modules

[nova heron]

i don't ni

no

[surreal rain]

@muted mist You should see the spawn nibbles machine on the sections now

[mellow whale]

Shoot me a dm @fresh walrus

[glass oriole]

Hello. I need some tips with the file inclusion/directory traversal skills assesment.
I read and practiced the module completely but i am unable of finding a path into the machine with the resources given.
My actual steps have been:

• 1. LFI --> /index.php?page=/etc/passwd with no output
     --> /index.php?page=../../etc/passwd with output "Invalid input detected!"
• 2. LFI to RCE --> i started a burpsuite against "/index.php?page=/var/log/nginx/access.log" with no output
     --> I am unable to find the PHPESSID of my session
• 3. I refused RFI because there's no VPN connection between hosts
     At this point im stuck and i would appreciate a bit of light, thanks in advance

[muted mist]

YOU ARE THE BEST

[coral badger]

Hi - New to HTB, i understand you can get CPEs for ISC2... Do i have to subscribe? I am probably looking in the wrong place. Any hints would be ace thanks.

[rustic sage]

On arch Linux trying to use burpsuite but it keeps telling me to enter some command illegal-access because I'm using java 16.

Anyone has any idea?

[flint moth]

@glass oriole some hints would base64 source,Hidden file
For the first part

[glass oriole]

ty

[dark solar]

wsggg

[short horizon]

I might be over thinking this question, but I've tried about 70 different pairs that equate to the sum of 1337 and still get unauthorized. Even made a script for it lol

nevermind

I got it.. I did overthink it

[short horizon]

I'm trying to delete the files I created on the docker after using PUT by using DELETE, but all it does is use GET instead

DELETE is allowed on the docker, so I'm wondering why it's using GET instead

PUT does the same, it doesn't overwrite, it just reads the file like GET would

[glass oriole]

I would suggest looking up the -X flag of cURL

[short horizon]

I was using burp suite for it, but I'm checking out the -X flag now

[glass oriole]

oh, and you are changing GET to PUT on the "proxy" tab_

?*

[short horizon]

I did it in the proxy tab and in the repeater

And had the same result from both, even after changing the auth to see if it mattered

[glass oriole]

If you are learning the request module i suggest looking up the header of each request, though the header for a GET request might be different from the PUT ones

[glass oriole]

let me try rn and ill confirm you

[short horizon]

PUT will create a new file, it just wouldn't overwrite existing ones for me in that module. It would just default to a GET. Same for DELETE

[glass oriole]

you are stuck in the "PUT and DELETE Methods" page right?

[short horizon]

Well, I got the flag. I just wanted to delete the extra flag.php I created because the original wouldn't be overwritten

Had to make a flag2.php to get the flag lol

[glass oriole]

if you want to delete it i know for sure curl -x DELETE path will work

if not, your target has something missconfigured

[glass oriole]

hahahah happens

[short horizon]

I'll try it again later. I've turned off my vm since completing it. I should start using curl more often

Appreciate the advice on the -X flag tho

[glass oriole]

yw ^^

[spring oriole]

Can someone help me? I don't know why this is not working. Thanks

[glass oriole]

hi, can someone guide me through cookie manipulation? I got the decoded value but have no idea what im supposed to modify to escalate my privileges

[tepid peak]

try python2

[spring oriole]

😢

[solid cradle]

try prefixing the command with python3 instead.

[spring oriole]

That's what I tried at first :(

[solid cradle]

oh. the first screenshot you posted didn't have either interpreter prepending.

[spring oriole]

Yes yes, sure, but then I tried that

With this hint I don't know why it doesn't work

[solid cradle]

@spring oriole when you ran it with python2 it says the file is not a 7z file. is it already actually uncompressed? can you view it in plaintext?

[spring oriole]

Okay, thanks 😅

Solved <3

[rustic sage]

Good Evening,
Course: OSINT. I am stucked with accepting the gps coordinates... Maybe I am doing something badly, but this should be straight forward.... So for example if I would like to add: Budapest as an example, my format would look like: 47° N, 19° E
Am I right?

[glass oriole]

Hi, i cant find what the web requests module asks in the "A Dive into Methods" section at "POST Method":

• Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section.
  And then leaves an input box, am i supposed to find a flag or smthg?

[drifting knoll]

feel free to DM me

[hollow hull]

So i am doing armageddon machine, and I was wondering when we use dirty_sock to privesc is it possible to use the first version over the second ? (is there any trade off )

It seems that v1 of dirty_sock requires you to create an account, while v2 just downloads a malicious snap

[pearl tiger]

how do i use a cd command in<?php system()?> ?

i try '<?php system("cd search.php" )'

but it look like i doesnt change

[pearl tiger]

can some one help me with the sql injection question?
Find the flag by using a webshell.

i already do the ls command

and find the 4 folders there

i dont know how to get into them

or how to save the result

[mental hornet]

alright, so on the Getting Started module Privilege escalation chapter, I have gotten the id_rsa and dud chmod 600 on it, but I am getting an "invalid format" error

ssh root@htbip -p htbport -i id_rsa
Load key "id_rsa": invalid format

[flint moth]

@mental hornet you could have missed something while copying or while pasting check that the format is ok or not ! Like when I did it and pasted in vim it added some character after new line

[mental hornet]

Nah, the key is in tact.

-----BEGIN OPENSSH PRIVATE KEY-----
...SNIP...
-----END OPENSSH PRIVATE KEY-----

obviously not the actual key, but there's no extra whitespace or new lines

box only has 22 min left, maybe I just refresh it and try again?

[flint moth]

Naa no need to refresh @mental hornet

[mental hornet]

I did

stat --format '%a' id_rsa                

and got 600

Do I have to go and like do the whole upload a public key?

[flint moth]

Sorry I couldn't get what you trying to say 😅 maybe you can dm me

[mental hornet]

If we find ourselves with write access to a users/.ssh/ directory, we can place our public key in the user's ssh directory at /home/user/.ssh/authorized_keys. This technique is usually used to gain ssh access after gaining a shell as that user. The current SSH configuration will not accept keys written by other users, so it will only work if we have already gained control over that user. We must first create a new key with ssh-keygen and the -f flag to specify the output file:

like this

[flint moth]

😯😯 I never tried this thing seems interesting but I don't know about this

[mental hornet]

yea. Doesn't work, so that's not the way.

[icy snow]

Anyone want to help me on intro to Network Analysis; specifically the question from the wireshark section “which employee is suspected of performing potentially malicious activities in the live environment?” The hint isn’t really helpful. Pg 13 of the module.

[abstract hollow]

@ebon wigeon

[tough dust]

For win fundamentals

Are you supposed to follow the steps for the creation of the share file and connection from attack box?

[tight glen]

Module:

Win Fundamentals

im struggling to connect via xfreerdp, is my command wrong?

I have had issues with xfreerdp before if that helps, i also spawned another box

[tough dust]

You aren't supposed to space

[tight glen]

thank your sir, been a while

[pearl tiger]

can some one help me in Writing Files sql injection?

[hexed tartan]

sqlinjection.txt

content: '

[pearl tiger]

this is the quetion

now i try to move around but i cant

i try the command

cn' union select '<?php system(cd ./var); ?>','<?php system("ls"); ?>','<?php system("cat shell.php"); ?>', "" into outfile '/var/www/html/shell4.php'-- -

[mortal basin]

The above is not a correct webshell command. Try to refer to the cheatsheet

[pearl tiger]

can you just pls tell me the command i already been two days on it

[sick gull]

hello all, could someone help me with a question in "intro to network analysis" ?

[hexed tartan]

if you provide the question sure

[sick gull]

"Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII?" I believe it is -rX, not sure if i am putting the wrong order or what because that is wrong

I've tried -rX /tmp/capture.pcap, -r, -X, -rXX, everything

[hexed tartan]

I think its -XX

[short horizon]

I'm pretty stumped on the Getting Started/Public Exploits module Edit: I'll try to sleep on it and ask for help later

I know I have the right exploit, but I feel like I can't find the correct TARGETURI

[sick gull]

tried -XX, no avail:(

[glass oriole]

Usually targeturi field has a small description of what is expected to be set

if you are looking for the webpage basepath i may not always be /

[short horizon]

It says root folder for Wordpress. Which I tried ||/wp-content/, /wp-includes/,/index.php/ and /wp-admin/||

[glass oriole]

and did you try the "/" folder?

[short horizon]

Yep

That’s the default option

[glass oriole]

dm me in order to avoid spoilers

[mellow whale]

@sick gull shoot me a message about the traffic analysis question

[glass oriole]

someone who has completed the file inclussion final assesment can help me with the second part?

[proven jay]

aanyone available to help with the hashcat module

[rustic sage]

What is the question? If not module related maybe.... 🙂

[proven jay]

Im stuck on cracking common passwords section

I have tried cracking the hash with several different builtin rules, and also with mode 0 and mode 1000

I would try using a hybrid attack, but were given zero information about the password pattern

[golden flower]

Hi, im finished the bash scripting , but i cant complete the module because in Flow Control - Loops part when i launch the script it gives me an error

Any idea, i think 90% the script are correct

[rustic sage]

in this case I cant help 😦 That is module specific ..

[proven jay]

ok, np 🙂

looking through the backscroll, looks like other people have asked about this, but theyve got no response

[rustic sage]

mode 0 is straight. Just guessing but if you would like to try hybrid attack maybe you need another mode. (if you menat in mode the -m in this case are you sure you have NTLM or MD5?)

[proven jay]

yeah I meant -m. Pretty sure its one of those since hashid said that

I mean there were other suggestions, but those were the only ones mentioned in the module

Ah I figured it out. Had to use a specific rule

Thanks for your help @rustic sage

[mental hornet]

nibbles question:

||anyone know why I get this from metasploit when trying to run it on nibbles?||

This exploit may require manual cleanup of 'image.php' on the target

currently doing it the way the guide says, but I was curious to try this route as well.

[rustic sage]

hello all, im stuck (for 5 days) in the Skill Assessment - Broken Authentication -> if anyone could dm me i'd be very happy 🙂

[mental hornet]

Figured it out. ||Improperly set LHOST|| - nibbles

[devout ginkgo]

I'm having an issue with the Linux Fundamentals "Filter Content" section, on the last question regarding using curl from the pwnbox to obtain the source code of https://www.inlanefreight.com. After spawning the target host, I enter "curl https://www.inlanefreight.com" on the pwnbox and I get an error "curl: (60) SSL certificate problem: certificate has expired". NSLookup is showing an IP address of 134.209.24.248. Am I missing something, or is there a configuration error?

[short horizon]

(Snipped from support channel to here). I tried doing a module page in the academy running an auxillary scanner. Using the same options, the output was saved in a loot folder in the ParrotOS provided by HTB but when I did it in my Kali box, the output didn't save. My Kali box is running metasploit v6.0.52-dev.

[glass oriole]

I solved it thx to your hint, thanks

[rustic sage]

Hi everyone, I'm stuck. Hashcat module, section "Working with rules": I can't crack hash, the hint says that I need to use rockyou and build a rule to append 2020 to every password in rockyou file. The rule is ok (I tested with --stdout), but still can't crack. Any real hint?

[short horizon]

This is my output, above the "scanned 1 of 1 hosts" should be a save to the loot folder, but there is none. (I crossed out the module used in case of spoilers). But the information is correct and the same as info used in ParrotOS. I thought it was a msfdb thing, but I re-initialized the database just in case and it seems like there's a configuration out of whack and I'm not sure how to fix it.

[icy eagle]

Hello everyone, I am currently stuck on module Linux Fundamentals "Service and Process Management" https://academy.hackthebox.eu/module/18 The issue I am having when I enter systemctl start ssh to begin the ssh process it is asking me for a password and I dont know what it is.

[bright drift]

Hi ! Are you sure you have enough privileges with your current user to run that command ? Just check back the "User management" part 😉

[fleet moth]

Hi. Could anyone help me with the question "Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII?" from "Network traffic analysis" module?

I found out, one must put 'sudo tcpdump' before the rest... the answer is:
sudo tcpdump -Xr /tmp/capture.pcap
🙄

[pine hatch]

Hello everyone, I can’t solve the following question: Find all TCP ports on your target. Submit the total number of found TCP ports as the answer.
Can you help me

[rustic sage]

nmap -p- ?

[pine hatch]

i try -Pn bcs it not <ork

work

when i try this command i have a msg and it tell hosts seems down

[desert saffron]

Hey guys can someone tell me what do i have to submit in the module "web request", "post method" section? I dont know what i have to submit, a flag, a admin username or some other stuff?

[pine hatch]

I've found the soluce for my prblms, i've just use HTB terminal and then i've use the nmap command with -sT and finaly it work

[hexed tartan]

@desert saffron manipulating the cookie should get you something, this somethings is your flag

[slate vine]

@rob#1234 heyyy

@finite thicket heyyy

[rustic sage]

could someone please help me with the first question of Linux Fundamentals --> Workflow --> Find Files and Directories?

I've been trying with the find command for so long but all it's giving me is tons and tons of files, some of which say permission denied

I'm going insane

the question is "What is the name of the config file that has been created after 2020-03-03 and is smaller than 28k but larger than 25k?" btw

[white basin]

What command are you using?

[drifting knoll]

@rustic sage pls be careful with spoilers

[rustic sage]

oh apologies!

||find / -type f -name *.conf -newermt 2020-03-03 -size +25k -exec ls -al {} \;||

[white basin]

For the permission denied you can use 2&> /dev/null

[rustic sage]

I don't understand the|| -exec|| part and I don't know how to filter by|| size less than 28||, only the ||more than 25|| part

ah alrighty, will try that now

[hexed tartan]

-28k

[rustic sage]

thought so too but it gives some kind of error, afaik because it treats that like a seperate option or smth

[dusk saffron]

You have to give the -size primary twice. Find will in general "list all files under the search root", filtered by primaries like "size", "newermt", and "name".

Grab a cup of coffee and read through "man find", it will save you time in the long run! 🙂

[rustic sage]

using the command|| find / -type f -name *.conf -newermt 2020-03-03 -size +25k -size -28k -exec ls -al {} ; 2&> /dev/null|| gives me nothing

[rustic sage]

makes sense, thank you

[dusk saffron]

That should probably be "2>/dev/null".

[rustic sage]

probably when I have time haha, I did try that while looking for the answer but I only really looked over it very quickly and I don't understand most of the things

[dusk saffron]

(Means "redirect stream 2 to /dev/null".)

[rustic sage]

ohh oops

thanks

[drifting knoll]

read the manual of the "find" command and execute the command with adding one option after another

[rustic sage]

hell yeah it finally worked

thanks mate :)

[lament niche]

Having a bit of a tough time escalating privileges on the “Getting Started: Skills Assessment” box.

Was able to retrieve the user.txt flag as “www-data”. From here I’m a little stumped. Couldn’t download an enumeration script since all writing is blocked on the account.

There’s another user, mrb3n, where the user.txt resides. Should I move laterally to his account some how— or go to root from www-data?

Only sudo permissions www-data has is NOPASSWD on /usr/bin/php. Haven’t had much luck searching where to go with that

[icy eagle]

I figured it out lol thanks for the hint 🙏

[solid cradle]

if you're already in a reverse shell as user www-data, can you see if you can find a place on the filesystem that allows write permissions and work from there with the enumeration script? ||Any temporary directories or shared memory spots? (remember, everything in linux is a file).||

[solid cradle]

Reading through man pages and digging in deeper until the tools are better understood is going to occupy a lot of your time, but it will be well worth it. Also if you hadn't figured it out, when viewing a manpage, you can search through it with the / and whatever you're searching for.

[lament niche]

Thanks for the idea! That was my first though was to try and find any sort of writeable file and run my enumeration script instead for it’s contents. Another user gave me a great nudge in the right direction. I’m given “sudo” for the /usr/bin/php file. While it’s not writeable, I am able to play around with it and possibly exploit some of its functions!

[solid cradle]

gtfobins ftw! lol

[lament niche]

Bingo! 😉

[tough dust]

For windows fundamentals are we supposed to follow the SMB guides or just read an answer the question.

[tight glen]

i read it

[tough dust]

I tried following along but i can never connect to the share

[sterile palm]

why cant i message in general?

[frigid vector]

Hello!
I've stuck on "File inclusion" module -"other php wrappers" section.
I started with python3 -m http.server 8080 (in the folder with "shell.php" ) and wrote this url http://10.129.29.114/index.php?language=http://localhost:8080/shell.php&cmd=id but it doesn't working. I got this in my terminal and nothing more - Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
and this mistake on my target ----- Warning: include(http://localhost:8080/shell.php): failed to open stream: Cannot assign requested address in /var/www/html/index.php on line 47

Warning: include(): Failed opening 'http://localhost:8080/shell.php' for inclusion (include_path='.:/usr/share/php') in /var/www/html/index.php on line 47

give me a little hint pls, whats going on?

[glass oriole]

Hi, what is the path where you ran the python3 -m http.server 8080?

and where is your shell.php script

[frigid vector]

All of these in the same folder

[muted mist]

Hello, hackers.
Have a question about some blank moments for me in "Nibble - Web Footprinting" section. Next section "Nibbles - Initial Foothold" starts on a position that we've already cracked admin password with some tool, but I didn't found that process described in previous section ("Nibble - Web Footprinting"). The main question: "Is it presumed that we crack that admin password on our own?" The second question: "When I use hashcat, I have to provide some file with initial hashes of possible passwords. I understand that I can get initial variants of password with CeWL, but should I convert each of them to hash manually or some automated tool exists?"

[frigid vector]

As I guess i don't need to write a full path in the url, a, I wright?

[glass oriole]

no no, its the relative path

lemme try

[frigid vector]

ty, it can be related with that nginx is shutdown or not?

[glass oriole]

is nginx shutdown?

Try the other wrappers

And check if they work

[frigid vector]

I 've tried this python3 -m pyftpdlib -p 21
but doesn't working too.
I got this on the target ------- Warning: include(): connect() failed: Cannot assign requested address in /var/www/html/index.php on line 47

Warning: include(ftp://localhost/shell.php): failed to open stream: operation failed in /var/www/html/index.php on line 47

Warning: include(): Failed opening 'ftp://localhost/shell.php' for inclusion (include_path='.:/usr/share/php') in /var/www/html/index.php on line 47

Notice: Undefined variable: p2 in /var/www/html/index.php on line 48

and nothing in └─# python3 -m pyftpdlib -p 21
[I 2021-07-12 16:16:25] >>> starting FTP server on 0.0.0.0:21, pid=2386 <<<
[I 2021-07-12 16:16:25] concurrency model: async
[I 2021-07-12 16:16:25] masquerade (NAT) address: None
[I 2021-07-12 16:16:25] passive ports: None

[solid cradle]

you might doublecheck your url for the download link again. What host address is it trying to contact the python webserver at?

[solid cradle]

||specifically this area: language=http://localhost:8080/shell.php&cmd=id ||

[frigid vector]

yeah

i have the same url

i've got checked it many times...

/index.php?language=http://localhost:8080/shell.php&cmd=id

python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

and nothing

I'll send a few screenshots...mb It will shed a light

[autumn pilot]

You are issuing a command id which will return a value, don't expect it to download/upload something

[frigid vector]

yeah, I'm not trying to download something. I've tried to include a web shell and execute the id command:)

and I dont know whats going on

[solid cradle]

again, doublecheck that host address you're specifying for it to be downloading the script from.

[solid cradle]

||you've got it trying to connect to a link at itself on port 8080.||

[frigid vector]

hm

[solid cradle]

think of 'localhost' as referring to itself in the third person. your system would refer to itself as 'localhost', and the server you're trying to attack also refers to itself as 'localhost'.

[golden flower]

exactly i did the same mistake

[solid cradle]

same kinda here, I've pasted scripts and forgot to change <IPADDRESS> I don't know how many times, then fought with it not working. lol

[tough dust]

How are we supposed to follow the Creating a network share in the windows fundamentals course if we can't even get the share to connect?

[drifting knoll]

check your credentials

[tough dust]

I'm doing this from outside the web pwnbox from my own vm running the ovpn

Would i just use the credentials of my own vm?

@drifting knoll

[still kraken]

Module [ SQLMAP ESSENTIAL ]
Chapter [ RUNNING SQLMAP on an HTTP REQUEST ]

Hey I'm currently stuck the first question, getting the flag from case2. I've followed the cheat sheet and even googled but I can't find a way to use sqlmap correctly 😕

If someone could just mp me to explain what I'm doing wrong that be great thanks 😊

[tough dust]

Yeah idk i still can't connect to the share even withing the pwnbox and the credentials from the text file on the pwnbox

[subtle igloo]

Hi i am a beginner in HTB can anyone guide me from where i have to start?

[unique valve]

Welcome to the community, we are glad to have you! It would be good to start with the HTB Academy module called Intro to Academy if you want to start learning with Academy.

https://academy.hackthebox.eu/course/preview/introduction-to-academy

[rustic sage]

Hi im new to HBT where and how do i start?

[urban sage]

@rustic sage @subtle igloo Check out Academy and or Starting Point.

[rustic sage]

K tks.

[subtle igloo]

Tq👍

[dark lake]

i personally would recommend to start with linux modules and some further research, because your pwnbox is also a linux destribution (parrot os) and also u should try to get familiar with virtual machines and setup a virtual machine (prefered kali)

[wraith pewter]

Hello anybody can tell if I buy HTB academy subscription will I able to get access of all modules for 1 months or I will get onyl 200 cubes ?

[dark solar]

youll only get 200 cubes

[dark solar]

hey guys im just stuck on the question "Find a way to start a simple HTTP server using "npm". Submit the command that starts the web server on port 8080 (use the short argument to specify the port number)."
i started the server but i dont get what im supposed to do

also can anybody tell me if the htb academy subscription is recurring?

[scarlet finch]

here @sterile hawk

[somber sphinx]

73.123.183.104

[icy snow]

Anyone complete the Dissecting network traffic with wireshark section of Intro to network traffic analysis? Struggling on the second question.

[rain goblet]

env

[timid grove]

Hello ! i just realise they combine all the module into 1 group

[wraith pewter]

Ok bro

[vapid grove]

I'm stuck in bash scripting module in this question:

Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,469 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer.

Only checking if var is equal to value returns nothing, so i don't get any output

[unreal patio]

I'm stuck connecting to the active directory machine

I've waited almost 10 minutes for it to boot

[ruby flint]

can someone explain what "flag" mean?

[unreal patio]

It comes from CTF(Capture the flag)

Which is a game in which you have to obtain an objective(flag)

[ruby flint]

ty

[drifting knoll]

did you solve the issue?

[unreal patio]

@drifting knoll I resetted the target and I'm waiting, getting timeout still

[blissful cliff]

Hi, just working on the sqlmap module, I have done the case #5, #6 & #7 flags however i was curious if anyone knew for future use how you determine prefix and suffix? i assume whatever you set for prefix is injected at the beginning and suffix at the end ... so would it be more just knowing syntax etc etc?

[mellow whale]

feel free to shoot me a message.

[drifting knoll]

it means the same page as have been shown in that section but on your target you need to spawn
http://<target>:<port>/admin/admin.php?<PARAMETER TO FUZZ>=key

[icy snow]

I figured it out last night, wasn’t looking at all the conversations.

Thanks though!

[mellow whale]

Awesome!

[unreal patio]

I solved the exercise but I don't get any output from the pipe

[rustic sage]

where do u type all of these commands?

cmd of what

is it a app?

[rustic sage]

k tks

[signal sable]

hi

im new here!

[urban sage]

👋

[topaz sun]

Team this seems to be the DUMBEST thing for me to be hung up on but .. I guess I am ... Im doing the Deobfuscation challenge in the academy... Using the jnice Web site i was able to deobfuscate however even putting the flag in as the answer in the format of the hint is telling me its incorrect. if any tips on how im inputting this wrong please DM

[vague saffron]

does anyone have any go to command to pull the flag from an ip and port

[topaz sun]

nmap maybe?

[topaz sun]

I am truly ashamed of myself... I WAY OVERSHOT This one...

[vague saffron]

what specific syntax for nmap? @topaz sun

[vague saffron]

still cant figure this out

[lapis kiln]

Does anyone know why the browser in the spawned instance would not be loading web pages?

[vague saffron]

u try resetting it?

[lapis kiln]

yeah ive reset the machine and ive restarted my browser and on two different modules in the web requests class i get infinite load screens that timeout.

[rancid holly]

Hi everyone ... i am currently doing "Intro to Network Traffic Analysis" .. but I am unable to solve one of it's section

if anyone can help .. I have tried most of the things I learnt in the blog but wasn't able to complete the challenge .. the traffic I can see is totally different from the what hint box says.

[mellow whale]

Shoot me a message

[unkempt sonnet]

do u still need help?

[autumn pilot]

Next time you post it, you will get a reward from me

[lusty pebble]

ok i think im not doing right at some point, i have found the /index.php?page= , I have tried all variations of /../ and cookie poison, also tried to do remote (http server), this module is File Inclusion/Directory Traversal and i'm on the last page, ping me if you help, very appreciate it, already half a week into this

[weary anvil]

hey guys! I don't really understand the function "EOF" in this part.. Can someone help me with that? thanks

I don't understand "<<" sign also in fact...

[dusk saffron]

@weary anvil They are "Here Documents", you can read about the construct in your shell's manual. (Example: man bash if you are using the Bash shell.)

(You might need to read about standard streams and shell redirection as well to understand what it does. But in short: the shell redirects the given command's input stream to read from the block of text in between the two "EOF"s.)

[rustic sage]

it isnt working for me too.

how to solve this

ohk tks a lot

ok tks

how to download fuff?

[blissful cliff]

Morning/afternoon all! Currently stumped on the skills assessment for "sqlmap essentials" and genuinely struggling to find area to attack. I have tried || --forms || flag and this only appears to work on one of the pages ... on the || contact.html || page I don't seem to be able to do anything in terms of submitting sqlmap queries with any success. In burpsuite I see || the use of "etags" || which could potentially be useful, but then I have no idea how to use them (or if they are even usable in anyway) .... any pointers/hints would be greatly appreciated before I start going crazy 😂 ...... covered any potential spoilers, just in case 😅

[rustic sage]

how to download fuff?

[blissful cliff]

|| sudo apt-get install ffuf ||

[unreal patio]

@blissful cliff send me a dm

[blissful cliff]

Okay 🙂

[mint lava]

have a closer look at the Shop and use Burpsuite

[blissful cliff]

Gotcha, thank you & @unreal patio for your time & info!

[honest patio]

Hey everyone, beginner here working through Windows Fundamentals -NTFS vs. Share Permissions. I am confused with the answer to the first question: "What is the exact name of the predefined firewall rule that must be enabled to connect to the share from the Pwnbox?". I have the correct answer input. But in reality its not until I enable the predefined rule -|| Netlogon Service (NP-In)|| - that I am able to connect to the Share from the Pwnbox. Can someone help me understand what is happening here?

[weary anvil]

Tanks

[unreal patio]

I can't seem to figure out the search syntax, the userlist is not verbose enough

[unreal patio]

Figured it out

[rustic sage]

Hello all!😀

[unreal patio]

o/

[honest patio]

Hi! thanks for replying! I have the correct answer already....but I have experimented with turning all 3 of the SMB related predefined inbound rules to disabled. And I can still connect. The ability to connect or not seems to be related to "Netlogon Service (NP-In)" ? Am i crazy?

[rustic sage]

Can I use Linode to complete modules? As a free user I am only able to spawn an instance once a day, could I instead use Linode?

[wet hemlock]

Yes you can even use your own virtualbox machine

but you need to connect with VPN which is to download on module site

and you have a .ovpn file

[rustic sage]

Thanks so much BeNo59!

sorry was afk

[autumn dune]

Is the same vpn file used for all the modules?

[unique valve]

Nope you arent crazy. You are on the right track 🙂

[wet hemlock]

I was doing on the same vpn all the categories of the same module so idk

I needed to connect to the same IP, so difficult to say

[winged lava]

DM me if u still have the problem

[unreal patio]

How do I search with windapsearch by attribute id?

I'm stuck at the Password-History-Length(1.2.840.113556.1.4.2014)

[short horizon]

I'm stuck on Getting Started - Public exploits I'm pretty sure I'm using the right exploit and have the right info but I'm not getting a loot save. I deleted metasploit-framework and re-installed it after a restart (restarted after that too just in case) and I'm still have the same issue. Can anyone help?

[pearl tiger]

some one know what is the os here?

[bright drift]

I've sent you a DM.

[wise flare]

anyone here who could crack a xiaomi? o don t have the Mi Account

[light harness]

hello everyone,
I am new here. Please can someone give me a quick overlay of whats going on here if you dont mind so cause i am a beginner and a noob also.

[sleek ferry]

hello there everyone, I am kinda new. Can someone please recommend me as to what I should first learn before I can hack a box, possibly something like a road map of what to learn. Thank you

[urban sage]

Check out HTB Academy.

[unique valve]

Try starting with the module Introduction to Academy and work your way from there. https://academy.hackthebox.eu/course/preview/introduction-to-academy

[vague saffron]

This has been asked a million times im sure but wtf is good with the 3rd lab for nmap

[tacit meadow]

Hey,
Module: Getting Started
Section: Knowledge Check
Question 2: "After obtaining a foothold on the target, escalate privileges to root and submit the contents of the root.txt flag."

Issue: So I got a footstep inside the system, running "whoami" returns "www-data". Cool. I run the LinEnum.sh script, finding this (picture attached). I then try to approach this like I learned in a previous section in this module, but to no avail.. I can't figure out how to work with the php thingy, I get permission denied while trying to append the line that allows me to reverse shell as root into it , as well as it is a symbolink that goes back and forth leading to the php7.4 in the same folder, but I don't have permission to edit it.. Kind of stuck on this 😦

[dark lake]

hello guys, does somebody has a little experience with troubleshooting aircrack-ng, if yes please dm me 🙂

[solid cradle]

i sent you a dm

[solid cradle]

what do you mean you cant figure out how to work with the php thingy?

[solid cradle]

the output from linenum I think you're talking about is telling you the programs that the user you're on can run with 'sudo', and the conditions allowed for you to run them. ||Do you need to authenticate as root to run any of the binaries listed with sudo?||

[flint moth]

@tacit meadow You can check https://gtfobins.github.io/ for php thing

[tacit meadow]

I mean, I am not doing something right, because I can't get to run the file. it just start a php command line and echoes everything I write

[tacit meadow]

from what I understand, I need to get a shell with root privileges. I found out that I can run a binary called php as the current user, without the need to authenticate as root with password.

[tacit meadow]

I tried, even after opening a php terminal, it just echos my commands (tried to look for php format commands etc..)

[quiet vault]

Look for a way to run system commands through php. You might need to look up basic php syntax @tacit meadow

[tacit meadow]

Thank you, I will try.

[quiet vault]

I'm on the loops section of the intro to bash scripting. I've written the script for the question at the end but I keep getting

enc: Use -help for summary.```

Any suggestions? Is it an error with line breaks or something?

[short horizon]

Am I doing something wrong? This is for Getting started/ Public exploits

I tried fiddling with the depth, <=2 would give me a could not download error, >=2 gave me the error above.

[quiet vault]

I can't see any reason why what I wrote should break the script

[dark solar]

hi guys

i have a question. does the monthly plan charge recurring payments?

for htbAcademy

[urban sage]

As in change once a month? Yes.

