HackTheBox - Socket

Name: HackTheBox - Socket
Uploaded: 2023-07-15T15:06:24Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 01:45 - Taking a look at QReader.htb 04:40 - Opening the QReader application to discover it requires GLIBC_2....

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap 01:45 - Taking a look at QReader.htb 04:40 - Opening the QReader application to discover it requires GLIBC_2.35, going back to nmap to see what flavor of linux was used 06:25 - Switching to Ubuntu Jammy and running Wireshark with the app running to see it makes a request to WS.QREADER.HTB 09:30 - Using BurpSuite to intercept this thick client by setting it up as a transparent proxy 12:00 - Playing with the websocket and discovering SQL Injection 14:40 - Using WebSocat and watch to build a quick client to test the SQL Injection over websockets and play…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:00 Start of nmap

1:45 Taking a look at QReader.htb

4:40 Opening the QReader application to discover it requires GLIBC_2.35, going back

6:25 Switching to Ubuntu Jammy and running Wireshark with the app running to see it

9:30 Using BurpSuite to intercept this thick client by setting it up as a transpare

12:00 Playing with the websocket and discovering SQL Injection

14:40 Using WebSocat and watch to build a quick client to test the SQL Injection ove

16:00 Identifying what database is used, using SQLITE_VERSION() and seeing it is SQL

20:30 Dumping the Users table

24:10 Dumping the other tables, getting the name of the admin in the answers table

28:20 Using username-anarchy to generate a bunch of potential usernames, then using

29:30 Logging into the webserver, looking at the webserver code and not really findi

32:00 Looking at sudo rules to see I can run build-installer.sh, which is a wrapper

34:50 Looking at the PyInstaller spec file, to show we can include files in the exec

35:30 Including files owned by root such as ssh key, shadow and flag in the specfile

39:30 Using Pyinstxtractor to extract the pysinstaller exe and downloading our files

40:47 Beyond Root: Decompiling the QReader Application with pycdc (Decompyle++)

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →