HackTheBox - Derailed

00:00 - Intro
01:00 - Start of nmap
02:50 - Looking at the HTTP Headers, discovering Cross Origin and rails
03:50 - Testing the Clip Notes functionality for SSTI/XSS
06:30 - Using FFUF to fuzz all Clip Notes to see if there's an IDOR Vulnerability
10:30 - Looking at how the site is build, discovering Web Assembly
13:00 - Sending a long string for the username and discovering the data overflows and goes into the Date field
15:50 - Using Pattern Create to find where our payload hits the date field
17:55 - Testing for XSS
21:20 - Seeing Cross Origin blocked us, adding the headers to get it loading javascript from our server
25:50 - Using XMLHttpRequest in our XSS to control the victim's browser and see what is on /administration
31:50 - Looking at the Administration page, discovering there is a File Disclosure
38:30 - Grabbing /etc/passwd and then getting some Ruby Source Code
48:00 - Discovering userinput is passed to open() in ruby, if we put a pipe as the first character it will execute instead of reading
49:45 - Getting a reverse shell
51:35 - Looking at the SQLite Database and cracking a password to switch to the openmediavault user
56:55 - Looking at the OpenMediaVault RPC Endpoints to see how we can interact with it
59:40 - Editing the OpenMediaVault Config to add a SSH Key for Root
1:09:20 - Another way for root, making a debian package then using the OMV RPC to install it

[@mounir7320]

Absolutely impressed by this incredibly realistic machine! I'm thrilled to see that HTB has taken a significant leap forward in the realm of cybersecurity training platforms

[@fabiorj2008]

Thanks for your time and dedication to teach. Thanks a lot.

[@0xmmn]

the way to get a shell using the open function on ruby was amazing.

[@offensive-operator]

I wanted to take a moment to express my deep appreciation for the incredible content you've been creating. I have over 5 years watching your content. Your videos have been an invaluable resource for me and countless others in the cybersecurity community. Your dedication and expertise are truly inspiring, and I'm in awe of the amazing job you've been doing. I have a suggestion that I believe would be incredibly beneficial to the community. If you could consider making two videos, one focused on "Privilege Escalation Methodology for Windows" and the other on "Privilege Escalation Methodology for Linux," where you explain the concepts and techniques just like you do in all your videos, I am confident that these videos would become an instant hit. With your guidance, I can envision these videos receiving well over 500,000 views in the first month alone. Your ability to motivate and educate is unparalleled, and I still find myself inspired by your work even after 5 years. Your impact on the field of hacking and cybersecurity is akin to that of an iconic figure, and I genuinely believe you are the epitome of excellence in this domain. I hope my comment serves as a testament to the tremendous influence you have had on aspiring cybersecurity professionals like myself. Your contributions have been nothing short of revolutionary, and I wholeheartedly thank you for sharing your knowledge and expertise with the community. I have faith that you'll continue to achieve great things, and I'm eagerly looking forward to any future content you produce. May you be blessed with even more success and recognition as you continue to make a positive impact on the cybersecurity world. again THANK YOU SOOOO MUCH MAN!!!. I have no words to describe how thankful I feel with you. a have learned a ton because of you. this comment comes from my hard sincerely LORD GUCCIF3R.

[@maixicek]

Awesome video, thank you!

[@angeleeh]

The foothold on this box is great

[@spacenomad5484]

Regex matching the CSRF-Token (or any other value between quotes): Instead of hard-coding the text behind quotes, I like to use "([^"]*)" [^"] matches every char that is NOT " (^ negates the character group, [^a-z] is "everything but a-z"). In plain words: Capture everything after dblquote up to the next dblquote.

[@nightermike]

Solved the box by using the build in js-function of the page getContent like this, then you can write the js-payload in the clipboard note itself and no need for fiddling with the cors header, but was interesting to see how other people solved this box :) aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

[@raihanahmmed6635]

Great video🎉🎉. Need video on registryTwo and coder.❤❤

[@sreedeepay2101]

Hats off❤❤❤❤

[@ThisIsJustADrillBit]

It would be crazy to see what kinda machine IppSec woukd make lol. I feel like everything just makes sense when he explains it.

[@AUBCodeII]

Hey Ipp, let's watch Barbie and Oppenheimer with the homies

[@ManyMan1338]

Ippsec is one the Best

[@cashpay50]

Wow, i dont do hack the box, does it have a guide for the box. Or you just approach it naturally and find the vulnerabilities?

[@eklypzn]

How many 1080's do you have in The Kracken? 4 or 8?

[@AbdennacerAyeb]

You are doing a great work for the community out there, and helping newbies to start in cybersecurity. Thank you a lot

[@tg7943]

Push!

[@sand3epyadav]

I love ippsec

[@yoseflevy6567]

Hi Ippsec i enjoying your content so much thanks a lot. 1 question tho can u pls make a guide how to build a medium machine on HTB?

[@MrChrisLia]

hmm I could tell this was one of your more uncomfortable boxes, as the explanations weren't as deep and thorough as previous videos

[@huntit4578]

Its 8 months old box

[@sotecluxan4221]

!