HackTheBox - Environment

Name: HackTheBox - Environment
Uploaded: 2025-09-06T15:00:53Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:30 - Discovering that Laravel is running based upon 404 page (or cookie) 04:40 - Running GoBuster, adding ...

IppSec · Beginner ·🔐 Cybersecurity ·6mo ago

00:00 - Introduction 01:00 - Start of nmap 02:30 - Discovering that Laravel is running based upon 404 page (or cookie) 04:40 - Running GoBuster, adding 403 to the ignore list of codes and discovering /upload 05:40 - Laravel running in DEBUG mode, so the error page gives verbose info. Searching for CVE's for Laravel 11.30.0 07:55 - CVE-2024-52301, changing the Laravel environment with argument pollution 09:30 - Discovering we can bypass auth by setting environment to preprod 14:30 - Exploiting another Laravel CVE-2025-27515 to bypass the extension blacklist 22:45 - Got a shell on the box, dumpi…

Watch on YouTube ↗ (saves to browser)

Chapters (12)

Introduction

1:00 Start of nmap

2:30 Discovering that Laravel is running based upon 404 page (or cookie)

4:40 Running GoBuster, adding 403 to the ignore list of codes and discovering /uplo

5:40 Laravel running in DEBUG mode, so the error page gives verbose info. Searching

7:55 CVE-2024-52301, changing the Laravel environment with argument pollution

9:30 Discovering we can bypass auth by setting environment to preprod

14:30 Exploiting another Laravel CVE-2025-27515 to bypass the extension blacklist

22:45 Got a shell on the box, dumping database

24:00 Discovering a GPG Encrypted file, using keys on the box to decrypt it

27:30 Sudo lets us keep the environment BASH_ENV which lets us set the bash environm

30:00 Beyond root, showing disabling debug mode on application and nginx config

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →