HackTheBox - Swagshop

Name: HackTheBox - Swagshop
Uploaded: 2019-09-28T15:00:06Z
Channel: IppSec
Description: 00:45 - Begin of recon 01:36 - Examining the web page to find Magento, noticing /index.php/ mod-rewrite misconfig and old copyright 04:50 - Whoops shoul...

IppSec · Intermediate ·🤖 AI Agents & Automation ·6y ago

00:45 - Begin of recon 01:36 - Examining the web page to find Magento, noticing /index.php/ mod-rewrite misconfig and old copyright 04:50 - Whoops should of done apt search magescan, either way this package is not in Kali 05:30 - Running MageScan to scan the website 08:20 - Finding an open configuration file (app/etc/local.xml) 10:30 - Running searchsploit to identify public exploits 12:10 - Examining an exploit that will add an administrative user via SQL Injection 15:15 - Running the exploit out of the box didn't work, send it through burp in order to debug it 16:45 - Exploit needed to be mo…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

0:45 Begin of recon

1:36 Examining the web page to find Magento, noticing /index.php/ mod-rewrite misco

4:50 Whoops should of done apt search magescan, either way this package is not in K

5:30 Running MageScan to scan the website

8:20 Finding an open configuration file (app/etc/local.xml)

10:30 Running searchsploit to identify public exploits

12:10 Examining an exploit that will add an administrative user via SQL Injection

15:15 Running the exploit out of the box didn't work, send it through burp in order

16:45 Exploit needed to be modified to include index.php due to mod-rewrite misconfi

19:25 Going back to SearchSploit and using the Authenticated RCE Exploit

21:30 Making the obvious changes to fix the exploit script

24:17 Debugging the exploit by running it through burpsuite, find out we need to use

29:00 Bit more in-depth debugging by setting a breakpoint with pdb

30:30 The regex is failing due to page not returning anything, the URL has a time sp

33:15 Finally fixed this exploit! Reverse Shell Returned

35:30 Noticing we can exec vim with sudo, lets privesc

37:10 Mentioning GTFOBins which helps find privesc paths from privileged programs

38:15 EXTRA: Examining the PHP Object Injection RCE Exploit

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →