HackTheBox - Checker

Name: HackTheBox - Checker
Uploaded: 2025-05-31T15:01:28Z
Channel: IppSec
Description: 00:00 - Introduction 01:05 - Start of nmap 03:30 - Enumerating version of Bookstack by the HTML Source, it's part of the CSS Include 05:22 - Enumerating...

IppSec · Beginner ·📰 AI News & Updates ·10mo ago

00:00 - Introduction 01:05 - Start of nmap 03:30 - Enumerating version of Bookstack by the HTML Source, it's part of the CSS Include 05:22 - Enumerating Teampass version by looking at github, discovering changelog.txt 08:45 - Looking at vulnerabilities in Teampass finding an SQLInjection on cvedetails 10:30 - Examining the SQL Bash Script, having it go through burp so we can inspect it 16:30 - Logging into Teampass and getting credentials to SSH and Bookstack 18:55 - Going back to Bookstack, looking at the SSRF Vulnerability 23:30 - Changing an SSRF in PHP to File Disclosure by using Filters 2…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

1:05 Start of nmap

3:30 Enumerating version of Bookstack by the HTML Source, it's part of the CSS Incl

5:22 Enumerating Teampass version by looking at github, discovering changelog.txt

8:45 Looking at vulnerabilities in Teampass finding an SQLInjection on cvedetails

10:30 Examining the SQL Bash Script, having it go through burp so we can inspect it

16:30 Logging into Teampass and getting credentials to SSH and Bookstack

18:55 Going back to Bookstack, looking at the SSRF Vulnerability

23:30 Changing an SSRF in PHP to File Disclosure by using Filters

29:30 Updating the PHP Filter Chain Oracle script and then running it to leak files

35:20 Leaking the Google Authenticator seed and logging into SSH

38:50 Extracting the server time from HTTP Headers so we can sed MFA Seed correctly

41:00 SSH into the box, looking at sudo and seeing we can execute a binary as root

44:50 Going over the binary in Ghidra, showing it is vulnerable to command injection

58:11 Creating a binary that will seed random via time and then monitor and write to

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →