HackTheBox - BlockBlock

Name: HackTheBox - BlockBlock
Uploaded: 2025-03-29T15:00:03Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:15 - Registering an account and discovering the chat, examining source and seeing a database solidity cont...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:00 - Start of nmap 02:15 - Registering an account and discovering the chat, examining source and seeing a database solidity contract 04:45 - Testing for XSS, discovering it within the username 06:00 - The /api/info page exposes the JWT, which lets us exfiltrate it even if HTTPONLY is set 07:10 - Using FeroxBuster to enumerate the API with different methods 10:00 - Discovering XSS in the Report feature, and get a hit from the admin, create a JS Payload to exfiltrate the admin token 16:00 - We are now the admin, which has access to a new endpoint that interacts with the b…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Start of nmap

2:15 Registering an account and discovering the chat, examining source and seeing a

4:45 Testing for XSS, discovering it within the username

6:00 The /api/info page exposes the JWT, which lets us exfiltrate it even if HTTPON

7:10 Using FeroxBuster to enumerate the API with different methods

10:00 Discovering XSS in the Report feature, and get a hit from the admin, create a

16:00 We are now the admin, which has access to a new endpoint that interacts with t

19:00 Playing with eth_getAccount

19:30 Playing with eth_getBlockByNumber, then viewing information on the chain. Enum

25:30 Shell on the box as Keira, can run forge as paul which we can exploit two ways

26:15 Exploiting forge with path injection since the sudo has no env_reset set

29:10 Exploiting forge with the build flag that has command injection

31:00 Paul can run pacman as root, which we can exploit a few ways. First we create

35:40 We could also just build a package that drops a new file, creating a malicious

40:30 Creating a package that just runs a command

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →