HackTheBox - Late

Time stamps will be added tonight

[@souleymaneadellah1176]

That autocorrect on globals tho. I was screaming internally when it happened

[@denic6861]

About to say the same thing

[@kenshinjo5472]

I struggle so hard with this one but watching this video and seeing how you did it makes me want to go back with to the box again.

[@burekhacks]

Tried so many times with different fonts and sizes and never worked so I gave up after a while.

[@neunzehnvierundachtzig]

Just Bold the command where it returns the error. for me _builtins_ (in get_flashed payload) always returned error. so i made it bold: {{ get_flashed_messages.globals. *builtins.open("/etc/passwd").read() }}*

[@burekhacks]

@@neunzehnvierundachtzig Great, thank you!

[@pratiksawant8119]

Same here i got ssti on first place but never got the right font

[@cipher3966]

I tried about 20 times playing with fonts. Then realized taking the screenshot directly from the webpage meant I could do it in 2 or 3

[@IvesvanderFlaas]

You make it look so easy. I spent time looking for exploits for tesseract and the Python tesseract package but didn't find any that worked. I feel stupid now.

[@gwerneckpaiva]

The text to image process was a nightmare!

[@velomeister]

this machine was a pain in the ass

[@Ms.Robot.]

Very well done. 🤩

[@upup5133]

Amazing description XD

[@shiffterCL]

great work!

[@cipher3966]

For the image part. After more than 20 attempts I realised that it worked much more easily if I took the screenshot directly from the webpage example rather than my own text editor

[@Landee]

11:54 you rename it with the right click, it remove the "s" 12:55 that's where the error come from

[@Voskos]

Its not an ippsec video if he doesn't have a typo and waste 5 minutes trying to troubleshoot it

[@Landee]

@@Voskos hahaha

[@tic977]

I did the priv esc with a cron job that was possible to run with a badly set PATH

[@cipher4873]

W youtuber

[@texastitan6567]

15 is crazy I was on my 86th screenshot before getting code execution 😂😂

[@laurenlewis4189]

I'm fuming that Comic Sans worked when I installed like a dozen non-default fonts to try out different monospace and dyslexic-friendly fonts

[@javamiya1980]

❤❤❤

[@matheusdesouza8056]

These root was very cool

[@and_rotate69]

For root flag, append chmod u+s /bin/bash then login with ssh then bash -p

[@edwardwhite8253]

Goddamn it, this box is already retired? I was planning on doing it a week ago

[@damuffinman6895]

Guess you were to late bruv

[@rajkaransinghgill2082]

what does it mean to be retired ? is it not good after retired or what ?

[@damuffinman6895]

@@rajkaransinghgill2082 In Hackthebox, there's two categories of machines, active and retired. An active machine is a machine that's relatively new, this means there's no writeups or reviews available for you to see. A retired machine is usually a couple months old, and has writeups and reviews available. So the only difference is really release date.

[@MoofyYT]

nice that you've converted to flameshot.

[@democsrf2793]

Lessgoo

[@memedaddyz]

I didnt get the part with ssh and curl as a user

[@purya2595]

Could you share this box docker image ?

[@LolLol-dj1tf]

how are you so good? Like you complete vuln boxes so quickly? How do you always find the next clue? teach us pls

[@somerandomwithacat750]

Ippsec is an incredibly good hacker but he almost always has solved these boxes ahead of time. When you see him coasting through a box with zero downtime you aren't really seeing the true picture. In real life you don't always know what the next step is going to be. This is very important to realize since seeing someone else do these boxes so easily will lead to imposter syndrome. Ippsec is still going to get sucked into rabbit holes or whatever.

[@khanhhnahk1]

Hi, can someone explain detailed for me about the reverse shell part? Thank you so much guys!

[@-bubby9633]

Basically whenever a user logs in via SSH it is configured to run "/usr/local/sbin/ssh-alert.sh" with root privileges. The sh script itself is just a standard script to alert the admin via email that an SSH login had occurred. The issue is however that our low-priv user has write privileges to this file. However, due to the attributes we can only append to the end of the file - we can't overwrite pre-existing contents. So as a result we append our command to execute at the end of the file with "echo 'COMMAND_TO_RUN' >> /usr/local/sbin/ssh-alert.sh". In this case he used a command to curl a reverse shell payload off his python webserver and pipe it to bash so it would be executed. Next was to make the script itself run. As noted previously, the script runs whenever someone logs in via ssh, so he got the id_rsa key for the current user then logged in via SSH using that. When the login was detected the ssh-alert.sh script ran, the command appended to the file executed, and the reverse shell was downloaded and executed.

[@khaloodkj886]

If you mean the index.html basically you put the reverse shell code that works with bash inside index.html then you get the code with curl and pipe it to bash

[@DeepanshuSingh_]

Box is late.

[@oni1350]

Do IppSec answers to subscribers ?

[@cimihan4816]

def!! Just ask him some valid questions. he might reply here

[@SSHad0w__]

He does. If you don't get a reply, just tweet @him.

[@vishnup5080]

make a video on redpanda pls

[@skyone9237]

Honestly I had no idea what to do with this box...how ippsec straight away decided to try SSTI??? Well he is very much experienced but this kind of box won't make sense to beginners like me.. 😂

[@neunzehnvierundachtzig]

He noticed that it was made with Flask. and Flask means SSTI mostly in CTFs.

[@somerandomwithacat750]

You look at what the app is doing : it's converting a string meaning its potentially trusting user input. So SSTI to see if you can make it do mathz

[@takeshikovacs1081]

so the reason you became root is because the pam module runs ssh-alert script as root ? not entirely understand that last part

[@khaloodkj886]

If you put “id” inside id.sh and execute id.sh as root it will show root id and if you execute it as user it will show user id simple

[@tg7943]

Push!

[@hondatech5000]

Took me about a hundred more uploads. I ran linpeas and was looking into exploiting the env path couldn’t figure it out. Totes missed the append tried all kinds of stuff missed out on root:/

[@rajkaransinghgill2082]

At 14:21 , why are we using the IP address 10.10.14.8 ? The IP for the host was different. Please someone clear this doubt.

[@ippsec]

That is the IP Address of my machine, we are telling the machine to reach back to my machine to get code to execute.

[@nectius123]

Ipssec did in 15, I did in 45… Does that mean I worth 1/3*Ippsec ? If so, hell yeah!!?? Progress!!

[@sand3epyadav]

I have done this; but reading ssh key 1 hour

[@declanmcardle]

Warning: the support telephone number is country code 234 = Nigeria. 🙂

[@neunzehnvierundachtzig]

The Only frustrating part was the OCR foothold. And the name doesn't suit the room though.

[@flrn84791]

The room? 😂

[@neunzehnvierundachtzig]

@@flrn84791 aka "Box" ,"Machine", "instance". I hope you got the point.

[@anthonyquattrocchi6252]

This was one of the most annoying boxes i've attempted on htb

[@somerandomwithacat750]

It's a really cool idea and I like the recent emphasis on SSTI on HTB boxes. But man, was that text conversion crap annoying lol

[@T1081198]

If you have vip go for silo or mischief. These newer boxes with AI. It seems like everyone eventually knew attack method but the payload delivery was annoying. I saw the name of it and skipped it. I would have been trying to get a php Webshell on this thing forever tbh lmfao “python, php, Ruby, awk, php2-9, nmap? Nope. Baby’s screaming there’s a Saturday with nothing learned yayyy!!” Then we explain to the fam how much we appreciate them being understanding while you’re not working, not studying, no researching, or playing video games, but you’re angry and unsettled over a puzz… 3AM…wait a minute… SSTI?! Gonna sneak to the computer even though I told myself I’d never do that agai…YES! SSTI! Thanks Ippsec for the videos on ssti or I never would have thought of that. Wtf does this box have to do with time? Other than the quick overwrite at the end. It’s not a cron, pspy wasn’t needed, no “active users”, image to text converter -> shell -> ssh checker? I tip my hat to everyone who did this one. Great concept but still waiting on AI to get better before I start doing boxes with it. Just always seems aggravating. Voice, Books, Images, etc. I want to say Book was the other SSTI but was harder right?

[@puneethkpati6265]

That’s the coolest ssti I’ve ever seen.

[@cybersecurity3523]

First bro

[@LolLol-dj1tf]

can you teach us how you always find the next step/clue?

[@somerandomwithacat750]

You look at what you have. He tried ssti because he knew it was accepting input from an untrusted source. It also said that the app was made with flask, which supports this.

[@somerandomwithacat750]

2. After you gain shell you do the same thing. What groups are you apart of? Can you read any ssh keys? What users and what groups are on the box? Did Nmap or 'ss' show you anything you haven't dealt with yet like mysql? Go check things like /var/ , /opt/ , try sudo -l, etc. If you have like mongodb ot mysql it's more likely that thays going to be apart of the next step. If not that, any custom bash scripts, cron jobs, etc. If there's nothing it's going to be permissions misconfigured somewhere

[@somerandomwithacat750]

3. Think of it like tchekov's gun. These boxes are made to teach you something. If you see something there is almost certainly a reason why it is there. A box designer isn't going to make a bash script that deletes XYZ or an ABC that does whatever for no reason. Use what you have available and what is in front of you. Even something like the box name or an innocent mention like "made with flask" is done on purpose. Lastly, just practice. A lot of this is just putting in the time to get the experience.

[@Wereld03]

@@somerandomwithacat750 i find expecting ssti here a big step. Normally you’d be piping data to some ocr program, then sending the response buffer out as a file. There is not reason to do any templating in that flow.

[@Wereld03]

Watching back it does have html tags in there, so thats a small hint ig

[@LetsFailYourGameDE]

Did he just say "let's see what this fuc* owns"??? xD 19:23

[@jaylal4899]

the initial foothold is way too far fetched. I tried so many payloads and couldn't get remote code execution... The priv esc looks fun.

[@ippsec]

Yeah a lot of the older boxes weren’t nearly as realistic, was a different time back then and the boot2root was more on the puzzle side than realism.

[@mrman9279]

Play

[@AbacateSexy]

although fun in concept, the machine was quite boring :/

[@krosec]

I did the same exploit for the foothold, but I got the id_rsa and accessed the machine as svc_acc via ssh, for the privesc was basically the same thing, I append a revshell to the file and ggwp

[@sotecluxan4221]