HackTheBox - Encoding

Name: HackTheBox - Encoding
Uploaded: 2023-04-15T15:03:32Z
Channel: IppSec
Description: 00:00 - Introduction 00:57 - Start of nmap 02:45 - Checking out the API Documentation 04:00 - Interacting with the API Server 05:15 - Showing the file_u...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 00:57 - Start of nmap 02:45 - Checking out the API Documentation 04:00 - Interacting with the API Server 05:15 - Showing the file_url, parameter and showing we can access local files 06:36 - Building a webserver in Flask to make some middleware to exploit this SSRF, allowing us to easily download files from the webserver 09:50 - Our middleware works! Can download files off the server. 11:15 - Downloading the apache2 configuration to find where all the webserver files are hosted 14:30 - Using gobuster against our middleware to discover any hidden webfiles, have to edit our…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

0:57 Start of nmap

2:45 Checking out the API Documentation

4:00 Interacting with the API Server

5:15 Showing the file_url, parameter and showing we can access local files

6:36 Building a webserver in Flask to make some middleware to exploit this SSRF, al

9:50 Our middleware works! Can download files off the server.

11:15 Downloading the apache2 configuration to find where all the webserver files ar

14:30 Using gobuster against our middleware to discover any hidden webfiles, have to

16:45 Running gobuster against our code now that it gives 404... Its going slow, swi

17:50 Git-Dumper fails because our middleware isn't setting content-type correctly.

19:50 Opening the source code from the .git repo up in Visual Studio code and Snyk s

21:00 Getting Unacceptable URL when trying to exploit this. Removing http:// fixes t

22:30 Getting RCE on a include() statement without poisoning a file on the server wi

26:58 EDIT: Showing there is also a URL Parsing bug on handler.php and we can change

31:52 With a shell on the box, discover we can use git with sudo. Inserting a POST-C

35:00 Generating a ed25519 ssh key, because the public key is extremely small... It'

38:10 Cannot make a git commit because we can't write to the directory. But since we

45:15 Shell as SVC, discovering we can write to systemd, creating a malicious servic

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →