HackTheBox - UpDown

Name: HackTheBox - UpDown
Uploaded: 2023-01-21T15:00:41Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 01:30 - Testing the webhook, examining the request the server makes 05:30 - Trying other URL Wrappers to see how the...

IppSec · Beginner ·💻 AI-Assisted Coding ·3y ago

00:00 - Intro 01:00 - Start of nmap 01:30 - Testing the webhook, examining the request the server makes 05:30 - Trying other URL Wrappers to see how the application behaves 08:10 - Finding the .git sub directory, running git-dumper to extract source code 10:55 - Finding and explaining the LFI Vulnerability 12:10 - Attempting to use the php filter to extract source code, does not work, turns out there's another website 14:00 - Discovering there is a special header requried to access the DEV Website 16:00 - Configuring BurpSuite to add the header for us 18:15 - Explaining the LFI And why we are …

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:00 Start of nmap

1:30 Testing the webhook, examining the request the server makes

5:30 Trying other URL Wrappers to see how the application behaves

8:10 Finding the .git sub directory, running git-dumper to extract source code

10:55 Finding and explaining the LFI Vulnerability

12:10 Attempting to use the php filter to extract source code, does not work, turns

14:00 Discovering there is a special header requried to access the DEV Website

16:00 Configuring BurpSuite to add the header for us

18:15 Explaining the LFI And why we are going to use a phar file to get code executi

22:30 Attempting to get a shell, when executing our file we get a ERROR 500. Simplif

26:00 Examining phpinfo to see disabled functions, and discovering system() was bloc

27:00 Converting the dfunc-bypasser script to PHP, so we can just upload it to the s

29:15 Showing off github co-pilot, turns out it didn't exactly give me what I wanted

31:00 Uploading our script to check dangerous functions and identifying we can use t

32:00 Creating a script to send us a reverse shell, more github copilot finishing ou

35:20 Exploring the developer home directory, finding a setuid python binary that us

39:30 We can run easy_install with sudo, getting root

40:30 Explaining the Code Execution without dropping a file, by using gadgets with p

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →