HackTheBox - ScriptKiddie

00:00 - Intro
00:45 - Running nmap
01:20 - Using Firefox Developer Tools to inspect the page and see its a Python webserver
04:50 - Fuzzing parameters with ffuf to see if anything sticks out
05:40 - Ffuf isnt giving expected output, lets send the request to BurpSuite to find out we are missing a HTTP Header
08:20 - Adding the Content-Type header to ffuf and finally fuzzing special characters
16:00 - There is a MSFVenom CVE and it looks like the webpage uses MSFVenom
17:20 - Editing the MSFVenom exploit to place a reverse shell but the exploit keeps failing
21:30 - Using curl to test the RCE
22:20 - Validated we have RCE, building out a web cradle with our curl to execute code
24:20 - Reverse shell returned as kid user
24:45 - Looking at the web application and discovering a logs directory
25:40 - Using stty to fix up our reverse shell so vim/nano works
28:00 - Running GoSPY to examine processes on the box
28:50 - Ha. GoSpy found the MSFVenom RCE
31:20 - Examining the scanlosers.sh script to find a RCE
35:15 - Having trouble exploiting scanlosers, taking a deeper look at the script
37:00 - Reverse shell as pwn returned
37:50 - pwn can run metasploit with sudo, executing commands by just specifying a binary in MSF
38:50 - Showing the IRB console within metasploit which would give us another way to execute commands
39:45 - Taking a look at the MSFVenom exploit

[@primalgaming614]

Always great watching these, you're an inspiration!

[@wavey1236]

your vids always make me so excited to learn, great vid as always keep it up ❤️❤️

[@jamaledineamarir6724]

"As always, we're gonna start over the Nmap. So : -sC for default scripts sV enumerate versions oA output all formats put it in the nmap directory and then the IP address of 10.10.10...."

[@dadamnmayne]

this can take some time to run so i have alllllready run it, looking at the results, we have just 2 ports open.

[@portal_it_id]

Thank you so much for this! ❤️ Much love from Indonesia 👍🏼

[@Ms.Robot.]

This was as good as Netflix. Excellent and original digital entertainment. ❤️💋

[@ItsDoros]

Yes dude

[@uaman11]

*better than netflix ;)

[@TR1ckY_TV]

you're a legend! thanks a lot

[@McDaniel1]

A master at work 👌

[@user-pu4yr7jg9y]

Thank you very much sir ! Really ! I love you !

[@HerbertEduardoFernandezTamayo]

great walk through, how important is to code in bash!, also, it's helpful how to update our netcat shell with capabilities such as scroll and other functions. By the way, I have to review again the process of lateral movement from kid to pwn user and also I couldn't activate my up/down keys on my shell, I could get the flags but definitively I'll rerun this video. All the best and thanks a lot!

[@b391i]

Awesome as usual 😎👍

[@xxanonymous6578]

Thanks for the video Ippsec. Hope you could do some more HTB Battlegrounds in the future.

[@sakthis6689]

🤩

[@ameersabbah6407]

Amazing Videos

[@nullnull6032]

This is very very cool

[@orlaani1451]

Msfvenom has a vulnerability. What an irony.

[@lowrhyan567]

Using msfvenom for exploit msfvenom lmao

[@yashjha7152]

I used the stones to destroy the stones😂

[@TheKSH991]

@system32 he’s talking about msfvenom not metasploit

[@hadrian3689]

Funnily enough, this box pushed me from Script Kiddie to Hacker rank. So it was like, I was fighting myself? Ba-dum-pshh. Anyway thanks for the video ippsec!

[@ingamer5195]

the irony lol

[@wkppp4732]

Thanks ipp!

[@IBOY_]

amazing ,thank you 😊😊😊😊

[@mihail2607]

I love how you say "Werkzeug", gets me every time. Just for clarity, it's pronounced "Verk tsoik"

[@whoamisecurity9586]

Thank you for the video 😊

[@ericpickles8648]

The reason that APK exploit occasionally failed is that the b64 encoded exploit occasionally had a ‘+’ or ‘/‘ character in it, which messed up key tool. The way I got around it was to hex encode the payload instead 👍

[@ertertz9408]

This is what url safe b64 is for.

[@ericpickles8648]

@@ertertz9408 Yeah, but the command has to run on the other box, which didn't have a urlsafe b64 (I think). Thinking about it now b32 might have been an easier option.

[@ertertz9408]

@@ericpickles8648 | tr '_-' '/\053' | That did the trick for me :)

[@pcr9253]

How did you learn this

[@dopy8418]

Man that’s a nice set of wordlists you seem to have there for gobuster. All i have is Dirbuster’s default set. Did you create those ?

[@kibouo9302]

check github.com/danielmiessler/SecLists/

[@TheDarthsteve316]

@@kibouo9302 Yoooo

[@dipnetsec3995]

Very amazing the great master in action!

[@andrewSC]

Do you know any solution for .pahd?

[@anandsajee8949]

cool

[@heberjulio6303]

Why not using msfvenom to generate the evil.apk file instead of editing the file with vim? That's the way how i got the shell with a nc listener

[@rajanipatil34]

He is making videos on free machines let's goooooooooooooooooooooooooooooooooooooooooooooo....

[@SinanAkkoyun]

What kind of Linux are you running? :)

[@mozzie6838]

Parrot OS, with HTB's pwnbox theme

[@saketsrv9068]

God bless you ipp.

[@philipp__3671]

fun fact: Werkzeug is german and can be translated with Tools in this case

[@0m4n1]

😎

[@stark6314]

😎😎😎😎

[@unit4246]

What’s is name of editor text ?

[@pragadeeshkumaran8313]

Half way through , he doesn't look like script Kidde atleast for building a site , and now I just watched till at time snap 17:00 ( Nothin special here )

[@rumaispp2110]

😎cool

[@bigappleplug6021]

And for this reason none of my references are ever obvious. End of my project I go over all callbacks and rename them to something that is harder to assess.

[@susnoname]

this machines is HARD! I understand the scanlosers script after explanation (still not 100% clear but clearer) and I would never exploit it on my own...

[@hoshmandctf1]

Only Channel KZbin send me notifications about uploads.

[@ItsMeooooooo]

Strangely enough I started exactly THIS box about 30 Mins ago. Now I have to wait to watch the vid until I finished the Machine on my own.

[@3rg1s]

Hello ippsec

[@RishabhDeepSingh]

where is that ffuf course?

[@grandmakisses9973]

At academy.hackthebox

[@smartaid8028]

I was only able to get user.txt

[@mailmaarnaarjan]

GoSpy? Dont you mean psspy?

[@whoamisecurity9586]

But in my case it demands for the password

[@mmmdyarcavadl9004]

What is note taking app he uses?

[@imranthoufeeque165]

Obsedian...

[@malfoytech4601]

why don't you zoom little bit to see your screen more precisely. From next video onwards it would be great if you gonna do that.....rest things are good 👍

[@ansh2423]

Script Kiddie Don't go on name its not for kids at all...