HackTheBox - SneakyMailer

00:00 - Intro
00:45 - Start of nmap
03:10 - Poking a the websites
04:20 - Starting gobusters in the background while we look at the site
07:00 - Grabbing a list of emails off of the website
08:40 - Using SWAKS to mass email users with a link
14:45 - User went to our website, grabbed credentials
17:50 - Failing to do FTP User Enumeration, do this at the end of the video
19:00 - Failing with Thunderbird to login
22:30 - Switching to the Evolution Mail client to check mailboxes, finding FTP Details in Sent Mail
28:40 - Using wget to mirror the FTP Directory, then poking at PHP Files
30:50 - Showing pypi/Register.php, which should have been used during the phishing stage
31:30 - Checking if we can upload files to the FTP Directory and finding the dev VHOST
35:00 - Shell Returned
37:00 - Discovering a HTPASSWD file, then cracking it with hashcat
39:50 - Checking out pypi.sneakycorp.htb:8080 and finding a pypi server
41:00 - Creating a Malicious PyPi Package
43:30 - Adding a reverse shell to our pypi package
44:45 - Creating a pypi configuration file
47:00 - Uploading the package and getting a shell as low
50:10 - Checking sudoers, and finding low can run pip3 - Use GTFO Bin to get root
53:30 - EXTRA: Enumerating the FTP Users by creating a quick webapp then using FFUF against it.

[@shellbr3ak443]

The Extra part of the video is AWESOME, can't thank you enough for these amazing videos.

[@jessee_jonessss]

I have been waiting for another video for sometime now. Thank You

[@mrd7901]

Saturday means IPPSEC videos ❤️❤️, lots of love sir ❤️❤️😍😍😍

[@oriel360]

love your vid and explanation, keep up the good work

[@mehmetux4186]

nice tutorial again. thank you ippsecc. sometimes I also make writing mistake but I can't find my mistake quickly.

[@omran.alshehabi]

Learned a lot as usual, thx

[@veritatas678]

That php webserver part at the ned was really helpful

[@highlightchannel7845]

Voice of a legend

[@timkatsapas]

That stupid pypi package tripped me up. I was trying to reverse shell but kept having syntax errors. *TRY HARDER* . Thanks for the awesome video. Damn you are fast at enumeration, sheesh.

[@0xtz_]

The first , amazing 😉

[@AhmedAbdullah-pp2mp]

سبقتني lmao

[@0xtz_]

@@AhmedAbdullah-pp2mp hhh

[@Deaple]

Wow this last tip to use apache's http thread for enumeration blew my mind

[@magbenyo]

i have been waiting

[@j4ck_d4niels]

Sat night with ippsec, always fun :)

[@celikom]

Awesome !!!

[@kret63]

That was sneaky :)

[@ninostephen]

The thing with thunderbird is that it sometimes fails to determine the correct configuration values while setting up the account. It's usually DNS. Could be others too. The solution would be to manually set the values. By values I mean the port, server hostname, ssl and stuff. Setting it to the non-ssl values would resolve the issue 🙂🙃.

[@williamwambua7710]

You should most definitely make a tutorial video for us dummies!!!

[@nikohegeheiskanen]

Man i went full telnet on this box :D made a python script to send all the mail using pwn tools and manually checked the mail with telnet too :D

[@aminhatami3928]

TNX.❤❤

[@azelbane87]

Awsome

[@techlegoblocks62]

Great video, why you mentioned you dont crack in the same box / VM? just curious on best practice on this, sounds interesting to set up a box only for this, got a spare Pi :)

[@ippsec]

Cracking can be very cpu/gpu intensive. You want it to work as fast as possible. Doing it on the machine you are doing other things slows it down. Pics aren’t good for this because they aren’t that powerful

[@techlegoblocks62]

@@ippsec awesome gave me an excuse to set up.something new. Each video is a library of knowledge, thanks!

[@gauravpurswani6671]

I think instead of using some tool for ftp-user-enum we can just create a 5 line python script, with socket programming and if else statement. Please Let me know if I'm wrong. Thanks for making such amazing videos. The way you explain things is 🔥🔥, I have learned a lot from your videos...

[@ippsec]

Yes. I believe I mention you can do that, the purpose was not to show how to code the entire enumeration piece yourself. It was showing how to put some middleware together in order to use existing tools in unintended ways. Which greatly speeds up the time it takes to fuzz simple things. I think most people try things like you mentioned and write the perfect script. However, when working against a clock this isn't always the best way.

[@gauravpurswani6671]

sorry maybe I was not attentive in the part when you were talking about the script, I will go through the video again. Trying the tools to use the way in which they are not intended, to achieve something else, sounds supercool. I will start doing things in that way. Thanks for replying!😄

[@mossyhorn2147]

@IppSec why don't you like cracking on a VM or your host computer??

[@mhamadyahya1]

What operating system you use? Parrot or kali linux?

[@element-1254]

In this video he is using ParrotOS.

[@abdosama]

FYI The password you got "soufianeelhaloui" is a moroccan nameand last name :)

[@Socversity]

It’s awesome. But why don’t you create course on it? For example, make a video on smtp, explain, why it’s important. What kind of things we should look for, what are common misconfigurations in smtp. Honestly, it would be appreciated. If you can start a short series on each service which can be exploitable. Thanks

[@ippsec]

Go to the HackTheBox academy for that type of stuff. academy.hackthebox.eu

[@Socversity]

@@ippsec thanks, but I couldn’t find such kind of stuff.

[@ippsec]

Nothing SMTP but that is where you can find it when/if I do create it.

[@Socversity]

@@ippsec thanks, appreciated 👍👍

[@MaximusHyde]

isn't ippsec doing enough for you already?

[@ahmadhama2491]

3:40 "it looks like we have Nginx running on php" LOL thanks ippsec for the great video again

[@Max-mz3is]

24:39 Port 465 smtps is closed, How were able to connect via 465, it should be default 25?

[@LoayMatar]

So that means that it was probably wasn't closed, it just didn't show up in the nmap scan because the scan was for the top 1000 ports, so maybe 465 wasn't in the top 1000 port. Maybe if he did -p- to scan all ports it would have showed up.

[@GabrielHenrique-yl3jc]

What is your operating system? What is your operating system theme?

[@kathib2571]

does watching this help to gain better IT-skills to get a sysadmin-job or else? or would it be wiser to watch something else?

[@CJ-rt8zy]

nope

[@kathib2571]

@@CJ-rt8zy something else?

[@Sleep-travel]

Love from India 😍😍

[@JuanBotes]

Thanks IppSec

[@LoayMatar]

I still don't understand how a user clicked on the link... obviously there aren't real users, so how did he get a click on the link in the phishing email?

[@vonniehudson]

Expert use of man pages

[@SaurabhMeherX]

Can someone please tell me why do we add the url to /etc/hosts file

[@ippsec]

Look up Virtual Host Routing, it’s just a way for a webserver to identify the site your going to

[@nikohegeheiskanen]

Also look into how dns works 👍

[@Zygorg]

23:10 port 443=993?

[@elchinefa9524]

he confused with https but 993 is ok it is for smtp ssl/tsl if i do not make mistake.

[@tymekl1509]

I don't know if this is for linux, but I used it for a long time, and it works, so.... yeah (Email client) www.oeclassic.com/

[@GC-qe8vc]

Ippsec your content is great, but try slowing down a bit! You are missing obvious error messages in your effort to type and click as fast as possible. There's a false impression out there that 'good hackers type 300 wpm and never look at a GUI window for more than 50ms' but that's in Hollywood not in real life. Anyway, thanks anyway...