HackTheBox - Brainfuck

0:20 - Recon
3:40 - Start of WP Hacking
10:30 - Logged into WP
15:00 - Login to SuperSecretForum
25:00 - Cracking the SSH Key
27:15 - Begin of getting root.txt (RSA Cracking)
rumkin.com/tools/cipher/ -- Site used to during the SecretForum stuff.

[@sowhatsupeirik]

Learn more of of your videos than school, when I pass my OSCP I'll buy you a beer.

[@deathfromthekrypt]

How is it going? Have you passed?

[@abbudi222]

he never passed

[@desktopt328]

Did he get any bears LOL :D I'm in the same boat as you now taking my oscp exam next week

[@abbudi222]

Desktop T how was it?

[@joshuavega2193]

Wondering the same, how was it?

[@thatonesecguy]

No freakin' way I'd have ever figured out this box. It's scary and awesome at the same time as I am preparing for the OSCP currently. God bless me!

[@sumneetsharma9383]

how far u reached bro for oscp prep

[@themastermind9012]

Hey dude, were you able to pass your OSCP exam? What were your strategies during your preparation phase?

[@thatonesecguy]

@@sumneetsharma9383 apologies, saw this just now. I passed my oscp in March 2023

[@thatonesecguy]

@@sumneetsharma9383 Apologies for replying so late, but gods be good - I cleared my OSCP in Mar 2023

[@Riistetyt33]

Currently doing the OSCP, but damn this box is crazy, no way I could figure this out! Thanks for your great videos IppSec, keep it up! :)

[@TechyTubeDotCom]

Your mistakes teach me even more on top of the already awesome techniques, thank you for each video.

[@hatemmohamed4032]

no doubt of it, you are an absolutely talented guy!

[@santiagotaboada4584]

Amazing video ippsec!! Thank you for explaining this :)

[@MrGentlemanism]

Damn.. you are a magician mate. Well done!

[@TheDarkHorseUprising]

just found your channel :) this video is fucking amazing keep it up. loved seeing your thought process for this.

[@user-vo1vr1hq5z]

Completely agreed!

[@nemetha856]

in 2020 this is an easy HTB box based on what boxes are added nowadays

[@mostafamsslati72]

Coming from 3 years later, its even worse now bro….

[@LightTheMars]

I'd never have thought of looking at the certificate

[@SonOfABeach1997]

There is some nMap scripts which displays the certificate information you could run against 443.

[@km0x905]

U do your best, Thanks

[@Cygnus0lor]

This was very informative...

[@TheBaghdadhawk]

I was stuck with odd length error for days and I gave up that box...damn🤦🏻‍♂️

[@zenziiiiiiiiii]

He is our Mr.ROBOT

[@derekpopowski3514]

I finally setup my john to have GPU support but it seems as though i have use the --format flag to set it to use opencl, I notice ipp does not use that flag is his john running the cpu only version or am i missing something simple?

[@constantinenabruk1199]

I cant understand why you don't have tons o visits, your videos are very instructive and as a network admin who wants to change to cibersec (Red Team) and obtain the OSCP its just GOLD. I want to give you an advice: A lot of noobs as me want to learn pentesting and know the know-to's of the things, if you open a Patreon and teach this things you will have my money, and i am sure that for a lot of people too.

[@ippsec]

Thanks for the kind words. I don't really want to do a Patreon as then I'd feel obligated to help on a more personal level, which I just don't have the time for.

[@apt1311]

Do you also read books i.e Art Of Exploitation PWK etc. to practise more and get better?

[@Rachith9012]

Is it possible to provide a structure to follow for a beginner and then we can deviate depending on enumeration and exploit , please

[@alimohammadi1148]

Wow its fun to see ippsec struggle over simple stuff wow 3 year ago was a whole another area :)

[@aidynskullz4139]

@ippsec really cool walkthrough for this machine. Just one thing, is there a way for me to get a shell as root on this box? It's always nice to declare you have got root once you get a root shell it. I don't know, just my opinion about it.

[@nolanwild8851]

You can do it, run "id" and you'll see that you are a member of "lxd" group. Then google for LXC privilege escalation. Same thing can be achieved if you are a member of "docker" group.

[@SonOfABeach1997]

@@nolanwild8851 This was the way I got root but it is an unintended way as this exploit was released after the box. Easier than RSA way though.

[@ex0atmospheric]

where is it configured that the proper nemonic has to be entered in the browser to get to teh proepr content? i would have thought the browser resolves the nemonic to the IP address before connecting? (which is what trying to connect with the IP address would do...only it doesn't show anything)...

[@ippsec]

Yes Virtual Host -- Think i talk about it in popcorn. WebBrowser adds the DNS Name to the header of request.

[@lumenknotty6355]

Thank you! I got user/root.txt. Is the OSCP like this? I have gone through about 30 of your tutorials now, and still feel like there is so much more to learn.

[@ex0atmospheric]

i assume these are virtual host configurations on apache?

[@ajinkyapathare3308]

Doing great work :) noobs usually leave such CTFs when they can't find answer after all if they don't know the answer they don't put time in finding it, they should but once it gets too much stressful they Quit. Thanks to you they'll learn :) Keep it up make more ;)

[@nuralam6797]

u spoke the damn truth...... having this bad habit, i have to change it......

[@ronin0x_]

Speak for yourself

[@PaulEubanks]

Wait, I'm missing something here. Instead of going through all that nonsense to reverse/decrypt what encrypt.sage is doing, could you instead have just modified the encrypt.sage script to output the variable "password" before it even goes into the encryption routine since it's able to read the contents of /root/root.txt already? I never saw how the permissions structure was set up in the video I don't think.

[@sd9847]

Access was denied to the root.txt file when running sage encrypt.sage

[@neoXXquick]

love it.. share other retired boxes dont work anymore..

[@Barrdian]

3poulakia means 3birds in greeklish :P Nice video btw sir.

[@retnikt1666]

Ah yes. HTML is my favourite programming language to exploit WordPress

[@privateger]

hello fellow devranter

[@brendangabrielortiz3568]

anyone else have trouble with wpscan not working? Probably just me but it's super annoying that I can't scan the website myself.

[@7Shol]

If the first encrypted Orestis's post is bound to his signature, what is the encrypted admin's post bound with?

[@toby9439]

It would have been encrypted with the same key. The signature just gave us the 'crib' to work it out.

[@xCCACA]

I hate these CTF like boxes ... but great job btw. as always. :)

[@NayaSapphire]

did anybody run the intro code... I got "ROBBIE" but he forgot one "

[@debasishdash3531]

wish me luck for the oscp journey

[@aggeloskatis6277]

this box was 3 poylakia kathontan

[@techchecker1698]

can anyone tell me about "ssh kracken" what is that ?

[@gaborfabian]

He said it in the video. It's his password cracking machine which has GPU's.

[@Rachith9012]

Why was Robot.txt checked ?

[@medoangel8370]

It's a standard file seen in most websites which has a list of domains , it's there to tell crawling scripts like the ones search engines use to not "look" (crawl) at those domains , and where the website doesn't want u to look is where u should look

[@crash4o4]

Hi there I herd you mention in your video if you want to learn more about cryptography to go? Trying to the part again.

[@ippsec]

I would guess cryptopals.com/, but this video is so old I really have no idea.

[@coffeewithfrank706]

@@ippsec thanks anything helps.

[@jack_brannan]

Thanks

[@nuralam6797]

hello @ippsec , yr video just cool but for noobs like me it's too much... can you recommend some other stuff i should do first to understand yr stuff.......

[@ippsec]

Unfortunately, I don't know any off hand. May sound odd, but it would be like asking you for good resources on how to do basic math like Addition. You know the material, but it has been so long since you looked at that specific level; you have no idea how what books to recommend. If I remember this was a hard box, the boxes on my Beginners Playlist would be a better place to start.

[@nuralam6797]

@@ippsec thnX a lot, :)

[@getoutandgrill]

Where can you get ssh2john python script?

[@ippsec]

Sorry! Thought it was part of John haha, turns out i downloaded it in my TenTen video around 10:45. Link: github.com/stricture/hashstack-server-plugin-jtr/blob/master/scrapers/sshng2john.py

[@arshdeeprobin1525]

Rip after this 💀

[@GGG-hh5jo]

I'll use this code as for the security

[@filipkecman5712]

From the point of ssh-ing to orestis, ippsec's voice doesn't match his actions and I was confused, refreshed the page and all but still nothing. I try to open watch this video on phone and everything is normal, BUT EVERYTHING he did while I was watching on my pc, is done differently on phone??? Plus the duration of the video on pc is 43 minutes, while on the phone 36 minutes?? Whole video is a brainfuck.

[@darshanakhare6676]

Process gosting attack plz

[@yurilsaps]

Is oscp as hard as this???

[@andreas3578]

vim exit = :x

[@KINGCASH1337]

You could of edited the type=password to anything you want and it would show the password

[@Kuisis]

for which part are you talking about?

[@uzoo.6428]

The html form in the exploit I believe, instead of inspecting it from the browser. Good to know both though imo

[@sd9847]

I got that password by luck when firefox asked me if I wanted to save it... You can actually just look at the source code!

[@user-ls6qv6js7s]

F*ck... i ran the code at the start and get the R then infinite loop.

[@anubhav9476]

Wait many comments here are from those going to get their OSCP, even I'm preparing for my OSCP in 3 - 4months from now I'm so stressed 😣😥

[@mehh5505]

You don't need to do any attack on that case for decrypting the rsa. If you have p, q and e you can easily get the private key.