HackTheBox - Writeup

Name: HackTheBox - Writeup
Uploaded: 2019-10-12T15:44:07Z
Channel: IppSec
Description: 01:04 - Start of recon identifying a debian box based upon banners 02:30 - Taking a look at the website, has warnings about DOS type attacks. 03:17 - Di...

IppSec · Beginner ·🔐 Cybersecurity ·6y ago

01:04 - Start of recon identifying a debian box based upon banners 02:30 - Taking a look at the website, has warnings about DOS type attacks. 03:17 - Discovering the /writeup/ directory in robots.txt 04:18 - Checking the HTML Source to see if there's any information about what generated this page. Discover CMS Made Simple 05:15 - CMS Made Simple is an opensource product. Search through the source code to discover a way to identify version information. 07:30 - Using SearchSploit to find an exploit 09:05 - Running the exploit script with a bad URL and triggering the servers anti-DOS protection …

Watch on YouTube ↗ (saves to browser)

Chapters (17)

1:04 Start of recon identifying a debian box based upon banners

2:30 Taking a look at the website, has warnings about DOS type attacks.

3:17 Discovering the /writeup/ directory in robots.txt

4:18 Checking the HTML Source to see if there's any information about what generate

5:15 CMS Made Simple is an opensource product. Search through the source code to di

7:30 Using SearchSploit to find an exploit

9:05 Running the exploit script with a bad URL and triggering the servers anti-DOS

10:10 Running the exploit script with correct URL and analyze the HTTP Requests it m

16:20 Explaining how password salts work

19:00 Using Hashcat to crack a salted md5sum

21:15 Demonstrating the --username flag in hashcat, this allows you to associate cra

24:14 Begin of low-priv shell, running LinEnum to discover we are a member of staff

27:58 Using google to see what the Staff group can do (edit /usr/local/bin)

28:40 Explaining path injection

29:40 Using PSPY to display all the processes that start on linux, useful for findin

31:58 Running PSPY to see run-parts is called without an absolute path upon user log

33:13 Performing the relative path injection by creating the file /usr/local/bin/run

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →