HackTheBox - Unicode

00:00 - Intro
01:00 - Start of nmap
02:20 - Registering and logging in and examining what a regular user can do
03:30 - Playing with the file upload capability
04:20 - Discovering there is a JWT in our HTTP Request, examining it to see it is RS256 and has a claim
07:55 - Explaining how we are going to exploit the Claim Misuse vulnerability in this JWT
09:45 - Creating a JWT Header that will have a modified URL for the claim, website says its an invalid key but doesn't reach out to us
12:20 - Using the redirect functionality on the web page to allow us to place the websites domain in our JKU Claim
15:10 - Modifying the JWK File to place our own RSA Key and generating one with ssh-keygen and openssl
18:00 - Showing us pulling N and E out of the RSA Key
21:30 - Converting the SSH Public key into a Certificate
24:24 - Updating the JWT to change our name to admin and finding a LFI Vulnerability
27:27 - Attempting to use WFUZZ to bypass the filter
33:40 - Giving up fuzzing wtih wfuzz
35:10 - Explaining why I'm going to try testing for unicode normalization and what it is, grabbing a payload from HackTricks
37:10 - Exploring /proc/self/ and hunting for the location of the webapp
39:02 - Finding the python application by using the /proc/self/cwd directory, then grabbing db.yaml and getting SSH Credentials
42:20 - Discovering a TREPORT Binary, which is a compiled python file
43:45 - Discovering the TREPORT Binary uses curl, which is weird
45:20 - Discovering the TREPORT Binary will allow us to use the file wrapper if we bypass the filter
46:50 - Bypassing the space filter in the TREPORT Binary using brace expansion in bash and having curl write the flag to /tmp
49:00 - Downloading a SSH Key and allowing us to login as root
50:00 - Examining the Web Application to show the Unicode Normalization Vulnerability
56:30 - Looking at the user table, to discover admin doesn't exist
57:58 - Finding out the login form was supposed to display errors but didn't because of a lacking some Jinja2 Templating Code
1:01:20 - Flailing around fixing the template to display error messages

[@gelzki5632]

The beyond root part always has a valuable learnings. Thanks for doing it always

[@NobusHK]

root part was damm silly :D

[@NobusHK]

lol i was just read the flag :)) i din't know the part with output think :)))

[@allenxd]

The privesc was sooo good. learned something again thanks Ippsec!

[@massylii]

Love from #ALGERIA 🇩🇿 💜

[@shaikhshafeen]

I have recently started watching full ads since I got no other way to support you atm. :(

[@pythonxsecurity8287]

waiting for fingerprint machine 🔥

[@ghsinfosec]

I think 'Ctrl +W' is the hotkey to delete back one word. Usually with base 64 encoded stuff like JWT's it will delete the whole cookie in one shot

[@definitelyno]

Yes. Another tip: CTRL-X-E will open the line in $EDITOR. I use it every now and then.

[@LMDAA2LP]

The good Saturday Evening Program in Form of an Ippsec Video. Is it possible that the second chaptermark is wrong? I think you wanted to write start of the nmap, not start of the intro. As always, good video otherwise.

[@ippsec]

You are correct, good catch.

[@kalidsherefuddin]

The great course

[@NVTFT]

nice

[@shashiravula8885]

I wonder user 'admin ' (with space) works..?

[@professionalcat9928]

pogging

[@abdosama]

Thanks a lot for your helping contents, you helped me get the eJPT cert and preparing for the OSCP, any advice on that ? Thanks

[@real.xplo1t]

ALT+Backspace can delete one word at a time, fyi :)

[@axelvirtus2514]

Hey ippsec no offense but what the point from bug bounty certificate from HTB?Its not like oscp or sans when employees ask for.

[@ippsec]

From my opinion -- If you're doing certifications just for employment purposes, you are doing it wrong. Certifications are a good way to measure progress over time, if you check any interview out, I'm sure I talk about it. Just go to ippsec.rocks/contributions and use that search. The live recon with naham is the most recent

[@lazarfilipovic9953]

first lel

[@NobusHK]

@@CyberAndy_ last one at the moment :(

[@sand3epyadav]

Ippsec coffie

[@Vogel42]

33:18 CTRL+W

[@ippsec]

Thanks!

[@vfuse7414]

@@ippsec omg I knew something Ippsec didn't know haha. Never thought I would see this day