HackTheBox - Academy

Name: HackTheBox - Academy
Uploaded: 2021-02-27T15:00:20Z
Channel: IppSec
Description: 00:00 - Intro 01:30 - Start of nmap 03:00 - Adding academy to our host file, then taking a look at the web page 08:50 - Discovering a weird port (33060)...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 01:30 - Start of nmap 03:00 - Adding academy to our host file, then taking a look at the web page 08:50 - Discovering a weird port (33060), attempting to enumerate it manually 13:15 - Discovering admin.php from our gobuster results 14:20 - Playing with having spaces in usernames, then seeing roleid in the parameter 16:30 - Creating and logging in with an admin to see a new vhost 18:00 - Looking for Laravel Exploits, finding a metasploit module 19:00 - Getting the APP_KEY from the laravel error page, which is needed for exploitation 19:50 - Using metasploit to exploit Laravel and …

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:30 Start of nmap

3:00 Adding academy to our host file, then taking a look at the web page

8:50 Discovering a weird port (33060), attempting to enumerate it manually

13:15 Discovering admin.php from our gobuster results

14:20 Playing with having spaces in usernames, then seeing roleid in the parameter

16:30 Creating and logging in with an admin to see a new vhost

18:00 Looking for Laravel Exploits, finding a metasploit module

19:00 Getting the APP_KEY from the laravel error page, which is needed for exploitat

19:50 Using metasploit to exploit Laravel and send the requests through burpsuite so

21:30 Analyzing the exploit, going to CyberChef to decrypt the payload

27:30 Reverse Shell returned

31:50 Looking at .env files to get passwords, then failing at logging into the datab

33:40 Creating a list of users on the box

36:10 Running crackmapexec with users and the password we found

38:45 Running LinPEAS

43:40 We are in the ADM Group so taking a look at /var/log

48:50 Looking at AuditD logs, then running aureport to get more details

54:30 Finding mrb3n can run sudo, then doing a simple GTFOBin with composer to get r

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →