HackTheBox - Magic

Name: HackTheBox - Magic
Uploaded: 2020-08-22T15:00:26Z
Channel: IppSec
Description: 00:00 - Intro 00:50 - Nmap 02:40 - Starting GoBuster on the root and images 05:00 - Finding Auth Bypass via SQL Injection on login then throwing it to S...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 00:50 - Nmap 02:40 - Starting GoBuster on the root and images 05:00 - Finding Auth Bypass via SQL Injection on login then throwing it to SQLMap 09:00 - Creating a basic PHP Shell, then attempting to upload it 12:30 - Grabbing the magic bytes off a JPG, then prepending it to our shell 16:00 - File uploaded, hunting for an LFI and doing more SQLMap 18:20 - Turns out we don't need the PHP Extension (.htaccess allows anything) 26:20 - Reverse Shell returned 27:50 - Grabbing the username and password out of Website Configuration 36:10 - Using VirusTotal to identify when a file was cre…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Intro

0:50 Nmap

2:40 Starting GoBuster on the root and images

5:00 Finding Auth Bypass via SQL Injection on login then throwing it to SQLMap

9:00 Creating a basic PHP Shell, then attempting to upload it

12:30 Grabbing the magic bytes off a JPG, then prepending it to our shell

16:00 File uploaded, hunting for an LFI and doing more SQLMap

18:20 Turns out we don't need the PHP Extension (.htaccess allows anything)

26:20 Reverse Shell returned

27:50 Grabbing the username and password out of Website Configuration

36:10 Using VirusTotal to identify when a file was created

37:20 Examining the .htaccess to see why we could execute code (should have a $ at t

39:30 Using MsqlDump to dump the database and get a password out of it, su to the th

46:00 Found a SetUID Binary (sysinfo) then using strace to see what it does

48:00 Using the -f argument with strace to follow forks and see the exec() calls

51:00 Using Path Injection since absolute paths were not used in exec() and getting

55:00 Showing SQLMap did complete with the increased level/risk

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →