HackTheBox - Trickster
Source: YouTube · IppSec · published Feb 1, 2025 · 52:26
This video demonstrates the full attack chain on Hack The Box "Trickster," progressing from open directory disclosure and CSRF-to-RCE on PrestaShop, through internal Docker enumeration and SSTI exploitation, to ultimately achieving root via a PrusaSlicer vulnerability 0:00.
Key Takeaways:
• Initial enumeration reveals a PrestaShop site with an exposed .git directory that leaks the hidden admin URL and exact software version 0:04.
• XSS is blocked by HTTP-only cookies, so a public PoC chains CSRF with RCE to trick the admin browser into installing a malicious theme with a PHP shell 0:13.
• Post-exploitation involves dumping the database, cracking hashes to obtain user credentials, and discovering a Docker container running "Change Detection" 0:22.
• The Change Detection service is exploited via Server-Side Template Injection (SSTI) to establish a foothold inside the container 0:31.
• Inside the container, brotli-compressed backups reveal credentials for the "adam" user, who can run PrusaSlicer as sudo—a binary vulnerable to RCE through post-processing scripts 0:36.
"Trickster" showcases a multi-stage web exploitation chain that transitions from external vulnerabilities to internal Docker services, culminating in a sudo misconfiguration that grants root access.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC and we'll be doing trickster from hack the box which starts off with finding a prester shop website with an open. directory that allows us to find the unique URL used for admin logins and it also provides the prester Shop version so some Googling around shows that prester shop is vulnerable to cross-site scripting but the HTTP only cookie is set so we can't just steal the admin cookie but thankfully the proof of concept has a cross site request forgery rce chain for us that would use the admin's web browser to upload a malicious theme with a shell on the box we can dump the prea shop database for more credentials and find another website called change detection is running this is vulnerable to service side template injection once we shell that we get acc…