HackTheBox - TheNotebook

00:00 - Intro
00:50 - Start of nmap
02:40 - Checking out the webpage, trying to identify the language running the page
03:50 - Exploring how Add Note works and testing SSTI/SQL/XSS
06:30 - Checking out the cookie to see how the JWT is encoded
07:30 - JWT.IO shows the JWT is RS256 and there's a URL for the privKey
08:30 - Editing the PrivKEy, I'm not sure why i didn't do this within the JWT.IO website...
10:00 - Confirming the server goes to us to get the PrivateKey
10:45 - Using ssh-rsa/openssl to create a RSA Key and forging the JWT
14:55 - Exploring the IDOR Vulnerability to see if unauthenticated users can access notes
18:45 - Uploading a PHP File to confirm code execution then a reverse shell.
21:23 - Identifying when the box was created by looking at SSH Host Keys, then using find to list files created around that time
26:20 - My reverse shell keeps crashing, doing the finds without the PTY Trick to find a backup that has an SSH Key
30:50 - SSH into the box with the SSH Key and discovering we can use sudo to access Docker
31:40 - Exploring the docker for sensitive information that could be used to access other users on the box
34:25 - Looking at the Docker Version to see it from 2018 and finding a vulnerability
36:10 - Performing CVE-2019-5736 to get root

[potatoonastick]

Man, the way you go through your boxes is kinda unique. Specifically the post-exploitation phase. Props as always

[daysling]

Aww, "Java Web Token" was funny

[mostwanted]

Loved it! Even I overlooked the other enumeration holes that I left. I was looking forward to this video. Amazing. <3 Looking forward to making more submissions for the community!

[onlyastronut]

Your method of forging keys was way easier than mine. I wrote a complete Python script that generated keys and gave me the cookie in base64 as output.

[JuanBotes]

love your videos, always learning from your guides - thanks

[Iamnoahfranklin]

Happy to see someone saying you name in right way. 👍🏻 ippsec

[infosec]

Great Video. I have solved this box but i have used another method to get root. Found this one preety nice. Always looking forward for your videos to learn and grow. <3

[yamunaudayanthi]

Great video...❤️ But still waiting for Zap...😝 What happened??😏 You don't like it...??🤗

[ASoggySandal]

at 6:02 - If you right-click in the Inspector -> Edit as HTML, you'll see the encoding that you were expecting to see. Most browsers unencode it for readability, so I use that trick a lot.

[hontar]

Wondering if it's not showing up as html entity encoded in the inspector is due to that you may need to edit as html to see the pre-rendered output? Big fan and sponsor btw.

[pzz]

Great video! Big fan, hope to hug you someday

[Filmer]

Hey do you have a discord or smth to interact with you and your community? Im like a beginner/intermediate in cybersecurity and would love to learn about new topics and interact with other people from the same field :)

[BennyM]

As new watcher, this was like magic, how do you copy and paste into vi??

[blackthorne-rose]

PLEASE... write up HTB "Under Construction" ... available material all much too ambiguous. THanks!

[aaryanbhagat]

I do not get how you directly changed the header and send it to the server, isn't that signature part is used to check if the token has been changed or not right?

[Cyberghst_]

Sir, may I ask you why is your website under the .rocks domain? I misspelled your domain a couple of times, all of them: ipsec, ipsecc and ipssec seem to be some kind of malicious domain. Are you aware of that? Isn't there something you could do about it?

[maxxroach]

24:03 My shell died that's rude. 😂 😂 😂

[caseylgoodrich]

No one would implement jwt verification this 😂

[mayurahir]

How u got this machine i find i find on hack the box but i don't gat can u please tell me 🙏