VulnHub - Pinkys Palace v2

Name: VulnHub - Pinkys Palace v2
Uploaded: 2018-04-11T10:14:08Z
Channel: IppSec
Description: https://www.vulnhub.com/entry/pinkys-palace-v2,229/ 00:47 - Start of Recon, get debian rev from apache header. 03:15 - Explanation of NMAP Filtered // T...

IppSec · Beginner ·🔐 Cybersecurity ·7y ago

https://www.vulnhub.com/entry/pinkys-palace-v2,229/ 00:47 - Start of Recon, get debian rev from apache header. 03:15 - Explanation of NMAP Filtered // TCPWrapped 06:45 - Enumerating Wordpress 09:58 - Finding /secret folder with Port Knock Ports 10:42 - Trying to take advantage of open wordpress installer (Rabbit Hole) 16:45 - Writing port knock script 34:10 - Finally successful port knock, lets see what ports are open 38:40 - Using Cewl to build a wordlist, then using Hydra to bruteforce HTTP Post Login 44:57 - Login, ignoring an SSH Key :( and instead playing with an LFI! 01:03:50 - Reverse …

Watch on YouTube ↗ (saves to browser)

Chapters (18)

0:47 Start of Recon, get debian rev from apache header.

3:15 Explanation of NMAP Filtered // TCPWrapped

6:45 Enumerating Wordpress

9:58 Finding /secret folder with Port Knock Ports

10:42 Trying to take advantage of open wordpress installer (Rabbit Hole)

16:45 Writing port knock script

34:10 Finally successful port knock, lets see what ports are open

38:40 Using Cewl to build a wordlist, then using Hydra to bruteforce HTTP Post Login

44:57 Login, ignoring an SSH Key :( and instead playing with an LFI!

1:03:50 Reverse Shell via LFI + Log Poisoning

1:07:50 Enough playing, lets crack SSH Key with John + sshng2john

1:13:35 Analyzing qsub binary with radare2

1:24:00 Finding the command injection in send function

1:26:14 Exploiting command injection to setup SetUID Binary (Stefano - Pinky)

1:29:29 Using SSH Keys to get proper session to pinky, then exploit cron script to get

1:36:49 Analyzing panel with Radare2

1:48:29 Enough of me learning, lets just take the easy route and use GDB+PEDA

1:56:39 Finishing up the exploit with some Shell Code

Playlist

Uploads from IppSec · IppSec · 48 of 60

← Previous Next →