HackTheBox - LightWeight

Name: HackTheBox - LightWeight
Uploaded: 2019-05-11T15:00:16Z
Channel: IppSec
Description: 00:45 - Begin of recon, Nmap 01:30 - Taking the CentOS Apache Version to find major version 03:20 - Running GoBuster with a Common-PHP-Files wordlist. 0...

IppSec · Intermediate ·🔐 Cybersecurity ·6y ago

00:45 - Begin of recon, Nmap 01:30 - Taking the CentOS Apache Version to find major version 03:20 - Running GoBuster with a Common-PHP-Files wordlist. 06:00 - Enumerating Ldap with ldapsearch 07:30 - Discovery of Password Hashes within ldap information 10:55 - Attempting to crack the hashes. (does not crack) 12:30 - Back to the web page 13:15 - Page says to login with ip@Lightweight with the password of your ip 15:35 - Running LinEnum 20:15 - Discovery of Extended Capabilities set on tcpdump 20:50 - Performing a packet capture over SSH without touching disk 23:45 - Examining the pcap created, …

Watch on YouTube ↗ (saves to browser)

Chapters (21)

0:45 Begin of recon, Nmap

1:30 Taking the CentOS Apache Version to find major version

3:20 Running GoBuster with a Common-PHP-Files wordlist.

6:00 Enumerating Ldap with ldapsearch

7:30 Discovery of Password Hashes within ldap information

10:55 Attempting to crack the hashes. (does not crack)

12:30 Back to the web page

13:15 Page says to login with ip@Lightweight with the password of your ip

15:35 Running LinEnum

20:15 Discovery of Extended Capabilities set on tcpdump

20:50 Performing a packet capture over SSH without touching disk

23:45 Examining the pcap created, don't see anything on ens33

24:20 Performing a packet capture through SSH and piping live results to WireShark

26:00 Discovery of LDAP Traffic, ldapuser2 password passed in clear-text

28:15 Using bash to exfil a file over the network (backup.7z)

29:25 Using 7z2john and hashcat to crack a 7zip file

32:05 Examining extracted files to discover a new credential (ldapuser1)

33:30 The openssl binary in ldapuser1 has an empty capability (which is all)

35:00 Using GTFOBins to see what we can do with openssl

37:11 Reading /etc/shadow with openssl

37:35 Adding an entry into /etc/sudoers to allow us to escalate to root

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →