HackTheBox - Zipper

Name: HackTheBox - Zipper
Uploaded: 2019-02-23T15:00:04Z
Channel: IppSec
Description: 01:15 - Start of NMAP 04:10 - Signing into Zabbix as Guest 05:30 - Getting potential usernames from inside Zabbix and guessing creds 06:30 - Running Sea...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·7y ago

01:15 - Start of NMAP 04:10 - Signing into Zabbix as Guest 05:30 - Getting potential usernames from inside Zabbix and guessing creds 06:30 - Running Searchsploit and looking for vulnerabilties 07:20 - Analyzing the "API" Script from SearchSploit as we have API Creds 10:15 - Modifying the "API" Script 11:15 - Showing a shortcut to skip the Container to Host Lateral Movement. 15:35 - Shell on the Container. 17:25 - Searching for Zabbix MySQL Password 18:35 - Dumping the Zabbix User Database 20:00 - Logging into Zabbix as Admin, discover ZBX Agent on Host. Testing if port is accessible 23:30 -…

Watch on YouTube ↗ (saves to browser)

Chapters (26)

1:15 Start of NMAP

4:10 Signing into Zabbix as Guest

5:30 Getting potential usernames from inside Zabbix and guessing creds

6:30 Running Searchsploit and looking for vulnerabilties

7:20 Analyzing the "API" Script from SearchSploit as we have API Creds

10:15 Modifying the "API" Script

11:15 Showing a shortcut to skip the Container to Host Lateral Movement.

15:35 Shell on the Container.

17:25 Searching for Zabbix MySQL Password

18:35 Dumping the Zabbix User Database

20:00 Logging into Zabbix as Admin, discover ZBX Agent on Host. Testing if port is

23:30 Running commands on the Zabbix Agent (Host OS) from Zabbix Server (Guest OS)

29:53 Getting a Reverse Shell on Zabbix (use nohup to fork)

32:40 Running LinEnum on Zabbix Host

35:15 Examining home directories to find Zapper Creds

36:42 Examining the "Zabbix-Service" SetUID

39:00 PRIVESC #1: Running ltrace to discover it is vulnerable to $PATH Manipulation

42:00 PRIVESC #2: Weak permissions on Purge-Backups Service

48:30 Extra Content: Building a Zabbix API Client from Scratch!

48:55 "Pseudo Terminal" Skeleton Script via Cmd module

50:00 Adding Login Functionality

56:08 Making the script login upon starting

57:50 Adding functionality to dump users

1:04:00 Adding functionality to dump groups

1:05:25 Adding functionality to add users

1:10:45 Adding functionality to modify users

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →