HackTheBox - Mailroom

Name: HackTheBox - Mailroom
Uploaded: 2023-08-19T15:00:31Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap, discovering two different OS's 02:30 - Running Gobuster to bruteforce VHOST 03:30 - Discovering XSS but noth...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap, discovering two different OS's 02:30 - Running Gobuster to bruteforce VHOST 03:30 - Discovering XSS but nothing we can really do with it 04:00 - Enumerating Gitea, discovering a repo with some source code 05:40 - Opening the code with VS Code and Snyk. Discovering a RCE Vulnerability but requires login 07:30 - Discovering an EAR (Execute After Read) Vulnerability on Authentication 09:10 - Start of building our Javascript payload to exploit NoSQL Injection, download the internal page 12:40 - Explaining the NoSQL Injection, then testing with a login b…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:00 Start of nmap, discovering two different OS's

2:30 Running Gobuster to bruteforce VHOST

3:30 Discovering XSS but nothing we can really do with it

4:00 Enumerating Gitea, discovering a repo with some source code

5:40 Opening the code with VS Code and Snyk. Discovering a RCE Vulnerability but re

7:30 Discovering an EAR (Execute After Read) Vulnerability on Authentication

9:10 Start of building our Javascript payload to exploit NoSQL Injection, download

12:40 Explaining the NoSQL Injection, then testing with a login bypass

16:30 Discovering what happens on invalid logins

20:40 Getting the length of the password

25:30 Bruteforcing the password with boolean logic

30:00 Logging in via ssh with the credentials we got from the nosql injection, looki

33:20 Logged into the dashboard, can hit the RCE Endpoint now to get a shell as www-

40:20 Discovering a keepass file, running PS enough we can see KPCLI Runs

41:30 Running STRACE against KPCLI to intercept syscalls

42:40 Specifying we only want to see READS, and can intercept keys sent to KeePass a

46:10 Going into the Mongo docker container and running mongodump to dump all the us

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →