HackTheBox - Forge

00:00 - Intro
01:00 - Running nmap finding a filtered port with some open ones
03:30 - Running GoBuster to always have something running in the background
05:00 - Playing with the Upload Form
07:20 - Playing with the Upload from URL to see what library connects back to us (SSRF)
09:30 - The Upload From URL has a blacklisted address, playing with it to discover what is blacklisted
10:55 - Bypassing the URL Blacklist in the SSRF by changing the case of words
11:45 - Running a virtualhost bruteforce within gobuster to discover vhost
13:10 - Bypassing the URL Blacklist in the SSRF by creating a webserver that will send a redirect
16:50 - Using the SSRF to download admin.forge.htb and discovering ftp creds and another SSRF
18:20 - Using the SSRF to use FTP
19:20 - Encoding the IP Address as hex to bypass a blacklist
22:10 - When specifying a directory in the FTP with SSRF need a trailing slash explaining why
23:10 - Downloading id_rsa and then logging into the machine
24:10 - The user can sudo run a python script, which stands up a debugger on a random port
26:13 - Doing a nested tmux so we can run the python script and then use netcat to connect
28:50 - Getting root
30:55 - Explaining how to harden the blacklist to prevent the easy bypassing
34:30 - Looking at how admin.forge.htb added FTP Support
36:50 - Thinking there's an RCE but there isn't, shlex is a good filter
44:30 - Getting frusterated, lets break this down and see whats stopping our RCE
45:40 - Playing with Shlex to discover it is what prevents the RCE

[@randomguy3784]

The 'Beyond Root' portion was extremely enjoyable! 😇👌

[@damnmayneunfiltered]

yep. kept me watching the whole 48 minutes

[@mertfromhell]

you are an absolute legend bruh no matter how much time passes you still doing this stuff even now

[@swapnilbhosale2230]

Amazing. We as a community owe you my man.

[@atefbouallegue605]

Today i learned that you can do SSRF inside of an SSRF 🥳 Thanks Ipp 🙏

[@damnmayneunfiltered]

2:26 MVC is both a methodology for software engineering and a mindset. model is thought of as the brains of the application, view is though of as what the end user sees, and controller makes the model and the view work together. This way, you can change something in the logic of the app without changing the view or the other way around. its handy when your application is going to be very large.

[@abdirahmann]

This was beautiful to watch :)

[@sand3epyadav]

Nice Video sir, you are my best teacher....

[@morphein]

the last part was super cool, I like that you try things and they don't work, it's even better than success LOL

[@pampipipi8254]

Love you man

[@MrMeLaX]

Thanks a lot for your work

[@techtutorials7026]

Thanks for video

[@tomasofficial.]

I had to say goodbye to my main linux machine.. storage error. So sad, I had everything set-up. Damn. But, new machine = better knowledge so kinda gg : ) nice video, wow.

[@PrinceHigu]

Would you mind sharing your Machine Specifications? For the physical machines (kraken and others) you use and the hardware allocation of VMs as well?

[@SaadiBabar]

Great video and got new things to learn , Thank you.

[@saurabhshinde1855]

Netcat redirect request crafting stuff was awesome.. So much to learn from you Ippsec.. Please keep it up

[@extravenger9137]

Great as always. Ippsec is there any chance we could have a new video on AV Evasion? it would be really cool to learn more about this subject, ik there are so many around the internet, but the way you describe things, i got used to it xD

[@ippsec]

If you use ippsec.rocks, I'm sure you can find a method that still works.

[@defyteryt2452]

Nice

[@flipponator]

Just wondering: Is the time in your VM off, or do you just like to record the videos at night time?

[@mathiasensimon]

It might be an am/pm clock

[@ippsec]

Time is correct in my VM. This video I was recording at 1am as it was just a busy week and couldn’t squeeze it in anywhere unless I just sacrificed sleep. I’m normally in bed by 10 or 11.

[@innerfire369]

Hello IppSec, I watch almost all of your videos and can I ask you to make more about Active Directory attacks. Thanks!

[@theebanb5183]

what is the keyboard shortcut to send requests to server from burp repeater tab?

[@ippsec]

Go to ippsec.rocks and type in "burp repeater"

[@sreyanchakravarty7694]

Thanks for the video

[@israelrabi5016]

what distro you use?

[@velomeister]

He uses Parrot OS.

[@israelrabi5016]

@@velomeister thanks

[@souleymaneadellah1176]

An Ipssec vid? Thats my afternoon sorted

[@MoeJama5454]

Long videos but worth it

[@prakasakatheilluminator6904]

Why i like ippsec's videos more than any other youtube cuz ippsec show every single method which is available in Box...

[@damnmayneunfiltered]

I didnt like this box.

[@AUBCodeII]

What's going on KZbin, this is ippsec and I'm gonna pin this comment for no reason.

[@skinnyelephant7351]

shlex.quote was the most fun part, when we (myself and you) could have just googled/stackoverflow it more, but spent time fuzzing it too much and then finally realizing its for input sanitization. lolllllllllllllllll anyways, like always, this was great to learn.

[@ippsec]

Yeah Google returned a lot of fancy words at first and scared me away. Just goes to show ho much more you can learn after getting the root flag

[@skinnyelephant7351]

@@ippsec 💝💝💝