HackTheBox - Stocker

00:00 - Introduction
00:56 - Start of nmap
02:15 - Running Gobuster in VHOST Detection mode to find the dev subdomain
03:50 - Intercepting a request to dev.stocker.htb and seeing an connect.sid cookie and x-powered-by header saying express, both indicating it uses NodeJS/Express
05:00 - Explaining why I'm trying these injections
07:00 - Bypassing login with mongodb injection by setting both username and password to not equals instead of equals
09:10 - Playing with the e-commerce store and seeing it gives us a PDF
10:45 - Using exiftool to see how the PDF was generated
12:05 - Inserting an HTML IFRAME when we purchase an item to see if the PDF Generated will include local files
17:00 - Extracting /var/www/dev/index.js and getting the mongodb password which lets us log into the server
19:50 - The order numbers don't appear to be that random, looking at the source code to identify how this is generated. It's just mongo's object ID which is heavily based upon time stamps
26:00 - Looking at sudo, we can perform a directory traversal to execute run any .js file as root
27:50 - Showing that you can now put regex in the Sudoers file which would fix this exploit

[@jojobobbubble5688]

I feel like I'm learning a lot from just watching your videos even though I'm not on the HTB platform (yet, because this newb needs THM) and I feel like watching your videos is the best "test of my knowledge" as I follow along till I get lost. Then I just watch for fun, while still learning!

[@ITSecurityLabs]

That’s a good one! Thanks for the sidelines , I learn a lot from those

[@rastawarlord]

Sidelines are real life

[@jmprcunha]

I always learn or recall something with your videos. Thank You IppSec!

[@Ms.Robot.]

Thanks. ❤ I learned a whole lot. This one was trickier.

[@abdelhamed8359]

Awesome as always ❤

[@souleymaneadellah1176]

You finally got wappalizer lol. I was always wondering why you didnt have it

[@trix1073]

Whatweb is also good tool

[@tperrak]

Thank you ippsec!!

[@somebodystealsmyname]

While you tried reading the /proc files, you forgot to use the returned id and still used the id_rsa one.

[@flashb4cker]

great video

[@AP-rv6kk]

Great video again. Why do you use Parrot instead of Kali? Kali seems to be more refined.

[@lewis6782]

An alternative solution to viewing the text in the is downloading the pdf and using pdftotext to view everything.

[@FinderTheIcewing]

The first thing i noticed is the new etc/hosts format. Is there a reason why it changed?

[@ippsec]

No idea why it changed.

[@sand3epyadav]

My heart ippsec

[@monKeman495]

please do an oauth code flow box if their any

[@tg7943]

Push!

[@zoes17]

32:10 yeah there are 7707 orders, 6200 more than Zerocool's worm crashed in systems...

[@baravind719]

What labs i should need to solve if i want to be a pro hacker in HTB

[@noobmohit2206]

2nd

[@sreyanchakravarty7694]

First

[@Mike-cp1tj]

no educational value in this one. cant be a psychic every time knowing just the right thing, like doing the vhost scan right away, doing just the right nosql payload in 10 seconds, or took 10 second and doing chromium exploit - give me a break... if you know the solutions to the exam you can always look like a genius

[@ippsec]

The box was blooded in under 10 minutes, with many other solves right after that. 1. Most people will start with a VHOST Scan, always have things running in the background 2. NoSQL is pretty trivial there. 99% of Express Apps use NoSQL, so that's why you'd start with it. 3. The PDF Exploit there is also pretty common and covered several times on this channel When I solved this box, it probably took me less time than the video length. The mindset you have is harmful in my opinion. It would be like calling "Cold Readers" or "Mentalist" psychic, when they are just experienced at recon and asking the right questions. The same goes for applications, when you get in a routine and do these types of challenges every day. What can be exploitable sticks out, seeing Express in the server header probably means nothing to many people. But to the experienced it changes things up greatly.

[@shades_dior]

great video