HackTheBox - Pikatwoo

Name: HackTheBox - Pikatwoo
Uploaded: 2023-09-09T15:05:21Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:15 - Identifying all the technologies used in the box 10:45 - Looking at OpenStack Keystone Authentication...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap 03:15 - Identifying all the technologies used in the box 10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155 12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout 14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times 25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it 35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with B…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

1:00 Start of nmap

3:15 Identifying all the technologies used in the box

10:45 Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155

12:15 Pulling up API DOCS to see how to login to Keystone, then testing lockout

14:00 Taking the Burpsuite Request, sending it to FFUF and using a trick to try each

25:30 Attempting to access Swift as a vendor to bypass auth, using GoBuster and disc

35:10 Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Bur

40:15 Using Frida to disable TLS Certificate Pinning on Flutter

45:20 Discovering the App Signs every request, grabbing the certificate out of the a

49:20 Performing an SQL Injection, getting an email address then looking for vulnera

58:48 Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Path

1:04:45 Logging into the docs, gaining access to the API and finding an LFI

1:09:45 Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to a

1:18:10 Using NGINX's temporary files with our PHP LFI to gain code execution

1:27:55 Shell returned on Pokatdex-API, exporting Kubernetes secrets

1:34:20 Discovering an APISIX admin key and exploiting this service by creating a rout

1:59:20 Shell returned on the APISIX box, discovering credentials we can SSH with

2:11:10 Explioting the CRI-O with Kubernetes to set a kernel param to execute a script

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →