HackTheBox - Sightless

00:00 - Introduction
01:00 - Start of nmap
03:30 - Discovering SQLPad
06:20 - Discovering a SSRF in SQLPad when adding connections. Sending to FFUF, use a time filter to show timeouts
10:01 - Finding the SQLPad Version (6.10.0), which has a template injection vulnerability getting a shell
14:25 - Shell returned, extracting the SQLPad database
17:45 - Cracking the shadow file of the docker container to get michaels password
21:05 - Shell as Michael, discovering headless chrome is running forwarding ports to access it
26:55 - Logging into froxlor, getting RCE as root by changing PHP-FPM Configuration
32:40 - Doing the box the intended way, getting Froxlor Cookie via XSS
44:30 - Changing the Web1 users password so we can FTP Into the box
49:00 - Cracking the Keepass database to get root ssh key

[apkanalyze]

Last week, I was in a meeting trying to explain the Ivanti vulnerability to other teams. At one point, I found myself was saying 'With that being said, let's just jump in.'

[Progressive_Entrepreneur]

Great work man! I DREAM OF BEING A PENTESTER, but holly crap there's a lot to learn makes me scared sometimes.

[MikeyP]

Me when I watch other 45min + videos * Press 2 x speed. Me when I watch IppSec 45min + videos * Press .5 speed. haha. What a talent!

[RISE_BEFORE_YOU_GREECE]

3 Week Gone 😅

Been Waiting For New Ipp Vid 😊🎉

[Mhmud]

Missed your videos sir happy new year and welcome back 🎉🎉🎉

[Marco_Ris]

ctrl+shift+t reopen closed tab ;-)
btw this box can't be easy. the first attempt to get the user flag was easy but to get the root flag is quite more than 1-3 steps like an easy box should have.

[SOLOxUNS]

Senin sayende ilerliyorum çok teşekkür ederim .. king of kings 😂🎉❤

[anonymousvevo]

Amazing as usual, i've got a question, how much time it takes for a newbie, to solve a box like this ? and is this suppose to be easy ? ^^

[gqngster]

For the froxlor part, you can use the install command to copy a file and set permissions in one go
install -o root -g root -m 4755 /bin/bash /tmp/bash

[AUBCodeII]

Ippy, you're back!!! Happy New Year!!! In 2025 we'll have:

* More Ipp memes
* More pop culture references
* More "Hey Ipp" questions/riddles/challenges
* More "Let's see" and more "There we go"
* Comments that are actually related to the videos (P(A) < 1 x 10⁻⁶)

[MarcelN]

Hi, trying to do the squiggly C inside SSH, and I have "Commandline disabled", although I've tried connecting via SSH as root from the HTB Pwnbox.
What should I do? Thanks!

[Denis-xljx]

Hey ipp, was wondering about the process at 14:50 to get a proper tty shell. I didn't know the script -q trick, is there a place where we can learn more about these? I also don't fully understand how/why it works, but I guess that's more to do with the Linux terminal than security

[lespetitjoueurs]

23:07 I can't open the ssh>

When I do ~C + enter nothing happens, would anyone help me?

[kaixianwongful]

How to do that ~C then send into ssh in background?

[vakdan]

I dont like this machine at all. But I discovered for myself that I can pwn AD easily. It was strange)

[DrNatas]

Lol, when I was in the box, I sawed other peoples work kinda gave up the root.txt.

[defkrogeldiz]

My burp suite is not intercepting requests to 127.0.0.1:9000