HackTheBox - OpenKeyS

00:00 - Introduction
00:31 - Begin of nmap
01:10 - Nmap shows it is BSD, going over some command differences
02:00 - Running GoBuster to find other PHP Scripts
04:30 - Looking at the includes directory and finding source code
10:14 - Reversing the Check_Auth binary with Ghidra, to see it doesn't decompile well
12:00 - Using VirusTotal to find out if this an old binary
13:20 - Using Cutter to decompile this binary, to see it does a better job than Ghidra!
17:50 - Finding some BSD Exploits related to authentication
20:00 - Putting SCHALLENGE as the username, causes a different error message. Then doing some code analysis around $_REQUEST
24:50 - Abusing the $_REQUEST() feature to overwrite the username file with a valid user and grab their SSH Key
26:10 - Showing how OpenBSD has some different command line switches
31:00 - Going back to the earlier CVE, since it showed a privesc aswell and explaining CVE-2019-19520
40:45 - EXTRA: Looking at the PHP Code to explain the $_REQUEST exploit again

[@hisham-pq3xc]

I love the small information that gives us while you solve the box

[@LegitZero]

This guy is actually the best at explaining stuff on the internet when it comes to computers. Keep going

[@kasuntechtest8871]

The thing about ippsec is , this is not just a walkthrough .... This is more artistic and enjoyable even it is about pure technical.......

[@BroodPitt]

Thanks for explaining the exploit! Real great treasure this channel!

[@tymekl1509]

I haven't even watched it yet, but I know this is gonna be awesome

[@pramodkhandelwal9321]

Not seen the video till now but still saying awesome video ippsec!!!

[@terminaltears]

Thank you for the video IppSec! You inspired me a lot.

[@mayankdeshmukh8752]

Awesome explanation !!

[@j0m0z]

I Love IPPSEC! Dude, in part because of you, and this channel, I am a pentester and security assessor. Next year I am going to build a team and this channel is going to be required training.

[@olivert.7192]

man privilege esclation seems super ez. But initial shell would have taken me ages. Very cool box though, it is easy after all if you do some good enumeration. I never did it but it looks really cool Good video ippsec

[@DHIRAL2908]

This box was hard if you had zero experience with BSD's common CVEs like me...

[@DHIRAL2908]

11:25 It does call a function before 'do {'. But can't really remember if it was very useful 🤔...

[@Sh1n3g4mi]

that 1 dislike must be from someone who had no idea what's going on.

[@Bwcap]

Love this terminal theme. Which is it?

[@tymekl1509]

I have a question @IppSec, will you continue to make videos on christmas break?

[@ippsec]

Probably not. I am in the process of moving and probably won't have an office for a few days.

[@rayyansiddiqui6261]

when ippsec says cool CVE, then it must be cool CVE!!

[@nickst2797]

Hello! You dont put your videos in playlists anymore?

[@trwwrt5687]

@IppSec what is ur desktop env and ur theme ??

[@eklypzn]

Just google parrot pwnbox

[@trwwrt5687]

@@eklypzn thanx man

[@kret63]

Wow, that was quite a headache.

[@tymekl1509]

sgid - stored gid

[@Adam-wc5ol]

Can you make a playlist for all HTB Videos ?

[@flamingoindigo4253]

check his playlist, he sorts it by difficulty too.

[@gauravbisht9622]

NO ONE: LITERALLY NO ONE: IPPSEC: I really like this box

[@MrKartos1]

Do another tmux video! Been trying to up my terminal game

[@JuanBotes]

@ippsec u awesome! LOL at men in black moment - forget everything i just said in last 30seconds @38:41

[@user-jl4kg6ls9g]

struggle solve the box!!!maybe 3 weeks i can solve give a time and watch @Ippsec