HackTheBox - Snoopy

Name: HackTheBox - Snoopy
Uploaded: 2023-09-23T15:09:24Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap, discovering ssh/dns/http 02:30 - Taking a look at the website 04:00 - Discovering a message about DNS, takin...

IppSec · Beginner ·📰 AI News & Updates ·2y ago

00:00 - Introduction 01:00 - Start of nmap, discovering ssh/dns/http 02:30 - Taking a look at the website 04:00 - Discovering a message about DNS, taking a look at the DNS and discovering zone transfers are enabled 09:40 - Identifying the website is running with PHP Enabled, then running gobuster 13:00 - Attacking the file download and discovering File Disclosure 15:35 - We got lucky discovering the File Disclosure filter bypass, using FFUF which would be make catching this more consistent 19:30 - Automating the File Disclosure by creating a python script 24:30 - Looking at files on the target…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:00 Start of nmap, discovering ssh/dns/http

2:30 Taking a look at the website

4:00 Discovering a message about DNS, taking a look at the DNS and discovering zone

9:40 Identifying the website is running with PHP Enabled, then running gobuster

13:00 Attacking the file download and discovering File Disclosure

15:35 We got lucky discovering the File Disclosure filter bypass, using FFUF which w

19:30 Automating the File Disclosure by creating a python script

24:30 Looking at files on the target, discovering the DNS Configuration which has th

30:40 Looking at the NSUPDATE Man page and then adding a the DNS Record mail.snoopy.

34:24 Using python to run a SMTP Server and then having Mattermost's forgot password

39:50 Using the Mattermost bot to provision a server via SSH which causes it to SSH

42:30 Backdooring PAM with pam_exec and a bash script to log passwords of users logg

50:40 cbrown can run Git apply as sbrown, looking for exploits around it and discove

1:08:50 sbrown can run clamscan in debug mode as root

1:11:45 Looking at CVE's in clamav and discovering an XXE in the DMG Parser (CVE-2023-

1:23:30 Downloading a DMG File (sublime), then modifying the XML to put an XXE in, sca

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HackTheBox - Snoopy

Chapters (17)

Playlist

Lesson complete!