HackTheBox RegistryTwo

00:00 - Intro
01:00 - Start of nmap
03:10 - Enumerating port 5000/5001 to see a Docker Registry and Auth Server
06:10 - Creating our auth token for the Docker Registry
08:45 - Adding the SSL Cert to our certificate store, then doing a docker pull to download and run the container
13:00 - Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of /..;/ (nginx directory didn't have a trailing slash on the location)
16:45 - The Examples directory has a sessions example that lets us modify the session, doing this to get a File Disclosure vulnerability then downloading the WAR file hosting the app
27:45 - Opening the WAR in JD-GUI then examining the source code, discovering we can change our user to admin by editing the session
33:30 - Pointing the RMI.HOST back to us, then use YSOSERIAL to host a malicious server
42:50 - YSOSERIAL-MODIFIED Docker is up, using YSOSERIAL to start a JRMP Listener and host a malicious payload
46:45 - Shell on the container, showing where IPv6 addresses are stored (/proc/if_inet6) and that we could have gotten this with the file disclosure which allows for bypassing the firewall, did not need to do the ysoserial step for this next one.
52:51 - Looking at the source code again, discovering we can use the RMI to perform file operations on the host
56:00 - Start of creating the RMI Client Java App
1:09:18 - Running into an error using our decompiled code. Having our exploit just reference the class files (before decompilation)
1:25:00 - Finishing up our exploit script, then writing an SSH Key
1:36:60 - Looking at running processes, discovering the RMI Server restarts every 3 minutes, then running PSPY discovering a quarentine.jar
1:43:00 - Looking at the initial JAR again, discovering it will give out a config. Using RECAF so I can just replace code in the jar without recompiling
1:48:00 - Looking at the Quarantine Service, which pulls a config from the RMI Server then runs CLAM AV
1:51:40 - Having CLAM AV scan /root, and flag every file as a virus sending it to /dev/shm

[@dadamnmayne]

The benefit of this format is not only do you get a walkthrough but you might get a vim tip or a tip to convert your burp suite repeater data to a curl command.

[@dadamnmayne]

i like when machine creators lead you to either a id_rsa or a password. that way, in practice, you can jump straight to lateral movement or priv esc if desired, especially on insane machine. its like a checkpoint.

[@apkanalyze3623]

That sneaky video was the good one :) I'm still smiling when I recall you reading the entire 'Total number of IPv6.' aaah good old days.

[@spandexvortex1097]

I think the reason you're getting the file content when you do 'ls' @1:34:00 is because of missing break statements for each 'case' condition. In Java, it's required to add the break statement after each 'case' condition ends, otherwise, it'll continue until it finds a break or until the default case.

[@ippsec]

Ah. Thanks! Yup that would explain it.

[@miroslavmetodiev8915]

23:41 You can undo an accidental tab close with ctrl+shift+T Thanks for being awesome! ❤

[@vijayvj3976]

Out of the box thinking 💯

[@ihavelowiq2723]

this is a simple request from a beginner. can u add beyond root part to every video. even thought they are easy box nothing crazy to show, can u route us through the box, showing how the site is hosted, how the inside is working, what are the main points we need to check, how the box creator has done things using crons like that. thank you. i always amazed by ur knowledge

[@noctavel]

Question: Why did you use http to transfer files from your host to victim but used nc the other way around (twice)? any specific reason or just your standard flow?

[@ippsec]

Habit - Generally speaking when doing offensive work, your target will be behind a NAT. So standing up a listener won't help much as there isn't the port forward (PAT) setup to access the webserver from the outside. On the attacking side, you have control of the router, or are you just are on a routable IP Address, so you can stand up a webserver.

[@user-cb5yk4gk9u]

Greeting From Morocco

[@abdelhay.]

Mgharba everywhere

[@abdelhay.]

Mgharba everywhere

[@user-cb5yk4gk9u]

​@@abdelhay.Wayih

[@RissaysArt]

hhhhh

[@tg7943]

Push!

[@gespoL-]

Se garantiu

[@AUBCodeII]

Ipp, you have a smooth brain. No ridges or lumps, or valleys or bumps; all ideas slide right off, like a waterslide!

[@neunzehnvierundachtzig]

Practice over years makes us think like a robot.

[@AUBCodeII]

@@neunzehnvierundachtzig Smooth brain is actually good, because: * Smooth * No wrinkles * Cute * Can't think = no sad

[@b14cky30]

I have one simple question: which technique should we apply for exploiting the machine after lots of enumeration? 1. Breadth First Search (Horizontally Proceed) - Means First of try all thing as surface level for initial foothold 2. Depth First Search (Vertically Proceed) - Means First Take one thing and deep dive into it and then another one.

[@moretto8589]

I think it depends on the situation I personally do breadth first if i see a lot of ports and if i see only 2 or 3 ports then depth first.

[@ippsec]

I go Horizontal, then exploit what I think will be the quickest first.

[@neunzehnvierundachtzig]

wait when did we start having Algorithms for hacking. Cool. The best way is the ippsec way.

[@neunzehnvierundachtzig]

​@@moretto8589 I like this. This is what I do too. Probably why I get overwhelmed when there's a lot of ports to check.

[@AAA-AAA158]

first

[@eyezikandexploits]

This box was a struggle for me

[@notTh3Mag1c1an]

is the volume a little lower or is it just to me?

[@ippsec]

Very well could be -- Something changed my volume settings before recording this video. Think Zoom maxed out my microphone and I had to find out the right settings.

[@notTh3Mag1c1an]

@@ippsec No worries Man, I increased the volume. We all good, it wasnt that low.

[@yuriypalikshanov8628]

[@sotecluxan4221]