HackTheBox - Horizontall

00:00 - Intro
00:57 - Start of nmap, examining the page discovering its all static with no user input
05:20 - Examining the source code of the website
06:20 - Running the javascript through a beutifier so we can easily read this, and finding another web endpoint
12:00 - Navigating to /admin brings us to a STRAPI login, searching for exploits and finding an RCE
13:50 - Lightly reading the exploit script, we will go more in depth at the end of this video
15:15 - Getting a reverse shell
17:30 - Reverse shell returned, looking for how the webapp talks to the database
18:50 - Explaining why this nginx server uses proxy_pass and has a node app listening on port 1337
21:20 - Dropping an SSH Key and using SSH to access this box, no privilege escalation yet just wanted a better shell
25:20 - Having a lot of trouble with getting data out of the MySQL Database, not exactly sure what went wrong here.
32:20 - Going over the LinPEAS Output and discovering port 8000 running laravel
33:50 - Going over why we cant see processes from other users
35:30 - Using SSH to tunnel port 8000 to our box, allowing us to access laravel, finding out laravel is in debug mode
37:52 - Finding an exploit and executing code as laravel.
41:08 - First script didn't work, looking to see if there are others. This one didn't require absolute paths, which allows it to work! Getting root
42:30 - Looks like there's some bad characters with our reverse shell, switching to a web cradle and getting root
46:00 - Explaining why this box isn't the box I wanted to show off FeroxBuster (Recursive Searching on API wouldn't work)
48:40 - Looking at the STRAPI Exploit and showing how the patch worked
56:50 - Comparing PHP Exploits

[yurilsaps]

I remember one year ago I was very beginner at hacking and said, let's watch easy videos to start, and this video made me really sad. now one year after I didn't cry watching again

[bidkonic]

26:41 the problem was with the "-", you should have wrapped the users-permissions_user in backticks: `users-permissions_user`

[dhaneshsivasamy]

Thanks Ippsec for this new "After Exploitation inspection" section in your recent videos. Can you also do them for AD machines in the future for better understanding of why we can enumerate null authentication, why we can list smb shares anonymously and stuffs like that

[cadesummers]

35:40 I have no idea how to get it to show ssh> using C. What inputs did you press? I can't get it.

[Giperium]

A very cool and detailed analysis of this car.
Many people don't care how the exploit works, but just publish the vulnerability.
It's nice to see in the wolkthrough that there is still an analysis of why the exploit worked.
I love ipsec for that.
I still haven't figured out how to get into the >SSH command prompt (~L\ or ~C\), what to look for when you press "C".
Maybe you need to press a hotkey?

[meudta]

1h of his content is like 4y of Computer science college

[readysetexploit]

At 5:31 the html source was laid out in a “horizontal” manner

[ghsinfosec]

Thanks for the explanation on the shell for zsh! I've seen other ways to do that, but I end up getting some weird line wrapping sometimes so I would switch to bash before setting up the listener, but I also forget to do that sometimes and have to re-establish my shell. I've learned a lot from your videos and really enjoy your approach to each box.

[nils]

Just managed the user flag on this one before its getting retired. Won't have time to try for the root flag anymore today so watching this later and learning will be fun.

[jonxslays]

videos are dope and helpful. thanks dude.

[asib]

The first laravel exploit does work - you could guess the log file location using the information about the location of the files mentioned in the debug output on /profiles.

[DJ-rrcj]

Hey Ipp! Another great video. A quick way to prettify the javascript source files is F+12 > debugger tab > app.js > then click the prettify button from within the developer console. You weren't imagining the button XD it's there (just not in view page source)

[spfy]

When you examine the http headers for the api you missed the x-powered-by header that told you this was strapi cms. Otherwise great walkthrough as always.

[ellerionsnow]

What is the thought process to look for VHOST? I wracked my head on this one trying to use dirbuster.

[danilopc]

How long did you take to do this box prior recording this?

[rayyue]

38:11 The gobuster returned "[ERROR] ... connection refused"

I have the same error too and the port forwarding is terminated.
Any idea why does this happen?

The error messages in the port forwarding are like:
"channel X: open failed: connect failed: Connection refused"
"client_loop: send disconnect: Broken pipe"

[shedelbrecherinc.]

~c is not working. I cannot seem to get the portforwarding to work in any way,

[kaushikkodeeswaran]

sir you have mentioned to reach the site i will have to add the IP to /etc/hosts file, directly typing IP in the url tab states "unable to reach the site" but after adding to hosts file i am able to reach, but why does this happen??

[tyaprak]

great vid as always.

by the way, my progress stalled in htb academy since ffuf was not installed on the box. can you please check the parrot os' basic template?

[Fahodinho]

I kinda wanna see ippsec do a room live without any prior knowledge