HackTheBox - Download

Name: HackTheBox - Download
Uploaded: 2023-11-11T15:02:09Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 05:30 - Playing with the download file functionality, discovering the UUID is the file on disk and not column...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·2y ago

00:00 - Introduction 01:00 - Start of nmap 05:30 - Playing with the download file functionality, discovering the UUID is the file on disk and not column in database by prepending a slash 09:00 - Finding a File Disclosure vulnerability, extracting application source code, getting source code of the app 13:15 - Start of signing our own cookies, examining the sig cookie to discover it is 40 bytes which is likely sha1 16:00 - Playing with Cyber Chef to discover how the cookie is signed 18:50 - Creating a python application to create and sign cookies so we can become other users 24:30 - Becoming ot…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Start of nmap

5:30 Playing with the download file functionality, discovering the UUID is the file

9:00 Finding a File Disclosure vulnerability, extracting application source code, g

13:15 Start of signing our own cookies, examining the sig cookie to discover it is 4

16:00 Playing with Cyber Chef to discover how the cookie is signed

18:50 Creating a python application to create and sign cookies so we can become othe

24:30 Becoming other users and looking at all uploaded files

32:50 Explaining the ORM Injection, looking at Prisma Documentation to discover how

37:00 Showing the proof of concept payload, and then making the script loop to extra

44:00 POC Script done, but it is slow. Adding concurrency/threading with asyncio/awa

48:50 Modifying the script to dump multiple users, and finding WESLEY's password

56:00 Explaining how the Boolean Injeciton script works

59:50 Looking at the running processes, discovering root is running su and a new pty

1:02:45 Explaining the TTY Pushback attack

1:10:20 Gettinng the PostGresql credentials from the systemd file which lets us write

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →