HackTheBox - Snoopy

00:00 - Introduction
01:00 - Start of nmap, discovering ssh/dns/http
02:30 - Taking a look at the website
04:00 - Discovering a message about DNS, taking a look at the DNS and discovering zone transfers are enabled
09:40 - Identifying the website is running with PHP Enabled, then running gobuster
13:00 - Attacking the file download and discovering File Disclosure
15:35 - We got lucky discovering the File Disclosure filter bypass, using FFUF which would be make catching this more consistent
19:30 - Automating the File Disclosure by creating a python script
24:30 - Looking at files on the target, discovering the DNS Configuration which has the RNDC Key to update DNS
30:40 - Looking at the NSUPDATE Man page and then adding a the DNS Record mail.snoopy.htb and pointing it to us
34:24 - Using python to run a SMTP Server and then having Mattermost's forgot password email us the password reset
39:50 - Using the Mattermost bot to provision a server via SSH which causes it to SSH back to us
42:30 - Backdooring PAM with pam_exec and a bash script to log passwords of users logging into our box, and grabbing CBROWN's password
50:40 - cbrown can run Git apply as sbrown, looking for exploits around it and discovering CVE-2023-23946.
1:08:50 - sbrown can run clamscan in debug mode as root
1:11:45 - Looking at CVE's in clamav and discovering an XXE in the DMG Parser (CVE-2023-20052)
1:23:30 - Downloading a DMG File (sublime), then modifying the XML to put an XXE in, scanning, then exfiltrating the root ssh key

[@AUBCodeII]

What's going on KZbin, this is IppSec, and today we're writing a ransomware in Python to encrypt John Hammond's files

[@ianberdahl108]

I've not done this room yet, but I just subbed for the retired rooms. So excited to do this!!! Watching IppSec you can just take notes for later, every little quick tip or explaining he does is GOLDEN!!

[@AUBCodeII]

I like these videos because it feels like Ipp is a friend talking directly to me teaching me all that stuff.

[@wutangdaug]

The backdoor pam is great, thanks for the knowledge. I'd love to learn more about your tricks/tips about doing engagements.

[@TihomirKit]

I'm getting the same "efficiency" vibes from this video as when I go to my dentist and he's surgically precise and time efficient. :D What a masterclass. Great video, thanks!

[@pa-vl1kg]

Thank you for making the webpages and text readable.

[@maniakdemi3548]

Awesome... Been waiting for this

[@fernandopierola]

Love this!!

[@Ghislo]

I low key feel like I'll never be able to fully complete a box like this lol

[@ihavelowiq2723]

me too bro feel like not smart enough to think like this

[@BurtMacklin947]

You learn more every time you watch an ippsec video or pop an easy box. Just keep going and we'll all get there :)

[@StevenHokins]

Nicely done

[@user-sw9bs8mp3f]

Very cool! Thank you

[@daohiep]

Wow the pam method is cool

[@faraminesmailiseraji7777]

helpful, ty!

[@de-identified]

Thanks again for making these contents, but I do have a question at 13:09 , how would you know there's a 'file' parameter on /download endpoint? I didn't see you make any parameter mining work

[@diaahanna8882]

When you hit the download button and intercept the request , the download button is making a request to /download?file=something

[@de-identified]

​@@diaahanna888210:09 there's no such parameter

[@AUBCodeII]

@@diaahanna8882 This. However, if we didn't have that request, we would have to fuzz using a wordlist of parameters, like /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt.

[@fatewalker6463]

Awesome

[@snowden-IT]

thank you

[@AUBCodeII]

17:11 So local file inclusion only happens when there's a include(filepath) function on the vulnerable code? What do you mean by "it's not local file inclusion unless you get command execution"?

[@ippsec]

Yes technically LFI requires the include(), just leaking a file is not inclusion. It is just file disclosure

[@AUBCodeII]

@@ippsec I see. Thanks for the response and for all the knowledge shared!

[@sotecluxan4221]

Yep!

[@somebodystealsmyname]

Git does not really support file modes. It can only create files with 644 and 755 on Linux.

[@tg7943]

Push!

[@x.plorer]

1:59 Reference to Rocket racoon *89P13* 😮

[@ihavelowiq2723]

54:18 why we renamed it again. does it have something to do with the exploit

[@ippsec]

Bit earlier in the video where I go over it. The CVE says a symlink needs to be renamed. Technically I could of copied the patch from the previous time I did it, but it is easier to just re-do it so when you perform the diff, it already has the rename commands in the patch file.

[@AshishGRz]

Which os is this???

[@user-wu6eq6zm2y]

Parrot HTB