Скачать или смотреть HackTheBox - OpenKeyS

00:00 - Introduction
00:31 - Begin of nmap
01:10 - Nmap shows it is BSD, going over some command differences
02:00 - Running GoBuster to find other PHP Scripts
04:30 - Looking at the includes directory and finding source code
10:14 - Reversing the Check_Auth binary with Ghidra, to see it doesn't decompile well
12:00 - Using VirusTotal to find out if this an old binary
13:20 - Using Cutter to decompile this binary, to see it does a better job than Ghidra!
17:50 - Finding some BSD Exploits related to authentication
20:00 - Putting SCHALLENGE as the username, causes a different error message. Then doing some code analysis around $_REQUEST
24:50 - Abusing the $_REQUEST() feature to overwrite the username file with a valid user and grab their SSH Key
26:10 - Showing how OpenBSD has some different command line switches
31:00 - Going back to the earlier CVE, since it showed a privesc aswell and explaining CVE-2019-19520
40:45 - EXTRA: Looking at the PHP Code to explain the $_REQUEST exploit again