HackTheBox - Greenhorn
Source: YouTube · IppSec · published Dec 7, 2024 · 28:17
This video covers the Hack The Box "Greenhorn" machine walkthrough, highlighting how to exploit PluginCMS for initial access and demonstrating the dangers of improperly redacting sensitive information in PDFs 0:00.
Key Takeaways:
• Gaining user access is straightforward by exploiting PluginCMS, which leads to discovering a PDF containing hire instructions with a redacted password 0:11.
• Using effects like pixelize, twirl, or blur to redact text is highly insecure because these visual alterations can often be reversed to reveal the original data 0:23.
• To successfully recover the redacted password, you must carefully extract the image directly from the PDF to avoid extra artifacts and then use a tool called dpix to unpixel it 0:36.
The tricky root step serves as a practical reminder to always use solid black bars for document redaction rather than reversible image-altering effects.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is ipag I'm doing greenhorn from hack the box which was a relatively easy machine but the root step could be tricky because it's very particular how you perform each step the user steps straightforward as just exploting plug CMS and then when you get on the box you discover a PDF that has um like a new higher instructions and there's a password that has been redacted via a pixelize effect and whenever you redact things from a document you should just use a black bar to put over top of the text whenever you use effects like pixelize twirl blur things like that there's always a good chance it can be reversed and that's where the tricky part comes in there is a tool called dpix that can unpixel this image however you have to extract the image by right clicking on …