UHC - Gobox

Name: UHC - Gobox
Uploaded: 2021-08-30T02:29:52Z
Channel: IppSec
Description: 00:00 - Intro, box is playable on HackTheBox! 01:09 - Start of nmap and enumerating the page on port 80 03:45 - Discovering Port 8080 07:00 - Using ffuf...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro, box is playable on HackTheBox! 01:09 - Start of nmap and enumerating the page on port 80 03:45 - Discovering Port 8080 07:00 - Using ffuf to fuzz and discover SSTI 09:50 - Showing wfuzz doesn't need nearly as many parameters 10:30 - Reading up on GoLang SSTI 11:40 - Using GoLang {{ . }} to dump all variables and get password 11:54 - Logging in to get the Source Code and finding the DebugCmd Function 13:00 - Showing RCE through the GoLang SSTI 16:00 - The Docker is an internal docker, showing a bunch of hints towards AWS 17:20 - Using the aws commands to list buckets and upload a…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Intro, box is playable on HackTheBox!

1:09 Start of nmap and enumerating the page on port 80

3:45 Discovering Port 8080

7:00 Using ffuf to fuzz and discover SSTI

9:50 Showing wfuzz doesn't need nearly as many parameters

10:30 Reading up on GoLang SSTI

11:40 Using GoLang {{ . }} to dump all variables and get password

11:54 Logging in to get the Source Code and finding the DebugCmd Function

13:00 Showing RCE through the GoLang SSTI

16:00 The Docker is an internal docker, showing a bunch of hints towards AWS

17:20 Using the aws commands to list buckets and upload a webshell via S3

21:30 Getting a reverse shell

25:00 Examining the NGINX Configuration -- LocalStack (used for s3) hack to enable a

26:26 The "Command on" flag is for port 8000 in nginx config, googling it to see its

28:28 The backdoor isn't working, running strings against the module to see system.r

29:40 Converting the RCE to a shell by uploading an SSH Key

33:40 Entering the golang container to show some more about the SSTI Configuration,

36:20 Opening the nginx module in Ghidra

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →