HackTheBox - Intense

Name: HackTheBox - Intense
Uploaded: 2020-11-14T15:01:52Z
Channel: IppSec
Description: 00:00 - Intro 01:15 - Begin of nmap 03:30 - Examining the Message, pointing out the endpoint does not need authentication 06:15 - Using FFUF to fuzz the...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 01:15 - Begin of nmap 03:30 - Examining the Message, pointing out the endpoint does not need authentication 06:15 - Using FFUF to fuzz the API End Point and show importence of Content-Type 12:00 - Starting SQLMAP then manually fuzzing this application 14:30 - SQLite Boolean Injection, with CASE IF/THEN/ERROR 20:00 - SQLite Boolean Injection, Enumerating Usernames 24:00 - SQLite Boolean Injection, Start of Dumping Password 26:10 - SQLite Boolean Injeciton, Optimization chat about UNICODE and SUBSTR 29:40 - Start of coding out python script to dump the hash 41:20 - This hash looks …

Watch on YouTube ↗ (saves to browser)

Chapters (25)

Intro

1:15 Begin of nmap

3:30 Examining the Message, pointing out the endpoint does not need authentication

6:15 Using FFUF to fuzz the API End Point and show importence of Content-Type

12:00 Starting SQLMAP then manually fuzzing this application

14:30 SQLite Boolean Injection, with CASE IF/THEN/ERROR

20:00 SQLite Boolean Injection, Enumerating Usernames

24:00 SQLite Boolean Injection, Start of Dumping Password

26:10 SQLite Boolean Injeciton, Optimization chat about UNICODE and SUBSTR

29:40 Start of coding out python script to dump the hash

41:20 This hash looks weird... Tons of troubleshooting

45:12 Explaining the issue, we are hitting the 140 character limit... Switching scri

51:55 Script completed to dump hashes.

53:15 Static source code analysis, find its vulnerable to Hash Length Extension Atta

59:50 Using HashPumpy to perform the Hash Length Extension Attack

1:11:30 We base64'd the signing portion wrong

1:13:30 Now we have access to /admin, can use its API to read files and directories, s

1:23:30 Finding a RW SNMP Community string and then using snmp-shell to get code execu

1:29:00 Generating a SSH Key then copying it slowly to the box

1:35:00 Doing a Local Port Forward with the Debian-SNMP User

1:37:20 Binary Exploitation with Note_Server: Going over Source and recompiling with g

1:41:00 Binary Exploitation: Setting up PwnTools so we can interact with the binary

1:46:40 Binary Exploitation: Defeating ASLR by leaking an address

1:56:20 Binary Exploitation: Leaking LibC and Getting Code Execution

2:05:30 Binary Exploitation: Creating offset's for our remote server to get it working

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →