![IppSec](/img/default-banner.jpg)
- 439
- 12 697 342
IppSec
Registrace 21. 12. 2016
Video Search: ippsec.rocks
HackTheBox - FormulaX
00:00 - Introduction
01:00 - Start of nmap
04:30 - Examining the Change Password functionality
06:20 - Discovering XSS In the Contact Form
11:15 - Building an XSS Cradle that manipulates the DOM to load an external JS file
18:35 - Creating an XSS that will send interact with the webchat and exfil messages back to us
26:30 - Discovering a new subdomain from the Online Chat
30:15 - Showing why we could not use Script SRC with our XSS Attack and why we used the DOM Technique
37:34 - Looking at the Git Auto Report Generating and discovering it uses simple-git v3.14 which has an RCE Vulnerability
44:40 - Shell on the box, dumping the mongo database
52:00 - Shell as Frank_Dorky
52:30 - Looking at the services running on the box to enumerate what each port is
55:30 - Showing bad permissions on the LibreNMS Directory which allows us to read and execute files in /opt/librenms
59:30 - Using the Templates in LibreNMS to get code execution
01:04:00 - Showing the intended way to exploit LibreNMS which is using a malicious SNMP Trap to attack an admin via XSS
1:17:30 - Exploiting the OpenOffice network port
01:00 - Start of nmap
04:30 - Examining the Change Password functionality
06:20 - Discovering XSS In the Contact Form
11:15 - Building an XSS Cradle that manipulates the DOM to load an external JS file
18:35 - Creating an XSS that will send interact with the webchat and exfil messages back to us
26:30 - Discovering a new subdomain from the Online Chat
30:15 - Showing why we could not use Script SRC with our XSS Attack and why we used the DOM Technique
37:34 - Looking at the Git Auto Report Generating and discovering it uses simple-git v3.14 which has an RCE Vulnerability
44:40 - Shell on the box, dumping the mongo database
52:00 - Shell as Frank_Dorky
52:30 - Looking at the services running on the box to enumerate what each port is
55:30 - Showing bad permissions on the LibreNMS Directory which allows us to read and execute files in /opt/librenms
59:30 - Using the Templates in LibreNMS to get code execution
01:04:00 - Showing the intended way to exploit LibreNMS which is using a malicious SNMP Trap to attack an admin via XSS
1:17:30 - Exploiting the OpenOffice network port
zhlédnutí: 4 434
Video
HackTheBox - Usage
zhlédnutí 9KPřed dnem
00:00 - Introduction 00:50 - Start of nmap 02:00 - Discovering the page is Laravel based upon cookies 05:30 - Discovering the SQL Injection in Reset Password, then running SQLMap screwing up our results because we logged out in middle of SQLMap 18:50 - Cracking the user out of admin_users 20:00 - Logging into admin.usage.htb and discovering a vulnerable Laravel Admin, which is vulnerable to PHP...
HackTheBox - iClean
zhlédnutí 9KPřed 14 dny
00:00 - Introduction 01:00 - Start of nmap 02:00 - Taking a look at the website 04:00 - Testing the Get a Quote feature for XSS 06:30 - Weaponizing the img src xss test by adding fetch to attempt to exfil the cookies 10:00 - Looking at the dashboard and seeing what features are available 13:00 - Discovering SSTI in the QR Code Feature, can do basic SSTI but any complex fails without any evasion...
HackTheBox - WifineticTwo
zhlédnutí 8KPřed 21 dnem
00:00 - Intro 01:00 - Start of nmap 02:54 - Discovering OpenPLC, looking for default credentials and logging in with openplc:openplc 05:10 - Uploading a C reverse shell to OpenPLC 08:20 - Talking about our shell hanging our webserver, showing a POC that runs system() to background a process which seems to be smart 09:55 - Discovering a Wireless NIC, running IW to see wireless networks and OneSh...
HackTheBox - Headless
zhlédnutí 12KPřed 28 dny
00:00 - Introduction 01:00 - Start of nmap 01:50 - Examining the cookie, measuring entropy with ent 04:30 - Testing the Contact Support form, putting HTML in the message triggers Hacking Attempt Detected 06:00 - Examining the /dashboard, playing with the cookie to see if we can view it 07:20 - Testing the Hacking Attempt Detected message for XSS 11:00 - Creating an XSS Payload to steal the cook...
HackTheBox - Corporate (FIXED)
zhlédnutí 9KPřed měsícem
Sorry for the double upload. The last 45 seconds were missing from the first video. 00:00 - Introduction 01:00 - Start of nmap 02:45 - Playing with the Agent Chat, discovering we can send HTML then testing for XSS then seeing CSP (Content Security Policy) Stops us 06:20 - Testing for the ability to perform redirection via HTML via meta refresh 09:20 - Discovering the 404 error page has reflecti...
HackTheBox - Perfection
zhlédnutí 14KPřed měsícem
00:00 - Introduction 00:50 - Start of nmap 02:50 - Discovering the Weighted Grade Calculator which we will exploit 04:50 - Using FFUF to enumerate all bad characters and discovering we can't send any symbols 07:10 - Quick bash one liner with JQ to URL Encode each line of our wordlist 09:30 - Discovering a New Line character breaks the search for Bad Characters, then getting a shell on the box 1...
HackTheBox - Jab
zhlédnutí 10KPřed měsícem
00:00 - Introduction 01:00 - Start of nmap 04:25 - Opening Pidgin to register with the Jabber Server then look at chatrooms 10:15 - Opening the XMPP Console so we can copy users to build the username list 11:50 - Running Kerbrute against the users to get a few ASREP Roast Hashes 15:45 - Having issues cracking the hash, need to specify downgrade on kerbrute 19:30 - Running bloodhound with jmontg...
HackTheBox - Office
zhlédnutí 12KPřed měsícem
00:00 - Introduction 01:00 - Start of nmap 02:00 - Testing the XAMPP PHP Vulnerability, which doesn't work 06:20 - Getting the Joomla Version from the manifest, then exploiting CVE-2023-23752 to get the MySQL Password (same as devvortex) 11:30 - Using KerBrute to bruteforce valid usernames and then NetExec to spray the MySQL Password to get DWOLFE's password 16:40 - Examining the PCAP on the Fi...
HackTheBox - Crafty
zhlédnutí 12KPřed 2 měsíci
00:00 - Introduction 01:00 - Start of nmap 02:55 - Doing a full nmap scan, then scanning the minecraft ports with scripts to discover minecraft version 04:45 - Discovering this minecraft version is vulnerable to Log4j 06:50 - Extracting Java Version/Class Path/etc via Log4j 10:40 - Using the Log4j Shell POC to get a shell, this reflectively loads a Java Library 13:50 - Getting a reverse shell 1...
HackTheBox - POV
zhlédnutí 10KPřed 2 měsíci
00:00 - Introduction 01:00 - Start of nmap 02:45 - Discovering the Dev Subdomain 04:00 - Playing with the Resume Download, discovering a File Disclosure Vulnerability 05:40 - Discovering some odd behavior with ../, its just a replace. Grabbing web.config 08:15 - Using YsoSerial.Net to create a malicious ViewState Gadget, be careful with command prompt and single quotes! 12:00 - Getting a revers...
Using PAM EXEC to Log Passwords on Linux
zhlédnutí 9KPřed 2 měsíci
Video will be public June 2nd 00:00 - Introduction 01:04 - Talking about what PAM is 05:00 - Talking about pam_exec 08:15 - Creating a bash script pam_exec calls to log passwords 12:20 - Creating a GoLang binary that replicates our Bash Script to log passwords 16:00 - First iteration almost done, dumping all passwords 18:38 - Explaining how we will add if the authentication was successful in ou...
HackTheBox - Analysis
zhlédnutí 9KPřed 2 měsíci
00:00 - Introduction 01:05 - Start of nmap 05:00 - Discovering the internal.analysis.htb subdomain 07:55 - Talking about why I want to run FeroxBuster here and showing the menu so we can stop crawling non-interesting directories (ex: js, css, img) 13:30 - Discovering list.php in users and fuzzing parameters 16:40 - Start of program to bruteforce usernames 21:55 - Got the first character of ever...
HackTheBox - Bizness
zhlédnutí 14KPřed 2 měsíci
00:00 - Introduction 01:00 - Start of nmap 03:00 - Seeing JSESSIONID and NGINX trying the off by slash exploit to get access to /manager, doesn't work here 04:30 - Dirbusting with FFUF because the lack of 404's messed with gobuster 07:40 - Discovering the OfBiz Version, looking for exploits 09:00 - Going over the Authentication Bypass in OfBiz 12:40 - Downloading YSOSERIAL and building a Docker...
HackTheBox - Ouija
zhlédnutí 14KPřed 3 měsíci
00:00 - Introduction 01:00 - Start of nmap 03:15 - Fuzzing the API port port 3000 with ffuf 09:00 - Discovering the Gitea Domain and seeing a repo which discloses HA Proxy 2.2.16 is in use 11:50 - Exploring CVE-2021-40346 an integer overflow in HA Proxy which enables HTTP Smuggling 18:00 - Putting a 3rd request in to make the HTTP Smuggle reliable and grabbing the source code to app.js 28:45 - ...
I was able... with a little (lot of) help from chatGPT (paid) to follow you all the way to root.txt BUT... esp toward the end there from Ghidra forward... it became obvious that you understand a BUNCH of reasoning behind all of those pivots that I do not. Will have to spend lots of time going through all this piecemeal in order to get a clue. Thanks as always for so much inslight. I've been trying to see if I can conquer these boxes with just the writeups first... then if (when) I faiil... go through step by step with you. All in All its a lot of fun and great for staving off dementia... LOL!
How to test different custom http request response headers for BSQLI XSS LFI RFI RCE ? Thanks
I need part 2. Great video
Completed this box today with help from the video. For some reason, the PHP web shell worked initially, got deleted by the script, and then stopped working entirely when trying to reupload (very odd). Used the php-reverse-shell script in the end and it worked consistently. Haven't owned a box for a year it shows. Fumbled over everything from upgrading the shell to dropping an SSH key into dash's authorized keys. It's crazy how quickly skills/knowledge can fade when not using them frequently. Thanks for the video, it helped loads.
what's going on ipp!
yep. wonder wtheck is wrong with my escape character business..
so... i'm doing the port forward in my initial ssh command... we'll see how this goes... lol
I went and uncommented "EscapeChar ~" in my ssh_config file, and restarted the ssh session... however doing the ~C sequence simply leads to a message "commandline disabled"...
O.k. at 21:16 i have no idea what you did there... "if squiggly C is the first line on your ssh prompt"??? HUH? how did even get an ssh prompt there?
How to console use ‘ssh>’ ? What command this..?
~ C something like that
@@NicolastheThird-h6m $~C command like that? I didnt work that;; Ctrl C (^c) is exit….
How do you do url-encode on burp?
select -> right click -> encode OR select -> CTRL+U
@@trueperson-o2z Ty
Instant like
Push!
I never could get the SNMP path working. Should have occurred to me that I could have run the script from the host, rather than my machine :)
Consistently awesome. ❤
I've exploited ApacheUNO before, it only takes one additional argument, but you can give it an awk reverse shell one-liner to avoid creating an executable file on the box.
awesome solution. adding that to my post, with credit to you
Great catch. Wish I had thought of using awk.
babe wake up new ippsec video
90% percent of us cannot say that
@@Overlord176 put some anime girls on your kali installation it's what i did
e@@formsight5927 but i use blackarch 😭
Ipp sold me Fentanyl behind Blockbuster for 223 V-Bucks
🔥🥰
cool
nice
🎉
❤
Can you do a video about that hashcat box How i cam build my own???
escape and arrow keys give me characters like ^[^[OB^[OD^[OC^[OA^[OD when i'm trying to vi Kernel.php. Can someone help me out? I've looked all over the internet but they all involve installing/editing files which we cant do when hacking boxes
🤣 love how I do the first 10 parts of teir 0 on the starting point, then it directs me to machines to try, and I'm like sure why not, oh hey a very easy one......I watched 10seconds of your video and I'm lost instantly.....very easy my a** 😂 great video though
I really, really love that you don't edit out your mistakes! I sometimes feel so unbelievable stupid when such things happen to me, but it really helps me to see that even people with much more skill still sometimes mess up! I messed things up on this box (but at least i learned :D): I did not properly use sqlmap, so the whole token/cookie thing did not work, therefore I have written my own python blind sql injection script from scratch. While at it, I learned about python thread polls to pwn in parallel \o/ After extracting the admin hash, john failed to crack it and very much later I learned about mysql equals (or like) not beeing case sensitive and my script therefore extracting the hash with mixed case... So much pain, but a lot to learn even just extracting and cracking the password! Thanks hackthebox for providing those machines!
Push!
Push!
as always awesome !
Does anyone got this error from sql map after saving request into a file and use that is "unable to find http header" anyone?
I did the exactly same thing that ipp do but i got this idk why is ipp's http header and mine is also same nothing more in there then why is that anyone have this same problem?
Push!
Nice one
Hey thank you for your guide. But in the Part of 44:17 i get this message after command: user@Backdoor:/home/user$ screen -r root screen -r root Must be connected to a terminal. user@Backdoor:/home/user$ screen -S root screen -S root Must be connected to a terminal. I did follow your guide step by step. Do you have an idea, what the problem is?
mount -o remount,rw / I do get this error: '/dev/block/dm-5' is read-only I am using AVD Pixel 3
This is insane
The easiest ctf in my whole life i saw it
Ipp doesn't like me anymore :(
Just a busy time of year and I’m not on the PC much to comment
@@ippsec Oh, ok
always good to watch these videos because i did end up rooting it but i _did_ get stuck on the raw symlink not working (however creating a symlink to just, all of /root works) and now i know why ^_^
Thank you!
isn't trying false creds and trying to force a remote buffer overflow crash going beyond discreet enumeration and just blasting the conch of battle?
10:58 you accidently clicked root.out
it wasn't due to cookie timeout, as you saved the request data at wrong file "root.out" at 10:58 , and the sqlmap ran correctly after deleting the previous result data. (i unknowingly spoke loudly when you saved it at wrong file 😩)
i was looking for this comment 😂😂😂😂
@@helidem😁
Ipp is a certified hood classic
i think i am hearing "vaultcmd /listcreds /all" from everywhere
☹️slove hard and insane machine with guided mode
Awesome 👍
26seconds
Suffered hours on tjis box. Then ended up looking for writeups. How are you making it this simple.
makes it look so easy. This box would take me 5h to crack probably.