HackTheBox - Skyfall

Name: HackTheBox - Skyfall
Uploaded: 2024-08-31T15:00:52Z
Channel: IppSec
Description: 00:00 - Introduction 01:11 - Start of nmap 03:00 - Discovering the demo subdomain, which is a Flask website 04:00 - Quickly playing with the File Downlo...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:11 - Start of nmap 03:00 - Discovering the demo subdomain, which is a Flask website 04:00 - Quickly playing with the File Download, Upload, and Rename -- Looking for low hanging fruit, not finding any 07:00 - Playing with the URL Fetch looking for a good SSRF, Discovering the site is likely in Docker 09:00 - Running FFUF with our SSRF to identify ports listening on the Host and Docker 11:30 - Talking about the two different 403's and why its important that one is coming from Flask and the other NGINX 15:00 - Talking about a URL Parsing bug between NGINX and PYTHON/WERKZ…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:11 Start of nmap

3:00 Discovering the demo subdomain, which is a Flask website

4:00 Quickly playing with the File Download, Upload, and Rename -- Looking for low

7:00 Playing with the URL Fetch looking for a good SSRF, Discovering the site is li

9:00 Running FFUF with our SSRF to identify ports listening on the Host and Docker

11:30 Talking about the two different 403's and why its important that one is coming

15:00 Talking about a URL Parsing bug between NGINX and PYTHON/WERKZEUG where strip

18:36 Viewing the Metrics Page and getting information about MinIO Discovering it is

23:00 Downloading the MinIO Client, then interacting with the filesystem manually

26:40 Searching all fileversions on MinIO then finding an older copy of .bashrc whic

34:40 Downloading and running the Hashicorp Vault Binary to interact with the servic

37:20 Showing how to identify all of our privileges, then creating an OTP for SSH an

40:00 Showing how this Vault Binary works by proxying the traffic

41:20 Showing another way to do this step, by manually enumerating the API which exp

53:22 Shell as askyy returned, discovering we can run vault-unseal with a few flags

57:30 Using libfuse to create a virtual mount on a directory we control, using memfs

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →