HackTheBox - Pit

Name: HackTheBox - Pit
Uploaded: 2021-09-25T15:21:07Z
Channel: IppSec
Description: 00:00 - Intro the important thing about this box is recon 01:28 - Start of nmap discovering an nginx server header 04:25 - The SSL Certificate leaks an ...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·4y ago

00:00 - Intro the important thing about this box is recon 01:28 - Start of nmap discovering an nginx server header 04:25 - The SSL Certificate leaks an important hostname 09:50 - Running an SNMPWalk which has a bunch of important information, notably the HTML Directory 13:30 - Discovering the SeedDms51x Directory, trying to enumerate version (Failing) 22:00 - Creating a python script to help with bruteforcing 29:30 - Script done, looking at SNMP to get other usernames 29:40 - Brutefocing michelle's password to get in and seeing the SeedDMS Version 33:30 - The SeedDMS Patch used htaccess, serve…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Intro the important thing about this box is recon

1:28 Start of nmap discovering an nginx server header

4:25 The SSL Certificate leaks an important hostname

9:50 Running an SNMPWalk which has a bunch of important information, notably the HT

13:30 Discovering the SeedDms51x Directory, trying to enumerate version (Failing)

22:00 Creating a python script to help with bruteforcing

29:30 Script done, looking at SNMP to get other usernames

29:40 Brutefocing michelle's password to get in and seeing the SeedDMS Version

33:30 The SeedDMS Patch used htaccess, server is nginx so its still vulnerable. Upl

42:30 Grabbing the MySQL Password from SeedDMS Config and trying it against other se

48:50 The SNMP is executing a program every time snmp is ran, we can trick SNMP to e

56:20 Start of Explaining SELinux

60:00:40 SELinux Using audit2why to show us why reverse shells were blocked from revers

68:00:50 SELinux Checking why SNMP could not read /root/root.txt

1:21:11 Explaining more about the SNMP vectors of this box

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →