HackTheBox - Delivery

00:00 - Intro
00:46 - Starting with nmap
02:15 - Enumerating the website to see links to the HelpDesk and Mattermost
03:40 - Attempting to enumerate the version of osTicket
05:45 - Searchsploit json output shows the date
06:30 - No exploits found, lets open a new ticket and see it gives us a way to update the ticket via email
08:40 - Creating an account on Mattermost with the email of the helpdesk to get the activation link
09:30 - Viewing the internal chat and seeing a password, then SSHing to the server
11:50 - Using hashcat to create a wordlist with its internal rule system
12:20 - Going over how Hashcat Rule files work
15:20 - Root #1: Running sucrack to bruteforce the root users password
19:50 - Root #2: Cracking the Mattermost Password
23:20 - Using hashcat to crack the Mattermost Password
26:45 - Going over how i set up the email server on this box

[@DraugaDae]

Sorry to see the documentation steps dropped, they were interesting in their own right - also the video ends at 28:11 but then continues for almost 10 minutes as dead space.

[@Vogel42]

i don't think he needs to recon his own box :)

[@DraugaDae]

@@Vogel42 Can't imagine he needs to hack it either, yet here we are!

[@nullpwn]

@@Vogel42 DraugaDae has a valid point, seeing how recon works on his own machine can help others in reconning and understanding VulnBox/self made ctfs. I believe strongly that self ctfs are harder because you already know how stuff works but you need to have the attacker mind and how somebody else will approach it

[@Ms.Robot.]

This was one of your better quality presentations. Thanks. Beautiful job. You are inspiring me through all aspects of network, OS, and device security. ❤️❤️❤️

[@saketsrv9068]

Kudos to such dedication towards the infosec community.

[@apehex1623]

Damn!!! Your box is original, there's the hunting logic, detailed and yet fast enough... You nailed it! 💯🔥

[@armandkruger911]

Excellent as always! That is why I always limit the SSH logon by Public/Private Keys and creating a dedicated group that is only allowed to SSH as well is locking in SSH traffic by specific IP address or subnets!

[@TechSolutionHindi]

ippsec setup tour please

[@MrMeLaX]

That was my first box on HTB. Thanks a lot for all your work.

[@cesarepele4947]

Great 1 as isual! That python smtp script was brilliant!

[@dylanreuter2928]

When doing sql queries, if you add \G to the end, it will show the fields in a vertical list which makes tables with a lot of fields sooo much easier to read. e.g., SELECT * FROM users\G;

[@MrShooksy]

Loved the walkthrough! Thanks ippsec

[@sumanbhardwaj9883]

Solving your own box lol, I loved this box though keep it up please

[@pramodkhandelwal9321]

Lol that intro.. so I am gonna be biased and say it’s amazing.... 😂 😆 Anyway great video ippsec!!!!!

[@booster4870]

thanks for the box and for the walkthrough

[@memoriasIT]

I did this the other day, it was a cool machine :)

[@Pyroteq]

I enjoyed this box. I thought the foothold method required a bit of "outbox thinking" =)

[@ameersabbah6407]

Amazing Videos

[@socat9311]

a how-to-create-a-ctf-machine would be a great tutorial :)

[@kluber994]

hello IppSec i'm korean and I am watching your video well when I study. Anyway I have a question in this video What is the support ticket? and how does the authentication email appear in the ticket? I'd appreciate it if you could tell me

[@LORDJPXX3]

Running Hydra against SSH - root user and using a password list containing the correct password didn't create a hit. Has anyone else seen Hydra perform false negatives?

[@tg7943]

Push!

[@bradleyshaw7164]

Can anyone recommend some webapp pentesting content? Recently sat OSCP and found web was my main weakness. Just looking for some good resources. Cheers

[@cybraxe]

Anyone know where i can find similar config for tmux like the one in IPPsec looks very nice to look at Thank you

[@deveshshah2571]

did not understand why you would chuck the plaintext pass in hashcat again. It would not even be a valid hash

[@ippsec]

If you ever do a DCSYNC against a company, just try it and you'll be surprised. It's just how the rule files work that makes it beneficial, hard to explain without just doing it.

[@mukundbhuva]

Finally Ippsec's face reveal 😌

[@EnglishItalian1]

Where?

[@mukundbhuva]

@@EnglishItalian1 goto Hackthebox official channel with he is with JohnHammond

[@grandmakisses9973]

Are we gonna get ippsec face cam now that we seen his face?

[@ajualex3503]

Sir what about setting up htb vms with nginx??

[@wkppp4732]

It's ippsec!!!

[@TheBrutaline]

Audio is kind of wack at times. Is it on my end or anyone else having problems as well?

[@profiluefter]

I agree, it's a bit painful to watch with headphones

[@tech0494]

And the guy who found this bug was inti , asome hacker🔥

[@vonniehudson]

1st

[@ARZ10198]

Ippsec OP

[@micosair]

You do know that a face increases engagement substantially..

[@dopy8418]

Dude this is not a Beyonce concert…

[@ippsec]

I’m here to teach, not be popular or an influencer. The cam gets in the way of text and doesn’t have any real benefit

[@desjomp]

@@ippsec the first thing to do with a new laptop sticker the webcam lens. :) greetts @rootsh3ll1

[@ianmoone2266]

Bro we are here for the content and methodology. Camera would be an irrelevant adittion.

[@pradohimself]

@@ippsec The cam gets in the way of text, nicely put