HackTheBox - Resource

Name: HackTheBox - Resource
Uploaded: 2024-11-23T15:07:14Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 06:55 - Discovering LFI in the page parameter but we cannot immediately exploit it 10:00 - Discovering admin ...

IppSec · Beginner ·📰 AI News & Updates ·1y ago

00:00 - Introduction 01:00 - Start of nmap 06:55 - Discovering LFI in the page parameter but we cannot immediately exploit it 10:00 - Discovering admin and playing with ping, deciding its not vulnerable and moving on 15:06 - Uploading a zip file to the ticket, then using the phar wrapper with our LFI to include it 19:50 - Shell returned on the box, python doesn't exist using script to fix our tty 23:00 - Editing our session file on the box, so we can change users without having to change the database 27:50 - Obtaining the HAR File from a ticket, showing Google's web app that visualizes the fil…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:00 Start of nmap

6:55 Discovering LFI in the page parameter but we cannot immediately exploit it

10:00 Discovering admin and playing with ping, deciding its not vulnerable and movin

15:06 Uploading a zip file to the ticket, then using the phar wrapper with our LFI t

19:50 Shell returned on the box, python doesn't exist using script to fix our tty

23:00 Editing our session file on the box, so we can change users without having to

27:50 Obtaining the HAR File from a ticket, showing Google's web app that visualizes

31:50 Examining the HAR File from command line, which I think is easier

36:30 Discovering old SSH CA Files in msainristil's directory, checking the SSH Conf

38:50 Using SSH-Keygen to sign a public key with a CA specifying root as the princip

43:00 Discovering a bash script which uses a web API to sign certificates with anoth

45:55 The host server has AuthorizedPrincipalsFile configured, explaining how this w

50:00 Logging in as ZZINTER and discovering they can run a bash script as sudo, whic

51:40 Explaining how this works, by doing a couple characters manually

57:50 Creating a program in golang to dump the CA File

1:09:15 Running the program, grabbing the CA then creating a root key

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →