HackTheBox - Hospital

Рет қаралды 22,709

Күн бұрын

00:00 - Introduction
01:00 - Start of nmap
03:00 - Analyzing the TTL to see that the Linux Host is likely a Virtual Machine. Also Docker is not at play since it decremented
07:00 - Attacking the PHP Image Upload Form, discovering we can upload phar files
13:48 - Uploading a php shell, discovering there are disabled functions blocking system
17:15 - Using dfunc bypass to identify proc_open is not disabled and then getting code execution
23:00 - Reverse shell returned on the linux host
26:00 - Uname shows a really old kernel, then doing CVE-2024-1086 which is a NetFilter exploit between kernels 5.14 to 6.6, getting root and then cracking the hash to get drwilliams password
29:20 - Talking about Man Pages and how they are organized to identify $y$ is yescrypt
33:40 - Logging into RoundCube, discovering an email that indicates that drwilliams runs GhostScript with EPS Files, looking for exploit
36:00 - Building a malicious EPS File with a powershell reverse shell
43:40 - PRIVESC 1: Uploading a shell in XAMPP and getting system
52:30 - PRIVESC 2: Discovering an active session, using meterpreter to get a keylogger running and stealing the password
1:01:50 - While we are waiting for keys to be typed, lets inject a Reverse VNC Server so we can watch the screen
1:10:08 - PRIVESC 3: Showing we could just remote desktop as Chris Brown and then view the password

Пікірлер: 38

@Ms.Robot. 3 ай бұрын

This lesson had really good structure. It was clear and concise❤️.

@ruycr4ft 3 ай бұрын

Hey man thanks a lot for the video! ruycr4ft here, the creator of the box :P

@AmanuelHaileGiyorgis 3 ай бұрын

Great box, my guy!!! Learned a lot btw

@ruycr4ft 3 ай бұрын

@@AmanuelHaileGiyorgis Glad you liked it!!!

@zhsloe 3 ай бұрын

Was a great box, had fun with it as well - especially loved the fact that you need to root the VM first to get to the real box :D

@ruycr4ft 3 ай бұрын

@@zhsloe Thanks!! Really glad you liked it

@PR1V4TE 3 ай бұрын

My G lowkey came to see the official walkthrough. 😜😜

@medo51201 3 ай бұрын

Hey man, just got this box bounty before it retired. Great to see your video though, the metapreter thing was something new to learn. As always, staygreat Ippsec.

@dragonv7 3 ай бұрын

Thanks Ipp! Amazing video from start to finish

@george___43 3 ай бұрын

Awesome video as usual!!

@h1-hackermater 3 ай бұрын

Amazing!!! thxs for sharing ippsec!! 🎉❤

@7DuRd3n 2 ай бұрын

it is good to know that we are allowed to create outages that we only know abouy. PS love ur content keep it up man. True inspiration.

@AUBCodeII 3 ай бұрын

🇺🇸 What's going on KZbin, this is IppSec, and today we're doing Hospital from HackTheBox 🇲🇽 Que pasó, KZbin, me llamo IppSec, y hoy iremos hacer Hospital de HackTheBox 🇧🇷 E aí, KZbin, aqui é o IppSec, e hoje vamos fazer Hospital do HackTheBox 🐱 Meow meow meow meow, meow meow meow, meow meow meow meow meow meow meow

@Ibr8kThingz 3 ай бұрын

Am i the only one that has to slow this down to .5x to follow this guy! Hahah great content.

@k_usuan 3 ай бұрын

As a beginner is a good idea to work on most HTB new retired boxes rather than only focusing on the hold boxes ?

@abdelhamed8359 3 ай бұрын

Nice video bro ❤

@user-js4wi8mp7m 3 ай бұрын

Is there a paper or article explaining in detail how the second privilege work? I think I have done progress injection before but I don't really know how you could read his key stokes from this. I also looked at the permissions for the Dr. Brown and it says he has SeMachineAccountPrivilege and SeIncreaseWorkingSetPrivilege. Does that have to do with the privilege escalation?,

@huzaifamuhammad8044 3 ай бұрын

Hey ippsec have you recorded any video on http request smuggling in the HTB series?

@ChrisBensch 3 ай бұрын

In your msfconsole, I see the prompt showing sessions and agents count, along with full path and session when you're in a shell. How did you get that?

@ippsec 3 ай бұрын

I think it’s just the newest version of msf, honestly don’t know

@alexdhital3095 3 ай бұрын

Awesome

@sotecluxan4221 3 ай бұрын

Yeah!

@zoes17 3 ай бұрын

*Alt + D* is delete a word in my terminal, not that it's too important but if it helps someone it helps.

@dopy8418 3 ай бұрын

Why don’t you ever scan for UDP ports ?

@ippsec 3 ай бұрын

Be a waste of 2 minutes every video. You should start up more scans in the background as you work. As I always say, always run recon

@dadamnmayne 3 ай бұрын

I definitely intermingle PHP and HTML whenever i develop 😂

@xAbdulRhmanX 3 ай бұрын

Hi ippsec, This box was good but weird at the same time, I RDPed to the system and noticed something typing and through it was another player or something 😅 I had the same thing with the viewing the password, so I opened notepad and let it type. It felt like cheating but it worked! I liked the keylogger approach. Over all I enjoyed this box

@ruycr4ft 3 ай бұрын

That was the automation of the .vbs script ;)