HackTheBox - MetaTwo

IppSec · Beginner ·🔐 Cybersecurity ·3y ago
00:00 - Introduction 01:00 - Start of nmap, attempting to login with FTP then going to the website 02:45 - Running WPScan with enumerate all plugins in aggressive mode 04:00 - Taking a look at the site while WPScan runs and finding a plugin (BookingPress-Appointment-Booking) and finding an exploit 06:15 - Replacing the NONCE in the exploit to get it working 09:00 - Using SQLMap to dump everything, while we attempt to get only the data we think we are interested in. 11:00 - Manually dumping the WP_USERS table with the SQL Injection 13:25 - Cracking the wordpress hashes to get a user credential 16:57 - EDIT: Playing with SQLMap to get it to dump this database 23:30 - Searching for Wordpress 5.6.2 exploits, discovering an XXE in WAV Files 25:20 - Using the XXE to exfil files off the webserver 30:20 - Discovering FTP Credentials in the WP Config, logging into the FTP Server and finding SSH Credentials 32:40 - Logging in as JNelson and seeing PassPie, which is a CLI Password Manager that uses PGP/GPG Keys 34:30 - Cracking to PGP/GPG Key with John and getting root
Watch on YouTube ↗ (saves to browser)
Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →
1 HHC2016 - Analytics
HHC2016 - Analytics
IppSec
 2 HackTheBox - October
HackTheBox - October
IppSec
 3 HackTheBox - Arctic
HackTheBox - Arctic
IppSec
 4 HackTheBox - Brainfuck
HackTheBox - Brainfuck
IppSec
 5 HackTheBox - Bank
HackTheBox - Bank
IppSec
 6 HackTheBox - Joker
HackTheBox - Joker
IppSec
 7 HackTheBox - Lazy
HackTheBox - Lazy
IppSec
 8 Camp CTF 2015 - Bitterman
Camp CTF 2015 - Bitterman
IppSec
 9 HackTheBox - Devel
HackTheBox - Devel
IppSec
 10 Reversing Malicious Office Document (Macro) Emotet(?)
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
 11 HackTheBox - Granny and Grandpa
HackTheBox - Granny and Grandpa
IppSec
 12 HackTheBox - Pivoting Update: Granny and Grandpa
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
 13 HackTheBox - Optimum
HackTheBox - Optimum
IppSec
 14 HackTheBox - Charon
HackTheBox - Charon
IppSec
 15 HackTheBox - Sneaky
HackTheBox - Sneaky
IppSec
 16 HackTheBox - Holiday
HackTheBox - Holiday
IppSec
 17 HackTheBox - Europa
HackTheBox - Europa
IppSec
 18 Introduction to tmux
Introduction to tmux
IppSec
 19 HackTheBox - Blocky
HackTheBox - Blocky
IppSec
 20 HackTheBox - Nineveh
HackTheBox - Nineveh
IppSec
 21 HackTheBox - Jail
HackTheBox - Jail
IppSec
 22 HackTheBox - Blue
HackTheBox - Blue
IppSec
 23 HackTheBox - Calamity
HackTheBox - Calamity
IppSec
 24 HackTheBox - Shrek
HackTheBox - Shrek
IppSec
 25 HackTheBox - Mirai
HackTheBox - Mirai
IppSec
 26 HackTheBox - Shocker
HackTheBox - Shocker
IppSec
 27 HackTheBox - Mantis
HackTheBox - Mantis
IppSec
 28 HackTheBox - Node
HackTheBox - Node
IppSec
 29 HackTheBox - Kotarak
HackTheBox - Kotarak
IppSec
 30 HackTheBox - Enterprise
HackTheBox - Enterprise
IppSec
 31 HackTheBox - Sense
HackTheBox - Sense
IppSec
 32 HackTheBox - Minion
HackTheBox - Minion
IppSec
 33 VulnHub - Sokar
VulnHub - Sokar
IppSec
 34 VulnHub - Pinkys Palace v2
VulnHub - Pinkys Palace v2
IppSec
 35 HackTheBox - Inception
HackTheBox - Inception
IppSec
 36 Vulnhub - Trollcave 1.2
Vulnhub - Trollcave 1.2
IppSec
 37 HackTheBox - Ariekei
HackTheBox - Ariekei
IppSec
 38 HackTheBox - Flux Capacitor
HackTheBox - Flux Capacitor
IppSec
 39 HackTheBox - Jeeves
HackTheBox - Jeeves
IppSec
 40 HackTheBox - Tally
HackTheBox - Tally
IppSec
 41 HackTheBox - CrimeStoppers
HackTheBox - CrimeStoppers
IppSec
 42 HackTheBox - Fulcrum
HackTheBox - Fulcrum
IppSec
 43 HackTheBox - Chatterbox
HackTheBox - Chatterbox
IppSec
 44 HackTheBox - Falafel
HackTheBox - Falafel
IppSec
 45 How To Create Empire Modules
How To Create Empire Modules
IppSec
 46 HackTheBox - Nightmare
HackTheBox - Nightmare
IppSec
 47 HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
 48 HackTheBox - Bart
HackTheBox - Bart
IppSec
 49 HackTheBox - Aragog
HackTheBox - Aragog
IppSec
 50 HackTheBox - Valentine
HackTheBox - Valentine
IppSec
 51 HackTheBox - Silo
HackTheBox - Silo
IppSec
 52 HackTheBox - Rabbit
HackTheBox - Rabbit
IppSec
 53 HackTheBox - Celestial
HackTheBox - Celestial
IppSec
 54 HackTheBox - Stratosphere
HackTheBox - Stratosphere
IppSec
 55 HackTheBox - Poison
HackTheBox - Poison
IppSec
 56 HackTheBox - Canape
HackTheBox - Canape
IppSec
 57 HackTheBox - Olympus
HackTheBox - Olympus
IppSec
 58 HackTheBox - Sunday
HackTheBox - Sunday
IppSec
 59 HackTheBox - Fighter
HackTheBox - Fighter
IppSec
 60 HackTheBox - Bounty
HackTheBox - Bounty
IppSec

Related AI Lessons

⚡
The Secure One Is Silent: Kerberos Stays Quiet, NTLM Tells
Learn how NTLM packets can be used in analysis processes for cybersecurity, and why Kerberos stays quiet in comparison
Medium · Cybersecurity
 ⚡
Reclaiming the Narrative: How “Hire a Hacker Pro” Built an Immutable Blueprint for Enterprise…
Learn how 'Hire a Hacker Pro' created an immutable blueprint for enterprise cybersecurity, and why it matters for businesses today
Medium · Cybersecurity
 ⚡
️ Shift-Left Security: La Seguridad no es una Meta, es el Camino️
Learn how Shift-Left Security integrates security into every stage of the development process, making it a crucial part of the journey, not just a final goal
Medium · Cybersecurity
 ⚡
Cloud Misconfiguration at Scale: Why It’s America’s Most Underrated Cybersecurity Threat — a…
Cloud misconfiguration is a significant cybersecurity threat due to its potential for large-scale damage, and understanding its causes and consequences is crucial for effective mitigation
Medium · DevOps

Chapters (14)

Introduction
1:00 Start of nmap, attempting to login with FTP then going to the website
2:45 Running WPScan with enumerate all plugins in aggressive mode
4:00 Taking a look at the site while WPScan runs and finding a plugin (BookingPress
6:15 Replacing the NONCE in the exploit to get it working
9:00 Using SQLMap to dump everything, while we attempt to get only the data we thin
11:00 Manually dumping the WP_USERS table with the SQL Injection
13:25 Cracking the wordpress hashes to get a user credential
16:57 EDIT: Playing with SQLMap to get it to dump this database
23:30 Searching for Wordpress 5.6.2 exploits, discovering an XXE in WAV Files
25:20 Using the XXE to exfil files off the webserver
30:20 Discovering FTP Credentials in the WP Config, logging into the FTP Server and
32:40 Logging in as JNelson and seeing PassPie, which is a CLI Password Manager that
34:30 Cracking to PGP/GPG Key with John and getting root
Up next
VPC Service Controls: Day Two Operations
Google Cloud
Watch →