HackTheBox - Poison

Name: HackTheBox - Poison
Uploaded: 2018-09-08T15:02:46Z
Channel: IppSec
Description: 00:56 - Start of recon, use Bootstrap XSL Script to make nmap pretty 03:10 - Looking at nmap in web browser 03:52 - Navigating to the web page, and tes...

IppSec · Beginner ·🔐 Cybersecurity ·7y ago

00:56 - Start of recon, use Bootstrap XSL Script to make nmap pretty 03:10 - Looking at nmap in web browser 03:52 - Navigating to the web page, and testing all the pages. 06:25 - Testing for LFI 07:00 - Using PHP Filters to view the contents of php file through LFI (Local File Inclusion) 08:40 - Testing for RFI (Remote File Inclusion) [not vuln] 10:00 - Code Execution via LFI + phpinfo() 14:45 - Modifying the PHP-LFI Script code to get it working 17:10 - Debugging the script to see why tmp_name couldn't be found 20:12 - Shell returned! 21:25 - Looking at pwdbackup.txt and decoding 13 times t…

Watch on YouTube ↗ (saves to browser)

Chapters (21)

0:56 Start of recon, use Bootstrap XSL Script to make nmap pretty

3:10 Looking at nmap in web browser

3:52 Navigating to the web page, and testing all the pages.

6:25 Testing for LFI

7:00 Using PHP Filters to view the contents of php file through LFI (Local File In

8:40 Testing for RFI (Remote File Inclusion) [not vuln]

10:00 Code Execution via LFI + phpinfo()

14:45 Modifying the PHP-LFI Script code to get it working

17:10 Debugging the script to see why tmp_name couldn't be found

20:12 Shell returned!

21:25 Looking at pwdbackup.txt and decoding 13 times to get password.

23:37 SSH into the box (Do not privesc right away!)

24:29 Getting shell via Log Poisoning

26:39 Whoops. Broke the exploit, because of bad PHP Code... We'll come back to this

28:47 Begin of PrivEsc, grabbing secret.zip off

32:38 Searching for processes running as root, find VNC

33:49 Setting up SSH Tunnels without exiting SSH Session.

37:43 Something weird happend... Setting up SSH Tunnels manually.

40:10 PrivEsc: VNC through the SSH Tunnel, passing the encrypted VNC Password

41:40 Decrypting the VNC Password because we can.

42:50 Examining the log file to see why our Log Poison Failed, then doing the Log Po

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →