HackTheBox - Sense

01:20 - Star of Recon
03:40 - GoBuster
04:45 - Getting banned and Pivoting to verify
10:20 - Logging into PFSense
16:50 - Manually Exploiting PFsense
38:30 - Using Metasploit to exploit
42:00 - Creating a Bruteforce Script in Python ( CSRF )

[@LuisLopez-le9zx]

Thanks ippsec for your videos, i can watch your videos all day like a Netflix series

[@MRBOXly]

indeed!

[@gespoL-]

Up

[@tigermelissa]

You are a damn hero. I've learned so much from your videos (my method is to do the boxes on my own - if I can - and then watch your videos while I'm waiting for my scans of my next boxes are running). Thank you from the bottom of my heart, I hope that HTB pays you for this good work!

[@dylanmakowski1070]

Keep up the longer vids, I learn so much from every video that I wish more content was in each of them.

[@indifferent1]

simple video tightly packed with nuggets of knowledge. Amazing thumbs up and vote for longer and detailed video. thankyou ippsec

[@kaisserbendlala341]

Always post these kinda videos, when u fail multiple times ! This is great and i learn so much of it ! Ty !

[@ericazelic892]

Ippsec - you're amazing! Thanks for everything you do :)

[@rbirtles7463]

Great content as always. When using nc to exfil your command output, you could use -k so you didn't have to keep running the command.

[@ashtonne]

Thanks for this detailed videos. It was interesting as usual, learned again a lot.

[@ITRIEDEL]

Love ur videos man. I love watching you make silly mistakes like me, because it means my mistakes arent that noobish haha. Keep it up!

[@ShadowD71]

Yes ippsec definitly wanna see longer Vids ... thank you for your effort. I learn so much through your Videos ... thank you very much.

[@MrHasooooni]

man i love when u make a mistake and then fix it on the record because that is how we learn please don't prepare your videos do them all like this we don't care about the time we spend watching this we care about how much learning we got from it please keep it up big fan from Saudi Arabia

[@humblelearner5101]

Thank you, really inspiring and motivating

[@dakshdubey4994]

Definitely wanna see longer videos. Goal is not to see you getting root but to learn little things and details and new tools. Specially gives me an inside of your thought process. So please make long videos.

[@jasonblank617]

I disagree with the length comments. These videos are the perfect length. I learn so much from them as is. If I don't get enough info about a command I spend my own time learning more. I really appreciate your videos.

[@sechvnnull1524]

I don't know if I will ever get to where you are but man its almost demoralizing watching you and realizing how much I suck! I have a very long way to go and still finishing school, unfortunately started very late in life but it helps to have these videos. Appreciate the time and effort you put into this thank you!!

[@jamieeccleston2988]

Hey bro I hope you're doing well and not fussing over how late you might've started on this stuff. You've gotten into it and you're serious about it which puts you above huge numbers of people. Good luck

[@sechvnnull1524]

@@jamieeccleston2988 Thanks man the encouragement helps immensely! I finished associates degree and almost done with my 3rd year and will be finishing up my bachelor's next fall at the University level. Thanks again man for everything you do!

[@sechvnnull1524]

@@jamieeccleston2988 I was able to make some very good friends with a couple of classmates that share my passion and who are very talented with programming and networking. We are now working together on tryhackme and hackthebox and different projects incorporating python and networking. We watch your videos and John Hammonds. But its a huge help as we progress along on this journey. I figured out i needed to change my attitude and not look at how far I have to go but focus on what im learning and realizing I can do this. It helps to have the right attitude. I came really far fast with python and it was because I changed my attitude about things.

[@mcdesilva74]

longer videos very good and appreciate showing all the possible options (apologies if I am very late in responding to this.).

[@TheNormann33]

Thanks a lot for you videos, and long videos are great

[@ahmerserwer6913]

doing a really great job but sometimes you make thing quite complicated ,but still its part of learning.Keep going with your great work!

[@lmfao69420]

late response but fuck it, he does a more complicated solution so he can learn something new in his videos too.

[@pking8890]

fld at 49:10, my guess would be field. I'm loving the python maaayyyne!

[@bugr33d0_hunter8]

I'm a bit behind, but I learned a ton from this one, it being BSD and all. I think 'fld' stands for field. Ex: username field, password field. Thanks again. I'm investing in a python class. Having trouble learning it on my own.

[@smarlakunta]

ippsec, thank you for your videos. love you !

[@tekken-pakistan2718]

Thanks much, learnt new thing i.e. using `python` in URL when chars are blacklisted

[@Retr0Kid]

Awesome dude keep it up. As for length of videos, eh long is alright and short is to. Sorry for the unstraight answer either or is pretty good.

[@bugr33d0_hunter8]

Love the long videos. Can you use vim as an IDE, to run code inside of vim, using python-mode ? Or is easier to just use interactive (ipython) instead? And can you run 2 and 3 code with ipython. . .

[@trashandchaos]

that environment variable trick was super clever

[@kacem3167]

Good job love your work

[@MrGFYne1337357]

New Sub, much respect

[@gunslingerfourtysix]

I like the way you explain the commands you put into the cli. You probably think your just mumbling to yourself but it actually helps us because we don’t all know what the commands mean. I’m gunna donate I learned a lot do you have a patreon account

[@ippsec]

Nope. Don't accept donations currently.

[@kumarsiddappa6118]

what was the intention to capture data from brupsuite and converted to curl command and created as bash script ?

[@eshaanbansal9122]

Great video. Btw, could have used socat to keep the listener on for multiple requests, instead of running nc again & again.

[@4ltd3l]

Great video as always, I actually started this box yesterday so this was a happy coincidence. Once you had remote command execution why didn't you open a reverse shell?

[@ippsec]

Because Reverse Shells won't always work; if you're always in a rush to get to the goal, you'll miss out on a lot of learning experiences. Without those experiences, you'll be lost when you come across a box that has a really nasty bad character (like space in Holiday). Or if the firewall is simply blocking connections that initiate outbound, which would stop the reverse shell.

[@4ltd3l]

Thank you! What causes "bad characters?" Is that a security feature of the host? And if a reverse shell is blocked by the firewall, shouldn't a NC be as well?

[@jdubbz9368]

there is a way around this restriction, coulda sworn that IppSec has gone over this in another video, but I can't find my notes on this topic atm. Will circle back if I do

[@maries5584]

Hi! May I ask a question? When you inject in this peace of code: exec("/bin/rm -f $rrddbpath$curdatabase"); why do you use "queues" as get-parameter (not "queuesdrop")? I supposed we inject into exec("/bin/rm -f $rrddbpath$curif$queues") with "database=queues"...so why does it work?

[@horizonholt8522]

I have the exact same question too!

[@kydo2540]

How are you able to connect to another box on that network? I have the info for nibbles, but when I try the same all i get is there is no route to host.

[@thednalofi6437]

Ippsec you rock brother 💪

[@collisioN_]

"...And a port number, we do 9000. Hmm, it's gotta be over 9000, 9001. There is no reason it has to be over 9000, I just wanted to say that."

[@rossmurphy4593]

For glob sakes man, put that nc lnp in a while loop before I lose my mind. Love your content bro.

[@affulsamuel728]

you made it easy for me. thanks teacher

[@ITSecurityLabs]

How did you get two boxes running at the same time from htb?

[@b3twiise853]

He rooted one in a previous challenge. So after being blacklisted, he used that boxed he rooted in the past as a proxy. Sorry for the noobsplain

[@Nomnominous1]

@@b3twiise853 But you can only run one machine at a time on HTB. I just did Nibbles right before this one and when I try to SSH or PING it doesn't respond.

[@omarsamkari]

Same question here! Any explanation on he connected via SSH to the Nibbles box?

[@ippsec]

@omarsamkari it used to be possible, unfortunately not anymore

[@ZerkerEOD]

**Edit - Would be good if I could read properly. I found my typo and everything is working. I have it working without the added white space at the end of the cmd file and I have the %26 at the end of the request. Thanks for such a great video @ippsec Did they patch the shell portion? I am doing it like you have and I am not getting a shell. I get cmd injection. I can ping mine to verify what is being sent like you did. But when I do the |python everything breaks. I think I might try other ways but can't get it working. Would love some insite

[@conscium]

this youtube channel is a goldmine for the aspiring pentester. were really appreciate your work sir. :) cheers

[@horizonholt8522]

Someone asked a year ago in a comment on this video (with no answer thus far) - I have the exact question. At 17:27: Why should we be using "queues" as the GET-parameter (and not "queuesdrop"), since we want to enter the if-statement with exec("/bin/rm -f $rrddbpath$curdatabase"); and not exec("/bin/rm -f $rrddbpath$curif$queues");? To make this clearer, using the "queues" as the GET-parameter would mean that exec("/bin/rm -f $rrddbpath$curif$queues"); gets executed instead, which is not what we want, right?

[@ippsec]

I'm guessing there is something earlier in the code that the blog post doesn't show that either shows something like $queues = $curdatabase or something. It looks like $queuesdrop would work. Easiest way to find out is to just try queues drop and see if it works. If it doesn't then edit the PHP script to put print statements in random places and see what stops it.

[@horizonholt8522]

@@ippsec Totally didn't expect this reply; Will check it out real soon when I can. Thank you so much!

[@TheMame82]

Great video. Small suggestion: use 2 firefox profiles (one for proxy + intercept cert, one for non-intercepted internet access) and start firefox with `--new-instance --ProfileManager` parameters from CLI.

[@tabnaka]

TheMaMe82 Nice idea. Thanks. Personally I've just used two browsers: Firefox for proxy and Chrome for direct.

[@ezequiel9055]

Better use exceptions in the proxy profile.

[@jey4037]

are OCSP rooms more difficult than this ?

[@enesozdemir9973]

Do we need to explain the vulnerability and the exploit in detail for oscp, like ippsec does it in this video? I ran the exploit on exploit-db and got root immediately

[@shady3220]

Why are we only using ruby script for the metasploit module toh?

[@raulcpop]

I have some question..How do you know which file must to use to gain the information with gobuster(wordlist)?! What is the main point there?! And what about the file extension? Could be a jpg,js,html what is your strategy to gain the text file.How you knew the file with gobuster can be found? Maybe the go buster can lead you to the file and the another one not(dirbuster).As you see i have these question because many of us had this problem. We used dirbuster and txt extension and "we could not find the files".

[@ippsec]

I almost always use the same wordlist. As for putting extensions that's just what you're looking for. In reality, I'd probably do swp/bak/~/.1/etc aswell but it would take a really long time. Unfortunately, it's really just a guessing game.

[@raulcpop]

Ok,I appreciate your fast replay..Usually things are mess here in my side. I cannot understand the logic between tools. I mean set up 2 different tools but with same task. One can fail and one can pass..How can be so much difference, when the task have been the same and the tools are doing same thing.

[@ippsec]

The tools aren't doing the same thing. Try running the tools through your BurpProxy and looking at what they do differently.

[@IsAMank]

Wtf, I found changelog.txt but somehow missed system-users.txt?

[@ITRIEDEL]

same here

[@joyoe]

same here!

[@Ddealer]

I tried a few different ways and dirbuster never gives me system-users.txt

[@audiokernel412]

instead of runing the nc over and over again you can do "nc -lkvnp 9001 > filesystem.txt" and also monitorize the file filesystem with "tail -f filesystem.txt"

[@stephenhendry7300]

Non related question but how long have you been in the industry?

[@ippsec]

Over a decade, but most of my experience is sysadmin related

[@stephenhendry7300]

IppSec ah cool. I've just started out studying toward my Cybersecurity degree and was wondering how long, if at all, itd take to get so efficient!

[@chris0234]

how could you tell this was BSD?

[@YuGoCheff]

@19:18 😂😂😂😂😂😂😂😂😂👌

[@Philbertsroom]

Why did you take the time to script a brute forcer if you know it'll lock you out :s?

[@ippsec]

To learn how to handle the CSRF token

[@romilthakkar404]

I have one question! Can we do ip release and ip renew (sudo dhclient -r et0) on kali if we get banned? will it work?

[@ippsec]

No. It uses your OpenVPN Address, which while it is dynamic the server remembers your IP for a certain period of time.

[@romilthakkar404]

@@ippsec Thanks for the response. I have one more question! I only put php extension while using dirbuster and didn't get txt files back. Eventually I got stuck on xmlrpc.php enumeration to exploit and couldn't figure out the way to get reverse shell. What should I do to avoid this mistake all the time? Should I put all extensions in gobuster/dirbuster all time? What is your way? I know in walkthroughs we only put the one from we can continue without wasting time!

[@yoon7878]

How can we bypass blocking our IP when we are brute forcing password with Python? Ippsec had only small number of passwords on his wordlist but in real scenario, it will have thousands of words. And if server is blocking us after 50 failed attempt, we need multiple IPs to make a SSH tunnel and run the script to brute force 50 passwords at a time. I don't think that is a valid approach to brute force the password. Any suggestion on this Ippsec?

[@omarsamkari]

Same question here! Did you find any solution for that?

[@yoon7878]

@@omarsamkari I found that you can use proxy servers to bypass IP block. there are multiple paid third party that gives you stable proxy IPs but I have not tried paid ones

[@earthlyelder]

Thank you

[@susnoname]

Can someone please help me why my meterpreter doesn't understand shell command? meterpreter > shell [-] The "shell" command is not supported by this Meterpreter type (php/php)

[@exploitation_rutm7606]

Have you solved this problem yet?

[@AdamRivet]

Thanks, I prefer long videos.

[@pswalia2u]

33:44 is just ❤️

[@tabnaka]

20:30 URL encoding the slash character likely would work. (Unless I missed that you tried that.)

[@ippsec]

It does not work afaik could do it via printf

[@demiscuzz6427]

@ 49:00 fld = field ??

[@dhaiwatmehta2323]

28:00 why dont you just get a shell from that.... easier than repeater thing

[@b3twiise853]

He wanted to show bad char enumeration

[@craiggray7110]

I think its better if you do not test before recording, I learn a lot by watching you troubleshooting small things.

[@ragnarlothbrok367]

And how Im supposed to do this without burp pro?

[@ippsec]

What did I do that you cannot do with Burp Free? The entire reason I wrote the python script was to not use Burp Pro.

[@ragnarlothbrok367]

Burp community edition cant intercept anything at all, intercept is on and no intel gathered, same on fully updated kali and same installed on my desktop.

[@ippsec]

There's something wrong with your configuration. When it comes to the interception feature there is no difference between community and pro. Make sure proxy is set, all protocols are selected, the IP Address you want to intercept isn't in exclusion, you don't have any plugins you aren't aware of, etc. Try watching one of the earlier videos like Popcorn where I may go into explaining Burp if you're unfamiliar with it. Or joining the NetSecFocus Mattermost group (link on HackTheBox), unfortunately I can't really help people troubleshoot as I'd get overwhelmed with random questions; but I can assure you there is nothing I've done in any of this video that you'd need Burp Pro for.

[@therenaissance8322]

IppSec Why do you have Burp Pro version if it doesn't make a difference with interception stuff?

[@pjsmith4471]

The Renaissance because it makes difference in other stuff like iSec said before... Only scanner, multithread for brute force attack and some useful plugins to work with... but intercept, repeater, intruder etc made that tool what it is today. If you want scanner and multithread brute force capability use owasp zap in addition of burp free. I dont understand guys who dont have some basics look videos like that...

[@battletux]

Anyone else getting these ridiculously long Citrix adverts on IppSec's videos? I've had 2 so far, one 45 minutes long the 2nd was 72 minutes long. It seems that citrix is using "adverts" as a way to spam their crappy conference video's...

[@ippsec]

There should be a skip button in the bottom right. If not describe the ad and i'll email google about it

[@b3twiise853]

That was an omen about Citrix cve

[@skylarmcdermott2020]

Lol ippsec you got a typo in the description “Star” instead of start

[@klpr7359]

please tell me the ssh password!??

[@ippsec]

That would be spoiling a live box mate. Have to find one yourself.

[@h.i.1359]

7:13 it's capital C

[@ippsec]

Haha. Well I was close! Think I was just forgetting the shift.

[@dakshdubey4994]

Also, could you make videos on teaching different topics. I know there are tons of videos on youtube for that but they have an element of "teaching" missing. Most of them are copied or some variations of them and their main aim is to just show certain things and not really teaching why or how something happened , when it happened. I hope you get what I am saying.

[@ippsec]

Unfortunately, those videos would take much more time as I'd have to organize some type of lesson plan and verify I'm not doing it in a way I'd want to revamp in a few months. Not to mention putting out that type of content for free limits what I could charge for in the future. Don't have any plans to do actual training material as it would take time away from my actual job, but don't want to take any steps that could close that door.

[@disblog2334]

1st comment lol :)

[@km0x905]

Hackers Blog 😂