HackTheBox - Yummy

Name: HackTheBox - Yummy
Uploaded: 2025-02-22T15:01:17Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:55 - Playing around with the website, booking a table and then registering an account 08:40 - Taking a loo...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:00 - Start of nmap 03:55 - Playing around with the website, booking a table and then registering an account 08:40 - Taking a look at the Save to iCalendar functionality and finding a File Disclosure vulnerability 12:15 - Finding the application source code via the /proc/self/cwd directory 14:15 - The JWT does RSA manually, using a weak exponent, showing we can factor this with RsaCtfTool 18:40 - Showing JWT.IO doesn't work with weak RSA Keys, showing an alternative tool 26:10 - Looking at cron jobs, finding all of the source code 28:20 - The DBMonitor Cron looks like it…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

Introduction

1:00 Start of nmap

3:55 Playing around with the website, booking a table and then registering an accou

8:40 Taking a look at the Save to iCalendar functionality and finding a File Disclo

12:15 Finding the application source code via the /proc/self/cwd directory

14:15 The JWT does RSA manually, using a weak exponent, showing we can factor this w

18:40 Showing JWT.IO doesn't work with weak RSA Keys, showing an alternative tool

26:10 Looking at cron jobs, finding all of the source code

28:20 The DBMonitor Cron looks like it will execute code if we create specific files

33:50 Using INTO OUTFILE with our SQL Injection to write files and exploit the DBMON

41:30 Shell returned looking at the database, then exploiting another cron because w

45:20 Looking at the commit history of an Mercurial HG repo and finding a password

49:05 We can run HG PULL as dev, showing there are multiple places we can put a HGRC

57:05 We can run rsync as root, but the standard gtfobin doesn't work

1:00:00 Showing the chown flag doesn't remove setuid bits in RSYNC, which lets us make

1:03:00 BEYOND ROOT: Showing the changes to the box (secure_file_priv and AppArmor) th

1:08:49 Showing the CHOWN removes SetUID but Rsync does not when changing owners

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →