HackTheBox - Trick

[@ianmusyoka9717]

There was another way of getting a shell using that login which is sql injectable and INTO OUTFILE to drop a shell and execute using LFI... The shell will be www-data but to escalate to the user you dig through nginx config file find that other subdomain Nice walkthrough!!!. The SMTP route totally didn't cross my mind

[@hackersworld2974]

teach me I'm a noob

[@DanielEhlmann]

I’m only now getting deep into pentesting and offensive security after some years of managing teams of cybersecurity and IT personnel, and it really feels like I’m unlocking a whole new side of cybersecurity that’s been veiled from my eyes. It’s great. Excellent content.

[@SiloGaming777]

Great to see the sqlmap things. I didn’t know any of that. The speed ups you used for it were excellent to learn. So thank you.

[@DeadAksRab]

Awesome. I did the box but was waiting for this video and yup I learnt 3 new things again. Brilliant.Thanks ippsec :)

[@adityatelange]

3:46 AXFR is Asynchronous Transfer Full Range.

[@DalBileAbas]

Salute Ippsec for the video and revealing other ways to gain RCE via the access logs and mail

[@adonistarcio]

I didn't think this was an easy box. But great to see how you did it

[@sand3epyadav]

Easy box

[@romilthakkar404]

Learning a lot from it. Thank you, appreciate it.

[@SakayaNagii]

Ippsec = 🧠++

[@h4gg497]

It doesn't use TCP just for zone transfers. Also for anything that's greater than 512 bytes. DNSSEC, IPv6 etc increase the response size. Although servers should respond to request for any records over TCP if TCP is used by the resolver. RFC 7766 is a good read.

[@h4gg497]

There was also an EAR vuln on the preprod-payroll site that offered an easy alternative auth bypass. The response size on the 302 redirect to login.php gives it away.

[@h4gg497]

You see it in the index.php code at 10:16. Missing exit; statement after the header('location:login.php').

[@lonelyorphan9788]

Another awesome video 🙂!

[@anselmpeter]

Awesome.. things go very fast with ippsec thanks YT have speed control.

[@formsight5927]

cool!

[@damuffinman6895]

Ippsec, how much do you get out of doing the easy to medium boxes? Does it just help to get your methodology down or is it to easy to have an impact.

[@celticfans1]

I was wondering why the privesc doesnt seem to work by changing the actionstart instead of actionban? seems easier by just restarting but it's not being executed, why?

[@celticfans1]

with sqlmap we had the FILE privilege, but I tried to write a file instead of read which worked. However, I couldn't write to .ssh to try and get a shell that way. Could someone explain why this wasnt possible and we only tried reading in the video?

[@FMisi]

It was an interesting box to pop

[@hackersworld2974]

how does he scroll so fast in copy mode in tmux ??

[@tg7943]

Push!

[@DeadAksRab]

How can the "database management system users privileges" be found manually without sqlmap?

[@ippsec]

If you go to ippsec.rocks, and search "file priv SQL", you'll find a video with time stamp answering this question

[@and_rotate69]

33:20 why didn't you just change the perms of the bash shell to be accessed by anyone with +s? is there a downside to it? cause i always use it xD

[@ippsec]

That's a bad habbit to be in as it leaves the server in a much worse state than before you got on it. Forget to change it back and bash will be a privesc for the next person, even if you fixed the vulnerability that allowed you to make it SetUID. A shell in /dev/shm will be erased upon reboot and if you patch the thing that executed it and you need to re-exploit the application to trigger it as another user. It's just safer.

[@netcatter]

@@ippsec What if you copy the /bin/bash into /tmp/bash and then modify the SUID of /tmp/bash instead? Then after escalating, delete the /tmp/bash

[@oz.3133]

I'm not getting the root reverse shell after pointing actionban to my reverse shell script on iptables-multiport.conf, restarting fail2ban and subsequently failing ssh. What could be going wrong?

[@celticfans1]

i have the same issue

[@InfoSecIntel]

Hey this is not related to this vid but what is your favorite not os specific command to test for rce that may be blind?

[@ippsec]

Ping against a DNS Name and look for the ICMP/DNS request.

[@S2eedGH]

Thanks for the great walkthrough. there is a thing I don't understand clearly on 20:13 . could you please explain it one more time? How the "include()" line should look when php filter working on it?

[@ippsec]

in order for php filter to work, it needs to be at the start of the path to include. So if the include is include( "someFolder/" + $userInput), a PHP include won't work because the folder is at the start of the path.

[@tanja84dk1]

My first thought why you cant see the enviroment is proc is prob as you say that nginx is running as root ( tbh I havnt done the box myself ) and I feel the reason the reason the website is running as michael is proberbly because the php-fpm is set to use/run as michael in the php-fpm pool configuration

[@sand3epyadav]

Everythink is a trick

[@jamesalexander655]

First

[@pranav9068]

Bruh i used dig -x and it gave a weird ans

[@beezball38]

I got preprod-marketing by fuzzing. it makes the payroll domain seem like a diversion unless you figure out how to SQL map properly, which I clearly did not very informative video as always.

[@yuyu-ce4fz]

nice