HackTheBox - Era

IppSec · Beginner ·☁️ DevOps & Cloud ·9mo ago

Key Takeaways

The video demonstrates a cybersecurity challenge, specifically the HackTheBox - Era challenge, using tools like nmap, bruteforcing, and exploiting vulnerabilities in PHP Streams and download functionality to gain admin access and eventually a shell.

Original Description

00:00 - Introduction 00:55 - Start of nmap 04:45 - Discovering the file subdomain 08:10 - Bruteforcing files to find login.php 11:25 - Bruteforcing ID's on the download functionality, discovering two other files 18:10 - Got creds from the database dump, logging into ftp and downloading Apache backup 23:10 - Looking at the source code, discovering some weird behavior around PHP Streams and the download functionality 26:27 - Logging in as admin with security questions 32:08 - Looking at PHP Wrappers, then using the SSH One to login and run a command to get a shell 37:55 - Looking at files owned by the group devs, discovering a monitor binary 41:20 - Making an ELF File and uploading it, to discover it needs to be signed 45:20 - Using docker to build the linux-elf-binary-signer program on github, then signing the binary 54:10 - Showing we could of done this with just pspy and copying the text_sig because signing isn't checked properly
☆ Save to playlist Watch on YouTube ↗
AI explanation not available for this lesson yet
This lesson is still being prepared for the AI tutor. In the meantime, explore lessons that are ready.
Browse explainer-ready lessons →

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →
1 HHC2016 - Analytics
HHC2016 - Analytics
IppSec
 2 HackTheBox - October
HackTheBox - October
IppSec
 3 HackTheBox - Arctic
HackTheBox - Arctic
IppSec
 4 HackTheBox - Brainfuck
HackTheBox - Brainfuck
IppSec
 5 HackTheBox - Bank
HackTheBox - Bank
IppSec
 6 HackTheBox - Joker
HackTheBox - Joker
IppSec
 7 HackTheBox - Lazy
HackTheBox - Lazy
IppSec
 8 Camp CTF 2015 - Bitterman
Camp CTF 2015 - Bitterman
IppSec
 9 HackTheBox - Devel
HackTheBox - Devel
IppSec
 10 Reversing Malicious Office Document (Macro) Emotet(?)
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
 11 HackTheBox - Granny and Grandpa
HackTheBox - Granny and Grandpa
IppSec
 12 HackTheBox - Pivoting Update: Granny and Grandpa
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
 13 HackTheBox - Optimum
HackTheBox - Optimum
IppSec
 14 HackTheBox - Charon
HackTheBox - Charon
IppSec
 15 HackTheBox - Sneaky
HackTheBox - Sneaky
IppSec
 16 HackTheBox - Holiday
HackTheBox - Holiday
IppSec
 17 HackTheBox - Europa
HackTheBox - Europa
IppSec
 18 Introduction to tmux
Introduction to tmux
IppSec
 19 HackTheBox - Blocky
HackTheBox - Blocky
IppSec
 20 HackTheBox - Nineveh
HackTheBox - Nineveh
IppSec
 21 HackTheBox - Jail
HackTheBox - Jail
IppSec
 22 HackTheBox - Blue
HackTheBox - Blue
IppSec
 23 HackTheBox - Calamity
HackTheBox - Calamity
IppSec
 24 HackTheBox - Shrek
HackTheBox - Shrek
IppSec
 25 HackTheBox - Mirai
HackTheBox - Mirai
IppSec
 26 HackTheBox - Shocker
HackTheBox - Shocker
IppSec
 27 HackTheBox - Mantis
HackTheBox - Mantis
IppSec
 28 HackTheBox - Node
HackTheBox - Node
IppSec
 29 HackTheBox - Kotarak
HackTheBox - Kotarak
IppSec
 30 HackTheBox - Enterprise
HackTheBox - Enterprise
IppSec
 31 HackTheBox - Sense
HackTheBox - Sense
IppSec
 32 HackTheBox - Minion
HackTheBox - Minion
IppSec
 33 VulnHub - Sokar
VulnHub - Sokar
IppSec
 34 VulnHub - Pinkys Palace v2
VulnHub - Pinkys Palace v2
IppSec
 35 HackTheBox - Inception
HackTheBox - Inception
IppSec
 36 Vulnhub - Trollcave 1.2
Vulnhub - Trollcave 1.2
IppSec
 37 HackTheBox - Ariekei
HackTheBox - Ariekei
IppSec
 38 HackTheBox - Flux Capacitor
HackTheBox - Flux Capacitor
IppSec
 39 HackTheBox - Jeeves
HackTheBox - Jeeves
IppSec
 40 HackTheBox - Tally
HackTheBox - Tally
IppSec
 41 HackTheBox - CrimeStoppers
HackTheBox - CrimeStoppers
IppSec
 42 HackTheBox - Fulcrum
HackTheBox - Fulcrum
IppSec
 43 HackTheBox - Chatterbox
HackTheBox - Chatterbox
IppSec
 44 HackTheBox - Falafel
HackTheBox - Falafel
IppSec
 45 How To Create Empire Modules
How To Create Empire Modules
IppSec
 46 HackTheBox - Nightmare
HackTheBox - Nightmare
IppSec
 47 HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
 48 HackTheBox - Bart
HackTheBox - Bart
IppSec
 49 HackTheBox - Aragog
HackTheBox - Aragog
IppSec
 50 HackTheBox - Valentine
HackTheBox - Valentine
IppSec
 51 HackTheBox - Silo
HackTheBox - Silo
IppSec
 52 HackTheBox - Rabbit
HackTheBox - Rabbit
IppSec
 53 HackTheBox - Celestial
HackTheBox - Celestial
IppSec
 54 HackTheBox - Stratosphere
HackTheBox - Stratosphere
IppSec
 55 HackTheBox - Poison
HackTheBox - Poison
IppSec
 56 HackTheBox - Canape
HackTheBox - Canape
IppSec
 57 HackTheBox - Olympus
HackTheBox - Olympus
IppSec
 58 HackTheBox - Sunday
HackTheBox - Sunday
IppSec
 59 HackTheBox - Fighter
HackTheBox - Fighter
IppSec
 60 HackTheBox - Bounty
HackTheBox - Bounty
IppSec

This video teaches viewers how to conduct a cybersecurity challenge, using various tools and techniques to exploit vulnerabilities and gain access to a system. The challenge involves using nmap to scan the network, bruteforcing to discover hidden files, and exploiting weaknesses in PHP code to gain admin access and eventually a shell.

Key Takeaways
  1. Conduct a network scan using nmap
  2. Bruteforce files to discover login.php
  3. Bruteforce ID's on the download functionality to discover other files
  4. Use the discovered credentials to log into ftp and download the Apache backup
  5. Analyze the source code to discover weird behavior around PHP Streams and the download functionality
  6. Use PHP Wrappers to login as admin with security questions
  7. Use the SSH One wrapper to login and run a command to get a shell
💡 The video highlights the importance of properly validating user input and ensuring that security measures are in place to prevent exploitation of vulnerabilities.

Related Reads

📰
Stop Writing Fragile SSH Scripts: Scaling Cisco Network Automation with Python and Nornir
Scale Cisco network automation with Python and Nornir to move beyond fragile SSH scripts
Medium · DevOps
 📰
Containers vs VMs vs Bare Metal — Part 2
Learn to choose the right abstraction for your workload between containers, VMs, and bare metal, and why it matters for efficient DevOps
Medium · DevOps
 📰
Can freshers apply for a DevOps role?
Freshers can apply for DevOps roles with foundational knowledge in Linux, Git, Docker, and CI/CD
Dev.to · kavin.dev
 📰
Two writers, one append-only ledger: the git conflict one .gitattributes line fixed, and the files it would have corrupted
Learn how to resolve Git conflicts caused by multiple writers to the same file using .gitattributes
Dev.to · Rulestack

Chapters (13)

Introduction
0:55 Start of nmap
4:45 Discovering the file subdomain
8:10 Bruteforcing files to find login.php
11:25 Bruteforcing ID's on the download functionality, discovering two other files
18:10 Got creds from the database dump, logging into ftp and downloading Apache back
23:10 Looking at the source code, discovering some weird behavior around PHP Streams
26:27 Logging in as admin with security questions
32:08 Looking at PHP Wrappers, then using the SSH One to login and run a command to
37:55 Looking at files owned by the group devs, discovering a monitor binary
41:20 Making an ELF File and uploading it, to discover it needs to be signed
45:20 Using docker to build the linux-elf-binary-signer program on github, then sign
54:10 Showing we could of done this with just pspy and copying the text_sig because
Up next
How do I turn on MFA delete for my Amazon S3 bucket?
Amazon Web Services
Watch →