modules

[rustic sage]

Ok thanks

[spark wyvern]

also on working with web services when I trie to install apache2 it fails because of dependencies is it to test my skill with package management or it is not supposed to do that ?

[wet swallow]

@spark wyvern first I couldn't install apache 2, but i did it with this command:

Sudo apt install apache2 -y

Idk if you need it

[spark wyvern]

I went sudo su
then apt install apache2 -y it runs but I get dependencies errors

[wet swallow]

Then try:

Sudo apt update

After this:

Sudo apt install apache2 -y

[spark wyvern]

update upgrade ok thx

[wet swallow]

Try it

[spark wyvern]

thx

[wet swallow]

Let me know

[spark wyvern]

yup

[wet swallow]

Does it work?

[spark wyvern]

XD

[wet swallow]

Have you install it?

Apache2

[spark wyvern]

not yet need to upgrade first

[wet swallow]

Ok 👍

Try it

And

[spark wyvern]

ok install apache 2 OK

shokran

enough for today Thanks HTB GREAT tool and thanks community

[wet swallow]

Yw my friend

[viscid warren]

I have begun my HTB Academy and I do not understand what the phrase "proof text" means. When I google it references bible passages. There are no bible references on the web page that pops up. Can someone tell what I am supposed to look for to answer this question? "What is the proof text displayed in the Target website you browsed?" I do not want the answer only what "proof text" means... I was told "Proof text is basically your flag" but I do not know what "your flag" is either. Someone please explain I have been stuck on this page all day because I do not understand the terminology, there is no help button
and google does not define it.

[sudden summit]

The flag is a hash string that you copy past into the answer section to prove that you have completed the challenge. It will be in a txt file or will display on the screen as : Flag: 32432snsdjisn93f902nfi2

Sometimes it will look like HTB{randomhash}

[viscid warren]

Thank you @sudden summit there is no "flag" mentioned on the webpage. so now I am back to aquare one. What is a "proof text"?

[sudden summit]

Proof text is the hash.

32432snsdjisn93f902nfi2

something like that ^^

[viscid warren]

and that should be on every web site?

[sudden summit]

no. Its for hack the box to show you have completed the task.

Not related to pentesting websites. Its just for the academy questions.

[viscid warren]

so the answer to the question would be "a hash"?

[sudden summit]

it may also look like HTB{welldone}

yes. In your answer you need to copy past the flag.

Which is the hash or HTB{}

[viscid warren]

but i do not know where the hash is

[sudden summit]

Thast what you need to find. What module are you stuck on?

[viscid warren]

I'm a noob, the first one.

the fifth page

[sudden summit]

Spawn the target system in the questions section

then browse to it.

[viscid warren]

i figured it out!

[sudden summit]

haha well done.

[timid grove]

NICE I NEEDED THIS 🤣

[rancid badger]

how to receive post request on server-side, given that netcat is not available on target server? Give me a hint ..!!!!

Module: File Transfer
Section: Windows File Transfer

Am I missing some commands available on powershell or do I need to think a broad?

[sonic sinew]

Hi guys i am new to the academy and i started with Windows Fundamentals.. buuut i have a problem Introduction Section. I cant seem to find the ip address of the machine i need to remote desktop to and cant log in in that machine. Can you give any hints how can i do it?

[tough fjord]

there is a button to press to launch the isntance

[odd python]

what do i need to put in here?

[rustic sage]

love 😆

i'm just starting Learning Process

[rancid badger]

Add me to the medium-modules, I am practicing that..!!!

[tough fjord]

you need an account on hackthebox main site and verify here to access the other channels

if you are tackling medium modules you are capable of creating the htb account 😉

[rancid badger]

I have created the htb account

What should I do on my account to join medium modules?

[odd python]

ummm someone pls?

[tough fjord]

@rancid badger read #welcome and follow the instructions

@odd python the flag you get when you are successfully logged in as an admin

[odd python]

Do i need to brute force into this?

Because all i get from instructions is the guest cookie....

[rancid badger]

I have hackthebox account without subscription, is that a reason?

[tough fjord]

no - if you read welcome and follow the instructions you will see how to verify

[tough fjord]

no brute force. play with the cookie and see what it is / what it represents

[odd python]

@tough fjord can i pm you?

[tough fjord]

you can but you'll just get the same information dude

look at the cookie and compare it to what it shown on screen when you login. then think about it logically

[rancid badger]

I am unable to figure out, I am unable to message on that channel but see the messages

[soft geode]

Hello, help me please with a question ! What is the name of the network interface that MTU is set to 1500?

ifconfig doesn't help

tun0
eth1
eth0

the answers are not correct

[rancid badger]

May be some network utitlities help, so keep thinking of how to see them?

[timid grove]

@odd python pay attention to yr login name when u log in as guest and the cookie

[hollow garden]

hello again, i'm still stuck on the 2nd question on hardening tips section on file inclusion module, i can't figure out how to use the curl command to execute a .php file , the section doesn't mention it (or maybe i'm blind)

[tough fjord]

#welcome its a channel. Read all messages

[soft geode]

I can’t get more of this information!

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether d2:c7:2b:68:9e:26 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether d2:43:d0:8e:8a:f0 brd ff:ff:ff:ff:ff:ff
5: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen 100
link/none
6: teredo: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 500
link/none

[rancid badger]

which section are you dealing with?

[rancid badger]

Okay, I figured it out. Thanks!

[tough fjord]

Good stuff dude

[fossil pivot]

@soft geode What module is that?

[soft geode]

LINUX FUNDAMENTALS

[soft geode]

LINUX FUNDAMENTALS

[tough fjord]

Are you running it from parrot or the target you ssh into?

[soft geode]

i run it from Parrot

I guess I misunderstood the task

[tough fjord]

Yeah. They are to be ran on the target

[soft geode]

how to launch on target?

[soft geode]

http://prntscr.com/w4p1ss

[tough fjord]

you've launched it

ssh to the ip address in that screenshot usingthe credentials also in the screenshot

[rancid badger]

There is GUI for ssh in parrot. Do some research...!!!

[eager spear]

i cant talk in general

and i am so confused

i just randomly clicked servers and here i am help

[tough fjord]

you need to verify your account to access the full server

read #welcome

[rustic sage]

On linux fundaments module https://www.inlanefreight.com cant connect to database. https://imgur.com/q0QOlUb.png its ok?

[drifting knoll]

we're working on it

[rustic sage]

oh ok

[dull berry]

hi man

[soft geode]

Thanks bro everything worked out!

[full sky]

how can I exploit nginx ?

[frozen barn]

On Linux fundamentals "Service and process manager" the systemctl command is asking for a password, does any know that one. I tried everything from username to password and even the brackets after the connection is made, nothing😩

[drifting knoll]

try without sudo

[soft geode]

hellp me pleasy ! I do not understand the question
Use "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles" as the answer.
i use command systemctl list-units --type=service
get response apparmor.service loaded active exited AppArmor initialization

what answer does she want from me?

[smoky prism]

try piping it to grep?

oh I see what you are saying, I don't remember this one

[nova moss]

I piped it to grep

It wants the service name

[soft geode]

i used command
ps -aux | grep apparmor

response
htb-stu+ 6789 0.0 0.0 13144 1100 pts/0 S+ 19:42 0:00 grep --color=auto apparmor

[nova moss]

you listing process instead of services, output could be diff

With systemctl you can check every service

[soft geode]

http://prntscr.com/w4wfi8

[nova moss]

grep it

[soft geode]

please show me example

[nova moss]

systemctl | grep description

with grep you can find text or patterns

[soft geode]

this command
systemctl | grep description
responce zero reaction

[nova moss]

replace "description" with the task requirements

[soft geode]

http://prntscr.com/w4wi9u

[nova moss]

Do the same grep that your doing with ps -aux

First check what You doing:
you are using ps to list process instead of use systemctl to list services

Then, you are doing grep ok, but You are doing grep to the wrong command

So, systemctl | grep "Your_pattern"

Replace your_pattern with the thing you want to find

Could be a string, a number

In this case You want to find the word apparmor

[soft geode]

http://prntscr.com/w4wk3x

[nova moss]

Thats it, check what of these services have the description that the task tell to you

You can do it in other way more easy, grep the description of the service that the task tell to you, so you grep "All description here"

[soft geode]

Thanks bro everything worked out!

[nova moss]

Btw check the order of systemctl, the structure, first you have the service name, then you have the status, and then You probably have the description

Good job 😄 Please delete your last photo to not give the totally answer to other users

[soft geode]

😁

[nova moss]

Have a great day!

[soft geode]

same to you !

[rare bolt]

Hi, I'm in Linux Fundamentals > Workflow > File Descriptors and Redirections

1. How many files exist on the system that have the ".log" file extension?
   I tried the Following:
   apt list --installed | wc -l

I mean the only thing I can think of doing is to count the number of directories in /usr/bin/. At the moment, I'm trying to think of a way of doing that. And, I'm still not sure of whether or not it's where all packages are stored to begin with. Any tips?

Nvm. I installed tree earlier and forgot about it. Lol

[azure marsh]

That task is getting to me too! I just can't seem to crack it.

[odd python]

oh

i solved that one

pm me if you need help

[sand bear]

apt list --installed returns the number of installed packages. You need to find files in entire system whose names end with .log

How did my name suddenly change to del_ something 👀

[tough fjord]

the bot auto updates account names to match htb names

you may want to check your account

[spark wyvern]

Hello, still struggling with this npm. Nothing found on web I tried worked but works on what I saw. sudo npm install http.server -g (as port 8080 is by default if not mentionned from what I understood)
Am I close ? Any slap in the back to make me closer ?
thank you

[tough fjord]

try running it as if 8080 was not done by default

[spark wyvern]

sudo npm install http-server -p 8080

tested this no success

sudo npm install -p 8080 http-server
sudo npm install -g -p 8080 http-server
aswel

[tough fjord]

imagine it is already installed

[lofty moat]

Hi, for the linux fundamentals I'm stuck with the question "How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)"
I tried htb-student@nixfund:~$ netstat -l | grep -v localhost | grep LISTEN | grep -v tcp6 | wc -l
93
can someone guide me what is not correct in my command please

[timid grove]

remove wc -l and look at the list, the questions only want ipv4 only

all not needed filter it away

[lofty moat]

Thank you

[soft geode]

Hello
npm start --host 127.0.0.1 --port 8080
tested this no success

[spark wyvern]

I tested a bunch of them

sudo npm start http-server -p 8080
sudo npm set http-server -p 8080
sudo npm config http-server -p 8080
sudo npm config set http-server -p 8080
sudo npm init http-server -p 8080

It is not FUN for DA MENTAL 😂 🤣

We should be able to buy the answers with cubes 👹 😂

also tested sudo npm start node-http-server -p 8080 and friends no luck there neither

[soft geode]

http-server -a localhost -p 8080 The answer is somewhere close

[timid grove]

very very close

[soft geode]

😁 bro its very easy

[rare bolt]

Linux Fundamentals > Workflow > Filter Contents
Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

I've tried to grep the output.

I'm assuming you have to redirect the output into a .txt file and then filter from there?

[hollow garden]

hello again, i'm still stuck on the 2nd question on hardening tips section on file inclusion module, i can't figure out how to use the curl command to execute a .php file , the section doesn't mention it (or maybe i'm blind)

[rare bolt]

@hollow garden The way it seems to be used, at least in the Linux Fundamentals course is that it takes a url and will return the website source code and allow you to inspect it.

Ex. curl https://www.inlanefreight.com

[hollow garden]

@rare bolt yes, but how to i execute a .php file with it then ? I mean, thats what i'm supposed to do if i reffer to the hint

[rare bolt]

@hollow garden Can you copy and paste the question?

[lofty moat]

Hi, for the linux fundamentals I'm stuck with the question "Determine what user the ProFTPd server is running under. Submit the username as the answer."
I tried htb-student@nixfund:~$ ps -aux | grep ProFTPd
htb-stu+ 6108 0.0 0.0 13144 1040 pts/0 S+ 15:23 0:00 grep --color=auto ProFTPd

But the answer htb-stu+ is incorrect
Can someone guide please

[spare turret]

im stuck on the To get the cubes back from this module, answer the following question. What is the difference between the two numbers of the learning progress mentioned above? and the numbers are (1.00)365 = 1.00
(1.01)365 = 37.7

can u guys help he?

[lofty moat]

@spare turret the answer is in the question itself "difference between the 2 numbers"

[spare turret]

thx

[hollow garden]

@rare bolt "Edit the php.ini file to block system(), then try to execute PHP Code that uses system. Read the /var/log/apache2/error.log file and fill in the blank: system() has been disabled for ________ reasons."

the hint :Place a PHP File in /var/www/html/ which contains a PHP Webshell using SYSTEM(), then use curl to execute the file. Be sure to restart apache after editing the PHP Configuration!"

[spare turret]

i put th ans in and it was incorect

can you maybe give me the ans?only this one ttime/

?

[raw lynx]

Hint: You have to filter something to get the right number - you're close

[rare bolt]

I don't know. Lol

[spare turret]

What is the name of the first section of this module?

[timid grove]

😆

look for the title of the module

white color

bigger font

[spare turret]

?

i need so much help

[timid grove]

you are doing page 3 of introduction to academy right ?

[spare turret]

yes

[timid grove]

okay

take a look at ur sections

how many sections are there for that module

[spare turret]

lemme check

[timid grove]

just tell me the numbers, will do

[spare turret]

7

or8

[timid grove]

okay

so type the first section as your answer

got it ?

[spare turret]

yea

im so stupid bro

[lofty moat]

Hi, for the linux fundamentals I'm stuck with the question "Determine what user the ProFTPd server is running under. Submit the username as the answer."
I tried htb-student@nixfund:~$ ps -aux | grep ProFTPd
htb-stu+ 6108 0.0 0.0 13144 1040 pts/0 S+ 15:23 0:00 grep --color=auto ProFTPd

But the answer htb-stu+ is incorrect
Can someone guide please

[tropic field]

Hi this questions: What is the name of the first section of this module?
I know I'm stupid. I am new and today I am experimenting

[old ridge]

Someone has already gave out pretty clear hint to your question @tropic field
Just look few messages back

[tropic field]

ok

I am reading, but I am not understanding where I have to click to see how many sections there are for that module

[urban sage]

Look at the whole page.

[tropic field]

Where I have to go? please, I am new and I would like to enter this world

[urban sage]

You don't need to go anywhere. It is on that page. 🙂

[tropic field]

I'm going crazy where

[urban sage]

I can't say more without giving the answer. It is right there. Take some time and read the whole page.

[tropic field]

I am not succeeding. I've tried everything, I'm not sure where to go

[raw lynx]

How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

I've tried so many variations but it seems like all of them are wrong. Could someone give me a hint for this one ?

My last try was with: netstat -nl | awk '{print $6}' | grep LISTEN | wc -l

[tough fjord]

Have you looked at the output of netstat?

Your current command is gonna be showing stuff on ipv6 and localhost as well

Your filters arent answering the question.

[urban sage]

@tropic field Try taking a break for a bit and coming back.

[unborn scaffold]

can anyone help me with this I don't understand what they are asking!

[autumn pilot]

Basically you have to log in as the user provided and you have to find a way to escalate to admin

[unborn scaffold]

the hint says something about cookies but I dont find anything useful the cookie is just an user cookie

[autumn pilot]

In the section's material there is an example

[tough fjord]

Have you tried modifying it? And seeing what happens

[unborn scaffold]

yes the cookie was base64 encoded so i decoded & changed the name form guest to admin & tried requesting with that

[pastel narwhal]

@unborn scaffold let's move this to DMs, so we don't spoiler ppl here

[azure marsh]

I'm struggling with the next one 😩

[unborn scaffold]

sure @pastel narwhal

[pastel narwhal]

You can message me directly if you want

[timid grove]

the DELETE section ?

[azure marsh]

Yeah, I think I've uploaded the flag.php correctly. Now I'm stumped lol

[deft void]

I'm curious as well. I don't understand why it says, "try to get admin", but it's already pointing you to the admin directory when logging as guest. Also tried decoding the base64, editing and encoding back to b64 to no avail.

[timid grove]

pay attention the page when u login as guest, and match it with the cookie

[azure marsh]

You're on the right track.

[rustic sage]

hi

i had a question

will i need to use

kali linux

as soon as i start learning cybersecurity and networking

[azure marsh]

Can do. I prefer Parrot OS though.

[rustic sage]

what's the best os out there for ethical hacking and pen tests

[urban sage]

Not necessarily no. You can technically work of any Operating System. Some flavor of linux is helpful but not required. Just be ready to do a lot more jumping through hopes as far as tool setup if you opt for Windows for example. Having a VM is sufficient though.

Best is relative. It depends on the opinions and experiences of the person you ask.

[rustic sage]

i'm currently working with linux

is it enough..??

[azure marsh]

Thats a matter of personal preference

[rustic sage]

what do you guys prefer

cuz i'm new to this

my actual speciality is web development

but i've shifted my interests towards cybersecurit

[azure marsh]

Just try different ones and see what you like working with.

[sudden summit]

for pentesting Kali your best option. It comes with hundreds of tools preinstalled for pentesting.

[smoky prism]

I prefer Kali, Parrot is great as well

for pentesting at least

[raw lynx]

I will give it a try - thanks for the hint

[summer silo]

In the Obfuscation section, the decoding question says to send a curl post to serial.php with the decoded flag... but when i add the -d "serial={decoded} I get it to return the encoded message from before... and i not using the -d right?

Turns out i was doing it wrong.

[azure marsh]

So I've uploaded the php ... anyone got a hint for me?

[sudden summit]

You should be able to browse to php you uploaded if it was done correctly

[azure marsh]

I guess I've done it wrong somehow then 😦

[sudden summit]

Check for a space between cat and /flag

[azure marsh]

yea there is. Just coming up as a blank page. I've obvs put it in the wrong place.

[sudden summit]

Try and test by uploading a simple txt file to narrow down where your mistake is.

txt with some txt inside. If your getting a blank page with the php file and not a 404 error then youv uploaded it correctly only the php syntax is wrong

[azure marsh]

mind if i DM you how I've uploaded it?

[sudden summit]

yeah no problem

[nova moss]

Why the website doesn't load at burp?

[tropic field]

To this question: Based on the commands you executed, what is likely to be the operating system flavor of this instance? (case-sensitive). I am in the system where all the specs are written, but I don't understand which one is right

Otherwise, following the instructions, I went to the bash terminal. But when I enter uname -a I don't know what to do anymore. I press enter but it goes to the end

[azure marsh]

Ive had that before. I just shut all the programs down, refreshed the target and started over.

[nova moss]

@tropic field If have the problem yet DM me if u want

[nova moss]

okok, ty

[white geyser]

hey guys, I am having problems with the Linux / Service and Process Management. The task "Use "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles" as the answer.". systemctl show the apparmor.service, but neither the "apparmor" nor "apparmor.service" work. Am I missing something? Thanks

[raw lynx]

Thanks I've didn't saw the correct question but now I understand the mistake I've made - I was now able to solve it with few adjustments. - many Thanks

[fathom oxide]

Hey guys I'm doing the linux fundamental module and I'm struggling with the find exercise.

"What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k".

I used
"find / -type f -name *.conf -newermt 2020-03-03 -size +25k -size -28k"
and it's not working.

[timid grove]

Its not working or it prints out alot of stuff ?

[fathom oxide]

Sorry, it works but it prints a lot of stuff including directories

[timid grove]

Have u learnt how to redirect output ?

[fathom oxide]

You mean using either | or ; ?

[timid grove]

Redirection like < or >

[fathom oxide]

I see no I haven't, i guess I'll look into it now. I just thought from the example it gave that the find function should filter it to options already set. So to clearly understand is the command that I wrote that prints all those input matches the filter I placed in?

[timid grove]

I guess thats later in the page u will learn

Try to play around w grep. Everytime u grep it will highlight the word fr u

[fathom oxide]

Cheers mate! Will do

[raw lynx]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

I'm stuck on this question. I've tried to grep the output based on https://www.inlanefreight.com but I don't see any "unique" paths with number just few js version Numbers like 5.4.4. Can someone explain me please how I can format the output corrently ?

[rustic sage]

help

q2

[timid grove]

Have to keep on filtering till u only see domain path .

[shut juniper]

guys

whats scorpion 3.0 it s a game???

[round vortex]

Hello guys !

I need some help in the web fundamental room

[raw lynx]

curl https://www.inlanefreight.com | grep https://www.inlanefreight.com | sed 's/.*https://g' - I still only see the Js Versions and not more. Anyway thanks for the hint. I think I have to search until I go crazy..

[quick lintel]

hello

i need help in file inclusion assessement

Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Submit the contents of the flag as your answer.

i was able to get the php code for the index page

<?php
if(!isset($_GET['page'])) {
include "main.php";
}
else {
$page = $_GET['page'];
if (strpos($page, "..") !== false) {
include "error.php";
}
else {
include $page . ".php";
}
}
?>

i can see that it is appending .php extension so i tried null byte but didnt work, most likely because it is a new version of php 7.3, I tried to use remote file inclusion, i created a file on my webserver and added it to the link still not working

any help or hint will be greatly appreciated

[tropic field]

Hi, I finished the introduction course at the academy. Which module do you recommend to start with?

[rustic sage]

i want to start learning ethical hacking

any ideas where to start

[ivory dock]

Hi i am currently doing the file transfer modules and have the following task: Upload the attached file named upload_win.zip to the target using the method of your choice.Once uploaded, RDP to the box, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.

My question is: How should I upload the zip file to the target? If I download it, it is stored on my Windows host system, but without VPN I cannot upload it to the target...

[burnt stone]

Go for the Tier 0 modules

[ivory dock]

I tried connecting via vpn and uploading it via Win Powershell but the server responses with "403 unauthorized"

[rustic sage]

where are those

[tough fjord]

Https://academy.hackthebox.eu

[raw lynx]

did you solved it ?

[uneven dock]

Soo im stuck at linux fundamentals > system information > what is the path to htb students mail. Could someone help me with this please? I cant find it

[flat star]

Hello all, i am on the WebRequests, and on the Request and Responses part, i have this question " What is the HTTP method used while intercepting the request? (case-sensitive)", i already respond corret to the 2nd question, but i dont know this. Somebody can help me? Thank you all.

[rare bolt]

Yup.

[nova moss]

are you stuck yet? If yes dm me

[wispy tree]

I've tried --lock, --lock --expiredate

various other options ;p

[nova moss]

What module is it_

?

[wispy tree]

Linux Fundamentals/User Management

[nova moss]

Try refreshing the page

And try what you have tried before

bc you have the right answer

[wispy tree]

Wow, ty lol

[nova moss]

I was in the same problem two days ago haha

[radiant bison]

I am stuck here too, is there any hints with only 2% that won't completely give it away lol

[rustic sage]

hello, I’m trying to connect to a VM via ssh but when you ask me the password is not accepted

[wispy tree]

Trim the fat ;p

[small basin]

just copy and paste it to prevent misspelling

[rustic sage]

Can someone help me with this question? = " What is the name of the network interface that MTU is set to 1500?"

[wispy tree]

ifconfig?

[rustic sage]

What should I find in ifconfig?

I found it thanks!

[wispy tree]

Right on 🙂

[azure marsh]

Does anyone know of a reason that may ffuf to run painfully slow?

[timid grove]

I feel it depends on what u fuzz, or connection or hardware . Something like that .

[azure marsh]

Fairs

[timid grove]

Hm let me see . 1% will be =

After decoding yr cookie without changjng anything, does it look the same with the login message ?

[young scaffold]

In Linux Fundamentals it mentions "It is highly recommended to set up our virtual machine (VM) locally to experiment with it." Where can I download this VM?

[wispy tree]

look into virtualbox and a ubuntu vm

Message #modules

[young scaffold]

Thanks @wispy tree

[lofty moat]

Hi, Stuck with the CURL question on linux fundamentals. "Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com/" website and filter all unique paths of that domain. Submit the number of these paths as the answer." I tried several ways . Downloaded the file using curl to curl.txt and the last command I tried was - cat curl.txt | grep https://www.inlanefreight.com/ | grep -n href | sort --unique . Can you guide me here please

[knotty lantern]

What is the version of the Apache that the first target web server is running on? (answer format: X.Y.ZZ)

i didn't understand this question

any help ?

[tulip meadow]

Hi guys, I'm replying to this message to point out that -at least for me- the question was not clear;
I've interpreted the "Not on localhost and IPv4 only" as I had to consider all the interfaces (localhost, ipv4 and ipv6), maybe I was interpreting it as "not only on localhost and ipv4" ..idk, probably is my lack of grammar, but have it written as "Not on localhost, IPv4 only" would have been better 😄

[hollow garden]

hello again, i'm still stuck on the 2nd question on hardening tips section on file inclusion module, i can't figure out how to use the curl command to execute a .php file , the section doesn't mention it (or maybe i'm blind)

[tough fjord]

Isnt the hardening question about examing what happens when you try to run it? Checking error logs

Rather than actually getting code exec

[viscid moth]

I'm getting an issue in finding total package installed on the target

I already tried apt , dpkg

To list package installed and saving the result and then using wc -l to find total number

But the answer is different I guess

[tulip meadow]

just google it, found the solution in the first results, but no explanation of the differences from one command to another

[viscid moth]

Okay thanks I'll try that

[tough fjord]

Look at the output of the commands

Wc will count all lines

Maybe some of the lines are not relevant to being an installed packagr

[hollow garden]

@tough fjord yes, but to get an error log i need to exe it right ?

[tough fjord]

No. Im pretty sure it tells you to sign in so you can see what is happening in the logs when you try to exploit jt

[sage basalt]

Hello, I'm currently having an issue with the "Linux Fundamentals" module

[wet swallow]

What is the issue?

[hollow garden]

@tough fjord well i tried looking at error logs but nothing about system function

[sage basalt]

In the "System Information" section on the module, I'm unable to ssh into the target server with the provided password.

[wet swallow]

You need to type this command:

Ssh username@target_ip

and click on enter

Then type yes and then type the password

You will find the username and password and the target ip with the question

[sage basalt]

Awesome - thank you.

[wet swallow]

You're welcome

[sage basalt]

As for the final four questions of that page, are there any other outside resources in particular that I could look up in order to find the answers?

[rustic sage]

Hey I have a problem

I have to connect to a network using ssh but I can't figure it out

[sage basalt]

which module?

[rustic sage]

Linux fundamentals

[raw lynx]

ssh username@target_ip

[rustic sage]

ah ok

[sage basalt]

I'm unable to find the proper command for "What is the path to the htb-student's mail?"

[raw lynx]

You have to check the question they asking for the mailbox of the user not the general one.

[rustic sage]

heyyy thanks

it worked

[sage basalt]

How exactly do you find it? Not looking for answers here, just general guidance in order to further understand what I'm working with

[rustic sage]

check out all the commands you learned

[sage basalt]

Am checking, thanks

[timid grove]

U got 1 extra character that is not needed

[timid grove]

Its all on the same page .

[sage basalt]

Okay, thanks.

[worldly cradle]

Hello, in the POST method, i have not clear the answer that i have to submit.

anyone can help me?

[real vault]

Linux fundamentals => Filter contents => Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com/" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

hi, i am stuck at this point, i don't get it clear about the unique path, it just take the path or with the filename ? going crazy right now

[wispy tree]

I'm stuck on this also, but I think you need to grep the number of www.inlanefreight.com incidences in the source code and count them. Not sure tho

Message #modules

[real vault]

already did, but wrong answer lol

[wispy tree]

same 🙂

[real vault]

should we bruteforce the answer from 1 to 100 ? lol xD

[wispy tree]

lol thinking about it

lol I just did it 😆

[tough fjord]

All instances of the domain with dirs. Then only count unique ones

[real vault]

okay, thanks for the clue

[foggy sinew]

hi all, can someone give me a hint on the Linux Fundamentals module?

[tough fjord]

Need to be a bit more specific

[foggy sinew]

sure, I'm on the File Descriptors and Redirections page, and can't answer the 1st question, "How many files exist on the system that have the ".log" file extension?"

I've ran the command "locate *.log | wc -l", got 24, but the question is not taking that as a answer

[tough fjord]

Try using find instead

[foggy sinew]

thanks!

[wet swallow]

So every dir of that html page?

[tough fjord]

Every url for inlanefreight

[next zephyr]

hey can any one tell me how to get student discount for HTB if i dont have student email id

[nova moss]

I haven't noticed that discount for student exist in HTB, how can I get one?

[low musk]

Also stuck, let me know if ya'll are able to figure out any specifics

[wheat marsh]

Can someone help me understand web requests GET module? im not sure where the flag.php is coming from as it was not mentioned in the section. this is part of the questions at the end.

[native burrow]

Pinging you in DM

[raw lynx]

I got a really easy question - why cant I make this symobl in bash ` ? I need it for the PUT and DELETE Question and can't even make the symbol in vim.

[tough fjord]

Ive made it. Whats your keyboard layout

[raw lynx]

Switzerland German - I even changed it

[wet swallow]

Wdym with every url?

[tough fjord]

As in you need to count all the unique full url for inlanefrieght

[wet swallow]

So I need to filter the url with grep

[tough fjord]

Yes

And remove the other junk

[wet swallow]

Oh ok

And use wc -l

To count

[tough fjord]

Once you've got unique ones

[wet swallow]

Alright

Ty

And for the second question

I used this command:

Ps -au | grep ProFTPd | wc -l

Something wrong with this command?

[native burrow]

You need to only count uniques right? That cmd will also count duplicates

So see if you can find a way to sort out the unique ones

[wet swallow]

What do you mean with unique?

So 1 of each?

[radiant bison]

it is the same. as the login message.

[native burrow]

Unique list would be a list with only one occurrence of each line

Only one occurrence of each domain/path etc

[wet swallow]

Oh ok

I am now using Cut

But it don't works well

[native burrow]

Do you have the exact question from the task?

[wet swallow]

Cut -d "/" -f1

Yeah this is the question:

Use cURL from your Pwnbox to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain.

Submit the number of these paths as the answer

[native burrow]

Alright, and what do you have so far

[wet swallow]

I have found the paths with grep

Like grep https://www.inlanefreight.com

But there are other things

So i need to cut but idk how cut works

I guess

[hollow garden]

Hello ! On the File inclusion module, trying to do the final test ! This is my first time going by myself, so I don't really know where to start. Do I need to try every single technique that is shown on the module and hope that it'll work ? Or is it better to try to get more infos on the machine ? And if yes how ?

[native burrow]

Lets say you have a line which looks like this
field1;field2;field3
You pipe to cut, set the delimitor to be semicolon with -d ";" and say you want to get field 2, you set it as -f 2

[wet swallow]

Yeah

[native burrow]

So it would be cut -d ";" -f2
Thats how it works in simple terms

[wet swallow]

But how with urlsl

Url

Like href="https:// ....

I can't find any semicolon

[raw lynx]

anyone got an Idea why I can't upload with curl -T flag.php

[native burrow]

Semicolon was just a general cut example. I solved mine using regex, but there's definitely ways of solving it simpler for non-regex'ers. Trying to think something out

[wet swallow]

I tried

With this:

Cut -d "." -f2

[native burrow]

Is flag.php in your current directory?

[wet swallow]

Because url have dots

I got a list with url

I added wc -l

But answer is wrong

[native burrow]

The task is asking for unique URL's

So see if you can sort out the duplicates

[wet swallow]

Oh

I will count

😂

[native burrow]

No you wont

[wet swallow]

Oj

Oh

[native burrow]

You will find the correct cmd :)))

[wet swallow]

Ok i will tey

Try

[native burrow]

it's just one pipe, you can do it

[wet swallow]

Alright

1 tip

Is it wit cut?

Or other command?

[native burrow]

Negative

You want to sort them unique

[wet swallow]

Oh ok

I will rey5

Try

[native burrow]

You can do it

[raw lynx]

I think I found a problem - just have to reset the whole machine I will give you a feedback (yes it is in the current directory)

[native burrow]

Gotcha. I don't see a reason for cUrl to not work as the --upload-file/-T flag is using PUT

[radiant bison]

I was able to get it figured out. Thanks.

[tough fjord]

@wet swallow the aim of the exercise is to get you used to being able to extract that type of info from a file.

[wet swallow]

Oh ok

I will try everything

[tough fjord]

As you may need to do this next time and use those urls to scan something

[wet swallow]

Oh ok

Sorry

[tough fjord]

Its worth the struggle now. As you will benefit in the future

[wet swallow]

Yeah your right👍

[tough fjord]

Lots of pentesting is taking large amounts of data. Quickly pulling out what you need and then using that in another tool / scan. The quicker you can do those things the more effective you become

[wet swallow]

Oh thank you for this👍

now I know

[spark wyvern]

npm question done

[hoary quest]

Can anyone please help me?

How and where do I spot a non-standard directory

And what is it? I can't find any useful information on it online

If someone actually replies please @me

Please

[native burrow]

Whats the context @hoary quest

Non-standard as a non-system generated directory?

[hoary quest]

I'm on the fundamental modules on operating systems, I'm new to this, I'm not sure. I can send the question if that helps?

"Find the non-standard directory in the C drive. Submit the contents of the flag file saved in this directory."

I've been stuck on it for hours

[native burrow]

Okay. I haven't done the Windows fundamentals module myself, but I guess you may need to enumerate the directories in a way. I.e. figure out whats supposed to be there and whatnot. Manual enumeration is a thing (crawling through directories yourself), or scripts.

So unfortunately I can't nudge you in the right direction here, not having done it myself. But now that there's more info here, I'm sure someone will come up with something soon

[hoary quest]

Thanks for the help, can you explain roughly what a non-standard directory is? There is a lot to look through lol

[native burrow]

If I have to guess, something not added by Windows itself

Something user-generated

It's just a small section of a fundamental module, so it's probably not deep (if this is the way of solving it). Once you know how the Windows structure is, it's easier to spot abnormalities. Good luck, I'm hitting the hay now

[hoary quest]

Thank you for the help :)

[rustic sage]

I need help

Which option needs to be set to execute a command as a different user using the "su" command?

It's sudo afaik

from linux fundamentals

[rustic sage]

i'm stuck at here

[wraith walrus]

Guys I am stuck

Idk I looked for hours and tried possibly everything but still dint get the mail directory for htb-student

I am talking about the Linux fundamental module

Pls I need help

[rustic sage]

try every single command on the workstation

[gray ginkgo]

good morning! is anyone around with the patience to explain a couple of things for the Buffer overflow module?

[rustic sage]

hlw

Can you help me a bit ??

[gray ginkgo]

i can try

pm me

[glass summit]

@gray ginkgo pm me, haven't looked at the module but I may be able to help.

[civic marsh]

Can somebody elaborate on what I'm supposed to do within the Web Requests POST Module?

The goal seems to be to log in to guest to get the admin token.

[summer silo]

@civic marsh the goal is to elevate your self to admin and get the flag

@wraith walrus have you googled it? And if so what did you google.

[civic marsh]

Thank you, I'll try again in the morning @summer silo

[civic marsh]

While I have you though, is this something that can be done using only Burp? @summer silo

[summer silo]

I did it using burp

Not sure if its there are other methods tbh

[cloud crystal]

so do you mean this is the only way to get to the next page? been having the same problem here

[verbal frigate]

I did it yesterday, you should check the hint, it’s easier than you think

[thorny monolith]

I'm also stuck on the POST question, I guess getting to something like "Admin panel...Welcome,<username>" is not enough? I guess the cookie is supposed to be printed on this page?

[thorny monolith]

nvm, got it, it's simpler that one originally thinks

[tiny karma]

Hey guys, can anyone help me please, I'm lostin section Linux Fundamentals. I've tried a lot's of commands I can't figure out... how you connect to ssh server? do you use FTP? FTP 10.10.10.2 21 ? or are you using another method, I've tried through smbclient and I can't succeed. msfconsole doesn't allow me to connect to the server,please give me a hint how do you connect with the machine, I'm already stuck for couple of days . I'm mentioning i'm using HTB machine from linux fundamentals

[viscid moth]

It's ssh name@ip

You are already provided with username and password@tiny karma

[tiny karma]

so, basically, I don't need to connect to FTP? right? I'm a bit lost, I was diving through many websites and lots of information. I think I've lost my path and I get confused. Thank you for your answer. I will try to find out how to get to the solution.

[tiny karma]

thanks a lot , I finally get in in the right way.. all this time I was trying to connect through FTP, I'm so silly 🙄

[viscid moth]

That's okay that's how we learn 🙃

[tiny karma]

From mistake, you right. Appreciate

[civic marsh]

Okay so I think I've made progress. I've made it to the ||admin's admin panel and can see its user name||. I didn't realize the ||sequence after the guest's name was a cookie. My programming backfround made me think it was just a unique ID denoting the user.||

Now still a bit stuck. Trying to figure out what the question is expecting as the answer.

[tough fjord]

@civic marsh so your background knowledge was right about it being a unique ID to seperate the multiple guest accounts

[civic marsh]

Okay, so I see what you mean. I'm not so sure I've access the admin panel or multiple guest panels. Looks like I'm getting "Welcome, ???" where ??? is 3 different garbled strings.

I must be missing something 😂

And the string seems to infinitely change based on the auth cookie.

[tough fjord]

play with the cookie, decode / modify / encode / submit. Try things out and see what happens

[civic marsh]

Okay so thank you for the hint. I got it. I wans't aware of the decoding tool within Burp nor did I even think to do that

Not a cyber security guy I guess

[fresh wolf]

Hello guys, I'm new to HTB academy :)
Can I get some help please. I'm really stuck and confused about RFI section

[civic marsh]

@tough fjord Sorry to disturb, just can't get the POST thing out of my head. This seems to be an example of bad security. I would imagine that's why it's in the beginner / tutorial modules. Would another example of this (perhaps even higher security) be account encryption? So instead of encoding / decoding we'd have to decrypt a password?

[tough fjord]

yeah this is just an example of a really really bad way of using a cookie for continuing authentication

[civic marsh]

Gotcha, thank you

[spring sonnet]

Is any issue with the first question of the JavaScript Deobfuscation module known? Pretty sure i've got the flag, but it isn't accepted :/

[spring sonnet]

Okay, forget it. Seems to be a layer 8 problem. Flag was accepted now.

[tiny karma]

hey guys, can anyone help me at least just a hint about Linux Fundamentals adduser or useradd," Which option needs to be set to create a home directory for a new user using "useradd" command?" I've tried both with Sudo , I actually creat user I give root privilege in visudo, but nothing works.it is an entire phrase or just a letter? adduser -d ... thank you 🙂

[gray ginkgo]

check you PMs

[fresh wolf]

Hello guys, I'm really new to this. Can anybody give me a hint regarding the remote file inclusion. I started the http server but I can't see any requests. allow_url_include is also set to on.
I get this: "Warning: include(http://localhost:8080/file): failed to open stream: Cannot assign requested address in /var/www/html/index.php on line 47"
Thanks for your help 🙂

[dusty atlas]

I'm struggling in finding the htb-student mail, can someone nudge me in the right direction?

wait

I might have found it

[gray ginkgo]

@dusty atlas look around, check your surroundings, the environment is your friend

[dusty atlas]

thanks. I thought I found it but I was wrong

nevermind. lol I was typing it wrong

[rain pasture]

I finished almost Linux fundamentals but one thing I couldn't solve

finding path to mail

I tried

/var/mail

/var/spool/mail

But still not working

[ivory viper]

I'm doing that right now and I have the same problem

[timid grove]

@dusty atlas @rain pasture @ivory viper try checking ur environment

[ivory viper]

Thanks. That worked

[dusty atlas]

I was able to figure it out. Thank you.

[timid grove]

good job !

[harsh cove]

facing issues in running the python scirpts like impacket, GetNpn users etc.
get an error that module not found. But when try to install the package or module it says requirmmet already satisfied.
Any help ?

https://cdn.discordapp.com/attachments/425588397516521484/790870454188900372/unknown.png

[inland sparrow]

Im stuck at the question what the kernel version is on the system. I tried everything but my answer keeps incorrect and i dont know what to do any more. I tried it with the command like cat /proc/version , but also uname -a or uname --kernel-version but all the answer i give with the info i get from the parrot terminal or wrong can someone give me a hint?

[tough fjord]

have you ssh into the target and ran the commands there?

otherwise the answers will always be wrong as the web vm instance isn't the target

[inland sparrow]

ssh?(Secure Shell?), I dont know exactly what you mean with in ssh into the target, sorry

[tough fjord]

right next to the questions there is a link that says something like click here to launch target instance

that will then turn into an IP

you then need to use SSH to login to that target using the credentials provided

and that is what you are meant to get the answers from

[inland sparrow]

and the ip i just need to enter in firefox?, sorry really a noob here

[tough fjord]

no, you need to use ssh to login

ssh username@ip

then it will ask for a password and you give the password it says

[inland sparrow]

oke now i get it thank you

@tough fjord Really thanks i didn't get there without your help

[rustic sage]

yo guys, why can't i see the htb:serious discussions

[tough fjord]

because you are not verified?

[rustic sage]

verified as what

like an administrator

or a moderator

[tough fjord]

read #welcome

it has full details

[hollow garden]

Hello ! On the File inclusion module, trying to do the final test ! This is my first time going by myself, so I don't really know where to start. Do I need to try every single technique that is shown on the module and hope that it'll work ? Or is it better to try to get more infos on the machine ? And if yes how ?

[timid grove]

#774040485748539423 message

refer to this message

it ask for file name

it doesnt want the path too

thank you ! 🙂

[sonic osprey]

hey I was wondering if someone could give me a push in the correct direction with this one

assuming I need a role for attachements so I'll just copy the question

Login with the credentials guest / guest and try to get to admin. so I navigate to this site and capture the requests and responses with burp , it shows you an Auth token for the guest user

and you need to get into admin but CSRF would require me to know the admins Auth token

so I'm kinda confused

[jagged roost]

You resolve this?

[jagged roost]

Yo. Resolve this?

[tough fjord]

@sonic osprey you are overthinking. There is no need for CSRF.

[dusty zealot]

Yo. Im working through linux fundamentals and am stuck trying to find a path for this problem, "What is the path to the htb-student's mail?" I don't understand why the path wouldn't be /var/mail

[tough fjord]

Thats a generic path to mail for all accounts

Check your environment

[wraith walrus]

Nope was working the whole day I'll see tmmr morning, btw what shld I check only env values?? Or is there something else

[nova moss]

You must to check your environtment, then you must to give the path to the htb-student mailbox

[opaque elm]

Hi, In Hacking WordPress => Directory indexing, I searched in the directories wp-content, wp-uploads, wp-admin, but I can't find the flag.txt file. I wrote something like this: curl -s -X GET target:port/wp-uploads/ | grep "flag.txt"

I also searched in the sources in the web browser console but I can't find this file flag.txt

[nova moss]

try just using target:port/

Web Request, what is expecting here?

[autumn pilot]

To find a way and escalate to an admin account

[nova moss]

I think I get it, but I must to find what?

Am I not getting yet?

[autumn pilot]

Welcome, guest_blalala, so I guess you haven't

[nova moss]

ohg ok

[opaque elm]

@nova moss use base64 to understand the cookie ...

[small moat]

I am also stuck on this and have no clue how to get to admin from guest.

if someone could dm me or just @ me or something that would be helpful, thanks, I have used base64 to decrypt the guest auth cookie, but I cannot find anything admin related

[autumn pilot]

Please read the material again

the material contain all the necessary steps

[rustic sage]

guys can someone help me on installing a vpn called wireguard on kali linux

becuse the steps are hard and i cant understand them

[autumn pilot]

This is not the place suitable for this kind of questions.

[rustic sage]

then where is the suitable place

like which server..?

[autumn pilot]

More like channel, verify your profile and try asking in #general

[plush flame]

Hello, I'v been working on the Web request post Method section, and I have googled it, read through the material, read through this chat log, used burp to decode the cookies from base64 and resend but I am still missing something. I'd really like to figure this out so I can move on.

Never mind, as if by magic, me finally posted this caused me to understand and get the flag.....

[rustic sage]

For php , type php -h and pass the flag with port

[pliant atlas]

I did the php

That npm one I cant seem to figure out

[opaque elm]

Hacking WordPress => Directory Indexing => I can't find the file with curl... something like curl -s -X GET target:port/mydirectory/ | grep ? or find ?

[pliant atlas]

thanks finally figured it out

[rustic sage]

How? :c

[split sequoia]

stuck with npm too

[west rampart]

What you tried so far @split sequoia ?

[split sequoia]

It’s alright i found the answer, but the hint are opposing

[clever crow]

Can someone give me the Apache version of the „Request and response“ task because it’s not working. Can please someone check this

[tough fjord]

Have you spawned the target

[wraith walrus]

Guys which option needs to be set to exec a command as a different user using the su command

[pearl birch]

I'm having an issue with Linux Fundemental at Service and Process management section this is the task "Use "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles" as the answer"

1. I made sure I'm connected via ssh and check for systemctl services like this "systemctl list-units --type=service

2. Command above pop with apparmor.service beneath UNIT and the description of the service is AppArmor Initiliazation. I copied and pasted this severally to the task answer box however, it keep coming back incorrect.

3. After gathering up some solutitons others have tried using this command systemctl | grep apparmor this output apparmor service with a description of AppArmor Initiliazation and another snapd.apparmor.service --------- loaded active exited Load AppArmor profiles managed internally by snapd

4. I copied and pasted the Load Apparmor Profiles managed internally by snapd description into the answer box and this didn't yield the desire answer again.

I need help with this task, please DM me with your help tips. Thank you in advance for taking your time to help a noob here. One Love!

[hollow garden]

hello, about file inclusion, i don't really understand when do i need to use php wrappers, any help ?

[gentle grove]

hello

[novel schooner]

hello everyone

[pearl birch]

Be more elaborate and maybe I can help. What's the module you're talking about and what section?

[nova moss]

I'm not in that module, but I have the logic in my mind

[dusty zealot]

@pearl birch I am stuck on the same task.

[dawn vapor]

how can i help you?

[dusty zealot]

I don't understand the nature of the question. "Use "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles" as the answer." I can follow until it asks to '...submit the x'. For reference, I have been able to run execute the systemctl and find the apparmor.services row.

[dawn vapor]

as far as i remember after getting the services try to grep for apparmor and you will get the unit name

[dusty zealot]

Thanks

[pearl birch]

Great... That was what worked for me as well.

[woven quest]

OH MY GOD I FINALLY DID THE GUEST/GUEST THING

I AM SO STUPID

if anyone needs help dm me

its simple as hell

[fresh wolf]

Hey guys, can anyone give me please a hint regarding the
Skills Assessment - File Inclusion/Directory Traversal. I've tried everything from the course but nothing seems to work. Thank you in advance ^_^

[inland sparrow]

Wenn installing git should i log in on the system also??

[wooden wyvern]

@inland sparrow i don't think so

[inland sparrow]

@wooden wyvern you right i just did something wrong

[rustic musk]

https://image.europafm.com/clipping/cmsimages02/2020/04/24/884182AA-7611-44B4-99CE-ADCCC08ACD76/69.jpg

[patent blaze]

In Linux fundamental - User management I try to sudo cat /etc/shadow into htb-student and it says itsn't one of the sudoers file. Was that suppose to happen ?

[sudden summit]

you need to have sudo privileges to use sudo. If you do a "sudo -l" it will show you what you can and cannot sudo

Sudo=Super User do

[patent blaze]

thx

[stable pagoda]

Hello, How were you able to solve this issue

[stable pagoda]

How did you resolve this, I got the decoded messgae but get error of wrong answer

[patent blaze]

what does the message " sorry, user htb-student may not run sudo on nixfund " mean ?

[inland sparrow]

sudo -l

[inland sparrow]

I'm trying to install OpenSSH. Im using the command sudo apt-get install openssh-server. But i need to insert a password. What am i doing wrong?

[rustic sage]

In local machine you are trying or in ssh

[inland sparrow]

in ssh

[rustic sage]

Try in local

In which tutorial you are in

[inland sparrow]

in linux fundamentals

[rustic sage]

What is the task

[frigid monolith]

Sounds like that will be in the Service and Process Mgmt

[inland sparrow]

yes

[frigid monolith]

Are you trying to install it on a local Linux VM or the Pwnbox provided by HTB?

[inland sparrow]

the one provide by htb

do i need to do it on a local linux vm

[frigid monolith]

no

Check it might already be installed.

run the 'systemctl [start|status] ssh' command

[rustic sage]

Htb machine is not a sudoer

Pwnend machine

[inland sparrow]

the status is active

[frigid monolith]

so I guess you can skip installing it then.
I wasn't sure if I needed to install it myself.

[rustic sage]

What are you installing

[frigid monolith]

ssh server

I think it was already installed on pwnbox

so you can skip that step in that section

Meanwhile, I have problems of my own :-).
Under Linux fundamentals -> Filter Contents,
I am having difficulty pinpointing the expected answer for - "the number of services listening on the target system on all interfaces?"

I have ran "netstat -ln" for all listening services, and filtered for only tcp/udp (no joy), and also included unx stream (still no joy)

[rustic sage]

I am not on that module yet but maybe you can use Nmap scan from your local machine

[frigid monolith]

yea I thought about that, but I am on the target machine itself an can list all listening ports. I have to give a number for the answer, and I'm afraid that even if I missed gave a number -+ the answer it will be wrong.

[rustic sage]

Sorry then bro

[frigid monolith]

Thanks @Mr. Venom. It's seems we are all pretty close in the areas we are working on so we should be able to bounce off each other.
Thanks again though

[inland sparrow]

@frigid monolith @rustic sage thanks I'm a task further maybe I can catch up with yall and help yall out were i can

[frigid monolith]

Cool. let me know when you get to 'Filter Content'

[rustic sage]

can you tell me how can i find index number of sudoers file

[inland sparrow]

@rustic sage ls -li sudoers if im correct

[rustic sage]

thnx bro

[inland sparrow]

Im trying to find a config file that is larger dan 25k but smaller then 28. Only i dont get no file that has that kind of data? where do i go wrong?

i use the command :
find / -type f -name *.config -user root -size -28k -newermt 2020-03-03 -exec ls -al {} ; 2>/dev/null

[frigid monolith]

@inland sparrow you can actually specify two -size options within the find command, such that one will be files above a certain size and the other will be for not more than that size, that way you can limit number of files that show in the output of the command

[inland sparrow]

@frigid monolith thanks

[thorny monolith]

just play around by chaning the cookie to the value desired, re encode it and send it forward. You will see the flag on the welcome page when it works

[rustic sage]

@frigid monolith you can try

[frigid monolith]

Thanks @rustic sage I just tried that but still no joy.

Are you on that section now?

[rustic sage]

not yet

send me the pwned ip

i will find the answer

[frigid monolith]

I can wait really. that will take away from your time. Don't worry, just let me know when you get there, no rush.

I'm still searching myself.

[rustic sage]

actually i need your help in previous sec

[frigid monolith]

oh what section is that?

[rustic sage]

file decriptor

[frigid monolith]

oh right. which of the questions?

[rustic sage]

both

actually i tried command both on my local and target machine but the result was wrong

[frigid monolith]

So for the first one, use the 'find' command, but take out all the -user -size and all that and then pipe it into 'wc -l'

I think that should be useful

[inland sparrow]

im almost there @rustic sage, i just dont understand what they mean with submit the full path of the xxd binary

[frigid monolith]

the full path of the xxd command on cli

how do u get the full path of a command?

[inland sparrow]

i dont know

this is the question:
Submit the full path of the "xxd" binary.

[frigid monolith]

the binary is the actual command that we run on cli. so remember one of the sections talked about how to get the path of that command

😅

[inland sparrow]

no got it

i go to bed

im just tired guys

[frigid monolith]

hahahaha, yes tiredness never helps.

[frigid monolith]

@rustic sage By the way make sure to redirect errors (fd 2) to /dev/null before piping to 'wc -l'

Just like the sample find command in that section.

[rustic sage]

like this find -name .log 2>/dev/null | wc -l but i am getting wrong answer

[frigid monolith]

you should list the files that you find first, so that you can count them, and remember to tell find where to start the search from, in this case it is the root directory /

so add the exec option:
-exec ls -al {} \; 2>/dev/null | wc -l

[rustic sage]

still getting 0

[frigid monolith]

oh just noticed, please make sure you are using:

-name *.log

don't omit the asterix

[rustic sage]

still wrong answer can you tell me which command you have typed

[frigid monolith]

Not sure I can do that here :), but you can DM and we can work through it.

[rustic sage]

hi

my xrdp segfaults when i try to paste the clipboard into the win vm. any tipps ? Thanks

[teal lion]

How can I find one of the non-standard update services running on the host ? For the Windows Fundamentals Module

[knotty lantern]

guys

i have a question how i can find an apache ver in burb suite ?

burp *

[thorny monolith]

server header

[novel schooner]

hi everyone, i'm wrapping my head around the POST moethod in the Web Requests module. there is anyone able to give some hints?

I decoded the guest cookie, and I changed the first part to "admin". encoded and sent to the page. Now the page tells me "Welcome, admin_blablabla", but it's not the solution... Any suggestions?

[mortal rose]

You're on the right track. What else can you change the cookie to?

[novel schooner]

Hey there! I tried to identify the second part of the cookie, thinking "maybe this is some kind of hash", but nothing... Usually, i expect the cookie to be some kind of session identifier, and in the real world, I'll try to steal some admin sessionID, to resend to the app. right now, i'm out of ideas! 😄

[rustic sage]

I dont get the answer right on (1.00)365 = 1.00
(1.01)365 = 37.7 because of the language issues.. Im From Northpole.
In the Learning Process box..I don-t get it what is mentioned with that

What is the difference between the two numbers of the learning progress mentioned above?

[drifting knoll]

check the hint

[rustic sage]

I did.. 36.6

[drifting knoll]

then check your math

[rustic sage]

Just dont get it..

[drifting knoll]

37.7 - 1.00 = ?

[rustic sage]

36.6

[drifting knoll]

no

[rustic sage]

36.7

Sorry.. now i go and run againt the wall with a laugh 😆

Have a Nice Holidays ya all..

[inland sparrow]

with the command dpkg -l | wc -l i get all packages installed i thought. But thats not the correct way can somebody give me a hint. The question is:
How many total packages are installed on the target system?

@rustic sage thanks

[rustic sage]

Hi question to win fundamentals how do i find the correct non.standart app who is running as the htb-student user ? I tried ctfmon.exe and NordPN.exe but they are not the correct ones Any nuges ? Thanks

[timid grove]

😩

[inland sparrow]

How many total packages are installed on the target system? Can someone give me a hint?

[patent blaze]

If htb-student isn't in the sudoers file what difference would make obtaining sudo's passwd ?

[delicate mica]

Can anyone give me a hint on the Linux Fundamentals - Filter Unique Domain Paths question. I know how to filter down the list but it will not accept my answer, wonder if I'm miss understanding the objective...

[patent blaze]

is there anyone awake ?

[rustic sage]

@patent blaze Sudo does not have a password only the user. If the user is not in the sudoers file but is in diffrent groups than your current user than this can help as you can then execute stuff as the new user with the new group and this may provide you with a way to privesc

@patent blaze also some kernels can be exploited, even if it is discuraged from hbt but it ist still possible

@delicate mica this exersice is very poorly worded and i did not knwo what they wanted from me either. Do they just want the urls oder the whole lines with the urls this is not clear. You will find some of the questions are like this - in the end i just brute forced my way trough that

@inland sparrow use google to find the correct command and then use less to see that you should not count the lines automaticly

[patent blaze]

thank you so much

So I don't have to get access? Just get the right command line ?

@inland sparrow

[rustic sage]

@patent blaze what is you specific question ?

[patent blaze]

sorry

I misunderstood the messages here

[inland sparrow]

@rustic sage @patent blaze thanks i got the solution tho

[rustic sage]

no worries - what question do you have or did it clear up ?

[patent blaze]

so so. I'll keep on trying get over the user management part

[rustic sage]

what module and what section ?

what is not clear ?

[patent blaze]

linux fundamentals - user management

[rustic sage]

ok found it

[turbid scarab]

In the ffuf module, RE: adding admin.academy.htb to the hosts file - do you add both academy.htb and admin.academy.htb with the same IP? Do you only add one of them? I'm struggling with the syntax of running a recursive scan on admin.academy.htb and I can't figure out why. Are we ever meant to be writing the domain name once it's been added to the hosts file or only using the target IP?

[obtuse magnet]

I've got two questions that I know I have the correct answer for but keep getting an incorrect response. I've got screenshots but don't want to post answers directly in the chat.

[rustic sage]

@patent blaze what is not clear to you ? What part ?

@obtuse magnet shoot me a DM 🙂

[obtuse magnet]

The one I'm in now is Javascript Deobfuscation and the question is in the info.

Will do

[patent blaze]

Since I do not know all the linux commands, I was searching through the web how I could get around it, and after running :

groups cry0l1t3

is returns :

cry0l1t3 : cry0l1t3 sudo

Based on my knowledge I presume that its telling that this account it belongs to sudo's group somehow.

I also tried to change htb-student and the other accounts with usermod but all those commands require sudo privileges.

When I try to :

useradd --create-home htb-student

it returns:

already exists. I get that answer when I change for mrb3n as well.

If I try to do that with cry0l1t3 it says "permission denied"

[rustic sage]

@patent blaze ok with groups <username> you get the group this user belongs to. if you use groups without any uder behind, then you get your groups wich are not in sudo as i would guess. why do you want to change the users ? just to experiement ? it is not required to finish the module and it will not work as htb has to preserve a clean envirement...

[patent blaze]

well, I wanted to change the user 'cause i thought that maybe I could then perform a useradd and then discover the right answer for the exercise, but it seems that this is not required, right ?

BTW, does this exercise need to be done inside htb-student ?

[timid grove]

@patent blaze u dont have to change anything . the question ask "which option" needs to blah3

u just have to give them the option that can be found in the man page

[inner sapphire]

I have a question for Windows Fundamental

[timid grove]

question about finding non windows thingy or ? 😆

[inner sapphire]

yes

like non standard update service

what's that

[timid grove]

i wish i could recall

[inner sapphire]

[timid grove]

its hard for me too for that question

i use grep but in powershell way

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/select-string?view=powershell-7.1

u can refer here if u want

how did u think like that ?

[inner sapphire]

in section Windows service&processes

it can stop this service and not affect to windows

[timid grove]

help us to delete this later

[inner sapphire]

ok

[timid grove]

thank you

[inner sapphire]

it's wrong answer

[timid grove]

question didnt ask for displayname

it ask for the name of the service executable

[inner sapphire]

like exe?

[timid grove]

mhm

[nova moss]

Hi, I'm bit stucked in the Web Request module, in the POST method, could you give me a hint?

[timid grove]

hint says cookies

pay attention to the cookies

[nova moss]

I'm doing

But I only see the cookie for the guest

[timid grove]

mhm thats the clue

compare it with " welcome , blahblahblah " when u log in

[nova moss]

Well, what resources can I see? I have like two days trying

[nova moss]

I login as guest and the cookie is guest_blabal

[timid grove]

mhm

[nova moss]

But I don't know how the admin cookie looks like

[timid grove]

#modules message

tbh, i feel this is a good advice , well said too

[nova moss]

I don't get the method yet, I understand what he saying but I don't how to apply it

[timid grove]

have u tried meddling with the cookies ?

[nova moss]

What you mean with meddling? Get the cookie?

[timid grove]

u know maybe like tamper the information of the cookie or something

[nova moss]

I think I tried but I'm gonna do it again

[inner sapphire]

I still confuse

hahaa

[nova moss]

Well I don't get it

[inner sapphire]

it's not found on instruction?

[nova moss]

If it is I don't get it XD

I've tried many things but I don't know what to do

[nova moss]

I tried

I don't get anything with it

[inner sapphire]

Maybe we're just need to understand the common theory first

[timid grove]

mhm

[nova moss]

I think I understood it

[inner sapphire]

I'm not brooo

@timid grove Get-Service | ? {$_.Status -eq "Running"} |fl

[nova moss]

I don't know what to do haha I have tried lot of things and stucked two days or three

[nova moss]

Windows

?

[inner sapphire]

Yeah for Windows Fundamental

[inner sapphire]

i got it!!

[nova moss]

nice! I'm stucked yet XD

[median token]

Hello I am currently stuck at WebRequest GET. Where do I find the values of num1 and num2 in the question?

[nova moss]

you must set the values

[median token]

Would any value work?

[nova moss]

Any values that added results in 1337

[median token]

Oh ok , I think I messed up in typing the parameters. Thanks for the help!

[inner sapphire]

i think we should learning with the same module

[nova moss]

may haha

[inner sapphire]

then we can discuss

[nova moss]

That is a good idea

[patent blaze]

Got it

[empty zenith]

i currently stuck at web request POST method as well

glad i am not the only one

LOL

[empty zenith]

Thanks a lot!!

[timid grove]

no worries man @empty zenith

[rustic sage]

hi guys im stuck at the web fundaments with the post method. I manged to change the thing and now im in the admin pannel but there is no flag... Where is the flag ? Thanks

guys, how long would it take to become an ethical hacker, like a semi-professional hacker

@rustic sage depens on to much factors, did you work in it before ? how fast can you grab concepts ? do you have any certs in the fild yet ? how much time can you invest etc. however i would say for someone who works in it maybe 2 years to get to OSCP and this is basicly the starting point of being one. To semi pro maybe another 3-5 years there is a liot to learn its like a bacherlors degree volume of stuff so....

lets say if i put basically an hour everyday in studying the theory parts of it and also applying it

for like 6-7 months

[rustic sage]

and i'm still a high school student in grade 12

Then study it with focus on security

[languid fjord]

Wdym by semi-professional?

as in like working in-industry?

[rustic sage]

Cant get the Maschine name with uname.. tried all the possibilities. With Linux fundamentals. Some help?

uname -a and uname -m

What is meant with this question.

[empty zenith]

I don't think it is enough, still, it depends on your comprehension ability.

[empty zenith]

maybe what you are looking for is machine "hardware" name.
I was there too, did some browsing to understand the question.

[rustic sage]

Im looking all the videos etc. and have only Headache.. 🤮

[charred basalt]

i need help with "How many files exist on the system that have the ".log" file extension?"
ive tried find . -name *.log 2>/dev/null | wc -l
any hints?

[rustic sage]

The connections of the HTB Viewer is kinda Laggy.

[rustic sage]

yeah i know, tipp use remina for the rdp windows connections xrdp is kinda buggy

ok im in the local file inclusion section and im wondering: How do i know how many ../ i need to get to / and then down again, this depends on the used technologoy and the sub folders of that tec wich determines where my file is located correct ? So i would have to guess it all the time right ?

[rustic sage]

i am on the linux fundamentals module i am stuck on this question:

What is the path to the htb-student's mail?
i mean i don't understand the question
can anyone help me a little?

[rustic sage]

It is asking that the mail will be saved for htb student in which folder

[rustic sage]

Cant understand the question> Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337.

Use cheat sheet to find the main command then change parameters as asked

Don't put the parameters '=1337'

[west rampart]

@rustic sage can I dm you ?

[drifting iron]

I am currently doing JavaScript Deobfuscation, Source Code. I got something like a flag, but it is not accepting it, can someone give me a nudge?

[rustic sage]

bash right?

but it says wrong *triggered

@drifting iron try to read the whole html code in end of script section you will find the HTB(flag) the whole HTB() is the answer

@rustic sage it should be complete i.e. /bin/shell type

Where the shell information is stored

[drifting iron]

Thanks! @rustic sage Did a lot of something else instead of that. :D

[rustic sage]

omg@rustic sage

thx

[nova moss]

I'm stuck yet, are you?

[empty zenith]

I have found the answer.
Try to check out my previous chat. I have reply to helpful clue

[nova moss]

It didn't help to me 😦

[native burrow]

Where are you stuck on POST? 🙂

[wet swallow]

I am stuck at PUT and DELETE method

[native burrow]

Just slide into my dm's again 🙂

and I'll take a looksie

[wet swallow]

Alright

👍

[nova moss]

I'm stuck on the post module

[native burrow]

Where are you having trouble with it?

[nova moss]

Well, I don't know what to do, I tried sending json, parameters, deleting cookies, changing username of cookie, but didn't work

[native burrow]

Have you tried decoding the cookie?

[wet swallow]

The hint says cookie

[native burrow]

yah

🍪

[wet swallow]

😂

[native burrow]

Nvm, you said you have changed username of the cookie. Can you send me what you changed your cookie to in DM? Just so we dont spoil it completely for others

[mossy perch]

Hi, for linux fundamental, I have to connect to an rdp but it doesn't seems to work, am I doing something wrong? https://prnt.sc/w9vdke

[surreal tusk]

Hey,
im stuck at Linux Fundamentals with question for a while.
"What is the name of the confige file that has been created after 2020-03-03 and is smaller thank 28k but larger than 25k?". For this problem I used the following command:

find / -type f -name *conf -size +25k -size -28k -newermt 2020-03-03 2>/dev/null

and the only thing i got is:
"/usr/share/drirc.d/00-mesa-defaults.conf", but this is the wrong answer(ERROR: Incorrect answer). Plus, I have read File Descriptors and Redirections.
Could somebody explain me this one, please?

Thanks.

[nova moss]

Check your size

-size +25 may be wrong

[surreal tusk]

+25k *

[charred basalt]

maybe the only thing you got is the answer 👀

[surreal tusk]

It's incorrect answer

[nova moss]

Try with the full path or only the file name

[charred basalt]

^

[surreal tusk]

full path of?

[charred basalt]

/usr/share/drirc.d/00-mesa-defaults.conf

[surreal tusk]

the fix is, i used the path instead of name... wow...

my life is a mess

[charred basalt]

nah its alright i did the same

we all new to linux

:)

[surreal tusk]

i've been stuck here for days with this simple find question haha

[charred basalt]

ahahah

[fresh wolf]

Hello guys, can anybody help me a bit or explain to me something regarding the Skill Assesstment of the File inclusion. I'm really stuck at something for like 4-5 day. Thank you in advance 😄

[fair lava]

hey there, I have finished the module "Learning Process" and I just need to answer the question. But no matter what I enter it's all wrong
The question:

What is the difference between the two numbers of the learning progress mentioned above?
I tried: Base, ambition, performance, "If you stop on the mountain and do not climb any further up, you will stay on the same spot.", 0.01, 1%

[pulsar lava]

read Local File Inclusion page in course material again and do exercises. And if you get stuck - redo it again :D. This really helped me.

[fresh wolf]

I've done it already, more than 20 times already xDD

[dawn vapor]

Hello can someone help me with the last step in skill assessment of buffer overflow

how can i view "/root/flag.txt without being root, i am getting permission denied

a hint will be much appreciated

[sudden summit]

gdb is not running as a superuser. You have your working exploit code so now run it without gdb

@dawn vapor

[dawn vapor]

ok thanks for the hint, but if i run leave _msg executable and give it the string value wouldnt that run it as htb-student user, how would it have superuser permissions

[sudden summit]

sudo

its a suid file

means it executes with superuser priviledges