HackTheBox - BountyHunter

Name: HackTheBox - BountyHunter
Uploaded: 2021-11-20T15:00:02Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Running nmap, doing all ports and min-rate 02:30 - Poking at the website to discover a static site 04:25 - Starting up a gobuster ...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro 01:00 - Running nmap, doing all ports and min-rate 02:30 - Poking at the website to discover a static site 04:25 - Starting up a gobuster to do some recon in the background 05:30 - Discovering log_submit, and finding out it is vulnerable to XXE (XML Entity Injection) 08:00 - Verified it is vulnerable to XXE, attempting to extract a file 09:50 - Chaining a PHP Filter to convert files to base64, which lets us avoid bad characters and leak source 11:15 - Start of coding out a program to automate this LFI 17:45 - XXE LFI POC Done, improving it by adding the cmd module 20:50 - Reading…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Intro

1:00 Running nmap, doing all ports and min-rate

2:30 Poking at the website to discover a static site

4:25 Starting up a gobuster to do some recon in the background

5:30 Discovering log_submit, and finding out it is vulnerable to XXE (XML Entity In

8:00 Verified it is vulnerable to XXE, attempting to extract a file

9:50 Chaining a PHP Filter to convert files to base64, which lets us avoid bad char

11:15 Start of coding out a program to automate this LFI

17:45 XXE LFI POC Done, improving it by adding the cmd module

20:50 Reading source code of pages, getting nothing

21:35 Finding db.php from out gobuster, leaking the source and getting a password

22:05 Grabbing /etc/passwd in order to build a userlist to password spray

22:45 Using CrackMapExec (cme) to perform a password spray over SSH and discovering

23:35 With shell on the box we can do sudo against a python file, doing some manual

31:00 Switching to VSCode to debug our exploit script

38:30 Exploit file works, copy it to our target and run it to get a root shell

39:44 Taking a step back and Verifying the bad characters in our XXE

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →