HackTheBox - Editor

Name: HackTheBox - Editor
Uploaded: 2025-12-06T15:00:06Z
Channel: IppSec
Description: 00:00 - Introduction 00:40 - Start of nmap 04:10 - Noticing the docs link which directs us to xwiki which discloses its version, searching for vulnerabi...

IppSec · Beginner ·🔐 Cybersecurity ·3mo ago

00:00 - Introduction 00:40 - Start of nmap 04:10 - Noticing the docs link which directs us to xwiki which discloses its version, searching for vulnerabilities 06:20 - Looking into XWIKI CVE-2025-24893 10:00 - Got Code Execution, getting a reverse shell now 15:45 - Finding the xwiki config, getting a password, which lets us SSH as oliver but oddly cannot use SU (go into this at the end of the video) 22:10 - Finding a vulnerable SetUID File, ndsudo from netdata. Vulnerable to Path Injection, lets exploit it 27:40 - Just talking about SetUID vs Sudo 31:40 - Digging into why we could not run SU 3…

Watch on YouTube ↗ (saves to browser)

Chapters (10)

Introduction

0:40 Start of nmap

4:10 Noticing the docs link which directs us to xwiki which discloses its version,

6:20 Looking into XWIKI CVE-2025-24893

10:00 Got Code Execution, getting a reverse shell now

15:45 Finding the xwiki config, getting a password, which lets us SSH as oliver but

22:10 Finding a vulnerable SetUID File, ndsudo from netdata. Vulnerable to Path Inje

27:40 Just talking about SetUID vs Sudo

31:40 Digging into why we could not run SU

36:34 Why we couldn't run SU, the SystemD Unit file has NoNewPrivileges

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →