Рет қаралды 30,544
00:00 - Intro
01:03 - Start of NMAP
04:30 - Discovering install.php, which says bludit is being installed.
06:30 - Looking for exploits searchsploit, everything requires Auth
07:35 - Attempting a login and noticing the CSRF Tokens
09:20 - Looking for exploits online that haven't made it to SearchSploit yet
12:00 - Placing the X-FORWARDED-FOR header to bypass brute force protection
15:40 - Creating a Python Brute Forcer
16:45 - Scripting: Grabbing the CSRF Value with python requests
18:20 - Scripting: Grabbing the PHP Session Cookie with python requests
18:20 - Scripting: Sending a login request with python requests
18:20 - Scripting: Telling request to not follow and detect a valid login
31:10 - Using Cewl to build a wordlist, then changing our python script to pull passwords from our wordlist
34:30 - Scripting: Setting a random IP in X-Forwarded-For header
37:50 - Scripting: Scripting fixing a bug then getting a password via brute force!
41:00 - Start of playing around with the Bludit Image Upload Vulnerability.
45:10 - Having trouble, running the exploit with metasploit through a proxy to understand what is going on
47:50 - Uploading a PHP Reverse shell then HTAccess file to get code execution
01:02:30 - Reverse shell returned, finding passwords in the bludit database, then cracking them.
01:08:20 - Cracked a password for hugo, switching to his user
01:09:30 - Doing the SUDO underflow exploit