My head explose now !!! @PaoloCMP
now I have to find a passowrd for the profile ???
WHAT THE ■■■■ THIS LAB ???
WE ARE IN ACADEMY ! THIS IS VERY HARD FOR THE NEWBIE
1 Like
Hey guys,
How can I login with Kira, I am using the password indicated in the hint throught ssh, ftp and smb but nothing works. In smb the access to SHARE in denied.
I also have tried to brute force ssh using kira and the wordlist that can be found in resources but it does not work
Should I use mutations with the password indicated in the hint?
Thank you in advance
yes
Hi guys! Can you give me some tips on the mysql part? I’ve tried almost everything, googled 3306 and 33060, looked through all mysql, mysqld and mysqlx files, I also tried going through all the existing default credentials (with and without rules). I don’t know what else I can do. I have access to the user sam and k.
this is the best hint, thank you very much.
After your hint i switched to the pwnbox and i solved it in about 30 minute. Thank you very much
Topic.: Password Attacks | Password Mutations
PWNBOX and PaoloCMP’s hint was the key for me as well. Pretty frustrating that the VPN wouldn’t work. 
Hi man,
I try to attack the Browsers with firefox_decrypt and laZagne.py
For firefox_decrypt, It ask me for a master password. I can’t go so far cause I dont know how to bruteforce this password.
For laZagne.py, it find nothing.
Other hint ?
I did it right now. Logged in as kira, firefox_decrypt, second item and done. Have you downloaded the firefox_decrypt from github?
1 Like
Hmm. I use firefox_decrypt-0.7.0 as recommand in github for python < 3.9
And it ask me for the master password…
I retry right now, same error. wtf
Oh ■■■■ I got it !
I wast time to find master password of firefox or try with other solution (like lazagne.py) , but the solution is very simple. There is no password protection for firefox !!!
I just hit enter…
Thank you very much for your hint and your time 
Any luck on this? I am still fighting it as well, mainly due to the fact that when I connect via ssh to the mysql box it keeps hanging and I can get any work done…
Still the same, how about you?
I pray to God, help me with the chapter on “Password Reuse / Default Passwords”!
1 Like
It’s easier than it seems. Nothing to crack, look at the github DefaultCreds-Cheat-Sheet for what you are looking for
1 Like
Thank you! Whatever my connection issue is on these two modules is hindering my ability to think, clearly!
1 Like
Can anyone help me with the Password Attacks Lab - Hard? I have found the NTLM hash of Administrator 500 but I can’t connect with this account and read the flag.txt.
What I can do ?
MySQL is the name of the service. Took me 3 weeks of learning hashcat, docker, and mysql, then this forum. Everything you need to solve this one ( Password Reuse / Default Passwords) is on the same page (Password Reuse / Default Passwords).
Once you crack the Administrator hash you should be able to use xfreerdp to connect and read the flag.txt
What does this mean? I am stuck on enumerating the users. Where do I get the device and country?
You can just open the folder with the password or run as different user and log in to powershell as admin.