HackTheBox - Inject

00:00 - Introduction
00:58 - Start of nmap
01:45 - Trying to identify the technology running the webapp, 404 page reveals it is likely tomcat
03:00 - Running Gobuster, then checking out the page
04:00 - Uploading an image and discovering an file disclosure vulnerability
07:45 - Using Snyk to identify vulnerabilities, but first we have to install Maven
10:45 - Exploiting CVE-2022-22963 Manually
11:55 - Playing with the exploit getting a reverse shell by dropping a file on the box (easy), then doing it without touching disk
19:50 - Shell as Phil
22:00 - Using find to show files owned by a group and finding a /opt/automation/tasks directory with ansible stuff
24:10 - Running Pspy to identify ansible is running on a cron job and executing any playbook in the automation directory
26:30 - Creating a playbook that sends us a shell

[lumikarhu]

during my last pentest i discovered a php lfi opening directories as well, it wasn't particularly clean output but it worked

[KrakenAcademy]

Hello ippsec, I also produce content about ctf's here in Brazil and a while ago I put this inject challenge, not knowing that I could only do it when the machine was retired and I ended up suffering a strike. Do you know if I can repost her here on youtube without violating htb guidelines, considering that she has already joined the retired? Thanks for the reply and you are an excellent content producer!

[sandepyadav]

Wawoo tq sir, i learn a lot your videos....

[tanmaykumar]

What is the extension you used in visual code ?

[xPSYCHBYTES]

im just starting in this shit and its lookin like wizardry rn

[xhech]

How can you send the request so fast in the repeater tab? What is the shortcut

[amieemaya]

Iclude maven and pspy on playbook thnx

[teets]

I find this stuff so interesting! How do you even begin getting into this?

[huzaifamuhammad]

@IppSec we need a special video on using Shodan for hackers/bug bounty hunters