HackTheBox - Unattended

IppSec · Intermediate ·📊 Data Analytics & Business Intelligence ·6y ago
01:00 - Begin of recon 03:30 - Running GoBuster to discover /dev and index.php 06:50 - Checking out the web application 07:55 - Discovering SQL Injection in ID and playing with it 11:45 - Running SQLMap to dump pieces of the database 14:55 - Nginx Misconfiguration, missing trailing slash 19:10 - Downloading source code of the application 21:20 - Exploring the source of the application 25:47 - Specifying an error string in SQLMap to have it do boolean logic versus time-based 27:00 - Installing a Docker LAMP Server to run the web application 45:40 - Finally got the application running locally (Missed a comma which created a lot more work) 46:15 - Analyzing the SQL Injection with Debug turned on to see how it works 50:00 - Explanation of gaining code execution through an LFI + PHP Cookies 53:00 - Exploring the cookie 55:40 - Have code execution on our docker, lets exploit the server 01:00:00 - Reverse Shell returned 01:02:35 - Exploring MySQL database and escalating to GULY 01:08:30 - Running LinEnum as Guly and going through the results 01:12:00 - Exploring files Guly can access due to Grub Group, downloading initrd 01:14:10 - Decompressing initrd.img and looking for the file GULY modified 01:21:20 - Running STRACE to see what uinitrd does 01:24:20 - Running uinitrd after modifying /etc/hosts and /boot/guid 01:26:20 - Extra Content: If you had trouble with TTY, SSH is accessible via IPv6 01:30:50 - Extra Content: Runing GIXY to analyze the NGINX Configuration 01:35:20 - Extra Content: Looking at uinitrd in Ghidra
Watch on YouTube ↗ (saves to browser)
Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →
1 HHC2016 - Analytics
HHC2016 - Analytics
IppSec
 2 HackTheBox - October
HackTheBox - October
IppSec
 3 HackTheBox - Arctic
HackTheBox - Arctic
IppSec
 4 HackTheBox - Brainfuck
HackTheBox - Brainfuck
IppSec
 5 HackTheBox - Bank
HackTheBox - Bank
IppSec
 6 HackTheBox - Joker
HackTheBox - Joker
IppSec
 7 HackTheBox - Lazy
HackTheBox - Lazy
IppSec
 8 Camp CTF 2015 - Bitterman
Camp CTF 2015 - Bitterman
IppSec
 9 HackTheBox - Devel
HackTheBox - Devel
IppSec
 10 Reversing Malicious Office Document (Macro) Emotet(?)
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
 11 HackTheBox - Granny and Grandpa
HackTheBox - Granny and Grandpa
IppSec
 12 HackTheBox - Pivoting Update: Granny and Grandpa
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
 13 HackTheBox - Optimum
HackTheBox - Optimum
IppSec
 14 HackTheBox - Charon
HackTheBox - Charon
IppSec
 15 HackTheBox - Sneaky
HackTheBox - Sneaky
IppSec
 16 HackTheBox - Holiday
HackTheBox - Holiday
IppSec
 17 HackTheBox - Europa
HackTheBox - Europa
IppSec
 18 Introduction to tmux
Introduction to tmux
IppSec
 19 HackTheBox - Blocky
HackTheBox - Blocky
IppSec
 20 HackTheBox - Nineveh
HackTheBox - Nineveh
IppSec
 21 HackTheBox - Jail
HackTheBox - Jail
IppSec
 22 HackTheBox - Blue
HackTheBox - Blue
IppSec
 23 HackTheBox - Calamity
HackTheBox - Calamity
IppSec
 24 HackTheBox - Shrek
HackTheBox - Shrek
IppSec
 25 HackTheBox - Mirai
HackTheBox - Mirai
IppSec
 26 HackTheBox - Shocker
HackTheBox - Shocker
IppSec
 27 HackTheBox - Mantis
HackTheBox - Mantis
IppSec
 28 HackTheBox - Node
HackTheBox - Node
IppSec
 29 HackTheBox - Kotarak
HackTheBox - Kotarak
IppSec
 30 HackTheBox - Enterprise
HackTheBox - Enterprise
IppSec
 31 HackTheBox - Sense
HackTheBox - Sense
IppSec
 32 HackTheBox - Minion
HackTheBox - Minion
IppSec
 33 VulnHub - Sokar
VulnHub - Sokar
IppSec
 34 VulnHub - Pinkys Palace v2
VulnHub - Pinkys Palace v2
IppSec
 35 HackTheBox - Inception
HackTheBox - Inception
IppSec
 36 Vulnhub - Trollcave 1.2
Vulnhub - Trollcave 1.2
IppSec
 37 HackTheBox - Ariekei
HackTheBox - Ariekei
IppSec
 38 HackTheBox - Flux Capacitor
HackTheBox - Flux Capacitor
IppSec
 39 HackTheBox - Jeeves
HackTheBox - Jeeves
IppSec
 40 HackTheBox - Tally
HackTheBox - Tally
IppSec
 41 HackTheBox - CrimeStoppers
HackTheBox - CrimeStoppers
IppSec
 42 HackTheBox - Fulcrum
HackTheBox - Fulcrum
IppSec
 43 HackTheBox - Chatterbox
HackTheBox - Chatterbox
IppSec
 44 HackTheBox - Falafel
HackTheBox - Falafel
IppSec
 45 How To Create Empire Modules
How To Create Empire Modules
IppSec
 46 HackTheBox - Nightmare
HackTheBox - Nightmare
IppSec
 47 HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
 48 HackTheBox - Bart
HackTheBox - Bart
IppSec
 49 HackTheBox - Aragog
HackTheBox - Aragog
IppSec
 50 HackTheBox - Valentine
HackTheBox - Valentine
IppSec
 51 HackTheBox - Silo
HackTheBox - Silo
IppSec
 52 HackTheBox - Rabbit
HackTheBox - Rabbit
IppSec
 53 HackTheBox - Celestial
HackTheBox - Celestial
IppSec
 54 HackTheBox - Stratosphere
HackTheBox - Stratosphere
IppSec
 55 HackTheBox - Poison
HackTheBox - Poison
IppSec
 56 HackTheBox - Canape
HackTheBox - Canape
IppSec
 57 HackTheBox - Olympus
HackTheBox - Olympus
IppSec
 58 HackTheBox - Sunday
HackTheBox - Sunday
IppSec
 59 HackTheBox - Fighter
HackTheBox - Fighter
IppSec
 60 HackTheBox - Bounty
HackTheBox - Bounty
IppSec

Related AI Lessons

⚡
Why Real-Time Analytics Eventually Changes Your Database Architecture
Real-time analytics can drastically change your database architecture, learn why and how to adapt
Dev.to · Mohamed Hussain S
 ⚡
Day 43: Hypothesis Testing & Statistical Analysis — Understanding How Data Makes Decisions
Learn hypothesis testing and statistical analysis to make data-driven decisions
Medium · AI
 ⚡
Day 43: Hypothesis Testing & Statistical Analysis — Understanding How Data Makes Decisions
Learn hypothesis testing and statistical analysis to make data-driven decisions
Medium · Machine Learning
 ⚡
I Spoke With 8 Interviewers. I Expected an Offer. They Asked for a 9th Round.
Learn how to navigate lengthy interview processes and improve your chances of landing a job in a competitive market
Medium · Data Science

Chapters (25)

1:00 Begin of recon
3:30 Running GoBuster to discover /dev and index.php
6:50 Checking out the web application
7:55 Discovering SQL Injection in ID and playing with it
11:45 Running SQLMap to dump pieces of the database
14:55 Nginx Misconfiguration, missing trailing slash
19:10 Downloading source code of the application
21:20 Exploring the source of the application
25:47 Specifying an error string in SQLMap to have it do boolean logic versus time-b
27:00 Installing a Docker LAMP Server to run the web application
45:40 Finally got the application running locally (Missed a comma which created a lo
46:15 Analyzing the SQL Injection with Debug turned on to see how it works
50:00 Explanation of gaining code execution through an LFI + PHP Cookies
53:00 Exploring the cookie
55:40 Have code execution on our docker, lets exploit the server
1:00:00 Reverse Shell returned
1:02:35 Exploring MySQL database and escalating to GULY
1:08:30 Running LinEnum as Guly and going through the results
1:12:00 Exploring files Guly can access due to Grub Group, downloading initrd
1:14:10 Decompressing initrd.img and looking for the file GULY modified
1:21:20 Running STRACE to see what uinitrd does
1:24:20 Running uinitrd after modifying /etc/hosts and /boot/guid
1:26:20 Extra Content: If you had trouble with TTY, SSH is accessible via IPv6
1:30:50 Extra Content: Runing GIXY to analyze the NGINX Configuration
1:35:20 Extra Content: Looking at uinitrd in Ghidra
Up next
Hedge Fund Performance and Risk Metrics
Coursera
Watch →