HackTheBox - Luanne

Name: HackTheBox - Luanne
Uploaded: 2021-03-27T15:00:00Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Starting nmap, using min-rate to speed up things and explaining why I don't normally show this 03:20 - Doing basic recon on...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Introduction 01:00 - Starting nmap, using min-rate to speed up things and explaining why I don't normally show this 03:20 - Doing basic recon on /, noticing authentication isn't required everywhere find robots.txt 07:05 - Taking a look at port 9001, searching for default credentials 13:10 - Once logged into Supervisord, we can examine processes see HTTP is using LUA 15:40 - Using FFUF to fuzz the /weather/ endpoint based upon the Supervisord and robots.txt 18:15 - Using FFUF to fuzz the city parameter of /weather/forecast for special characters 22:00 - Confirmed injection, failing to …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Starting nmap, using min-rate to speed up things and explaining why I don't no

3:20 Doing basic recon on /, noticing authentication isn't required everywhere find

7:05 Taking a look at port 9001, searching for default credentials

13:10 Once logged into Supervisord, we can examine processes see HTTP is using LUA

15:40 Using FFUF to fuzz the /weather/ endpoint based upon the Supervisord and robot

18:15 Using FFUF to fuzz the city parameter of /weather/forecast for special charact

22:00 Confirmed injection, failing to get it to work

24:45 Going back to FFUF to fuzz for another character after the single quote. We ca

30:20 Reverse shell returned, attempt to crack the hash on my VM and crash my VM...

38:00 Using the webapi_user in order to access the webserver

42:40 Looking into the arguments for HTTP Running on port 3001, since we can hit tha

49:45 Looks like nginx supports going into home directories, looking at r.michaels t

53:10 Looks like r.michaels has some PGP Keys associated with his account, finding a

57:00 The encrypted tar had a different password for webapi_user, decrypting it and

57:50 Box done, cleaning up notes

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →