YT YouTube2Text

YouTube2Text → Transcripts → 🥷 Resumen de cómo DETECTAR y Explotar VULNERABILIDADES Paso a Paso | HACKING ÉTICO y Ciberseguridad

🥷 Resumen de cómo DETECTAR y Explotar VULNERABILIDADES Paso a Paso | HACKING ÉTICO y Ciberseguridad — Transcript

by El Pingüino de Mario · 5,655 words · 794 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Welcome to my channel, welcome to a new
0:02video, and today we're going to do the
0:03following. We're going to make a
0:05machine, a slightly complicated machine
0:07for our Dockerlaps platform. We're
0:09going to make the Summer Vibes machine.
0:11See? If I type Summer here, we'll have
0:14this machine in the search engine,
0:15which is a difficult machine, although
0:18it's not that difficult in itself; but
0:20it's a long machine, it's a machine
0:22that considers the exploitation of
0:23several vulnerabilities: you have to do
0:26a fairly complete intrusion process. So
0:28, that makes it ideal for practicing
0:30hacking, even if you're just starting
0:33out. We're going to see things like
0:35first a really basic port scan with
0:37Nmap, then port enumeration. We're
0:40going to go into each one of them and
0:41analyze them. Then we're going to fing
0:43web, we're going to find directories.
0:45Once we have found directories, we are
0:47going to identify vulnerable services,
0:49the version of said service, we are
0:51going to see if there are exploits, we
0:53are going to test some of them, we are
0:56going to use brute force, we are going
0:58to do an intrusion, we will exploit
1:00several vulnerabilities and enter the
1:02machine. So, well, this is basically
1:04going to be a summary. I think it is
1:06going to be ideal for those who are
1:08starting out in hacking. So, well, I
1:09highly recommend this machine and let's
1:11get to it. Well, in my case, well, I am
1:13going to download it. Let's go here to
1:16the Mega link and click on end, and
1:17this machine is also very good in my
1:19opinion because it exploits a
1:20vulnerability that came out very
1:22recently, it is from this year. So
1:24sometimes it is very good to practice
1:26hacking with current things, well,
1:28things that are recent, because I think
1:30that helps a lot, right? Well, here we
1:32have the zip point. Let's open it and
1:34now, well, we simply extract the
1:36contents of this file. Zip to the
1:38desktop. Well, as you know, this is how
1:40it works in Dockerlaps. We have an
1:42auto-deployment script and then we have
1:44the machine itself. So, we're going to
1:47run this machine like this. Let's go to
1:50the desktop and type in auto-deploy and
1:52pass it the Summer Vipes machine. Well,
1:56once we've done this, notice that the
1:57auto-deployment script takes care of
1:59everything. We forget about it, wait a
2:02bit and voila, we have the IP provided
2:04here. Let's ping it and see. And we
2:07have connectivity. Well, now we're
2:09going to start the hacking process step
2:11by step. But I think before we continue
2:14, at least I'm hearing a noise here, I
2:16don't know if you're hearing it too. I
2:18think there's a noise here in the
2:19background. And yes, I think it's a
2:22message from our sponsor Rayola
2:25Networks. If you're thinking of setting
2:27up a website, Rayola Networks is your
2:29solution. They offer different SSD
2:31hosting rates, so we're guaranteed high
2:33speed on our website. In addition, with
2:36these offers we can have a 20%discount
2:38on annual contracts along with the
2:40registration or transfer of a free
2:42domain, which allows us to have
2:43everything we need to get started with
2:45hosting plus a domain at a really
2:47affordable price for the channel's
2:49followers. Whether we want a single
2:51domain, more than one domain, depending
2:53on the storage, that is, if we want to
2:56create a web page, these offers are
2:58ideal. In addition, as we can see on
3:00their website, they also have 24-hour
3:02support by phone or ticket, as well as
3:05a 30-day warranty, support for
3:07WordPress, a very important high-speed
3:09SSD and also an SSL certificate
3:11included. Also, in case you already
3:14have another provider and want to make
3:16the change, Rayola Networks offers free
3:18migration, as well as automatic backups
3:20every day and free tutorials and
3:22resources. Here we also have more
3:24detailed information, the different
3:26rates depending on our needs. We have
3:29everything from the most basic plan,
3:30which is still very complete, to a much
3:32more advanced plan such as the Pro plan
3:34. So, ultimately, if you want to create
3:37a website, Rayola Networks is ideal.
3:39And that's it. Well, now we've seen
3:40this wonderful little message. Let's
3:42continue with the video. Well, well,
3:44well. Okay, let's start with the
3:46step-by-step hacking process of this
3:47vulnerable machine. We can see that we
3:49have connectivity. Let's start with
3:51step number one. This is very much
3:53focused on those who are starting out
3:55in cybersecurity. When I come across a
3:57system, when I want to, well, when I
3:59have a goal, step number one, well,
4:01apart from first launching the ping
4:03command, etc., etc., is to perform a
4:05scan for open ports with Nmap. That is,
4:08we would do it like this. NMAP is a
4:11tool to find open ports on a system, be
4:14it Linux or Windows, whatever. So, with
4:17NMAP, using this series of parameters,
4:20I'm scanning for ports that may be open
4:23on this machine, which in this case is
4:25the IP of the victim machine. Well, P-
4:28is to cover the entire range of open
4:30ports. This is good, gu SS SIM-type
4:33scanning is so that the TCP connection
4:35is not completely completed because
4:37NMAP does not need to wait for the
4:39entire TCP connection to be completed
4:41to be able to know if a port is open or
4:44not. So, by doing this, we can make the
4:46scan faster and at the same time make
4:48it a little more useful. gu SC is a set
4:50of skips that NMAP has to be able to do
4:52this recognition, to be able to give us
4:54much more information. SV is so that on
4:57each port, for example, if Apache is
4:59running on port 80, it shows me the
5:01Apache version, as well as any other
5:03port, whether it's port 21, if it's
5:05running a VSFTPD, if it's running a Pro
5:08FTP, whatever, it's going to show me
5:10the min rate version so that this scan
5:12goes really fast. Uh, we can set it to
5:143000, we can set it to 5000. When we
5:16are in a controlled environment, 5,000
5:18is perfect because this is going to be
5:20quite powerful, what happens is that it
5:22is going to make quite a lot of noise,
5:24but since we are here in a controlled
5:26environment, there is no problem. Minus
5:28N so that it does not perform NS
5:29resolution. This is something that
5:30takes a long time. Triple verbose for
5:33Kenemap as it advances, as it does this
5:35scan, so that it reports to me what it
5:38finds as it goes. And then the PN dash
5:41parameter, basically to, well, that's
5:43it, to not use the ping command to do
5:46this reconnaissance. And well, here I
5:49could use the minus on parameter to
5:51save this entire report in a file
5:53called scan or also pingü scan. The
5:56name is very important. Well, doing
5:58this, notice that we are finding open
6:00ports, port 80 and port 22 SSH. Okay,
6:03by default SSH runs on port 22 and HTTP
6:06runs on port 80. Well, we are indeed
6:09checking it. Open SSH version 8.9 is
6:12quite corrupted. Let's remember that if
6:15it were version 7.7 or earlier, for
6:16example, there would be a user
6:18enumeration exploit, but in this case
6:20it doesn't apply because it is a fairly
6:22current version. Well, in this report
6:24we can already obtain, well, let's say,
6:26information about the machine beyond
6:28the issue of open ports. For example,
6:30look at this that says Ubuntu 0.7 here.
6:33I can find out the exact version of
6:35Ubuntu with this information. How can I
6:37find out? Well, you'll see it like this
6:38. I paste this into the browser and
6:41here we have the Launchpad website, and
6:43if we go here we can see the Ubuntu
6:45version. In this case it is the Yumi
6:47version. It is also a current version,
6:50well, we can put Ubuntu Yami here and
6:53it is the Ubuntu 2204 version, well,
6:55long-term support, right? Well, perfect
6:58, we are obtaining information. This
7:00can be very useful because we could
7:02already know if it was an old version
7:04or not, but in this case it is quite
7:05current. Well, let's take a look at
7:07port 80, shall we? We are interested in
7:09port 80. Let's go to the browser and
7:12type 172.17.0.2. If I enter the IP of
7:17the victim machine in the browser, what
7:19I will get is to view the content of
7:21port 80. If, for example, port 43 were
7:24open, which would be the port where the
7:26https protocol runs by default, which
7:28would be like this but with encryption,
7:31then we would have to enter through
7:33port 4.3, which would be here, by
7:35typing https. But here, when I just
7:38type the IP, it's like typing http,
7:40colon, slash, slash, which would
7:42basically be insecure. Okay, perfect.
7:45Well, here we have a little bit of this
7:47little Apache template. This is, well,
7:48when you install Apache, this appears
7:50by default. Okay, something very
7:52important to do, well, when we are at
7:55this point, is to do web fucing, that
7:57is, web fucing is a technique that
7:59allows us to find directories or files
8:01within this server, within this website
8:04. Imagine that here after this, well,
8:07this IP, there is a bar login/admin/
8:10upload, anything, whether files, for
8:13example, in welcome.php PHP, such as a
8:16welcome SIMAS, a welcome directory.
8:20Well, for both cases, to be able to
8:22find this, we have the web fucing
8:23technique and for that we can use
8:25several tools. We have Dirf, Gobustter,
8:28Ufut, Fuf, uh Dir Search, there are
8:30many. For example, I'm going to use
8:33Gobuster, Gobuster Dir. And then I say,
8:36"Hey, I want you to find directories
8:37for me and I say minus U, so here we're
8:39going to paste the URL http colon slash
8:41slash and paste the IP of the target
8:43machine, right? Now, with the minus W
8:45parameter, here we're going to load a
8:47directory list. User directory list,
8:49seclist, Discovery, I think I remember,
8:52Web Content directory list, lower case,
8:55as far as I remember, yes, and for
8:57example medium. Well, here I'm loading
9:00a dictionary that has, on each line,
9:02many possible paths of a system, many
9:05in fact. Well, we're using this
9:07dictionary: directory list lowcase 2.3
9:09medium. Remember that this is inside
9:11the checklist directory. This by
9:13default depends on the CALI, it may or
9:15may not be installed. If this is not
9:17installed for you, you put sudo aptal
9:19segist, this here and that's it. And
9:22this entire path is created for you.
9:24Well, if I do this here, for example,
9:25this is what it's going to do. What
9:26we're going to do is search for web
9:28directories. In this case, there's an
9:30issue, and that is, well, this is
9:32nothing because this is already there
9:33by default. In this case, it happens
9:36that if the directory is not found in
9:38this dictionary, Gobuster won't find
9:40any path for me. That's normal. The
9:43path must be in the dictionary. So, in
9:45this case, it's a bit of a mischievous
9:47machine. Well, it won't find it here,
9:50unless we go to the source code and I
9:53intentionally left a little clue down
9:55here to show you this, right? To show
9:58you that sometimes if the directory is
10:00a bit strange, Gobuster won't find it
10:03because it won't be in the dictionary.
10:05Here we have, look, CMS Miss Simple and
10:07Instal Gear. Well, here we have a CMS
10:09Miss Simple, uh, which is installed
10:12here. To access it, CMS MS. Well, it
10:15seems that there is a directory, but
10:18since it wasn't in the dictionary, it
10:21can't find it. Let's do a test. Let's
10:23go here and, well, let's go. Let's see
10:25if this directory exists and it does
10:27exist. That's why it's very important
10:29to do a good enumeration and be able to
10:30find all the directories properly.
10:31Let's remember that we haven't found
10:34this because it wasn't within this
10:36dictionary. Let's do a test. For
10:39example, I could edit this. You see, I
10:42can edit this here. And what happens if
10:45I, for example, add cms ms here, for
10:48example? No, manually. Well, now we're
10:50going to see how Gobuster will find it.
10:53See? Now it did find it because now I
10:55added it within the dictionary and if
10:57it's added, I can find it. Well, CMS,
11:00MS, perfect. Well, this vulnerability
11:03is quite nice because this is basically
11:06a CMS. A CMS is basically a, well, yes,
11:09a tool that allows you to create web
11:12pages in a fairly simple way compared
11:14to doing them by hand, so to speak,
11:17right? Well, doing it with code is
11:19basically a good thing, a content
11:21manager, right? For example, WordPress
11:23is a CMS Drupal Magento and we also
11:25have CMS Simple which is another option
11:27, it's another alternative. Well, I
11:29installed this and so something that
11:31you should always do is check the
11:33version, right? Let's do some research.
11:35That is to say, whenever you come
11:37across a service, a website, anything,
11:40the first thing you should check, or at
11:42least almost the first thing, is the
11:44version. In this case, here we are
11:46seeing what this site says. Well, it's
11:48made in CMS M Simple version 2219. Well
11:52, this is information that you should
11:54always check, you have to consult. We
11:56can see it manually or in many cases,
11:58well, you could use tools like What.
12:01Wordweb is a tool that, at the terminal
12:04level, shows us a lot of information
12:06about a web page. Well, we can also
12:08find the version here. So, if we can't
12:14find it manually, it's advisable to
12:16also use these tools as a plan B,
12:18because maybe we can't see the version
12:20by looking at it, but hey, we have
12:21tools to be able to list it. Version
12:252219. Okay, perfect. Let's go to the
12:28internet now and I'm going to type CMS
12:31Mate simple version 2219 and we have to
12:34type exploit. Let's see if there are
12:37exploits to exploit this. And they do
12:41exist in version 2219. Let's look at
12:43something else now. CMS M simple latest
12:47version. Let's see the latest version
12:50of this CMS. And we can see that the
12:52latest version is 2219, that is, we are
12:55dealing with, well, let's say, a tool
12:57that is updated to the latest version,
13:00very updated. And even so, let's see
13:02how we can compromise it. Okay, perfect
13:05. Let's see what we have here. We have,
13:06well, look, for example, the first one
13:08is called simple, SSTI, a Site Template
13:11Injection server. Okay, perfect. Here
13:13we are seeing a little bit how this is
13:14exploited. Look, here it says," Hey,
13:16log in as the admin user and then go to
13:18the dising manager directory. "Okay, it
13:21goes through a few steps. I have a
13:22video on my channel explaining this
13:24vulnerability. Basically, if we test a
13:26paylot like MX, and we see that the web
13:29calculates and interprets it in the
13:31output, it means that it is vulnerable
13:34to SV6 Template Injection. What happens
13:37is that this does not imply that we
13:39already have remote command execution,
13:41it depends on other things, but anyway,
13:43it would be vulnerable. Well, what
13:45happens? Well, yes or yes, we have to
13:47log in as the admin user. So, let's do
13:49one thing. Let's copy the URL and fuze
13:52the CMS directory again. That is, we
13:55are not going to do it, let's say, to
13:57the IP, but now also to this directory.
13:59Let's go there. And here it does find
14:01many things. You see that the web
14:04fuzing technique is quite important.
14:06Well, we have an admin directory that
14:08right here in GitHub tells us that we
14:10have to log in as admin. In other words
14:13, let's see if we can access this panel
14:14. Let's go. to put admin. And perfect,
14:18we are seeing an admin panel, a login
14:20panel. We can try admin, for example,
14:23right? I mean, here you always have to
14:26try a few typical combinations, right?
14:28Root, root and cms for example. But no,
14:33I'm telling you no. Well, look at the
14:35error message. Username or password
14:37incorrect. Well, when I don't have any
14:40data, well, you can do brute force
14:42attacks. What happens? I could do it
14:45here with Hidra. Well, usually with
14:47Idla, when we do a brute force attack,
14:50whether it's SSH, FTP, MySQL, SMB, it's
14:52simple because it's always the same
14:54syntax, but when it comes to doing a
14:57brute force attack here on a website,
14:59things change a little and it gets a
15:01little bit complicated. Even so, we're
15:03going to see it here step by step. How
15:05can I do a brute force attack on a web
15:08login panel? Well, let's see a little
15:10how it's done. First, let's do a brute
15:11force attack on a web login panel.
15:12intercept this request with Bursuit.
15:14Bursuit is a proxy, that is, here I
15:16have Bursuit. Bursuit is a fairly
15:18essential tool in the context of web
15:20hacking and it is used first to
15:22intercept a request and then manipulate
15:25it. We can manipulate it, we can see
15:27how the information is sent, how it is
15:29processed behind the scenes and that is
15:31essential when exploiting a
15:32vulnerability, right? So, well, first I
15:34am going to open Bursuit because I want
15:36to see how this is being sent behind
15:37the scenes. Well, let's intercept.
15:40intercept is on. And now, inside the
15:42browser, in my case I use Firefox,
15:44let's go all the way down to where it
15:46says Network Settings, let's activate
15:48this: manual proxy configuration,
15:51saying:" Hey, from now on I want
15:53everything I do from the browser to go
15:55through the Bursuit proxy, which
15:57Bursuit runs on port 8080 of our local
15:59host by default. "Well, let's put it
16:02here and then right now, well, if I
16:05click submit here sending data, it will
16:08work. Look, admin, for example, admin
16:11submit and okay, perfect, we have
16:14received it with burso. Okay, now at
16:17this point, how can I, based on this
16:19information, specify it to Hydra, which
16:21is the tool used to perform brute force
16:23and make the attack work properly? Well
16:25, let's see a little bit about how it
16:26would be done. You see, the first thing
16:28will be to type hydra. Hydra-l and here
16:30, what happens is that we do not have a
16:32username or password, but in these
16:34cases, hey, we have to try to see if
16:37the admin user exists. So, we are going
16:39to type admin, which is usually a user
16:41that exists, it is worth testing. Well,
16:43we type men admin, we type men because
16:46the data that I do know is the data
16:48that we put in lowercase. And now gu p
16:51in uppercase, we put the data that I do
16:53not know, which is the password user
16:56ser gorlish, rogu, which is a
16:57dictionary that has many possible
17:00passwords. Okay, now next step. Well,
17:04here we are seeing that this request is
17:06being transmitted by post. Note here
17:07that it says post. Well then, this must
17:10be specified. You have to put http http
17:14post form. And now here we put a colon,
17:17slash, slash and we have to put exactly
17:19the path to get here. And well, what
17:21path is it? Well, this one here.
17:23cmsadminlogin.php. Perfect. We paste
17:26this and now here we put a colon and we
17:29have to put this here. username,
17:31password and login submit. We are going
17:34to copy this, we are going to paste it
17:35here. And now, yes, we are going to
17:37correct it. Okay, username is fine.
17:40Where it says admin, we are going to
17:42remove this and we have to put the
17:44circumflex symbol and we put uh user
17:46and close again, well, the circumflex
17:49symbol. Now we put password and in
17:51password we put exactly the same,
17:54circumflex and we put pass and
17:56circumflex again. And now a login
17:59submit equals submit. This is fine. And
18:02now we put a colon and we have to put
18:04basically the error message that
18:06appears for each failed login attempt
18:08because that way Hydra can know when an
18:10attempt has been successful and when
18:13not, that is something very important.
18:15So let's go here and paste it exactly
18:18as is. There it is. Username or
18:20password incorrect. Identical. We have
18:22to put everything the same. Well, if I
18:24execute this, we are going to do a
18:26little brute force attack. Well, it
18:28gives me a little error and okay, now I
18:29know why it failed and it is because I
18:31did not put the IP address. 172.17.0.2.
18:34A pretty silly mistake. And here now we
18:37put double slash and this should work
18:40correctly. We do the attack and well,
18:42it seems that it does, it seems to work
18:43. Done, it basically found the user
18:46adminate. Very good, let's test it.
18:49Let's go here to the browser, we put
18:51admin, password chocolate and let's see
18:53if it works. And it works. We are in.
18:55Perfect. Now, once this is done, we can
18:57follow the instructions of this exploit
18:59, because we are now inside the
19:01administration panel of this CMS. It
19:03says," Hey, log in as admin and then go
19:05to the out section. "Let's go to the
19:08Design Manager section. Design Manager
19:12and then Breath Cramps. Let's go here
19:14to Bridcamps which is here. Perfect.
19:16And it says now over here, okay? Well
19:18now, well, insert for example, uh this
19:21PU, for example, 7x and let's see if
19:23the calculation 49 is displayed within
19:26this URL. Let's test it. Let's remove
19:29all this. This outside. We paste this,
19:32click apply and well, now if we enter
19:35this URL of the index.php page
19:37templates, let's test it. Let's test it
19:40. We remove all this, paste this here
19:43and it works. Look, 49. We're seeing it
19:46here at this point. 49. Well, this is
19:48vulnerable to template injection, which
19:50you already know we have a video on my
19:52channel, since I did it a while ago.
19:54Let's go to Jitha. Jitha payloads all
19:57the things server temp injection. Let's
19:59see a little bit of the instructions.
20:01Here we have this wonderful repository
20:03that explains very well how to exploit
20:05this vulnerability in many different
20:07technologies. In this case, We are in
20:09PHP because this is a CMS that works
20:11with PHP. So, well, we have to locate
20:14ourselves here. PHP or Smarty or Dig,
20:16it depends on the template that is
20:18running behind. How can I check that?
20:21Well, by testing. Look, look, here it
20:23says," Hey, Smarty is, let's say, the
20:26PHP template. "Let's copy, for example,
20:28this, Smarty Version, and let's see if
20:30this interprets it for us. So, if this
20:32interprets it for us, well, we can
20:34confirm that the template is Smarty.
20:37Well, let's go. Here we paste this,
20:39apply it and right now, look, version
20:42421, it works. We are looking at a
20:45Smarty template. What happens? We are
20:47looking at version 4 421. And here,
20:49what happens? What is the issue? Well,
20:51look, look, here I could execute PHP
20:54commands, echo, ID, system, LS. And
20:56with this we could already do the
20:57intrusion, but what happens? Here it
20:59says compatible with version 3 and we
21:02are on version 4, so it will not work.
21:04I can do a test. I can paste this here,
21:07I click apply and we see that it does
21:10not work. Normally, it does not work,
21:12nothing happens. This website is
21:14vulnerable to CB7 Play Injeestion, but
21:16what happens is that from there we can
21:17derive it to an RC, to a remote
21:19execution of commands, that is already
21:20Another story. But hey, that's okay.
21:22Let's keep listing, let's go back and
21:24see what else we can do. CMSM simple
21:272219 remote code execution, remote
21:30command execution, exactly what we want
21:33. Well, log in as admin, go to the
21:35extensions section and go to user
21:37define tags. Let's go there. Let's go
21:39to the extensions section, user define
21:42tags. And it says," Okay, once you're
21:44there, well, for example, paste this
21:46hair here, which is the typical code in
21:47PHP to be able to execute a system
21:49command. For example, let's go here. "
21:51Okay, so we delete this code, this text
21:54, paste ours, and hit run. Yes. Okay,
21:58let's do it again. Let's see. And it
22:00works. Now, we are executing commands
22:03remotely. What happens when I manage to
22:06execute commands remotely? What is my
22:08goal? Well, my goal is to be able to
22:10get into the machine from here. How do
22:12we get in? By using a reverse proxy.
22:15There is a website called Repselles,
22:17which is 100%recommended. Here I can do
22:19something. I can first enter the IP of
22:22my attacking machine, which would be
22:24192.168.0.20, and for example, here I
22:27can enter a port to listen. Remember,
22:29if I want to know the IP of my
22:31attacking machine, we have the if
22:32config command. With the if config
22:34command. Here we are checking it.
22:36Interface eth0, the IP of my attacking
22:38machine, although in this case this one
22:41would have also worked, because we are
22:43using a Dockerlaps, in both cases it
22:46works, but anyway, I'm going to do it
22:48with this IP, point 20. Perfect. So
22:51let's copy all this from here. And well
22:54, if instead of the ID command I
22:56execute this, well, maybe we can get a
22:58reversal. And now with Netcat I start
23:01listening waiting for an incoming
23:03connection. And well, let's try it. If
23:05I send this, we send it. Well, nothing,
23:08again because this seems like it has to
23:10be clicked twice and mm it didn't work.
23:13It didn't work. Why didn't it work?
23:15Because this payload depends on the
23:17context, especially if we launch it
23:20from a web, it has to be encapsulated
23:22within bas C. And now, in quotes we put
23:25it like this. So, in this more
23:27encapsulated way, then it should work.
23:30Let's try it. We hit run. We see that
23:33nothing happens. Let's hit it again.
23:35And now it did work. We are now inside
23:38the machine. We have exploited two
23:40vulnerabilities, but one of them was an
23:42RCE, a remote command execution and
23:44That's what makes it so dangerous, well
23:46, having a website or something that is
23:48vulnerable to remote command execution,
23:50because that implies that we can enter
23:52the machine. Well, let's do a little
23:54TTI treatment, which is also a
23:56fundamental step when escalating
23:57privileges. What happens now? Well, if
23:59I type, for example, clear, you can see
24:01that this doesn't clear. If I type
24:02control C, I lose the connection. Well,
24:06how can I fix this? Well, I fix it this
24:08way, by doing TTI treatment. So, first,
24:11well, I'm going to go to the root and
24:14then we do script of nul minus cebas.
24:17We type this. Okay, now I type cr z
24:20stti raco. Fg. So now we type reset x
24:25term and right now I have to create two
24:27environment variables. Sport sell to
24:31base. We're going to use a base like
24:34sell and sport term equal to eh equal
24:37to x term. So now it's like this. Look,
24:39if I type control C. I don't lose the
24:41connection. If I can clear, the
24:43terminal is cleared. We're in now. Okay
24:46, what's the only thing? Okay, what's
24:48the last thing we need? Well, right now
24:50we have to put the columns. You see,
24:52let's go to my cali and put stt size.
24:57So, what I have to do is resize the
25:00size of this session, basically with
25:03the same dimension as my screen. So,
25:06well, it would be like this. Let's copy
25:08this 30 and this 134 and right now we
25:12put stti rowe. So rows are 30 and
25:15columns are 184. There we go. Now we
25:19have it. We already have 100%treatment
25:21of the TTI. Okay, now, what things do I
25:23have to do to be able to escalate
25:25privileges? Well, first we can execute
25:27the command sudo minus L, but it's not
25:29going to work to see if I can execute
25:31as root or as another user some binary
25:33or command. We can't. The second thing,
25:36basically execute binaries with suid
25:38enabled. Fine barrita perm errors to
25:44death null. I mean, this way, well, we
25:48could run binaries as root, but we
25:49can't because these that don't appear
25:51here are, let's say, normal. Well, what
25:54else can we look at? OPT directory,
25:56because hey, maybe there are
25:58interesting things here, right? But
26:00there are no hidden files either. Now
26:03let's look at the ETC Pass WD to see
26:05the existence of users in the system.
26:08There are none more. Well, we do have
26:10the CMS user, but this one, well, this
26:11one is nothing more. There are no more
26:13users. The only thing we have is the
26:16root user, su root, but we can't scale.
26:19What can we do at this point? Well,
26:21here we have two options. Well, on
26:23GitHub, a while ago I created this
26:26script which is sudo brosa, to a user
26:30within the Linux system, for example,
26:32to root or whoever. Well, you can
26:35simply pass it the Rogu, Mario user or
26:38root, whoever. In this case, it's root
26:40and this does brute force, right? And
26:41it finds the password, which, well,
26:43coincidentally, I put the same one, the
26:45password chocolate. Well, we can do
26:47that. In this case, I'm telling you
26:49that the password is chocolate, which
26:51is the same one that was inside the
26:53simple CMS M. Why did I do this?
26:55Because, well, password reuse is quite
26:57common and it's something that's worth
27:00keeping in mind at all times. When I
27:02come across a password, I should
27:03already have it in mind so that I can
27:05reuse it whenever I can. In that
27:07context, it's worth trying. So, the
27:09goal of this machine is also the same,
27:11to try reusing the same password,
27:13because as incredible as it may seem,
27:15it can work. How many people are there
27:18who, well, use the same password for
27:20everything? A lot, a lot of people. And
27:22I was the first one back in the day.
27:23Hey, be careful, hey, now it's won,
27:24obviously. Well, that's basically how
27:27an intrusion process is carried out on
27:29this machine, which is actually quite
27:31extensive, which is this machine, the
27:33Summer Vibes machine. I think it's very
27:35, very useful for understanding many
27:37things about hacking. Okay, let's
27:38remember, if I'm done with the machine,
27:41you know that in Dockerlabs, well, if I
27:43put control C in this autodeployment
27:45script, the script takes care of
27:46removing everything and we forget about
27:48it. This script is really wonderful,
27:51I'm really proud of it. I'm really
27:53proud of my little one. And well, look,
27:55there it is, it worked. Now there's no
27:57trace of this machine inside Docker.
28:00Look, well, there are many containers
28:02here, but these are for other things,
28:04right? It's because I'm doing a lot of
28:06machines and a lot of tests, so I don't
28:08care about this. Well, here we have the
28:10machine. As you know, guys. In
28:12Dockerlabs there are no flags, that is,
28:14there's no flash here like TR hand me
28:15hat from box in other tools. What there
28:17is is ROS, that is, when you make a
28:20machine, you can send me your right
28:22apps, well, let's put it this way. For
28:24example, this machine, the Summer
28:26machine. Vipes. Here we have, let's say
28:29, a small menu to send me your tutorial
28:31. You put the author and the URL. For
28:33example, if you have it on GitHub,
28:34Ritap, well, ideal. And that's how I
28:37would basically put it here in this
28:39section. So now you know that instead
28:41of having flags in Dockerlaps, what
28:43there are are rits, which I think is
28:45the best way to demonstrate that you
28:47have compromised a machine and that you
28:49have understood it by documenting
28:50everything, which is a very, very good
28:52practice. So, well, tremendous video,
28:55honestly, a pretty powerful video there
28:56, to say the least. I hope you have
28:58learned, I hope you have liked it. I
28:59really did. I think it is a video that
29:01summarizes very well an intrusion
29:03process from beginning to end and I
29:05think for those who are just starting
29:07out or also those who have been doing
29:09it for a while, I think you learn
29:10things, you learn things and it always
29:12comes in handy. Well, as you know, at
29:15DCAS we have a lot of machines, we have
29:17more In labs, we have a lot, and well,
29:19there will be many more each time, so
29:21here, well, you'll be able to practice
29:23a lot. And then here we have this from
29:26Cominum, which is a little surprise
29:27that I can't say anything more about. I
29:30won't say more, I won't say more, but
29:31well, I'll keep you informed right away
29:32. So, guys, I hope you liked it, I hope
29:34you learned, and I'll see you on this
29:36channel and on Twitch, because remember
29:38that we have Discord and Telegram
29:40channels, which are all in the video
29:41description. And then we also have a
29:43Twitch channel, where we go live twice
29:45or three times a week, depending, more
29:48or less live, so that we can learn
29:49everything, all together, this same
29:51thing, learning hacking. So, I'll say
29:53goodbye and I'll see you another time.
29:56Until next time. Yeah.

About this transcript

This page contains the full transcript of 🥷 Resumen de cómo DETECTAR y Explotar VULNERABILIDADES Paso a Paso | HACKING ÉTICO y Ciberseguridad by El Pingüino de Mario, generated from the public captions YouTube serves with the video. The transcript has 5,655 words across 794 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.