HackTheBox - Luke

Name: HackTheBox - Luke
Uploaded: 2019-09-14T15:00:10Z
Channel: IppSec
Description: 00:40 - Begin of Recon 02:45 - Checking FTP to get a note 03:38 - Going to each of the three websites 04:30 - Running Gobuster on port 80/3000 06:30 - T...

IppSec · Intermediate ·🧠 Large Language Models ·6y ago

00:40 - Begin of Recon 02:45 - Checking FTP to get a note 03:38 - Going to each of the three websites 04:30 - Running Gobuster on port 80/3000 06:30 - Taking notes of all the login pages (forgot Ajenti) 07:55 - config.php found which has a password 10:15 - Discovering /login on port 3000 accepts username=&password= 11:25 - Successful login! JWT Token returned 14:00 - Using curl to add the JWT Token in the header to access other api endpoints 15:10 - Using BurpSuite to add headers 18:30 - Navigating the Rest API to dump the usernames and passwords 20:30 - Attempting logins on other services 21…

Watch on YouTube ↗ (saves to browser)

Chapters (22)

0:40 Begin of Recon

2:45 Checking FTP to get a note

3:38 Going to each of the three websites

4:30 Running Gobuster on port 80/3000

6:30 Taking notes of all the login pages (forgot Ajenti)

7:55 config.php found which has a password

10:15 Discovering /login on port 3000 accepts username=&password=

11:25 Successful login! JWT Token returned

14:00 Using curl to add the JWT Token in the header to access other api endpoints

15:10 Using BurpSuite to add headers

18:30 Navigating the Rest API to dump the usernames and passwords

20:30 Attempting logins on other services

21:30 Derry can login to /management

22:50 Ajenti Password! Lets try logging in

22:30 Ajenti has a virtual terminal that is running as root!

26:20 Extra Content - Getting a reverse shell

28:30 Grabbing the JWT Secret, so we can forge our own tokens!

29:10 Creating a python script to generate JWT Tokens

30:20 This token has no expiration time, and is assigned at 0. Should never expire!

31:30 Adding Requests to our script, so the script can make web requests

33:15 Lets try removing all signing algorithms from the token and see if server acce

34:40 Cracking the JWT Token Signing key with Hashcat

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HackTheBox - Luke

Chapters (22)

Playlist

Lesson complete!