HackTheBox - Passage

Name: HackTheBox - Passage
Uploaded: 2021-03-06T15:00:02Z
Channel: IppSec
Description: 00:00 - Intro 01:10 - Start of nmap 02:10 - Identifying this is likely Ubuntu Xenial 03:30 - Attempting basic SQL Map 05:20 - Failing to find a way to e...

IppSec · Beginner ·📰 AI News & Updates ·5y ago

00:00 - Intro 01:10 - Start of nmap 02:10 - Identifying this is likely Ubuntu Xenial 03:30 - Attempting basic SQL Map 05:20 - Failing to find a way to enumerate CuteNews version 06:55 - Looking over an exploit script from SearchSploit 08:15 - Finding there is a page that exposes a bunch of user hashes... wat? 10:20 - Copying a bunch of PHP Blobs, then using grep to only show us the hashes 11:50 - Going back to looking over the exploit script 14:00 - Sent the exploit script through burpsuite and looking at each request 15:45 - Getting a reverse shell and fixing out TTY 19:00 - Searching CuteNew…

Watch on YouTube ↗ (saves to browser)

Chapters (21)

Intro

1:10 Start of nmap

2:10 Identifying this is likely Ubuntu Xenial

3:30 Attempting basic SQL Map

5:20 Failing to find a way to enumerate CuteNews version

6:55 Looking over an exploit script from SearchSploit

8:15 Finding there is a page that exposes a bunch of user hashes... wat?

10:20 Copying a bunch of PHP Blobs, then using grep to only show us the hashes

11:50 Going back to looking over the exploit script

14:00 Sent the exploit script through burpsuite and looking at each request

15:45 Getting a reverse shell and fixing out TTY

19:00 Searching CuteNews PHP Files for passwords

20:35 Decoding the php files within the users directory to get password hashes

20:50 Writing a nasty bash one liner to go over all the files and output the base64,

23:00 Using Hash Identifier to get an idea what the hash is, then using CrackStation

26:15 The Cred we decrypted was for John, using SU to switch to the john user

27:00 Oddly enough the SSH Public key is John's directly wasn't generated by him...

30:00 Using Nadav's key to SSH into the box

31:48 Exploring VIMINFO to see some forensics on what this user has done

34:14 Looking for USBCreator Privesc's

37:00 Running the GDBus command to copy files and get root.

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HackTheBox - Passage

Chapters (21)

Playlist

Lesson complete!