HackTheBox - Drive

00:00 - Introduction
01:00 - Start of nmap
02:30 - [MasterRecon] Examining CSRF Cookie to discover it is likely Django
07:50 - Using FFUF to bruteforce ID's of uploaded files, can discover valid ID's but not view the ID itself
14:00 - Accidentally deleting something important when FUZZING, always be careful of what you are doing with tools
16:45 - Discovering the /block endpoint allows us to view any file, discovering a file with credentials which lets us log into the server
23:00 - Setting up a SSH Tunnel to access port 3000, which is Gitea. Discovering an old commit that has the password to decrypt backups
32:00 - Logging into the box as Tom, discovering the DoodleGrive Binary, opening it up in Ghidra
38:45 - Looking at the Sanitize_String command, to see what characters we cannot use
41:40 - Exploiting DoodleGrive via SQL Injection with the EDIT command, this is easy to exploit because SetUID's preserve environment variables
47:40 - Got root, our path is messed up which makes the shell hard to use, however fixing the path is easy
50:45 - Exploiting DoodleGrive via LOAD_EXTENSION, by dropping a library and using char() to avoid the sanitize string function
54:00 - Our SQL Extension C Code
1:02:36 - Failing to use WriteFile() guessing this is because of the size of our input, may incorrectly say buffer overflow here.
1:16:20 - Exploit DoodleGrive via Binary Exploitation! Explaining the Overflow and Format String Vulnerability we will use
1:19:30 - Creating a python script to find where the Canary exists in memory via the Format String Exploit (%i$lx)
1:23:30 - Proving this is the canary by stepping through the program in GDB use $fs_base to examing fs
1:25:30 - Finding where we can overwrite the canary with pattern create
1:27:55 - Creating a python script to exploit this binary
1:43:40 - Converting our pwntools script to use SSH so we can exploit the binary on the target

[@noctavel]

when you were trying to add the ssh key onto root you were at the "insert command" mode, not in "enter username to activate" mode. I think that's why it didn't work. The binary overflow was 🤯🤯🤯🤯, great video !

[@olivernichols7493]

Love your videos. Fun fact (I understand that these boxes aren't supposed to display "best practices" since they are flawed in some way), the API "shouldn't" perform the delete on a GET request. As you saw with ffuf, Web crawlers could perform dangerous actions if this is allowed. GET requests are ideally 'read-only' operations. If this was a pentest, it's something to keep in mind to jot down for the client 🙂

[@ippsec]

Yup, that's a very valid point.

[@Ms.Robot.]

The explanation was clear and easy to follow along.Thanks❗❗

[@billbanks9141]

This guys has been doing the damn thing for years, what a beast!

[@JuanBotes]

thanks for going beyond root and extra tips bits \o/

[@davhovhannisyan6986]

That's amazing💪

[@StevenHokins]

Very nice video thank you

[@affanansari9570]

Great video🎉

[@angelindisguise4638]

You were only 20 minutes in

[@Gray3ther]

Great stuff, as always! Are you using the Dark Reader extension or something different? Keep 'em coming! 💪

[@apkanalyze3623]

At 1:13:43, we attempted to write an SQL payload on the select option pane. Before selecting option 5, there might be a reason for the .ssh directory not being created.

[@AUBCodeII]

Hey Ipp, let's get OSEE before John Hammond does

[@lumikarhu]

i think you have years to get it then lol

[@zoes17]

"wget -o " writes logs to file while "wget -O " writes documents to file. That was the problem with your a.so being UTF-8 text and having an a.so.1 . I really need to work in my binary exploitation and RE skills.

[@AUBCodeII]

Hey Ipp, I just completed my 30th HTB machine today lol

[@ippsec]

Nice job! Gratz

[@user-pk1fp5ie8m]

Hey, are you using Linux as your daily or main desktop distro?

[@tg7943]

Push!

[@nanoskletton]

Hi Ippsec, i have a question. how can i be better at solving windows machines?! i can easily pwn hard linux machines, but i get stuck in easy windows machines. i know that i should keep trying, but i want to know what topics should i learn to do this. thanks for your golden channel!

[@vviolin343]

What are the specs of the kracken machine?

[@taochen1656]

爱你 ippsec

[@ominousSHELL]

48:51 Ippsec I notice that you don't take advantage of the tmux clipboard and it's buffer. That's a slight optimization you and I could incorporate (because its something I also just realized while watching you), especially if you're not planning on saving the password/username to a file. Or maybe your system OS also saves the history of clipboard contents, but tmux might be much faster here.

[@ippsec]

Yeah, that is the better way to do it but just don't have the mental power to keep track of it (or remember to do it) while doing the machine and talking.

[@ominousSHELL]

@@ippsec Yeah, if you were to use it in your videos it should be muscle memory or the videos will be less flashy and more a podcast .

[@extravenger9137]

hey ipp, What is the model of your keyboard please?

[@ippsec]

Ducky zero, with cherry reds.

[@werterdererste]

One Question Every time i finished a box i whatch your videos. but know i found in two weeks two boxes without a viedeo. Are there any reason why you dont make a viedeo for Nunchucks and Squashed? I mean you made to nearly every box a viedeo.

[@ippsec]

They were non-competitive (not a weekly machine) and forgotten about.

[@werterdererste]

@ippsec ok no problem

[@arman97]

I drive.

[@PatrickHener]

Loved the BOF with pwntools. Very educating. Thanks