one route from DMZ that I can get my way to Domain admin?
Cuz I heard that cpts exam is more linear

[near breach]

Thanks. I just switched to a different computer and everything worked)

[vocal schooner]

Hey, i have to extract KRBTGT Account's NT Hash using mimikatz, but i can't :/ why ?.

In this section :
https://academy.hackthebox.com/module/143/section/1457

I'm logging to htb-student_adm

[boreal raven]

I am also facing the same issues, have completed other question. Seems like the module issue

[dusk holly]

what is best module i can buy in CAPE path for 500 cubes (other than kerberos attacks)?

[drowsy grove]

Hey, if any staff are around you might wanna take a look at the Dynamic Port Forwarding with SSH and SOCKS Tunneling module, the second host seems to be down

Same on my local machine, same on the pwnbox

can't access it from the pivot host

[fathom pendant]

iirc you should be using the lab_adm user, not htb-student_adm user iirc they don't have the same rights/privs

either that or you need to run powershell as admin

[onyx herald]

Hey guys. Is it just me or someone also have a similar problem. I have been working on the password attack module and under Pass the Certificate section all the IP addresses that i am being provided are not working.
The error message is always the host is down and unreachable.

I have done some parts but now not working at all.
Its either you get a connection for a few minutes and drops or one host will be up and the other one down.

How can i fix this?

[fathom pendant]

reach out to website support; i'd also check to make sure you don't have multiple vpn connections running

[fathom pendant]

also don't cross-post to multiple channels

[boreal raven]

I am Stuck on the module Skills Assessment - SQL Injection Fundamentals
the First question "What is the password hash for the user 'admin'? Have obtained the hash but that is not working."

Rest of the question including the last flag is completed but this gives me error, can someone please guide me on this

[runic nacelle]

Hello can anyone Help me with file inclusion
Skills Assessment - File Inclusion I can't bypass this
if (isset($_GET["region"])) {
if (str_contains($_GET["region"], ".") || str_contains($_GET["region"], "/")) {
echo "'region' parameter contains invalid character(s)";

[green musk]

Can nudge you with the following:- there are 2 vulnerable endpoints where one does file read and one does execution

[green musk]

Dm check

[runic nacelle]

thanks for the help let me keep digging

[strong spruce]

Hi, I have a question for the Brute-Forcing Password module in the Broken Authentication course.

Towards the end of the module, is says, "Upon providing an incorrect username, the login response contains the message (substring) "Invalid username", therefore, we can use this information to build our ffuf command to brute-force the user's password:"

I double-checked the error message I get on the deployed machine and for an invalid username as well valid username but invalid password, the message is the same: "Invalid username or password". Thus, when I built my ffuf command with this message, I get nothing

I tried the steps as mentioned in the module and though I got the password, I am curious as to this discrepancy. Am I not understanding it correctly ?

[hardy jacinth]

can any one assist me how to install adb?

cause I try to install it by sudo but I couldn't

[boreal raven]

i solved it copy the whole thing

[fathom pendant]

so sudo apt install adb doesn't work? it helps to know errors of some form that may be helpful in diagnosing the issue

[gray yacht]

You might need to run sudo apt update, then sudo apt install adb

[civic sinew]

@boreal raven what is whole thing including p= or even more?

[gray yacht]

It should match either. You can DM your input and output if you are not getting the desired results.

[nimble tangle]

hey in the attacking common services easy skill assessment trying to brute force the rdp and ftp with the user and pass lists in the resources gave nothing any help with that ?

[green musk]

Which tool you using?

[inland oak]

hi ,,
anyone can help me since im stuck on this module almost 1 month.
I need help with module Window Privilege Escalation , the question is " What service is listening on port 8080 (service name not the executable)? "

[vocal schooner]

.\PingCastle.exe -h
The program is unsupported since: 2025-07-31 00:00:00Z)

https://academy.hackthebox.com/module/143/section/1460

[nimble tangle]

nxc

[inland oak]

anyone................

[green musk]

Try hydra or Medusa they may work

[green musk]

Which sub topic?

[inland oak]

Initial Enumeration

I hv tried everything.. now exhausted

please gimme any hint

[green musk]

Did you see if that service is open using netstat -ano commad?

[nimble tangle]

with the user and pass list in the resources ?

[green musk]

Its skill assessment so you should not rely on it but you can try if it works or even finds you valid user

[inland oak]

i tried run inside the RDP and yes it show port 8080, but I dont see the service name..

check this out

[green musk]

It won’t let you see the service name try to look around on program files or x86 to see installed applications?

[inland oak]

ok ..

[green musk]

Whenever you see some ports open specially 80,443 or 8080 your first instinct should be to look for installed services

[fathom pendant]

use tasklist to find it

https://stackoverflow.com/questions/48198/how-do-i-find-out-which-process-is-listening-on-a-tcp-or-udp-port-on-windows this is an interesting SO

[fathom pendant]

this is also a case where you should be able to use built-in tooling to find it not just exploring what's installed. (you also don't know if there's multiple 'installed' services, but not running)

[devout pumice]

Hi who do I contact about a billing issue. I emailed customerops. They replied asking for more info and seem to have gone into a blackhole, no longer responding to emails.

[hexed lintel]

open ticket, you will get faster reply

[latent marsh]

Can someone help me with Blacklist filter in File upload module - I have tried different extension and some of them says "upload successful" and tried using GET request but I get php code a output

[devout pumice]

@hexed lintel thanks

[mint rover]

Module: API Attacks
Section: Broken Authentication
Question: Exploit another Broken Authentication vulnerability to gain unauthorized access to the customer with the email '[e-mail]'. Retrieve their payment options data and submit the flag.
Problem What I am supossed to do with the Password Reset & OTP Endpoints here? 🙂

[gray yacht]

Look at the request body parameters for each endpoint to determine what you are supposed to do with them.

[nimble tangle]

hey in the attacking common services easy skill assessment trying to brute force the rdp and ftp with the user and pass lists in the resources gave nothing is there anyone who solved that lab might hint me please?

[gray yacht]

If you don't have a username identified yet, try to enumerate other services.

[quick folio]

In the new UI there is no resources button. FYI

[nimble tangle]

@gray yacht can i dm you please

[leaden rampart]

I am running kali-arm64 in my MacBook and i have the BloodHound CE v8.2.0 running. The BloodHound UI have no Analysis tab, and does not automatically render a graph view. Does your BloodHound CE behave the same way?

[gray yacht]

Sure

[wheat orbit]

One message removed from a suspended account.

[hollow kernel]

you can transfer the txt

[stoic anchor]

Hey everyone, I'm working on the new file inclusion skills assessment and could use a small hint. I've successfully identified an Arbitrary File Read vulnerability, which I used to discover an Unrestricted File Upload vulnerability. I can upload a PHP shell to the /uploads/ directory and can predict its MD5-hashed filename. However, direct access to the shell is blocked by a deny all rule in the Nginx configuration, resulting in a 403 error.

I feel like I'm just one step away but am missing a small detail. Any pointers would be appreciated!

UPDATE:

Look at the contact.php source code page 😉

[wheat orbit]

One message removed from a suspended account.

[hollow kernel]

pyhton -m http.server port and i your machine wget://victimip:port, you can see this en transfer methods

[wheat orbit]

One message removed from a suspended account.

[hollow kernel]

or try to do python -c 'import pty; pty.spawn("/bin/sh")' to give a interactive shell in linux

[wheat orbit]

One message removed from a suspended account.

[wheat orbit]

One message removed from a suspended account.

[zenith canopy]

Module: Attacking common services, does this mean that both entries are linked servers, but isremote = 0 means it is another database instance on the same machine?

[tiny pendant]

hello guys!
i am on the passwords skill assessment
i got creds from DMZ01 and pivoted using ligolo everything is working fine but i cant rdp into the next target?
i added everything into etc/hosts but still getting an error. nmap shows the port is open and NC shows the same

[brave field]

https://learn.microsoft.com/en-us/sql/relational-databases/system-compatibility-views/sys-sysservers-transact-sql?view=sql-server-ver17

[green musk]

Sometimes ligolo doesn’t work so if you can do local port forward

[brave field]

try with xfreerdp3

[rustic geode]

what is the best free nmap course

[dawn gazelle]

This is going to be a very generic, often asked question, but i want to know. Where should i start learning if i want to become advanced in this field?

[gray yacht]

Doesn't matter if the port is open and service is running. Are you sure the user creds you've harvested can gain remote access to that host? Have you tried those creds against all hosts? What is a JUMP server generally used for?

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[storm elk]

👆 @dawn gazelle

[dawn gazelle]

Oh w

[junior halo]

need help in File inclusion assesment , got lfi but cant escalate iut further , any hints

[boreal raven]

Paste the whole line you got not just the hash

[heavy slate]

AI Data Attacks + Pickles and Stenography - can i do it in Pwnbox or do i have to set up my own linux vm?

[meager hill]

any tips on the LLM Output attack final assignment? Stuck for days

[fathom pendant]

there are multiple targets; only one is able to be rdped into i suggest checking with nxc and the creds you have :)

[noble spire]

hello I tried using your method, which involves using the password provided in the example (“pentester3”), but it neither enabled OTP via SMS nor OTP via email. I also tried brute-forcing the password.

Additionally, I attempted to brute-force the OTP while passing the correct endpoint for the password reset, but that didn’t work either.

this is the quations in api attacks Broken Authentication
Exploit another Broken Authentication vulnerability to gain unauthorized access to the customer with the email '[e-mail]'. Retrieve their payment options data and submit the flag.

[plain summit]

Is there a module for Immunity Debugger setup/mona setup?

[plain summit]

Stack-Based Buffer Overflows on Windows x86?

[zenith token]

Hello There
I am currently working on the Module "Cracking Passwords with Hashcat" section "Cracking common hashes".
Could anyone give me some help regarding the question of cracking the following hash: 7106812752615cdfe427e01b98cd4083 ?

[tawny quiver]

I am working on the password attacks module. I'm logged into HTB on a Kali VM and I tried downloading the vpn link, starting the machine, but when I try to launch the openvpn file it just stops here:

[oblique plume]

Is there a module admin I can speak to about some lab issues I experienced in the Attacking WPA3 Wi-Fi Networks module? The training does not correctly outline the TTP for OWE Evil Twins

[junior halo]

i got aceess the panel , now getting confused between prameters . cant see anonmaly clearly , any hints for sql fundamentals skill assesment

[fathom pendant]

if you're having lab issues it's best to reach out to website support

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

this is expected behavior; open a new terminal and you should be good to go

[rare condor]

hi

https://academy.hackthebox.com/module/115/section/1139 why is this lab so slow ?```The Live Engagement

Working through the foothold is quite painful (it's extremely slow and keeps freezing up).

sometimes I think the paths haven't been updated .

[wicked girder]

That means you're connected. The terminal is working currently with the command 'sudo openvpn "your_file_goes_here"'

You can open another terminal or use 'sudo -b openvpn "your_file_goes_here"' instead

[errant moss]

Hello!
I could use a hand on

Active Directory Enumeration & Attacks
Attacking Domain Trusts - Child -> Parent Trusts - from Linux

I'm supposed to get the NT hash of user "bross" but so far not going so well and I think I'm missing something. Anyone available to help?

[uneven lava]

Did you solve it?

[hidden ledge]

java/jsp_shell_reverse_tcp try this one with a netcat listener, I had same issue for some reasons

[tiny frigate]

In Active Directory Enumeration & Attacks > Credentialed Enumeration - from Windows ( https://academy.hackthebox.com/module/143/section/1421 ), I can't connect to the target? I copy-pasted IP, username, and password to be sure, and tried both xfreerdp and xfreerdp3 after installing that on Pwnbox...what am I missing here?

Never mind, just had to reset the target AGAIN, lol

[glacial minnow]

could someone hint me on why my php code is not executing, i managed to bypassed the filter and i ive tried null byte char and still didnt execute

[fathom pendant]

Perhaps that extension doesnt work, also null byte stuff is a pain the ass, dont use it if possible

Also; your php code isn't taking any parameters

[glacial minnow]

yeah but that's just 1 attempt, i forgot to remove the query param

[warm knot]

Need help with connecting using the vpn for the academy modules. Is this the right place to get help?

[cloud urchin]

You can ask here but the website is the only official support

This is a good article https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

[warm knot]

Yup, did everything in that guide. The issue is I'm getting a no route to host despite the routes being established.

(base) ┌──(nuvious㉿kalimini)-[~/Code/HTBAcademy]
└─$ ip route                    
default via 192.168.11.1 dev wlan0 proto dhcp src 192.168.11.204 metric 600 
10.10.8.0/22 via 10.10.14.1 dev tun0 
10.10.14.0/23 dev tun0 proto kernel scope link src 10.10.14.2 
10.129.0.0/16 via 10.10.14.1 dev tun0 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.11.0/24 dev wlan0 proto kernel scope link src 192.168.11.204 metric 600 
                                                                                                                                 
(base) ┌──(nuvious㉿kalimini)-[~/Code/HTBAcademy]
└─$ ssh htb-student@10.129.71.56
ssh: connect to host 10.129.71.56 port 22: No route to host

This is in the linux fundamentals section. The instance is reported to be up under that specific IP, it just isn't connecting even though the route is populated.

Going to try restarting the instance, but given it's a routing issue I'm not sure that will do anything.

Bounced it again, got a different IP but same result.

[cyan veldt]

can anyone help me in using web proxies Repeating Requests section?

idk which one of these are the flag

(its not flag.txt)

[waxen totem]

It should be flag.txt, check for trailing and leading spaces

[cyan veldt]

its not

[waxen totem]

Ohhh

[cyan veldt]

any clue?

[waxen totem]

hold on it's been a while since I've done that module and I don't have notes for it

[cyan veldt]

can u give me the flag if u have done it

[waxen totem]

No, sharing flags is not allowed

[waxen totem]

Ok so just look around in the root (/) directory using the command injection.

[warm knot]

Just another prod at the above. Is there a more formal support channel for more technical issues like this? Can get by using pwnbox but would prefer to use the VPN route. No worries as well if someone's looking into it and just hasn't had a chance to respond.

[waxen totem]

There's no official support on disscord

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[warm knot]

Thanks!

[cyan veldt]

Thanks!

[rain mirage]

PIVOTING, TUNNELING, AND PORT FORWARDING
Skills Assessment:

In previous pentests against Inlanefreight, we have seen that they have a bad habit of utilizing accounts with services in a way that exposes the users credentials and the network as a whole. What user is vulnerable?

i saw the hint it says i will probably get the password in the lsass , so i assume that i need to transfer the lsass to my attacker host and decrepit it ... so to transfer the lsass i tried .. transferring nc (its not accepting any packets) , scp (did not work) , and i have tryed alot to somehow get the lsass to my attacker host but cant .

any hint ?

[cyan arch]

Hey, stuck on api attacks skills assessment. I have broken access on products but nothing too interesting from there. Then I see a way to reset supplier password , got a list of interesting emails (5) and tried seclists htlm-colors as well as custom wordlist but still can't seem to crack reset their passwords? Could anyone give me a nudge?

also tried sqli there but failed

[leaden basin]

morning all 🙂

[green kernel]

There's no official support on disscord

[devout lily]

Hi everyone, does someone know how to solve this?

VM language is italian

[wanton ferry]

Bounced it again, got a different IP but same result.

[cyan veldt]

do I add the DIRECTORY path?

or the request should include that?

[crystal cliff]

[daring lava]

Hi, i'm in the Getting Started module of the Penetration Tester path. In the Basic Tools section there's an optional exercise at the end of it, that says to grab the banner of the server. I run this netcat on port 22 and it gives me

SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7

However when I reveal the answer on the exercise, it says the answer is
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1

[prisma flame]

Hello

[daring lava]

I want to include a screenshot but I think I'm unable to haha

Nevermind, I'm an idiot. I figured it out. TY!

[fathom pendant]

you need to connect your htb account in order to include screenshots

[worthy sorrel]

anyone solved file inclusion updated skill assessment

[dry falcon]

yep

[worthy sorrel]

Can you help a bit I got the param got lfi able to read logs put a webshell unable to execute it

[worthy sorrel]

..

[dry falcon]

sure

[worthy sorrel]

How we will get it exeucted

[fathom pendant]

make sure you use the proper quote type :)

[gray yacht]

I'd focus on trying to abuse an endpoint the resets a password and requires more than one parameter. If that is to broad, you can DM.

[weary crow]

Can someone help me out on the graphql module

[green musk]

back and forth might lead you

[green musk]

if you had read the code of contact.php you might see why it fails

[green musk]

some files get decoded and in order to achieve execution you need to send encoded payload

[weary crow]

Hey 👋🏼

[wooden ivy]

Android Application Dynamic Analysis > Dynamic Code Instrumentation > Hooking Native Methods is using Frida 16 and Module.findBaseAddress('libangler.so'); in its Code Snippet. However since Frida 17 this method was removed and replaced by Process.getModuleByName('libangler.so').base. Using the Frida 17 approach I'm always getting Error: unable to find module 'libangler.so'. Does someone have a working snippet for this module?

[silent basin]

Attacking Windows Credentials…..Can someone help me understand how we get minkatz onto the target system???

[hollow kernel]

Study Transfer methods module

[weary crow]

Can someone please help me,I'm stuck on attacking graphql

[green musk]

Can someone nudge me with sql injection skill assessment like after doing the first step I’m struggling to find valid link where sql is vulnerable I tried every damm SQLi discovery on both search boxes

[fathom pendant]

it helps to know the module and section

[green musk]

Basically I got to know which sqli discovery is being blocked by site but I’m still struggling to find the parameter 🥲

[fathom pendant]

what is the module name dude.... you saying sqli doesn't narrow shit down LOL

[green musk]

Skill assessment of sql injection

[fathom pendant]

sql injection fundamentals???

there's multiple 'sql injection' modules

[green musk]

Yes man my bad

[fathom pendant]

i take it you found a way to log in already

[green musk]

Yes i did

[fathom pendant]

try manipulating the q

[worthy sorrel]

I did and did not get it tbh

[green musk]

Files gets converted to something when uploading and for executing try some encoding

[worthy sorrel]

Uploading?

[weary crow]

Hey bro can I some help on attacking graphql module

[worthy sorrel]

In file inclusion. We have to upload the file

There is no upload.php I tried accessing but this page does not exist

Oh okay

There in the pdf

[fathom pendant]

take it to dms so we're not spoiling module content above tier 0 😉

[worthy sorrel]

Oh okay going to do it but for reference can I dm so

[worthy sorrel]

Sure my bad

[green musk]

Done

[fathom pendant]

in order to have others be able to better help you it's best to at least describe your issue; this can include adding things like basics that you tried, and what section you're working on

[weary crow]

I'm working on the first section of the module