HackTheBox - Sea

Name: HackTheBox - Sea
Uploaded: 2024-12-21T15:00:45Z
Channel: IppSec
Description: 00:00 - Introduction 00:40 - Start of nmap 03:40 - Trying to identify what is running the webapp (WonderCMS), discovering a themes directory in source a...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 00:40 - Start of nmap 03:40 - Trying to identify what is running the webapp (WonderCMS), discovering a themes directory in source and burpsuite 04:36 - Taking a string that looks unique in the CSS and searching GitHub to discover where it exists in an open-source repo 05:45 - Showing several ways we could of dirbusted the themes directory to discover this file 08:45 - Discovering a public POC for the XSS Attack 14:07 - Showing the pathname is not being set correctly in the public poc, fixing it then getting a callback 18:50 - We see the webserver downloaded our shell but t…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

0:40 Start of nmap

3:40 Trying to identify what is running the webapp (WonderCMS), discovering a theme

4:36 Taking a string that looks unique in the CSS and searching GitHub to discover

5:45 Showing several ways we could of dirbusted the themes directory to discover th

8:45 Discovering a public POC for the XSS Attack

14:07 Showing the pathname is not being set correctly in the public poc, fixing it t

18:50 We see the webserver downloaded our shell but the poc didn't send it to us dir

21:00 Extracting the WonderCMS Password and cracking it

24:48 Discovering a few ports listening on localhost, checking /etc to try and figur

26:00 Forwarding port 8080 back to our box, then discovering a webapp that has a com

31:40 Discovering our shell dies quickly, adding a nohup to our reverse shell to mak

34:00 Showing why our reverse shell is not stable, it hangs the webserver which caus

37:30 Showing an alternate way to getting the shell, just editing sudoers file to ad

40:10 Going over the XSS, showing the Reflective Injection and why it only triggers

43:50 Manually exploiting this XSS by writing our own javascript to install the them

55:20 Showing we could have just stolen PHPSESSID, then we can use our browser to in

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →