HackTheBox - Topology

Name: HackTheBox - Topology
Uploaded: 2023-11-04T15:00:22Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:30 - Discovering Discovering the LaTeX Equation Generator Page 04:10 - Attempting to get code execution, d...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:00 - Start of nmap 02:30 - Discovering Discovering the LaTeX Equation Generator Page 04:10 - Attempting to get code execution, discovering a WAF. Building a wordlist and using FFUF to identify potentially dangerous commands that aren't blocked 07:45 - Discovering lstinputlisting is not blocked, which will let us read files 10:45 - Using FFUF to bruteforce subdomains, show the automatic calibration, so you don't need to manually specify filters 13:25 - Looking for the Apache Config for the Dev subdomain, as it likely has a htpasswd file we can get a password from 15:25 -…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

1:00 Start of nmap

2:30 Discovering Discovering the LaTeX Equation Generator Page

4:10 Attempting to get code execution, discovering a WAF. Building a wordlist and u

7:45 Discovering lstinputlisting is not blocked, which will let us read files

10:45 Using FFUF to bruteforce subdomains, show the automatic calibration, so you do

13:25 Looking for the Apache Config for the Dev subdomain, as it likely has a htpass

15:25 Showing the alternate path to get RCE, Bypassing the filter by encoding charac

18:50 Talking about the catcode command and a failed path at evading a filter with t

21:40 Looking at the wikibooks latex page and seeing ^ is superscript by default, so

22:20 Testing the bypass with a valid command to make sure it works

24:00 Writing a file

27:35 I failed at typing my PHP Shell, standing up my own PHP Server so I can see th

29:30 PHP Script is written, getting a reverse shell grabbing the htpasswd and krack

33:30 Copying LinPeas and disabling FAST mode, so it looks for unique processes

36:30 Discovering a cron that is running GNUPLOT

37:50 Looking at GNUPLOT commands and discovering it has a SYSTEM Command

42:00 We aren't getting a reverse shell, running the command ourself to see STDERR a

43:00 Root shell returned, just playing with GNUPLOT to show we can write to a file

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →