Official Trick Discussion

HTB Content Machines
165

Finally got user after 4 days thank you to all those that helped me

1 Like
166

Hello, I’ve found three subs and some information from smtp enum. Can anyone give me some hints?

167

Can somebody call Jim Carrey from Bruce Almighty so he can help me get root my god!!!

168

hey, can anyone give me a nudge for finding the last domain none of my prefixes seem to be landing :frowning:

169

Thank you for this!! Been Stuck on finding the correct method for the L** and this helped :smiley:

170

I assume the bootstrap plug is some form of “funny” cross marketing?

171

Hi All

Did anyone find ‘trick.htb’ through enumeration, or was it assumed?

Thank you.

Update: the server name can be enumerated using dig command. My bad.

173

You can deduct it when you observe that there is a DNS.
A DNS needs a main domain at the time of configuration.

1 Like
175

Still can’t find more than one subdomain… can anyone DM me some hints please?

176

Thank you @Nevuer for the hint - very much appreciated.

1 Like
177

if you’re still looking for the subdomains, hacktricks’s article on dns is only going to get you so far. you need to fuzz to go further. think about the subdomain p*****-p******.trick.htb and think about an organization. the second p-word in the subdomain is interchangable when you think about a large organization.

1 Like
178

Alright, so I am pretty new to HTB, and upon my initial nmap scans I saw there was something up with debian.localdomain and the port 53 dns. I am confused on how to get a domain for dig and DNS enumeration if all I have is an IP, and setting up my /etc/hosts with the IP doesnt let me do anything with gobuster dns or anything, so I am very lost…

As far as i have been aware I need a domain name to enumerate DNS and am stuck with that part because all I have is the IP address…

179

Hi everyone, i get d*.*n domain, is the right way? I can’t properly enum dns server. Someone can dm me for a little hint?

180

no need to fuzz for subdomains. dns enumeration gives out one. later local configuration file gives the other.

2 Likes
181

DNS enumeration will give what you need

This will help you a lot → 53 - Pentesting DNS - HackTricks

182

Done! First box I’ve tried on HTB, definitely a fun one. Thanks for the couple of initial hints!

184

you can dm me for a nudge about dns

185

finally rooted, learn a few things and it was a good experince.
for root don’t think to much it’s quite easy just use google.

thanks to NeverHackMe for the help, much appreciated

1 Like
186

rooted.

Initial Access: Its tough to walk away from rabbit holes when you have convinced yourself that you are inches away from the way in. This is why we need the forums. I know this isnt new to anyone here, but find all subdomains. Once you are on the right track, use the L** vulnerability. Remember with payload filters, its hard for defenders to filter all of them. Its important to Payload All The Things. Once you succeed, find a file that can let you in.

Priv Esc: This was straight forward to me. Enumerate your user’s permissions in the most basic way possible. Get a basic understanding of the tool in question.

DM me for more nudges.

1 Like
189

restart the box. i had to restart also.