HackTheBox - Ouija
00:00 - Introduction
01:00 - Start of nmap
03:15 - Fuzzing the API port port 3000 with ffuf
09:00 - Discovering the Gitea Domain and seeing a repo which discloses HA Proxy 2.2.16 is in use
11:50 - Exploring CVE-2021-40346 an integer overflow in HA Proxy which enables HTTP Smuggling
18:00 - Putting a 3rd request in to make the HTTP Smuggle reliable and grabbing the source code to app.js
28:45 - Taking a look at the APP.JS source code and discovering a Hash Length Extension attack
38:14 - Performing the Hash Lenght Extension attack and then using FFUF to find the length of the secret
45:00 - Have another File Disclosure, chaining it with the /proc symlink to read an SSH key to get shell on the box
52:45 - Discovering port 9999
58:00 - Opening the PHP Library up in Ghidra and discovering an integer overflow
1:04:00 - Creating a C Program to explain the integer overflow
1:11:50 - Setting up a test environment so we can debug the PHP Library and see how it behaves
1:17:15 - Getting a breakpoint to work and stepping through things in lverifier.so
1:21:00 - Creating a pattern so we can see where we write data to
1:24:22 - Creating a python script to build our payload
1:35:50 - Running into an issue, discovering the first parameter doesn't terminate where we thought and the fopen call fails. Playing with the exploit to find a way to terminate fopen (linebreak)
1:46:45 - Burpsuite wasn't URL Encoded a linebreak, doing it ourselves and then getting shell
Пікірлер: 27
Always when I hate myself, I'm watching ippsec's insane box walkthroughs, so I can feel even more stupid
Idk how people think of these, I can barely do a medium box, let alone a insane one. You're insane ippsec, much love from south africa
@Siik94Skillz
26 күн бұрын
Experience... thats how
Even if you can't do the box, its good to take all the knowledge.
Insane… ❤I cannot even imagine how much you have studied to reach this level
Awesome box. I wish we could debug the HTTP smuggling part so we could figure out why it was acting the way it acted when you added a third header. Also, I used xclip -o > file.txt to paste into a file in a terminal and use tmux loadbuffer - to load data in the tmux buffer. Thanks for the video!
man, I love some aspects of this box
I give up on this one because I can't able to get the foothold but hey thanks for uploading this will try to understand where I lack
Awesome!!!!
The best.
Could you point to a resource where I could study more in detail about this Hash extension attack?
Good !
what certs do you have?
My head hurts
How long does it take to do a box like this?
@Darius1013
24 күн бұрын
It depends on your skill level - if you understand basic concepts and how stack works - it takes few hours to get foothold and pwn root, but if you have lack of knowledge in some parts - you can spend at least few hours filling your gaps (and i'm not talking about basic tooling, but more how stack handles stuff - in this case you needed to understand HA proxy overflow and do debugging on lib file - if you already run into this HA exploit - its way easier, if you did other debugging - again - not so hard as start from 0). So i would say on average it can take from few hours to few days - depending on your skills - and if you can't do it in few days - you're lacking basic skills on some specific parts (you can train them on easier machines), or missed something - can't find anything in day - check your notes again, try different angles and finally rabbit holes - you can dig deep where is nothing - it takes time, and give 0 results, but sometimes you can find unintended ways to hack the box, so idk, maybe they are not so bad.. Funniest part is adventure, so just try and if you fail, you still learn something and will do better on next one :)
@AUBCodeII
Күн бұрын
xct, currently ranked #1 on HTB, took 17 hours, 50 minutes and 57 seconds to get system blood.
Its Gonna Be More Fun If Using HTTP/2 Pipeline 😊
Push!
Hi Ipp, today is my birthday :3
@ippsec
26 күн бұрын
Happy birthday!
@AUBCodeII
26 күн бұрын
@@ippsec thanks! 😊
Awesome
Ippsec the legend
I never click on an insane box 🤧
in here i don't understand this. (!(d(q.headers['identification']).includes("::admin:True"))) in this check, d() returns value. how to check admin:true in it?
@ihavelowiq2723
21 күн бұрын
i ran the code and it just works. :|