HackTheBox - Cache

Name: HackTheBox - Cache
Uploaded: 2020-10-10T14:59:23Z
Channel: IppSec
Description: 00:00 - Intro 01:10 - Running NMAP and checking out the page 03:30 - Author page contains a hint to do some type Domain Brute Forcing 04:25 - The Login ...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 01:10 - Running NMAP and checking out the page 03:30 - Author page contains a hint to do some type Domain Brute Forcing 04:25 - The Login form won't go to burpsuite, lets check out javascript 08:05 - Doing VirtualHost (VHOST) Bruteforcing with GoBuster to discover hms.htb 12:00 - Discovering OpenEMR, running searchsploit, attempting to find the version of it 15:25 - Searchsploit doesn't have any exploits, checking one on google to find a SQL Injection 19:00 - Discovering error based SQL Injection (XPATH) 23:10 - Manually extracting data from error based SQL Injection (XPATH) 27:2…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Intro

1:10 Running NMAP and checking out the page

3:30 Author page contains a hint to do some type Domain Brute Forcing

4:25 The Login form won't go to burpsuite, lets check out javascript

8:05 Doing VirtualHost (VHOST) Bruteforcing with GoBuster to discover hms.htb

12:00 Discovering OpenEMR, running searchsploit, attempting to find the version of i

15:25 Searchsploit doesn't have any exploits, checking one on google to find a SQL I

19:00 Discovering error based SQL Injection (XPATH)

23:10 Manually extracting data from error based SQL Injection (XPATH)

27:25 Using BurpSuite Intruder to aid us in running a bunch of SQL Injections, incre

33:08 XPATH Injection only extracts 32 characters, we need to use SUBSTRING to extra

37:40 Logging into OpenEMR then using file upload functionality to upload a webshell

46:15 Enumerating Memcache to discover credentials for luffy

50:40 Luffy is a member of Docker, using GTFO Bins to use docker to privesc

56:00 EXTRA: Going back to memcache, lets forward the memcache port to our box via c

1:01:25 Using Metasploit to dump memcache

1:02:40 Using Memcache utilities to manually enumerate memcache

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →