HackTheBox - Celestial

Name: HackTheBox - Celestial
Uploaded: 2018-08-25T15:00:00Z
Channel: IppSec
Description: 00:58 - Begin of Recon 03:00 - Looking at the web application and finding the Serialized Cookie 04:38 - Googling for Node JS Deserialization Exploits 06...

IppSec · Intermediate ·🛡️ AI Safety & Ethics ·7y ago

00:58 - Begin of Recon 03:00 - Looking at the web application and finding the Serialized Cookie 04:38 - Googling for Node JS Deserialization Exploits 06:30 - Start of building our payload 07:10 - Examining Node-Serialize to see what the heck _$$ND_FUNC$$_ is 09:10 - Moving our serialized object to "Name", hoping to get to read stdout 11:30 - Really busing the deserialize function by removing the Immediately Invokked Expression (IIFE) 13:25 - Failing to convert an object (stdout) to string. 14:02 - Verifying code execution via ping 15:32 - Code execution verified, gaining a shell (Get a shell v…

Watch on YouTube ↗ (saves to browser)

Chapters (14)

0:58 Begin of Recon

3:00 Looking at the web application and finding the Serialized Cookie

4:38 Googling for Node JS Deserialization Exploits

6:30 Start of building our payload

7:10 Examining Node-Serialize to see what the heck _$$ND_FUNC$$_ is

9:10 Moving our serialized object to "Name", hoping to get to read stdout

11:30 Really busing the deserialize function by removing the Immediately Invokked Ex

13:25 Failing to convert an object (stdout) to string.

14:02 Verifying code execution via ping

15:32 Code execution verified, gaining a shell

18:49 Reverse shell returned, running LinEnum.sh

21:26 Examining logs to find the Cron Job running as root

22:09 Privesc by placing a python root shell in script.py

24:15 Going back and getting a shell with NodeJSShell

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →