HackTheBox - Cerberus

00:00 - Introduction
01:00 - Start of nmap
02:00 - Looking at the TTL of Ping to see its 127, then making a request to the webserver and seeing it is 62
03:45 - Showing DNS is listening on Cerberos and exposing the 172.16.22.0/24 network
05:15 - Looking at Icinga, testing default credentials
06:20 - Fingerprinting the Icinga release by looking at javascript, using UI.JS since it looks like it changes frequently
09:05 - Cloning the repo, then writing a one-liner to hash all versions of ui.js and finding which commit the version off the webserver is on
12:10 - Finding a File Disclosure vulnerability in Icinga CVE-2022-24716, leaking some Icinga configuration files and finding a web users password
16:20 - Gaining RCE via CVE-2022-24715, which allows us to write a file to disk then change where the Icinga plugin directory is to get code execution
25:30 - Shell as www-data, doing some basic recon to figure out what type of virtual environment we are in via /sys/class/dmi/id/sys_vendor
29:00 - Looking at running processes and seeing sssd is running which allows this box to talk to the domain
30:00 - Looking at SetUID Files, discovering FireJail and privesc'ing CVE-2022-31214
36:00 - As root on linux, we can now examine the SSSD configuration and get a domain password
44:50 - Setting up a SOCKS Proxy via chisel, so we can use Evil-WINRM to log into the windows machine as Matthew
48:50 - Discovering ManageEngine ADSelfService Plus is running, finding an exploit
52:50 - Fighting with Chisel to get all the port forwards working, have trouble with two socks proxies
01:00:00 - Redoing our tunnels, doing a portforward on linux to get evil-winrm, then a socks on our windows target to access ManageEngine
1:06:10 - Running the Metasploit Exploit against ManageEngine and getting root

[@muhamadazim1678]

For me I really like u spend more time screwing and fixing around when an error happen.. it’ll give us more thing to learn.. keep it up 👍👍

[@meshelishaool8808]

I learn a lot from the video specially the tunneling, and I loved the "Get the version of the web application" part.

[@moonlessiguana1826]

Please don't stop making your videos!! We love you and your content

[@0xKalbani]

Thanks for the great walkthrough. For the tunneling issue, the issue was that you can not have two socks proxy listening in same port (1080) using chisel or other tools. You can here forward the socks connection to other port from chisel by running the command: ‘./chisel client ip:port R:socks:1081’.

[@ekadani5335]

I couldn't get the socks proxy to work with your command, but if I place the port in the middle, then the socks proxy will work. The command is: `./chisel client ip:port R:1081:socks`.

[@TheExcetto]

As someone who's begining to learn Your knowledge is impressive Learnt loads Keep it up 😁

[@AUBCodeII]

Ippenheimer

[@obscurus4103]

lmao

[@MoxResearcher]

Ipp is the BOMB

[@ThaLiquidEdit]

I like this for loop with git commits finding ui.js commit hash! Very useful!

[@boogieman97]

Awesome as always!

[@govil1000]

finding version using js files thats nice man

[@illusionsingh]

Amazing box After a long time

[@maixicek]

Really good job ipp 👍

[@monKeman495]

25:07 holy shit the greatest feeling ever

[@tobao6455]

love it man

[@snowden-IT]

Thank you my frined❤❤❤❤❤

[@LNA0x963]

very usefull👍

[@michaelakandi]

Amazing

[@BogdanDolia]

nice 👍

[@faanross]

first time attempting a difficult box - sweating buckets.

[@huntit4578]

How does your burp contain big text like i increased font size and it only increased tabs font size not data in repeater tab

[@vanshagrawal3056]

a bit late ig but you can increase the font size in inspector and message editor tab under settings

[@sand3epyadav]

I got lots of errors during snyk?

[@tg7943]

Push!

[@yajirushik2871]

Idk what's that, captain?

[@sreyanchakravarty7694]

First

[@y.vinitsky6452]

hey @ippsec just wondering have you been able to get openvpn 3 client to work with HTB?