HackTheBox - Chaos

Name: HackTheBox - Chaos
Uploaded: 2019-05-25T15:00:08Z
Channel: IppSec
Description: 01:05 - Begin of recon 02:20 - Starting up GoBuster then editing /etc/hosts to add the hosts in nmap 03:20 - Going over the website 06:00 - Discovering ...

IppSec · Beginner ·🔐 Cybersecurity ·6y ago

01:05 - Begin of recon 02:20 - Starting up GoBuster then editing /etc/hosts to add the hosts in nmap 03:20 - Going over the website 06:00 - Discovering a wordpress instance (/wp/ form goBuster) 09:50 - Finding webmail credentials from a wordpress Protected Post 10:30 - Discovering webmail.chaos.htb (Method 1) 12:50 - Testing IMAP, then configuring Evolution to login to the mail server (Method 2) 16:40 - Decrypting the message that was in the draft. 22:55 - Message decrypted, new page discovered 23:11 - Discovering a webpage for creating pdfs 24:10 - Searching for a code injection path for LaTe…

Watch on YouTube ↗ (saves to browser)

Chapters (23)

1:05 Begin of recon

2:20 Starting up GoBuster then editing /etc/hosts to add the hosts in nmap

3:20 Going over the website

6:00 Discovering a wordpress instance (/wp/ form goBuster)

9:50 Finding webmail credentials from a wordpress Protected Post

10:30 Discovering webmail.chaos.htb (Method 1)

12:50 Testing IMAP, then configuring Evolution to login to the mail server (Method 2

16:40 Decrypting the message that was in the draft.

22:55 Message decrypted, new page discovered

23:11 Discovering a webpage for creating pdfs

24:10 Searching for a code injection path for LaTex

24:45 Discovering the blacklist is on "input"

25:30 Testing for blind command execution via ping

27:43 Reverse Shell Returned

28:10 Enumerating the web directory to find passwords

29:11 Switching to the "Ayush" user with mail password, discover we are in rBash

29:45 Escaping rBash by via tar (Method 1: GTFOBins)

31:00 Escaping rBash by editing path (Method 2)

32:55 Discovering a mozilla user configuration directory, copying it off to export p

36:30 Using firefox_decrypt to export root password

37:30 Logging into webmin with credentials from firefox

37:50 Privesc via switching to root user with known password (Method 1)

38:10 Using webmin to execute commands as root (Method 2)

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →