modules

[fathom pendant]

took less than a minute to do what it says to do in the reading

not grabbing the whole screen since it contains the answer

[coarse pine]

just cuz you did it before

[fathom pendant]

not even remotely

[coarse pine]

you have notes

[fathom pendant]

I literally only did what it said to do in the last paragraph of the reading

the parapraph starting with; Attempting to log in

the only thing my notes have is just what the page says paraphrased

[coarse pine]

I got it in my way

I always do

[fathom pendant]

that's not always gonna be feasible

especially if you're on an actual engagement and not a training site

you're not gonna be able to spam guesses on an actual engagement

[coarse pine]

you are not helping at all btw

[fathom pendant]

You just refuse to accept the fact that you massively overcomplicated the problem

[coarse pine]

the only two modules I found talk about LDAP are TEIR 3

[fathom pendant]

those are modules explicitly named LDAP and such

[coarse pine]

even so you are not helping

[fathom pendant]

it's talked about in Windows Fundamentals, and even Intro to active directory

[coarse pine]

I don't like you

[fathom pendant]

https://academy.hackthebox.com/module/details/74;

you can not like me, don't care. I'm not gonna coddle you.

Since you bruteforced the answer do you want me to dm you what it expected you to do?

[coarse pine]

sorry I don't understand you anymore

for some reason

oh

if you are going to be rude don't DM me

[fathom pendant]

it means i'm not gonna 'be gentle' with you for failing to do the bare minimum of reading the page.

I'm not gonna be rude, unless you count me messaging you the paragraph that explicitly gives instructions as rude

The reason I declined the DM earlier is because I had a feeling you just wanted the answer instead of the way to reach it

[coarse pine]

I was shocked

XD

OOHHHH I see now

[dire flint]

Hi guys, Can someone give me a hint for the last question for the Windows lateral movement SA's last question What's the content of the flag located at DC C:\Users\Administrator\Desktop\flag.txt? I tried a lot of things with the VNC from backup but i could not do anything with it...

[coarse pine]

it is not fair to test someone about thing he did not hear before anyway

without even teaching him

[fathom pendant]

as was explained before, the reading does teach you about LDAP and everything you need to know to complete the task

[rugged swan]

Can I DM anyone to ask a question about the official solution of Attacking common services - Medium assessment? There's something that doesn't make sense at all to me in the solution. Thanks

[cloud urchin]

Sounds like you are on the right track. You can DM me if you want.

[coarse pine]

they don't

they just talk about ldapsearch

[dire flint]

On my way :D

[fathom pendant]

they quite literally do talk about LDAP

in the first paragraph I fear

and they explain how LDAP injection works

[coarse pine]

not true

this does not make any since

oh God

[fathom pendant]

you don't have to think too deeply about it

[coarse pine]

now I feel bad because of you

[fathom pendant]

not my problem i fear. I am not the cause of this, it's yourself to blame

[coarse pine]

maybe

[fathom pendant]

LDAP Injection
is a part of the reading btw

[coarse pine]

but I still feel bad

[fathom pendant]

the goal of the question was also clear: "After bypassing the login"

[rugged swan]

@fathom pendant can I DM you? I don't want to ask for solutions/hints but I think there's something wrong in the official solution of an assessment..

[fathom pendant]

that heavily depends on the module, as

1. I'm not staff
2. I'm not staff
3. I haven't done all the modules

[sand valve]

@coarse pine did you solved ?

[coarse pine]

I always do

[sand valve]

Nice btw i think i found a solution for your problem

But i wasn't sharing cuz didn't wanted to ruin ur learning

[fathom pendant]

She just bruteforced it

instead of actually doing the thing that's simple

[sand valve]

Just tell her

[fathom pendant]

funny thing is I PASTED THE EXACT MODULE TEXT lol

she just got hung up on something irrelevant to the goal

[sand valve]

@coarse pine

@coarse pine

[fathom pendant]

already resolved

with many such caps lock from me LOL

whether or not lessons were actually learned are tbd

@coarse pine keep it relevant to the channel

[sand valve]

I saw that @coarse pine

Htb socks huh

[clear roost]

hello, i am on LLMNR/NBT-NS Poisoning - from Windows - for some reasone i just cant connect to the windows machine via rdp. its always says faild to connect . any one have this problem too ?

[fathom pendant]

there's usually more to the error than 'failed to connect'

[clear roost]

xfreerdp /u:htb-student /v:10.129.248.50 /p:Academy_student_AD!
[21:48:51:267] [4391:4392] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[21:48:51:267] [4391:4392] [ERROR][com.freerdp.core] - failed to connect to 10.129.248.50

this what i get

[fathom pendant]

reset the vm

also wrap the password in single quotes just to be on the safe side

[clear roost]

got you , thanks i will do it

[clear roost]

i reset the vm and wrap the password now all get is black screen, any solution ?

[fathom pendant]

press enter

:)

[sand valve]

Now i understand how marcilee feels , helping in modules

Respect.

[clear roost]

my bad hhhh ,thank you

[fathom pendant]

no problem; the explanation is that for whatever reason xfreerdp doesn't draw the Acceptable Use Policy Screen (you can sometimes get it to do so if you use /dynamic-resolution and resize the screen)

[warm horizon]

Hi,

I’m stuck on the Web Fuzzing Skill Assessment and I believe the instance might be broken.

I’ve reset the target several times and followed the module step by step.
Using ffuf with SecLists (common.txt), the only endpoints I consistently find are:

• .hta → 403
• .htaccess → 403
• .htpasswd → 403
• /admin → 301
• /server-status → 403

There are no endpoints returning 200 or any response size deviation that could lead to the flag.
I’ve been testing different filters and wordlists with the same result.

Could you please confirm if this instance is working as expected or if there’s something else I should test?

Thanks.

[wispy rock]

Try gobuster

[warm horizon]

sorry

[cyan veldt]

Attacking graphql, Information Disclosure
https://academy.hackthebox.com/module/271/section/3152
'After executing an introspection query, what is the flag you can exfiltrate?'

can anyone help?

[warm horizon]

Skill Assessment container is broken.
robots.txt returns default Apache 404,
no accessible endpoints found,
discovered files return 404,
admin always Access Denied.
Please reset instance.

Hi guys, I need some help with the Skill Assessment.

I’ve been stuck on this for many days and I believe the instance may be broken.

What I already tried:

Directory fuzzing with ffuf using common.txt

Directory brute-force with gobuster

Manual testing with curl (GET, POST, PUT, OPTIONS)

Parameter fuzzing (param=FUZZ)

Header bypass attempts (X-Forwarded-For, X-Original-IP, User-Agent, etc.)

Results so far:

/admin always redirects (301) and then returns Access Denied

All other discovered paths return 404 or the same response

robots.txt returns a default Apache 404 page

No endpoint returns different content or exposes a flag

At this point, I can’t find any accessible page that leads to the HTB{...} flag.

Am I missing something obvious, or could this Skill Assessment instance be broken?
Any guidance would be really appreciated. Thanks 🙏

[cloud urchin]

Modules are private instances, it's more likely you're not doing something right

always best to say which module, section, and question you're on, otherwise no one knows.

[mighty matrix]

Thanks

[warm horizon]

Module: Web Fuzzing
Section: Skill Assessment

Description from the page:
To complete this Skill Assessment, we need to apply the tools and techniques covered in the Web Fuzzing module. All fuzzing should be done using the SecLists common.txt wordlist located at /usr/share/seclists/Discovery/Web-Content.

Question:
After completing all steps of the assessment, a page should be displayed containing a flag in the format HTB{...}. What is that flag?

What I’ve tried so far:

• Directory fuzzing with ffuf and gobuster using common.txt
• Parameter fuzzing on discovered endpoints
• Manual testing with curl (GET, POST, OPTIONS, PUT)
• Header manipulation (X-Forwarded-For, X-Original-IP, User-Agent, etc.)

Results:

• Most paths return 301, 403, or identical 200 responses with “Access Denied”
• Admin endpoint always redirects or denies access
• No unique response or page displaying a flag has appeared

At this point I feel I may be missing a specific technique or detail from the module.
If anyone could provide a hint or point me in the right direction, I’d really appreciate it.

[cyan veldt]

?

[fathom pendant]

Dig around to find and expose secrets

[mighty matrix]

ip isnt pinging and I am connected to the vpn

[cloud urchin]

you don't provide enough info to be given help

there could be a million reasons as to why that is happening

for example, did you spawn the target? is that the right ip?

maybe it just doesn't respond to pings and you're not supposed to rdp anyway

could be your routing, etc

[mighty matrix]

Yeah it is the right IP, I reset the IP as well and it says to RDP to that IP. The module name is Windows Event Logs and I have re downloaded the vpn file too

[cloud urchin]

did you use the pwnbox at the same time, or recently?

[mighty matrix]

yeah I did

recently

but I didnt use it for this exercise/module

[cloud urchin]

try killing the vpn, kill the target, re-download the vpn file and use the new one to reconnect. then re-spawn the target and try again.

[mighty matrix]

thanks. I basically did that. Had to use another locations vpn too

[cloud urchin]

did it work?

when you switch vpn locations the target spawns in another location so you probably need to hard refresh the site

[mighty matrix]

it did work. Suddenly I connected to rdp and just as I wass about to start doing things it closed and now I cant even ping the IP 🤦

[mighty matrix]

Hi, I am stuck on this question the first section of windows event logs any tips/advice on how to approach it would be nice

[candid bough]

Still need help?

[void kayak]

it just happened to me as well. weird. Came here to check if it's not a maintenance thing. I changed the vpn location without success already. Not a big deal

[mighty matrix]

Yes please

[mighty matrix]

Yeah, dunno what it was. Anyways it worked, although it was a big hassle

[mighty matrix]

If u could dm me some tips for it that'd be awesome. Module literally didnt cover any ways of making XML queries in event viewer

[candid bough]

Ok

[viscid bolt]

For Intro Intro to C2 Operations with Sliver - the "Kerberos Delegation & Enumeration", anyone else having issues using psexec like shown in the module. Hangs on file upload for me

[full echo]

What Type of Naive Bayes Classifiers are you using?

Look closely to how the http request is constructed.

[pure osprey]

DM me

[rotund sequoia]

Password Attacks - Attacking Windows Credential Manager

How come ||mimikatz|| didn't work but ||LaZagne worked||? Also what was the hint for that section, I already submitted the answer so I can't see it anymore.

[bitter notch]

I am needing some help on this Windows Event Logs but not able to post a picture or screenshot.

By examining the logs located in the "C:\Logs\PowershellExec" directory, determine the process that executed unmanaged PowerShell code. Enter the process name as your answer. Answer format: _.exe

I have tried injecting the unmanaged Powershell-like Dll into another process as shown earlier in the module but cant seem to find the .exe I am looking for in the logs. I changed the sysmonconfig.xml as well but not sure where to look next.

Nevermind, I was able to use a Get-WinEvent command to find my answer.

[fathom pendant]

One hooks into different libraries. Also if you refresh the page it'll allow you to click the hint

[junior helm]

Does anyone have RDP connection in LDAP Overview section like me? I can't sign in with provided credential.

[fathom pendant]

Shouldn't need to specify domain as ws01

[junior helm]

It's not working too 🙁

[autumn pilot]

Have you tried to get an RDP connection using the workstation provided (e.g., pwnbox)?

[junior helm]

I just tried it 😄

[autumn pilot]

Switch to the EU VPN servers and if it still doesn't work reach out to support

[hasty mauve]

Module: Active Directory Trust Attacks
Section: Skills Assessment
Question: Gain access to the DC05 (Fabricorp.ad) and submit the contents of the flag located in "C:\Users\Administrator\Desktop\flag.txt"

I'm stuck at this question, which is the last one, can anyone help please?

[digital pendant]

Might not be a reason but for sake of future encounters with special chars in passwords, wrap them in single quotes using xfreerdp

[brave field]

dm me

[little terrace]

why doesnt the linux priv esc teach linpeas? or have i not gotten to that part?

[knotty granite]

It’s either you haven’t gotten to that part or it’s the fact that linpeas is easy to understand and execute

[acoustic oak]

Hello for the web proxying module, is this the best place to discuss bugs found or do I reach out to the chat window on the site?

[knotty granite]

This is a good place

[marble quiver]

In the File Upload Attacks Skills Assessment: How do you guys capture the Post request when uploading something?

I only see the GET

[digital pendant]

#1234357888114364508 is where module specific bugs are often discussed, create a thread, show the bug and the owners/staff will/may act after

[junior helm]

It's seem like you have to put INLANEFREIGHT.LOCAL in username

[worn sun]

weird tho shouldn't the machines be locally connected anyways

[junior helm]

Thank you @fathom pendant @autumn pilot @digital pendant, I figured it out

[junior helm]

Yeah. I noticed this warning about certificate, so I tried add that domain name

[fathom pendant]

I mean, the warnings are safe to ignore anyway

[fathom pendant]

Depends on how the lab is set up

[junior helm]

Yeah, just my luck to use that domain name and success

[fathom pendant]

Sometimes settings, especially domain joined, require a domain name. Like inlanefreight.local

With htb the common domains you'll see are like "inlanefreight.local" and "freightlogistics.local"

[brave field]

dm me

[left frigate]

Hello, can I confirm if I get the gold monthly subscription for HTB academy I will get 500 cubes every month added to my account?

[fathom pendant]

Yes, you get exactly what it says on the tin. Every time it renews you get 500 cubes

[left frigate]

Thank you very much

[dire flint]

Hey guys, AD LDAP Skill assessment, last question... The htb-student just don't have non default privilege or am i dumb ?

[foggy snow]

Hey! I am stuck on the "Using Web Proxies" Skill assessment on the first question "The /lucky.php page has a button that appears to be disabled. Try to enable the button, and then click it to get the flag.". I tried using ZAP HUD and Burpsuite but it just doesn't want to work, anyone who can help me out?

[cloud urchin]

Were you able to enable the button?

[foggy snow]

No

I've tried it with the ZAP HUD, but it doesn't seem to find a disabled button

Also tried it within Burpsuite but same issue there

[cloud urchin]

Look at the response and see what you may be able to change to enable it

[foggy snow]

Well i'm using ZAP for the first time so i'm probably doing something wrong, but I can't seem to edit the Response?

I would remove the "disabled" part

[cloud urchin]

idk i don't really use zap a whole lot. BS was a lot easier. instead of removing 'disabled' think about how you may be able to 'enable' the button.

[foggy snow]

Well within BS I enabled Response interception and turned on "Enable disabled form fields", which is what the module tells me to do, but the button still doesn't work

[cloud urchin]

look at the code in the response, the button is controlled client side. think about how you may be able to turn a disabled button into an enabled button.

... how can you turn 'disabled' into 'enabled'.... that's the best hint i can give you

[foggy snow]

Ahhh got it to work, ||had to turn off intercept after editing the response and spam the button a few times||

[dire flint]

If someone could give me a hint, i feel a bit lost for such a simple question

[coarse verge]

I'm doing linux fundamentals but each time i try to ssh my spawned target the server keeps closing my connection , i don't even get to put the password, any help on this ?

[foggy snow]

Are you connected via OpenVPN or the PwnBox?

[coarse verge]

via Open vpn , i pinged the targer and it responded

[foggy snow]

is port 22 open?

[fathom pendant]

which section specifically

because if i recall correctly there's like one or two sections that use an alt port for ssh

[coarse verge]

yes its open

[foggy snow]

can you show me what command you're trying?

[coarse verge]

system information and navigation

[fathom pendant]

ok that one should be default

are you using the pwnbox or your own vm

(pwnbox being the in-browser vm)

[coarse verge]

that's the command

[coarse verge]

i'm using my own vm

[fathom pendant]

sudo ip a | grep 'tun' how many tun connections do you have?

[coarse verge]

3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500

the response

[fathom pendant]

so only one tun; and you tried resetting the target then waiting a few minutes i assume

did you try changing vpn regions?

[coarse verge]

yeah i tried resetting and changing vpn locations, funny i even used my kali on vmware and did the same thing on my virtualbox kali as well

[fathom pendant]

and to be clear you're only running one vm with one vpn

[coarse verge]

yes only one vm and one vpn

[fathom pendant]

not able to replicate on my end

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

^ reach out to support

[coarse verge]

but it worked on HTB pwnbox when i used it some hours ago

[fathom pendant]

(using pwnbox bc i'm too lazy to spin up my vm)

[coarse verge]

alright thanks

[fathom pendant]

if it works on pwnbox then there's something with your vm/system that's causing the issue, and it's not on HTB end

[coarse verge]

even when i use different vms?

[fathom pendant]

something would be wrong either:

• in your vm config somewhere
• in your router somewhere

if your router assigns a 10.x.x.x ip to your devices, you could be facing a weird conflict issue

[marble quiver]

Did anyone solve the "RDP and SOCKS Tunneling with SocksOverRDP" Section in the "Pivoting, Tunneling, and Port Forwarding" Module with ligolo-ng?

[coarse verge]

wait could having wrong regional time be the cause ?

[fathom pendant]

don't believe so

[coarse verge]

i just notice my machine has the correct time but the vm's are both show 6jan and wrong time

[coarse verge]

ayt

[fathom pendant]

yeah, it's super simple; you might need to run execution-policy bypass -scope process first on the windows machine if it's giving you trouble

[marble quiver]

Alright. How do I get the agent on the 2nd Host? Is there an easy way either from kali or Host 1?

[foggy snow]

scp?

not sure if thats possible, been a while since I did that module

Ahh since its RDP I just used /drive

[zenith cargo]

Okay I find myself stuck on the seemingly simple question in the chapter "Generating Shellcode" of module Stack-Based Buffer Overflows on Linux x86. The question is: Submit the size of the stack space after overwriting the EIP as the answer. (Format: 0x00000) From my understanding, this means the space from the instruction pointer to the end of the stack, pointed to by the stack pointer, thus the answer should be address of EIP - address of ESP.
Using gdb I found the addresses of the registers:

 eip = 0x56555551 in bowfunc; saved eip = 0x565555af

(gdb) x/x $esp
0xffffd184:     0xd4

That should be 0x00008 bytes. But its wrong. I dont understand what im missing

[grizzled schooner]

Documenting and Reporting Practice Lab --> Can't seem to get RDP working to get to the host:

xfreerdp /v:'10.129.87.41' /u:'htb-student' /p:'HTB_@cademy_stdnt!' /drive:/home/aria/Desktop /dynamic-resolution

[15:20:12:221] [18033:18038] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[15:20:12:221] [18033:18038] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[15:20:15:356] [18033:18038] [ERROR][com.freerdp.core.transport] - BIO_should_retry returned a system error 32: Broken pipe
[15:20:15:356] [18033:18038] [ERROR][com.freerdp.core] - transport_write:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[15:20:15:356] [18033:18038] [ERROR][com.freerdp.core] - freerdp_post_connect failed

Anyone know what's happening here?

[cerulean bramble]

I'm fighting with the imagebot on the LLM Output Attacks skill assessment. I haven't been able to obtain the admin key, so far. I've gotten a few formatting errors and DB errors and I even got it to hallucinate a key (I think). Would anyone be so kind as to give me a nudge in the right direction?

[fathom pendant]

xfreerdp has the /drive: option

[slim siren]

Module: Active Directory Trust Attacks
Section: Skills Assessment

Would like to check if anyone could help me at the first flag?. I cant find a way to privesc to the child domain.

[upper haven]

DM me what you tried so far 🙂

[cerulean bramble]

Thanks. Message sent.

[grizzled schooner]

Bumping this. Even after machine reset, fails to work. Tried running this without dynamic resolution, as well as drive sharing. Cannot seem to RDP to this box

[stuck bison]

Hello! i'm figuring out how to get a flag for a module using pwnbox. anyone is available to help?:

I connected to the box in the browser, copied the file over. running the provided python script, it looks like it's using port 8000 on this pwnbox to validate. but nothing is running on it. (I'm not using the VPN)

I'm trying to get a flag for the "Model Evaluation (Spam Detection)" module of the Applications of AI in InfoSec course

[stuck bison]

ok, I figured it out. There is an option to spawn a pwnbox and a target VM. I started both and access the target vm from the pwnbox. worked, got the flag...

[cobalt quest]

Module: Getting started
Section: Type of shells

Sorry if a bit unrelated. But I am doing some of my note taking in obsidian and I am copying some of the powershell or python commands to take note of them but they keep running and triggering my antivirus. Does anyone have any recommendations or what they do to take note of commands that may be "malicious"? Or should I not bother with making not of the reverse shells/binding shells?

[cloud urchin]

Make an exception to that folder

[cobalt quest]

In Obsidian or on my actual computer

ah nevermind, I got it. Thank you for the help

[fathom pendant]

add your vault to exceptions, that way any new file in the vault won't get scanned

[cobalt quest]

That was the fix I was searching for, thank you!

[fathom pendant]

np

a software i was using when I started, thankfully, still had it in a buffer so it didn't wipe the page. just told me it was deleted

[night shale]

Hi guys, can I dm someone based off some questions from CPTS and hackthebox machines?

[fathom pendant]

wdym 'from cpts' do you mean based on the cpts path?

[night shale]

yeaaa

[uncut slate]

Looking for some assistance on Windows Event Logs & Finding Evi - Skills Assessment.
I'm assuming one or two .dlls are the source of the injection, but I can't figure out how to find the process that did it.
It has to be the parent process, but I'm not sure how to get to that next layer of information with what I have.

[knotty granite]

I need a study session with you

[stray shore]

Hello everyone.
I'm new in this forum, so forgive me please if I'm making a mistake asking for help here for a module.
I'm on this module: https://academy.hackthebox.com/module/49/section/1017 , the one about "NTFS vs. Share Permissions".
I have xfreerdp to the Windows client machine, I shared a folder as the example said, but I'm not able to use smbclient. It says Error NT_STATUS_IO_TIMEOUT.
I tried with my own Parrot machine and with the Pwnbox, but both do the same...
I also tried to recreate the target machine and the VPN, but still cannot connect.
Is there something I'm doing wrong? If you need me IPs from target or Pwnbox, tell me.
Thanks in advanced for your time

Mmm... I thought that, but netstat sais that 139 and 445 are listening, and both are ports for SMB, aren't it?

PS C:\Windows\System32\drivers\etc> netstat -a

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 WS01:0 LISTENING
TCP 0.0.0.0:445 WS01:0 LISTENING
TCP 0.0.0.0:3389 WS01:0 LISTENING
TCP 0.0.0.0:5040 WS01:0 LISTENING
TCP 0.0.0.0:7680 WS01:0 LISTENING
TCP 0.0.0.0:49664 WS01:0 LISTENING
TCP 0.0.0.0:49665 WS01:0 LISTENING
TCP 0.0.0.0:49666 WS01:0 LISTENING
TCP 0.0.0.0:49667 WS01:0 LISTENING
TCP 0.0.0.0:49668 WS01:0 LISTENING
TCP 0.0.0.0:49669 WS01:0 LISTENING
TCP 0.0.0.0:65416 WS01:0 LISTENING
TCP target_ip:139 WS01:0 LISTENING
TCP target_ip:3389 mi_parrot_is_here:58924 ESTABLISHED

And I don't know... It feels like a following practice, it is strange that the machines won't allow you to try the lesson, don't you think?

[brave field]

Or maybe firewall is blocking the access

run nmap scan on port 445

[stray shore]

uhu, trying 🙂 (firewall was my other suspect)

[brave field]

if it shows filtered then it's the firewall blocking the access

[stray shore]

Firewall. The target was not answering even ping.
After disable FW, now seems that it should work
┌─[cheshire@parrot]─[~]
└──╼ $nmap target_ip
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-06 07:42 CET
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.10 seconds
┌─[cheshire@parrot]─[~]
└──╼ $
┌─[cheshire@parrot]─[~]
└──╼ $
┌─[cheshire@parrot]─[~]
└──╼ $nmap target_ip
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-06 07:43 CET
Nmap scan report for target_ip
Host is up (0.26s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server

Nmap done: 1 IP address (1 host up) scanned in 19.90 seconds

Thanks for the idea 😄

[fathom pendant]

windows targets by default don't respond to ICMP echo; it's a default feature of windows

if you would have scanned with -Pn you would have gotten results without needing to disable fw

and in-general a client/employer would be unhappy with you disabling the firewall on a system

[stray shore]

Yes, that is true, but it wasn't allowing me even do the SMB practice.. Firewall was in the middle.
What does -Pn? I didn't reach nmap lesson yet.
And yep, I know that is a brute solution, but I only was trying to follow the lesson 🙂

[fathom pendant]

especially for something that would be a routine administrative task, like setting up a fileshare

[fathom pendant]

-Pn -> don't send ICMP echo request (ping) to test if the host is up, you're essentially telling NMAP 'trust me bro, it's up'

[stray shore]

Interesting, thank you 🙂

[fathom pendant]

https://nmap.org/book/man.html <the RTFM pages for nmap

[brave field]

Since SMB (445) is not accessible externally, you can’t enumerate shares from your machine using smbclient. However, once connected via RDP, you can access the shares directly from the Windows system.

[fathom pendant]

actually nothing in that netstat shows only available locally

i see the wildcard 0.0.0.0 which is a stand-in for 'all-interfaces' but nothing that indicated localhost

the error was a timeout, which generally is when the system times out making a request. Nothing to do with it being open or not.

if it was a firewall issue or it not being accessible -> NT_STATUS_CONNECTION_REFUSED

[brave field]

In this case, the firewall is silently dropping (filtering) SMB traffic rather than rejecting it, which results in the NT_STATUS_IO_TIMEOUT error.

[fathom pendant]

no, what they've only shown is that they were able to get an nmap scan through. Not that the smbclient timeout issue was resolved

These labs aren't set up in a way to silently drop packets, that'd be cruel and unusual punishment for beginners

[late shell]

So if one has an annual Silver plan couldn't they just use the walkthrough answers if they wanted to stack cubes? There is a module I want to buy but its 1000 cubes, lol

[fathom pendant]

sure but they'd really only be hurting themselves

[late shell]

Not if they go back and actually do the exercises, haha

[fathom pendant]

but do you really expect them to do that?

also it'd be leagues cheaper to just buy plat monthly then cancel for the cubes

[severe inlet]

Why did the CWES get rid off the FFUF module?
Is it not maintained anymore or something?

[acoustic owl]

There is a newer module that covers more than just ffuf

[digital herald]

Module: “Attacking AI – Application and System”, section: skills assessment (RootLocker MCP server).
​
I am kind of stuck on this module, is it possible to give a hint or a a way out?
Note that tools/list only shows store_file and store_password, resources/list only shows the five simple resources, and repeated resets never expose additional tools.

[brave field]

Then how do you explain this - before disabling Windows Defender Firewall, Nmap showed 445 filtered, the packet trace had no SYN-ACKs, and smbclient timed out (NT_STATUS_IO_TIMEOUT). After disabling it, Nmap saw the port open, SYN-ACKs were received, and smbclient returned NT_STATUS_ACCESS_DENIED. This proves the timeout was caused by the firewall silently dropping packets, not the SMB service itself.

[fathom pendant]

Im not seeing where that was said unless you dmed them to troubleshoot

[lilac swift]

Good morning everyone. Please I need you assistance in the Incident Handling Process sill assessment last question. I’m finding it very difficult to input the format.

[zenith cargo]

Wym

[dusk holly]

try one slash in between

as the example showed

[lilac swift]

I appreciate your response. I’m still finding it difficult

[dusk holly]

you mean it is not working

[lilac swift]

Yes

[dusk holly]

maybe check forums on this topic, and see what others have tried

[zenith cargo]

Guys any help here, im really confused

[late shell]

I already have the silver plan tho, haha. I want to do the CJCA, but also want to do one of the other 3, but also really want to do the OSINT course but it's 1000 cubes 😭

Some phenomenal content so far

[lilac swift]

I need help with this question. Iv tried but no success.

In the same file (i.e., logs-wazuh.zip), identify the user who executed the suspicious PowerShell
command. The format is domain \user.

[weary crow]

Hi I'm having trouble spawning my target on acl at AD enumeration and attacks

[brave field]

It wasn't said anywhere, I did it myself. You can test it yourself if you'd like.

[tawny flint]

Hey, I’m stuck on the LFI skill assessment. I can’t get the file to execute, I’m on the last step. Could someone give me a hint? I’d really appreciate it!

[marble quiver]

"RDP and SOCKS Tunneling with SocksOverRDP" Section in the "Pivoting, Tunneling, and Port Forwarding" Module:

I have my ligolo-agents running on Host 1 (10.129.42.198/172.16.5.150) and Host 2 (172.16.5.19), with Host 2 being connected via Listener to Host 1. Why can't I access Host 3 (172.16.6.155)?

[hidden ledge]

You can come dm to avoid spoiling

Because I'm not sure which file you are talking about

[marble quiver]

I can reach it, but the RDP client says "Failed to connect"

[knotty granite]

I mean I wanted to study together. Anyways here’s some help maybe? I’m learning.

So the question maybe asking how much space exists after the saved return address and not the instruction pointer register.

Find where saved EIP is on the stack and calculate how many bytes exist after the stack frame.

Hope this helps.

[zenith cargo]

Oh My bad, yes for sure id like that

[zenith cargo]

Oh I understand now

I think i confused the save return address with the IP register

Well that was stupid

[knotty granite]

It’s all good 👍

[hidden ledge]

Module: Windows Privesc
Section: Interacting with Users

The hint tells to check for writable file share but they are either READ ONLY or NO ACCESS, what i'm I missing here ?

[gray yacht]

Might be subdirectories

[hidden ledge]

Yup in fact thanks. How do I know when the subfolder is writable or not ? Looks like icacls always gives me (RX)

[lucid forum]

I need assistance on the assembling and disassembling module. The lab wants me to download the disasm.zip file (which I did) inside the pwnbox but when I go to extract it and it's completed, nothing happens and wont let me open anything

[marble quiver]

How can I fix this error when connecting with xfreerdp?

[lucid forum]

Nevermind! I just extracted the file to the desktop and used cat to find the flag

[worn sun]

maybe a config error in /etc/krb5.conf

[lucid forum]

I downloaded a newer version of freerdp and the command is xfreerdp3, try that

[marble quiver]

I use xfreerdp3

[grand solar]

I had a quick question about this weird issue I'm having for the File Upload Attacks - Skills Assessment - File Upload Attacks section where I was not getting a web shell in one Burp repeater tab and then I created a new repeater request and it worked? I was trying to figure out why this is the case so I tried copying and pasting the request that was working to the repeater tab that failed, and this still failed for some reason while it works on the other tab? anyone know why this happens so i can avoid this in the future?

[graceful ferry]

Any possible nudge for Injection attacks - Skills assessment ?
I have generated a PDF, found the injection point for it, found the internal web page with the search function. I am aware that there should be an XPATH injection now, in that search parameter, but I'm unsure on how to proceed with it

[grizzled schooner]

I feel genuinely stupid - I can't seem to get anywhere for the Documenting & Reporting lab. I've used a tool to capture hashes, none of which seem to get me anywhere. I used one of them to pull the SAM and SYSTEM hives. The Admin hash it gives doesn't get me anywhere. Can I get a nudge or something? Please @ with responses

[silk lagoon]

you can dm

[lone ferry]

Module: attacking corporate WiFi - abusing the guest network. The default browser and chrome both fail to open in the rdp session. Anyone else do this module? Any help appreciated

[sharp solar]

Hello!

Do I get to keep access to modules I entered with the annual subscription when the subscription expires?

[tulip copper]

Only if you complete the module

[acoustic owl]

All modules that you have completed within the subscription are yours to keep.

[iron cipher]

I am currently in the skill assessment for Kerberos attacks section and i am on the last question viewing the secret share however i have tried coercing isn’t spoolersample and i have tired printer bug and none have worked i tried renewing the tickets, i have tried passing the ticket. I tried server01 and Jake.kirk user however still nothing i tried kerbrelayx but i couldn’t do that either. If you can reach out to me that would be great.

[cyan veldt]

How can I enter the skill assessment's target?
it keeps showing me 400 bad request
https://academy.hackthebox.com/module/33/section/518
SQLi fundamentals

I have CA portswigger certification

what is the issue

[narrow nacelle]

module/21/section/128 -> introduction to bash scripting (section 7/10), the last question

I'm not getting the question, or what it's asking..and even when I solve the script, I believe in the intended way, it doesn't work

[knotty granite]

I'm guessing the answer is either the number of characters in the 28th result or just the 28th result itself.

[narrow nacelle]

it doesn't work, and the 28th result is too big to provide it as an answer, i think..and then, the script I'm supposed to edit, is using the value produced to decrypt a flag, and I'm thinking i should be submitting the flag, though it doesn't decrypt

[knotty granite]

ok wait dm me so I can see the script and help further (I haven't done this module yet)

[cyan veldt]

anyone?

[fathom pendant]

be careful how you echo

[uncut gyro]

Hey peeps. hoping someone can point me in the direction of what im doin wrong. im in android fundamentals assessments last question. ive downloaded the new zip file, opened it, build, Generate signed app bundle or apk. i then open the app and still get Hello Android! flag, which isnt working. any pointers?

[paper ridge]

please cn anyone help me with smtp here please?

[fathom pendant]

what academy module is this related to?

[paper ridge]

email campaign

[fathom pendant]

that's not an academy module

[paper ridge]

that means am not getting it right

but do you undrstand what i need?

[fathom pendant]

Yes, and no; you're not gonna find anything like that here. No one is going to help you with your shit, we're going to operate under the assumption what you need it for is illegal

[paper ridge]

pls dm me

[paper ridge]

nop its not illlegal

[uncut gyro]

could someone help me as well please?

[fathom pendant]

no

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[uncut gyro]

haha im in android fundamentals last part last question. i import the new file on a fresh pixel 3, sign it and reload it and the words i get dont seem to be the flag

[paper ridge]

ok what is the task please?

[uncut gyro]

Sign the application myapp.apk and install it by either dragging and dropping it onto the device or using ADB. Make sure to first uninstall any previous versions of the app. After installation, tap on the app to start it. What is the message printed on the screen?

[paper ridge]

on it

[paper ridge]

on andriod?

[uncut gyro]

yep

[paper ridge]

am using rdp

[dusk holly]

Password attacks -> Attacking Windows Credential Manager
in this module, we were supposed to exploit credential manager, and we have to use UAC bypass to get admin privileges , i did and using mimikatz didn't give me password for mcharles , but other users were able to extract it using the same technique as mine, i wanted to leave it here if there are not more techniques should be performed, i have done this module before

@silk lagoon

[narrow nacelle]

maybe you guys can rewrite that question?..feels like it's not structured very well

but i got it, thanks

[fathom pendant]

the example is in the exercise code, no?

[narrow nacelle]

the 'intended' way to do this challenge, based on what has been covered in the previous sections, doesn't work, the issue being the consideration of newlines

[fathom pendant]

ah yeah sorry brain mixed up examples

[lone ferry]

Any chance a mod has a min to check this module out?

[dusk holly]

unfortunately mods are not responsible for this, but if you think this is issue from HTB, then contact support

[lone ferry]

That’s what I thought I was doing- thanks

[remote yoke]

Is it just me or is the Windows Event Logs & Finding Evil module quite difficult as compared to the rest of the modules in CJCA

[silk lagoon]

I had no issues if you want you can dm me so I don’t spoil the command

[silk lagoon]

Even now looking back at my notes I followed everything in the reading section and was able to get mcharles

[dusk holly]

yeah, it was probably because i spent too much time on the target i guess, i don't really remember the module being hard af, so i just skipped but thank you for clarification

[silk lagoon]

yeah the module shows how we can enumerate the credentials that are stored, then we can use a command to impersonate that stored user. Then here you would bypass UAC and use mimikatz.

[dusk holly]

yep, exactly like that, some environmental issues didn't showed it i guess

[silk lagoon]

on then prob the command inside mimikatz.exe; because I had that same issue, it was't the typical sekurlsa..

[dusk holly]

i used the one shown in the course, starting with sekurlsa

[silk lagoon]

yeah then that is why

HTB doing HTB things, making things interesting by making you think differently there and there

[past agate]

Hey everyone, got a question about the Information Gathering - Web Edition module specifically the Subdomain Bruteforcing section, in the question i suppose to enumerate the domain using dnsenum/fierce or any of the other tools, i scanned it several times with each of the tools but im stilll not getting much, here is the domain i got form each of the commands:
dnsenum:
dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
Brute forcing with /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt:
www.inlanefreight.com. 30 IN A 134.209.24.248
ns1.inlanefreight.com. 95 IN A 178.128.39.165
ns2.inlanefreight.com. 95 IN A 206.189.119.186
ns3.inlanefreight.com. 30 IN A 134.209.24.248

fierce:
fierce --domain inlanefreight.com --subdomain-file /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
NS: failure
SOA: a.gtld-servers.net. (192.5.6.30)
Zone: failure
Wildcard: failure
Found: www.inlanefreight.com. (134.209.24.248)
Nearby:
{'134.209.24.245': '1266637.cloudwaysapps.com.',
'134.209.24.248': 'inlanefreight.com.',
'134.209.24.252': '1322472.cloudwaysapps.com.'}
Found: ns1.inlanefreight.com. (178.128.39.165)
Nearby:
{'178.128.39.168': 'fdcb359d-fe9f-47d8-ae22-95ee8b233a63.fs.lucidlink.com.'}
Found: ns2.inlanefreight.com. (206.189.119.186)
Nearby:
{'206.189.119.185': '344738.cloudwaysapps.com.'}
Found: ns3.inlanefreight.com. (134.209.24.248)
Found: customer.inlanefreight.com. (134.209.24.248)

For some reason i didn't even found the support subdomain, any idea what im doing wrong?

[silk lagoon]

@dusk holly imma dm you

[silk lagoon]

What question is it?

[past agate]

"
Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com.
"

in the "Subdomain Bruteforcing" section, it's the only quesiont at the bottom of the page

im using the same command as in the example: "
Adam369@htb[/htb]$ dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt

dnsenum VERSION:1.2.6

----- inlanefreight.com -----

Host's addresses:

---

inlanefreight.com. 300 IN A 134.209.24.248

[...]

Brute forcing with /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt:

---

www.inlanefreight.com. 300 IN A 134.209.24.248
support.inlanefreight.com. 300 IN A 134.209.24.248
[...]

done.
"

And im not finding the support subdomain like in the example

[silk lagoon]

But you got the answer?

[past agate]

no because the answer is a subdomain i should find and it's not any one of these

[silk lagoon]

I’m checking, it’s been a while..

[past agate]

thanks

[silk lagoon]

I am getting the right results

[past agate]

you run the same command and getting more subdomains?

[silk lagoon]

Yeah

[past agate]

"dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt "

just to be sure

[silk lagoon]

Yessir

[past agate]

i even connected via VPN to HTB academy and still same result

any idea what im doing wrong?

[silk lagoon]

inlanefreight.com is accessible outside of VPN

Can you access it?

[past agate]

We i go the website via browser it's just a blank white page

[silk lagoon]

Then that’s the problem

You have access to internet lol?

Get off the VPN

[past agate]

Yes i tried without the vpn and i can access other websites without a problem

[silk lagoon]

And that one you can’t?

I can even access it outside machine

[past agate]

I'll check that in a bit and let you know

[viscid patio]

I’ve been stuck in the Incident Handling Process module, trying to answer the question;

During recovery, IOCs are still observed intermittently. Should recovery proceed, or should the case be escalated back to the investigation phase? Answer Format: Recovery/Investigation

anyone have any hints or tips could give me?

[agile mountain]

Hi! I found the flag for the SQLMap Essentials' skills assessment. However, wheneverI supplied the flag, it keeps saying wrong answer. Please, what am I doing wrong?

[graceful ferry]

Make sure that there aren't any spaces before and after the text

Also that it's in format HTB{FLAG}

[agile mountain]

There are no spaces and also it is in the HTB{FLAG} format!

[graceful ferry]

You can DM me if you want

[agile mountain]

Alright. Thanks!

[past agate]

Checked it again in the machine and outside of it the website loads up, im scanning it again to see if i get a different result

still same result found only the customer subdomain

[tame apex]

Hi
Doing the skills assessment for the CLI PS and got stuck on this Use the tasklist command to print running processes and then sort them in reverse order by name. The name of the process that begins with "vm" is the flag for this user.
Used tasklist | sort / R got 3 exes that start with vm but no matter how or which I try it won't accept it

[leaden island]

yo guys

[dusky hull]

why it doesn't accept answer: DHCP Request , for question: What type of message does a client send to accept an IP address from a DHCP server?

this should be it

[leaden island]

im on attacking web applications -> attacking splunk
im configuring the splunk reverse shell as a splunk base application, that i should upload to get a reverse shell.
the module says:

We need the .bat file, which will run when the application is deployed and execute the PowerShell one-liner.
Attacking Splunk

@ECHO OFF
PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
Exit

the reverse shell, powershell script is named run.ps1, as the module packages the application folder here:

splunk_shell/
splunk_shell/bin/
splunk_shell/bin/rev.py
splunk_shell/bin/run.bat
splunk_shell/bin/run.ps1
splunk_shell/default/
splunk_shell/default/inputs.conf

what exactly was the -Command "& '%~dpn0.ps1'" part above ?

shouldnt it be named run.ps1 ?

[brave field]

try DHCPREQUEST

[dusky hull]

it doesn't work

[brave field]

mind the gap maybe

[dusky hull]

tried it as well, not accepting it. DHCP REQUEST

[iron cipher]

I am currently in the skill assessment for Kerberos attacks section and i am on the last question viewing the secret share however i have tried coercing isn’t spoolersample and i have tired printer bug and none have worked i tried renewing the tickets, i have tried passing the ticket. I tried server01 and Jake.kirk user however still nothing i tried kerbrelayx but i couldn’t do that either. If you can reach out to me that would be great.

[gray yacht]

You can send me a DM on what you have tried.

[prime merlin]

Hi! im currently working on the network enumeration porton on HTB academy and its wanting me to " Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.". I identified all the ports, found port 31337/tcp STATE:OPEN SERVICE:Elite. I said hmm sus. so tried to grab the banner with --script banner,default which returned the banner with what i believe to be the flag its formatted like this HTB{leetspeek string} but when i submit its saying the answer is incorrect? am I looking in the wrong place here?

[worn sun]

check that there are no trailing spaces

when u copy/paste

[prime merlin]

no dice

do they put fake flags in the learning modules?

[cloud urchin]

No

[prime merlin]

im at a loss then am I allowed to show you guys what im looking at here?

[cloud urchin]

You can ask to DM someone if you feel like you need to reveal more info, but I can't do that myself right now I'm working

[prime merlin]

i found it. the flag was in fact a different one from the one i was looking at

[cloud urchin]

you probably found the flag for a different question then

[pale island]

in teh file upload attacks client side validation i cannotclick the upload button, it does not react and gives no options to upload a file. i have tried different browsers. anybody got an idea how to fix it?

[cloud urchin]

i think you click the picture or something

[pale island]

no way it is indeed just clicking the picture

[cloud urchin]

yeah i think you first select which pic you want to upload, then you can click the upload button after. but i forget exactly.

[pale island]

yes, thank you. took a long time to find it

[grave marsh]

can someone please help, i think the Oracle TNS section within Footprinting is broken. Or if so can someone help me install odat and sqlplus. I mentioned this already a week ago and got some silence :/ I have completed every other section in Footprinting and really want to get it done today. If anyone can help I would REALLY appreciate it.

i am using the web based parrot linux

nvm i fixed it but boy is it a lot of hastle
thank god chat gpt exists because deadass if i tried this 5 years ago id give up

[cloud vessel]

I am currently working on the File Inclusion module and focusing on the Basic Bypasses challenge. This web application has several filters to prevent Local File Inclusion (LFI) attacks. My goal is to bypass these filters and read the file /flag.txt.

I have already found the flag, but I think I wasn't supposed to do it like that.

Do I have to find other directories and then path traverse to the flag with this command:

ffuf -u "http://94.237.61.202:47604/index.php?language=./languages/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt

[reef osprey]

sign the app, install it and open it

make sure you are using the app from question 4

[unique spruce]

questions guys

can i skip around cpts

[waxen totem]

the path? you can but it's not recommended, that being said if I were to jump around I'd be prioritizing the theory modules, then the web, then the AD, then the networking(pivoting), and finally the privilege escalation and documenting

[unique spruce]

this is rn

vulnerability assessment is genuine helll bro

its so boring

genuinely falling asleep

[waxen totem]

While I agree that it's a bit of a boring module, it is rather important for you to understand how to use these tools as they're pretty standard

[unique spruce]

idk the extensive reading in cpts is like insane

im mainly doing cpts just for the sake of it im still in high school dont ban me ive already done the form and stuff and had to go thru a mod to be here

[vast cairn]

So, I'm working on the "Weak Permissions" section of Windows Privilege Escalation, and it's not letting me change the service binary path for WindscribeService. I'm not sure why. There's no instruction for opening the PS in administrative mode and there's no way to do it anyway because I don't have the admin pass here.

[unique spruce]

im mainly a coder but i thought pen testing would be a good skill to have bc i havent had goals in years so im trying to like do something and the boringness and extensive reading is making it so unmotivating

and im not at the point where i can just spam machines and learn from that

[uncut gyro]

Thanks. Im sure ive done that, but not getting the right flag.

[unique spruce]

i have the student thing so i can particpate in all paths is cpts as interactive as it gets with pen testing

[waxen totem]

honestly spamming machines isn't going to get you anywhere without the right mindset and resources, truth be told unless you're reading writeups you'll still be reading a lot, only this time it'll be from various sources without a provided methodology unlike the modules

[unique spruce]

yeah so i havent really tried that

idk im on the vulnerability testing and even with previous modules the amount of reading is genuinely ridiculous and the lack of interactivity is insane

im not sure what to do tbh

[waxen totem]

I mean you can follow along with that module, a pwnbox and a target running the vulnerability scanners is provided

[unique spruce]

does the interactivity increase from this point on

like idk i js want it to get funner

[snow tiger]

I got a flag, but it didn't work.
The flag starts with "7h15" Please provide me some hint?

Module: JAVASCRIPT DEOBFUSCATION
Section: Decoding
URL: https://academy.hackthebox.com/module/41/section/445

[unique spruce]

like not even trying to be immature or impatient but like for example with coding right im pretty good like i was able to code a fully functional graphics windows animations and mouse and keyboar and eveyrthing for a game and that was super interesting

like im js trying to look for that interest again

never been excited to code 6k lines you know what i mean

[cloud urchin]

That is not what the flag starts with. It starts with HTB{

[cold reef]

Does anyone know why this path is locked? I've searched for the path and it doesn't show up, is it something that only a subscription or certain certification unlocks?

[void holly]

So if you intend on doing the CPTS exam, I recommend reading as it will explain quite of useful information for when its time to document your findings in a report. If this is just for personal enjoyment, then just read whatever you would like! 🙂

[cloud urchin]

https://academy.hackthebox.com/paths/jobrole path is at the bottom here

[unique spruce]

well i really want to do the exam and get the cert

[cold reef]

You're the best! Thanks SuperNuts!

[unique spruce]

but im asking if its as painstakingly boring as vulnerability assessment or such like rly reading modules and not as interactive idk if id be super interested

[void holly]

The exam consist in producing a report. If you do not produce a report up to HTBs standards, then you will not get a passing grade

[unique spruce]

im not concerned with writing a report

i mean of the actual course like learning

is it this boring all the way through or does it get more interactive

[snow tiger]

Thank you for you reply.

I just realized what this means.
"serial=YOUR_DECODED_OUTPUT".

I had to replace YOUR_DECODED_OUTPUT with the decoded string.

[void holly]

The course in general or just this module?

[unique spruce]

general

like foward from here

because this is by far the worst ive seen in terms of like just text

[void holly]

ah yes, I would say the vuln assessment module is more formal than the other. But the formal work is required at some point in the work of a pen tester.

[novel matrix]

we know based on your roles ;)

[vast cairn]

ok so with this, I tried going backwards and replacing the SecurityService.exe with a msfvenom package, but my listener isn't picking up on it after I sc start SecurityService

[vast cairn]

and then when I try to do the sc config on WindscribeService I get this error

[brittle condor]

Hi

[earnest pasture]

It doesn't work because when you type sc in PowerShell, you are using the alias for the Set-Content command. Therefore, you would not be using the sc.exe binary. Try use cmd

[fathom pendant]

use sc.exe instead of sc

as Daemon said, it's an alias

[feral adder]

Anyone can help me in the LFI assessment?

[dusk holly]

Ask your question directly, more people tend to help in that way

[fathom pendant]

what module is this from?

[coarse pasture]

this is \SOC Analyst path\ Windows Event Logs & Finding Evil\ Tapping Into ETW

[fathom pendant]

thanks lol because searching silkETW and seatbelt threw up a bunch of diff stuff

[fathom pendant]

i deleted the message because the module is tier 2 but i'll check what you may be missing gimme a sec

[coarse pasture]

sure

[fathom pendant]

There's another Get; did you run ETW and replicate the attack.

[coarse pasture]

Got the solution thanks bro!

[past agate]

Haven't done this model but here's a list of headers, might be helpful

[hearty valve]

HTB, regarding the "Abusing HTTP Misconfigurations" module. I'm curious how we were supposed to know the vhost httpattacks.htb ? The vhost was needed for completing the content.

As "httpattacks" is not a part of any known wordlist, it's impossible to fuzz the domain.

The vhost was given in the Annual Subscription "Walkthrough" feature and luckily someone nudged it from there. The module content has no mention of the vhost whatsoever... Not through hints either.

[ivory kelp]

hi any one here?

[ivory tide]

Feels like im missing something but not sure what

[jolly yacht]

is it important to actually know how to subnet a CIDR to be successful in Career apart from exam? I mean I know how to understand that, like Network address, subnet mask, broadcast address, usable address, etc. But I don't know how to subnet that mathematically like if 192.168.32.0/23 is given, Do I really need to know that or I can just use some online website or AI if i want to subnet that ?

[fathom pendant]

how to subnet is generally only gonna be network admin; however understanding how they work is generally gonna be universal

[jolly yacht]

Cool, I understand how it works but I hate the math part where I want to actually get ( Network address, broadcast address, no of host) from the CIDR.

[fathom pendant]

well there's several bits to understand regarding cidr notation; the two major bits are the network and the subnet mask

there was actually a whole thing about this like yesterday in the chat

subnet masks are always filled left to right, and will never have gaps.
11111111.11101110.11111111.00000000 will be an invalid mask.
The notation isip/B where /B represents the number of left-justified (filled left to right) bits the subnet mask has (max of 32 for IPv4)

the ip is generally gonna be the host ip

i'm just waiting to see if you respond or have a question lol

actually the convo happened in #general

[jolly yacht]

yeah, I am just processing the info you conveyed.

[fathom pendant]

This wouldn't the first time i've broken this down LMAO; there's probably several different instances of me breaking it down

[jolly yacht]

Yeah, I know you are obsessed with this networking/subnetting part lol. I saw several times that you mentioned you are revising some subnetting parts from your old notes and explaining those to individuals.

[fathom pendant]

someone had a similar question re subnets and stuff yesterday; #general message you can read from there :)

[jolly yacht]

Thank you 👍

[pale island]

File upload attacks whitelist filters. Has anybody done it trough character injection i wanna know how you got it to work. I only have done it the other way

[ivory kelp]

heloo brother i have an issue in one of the module s

can any one help

[eternal vigil]

hard stuck at the final question of footprinting dns module
What is the FQDN of the host where the last octet ends with "x.x.x.203"?
|| dnsenum --dnsserver 10.129.172.166 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb ||
above is the 1st scan that i've performed
i'll send the 2nd one in dm only cause it'll be a spoiler
pls confirm if i'm doing it right T~T

[storm elk]

if you need help, dont ask to ask and ask a specific question and tell people the module and section you're on

[fathom pendant]

subdomains of subdomains; focus on a subdomain you haven't before; start small go big with wordlists

[storm elk]

just saying "i need help" wont get any response

[eternal vigil]

did that

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[eternal vigil]

can i dm you regarding that ?

[storm elk]

#modules message

👆 how to ask a question

[fathom pendant]

i was just going over vague nudges; you can dm

[ivory kelp]

my apologise, forgive me for my inconvenience

information security foundation is the module
setting up is the section in that
and VPS Hardening is sub section
i am stuck on this question mention below
Q What does the acronym Linux PAM stand for?
i have used every possible answer to this question but it won't budge plz help i have written Linux

Pluggable
Authentication
Modules

[fathom pendant]

just the PAM part, not Linux

[ivory kelp]

Pluggable Authentication Modules tried this did not worked

[fathom pendant]

Make sure you don't have additional spaces anywhere

[harsh gorge]

Go to sleep

[fathom pendant]

you're not my real mom

[ivory kelp]

ok thanks it worked

[tacit grove]

can anyone help with booting Android_Forensics_AVD on linux? other avd image works, but provided by the course not working

[left frigate]

How much cubes is this exactly?

It does not state how many cubes you get for buying this gift card

[fathom pendant]

because the gift card can be used for more than cubes

https://academy.hackthebox.com/billing

though it'd be smarter to buy a monthly sub instead; far cheaper/better value

[left frigate]

Oh yeah, but my work might find it easier to buy the gift card themselves and then send the code to my email, rather than me buying it then submitting a form to get it expensed back.

I mean either works but the gift card option just makes it easier for my work

[fathom pendant]

yeah

you can use a gift card to buy subs :)

[left frigate]

the gift card option does not really say how much £100 is but I assumed its like 1000 cubes

[fathom pendant]

i'm just stating that rather than buying cubes outright you'll get better mileage out of monthly subs

more cubes for same price over an increased period of time

if you need all 1000 cubes right away, that's a different story

for instance these are the 2 higher tier monthly subs; (note that the discount is the comparison to it's cube equivalent, not that it gives you that discount for purchasing cubes while the sub is active)

[left frigate]

Thank you very much for your hlep

[mellow tangle]

Hi everybody!

In Active Directory Module in the Domain Trusts Primer section (https://academy.hackthebox.com/module/143/section/1488) there's a PowerView function which allows listing domain users. Within the section an example of that function is shown Get-DomainUser -Domain CHILD_DOMAIN. After I connected to the target via RDP, imported PowerView and ran that command to list domain users of the child's domain, I got an error. The trust between domains is bidirectional, which means that I should be able to list users within the child's domain?

Is there any chance someone can give me a hint in the direction to understand why I can't list users in the child's domain?

[gray yacht]

I think that is just setup to provide an example and doesn't have the other hosts available in that lab. Try it again on later labs where those hosts are actually up.

[bleak trellis]

Hey y'all! A little doubt here. I was doing the Introduction to Threat Hunting & Hunting With Elastic module and in the part of Hunting for stuxbot at the moment of seeking the file download I notice that there's another event from the file.io domain like 1 sec after, but, I do not know why it appears as www.file.io and the resolved ips are different. Could anyone light me up ? Thanks in advance.

[mellow tangle]

thank you very much🙌

[olive fiber]

any one can give a little tip for Wi-Fi Evil Twin Attacks - Skills Assessment second question?

I think i am doing eberything correct but cannot get the reverse

[olive seal]

I have finished 2 modules for js deobfuscsion (js debfuscation & secure code:101)
But I can't see any info about VM decompilation since it's the top obfuscation technique used by malwares specially with js and a browser .. also the modules haven't cover anti-debugging techniques and how to get around them .. the module are not covering real world scenarios it's just for basics and i can admit they helped me a lot getting better understanding but unfortunately not covering the most disgusting parts this made me stuck a lot when facing an anti-debug codes or VM based execution

[dusk holly]

because they are not advanced modules, this is what they are made for

[languid sequoia]

hi

i need some help

im tryingto install parrot os security vm

but after I start the installation , its stuck at 34 % and says that disk space is full

although I've allocated 25 gb to the vm and the base is 20 gb

so how

what do i do

[dusk holly]

maybe ask AI

[languid sequoia]

I juiced deepseek and chatgpt

[languid sequoia]

bruh I can't get it to work

[naive rampart]

hi so i recently started the cwes and im at Using Web Proxies more specifically Using Web Proxies and everything's good i get the fuzzed admin directory but when i try to view it in my browser it shows a blank page im not sure what the issue is ive done this box 5 times now with different tools/methods but always get stuck at the browser thanks for any help 🙂

English is not my first language sorry if i made a mistake

[gray yacht]

You can shoot me a DM with what you are seeing and trying.

[naive rampart]

Thanks 🙏🏼🙏🏼 I'll do this later if that's ok I'm at work

[gray yacht]

Not a problem

[languid sequoia]

does the screen being black here

indicates anything ( it should be a parrot light blue background )

and are these errors a problem

[leaden island]

yo guys, im on attacking common applications, PRTG network monitor section
it is vulnerable to the command injection being told about in the section
however its not working for me, no matter what payload i use

i also copied and pasted the section's command to create a user on the system, didnt work

a PoC from metasploit worked, however, i still cant do it manually

[earnest pasture]

dm me

[karmic frigate]

hi so i dont seem to have the footprinting wordlist and i cant move forward
what can i do

i dont have the resources tab

or button

[gray yacht]

I've created an erratum post about this, as another user has the same issue and after checking my notes, this wordlist was provided when I went through the module. For the time being, I would either move on or try small username wordlists to see if they might work.

[karmic frigate]

it was provided in the afternoon but i had to attend a meeting and closed the laptop and now i have opened it and it disappeared

i left metasploit running so it should have giving the answer

is the post have a solution in it?

[gray yacht]

Have you done the Attacking Common Services module?

[karmic frigate]

found a solution like i can change any ending to the resources so i added the foorprinting and thats it

https://academy.hackthebox.com/storage/resources/Footprinting-wordlist.zip

[fathom pendant]

this only works if the name is stored that way on the server

[soft moon]

I am a bit stuck of getting a phpcmd shell, i see when i did burpsuite sniper attack for successful upload but cant seem to get the web page to execute the code to then read the /flag.txt 🙁
https://academy.hackthebox.com/module/136/section/1289

[somber sonnet]

Hi, I've been having a couple of issues with finding the answers in the Windows Privilege Escalation - Further Credential Theft module. I've managed to find the first question's answer, but I couldnt find the answers for the next 3 questions. I've exhausted all the techniques taught in this module, as well as the previous modules. Can I get a hint on how to continue? found the issue 🤦

[waxen totem]

Well those 3 rely on each other so you need to answer question 2 before being able to use the techniques to find the answers for questions 3 and 4. I suggest thinking dumber, the question is asking "Which user has credentials stored for RDP access to the WEB01 host". What often happens when credentials are stored?

[somber sonnet]

I know that stored credentials for RDP can be accessed using ||cmdkey /list||, but I tried that while on the jordan user and didnt see anything

[waxen totem]

Think even dumber than that. Think down to the purpose of stored credentials

[somber sonnet]

I guess, to make it easier to login to a service or computer without having to enter credentials multiple times?

[waxen totem]

Good, now go from there.

[mental canopy]

Did you end up figuring this one out?? I thought I knew the path for sure but nothing has worked. I tried giving it a fresh set of eyes and trying some different attacks but nothing is working for me

[somber sonnet]

Well, I've tried to check in the PuTTY and RDC applications, to hopefully find maybe a prompt asking to provide the password for a user, but unfortunately I couldnt find anything (I dont think there is a WEB01 host either on the network, but that might just be me). I've also tried poking around the Firefox and Chrome browsers to see if any stored credentials have been saved there, but to no avail. Currently the only stored credentials I've discovered are in DbVisualizer, which was the answer for part 1

[waxen totem]

Well check again, sometimes stored credentials don't show up unless you specify a target to connect to

[somber sonnet]

yes I've tried specifying WEB01, WINLPE-WEB01 and WEB01.inlanefreight.local, all of which returned an error that there is no such host

[hasty mauve]

Yes, just simply double check the Domain SID you're providing.
Get-DomainSID was giving me the SID of the child domain for some reason.
I tried Get-Domain "inlanefreigh.ad" and got the correct one.

[waxen totem]

DM me

[mental canopy]

Thanks! I just checked my notes and it's definitely the wrong domain SID. Thanks a lot!

[waxen totem]

For those having the same issue with Windows Privilege Escalation - Further Credential theft:

• ensure you are using the right credentials shown above the questions. they may have changed.

[little terrace]

hi im having rdp issues on windows priv esc. instructions were to rdp to even begin but i cant do that.
both remmina and xfreerdp are not working for me

[little terrace]

nvm, switched academy servers, and remmina worked

[weary torrent]

hey friends currently at attacking common services module. Question I am working on is "what's the password for the username "jason" " I ran nxc smb but it did not return anything, why is that? I also tried hydra and it found 0 valid password. also already reset the target

[fathom pendant]

iirc you may need to add -local-auth to nxc

[little terrace]

~~is there a way to background the msfconsole multi handler waiting for a connection? ~~(exploit -j works)

[vital zodiac]

Hi
Anyone can help me for "XPath - Blind Exploitation" module?

[vestal ore]

Sorry, i'm doing https://academy.hackthebox.com/module/67/section/2502 but i can't spwan the target. What's up with htb academy? Where can i contact the support?

[compact patrol]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[vestal ore]

thank you

[worn sun]

stuck a bit on the skill asessment

[snow steppe]

Anyone doing android dynamic analysis module?

I am using frida version 17.4.1.
I am getting error "TypeError: not a function at onEnter" when I run the script provided in Hooking Native Methods section.

I was also getting error at findBaseAddress function but I replaced it with process.enumerateModules to get the base address of the module.

[worn sun]

can i dm anyone who has done NTLM Relay Attacks ?

[chilly kernel]

hi please i got a question
I can successfully access the HTB target web page using the machine ip and when The page loads normally for about 1 second, then my browser automatically redirects me to an unrelated public website (money/currency–type site)...
why.

[terse spade]

I was looking for course on the DuckyScript, or something similar, but I couldn't find it. Is there course like that, or in not is there a chance it would be created?

[gray yacht]

What module/section is this occurring?

[mental canopy]

You can DM

[dusk holly]

can i DM you for password attacks skills assessment

[gray yacht]

Sure

[faint hill]

Does HTB have a status page so that we can check for service statuses and outages? I'm working on the Kerberos attacks module and the powershell over RDP is so unresponsive it's barely functional at all - assuming i even get a conection.

[gray yacht]

A little Google Fu https://status.hackthebox.com/

You might need to play with using a different VPN config.

This article has some troubleshooting steps you can try that might help with the lab env
https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

[faint hill]

Strange. The page says no issues. No connection. I've refreshed a few times... new VPN server, refreshed, deleted the vpn file, reconnected and it either won't connect or when it does... it is so maddeningly slow as to be unusable. Good luck copying and pasting tickets from Rubeus witht that kind of unresponsiveness.

[faint hill]

I've been using these kinds of fora and platforms for years. .....

[gray yacht]

Which Kerberos Atacks section are you working on? I can check my end and if it seems solid pass along what I am using.

[faint hill]

Unconstrained Delegation - Computers

I finished the module yesterday but am going over some stuff to check my execution/ workflow. Worked sort of OK but was also really slow

[gray yacht]

I have a slight lag on US Academy 5 (medium load) using UDP, but definitely able to run Rubeus and copy/paste output.

[faint hill]

have also just switched to a US server with supposed low load and it only connected after 4 tries. Will check the latency, if not to standard I'll wait a day or 2 and try later.

[wooden ivy]

same here

[toxic vault]

Hi I've started the SOC Analyst and keep getting this message in my virtual machine everytime I try to connect to the hive

Unable to connect

Firefox can’t establish a connection to the server at 10.129.238.130.

The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer’s network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the web.

[hidden ledge]

VPN is up ?

[toxic vault]

how do you do that

im new

[hidden ledge]

https://help.hackthebox.com/en/articles/8602725-understanding-the-hack-the-box-vpn

You have to download a vpn config file to access the HTB network. But everything is well explained in the link above

[toxic vault]

Do I have to install open vpn connect

im on windows

not the file you mentioned

[steady onyx]

hi can i ask for help when answering a module question here

[dusk holly]

yes

[inner basin]

#careers-and-certs

[dull delta]

I am having some trouble on the skills assessment for the Intro to x86 assembly module. I believe I have successfully disassembled and decoded the provided shellcode. But I can't seem to get the key. Decoded shellcode is sitting on the stack at $rsp.

[fathom pendant]

sometimes you have to give it a few minutes after spawn; it can take up to like 5 minutes from what i've seen

[vague dome]

Quick question since I'm kinda lost in the Intro to assembly language skill assessment, what exactly do I have to put as the answer on the first question?

[fathom pendant]

https://academy.hackthebox.com/module/85/section/875 this section?

if so there's a flag within it that's in the format HTB{..}

[vague dome]

The skill assesment one Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode, by adding a loop to 'xor' each 8-bytes on the stack with the key in 'rbx'.

[fathom pendant]

Ah I didnt do that one, but the answer will be the output of it

[vague dome]

I see, thank you

[dull delta]

@vague dome, Im on the same one. Can’t get the decoded shellcode to run.

[cloud vessel]

Can someone please give me a hint for the File Inclusion/Automated Scanning module? I started by typing the following command but I'm getting tones of 200's:

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?FUZZ=value' -fs 2287

[fathom pendant]

Its backticks, not quotes

[cloud vessel]

got it

[fathom pendant]

``` at the top and bottom

Anyway gimme a sec to pull it up and see if I can figure it out

[cloud vessel]

sure, ty

[fathom pendant]

Your filter size is wrong

[cloud vessel]

hmm

why is it wrong?

[fathom pendant]

because it is.... LOL

[cloud vessel]

hmm

[fathom pendant]

you're getting a bunch of 200 requests... yeah? and what size do THOSE requests have in common

(don't answer that, just getting you to think logically)

[cloud vessel]

gonna look at the output again

[fathom pendant]

the example filter size is just that an example, based off the example results

[cloud vessel]

They are all 2309 in size ...

so that may mean

[fathom pendant]

that's the thread to follow 😉

i'm also deleting it so that others can't just cheat their way through (ik it's a tier 0, just rather push the way than have someone tell them)

[cloud vessel]

yeah yeah no problem

tbh though, it's so much info I'm ingesting that I wasn't even sure what -fs was doing

[fathom pendant]

the LFI lists from the reading should get you the rest of the way

[fathom pendant]

so ffuf has two parallel filtering types -f[type] and -m[type]; -f[type] filters out the [type] based on what you specify; so -fc 404 (which is the default iirc) will filter OUT (so it excludes) any responses with code 404 (not found) from the output. the -m[type] filters IN what's specified, and only includes results with your matched filters

you can do ffuf --help to see all the options; or man ffuf to see what all you can do

[cloud vessel]

I thought it was for "filter size"

hence when I did -fs 2309 it excluded all of them

[fathom pendant]

-fs -> filter OUT size

[cloud vessel]

I aggree I should've read the ffuf man

[cloud vessel]

got it

[fathom pendant]

meaning that if the result contains the size you specified, it doesn't get shown in your output

[cloud vessel]

-fs: filters out by size and -fc: filters out by code

[fathom pendant]

yup :)

[cloud vessel]

oh you can match them accordingly

so neat!

[fathom pendant]

yep

though in MOST cases, you're not gonna know what you want to match

[cloud vessel]

makes sense

[fathom pendant]

but you do know what a response you don't want looks like :D

[cloud vessel]

so you just go for it and then filter it out according to what you need

[fathom pendant]

yup

The examples and lab are a way to build up the thought process; because you WILL get 200 codes... because index.php does, in fact, exist

[cloud vessel]

yeah

[fathom pendant]

it's also a way to make you think that a response code doesn't necesssarily mean it's what you want

even 403 (forbidden) errors can be useful to look at sometimes

[cloud vessel]

pretty cool

these kinda moments is when I realize that I still have a few more years before AI can do it like people like you can today

[fathom pendant]

I think the thing that people often overlook when doing the modules (in general) is that they're attempting to teach you a way to think about the problem, just because the lab doesn't follow the examples perfectly doesn't mean you shouldn't be learning something from it. IMHO the labs that follow 1to1 don't teach too much if there isn't a decent enough explanation as to why.

[hexed oyster]

speaking of which, I'm struggling with Attacking Common Applications -> Attacking OSTicket. I've confirmed the vulnerability mentioned in the writing and I understand and have figured out how to leverage the technique they introduced. There must be something I'm not understanding because I'm not seeing a way forward. It occurs to me that this module is less of a "code" vulnerability and more of a vulnerability in logic, which is definitely a weak spot for me.

Feel free to dm me, I can provide more in-depth explanation, I just don't want to give out spoilers.

[fathom pendant]

i'm assuming you logged in to the portal? (this is one of my least favorite ones, as the credentials were given in an example they labeled 'not real' or something like that)

at least I think that's the one

[hexed oyster]

I remember trying those creds on the off chance they were valid and nothing landed on OSTicket for me....

<checking notes>

I don't think I tried it on those on anything else, though...

I'm going to try that now.

[hexed oyster]

I'm going to go back and check myself on those, just to make sure that I've done it.

[hexed oyster]

may I dm you a screenshot to verify?

[fathom pendant]

I'm not at my notes right now to verify myself 😅

[hexed oyster]

OH! 🫢 no worries! I'm sure I can manage this part on my own.

Thank you, anyway.

[severe inlet]

Hello i have a question regarding the "Gold Annual"
For the following since one of the features is "Exam voucher switching (applies to unused exam vouchers)" Can i change the HTB CJCA to any other exam voucher?

[fathom pendant]

As far as I'm aware no, as it's not the same tier/cheaper than the other 2. but it's best to reach out to website support for confirmation

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[hexed oyster]

Figured it out. Thank you! ❤️

[void stone]

could anyone help me with the NTLM relay attacks skill assessment? i have creds so from my understanding petitpotam should work. i do not understand why it only works the way the solutions describe by creating a computer account

[fathom pendant]

Ill be at my computer in an hour to check my notes if you wanna dm to remind me to check.

[weary torrent]

okay dm'ing you in an hour, thank you

[vestal bloom]

same problem. Any hints?

[void stone]

I figured it out. and the reason is honestly hilarious

[weary torrent]

just dm'ed you

[fathom pendant]

Yup just a sec

[junior thunder]

the connection between my target and my attacker is rll slow like so slow it taked multiple seconds for a single ping! when i do an nmap scan it says host is down i can only scan with -Pn and the scan will take 3,5 hours

my pwnbox is on the lowest delay of 21 ms is there any fix ?

[cloud urchin]

maybe try changing regions, but also depending on the type of scan it can take a long time

nothing in acadmey should take that long though, so you may be doing something wrong like the wrong kind of scan, or scanning ports that don't matter

[junior thunder]

but if i use ping (ip) i still got no response after 17236 ms

[fathom pendant]

not all devices respond to pings; unless you're saying it replies after that long

[junior thunder]

it responded after that

[fathom pendant]

it also helps to say what module you're working on so others can verify if it's the lab or just you

[junior thunder]

module/77/section/726

[cloud urchin]

we don't have that stuff memorized

[fathom pendant]

the numbers are borderline useless, it helps to provide the names

[junior thunder]

penetration tester getting started

should i change vpn region ? because it does not work in my vm and in the pwnbox

[cloud urchin]

If you've launched the VPN at the same time as using the Pwnbox that is a problem. They share the same IP and it could be the cause of your problems.

Terminate everything, then re-start the target and pick only one. Yes changing regions can help.

[junior thunder]

ahh okay ill try that

i mean i can ping the target now but nmap -p- (ip) is still really slow 2 min elapsed 0.94% done

does it matter what protocol i have on the vpn ?

[cloud urchin]

which section? do you really need to scan every single port?

[junior thunder]

Perform an Nmap scan of the target and identify the non-default port that the telnet service is running on.
the hint was use -p-

imma change regions and see if that helps

i do see a LOT of authenticate/decrypt packet error: packet HMAC authentication failed in the vpn logs

[cloud urchin]

can you just name the section

[junior thunder]

service scanning

[cloud urchin]

it probably won't take that long to get it, but yeah you're supposed to use -p- there. make sure you're not using unnecessary stuff like scripts.

[junior thunder]

im not but authenticate/decrypt packet error: packet HMAC authentication failed this keeps on popping up when i start the nmap scan

just skip this question ?

(in htb)

[cloud urchin]

idk that sounds like an issue with the vpn connection

if you switch regions you have to re-download the VPN file for that region

killall -9 openvpn

re-download for your region, then try opening the vpn connection again

[junior thunder]

ohw killing it broke the file

hmm yea ive reactivated the vpn now on us server but still the scan is so slow

or not even working

it just says host is down

i was able to answer the SMB question

the normal nmap scan takes about 3 mins so is it the -p- that makes it take 3 hours ?

[cloud urchin]

that makes it scan every port, but there are more factors such as if you're scanning udp, tcp, if you're running scripts, etc.

[junior thunder]

my command is nmap (ip) -p-

now it takes 38 mins

that seems more reasonable

ill just wait it out

tysm for ur help !

[cloud urchin]

yeah it won't take that long, you should find the port much faster than that, just let it rip

np

[vast cairn]

hey guys I'm getting close to the end of the Wifi Pentesting Basics module, and I"m trying to connect to the WEP device, HackTheBox-WEP. But, I can't ping or wget or anything from the IP they tell me to get the flag from.

Nevermind. I forgot to run the dhclient command

[lusty terrace]

I am doing The live engagement for Shells and Payload but there is no browsers in the RDPed machine besides tor which it says I can't use it because there is no internet

[fathom pendant]

firefox in the terminal

[lusty terrace]

thank you and lol that was very stupid .....

[fathom pendant]

:)

also

for your future reference, look at the desktop :D

(this is unrelateed to firefox)

[lusty terrace]

oooo some creds

[neat halo]

Seem the cheatsheet was wrong

[fathom pendant]

what's wrong about the cheatsheet, also #1234357888114364508 to report errors

ah checked the docs. but yeah #1234357888114364508 is where you should post

[neat halo]

extension specified should be using -x instead of e

sorry I post it there

[fathom pendant]

and the status code is -C

-e is extract links from response

[short osprey]

If anyone has any hints for the LFI Skill Assessment I'm all ears, I've hit a brick wall trying to get any RCE.

[tranquil fulcrum]

can i get a nudge on the Type Filters module? ||I've successfully bypassed the filters and uploaded the file but for some reason I couldn't get the code to execute? it just displays the script as is ||

[cloud urchin]

Please don't reveal content from modules above tier 0, like attack paths/vectors etc

[lofty totem]

Hi everyone ,

I’m stuck on the SSL/TLS Certificate Pinning Bypass lab and would appreciate guidance from anyone who has solved it, i have been try'n for 2 days and tried all configurations/steps with no clue.
Section: Android Application Dynamic Analysis
Lab: SSL/TLS Certificate Pinning Bypass
Current problem: Burp still does NOT show any ChatApp traffic after rebuilt, re-signed, and reinstalled the modified APK multiple times

Verified Burp CA replacement and network_security_config.xml
Any help or nudge in the right direction would be greatly appreciated

[digital pendant]

Sounds like the file type youve gone with isnt being detected as scripts to be executed. Revisit the material and make sure it matches (or in some cases it may want you to try something different) it might talk about .php.jpg but instead .phtml.jpg is expected to work.

Im not near my notes to actually check but that may help

[rustic sage]

Hello, I'm working on the "Password Attacks" - "Credential Hunting in Network Shares" module, and I'm having some difficulty understanding why Snaffler is unable to pickup on the second set of credentials needed. I'm curious if I'm using it incorrectly, I've run .\snaffler.exe -s -o snaffler.log and .\snaffler.exe -s -i C:\ -o snafflerlocal.log and even pointed it directly at the folder the second set of credentials are in and it doesn't seem to find them even though it seems like it should. The file is a text document and has the word "Password" in it, which I would think would match. Any tips are appreciated. I am OK using other tools, but this one seems a bit stealthier considering you can turn off the network discovery and run it on the local file system.

[midnight crescent]

in the Shells & Payloads i cant connect to the target I tried with booth openvpn and The pwnbox I cant even ping it.
exactly in the Reverse Shells tab

[steady willow]

HI all! I'm doing the "Intro to Threat Hunting & Hunting With Elastic" lab, and I'm stuck on a question for "Hunting for Stuxbot". It asks me for the process arguments for mimikatz, and I think I've found the correct arguments, but it's not accepting it. I suspect it may be a formatting problem.. Can anyone help me verify?

EDIT: UGH, got it. If anyone ends up reading this and running into the same thing, be mindful of commas

[calm swan]

I’m currently working on the Login Brute Forcing module, specifically the Dictionary Attacks section, and I’ve run into something I don’t understand.
I was able to get the flag using the provided Python script, so I know the correct password and that the service is working.
However, when I try to replicate the same attack using ffuf (cuz it's just faster), it doesn’t work at all.
This approach did work for me in the previous section (Brute Force Attacks - PIN brute force), but for this dictionary attack it fails.
What I tried:

• Using ffuf with a POST request to /dictionary
• Filtering out responses that contain the incorrect password error message
• Various combinations of headers and filters
  After ffuf didn’t return anything, I tried to manually reproduce the request with curl, but even that fails when using the correct password:
  curl http://<IP>:<PORT>/dictionary -X POST -d "password=<REDACTED>" (also tried providing content-type for json and urlencoded)
  So my questions are:
• Is the endpoint expecting some specific cotent type or body format I didnt test out?
• Is the python script sending the request differently?

[covert schooner]

Anyone for a nudge on footprinting Hard assessment.
Not able to figure out the starting point

[dusk holly]

did you also check UDP ports

[covert schooner]

Yep got that one. IDK why -sU -p- did not reveal that

[elder prawn]

guys im like

losing connectoin every 30 seconds doing machines

[frosty plover]

Hello, I was trying to complete the Firewall and IDS/IPS Evasion – Hard Lab, but I got stuck there. I searched online for help and saw that many people managed to solve it thanks to hints. If there were no hints, how would I be able to find the port I need? The port is a xxxxx five-digit number and it does not appear when scanning all ports. When performing a “healthy” (safe) scan, it takes a very, very long time. Is there anyone who could help me with the appropriate command?

[frosty plover]

@hoary cloak

[hoary cloak]

You kind of answered your own question

the "correct" scan would take a long long time

This is just the nature of IDS/IPS and how they can punish based on Time vs "Volume"

I am not sure, but I assume the "correct" scan would look something like this:
nmap -sS -p49152–65535 -T2 -f --source-port 53 -Pn -n

maybe it would need to be more granular, maybe even slower, maybe SYN scan is not enough. But that's a good starting seed I guess.

[frosty plover]

I thought I would obtain the answer by doing a slow and safe scan. It’s just that this is a lab, and I assumed it wouldn’t take an excessive amount of time to scan, so I wondered if there might be some additional method. Because finding the answer only through a hint doesn’t really make sense. Thank you.\

[misty solar]

Hi everyone! I'm trying to solve the questions section of "IMAP/POP3" footprinting section, but I'm stuck to connect to POP3 and IMAP services of the target machine.
I have executed "openssl s_client -connect 10.129.114.49:110 -starttls pop3 -msg" to connect to POP3 service but the server does not complete the TLS handshake, there is no server hello.
The same trying to connect to IMAP "openssl s_client -connect 10.129.114.49:143 -starttls imap -msg". I have encountered the same behaviour also on ports 995 and 993 - I'm using these commands : "openssl s_client -connect 10.129.114.49:995 -msg" "openssl s_client -connect 10.129.114.49:993 -msg".
Can you please help me to understand what is wrong ?

[calm swan]

any1?

[misty solar]

anyone can help pls ?

[bright quiver]

Anyone finish the ai red team path specifically the ai data attacks and the one after the application one. If so please feel free to dm me. Looking for some advice or tips. I’m more so stuck on the pickle module and the attack assessment.

[tired locust]

Hello everyone
I'm trying to do kerberosting from linux module of penetration tester path
I used GetUserSpn.py module but it needs valid password to list available information but I can't see any cleartext password in lab guide itself
What am I doing wrong here?

[tribal lark]

could someone help me with https://academy.hackthebox.com/module/113/section/2139 thanks i cant find the MAP with -RW-- permissions ............. never mind i figured it out 🙂

[gray yacht]

You can grab it from the Credentialed Enumeration - from Linux section of the module.

[gray yacht]

You can DM if you are still not getting anywhere.

[tired locust]

Thanks a lot
Can you give much more details
How can I exactly extract the passoword for SapServiceaccount?

[gray yacht]

Pretty sure the section covers that.

[tired locust]

I've found that
I appreciate your help

[dull solar]

https://academy.hackthebox.com/module/81/section/787
I've got a format issue with an answer. Specifically for question 1 on the page. It asks for both ports which I do have and know are correct as I double-checked on the solution, but I don't know in which way to format the two ports to submit.

Any ideas?

[fathom pendant]

This module reuses creds, a lot. Always save credentials, never know when they'll come in handy

[fathom pendant]

Format is
X Y

[dull solar]

tyy

[fathom pendant]

Ive seen a fair bit where if htb wants you to list, unless explicitly told otherwise, the format is
A B C ...

[dull solar]

alrighty

[naive parrot]

https://academy.hackthebox.com/module/112/section/1245

am I supposed to crack the hash myself to get the clear text password ?

[waxen totem]

If metasploit doesn't do it for you then yes do it yourself.

[naive parrot]

I've tried

and the hash metasploit give me is a fake hash kinda

it's 123456789abcdef

repeated

[naive parrot]

ok I got it

idk if I can say what I did to get the solution

but I changed something in the options of the metasploit I was using

[fathom pendant]

you can use hashcat

just don't use the mask (-a 3)

[quartz sundial]

Hello!

Please help me with the "Introduction to Windows Evasion Techniques" module. The lab where I can generate files is on the second page of the module. But for the tasks are run in a different lab. Is this the intended behavior? So, I need to spawn one lab first, then generate the payload, then spawn the second lab and test the payload? And if there's something wrong with the payload, should I spawn the previous laboratory back?

[fathom pendant]

this is intended

[quartz sundial]

This is somehow complicated.. no?

The project I created is deleted after lab respawn. Should I recreate it for each test? Maybe there are two machines in the second lab? I could connect via ligolo without any problems. It's more logical

[fathom pendant]

i mean the main bit is transferring files back and forth

[quartz sundial]

File transfer is not a problem

[quartz sundial]

I can't found EVASION-DEV in network

[fathom pendant]

as in from the dev to your vm then from your vm to the victim

i haven't done the module myself and don't know if the module specifically tells you about the setup

[quartz sundial]

You don't understand.

I can't run two labs at the same time, this https://academy.hackthebox.com/module/254/section/2826 and this https://academy.hackthebox.com/module/254/section/2827

I don't understand how I can simultaneously create a payload and test it to get a flag

[fathom pendant]

i know what you mean

i think i'm not conveying it right

[quartz sundial]

It's a very strange situation... it seems like I just don't understand how to connect to the second virtual machine in the second lab.

[fathom pendant]

spawn dev -> create payload
payload -> your attacker vm
spawn victim -> transfer payload

[quartz sundial]

So, I have to launch each lab in each section one by one?

[fathom pendant]

like i said, unless the module itself says otherwise in the reading, I guess

[quartz sundial]

This doesn't make sense. Why not just create two labs in one network? It's just unrealistic to work like that...

[fathom pendant]

/feedback

[short osprey]

Got it! That was a whole lot more complex than I was expecting. A good challenge.

[signal chasm]

do you guys recommend using the parrotOS VM to do all the modules from HTB or should I use an own VM?

[cloud urchin]

your own vm

[tight copper]

this my module Spraying, Stuffing, and Defaults in Password Attacks i need help for Use the credentials provided to log into the target machine and retrieve the MySQL credentials. Submit them as the answer. (Format: <username>:<password>)

[signal chasm]

why? where are the benefits in using my own VM?

[cloud urchin]

faster, unlimited time

[signal chasm]

Unlimited time i got already with the membership. Yes, the velocity is indeed a thing. But I assume that all tools needed to complete all things will already be installed and working flawlessly, no?

[cloud urchin]

not sure, i used my own vm

it's just a much better experience imo

nothing wrong using the pwnbox though

[signal chasm]

I am asking because slowly I am noting some differences according to the tools. SELinux doesnt run on ParrotOS but ont module is telling me to use SELinux. This is starting to confuse me. I am not sure if this is on me. I cannot believe that HTB has modules, which cannot run on parottOS (SELinux thing is optional though)

[cloud urchin]

i never did that so idk

it's probably just showcasing it

not expecting you to use it on the attack box

regardless vm is better imo, like i said. but that's just my opinion.

[signal chasm]

I am doing the module linux fundamentals part network configuration and want to do the optional thing with apparmor. Can anyone recommend me here something super simple to try apparmor out? I need something that I can experiment with it and confirm it by my own. I am not very "pro" with services and stuff.
for the first step I thought i can create a file and try to remove the permissions for it, but for that, I do not need apparmor, I just us chmod. I think that is not the way to go... What service can I use, which I can easily execute and modify and test it with apparmor? any ideas?

[signal chasm]

ok, I think I will consider this. Since it can also be usefull to have my own VM set up with the tooling needed

[tight copper]

i am here i do Spraying, Stuffing, and Defaults in the module of passsword attack

[dusk holly]

one tool is mention for searching default credentials in the section

search for MySQL in the tool

and try to connect to the localhost MySQL service for checking valid credentials, you can easily found the connecting command by searching google or using any AI

[tight copper]

okay i am gonna see thanks

[dusk holly]

well, that is too much for just a section, do you take notes

[tight copper]

yeah i do a reprot like what i have do and not etc...

[dusk holly]

not report, the notes you take while learning the section and module

[tight copper]

when i learn smth yeah i take note but not always its depend if the module its difficult for me or not

do you have advice for me

[dusk holly]

sometimes you might miss simple things, so it is always good to add simple things to your note, even if it simple tool or action

[tight copper]

okay thanks i will do that now 😅 😂

[dusk holly]

great, good luck, don't hesitate ping me when you got stuck in password attacks module, i recently completed that one too

[tight copper]

okay

[proven stirrup]

Guys can someone help me with the second q in Pass the Certificate password attacks module bcz i think there is a problem with it

[civic sinew]

I am stuck on the last question of Attacking WordPress, i tried to edit the 404.php template but got an error "Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means, such as by using SFTP." I tried also the wpdiscuz rce, but no luck. Can somebody please give me a hint?

[gray yacht]

Make sure your hosts file is accurate, that you have the IPs in the right spots within the attack chain, and can also try things with sudo or as root, just to rule that out. Most of the time attention to detail is the biggest reason this gives people problems, but sometimes there are other issues. Check those things and if you still have issues come back to this channel.

[twilit sparrow]

Hi! someone could give me a hint for Advanced XSS and CSRF Exploitation
Skills Assessment? I know where to inject but without any results trying to promote my user. Thanks in advance!!

[olive depot]

May i DM someone, for help on the 'Password Attacks' Module? Been stuck for a while now >.<

[dusk holly]

more people tend to help when you ask your question directly

[river grove]

You can DM me

[pallid temple]

Hello everyone, can someone help me please, i don't know why i can't pass this question

[tropic notch]

I justed finished local file inclusion assessment that was hard i spent almost 5 hours

[lament maple]

Hi Team, I am having a problem connecting to Target system: 94.237.50.128:30133, When trying to login from HTB provided PWN box: htb-qefs0klkws.htb-cloud.com:1 (htb-ac-2054659)
While logging with this command ( mysql -u root -h 94.237.50.128 -P 30133 -p) it Show error: ERROR 2013 (HY000): Lost connection to server at 'handshake: reading initial communication packet', system error: 11

Struggling from last 1hr to connect. How shall I fix this?

[lament maple]

Problem is only when I try to swapn target mysql db in 'SQL injection' section of module: 'SQL injection fundamentals'.

[pale island]

the sql injection is on the website. so just visit the ip in your browser and it should work

[lament maple]

Wow… I really just spent an hour on this for nothing 🙁
Thank you!!!

[pale island]

Dont worry happens to the best of us

[green flower]

@slate zinc all the symbols got replaced with this in the site

[winter shell]

Hello ! i am currently at the pivoting and tunneling module and the RDP and Socks tunneling and i cant run the command regsvr32.exe SocksOverRDP-Plugin.dll because i have a error. i have also disabled the antivirus. Any ideas ?

[slate zinc]

whole website?

what os and browser do you have and do you have any extenions installed?

[green flower]

yeah even in my settings all the symbols in text got replaced with similar thing it was normal like few minutes ago then it became like this

[slate zinc]

@green flower

[green flower]

it got solved browser problem it seems everything is fine now thanks for helping

[winter shell]

Nevermind you had to open the cmd as admin

[pale island]

in server side attacks the identifying SSRF i cannot seem to get to the last step doing: Access the internal application to obtain the flag. (idk why but curl worked but via burp it did not)

[pale island]

okay i still have the problem. it does not matter whatever i send trough burp it just gives me the standard page (even though i use the module supplied commandswhich give a different output when you look at the module photo's) (edit works in pawnbox but not on my own VM even when i add the domain to the /etc/hosts file. reinstalling vpn file has done nothing too. doing exact same request but only pawnbox give the right one) if anyone has a solution i would love to hear it

[echo widget]

Hi,
I'm stuck on the module DACL Attacks II Skill assessment, Q2.
I think i have the path, but i'm struggling, I need a little hel please 😢

[safe star]

dm

[somber sonnet]

I've tested some of the payloads, and they do seem to work locally, but for some weird reason it just doesnt work on the target system even after taking into account the filters

[reef osprey]

are you installing the certificate (.cer) in de device correctly?
what does it said the "event log" in burp?

[heavy dome]

Module: ADCS i've issues with labs, routing it's right?

[heavy dome]

HELP!

[autumn pilot]

Did you check your /etc/hosts file as lab.local points to a 192.168.1.75 IP address

[fathom pendant]

be mindful of sharing information from modules above tier 0; it's also recommended (if you're doing the CPTS course) to do it blind. As in not reading the material at all

[heavy dome]

i've sloved whit -ns... THX!

[eternal vigil]

Hey i have a doubt in Attacking Common Services FTP module , in the lab environment they are asking us the port, is there any way to get the port of ftp instead of doing -p a full port scan which was taking like an hour, i just guessed the port in the lab but i want to know if there is any method to find port for a specific service or what is the right method to go about it???

[fathom pendant]

the problem is that it doesn't reliably spin up, iirc the standard scan does check for common alt ports, so you shouldn't need to do -p-

but it also shouldn't take an hour

[eternal vigil]

yaa that's what bothered me the most and guessed it outright

[fathom pendant]

sometimes i just throw in -sT to force it to use TCP instead of SYN scan

[eternal vigil]

That makes so much more sense

[fathom pendant]

But also, it can depend on your connection

[eternal vigil]

just expanding my search perimeter might help i'll try that. Thankyou.

[fathom pendant]

while the tcp connection is generally recommended/preferred for your vpn, if you have an unstable connection - UDP will work better

[eternal vigil]

thats fair, Thankyou, it cleared my doubts.

[thin nest]

Module - Introduction to Windows Command Line section skill assessment

guys i am stuck here
i have logged in via ssh where is the flag ??

[digital pendant]

Its in the MOTD / banner ? Check the text that reads out when you SSHd in

[thin nest]

i checked .ssh there is a long hash there

@digital pendant where is MOTD /BANNER ??

OHHHH

I FOUND IT HOMIE

THANK YOU 🙂

[somber sonnet]

ah I see, apologies

yeah Im currently doing a semi-blind run, doing as far as I can until Im stuck, then referring to the walkthrough

[thin nest]

i cant login to this macchine

what is the password

Module - Introduction to Windows Command Line section skill assessment

""

or blank

can't ssh

found it guys

no problem

[lusty terrace]

Password attacks for VHD is taking forever...

[fathom pendant]

why are you applying such a large ruleset?

also helps to provide the module and section name so others might be able to help you better

[lusty terrace]

this is what the module teaches. Module is Password Attack - Cracking Protected Archives

[fathom pendant]

also the example doesn't use a ruleset

[lusty terrace]

Im not using a ruleset

[fathom pendant]

in the previous bit you used one

[lusty terrace]

the upper one I did but then I Did it normally like the module suggested

[fathom pendant]

ye gimme a sec

[lusty terrace]

it's making my mac hot :vvvv

and eating battery like crazy

[pale island]

Still stuck on this, cannot get burp to work on my own vm but works on pawnbox. currently think its local antivirus on pc blocking it. could that be possible?

[fathom pendant]

john might be able to find it faster; but you'll need to echo it into a file

[lusty terrace]

alright I'll try it with john

[compact otter]

hello, quick question, im doing cwes path right now and when i start zap and try to open their preconfigured browser im hit with this error

does anyone know what the reason could be?

i haven't checked the website they recommended in the error yet, will do now but just want to check if anyone else has this problem

nvm the faq helped me fix it

[fathom pendant]

lol yep the docs are always to the rescue

[compact otter]

i was scared it was my linux distro causing this problem lmao

[gusty mortar]

Advanced SQL Injections   - Skills Assessment
Anybody i can DM ?

[pallid temple]

Yesterday I asked if someone could help me with a question that I'm confused about, I was answered with a laughing emoticon. I don't think it's funny that I asked, if you want to block me it's ok, but I asked the question here because the support people directed me to ask for help here, so I'm asking you once again regarding the question, I've tried everything and the only answer is the same and I don't understand why it doesn't work. Thanks in advance.

[waxen totem]

It's funny because that's an error regarding permissions, not the contents of the file 😅

[pallid temple]

Ok I understand,thank you

[thin nest]

Module - Introduction to Windows Command Line section skill assessment

i cant locate the flag.txt within thousands of flag.txt

how to get the output within flag ??

i am trying to use tree find findstr

[dusk holly]

they probably teached filtering, maybe it can be helpful

[thin nest]

filtering nah man

only in powershell