HackTheBox - Jarvis

Name: HackTheBox - Jarvis
Uploaded: 2019-11-09T16:00:45Z
Channel: IppSec
Description: 01:00 - Begin of Recon 02:30 - Running Gobuster and examining the web page 05:10 - Room.php is the only page that accepts user input, basic testing for ...

IppSec · Intermediate ·📊 Data Analytics & Business Intelligence ·6y ago

01:00 - Begin of Recon 02:30 - Running Gobuster and examining the web page 05:10 - Room.php is the only page that accepts user input, basic testing for SQL Injection 05:40 - Using wfuzz to fuzz for special characters then getting our IP Banned :( 10:00 - Unbanned, running wfuzz again and examining unique responses 13:00 - Showing several ways to test for SQL Injection (subtraction and hex()) 16:30 - Examining the MySQL Query Structure 17:30 - Explaining Union Injection 21:15 - Nested queries with union statements 23:20 - Extracting information out of Information_Schema to databases, tables, co…

Watch on YouTube ↗ (saves to browser)

Chapters (22)

1:00 Begin of Recon

2:30 Running Gobuster and examining the web page

5:10 Room.php is the only page that accepts user input, basic testing for SQL Injec

5:40 Using wfuzz to fuzz for special characters then getting our IP Banned :(

10:00 Unbanned, running wfuzz again and examining unique responses

13:00 Showing several ways to test for SQL Injection (subtraction and hex())

16:30 Examining the MySQL Query Structure

17:30 Explaining Union Injection

21:15 Nested queries with union statements

23:20 Extracting information out of Information_Schema to databases, tables, columns

24:08 Using LIMIT to ensure only one row is returned

25:25 Using GROUP_CONCAT to allow us to return multiple rows within union

32:20 Extracting Mysql users/passwords then cracking MySQL (mode 300)

35:10 Another way to get the password, LOAD_FILE() to view PHP Source Code

42:30 PHPMyAdmin 4.8.0 RCE (LFI + Tainted PHP Cookie)

57:40 Dropping a shell via the PHPMyAdmin exploit

59:30 ALTERNATE Way to get Shell:Dropping a file from the SQL Injection

1:03:52 Examining the PHP Cookie to see what happened with the PHPMyAdmin stuff

1:05:45 Examing the Python Script we can execute as pepper with sudo

1:10:40 We can execute code with $() but theres bad characters, so drop a bash script

1:15:00 Running find to look for setuid binaries, discover systemctl then check GTFO B

1:21:15 Copying our Sysmctl Scripts out of /tmp then creating our malicious service

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →