HackTheBox - JSON
00:52 - Start of recon, NMAP
04:35 - Using SMBClient to look for OpenShares
04:50 - Examining the HTTP Redirect on the page
06:56 - Attemping default credentials
08:25 - Running GoBuster with PHP Extensions
12:45 - Examining the /api/ Requests made in BurpSuite
13:35 - Comparing Requests to notice one has a "BEARER" Header. Researching exactly what it is.
14:45 - Examining the contents of BEARER/OAUTH2 by base64 decoding it.
15:50 - Inducing an error message by placing invalid base64, then trying to get a different error message by putting valid but unexpected bas64
16:50 - See a serialization error, pointing towards JSON.NET, then switching to Windows to install ysoSerial
22:54 - Creating a .net Deserialization exploit that will ping us
27:50 - Base64 encoding the exploit, starting tcpdump, and checking for code execution. Then editing our exploit use a PowerShell webcradle with Nishang to get a reverse shell
32:51 - Reverse Shell Returned, Running WinPEAS from my SMBShare so we don't touch disk
37:00 - Going over WinPEAS.bat, which doesn't have color (we will do EXE later in the video to get colors!)
42:00 - PrivEsc #1: Reversing Sync2Ftp to decrypt a password
50:15 - Decompile SyncLocation.exe via DNSPY, then edit the executable to display the decrypted password.
56:15 - Couldn't use PSEXEC with the decrypted creds. Lets use Powershell Invoke-Command to switch users
1:05:25 - PrivEsc #2: FileZilla Server - This will require us to pop the box from Windows!
1:10:50 - Using Chisel to forward 127.0.0.1:14147 to us
1:15:15 - Running the FileZilla Server and connecting to the box through our tunnel to create new users
1:21:53 - PrivEsc #3: JuicyPotato
1:24:53 - Running JuicyPotato to get a system shell
On this page of the site you can watch the video online HackTheBox - JSON with a duration of hours minute second in good quality, which was uploaded by the user IppSec 15 February 2020, share the link with friends and acquaintances, this video has already been watched 53,337 times on youtube and it was liked by 802 viewers. Enjoy your viewing!
