HackTheBox - Intense

00:00 - Intro 01:15 - Begin of nmap 03:30 - Examining the Message, pointing out the endpoint does not need authentication 06:15 - Using FFUF to fuzz the API End Point and show importence of Content-Type 12:00 - Starting SQLMAP then manually fuzzing this application 14:30 - SQLite Boolean Injection, with CASE IF/THEN/ERROR 20:00 - SQLite Boolean Injection, Enumerating Usernames 24:00 - SQLite Boolean Injection, Start of Dumping Password 26:10 - SQLite Boolean Injeciton, Optimization chat about UNICODE and SUBSTR 29:40 - Start of coding out python script to dump the hash 41:20 - This hash looks weird... Tons of troubleshooting 45:12 - Explaining the issue, we are hitting the 140 character limit... Switching script up to do SUBSTR 51:55 - Script completed to dump hashes. 53:15 - Static source code analysis, find its vulnerable to Hash Length Extension Attack 59:50 - Using HashPumpy to perform the Hash Length Extension Attack 1:11:30 - We base64'd the signing portion wrong 1:13:30 - Now we have access to /admin, can use its API to read files and directories, showing Sched_debug and /proc/net/tcp,udp,environ to get important information 1:23:30 - Finding a RW SNMP Community string and then using snmp-shell to get code execution 1:29:00 - Generating a SSH Key then copying it slowly to the box 1:35:00 - Doing a Local Port Forward with the Debian-SNMP User 1:37:20 - Binary Exploitation with Note_Server: Going over Source and recompiling with ggdb flag 1:41:00 - Binary Exploitation: Setting up PwnTools so we can interact with the binary 1:46:40 - Binary Exploitation: Defeating ASLR by leaking an address 1:56:20 - Binary Exploitation: Leaking LibC and Getting Code Execution 2:05:30 - Binary Exploitation: Creating offset's for our remote server to get it working