HackTheBox - Rabbit

Name: HackTheBox - Rabbit
Uploaded: 2018-08-18T15:00:17Z
Channel: IppSec
Description: 01:40 - Begin of Recon (nmap, setting hostname, dns, nmap, ipv6) 05:45 - Checking websites (80,443,8080) 08:10 - Attempting to enumerate users of OWA-20...

IppSec · Intermediate ·🔐 Cybersecurity ·7y ago

01:40 - Begin of Recon (nmap, setting hostname, dns, nmap, ipv6) 05:45 - Checking websites (80,443,8080) 08:10 - Attempting to enumerate users of OWA-2010 (Fails) 14:10 - Checking out Joomla Version (/administrator/manifets/files/joomla.xml) 15:50 - Using SearchSploit with (Complain Management System) 19:38 - Register Account, Login, Verify/Play with SQL Union Injection 23:30 - Enumerating SQL Injection with SQLMap 29:18 - Going back to MSF/OWA_LOGIN and testing credentials. 32:15 - Logging into OWA and reading email to find out OpenOFfice, Defender, and Powershell Constain Mode is installed 3…

Watch on YouTube ↗ (saves to browser)

Chapters (20)

1:40 Begin of Recon (nmap, setting hostname, dns, nmap, ipv6)

5:45 Checking websites (80,443,8080)

8:10 Attempting to enumerate users of OWA-2010 (Fails)

14:10 Checking out Joomla Version (/administrator/manifets/files/joomla.xml)

15:50 Using SearchSploit with (Complain Management System)

19:38 Register Account, Login, Verify/Play with SQL Union Injection

23:30 Enumerating SQL Injection with SQLMap

29:18 Going back to MSF/OWA_LOGIN and testing credentials.

32:15 Logging into OWA and reading email to find out OpenOFfice, Defender, and Power

36:20 Creating a malicious OpenOffice macro with LibreOffice + Downloading an Execut

40:18 Compiling Merlin (like MSF/Empire)

48:40 Sending the email and waiting.

50:20 Merlin call back, Switch to Powershell Nishang to get a interactive shell

54:30 Running PowerUp to find we are an Administrator

56:56 Running JAWS to do some more Windows Enumeration

1:03:04 Found an odd scheduled task "System Maintenance"

1:06:03 Attempting to write a php shell to HTTPD

1:12:30 Frusterated creating a PHP Script... Switch to the SCHTask Privesc

1:18:20 Uhh. Testing if echo is somehow breaking .bat/.php files

1:21:50 Going back to test PHP to verify it just didn't like echo.

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →