HackTheBox - Seal

Name: HackTheBox - Seal
Uploaded: 2021-11-13T15:01:53Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Begin of nmap 03:25 - Browsing to the website and doing some light fuzzing 06:10 - Adding the uri_hex (url encoder) to our wfuzz ...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro 01:00 - Begin of nmap 03:25 - Browsing to the website and doing some light fuzzing 06:10 - Adding the uri_hex (url encoder) to our wfuzz to fuzz special characters 07:55 - Taking a look at port 8080, discovering gitbucket and registering an account 09:20 - Exploring the infra repository on gitbucket, going over its Ansible Scripts 12:30 - Taking a look at the Seal Market Repository and discovering NGINX has mutal auth configured 14:00 - Discovering tomcat credentials in a previous commit 15:45 - Going over an Orange Tsai SSRF Talk from 2018, showing the Tomcat SSRF when behind N…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Intro

1:00 Begin of nmap

3:25 Browsing to the website and doing some light fuzzing

6:10 Adding the uri_hex (url encoder) to our wfuzz to fuzz special characters

7:55 Taking a look at port 8080, discovering gitbucket and registering an account

9:20 Exploring the infra repository on gitbucket, going over its Ansible Scripts

12:30 Taking a look at the Seal Market Repository and discovering NGINX has mutal au

14:00 Discovering tomcat credentials in a previous commit

15:45 Going over an Orange Tsai SSRF Talk from 2018, showing the Tomcat SSRF when be

17:00 Testing the SSRF Exploit to discover we can hit protected pages

18:00 Logging into tomcat, then showing another SSRF

19:25 Using MSFVenom to generate a malicious war file to exploit tomcat

21:00 Reverse shell returned, uploading pspy to discover a cron running a playbook

23:00 Going over the playbook to show how we can exploit this playbook to copy an ss

26:00 Creating the symlink to extract the SSH Key

28:30 SSH in with Luis, discovering we can run ansible with sudo, then creating a ma

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →