HackTheBox - BigBang

Name: HackTheBox - BigBang
Uploaded: 2025-05-03T14:59:53Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:40 - Discovering BuddyForms on Wordpress, manually discovering the version (before this we ran WPSCAN aswe...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·11mo ago

00:00 - Introduction 01:00 - Start of nmap 03:40 - Discovering BuddyForms on Wordpress, manually discovering the version (before this we ran WPSCAN aswell) 06:20 - Finding a BlogPost showing a File Disclosure Vulnerability in BuddyForms and they used a Phar Deserialization trick to get RCE but this doesn't work on PHP8 09:00 - Playing with the File Disclosure, using a PHP Filter Chain to prepend GIF89a to our file and show we can trick the magic byte trick 15:20 - Finding a Blog Post which talks about a buffer overflow in GLIBC ICONV for PHP, which shows we can get RCE on file reads up to php …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Start of nmap

3:40 Discovering BuddyForms on Wordpress, manually discovering the version (before

6:20 Finding a BlogPost showing a File Disclosure Vulnerability in BuddyForms and t

9:00 Playing with the File Disclosure, using a PHP Filter Chain to prepend GIF89a t

15:20 Finding a Blog Post which talks about a buffer overflow in GLIBC ICONV for PHP

18:30 Setting up WrapWrap which is just a better way to prepend/append bytes, showin

20:40 Modifying the CNEXT exploit which exploits the ICONV in PHP to achieve RCE on

33:30 Reverse shell returned! Using Chisel to setup a tunnel to the MySQL Server, so

39:14 Shell as Shawking, finding Grafana and the SQLITE Database, downloading it and

47:10 Downloading the Satellite APK File, then decompiling it to discover the HTTP R

50:00 Logging into the satellite webserver

52:40 Exploring the command endpoint

55:00 Using PSPY64 to examine what processes the webserver creates when we make requ

57:00 Using a linebreak to get RCE on the server, making bash setuid to privesc

59:00 Showing we could just edit the crontab since we are root, which would allow us

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →