HackTheBox - Gofer

Name: HackTheBox - Gofer
Uploaded: 2023-10-28T15:00:51Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:40 - Running gobuster to discover the proxy.gofer.htb subdomain 05:20 - Enumerating SMB to find a note whi...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap 03:40 - Running gobuster to discover the proxy.gofer.htb subdomain 05:20 - Enumerating SMB to find a note which gives an email address to send a malicious document to and hints at HTTP Methods being filtered 08:45 - Discovering the proxy.gofer.htb domain responds differently to POST vs GET requests, then gobustering setting our method to POST 11:55 - Finding a SSRF in the proxy, then playing with protocols to discover it accepts GOPHER requests 16:40 - Showing we can get around the localhost/127.0.0.1 blacklist by encoding the IP Address in HEX, then …

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:00 Start of nmap

3:40 Running gobuster to discover the proxy.gofer.htb subdomain

5:20 Enumerating SMB to find a note which gives an email address to send a maliciou

8:45 Discovering the proxy.gofer.htb domain responds differently to POST vs GET req

11:55 Finding a SSRF in the proxy, then playing with protocols to discover it accept

16:40 Showing we can get around the localhost/127.0.0.1 blacklist by encoding the IP

21:30 Sending a SMTP Request via gopher to send an email with a link to a malicious

27:55 Making a ODT Document with a macro that executes on-open and sends a shell

34:50 shell as jhudson

36:30 Going over LinPEAS, discovering TCPDump has capabilities to allow any user to

44:40 Opening the capture in Wireshark and showing the TBuckley sent his password to

46:57 Executing the notes binary, looks like a traditional UAF Problem, playing with

50:30 Opening the binary in Ghidra to show deleting the username only calls free, do

53:19 Running the binary in GDB, then setting breakpoints and showing USER and NOTES

56:00 Showing what happens when you create the user, free the memory, then create th

59:38 Having an issue when doing it, turns out to be because we placed our shell in

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →