HackTheBox - Postman

Name: HackTheBox - Postman
Uploaded: 2020-03-14T14:00:22Z
Channel: IppSec
Description: 01:00 - Begin of nnmap scan 01:45 - Checking out the website, trying to identify what technology runs the site 03:20 - Nmap scan finished, start more re...

IppSec · Beginner ·🔐 Cybersecurity ·6y ago

01:00 - Begin of nnmap scan 01:45 - Checking out the website, trying to identify what technology runs the site 03:20 - Nmap scan finished, start more recon (GoBuster and full nmap port scan) 07:00 - Trying to find out when the website was stood up with exiftool 09:00 - Full nmap showed the REDIS port, initial poking 10:55 - Searching the internet for things you can do with a REDIS Server 14:50 - Dropping a webshell didn't work, lets try dropping an SSH Key 16:30 - Discovering the location of a .ssh directory by guessing the default (/var/lib/redis/.ssh) 19:30 - Got a shell on the box! 22:00 - …

Watch on YouTube ↗ (saves to browser)

Chapters (17)

1:00 Begin of nnmap scan

1:45 Checking out the website, trying to identify what technology runs the site

3:20 Nmap scan finished, start more recon (GoBuster and full nmap port scan)

7:00 Trying to find out when the website was stood up with exiftool

9:00 Full nmap showed the REDIS port, initial poking

10:55 Searching the internet for things you can do with a REDIS Server

14:50 Dropping a webshell didn't work, lets try dropping an SSH Key

16:30 Discovering the location of a .ssh directory by guessing the default (/var/lib

19:30 Got a shell on the box!

22:00 Running LinPEAS

29:45 Running LinEnum twice (once with throrough mode enabled). To make sure we hav

33:10 Discovering Matt logged in at a time we did not previously have

36:07 Discovering an encrypted SSH key, cracking the SSH Key with John

40:00 SSH failing to work, decide to just use "su" to switch to the Matt User

42:00 Discovering we can login to WebMin with Matt

42:48 Running searchsploit, then using Metasploit to exploit Webmin

45:30 Root shell returned, set Metasploit to go through burp and play with it until

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →