modules

[acoustic oak]

Great! yeah probably a lot of people hitting that one or server issue, who knows. Happy hacking

[deep hemlock]

could be

what are you doing

its down again

[acoustic oak]

I'm working on Web Fuzzing. No issues on that module.

[deep hemlock]

what shittty thing its just getting down i couldnt upload atleast

somwhow at last lol

[acoustic oak]

Sometimes pwn box is slow, sometimes it's best to use your own machine if you have the power. Or it could be the target idk. Sometimes that's part of the process is dealing with speed.

[deep hemlock]

i never pwn box

used this kind of first time only for this one

can u imagine

[gray yacht]

If that's splunk, use https instead of http

[deep hemlock]

ended btw thanks for the suggestion it would help me later

[mystic fjord]

Is anyone else experiencing this error in the API Attacks module?

Looks like de public instances are not responding

[dire flint]

I have an enterprise account with private instances, but I cannot spawn any machines on the NTLM Relay Attacks module, is there a downage with HTB servers ?

[gray yacht]

Did you attempt to go to the Swagger UI that it mentions in the Swagger API User Interface paragraph (near the bottom of the Introduction to Lab section)?

[mystic fjord]

my bad then hehe, thx

[gray yacht]

All good, it's easy to miss.

[magic lotus]

Hello, I'm doing some modules and I have a doubt not related to the modules it self but more why some attacks don't work properly if we don't pass all the parameters directly like http://someip/reset.php?uid=52&token=e51a85fa-17ac-11ec-8e51-e78234eb7b0c&password=xxxxx.
I have tried with burp to pass the parameters like this but it never worked.

POST /reset.php HTTP/1.1
Host: 94.237.49.209:58900
Content-Length: 129
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://94.237.49.209:58900
Referer: http://94.237.49.209:58900/settings.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=prmls4umqft5eqpsm1p0q62qin; uid=52
Connection: keep-alive

uid=52&token=e51a8a14-17ac-11ec-8e67-a3c050fe0c26&password=xxxxxx

But then it worked like this.

GET /reset.php?uid=52&token=e51a85fa-17ac-11ec-8e51-e78234eb7b0c&password=xxxxx! HTTP/1.1
Host: 94.237.49.209:58900
Content-Length: 0
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://94.237.49.209:58900
Referer: http://94.237.49.209:58900/settings.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=prmls4umqft5eqpsm1p0q62qin; uid=52
Connection: keep-alive

Could someone explain why one works and the other not, and a quick way of identifying if any because I have lost a little bit of time figuring this out. 😀
Well the error was always saying missing parameters, this can be the tip, but nonetheless I have tried other parameters about the user and always receiving the same error.

Thanks in advance.

[queen quest]

I need help in one question "According to wikipedia.com snapshot taken on February 9, 2003, how many articles were they already working on in the English version? Answer with the number they state without any commas, e.g., 100000, not 100,000." somehow my answer is not correct. Anyone can help out?

[scenic parcel]

what was the status code for the first one?

[unique quarry]

hello guys, i'm at the Windows Services & Processes module and to be honest i cannot find the non standard service, i tried to run the get-service with status running but only bring standard services to me, anyone could give me some hint?/

[slate palm]

Hi guys. Can anyone give me a hint on the skills assessment of the Injection Attacks module ;-; ? I have found the xpath injection point but I can't guess what the xpath query might be to escape with the correct syntax. Your help is crucial because I am hard stuck on this for a whole week now 🙁

[elder prawn]

Hi Team, im doing module Active Directory Enumeration & Attacks,

in Kerberoasting - from Linux,

im told to do kerberoast attack via getuserspn, yet i don't have the password for forend???? why? how am i supose to get password????

this is not ok!

[autumn pilot]

I'm pretty sure that you've seen his password in past sections

[elder prawn]

ok, but it should've been in the section!

[autumn pilot]

It is the same environment, taking notes is crucial

[elder prawn]

sometimes the environment changes, and there isn't much of an indicator to know when it does. i just find that it would be simpler to put it in the section itself instead of 'taking notes', but hey thatsj ust em

[autumn pilot]

Well the module is one of the biggest out there, so note taking is quite important

The very least for the exercises, so you can come back and revisit your path of exploitation

And, either replicate it in the future or find other methods to do the same

[magic lotus]

With POST 200 OK - Access Denied
With GET 200 OK - Missing Parameters

Request:
POST /reset.php HTTP/1.1
Host: 94.237.122.188:55919
Content-Length: 56
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://94.237.122.188:55919
Referer: http://94.237.122.188:55919/settings.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=30jehh0i2ll2ernt49fnomuclq; uid=52
Connection: keep-alive

uid=52&token=e51a8a14-17ac-11ec-8e67-a3c050fe0c26&password=xxxxxxx

Response:
HTTP/1.1 200 OK
Date: Thu, 21 Jan 2026 09:55:33 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 13
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Access Denied

Request:
GET /reset.php HTTP/1.1
Host: 94.237.122.188:55919
Content-Length: 56
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://94.237.122.188:55919
Referer: http://94.237.122.188:55919/settings.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=30jehh0i2ll2ernt49fnomuclq; uid=52
Connection: keep-alive

uid=52&token=e51a8a14-17ac-11ec-8e67-a3c050fe0c26&password=xxxxxxx

Response:
HTTP/1.1 200 OK
Date: Thu, 21 Jan 2026 10:14:58 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 18
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Missing parameters

[scenic parcel]

I thought you were getting 405 for the POST. Looks strange to me. Maybe it's hardcoded that way.

[proven stirrup]

I didn't notice xd, but I solved it ty

[worldly prairie]

Can somebody help me with ntlm relay attacks skill assessment Question 3? I finished Q2 and downloaded ||ShareSQL.zip|| but cannot decrypt it (cleartext password not working). I have SMB session as DOB, but cannot find the attack path...

[hasty mauve]

I'm not really sure what was the next step but have you tried rockyou on the zip file?

[safe star]

did you type it in correctly?

[worldly prairie]

copy and paste from the log

[safe star]

dm what you tried

[worldly prairie]

stupid mistake -got it now, thx!

[fallen stag]

Hi, can someone help me clarify something regarding one of the taught content in the Web Attacks module ? I'm on Advanced File Disclosure section and can't seem to find any documentation or source that agrees with the following content :

After that, if we reference the &joined; entity, it should contain our escaped data. However, this will not work, since XML prevents joining internal and external entities, so we will have to find a better way to do so.

The mentioned payload for some more context is

<!DOCTYPE email [
  <!ENTITY begin "<![CDATA[">
  <!ENTITY file SYSTEM "file:///var/www/html/submitDetails.php">
  <!ENTITY end "]]>">
  <!ENTITY joined "&begin;&file;&end;">
]>

Ok I think I figured it out in the w3.org documentation, I don't know if it's relevant to keep the message there but here is the given explanation if anyone is curious to know :

Validity constraint: Proper Declaration/PE Nesting

Parameter-entity replacement text MUST be properly nested with markup declarations. That is to say, if either the first character or the last character of a markup declaration (markupdecl above) is contained in the replacement text for a parameter-entity reference, both MUST be contained in the same replacement text.

Well-formedness constraint: PEs in Internal Subset

In the internal DTD subset, parameter-entity references MUST NOT occur within markup declarations; they may occur where markup declarations can occur. (This does not apply to references that occur in external parameter entities or to the external subset.)

https://www.w3.org/TR/xml/#sec-cdata-sect:~:text=element.-,Validity,subset.)

[hearty wasp]

I got some trouble with the Password Attacks module, specifically "Pass the Ticket (PtT) from Linux" section
anyone did the last two optional tasks successfully?

[magic lotus]

Yes, that is the reason why I'm asking because even when you do it normally those parameters doesn't appear directly on the bowser or burp request like http://someIP:PORT/reset.php?parameters.
We have to pass it manually with this format /reset.php?parameters

Or is like you said something hardcoded in the code.
Hopefully someone can explain.

Thanks for your input.

[fleet spear]

have you tried in burpsuite to scan with paraminer for guess query parameters? the purpose could for example be that in normal cases some parameters are not disclosed because they are only supposed to work from example an admin view

[gritty sundial]

I think an answer for ||"Based on the contents of test000002.ptr.err, which line of the intermediate language (IL) file assembly.ll does the vulnerability appear on? Provide only an integer, eg 123. "|| in the "Introduction to binary fuzzing" is incorrect. Can some one help me please?

[gray yacht]

You can DM if you are still having trouble with this, but I am going to delete the screenshots because of the content being above Tier 0.

[hearty wasp]

@gray yacht apologies.

[gray yacht]

It's all good.

[viral lotus]

Doing the intro to digital forensics module, I am stuck trying to pull the correct data from Velociraptor does this look correct? I am not getting the 'scheduled task' thanks

[gentle ridge]

About: Attacking AI - Application and System module assessment.
I did the enumeration of the MCP, calling resources and tooling, browsing for vulns but I got nothing.
I had a look on the solution (Yea it is bad). However, nop! I do not have the vulnerability. I can not exploit anything.
I restarted the box and so on nothing.

Any one got that kind of issue?

[faint geode]

Is this the skill assessment? Im just starting it so I can't help haha

[opal cape]

Hey are there any modules that are intros to docker and kubernetes? And have labs ?

[fathom pendant]

No, theres no modules specific to those.

[opal cape]

Ok thank you. Do you by any chance know any sources that may have labs on this?

[fathom pendant]

Google; it all depends on what exactly you want out of it

I believe k8 has their own set of courses and even certifications

[opal cape]

Ok thanks

[icy bramble]

Hi. I would like to make use of your help on the crackmapexec assessment. I am stuck on question 3. the password "We****1" I got from the database does not match any use i got from the rid brute force or the user enumeration with Atul account, nor the new users found as jas. Can you help me to know where i got it wrong?

[grizzled dirge]

Information Gathering - Web Edition > Virtual Hosts
I did successfully fuzz vhosts to answer questions 2-5, but question number 1 - the vhost prefixed with 'web' I cannot answer. I tried multiple wordlists, including subdomains-top1million-110000.txt, but there seems to be no vhost starting with 'web' on the target machine 🙁 Any hints?

[gray yacht]

Maybe try more things with what you identified in that database.

[icy bramble]

I tried bruteforcing with all the possible protocols. Just a hint to put me in the right direction. I don't know what to try again

[gray yacht]

That was a hint, lol

You can DM.

[trail hazel]

Hi I'm facing a minor bug happening on API Attacks module in security configuration section. I was following the steps and when I make a request with SQL injection as per example I get a TypeError: NetworkError when attempting to fetch resource I switched to another computer and tried it there and it worked. Anyone has any clue why this happens?

[tight copper]

hey i am doing Pass the Certificat of the** module password attache** but i am blocked at this ** What are the contents of flag.txt on Administrator's desktop?**

[jovial walrus]

on hard skills assessment for attacking common services why is it that nmap doesnt detect mssql running on the target?

[woeful ermine]

Hey guys so i was doing broken authentication skills assesement and for some reason ffuf just wasn't working, when i saw a write up and figured the correct extension i literally tested that in ffuf also didnt work yet when i use curl to same extension it works fine , i did use -request-proto http fyi and still didnt work. Any idea why as it really annoyed me, i got a picture to give an idea if anyone could help .

[fathom pendant]

Because its running internally from what I recall

[calm swan]

hello there,
quick question on the module Attacking Common Applications - PRTG Network Monitor.
I kinda obtained reverse shell but idk why I can't interact with it (cannot execute any commands)
Any idea what could have went wrong? (not providing the PS payload for reverse shell just in case it's too much of a spoiler)

[fathom pendant]

Likely the output isnt being sent to stream

[calm swan]

any idea how to do it correctly?

I mean the section is telling us to try to obtain a reverse shell so I assume it is possible, right?

[jovial walrus]

didnt quite get u

[fathom pendant]

Its possible, im just saying something likely went wrong with your payload

[fathom pendant]

As in its not visible and running from the outside.

[calm swan]

yea... got it now

thanks, I wanted to give up and just use winrm haha

[jovial walrus]

i cant rdp
Dynamic Port Forwarding with SSH and SOCKS Tunneling
second question on the exercise
proxychains xfreerdp3 /v:172.16.5.19 /u:victor /p:'pass@123'

[tribal lark]

Quick question on the AD enumeration & attack module…. Is dehashed not a paid service

[candid bough]

Yea, I'm pretty sure it is.

[dusk holly]

Pivoting, tunneling and port forwarding module -> RDP and SOCKS Tunneling with SocksOverRDP
trying to laod DLL file using regsvr32.exe but i keep getting error, i am pretty sure my DLL file exist, and just right after this error the DLL file is disappearing i don't know why thoug, any one faced the same error

[candid bough]

Defender quarantined the file.

Disable defender or add an exclusion.

[dusk holly]

alright, thank you

[dusk holly]

it looks like anti virus protection is off, but i still can see the quarantined SocksOverRDP file history

nevermind, real-time protection was on

[fathom pendant]

yeah RTP is a pain in the ass LOL i'm at least glad that windows made it run even if you disable defender itself

[fathom pendant]

kerberos-1.mit.edu
perhaps your krb-conf file is broken 😉

[dusk holly]

yeah i was wondering like where to fuck my file go, the defender didn't even notify me about it, so i was kinda shocked

[fathom pendant]

yeah RTP doesn't generally notify you

it just disappears

only if defender quarantines it

that's how you get disappearing notes

[jovial walrus]

used local port forwarding for now

What IP address is used on the attack host to ensure the handler is listening on all IP addresses assigned to the host? (Format: x.x.x.x)
this ques on remote port forwarding
i couldnt understand why we set lhost to 0.0.0.0 in the msf handler

[fathom pendant]

lhost - listening host; 0.0.0.0 is wildcard for all interfaces

so it's listening on localhost, tun0, whateveryourdefaultadapteris

you can set the lhost to tun0

[dusk holly]

when you use port forwarding or tunneling, the DNS resolution is performed by the pivot machine i guess so in normal connections your krb5.conf file does not matter but when pivoting machines it matters, that is how i understood it.

[fathom pendant]

and is generally going to be preferred

[fathom pendant]

it depends; the main thing is domain joined, since kerberos is really only used in AD

[dusk holly]

pivoting, tunneling, and port forwarding -> RDP and SOCKS Tunneling with SocksOverRDP
for anyone who is facing this issue, it is just access denied error, use administrator to load the DLL file, i wonder why it can't just say access denied instead of some fancy shit

[jovial walrus]

how should i fix this btw

[fathom pendant]

file corrupted maybe

[dusk holly]

right, the pivot machine wasn't joined to the domain in the lab i think, that is why it didn't work you mean

[dusk holly]

but it worked with administrator

also searching the error just said access denied so

[jovial walrus]

.

[fathom pendant]

i don't recall needing kerberos at all for this

[jovial walrus]

oh

not sure what is wrong then

[dusk holly]

i also thought it was DNS error because it keep giving DNS resolution failed in pivot machine shell

[fathom pendant]

DNS error would likely be because of the whole - krb.mit.edu thing 😅

[dusk holly]

i don't know how to demonstrate configuring krb5.conf in text but you can search it up how to configure it

[fathom pendant]

you don't need to configure it

it's not required

[dusk holly]

it worked for me after configuring though

[fathom pendant]

dude it's from the same module you're on, an earlier section even

[dusk holly]

i know, i am saying what i can remember and what worked for me, sometimes i trust AI too much i guess, but the krb5.conf really fixed the issue for me

[fathom pendant]

but i can state for a fact that configuring krb5 isn't required

[dusk holly]

maybe it was one of the solution i guess

[fathom pendant]

because it shouldn't need to interact with it

[jovial walrus]

after i finish my dinner can either of u get on a quick call and help me wth the rdp connection for dynamic port forwarding lel

[dusk holly]

you can still try my option thogh, it won't take long

[fathom pendant]

just did a fresh spawn

and it worked just fine

ssh -D 9050 ubuntu@targetIP -> proxychains xfreerdp /v:172.16.5.19 /u:victor /p:'pass@123'; works exactly as intended

[dusk holly]

do you still use xfreerdp instead of xfreerdp3

[fathom pendant]

xfreerdp3 isn't installed on pwnbox and i'm getting ready for bed

[dusk holly]

alright, sleep well

[jovial walrus]

https://tenor.com/view/good-night-gn-晚安-buenas-noches-bonne-nuit-gif-16475290021408405446

[dusk holly]

did it worked with fresh target

[jovial walrus]

ah still having dinner..i will get back to u

[dusk holly]

alright, take your time

<@&861185840277487616> this looks like scam so

[toxic cradle]

I’m in the Linux privilege escalation module

Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer.?
After spawning the shell by ncdu I’m not able to find the flag?

[dusk holly]

maybe try configuring krb5.conf if that does not work then i don't know any other options

[jovial walrus]

hmm

[dusk holly]

this is my krb5.conf for example

[jovial walrus]

yeah idk if i should make changes for now..I'll see what happens in next few sections then decide

[dusk holly]

i think there is a section where they teach how to change this configuration

also you can try pwnbox for this

[spiral jetty]

Look for the custom DNS server version! 😏

[storm elk]

Guide to ask a great question: #modules message

[brisk drift]

Thx for your help

[sly nebula]

Are there any plans in the future for modules discussing source code auditing, SSDLC, CI/CD pipelines, assessing software design and the like?

[waxen totem]

Future content plans, especially for academy, aren't released for a variety of reasons

[indigo pendant]

I'm currently doing the Intermediate Network Traffic Analysis Module, where the author shared this wireshark display filter to find failed authentications:

(wlan.bssid == F8:14:FE:4D:E6:F1) and (wlan.fc.type == 00) and (wlan.fc.type_subtype == 0) or (wlan.fc.type_subtype == 1) or (wlan.fc.type_subtype == 11)

The problem i see with it is that it filters for Association Requests (00) recieved by the specified AP (F8:14:FE:4D:E6:F1), but filters for Association Response (1) and Authentication (11) from any and all APs in the vicinity.

I belieive this is an error that is present due to oeprator precedence, which cna be simply solved by using parantheses like this:
(wlan.bssid == F8:14:FE:4D:E6:F1) and (wlan.fc.type_subtype == 0 or wlan.fc.type_subtype == 1 or wlan.fc.type_subtype == 11)

Now the 802.11 management frames only for the specified bssid will be filtered.

Am I correct? Or did i misunderstand what the author's intention with the filter was in the first place?

[gentle ridge]

Yes it is the skill assessment...

[fleet spear]

in windows 2008 server /windows escalate privlegies i only get the task scheduler to work of that sherlock report maybe vulnerable tried the logon2 that was reported maybe vulnerable i get it to report spawned systemshell but it cant spawn a reverseshell so maybe im just doing somethig wrong

[young sentinel]

Need help, might lose my streak if I can't figure out why this keeps happening. I have my bitdefender turned off (he and Kali don't like each other) as well as my NordVPN (since I am using the academy vpn). I am working on DNS Zone Transfer and every time I do the dig request, I get this:

dig axfr @10.129.4.44 inlanefreight.htb
;; Connection to 10.129.4.44#53(10.129.4.44) for inlanefreight.htb failed: host unreachable.
;; no servers could be reached
;; Connection to 10.129.4.44#53(10.129.4.44) for inlanefreight.htb failed: host unreachable.
;; no servers could be reached
;; Connection to 10.129.4.44#53(10.129.4.44) for inlanefreight.htb failed: host unreachable.
;; no servers could be reached

Any ideas why? I use Kali not Parrot, my Bitdefender and NordVPN are paused. I have no clue and I really don't need to lose my streak. Any help will be great and you may DM me. Please no answers, just some ideas and help.

[waxen totem]

try without the domain name

[indigo hare]

Hello, i need help.

Firewall and IDS/IPS Evasion - Hard Lab
With our second test's help, our client was able to gain new insights and sent one of its administrators to a training course for IDS/IPS systems. As our client told us, the training would last one week. Now the administrator has taken all the necessary precautions and wants us to test this again because specific services must be changed, and the communication for the provided software had to be modified.

(champadm㉿SRVKALI)-[~]
└─$ nmap -sT -Pn -n -sV --version-intensity 2 --max-retries 1 --scan-delay 3s -p 22,80 10.129.4.227

Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-23 11:20 CET
Stats: 0:00:12 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 11:20 (0:00:06 remaining)
Stats: 0:00:17 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 11:20 (0:00:11 remaining)
Nmap scan report for 10.129.4.227
Host is up (0.076s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.94 seconds

Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.
Ubuntu 4ubuntu0.7

Submit
The answer you provided is incorrect

any can help with write target?

[waxen totem]

Well that ain't a service that's an OS...

[indigo hare]

Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.
OpenSSH 7.6p1

Submit
The answer you provided is incorrect

sorry im new at HTB

OpenSSH 7.6

Submit
The answer you provided is incorrect

Apache httpd2.4.29

Submit
The answer you provided is incorrect

Apache 2.4.29

Submit
The answer you provided is incorrect

“a service that plays a vital role … because they require large amounts of data”

SSH PROTOCOL 2.0

Submit
The answer you provided is incorrect

[plucky mantle]

Hey guys! So I am currently stuck on a question in linux fundamentals "Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths (https://www.inlanefreight.com/directory" or "/another/directory") of that domain. Submit the number of these paths as the answer.". My current answer is 7 altough I am pretty sure this is supposed to be right. I used commands 1. curl https://www.inlanefreight.com | grep "https://www.inlanefreight.com/\"\|https://www.inlanefreight.com/'" | tr " " "\n" > inlane.txt and 2. cat inlane.txt | grep ""https://www.inlanefreight.com/\"\|'https://www.inlanefreight.com/'" | wc -l . And I am not sure what I am doing wrong

[indigo hare]

SOLVED-

Thanx!

[waxen totem]

been asked so many times so just check pinned

[magic lotus]

I haven't done that because the parameters being used are the same without tampering them, meaning if I try to change the user password that is logged in with the correct cookie, the parameters work without putting them directly in front of the POST verb, meaning.

POST /reset.php HTTP/1.1
Host: 94.237.122.188:55919
Content-Length: 56
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://94.237.122.188:55919
Referer: http://94.237.122.188:55919/settings.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=30jehh0i2ll2ernt49fnomuclq; uid=74
Connection: keep-alive

uid=74&token=e51a8a14-17ac-11ec-8e67-a3c050fe0c26&password=xxxxxx

If you don't tampering it, it gives 200 OK without any error messages but if you tried to tampering the user id lets say uid=110 you will receive the previous errors messages on my previous post's.
Now if you use the correct verb to be able to change the password of the uid the only way I found it was to be like this on burp or directly on the browser /reset.php?uid=74&token=e51a8a14-17ac-11ec-8e67-a3c050fe0c26&password=xxxxxx

This is the reason I'm struggling to understand.

[waxen totem]

might just be cause of the code instead of using $_REQUEST it might just be using $_GET which doesn't get POST parameters

e.g. if I write the following reverse shell:

<?php system($_GET["cmd"])?>

it only works with:

GET /shell.php?cmd=id

but not:

POST /shell.php

...
cmd=id

[fleet spear]

i try to think like get/post delete are different endpoints and they can have implementation flaws that you must test

[waxen totem]

if it's the same file it's the same endpoint

[fleet spear]

well in a way they are same endpoints but from the output they are different

[waxen totem]

they're just triggering different parts of the code

[fleet spear]

so in a QA you would need to run diffrent test cases to prove the code do same stuff depending if it is a post or get since it should just reset a password

[waxen totem]

well not exactly, since you don't really want the user to control which request methods are being used

also usually POSTrequests are the standard since with GET requests you could theoretically just send a person a link to reset their password

[fleet spear]

well since the design was to allow both get and post and you exposes them they should do the same stuff

[sterile anchor]

hi

[waxen totem]

well you could have a page like: upload.php and the default behavior for GET requests is just to display the upload page but the default behavior for POST requests could be to upload the file. You have a valid reason to use both requests on the same endpoint but ensure different functionality and isolation between the functionalities.

[fleet spear]

well they are built to test our ability to find flaws in this case so we should find some disrepancy in some way, and teach ous to be inovative

[waxen totem]

Well yeah the discrepancy with that endpoint that he pointed out was that it only accepted parameters from the GET request.

The examples are vulnerable on purpose but could be flawed in a way that isn't intended

[sterile anchor]

oh nvm, it worked after some retries

[fleet spear]

other times it is simple because they forgot to incorporate some middleware that should have ensure authentication

[ionic coral]

I wonder, if someone might be able to give me some guidance. I'm working through "Cracking Miscellaneous Files and Hashes" there is a .7z downloaded. I've tried installing john multiple times, as well as resetting the box, but I can never find the 7z2john.py module. I know it's supposed to be on /opt/7z2john.py on the pwnbox, but it doesn't exist and using a locate and find command turns nothing up either. Is anyone able to give some guidance on this please?

[fleet spear]

well thats the difficult to build CTF vulnerable stuff that pepole some times found another way to solve it

[waxen totem]

once you install john on kali it should be installed as 7z2john

otherwise just download from the github

[ionic coral]

Thank you very much

[woven zenith]

I have a question in Module "Windows Privilege Escalation " > "Server Operators". How does one can identify that this "AppReadiness" service is vulnerable out of all the services running on that machine

[fathom pendant]

well the short answer is research

the long answer: also research

[woven zenith]

nice

[fathom pendant]

generally though i believe the reading walks you through finding things

[woven zenith]

In "Windows Privilege Escalation " >"User Account Control". I wasn't able to produce the result desired from the section's lesson. Funny enough the solution guide just outright give the "flag.txt" as the answer. Seems like who ever creates this section give up and provide the flag instead 🤦‍♂️

[dusk holly]

i think you can leave it in #1234357888114364508 hopefully they will fix it

[fathom pendant]

The walkthroughs always provide answers, its known

[woven zenith]

I don't gety it

[fathom pendant]

Im just referring to the latter half of your message, that the flags/answers are in the annual walkthroughs

I've brought it up before

[woven zenith]

Yeah, there's the answer.. but the walkthrough just give the flag.txt less the steps how to get it.

[fathom pendant]

Ahhh ok then #1234357888114364508 for that bit. I misunderstood what you meant

[woven zenith]

To me, I find it extremely frustrating for someone exerting effort to understand the lesson then you finally decide to hit the "show solution" button but find out your not getting any.. lols 😢

[fathom pendant]

Yeah, i def get that

[ivory dock]

I'm reviewing the Windows file transfer methods section of the file transfers module. On the 2nd exercise, we have to upload a file to the target and do some stuff. I decided to try uploading it by firing up a WebDAV server on my Kali VM and grabbing it from there. But, following the example provided in the module, I cannot access the share from the terminal (not even dir or mount the share). I can access it via the browser, but I want to know if there's a reason I can't via the terminal.

I've done a bit of research and set up HTTPS to be used for the share and tried a few different options but I can't get it to work as shown in the module. Is it a security measure blocking my attempts or something else?

[dusk holly]

are you using something like this:

dir \\192.168.49.128\DavWWWRoot

[frank merlin]

@worldly tapir @worldly tapir @worldly tapir @worldly tapir @worldly tapir

[fathom pendant]

is there a reason for you pinging another user like this? because general behavior like this isn't tolerated

[ivory dock]

Yes

[frank merlin]

need him to come online, we got a bit of a deadline, sorry didnt know this was not allowed

[dusk holly]

this is little info from my notes, maybe try to connect to your share directly:

info: DavWWWRoot is a special keyword recognized by the Windows Shell. No such folder exists on your WebDAV server. The DavWWWRoot keyword tells the Mini-Redirector driver, which handles WebDAV requests that you are connecting to the root of the WebDAV server.

You can avoid using this keyword if you specify a folder that exists on your server when connecting to the server. For example: \192.168.49.128\sharefolder

[toxic compass]

I was doing an Nmap scan on a target and got these results. It’s not accepting any of the OS answers I provide.
here is the result :

Aggressive OS guesses: Linux 4.15 - 5.19 (98%), Linux 3.2 - 4.14 (96%), Linux 5.0 - 5.14 (95%), Linux 4.15 (95%), Linux 6.0 (95%), Linux 2.6.32 - 3.10 (95%), OpenWrt 21.02 (Linux 5.4) (94%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (94%), Linux 2.6.32 (93%), Linux 5.10 - 5.15 (93%)
No exact OS matches for host (test conditions non-ideal).

[ivory dock]

Yeah yeah, that's the text from the module. I tried a bunch of different ways and can't connect via the terminal. Only the browser

[dusk holly]

maybe check forums on that section

[ivory dock]

Did that to... no one seems to have tried or complained about this method.

[white vale]

@fathom pendant how can I further continue on htb if some boxes are unreachable ? I tried to use a different server, kill vpn sessions, refresh, donwload new ovpn key, start target and still unreachable ?

I am on htb academy pentest path

[ivory dock]

Did you manage to figure out the issue?

[dusk holly]

I will try that method and notify you on that later

[ivory dock]

Appreciated!

[thorn frigate]

In order to find a config file created after 2020-03-03 smaller than 28k but larger than 25k I ran this command find / -type f -name *.conf -size -28k -size +25k -newermt 2020-03-03 -exec ls -al {} ; but I kept getting hit with output like "find: ‘/run/cryptsetup’: Permission denied" for everything. I attempted running as it with sudo but htb-student(The user I am) is not part of the sudeors group. Some help? I'm doing Linux fundamentals module.

[waxen totem]

The permission denied error is irrelevant. Not all configuration files end in .conf

[fathom pendant]

1. add 2> /dev/null; this will throw errors to the void
2. make sure you're running it on the target system

[thorn frigate]

Thanks for the help

[fathom pendant]

you aren't going to be required to be root to perform the task

it exists in a place readable by your user

[ancient niche]

Good evening guys

I need help with the module

pentest in a nutsshell

[unique quarry]

guys, it is normal almost all of the sections in a module give 0 cubes?isnt to give the cubes where under the module when we buy it?

[ancient niche]

i cannot escalete privileges with administrator in powershell

[fathom pendant]

Not all questions give cubes, youll receive the 20% cubes as/when you complete a module. I believe the beta view demonstrates the cube amount better

[unique quarry]

thx!!

[ancient niche]

I don't have port listening in python 3 🙁

[unique quarry]

guys, are thereother way to find the cmdlet for a specific .exe? i found with findstr, but i think isnt the "correct" way in the context

[cloud urchin]

what do you mean

a cmdlet is a powershell command, an .exe is a binary

[fathom pendant]

Findstr is a windows executable, under powershell its an alias for "select-string"

[unique quarry]

i got it now, i misunderstood the concept, thx
so, in the section, says that we could find the alias from an cmdlet using Get-Alias, in question there is an executable how i suppose to get the cmdlet from a .exe without using the findstr?

[ancient niche]

pls

I need help

with thas

that

[cloud urchin]

You can probably get help if you provide a bit more detail, not having a port listening in python is a bit vague. What exactly are you trying to do?

[tired juniper]

I’m on the SOC Path and I need the access “TheHive” to answer a question. The instructions state navigate to http://TARGET_IP:9000
but when I put this into the browser I get nothing. Also am I using the IP of my PwnBox because I don’t have a target specified. Any help would be greatly appreciated. Thank you in advance.

[lapis folio]

hi folks. For Bypassing Wi-Fi Captive Portals: Client Hijacking through Malware Portal

anyone managed to complete the 1st question to grab the flag.txt? My reverse shell never connected back to me.

Apache logs shows 200 OK - so it does manage to grab my ELF file, but no reverse shell established

[fathom pendant]

a lot of times with powershell aliases are just the common name of an executable; if you want to use the executable you have to specify .exe at the end

[opaque copper]

random question guys . Is someone allowed to share the solution for skills assessment of a module ??

[dusk holly]

No it is not allowed if it is above tier 0

[dusk holly]

unfortunately, it didn't work in my case too, i think there has been some changes to this project since the module is pretty old

sorry for late reply

[ivory dock]

No rush, thanks for taking the time to try it out

I figured things have changed. If I have some time some day I'll try it out with my windows vm. I have an idea that it's due to some default security config 🤷‍♂️

[dusk holly]

it won't worth time i guess, we already have faster and better options out here we can use

[tight copper]

Password attack ?

[dusk holly]

password attacks module will give cubes

according to the measured tier

[novel lake]

I’m having trouble too. "curl https://www.inlanefreight.com/" (or using its IP) does not work at all on my Pwnbox.

[haughty fiber]

PRTG Network Monitor cant get a code execution to work i think

[marble quiver]

AEN - Exploitation & Privilege Escalation Section

I found the credentials, but can't even log in on the website because it's not loading after clicking "Log in". My Ligolo Tunnel is also crashing all the time when doing this.
Did I miss something or is it the machine?

[acoustic owl]

iirc, the free version of PwnBox does not have internet access. Use your own VM instead.

[haughty fiber]

can someone help me. It's from PRTG Network Monitor module

[tight copper]

Not many no

[dusk holly]

what do you mean

[tight copper]

I my module not all exercices give you cube like juste 2 or 3 question

Other give you 0

[dusk holly]

yeah but same modules tiers give the same amount of cubes, even though the sections give different amount, the total number of cubes are the same

[marble quiver]

When I try to log in it crashes the tunnel

Great

[solid forge]

where is that wordlist form?!

i've never seen the ephar extention

[radiant lagoon]

sql injection fundamentals
section database enumaration

i cant seem to find the users table i need for the question

[indigo pendant]

Module : Intermediate Network Traffic Analysis
Section : IP Source & Destination Spoofing Attacks

The author says : The Source IP Address should always be from our subnet - If we notice that an incoming packet has an IP source from outside of our local area network, this can be an indicator of packet crafting.

This doesn't make sense to me. A packet incoming will always have an IP souce from outside of network, well because it has arrived form outside.

Or is the author exclusively talking about LAN networks, where devices outside network are not supposed to talk to devices inside network?

[fathom pendant]

There's likely context surrounding that paragraph that places it; but yes LAN

[indigo pendant]

This is the entire context:

There are many cases where we might see irregular traffic for IPv4 and IPv6 packets. In many such cases, this might be done through the source and destination IP fields. We should always consider the following when analyzing these fields for our traffic analysis efforts.

• The Source IP Address should always be from our subnet - If we notice that an incoming packet has an IP source from outside of our local area network, this can be an indicator of packet crafting.

• The Source IP for outgoing traffic should always be from our subnet - If the source IP is from a different IP range than our own local area network, this can be an indicator of malicious traffic that is originating from inside our network.

Actually both points do not make sense at first glance.

Point 1 makes sense in case of LAN, as source and destination IPs need to belong to the network. But how come the source IP being from outside the network implies "packet crafting"?

Point 2 makes no sense to me at all.

[fathom pendant]

Point 2 - this is saying that source ip should be from local network
Local -> NAT -> outside world

I.e. if the source is 192.168, but your network is 10.0 then its crafted. Simple as that

The expected traffic should follow the expected subnet

[radiant lagoon]

can you help me too?

[indigo pendant]

But by default any outgoing traffic (whether organic or tampered/malicious) will have the source IP of the host that belongs to the network.
I cant imagine a situation where the attacker will make an (dumb) effort to change the source IP to an IP that doesnt belong to subnet.

EDIT - The attacker would craft packets with external Source IP on a LAN to go undetected. Eg: A SOC analyst filters based on subnet 10.0.0.0/24 but the tampered source ip is 1.1.1.1. As a result, the malicous packets are invisible to the analyst

[fathom pendant]

Page #s are useless, just say the section name

[radiant lagoon]

database enumeration

[ancient niche]

ey guys I need your help. I'm module pentest nutshell and I cannot listening port with powershell and I don't know why. I'm completely stuck. 🙁 pls

[ancient niche]

🙁

[fleet spear]

if you try your obfuscated command in your own terminal you maybe get an answer where it is malformed

[dusk holly]

what is the point of hiding the IP?

[ancient niche]

the virtual Machine

[dusk holly]

what virtual machine

[ancient niche]

my

mein

[dusk holly]

alright

[ancient niche]

pls I need help

[fathom pendant]

access is denied
Try placing the file somewhere like temp, or a place then user can write to

Reading the error explains the error

C:/users/ is like /home/ you generally can't just write there

[ancient niche]

The problem is that when I run the script on John's account, I don't have permission to do so. I can only access it as John or as a guest.

[fathom pendant]

Winpeas.ps1 doesnt exist... you executed it in memory and saved the output to winpeas.txt...

You're running Invoke-Expression (IEX) to run it directly from the net object

Your own dir command shows its not there

[ancient niche]

so

mmm

i guess that , should be there

[fathom pendant]

winpeas.ps1 was executed, you saved the output to winpeas.txt

That file exists...

[ancient niche]

Will it be another route?

[lost creek]

For the Introduction to Sliver module:

Did anyone else experience regular session timeouts while on their own VM/ connecting via VPN?

I've never before experienced any connectivity issues in any capacity, but don't want to blame it on the module environment either.

[fathom pendant]

Read winpeas.txt that's right there

[ancient niche]

okey

[fathom pendant]

@cobalt quest spoilers do nothing; short answer is just enumeration

[fleet spear]

wow great connected through rdp https://academy.hackthebox.com/module/24/section/161 and mounted my a folder with some notes and boom threat detected, maybe it would be fricking good to warn defender it turned on

[fathom pendant]

Generally assume defender is on until you confirm otherwise

[fleet spear]

it would be great if i could become administrator to get my files back..

this is t he real test to become administrator 😉

[fathom pendant]

Take it as a lesson learned to not mount important files

[ancient niche]

and this?

[fathom pendant]

You added a " at the end there... thats why it broke

But for the backupprep it says exactly; your user doesnt have the access to view the c:\healthcheck.log

[ancient niche]

exactly but i don't know why

[fathom pendant]

Because your user isn't part of the access group(s) for it

[ancient niche]

but how can i doing that?

[fathom pendant]

Why do you need to run that script?

[ancient niche]

for do the next exercise

[gaunt surge]

Question about ACL enumeration

Using the skills learned in this section, enumerate the ActiveDirectoryRights that the user forend has over the user dpayne (Dagmar Payne).

Why am I unable to see/search the user forend in bloodhound by name? If i search by his SID in bloodhound I am able to find him. Just trying to understand why this happens. Used -c all with sharphound versions 2.7.2

[ancient niche]

for i can open the File of privilege Scalation

Escalation

[hollow widget]

Is this a place to get help for any academy modules? prob a dumb question but i thought id ask anyway.

[cloud urchin]

yes

[hollow widget]

thanks 👍

I have a question for Attacking FTP. I've been scanning the target with different nmap scans and I'm not getting any open FTP ports.

[cloud urchin]

Try scanning all the ports

[hollow widget]

I have. still no FTP. Tried running --min-rate 1000 for a faster scan and nothing. Also tried running the scan without min-rate but the estimated time for the scan to finish is up to 3 hrs.

[cloud urchin]

Best to mention the module/section/question you're stuck on so there's more context. Otherwise a port scan should show the FTP server if there is one. Maybe check your network stuff, make sure you can reach target, don't have VPN + Pnwbox on at the same time, etc.

[hollow widget]

I havent tried using Pwnbox instead of my vm. I'll try that instead incase its a netconfig issue on my end. for clarification its https://academy.hackthebox.com/module/116/section/1165

[cloud urchin]

You should be able to find it with a scan, it shouldn't take to long at all. Make sure you're using the right arguments.

[hollow widget]

will do. thanks for the quick reply.

[hollow widget]

Tried the scan via pwnbox and got the same results. I decided to change the VPN server location and try again that way. I now see the open FTP port. VPN was set to EU.

[ancient niche]

i cannot get it the file winpill en target windows 🙁

[ancient niche]

already i finded four days for that oh my good xD

[ancient niche]

Thanks Marcielere for alll

[primal ginkgo]

Hey anybody run into all users from user2 ranging to user10 in the Skills Assessment for "Introduction to Windows Command Line" lacks a password? If you wanted to ask a person to acquire them... why not explicitly say so instead of assuming

[fathom pendant]

the password will always be the answer to the previous question

[primal ginkgo]

Thank you, I tried that a few times just going to metaphorically slam my head against it until either it drives me insane so I meet the definition or It solves itself.. hopefully it solves itself

[fathom pendant]

as a protip always use single quotes for wrapping passwords

[carmine patio]

Hi iam not able to connect to windows fundamentals ip address ive tried changing my vpn from EU to US and from udp to tcp, tried changing my mtu but nothing has worked please help me

[jovial walrus]

I couldnt understand socat bind shell at all like how is the redirection happening

I did understand socat reverse shell..Pivoting, Tunneling, and Port Forwarding module

[dusk holly]

it works just like any other port forwarding techniques, but you are just using it directly in pivot machine

[waxen totem]

SOCAT takes in 2 arguments where the first one is always an input and the second one is always an output.

$ socat tcp-listen:12345,reuseaddr,fork exec:/bin/sh,pty,stderr,setsid,sigint,sane
#       |-------------input-----------| |-----------------output-----------------|

so essentially it's listening on a port, when it receives a connection it makes sure the port is reusable and the connection is forked. It then sends whatever we put into that connection into /bin/sh passing pty, stderr, stdsid, sigint, and calling sane on the stty back through the connection.

[mighty matrix]

Hi guys, is the RDP having issues? it keeps ending the connection when I try to use it

I am on the windows event logs module on the SOC analyst path. Is it okay if I skip this module for now and go to the next module and come back to it again later in the future? (are the modules dependent on the ones prior?)

[dusk holly]

it is working fine for me with TCP VPN

[mighty matrix]

okay thanks, I may try that. but is it okay if I skip this particular module for the time being?

[dusk holly]

modules usually related to each other in paths, but if you believe you have good understanding of a concept, you can skip it for now

[mighty matrix]

okay thanks I'll just try finish it off for now I guess 😅 its just stressing me out with the rdp

Any help please? I am trying to use sysmon on the rdp (for windows event logs and finding evil module)

[mighty matrix]

managed to execute the dll hijack as shown in the module, however it's not showing in the filtered logs in event viewer?

[pallid meteor]

Hi everyone, I'm studying AD enumeration and attacks. I'm struggling to understand and identify the main attack vectors. Would anyone like to work through a live box together?

[wooden canopy]

Hey, I'm on the module : KERBEROS ATTACKS - Unconstrained Delegation - Users

I've got some issues with the final part can I dm someone ?

[gray yacht]

You can send a DM.

[mortal wharf]

Hello, can someone help me with a reverse shell without vpn ? The system cant connect to my listener

[fathom pendant]

Wdym without vpn?

Any target that is public won't be able to connect to your system. Reverse shells are out of scope for those

[zinc zodiac]

Heyy guys ..im back for another statement ..ummm..did anyone feel like the answer for the IPS/IDS Evasion - Hard Lab didnt add up or didnt make sense? ..or its just me ..if it is ..can someone explain it to me privately

[fathom pendant]

It makes sense to me. I can pull up my notes in a sec but it makes plenty of sense, especially if you refer to the reading

[stray creek]

<@&861185840277487616>

[topaz grove]

Hi, strugling on LLM Output attacks Skills Assessment for sometime.
What I've done so far:
SQL injection but nothing leads to sensitive/useful information.
Jailbreak as DAN but only limited to function request.
Can someone give some nudge?

Hi man @lean bronze , can I dm you for some nudge in LLM Output attack skill assessment?

[rotund ore]

Finished all modules for CJCA preparation, didnt think i would come nearly this far when i started, but here we are. Now on to learning and mastering all topics to get my cert this year. Thanks to everyone in this great community for making this possible.
If anyone has suggestions for modules that are most valuable if i want to work as a SOC Analyst Tier2, hit me up.

[lean bronze]

Sure, what part are you struggling?

[deep hemlock]

Attacking Common Applications
Page 21
Attacking Thick Client Applications

anyone can help me wiht this one

?

i can fined the mz

hello

??

[narrow plume]

hi all,
i am facing issues since almost an hour at this exercise in the module "Introduction to bash scripting".
does anyone know why my script could constantly fail? i checked every line of my script and i still dont find anything.. if i'm allowed, i could send a screenshot my script so youll find an issue smth i didnt find, it would be easier.
thanks in advance.

[tranquil moat]

Hello, i'm not sure you can share the script here neither.
If you want, DM me and we'll check it out.

[deep hemlock]

//.

i can t

[signal chasm]

Hej There, I am doing the Windows fundamentals module and I need to connect with RDP to a IP. Well... I use Remmina and I am not very successfull. I cannot ping the spawend machine nor can I access anything with nmap. With nnmap I use the port nr 3389. pinging doesnt get an answer. nmap neither. connecting with remmina either. I tried it on my own VM and with the parot one. Can somebody help me here?

[tender nimbus]

hey guys any idea why i cannot connect zith guest with rpcclient but I can with smbclient?

[thin flicker]

Try respawning the target machine since pinging it doesn't work.
Also the module teaches to use xfreerdp to connect to an rdp session

[fathom pendant]

make sure that you do it as shown 😉 the module is above tier 0 so sharing the script here is against the rules. But i can almost guarantee what the issue is. ||it's the last 19 characters, it's counting the newline as one character||

[signal chasm]

i respawned it multiple times and nothing worked. however, I respawned again as you said. And this time, I used xfreerdp. worked... no idea why

[thin flicker]

Oh okay that's interesting 🤔

[thin flicker]

Glad it works. Happy hacking ✌️

[fathom pendant]

windows machines don't always respond to pings

try changing vpn regions

[vital zodiac]

Is there anyone can help me in "Exploitation of PDF Generation Vulnerabilities" module.

[cloud urchin]

That sounds like a section of a module, not a module

[turbid jewel]

There is anyway to make the rdp machines faster?

[cloud urchin]

There are tips here https://help.hackthebox.com/en/articles/9297532-connecting-to-academy-vpn

also use tcp vpn, maybe switch servers or regions

[turbid jewel]

Sure, i'll take a look, thanks

[cloud urchin]

3 more weeks

[fleet spear]

what is special with 104?:)

is there some badge?

[cloud urchin]

yeah a badge

[tall pike]

i thought i should have forge my ticket first then get in with rdp... wasted 1 whole day...

[glacial remnant]

just finished the logrotten section on the Linux Privilege Escalation under logroate. i could never get the callback to work so instead of just trying to get a reverse shell i just cat'd the flag to my netcat listener. it took about 15 seconds but i did end up with the flag but anyone else have issues with the shell or anything im doing thats horribly wrong?

[cloud urchin]

yeah logrotate is really sensitive, i think i could only get the command to work once before i had to reboot. and the shell only lasted a few seconds. i had to pre-setup the command to cat the flag.

[glacial remnant]

cool well good to know not just me and extra finicky. thanks for the sanity check

[woven zenith]

so, this means you've majority of the course? maybe a lot more.

[cloud urchin]

I've completed a couple courses, and some modules from others.

[woven zenith]

I have a question in Windows Privilege Escalation module - Skill assessment 1. I was thinking what kind of thought process in able to understand how to attack this type box. Because I feel like the solution is beyond what can enumeration can do. I've done manual enumeration checking users, vulnerable services, writable paths, etc. I did use automated tools such winpeas, powerup, sharpup, etc. Heck, I even use Metasploit just to look if local exploit suggester can give some hint.

I feel like the solution is like a hail mary attack because the efforts of doing enumeration didn't yield result that this box is vulnerable on that specific kind of CVE.?? Just wondering.

[cloud urchin]

Your enumeration should have caught it. Basically you want to always check what non-default permissions your user has, or the groups that your user is a part of. also check what access they give to shares, etc. You should maybe make a check list of everything to check for when you get user access, then reiterate through the checklist again if you get another set of credentials.

[whole magnet]

Looking for assistance on bash scripting, for loops. Trying to echo a variable 28 times into base64 to enocode the number of characters into a salt. But i mess up somewhere, i have tried many ways of including / excluding newline characters, and subtracting 1 and 2, to no avail. Pointers?

[hasty rock]

I’m working through the SMTP Enumeration lab in the Academy path and believe I’ve completed the technical requirements, but I’m unable to submit an accepted answer, which is blocking module completion. I’m not asking for the answer — just clarification on where I may be going wrong or what the lab expects.

Link: https://academy.hackthebox.com/module/112/section/1072

Screenshots: https://imgur.com/a/OVw316q

Summary of what I’ve done:

Identified SMTP on port 25 (InFreight ESMTP v2.11) via Nmap; supports EHLO, VRFY, STARTTLS, etc.

Successfully interacted manually via Telnet (EHLO, MAIL FROM, RCPT TO).

All RCPT TO attempts (valid and invalid users) returned 250 OK, indicating catch-all / open relay behavior.

Confirmed open relay using smtp-open-relay Nmap script.

smtp-enum-users with VRFY initially returned no results (252 responses).

Running smtp-enum-users without restricting method returned multiple usernames (root, admin, administrator, webadmin, sysadmin, guest, user, etc.).

At this point, it appears user enumeration succeeded via tooling, but none of the enumerated usernames or hostnames are being accepted as the lab answer.

I’m trying to confirm whether:

A specific enumerated username is expected,

The intended takeaway is that enumeration is unreliable due to open relay / catch-all behavior,

Or if there may be an issue with answer validation for this lab instance.

Appreciate any guidance or confirmation on the intended outcome. Thanks!

— FuegoTier

[autumn pilot]

Use the provided wordlist in the resources of the module

[ivory kelp]

need assitence to coreect the answer module .information security foundation sub mudle - windows fundamentals and sub part - Windows Management Instrumentation (WMI) Q= Use WMI to find the serial number of the system. Answer - VMware-42 30 fd d0 9d d5 b8 90-09 c7 c1 05 f1 33 52 c4 not working

tied eleiminating spaves deleting the "VMwere - "

not worked

[autumn pilot]

Think if you need to focus on VMware instead of something else

[ivory kelp]

apologies , i understand now thanks sir

[scenic parcel]

Hi all! I'm doing skills assessment of Advanced SQL Injections module . I've been stuck on the last question for days and need a little push. It seems I know the injection vector, but i'm having trouble with confirmation and enumeration. I see what roles exist in db, but fail to confirm if the user inherits from them. User priv enumeration gives me select, update, insert and that's it. Anyone can give me a little push?

[agile falcon]

can anyone reccomend me a module that would teach me all the basics of afew kali linux tools? or speicfically gobuster and burpsuite?

[nocturne sun]

Linux fundamentals, Web fuzzing, Web proxies

[agile falcon]

thanks! could i also get suggestions on what modules i could do that would improve my ctf skills?

[severe inlet]

Hello i just finished the SQLMap Essentials Skills assessment and i wanted to ask based on what did we choose the || between scrip? || ?

[nocturne sun]

Any specific topics?

[agile falcon]

currently I’m going for web exploitation specific stuff or forensics but anything broad would also be great.

[scenic parcel]

to use it instead of filtered operators like <, >

[severe inlet]

How did you know they were filtered tho?

I used the -v 6 for SQLMap but couldn't tell if anything was filtered it just said that my sql queries were wrong SQL Error output

[scenic parcel]

I know it straight from your question as it implies you have completed the SA, which means that tamper script did help you. And BETWEEN itself Replaces greater than operator (>) with NOT BETWEEN 0 AND # and equals operator (=) with BETWEEN # AND #.

[vagrant wraith]

Hey guys has anyone solved the lab called Browsed ? can anyone drop a hint in the beggining of the lab ?

[dusk holly]

Active Directory (AD) Enumeration & Attacks modules -> Credentialed Enumeration - from Windows, in the first question of this section, we are asked:
Using Bloodhound, determine how many Kerberoastable accounts exist within the INLANEFREIGHT domain. (Submit the number as the answer)
i run the SharpHound, and transferred the zip file to my local host to analyze it locally, but the result my BloodHound CE showed is different from actual answer, i know the answer because i solved it before, iirc i used BloodHound Legacy to solve it, anyone faced the same issue, i also tried this from HTB provided bloodhound which is legacy, and it showed correct answer.

[severe inlet]

Yes yes it did help since i got the flag

But my question is how would i choose it directly? since for me i used multiple scripts till this one worked

Was there a way to make sure this specific one would work so i don't waste time during the exam?

[scenic parcel]

my guess is just look at the output of sqlmap keeping in mind --technique and other flags you started it with. -v6 is not always neccessary. Sometimes -v 3 would give you messages of what might be the problem. I think there is no "one shot" way of doing that, but that's just my opinion

[scenic parcel]

basically if you have SQL Error in sqlmap output than that error is specifying what went wrong, i.e. syntax error at ..... At that point you analyze what sqli was attempted and based on that judge what the filters might be. I hope it helps

[severe inlet]

@scenic parcel Thank you so much will try that next time

I thought i did something wrong by trying each script till between

[scenic parcel]

You can navigate to sqlmap source code dir and take a look at those scripts, and write your own if needed

[fast quest]

Hey guys! I'm really, really stuck on DACL Attacks II Skill's Assessment. If someone could give a little nudge I'd highly appreciate! Thanks in advance!

[fathom pendant]

Ad enum & attacks is above tier 0. Don't share things from the labs

[narrow plume]

thank you for your help :))

[fathom pendant]

Np; its a bit dumb with expectations at times

[narrow plume]

yes sometimes its harder

[fathom pendant]

Like having you do echo | wc (which adds a char) instead of just ${#var}

Off-by-one errors :))))

[molten swallow]

Is that only me, or password attacks module is ass😭
How the hell it supposed to be done in 1 day(8 hours session)?

[fathom pendant]

What section is tripping you up?

Also the time estimates are usually safe to ignore

[molten swallow]

Shares took some time but manageable, lateral movement is seems so off here

It's like patience lesson

Mainly because of slow/laggy rdp

[fathom pendant]

Lateral movement is basically just pillaging info to move to the next machine, treat each as a blank slate for discovery

[fathom pendant]

Try using the tcp vpn and changing vpn regions

[molten swallow]

Didn't think of that, tcp connection may stabilise the situation

Thanks in advance

[fathom pendant]

Np

I forget the command but in the help article related to connecting to the vpn, it recommends a command for xfreerdp

[ocean night]

xfreerdp /u:username /p:password /v:TargetIP /cert-ignore /bpp:8 /network:modem /compression -themes -wallpaper /clipboard /audio-mode:1 /auto-reconnect -glyph-cache /dynamic-resolution

@molten swallow 👆 🙂 Also, some found reducing the mtu on tun0 to 1200 helped in certain situations

sudo ip link set dev tun0 mtu 1200

[molten swallow]

Thank you guys

[queen quest]

Password attack modules are so long and now I am on stuck in Skill Assessment. Can’t get it where to go now

[fathom pendant]

Treat each host as a blank slate

Enumerate from 0

[gray yacht]

If you're still stuck you can DM.

[queen quest]

Okay, yeh that’s what I did last night after ssh and proxychains I thought of using same creds again 🤔

[fathom pendant]

I believe i have notes on the new SA; are you on the foothold? I need to get back to revamping notes

[queen quest]

Yes I am on the start of it 😭

I made notes but maybe I missed somewhere

[green vessel]

are academy Subscriptions seperate from the labs ones?

[fathom pendant]

Yes

[green vessel]

what was that 💀

[fathom pendant]

You might be missing some history

[fathom pendant]

A scam bot

https://tenor.com/view/the-penguins-of-madagascar-madagascar-movies-animation-cartoons-gif-16596826

[queen quest]

Ohkkk hmm 🧐

[green vessel]

even the stuedent one ?

[dusk holly]

you can DM me if you are still stuck

[fathom pendant]

Yes, they are separate platforms

[lethal kayak]

Hello guys. i need help. I'm stuck on the footprinting module easy lab. I've done some enumeration but i haven't made much progress. can someone please point me in the right direction? 🙇‍♂️

[covert schooner]

Hi I am unable to setup webdav server to upload files using SMB via HTTP. Currently on Windows File Transfer Module

[dusk holly]

me and one of the user also had this problem, this is probably because the tool has changed since the module is written

[covert schooner]

I can access the same via browser

but not in the way we access SMB shares

[dusk holly]

yeah we also experienced this

[covert schooner]

oh so you found any workarounds?

[dusk holly]

unfortunately no, if you find, let me know

[night vortex]

Do we need to ssh into the ip and port before entering curl cmds in the command prompt from inside the box?

[gray yacht]

I would say, it's likely that BH CE did provide the information, but it doesn't display it in a way to make it easy to identify the missing account.

[dusk holly]

that is probably it, because i didn't really looked at it carefully and it is my first time using CE, it looks like better than Legacy

[gray yacht]

It isn't bad, just takes a minute to adjust to things. Let me know if you aren't tracking on what I was getting at.

[ocean night]

For that specific target, you can either just directly access it from spawning the Pwnbox above, or through your own browser / terminal. You do not need to SSH into it.

Have another read over above where the question is asked, in the section content @night vortex - that will help you to bypass the requirement you have come up against with that command.

[molten swallow]

Hello again, am I wrong in thinking that pass-the-something attacks are only present in the password attacks module?
Or the AD module going in-depth about this attacks?

[strong atlas]

You have pass-the-something in AD modules, but there is nothing difficult here: instead of passing passwd to command, you pass a hash...

[molten swallow]

So i think i should stay a bit longer at pass attacks, thanks😀

[gaunt surge]

Any chance someone can help with this? I would like to find out

[fathom pendant]

PTH is prevalent in AD

But they're explained a bit when you come across it

[molten swallow]

I just redoing all my notes and this module goes almost into every stage of assessment. Enum , cracking , spraying, lateral etc. So i definitely should stay here a bit longer within pass-the attacks to note them properly

[fathom pendant]

You dont need to stick too long tbh

[molten swallow]

I already tired as hell of this module tbh xdd

[fathom pendant]

The underlying thing is that the auth mechanism accepts the hash of the password and succeeds the login

[gray yacht]

I'd check the SharpHound output to see if you can identify any errors that might have contributed to this, check the version of Bloodhound you are running (new SharpHound, old Bloodhound, etc.), etc. I just ran it using the provided version of SharpHound in the C:\Tools directory and used a version I recently compiled (2.7.0) and both showed what you are missing with BH CE (v7.3.1).

[molten swallow]

Yep, but there are some interesting techniques like popping a reverse shell to DC via rdp->pth->powershell because of connection restrictions. Indeed was a interesting solution. Or a possible rdp connection after editing the registry of admin restrictions. There's a lot, but i think it definitely will shoot and play it's own role some day.

[brisk drift]

Hey guys, i've a little problem, i'm doing de PentesterModule, i'm in the nmap course, i need to find the name of an OS, i'm 99% sure i have it, but it doesn't word for submit my answer, do someone can help me mp ? thx guys

[molten swallow]

Are you scanning from your own machine or pwnbox? If it's yours - try to scan it the same way with pwnbox.

[fathom pendant]

What's the section?
Also its the pentester pathway, nmap is the module

[brisk drift]

Nono, I think i have it, just i try to write it in the academy and it's not that, but when it doesn't work, i've a message like "too much noise, hehe no OS" and now i've it

This one

I can show my nmap mp if u want but i don't want to spoil if anyone is working this same thing

[fathom pendant]

Its extremely simple. Its asking for the name, like windows, kali, parrot, etc. Its not asking for a version

[brisk drift]

Yeah i saw that

And with my nmap i've the ligne OS detail ...

ok i've try the most famous os so the question is validate, but it wasn't the same that on this line wtf, i'll try to search how was the good method

[fathom pendant]

Sometimes a version scan can reveal more details

If you're absolutely certain, refresh the page and try again

[brisk drift]

I'm trying to find the good command to see the *** OS

ok i think i'm fine

Thx for your time

[pale island]

i have a question about the Broken Authentication skills assessment. i am kind of stuck at the ||otp|| part. i cannot find any difference in ouput and no format i should follow. anybody got a small hint?

[brisk drift]

May u help me with the fact of being quiet please ?

[fathom pendant]

?

[gray yacht]

If brute forcing isn't working, maybe you can check for potential ways to bypass and other things that were taught that are relevant to what you are working on in the skills assessment.

[brisk drift]

WIth Nmap, i'm stuck in these 3 last courses

[vast seal]

Hey all. So I have tried installing Python 2.7 on the Pwnbox, and have had no luck. I tried the install steps they recommended in the Rpivot module, but I can't get it to work. I tried Kalis documentation in installing as well but it doesn't work in Kali either. Been trying all day yesterday and I am getting annoyed because I don't know how else to convert kirbi files to hashes for cracking. Is there an easier way to do this?

Here is the steps they gave that doesn't work:

Alternative Installation of Python2.7

Remove pyenv.run's directory first before installing
'''
Criminal0fPurp0se@htb[/htb]$ curl https://pyenv.run | bash
Criminal0fPurp0se@htb[/htb]$ echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
Criminal0fPurp0se@htb[/htb]$ echo 'command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc
Criminal0fPurp0se@htb[/htb]$ echo 'eval "$(pyenv init -)"' >> ~/.bashrc
Criminal0fPurp0se@htb[/htb]$ source ~/.bashrc
Criminal0fPurp0se@htb[/htb]$ pyenv install 2.7
Criminal0fPurp0se@htb[/htb]$ pyenv shell 2.7 '''

[fathom pendant]

Use ``` to wrap code blocks

```
Like this
```

[pale island]

thank you

[fathom pendant]

Not sure how this relates to you saying "be quiet"

[vast seal]

When you say codeblocks, do you mean in the install steps they provided?

Isn't it like that already or am I missing something?

[brisk drift]

it's about IDS / IPS bypass, i have to use the less frame possible as far as i ve understood

[fathom pendant]

Yes, its just for formatting on discord

[fathom pendant]

Each assessment is independent of each other. But im not sure i understand what exactly youre asking

[brisk drift]

Criminal => Criminal

Theses are cod blocks

[vast seal]

Oh!

[gray yacht]

Last I remember it was already setup for use on pwnbox.

[brisk drift]

May i send u my nmap in private message ?

[vast seal]

It isn't. When was the last time you used it?

[fathom pendant]

Fuck it. Sure.

[gray yacht]

Give me a second, but it was the last time I helped someone with the rpivot section, which wasn't super long ago.

[brisk drift]

Done

[vast seal]

I ended up skipping Rpivot and got the flags another way, I am on the AD section with Kerberoasting and I hit a wall with this cause I need the kirbi2john.py script for converting the hashes.

[gray yacht]

When you spawn a terminal, go ahead run ls -la and you should see .pyenv.

[vast seal]

I see it

[gray yacht]

Good now?

[brisk drift]

he's probably dead in his virtual env x)

[vast seal]

When I try running the script, I get this error:

 python2.7 kirbi2john.py
pyenv: python2.7: command not found

The `python2.7' command exists in these Python versions:
  2.7.18

Note: See 'pyenv help global' for tips on allowing both
      python2 and python3 to be found.

[brisk drift]

theses one x) : ``

not theses ''

x)

[vast seal]

fml

[brisk drift]

Check that pyenv versions

[vast seal]

its at 2.7.18

[brisk drift]

try that pyenv global 2.7.18

[dusk holly]

i think if you are using kali linux, kirbi2john command will do the work

[vast seal]

I ran that command, and then got this error python2.7 kirbi2john.py Traceback (most recent call last): File "kirbi2john.py", line 18, in <module> from pyasn1.codec.ber import encoder, decoder ImportError: No module named pyasn1.codec.ber

[brisk drift]

look at your log

[dusk holly]

this error telling you that it could not find module named pyans1.codec.ber which is used in the script you are trying to use, you can install it somehow i guess but it is better to use kirbi2john anyways there should be one in python3 version

[vast seal]

Thank you, I will investigate this

[vast seal]

oh yeah this is way better lmao immediately works

Heres the link in case anyone wants it or searches for it in the future: https://github.com/openwall/john/blob/bleeding-jumbo/run/kirbi2john.py

[dusk holly]

yep, trying to work with different programming language versions is pain in the ass

[brisk drift]

Sever, may i ask u a question with Nmap ?

[dusk holly]

yes

[brisk drift]

can we private 5m, easier

[dusk holly]

you mean DM

[brisk drift]

yeah

[dusk holly]

i will DM you

[brisk drift]

Everything is explain 🙂

[dusk holly]

<@&861185840277487616>

[gray yacht]

Ah gotcha, well you should be able to just run kirbi2john instead of going down the path of using the pyenv and python2.

And it looks like someone already got that information to you.

[hard path]

same problem here

[timid inlet]

Hello, I am doing the module on infiltrating Windows and have a problem with meterpreter. See screenshot, I am trying to follow along but the 'getuid', 'shell', 'ps', etc. commands do not work. Trying to load stdapi does not work. Nothing I could find on Google works... I am using my own Parrot VM. Any ideas?

[vast seal]

Thanks anyways buddy, appreciate it all the same

[gaunt surge]

Hi, thank you for the tip. I was running the sharphound version (2.7.2) that I downloaded via Bloodhound (so it is the correct version). I now tried the sharphound in C:\Tools and it indeed worked (with the same bloodhoud). I then updated my sharphound and bloodhound to the newest version (running via docker), and tried it again with the updated sharphound, and again it worked. Seems like something is broken in sharphound 2.7.2 somehow. Thanks for the help!.

[vital zodiac]

Hi
Anyone please can help me in "Exploitation of PDF Generation Vulnerabilities"?

[leaden island]

yo guys
i need help in attacking tomcat CGI
i cant find any path to any CGI script by brute forcing
i found the same wordlist being used in the section, however, its 4614 lines, while mine, which i just pulled from the dirb repo, is only 1437.
not sure if the wordlist is the problem or not, because i tried other ones and i did not succeed

i tried other extensions as well

[sly kelp]

What have you tried until now

[agile torrent]

Hi all, working on the vhost section of 'Information Gathering - Web Edition' currently. My FFUF scan is picking up 6 subdomains, but it's missing the one starting with 'web' when using the common.txt and subdomain-top1million-110000 wordlists. I started by filtering by the size, then moved onto a regex filter of the text on the fallback webpage with the same result. The box has been restarted multiple times. Any nudge/sanity check would be appreciated :)

[hasty rock]

Thank you @autumn pilot I will run the RCPT TO:[e-mail] for each name from the wordlist to see if they're any variances/distinctions.

[fathom pendant]

Don't use rcpt

Also there's tools to automate this task

[vapid storm]

im having trouble with this question also ive spent hours and days on it lol

[fathom pendant]

Its in the subdomain list

[vapid storm]

Can anyone help me with the windows attack and defense PKI-ESC1 question about finding the flag. ive tried for days cannot get the credentials ive done everything up to making the cert.pfx on WS001 and then running the rubues command but i cant get into dc1$\scripts

[agile torrent]

Thanks Marcie! Am I able to flick you my command (or allowed to put it here)? I've grepped the subdomain 110k list for 'web' (~400 words) and rerun it, but still no luck.

[fathom pendant]

Give me a sec and ill pull the md5sum and the wc for it

[agile torrent]

tyty

[fathom pendant]

e6114766582484501fae472253777171 the md5sum

md5sum /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt 
8865007ef82bbad5e6544ec75a49dac9  /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt

and the sum of the whole list itself

my default grep is egrep which is regex grep

[agile torrent]

ah ty, seems the list on github has had an update

[fathom pendant]

i've had this list for a hot minute

[agile torrent]

as of a couple weeks ago

[agile torrent]

its down to 216 when grepping ^web

[fathom pendant]

interesting let me pull the list itself and see

[agile torrent]

ill go swipe an older version

[fathom pendant]

huh, you're absolutely right it has far fewer; maybe an #1234357888114364508 is needed to change to one of those 216 words

curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/DNS/subdomains-top1million-110000.txt | grep ^web | wc -l
216

^ the command i used to check

[agile torrent]

dope, ill write one up. thanks for your help!

[fathom pendant]

np and i double checked the first 2 characters after web... and the expected one isn't in there

just in case the expected was in there and it was just being dumb

yk

@agile torrent for giggles and shits try the combined_subdomains.txt from the updated repo

yep it's in the combined list

though that has over 600,000

so maybe trim from ^web

that drops it down to a measely 12,477

i'm using curl to check the length and wordlist; so i'm not downloading anything new

[agile torrent]

ah yeah that makes sense

combined list hasn't been updated for almost a year so thats chilling

[fathom pendant]

i'm just doing curl -s <raw link> | grep ^web | wc -l

the other one it appears in in the old repos is the italian one 💀

but i didn't check the raw

[agile torrent]

whadda the hella 🤌 🤌 🤌

[fathom pendant]

but i'll update my brain notes to recommend people trim from the combined list and work off that

i believe with grep you can do a multi selection via grep "^blahblah\|abc\|d" i believe it requires the \| and not just |

yep you can chain OR statements (the \| is an or statement with grep)

so you can generate a list for all the questions chaining grep "^web\|^vm\|^br\|^a\|^su"

the ^ is the anchor for start of line

if you know the end of line, it's $ so if you know it ends with 123 grep 123$ and if you need to grep for the special characters you just need to escape it

[agile torrent]

oh thats clever

prob gaming the question system a little bit, but good if you know a pattern

[fathom pendant]

random list with the prefixes; and utilizing the grep filter

just as a proof of concept :)

[agile torrent]

yeah def, ill add it to the cheatsheet

[fathom pendant]

honestly i forget when/where I learned about the OR bit with grep

it's just part of the mindset, you have known info, so use it.

[agile torrent]

its just a regex right? i wonder if it can do capturing expressions

[fathom pendant]

imagine if they set it up with a bunch of different vhosts that responded for you to sift through 💀 that'd be evil

[agile torrent]

gits n shiggles

[fathom pendant]

yep it's regex, if you want to use regex to capture more specifically you can use brackets to signify ranges of things i.e. ^[a-zA-Z]{1,7} <- looks for only things that start with the letters a-z or A-Z up to 7 of them. (but matches anything below that, you do need to use the -E argument for extended regex/bracketing

{min,max}

if you don't specify a max, it doesn't set one

so say you know something is a minimum of 8 characters -> {8,} is a valid range

[agile torrent]

seems it understands the syntax but just ignores it

[agile torrent]

yeah the range stuff is good

[fathom pendant]

yeah your syntax looks for web anywhere

[agile torrent]

had to figure out a bunch of regex stuff for the vscode search a while ago

[fathom pendant]

the ^ anchors it

regex is SUPER powerful

[agile torrent]

yeah thats alright, i was more meaning the brackets. if it respected them i would have expected the output to be mail, disk, etc

[fathom pendant]

ah fair enough

[agile torrent]

can prob do that sort of thing with sed

[fathom pendant]

might need to use -E for extended RegEx

sometimes it's a bit silly :)

extended adds the classifiers and stuff

otherwise you're limited to some basic stuff

that's the command i showed a sec ago without the -E

:)

[agile torrent]

oh dope

[agile torrent]

turns out pcregrep can do the thing i was trying to do here

or two runs of grep, pick your poison type of thing ig

oh nvm the perl variant does it

grep 'web\K(.*)' subdomains-top1million-110000.txt -oP

[lusty terrace]

I am doing Login Brute Forcing - Brute Force Attacks the question for the pin... its from 0000-9999 im at like 0333

could I possibly just get the answer without waiting ....

[agile torrent]

no lmao

have you tried upping the request rate?

[lusty terrace]

Im using what the module taught

so nope...

[agile torrent]

what tool does that one use again?

[lusty terrace]

just a simple python script lmao

ridicously slow

[waxen totem]

well part of what the module teaches is that these tools can be slow so you'll just have to wait unless you wanna do your own research and multithread the application

[agile torrent]

or do the poor mans one, change the range in the script they gave you to each do a quarter of the search space and run four at the same time

would def be a great learning experience to setup multithreading properly, but would prob take longer than just waiting for the script to finish

[lusty terrace]

I have no idea if the ffuf I learnt from last module would help but testing it rn

[agile torrent]

oh yeah that'd be good

[lusty terrace]

yeah... I should've just used ffuf

already done

[west yacht]

anybody ever have issues rdping into a windows server, pwnbox is not loading for me either

[lusty terrace]

I don't think that's the correct password

with ))

[drowsy grove]

remove the )) and for passwords use single quotes

[hasty rock]

Oh wow! Okay. I'm excited to see what's possible! Thank you @fathom pendant

[heady sapphire]

Guys I can’t understand the use of IP Spoofing for firewall evasion : When u try it it never works :

[novel matrix]

YOu just need the target IP address. you don't need -e tun0. you have other flags to use for evasion.

I would revise you going back through the course

[heady sapphire]

No bro this is the exact course command been used but it seems to me that ip spoofing is kinda useless

[waxen totem]

Well it can't seem to determine a route to your target, it isn't useless it just can't find you

[heady sapphire]

No it is useless because if I spoof the ip of the sender then I can’t receive data back , so what’s the point of it ?

[waxen totem]

Well even if the packets don't come back they still create logs against the target which can serve a few things like:

• a smokescreen
• frame someone
• just create a lot of noise

[heady sapphire]

Like what?

[waxen totem]

also can work if you're using proxies

[tribal dock]

Can anyone please help me? I am stuck at question number 3 of the skill assessment of the 'Using Crackmapexec' module. I have got credentials for sql***, sq***, local administrator on SQL01$, Jul***, and A****. Thankyou

[indigo hare]

// Section 10 - 15 // Using the Metasploit Framework // Question 1

The target has a specific web application running that we can find by looking into the HTML source code. What is the name of that web application?

nmap -sV 10.129.203.52
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

msf auxiliary(scanner/http/dir_listing) > use auxiliary/scanner/http/dir_scanner
msf auxiliary(scanner/http/dir_scanner) > set RHOSTS 10.129.203.52
RHOSTS => 10.129.203.52
msf auxiliary(scanner/http/dir_scanner) > set PATH /
PATH => /
msf auxiliary(scanner/http/dir_scanner) > run
[] Detecting error code
[] Using code '404' as not found for 10.129.203.52

[+] Found http://10.129.203.52:80/files/ 200 (10.129.203.52)
[+] Found http://10.129.203.52:80/icons/ 404 (10.129.203.52)

im blocked here, any can tell me a hint?

all auxiliary im using not found any info and searching on the html nothing

[waxen totem]

Have you tried: simply using the application as normal?

[leaden island]

anybody pls

[waxen totem]

try grabbing the one from SECLISTS

[indigo hare]

Thanx !!!

[waxen totem]

please don't spoil module answers in the chat btw.

[indigo hare]

sorry !!

[leaden island]

yup, this worked

youre a G

[inner canyon]

A SQL user have access to very useful tables and features on sql01.

[agile falcon]

Hello, I can't seem to connect to the Linux Fundamentals HTB student SSH IP. It just keeps me in a 'waiting' state. I've tried disconnecting from the OpenVPN config, running it with --daemon --config and then connecting to the SSH, changing the location, and redownloading the config. I am currently running a full port scan to see which ports are open to try those instead. Could anyone help?

also, im able to ping the ip and receive a response. ^

^^^^^^^ Never mind, I fixed it! It was a Maximum Transmission Unit (MTU) issue. The SSH handshake message was too large for my VPN tunnel to handle without fragmentation. To fix it, I manually lowered the MTU of my VPN interface by running: sudo ip link set dev tun0 mtu 1200

[molten swallow]

Hello guys, i have a question about ptt and over-pass attacks. Are Mimikatz and Rubeus mostly interchangable and its preferable to use Rubeus , cause its not communicating with LSASS that aggressively and much stealthy to the edr, etc.?

This part of pass attacks is heavily loaded and i can't comprehend it's clearly.

[tribal dock]

@inner canyon Brother i dumped all sql tables still i havent found any way to DEV01. Can you please guide me a little bit more

[inner canyon]

You got juicy information, what can you access with it? Just got to enumerate a bit more.

[gray yacht]

Hey be sure not to provide attack paths for skills assesments or labs.

[fathom pendant]

@left needle that module is above tier 0; refrain from sharing screenshots from enumeration in the module

[granite sandal]

I'm doing the "Spraying, Stuffing, and Default Credentials" section in the Password Attack Module. I got the answer for the challenge question but I don't see why we were given creds to ssh to another box? It seems unnecessary?

[royal saddle]

I seem unable to spawn the target system, is it just me? What could I do?

[dusk holly]

to check if the credentials are valid or not, instead of brute forcing the answer

[fathom pendant]

man it helps to know the module name and section so people can be more helpful

[fathom pendant]

ssh in and use credentials until they work. there's an sql server running internally

[royal saddle]

module/143/section/1422
Active Directory Enum & Attacks: Internal Password Spraying - from Windows

[granite sandal]

Thank you. I searched around and saw we're supposed to check with mysql -u <username> -p and see if the login works. I appreciate it.

[dusk holly]

it was working fine for me recently, maybe try refreshing the page, you can also wait a bit to spawn it later

[severe inlet]

Hello i wanted to ask what is the meaning of chaining exploits?

Does it mean i exploit A then Exploit B to reach C

or i mix both A and B Exploits at once to reach C?

Or both?

[fathom pendant]

chaining exploits is basically combining exploits to reach a goal;
Say you need exploit B to get to C, but that requires exploit A to be achieved, so you chain A and B to get C

[hasty mauve]

@severe inlet

An example on that would be:

A: You exploit a SQLi to get a password from the database
B: Use the found password to login to dashboard, which has a feature that is vulnerable to directory traversal
C: You Abuse directory traversal to read SSH private key of a user and gain a shell

So here, you chained SQLi with directory traversal to read a private SSH key and get a shell.
This is what chaining means.

[fathom pendant]

this wouldn't be a chain

imho

but it is, so my opinion is moot lol

[frozen sage]

did you found a solution?

can i dm you as well?

[unreal crane]

help

[tall pike]

try to switch to US vpn (if you are using EU) then try to respawn again

[unreal crane]

yeah it worked thanks

[fast quest]

I Tried both US and EU both fails launch the VM

[tall pike]

no worry

[tall pike]

i am currently on US 1 and fixed for me

[fast quest]

so we can use the vpn server which doesn't mention "recommended"?

[tall pike]

ofc

[fathom chasm]

Hello
I am having issues today spawning targets. The target is not deploying. What is the solution?

[tall pike]

try to switch US vpns (if you are using EU ones), it fixed for me

also support team is working on it atm

[fathom chasm]

I am supposed to be on EU

[tall pike]

m2 but EU and a few of US ones having technical issue rn, try US 1 like me

[fathom chasm]

ok thank you mate. I will switch to US!

[tall pike]

nw

[stable aurora]

sure

[analog oasis]

are vms down?

they don't spawn

[tall pike]

EU vpns having technical issue rn, switch to US 1 (worked for me)

[ocean night]

Which VPN server were you having trouble with please?

I will pass it on to the team

[analog oasis]

i meant the vm itself doesn't spawn, i haven't tried to connect yet

does changing the vpn fixes this?

[ocean night]

Yeah I understand, but that may well be due to an issue with the VPN server.

[tall pike]

i think all EU VPNs and a few US ones (not sure which ones), already talk with support team

[ocean night]

Which VPN server are you assigned to at the moment?

[analog oasis]

eu

[ocean night]

(if it's failing)

Which one?

There are 6 EU Academy VPNs

[analog oasis]

eu academy 3

[fast quest]

the machine getting spawned but failed to work like rdp is not working

[left frigate]

Yep I am getting same

[ocean night]

Please do raise with support also

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fast quest]

i used almost all the vpn server experiencing the same in all the servers

[ocean night]

I am raising internally too.

[analog oasis]

alright i will do so, thanks.

[ocean night]

Which module / section target were you trying to spawn?

[analog oasis]

attacking common services module, attacking rdp section

[ocean night]

ty

[left frigate]

my module was different to which it was down cannot remember name but I think I already sent amessage to support

[tall pike]

ahhh my next module after password attacks

[ocean night]

eu-academy-1 and 3 comfirmed as impacted. Checking the rest.

Yeah.. team are already investigating it seems https://status.hackthebox.com

Switching to US region for now is the workaround, as you already found

The issues with the EU academy VPNs and spawning has been resolved.

[fathom pendant]

if only there was a tool to help you quick switch between them 👀

[tall pike]

there is a tool that lets you switch vpns in web, downloads the file and connects for you ?

[fathom pendant]

it doesn't connect but it downloads it :3

#community-content message

[severe inlet]

Oh so mostly all modules train us for this right?

I remember like the footprinting module had multiple chains if thats the case

Where you get information from ftp then use it to ssh or go to something else

[tall pike]

how the holy that bypasses the cloudflare

[severe inlet]

But the idea of chaining 2 things together seems really complicated to me so idk about it

Like combining 2 web vulnerabilities at the same time to exploit something

[severe inlet]

Do you have any examples for this?
I cant think of any except for vulnerabilities with http verb tampering

[fathom pendant]

it's not as complicated as you think

[fathom pendant]

it doesn't bypass cloudflare

that's why it requires a context session

[tall pike]

oh

still pretty good

[severe inlet]

I hope you are correct lol

[hasty mauve]

yeah lol I thought it was like this too when I first heard the term exploit chaining.
I heard that you'll have to chain multiple vulnerabilities in CPTS and I was terrified of that lol.

But turns out, it's simpler than I thought

[vast seal]

Yall think doing the web application path after doing the penetration testing path is overkill for CPTS and OSCP? I know the CPTS covers only what is in its path, but figure its good practice. And seems like alot of the pentesting path covers its modules

[fathom pendant]

i'd say it's overkill

[covert schooner]

Hi I am unable to upload files using Powershell UploadFile cmdlet and a ftp server with write mode enabled. Currently doing File upload module in academy.

[unreal crane]

yeah thank u guys

[fathom pendant]

not sure why you're using 192... the academy targets don't spawn in that subnet

[covert schooner]

that is my kali vm ip

[fathom pendant]

yea, but that wouldn't line up either

:) you need to use the tun0 ip

[covert schooner]

no i'm trying on my seperate instances

one windows vm and one kali vm. there is no relation with academy targets rn

[unreal crane]

xd

[fathom pendant]

that doesn't help as there could be some networking things

[covert schooner]

Networking is fine, every other method mentioned in the module is working fine

[fathom pendant]

I suggest asking in #homelab-sysadm since this isn't related to you testing on an academy target

so no one can sanity check things

[covert schooner]

Lmao but if the command mentioned in the module itself isnt working

why should I go in to the #homelab-sysadm

[fathom pendant]

this sounds more like user error rather than module error

and i'm asking you to go there because you're testing in YOUR OWN SETUP

not in the academy space

:)

so the issues could be related to other stuff

[covert schooner]

thanks

[fathom pendant]

here's the docs https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.uploadfile?view=net-10.0

[analog oasis]

if you are trying to transfer files between your local instances using ftp, i think you need to setup a client-server using an official app because i heard that ftp doesn't work smoothly on windows, you can try SMB though

[covert schooner]

It worked. Had to use the full path of desired file

Thanks

[undone kindle]

Hey everyone,
I hope you're all doing well. I'm reaching out because I'm feeling a bit overwhelmed with everything. I'm currently working through the Junior Cybersecurity Analyst path (which I was told is a good beginner friendly start, only been at it 2 weeks), and I’m currently on Introduction to Bash Scripting (Comparison Operators section). Both this and Linux Fundamentals have me feeling like I'm drinking from a firehose. I’m struggling to figure out how to properly approach the problems. I'm stuck on one question and I’ve reread the material, used Google, and even talked it over with ChatGPT for a good 45 minutes, but I still feel completely lost.

I understand we cant share answers in this chat, but I'm not sure if I'm able to list what I've done or what answers I've gotten (that turned out to be wrong obv.), but I can definitely do that if it’s allowed. I was just hoping it would start making sense, but no matter how many times I reread it, I’m still lost. I would really appreciate any guidance, tips, or insights from yall, I’d be super grateful!

Q: Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer.

[stable aurora]

hello, is this question specifically for bash or it's not specified?

[undone kindle]

im pretty sure its for bash, because its in the Bash module.

[stable aurora]

yeah makes sense now

you can dm if you want

[quartz jacinth]

hello is this the channel where i can ask questions about module sections ?

cpts

I am in windows privelege escalation - legacy windows 2008 r2
i have meterpreter session running using smb delivery module as said in the section , i ran windows exploit suggester to priv esc but all exploits suggested aren't working

https://academy.hackthebox.com/beta/module/67/section/912

the rest of the modules return the same incompatiblity as last image

ran sherlock and it suggested the same vulns

also tested the exploit in the section eventhough suggester said it wasnt vulnreable to it

[severe inlet]

Thank you so much i will definitely be more confident in my CWES Exam now since i heard alot about chaining

[granite sandal]

Hi everyone. I'm doing the Attacking Windows Credential Manager section in the Password Attacks module. I got the correct answer but im not sure if i did it the right way. Is there a step by step guide i should be referencing?

[fathom pendant]

there's no step by step guide, and there's multiple paths to get the answer

[granite sandal]

copy, thank you

[tall pike]

you gonna love PtT from linux

@fathom pendant is Password Attacks actually longer than it says in website or am i kinda dumb dumb ?

[fathom pendant]

yes

i ignored the time estimates

[vernal hamlet]

hello there , i am solving NTLM Relay Attacks Module
i am stuck at the last question Q4 i was able to get ||SQLADM|| but i cant find a way of it leading to the domain contoller any help i would appreciate it dm plz

[gray yacht]

Did you set it up with socks? If not try that out and it should be easy.

[vernal hamlet]

yes i have it with socks as smb sess and it has local admin over ||SQL03 ||thats it i dont see interesting shares and it cant set ||rbcd ||which i tried

[gray yacht]

You can send me a DM.

[jaunty kraken]

I'm experiencing exactly the same issue as him, and I'm unable to complete the module exercises.
Can someone please help me?
I searched through the posts on the server, but I couldn't find any solution.

[fathom pendant]

that's because the problem is likely a connection issue; respawning the target may work or changing vpn region/respawning

[jaunty kraken]

Thank you. I had respawned the machine several times, but I hadn’t tried changing the region.
I’ll give that a try.

[west yacht]

thanks my stupid a**

[west yacht]

thanks

[heavy dome]

🎉 https://academy.hackthebox.com/achievement/badge/d8f4fb89-fbfd-11f0-9254-bea50ffe6cb4

[jaunty kraken]

I just wanted to give a quick update.
I tried switching through several regions during my lunch break, and I finally found one environment where TLS connections worked.
(The last SMTP exercise still didn’t allow successful enumeration. ) thx.

[hasty rock]

Hey everyone, I’m stuck on the SMTP enumeration module and want to sanity-check my approach, because I’ve followed the guidance but I’m still getting 0 valid results for what the question is asking.

What I’ve done so far:

• Identified SMTP on port 25 (InFreight ESMTP v2.11)

nmap -p25 -sV -sC <target>

• Manual SMTP interaction via telnet
– Corrected EHLO syntax
– Server accepts VRFY, EXPN, RCPT, etc.
– RCPT TO returns 250 OK for any username (catch-all / open relay behavior)

• Confirmed open relay:

nmap -p25 --script smtp-open-relay <target>

• Enumerated users via Nmap:

nmap -p25 --script smtp-enum-users <target>

This returns:
root, admin, administrator, webadmin, sysadmin, netadmin, guest, user, web, test
→ None of these are accepted as the module answer

Per moderator guidance, I stopped using RCPT and switched to automation + wordlist

• Used the module-provided name list (~100 common names)
• Created users.txt

smtp-user-enum attempts:

smtp-user-enum -M VRFY -U users.txt -t <target>

→ 0 results

smtp-user-enum -M EXPN -U users.txt -t <target> -D inlanefreight.htb

→ 0 results

Manual automation using netcat (with proper CRLF + QUIT):

while read user; do
printf "VRFY %s\r\nQUIT\r\n" "$user" | nc <target> 25
done < users.txt

All users tested so far return:

550 5.1.1 <user>: Recipient address rejected: User unknown

No variance in responses, no aliases, no 250/252 differences.

At this point:
• VRFY appears hardened
• EXPN returns nothing
• RCPT is unusable due to catch-all
• Wordlist automation yields only 550 unknown

My question:
Is the expected takeaway that enumeration is not possible in this configuration, or is there a specific signal/command/output I should be keying in on for the answer?

Appreciate any guidance — just want to make sure I’m aligned with the module’s intended outcome and not missing something obvious.

[autumn pilot]

Use the wordlist that can be found and downloaded in the resources of the module, do not create a wordlist by yourself

[hasty rock]

Thank you! I used the wordlist provided in the modules resources. The list gave 101 names. I created a nano users.txt to run an automated script: while read user; do
printf "VRFY %s\r\nQUIT\r\n" "$user" | nc <target> 25
done < users.txt
So far, I am not having any success. I am attempting to discover the user without manually typing each name as a wordlist may not always be provided.

[autumn pilot]

I just tested the exercise using the footprinting-wordlist.txt wordlist and it works

Keep it simple

[hasty rock]

VRFY, EXPN, RCPT, and Auth return nothing.

Okay. Thank you!

Currently having issues with downloading the wordlist inside the vm directly. Only my actual desktop is able to access the wordlist.

Do I sign into my HTB account using the VM's Firefox?

[upper widget]

Module: AD Hardening - Recon & Initial Access- Skills Assessment

Why is it not getting remediated?

[jovial walrus]

DNS Tunneling with Dnscat2 chapter on pivoting, tunneling module

[upper widget]

Module: Intermediate Network Traffic Analysis
File: ARP_Spoof.pcapng --> Corrupt. It does not open

[plush urchin]

Good day I am going through the second detection example on analysing evil with sysmon and event logs.

But I can't see the event 7 on sysmon

I have done PSInject on powershell and it has clr and clrjit DLL in the module of process hacker but I can't find the event on sysmon

[foggy snow]

Hey! I am currently doing the 'SQL Injection Fundamentals' module. I am trying to complete the question within 'Writing Files', however I just can't seem to get any output.
I used a union injection with the following payload: ||cn' UNION SELECT "", '<?php system(_REQUEST[0]); ?>', "", "" INTO OUTFILE '/var/www/html/shell.php'-- || and it definitely writes the file since I can access /shell.php, but when I try getting execution by using ||http://IP:PORT/shell.php?0=id|| I don't get any output, I already confirmed I have the needed privileges and everything.

[waxen totem]

You're missing a $ in your payload

[foggy snow]

Ahh I see, thanks! always the simple mistakes haha

[fast quest]

Hey for DACL Attack 2 skill assessment VPN and machines are not reachable I have tried US and EU server. Could you check on this module or SA?

If anyone working on DACL attack 2 SA please let me know the SA machines are working or npt?

[winter shell]

Hello! i have stuck in Kerberoasting - from Linux (Active Directory Enumeration & Attacks) in this question What powerful local group on the Domain Controller is the SAPService user a member of? i used crackmapexec but it does not say PWn3d! is any way to see the local group on of this user ?

[earnest jacinth]

https://www.netexec.wiki/ldap-protocol/query-ldap

[vapid storm]

Hello, can anyone help me with the windows defense PKI-ESC1 questions. Ive checked the forums as well as other resources but i cant get in dc1\c$\scripts.

[fading cipher]

hello i am having some trouble in the command injections module, can someone help ?

[dusk holly]

people tend to help more when you ask your question directly

[vapid storm]

Can anyone help me figure out how to find the flag? Last time im asking

[gray yacht]

I haven't done the module, but are you supposed to leverage ESC1?

[tall pike]

are we not allowed to use our vms for skill assessment (from password attacks) or am i missing a configuration ?

[gray yacht]

So you're good? I'm going to delete your response as it includes spoiler information.

[gray yacht]

You can use your own VM, just need to download the OpenVPN config file.

[tall pike]

i do have it tho, connected too

[gray yacht]

Are you unable to do anything with the external target?

[tall pike]

i can't ssh the target

i am at the start and machine won't let me even connect

but when i switch to parrot os on web, it allows to me connect with ssh

lemme get the SS

[gray yacht]

You can DM what you are trying and I can help you troubleshoot a little.

[sly roost]

Hello am in Information Gathering - Web Editing

inside of the Fingerprinting it require us to use nikto tool now i've ran the commands but doesn't seem to be working if anyone can see if i made any mistakes

nikto/program on  master via 🐪 v5.34.1
❯ ./nikto.pl -vhost app.inlanefreight.com -host 10.129.12.153  -Tuning b
- Nikto v2.5.0
---------------------------------------------------------------------------

nikto/program on  master via 🐪 v5.34.1
❯ ./nikto.pl -vhost app.inlanefreight.com -h 10.129.12.153  -Tuning b
- Nikto v2.5.0
---------------------------------------------------------------------------

my vpn is turned on for HTB and the exmaple and questions can be found here
https://academy.hackthebox.com/beta/module/144/section/3075

[molten swallow]

It maybe a stupid question - I've deleted krb5.conf and reinstalled package but the popup menu for default realm doesn't show up and also I don't have fresh default krb5.conf?

This file is like a scratchpad and should be redone for every new domain in order not to break kerberos-based attacks?
I can leave garbage/nothing here until i need this, or deletion may break other attacks?

[hidden ledge]

You can write it manually or use netexec to generate one

netexec smb ip -u user -p password --generate-krb5-file /path
export KRB5_CONFIG=/path

[molten swallow]

But it wont break other windows attacks that doesn't involve krb?

[hidden ledge]

No I think you are good to go

If I understood what you mean

[toxic compass]

hello !! i was stuck on Firewall and IDS/IPS Evasion - Hard Lab

Host script results:

| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
| Computer name: nix-nmap-hard
| NetBIOS computer name: NIX-NMAP-HARD\x00
| Domain name: \x00
| FQDN: nix-nmap-hard
|_ System time: 2026-01-28T18:11:06+01:00

is samba 4.7.6 answer wrong or
am i missing something?

can u elaborate plz 🙂
i

[molten swallow]

So this .conf should be redone for every new target and just have [libdefaults] and [realms] if im doing it manually, or netexec will generate it for me with the same fields?

[toxic compass]

ohhkay. btw what was wrong in my scan? it gave me version of samba

did it , plz check 🙂

[cunning fern]

Iirc you should read the article about firewall evasion once again

Carefully

[lusty depot]

Hi everyone, I just cleared the password attacks skills assessment, but I have some questions.

Aside from being able to move faster, stealthier, and perform attacks like pass-the-hash, forging tickets etc — what’s the main point of having the hash if you already have the password?

I’m asking because in the assessment, I was able to retrieve every password a bit earlier 🤔.
Is it because using the hash can bypass some password-based authentication protections ?

The whole point of trying to get the hash isn’t because you don’t know the password? At least for interactive users ?

[fathom pendant]

Using the hash is an intermediary to the password, within authentication mechanisms: they're the same.

Tickets are more powerful, they grant the authorization of whatever the ticket gives as whatever service/user you're importing from without the need to brute a pass

[turbid jewel]

In the password attack linux thing, i was able to get the service account .kt and get a hash, but I need password to use ssh

I used hashid and tested a lot of -m options

This is really the way or i'm being dumb?

[lusty depot]

Sure, so if I have the password, I could just use it without caring about the hash

[lusty depot]

Rabbit hole, I suggest you to enumerate a bit more, think dumber.

[turbid jewel]

Okay, i'll try again

Thanks

[molten swallow]

This module drains the soul

[lusty depot]

So true. With all those useless documents that you have to check 😞

[molten swallow]

Shares was fun, you need logically analyze where the right things can lay down peacefully

[lusty depot]

Sure, you need to avoid tunnel vision

[molten swallow]

I can only imagine rabbit holes on the exam

To think , then to do. Only one solution

[lusty depot]

the level of logical analysis is probably insane. I think a good thing is to learn how to prioritize attacks path and target

[molten swallow]

Ippsec videos helps a lot

[lusty depot]

It’s like if you don’t have enough information, trying a password attack is probably useless unless you are facing a common apps or a login page with default creds

[lusty depot]

Yup

[warm horizon]

Subject: Help with TinyFileManager Lab - Stuck on Search Injection / Path Traversal

"Hi everyone, I'm working on a lab featuring TinyFileManager (similar to CVE-2021-45010) and I'm stuck. I've discovered a flag.txt location hint in a text file, but I can't seem to read it.

What I've tried so far:

Command Injection in Search: I've tried multiple payloads in the extension and content parameters via POST request to index.php?p=, including:

html" -exec cat /flag.txt #

html";cat /flag.txt;#

Using ${IFS} instead of spaces to bypass filters.

Using ||cat /flag.txt to force execution.

Path Traversal / LFI: I tried accessing the flag directly via:

index.php?to=&dl=../../../../flag.txt

index.php?p=&view=../../../../flag.txt

URL encoding dots and slashes (%2e%2e%2f).

The Result: Every single attempt returns a response with a Content-Length of 60789. It seems the server is either sanitizing my input or I'm missing a specific bypass for the guest account restrictions. The 'Report Issue' link points to the official GitHub, but the known RCEs there aren't working for me.

Am I looking at the right parameter? Is there a specific character filter I should be aware of, or should I be looking for another entry point entirely? Any nudge in the right direction would be appreciated!"

[fathom pendant]

Which academy module is this related to?

[sharp torrent]

I’m trying to complete, “attacking common applications”. I’m exploring, “Exploiting web vulnerabilities in thick-client applications”. Whenever I compile the java binary the first time it compiles fine ( as per the learning material) but when I try to compile again the key mapping get’s distorted and I can no longer use commands with “-“ or “/“. It makes it impossible to complete the lab. I’m at 98% complete the CPTS course can someone help me with this please or provide a suggestion.

[brazen axle]

Hello, has anyone took Android Pentest Skill Path? DAST module in particular, i see that there will be some work with SMALI, how would rate it?

[fathom pendant]

Did you make sure to remove the bits in the manifest file? Iirc that got me a bit. But that bit overall is just clunky

[sharp torrent]

thanks!! i'll give that a try

[fathom pendant]

Also making sure to have a single newline in the file. Iirc that also breaks it. Its been a little over a year since I touched it, so ymmv

[warm horizon]

"Thanks MarcieLee! I'm seeing the same issue where commands with '-' or '/' are failing. I'll check the manifest file and the newline issue. Should I be looking for a specific entry point in the manifest to trigger the flag or is it just about fixing the compilation?"

[digital rain]

RE: Info Gathering Web Edition Module, does anyone know the answer here? I cant get archive.org to work for this one 🙁

According to wikipedia.com snapshot taken on February 9, 2003, how many articles were they already working on in the English version?

[fathom pendant]

Just fixing compilation. I remember just hating how clunky it was

[fathom pendant]

I think archive.org has been having infrastructure problems

[warm horizon]

"I see what you mean about it being clunky. I'm looking at the file manager now but only seeing some .txt files and a tmp folder. Should I be creating a new file to trigger the compilation or is there a hidden config I need to fix to get the flag to reveal itself?"

"My apologies, MarcieLee! I think I explained my situation poorly due to the language barrier (I'm from Brazil and still working on my English). I am actually working on the TinyFileManager 2.4.6 lab, not the Java thick-client one.

I've identified a potential Command Injection in the extension parameter of the search function, but I'm stuck. Every time I use quotes, pipes, or slashes, the server returns a 60789-byte response, which seems to be a 'silent' error or a filter blocking the execution. Since the Java module doesn't apply here, is there a specific trick to bypass the character filtration in this version of TinyFileManager to get the RCE working? I'm really trying to learn the 'injection' part mentioned in the hint file!"

[fathom pendant]

What htb academy module is this from?

If its not from an academy module, you're in the wrong chat

[warm horizon]

@fathom pendant Command Injections

Skills Assessment
You are contracted to perform a penetration test for a company, and through your pentest, you stumble upon an interesting file manager web application. As file managers tend to execute system commands, you are interested in testing for command injection vulnerabilities.

Use the various techniques presented in this module to detect a command injection vulnerability and then exploit it, evading any filters in place.

Connect to Pwnbox
Your own web-based Parrot Linux instance to play our labs.

Pwnbox Location
UK
397ms
Terminate Pwnbox to switch location

/ 1 spawns left

Waiting to start...

Enable step-by-step solutions for all questions
sparkles-icon-decoration
Questions
Answer the question(s) below to complete this Section and earn cubes!

Target(s): 83.136.255.53:54017

Life Left: 81
Authenticate to 83.136.255.53:54017 with user "guest" and password "guest"

• 10 What is the content of '/flag.txt'?
  Submit your answer here...
  +10 Streak pts

[fathom pendant]

I dont recall tfm from Command Injections, though that module i mostly just did what the reading showed

Also please dont copy/paste the entire page

[warm horizon]

"Sorry for the copy-paste! I'm indeed in the 'Command Injection' module. I'm struggling with the character filter on TinyFileManager 2.4.6. Since pipes and quotes return a 60789 error, I'll re-read the section on 'Bypassing Blacklisted Characters' to find the right syntax. Thanks for pointing me in the right direction!"

[cosmic elm]

Hello all! I am working on the AI Red Team path.

Module: Applications of AI in Infosec
Lesson: Model Evaluation (Network Anomaly Detection)

Issue: problems uploading network_anomaly_detection.joblib to HTB model validation webpage from my personal computer

Description: I was able to connect via openvpn but when I navigate my browser to http://<target- IP>:8001 to upload the model that I have trained on my local Jupyter instance, the connection keeps timing out. In a previous lesson, I was able to successfully navigate to http://<target-IP>:8000 to submit the spam detection model, which makes me think maybe it is a problem on the back-end. Can someone please help?

[modern lantern]

I just used the scripts that we loaded into jupyter (to do whatever) to send off the model to htb. I dont think you need to navigate to 'targetip:8000'?
Can dm me if you have questions.

[scenic parcel]

I remember this user interface. Looks like your misidentified injection point. Still need help?

[cosmic elm]

Thanks for the reply! Sure, I'll send a DM

[west yacht]

Anybody ever unable to reach or even ping the target IP on pwnbox

[west yacht]

unable to ping from my VM either

never had this issue before

disregard resolved

[earnest pasture]

Good evening, everyone. I have a question about the AD Active Directory Enum & Attacks Skill Assessment. I connected via WinRM with the local administrator hash to the machine they gave us, but when I try to enumerate the AD with PowerView, I get errors. However, if I do it as SYSTEM, I can enumerate it with PowerView normally. Why is this happening?

[dusk holly]

Maybe double hop problem, what are you using to connect to system shell

[earnest pasture]

I am using evil-winrm with the local administrator hash to connect to the host.

[dusk holly]

I mean you said it is working if you do it as system what are you using to do it as system

[earnest pasture]

Can I send dm? So I don't give away any spoilers.

[dusk holly]

Yeah

Hi
Question for everyone, I am currently going through sections and some of them contains alternative ways to solve the problem, do you guys think, should we try every one of them, or at least important ones? If yes what is the benefit of it, but I think it takes too much time

[hasty mauve]

I usually try one, but take notes of all of them.

[dusk holly]

I usually do that too, but I think I should try more than one tool

[jovial walrus]

on chisel section on pivoting module I was struggling to rdp, this command helped ,,..just in case someone faces similar issue

[hasty rock]

Hey everyone — I’ve been stuck on this module for about 4 days now (https://academy.hackthebox.com/module/112/section/1072). I’m trying to automate running the provided footprinting-wordlist.txt against the SMTP service using the example approaches (VRFY / EXPN), but I’m getting no valid results, even though the moderator confirmed the wordlist works.

I’ve tried looping with while read user; do ... nc <target> 25; done, keeping it simple, and avoiding over-engineering, but I still can’t identify the expected user.

Also struggling with downloading/accessing footprinting-wordlist.txt inside the lab VM itself — it downloads on my local machine but isn’t accessible in the VM, and direct wget from the Academy URL returns 404.

Any help, exact commands, or tips for reliably getting the wordlist into the lab and running it correctly would be hugely appreciated.

[earnest pasture]

There is a tool in Linux called “smtp-user-enum” that can help you, but if you want to automate it yourself, you should keep in mind that, due to connection issues with a service, it may take some time to validate your account. For example: I connect to the SMTP service, the service responds with the banner, when I log in, it may take a while to respond and validate my user, so you should have a wait limit of about 10-15 seconds before validating other users. I don't know if I explained it well, but if you have any questions, you can send me a DM.

[earnest pasture]

If anyone knows why this is happening, please don't hesitate to let me know. I've been looking into it, but I'm still confused.

[waxen totem]

Because local admin != domain admin. Local admin isn't a member of the domain. System accounts are a member of the domain as a computer account.

[earnest pasture]

But the machine is joined to the domain, and as the local administrator of the host, I should be able to enumerate the AD, or at least that's what I understood from the AD enumeration & attacks module.

[waxen totem]

yeah the machine is joined but local administrator is not a domain account

SYSTEM is the domain account for the machine

[earnest pasture]

Sure, the problem I have is that when I log in as SYSTEM on a computer connected to the domain, I can enumerate the AD with PowerView. But when I connect via evil-WinRM with the local administrator to the same computer joined to the domain, I can't enumerate the domain with PowerView, so I wanted to know if I should actually be able to or if it's a lab issue.

[waxen totem]

you should be able to do it if there's cached domain credentials

[hasty rock]

Thank you so much @earnest pasture and you explained perfectly. I will update you via DM on the results.

[hasty rock]

Thank you! This helps a lot!

[cyan veldt]

can anyone help me with API attacks section Broken Object Property Level Authorization
https://academy.hackthebox.com/module/268/section/3063
last question "Exploit another Mass Assignment vulnerability and submit the flag."

[heady hazel]

hi, same issue here 🙂 I restarted the box multiple times..

[heady hazel]

uh, solved.

[dusk holly]

@lapis tinsel don't DM without asking, you can ask your questions related to modules here and people will help

[leaden island]

yo guys
im on attacking thick client applications
and ive few questions to ask

[hard path]

idk if its only me but i have many problems recently... sometimes ports dont show up, now i cant get a file from ftp from a lab, which u normaly should get etc etc

[worn sun]

for anyone who have done the ai red teamer path, particularly 2nd module skill asessment, why am I getting the following response when i try to upload my model?

Response: {"accuracy":0.0,"metrics":null,"misclassified":[]}

[vocal schooner]

Anyone know in the Introduction to Sliver C2 why the task is never launched for the lsass save ? pls

[sinful tide]

Hello, I am doing the introduction to windows evasion Techniques

And I am stuck in the process injection skill assessment, it is basically asking me to perform the injection on the calculator I did that it works fine, but when I delivered it on the victim machine it did bypass the AV but nothing happens even though it says it got executed I even added a code section to make a get request to my PC and creat a text file and none of these got triggered even though the log file says it got executed so I am wondering if anyone got the same issue here