HackTheBox - Interface

IppSec · Beginner ·🌐 Frontend Engineering ·3y ago

Key Takeaways

Exploits directory traversal on HackTheBox - Interface to access API Server

Original Description

00:00 - Introduciton 00:50 - Start of nmap, navigating to the page and identifying the framework based upon 404 02:30 - Playing around looking at javascript source, not getting anything 04:30 - Playing around with prd.m.rengering-api.interface.htb... I'm guessing file not found is the webserver, not actual code. 07:40 - Showing the difficulty of dirbusting API Servers 11:20 - Showing importance of updating FeroxBuster 15:00 - Playing with the HTML2PDF endpoint and discovering we need to send a POST with HTML as an argument 18:20 - The PDF Generated has dompdf 1.2.0 in the exif data searching for exploits 20:40 - Researching how CVE-2022-28368 works, then manually exploiting the vulnerabiltiy 28:50 - The CSS/Font is created, running the exploit and finding where the Font (PHP File) gets uploaded to 34:30 - Reverse shell returned 38:15 - Uploading pspy to examine how the box cleans itself up 40:20 - Discovering and exploiting Bash Arithmetic Injection

Watch on YouTube ↗ (saves to browser)

Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

HHC2016 - Analytics

HHC2016 - Analytics

HackTheBox - October

HackTheBox - October

HackTheBox - Arctic

HackTheBox - Arctic

HackTheBox - Brainfuck

HackTheBox - Brainfuck

HackTheBox - Bank

HackTheBox - Bank

HackTheBox - Joker

HackTheBox - Joker

HackTheBox - Lazy

HackTheBox - Lazy

Camp CTF 2015 - Bitterman

Camp CTF 2015 - Bitterman

HackTheBox - Devel

HackTheBox - Devel

Reversing Malicious Office Document (Macro) Emotet(?)

Reversing Malicious Office Document (Macro) Emotet(?)

HackTheBox - Granny and Grandpa

HackTheBox - Granny and Grandpa

HackTheBox - Pivoting Update: Granny and Grandpa

HackTheBox - Pivoting Update: Granny and Grandpa

HackTheBox - Optimum

HackTheBox - Optimum

HackTheBox - Charon

HackTheBox - Charon

HackTheBox - Sneaky

HackTheBox - Sneaky

HackTheBox - Holiday

HackTheBox - Holiday

HackTheBox - Europa

HackTheBox - Europa

Introduction to tmux

Introduction to tmux

HackTheBox - Blocky

HackTheBox - Blocky

HackTheBox - Nineveh

HackTheBox - Nineveh

HackTheBox - Jail

HackTheBox - Jail

HackTheBox - Blue

HackTheBox - Blue

HackTheBox - Calamity

HackTheBox - Calamity

HackTheBox - Shrek

HackTheBox - Shrek

HackTheBox - Mirai

HackTheBox - Mirai

HackTheBox - Shocker

HackTheBox - Shocker

HackTheBox - Mantis

HackTheBox - Mantis

HackTheBox - Node

HackTheBox - Node

HackTheBox - Kotarak

HackTheBox - Kotarak

HackTheBox - Enterprise

HackTheBox - Enterprise

HackTheBox - Sense

HackTheBox - Sense

HackTheBox - Minion

HackTheBox - Minion

VulnHub - Sokar

VulnHub - Sokar

VulnHub - Pinkys Palace v2

VulnHub - Pinkys Palace v2

HackTheBox - Inception

HackTheBox - Inception

Vulnhub - Trollcave 1.2

Vulnhub - Trollcave 1.2

HackTheBox - Ariekei

HackTheBox - Ariekei

HackTheBox - Flux Capacitor

HackTheBox - Flux Capacitor

HackTheBox - Jeeves

HackTheBox - Jeeves

HackTheBox - Tally

HackTheBox - Tally

HackTheBox - CrimeStoppers

HackTheBox - CrimeStoppers

HackTheBox - Fulcrum

HackTheBox - Fulcrum

HackTheBox - Chatterbox

HackTheBox - Chatterbox

HackTheBox - Falafel

HackTheBox - Falafel

How To Create Empire Modules

How To Create Empire Modules

HackTheBox - Nightmare

HackTheBox - Nightmare

HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions

HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions

HackTheBox - Bart

HackTheBox - Bart

HackTheBox - Aragog

HackTheBox - Aragog

HackTheBox - Valentine

HackTheBox - Valentine

HackTheBox - Silo

HackTheBox - Silo

HackTheBox - Rabbit

HackTheBox - Rabbit

HackTheBox - Celestial

HackTheBox - Celestial

HackTheBox - Stratosphere

HackTheBox - Stratosphere

HackTheBox - Poison

HackTheBox - Poison

HackTheBox - Canape

HackTheBox - Canape

HackTheBox - Olympus

HackTheBox - Olympus

HackTheBox - Sunday

HackTheBox - Sunday

HackTheBox - Fighter

HackTheBox - Fighter

HackTheBox - Bounty

HackTheBox - Bounty

Related Reads

Creta Frontend Interview Experience | Remote Role

Learn from a candidate's frontend interview experience at Certa for a remote role

Medium · JavaScript

The Case of the Ghost Tooltip

Learn to identify and debug mysterious frontend bugs like the Ghost Tooltip

Medium · JavaScript

How I made a scroll-scrubbed video portfolio fast (Next.js 15 + GSAP + canvas)

Learn to create a scroll-scrubbed video portfolio quickly using Next.js, GSAP, and canvas

Dev.to · Pratham Sharma

5 Reasons HTML Is About to Change Frontend Development

HTML is evolving to play a more dynamic role in frontend development, and here's why it matters

Medium · Programming

Chapters (13)

Introduciton

0:50 Start of nmap, navigating to the page and identifying the framework based upon

2:30 Playing around looking at javascript source, not getting anything

4:30 Playing around with prd.m.rengering-api.interface.htb... I'm guessing file not

7:40 Showing the difficulty of dirbusting API Servers

11:20 Showing importance of updating FeroxBuster

15:00 Playing with the HTML2PDF endpoint and discovering we need to send a POST with

18:20 The PDF Generated has dompdf 1.2.0 in the exif data searching for exploits

20:40 Researching how CVE-2022-28368 works, then manually exploiting the vulnerabilt

28:50 The CSS/Font is created, running the exploit and finding where the Font (PHP F

34:30 Reverse shell returned

38:15 Uploading pspy to examine how the box cleans itself up

40:20 Discovering and exploiting Bash Arithmetic Injection

How to Speed Up Your WordPress Website with WP Rocket ⚡Tutorial 2026