Today we root "BountyHunter " 🤑, an "Easy" machine from HackTheBox! - Like and Subscribe :)

⏱️Timestamps/Steps:
➡️ 00:00 - Intro
➡️ 00:10 - Recon explanation (rustscan/nmap)
➡️ 01:25 - Web server enumeration(gobuster,whatweb)
➡️ 02:40 - Review of adding a host entry to /etc/hosts
➡️ 03:40 - Review of the web app
➡️ 04:10 - Explanation of the usage of burpsuite
➡️ 05:00 - Using dev tools to review web app functionality
➡️ 05:50 - Observing data sent as base64
➡️ 06:20 - Decoding data sent(base64) to plaintext, seeing our input is sent as base64 encoded XML
➡️ 07:20 - Using burpsuite decoder to decode, and manipulate XML input
➡️ 08:30 - Explanation of why our input didnt work - we need to URL encode!
➡️ 09:20 - Explanation of XXE(XML extenal entity injection)
- see my video on creating and exploting it! - [ Ссылка ]
➡️ 11:00 - Abusing XML upload to upload XXE vulnerability.
➡️ 11:50 - XXE works, we can read local system files
➡️ 13:25 - Creating a python script to automate the exploitation of XXE
➡️ 20:20 - Extracting base64 payload using regex
➡️ 26:00 - Extracting system files using python script, getting creds from db.php
➡️ 28:00 - Logging into SSH as "development" via stolen credentials
➡️ 28:20 - Review of sudo to priv esc
➡️ 29:25 - what is sudo?
➡️ 29:40 - Sudo -l points us to python script we can run as root
➡️ 29:50 - Review of python script to find vulnerabilties to escalate to root
➡️ 33:40 - Using vscode python debug to step through the code line by line to get to the vuln code
➡️ 48:40 - Evaluation of python eval func to get code execution
- I did a video including this attack with a similar example - [ Ссылка ]
➡️ 49:50 - Extracting required code to replicate script functionality, and creating a python script to fuzz it
➡️ 53:00 - fuzzing eval code based on errors
➡️ 55:00 - Importing subprocess module using pythons interpreter - __import__('subprocess')
➡️ 56:45 - Using our payload in the local code to confirm it works
➡️ 58:30 - Creating an exploit to create a root bash shell to give us root locally
➡️ 59:30 - Showing we need to add "-p" to rootbash to make our effective UID as root(0)
➡️ 1:01:00 - Getting a root local shell on the bountyhunter.htb!
➡️ 1:03:00 - *trying* to find docs to explain why -p fixed it... failing kinda
➡️ 1:04:50 - Getting a root reverse shell on bountyhunter.htb!
➡️ 1:06:00 - Outro / please subscribe etc. etc. donate to my onIyfans etc.

⭐️Link to box:
🔗[ Ссылка ]

For more Cyber security/hacking based content, check out the rest of my channel - covering SQL injection, server side template injection, remote code execution/injection(rce), linux/windows privilege escalation, wireshark, CVE's, hackthebox, scripting - web application security testing automation etc. :)

свернуть