HackTheBox RegistryTwo

Name: HackTheBox RegistryTwo
Uploaded: 2024-02-03T15:00:51Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 03:10 - Enumerating port 5000/5001 to see a Docker Registry and Auth Server 06:10 - Creating our auth token for the ...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Intro 01:00 - Start of nmap 03:10 - Enumerating port 5000/5001 to see a Docker Registry and Auth Server 06:10 - Creating our auth token for the Docker Registry 08:45 - Adding the SSL Cert to our certificate store, then doing a docker pull to download and run the container 13:00 - Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of /..;/ (nginx directory didn't have a trailing slash on the location) 16:45 - The Examples directory has a sessions example that lets us modify the session, doing this to get a File Disclosure vulnerability then downloading the WAR f…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:00 Start of nmap

3:10 Enumerating port 5000/5001 to see a Docker Registry and Auth Server

6:10 Creating our auth token for the Docker Registry

8:45 Adding the SSL Cert to our certificate store, then doing a docker pull to down

13:00 Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of

16:45 The Examples directory has a sessions example that lets us modify the session,

27:45 Opening the WAR in JD-GUI then examining the source code, discovering we can c

33:30 Pointing the RMI.HOST back to us, then use YSOSERIAL to host a malicious serve

42:50 YSOSERIAL-MODIFIED Docker is up, using YSOSERIAL to start a JRMP Listener and

46:45 Shell on the container, showing where IPv6 addresses are stored (/proc/if_inet

52:51 Looking at the source code again, discovering we can use the RMI to perform fi

56:00 Start of creating the RMI Client Java App

1:09:18 Running into an error using our decompiled code. Having our exploit just refer

1:25:00 Finishing up our exploit script, then writing an SSH Key

1:37:00 Looking at running processes, discovering the RMI Server restarts every 3 minu

1:43:00 Looking at the initial JAR again, discovering it will give out a config. Using

1:48:00 Looking at the Quarantine Service, which pulls a config from the RMI Server th

1:51:40 Having CLAM AV scan /root, and fl

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →