HackTheBox - Clicker

Name: HackTheBox - Clicker
Uploaded: 2024-01-27T15:00:10Z
Channel: IppSec
Description: 00:00 - Introduction 01:02 - Start of nmap and discovering NFS, which is hosting source code to the webserver 05:50 - Showing off the NFSClient Golang b...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:02 - Start of nmap and discovering NFS, which is hosting source code to the webserver 05:50 - Showing off the NFSClient Golang binary by Mubix, does not work here because NFS is Read-only 07:40 - Viewing the website for the first time, so we have an idea of what source code we are looking at 09:00 - Looking at the source code, Snyk doesn't give us anything 11:45 - Looking at database queries and finding a Mass Assignment Vulnerability 13:30 - Discovering we need to assign ourselves to Admin 14:45 - Using a line break, to bypass the check against the Key, allowing us to …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:02 Start of nmap and discovering NFS, which is hosting source code to the webserv

5:50 Showing off the NFSClient Golang binary by Mubix, does not work here because N

7:40 Viewing the website for the first time, so we have an idea of what source code

9:00 Looking at the source code, Snyk doesn't give us anything

11:45 Looking at database queries and finding a Mass Assignment Vulnerability

13:30 Discovering we need to assign ourselves to Admin

14:45 Using a line break, to bypass the check against the Key, allowing us to pass i

17:48 Showing another way to set our Role To Admin through SQL Injection in the Valu

21:52 Viewing the Administration page, discovering how the export function works

25:00 We can place PHP Code in NICKNAME for our user, which then the export function

30:12 Running LinPEAS, discovering a SetUID Binary (execute_query)

36:00 Examining execute_query in Ghidra, discovering a File Disclosure Vulnerability

42:00 Grabbing the SSH Key for Jack

44:27 Jack can sudo run /opt/monitor.sh, and set the environment. We can use LD_PREL

50:15 Showing the intended way by setting a proxy to CURL, allowing us to change the

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →