IppSec

HackTheBox SmartHire

IppSec — Sat, 26 Sep 2026 00:00:00 GMT

00:00 - Introduction
00:50 - Start of nmap
03:55 - We can enumerate valid usernames based upon time
07:00 - Enumerating subdomains with ffuf finding models.smarthire.htb
10:00 - Discovering MLFlow has Python Pickles
13:00 - Sidequest, the copy to clipboard doesn't work over http weakening our browser to allow clipboard access from HTTP
17:40 - Uploading a Python Pickle, showing that the --data-binary flag is important
25:40 - Got a HTTP Callback, getting a reverse shell
27:16 - Shell returned
29:50 - We can write to a plugins directory of a program we can run via sudo, begin of research to exploit
37:50 - Turns out for PTH files we need to put everything on one line. Getting root

HackTheBox - Silentium

IppSec — Sat, 12 Sep 2026 00:00:00 GMT

00:00 - Introduction
00:53 - Start of nmap
03:00 - Discovering the staging subdomain with ffuf
05:07 - The login has 3 different error messages allowing us to enumerate valid emails
06:50 - Forgot Password returns the entire user object, including reset token, taking over ben's account
10:30 - Finding an public RCE in Flowise, but this docker doesn't have bash that makes it a little tricky to get the reverse shell
16:35 - Shell returned getting a password from the environment then SSH into the box
20:55 - Accessing GOGS by creating a SSH Port Forward, then looking at the version to find a RCE (CVE-2025-8110)
25:40 - Creating a Git Repo so we can trigger the File Write uploading our SSH key to the root directory
27:50 - Sending the File Write command to GOGS

HackTheBox - Pirate

IppSec — Sat, 05 Sep 2026 00:00:00 GMT

00:00 - Introduction
01:05 - Start of nmap
04:00 - Running a lot of NXC Enumeration (users, computers, groups, delegation)
07:00 - Running Rusthound and looking over Bloodhound data, discovering delegation, pre-2k compatibility group, etc
14:30 - Abusing the Pre-2k Compatibility group to login as MS01 and dump GMSA Passwords
17:00 - WinRM to DC01, pivoting to Web01 via chisel
31:00 - Stealing the NTLM Hash, discovering NTLMv1 and attempting to crack it
34:30 - Using KrbRelayX to add the ippsec DNS record
48:20 - Unable to crack, doing NTLMRelay and coercer to trick the machine account to authenticate from HTTP to DC LDAP and then using set_rbcd to add a privilege that lets us impersonate users on this box
01:00:00 - Running SecretsDump with our impersonated account to dump the SAM, get A.White's password which can reset their ADM account password whom has a path to DA
01:07:00 - Updating the SPN's to point to the DC instead of WEB01 which lets us impersonate users to the domain and getting root
01:12:10 - Unintended: Showing a direct path from Web01 to A.White with RemotePotato0 and NTLMRelay

HackTheBox - Cobblestone

IppSec — Sat, 15 Aug 2026 00:00:00 GMT

00:00 - Introduction
01:00 - Start of nmap
03:00 - Creating an account on the main domain and discovering it doesn't create one on vote
05:30 - Discovering a SQL Injection when suggesting URL's on the vote application, converting it to Union Injection and showing SQLMap
10:15 - Union injection working, getting the payload over to SQLMAP so we can have it dump the database while we look at other things
15:30 - Going back to the Skin Suggestor, discovering XSS
17:50 - Having the XSS Send us back the page the victim is on, discovering a debug page is linked which contains PHPINFO
23:15 - The PHPINFO output reflects the PHP Cookie, creating a CSRF Payload to have the victim navigate to the PHPINFO page and send us the output to steal their cookies even thoe they are marked HTTPONLY
28:15 - Discovering SSTI, this is PHP so using a PHP TWIG Payload to get RCE, some commands fail discovering it is apparmor
35:15 - Failing to get a reverse shell for a while
41:08 - Using MySQL Dump to dump the database, the SQL injection didn't get this because its a different DB
45:50 - Shell returned as Cobblestone
51:00 - Discovering Cobbler is running, forward the post back to us, use XMLRPC to get RCE (a 2014 GitHub issue)
54:20 - Having Claude look at the issue and try to make a POC while we poke at it manually
58:48 - Proving we can bypass auth with -1 as the password, and getting shell

HackTheBox - Helix

IppSec — Sat, 08 Aug 2026 00:00:00 GMT

00:00 - Introduction
00:45 - Start of nmap
03:20 - Using FFUF to VHOST Bruteforce and finding flow.helix.htb
05:30 - Looking into H2 Database RCE's, finding the Alias Command allows us the ability to run Java
07:10 - RCE #1: Using H2 Syntax to create an alias to run a shell command
15:10 - RCE #2: Adding a Processor to run Groovy
18:00 - RCE #3: Adding a Command Processor to run a bash command
19:40 - RCE #4: Is it easier to just use Metasploit?
26:00 - Shell on the box, using Find to show the types of all the files in our CWD and finding an SSH Key
30:15 - Shell as Operator, cracking a PDF
38:00 - Running OPCUA-Client-GUI and editing the registers to put the device in maintenance mode