HackTheBox - Blunder

Name: HackTheBox - Blunder
Uploaded: 2020-10-17T15:01:02Z
Channel: IppSec
Description: 00:00 - Intro 01:03 - Start of NMAP 04:30 - Discovering install.php, which says bludit is being installed. 06:30 - Looking for exploits searchsploit, ev...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 01:03 - Start of NMAP 04:30 - Discovering install.php, which says bludit is being installed. 06:30 - Looking for exploits searchsploit, everything requires Auth 07:35 - Attempting a login and noticing the CSRF Tokens 09:20 - Looking for exploits online that haven't made it to SearchSploit yet 12:00 - Placing the X-FORWARDED-FOR header to bypass brute force protection 15:40 - Creating a Python Brute Forcer 16:45 - Scripting: Grabbing the CSRF Value with python requests 18:20 - Scripting: Grabbing the PHP Session Cookie with python requests 18:20 - Scripting: Sending a login reques…

Watch on YouTube ↗ (saves to browser)

Chapters (21)

Intro

1:03 Start of NMAP

4:30 Discovering install.php, which says bludit is being installed.

6:30 Looking for exploits searchsploit, everything requires Auth

7:35 Attempting a login and noticing the CSRF Tokens

9:20 Looking for exploits online that haven't made it to SearchSploit yet

12:00 Placing the X-FORWARDED-FOR header to bypass brute force protection

15:40 Creating a Python Brute Forcer

16:45 Scripting: Grabbing the CSRF Value with python requests

18:20 Scripting: Grabbing the PHP Session Cookie with python requests

18:20 Scripting: Sending a login request with python requests

18:20 Scripting: Telling request to not follow and detect a valid login

31:10 Using Cewl to build a wordlist, then changing our python script to pull passwo

34:30 Scripting: Setting a random IP in X-Forwarded-For header

37:50 Scripting: Scripting fixing a bug then getting a password via brute force!

41:00 Start of playing around with the Bludit Image Upload Vulnerability.

45:10 Having trouble, running the exploit with metasploit through a proxy to underst

47:50 Uploading a PHP Reverse shell then HTAccess file to get code execution

1:02:30 Reverse shell returned, finding passwords in the bludit database, then crackin

1:08:20 Cracked a password for hugo, switching to his user

1:09:30 Doing the SUDO underflow exploit

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →