HackTheBox - Bizness

00:00 - Introduction
01:00 - Start of nmap
03:00 - Seeing JSESSIONID and NGINX trying the off by slash exploit to get access to /manager, doesn't work here
04:30 - Dirbusting with FFUF because the lack of 404's messed with gobuster
07:40 - Discovering the OfBiz Version, looking for exploits
09:00 - Going over the Authentication Bypass in OfBiz
12:40 - Downloading YSOSERIAL and building a Docker so we don't have to worry about Java Versions
14:30 - Building a ReverseShell Payload that works with YSOSERIAL
18:40 - Reverse shell returned! Looking at OfBiz and finding out it uses the Derby Database
22:30 - Copy the Derby Database then using IJ from Derby-Tools to dump the data
26:40 - The hash in the database is a URL Base64 Encoded, decoding it reveals it has a length of 40 which is normal for Sha1Sum. Decoding it then cracking with hashcat

[beloraymonyela]

that was a nice one, thanks for everything set in the dark mode especially if you watching it in the dark....awesome really

[AUBCodeII]

It took me a while to figure this out, but you can also use John the Ripper to crack a salted hash.

First, we need to create the file with the hash and salt, in the format <hash>$<salt>. I'll name it admin.hash:


After that, we need to identify the format to be used:
john --list=subformats | grep -i sha1 | grep -i '\$s'

The command above shows us that we want to use the dynamic_24 and dynamic_25 formats:
Format = dynamic_24 type = dynamic_24: sha1($p.$s)
Format = dynamic_25 type = dynamic_25: sha1($s.$p)

Since we don't know whether the salt is added before or after the string before calculating the hash, we have to test both formats.

Finally, we need to run john with both formats:
john admin.hash --wordlist=rockyou.txt --format=dynamic_25

After running john with the dynamic_25 format, we find out the the cleartext password that, prepended with the salt "d", generates the hash above.

[azelbane]

💪🙏👏🏽what a MAGNIFICENT video! Excellent👏👏🏻

[bartomiejpotaman]

it doesnt return true in the login function. Instead, when requiredPassword parameter is set to 'Y' then i returns string "requirePasswordChange".

[bartomiejpotaman]

also the blog post doesnt exist anymore or i just cant find it. Anyone anything?

[Mykmy]

It would not be possible for a beginner to discover this part of the hash, I believe that saying that this machine is easy was really a mistake on the part of the staff

[HopliteSecurity]

Really well done and thanks for the detailed explanation. Keep up the amazing work ❤❤

[DrK_PrxY]

Hey mate ! What is that shell you're using ? Thanks and Cheers !

[Grasimee]

Could you turn your microphone up a little in future videos please? I have everything on max and its still quiet

[CHAP_SEC]

I just recursively cat the entire directory on to my attack machine into one text file and then used strings. Piped that to grep to look for "Password" 24:03

[martin-hollingsworth]

You have a beautiful brain good sir 🤓.

[AUBCodeII]

#Let'sSeeGang
#ThereWeGoGang
#Let'sSeeAndThereWeGoGang