HackTheBox - Pollution

00:00 - Introduction
01:03 - Start of nmap
02:00 - Checking out the site, discovering an email (collect.htb) and setting up gobuster
06:00 - Discovering forum.collect.htb which is running MyBB, someone uploaded a Burp history file which contains API Information
09:30 - Manually examining the BurpSuite Backup File, and discovering it contains full HTTP Requests
12:12 - Sending a POST Request to /set/role/admin with the secret token
12:50 - The Admin Page has a separate registration forum, which sends an XML Request. Trying XXE and discovering Blind XXE
19:30 - Using my Blind XXE Script to make exfiltrating files quicker
23:20 - Trying to extract the Apache Configuration, getting the developers.collect.htb.conf file and then getting/cracking the htpasswd file
25:50 - Logging into developers.collect.htb, cannot login, going back to the Blind XXE getting source code and finding Redis Creds
28:50 - Enumerating Redis, seeing PHP Sessions, and changing our cookie to say we are an admin
36:50 - Using the PHP Filter Chain to get code execution on this include() which leads to a shell
44:20 - Looking at listening ports, seeing a few things on localhost. PHP FPM is listening on 9000, injecting code with fcgi.py into that and getting shell as Victor
52:45 - Grabbing the Pollution_API Source Code (listening on port 3000), then using Snyk to look for vulnerabilities
55:30 - Seeing where Lodash is used and talking about Prototype Pollution
59:30 - Logging into the API
1:02:00 - Our user is not an admin, logging into the MySQL Database and changing our role to admin
1:05:00 - Testing our ability to send messages
1:06:09 - Using Javscript Prototype pollution to set SHELL to a local file we created, which the exec() call uses and getting root.
1:07:00 - Doing this exploit without the need to drop a file by setting SHELL to /proc/self/exe

[@speedfastman]

I use these to fall asleep to.

[@neunzehnvierundachtzig]

It's the windows/AD playlist for me

[@melunadejoode]

Omg I also do that

[@stevesharma6521]

Omg I thought I am the only one who does this wtf!!!!!!!

[@damuffinman6895]

Why lol

[@muhamadazim1678]

Yesssddsd… every night 😂😂

[@huyvuquang2041]

This is by far the best web exploit box I have ever seen. Always love the way you explain things, very clearly. Keep it up man. Thanks

[@lool7922]

amazing work - what a good explanation . 👍👍👍

[@StevenHokins]

Really good video, thank you for it ❤

[@johnathonzorbac4361]

Good stuff ❤

[@chasejensen88]

Hey IppSec, thank you for all the amazing videos. I learn so much from every single one, and hopefully, I'll be able to return the favor and contribute back soon enough. I've noticed in most of your videos, including this one at the 2:04 mark, you mentioned the practice of adding domain names like collect.htb to the /etc/hosts file (or equivalent hosts file on different operating systems). I understand the basic concept of hostname resolution and how it bypasses querying DNS servers, but I'd like to understand the specific benefits and use cases this technique offers, particularly in terms of Recon and Bug Bounty Hunting. If you (or anyone) don't mind shedding some light on the topic for me, I would greatly appreciate it. Thanks again!

[@ippsec]

Currently there isn’t any DNS on Hack The Box, so in order to do virtual host type of stuff like vhost bruteforcing you see here, need to add it to the host file

[@chasejensen88]

@@ippsecoh ok I see, so if they did have dns resolution on their boxes there wouldn’t be a need to do that in most cases sine they would already have resolvable name, correct?

[@alanisam6220]

First! you are awesome ippsec :D

[@tperrak]

Thank you ippsec!!

[@sotecluxan4221]

Gorgeous!

[@sand3epyadav]

Sir, My heart is ippsec i love ippsec....

[@Palidon]

At 54:43 you also found the JWT signing token so instead of going to the DB and changing the role someone could also forge the JWT token.

[@ippsec]

I believe the running app in /root, was slightly different and used a different key.

[@hacktheboard]

I'm curious if the php filter RCE trick works in the blind XXE you found. Have you tried that?

[@Ms.Robot.]

Nice web app work ‼️

[@kerbalette156]

Amaze. Do you do these this quick?

[@monKeman495]

why do we require extra gadget which is shell where we already have exec avail isn't we just use predefine property __proto__.exec or Object.Prototype[exec]

[@dr.khal33d71]

great !

[@r3dp4rrot]

Ippsec, please teach us on how to create a box !!

[@vijayvj3976]

Hey IppSec..❤❤

[@samu5167]

At 1:08:08 I think you have access to argv[0] because you pollute all the objects in child_process

[@tg7943]

Push!

[@chasejensen88]

Did you release the video of you making the script? 19:25

[@ippsec]

Yes, it’s currently a paying member only video ($3/m tier). This one will be released to everyone Sunday thoe

[@chasejensen88]

@@ippsec Sold!

[@InfernoPetrivich-mk5ft]

Wha about real target with ips/ids/edr/siem/waf/av/etc ?)) After real bb - htb realy easy

[@AUBCodeII]

Ipp, there's a LinkedIn account with your name, is it really you?

[@ippsec]

If it’s Ippsec in the url yea

[@AUBCodeII]

@@ippsec it is, lol. Thanks for adding me

[@sand3epyadav]

@@ippsec i already followed ippsec sir...

[@ctf59]

:D