HackTheBox ~ Quick Walkthrough смотреть онлайн

Follow me as I take down a #HTB Hard machine: QUICK. It involves more enumeration and digging into php files to find a login bypass. I will explain how a bash loop, symlink, and a race condition gets you to root!

00:00 Intro
03:00 Parrot OS & pwnbox theming
https://github.com/theGuildHall/pwnbox
03:57 Nmap
05:51 Web Enumeration [9001]
07:55 Build User List
08:40 Build Domains List
10:39 User Enumeration Check: None
11:11 Web Directory Enumeration [Gobuster]
13:24 QUIC [UDP:443] Enumeration
14:44 Install QUICHE
https://github.com/cloudflare/quiche
17:38 Install cmake
19:30 Web Enumeration [QUIC/HTTP3]
23:57 Download Documents with Quiche
26:18 Password Found!
26:53 Password Spray & User Fuzzing with #Burpsuite Intruder
30:20 Authenticated Web Enumeration [9001]
34:20 ESIGate RCE Vulnerability [CVE-2018-1000854] Explanation
39:15 Exploit ESIGate CVE
43:44 U1 Shell / ~~USER.TXT~~
44:20 System Enumeration [/var/www] & Find DB Credentials
45:03 Breakdown Login.php logic
46:17 MySQL enumeration
49:01 System Enumeration [Printer Website]
49:39 Breakdown Index.php logic
51:38 Virtual Hosts Enumeration
56:14 Remote SSH Tunnel Redirect to Access Printers Website
57:22 Login Bypass: MySQL INJECT INTO Users Table
1:04:30 Authenticated Wed Enumeration [Printers]
1:05:43 Print Job Demo
1:07:19 Breakdown Job.php login
1:10:07 Privilege Escalation via Symlink with Race Condition
1:15:58 Dumped RSA private key! ?
1:16:53 U2 SSH Access
1:17:40 U2 Home Directory Manual File Enumeration
1:20:45 Root SSH / ~~ROOT.TXT~~
1:21:03 Summary

Thanks for Watching! Please hit the Subscribe you liked this and want to continue learning through #HTB!
#BridgingTheGap