HackTheBox - CTF

Name: HackTheBox - CTF
Uploaded: 2019-07-20T15:00:00Z
Channel: IppSec
Description: Support me on Patreon! https://patreon.com/ippsec 00:52 - Start of Recon, discovering CentOS Version via HTTPD Version 02:15 - Checking out the HTTP Pag...

IppSec · Beginner ·🧠 Large Language Models ·6y ago

Support me on Patreon! https://patreon.com/ippsec 00:52 - Start of Recon, discovering CentOS Version via HTTPD Version 02:15 - Checking out the HTTP Page 03:32 - Checking out login.php 05:15 - Identifying a Secure Token is used, most likely STOKEN 07:05 - Failing to enumerate usernames through BruteForce 09:45 - Fuzzing the login form with special characters to identify a blacklist 11:45 - Trying Double URL Encoding to bypass the BlackList 12:55 - Explaining Double URL Encoding 14:45 - Discovering this is most likely a LDAP Injection 16:50 - Explaining how a LDAP Query Works 19:15 - Identifyi…

Watch on YouTube ↗ (saves to browser)

Chapters (25)

0:52 Start of Recon, discovering CentOS Version via HTTPD Version

2:15 Checking out the HTTP Page

3:32 Checking out login.php

5:15 Identifying a Secure Token is used, most likely STOKEN

7:05 Failing to enumerate usernames through BruteForce

9:45 Fuzzing the login form with special characters to identify a blacklist

11:45 Trying Double URL Encoding to bypass the BlackList

12:55 Explaining Double URL Encoding

14:45 Discovering this is most likely a LDAP Injection

16:50 Explaining how a LDAP Query Works

19:15 Identifying the LDAP Query Structure with a Null Byte

20:40 Injecting the WildCard (*) to enumerate usernames

24:00 Using Wfuzz to extract the username

26:00 Enumerating LDAP Attributes that are utilized

30:26 Creating a python script to extract the Pager Attribute

41:38 Script complete, lets extract the token

43:45 Using STOKEN to generate the OTP and logging in

46:00 Disabling NTP so we can math the server time

46:44 Discovery of that second half of the original LDAP Query at 16 minutes.

47:33 Using a Null Byte to remove the GROUP Check.

50:33 Running Commands

50:25 Reverse Shell Returned

53:17 Checking for the LDAP Bind password, then SSHing into the box

55:00 Going over the /backup directory

58:20 Using ListFiles to have 7za print our the contents of root.txt

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HackTheBox - CTF

Chapters (25)

Playlist

Lesson complete!