HackThebox - Dynstr

00:00 - Intro
01:00 - Start of nmap discovering the distribution of Ubuntu based upon SSH Headers
03:40 - Looking at the WebPage and discovering credentials
06:20 - Checking No-IP's documentation for updating Dynamic DNS Names
07:30 - Using Curl to create a dynamic DNS Name
10:10 - Testing for Command Injection
12:45 - Enumerating the bad character and explaining why we could not use periods
14:45 - Converting the IP Address to a format that won't have periods (Hex)
19:00 - Reverse Shell returned, checking out the web source
28:00 - Discovering hosts from *.infra.dyna.htb can ssh into the box if there is a private key and finding the private key in the support directory
32:15 - Using SSH-Keygen to get the SSH Keys fingerprints to make sure private and public key match
35:00 - Attempting to create the DNS Record with the DNS Key that was in the web source
36:35 - Finding a second DNS Key, which can update Infra's subdomains
40:30 - SSH in as bindmgr and discover we can execute a bash script with sudo, exploiting a wild card argument
45:35 - Testing the cron without doing anything malicious
47:55 - Creating the file --preserve=mode, which the cp command will treat as an argument letting us drop a SetUID Binary and have it owned by root

[@ajualex3503]

The -p flag in bash is related to security. It is used to prevent the shell reading user-controlled files. If Bash is started with the effective user (group) id not equal to the real user (group) id, and the -p option is not supplied, no startup files are read, shell functions are not inherited from the environment, the SHELLOPTS, BASHOPTS, CDPATH, and GLOBIGNORE variables, if they appear in the environment, are ignored, and the effective user id is set to the real user id. If the -p option is supplied at invocation, the startup behavior is the same, but the effective user id is not reset.

[@hadrian3689]

When I did first this box, I used sftp within the box to upload the authorized_key and Public key so that I can SSH in lol which in hindsight it was such a roundabout way lol but you live and you learn thanks for the video!

[@ayalfadhel]

Thx Ippsec for being an inspiration

[@spiritedaway99]

thank you,I ve been workin on this for a week and you basically solved it in few hours soo cool,wish Id be in the same level as you one day :)

[@kodany819]

You just din't know how it' worked normal

[@techworld323]

What a coincidence , I Just watch dynatr a few minutes ago , and now again 😀

[@almaring2839]

@Ippsec The -p command stands for "Privileged"

[@declanmcardle]

@30:50 also, if you have two panes split horizontally, copy and paste will by default take over the text from the rhs pane too. :-( so, care needed as you say (Ctrl-B Z temporarily)

[@chuckwoolson9339]

Another awesome video! Which hotel are you going to be staying at in the near future? Just wondering :D

[@SN-db8mv]

this came in my recommended and I have no idea what I’m seeing or listening too

[@bikhlarrovamarakov5392]

thanks master

[@diabawii]

by default, bash drops privilege to the user executed it(bindmgr) , with -p you telling it to not drop privilege back to (bindmgr) and stay as root

[@faresamara7528]

apache version is vuln to the latest path traversal

[@omkarpotpelwar1671]

What if instead of pointing the dynamic dns towards our own ip address to login through ssh, you could have just edited the id_rsa and remove that rule. You also had read/write permissions on the file. Also, for getting root, you could have just put reverse shell in the sudo executable.

[@anonymousNoob992]

How did you know that there was a command injection vulnerability in the URL? What was your thought process when you did that?

[@ippsec]

Saw the error say nsupdate, which is a binary

[@MoeJama5454]

The way you pronounced Dyna DNS

[@ionelanicoleta1449]

can anyone please tell me why is he saying at 23:28 that he's controlling h, hees not root like he demonstrated in thate php code

[@kalidsherefuddin]

Ok thanks

[@brettnieman3453]

How would someone at a hotel wifi do a reverse lookup for your domain and access 22 of your firewalls?

[@ippsec]

If I’m at the hotel, my laptop would update the ddns host to point to the hotel. Anyone at the hotel would have the same edge ip, so they could connect toy house.

[@declanmcardle]

Hmm...ssh-add -l| wc -l could be an issue here

[@declanmcardle]

@40:30 or sign your own key and adjust HostCertificate /in /etc/ssh/sshd_config so the ~/.ssh/authorized_keys isn't referenced...

[@ippsec]

Yeah I don’t generally do that when recording because I don’t want be in the habit of using my private key and accidentally leaking the private key in a twitch stream when I’m explaining what’s happening