HackTheBox - Resource
Source: YouTube · IppSec · published Nov 23, 2024 · 1:14:12
This video by IP from Hack The Box demonstrates an SSH authentication method using a Certificate Authority (CA) to sign public keys, offering advantages over traditional authorized_keys files such as expiration management and centralized control 0:00.
Key Takeaways:
• The primary focus is on using a CA to sign SSH keys, which allows for setting expiration times and simplifies key management compared to maintaining multiple authorized_keys files 0:06.
• The exploitation path begins with compromising a web application to access a Docker container 0:26.
• Inside the container, an old, legacy Certificate Authority file is discovered 0:30.
• This legacy CA lacks a principal file, requiring the attacker to sign a new key directly using the CA 0:34.
• By signing the key as root, the attacker can authenticate into the Docker environment as the root user 0:38.
This technique highlights how legacy cryptographic artifacts can lead to full system compromise if not properly managed.
Sources:
- 0:00 Introduction to the Hack The Box machine and the topic of SSH CA authentication.
- 0:06 Explanation of the benefits of using a CA for SSH key management.
- 0:26 Discovery of the Docker container after web app exploitation.
- 0:30 Identification of the legacy Certificate Authority file.
- 0:34 Details on the lack of a principal file in the legacy CA.
- 0:38
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IP I'm doing resource from hack the box and my favorite thing about this box is how it showcases the use of a certificate authority to sign SSH public keys for authentication which is just a cool way to manage SSH Keys as not only does it eliminate having to manage a 100 authorized key files but also lets you assign expiration times on keys so if you wanted to give someone access for a day a week a year whatever you can do that um but back to the Box there's two implementation showcased once you exploit a web app you land on a doc container and discover a old certificate Authority file and they say it's the Legacy Way right there's no principal file so you just have to use this CA file to sign keys if you sign it as root then you can log into the docker as r…