Can someone please tell me why the user flag DOES NOT WORK, Ive reset the box and still nothing
@BrandonSG said:
Can someone please tell me why the user flag DOES NOT WORK, Ive reset the box and still nothing
This comes up on every thread about once a week. HTB uses dynamic hashes and sometimes they dont work. The hashes should change after every reset and be different on different VPNs - this means that hashes should be used as soon as you get them and that sometimes the process which registers the new hash in the scoring server will break.
If it is a box that is being hit with resets, it becomes imperative that the hash is used immediately as a reset will render it invalid.
Your choices are really:
- Wait a while, repwn the the box and get a working a hash.
- Report it to HTB via a jira ticket and get them to fix the problem.
This isnât something that can be fixed by the forum or by tips from other users.
All of the solutions for box no longer work, The box was updated recently. Windows Defender will now remove any nc.exe it comes across. Also any NC.exe you try will not run, as Defender stops it. We need to figure out a way around Defender to allow us NC.exe to run or find another solution that does not involve nc.exe being needed.
Also any tools like WinPEAS.exe will be removed via Defender.
Interesting that it has had a defender update as the device isnât internet connected (or at least shouldnât be - that might imply HTB are running patches on systems).
So you could try different versions - even when it was live there were issues about getting code onto the box.
You could try powershell as an alternative (or even PowerCat).
Or you could try different locations on the filesystem to see if that changes anything.
I have and idea today to get root on the box. If it works, i will let you guys know.
I got root, and I also notice the HTB would not take my user flag. Since I had Local admin, took look at user, and it was a different flag??? I looked up my notes and screen shot, and I had a totally different flag. VMs might have different flags. But I found another way to root the box, and no rev shell needed, no netcat needed. This way you bypass any app locker or Defender issues. PM I can you the details or I can get a new write up posted, showing the âNewâ way of getting local admin on this box. 
tip for Root: If you understand the old way, you can leverage another option. Does not always have to be some reverse shell. If you got the script to run with system access. LOL you can make the box do what ever you want.
@PanamaEd117 said:
I got root, and I also notice the HTB would not take my user flag. Since I had Local admin, took look at user, and it was a different flag??? I looked up my notes and screen shot, and I had a totally different flag. VMs might have different flags.
HTB has been using dynamic flags for quite some time.
didnât know that. thanks
C:\Users\Nadine\Desktop>type user.txt
type user.txt
Access is denied.
C:\Users\Nadine\Desktop>whoami
whoami
nt authority\system
why I cant read user.txt even I am system shell?? it is the first time I meet this problem in all htb machines I rootedâŚ
I thought you got the user flag from the FTP server on this box (in users/public)?
SYSTEM privs on a windows machine donât override individual security settings on files and folders. There are a couple of HTB boxes where being SYSTEM doesnât give you access to the flags (especially when NTFS encryption is in place).
Canât seem to get past AV for PE⌠tried many different things different things. Different directories, different exeâs for nc, tried .net reverse shell, tried .bat, even executing directly via the app console the script was popped by AV. erg⌠How to bypass av on this box???
Type your comment> @meggers said:
Canât seem to get past AV for PE⌠tried many different things different things. Different directories, different exeâs for nc, tried .net reverse shell, tried .bat, even executing directly via the app console the script was popped by AV. erg⌠How to bypass av on this box???
I wanna bring more attention to this for everyone coming here for TJ Nullâs list. Most walkthroughs donât work now. nc.exe is now recognized as a virus. Just about every reverse shell method is flagged. I just grabbed the flag with no shell.
I guess Defender got updated on this box or something? Iâm not sure. Iâm on Kali 2020 and tried multiple nc.exe and shell methods.
If anyone could speak to why the box is different, Iâd like to know.
1 Like
I donât know why, but trying a different nc binary worked for me.
Try this one: nc.exe/nc64.exe at master ¡ int0x33/nc.exe ¡ GitHub
1 Like
just did this walkthrough since the webui way wasnât working. Also used the above nc64 bnary from b1d0ws. If youâre having trouble with privesc, try the steps with curl. Worked for me. ServMon - Write-up - HackTheBox | Rawsec