HackTheBox - Derailed

Name: HackTheBox - Derailed
Uploaded: 2023-07-22T15:00:09Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 02:50 - Looking at the HTTP Headers, discovering Cross Origin and rails 03:50 - Testing the Clip Notes functionality...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Intro 01:00 - Start of nmap 02:50 - Looking at the HTTP Headers, discovering Cross Origin and rails 03:50 - Testing the Clip Notes functionality for SSTI/XSS 06:30 - Using FFUF to fuzz all Clip Notes to see if there's an IDOR Vulnerability 10:30 - Looking at how the site is build, discovering Web Assembly 13:00 - Sending a long string for the username and discovering the data overflows and goes into the Date field 15:50 - Using Pattern Create to find where our payload hits the date field 17:55 - Testing for XSS 21:20 - Seeing Cross Origin blocked us, adding the headers to get it loadin…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:00 Start of nmap

2:50 Looking at the HTTP Headers, discovering Cross Origin and rails

3:50 Testing the Clip Notes functionality for SSTI/XSS

6:30 Using FFUF to fuzz all Clip Notes to see if there's an IDOR Vulnerability

10:30 Looking at how the site is build, discovering Web Assembly

13:00 Sending a long string for the username and discovering the data overflows and

15:50 Using Pattern Create to find where our payload hits the date field

17:55 Testing for XSS

21:20 Seeing Cross Origin blocked us, adding the headers to get it loading javascrip

25:50 Using XMLHttpRequest in our XSS to control the victim's browser and see what i

31:50 Looking at the Administration page, discovering there is a File Disclosure

38:30 Grabbing /etc/passwd and then getting some Ruby Source Code

48:00 Discovering userinput is passed to open() in ruby, if we put a pipe as the fir

49:45 Getting a reverse shell

51:35 Looking at the SQLite Database and cracking a password to switch to the openme

56:55 Looking at the OpenMediaVault RPC Endpoints to see how we can interact with it

59:40 Editing the OpenMediaVault Config to add a SSH Key for Root

1:09:20 Another way for root, making a debian package then using the OMV RPC to instal

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →