HackTheBox - Trick

Name: HackTheBox - Trick
Uploaded: 2022-10-29T15:20:29Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:30 - Poking at the DNS Server and discovering its hostname when querying itself 03:00 - Using dig to show ...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Introduction 01:00 - Start of nmap 02:30 - Poking at the DNS Server and discovering its hostname when querying itself 03:00 - Using dig to show the reverse lookup aswell, then perform a zone transfer with axfr 04:30 - Just showing dnsrecon to bruteforce a range of IP's, not really relavent to this but figured I'd show it 06:00 - Poking at the website and logging into the website 07:30 - Finding an LFI that allows us to disclose PHP Source code, can't do much else because it appends .php to our string 12:15 - Using SQLMap with the login to extract files 14:20 - SQLMap only found time in…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

1:00 Start of nmap

2:30 Poking at the DNS Server and discovering its hostname when querying itself

3:00 Using dig to show the reverse lookup aswell, then perform a zone transfer with

4:30 Just showing dnsrecon to bruteforce a range of IP's, not really relavent to th

6:00 Poking at the website and logging into the website

7:30 Finding an LFI that allows us to disclose PHP Source code, can't do much else

12:15 Using SQLMap with the login to extract files

14:20 SQLMap only found time injection, changing the levels and specifying the techn

16:45 Having SQLMap extract the nginx configuration and discovering another subdomai

19:10 Checking out the new domain preprod-marketing.trick.htb, discovering an LFI bu

21:30 Going over the source code of the LFI to show why this was vulnerable the ../

24:00 Using the LFI to discover the user we are running as, then extracting an SSH K

25:30 Showing another way to weaponize this LFI, poisoning the nginx access log

27:15 Showing yet another way to weaponize the LFI with sending email to the user, t

29:40 Shell on the box, checking Sudo then using find to see files owned by my user/

36:10 Editing iptables-multiport.conf to execute a file instead of banning a user an

37:30 Showing an alternate way to discover preprod-marketing, using a creative sub d

39:45 Checking out why we couldn't read the environ file, turns out it was owned by

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →