HackTheBox - DropZone

Name: HackTheBox - DropZone
Uploaded: 2018-11-03T14:58:21Z
Channel: IppSec
Description: 01:00 - Start of Recon 02:15 - TFTP Enumeration - Identifying configuration and OS information 06:32 - Finding a path to code execution 07:17 - Examinin...

IppSec · Beginner ·🔐 Cybersecurity ·7y ago

01:00 - Start of Recon 02:15 - TFTP Enumeration - Identifying configuration and OS information 06:32 - Finding a path to code execution 07:17 - Examining PSExec Metasploit Module 08:55 - Using irb within metasploit to print a powershell payload 12:30 - Examining PsExec() 15:40 - Examining native_upload 18:10 - Examining mof_upload 20:34 - Using irb within metasploit to print the MOF File 22:35 - Quick explanation of MOF Files 25:05 - Modifying the MOF to run NetCat 27:30 - Uploading nc to the target 28:50 - Uploading the malicious MOF File and getting a shell! 29:50 - Using Streams to view Hid…

Watch on YouTube ↗ (saves to browser)

Chapters (22)

1:00 Start of Recon

2:15 TFTP Enumeration - Identifying configuration and OS information

6:32 Finding a path to code execution

7:17 Examining PSExec Metasploit Module

8:55 Using irb within metasploit to print a powershell payload

12:30 Examining PsExec()

15:40 Examining native_upload

18:10 Examining mof_upload

20:34 Using irb within metasploit to print the MOF File

22:35 Quick explanation of MOF Files

25:05 Modifying the MOF to run NetCat

27:30 Uploading nc to the target

28:50 Uploading the malicious MOF File and getting a shell!

29:50 Using Streams to view Hidden text within ADS

33:08 Start of Bonus Content, finging a TFTP Exploit that uses MOF

35:05 Attempting to use distrinct_ftp_traversal against DropZone

36:30 Installing pry.byebug in order to allow us to drop to a debug console and step

40:50 Testing out pry.byebug

42:30 Finding why the exploit module didn't work

44:50 Module still doesn't work, TFTP Stopping mid transfer

49:30 Whoops, changed the delay on the wrong timeout

51:00 Meterpreter Shell returned, showing off the extended API and some WMI Commands

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →