HackTheBox - Pikaboo

00:00 - Intro
01:05 - Start of nmap
03:00 - Discovering the webserver is apache, despite nmap saying it is nginx
06:30 - Every request with /admin gets a 401, indication that nginx location may not end with /
07:30 - Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ directory
08:30 - Running gobuster in /admin_staging/ to discover more php scripts
09:20 - Testing index.php for lfi with a php filter
12:00 - Looking at the source and seeing it is using include() which allows for RCE if we can get it pointed at php code
13:50 - Playing with the LFI, eventually finding info.php which tells us open_basedir is set to /var/ which prevents the LFI from going out of that directory
16:35 - Using wfuzz with an LFI wordlist to search for files we can chain with this LFI, discovering ftp logs
19:00 - Poisoning the FTP log with a php reverse shell then using the LFI to trigger it
24:15 - Looking at the /opt/pokeapi directory to find a LDAP credentials
25:45 - Using ldapsearch to dump information out of the linux ldap server to get pwnmeow's credentials
28:25 - Using ftp with pwnmeow's credentials, then running linpeas
32:35 - Examining the CSVUpdate cron and finding a code injection vulnerability in the perl script
35:20 - Going over why perl will execute a variable starting or ending with | with an open() command
37:30 - Creating a revers shell file that begins with |
41:30 - Uploading our malicious file via FTP and getting root

[@anvithlobo]

41:38 is designed that way If the first character of the file name is ‘|’, the remainder of the argument is interpreted as a shell command. tnftp then forks a shell, using popen(3) with the argument supplied, and reads (writes) from the stdout (stdin). If the shell command includes spaces, the argument must be quoted; e.g. ‘"| ls -lt"’. A particularly useful example of this mechanism is: ‘dir "" |more’.

[@XiSparks]

This one was so awesome. Loved all the different tricks.

[@AvinashKumar-fe8xb]

sheer brilliancy, loved it :)

[@pswalia2u]

Amazing as always :)

[@48pluto]

You forgot to talk about incrontab at the end of the video. Thanks for the video !

[@harshparekh9841]

Awesome box and awesome walkthrough

[@Rienck]

An good amount of trickery in this one! Thanks for the entertainment!

[@GiniLoh]

Nice one, thanks you bruh

[@Ms.Robot.]

This is very informative. 👍

[@gabrielsantos19]

Thank you, IppSec 👍

[@markgentry8675]

you were going to talk about that file that was like crontab. I cant remember what it was called, but you found it in the linpeas output.

[@chiragartani]

1st. Will watch the video later 🙏😀

[@amieemaya9472]

its a talk about incrotab anyways nice vid again thank u

[@deadeye821]

Nice video ippsec

[@sefterm-zade9744]

thanks for everything. I see you as my master. I want to ask do you update oscp playlist?

[@olufelajunior]

Amazing video, how and where did you learn all these things ? I find it hard to go on hack the box, scares the hell out of me..lol

[@angelk316]

Please do videos of pentesting other systems like mainframes and cloud environments

[@lawaace1056]

Hey man a stupid question lol , how old are u if u don’t mind asking

[@benplayz5347]

please do fingerprint box next. ive been stuck from when it has been released

[@benplayz5347]

please try fingerprint box next. i've been stuck from when it has been released

[@sand3epyadav]

I have download this video watch in night