HackTheBox - Talkative

00:00 - Intro
01:00 - Start of nmap
02:45 - Taking a look at websites, making note of all login prompts (bolt, rocketchat)
07:15 - Start of looking at Jamovi, using the Rj Editor to execute code and get a reverse shell
09:10 - Using cat to send files over the network to our box and viewing the bolt-administration document
12:50 - Taking a credential from the document and logging into Bolt CMS
13:40 - Editing a theme in bolt to give us code execution
19:00 - Using script to get a full PTY since python isn't on this box
20:40 - Looking for passwords for bolt, finding a sqlite database
25:45 - Getting the ip address of the box via the hostname command since ifconfig and ip were not on the box
26:40 - Using /proc/net/tcp to get listening ports
29:20 - Using the docker container to SSH into the host computer via its docker IP
31:25 - Using ps -ef --forest to view running processes, can see inside docker containers to find mongo
34:50 - Using bash to perform a portscan based upon the exit codes of echo'ing data to a network socket
36:40 - Setting up chisel so we can talk to the mongo port
39:00 - Using MongoDB Shell to log into mongo and change the user we created to become an administrator on RocketChat
44:25 - Using Web Hook Integration in RocketChat to get RCE as an authenticated admin
49:15 - Reverse shell returned
51:00 - Manually identifying our Docker Capabilities with /proc/self/status
55:40 - Using cat to download files from the network and downloading the shocker exploit which should exploit this capability
1:02:30 - Was using the wrong shocker exploit to exploit cap_dac_read_search. Downloading the one to write files and putting our passwd file on the box

[@h0ck3yphreak]

You know what I love about watching IppSec for all these years? Still to this day, to hear him say, "What did I do? Oh, I'm an idiot", when I do the same exact thing during my studies... It's nice to know that even at an elite level that ipp is at, we all still make mistakes. Love the work sir.

[@aaronflippens2149]

I always love watching ur videos. Keep up the great work

[@lonelyorphan9788]

Great video! 🙂 I love watching you think through stuff when you're trouble shooting. It really helps me with my thought process.

[@MichaelJohnson-br7zz]

Its great to see the unique ways to copy across files and to also spawn tty shells. Thanks for this. I found watching this video and following along a great learning experience. Im even hand writing notes into a book that I hope to turn into my own pentest manual.

[@D3athByF1r3]

Just got introduced to this guy from reddit...you are what I aspire to be lol. Your knowledge level is insane. I'm struggling at tier 1 in HTB, and you're blowing through this stuff like nothing

[@nyzkin]

Very good Talkative machine and excellent write up

[@_filipe.miranda]

TNice tutorials might just be the first motivational comnt ive ever seen on a tutorial vid. ga thanks bro

[@howismake]

Bravo great tutorial

[@chukwunyereexcelgreat7595]

This is great

[@getoutmore]

Im a simple man. I See ippSec Box Video I Hit Like.

[@Ms.Robot.]

This one seemed more challenging. "When we were doing our exploit before, we accidentally wiped our copy, " Who's we? 😁🤩😃

[@darkcat7872]

Can someone explain. Can't connect to ip address of talkative, what am I gonna do? Send information that connection refused

[@JohnDoe-or2np]

I'll be honest, I have no idea what's going on. All I know is that I want to do this. Anyone have any tips? I only know how to browse the web. Should I start with learning coding languages or just by learning how Operating systems work first?

[@SyBernot]

You missed the h in ssh when you were trying to copy the root key. I feel like I need to be more careful from spotting your mistakes because I make them too and just move on as you did and that potentially can cost you hours.

[@musacham1025]

How do I get access to retired machines on HTB

[@SasukeUchiha-yd9su]

Subscribe to VIP plan

[@sand3epyadav]

take vip subsription

[@h4gg497]

You made a typo when you tried retrieving the root user's id_rsa.

[@tg7943]

Push!

[@sand3epyadav]

i love ippsec, because my android dp is ippsec

[@bakir.75]

Hey guys can somebody reset email passwords

[@oy9804]

Hello @ippSec I know you don't have free time so I want a , Roudmap, How do I get to your level of experience You have to guide us to the right path to become like you Tell us what did you study to get this experience

[@damuffinman6895]

Practice homie, read writeups, keep doing hackthebox machines, assuming you are, read writeups if your really stuck, take notes, watch ippsec of course, watch infosec videos about recent exploits or different topics about hacking etc. Over time you'll eventually pick up little things, and with a little bit of luck, you might be like ippsec. Takes time though, years.