HackTheBox - Sandworm

Name: HackTheBox - Sandworm
Uploaded: 2023-11-18T15:00:18Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:10 - Finding their public key, then sending an encrypted message that contains a XSS Test payload 06:50 - ...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap 03:10 - Finding their public key, then sending an encrypted message that contains a XSS Test payload 06:50 - Creating a PGP Key and sending our public key, so they can send an encrypted message back 08:40 - Decrypting the message they sent to us 09:50 - Signing a message, but not encrypting it for them to verify and see they give us the metadata back 12:40 - Testing a SSTI Payload in the username of the key, and seeing it will dump the config 15:25 - Finding a SSTI Payload with Jinja2 that gives code execution... First attempt fails 19:23 - Testing a …

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

1:00 Start of nmap

3:10 Finding their public key, then sending an encrypted message that contains a XS

6:50 Creating a PGP Key and sending our public key, so they can send an encrypted m

8:40 Decrypting the message they sent to us

9:50 Signing a message, but not encrypting it for them to verify and see they give

12:40 Testing a SSTI Payload in the username of the key, and seeing it will dump the

15:25 Finding a SSTI Payload with Jinja2 that gives code execution... First attempt

19:23 Testing a different SSTI Payload and getting code execution

21:40 Reverse shell returned, discovering we are in a jail, attempting to get chisel

26:55 Finding admin.json which contains another credential and we can use this to SS

28:00 Logging into MySQL and attempting to crack the hashes

31:00 Identifying that a file in the cargo directory for atlas is being updated ever

35:55 We can write to one of the libraries cargo using to build, putting a reverse s

43:50 Identifying that Atlas can run Firejail as root, finding a exploit for Firejai

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →