HackTheBox - WifineticTwo
00:00 - Intro
01:00 - Start of nmap
02:54 - Discovering OpenPLC, looking for default credentials and logging in with openplc:openplc
05:10 - Uploading a C reverse shell to OpenPLC
08:20 - Talking about our shell hanging our webserver, showing a POC that runs system() to background a process which seems to be smart
09:55 - Discovering a Wireless NIC, running IW to see wireless networks and OneShot to attack WPS
12:30 - Joining the Wireless Network, showing how important it is to tell DHCLIENT to not update default routes
16:55 - Cheating to get a root shell, so we can show the routing table of…
Watch on YouTube ↗
(saves to browser)
Chapters (14)
Intro
1:00
Start of nmap
2:54
Discovering OpenPLC, looking for default credentials and logging in with openp
5:10
Uploading a C reverse shell to OpenPLC
8:20
Talking about our shell hanging our webserver, showing a POC that runs system(
9:55
Discovering a Wireless NIC, running IW to see wireless networks and OneShot to
12:30
Joining the Wireless Network, showing how important it is to tell DHCLIENT to
16:55
Cheating to get a root shell, so we can show the routing table of the containe
19:20
Adding unset new_routers to a DHCLIENT Enter Hook so it doesn't update routes
21:10
Once we get on the Wireless Network we can SSH to OpenWRT and get the root fla
21:45
Showing we could exploit OpenWRT through the web interface aswell, setting up
23:20
Logging into OpenWRT with a blank password, going to the Scheduled Tasks to cr
27:10
Creating a Reverse Shell Payload with MSFVenom
29:20
Getting multiple reverse shells so we can easily run multiple commands on the
Playlist
Uploads from IppSec · IppSec · 0 of 60
← Previous
Next →
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
HHC2016 - Dungeon
IppSec
HHC2016 - Terminal Speedrun
IppSec
HHC2016 - Ads
IppSec
HHC2016 - Debug
IppSec
HHC2016 - Exception
IppSec
HHC2016 - Analytics
IppSec
HHC2016 - Getting Coins
IppSec
HackTheBox - Popcorn
IppSec
HackTheBox - October
IppSec
HackTheBox - Arctic
IppSec
HackTheBox - Tenten
IppSec
HackTheBox - CronOS
IppSec
HackTheBox - Brainfuck
IppSec
HackTheBox - Beep
IppSec
HackTheBox - Bastard
IppSec
HackTheBox - Bank
IppSec
HackTheBox - Joker
IppSec
HackTheBox - Haircut
IppSec
HackTheBox - Lazy
IppSec
Camp CTF 2015 - Bitterman
IppSec
HackTheBox - Devel
IppSec
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
HackTheBox - Granny and Grandpa
IppSec
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
HackTheBox - Optimum
IppSec
HackTheBox - Charon
IppSec
HackTheBox - Sneaky
IppSec
HackTheBox - Holiday
IppSec
HackTheBox - Apocalyst
IppSec
HackTheBox - Europa
IppSec
Introduction to tmux
IppSec
HackTheBox - Blocky
IppSec
HackTheBox - Nineveh
IppSec
HackTheBox - Jail
IppSec
HackTheBox - Blue
IppSec
HackTheBox - Calamity
IppSec
HackTheBox - SolidState
IppSec
HackTheBox - Shrek
IppSec
HackTheBox - Mirai
IppSec
HackTheBox - Shocker
IppSec
HackTheBox - Mantis
IppSec
HackTheBox - Node
IppSec
HackTheBox - Kotarak
IppSec
HackTheBox - Enterprise
IppSec
HackTheBox - Sense
IppSec
HackTheBox - Minion
IppSec
VulnHub - Sokar
IppSec
VulnHub - Pinkys Palace v2
IppSec
HackTheBox - Inception
IppSec
Vulnhub - Trollcave 1.2
IppSec
HackTheBox - Ariekei
IppSec
HackTheBox - Bashed
IppSec
HackTheBox - Flux Capacitor
IppSec
HackTheBox - Jeeves
IppSec
HackTheBox - Tally
IppSec
HackTheBox - CrimeStoppers
IppSec
HackTheBox - Fulcrum
IppSec
HackTheBox - Chatterbox
IppSec
HackTheBox - Falafel
IppSec
HackTheBox - Nibbles
IppSec
DeepCamp AI