[solid cradle]

you can purchase cubes directly without a sub, but the sub gives discount.

[rustic sage]

Hey guys. Trying to perform an ssh connection to a target from my Ubuntu workstation. I keep getting a connection timed out output from the console. Any ideas on how this works?

[drifting knoll]

are you connected to VPN?

[rustic sage]

No. Lemme try doing that now

Using the same openvpn file that was provided to me from the machine section of the site, right?

[drifting knoll]

yes

[rustic sage]

Using the vpn key I generated within the module

[drifting knoll]

did you use "sudo" ?

[rustic sage]

Oops missed that

Sweet, works like a charm. Gonna try and connect with ssh now

Do I also use sudo on the ssh command?

[drifting knoll]

no

[rustic sage]

Just waiting for now

Output: connect to host 10.129.237.54 port 22: Connection timed out

[quiet vault]

Are you connected to the vpn? What do you get if you do sudo ifconfig tun0?

[rustic sage]

I don't have ifconfig installed on my machine

[solid cradle]

try ip a

[solid cradle]

sorry, ip a not all

[rustic sage]

I should be 🤔 I connected with the VPN key through a different terminal window

[drifting knoll]

make sure you don't copy&paste the password

[quiet vault]

You have 2 different vpn connections

[solid cradle]

it shows you've got 2 tunneled connections

[rustic sage]

How do I close them? I thought closing the terminal I connected through to them was enough

[solid cradle]

neither of which appears to have netmask that will cover the IP of the spawned machine

[quiet vault]

killall openvpn should do it

[rustic sage]

The tun0 entries were the openvpn connections right? just ran the command and they are no longer there

Should I try to reconnect now?

[quiet vault]

If I were you I would delete all ovpn files and download it again

[solid cradle]

at least the ones named academy*.ovpn

[rustic sage]

I'm going to reset my target and redownload my VPN key

[crystal quail]

I'm working on the File Inclusion module, and I'm having trouble grasping the section about using the zip file to hide a web shell. Can someone offer a hint?

[rustic sage]

OK. Just connected. If I want to connect to my target, is there a specific port I should use?

[quiet vault]

No. It will automatically use the default one

If it doesn't say on the page it will be running on port 22 so you don't need to specify it.

Can you ping the target?

[rustic sage]

Yup

Gonna try and connect

[quiet vault]

It should work

[rustic sage]

Is there a way I can stop pinging or do I just have to close the terminal

[quiet vault]

control c

[rustic sage]

Thanks!

[quiet vault]

Ctrl-c stops a running program

[rustic sage]

Works like a charm, thanks y'all!

[ancient oriole]

Hi, how can I find out what operating system is this? - network enumeration with nmap

Davho@htb[/htb]$ sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace --disable-arp-ping

Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-15 00:12 CEST
SENT (0.0107s) ICMP [10.10.14.2 > 10.129.2.18 Echo request (type=8/code=0) id=13607 seq=0] IP [ttl=255 id=23541 iplen=28 ]
RCVD (0.0152s) ICMP [10.129.2.18 > 10.10.14.2 Echo reply (type=0/code=0) id=13607 seq=0] IP [ttl=128 id=40622 iplen=28 ]
Nmap scan report for 10.129.2.18
Host is up (0.086s latency).
MAC Address: DE:AD:00:00:BE:EF
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

I am searching for it for like 1 hour, but cannot find it 😦

[unique valve]

What scan option in Nmap allows you to enable OS detection?

[ancient oriole]

-O i think

but I have to find out only from that output

"Based on the last result, find out which operating system it belongs to. Submit the name of the operating system as result."

[drifting knoll]

check every piece of information in that output and ask yourself if you really know what you're looking at
otherwise feel free to DM me

[quiet vault]

I'm on the skills assessment of hacking wordpress and I can't find the wordpress site

[rustic sage]

Hi everyone, I'm new here. How would you rate the academy?

[ancient oriole]

Thank you Cry0l1t3, I've solved it 🙂

[drifting knoll]

making your actions/decisions based on others opinions equals letting others to decide about your success
everyone learns differently, everyone feels different about any kind of product
i highly suggest to try it out for free and make your own impressions
on those you can decide what is best for you

[drifting knoll]

well done

[ancient oriole]

thanks

[quiet vault]

I'm assuming wordpress is running the blog but I can't access it

[ancient oriole]

I had that same issue

you need to ||add that url to your hosts file||

and then it will work

[quiet vault]

done

||message: ||

I still can't access http://blog.inlanefreight.local/

[rustic sage]

Very teacher-esque of you... I think this is going to be fun... 🤔

[wet schooner]

Are there any plans for full time moderators to support academy based issues? From my limited experience there is a lot of questions with very limited support. This is not to criticise as the platform is great, however when we struggle sometimes there is nowhere to turn :)

[drifting knoll]

feel free to share all your questions with me

in DM pls

[wet schooner]

Thankyou that is great, and thanks for the reply. I help where I can and when I'm struggling Id just like an official channel to turn to, appreciated

[drifting knoll]

all modules related questions can be posted here (just be careful with spoilers)

[wet schooner]

I've posted many questions with no spoilers and had no official help, occasionally I got community help, usually I figure it out for myself, but sharing knowledge and helping each other makes great achievements :)

[mossy girder]

I am working thru them myself.... they take time.. am doing SQLmap now

[wet schooner]

Its a cool well put together module

[quiet vault]

I just hope that the people with more knowledge/experience check this channel every once in a while and help with questions. In my experience it's simple issues people have. I help people if I understand what they're trying to do

[wet schooner]

My point entirely mate, official moderation rather than relying on Joe bloggs trying to explain what he/she thinks is going on

[quiet vault]

Even just a way to make it easier to see issues people have that haven't been resolved. I don't know how it could be implemented.

I had an issue before to do with bash scripting but my request for help has gotten a bit buried. I know it's likely to be a minor error, wrong type of brackets or something, but I can't see it. If someone checks the channel now at most they'll see upto someone having issues connecting through the vpn

[wet schooner]

See I can help you with that bash scripting issue, however I probably can't help without giving a direct answer where an official moderation could guide you, feel free to DM if you want the help on this issue

[solid cradle]

I try to help here and there when I see something I can help with, but I'm going through the modules as well. Sometimes explaining to someone to help them without spoiling the method or giving it away takes tip-toes around the answer. Sometimes its tough to not give away especially if they're right on the edge of getting it figured out themselves. lol

[crystal quail]

Whew! 12 hours working on the File Inclusion/Directory Traversal. Finally finished.

[coral fable]

congrats

[tight glen]

someone available for windows fundementals skill assesments?

thanks edit: im good thanks anyways

[frosty fox]

how to be a hacker

[novel matrix]

++academy

[red obsidian]

Academy Site

Cyber security training with hands-on exercises by Hack The Box. Join now and advance your cyber security skills!

[sharp saffron]

hello

[short horizon]

Can I shoot you some DMs too? I feel like my question's been lost a couple of times in the sea of messages too

[unique valve]

Hello. Welcome.

[coral fable]

I don't know who wrote stack based buffer overflows on linux x86, it's just a gem, very marvellous this course ! ❤️

[hexed blaze]

The knowledge check on the getting started module is insanely slow. Anyone have any tips on speeding this up. Each page is like 5 min to load.

[quiet vault]

That sounds like a network issue. Try accessing other sites and see if they are slow. If it doesn't seem like an issue on your end try #613049811481919508.

[hexed blaze]

I'm using the built in instance. Do you think it would be faster to just vpn from my machine? My network speed is fine.

[quiet vault]

It might be. There migh be an issue with pwnbox

[brisk cobalt]

To Anyone who's doing the Windows fundamentals module and is stuck on the ipconfig alias question, DON'T USE POWERSHELL ISE!!!!
Use the normal powershell as powershell ise won't show you the right alias.
So much for "outside the box"....

[opal storm]

I have a question about the introduction to python3 module? I am having trouble understanding what the question means by type of x_coordinate

[quiet vault]

Can someone give me a hint on how to get a shell on the skills assessment of hacking wordpress. I've tried checking the plugins for vulnerabilities and trying to get ssh keys using LFI. I'm hesitant to start bruteforcing for a login

[unique valve]

Feel free to DM me. I have some time to give you some hints.

[quiet vault]

There is a command in python to find the type of a variable, try to see if you can find it through google

It is obvious when you know it

[opal storm]

i got it ty

[opal storm]

could someone help me with the LFI RCE for trying to get the contents of /etc/issue?
nvm

[real beacon]

I am looking for help with the RFI section of the file inclusion module. I have set up my shell.php file and my python server, but I am unable to get the target to connect with my machine to get the file. No requests are getting logged. Any suggestions?

[solid cradle]

are you having it connect back to your vpn ip or public ip?

[rancid holly]

I still have to solve the final module ... can I contact you if needed?

[cunning sierra]

good morning, can anyone help with the Bloodhound module?

[cunning sierra]

nvm.

[rustic sage]

Is the academy free?

nvm.

Hey can anyone tell me windows fundamentals module what is sddl because i got sddl but it says it is wrong plz help

[tight glen]

stuck on the same question

[vague saffron]

why is lab 3 for nmap impossible

[wanton nest]

Hello

I have a question

Can you help me?

Fortress - JET

Question 2: Digging in...

after use dig - dig @10.13.37.10 -x 10.13.37.10

[quiet vault]

You'er asking the wrong person. I don't really have a clue what I'm doing

[wanton nest]

The link does not open for me

[wanton nest]

Ok, I'm very Sorry

[quiet vault]

No worries

[wanton nest]

😉 🙏 .

[cursive cave]

hi, im doing the linux fundamentals module, but i ran out of spawn for the pwnbox and i need it for my excercies

can i use one of my vm instead?

and if so, how?

i really need help

[dull orchid]

you've to buy a packet on the platform , at least 20 € per month to have unlimited access with te pwnbox

[cursive cave]

can i use my kali linux instead

[dull orchid]

u need to access as ssh to the remote machine

Anyone stucked on the GETTING STARTED MODULE ?

[cursive cave]

?

so the only way i could learn

[dull orchid]

expecially on the PRIVILEGE ESCALATION module , i got access from user1 to user2 now i can't excalate from user2 to root !!!

[cursive cave]

is to buy the pwbox

[dull orchid]

hey mate i pay 20 euro per month , do you think i'm stupid ?

[cursive cave]

nop

ill buy it then

[dull orchid]

yes indeed

is the best thing u could make for yourself mate

trust me bros'

hacking is like flyng

and it's not enough 1 life to learn it

[unique valve]

You can use your own VM and VPN into the academy network as well.

@tight glen and @rustic sage feel free to dm me for help on that challenge in Windows Fundamentals. Pay special attention to the object that you need to get the SDDL for.

[cursive cave]

Oh, is there a tutorial to do that on youtube

Im doing the module “Linux fundamentals” btw, im not doing the official hackthebox yet

[quiet vault]

Do you know how to set up a virtual machine?

[unique valve]

Im not sure about the video walkthrough on YouTube but id be glad to help through DMs. If you use your own system I recommend VM as @quiet vault mentioned.

[flint moth]

@rustic sage you mean you want to move your uploaded shell to some other location?

[tight glen]

think he wants to call it via url

[flint moth]

Just remove the ?0=I'd part

To activate the shell , you have path but from that screenshot in url parameter (?0=Id) at the end is changing the path or something , so I guess it should work <ip>/path/shell.php

[solid cradle]

appears you might need to work on the location of your shell for the url. Think relative to webroot, not file-system root.

I probably should have said relative to webroot base, not file-system base, but I think ya figured out what I meant.

[flint moth]

Ohh ok so shell is uploaded a path which it cannot access 👍

I wonder if we could test LFI here to activate that shell too 🤔

[solid cradle]

not necessarily. Where they have it may be accessible, but the URL in the request is not pointed to an accessible or existent location relative to the webserver documentroot.

if the webserver documentroot is /var/www/html for example, it shouldn't be allowed to access anything outside of that such as /var/www or /var. The url needs specify the location relative to where its documentroot is set, so someplace like /var/www/html/myfiles/myfile wouldn't have the full filesystem path, but relative to where the webserver documentroot starts.

a url with something like /var/www/html/myfiles/myfile in it translated to a filesystem location would translate to /var/www/html/var/www/html/myfiles/myfile when the documentroot is factored into it. Hopefully I tiptoed around that enough without spoiling anything.

[dull orchid]

anyone can help me about the use of "chmod" in order to do the privilege escalation ?

thanks a lot in advance

[wanton nest]

Is it possible when I finish Jet that I reach or close to the level of Pro Hacker?

[dull orchid]

neither Kevin Mitnick , after all is a pro hacker ...What would you like to be ? Please come on...

[coral fable]

Hmm , I'm a bit scared by the challenges STACK-BASED BUFFER OVERFLOWS ON LINUX X86 . I tried a couple of techniques to read the /root/flag.txt but it canceled by permission

I hope I don't have to rewrite variables or code over the original code in the text section?

I'm a bit afraid because I don't want spoil the final exercice

[opal grove]

why is the working with web services module so hard to understand what they want you to do -_- or is it just me!

[tepid peak]

Try running outside of gdb

[untold mountain]

can someone give me a little advice as to why my nmap is not working

if so please dm me.

[coral fable]

I tried but same side effects, this morning I've crafted a homemade shellcode but ...
the setreuid seems targeted on time for write and I guess after I can not use a second time. But it's not clear actually for me

[finite zealot]

Hello all

[lament cave]

hey here need a small help in academy challenges sql injection can anyone help me out

[unique valve]

Hello and welcome!

[cursive cave]

Find a way to start a simple HTTP server using "npm". what the heck :))

as far as i know, npm is a packet manager

can anyone hint me a little bit

[tepid peak]

You can DM me if you want to, although I'll probably need to redo it

But I had the same isssue as well

[median yacht]

Yo

[unique valve]

Read more about npm and http-server on the project’s official docs site.

[crystal quail]

Sure, PM me

[mossy girder]

Any tips for case6 for the SQLMAP

I can't seem to set the ID as a param using diff permutations and prefixes

I have the rest of it figured, stuck on 6

And I did use prefixes and suffixes, not sure I am looking at it right

I don't want an answer... just looking for reading material into that case

[short horizon]

Privilege escalation in getting started made me feel so dumb lol

One thing I learned is try everything even if you don't think you have access to it lol

I also gave up on using my VM for HTB academy and started to use the Parrot OS provided, Some sections of the module aren't possible for me on my VM for some reason. I tried a new instance of kali linux as well as connecting to the academy vpn and keep getting server timeouts for some problems/challenges

[remote dome]

hello.. may I have a support from the academy stuff.. I think I resolved an question but still say that the answer isn't correct

[crystal quail]

offtopic for this channel, I think, but has anyone else had firefox performance issues with the ParrotOS OVA? Nevermind, OVA running in vbox. I changed the graphics controller to 'vboxvga', and life is a little better now.

[oak spire]

Can someone message me about getting the proper info for this question?

Identify one of the non-standard update services running on the host. Submit the full name of the service executable (not the DisplayName) as your answer.

it wants me to use powershell

thank you for your help, just got it

[solid cradle]

what would be 2 numbers that the sum equals 1337?

[muted mist]

Hey guys! Does anybody know if module that classifies/explains all kind of vulnerabilities exists in Academy?

[vague crag]

I have a general question, Where should you start if you have 0 hacking knowledge

[astral seal]

Heyy guys, I' currently stuck in the Service scanning section of the getting started module.
"Perform an nmap scan of the target. What service is running on port 8080?"

it shows the service as http-proxy. But when I submit it as the answer, it's saying wrong answer.

[molten tiger]

Someone who knows about hacking could help me please send priv I take help has in relation to social networks

[quiet vault]

If you don't know much about linux check out the linux fundamentals course. You need to know at least the basics

[mossy girder]

If you have 0 knowledge, I would suggest watching BGS...

getting an idea of some of the flow, do pico puzzles

[fleet moth]

I would begin with all Tier 0 General modules on the HTB academy

[floral nimbus]

Like a good few folks I'm also tearing my hair out trying to solve File Inclusion / Directory Traversal Skills Assessment and could really do with a hint. I've read through index.php and tried a number of the LFI/RCE techniques but all to no avail. Any help would be gratefully received.

[low star]

^^^^^^^ im not even jokeing, i came here for this too. @floral nimbus the /var/log/apache2/access.log poisioning using <?php system($_GET['cmd']); ?> is just not working. i have no idea why

[low star]

How do I go about resolving this issue ?

[keen raft]

Okay I think I am going insane. I'm on the SQLMap Essentials skills assessment and I cannot for the life of me find a single request that I could even begin to exploit. Every link points to #. I don't know if I'm missing something obvious here but all the forms look like this <form action="#" class="...">. Either the box is broken (unlikely) or I am incredibly stupid (very likely). Could someone give me a pointer please?

bruh

[solid cradle]

strikethrough text makes that question a little hard to read and comprehend.

[keen raft]

I figured it out and edited the message. The bruh was the result of me discovering that I’m a moron

[solid cradle]

if you were trying to hide spoilers, you can select text when its in edit and a menu should popup with one of the options being to mask the selected text.

[solid cradle]

ah ok. lol

[tidal mango]

Is anyone able to help me on the Stack-Based Buffer Overflows on Linux x86 module? Currently on the Identification of Bad Characters section and need some help. Thanks

[misty violet]

Aloha brand new here. brand new to everything

[unique valve]

Welcome. Its good to have you.

[cursive cave]

hi

i just bought the htb member ship

i am COMPLETELY new to this, any suggestions on what module/ path i should learn

[frail ruin]

Hi. I need help with Skills Assessment - File Inclusion/Directory Traversal module. I can read source code and I know log file path but I am not able to read that.

[frail ruin]

<?php if(isset($_GET['log'])) { $log = "logs/" . $_GET['log']; echo "<pre>"; include $log; echo "</pre>"; } ?>

I just need to bypass this I know it appends logs string to path. So I use forward slash to bypass it. Logs are already written with <pre> tag does that affect bypass?

[young sleet]

can someone help me resolve the issue of not being able to connect to rdp via vm even though i've installed openvpn

also i'm unable to get this question : "What is the exact name of the pre-defined firewall rule that must be enabled to allow SMB connections to Windows from the Pwnbox?". if anyone could explain me a bit in detail

[marsh hollow]

hey need a hint on question 2 on Managing Libraries in Python (Continued)

is in Introduction to Python 3, plz dm

[unique valve]

I can help. DM me when you are ready.

[deft cloak]

can someone hemp me on this
ssh htb-student@ip says connection refused

I am on linux fundamentals services and process mgt, I have connected using academy openvpn and and also tried after resetting the target

[unique valve]

Feel free to DM me for help when ready.

[rustic sage]

How do I even get started?

[unique valve]

I recommend you start with https://academy.hackthebox.eu/course/preview/introduction-to-academy

[craggy sage]

do you guys teach from basics ..or any material

[unique valve]

All fundamentals modules are designed to reach someone at a beginner level, though they are meant to challenge people to apply the understanding.

[craggy sage]

thank you !

[tribal quail]

How often is HTBA updated btw? What was the latest module added etc.?

[stable turtle]

Can someone check if this is intentional, the module Network Enumeration with Nmap medium lab asks for DNS version, however the answer turns out to be a flag

[tight glen]

i think Intro to Network Traffic Analysis is fairely new, id say a module each month roughly? maybe less

[oblique epoch]

Hi, is there an academy .ovpn file?

[median meteor]

Hi, can anyone give me a hint for SQL module ?

Login as the user with the id 5 to get the flag

stuck on this question

i can log in as tom for example , but i guess i need to use OR to log in as user whos ID is = to 5

??

[unique valve]

Yes you can find it right near the module challenge at the bottom of a section.

[rain juniper]

do you guys have any tips for getting the ssh session to stop crashing?

i'm able to connect a couple of minutes until it just stops responding

[quiet wadi]

Hey I'm on the last step of the skills assessment for Javascript Deobfuscation and I cant seem to get this POST to work. Anyone available to give me a hint as to what I'm doing wrong?

nvm syntax error. I forgot the -d. F

[craggy sage]

Hello admin ..somone from this server has changed my nickname to 'Change me'

Pls dont do this

[oblique epoch]

Thanks, I figured out. I think just the module I was in didn't have it yet? A later module had the option.

[icy snow]

File transfers module… page 2 Windows File transfers: “Upload the file “upload_win.zip” using a method of your choice. Then, RDP, unzip, blah blah blah.” I’ve tried SCP but it’s not allowing the ssh connection. Any ideas what I’m doing wrong?

[novel matrix]

then verify. name must be taggable and in English with no ASCII character. We have #rules for a reason.

[still kraken]

[Module Hacking WordPress]
{Skill Assessment}

Hi ! I'm currently doing the wordpress assessment and I'm stuck at the first question finding the version... If you can give me a little hint feel free to PM :)

[clever imp]

Introduction to Python: First Iterations.

From what I understood from the question, I am supposed to take the code example and replace the PAGE_URL with the appropriate target and port, and then run the file. I have done that, but I am getting the following errors.

./py_test: line 5: PAGE_URL: command not found
./py_test: line 7: syntax error near unexpected token `('
./py_test: line 7: `def get_html_of(url):'

Is there a step I am missing?

[tribal linden]

Can any one help me with the active directory module?

[smoky root]

Hi, can someone hep me to understand, am i right or no?
Trying to fight with "File descriptors" in module Linux fundamentals, there is a question "How many total packages are installed on the target system?".

I tried this:
apt list --installed | wc
dpkg -l | wc (minus 5)

[rustic sage]

Hi

I'm new in the group

[simple cape]

Anyone to give me a pointer on how to find the answer on the last question on the Active Directory LDAP - Skills Assessment

[crystal quail]

As a hint, the 'wc' command is 'word count'. You probably aren't interested in the number of words from the apt command. You need to add a flag to that command to get what you are looking for.

[smoky root]

Yes, got it, thanks

[smoky root]

Hi, you are welcome

[rustic sage]

thanks

[knotty swan]

hi

anybody help me

[mossy girder]

I asked yesterday and then went and did the final, coming back to it... I know for SQLMAP essentials case col=ID and eve with elevated level and risk its not seeing it as injectable...

any tips or am I again overthinking this one

Thanks.. I am just not looking at it right I think

[mossy girder]

Any more tips on SQLmap case6 ?

[tender dew]

Anyone help with a nudge on the Broken Authentication skills assessment?

[mossy girder]

I just want pointers..

I passed permutations at it... but still no luck

[rain juniper]

just a question that came up with the file transfer room

what do they mean that connecting to our smb share will give us the hash?

is it the one the user enters as the password or something else

[lofty brook]

Can you hack on mobile?

[mossy girder]

I would haaate trying to type out mobile

[quiet vault]

Probably, I think you can run kali on some phones and you can use termux. I would invest in a decent bluetooth keyboard. To be honest I would look at getting something else, laptop or desktop

[idle sonnet]

yo

im doing the request and response module where you use burpsuite to intercept http requests, im having the issue where the embedded browser is not supported in sandbox

i think it is because it is running as a super user or something, how would i run it as a normal user?

its ok i manually added the proxy to the foxyproxy, im not sure if that is supposed to be done like that. the module never mentions adding it, just it implies that its already made and all you have to do is click on it

[nimble kayak]

Hey everyone. I'm doing the Active Directory BloodHound module and need some help for the this question:

"Using the attached data find what rights the user andrew.page has over the user wilford.stewart."

I am tinkering around with BloodHound, but I'm not sure what they are actually looking for? Not looking for the direct answer, just help understanding what I should be looking for!

[nimble kayak]

Ah, I figured it out. I will answer the question, just in case someone comes searching in the future:

You need to look for the "Edge" between the two 🙂

[icy snow]

FYI I figured this out. If anyone needs pointers lmk.

[nimble kayak]

Anyone have trouble RDPing to the target in the Active Director BloodHound Skills Assessment? I keep getting incorrect user or password and I'm using the one provided! I restarted the target a few times just to be sure there wasn't some random error.

[pulsar timber]

how to hack

CODM

[novel matrix]

If you're here to "hack" a video game. You may as well leave. Please read the #rules

[sly nebula]

If you still need help, PM.

[silver fable]

The VPN connection to academy is only for subscribed users?

I cann't find it anywhere

[autumn pilot]

not every module has .ovpn file for it

if there is a docker instance in the exercise you do not need vpn to be able to reach it

[silver fable]

I was looking at SQL Injection Fundamentals

[astral seal]

Hii guys, I'm kind of stuck with Service Scanning section in the Getting Started module.
the nmap command that I run is not outputting any ports when I scan for all the ports.

but if I specify a particular port it'll show result

This is the nmap command that I use.

nmap -sC -sV -p- <TARGET> -Pn -v

Any idea why it happens?

[flint moth]

@astral seal -p- & -Pn tags increases the time need to scan significantly

[astral seal]

If I don’t use -Pn, it doesn’t scan at all. Says the host is down @flint moth

[wary inlet]

ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.27 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -sC -sV -p$ports 10.10.10.27

i found this in help section

[flint moth]

@astral seal after executing the command you can hint Enter to know it's progress

Or sometimes hosts need some time to go into working State

[wary inlet]

can u ping the host?

[astral seal]

Error #487: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-"
QUITTING!

This is what this one outputs

[astral seal]

let me see

THe thing is if specify a particular port, it'll return the result

sudo nmap -p8080 10.129.86.200 -Pn -sC -sV

PORT     STATE    SERVICE    VERSION
8080/tcp filtered http-proxy

[astral seal]

no response @wary inlet

[flint moth]

@astral seal seems like some problem with host maybe

[astral seal]

I feel the same. I have been spawning different target machine since yesterday. @flint moth

But this site can show the common ports (not all the ports)

http://www.ipv6scanner.com/cgi-bin/main.py

[flint moth]

@astral seal you can also use the script that @wary inlet typed if you know little bash script , one of the creative way

[flint moth]

.

[astral seal]

@flint moth I have tried the script. it throws an error

Error #487: Your port specifications are illegal.  Example of proper form: "-100,200-1024,T:3000-4000,U:60000-"
QUITTING!```

[opal storm]

In the section "Identifying Hashes" within the Hashcat module, could someone help me with my command for cracking hash? Its taking a while but i feel like i have it right? Or could it be that i am using rockyou.txt as my wordlist?
Nvm i just need to learn how to read.

[vague crag]

what am i doing wrong here? I'm pretty sure this is correct

This is the section Service and Process Management of Linux Fundamentals

[crystal quail]

Try simply "apparmor"?

[vague crag]

There are 2 services running with the same description. You have to sumbit the snapd version of the service apparmor

[icy snow]

Anyone able to help me with File Inclusion/Directory Traversal? Page 6 - hardening tips, second question… I’ve completed the whole module except this question and it’s driving me nuts. Hint didn’t help.

[flint moth]

@icy snow have you added the system() function in php.ini file ?

[icy snow]

I think that’s my problem… I feel like I’m doing it wrong

I opened the file with Vim, added the ‘system()’ function, and then saved it.

[flint moth]

You sure you added system at the write place?

[icy snow]

I added it under ‘disable_functions’

[flint moth]

Oka , then just execute any php code that contains a system function you can search on google for it

[icy snow]

I’ll try it again. If I get stuck again I’ll PM you. Thanks!

[clever imp]

Did anyone else in here have an issue with intro to python first itterations? I am unable to run the code from the module, and also as a test, I tried running the site through a python tool which does the same thing, which I tested on several sites, but when I try to run it on the target:port, it always errors out. Any help would be greatly appreciated.

[gray cypress]

Hi
I try to solve the path traversal challenge. i can use php wrapper and read the index.php but now, i don't know how to get flag because i can't read other file and i can't convert /root/flag.txt to base64.
plz help me.

[flint moth]

@gray cypress base64 , read carefully index.php , directory

[gray cypress]

Thank you
I was able to solve it.
👍

[rustic sage]

Module : WINDOWS FUNDAMENTALS
chapter : NTFS vs. Share Permissions
question : What is the name of the utility that can be used to view logs made by a Windows system? (Format: 2 words, 1 space, not case sensitive)
I have tested several usernames with no spaces and by making combinations but i can't get it.

[unique valve]

Its not a user name that you are looking for. Its a utility in Windows. You can find the answer in the reading.

[rustic sage]

nice i succeeded

[unique valve]

Excellent job! Keep moving forward.

[west otter]

So am I just an idiot or does the free tier of Academy just not work for me?

I am testing the fundamentals modules to get a feel for how the courses work, but my workstation keeps failing

[unique valve]

By workstation do you mean your personal computer or Pwnbox?

[west otter]

The Pwnbox

I am just trying to get through the intro to htba course and it has now expired twice and says I have 0/1 instances remaining

[unique valve]

Feel free to dm me for more in-depth troubleshooting.

[safe smelt]

I'm stuck getting the last cube from the WordPress module. (Shell Upload) I'm sure I'm missing something really basic here. Cans someone help me out? This is killing me!

[rancid holly]

anyone solving knowledge check of SQL Injection fundamentals would like to know how they are approaching cause I am stuck after trying to get through the logon page + the site functions very slowly

[safe smelt]

@rancid holly DM me and I can give you a hand.

[dark lodge]

Hello guys, i am stuck on introduction to bash scripting at the module comparison operators. If someone can DM i would show you what i have done and maybe u can help

[hazy hearth]

If I am going through modules on HTB Academy and running kali linux do I need to use openvpn ? or can does task be completed on my network . OpenVPN seems slow making some task incomplete

[stone jacinth]

Can anybody help will the Skills Assessment - File Inclusion/Directory Traversal question "https://academy.hackthebox.eu/module/23" I tried all the ways given in that topic, but still no result.

[tame horizon]

Hi, I seem to be stuck on trying to start apache2, I use apt and updated before install but I keep getting a failure when trying to systemctl start it. There are no logs. Anyone encounter the same problem on pwnbox?

[bold oar]

Hi!
Anyone who can give me a help with correct answer format in "OSINT: CORPORATE RECON" Module? Thx!

[smoky root]

Hi can you help me with Linux fundamentals - Filter content, question 3 ? "Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer."
I don't understand what is "unique paths"

[rustic sage]

paths that aren't equal

[drifting knoll]

feel free to Dm

[timber sonnet]

can anyone help with the very last question in the file inclusion/ directory traversal? I must be missing something I have tried I think everything from the course and had no luck... Skills Assessment - File Inclusion/Directory Traversal "Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Submit the contents of the flag as your answer."

[strange silo]

Thank you! I've been stuck for two days. I could solve it with your answer, but I would never have guess it.

[opal storm]

so for the cracking common hashes in the hashcat module, for some reason, hashcat is saying its gonna take 5-7 hours to crack the hash? I feel confident in my command and what im using but idk. Ive tried different hash types as well
Edit: Patience is key sometimes

[tame horizon]

HEY!!! I actually found the reason, I think I found why my apache server wont start! So port 80 was required to be open for apachectl, but was being used be something called python 26 or something. so I killed that process to make room for apachectl. Turns out that port 80 is being use by a program to do the remote viewing for HTB pwnbox. So I guessss that I'm not able to use apache while using pwnbox and I need my own computer with a Linux distro to use the apache.service so that port 80 is open!

[open gyro]

what does this mean?

I have tried changing permission of the file , still it shows me this or am I doing wrong or does it mean something else?

[tight glen]

have u tried accessing the file as sudo?

[open gyro]

it is able to access but not write

[tight glen]

not sure what ur using to edit the file but i suggest nano or vim

[tame horizon]

anyone can confirm, apache does not work with pwnbox?

[ancient oriole]

Hi, I need help at the skill assessment - file inclusion/directory traversal. Can I PM someone about it? I don't want to spoil it here.

[wind pendant]

Help me plz. I can't login in into ssh. I type the correct network name and username and everything, but it doesn't want to connect. T^T

It says permission denied

both in the sandbox and on my laptop running Parrot

I typed ssh [e-mail] and then the password HTB_@cademy_stdnt!

[hasty mulch]

same here

I type "ssh htb-student@[ip-address-to-htb]"....Connection refused

I tried both the SSH and the "Start instance"

[hasty mulch]

nevermind. I feel sooo stupid.. I did ssh from a VM and not the instance you start in the browser.

[wind pendant]

I also did it on the instance on the browser

It doesn't work

[tribal linden]

Any on able to help with the active directory module?

[simple cape]

The Active Directory LDAP? if yes feel free to dm me

[jagged zenith]

Hey guys

[full lagoon]

Hi

How to learn

[drifting knoll]

https://academy.hackthebox.eu/course/preview/learning-process

[mossy girder]

I have been thru a TON of command permutations for SQLmap example6 including multiple prefix iterations.. I am not seeing an injectable param

Including the prefix from the cheat sheet and using )

thanks

[mossy girder]

I am just not looking at it correctly I don't think

[hasty mulch]

Anyone having trouble using pwnbox on Mac? 9 out of 10 I can´t even click in the pwnbox without triggering the "paste"-option.

EDIT: Looks like it is a safari issue. Works find on Chrome

[tribal remnant]

Finally passed the login brute forcing module. the last skill assessment was a brainfk

[neat jungle]

Anyone know why i am unable to access or open the vm? keeps saying error, validation failed. any ideas why

never mind.

[icy snow]

Anyone experience issues using FreeRDP with the boxes in academy modules?

I’m working on the Buffer Overflows for Windows modules, specifically page 3. Every time I RDP to the box, it connects for 2 minutes and then auto disconnects.

[wind pendant]

I used systemctl | grep "apparmour" and I typed the answer I got from this command, and then it says it's a wrong answer!? Huh????

There's no other answer to this, and why doesn't it work?

Is it a bug in the module?

[wind pendant]

Also what the heck?

[hushed ravine]

lmfao

[floral peak]

Hello, i am new here along with new to cyber security

[spring oriole]

I was going to ask the same question... Did you manage to complete it?

[floral peak]

Would anyone be able to help me with a very basic problem that I can't seem to figure out? I need to figure out how to find a path

[wind pendant]

... using ls?

I don't get what you mean.

[slender shoal]

Do you mean the very first introduction?

[wind pendant]

I think he meant the first intro about student home path.

I can't even connect to the ssh.

[slender shoal]

oh, I passed that

did they read the intro?

[wind pendant]

Idk, he's new

I'm also new.

[slender shoal]

I'm new, in acc

but I have old ones

[wind pendant]

Shouldn't it be /home?

It says that it's the wrong answer...

[slender shoal]

no it;s not

I think

[wind pendant]

I don't quite get some of the questions

[slender shoal]

the first question, did you get it?

[wind pendant]

Some I'm even correct, but missing and "s" at the end

Yes I did

[slender shoal]

oh

tbh, one use of Linux isn't enough tho

[wind pendant]

Also, I typed uname -a and then type the kernel version, it also says that it's wrong.

[slender shoal]

it happens sometimes

[wind pendant]

Then how am I supposed to finish this course lol

[slender shoal]

I actually sometimes make multiple accs and reanswer them

[wind pendant]

Wha-

[slender shoal]

I have like 15

[wind pendant]

Omg

[slender shoal]

I need Linux lol

[wind pendant]

I have ParrotSec on my laptop, and tried to ssh through there too.

[slender shoal]

so I downloaded Parrot OS

I also have Kali at the same time

[slender shoal]

it's hard on laptop, it's lagging so much

[wind pendant]

I'm not running it on a VM

[slender shoal]

-_-

[wind pendant]

It's fast for me tho

[slender shoal]

good, for me I have low connections

[wind pendant]

I use Parrot to replace Windows 10, because it's too slow.

[slender shoal]

I use a lot of Linux for playing XD

[wind pendant]

I'm sorry to hear that.

[slender shoal]

nah it's okay, it happens times

Well I do have problems with the modules tho

For me, it's hard to ||understand English||

I speak tagalog

[wind pendant]

For me, it's hard to understand what the exercise is trying to hint me at.

Rather, the question is hard to understand.

(I'm not a native English speaker though)

[slender shoal]

mostly when you saw the cheat sheet tho XD

that triggers me

[wind pendant]

xDDDDD

[floral peak]

yeah it was like the very introduction to linux fundamentals. I know about ls and used that but whenever I tried to put that as the answer it said it was wrong. I simply wanted to ask in case there was something I could've been missing

[wind pendant]

You have to be logged in into SSH.

I can't login tho. I don't get why.

[floral peak]

right and I was logged into ssh

[floral brook]

Hey,
I am stuck on the “Broken Authentication Module”.

I am about to give up on this module. I’m stuck on page 5 “Weak Bruteforce Protections” and can’t answer question 2: “Work on webapp at URL /question2/ and try to bypass the login form using one of the method showed.” Hint: “This web server doesn't trust your IP!”.

I get the hint and used the method described in the section to change what my IP looks like in the header. I rewrote the provided python script several times, tried with hydra and ffuf, but I don’t find anything. I worked on the scada cvs to make it work with the script, used rockyou and several of the default credential lists of SecLists.

[floral peak]

what I was specifically having a problem with was finding the path to htb-student's-mail

[wind pendant]

The problem is with the wording of the question..

[floral peak]

Oh really?

[wind pendant]

I think.

[floral peak]

You got any idea what it actually wants?

[wind pendant]

/var/mail/$USER maybe?

idk

I'm confused as well

or /var/mail/

[floral peak]

yeah, I mean from what it asks I assume that it implies the /htb-students-mail exists somewhere. As to where is whats killing me

Ill try that though

[wind pendant]

I think they are doing a bad job asking questions. It's not that the meaning is isn't obvious, but it doesn't narrow the target down.

[floral peak]

yeah, I think Im going to have to agree with you on that. Im not exactly clueless with how linux commands work and how to use them. I wanted to do this to solidify what I know of linux

[wind pendant]

same

they also have an issue of case sensitive or only one answer works

for example, I was scratching my head why I can't pass the question. It's because I was missing an "s" at the end

[floral peak]

ah yeah

[wind pendant]

They could've add a feature, like "Oooh! You're close!"

[floral peak]

i mean case sensitive, I can kind of understand due to bash and anything you put in the CLI needing specific syntax

[wind pendant]

Yes, but some answer doesn't need to be

[floral peak]

Thats true

[wind pendant]

for example I was typing "parrot" and it didn't work, when "Parrot" works

it's the same os name lmao

[floral peak]

lol

[wind pendant]

right, I have to go to sleep

It's 0:26 now in my country.

bye

[floral peak]

ah yes bye bye

[wind pendant]

Sorry, my English got weird there lol.

[floral peak]

that is okay

I found the answer by the way

you were right about /var/mail

[wind pendant]

So they are bad at giving us instructions all along...

Bye

Have a nice day/good night

:)

[rustic sage]

Anyone willing to explain to me what the question in "Take Control of EIP" in STACK-BASED BUFFER OVERFLOWS ON LINUX X86 means? I tired reading the registers with gdb and stepped through the program using the different values as it progressed but no answer seems to be correct. I'm sure I'm missing something and would appreciate a nudge. Thanks 🙂

[wooden cradle]

anyone who can give me some help with "OSINT: CORPORATE RECON": "Cloud Storage" or point me in the right direction?

[mossy girder]

Greyhatwarfare maybe

[drifting knoll]

feel free to DM

[ancient oriole]

Hi, I am stuck at Introduction to bash scripting - comprasion operators, could someone help me? I cannot find what's wrong in my code. I am trying to solve this question for 2 hours now.

[nimble kayak]

I asked this a few days ago, but got no responses. Figured I'd wait to see if any errors were cleared up, but I still have the same problems. Original questions:

Anyone have trouble RDPing to the target in the Active Director BloodHound Skills Assessment? I keep getting incorrect user or password and I'm using the one provided! I restarted the target a few times just to be sure there wasn't some random error.

[deep patio]

I'm getting the same problem... Completely stuck on question 2. I've rewritten the python script, tried hydra and several different PW lists, but I'm not getting anything.
Since the hint it This web server doesn't trust your IP!”, I would expect some message on the site saying that the IP is invalid (This is a training module after all), but all I'm getting is "Invalid credentials."
Can anyone give a sanity check or nudge for this?

[slender shoal]

tbh, it is wrong tho bc the question was supposed to be easy and understanding
keep reading the question and get the supporting detail of it

the first question got me fooled tho

[floral peak]

Ah yeah, That's what I was thinking as well. Oh well, this stuff is good and all but I suppose there are still things that could be refined

[slender shoal]

have you found the answer yet?

[floral peak]

yeah I found it

but there are many questions like that it seems within the starting linux modules

[slender shoal]

yep, do you have your own Linux?

[floral peak]

hmm no not really

Ive got vmware and downloaded the linux vm but I somehow messed something up and gotta redownload it

[floral brook]

Ok, got it to work. The username & password don’t matter at all. You can just use curl.

[tough fjord]

The answers are easily findable without guesswork

[ancient oriole]

Hi, could someone please explain to me what do they want me to do in introduction to bash scripting - flow control - loops? i don't understand it. They want me to encode one variable 28 times, but how do i get the 28th hash? I am encoding, not hashing.

[tough fjord]

get it to print out the result of the 28th round of encoding

[ancient oriole]

and then get the lenght of it, and assign it to the salt variable?

i did that, and it says error bad decrypt

but thanks anyway

[tough fjord]

confirm your script is working as intended

if you are getting bad decrypt then one of the values you are using is not correct

[ancient oriole]

I still cannot solve it, i've even tried to bruteforce it, but still couldn't get the right salt, i am doing something wrong, but i don't know what.

[mossy girder]

Focus.. I just did it

Read closely thru the script, your for loop... Your encoding

Its doable

[sly nebula]

To anyone struggling with "Broken Authentication": PM me, I can provide guidance.

[nimble kayak]

Anyone have trouble RDPing to the target in the Active Director BloodHound Skills Assessment? I keep getting incorrect user or password and I'm using the one provided! I restarted the target a few times just to be sure there wasn't some random error.

[drifting knoll]

you have to wait 5 minutes until the target spawns because its loading an entire lab in the background

[nimble kayak]

...For the password to work?

The RDP window launches fine, but I'm being told that the login information is incorrect.

[drifting knoll]

targets need to be configured properly (by the spawning process) before you can use it. if you interrupt it or try to connect it might cause an error

[nimble kayak]

I am waiting until the target launches.

[drifting knoll]

you need to wait 5 minutes

[nimble kayak]

@drifting knoll I've now tried logging in every 5 minutes from your message. Maybe I am not being clear about my issue.

The RDP launches and Windows says "The user name or password is incorrect. Try again."

[drifting knoll]

did you copy&paste the password?

[nimble kayak]

Yes

[drifting knoll]

try to type it manually

[nimble kayak]

I have done that as well

[glass quail]

can somebody help me with using my own machine for the modules on HTB academy?

[nimble kayak]

@glass quail You need to download the VPN key to use your own machine.

[glass quail]

where is that located? I know how to do it on my HTB account but not the academy one I'm not seeing the option .

[glass quail]

^^

[nimble kayak]

It's usually on your account profile page, but you can also download it while you are in a module. There is an option in the "Questions" area that says "Get VPN Key"

[glass quail]

can I take picture to show you what I see? I'm on the module javascript deobfuscation at the end and haven't seen it.

[nimble kayak]

In my experience, some of the modules do not show the option. It's kind of lame, but I try to work around it.

[glass quail]

Ok thank you it's kind of annoying because the machine isn't persistence

[wicked gazelle]

Hi hi! i need some help with Stack-Based Buffer Overflows on Linux x86

the skills assessment, im so stuck

:S

[mossy girder]

Without giving it away any wordlist suggestions for the the HTTP auth

for brute-forcing

[mossy girder]

The Default Ftp one was my next guess

[astral seal]

Hi guys,
I'm kind of stuck at the getting started module in the section Nibbles - Initial Foothold. I see that the source code contains /nibbleblog/ in comment. But I can't navigate to /nibbleblog/ from my browser. Strange !!
But I can navigate to /nibbleblog/admin.php

Is the box buggy??
Any insight on the situation is apreciated. Thanks

[mossy girder]

No.. the box can be done

[open gorge]

I guessed but can anyone explain how you can determine this because it's not explained in the module

[astral seal]

10.129.196.113 Check this IP

[mossy girder]

Just need to be creative about getting your shell onto it

[astral seal]

http://10.129.196.113/nibbleblog/

[midnight forge]

The|| ttl|| gives a clue about what OS is most likely used. Thought that was mentioned in the module..?

[open gorge]

I didn't see it specifically unless I missed it completely

[drifting knoll]

pls be careful with spoilers

[open gorge]

Lo Siento

[stiff stream]

Can anyone take look at my code for Bash Scripting to print last 20 characters for the variable var?

[mossy girder]

YEah no spoilers... I did that one last nite

[blissful cliff]

Wondering if someone can help me with submitting the answer for the Windows fundamentals - Skills Assessment (bit of a daft one potentially lol 😅 ) ... I have followed the steps to || get set all the security permissions and putting the user in HR group etc || and || even got the sddl || however no luck submitting the answer for some reason ... I haven't included the sddl in this msg for spoilers 🙂 so if you are able to help please DM .... thanks in advance!
-----‐------------------------------------
This has been RESOLVED thanks to everyone who dm'd with help 🙂

[narrow owl]

Does anyone know how to connect to the vpn so that I can answer the qustion openvpn seem to not being able to connect using academy.ovpn file, I think my country blocks VPN any solution please

[dull orchid]

If you use the vpn of the instance in the module , the VPN is included into and it works

[twin stirrup]

Can I get some help with this question in the hashcat module Crack the following hash: 978078e7845f2fb2e20399d9e80475bc1c275e06 using the mask ?d?s.

[rustic sage]

The mask has to be placed at the end of your command iirc

[fair narwhal]

Hi!, im doing SQL Operators in SQL Injection Fundamentals module and i have a doubt, can i dm someone who did this before?

[daring tusk]

someone wanna help me out with the hash 7106812752615cdfe427e01b98cd4083 using hybrid mode or rules?

[daring tusk]

message me if you want help! I did that module and got the flag.

[quiet wadi]

Question, I'm doing Nmap Enumeration Module and this is asking me to enumerate the hostname of my target, but it doesn't give me a name server to use for DNS resolution. Am I missing something?

Disregard there is another way to get the NetBIOS computer name without using the "--dns-server <ns> scanning option"

[tribal remnant]

I'm also struggling here, actually I logged in as admin, but no matter how i tweak the token in the decoder, none of these are accepted as the correct answer.

[inland glen]

ask a question you find the answer, is this how htb "teaches"

[inland glen]

so i will ask a different way, i just bash my head against the wall until the answer comes to me magically (if i am wrong, just keep being wrong until i am less wronger)?

[daring tusk]

Struggle is normal when it comes to solving problems on hackthebox. The most useful help is the one that allows the student to get back on track and to understand his errors. If they are stuck, then they must be guided accordingly while not hand feeding the answers.

[tribal remnant]

guess ye, but I feel like the answer here is nothing to do with the topic (POST requests) and as I said, I'm already in (learnt what I have to learn from the current lecture). So I'm having a modified cookie already. But it says it's not correct.

Or is it just the displayed name what I changed? Can any1 point me where I was wrong?

[tribal remnant]

got some hints from Zand, where the confusion was. Thanks!

[glass quail]

it finally started showing up

[tough fjord]

thats how most education establishments 'teach' - In college / university you are asked a questions and expected to go and find the answer. Effective research skills are part of the learning process. You cannot expect all answers to be spoonfed to you all the time via course materials

any that do that are effectively guardrailing you (like those guard rails in bowling that stop the ball going into the gutter) - it becomes impossible to fail, it doesn't matter what you do you will hit the target. Then once out in a real environment you start hitting the gutter and it is an up-hill battle to get out of it

People shouldn't be fed answers, they should be guided into the right area to discover the information they need. Most the issues I see people encounter is because they misunderstood or assumed what was required and got stuck into a specific thought process and couldn't back out of it. Normally all it takes is a small nudge and they achieve the task.

[vapid grove]

Hi, im stuck at sqlmap essentials module, at skills assesment

[cursive cave]

brooooo who made this website? i think i just found an easter egg in here

on the basic networking course

in the MAC address part

there's an examole

example of a MAC address

DE:AD:BE:EF:13:37
DE-AD-BE-EF-13-37
DEAD.BEEF.1337

bruhhhh dead beef 1337

1337 is LITERALLY a rap group

in my country

yoooooo this is sick

is this some kind of coincidence or something

[dusk saffron]

https://en.wikipedia.org/wiki/Leet @cursive cave

[cursive cave]

pfffffffft thats a huge misunderstanding but also a coincidence at the same time

[twin stirrup]

Anyone available to take a look at my command for the hashcat module?

[sly nebula]

"STACK-BASED BUFFER OVERFLOWS ON WINDOWS X86", Module "Fuzzing Parameters": I am fairly sure I have the right answer to the question (I can provide proof), but for some reason it won't get accepted. Could someone shed some light here?

[vague sigil]

Im stuck at the last step in the knowledge check, if anyone willing to give a nudge

[tough fjord]

Thorough explore the site to find the vulnerable location

[open gorge]

Hey, I'm having difficultly revealing the hostname on one of the module and I tried both a -sL scan and a -sn

[vague sigil]

Is the knowledge check module a bug?

[fluid pilot]

@open gorgeTry -sV

[vapid grove]

Yes I have already done that, but none of the files seem to be php or use any parameter

[pine hound]

turn on Burp proxy and click around. you will find it.

[tough fjord]

then you haven't looked thoroughly through the site tbh. It's there and once you find it the rest is simple

[rustic sage]

Hello, I need help with the POST method of the web request module. I've done what the exercise ask me to do but I don't know what I have to input to complete it.

[quiet wadi]

I believe you have to adjust the cookie you're given to make the site believe you've previously logged in as admin

[flint moth]

@sly nebula did you used the same code for FUZZING as shared in module ? Because I tried my own little code and it my more exact value but the module's code give fairly rough value which is the right answer

[sly nebula]

Yes, I did.

Oh, I see what you mean. I just got the right answer. Thank you!

[whole grove]

Can anyone tell me why do you need powershell in Pwn box?

[limpid heath]

Hey guys! I need help with the windows fundamentals module. I' m in the NTFS vs. Share Permissions section and i don' t know what the pre-defined firewall rule is.

Pls

[autumn pilot]

check the firewall and inbound/outbound rules

[limpid heath]

i cant find something

I am really new to hack the box academy. It is the second module that i make

SO i dont not much about this

[mortal basin]

The question mentions"increments of 1000", so this is not the exact length. This comes later..

[vague sigil]

Still stuck at last step of knowledge check 😦

[rustic sage]

I did it but nothing

[quiet wadi]

The cookie isn't the flag. You have to replace your cookie with a manipulated cookie. The cookie it gives you may be encoded. The flag will have the classic HTB{SomethingSomethingDarkSide} format

You need to manipulate the cookie itself and then change your cookie to the manipulated cookie in a way that tricks the system into thinking you previously logged in as admin

[rustic sage]

done! thanks you

[quiet wadi]

No problem at all :)

[neat tide]

Yo! Can someone help me with this, I'm not able to chmod the id_rsa file

module---> Privilege Escalation

[quiet wadi]

Notice you can read the private key

[neat tide]

Yup I'm supposed to use vim... But I have no idea how to save the key on vim

[quiet wadi]

I'll DM you

[dark lodge]

Hello guys, i try to answer this

i did this but its not working could u help ?

[cosmic dirge]

Hello ,help pls I try to append 2021 to rockyou.txt for use hashcat with the rule i use echo ‘&2 &0 &2 &1’ >rule.txt after this hashcat -a 0 -m 100 rockyou.txt -r rule.txt but can’t crack

[sly nebula]

Yeah, my bad. I misunderstood the question and went too far ahead.

[steep kite]

can someone answer me why I have no internet connection in the pwnbox? : (

[dusk saffron]

What do you want the rule do to? (Also, check this reference: https://hashcat.net/wiki/doku.php?id=rule_based_attack)

[urban sky]

Hey whats up guys. im getting tired of copying the answers manually. how do copy/paste from the remote vm to local machine

[sand bison]

can someone help please

[cosmic dirge]

I have to append 2020 on the end of word list the sintax is echo (&2&0&2&0) >rule.txt or ‘&2 &0 &2 &0’