HackTheBox - Charon

Name: HackTheBox - Charon
Uploaded: 2017-11-04T15:04:21Z
Channel: IppSec
Description: 1:30 - Rabbit Hole - Searching for SuperCMS 6:23 - Running enumeration in the background (GoBuster) 7:40 - Rabbit Hole - SQLMap Blog SinglePost.php 12:0...

IppSec · Beginner ·🔐 Cybersecurity ·8y ago

1:30 - Rabbit Hole - Searching for SuperCMS 6:23 - Running enumeration in the background (GoBuster) 7:40 - Rabbit Hole - SQLMap Blog SinglePost.php 12:04 - Finding PHP Files in /cmsdata/ (GoBuster) 12:53 - Manual Identification of SQL Injection 15:50 - SQL Injection Explanation 17:20 - Rabbit Hole - Starting SQLMap in the Background 18:10 - SQL Union Injection Explanation 19:30 - Identifying "Bad/Filtered Words" in SQL Injection 21:02 - SQL Union Finding number of items returned 21:48 - Returning data from Union Injection 22:48 - SQL Concat Explanation 23:55 - Enumerating SQL Databases Explana…

Watch on YouTube ↗ (saves to browser)

Chapters (28)

1:30 Rabbit Hole - Searching for SuperCMS

6:23 Running enumeration in the background (GoBuster)

7:40 Rabbit Hole - SQLMap Blog SinglePost.php

12:04 Finding PHP Files in /cmsdata/ (GoBuster)

12:53 Manual Identification of SQL Injection

15:50 SQL Injection Explanation

17:20 Rabbit Hole - Starting SQLMap in the Background

18:10 SQL Union Injection Explanation

19:30 Identifying "Bad/Filtered Words" in SQL Injection

21:02 SQL Union Finding number of items returned

21:48 Returning data from Union Injection

22:48 SQL Concat Explanation

23:55 Enumerating SQL Databases Explanation (Information_Schema)

25:46 Returning Database, Table, Columns from Information_Schema

29:30 Scripting to dump all columns

36:45 Listing of columns in SuperCMS

37:15 Dumping User Credentials

41:36 Logging in and exploiting SuperCMS

47:00 Return of reverse shell

48:40 Transfering small files from shell to my machine

50:56 Using RsaCtfTool to decrypt contents with weak public key

52:52 Breaking weak RSA manually

1:01:20 Begin PrivEsc to Root

1:02:40 Transering large files with NC

1:03:50 Analyzing SuperShell with BinaryNinja (Paid)

1:06:04 Analyzing SuperShell with Radare2 (Free)

1:08:22 Exploiting SuperShell

1:12:46 Encore. Getting a Root Shell with SetUID Binary

Playlist

Uploads from IppSec · IppSec · 26 of 60

← Previous Next →