HackTheBox - Noter - Cracking Flask Cookies and performing MySQL Raptor Exploit on Modern Distro RCE

Name: HackTheBox - Noter - Cracking Flask Cookies and performing MySQL Raptor Exploit on Modern Distro RCE
Uploaded: 2022-09-03T16:39:16Z
Channel: IppSec
Description: 00:00 - Intro 00:57 - Start of nmap 02:40 - Registering an account 02:55 - Enumerating valid usernames based upon error message 05:30 - Using ffuf to ma...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Intro 00:57 - Start of nmap 02:40 - Registering an account 02:55 - Enumerating valid usernames based upon error message 05:30 - Using ffuf to match regex to enumerate valid usernames 07:10 - Poking at the web applicaiton trying IDOR/SSTI and failing 08:50 - Looking at the cookie given by the application and discovering it is a Flask Session Cookie 10:45 - Trying to crack the Flask Session with Hashcat. It fails because I think the payload is too long for hashcat. 16:50 - Using Flask-Unsign to crack the session 18:45 - Using flask-unsign to forge a cookie that says we are the Blue User…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Intro

0:57 Start of nmap

2:40 Registering an account

2:55 Enumerating valid usernames based upon error message

5:30 Using ffuf to match regex to enumerate valid usernames

7:10 Poking at the web applicaiton trying IDOR/SSTI and failing

8:50 Looking at the cookie given by the application and discovering it is a Flask S

10:45 Trying to crack the Flask Session with Hashcat. It fails because I think the p

16:50 Using Flask-Unsign to crack the session

18:45 Using flask-unsign to forge a cookie that says we are the Blue User

22:30 Logged into the application as Blue, get the ftp_admin password

25:10 Unzipping the source code that came from the ftp server and using diff to comp

27:50 Failing to exploit a command injection vulnerability in the export note functi

32:40 Going deeper in the export note function to discover it uses a node library md

43:10 Running LinPEAS

48:20 Start of the Raptor Exploit, we pulled a bad version so it isn't immediately g

55:20 Running Show Variables like '%plugin%' which will tell us where we should drop

1:00:30 Using a different version of raptor which has a do_system_init function, this

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →