HackThebox - Dynstr

แชร์
ฝัง
  • เผยแพร่เมื่อ 19 ธ.ค. 2024

ความคิดเห็น • 23

  • @ajualex3503
    @ajualex3503 3 ปีที่แล้ว +32

    The -p flag in bash is related to security. It is used to prevent the shell reading user-controlled files.
    If Bash is started with the effective user (group) id not equal to the real user (group) id, and the -p option is not supplied, no startup files are read, shell functions are not inherited from the environment, the SHELLOPTS, BASHOPTS, CDPATH, and GLOBIGNORE variables, if they appear in the environment, are ignored, and the effective user id is set to the real user id. If the -p option is supplied at invocation, the startup behavior is the same, but the effective user id is not reset.

  • @hadrian3689
    @hadrian3689 3 ปีที่แล้ว +9

    When I did first this box, I used sftp within the box to upload the authorized_key and Public key so that I can SSH in lol which in hindsight it was such a roundabout way lol but you live and you learn thanks for the video!

  • @techworld323
    @techworld323 3 ปีที่แล้ว +1

    What a coincidence , I Just watch dynatr a few minutes ago , and now again 😀

  • @declanmcardle
    @declanmcardle 2 ปีที่แล้ว

    @30:50 also, if you have two panes split horizontally, copy and paste will by default take over the text from the rhs pane too. :-( so, care needed as you say (Ctrl-B Z temporarily)

  • @ayalfadhel
    @ayalfadhel 3 ปีที่แล้ว +5

    Thx Ippsec for being an inspiration

  • @spiritedaway99
    @spiritedaway99 3 ปีที่แล้ว +1

    thank you,I ve been workin on this for a week and you basically solved it in few hours soo cool,wish Id be in the same level as you one day :)

    • @kodany819
      @kodany819 3 ปีที่แล้ว

      You just din't know how it' worked normal

  • @almaring2839
    @almaring2839 3 ปีที่แล้ว +2

    @Ippsec The -p command stands for "Privileged"

  • @anonymousNoob992
    @anonymousNoob992 3 ปีที่แล้ว +1

    How did you know that there was a command injection vulnerability in the URL? What was your thought process when you did that?

    • @ippsec
      @ippsec  3 ปีที่แล้ว +6

      Saw the error say nsupdate, which is a binary

  • @SN-db8mv
    @SN-db8mv 3 ปีที่แล้ว +2

    this came in my recommended and I have no idea what I’m seeing or listening too

  • @diabawii
    @diabawii 3 ปีที่แล้ว +3

    by default, bash drops privilege to the user executed it(bindmgr) , with -p you telling it to not drop privilege back to (bindmgr) and stay as root

  • @ionelanicoleta1449
    @ionelanicoleta1449 3 ปีที่แล้ว

    can anyone please tell me why is he saying at 23:28 that he's controlling h, hees not root like he demonstrated in thate php code

  • @brettnieman3453
    @brettnieman3453 3 ปีที่แล้ว

    How would someone at a hotel wifi do a reverse lookup for your domain and access 22 of your firewalls?

    • @ippsec
      @ippsec  3 ปีที่แล้ว +1

      If I’m at the hotel, my laptop would update the ddns host to point to the hotel. Anyone at the hotel would have the same edge ip, so they could connect toy house.

  • @MoeJama5454
    @MoeJama5454 3 ปีที่แล้ว

    The way you pronounced Dyna DNS

  • @chuckwoolson9339
    @chuckwoolson9339 3 ปีที่แล้ว

    Another awesome video! Which hotel are you going to be staying at in the near future? Just wondering :D

  • @omkarpotpelwar1671
    @omkarpotpelwar1671 3 ปีที่แล้ว

    What if instead of pointing the dynamic dns towards our own ip address to login through ssh, you could have just edited the id_rsa and remove that rule. You also had read/write permissions on the file. Also, for getting root, you could have just put reverse shell in the sudo executable.

  • @declanmcardle
    @declanmcardle 2 ปีที่แล้ว

    @40:30 or sign your own key and adjust HostCertificate /in /etc/ssh/sshd_config so the ~/.ssh/authorized_keys isn't referenced...

    • @ippsec
      @ippsec  2 ปีที่แล้ว

      Yeah I don’t generally do that when recording because I don’t want be in the habit of using my private key and accidentally leaking the private key in a twitch stream when I’m explaining what’s happening

  • @declanmcardle
    @declanmcardle 2 ปีที่แล้ว

    Hmm...ssh-add -l| wc -l could be an issue here

  • @bikhlarrovamarakov5392
    @bikhlarrovamarakov5392 3 ปีที่แล้ว

    thanks master