Hack The Box Hacking Battlegrounds - Cyber Mayhem Gameplay with Ippsec

Let's play Cyber Mayhem! ⚔️
Watch this awesome video by Ippsec playing #HBG, explaining anything you need to know about this new way of playing and learning via #HTB.

HBG streaming is not allowed currently, but stay tuned as cool updates are coming up! Currently, we are on Early Beta, so battles are available for VIP and VIP+ players.

HBG is here! Get Ready, Set, PWN! 🏁

00:00 - Introduction
01:43 - Logging into Battlegrounds
04:30 - Going over my current workflow/setup.
06:25 - My Start Battlegrounds script, just setting up a WWW Directory with my IP Address.
07:20 - Going over a script I use to quickly SSH into the defending castles.
08:15 - The Get Flags script, which just SSH's into machines and cats flags.
09:10 - Going over Metasploit.
10:10 - Setting up BurpSuite to only intercept traffic to the castles.
11:50 - Doing a dry run of setting up my scripts, while I wait for a queue.
13:15 - Showing my favorite incident response command, ps -aef --forest.
13:45 - Going into a processes /proc/ directory to look at their current working directory.
16:15 - Match Found! Going into the lobby and downloading an OpenVPN Key.
17:50 - Match Started, setting up the battleground script and going to each castle, then pressing: Ctrl+Shift+R
18:50 - Assigning a box to myself to notify the team I'm working a box and logging into the blue box.
19:25 - Intercepting a login request, seeing this is XML, trying XML Entity Injection.
20:50 - Grabbing the SSH Key for Olivia and logging in.
22:20 - Discovering how to patch this vulnerability and validating our patch (libxml_disable_entity_loader).
23:40 - Finding Olivia's password, running sudo and seeing there are a few GTFOBins to privesc
24:50 - Running SYSCTL to dump the root's SSH Key and logging into the box.
26:30 - Doing some light Incident Response on our box to hunt for revshells. I missed a shell here! Metasploit can be found at PID 3437...
28:40 - Starting a TCPDump and then logging into the other castles.
31:00 - Finally found the reverse shell! on our box. Checking the current working directories
32:10 - Grabbing the IP Address of the shell to look at HTTP Access Log. Still don't really see any malicious HTTP Requests.
35:50 - Incorrectly killing the process, then running TCPDump.
38:30 - Killing their shell for real this time.
39:50 - A different box got owned, finding a reverse shell.
42:00 - Tobu keeps getting a flag on another box but has no shell, doing some incident response to find out what happened.
47:00 - Doing a bad job analyzing that TCPDUMP we captured earlier with Wireshark.
51:15 - Examining the HTTP Headers to /blog, to discover an Xdebug header, checking the exploit in Metasploit.
52:49 - Doing some IR against our meterpreter session. Seeing how well it stays hidden prior to running a shell.
54:30 - Disabling Xdebug. 😎⚔️🎮🏁

[leejamison]

watching ippsec navigate tmux is like watching a ballet recital...so effortless :')

[tripzart]

I'm nowhere at all near this level of hacking and have not done blue team stuff before but this video was excellent. Seeing how you identify shells/meterpreter processes from a defender's POV was educational and exciting and I learnt alot from this 1h video! Thanks ippsec. I'll probably try out battlegrounds in the far future once I've learnt more

[mariolol]

Its kinda depressing to see how good they are when you just started getting into hacking

Edit: its now only four months later and i understand what he is doing! Yay

[InfiniteLogins]

This is amazing, I feel like I'm watching an OG MLG tournament.

[HQinternet]

when you see ippsec in your team... :D or the horror of seeing ippsec on the other team.. :S

[xLegacyy]

Thanks for all the times you carried me my dude :D

[Kargha]

This was amazing to watch! Hopefully you'll be able to share more of this in the future!

[davidbuckalew]

I know this is a long time ago. Just started my hacking endeavors a little while ago--unless you count the stuff I did in dos and unix 30 years ago...Anyways, watched 15min of this. Damn, this guy is fast. My head started to spin.

[SapphireSymphony]

what a great content. I love watching ippsec do it days to days 😊

[the_unknown]

im a simple man. I hear ippsec, I subscribe

[alexanderastardjiev]

This is awesome. We need more videos like this. I really hope ippsec will continue making videos playing Mayhem

[sharghaas]

When IppSec allows the service to run but won't show the password anymore "Let's have some fun :3"

[guyunknown]

When he did tree for forest omg that lvl of heartbeat😂

[Queennyla]

This is amazing for intermediate learners like me...God bless you ippsec!

[SilverCraft]

I am recently studying blue team stuff and I am so happy that it won't be a waste T^T

[master-sy]

The background music reminds me of mass effect..Cool!

[zgredfryd]

Holy f**k.... Man I recently started my journey with pentesting. I wanted to know how battlegrounds work and try them myself. Your video was intimidating :D Back to studying for me I guess:D. Thank's for showing me new skills. It was definitely worth my time!

[bluegizmo]

Awesome vid! I actually understood everything you did, I just wouldn't be able to remember all the commands and stuff to do it myself yet lol

[JuanSanchez-iqlp]

I have no idea what imp seeing or what's going on but being a cyber security major this is exciting.

[michaelgirma]

Ippsec where have you been all my life <3