HackTheBox - Pikaboo

Name: HackTheBox - Pikaboo
Uploaded: 2021-12-04T15:00:28Z
Channel: IppSec
Description: 00:00 - Intro 01:05 - Start of nmap 03:00 - Discovering the webserver is apache, despite nmap saying it is nginx 06:30 - Every request with /admin gets ...

IppSec · Beginner ·🛡️ AI Safety & Ethics ·4y ago

00:00 - Intro 01:05 - Start of nmap 03:00 - Discovering the webserver is apache, despite nmap saying it is nginx 06:30 - Every request with /admin gets a 401, indication that nginx location may not end with / 07:30 - Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ directory 08:30 - Running gobuster in /admin_staging/ to discover more php scripts 09:20 - Testing index.php for lfi with a php filter 12:00 - Looking at the source and seeing it is using include() which allows for RCE if we can get it pointed at php code 13:50 - Playing with the LFI, eventually finding i…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Intro

1:05 Start of nmap

3:00 Discovering the webserver is apache, despite nmap saying it is nginx

6:30 Every request with /admin gets a 401, indication that nginx location may not e

7:30 Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ d

8:30 Running gobuster in /admin_staging/ to discover more php scripts

9:20 Testing index.php for lfi with a php filter

12:00 Looking at the source and seeing it is using include() which allows for RCE if

13:50 Playing with the LFI, eventually finding info.php which tells us open_basedir

16:35 Using wfuzz with an LFI wordlist to search for files we can chain with this LF

19:00 Poisoning the FTP log with a php reverse shell then using the LFI to trigger i

24:15 Looking at the /opt/pokeapi directory to find a LDAP credentials

25:45 Using ldapsearch to dump information out of the linux ldap server to get pwnme

28:25 Using ftp with pwnmeow's credentials, then running linpeas

32:35 Examining the CSVUpdate cron and finding a code injection vulnerability in the

35:20 Going over why perl will execute a variable starting or ending with | with an

37:30 Creating a revers shell file that begins with |

41:30 Uploading our malicious file via FTP and getting root

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →