HackTheBox - Nightmare

Name: HackTheBox - Nightmare
Uploaded: 2018-07-07T15:00:08Z
Channel: IppSec
Description: Edit: Whoops forgot @stefano_118 helped create this machine! 01:50 - Start of Recon 04:58 - /documents and /secret rabbit hole enumeration 08:13 - Usin...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·7y ago

Edit: Whoops forgot @stefano_118 helped create this machine! 01:50 - Start of Recon 04:58 - /documents and /secret rabbit hole enumeration 08:13 - Using wfuzz on the /secret rabbit hole to find argument for download.php 13:40 - Begin of Web Application Enumeration, some XSS Found 18:23 - Throwing bad characters in username and finding Second-Order SQL Injection. 23:50 - Begin of Union Injection to dump the database via second order sql injection 39:36 - Dumping users and passwords from SysAdmin table and using Hydra to bruteforce SSH 43:54 - Enumerating SFTP (Using SSHFS to Dump a File Listi…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

1:50 Start of Recon

4:58 /documents and /secret rabbit hole enumeration

8:13 Using wfuzz on the /secret rabbit hole to find argument for download.php

13:40 Begin of Web Application Enumeration, some XSS Found

18:23 Throwing bad characters in username and finding Second-Order SQL Injection.

23:50 Begin of Union Injection to dump the database via second order sql injection

39:36 Dumping users and passwords from SysAdmin table and using Hydra to bruteforce

43:54 Enumerating SFTP (Using SSHFS to Dump a File Listing)

53:00 Converting 64-Bit SFTP Exploit to 32-Bit

1:11:46 Reverse Shell Returned, some stuff and finding Set-GID Binary

1:22:55 Reversing SLS binary with Radare2 (r2)

1:47:53 Exploiting SLS Binary with new line character (Get to Decoder User)

1:51:47 Begin of Kernel Exploitation (CVE-2017-1000112)

1:56:00 Kernel Exploit Compiled (silly mistake before)

1:59:52 Creating a new lsb-release file so exploit can identify kernel

2:07:03 Recap of Box

2:09:56 Creating a Tamper Script to do Second-Order SQL Injection

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →