HackTheBox - Pilgrimage

Name: HackTheBox - Pilgrimage
Uploaded: 2023-11-25T15:00:01Z
Channel: IppSec
Description: 00:00 - Introduction 00:55 - Start of nmap 03:00 - Uploading an image file and trying to identify how the upload works 06:20 - Running Git-Dumper to dow...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·2y ago

00:00 - Introduction 00:55 - Start of nmap 03:00 - Uploading an image file and trying to identify how the upload works 06:20 - Running Git-Dumper to download the exposed .git directory, taking a look at the source code 09:45 - Looking at the ImageMagick version (7.1.0-49) and seeing it is vulnerable to CVE-2022-44268 13:30 - Generating a malicious image and downloading the sqlite database 19:30 - Doing a PS and seeing inotifywait is being used to run a bash script when files created in web directory 21:35 - Showing why the bash script is not vulnerable 28:00 - Finding a binwalk exploit for ver…

Watch on YouTube ↗ (saves to browser)

Chapters (11)

Introduction

0:55 Start of nmap

3:00 Uploading an image file and trying to identify how the upload works

6:20 Running Git-Dumper to download the exposed .git directory, taking a look at th

9:45 Looking at the ImageMagick version (7.1.0-49) and seeing it is vulnerable to C

13:30 Generating a malicious image and downloading the sqlite database

19:30 Doing a PS and seeing inotifywait is being used to run a bash script when file

21:35 Showing why the bash script is not vulnerable

28:00 Finding a binwalk exploit for version 2.3.2, which takes advantage of path tra

32:50 Taking a look into the exploit to see how it works

35:30 Showing the PFS File Format

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →