HackTheBox - Soccer

Name: HackTheBox - Soccer
Uploaded: 2023-06-10T14:59:26Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap, assuming the web app is NodeJS based upon a 404 message 04:20 - Running Gobuster and discovering Tiny File M...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap, assuming the web app is NodeJS based upon a 404 message 04:20 - Running Gobuster and discovering Tiny File Manager 06:00 - Looking for the source code and finding a default password of admin@123 06:45 - Navigating to uploads and attempting to upload a php shell to the website 07:45 - Getting a reverse shell with our php shell 09:00 - Reverse shell returned 09:30 - Talking about hidepid=2 is set, so we can't see processes for other users 10:00 - Looking at nginx configuration to see what port 9091 is and discovering a new subdomain (soc-player.soccer.…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:00 Start of nmap, assuming the web app is NodeJS based upon a 404 message

4:20 Running Gobuster and discovering Tiny File Manager

6:00 Looking for the source code and finding a default password of admin@123

6:45 Navigating to uploads and attempting to upload a php shell to the website

7:45 Getting a reverse shell with our php shell

9:00 Reverse shell returned

9:30 Talking about hidepid=2 is set, so we can't see processes for other users

10:00 Looking at nginx configuration to see what port 9091 is and discovering a new

11:00 Navigating to soc-player.soccer.htb and discovering a few more pages

12:00 The /check endpoint looks like it is vulnerable to Boolean SQL Injection

13:00 Intercepting the websocket in BurpSuite and showing

15:20 Using SQLMap to dump the database, first time I've used SQLMap with websockets

23:30 Attempting to ssh with creds found in the database and logging in as player

26:50 Running LinPEAS

30:50 Looks like we can run doas, which is like sudo. Looking at the command we can

33:30 Creating a dstat plugin, then executing it with doas

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →