modules

[coral lion]

you could just reply to yourself to make it easier

[hardy jacinth]

you can give me the flag (:

[fathom pendant]

lol flag sharing is strictly prohibited

especially for modules above tier 0

[coral lion]

😂

[hardy jacinth]

i stuck on this for a week

[fathom pendant]

best guess is that your shellcode is a bit too big

it says under 50 bytes

[coral lion]

code optimization 😄

[hardy jacinth]

it 41

[coral lion]

daym

yea idk shit in this

imma go do my bash

[hardy jacinth]

what can i do hate the monitor?

[fathom pendant]

@hardy jacinth module is above tier 0; don't share code from the module please

[hardy jacinth]

fine

even this ?

[fathom pendant]

can we not

[hardy jacinth]

ok

[fathom pendant]

just wait for someone to offer to dm and assist you

[hardy jacinth]

i guess i should lock for another module

[hardy jacinth]

finally i thought i will kill me self for this moudule

but i got another problem I need my page for SOC Analyst Prerequisites

[sly kelp]

wait until they fix

[granite sandal]

copy ghostrider, thank you

that worked. its always the simplest things. Thank you!

[grizzled schooner]

Does a student subscription give me full access to the CAPE job role path? Please @ with replies

Nevermind - found it ^

[polar crescent]

hi, having an issue in the AI data attacks, evaluating the Trojan attack section. In the last cell of the notebook where the file needs to be submitted to get a flag, I keep getting the error read timeout while submitting. Have tried respawning, increasing the timeout, but still the same error - Error submitting model: HTTPConnectionPool(host='154.57.164.79', port=32104): Read timed out. (read timeout=120)

[silk ice]

I'm working on https://academy.hackthebox.com/app/module/116/section/1165 and have a question.

When running medusa -U users.list -P passwords.list -h $IP -M ftp -n 2121 I don't get any hits but when I run hydra -L users.list -P passwords.list ftp://$IP:2121 -q -t 45 I get a hit (which is the expected outcome).

Why do they end up with different results? Aren't they essentially performing the same bruteforce?

[cloud urchin]

@granite sandal @sick meteor Please take care not to reveal content or spoilers for modules above tier 0

[jovial walrus]

in lxc/lxd section on linux priv escalation they ask to unzip alpine image but never tell what is alpine and where to install it from ?

[brave field]

https://github.com/saghul/lxd-alpine-builder

[untold orbit]

Hi all,
Can anyone please help me with this?

[brave field]

dm please

[coral lion]

Can anyone help me with a Bash Script? (Can't send the code here cuz the module is above Tier 0)

[dusk holly]

you can try to explain the problem without sending code

[grand veldt]

someone plz tell me that is this HTB subscription is available in coursera ?? i am a student and cant afford this plz tell me thanks

guys also tell me whats the diff between monthly and anual subscription ?

[dusk holly]

this is not academy subscription, this is Labs subscription which only HTB can offer, monthly and annual subscription is pretty straightforward i think, monthly you pay for one month while annual you pay for whole year

[grand veldt]

yeah i knew abot that this is a lab subscriptiion

any discount for students ??

[dusk holly]

unfortunately discount for students only exist in academy

[grand veldt]

oh i think i have no choice either thanks btw can you plz tell me if a bought thiis does it unlock all the vip labs ??

[dusk holly]

yeah it basically unlocks everything in labs, not including Pro labs (except for two free ones)

those have separate subscription

[grand veldt]

so the vip labs in these are all unlock after buyinh subs???

[dusk holly]

yes

[mighty matrix]

Hi, it's been saying target spawning on the Analyzing Evil With Sysmon & Event Logs module for the past 10 mins. I have tried to refresh the page numerous times. Is HTB functioning as normal or are there issues?

[final cypress]

Question. I'm trying to connect to the spawned target, however it keeps telling me I have the wrong passkey.

I am copying and pasting the one that is there.

Any idea why it's doing that?

This is for Linux Fundamentals, section 8.

[autumn pilot]

You need to use the htb-student username to SSH into the target

[thick beacon]

?

[final cypress]

I'm an idiot. Thank you.

[untold orbit]

have you spawned shell?

I would spawn shell through meterpreter and do some enumeration

[coral lion]

the problem asked me to print the last 20 characters of a variable that keeps getting coded in base 64 in a loop when certain conditions are met (the variable must have a string in it and its character count must be over 113450)

my bash script found the condition and printed the last 20 characters

but its somehow not the correct answer

[iron ether]

I have the same problem any answers?

[cosmic jay]

Having trouble on Windows Event logs and finding evil, the sysmon section.

I set sysmon to run with the provided config file, and perform the dll hijack, getting the text box indicating hijack was successful, however no Event ID 7s are recorded in the sysmon event logs, and I couldn't find other events related to loading dlls.

[sour ether]

Hello everyone,
I am doing the Broken Authentication Module from Web Pentester Path and in the content Brute-Forcing 2FA Codes, I done the lab, but I am curiously, because the ffuf do not returned a token to insert, but, do the direct bypass. Its the correct?

I thinked that the code will be returned on console to insert in browser 😛

[cosmic jay]

Issue solved. The config file that comes preloaded on the machine has event ID 7 disabled by default. Enabling is a one line change.Just in case this is not intended I am putting this here.

[iron oar]

Does anyone actually prefer the new academy UI to the old one?

[heavy sluice]

I do. I have a big screen and it was hard to read the text in the old UI. But while I like the design and concept I do not like that functionality got worse. (Code blocks, revisiting of modules, showing modules of the path in the small box where you only see the green checkmarks and have to scroll to visit the module you want to do next, and so on)

[quick cloud]

i stuck at the imap and pop3 module labs please help if anyone know how to do this

[dusk holly]

learn how to retrieve the body of the email, the cheatsheet commands don't include this command

[quick cloud]

@dusk holly can you please share the command i stuck for almost for 1.5 hours

[dusk holly]

maybe try this: a FETCH 1 BODY[] next time, don't forget to check HTB Forums as well

[halcyon sparrow]

Hey, on the old UI, there was a link to the youtube video walkthrough for the course labs. Do you know if this option has been removed or moved? I can't find it anymore

[coral lion]

Can anyone help me with this?

[fathom pendant]

body[] is 1000x better than all

[fathom pendant]

There was a link to videos?

Maybe for the tier 0 modules, but no video guides (should) exist for modules above tier 0

[dusk holly]

isn't it the same?

[fathom pendant]

No, no it is not

[halcyon sparrow]

if i remember well yes, there was the written walkthrough and a video (only for the labs such as "Fingerprinting lab - medium" for instance)

but nevermind

ty

[fathom pendant]

Doesn't sound right, since that module is above tier 0 if im remembering correctly

[halcyon sparrow]

oh okay

[fathom pendant]

Yeah its a tier 2 module, so any video guide/walkthrough would be stricken down by copyright claims due to ToS

https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[keen zephyr]

Which VMs you guys use daily?
I have been using virtual box for the past few months, but I gotta figure a new one because vbox always burns CPU cycles despite being idle, like 8% of total CPU usage when vbox is open idle vs 0.5% when box is closed

[brave field]

what's the command syntax for this?

[fathom pendant]

Sever showed the syntax;
Imap syntax goes
Prefix command arguments

You can put anything as the prefix

[heavy sluice]

I use WSL at work, I've never run into any problems with it. (Except Wi-Fi hacking)

[sour ether]

@fathom pendant

[cosmic vine]

is there any way to see what changes to the new ui are being worked on based on feedback which has been submitted? i'd like to know if i need to start creating my own workarounds to make the new ui easier to use or if the bugs will be fixed sometime soon

[fathom pendant]

don't ping me

[sour ether]

Have a FAQ, here? I do not ping to anything :))

[fathom pendant]

you specifically pinged me about a random question you had regarding what you're asking about. see #rules

[glad flicker]

nvm

[hardy jacinth]

hola

[tidal steppe]

Is there any code review modules? I don’t know that much about code review but I wanna learn

[cloud urchin]

https://academy.hackthebox.com/course/preview/secure-coding-101-javascript

[hardy jacinth]

there is web called coddy I used to learn it there it have all the computer language

it similar to duolingo

[tired olive]

Is there a way to go back to the classic academy layout?

i really preferred it over the new one haha

[hardy jacinth]

which is better focus on attack or DEFENSIVE

if any one have an idea about that plz told me

[tired olive]

depends on your goals and interests

[hardy jacinth]

i study right now network

[fathom pendant]

nope, it's retired -- and it's far too much effort to maintain 2 versions of the same website

[swift carbon]

More jobs in defense, if that matters to you

[hoary herald]

Hello

I need help with a module; I've been trying for a long time.

Can someone help me privately or should I send my question here?

[fathom pendant]

People cant help you if you dont at least say what module and section you're working on

Asking here is fine just be mindful to avoid spoilers for modules above tier 0

[hoary herald]

Help me.

[fathom pendant]

Module is tier 2 please refrain from spoiling info

[hoary herald]

Help me for dm.

[fathom pendant]

Don't dm people without asking. I am busy atm

[hoary herald]

Ok.

[fathom pendant]

The question says "directory" check common places where an admin might tell scrapers not to look

[hoary herald]

I already tried that. It doesn't work.

I tried with several dictionaries.

List subdomains and directories. I'm not getting anything.

Neither subdomains nor directories appear. I tried with other dictionaries and they didn't work either.

[jovial walrus]

how is privileged groups section diff from lxd in linux priv esc module...seems pretty much same except diff container image ?

why is it that we skipped the lxd initialization process in lxd section but we did it in privileged groups section before importing image?

[little terrace]

im doing AEN, and i cannot RDP at all. ive tried rdesktop, xfreerdp3 and remmina and it all doesnt work. i dont want to use the pwnbox to do this. im pivoting using ligolo too so it shouldnt be that hard

any help?

[fathom pendant]

because you're overthinking this, remember a common text file that exists on most web servers

[fathom pendant]

without spoiling too much ||not all the machines have rdp||

[little terrace]

so even if a bh scan says that the account can rdp, and nmap shows that the rdp port is open on that machine, there is an extra config stopping me from rdping in?

[fathom pendant]

like i said i'm not gonna spoil too much about AEN as I generally advise people to do it blind, I suggest as well trying to reset the lab, changing vpn regions, etc

[little terrace]

nvm turns out /timeout:100000 needed to be added because it took too long each time

[burnt thorn]

Hello, I’m sorry if this isn’t the correct channel to ask this. May I know if it’s possible to transfer or donate a cube from one account to another?

[autumn pilot]

nope

[burnt thorn]

Thank you for the info.

[silver fable]

Hi, I'm working on question about cracking hash of Mark's password. I tried multiple ways to generate wordlist, cupp only, cupp + rules, words + rsmangler, but I'm still not successful. Can anybody help me with that? Steer me into right direction?
Module: Wi-Fi Password Cracking Techniques
Section: Generating Wordlists

[heavy sluice]

His Name is john https://discord.com/channels/473760315293696010/1471791336372965376

[stuck hollow]

In module Introduction to Malware Analysis section Interactive windows internals, I am unable to keep RDP open; it constantly closes on its own, preventing me from working on the questions. Any help please? im using xfreerdp3, cant move forward

[stuck hollow]

Any help please?

[regal gust]

Hi all. Stuck on command injetions, section 3 (filter evasion), subsection 3 (bypassing other blacklisted characters), question 1.

The question is asking me to find the user in the / home directory, using env variables to avoid the blacklist. Not sure why me command isn't working? Also found that only ls is accepted, all other commands fail, which is whacky.

ip=127.0.0.1${LS_COLORS:10:1}%0als${PATH:0:1}home

And full BURP output:

Any help would be much apprechiated

Also tried adding another %0a between the ls and the /home

This just provides ls output for the present directory

Ah, solved my problem haha. Turns out just typing my thoughts out helped

Thanks for being an inadventant rubber ducky :3

Insne lab haha

[short vigil]

Question on file transfer module section 2 question 2:
‘upload the attached file named “upload_win.zip” to the target with method of choice. ‘
Where is this attached file? No resource tab within the module

[short vigil]

I think this is a bug, i looked at a walkthrough to make sure im not an idiot and there is suppose to downloadable as a resource but it is found nowhere on the page

[plain hare]

Hi All, quick question has anyone done the skill assessment for the Advanced XSS and CSRF Exploitation? im currently 75 in the exploitation, but have a question, anyone that could help?
i dont want to spoil so DM would be prefered if anyone has completed it

[short vigil]

The fix i did here was just specify the resource i needed to download manually in URL. Fyi

[brave field]

dm please

[keen zephyr]

sent

[shell panther]

Hi, can some1 assist me in the info gathering module, i cant set up the enviroment

[cosmic radish]

Hello ! Is there anyone that's finished the skill assessment on linux forensics that can help me with question 4 :

What is ParentProcessId for a sh command which sends a password using echo to the sudo python3 process?

I found a log that has the exact field and matches the description to a T but the answer isn't accepted.

[plain hare]

Hi could i get some help with skill assessment for the Advanced XSS and CSRF Exploitation?

[keen zephyr]

Finally, I've solved the 'Information Gathering - Web Edition' assessment challenges hahaha

Thanks @brave field for helping me out, you rock

[worn pine]

hi, i'm currently working on "Evil Twin Attack on WPA2". i tried using my own vm but the vpn config keeps refreshing every 5 minutes, so i tried pwnbox. But i got stucked here.

[rare ether]

Hi! In regarding of AI Data Attacks: Execute the Attack (Section 24 / 25), the host cannot connect target:

same problem there

[gray yacht]

If you set everything up as shown in the section, I would just restart the target and give it a few minutes after it comes online before accessing it to ensure everything is configured and running correctly within that instance.

[worn pine]

I restart everything, now after i sent deauthenticated packets there's no " WPA handshake: MAC" and the BSSID is missing

[gray yacht]

You can send me a DM.

[silk ice]

Hello, can I ask why the rockyou.txt on HTB pwnbox doesn't automatically come as .txt instead of .txt.gzip? Like is there a particular reason it is shipped this way?

[fathom pendant]

should be able to use the wordlist from the reading

[tawdry goblet]

Oh. I was trying to slov5 it with5 the worldlist file

[cloud urchin]

Try entering the flag instead of the html page. I've deleted your post as it may contain spoilers. The question asks for the flag, not the file name.

[cloud urchin]

Zipping the file reduces the file size.

[plain hare]

Hi, all, could i get some help on the skill assessment for the Advanced XSS and CSRF Exploitation? has anyone completed it?

[normal fiber]

Who can I dm help for windows lateral movement assessment on HTB

[cloud urchin]

what's your question

You can DM me

[fathom pendant]

hashcat can use the zipped file without needing to unzip it

[silk ice]

oh nice

[silk ice]

is it better to use zipped wordlists? what is best practice?

[fathom pendant]

as super said, filesize, if you need the space leaving it zipped is fine

[jovial walrus]

can someone help me with logrotten on linux priv esc module ? I have heard how horrible this section is with multiple attempts requried to get a connection back and I am stuck at the same step

[autumn pilot]

if you can't get a connection simply get the flag, in either situation you are tasking the root user to run a command

[lusty terrace]

currently doing AD skill assessment I just finished Question 4 - Submit the contents of the flag.txt file on the Administrator desktop on MS01 however I don't think I got the answer how the question wants me to

can I DM someone?

[jovial walrus]

finally got it somehow

this lab needs to be changed ffs

[vale trail]

academy v2 bug?
my dashboard keep showing completed modules instead of the module i'm currently going trough
already tried going trough the module again by clicking "mark complete & next" and "finish" at the end

[vale trail]

i dont have this banner ... might have closed it earlier

[silver fable]

Module: Wi-Fi Password Cracking Techniques
Section: Skills Assessment
I'd like some hint on enterprise network. I think I have problem with getting right wordlist. Anybody for a DM?

[gray yacht]

If there are provided wordlists, start with the smallest first.

[plain hare]

Hello, who can I dm for questions about the skill assessment for the Advanced XSS and CSRF Exploitation on HTB?

[charred crest]

hello

[silver fable]

somewhere I made mistake, I don't know where. Had to revert everything and do it again

[heavy sluice]

First oft all get the usernameschema (first.last, f.last etc.) and the domain. And then use airhammer

[wind forum]

yo is question 4 web archives in information gethering - web edition cooked?

im pretty sure i have the correct answer

nvm

[vestal birch]

Hello, for the Introduction to Malware Analysis module I’m having trouble accessing any of the target systems. I’m using openvpn and it’s successfully connected on my Linux vm. Any suggestions on how to remedy this?

[sick meteor]

Module:Http Attacks
Section:Log Injection
I'm not finding how to evade or bypass the filters. Maybe I'm misunderstanding the question? From what I understand I need to inject PHP code to rce to get the flag but I'm stuck. Characters like < are either stripped out or the encoding I'm attempting isn't decoded. Any hints?

[sick meteor]

Nevermind

[plain hare]

Who from HTB team can I ask for help?

[fathom pendant]

well the answer is support on the website, but it depends on your question

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[plain hare]

im stuck in the last part of the skill assessment for the Advanced XSS and CSRF Exploitation il DM you so i dont spoil

[fathom pendant]

i haven't done that module

[edgy crystal]

Can someone offer help for Comparison Operators? It is part of the "Introduction to Bash Scripting" and I'm worried that because of the recent update there is a problem with the question.

For refrence, this is the question:

Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer.

[hexed oyster]

Been banging my head on 'Attacking Common Applications -> Final 2'. Would really like some feedback if anyone has the time. I've got notes.

[fathom pendant]

try the last 19 characters

[tired olive]

any ideas on how to correct a 'no rdp scan code' error ?

i keep resetting the target but am getting that when i try to rdp to it

[fathom pendant]

usually means that xfreerdp can't determine your keyboard layout

[edgy crystal]

Thank you for the reply. My challenge wasn't printing the last 20 characters, but rather finding var when it contained value and was over 113450. I can send you my code if that's alright.

[fathom pendant]

not avail for code review; but the question tells you what it wants. you have part 1; you just need part 2 -- getting the last 20 chars

[tired olive]

and how do i address that

[fathom pendant]

https://github.com/FreeRDP/FreeRDP/wiki/Keyboard google is your friend :)

[edgy crystal]

I understand the question. However, the problem is that my code can’t find when val contains value and is long enough. Instead, nothing gets outputted. But, I’ve also tried other people’s code I found and it also didn’t work, so I’m worried there’s an issue with the page because of the ui update.

[quasi wave]

hi I'm doing the automatic modifications section of web proxies module and I have had some issues with automatic modifications. I can't tell you what I am supposed to do without spoiling because its step by step instructions that I am supposed to follow. Is anyone available today for a DM?

preferably someone who uses web proxies such as Burp Suite?

My issue is I am trying to intercept a request and responses to it but its not letting me select which request to modify

And I need to intercept a specific request automatically

[quasi wave]

hi now requests are SOMEWHAT being intercepted automatically but not really

because I forward the requests and they don't always perform commands automatically

but the user agent modification was made automatic successfully

hold on I think I got it working

now doing burp repeater section

never mind I solved the next section on my own

it took a little bit of thought

I don't need help with this after all

[faint gulch]

Is anyone free to a DM regarding the NTLM relay attacks assessment (Q2)?

[rustic geode]

hi i need a hint for the Skills Assessment - File Upload Attacks
i got the source code of upload.php
but i can't to upload the webshell even if i use the file name that can bypass the filter

[fathom pendant]

you aren't looking to necessarily bypass the filter. The upload changes the name of the file by appending something to it. (note that the time may be reflective of EU time)

[white vale]

I think I finnaly got it

Its so confusing that Skill Assessment

[white vale]

How could I have found a way to actually upload it when no POST request was being made, I guess that was my most asked question there in file upload skill assessment

[fathom pendant]

I misunderstood what you meant, yes bypass is the first step, second is knowing whats happening to it to be able to call it

[tired olive]

what to do if a section is stuck on target spawning?

[fathom pendant]

Ctrl+shift+r to refresh and try again, sometimes (if possible) changing vpn regions back and forth kicks it into gear

[white vale]

Well I m not sure there was any bypass maybe in older version of the skill assessment but this one is different I had to do post with curl manually

[fathom pendant]

Its doable via burp as well

[white vale]

Yeah, and that took me a while to figure out lol --proxy

[tired olive]

is there a way to see server status? none of the VPN servers im attempting to spawn targest on are working

[fathom pendant]

https://status.hackthebox.com

[white vale]

Also I dont see any videos of this new skill assessment is it because is tier 0?

Can I create my own video but using a mock up page similar? Or is this not permitted

[fathom pendant]

file inclusion yeah?

https://help.hackthebox.com/en/articles/5188925-streaming-writeups-walkthrough-guidelines

[white vale]

Sorry, I meant File Upload attacks

[fathom pendant]

file upload attacks is tier 2 that's why there's no writeups on it.

[ornate wigeon]

Why is the publickey timed so fast?

[lusty terrace]

Anyone can give me a hint on AD Enum & Attack Question 6, I tried recursively searching for "password" but it gives too much information that I couldn't process them

[harsh gorge]

https://tenor.com/view/jarvis-jarvis-skill-issue-skill-issue-gif-24471438

[lusty terrace]

oh wait

the module didn't say search....

I read it as search for cleartext

what kind of dumbness is this

[ornate wigeon]

I can’t log into bash

[foggy monolith]

Just ran into this same problem myself. Literally always hangs and times out.

There was only like one instance where it didn't hang and time out and in that case the remote result was radically different from local evaluation.

If there's a problem parsing a model, the server should send an error message. It shouldn't just hang.

[ancient coyote]

Issues with the DC in PTPF: Port Forwarding with Netsh? Or just me

Ran test-net connection from the pivot host and it failed on 3389 and 445, I’ve restarted the lab 3 times

[left lintel]

oh lol

i didn't realize

but did that solve the issue lmao

[tribal lark]

i got it i was using the wrong creds for wley lol

[tired locust]

Hi guys!
I'm trying to perform RDP tunneling in pivoting module.
Firstly I downloaded SocksOverRdp.zip file into my attack host,after extracting I transferred the dll file to my target windows machine,however when I run it,I encounter this error.How can I fix it?

[dusk holly]

make sure Windows Defender is completely off

[tired locust]

Yeah,it's completely off

[tired locust]

Virus,Threat Protection is disabled and defender firewall is completely off for both domain and endpoint environment

[dusk holly]

i think windows defender shows it is off even only one or two options is set to off, make sure real-time protection is off too by going into details like this

[tired locust]

okay let me check

[shut wraith]

Hello, in the kerberoasting module, it just shows this but doesn't show the creds to connect to the windows machine...

[brave field]

Click on the first question to reveal the creds

[tired locust]

I solved it the problem was all about permissions
I didn't run powershell with admin privileges previously
Thanks!

[dusk holly]

you gonna get the creds from the questions

[tribal lark]

White list the folder

[shut wraith]

Thanks guys found it

[topaz tundra]

How ican it be fixed ?

[brisk drift]

Hey guys, for the course Antak Webshell in the shell & payloads module, i did everything i should, but i just don't understand the format of the flag x), may someone help me pls !

The question : Establish a web shell with the target using the concepts covered in this section. Submit the name of the user on the target that the commands are being issued as. In order to get the correct answer you must navigate to the web shell you upload using the vHost name. (Format: ****\****, 1 space)

what mean the 1 space ????

[dusk holly]

maybe you should put one space after the name

[brisk drift]

I tried everything

May i just dm u to send my answer and u just tell me if the format is wrong or the all answer

[dusk holly]

alright

[hexed oyster]

OK, I feel like I'm officially stuck on 'Attacking Common Applications -> Final 2'. I've foot printed and enumerated everything I can think of. I've found several vhosts. Fingerprinted what I could about them, which wasn't a lot. Attempted to brute force the password on them but I'm coming up goose eggs. Any advice?

[native socket]

Hello everyone. I am working on the SOC Analyst module. In the first section, Incident Handling Process. I am trying to access The Hive so that I can answer the question. As far as I know I am doing it correctly to connect. I have started the target, and I have put http://10.129.13.2:9000 in firefox and it will not connect. I was hoping to receive some guidance, am I not doing something correctly? Thanks a lot, looking forward to any advice.

[fair zinc]

Need help on wifi passwords cracking techniques, found all passwords except ClyraCloud-ORT. Ik i need to focus on netgear passwords here but generating them didn't help either and I've exhausted most of my options

[ancient niche]

ey guys I need you help please. I canno't get it the reverse shell and i don't know why

module stack-buffer overflows on windowsx86

[tulip knoll]

hello im just a begginer im currently on the linux module the q was How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)
but i had to exclude locals and ipv4 for the response im pretty confused about it, its not like they are asking for all of them?

[white vale]

finally, learn a new skill on that assessment !

you guys are very sneaky lol hats off to the creator

@mortal basin

[shrewd locust]

Hello, SocksOverRDP module, the second target on the internal network is not working - not responding to any ping or any rdp connections

[cloud urchin]

It doesn't look like you pivoted from your screen shot, hard to tell. what's ipconfig say?

[cloud urchin]

yeah you're not on that subnet

you need to pivot

[shrewd locust]

I tried many times, the host does not even respond to rdp

Ok i got it, the masks made me confused 😅

[fresh moth]

Hi team im stuck at something im in an ad enviorment i have a list of usernames i got from ldapsearch , how to i check if any of the users are valid with a list of password ? the thing is the password file is rockyou will take forever .. so is there an easy method?

Im at the ad "AD Enumeration & Attacks - Skills Assessment Part II"

Q4:-Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.

[vagrant canyon]

bruteforcing won't be the path

[vagrant canyon]

perhaps try the techniques in that module to extract a weak user credential hash.

[fresh moth]

ok il try

[fresh moth]

One thing worked, but the module already provided the password. The command just uses that specific password, so it succeeds immediately. In a real scenario, we wouldn’t be given the password beforehand we would first need to discover or crack it (for example through password spraying, Kerberoasting, or other enumeration techniques) before using the command. right?

[warm pumice]

where is the integrated terminal in academy 2.0?

[cloud urchin]

The pwnbox? It's just above where you spawn the target.

It won't be shown in sections that aren't interactive

[weak patrol]

I have a question concerning the 'Attacking Windows Credential Manager' module...
How do you transfer mimikatz to the windows account you're working on?

[fathom pendant]

They're talking about the old jank feature where there was a terminal in the academy window when you spawned pwnbox, i never liked it

[cloud urchin]

ahhhh that

[vestal geyser]

dacl

[autumn garnet]

does anyone know how to solve the answer to WCVS section in the http misconfigurations?

https://academy.hackthebox.com/app/module/189/section/2011

im using this command "web-cache-vulnerability-scanner -u http://154.57.164.66:31883"

[quick granite]

The new academy GUI is so frustrating....

I really hope they revert it with so many people disliking it

[jovial walrus]

Recent 0 days sudo section CVE-2019-14287 in linux priv esc module
how are we getting a root shell when we r trying to fetch id as root ?
just couldnt understand this cause the priv is that we can run id as all users

[lusty terrace]

hey mate just wandering since you're also on Skill Assessment part II after rdp is it slow for you as well?

everything takes like a billion second to move

[cloud urchin]

@dense pawn Please take care not to post content from modules above tier 0

[dense pawn]

ok. where could i get clarification on that question?

[cloud urchin]

Here. Just ask without spoiling content or posting content. If you feel like you need to reveal more info you can ask to DM someone. Anyone who has done the module doesn't need all that context because they already know the answer.

[dense pawn]

For Question 8 of AD Enumeration & Attacks - Skills Assessment Part II, how do they retrieve the plaintext credentials? it says the "hex can be decoded", but i dont understand how, the data returned for the service account in question is a dcc2 hash.

[lusty terrace]

hello since you're on question 8 can I ask when rdp is it slow for u as ell?

[dense pawn]

try another protocol

[dense pawn]

also i was having aboslutely awful labs until i switched from running openvpn on kali instead of windows, and using a tcp vpn kit instead of udp

[autumn gulch]

Anyone here to help me

I am doing this SQLMAP Module https://academy.hackthebox.com/app/module/58/section/526. I got the flag5 but it's saying incorrect. I dobn't know why i am getting that error. Can anyone nudge me ..

[mint cargo]

Hey all, was wonfering if anyone could give a nunge in the right direction, been working on the Attacking Wi-Fi Protected Setup - Skills Assessment: What is the WPS PIN for the WiFi network named HackTheBox-Corp?

Ive generate a list of possible pins using wpspin, utilized the bash script with reaver, its been running for a few hours now and i dont know if ive gotten myself in a rabbit hole or not

Any help hints or tips would be appreciated! cheers

[pale island]

I think it is because it is time based so sonetimes when it lags it sees a character as a different one https://discord.com/channels/473760315293696010/1479127514499514500

[autumn gulch]

I will check this i am stuck at this from past 1 hour. Thanks

[elfin patio]

try using switch --fresh-queries in sqlmap

[autumn gulch]

I run same command like 5 times after i get correct flag .. 😪

[radiant jolt]

I'm silver annual, i don't think i will study this week, will my steak be lost, there was a message before tha it will use one of the blue icons, but i don't see it anymore, not sure if something changed, anyone can give me some insight on this?

[tender nimbus]

if needed: password attacks - Pass the Ticket (PtT) from Linux
Hey guys, it is not really a module related question but can someone explain to me what happens here? I understand the proxychain part, it is like to execute tools from our attacker, the packets will be send to 1080, but I don't understand the chisle part? We launch a server, the target connects to us, but when we execute a command on our attacker with proxychians, how does chisel or proxychains know that it has to go to the target? proxychains is on port 1080 and chisel 8080?

[stark hedge]

Chisel uses port 8080 to maintain the connection with the target while simultaneously opening a SOCKS proxy on port 1080 locally, so when you use proxychains, it simply sends the traffic to the 1080 "entrance" Chisel created and automatically forwards it through the established 8080 tunnel to the target.

[lusty terrace]

Yah I just wantd to confirm bcaus rdp doesn’t seem to want to work…

[crude grove]

Reversing Hybrid Apps
Android Application static analysis

please I need help I don't understand the question, do I have to actually login to the app or just find the message in the code?
I'm confused and stuck here

[sharp fog]

"Hi everyone! I'm currently stuck on the Linux Fundamentals module (Question 6 about the MTU 1500 interface).

I've run ip link | grep "mtu 1500" and my terminal shows three interfaces: ens3, lxcbr0, and tun0.

I've tried submitting all of them (ens3, tun0, lxcbr0) using copy-paste, and even tried 'eth0', but the platform keeps saying it's incorrect. I'm connected via SSH to the target.

Is there a known bug with the instance htb-hpxhpmruoz or am I missing something specific here? Thanks for your help! (Attached is the screenshot of my terminal)"

[verbal ivy]

it's ip a not ip link

[sharp fog]

I thought the answer was ens3, but the platform won't accept it. Any idea why? Thanks for the help!

[verbal ivy]

as what i see here it's not the right answer
try the same command with ip a instead of ip link
should give u the right answer

[crude grove]

please 🙂

[sharp fog]

Always the same answer, ens3, eth0, lo, Nothing is being accepted by the platform.

[verbal ivy]

i just tried the same command and got the right answer directly .

ip a | grep 'mtu 1500'

[sudden cloud]

Hey! It's a bit hard to explain but I can't figure this out. I was trying the lab in the academy module "file upload attacks>type filters" and I got the flag. But I was wondering how are we able to execute the final file shell.jpg.phar (also shell.jpg.phtml worked) on the server if I uploaded the web shell with a different name (shell.jpg.inc)? basically how is it possible that the web shell that I uploaded with a name gets executed with another name?

[crude grove]

Why does it have to be so confusing?

[stark hedge]

I haven't done this specific module but since it's a about static analysis, I assume you don’t actually need to run the application or log in to any live service, but instead you should decompile the APK and look for the logic inside where you will likely find the key.
But again this is just my assumption.

[verbal ivy]

Anyone have the link where you can input the student ID and track his progress? , looks like it's broken in the new version .

[crude grove]

i found the key
tried every logic for the answer, but nothing 404

[crude grove]

some admin help please

[stark hedge]

maybe try using the obtained key to authenticate to the application and retrieve the message

[crude grove]

done that , nothing
also the app requires username+pass in its UI , but that's something else, no user or pass in the app code

[stark hedge]

Feel free to DM me if you want to discuss it further.

[cloud urchin]

Yes, it's a requirement to complete the path before you may start the exam.

[crude grove]

yes

[crude grove]

@admin plz

[cloud urchin]

No need to try and ping admins/mods/staff.

Just be patient and maybe someone who has done the module will help.

[silk lagoon]

It’s not asking you to login in, decompile it using JADX or Android studio or any other tool.

[still coral]

Anyone done the Bufferoverflow module? I don't understand the question "How large can our shellcode theoretically become if we count NOPS and the shellcode size together?" Can anyone help me out?

[clever rapids]

there are some details missing, please provide more context

[hardy jacinth]

Examine the registers and submit the address of EBP as the answer.

0xffffd598

The answer you provided is incorrect ???>???????

(gdb) info registers ebp
ebp 0xffffd598 0xffffd598

[fathom pendant]

That's never been a thing aside from for institutions

[verbal ivy]

Student ID

Your unique Student ID lets others view your progress in HTB Academy.

Learn more here
HTB-9ECXXXXXX

someone can't track my progress using this ID ?

[fathom pendant]

Only institutions, ive had various conversations with staff regarding this

Due to my own reasons ive had this conversation

[verbal ivy]

that's actually very unfortunate as would be nice to add it in my c.v as progress etc ..

[fathom pendant]

You.... you can... not sure which institutions have it

[verbal ivy]

instead of exporting the whole progress via a pdf it can be availalbe online using the ID

[fathom pendant]

Institutions being companies and schools

[verbal ivy]

Like to add the feature ?

[fathom pendant]

No

About the lack of transparency overall about it

[verbal ivy]

it's only there for tracking students who actually have the subscription through there Institution* if i understand

i saw something before to check the status i think it was for prolabs and i mistaken it for academy spent half an hour looking for the endpoint

[quasi wave]

I just did another section on my own. Gonna do yet another soon in like ten minutes. I'm psyched.

Maybe in a couple months I'll be helping other people with CWES modules.

This is gold.

I don't have a section I need help on today but just letting you guys know.

[trim flint]

i have question in nmap lab ask here ?

[cloud urchin]

Yes this is the right spot, just take care not to spoil content from modules above tier 0.

[trim flint]

the medium lab

[cloud urchin]

if you need to reveal more info you can ask if someone can dm you about it

[trim flint]

of Firewall and IDS/IPS Evasion i get answer witcg is the domian server

if anyone can help dm me please

🫠

can i send my expected answer only ? and for the method to get the real answer

[cloud urchin]

@verbal ivy It applies to all subscription levels of HTB. They don't want the content to be leaked, understandable. The writeup in the higher tier subscriptoin is still part of their content.

[verbal ivy]

thanks for clarification 🫶 .

[viscid bolt]

Can anyone give guidance on Active Directory Trust Attacks - Skills Assessment Q1: Gain access to the "Inlanefreight.ad" domain and submit the contents of the flag located in "C:\Users\Administrator\Desktop\flag.txt"

|| Found foreign group stuff but that is about it, haven't owned the child domain yet, a little stuck ||

[verbal ivy]

If you already found the foreign group relationship, check what group your user is part of in the parent domain. Use PowerView to enumerate foreign users and foreign group members. That should show you the group your account belongs to in inlanefreight.ad. After that, think about what you can do with that membership.

Hope i helped without helping so we don't get muted

[viscid bolt]

Ah okay, so was on the right track, will look more into it, much appreciated!

[verbal ivy]

Yes you are , just check which group your user belongs to and it should ring a 🔔

[hardy jacinth]

sws

[tired olive]

am i allowed to be making writeups of skills assessments if im not including answers

[cloud urchin]

It's against ToS to post anything over tier 0.

[tired olive]

okay thank you

[tired olive]

I’m having difficulty finding information - would you happen to know about posting reports of Sherlock’s assuming I exclude direct answers and their paths

I know you can make writeups of retired boxes but wasn’t sure if there was any flexibility with Sherlock’s

[cloud urchin]

I don't know

[plain hare]

Hi, all, has anyone completed the skill assessment for the Advanced XSS and CSRF Exploitation? im currently stuck and looking for some help

[lusty terrace]

i'm doing AD enum and attack - skill assessment II question8 I got a reverse shell on metasploit and uses the "auto" PE and tried to dump sam, which got a hash but couldn't connect to any others, but in a writeup I saw they did the same except they did smth different but ultimately dumped sam as well but their hashes could be used to connect..... what am I missing?

we both did lsa_dump_sam

[weak patrol]

Anyone?

[fathom pendant]

Retired sherlocks are fair game, its laid out in the streaming/writeup guidelines htb has out

[quiet halo]

im having trouble with taask 4 in pillaging from windows priv esc module

I checked the env and also history file and I found the password but htb is not taking it

[turbid mulch]

I am working on the 'Host Discovery' section of the 'Network Enumeration with Nmap' #module but find the wording of the question a bit confusing. "Based on the last result, find out which operating system it belongs to. Submit the name of the operating system as result." In this context does 'the last result' refer to the previous Section or the last operation carried out in the Pwnbox? This Section is about using Nmap to discover what services are running on a server so my presumption is that the question is attempting to ascertain what operating system is running on the Pwnbox but when I enter this as the answer to the question is comes back as incorrect.

[untold orbit]

It might be asking for the OS of target

[brave field]

dm please

[fathom pendant]

The "Last Result" refers to the last bit referenced in the section.

it gives a sample SENT/RCVD set of packets with various bits of info in them

[stark hedge]

Generally, there are many ways to transfer files to a target. I’d highly recommend going through the File Transfers module.

[weak patrol]

I will go through it again…
Thanks

[fathom pendant]

Xfreerdp has the /mount: option as the simplest method

[spare fossil]

where is the flag ?
Wi-Fi Penetration Testing Basics/Connecting to Wi-Fi Networks/
Connect to the WPA Wi-Fi network named "CyberNet-Secure" with the PSK "Password123!!!!!!". Once connected, locate the flag at the IP address 192.168.1.1.

i've connected, where do i find the flag ?

[heavy sluice]

Open the browser and enter 192.168.1.1

[spare fossil]

i mistakely used the browser from the pwnbox instead of the rdp one session one. vm within a vm lol... anyways, the browser on that rdp session does not work

i will try with curl

[narrow elk]

In Attacking Common Service, the "Attacking FTP" section spawns a SMB target instead of a FTP one.

[heavy sluice]

As I remember some of the RDP machines did not have curl but if it works it works, as a last resort you can always use nc 😁

[fathom pendant]

the module reuses the same target in a few of its sections. But if the right port doesn't show up, try respawning it a few times (this is a known thing)

[foggy monolith]

Why is AI Privacy § Data Partitioning and Teacher Training causing this?

[wraith crystal]

hello, im new here, im experenced with linux but i cant seem to ssh into the first machine in linux fundamentals (system information). tried both with htbs pwnbox and with my own openvpn but i get

C:\Users\(user)>ssh htb-student@10.129.16.6
htb-student@10.129.16.6's password:
Permission denied, please try again.

ip is fine, copied straight from the exercise. user is fine, password is copy pasted too. i have no clue what im doing wrong

[foggy monolith]

Anyone?

[open siren]

Hey guys, on HTB I am currently doing a module(https://academy.hackthebox.com/app/module/77/section/726) that requires me to perform an extremely simple Nmap scan for the version of the serice running on port 8080, which should be simple. However my scan did not produce a version, in fact it was initially returned as Host down, so I have to use -Pn
Any solutions?

[fathom pendant]

Works fine for me, if you're having to use -Pn then it seems like your VPN connection is messed up

sudo killall openvpn then re-run the openvpn connection

ah with the added context, then i'd double check that you're still connected to the vpn; i generally and will always advise to do things like this from a vm. It sounds like you're doing this from wsl, which is honestly more of a headache than it's worth on a good day

[open siren]

ahh ok ill try that

sry i didnt reply for a while

ohhhhh just saw now that a vpn file was indeed available for this excercise

that makes sense

ty

[compact sigil]

Hi, I verified my student email, but for some reason it's not giving me to the student discount for HTB academy, did I do something wrong?

[compact patrol]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fathom pendant]

https://help.hackthebox.com/en/articles/13465244-getting-the-student-subscription

[compact sigil]

thanks I already opened a ticket

[hardy urchin]

Hello guys, i work on the skill assessment for Information Gathering - Web Version. I dont know if iam running down a rabbitwhole... i found a subdomain and extracted the api token, now i need to crawl inlanefreight.htb - The page only returns the index.html, i cant find any emails.

[fathom pendant]

maybe you should crawl some subdomains you find

[hardy urchin]

meaning there is more then 1 subdomain?

[fathom pendant]

i'm being vague on purpose so as to not spoil for others

[hardy urchin]

ill get back to recon

[fathom pendant]

just remember there can be multiple layers to subdomains

a.b.do.main
c.b.do.main
e.b.do.main
etc

[hardy urchin]

can i dm you rq, i found the solution but still have a question i cant ask here because i think id spoil others

[analog urchin]

Where can I download the vpn for academy in the new version of the academy? 😭

[heavy torrent]

can I please get a nudge on the "Dynamic Analysys" section of the "Introduction to Windows Evasion Techniques" module?

I am able to get a reverse shell but cannot read the flag. Which seems obvious to me as I am using alpha user.

this is the exact module: https://academy.hackthebox.com/app/module/254/section/2829

[twin gulch]

Anyone Who done ZAP Fuzzer - Using Web Proxies ?
I hate this tool and messing with the question

[barren island]

Hi guys, I'm doing the Wi-Fi Evil Twin Attacks Skill Assessment module; I am stuck on the second and third question, does anyone could help me with it?

[twin gulch]

Anyone?

[verbal ivy]

can you be more specfic when you ask your question
MODULE > Section > question

[verbal ivy]

you doing something wrong you should get revshell as beta user , read the question carefully. ''

[weak patrol]

I am having issues finding a username for this question, I have run some commands but they don't seem to give me the right output.
Once the command is done running I get "2026/03/17 00:47:23 > Done! Tested 21 usernames (0 valid) in 1.113 seconds"
May I DM someone so that I can show them what I did and maybe they can point me in the right direction?

[plain charm]

Which module?

[weak patrol]

Attacking active directory and ntds.dit
https://academy.hackthebox.com/app/module/147/section/1326

[verbal ivy]

lm check

[weak patrol]

Okay

[verbal ivy]

which tool u used to generate the usernames?

am sure if you use username-anarchy it will be there

[weak patrol]

username-anarchy

[verbal ivy]

https://github.com/urbanadventurer/username-anarchy

[weak patrol]

yes I used this tool and it generated the possible usernames but after running them through kerbrute I still didn't manage to find the right one. not sure what I did wrong

[verbal ivy]

lm verify

[weak patrol]

okay

[verbal ivy]

i tried

it works

[weak patrol]

can I dm you?

[verbal ivy]

just run the tool directly

without anything

you get like 15 usernames

[weak patrol]

what do you mean without anything?

[verbal ivy]

./username-anarchy John Marston > users.txt

[weak patrol]

ah okay

let me try it

what domain did you use for inlanefreight?

[verbal ivy]

run it with crackmapexec

do password spray

[quiet halo]

is anyone have issues with the Windows Privilege Escalation Skills Assessment - Part I machines? i restarerd a few, none work. I tried other machines and they work just fine

[severe inlet]

i just spent an hour on the medium lab on the Network Enumeration with Nmap module

Turns out the same command on PwnBox gave the flag its a bit annoying anyone knows why?

[pine valley]

guyss who know how to see password target i cant connect target because i dont know password target how to get a password target htb not provide it

[tranquil crystal]

Please specify the module so people can know

Linux Fundamentals I assume

[pine valley]

yess of course from module operation system fundamental im choose linux fundamental

[pine valley]

not your assume that exactly correct

[tranquil crystal]

Which section is it? I'll take a look at the module

[pine valley]

whait

okey here is full page screenshoot

section 6 still very new basic

[tranquil crystal]

It gives you the password

[pine valley]

why you have it

in my option nothing hint

owhh faakkkkkkk thnk youuu

im skip question 1

ty ty ty

[tranquil crystal]

Np

Glad I could help

[pine valley]

yess because from yesterday im so confused like wtf how

[pine valley]

thankyou @tranquil crystal finally im passed the test after 1 day im confused mwmwmwmw thank u so much may god bless u

[tranquil crystal]

You're welcome

[glacial pasture]

In this module, Active Directory Enumeration & Attacks
the bloodhound data and enumerating using PowerView gives nothing to answer this question

[untold orbit]

Could be using custom cipher with Bloodhound help finding the answer?

[glacial pasture]

I used multiple Custom cyphers that search for it and nothing matched any of them

[wooden seal]

where do i download vpn profile for academy in this new UI? 😭

[wooden seal]

💀

thanks for fixing my blindness @glacial pasture

[glacial pasture]

UI updates are overwhelming

[wooden seal]

wait i am not getting anything next to pwnbox

i wasnt blind

And yea FYI i had silver sub but i am on free tier now and revisitng the completed module to do them again
incase it affects this

[junior swift]

You could've also just looked for the Remote Management Users group on Bloodhound, assuming your ingestor collected it properly.

[glacial pasture]

What could affect the Bloodhound collection efficiency (I used SharpHound.exe with -c All )? because sometime I miss some relations/attributes

[junior swift]

Personally I'm not too familiar with what could cause missing information, however I do know that All is just a preset, it doesn't actually collect all that the ingestor can collect.

[wicked oxide]

Hello all 🫡
Got a question, i'm trying to redo the skills assessments in the CWEE path and some modules that require to download the source code are missing the download button on the new UI.
Am I blind or ?
I saw the message on the dashboard concerning the fixes for errors in module completion but i wanted to be sure if that concerned this too or if i missed smth

I will share a screenshot of the SA of INTRO to WHITEBOX PENTESTING

Thanks for the help

[twilit wind]

Is there any way to get back the 1.0 UI it makes the page very very laggy for me and almost unusable

[verbal ivy]

you will get used to it brh

first check what type of hash is it ? > use the magic decrypt in cyberchef
didn't do that course tbh

[opal hound]

Hey guys, I’m stuck on AD Enumeration & Attacks - Skills Assessment Part I
the question: (Q8) Take over the domain and submit the contents of the flag.txt file on the Administrator Desktop on DC01
what im struggling at is i run runas /netonly /user:INLANEFREIGHT\tp**** powershell to open a new powershell as tp****. then i run mimikatz.exe on that powershell window but the problem is that it doesnt have administrator privilege to run mimikatz. Can some1 help me?

[verbal ivy]

try :
https://crackstation.net/

[gray yacht]

CyberChef sure does SHA256.

[verbal ivy]

how he gonna decrypt sha256

https://tenor.com/view/spider-man-gif-1760452691448589843

it's a one way hash not encryption

[gray yacht]

My response wasn't about it decrypting SHA256, just that CyberChef does have SHA256.

After scrolling up a bit more, I now see the initial question. Lol

[native socket]

Thats what I thought as well.

[verbal ivy]

send me the hash

[gray yacht]

So you likely have to keep using other parts from CyberChef

[verbal ivy]

can you screenshoot the question ?

or link the section of the module

link would be better

so i see the file

send me the link

which section on the module

or the name of the section you doing

i do have access to SOC path

[gray yacht]

Hey if this module is above Tier 0 you need to delete the content you posted and take it to DMs.

[opal hound]

so i run secretsdump on kali and manage to get the admin hash. tyvm

[native socket]

My bad, didnt know

[gray yacht]

It's all good

[verbal ivy]

you are trying to decode the wrong value , read the question carefully .
look at the logs and > decode the command.

[native socket]

Well I tried to decode the encoded portion of the command, still no results. There is obviously something that I am still missing. Think I am going to take a break from this one for a little while and work on something else. Thanks for the help.

[verbal ivy]

it just so simple ..
|just find the command and decode it 🙂

you are obviously overthinking it

Not sure as i closed thevlab ,but please don't post them here .

[warm horizon]

Why did the gym's IP address become like this now, without the port even being opened on the gym's computer? curl -I http://10.129.234.166/phishing/index.php
curl: (7) Failed to connect to 10.129.234.166 port 80 after 21061 ms: Could not connect to server

[native socket]

figured it out finally...lol was trying to decode it with the wrong tool.

[native socket]

Thanks for the hint, was using the wrong tool.

[native socket]

Just had to research how to decode powershell commands a little.

[gray yacht]

Awesome!

[strange needle]

is it a sign to skip prevention module?😆

[shut quest]

You're not blind, I opened #1234357888114364508 and was told it's a known issue they are working on.

[wicked oxide]

Okay thanks a lot for the answer 🙏

[cerulean bramble]

So, I just spawned a target system and I'm noticing that it gives me an IP but no port number. I know they recently changed the UI. Is there somewhere I'm supposed to be able to find the port number of the spawned system? I'm working on the AI Data Attacks module in the Pickles and Steganolgraphy section.

[echo agate]

I am having trouble with the machine in this module - https://academy.hackthebox.com/app/module/145/section/1295.

The machine is reachable via my Parrot attack box via VPN.

└──╼ $ping 10.129.18.90
PING 10.129.18.90 (10.129.18.90) 56(84) bytes of data.
64 bytes from 10.129.18.90: icmp_seq=1 ttl=63 time=155 ms
64 bytes from 10.129.18.90: icmp_seq=2 ttl=63 time=516 ms

nmap shows a web server running on port 80

┌─[user@parrot]─[~/vpn]
└──╼ $nmap -sV 10.129.18.90 -p 80
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-17 17:37 UTC
Nmap scan report for 10.129.18.90
Host is up (0.19s latency).

PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.59
Service Info: Host: 172.17.0.2

However, i can get any data back from port 80. The browser hangs and so does wget.

└──╼ $wget 10.129.18.90
Prepended http:// to '10.129.18.90'
--2026-03-17 17:38:40-- http://10.129.18.90/
Connecting to 10.129.18.90:80... connected.
HTTP request sent, awaiting response...

I have restarted the target several times. I even read the solution which indicates it should be straightforward to access the page on port 80.

Any ideas are welcome. I am stuck.

[analog urchin]

Maann where are the vpns for academy 2.0??

[fathom pendant]

sections that require you to access a 10.129.x.x target have a vpn tab next to the pwnbox

[echo agate]

thank you. i assumed the academy regular vpn was fine since i was able to ping this box.

[fathom pendant]

It is, thats the name it downloads as.
Academy-regular => regular academy usage
Academy-exam => exam usage

[echo agate]

hmm. I was connected via the regular vpn when i posted the above message. I downloaded the vpn next to the pwnbox as you mentioned and the wget began to work.

┌─[user@parrot]─[~/vpn]
└──╼ $diff academy-regular.ovpn academy-regular2.ovpn
3,4c3,4
< proto udp
< remote edge-eu-academy-3.hackthebox.eu 1337

proto tcp
remote edge-eu-academy-3.hackthebox.eu 443
65c65
< <tls-auth>

---

<tls-crypt>
87c87
< </tls-auth>
\ No newline at end of file

---

</tls-crypt>
\ No newline at end of file

[fathom pendant]

that's the standard differences between the udp and tcp files

[near grotto]

Hi Team, can anyone help in this ques htb cape, bloodhound mudule ques "Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78)."

I divided the Total global aministrator / Total azuser * 100 but didn't find the anss

[viscid bolt]

Still on Active Directory Trust Attacks - Skills Assessment Q3: Gain access to the DC04 (Mssp.ad) and submit the contents of the flag located in "C:\Users\Administrator\Desktop\flag.txt" A little stick if anyone can assist!

|| Looked at Trust Account attack, but did not work, for outbound one-way it looked like the goto technique, if anyone has more guidance! ||

[viscid bolt]

Find how many people have a path to GA, and the # of AZ users. BloodHound legacy makes it relatively easy, BH CE is more annoying with that specific scenario

[young tinsel]

having some trouble on the module Web Server Pivoting with Rpivot - for some reason, my proxy is just refusing to work even though i've quadrple checked my rpivot commands on the client & server + proxychains.config

[gray yacht]

I'd work that trust account some more.

[strange ravine]

i'm struggling with Introduction to Bash Scripting, section Comparison Operators

The question is "Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer." but everytime i run my script it outputs nothing and i'm not sure where im going wrong

[echo hornet]

could you send your script?

[strange ravine]

i'll send in dms, dont think im allowed to send here

[quasi wave]

I completed another section today on my own. I'm killing it.

later today I'm gonna do two more. I'm a little tired because I need food for fuel but I'm gonna do really well with this. I am taking a break to get some food.

[cerulean bramble]

Does anyone know where to get the port number for spawned targets now?

[cloud urchin]

Targets that have a port number will show in the same place. If they don't have a port number then it's not a public docker container and you'll need to be on the VPN or use the Pwnbox (not at the same time) to connect to the target on whatever port.

[cerulean bramble]

Ok, I must be missing something then. I'm on the Academy VPN. The script is supposed to connect to this target and upload the trained model but it's failing to connect. I can ping the target. The part of the script I'm supposed to replace with the target information shows an example with an IP and a port, but the module isn't giving me a port.

[cloud urchin]

Always best to say which module and section you're on if asking for help

[cerulean bramble]

I'm working on the AI Data Attacks module in the Pickles and Steganography section.

[cloud urchin]

there are a lot more parts to that section

best to say exactly which section not generic

[cerulean bramble]

So, the exercise is in the "Execute the Attack" section but you build the script throughout that section. The part of the script that requires the "api_url" is in the Execute the Attack section.

[cloud urchin]

did you try just visiting standard website ports

80/443

or nmap

[cerulean bramble]

I'm running an nmap scan now but it hasn't found anything yet. 80 is the one that fails. I've also tried the 5555 that's in the example.

[cloud urchin]

maybe someone who has done the module can chime in then

[cerulean bramble]

Thanks for trying. I'll keep scanning and trying things and hopefully I'll get it.

[quasi wave]

hi for the Burp Intruder section of Using Web Proxies module, I am fuzzing every file ending in .html and it says I don't have permission to access the resource. I tried changing my User Agent and it didn't help. Can someone give me a hint? I am searching in the /admin folder.

[sterile solstice]

I'm currently trying to do DACL II - Skills Assessment. Can someone give me a nudge for Q1. I'm missing something, and unsure what.

[feral adder]

Hey guys do you have any idea where's the resources tab located in the new UI of academy? in the said module of FOOTPRINT SMTP it said there's a wordlists needed to download to finish the task but I haven't seen where it was unlike before the previous UI it was at the bottom.

NVM, I found it.

[cloud urchin]

You can DM me

[sterile solstice]

DM sent

[keen zephyr]

Hey guys.
I'm solving the SQLi skill assessment challenge and I'm being unable to submit the flag I found.

The challenge says:

Achieve remote code execution, and submit the contents of /flag_XXXXXX.txt below.
I did managed to achieve that RCE and extract the flag, but again, the platform says my answer is incorrect.

I also did checked for empty characters around

[brave field]

dm please

[earnest jacinth]

heey, do you remember how you've solved this question ? I'm facing the same issue

[olive fiber]

I did a reset

[lone ferry]

Anyone else having issues with targets dropping connections? Trying to finish WinPrivEsc module but any RDP session times out after a command or two…

[vocal schooner]

Same, i can't spwning the target, it's loading

[hidden ledge]

Hello does anyone knows why responder + smb authentication fails with ligolo ?

Comes from mssql xp_dirtree, reverse shell is working well but anything on port 445 seems to fail

Resolved.

[brave field]

run it with admin privs?

[hidden ledge]

It's a known issue apparently: https://www.reddit.com/r/hackthebox/comments/1mwbvgq/is_it_possible_to_use_responder_over_ligolo/

[brave field]

You can catch smb hashes over ligolo but the pivot host that you compromised needs to be running as sudo or root or admin user to actually use ports below 1024 aka well-known or system ports. You need port 445 to bind it to the pivot's internal IP.

[hidden ledge]

Yes I know that I always run the proxy as root 🙂

[brave field]

the target too otherwise it can't bind to that privileged port on the internal interface

[warm horizon]

My friends, I have a question: the gym's IP address now only works if you download a VPN, right?

[white vale]

I am surprised I am not having issues right now

[heavy sluice]

Isn't that normal? Your traffic would go around the whole world if you the other servers

[white vale]

I guess this is the new normal with ai in our wolrd

but also really happy with the content in bth academy and how some labs are build

for example a target with ip 154.57.x.x makes it so convenient for testing

[thin hearth]

hi, i can't access to hackthebox academy with brave browser ? anyone have same trouble ?

[sick bane]

Yes. It seems the site is not loading properly.

[dusk holly]

same

[vocal phoenix]

same

[turbid scarab]

Same

[jolly spruce]

Yep, same here

From Edge browser

[final shale]

the damn new design. I told them it sucks.. 😄 😄

[vocal phoenix]

After some time it loads

[zealous fiber]

For me it loads, but its suuuppper slow

[final shale]

They basically forced the BETA on us to test

[jolly spruce]

Not an inherent problem with the new UI

Even for it, it's unusually slow

[mental current]

Seems like I am not alone with the slow loading

[cerulean bramble]

Same.

[thin hearth]

I think the problem doesn't come from the new UI. The change in the technology stack is the problem

[jolly spruce]

Ok it looks better now all of a sudden

[mental current]

Still looks unstable

[wintry pagoda]

Can someone spawn targets on the academy ?

[warm horizon]

I've been trying since last Friday, but the IP address isn't working.

[mystic osprey]

Hello guys
I am on the Attacking Common Applications module in the WordPress section.
To solve the questions I need to connect to the VPN and add a VHOST to my /etc/hosts but after I do that I can't reach the VHOST. However I can reach the main domain. Sometimes the VHOST works and sometimes not, and I don't really know why.
Does someone have any fix?
Thanks.

[brazen marlin]

what does your entry in /etc/hosts look like

[mystic osprey]

I tried this:
10.129.19.92 inlanefreight.local
10.129.19.92 blog.inlanefreight.local

and this:
10.129.19.92 inlanefreight.local blog.inlanefreight.local

[brazen marlin]

then try http://inlanefreight.local and it doesnt work?

[mystic osprey]

it works

[mystic osprey]

http://blog.inlanefreight.local doesn't work

[brazen marlin]

add that entry to /etc/hosts too

[mystic osprey]

I added it

[mystic osprey]

.

[vestal cairn]

I have a question about the first task from linux foundation (Working with Web Services) - https://academy.hackthebox.com/app/module/18/section/74

I noticed a lot of people also were confused about this question
As I understand the main idea - I need to google
But I googled and found the answer on stackoverflow with NPM. This answer satisfies the request "Find a way to start a simple HTTP server inside Pwnbox or your local VM using "npm""

How was I supposed to think of the answer? What's the correct thinking process ?
When I realized that the system doesn't accept the answer with npm I think only about changing arguments, but not thinking about npm

[keen zephyr]

dm

[brisk drift]

Hey guys, i have an issue with burpsuite for the Module Shell & Payloads / Web Shell, it don't connect me, maybe i did something wrong, may someone help me pls ?

Or i just realized, that event when i'm off burpsuite... idk if it's the site or what

I need help for php shell, thx

[trail gate]

Could anyone spare me assistance over Nmap Enumeration Hard Lab?

[brisk drift]

I can try, let me see if i can remember it

[trail gate]

i dont think i can send pictures

do u mind if i dm you?

[brisk drift]

do it

[trail gate]

sent

[foggy jackal]

can i nudge someone for mssql,exchange and sccm skill assessment the first question?

[foggy jackal]

hey did you figure it out..i am stuck out here as well

[brisk drift]

Hey guys, i have an issue with burpsuite for the Module Shell & Payloads / Web Shell, it don't connect me, maybe i did something wrong, may someone help me pls ?
Or i just realized, that event when i'm off burpsuite... idk if it's the site or what

[halcyon patrol]

Anyone experience issues with the pwnbox in academy ?
I can interact it from the lesseon section but not when clicking the full screen.

[cloud urchin]

I had that problem before, I think I re-spawned the target, went to the Pwnbox, did full screen and then never tabbed out. I think tabbing out does it.

[near grotto]

Hi, I found 3 user and total users are 13 after calculating ans is incorrect

[viscid bolt]

You are miscalculating the first amount of users to GA

[near grotto]

I tried various query and graph somewhere it's is 3 or 2

[near grotto]

it's 4

[quasi wave]

hi for the burp intruder section of Using Web Proxies module, when I try to run the attack with the wordlist, I get results but the thing is I get an error saying "you don't have permission to access this resource" or whatever. I get a 403 error. I am doing what the assignment says I think I think its just not working. Can someone help me out here?

[dapper moth]

May be shooting this to the wind but... Has anyone found an actionable resolution to the error while loading symbols in the Intro to WinDBG Module?
Skills Assessment btw

Setting the Symbols path to C:\Symbols and reloading the session didn't resolve

[quasi wave]

hi are any moderators available for DM tonight? I need to talk to someone

[cloud urchin]

best to just ask your question

[quasi wave]

I did

look above

[cloud urchin]

ok you don't need a mod then

[quasi wave]

right so my issue is I think I did the section right and its still not working

[cloud urchin]

Best to include the section too

[quasi wave]

Burp Intruder is the name of the section. Its a subsection of the Web Fuzzer section of the Using Web Proxies module

I think I did what the section is asking

[clever lance]

hey everyone, for the past few days, the Pwnboxes have been ridiculously slow, and timing out, is it me or does HTB know about this?

[steel snow]

hey!

I am doing everything correctly for metasploit module

the first part of the second section of the module, which is the modules subsection of the components section

and it's timing out

[quasi wave]

ok solved the module I needed help with

just needed to be more patient with it that was all

[steel snow]

i was trying to solve mine for hours

still wasn't fixed

and i am pretty sure the issue isn't from me

[steel snow]

Yeah, i fixed mine by not fixing it

i just used the pwnbox

and that

fixed it...

[candid lily]

is there any option to get old ui back

who asked for this

[dusk holly]

Unfortunately no

[viscid bolt]

Anyone else have issues with the sliver skills assessment? Everything is super slow, can't even run commands to get the last flag

[fathom pendant]

@lusty terrace please don't reveal information from modules above tier 0; I understand that the module is essentially a walkthrough of it but please refrain from sharing such info.

[lusty terrace]

I thought that much was not much information ...

tried to be vague and thought if someone knew they might be able to help

@fathom pendant Could I dm you and ask about it?

[fathom pendant]

I generally don't help out with AEN as I always urge people to do it blind, especially if they're doing the CPTS path. If things aren't working as you think they should, then I suggest changing vpn regions and respawning the target and seeing if that fixes your issues

[lusty terrace]

ahh alright I will try that

Is it by design for AEN to be quite slow?

Or sometimes js unresponsive

[fathom pendant]

btw blind means not answering the questions and just focusing on trying to get to the highest domain privileges available since the questions are leading

I didn't have any stability issues when I did AEN a while back

[lusty terrace]

Then its my target/region

Pinging sometimes don’t work

And takes forever to load

[fathom pendant]

sounds like it's a problem on your end not on the target end tbh

but i'm not staff so I don't have access to any bit of logging that can confirm/deny what you're experiencing

[lusty terrace]

Possibly? But i’ll respawn and change vpn regions to see

[lusty terrace]

bruh @fathom pendant changing these helped alot

._.

[fathom pendant]

it happens

[covert blade]

Hi everyone. Can I acess the Academy Target machine using my own kali linux ?

[brave field]

yes

[fathom pendant]

so long as you have the academy-vpn file (downloadable next to the tab that launches the pwnbox in sections that require it)

[covert blade]

Okay, thank you! That means it is not available for all machine ?

Here for example, I don't see anything

[halcyon sparrow]

Hi, is there a way to switch the theme on htb academy? Its a bit tiring to read white text on a black background

[fathom pendant]

correct; a good shortcut to know is if the 'spawn target' button gives an ip:port to connect to, that's a public docker container, and accessible by any device with internet access

[fathom pendant]

no, that's not an available feature; you can use /feedback on the discord to send it off to the HTB staff to look at and maybe implement

[halcyon sparrow]

Thank you

[fathom pendant]

most of the people that use HTB are the hackers that swear by dark mode so they built their site around the majority being darkmode users. White backgrounds tend to strain the eyes more, but everyones eyes are different so

[jovial walrus]

could you pls help me on this

or anybody else on Prompt inejction Attacks module jailbreaks 2 section

[jovial walrus]

nvm got it

[jolly spruce]

So, I'm at Windows Privilege Escalation.

Does anyone know of any guide for compiling UACME properly on Visual Studio 2026? I've figured out how to configure things so that Akagi and Yuubari get made with what is probably their full size in the 1st compilation (1st = before also throwing in Naka, Fubuki and Akatsuki into the mix, for re-compiling Akagi and creating its "full power" version).

But when it comes to the Fubuki and Akatsuki .dll files, I can't for the life of me figure out if I'm doing things right. I keep getting a Fubuki64.dll that is 34 KB (which might be ok according to chatGPT, but not so much according to Gemini), and an Akatsuki64.dll that is at 12 KB, which is definitely wrong according to them.

Any help? I've been struggling with this for over 5 hours at this point 😭

[jolly spruce]

Ok, I maaaay have been led into a bad rabbit hole by a certain different Gemini model

Play stupid games, win stupid prizes they say

[lone ferry]

It’s been a week of complete useless HTB academy. No targets for winPrivEsc assessment will even ping. Hey HTB team what is going on and when will it be resolved? There’s nothing to be found about these outages on your site and support chat is down.

[brisk drift]

i just think that as they lauch they new palrform, they are focus on smthing else

[cloud urchin]

Did you reach out to support on the site? Other people aren't having problems, it's probably on your end.

[primal ginkgo]

Anyone experiencing consistent trouble connecting to Target Machines within the Academy even after download a fresh OVPN conf?

[keen zephyr]

I had many packet loss a while ago. It was frustrating seeing blank results after a terminal command.
Switching the VPN from UDP to TCP solved that

[primal ginkgo]

Yeah I did the same thing and its still giving me a bad time.

Literally went and checked if my IP address on TUN0 could reach the lab IP and yeah it could via TCP, download a TCP config for OVPN, and nothing.

Even ran wget and curl too see what was what; wget got me a blank as a whiteboard HTML file and curl was just.. unresponsive after ~133000 ms

[silk ferry]

On the introduction to networking module, on the first section, it gives a small scenario of a pentester not being able to reach the domain controller through ARP because of a misconfigured subnet mask... but shouldn't ARP not care about subnet masks since its layer 2 and there is also no mentions of VLAN separation or physical separation so I'm just a little confused here... if anyone knows please lmk

[brave field]

The pentester can talk to the DC fine, but the DC doesn't know how to talk back because of mismatched subnet masks, so the replies go to the gateway and get lost.

The Domain Controller is on a /25 subnet (10.20.0.0–10.20.0.127), and the pentester is at 10.20.0.252, which falls outside that /25 range.

[silk ferry]

Oh gotcha so because the pentester IP is outside the subnet range of the DC, it won't know how to send back a response to it?

[brave field]

Exactly, the DC sees 10.20.0.252 as outside its /25 range (0-127) so it forwards the reply to its gateway instead of responding directly and that's where it dies.

[silk ferry]

Got it, thank you for that!

[brave field]

So the pentester should have set their subnet mask to /25 to match the DC's network, that way both sides see each other as local and replies come back directly.

[silk ferry]

Should I also assume that the pentester manually set the IP instead of getting it from DHCP ?

[brave field]

Yeah apparently so otherwise the DHCP would have handed them the correct subnet mask automatically, so the fact that this misconfiguration happened in the first place pretty much implies they set it manually.

[silk ferry]

Makes sense, thank you!

[brazen saffron]

I would like to do this question "Check the alert with reference 67c202 (LSASS Access) in TheHive, and provide the MITRE rule ID as the answer." in the module Incident Handling Processsection Cyber Kill Chain(2/11), it 's saying it use port 9000, http://<target_ip>:9000/ and... trying to connect but every target I spawn have not this..

[indigo plover]

Hello, can you please DM me the commands you typed and their result or create a thread in #1234357888114364508

[brazen saffron]

Fixed.

[acoustic owl]

Have you tried a zone transfer?

[native egret]

I'm working on the Windows PrivEsc Module in the 'Weak Permissions' section. I've followed the steps in the module, but can't seem to elevate privileges to answer the lab question. Any help here appreciated.

[severe inlet]

Yes already did that

That didn't work aswell

i think i will try from pwnbox because sometimes it doesn't work on my machine but it works on pwnbox

[fathom pendant]

Subdomains of subdomains

@severe inlet module is above tier 0, please dont reveal information like that from it. A zone transfer finds the information you're looking for.

[cursive wyvern]

AD Enumeration & Attacks - Skills Assessment Part II - on middle stages in Solution for some reason appears pswd *W*** which it is correct for that circumstances, but it comes from nowhere in that solution. isn't that a solution issue? i got previous cred which hold me in a dead end at the moment

[dapper moth]

I can. Sorry for the late reply.
I was going to comment here how I resolved the error but I can create a thread indeed.

[severe inlet]

Interesting thank you

And i wont do that again sorry

[crystal lion]

What's going on with RDP?

I havent been able to connect to the target since yesterday

[jovial walrus]

why can we only enroll in one path at a time ?

[stable badger]

hello guys im getting started on Cracking into Hack the Box module Web Requests 3/4 section http methods POST
and im stuck in there because i dont know why when i use the cookie that i get from the website on curl it keeps saying that the cookie is not valid

can anybody help me pls

[cloud urchin]

What's the section name?

[fathom pendant]

This one yeah? https://academy.hackthebox.com/app/module/35/section/224

[stable badger]

yes, that one

[stable badger]

POST

[fathom pendant]

how are you formatting and what flag are you using; i used the -b 'PHPSESSID=<SESSID>' http://ip:port/search.php --json <json request here>

if you wanna dm me your command that's fine

[stable badger]

ok

[weak patrol]

https://academy.hackthebox.com/app/module/147/section/1320

I am having a bit of an issue in this module. I have found some files that possibly have the password I am looking for but I am unable to transfer the files to my local account so that I can crack them and the account I am currently in doesn't have admin privileges.
Any help?

[quick cloud]

i doing attacking common services module and i stuck at my first lab i on port 21 ftp is closed and on scaning all the ports it dont get any thing can please anyone can help me

[shut quest]

Not sure what your nmap command looks like but if you're trying to go fast slow down, iirc I had to restart that lab once or twice to get the port to show up. Also try waiting a minute after you get the ip.

[quick cloud]

ok i will try again

[shut quest]

Use your noodle and delete the spoilers.

[quick cloud]

@shut quest what does that means

[shut quest]

It means delete your prior two messages. And think about what you just posted.

[quick cloud]

@shut quest i deleted it

@shut quest so can u please help me ?

[shut quest]

I did

[quick cloud]

@shut quest how

[shut quest]

I will not spell it out for you.

[heavy sluice]

It probably is on another port and NOT 21. nmap scans only the top 1000 ports when you do not tell it to do something else

[quick cloud]

@heavy sluice yes but i think there is something wrong with htb servers , can anyone know how to restart it or any solutions

[heavy sluice]

Nothing wrong for me

[narrow nacelle]

Hi, I'm doing the "Web Server Pivoting with Rpivot" module and can't find the flag on the home page. I gave up using rpivot because of obvious reasons, so I used dynamic port forward with ssh and after that I also tried ligolo. Connected to the internal network but there's no flag on the home page

[gray yacht]

When you launch a browser for the .135 host, it should be in the red banner underneath Apache2 Ubuntu Default Page. Can be easy to miss.

[narrow nacelle]

My bad 😅 Thanks

[heavy sluice]

I present to you the longest 1 day module in HackTheBox. I am working on it for around 5 days now the Windows Lateral Movement Techniques especially
https://academy.hackthebox.com/app/module/147

[elfin patio]

i am solving skill assessment of command injection, using command ip=127.0.0.1%0a{ls,-la}${IFS}${PATH:0:5} to get user in home directory, still not getting result.. can anybody help or tell what i am doing wrong?

[brave field]

dm please

[lone ferry]

I did reach out to them. Not sure how reaching a spawned target from inside their VMs could be “on my end”. Thanks though for the isolation knowledge may be just the assessment machines

[autumn pilot]

some targets could be configured in a way that prevents icmp requests, which means you won't see any results by pinging them

[lone ferry]

I like the way you think. I broke down and read the “show solution” which kinda conflicts with the instructions. It says rdp in, test says to find a foothold gives no creds.

Edit: You are correct 👍 the rdp writeup was throwing me off. Thanks

[worn swallow]

No download button for Vpn on academy?

I am using phone btw

[minor bear]

I'm working through the "Attacking Thick Clients" section in the Attacking Common Applications module on pwnbox, and am having trouble with getting PowerShell to load. It opens for a brief second, then crashes. I can get command prompt to work, and if I try to open PowerShell from command prompt I get the error "Windows PowerShell terminated with the following error: The type initializer for 'System.Management.Automation.Runspaces.InitialSessionState' threw an exception."

Does anyone know a fix for this?

[green mulch]

I ran it as Administrator and it worked for me

[minor bear]

It does the same if I try running PowerShell as admin, unless you’re saying to run command prompt as admin and use that to run PowerShell

[wintry pagoda]

Hello guys

How can i fix this ? Waiting for 10 mins now

[green mulch]

Naw I just ran as admin from the start menu I think it's a lab issue

[green mulch]

This spawning issue is happening for quite few days now try other vpn

[minor bear]

Thanks for the sanity check, wanted a second opinion before rebooting

[fathom pendant]

@ashen nova be mindful not to share things from modules above tier 0; especially since it contains answers for several questions.

Start with a dig of the base domain (don't use automated tooling); then move on from there

[pseudo kraken]

Hey guys, im in the Active Directory module in the CPTS Path, in the Attacking Domain Trusts - Child -> Parent Trusts - from Linux .

I dont know what the password for the htb-student_adm is in order to use secretsdump, any help? i tried going through some previous modules but didnt find anything

[cloud urchin]

I don't think you need it.

[pseudo kraken]

i tried using secresdump with the credentials provided and it fails, in the path it is using this command 'secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/krbtgt' so probably its the htb-student_adm user, but i dont have the credentials for the user

[green mulch]

Maybe try credentials reuse

[pseudo kraken]

i tried, the module is about golden ticket, the account in order to authenticate to collect the info needed is htb-student_adm, but the password is unknown

idk what to do, ive searched past modules to see if i cracked such a user but no luck

[warm horizon]

Could someone tell me why my IP address isn't working? It won't open URLs and it doesn't work in the terminal. I've been having this problem since last week.
Unable to connect

Firefox can’t establish a connection to the server at 10.129.234.166.

[young tinsel]

need some help on the RDP/SOCKS tunneling module - I've got the SocksOverRDP client/server established & proxifier running, but every time i try to run mstsc to connect to the target box, I'm getting an error that the host is unreachable

[verbal ivy]

heey guys am here if ssomeone need help with some module just ping me

[sick meteor]

@verbal ivy I am stuck on something. May I DM ?

[verbal ivy]

Yeah yeah go ahead just ask here

[sick meteor]

I'm on http response splitting in the http attacks module. From what I can figure out I need to get the payload to execute in the admin browser but I'm out of ideas (and knowing it's tier 3 not sure how much I can ask / explain what I tried)

[verbal ivy]

Let me have a look (next time ping me as I don't get notifications)

oh that one is a tricky one

[sick meteor]

Yeah there was a very similar question about 10 years ago on the CTL app exams

[verbal ivy]

you’re on the right track thinking about getting JS to run in the admin’s browser, but the tricky part isn’t just injecting HTML… it’s controlling how the response is interpreted. play a bit more with CRLF to mess with headers, especially anything that affects how the browser renders the body. also think about how the redirect behavior might prevent your payload from executing and how you could break that flow. 🙂
if it seems hard u may dm after trying that .

[sick meteor]

Thanks I'll go do something odd to clear my head

[verbal ivy]

Gl mate

If anyone need help ping me 🙂
cuz i refersh my memory too 😄
gl everyone .

[trail gate]

thank you bro :) i will track you down soon enough

[sick meteor]

Got there. sigh i did overthink it and forgot about something fundamental to response headers

[verbal ivy]

I knew you will do it , Gg keep up. 🔥

[trail gate]

@verbal ivy hey man could i ask you some questions over DM?

[verbal ivy]

Sure , Go ahead.

[cursive wyvern]

okay, peopee, in AD Enumeration & Attacks - Skills Assessment Part II there is a password comes from nowhere 'W***', according to solution. Should we guess it or it could be retrieved somehow else?
Question: "Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain."
PS: btw also facing 'Can't talk to KDC' issue with kerbrute
PSS: from domain joined machine (win) it works either way, with --dc flag (dns/ip), or without it: *kerbrute_windows_amd64.exe passwordspray -d INLANEFREIGHT.LOCAL <userfile> <pswd> *. on non-joined machine (linux) --dc is obligatory and it should be IP

[amber bane]

hi all, is there a way to reopen a completed course/module after we have completed it?because I wanted to look back the questions.

[verbal ivy]

that password isn’t coming from nowhere, it’s just one of those super common defaults you’re expected to try in a spray. no need to ‘find’ it somewhere, think more along the lines of what orgs lazily set for users. ( I just password spray that one when i did it as the question mentioned "weak creds")
for the KDC issue, that’s usually not the tool itself… check connectivity to the DC (port 88), DNS resolution for the domain, and make sure you’re targeting the correct domain name. if any of that is off, kerbrute will .

[verbal ivy]

Yes go to library > search for the module and click it then Revisit Module

[fathom pendant]

it doesn't come from nowhere, consider all techniques available to you and the question itself gives you a hint as to what should be tried. Along with the reading giving it to you somewhat directly

[amber bane]

Thanks!!!

[cursive wyvern]

seems it is about guessing. if so, i'm very angry about that, as educational part is not about guessing, moreover i was going through module 2 months ago and can't even think that it should be guessed. thanks

[fathom pendant]

this is why notes are important

and it is a 'guess' but it's an educated guess. It's not a random string based off nothing

[cursive wyvern]

thanks. fact that it should be guessing - freaks me off. i read module 2 mo ago and relying on facts and unconsciously relying on facts so guessing even not comes to mind. updated post about kdc. thanks again

[cursive wyvern]

yeah, guess definitely educated. i dove so deep into assessment after 2 mo pause as couldnt even think og a guess. thanks

[verbal ivy]

it's not really guessing , it just shows human errors .
irl env you always find weak passwords everywhere so if there is no lockup on how much you can try then you can bruteforce a couple of lists and who knows .. u might find stupid password everywhere .
Password attacks module covers this well

[verbal ivy]

yeah it normal because domain joined Windows machine it already knows the domain + KDC via AD/DNS
on the other hand a non joined you must tell it where the KDC exactly

(cuz u just saying a name and linux says wtf are you talking about)

• it's a risk assessement so they are testing your knowledge about the previous sections you did and for this case they are testing this exact part (or starting from it)
  https://academy.hackthebox.com/app/module/143/section/1490

[fathom pendant]

it's a guess in the sense that there's no obvious way to know the answer, no matter how you spin it it's still a guess in that sense

if you approach it from a blank slate perspective, it's still 'guessing'; it's just an educated guess based on a common weakness

[halcyon flume]

Hi all, I have a question on the Kerberos Attacks module Kerberos Authentication Process section in the Active Directory Pentester path. I'm trying to understand who does the authentication of the user vs who does the access control (authorization of what the user can access on the service). I'd like to clarify the paragraph on Ticket-Granting Service (TGS). It says that the KDC "checks their authorization to access the requested resource before issuing a service ticket". Is this correct? Or does the KDC only check that a user has a valid TGT and issues a service ticket if so, leaving the service to do the authorization checks?

[green mulch]

The KDC issues the TGS anyway by Default and the service itself check the Authorization so KDC only authentcates it's the service headache to Authorize or Not

[lusty trench]

Help! Citrix Breakout is driving me nuts!

[lusty trench]

Can you clarify where the SMB share should be run from? I've been stuck on this for days.

[fathom pendant]

@grave rain module is above tier 0, be mindful of posting things from it

[amber bane]

hi, i'm on the vulnerability assessment module and on the nessus assessment section.
my question is, if we don't want to use the browser-based-box and instead using our own nessus and linux machine connect via htb openvpn, how do we scan the target? I try to scan the 172.16.x.x but failed (I guess because not the same ip range), so what is right approach?

[untold orbit]

I think you are asking about pivoting?
You can use pivoting to pivot across different network. Use HTB spawn targets as pivot machine.

[ruby kettle]

Hey there, anybody got the AI Red Teamer module, and can help me with course reviews. Looking to buy it.

[verbal ivy]

i kinda remember that course if u refering to how to use nessus u don't actually need to scan as the scans already there but if u still wondering i can check

[gray yacht]

It should be on the initial target you access.

[amber bane]

Yes, I want to practise scanning from my own kali linux and nessus on my machine.

[verbal ivy]

as i remember they give you access to nessus but if you wanna practice it on other targets just download nessus

[amber bane]

Ya, possible. As well Thanks!

[mortal wharf]

I am currently doing the CPTS path with the student subscription. Do I still have access to my finished modules when I cancel the subscription or do I need to have an active subscription in order to access the modules ?

[verbal ivy]

yes once u finish a module it ur forever

[mortal wharf]

Okay, good to know. Thank you !

[cobalt vector]

what is this cpts

what does that mean

[verbal ivy]

https://tenor.com/view/spongebob-upside-down-come-here-gif-6152457

[cobalt vector]

ohhhh its a sex thing

[worn ferry]

Dear, how can I purchase the blocks more cost-effectively? I only plan to take the courses of CAPE and CWEE.

[acoustic owl]

The most affordable option is probably the monthly subscription, which provides you with a certain number of Cubes each month.

[worldly gull]

I’m doing cpts too, can you guys wish me luck, I wonder if I’ll finish the path before summer

[nimble oasis]

godamn.. returned to academy today and.. how is it possible to change something and turn it into something this terrible ??
It's designed for phone over desktop (who the fuck study cybersecurity on a phone first ?), it's bulky, less user friendly, unclear to a point when i'm just wanting to give up on trying to read the text, block of code are fucked, size of text is too big, space on each side that is as large as the text, table that give no info and is wide for nothing and bulky for nothing, it just feels like i landed on something vibecoded with ai.

I'm not really here to trash talk, just wanna give constructive feedback;pls don't takes words to heart.

Buttons act weirdly (dropdown gives hover effect box, while other give underline bar, but those on the right give hover ??)
Top bar and end bar are uncorrectly sized (top one is bigger than the end one), ui is slow and unresponsive, cheatsheet is ten times worse than before, colors don't hilight properly, stuff just feels bulky, space wasted and not clean, "note" button (okay why not, even if i'm pretty sure everyone got a osbidian) however why does it move the text ?? same for "Get unstuck" button.

Dashboard take 5s to load, list of enrollment is bulky, doesn't feel clean, same for the profile box on the dashboard, why is it not correctly sized ? why the gap between name/pp and the status ?

Btw the edgy progression bar are in the same state the / get cutted cause pixels ig and it just feels trashy. And in dashboard same problem text to big, cards bulky for no reason.

Gonna share the same message in feedback, but dunno, is this really the way to sell ur platform to schools and people that like cybersecurity ? by giving a platform designed for phone over desktop, bulky, space wasted, and not user friendly? Sad change when last ui was perfect. This one just doesn't make me wanna study on academy when i know perfectly well the quality of the content..

sry for the rnt, just sad and wanna give some feedback

[cursive wyvern]

back to AD assessment II: at point of using 'mimikatz sekurlsa::logonpasswords' under nt/authority on MS01 i faced the issue that there is no password for user

kerberos :    
     * Username : m*****
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : (null)    

but 'lsadump::secrets' has it(but it is not obvious that it was a password)

Secret  : $MACHINE.ACC
cur/hex : <SNIP, not required> 
    NTLM:031fc31a8ec7c4484dd4c8badc58fbeb
    SHA1:a0f5f5c233b7a629fb4788450f5f992243c58dba
old/text: ;6bu^ur;mJ&ES&#Iu)CQZeckLZsyN >AgIv4DZ^&EX,Wu.ahRkT%c3)R+c&xcu_:]n#V1V.j[=+GTjk?l)z OaU8!c^\#`s?8/E!xy^itE>kYiBcSgohVb$P
    NTLM:6991907663e3f68922d24ac9a573e2c3
    SHA1:33058b24d5882f1dd18ce81988aa64226e2879b5

Secret  : DefaultPassword
cur/text: <password here>

CME also shows it
SMB 172.16.7.60 445 <machine> INLANEFREIGHT\m*****:<pswd>

problem: where did i screw up or it is intermittent issue? as a result, not clear to trust mimikatz or not

[verbal ivy]

i actually do the modules from my phone

[verbal ivy]

which ad

[cursive wyvern]

second assessment, around MS01 privesc. AD Enumeration & Attacks

[verbal ivy]

lm hv a look

[verbal ivy]

which qs?

[cursive wyvern]

Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.
you probably looking into solutions to navigate. Question 8. After some msf exploit setup

[verbal ivy]

if it is qs 8 just run cme with adminsitrator pass
it took me so much time that one idk maybe a problem with it or in me

[cursive wyvern]

already. cme works out here, but i'm afraid if i could even trust mimi

[verbal ivy]

i did it with cme don't really know

seems easier mimi always gives 20k ouput i need to read with my laziness

[silk lagoon]

Ms01 or sql

[cursive wyvern]

you know what and where to look at. i'm not at that point of understanding, so visually scanning what could be useful and am i at the place when i should be.
thanlk you

[verbal ivy]

am also still learning man i just finished the module last week haha that why i still have the stuff i did

Good luck with the path it's very heavy

[trail gate]

@verbal ivy can you help me on this?

its over the smtp footprinting module

[verbal ivy]

sure

[trail gate]

i cant send screenshots here could i show you in dm?

or would you prefer just to keep it in here

@verbal ivy

[verbal ivy]

yes

[trail gate]

keep it in here?

[verbal ivy]

u can dm

[round epoch]

Hi, I'm on the Linux Fundamentals module in the section, File Descriptors and Redirections. I thought I was doing something wrong why I was unable to obtain the correct answer to the 10 point question of 'how many packages on the target system?'; the issue was and remains, I was never on the target system. I finally took a closer look at the terminal to see whether I was logged into the target system: I never have been because because the connection has always been rejected from port 22.

I do not know how to overcome this.

[nimble oasis]

Cursed

[verbal ivy]

love u too man

[cursive wyvern]

just have finished it. well, there were unexpected places definitely. there is a zoo of tools required, and some of them too similar with some discrepancies which seems vital. glad I've figured out to spin bloodhound at the very start. well, seems a lot of AD pain ahead.
there were 15 mins left for the box and extending it returned generic error, seems I exhausted it.
thank you

[verbal ivy]

there is a docker version of bloodhound look it up and for getting ad data i use rusthound-ce
Congrats ㊗️

[cursive wyvern]

i already have spent half a day a while ago starting figuring out what docker for my linux is okay finishing with working BH installation on container with my simple password and bloodhound-cli
rusthound should be on joined machine or just same network is enough?

[verbal ivy]

rusthound is same as bloodhound-python
but taking steroids as it was built in rust

[cursive wyvern]

didnt use py one. okay.
have you gone through win/lin privesc modules? is that more appropriate to start win one after AD? or does not matter?

[verbal ivy]

just follow the structure they give you would be better

[cursive wyvern]

looking at the structure I'm not sure if it is appropriate imo. AD for some reason in the middle when there is no intersection with other modules and I postponed AD understanding that it is huge and knowing that fat part of exam related to it not to forgot material closer to exam. only lin/win PrivEsc and attacking enterprise left for me.

[verbal ivy]

honestly doesn't matter which one linux or win priv escalation
i would say linux if u want me to chose a bit easier than the windows one as it also long and annoying

i finished the whole path just waiting for a voucher to do the exam

[cursive wyvern]

good luck!!! so, there is a ping period between requesting exam and its start? i do not recall that. it should be possible to dive into at any time. but check could be few weeks

[woeful goblet]

Sup Guys, i just started learning about Cybersecurity but i already know Python basics. I watched different videos about how to start and it was always: Linux & Networking. Could anyone of you give me an advice in this matter where i can start?

[cloud urchin]

Academy paths that interest you, ie. network pentesting to web pentesting paths

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[dusk basin]

Hello.
I am in the module "Password Attacks". Currently in section "Pass the Hash"
I'm trying to obtain the hash of David using mimikatz sekurlsa::logonpasswords, but I don't see the user david anywhere.
Looking at internet, it says that mimikatz should return the user, am I missing something?

oh, and of course now I try it again and it appears....
nevermind then

[paper crest]

Hello ! I'm studying the HTTP Attacks module specifically the HTTP Request Smuggling / Desync Attacks section covering TE.TE and TE.CL topics. Both modules demonstrate attacks via Transfer-Encoding header obfuscation.
In the TE.TE lab the CL.TE attack vector is used to make the admin visit a specific page. In the TE.CL lab the goal is to gain access to the admin panel directly. My question is: why can't we use the CL.TE vector in the TE.CL lab to access the admin panel? When attempting CL.TE we get a 401, but with TE.CL we get full access. What is fundamentally different about how the request reaches the admin panel between these two vectors?
And is CL.TE generally considered a user-targeted vector rather than a server-side access vector?

[jaunty latch]

Question, I've recently come back to HTB academy and started using my account that I started with. I can't see an option to reset any progress, now I have to re-read all the content that I have done in the past but forgotten. Is this by design?

[storm elk]

Yes

[jaunty latch]

Is there a plan to implement this feature in the future?

[storm elk]

Not as far as I know of 🙂

[jaunty latch]

Thanks 🙂

[woeful goblet]

Thankss

[pallid wadi]

I can not get SSH'd in. I connected the VPN , but no login's pop after being connected.

[untold orbit]

Can you ping the target??

[pallid wadi]

Nope, but I think I don't need to SSH in this case, took me long enough to figure it out. 😆

[untold orbit]

Cool

I think you need to mention module and section for people to help you out

[pallid wadi]

This is for module Service Scanning in Pentesting Basics

[jovial walrus]

I am on the skills assessment for prompt injection and I got the key but am a lil clueless on how to get admin banned now...Any help is appreciated

[jovial walrus]

Nvm solved it ..lemme know if anyone needs help

[halcyon flume]

In the Kerberos Delegations section of the Kerberos Attacks module of the Active Directory Pentester path, under Constrained Delegation, it says that a copy of the TGS ticket the user sent to the first service is stored in additional tickets field. Is it correct to say that the SPN in this copy of the TGS ticket is that of the first service? In that case how does the first service know which service to delegate authentication to? Where is this info stored?

[waxen totem]

msDs-AllowedToDelegateTo property of the front-end server (first-hop) stores the SPN of the service it's allowed to delegate to or in the case of resource based constrained delegation(RBCD) it's in the msDs-AllowedToActOnBehalfOfOtherIdentity property of the back-end server (second hop) .The user's TGS doesn't actually have to store the SPN as it isn't directly interacting with it, all it needs to store is whether or not it's forwardable (whether or not the TGS can be used for delegation)

[faint gulch]

Is there any ongoing issue with spawing and accessing machines by any chance?

[halcyon flume]

In the Unconstrained Delegation - Computers section of the Kerberos Attacks module of the Active Directory Pentester path, under S4U2self for Non-Domain Controllers, it says that the S4U2self method is "particularly useful for scenarios where we have a ticket from a computer that is not a domain controller." But in the example shown, we had to use the Domain Controller's TGT. I'm confused by this

[wise dune]

Hey, my streak counter seems to have bugged out and I currently have 30 out of 0 streak points, anyone ever encountered that?

Worried I could lose my streak due to a bug

[untold orbit]

Me too

[dusk basin]

Hey.
Just wanted to say, I've just completed the Password Attacks module, and I loved the final Skills Assessment, I literally spent 3 hours to complete it, but I enjoyed every single minute of it!

[dim hound]

Hi there, currently I am working on SA of Windows Lateral Movement. I am able to login as a user with RDP but there is no flag at: What's the content of the flag located at C:\Users\Arturo\Desktop\flag.txt ?

can I dm someone, to provide my findings so far to check if I am on the correct path ?

[silver sapphire]

Hi, could anyone help mi with explanation of Skills Assesment part I in Advanced SQL Injections? I don't understand one thing (I was able to solve it due to solution but I can't understand where one thing come from) 🙂

[fathom pendant]

known problem since UI update

[lusty terrace]

anyone know where I can learn Ligolo-ng

[potent delta]

While going through the Wi-Fi Penetration Testing Basics Overview - Section 4 and I have run into an issue where its not showing my wlan0 interface. I tried restarting the instance and that didn't fix it. When running the** iwconfig** command I receive the output lo, ens3, lxcbr0, tun0 that show "no wireless extensions". Did I miss a step? I am suppose to assign one of the interfaces as the wlan0? Any help would be appreciated

[halcyon flume]

Is anyone able to help clarify this? Thanks

[patent maple]

https://docs.ligolo.ng

The documentation is enough to understand about it and pretty easy

[ocean rapids]

i have completed the nmap , intro to networking , linux fundamentals , web requests module can anyone recommend me some other modules and what to do next

[dusk basin]

I would say to go to whatever you want to learn next

[whole nexus]

Consider covering the Tier 0 modules, or maybe picking a path. The Information Security Foundations path is a good start, or whichever one catches your interest

[spark portal]

intro to hacking banks, its tier 1

then you can go for the Certified Unethical hacker cert

[untold orbit]

Youtube would be good option.
I checked out videos for Double Pivot using ligolo-ng and reverse shell using ligolo-ng.
This teaches you to set up ligolo tunnel and also listening port.

[spiral birch]

Hey, is anyone having issues with the Information Security Foundations in getting the VirtualBox Environment set up, as far as I've gotten is setting up the ParrotOS and the Windows Developer Set-up and I feel like i'm doing something wrong or I am missing something

[torn fiber]

i am also having some problem in academy [21:07:49:328] [9283:9284] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[21:07:49:328] [9283:9284] [INFO][com.freerdp.client.common] - Network disconnect!
i am doing the attack common application module i am getting disconnect from the server for table of context number 5 6 and 7. right now doing number 7 but rdp is getting disconnected too fast to be able to do anything. where should i go? to discuss this problem.

[jovial walrus]

kernel exploits section window priv esc module this table is messed up

[waxen totem]

#1234357888114364508

[fathom pendant]

You dont need to do everything in the setting up module

[fathom pendant]

As the question states, its asking for the header; formatted
Content Length: xxxxx

[short oasis]

Now solved thankyou

[fathom pendant]

@paper crest module is above tier 0; refrain from spoiling attack vectors and such

[paper crest]

Hey everyone! 👋

I'm currently studying HTTP Request Smuggling / Desync Attacks and I have a conceptual question I'm trying to wrap my head around.

I understand that TE.CL and CL.TE desync techniques behave differently in terms of where the "smuggled" portion of the request ends up and who processes it.

My question is more conceptual: is it correct to say that CL.TE is generally more effective when targeting other users/clients, while TE.CL is better suited for directly interacting with backend/server-side logic? Or is that an oversimplification?

Basically - what is the fundamental difference in how these two techniques affect request flow, and why might one give you access to something that the other doesn't?

Would really appreciate if someone could explain the distinction! 🙏

[brazen saffron]

Analyze the event with ID 4624, that took place on 8/3/2022 at 10:23:25 https://academy.hackthebox.com/app/module/216/section/2300
I'm trying to get the event using XML queries and using the "GUI", I try to look at some writetup but I have no event at this date... The first event I see it's (10/4/2022)...
Any hint 🥹 ?

[random sinew]

Hey I dont think you can simplify it like that.It all depends on the application's context, what you see in the module is just one example among many others.
But feel free to correct me if you disagree.

Speaking of the module, I would need help with the TE.CL one. I tried a lot of things, but I'm still not there.

and according the discord history i'm not the only one who struggle on this step

[paper crest]

I can help

Send me a message, and I'll give you some advice

[jolly spruce]

I am experiencing major glitches in the Citrix Breakout section of the Windows Privilege Escalation module

Not only am I not able to access my attack host's tun0 IP (which I was able to do yesterday, from a Pwnbox on another PC, for some reason)

But the RDP connection also keeps dying every few seconds, and I can't reconnect for like a couple minutes after that, every time

I know how to solve the questions; this is one of those sections where the content spills out the method

But I still wanna, you know, actually do it 😭 Gotta be done with this module asap

[green mulch]

For the rdp part you can solve it by increasing the timeout and using other compression options with xfreerdp

[brazen saffron]

Got it, no idea why the event viewer didn't show me before.. When I insert the date, it shows me nothing :>.

[jolly spruce]

😮 You sure? Alright, maybe I'll give it a try soon

There's still the UNC resolution problem though

It just isn't detecting my attack host

[green mulch]

Yesh for me this always solve the rdp issues as it's mostly network related issues

[green mulch]

I'm also on that module but not yet reached that section so I'm not sure about what is the issue there

[jolly spruce]

Idk, I've never once had such issues before, that weren't caused by something more concrete (like my connection being down altogether)

Feels to me like this particular VM is just very problematic

[green mulch]

Yeah the network latency messes with it so it can never happenif your internet is mostly good but for me my internet mostly sucks so I know xD

[green mulch]

Could be but I can't confirm

[jolly spruce]

There have been other people to report this too, anyway

etc.