HackTheBox - Safe

CO_g3wtC7rk/default.jpg

00:40 - Begin of nmap
02:31 - Discovering MyApp in the HTML Source
03:30 - Examining MyApp on port 1337
05:30 - Opening myapp up in Ghidra
07:20 - Testing out the buffer overflow
08:40 - Using pattern search to see where we can overwrite RSP
10:15 - Create a PwnTool Skeleton and having it call main instead of crashing
12:30 - Testing calling main (error: need to do recvline to send text)
13:50 - Explaining hijacking the SYSTEM() call
17:11 - Finding a way to put user input into RDI
17:30 - Examining the Test Function which places RSP to RDI
19:50 - Finding a pop r13 as the Test Function jumps to r13
23:30 - Putting the gadget togather for code execution
27:00 - Setting pwntools to exploit the remote host
28:30 - Shell on the box
29:15 - Dropping SSH Key to get a normal shell and copying keepass files
31:40 - Using keepass2john to create hashes to crack
35:00 - Cracking keepass hashes with hashcat
37:50 - Using kpcli to export the root password
39:20 - Using the root password to su to the root user

CO_g3wtC7rk/default.jpg
HackTheBox - Safe HackTheBox - Safe Reviewed by Anonymous on October 26, 2019 Rating: 5