HackTheBox - AppSanity

Рет қаралды 13,422

Күн бұрын

00:00 - Introduction
01:00 - Start of nmap, showing 5985 isn't in the top1000 so doing a full port scan
04:40 - Taking a look at the MedDigi website
07:07 - Taking a look at the Signup Request seeing AcctType
09:30 - Changing the AcctType to 2 and getting a different privilege
14:00 - VHost enumeration shows the portal.meddigi.htb domain, using our pre-existing session from the main page on this domain to bypass login
17:52 - Discovering SSRF in the Prescriptions page
19:40 - Discovering the File Upload requires a PDF but checks the magic bytes so we can make a PDF Header on our file and upload ASPX Web Shells
25:30 - Going back to the SSRF and discovering we can use time-based queries to identify ports listening on localhost
28:30 - Using FFUF to filter by duration to show us the requests that don't take a long time
38:22 - Discovering port 8080 shows our upload location, then navigating to it and getting a shell
42:22 - Finding DLL's the webserver uses, they are dotnet so copying them to a windows box so we can use dnspy and finding a password
45:40 - Using netexec to try the password against all users, then logging in as devdoc
53:00 - Looking at the ReportManagement.exe, opening it up in Ghidra
56:50 - Using chisel to forward port 100 to our box so we can access ReportManager
59:30 - Strings shows that externalupload.dll is right next to the Libraries string
1:00:15 - Looking at imports, see CreateProcessW, then going to where the binary calls that process
1:03:30 - Doing Dynamic Analysis with ProcMon, creating all the directories/files the program wants
1:18:50 - Eventually see it looking for files in the Libraries Directory when doing the upload command
1:21:45 - When externalupload.dll exists, we can see it doing a CreateProcess call, creating a DLL that sends a reverse shell
1:26:30 - When the DLL is in the libraries and we run upload, we get a shell

Пікірлер: 28

@pendragon3434 4 ай бұрын

I would've been so lost after gaining the initial foothold with devdoc, I dont think I'd have noticed the service listening on port 100 and even if I did I feel like I would've never figured out what the program was doing or how ro exploit it's functionality. Hopefully one day ill be able to spot these little things even half as well as you do. Great walkthrough appreciate the work

@charlesnathansmith 4 ай бұрын

The BUFFER_OVERFLOW results in process monitor are from the program getting buffer size info from the Win32 API If you want it to return some string value or something large, you make a call to wtv info API routine giving it a buffer and the buffer size, and if the size isn't large enough to hold the response, you get an overflow response code and information on the correct size that its needs to be. Usually the pattern used is to send the request with a 0 size, so it errors and gives you the correct size, then you can allocate enough space and make the call again with the correct size. This results in tons of overflow errors listed in the system messages, but it's just standard procedure

@AUBCodeII 4 ай бұрын

59:46 you can also use -C3 instead of -A3 -B3. The "C" stands for "context" so it's easy to memorize.

@prudhvikonakalla9605 4 ай бұрын

Waiting for your video sir....😊

@Omar-sr1ln 4 ай бұрын

sar do the needful saaaaar

@kalidsherefuddin 4 ай бұрын

The great work

@for14556 4 ай бұрын

@IppSec - The inserted magicbytes are not going to break the synax of the reverse shell?

@ippsec 4 ай бұрын

Nope. ASPX ignores the characters that aren't part of its syntax. Just like PHP wouldnt execute whats before

@J064n 4 ай бұрын

Whats your terminal setup and shortcuts?

@puzzlepuzzlepuzzle760 4 ай бұрын

May i ask what OS you normally run IppSec?

@MoxResearcher 4 ай бұрын

Parrot

@Beetlemiao 4 ай бұрын

One thing I don’t understand is how you can tell that the report management is ran by a high privileged account, how do you check that before going that route?

@G0rlami 4 ай бұрын

"tasklist /v" shows all the running processes + the users that they run under. When you run it you can usually see under which user every process runs . Side note*: Some entries are showing as "N/A" for the User, but that usually means that it's running under a system account.

@AUBCodeII 4 ай бұрын

Ipp Bandicoot

@dadamnmayne 4 ай бұрын

ippflix and chill