HackTheBox - Ariekei

IppSec · Beginner ·🔐 Cybersecurity ·8y ago

Key Takeaways

Exploits HackTheBox Ariekei using Nmap, GoBuster, and ImageTragick to achieve reverse shell

Original Description

00:23 - Explaining VM Layout 01:47 - Nmap Start 05:20 - Poking at Virtual Host Routing (Beehive & Calvin) 10:25 - Fixing GoBuster to find /cgi-bin/ 11:48 - Enumerating WAF (Web Application Firewall), to see how it detects Shellshock 15:08 - Using VirtualHostRouting to navigate to Calvin.htb.htb 18:15 - Using ImageTragick to exploit Calvin 25:30 - Calvin Reverse shell returned 31:35 - Poking at /common, which allows pivot to Bastion Host 34:20 - SSH into the Bastion Host 38:45 - Explain SSH Local and Remote Port Forwarding 46:00 - Beehive Reverse Shell Returned 50:00 - Finding the root password via /common/containers/bastion-live/Dockerfile 54:50 - PrivEsc via Docker (much like the LXC shown in Calamity) 57:05 - Getting root access to filesystem ==== BOX DONE. 58:10 - Failing to get root shell via Crontab 01:06:20 - Yeah screw crontab, lets just create an ssh key.
☆ Save to playlist Watch on YouTube ↗
AI explanation not available for this lesson yet
This lesson is still being prepared for the AI tutor. In the meantime, explore lessons that are ready.
Browse explainer-ready lessons →

Playlist

Uploads from IppSec · IppSec · 37 of 60

← Previous Next →
1 HHC2016 - Analytics
HHC2016 - Analytics
IppSec
 2 HackTheBox - October
HackTheBox - October
IppSec
 3 HackTheBox - Arctic
HackTheBox - Arctic
IppSec
 4 HackTheBox - Brainfuck
HackTheBox - Brainfuck
IppSec
 5 HackTheBox - Bank
HackTheBox - Bank
IppSec
 6 HackTheBox - Joker
HackTheBox - Joker
IppSec
 7 HackTheBox - Lazy
HackTheBox - Lazy
IppSec
 8 Camp CTF 2015 - Bitterman
Camp CTF 2015 - Bitterman
IppSec
 9 HackTheBox - Devel
HackTheBox - Devel
IppSec
 10 Reversing Malicious Office Document (Macro) Emotet(?)
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
 11 HackTheBox - Granny and Grandpa
HackTheBox - Granny and Grandpa
IppSec
 12 HackTheBox - Pivoting Update: Granny and Grandpa
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
 13 HackTheBox - Optimum
HackTheBox - Optimum
IppSec
 14 HackTheBox - Charon
HackTheBox - Charon
IppSec
 15 HackTheBox - Sneaky
HackTheBox - Sneaky
IppSec
 16 HackTheBox - Holiday
HackTheBox - Holiday
IppSec
 17 HackTheBox - Europa
HackTheBox - Europa
IppSec
 18 Introduction to tmux
Introduction to tmux
IppSec
 19 HackTheBox - Blocky
HackTheBox - Blocky
IppSec
 20 HackTheBox - Nineveh
HackTheBox - Nineveh
IppSec
 21 HackTheBox - Jail
HackTheBox - Jail
IppSec
 22 HackTheBox - Blue
HackTheBox - Blue
IppSec
 23 HackTheBox - Calamity
HackTheBox - Calamity
IppSec
 24 HackTheBox - Shrek
HackTheBox - Shrek
IppSec
 25 HackTheBox - Mirai
HackTheBox - Mirai
IppSec
 26 HackTheBox - Shocker
HackTheBox - Shocker
IppSec
 27 HackTheBox - Mantis
HackTheBox - Mantis
IppSec
 28 HackTheBox - Node
HackTheBox - Node
IppSec
 29 HackTheBox - Kotarak
HackTheBox - Kotarak
IppSec
 30 HackTheBox - Enterprise
HackTheBox - Enterprise
IppSec
 31 HackTheBox - Sense
HackTheBox - Sense
IppSec
 32 HackTheBox - Minion
HackTheBox - Minion
IppSec
 33 VulnHub - Sokar
VulnHub - Sokar
IppSec
 34 VulnHub - Pinkys Palace v2
VulnHub - Pinkys Palace v2
IppSec
 35 HackTheBox - Inception
HackTheBox - Inception
IppSec
 36 Vulnhub - Trollcave 1.2
Vulnhub - Trollcave 1.2
IppSec
 ▶ HackTheBox - Ariekei
HackTheBox - Ariekei
IppSec
 38 HackTheBox - Flux Capacitor
HackTheBox - Flux Capacitor
IppSec
 39 HackTheBox - Jeeves
HackTheBox - Jeeves
IppSec
 40 HackTheBox - Tally
HackTheBox - Tally
IppSec
 41 HackTheBox - CrimeStoppers
HackTheBox - CrimeStoppers
IppSec
 42 HackTheBox - Fulcrum
HackTheBox - Fulcrum
IppSec
 43 HackTheBox - Chatterbox
HackTheBox - Chatterbox
IppSec
 44 HackTheBox - Falafel
HackTheBox - Falafel
IppSec
 45 How To Create Empire Modules
How To Create Empire Modules
IppSec
 46 HackTheBox - Nightmare
HackTheBox - Nightmare
IppSec
 47 HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
 48 HackTheBox - Bart
HackTheBox - Bart
IppSec
 49 HackTheBox - Aragog
HackTheBox - Aragog
IppSec
 50 HackTheBox - Valentine
HackTheBox - Valentine
IppSec
 51 HackTheBox - Silo
HackTheBox - Silo
IppSec
 52 HackTheBox - Rabbit
HackTheBox - Rabbit
IppSec
 53 HackTheBox - Celestial
HackTheBox - Celestial
IppSec
 54 HackTheBox - Stratosphere
HackTheBox - Stratosphere
IppSec
 55 HackTheBox - Poison
HackTheBox - Poison
IppSec
 56 HackTheBox - Canape
HackTheBox - Canape
IppSec
 57 HackTheBox - Olympus
HackTheBox - Olympus
IppSec
 58 HackTheBox - Sunday
HackTheBox - Sunday
IppSec
 59 HackTheBox - Fighter
HackTheBox - Fighter
IppSec
 60 HackTheBox - Bounty
HackTheBox - Bounty
IppSec

Related Reads

📰
HTTPS, TLS & Encryption Basics
Learn the basics of HTTPS, TLS, and encryption to secure your online communications
Dev.to · Sri Balaji
 📰
Introducing jev-sec-audit
Learn to use jev-sec-audit to identify package.json threats and improve project security
Dev.to · Dhanush N
 📰
CVE-2026-54892: CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder
Learn about CVE-2026-54892, a vulnerability in Plug Query Decoder that can cause a denial of service due to algorithmic complexity, and how to mitigate it
Dev.to · CVE Reports
 📰
Twenty Got Three Days, Eight Got Fourteen: CISA's KEV Due Date Is the Free Sort Key Nobody Reads
Learn how to prioritize patches using CISA's KEV due dates as a free sort key to streamline your patch queue management
Dev.to · Gary Austin

Chapters (17)

0:23 Explaining VM Layout
1:47 Nmap Start
5:20 Poking at Virtual Host Routing (Beehive & Calvin)
10:25 Fixing GoBuster to find /cgi-bin/
11:48 Enumerating WAF (Web Application Firewall), to see how it detects Shellshock
15:08 Using VirtualHostRouting to navigate to Calvin.htb.htb
18:15 Using ImageTragick to exploit Calvin
25:30 Calvin Reverse shell returned
31:35 Poking at /common, which allows pivot to Bastion Host
34:20 SSH into the Bastion Host
38:45 Explain SSH Local and Remote Port Forwarding
46:00 Beehive Reverse Shell Returned
50:00 Finding the root password via /common/containers/bastion-live/Dockerfile
54:50 PrivEsc via Docker (much like the LXC shown in Calamity)
57:05 Getting root access to filesystem
58:10 Failing to get root shell via Crontab
1:06:20 Yeah screw crontab, lets just create an ssh key.
Up next
Google Did The Impossible
Boot dev
Watch →