HackTheBox - Undetected

Name: HackTheBox - Undetected
Uploaded: 2022-07-02T18:05:03Z
Channel: IppSec
Description: 00:00 - Intro 00:54 - Start of nmap 02:00 - Taking a look at the website 10:00 - Running gobuster against store.djewelry.htb and discovering a vendor di...

IppSec · Beginner ·🔐 Cybersecurity ·3y ago

00:00 - Intro 00:54 - Start of nmap 02:00 - Taking a look at the website 10:00 - Running gobuster against store.djewelry.htb and discovering a vendor directory that has phpunit 11:45- Exploiting phpunit to get a shell on the box 15:15 - Shell recieved on the box as www-data 17:20 - Looking for files owned by www-data on the box by using find to discover /var/backups/info 19:30 - Running strings against the /var/backups/info file and discovering a hex string that is a shell script. Using CyberChef to decode it and gain access to steven 25:00 - ssh in as steven, talking about the duplicate users…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Intro

0:54 Start of nmap

2:00 Taking a look at the website

10:00 Running gobuster against store.djewelry.htb and discovering a vendor directory

15:15 Shell recieved on the box as www-data

17:20 Looking for files owned by www-data on the box by using find to discover /var/

19:30 Running strings against the /var/backups/info file and discovering a hex strin

25:00 ssh in as steven, talking about the duplicate users as steven and steven1 have

27:00 Talking about timestamps, my favorite way to find tools left behind by hackers

28:15 Using find -type f -printf "%T %p\n"to show the full time stamp for files

30:45 Using find to find files that were created 00:00:00, which is an indication of

33:40 Running the backdoored binary in Ghidra and discovering a backdoor in the logi

36:15 Extracting the backdoor password and using CyberChef to decode it

41:50 We skipped a step, finding and examining a backdoored apache module

43:50 The easy way of doing strings and decoding the bsae64 to discover what the bac

45:15 Having trouble analyzing this with Ghidra

48:00 Switching to Cutter which handles this binary better

51:40 Going back to Ghidra and seeing what we missed

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →