HackTheBox - Unicode
00:00 - Intro
01:00 - Start of nmap
02:20 - Registering and logging in and examining what a regular user can do
03:30 - Playing with the file upload capability
04:20 - Discovering there is a JWT in our HTTP Request, examining it to see it is RS256 and has a claim
07:55 - Explaining how we are going to exploit the Claim Misuse vulnerability in this JWT
09:45 - Creating a JWT Header that will have a modified URL for the claim, website says its an invalid key but doesn't reach out to us
12:20 - Using the redirect functionality on the web page to allow us to place the websites domain in our JKU Claim
15:10 - Modifying the JWK File to place our own RSA Key and generating one with ssh-keygen and openssl
18:00 - Showing us pulling N and E out of the RSA Key
21:30 - Converting the SSH Public key into a Certificate
24:24 - Updating the JWT to change our name to admin and finding a LFI Vulnerability
27:27 - Attempting to use WFUZZ to bypass the filter
33:40 - Giving up fuzzing wtih wfuzz
35:10 - Explaining why I'm going to try testing for unicode normalization and what it is, grabbing a payload from HackTricks
37:10 - Exploring /proc/self/ and hunting for the location of the webapp
39:02 - Finding the python application by using the /proc/self/cwd directory, then grabbing db.yaml and getting SSH Credentials
42:20 - Discovering a TREPORT Binary, which is a compiled python file
43:45 - Discovering the TREPORT Binary uses curl, which is weird
45:20 - Discovering the TREPORT Binary will allow us to use the file wrapper if we bypass the filter
46:50 - Bypassing the space filter in the TREPORT Binary using brace expansion in bash and having curl write the flag to /tmp
49:00 - Downloading a SSH Key and allowing us to login as root
50:00 - Examining the Web Application to show the Unicode Normalization Vulnerability
56:30 - Looking at the user table, to discover admin doesn't exist
57:58 - Finding out the login form was supposed to display errors but didn't because of a lacking some Jinja2 Templating Code
1:01:20 - Flailing around fixing the template to display error messages
Auf dieser Seite können Sie das Online-Video HackTheBox - Unicode mit der Dauer stunde minuten sekunde in guter Qualität ansehen, das der Benutzer IppSec 07 Mai 2022 hochgeladen hat, den Link mit Freunden und Bekannten teilen, dieses Video wurde auf Youtube bereits 20,025 Mal angesehen und es wurde von 506 den Zuschauern gefallen. Viel Spaß beim Betrachtenden Zuschauern gefallen!
