HackTheBox - Writer

00:00 - Into
00:49 - Start of nmap
06:10 - Discovering admin login page, running SQLMap and discovering it is SQL Injectable
07:45 - Testing for SQL Injections in the username and password, discovering injection in the username
10:15 - The adminsitrative interface lets us upload images, failing to upload a PHP Shell
14:30 - Using the SQL Union Injection to extract source code via Load_file, then creating a python script to automate it
17:35 - Creating a Regular Expression in Python to grab only the data we want and be multiline
22:45 - Downloading a good LFI Wordlist and then using it with our python script to find interesting files
26:30 - Finding the apache configuration which gives us where the web application lives
27:10 - Updating our LOAD_FILE command to utilize TO_BASE64 in order to get around the web application doing HTML Entity Encoding
33:30 - Discoving an hardcoded password in the python flask web application
35:05 - Discovering command injection in how the web application handles URL's
37:20 - Simplifying our reverse shell by using a base64 cradle
40:04 - Having troubles uploading the image, create the image manually on our box, so the image upload form creates the request for us. Then getting a shell
45:10 - Discovering another database password within the second web application, cracking a password then switching to the Kyle user
51:00 - Using find to find files owned by a group
51:45 - Examaning the Postfix config to see it executes the Disclaimer script as John and is editable by our gorup. Edit the file, then sent an email to get shell as John.
55:00 - Showing John doesn't get all the groups assigned to him from the Postfix shell. SSH allows this group to be assigned to him
57:24 - Write access to apt.conf.d, creating a pre-invoke script which is a persistence technique to run code whenever apt is ran
1:01:04 - Showing the intended route of this box by editing a python script over SMB
1:04:30 - Using the Image Upload form as a SSRF in order to access the second web application listening on localhost

[@ivanvalentini9345]

To do file enumeration with the sql injection you could have used the option --common-file and pass it a wordlist then use --file-read= to read the file all with sqlmap. Great video :)

[@saketsrv9068]

Waiting for insane release,but kudos to your dedication !

[@Ms.Robot.]

Cool. This was very dynamic. Amazing. ❤️

[@nuridincersaygili]

This is pure gold! Thank you!

[@aminhatami3928]

Thanks for your great videos.

[@darkivy7207]

fantastic guide thank you!

[@uaman11]

I’m on my 5th day of watching this this is a strenuous video 🤯 but I love it

[@AshishKumar-gn9pz]

First like first comment love from India ippsec

[@lonelyorphan9788]

Ippsec rocks!!! 🙂

[@googlebaba7510]

Thanks for such a nice content . Please try to make some videos other than ctfs so that we can learn some extra things from you Thank you 💗

[@tortotifa5287]

When you wanted to crack the hash using john, actually you were right! You needed to add a $ in front of the hash as seen on your google research

[@shay110020]

Hey ippsec! I have a suggestion if you didn't know about, you can "copy as curl" the request in burp or the network tab in firefox, then convert the curl to a python script by some online tool and you have a python script of the request you've made! :)

[@loqpa2364]

There is a copy-as-python-request extension in burp, works like magic.

[@pswalia2u]

Great work! I have one doubt, why we are supplying absolute file path to image_url param. Like this file:// . I mean this webserver might alread be running in web root, in that case relative path to file should work.

[@arachn1d13]

Does anyone know why sqlmap wont work with a UNION based technique on the login page? It seems to only work with time based blind which is a pain.

[@cosmicrisis5699]

Did the box get changed after this video? The writer_web directory isn’t writable for me despite using smbclient and when I finally got in the box I saw that it wasn’t listening on port 8080 at all

[@BartVerhoeven1992]

Instead of these regex, that might be buggy in some situations, and on top of that aren't super easy to construct... Why don't you use xpath expressions to select your data from the html?

[@ippsec]

Primarily because I'm more comfortable with regex and can do it quicker.

[@infosec6253]

Got it

[@gingerman942]

Can we get a log4j video? Maybe you exploiting the vulnerability?

[@johntheocharis573]

Why are your views going down....

[@orxanovn5057]

this is lab very very hard

[@oy9804]

great but One video a week is not enough

[@neunzehnvierundachtzig]

Bro KZbin is not his job

[@damnmayneunfiltered]

he's also mad consistent when you consider the number of videos he has to the number of retired htb boxes...plus this is the best free training by far.

[@SuperSohaizai]

Add on to that, he does not only run the box one time. He has to run it a few times, check how did other people do it and includes those information as well. And then there is UHC series too

[@mtech1935]

instead of running directly john u have to use if john is installed in opt directory then do this /opt/run/john hash.txt - -wordlists=/usr/share/wordlists/rockyou.txt this will load the hash file idk why but this works for me instead of running john directly