Footprinting htb academy (medium)

I am stuck need a new perspective.
i found the nfs share and the ticket with user alex. i logged in using rdp but stuck on MSSQL. seems like there is another user, Where do i find it? or am i missing something in nfs already checkd the mount twice all files are empty. Please help someone


Alex has no rights to access the database. So you need another user with whom you can connect to the server via RDP.

1 Like

Thank you for the response.
And yes i figured that much that i definitely need another user. The question is i can’t seem to find it. I checked the Alex’s windows system there’s only one more besides alex (administrator). I am not sure where to look for other i know it has to do with HTB user i am not sure and the hint is for mssql so no help there.

you’re right that’s exactly the other user, and you have the credentials if i’m not wrong, so try to connect to rdp with them.

1 Like

Hey thank you for the response

Yes i tried using the alex’s creds it didn’t work with admin. So am i missing something maybe in the nfs ?cause i checked and there was only one file with the smb creds and that’s what I’ve been using

i did this module some time ago, i hope i remember… but i think that there were the creds for a “sa” user.
Tell me if i’m wrong

1 Like

Yes you are absolutely right and i just found a file on alex’s windows folder with the sa and creds. I guess i didn’t look properly and i got the flag
Thank you!!

I have a question on this. I can see and mount the NFS share, however I cannot access the share after it is mounted. The permission on the mount show as nobody nogroup. Any clues on how to deal with that? Thank you.

1 Like

Make sure you are a root user when accessing it. Not (htb-xxxx)

1 Like

Thanks! I can now see files and will continue, I appreciate the help!

1 Like

So I am connected as Admin to the database… I am a bit overwhelmed with where to be looking for users/passwords. I much prefer the command line/mysql :grinning: any clues where I should be looking in this web of madness GUI database?

Check out the hint and the previous example on the reading module

1 Like

I am still trying to find this… I am connected as Administrator to the WINMEDIUM sql database. is that at least the correct database/computer to be connected to? I see an “accounts” database that looks similar to the example in the course reading material but under tables/keys/dbo.devacc it is empty. Thank you!

NVM I got it!

1 Like

How did you check Alex’s windows system? Was that the ip in his ticket? Because when I try to ping that, it says host unreachable. In the NFS, I only see one file that has any data.
Any hint would be GREAT!

I have no idea how to parse any of this db stuff. I’m looking for keywords. “Accounts”, “Security”, “Logins”, “Server Roles”, I don’t see a “HTB” user in this database.

And “Look at/edit the last 200 entries” is never touched on anywhere in this module. I have not learned how to do this. What are they talking about??

Trying to read the Microsoft Docs right now, attemtping to learn this MSSQL stuff. “How to view/edit recent entries”. It’s not meant for beginners to Microsoft.

There is no “HTB” user, locally nor in SQL. {Pepe Silvia Meme}

I’m just clicking random stuff at this point… Where?? Where is this user named “HTB”?


I’m in the same position as you were/are. Any luck? Do you have a hint for me?


I’ve been stuck in MSSMS for 2 days. Logged in with the right credentials, but I have no clue where to find the HTB user. I’m trying blindly opening some databases, but no luck. I know about the editing 200 entries hint, but I don’t know on what db to use it. And what about the info from the stop? Is it useful somewhere, or it is just a reminder? Do you have a hint for me, please?

right click on


and choose edit top 200. If someone knows how to use a query to do a search please let us know! You’ll find what you need in there.

[/spoiler][spoiler]This text will be blurred

1 Like