HackTheBox - Sightless
Source: YouTube · IppSec · published Jan 11, 2025 · 52:56
This CTF walkthrough for the "Sightless" Hack The Box machine demonstrates exploiting an outdated SQLPad application to gain initial Docker access, then pivoting to the host via an exposed Chrome debug port to bypass intended XSS exploitation paths 0:00.
Key Takeaways:
• SQLPad version 6.1.0 contains a template injection vulnerability allowing Remote Code Execution (RCE) and a shell within a Docker container 0:16.
• Inside the container, the attacker retrieves SSH credentials for the host machine from the Docker shadow file 0:21.
• An unintended root path involves exploiting a headless Chrome instance with an exposed remote debugging port to intercept Froxlor admin credentials 0:27.
• The intended path requires exploiting a blind XSS vulnerability in Froxlor to add a new admin user, followed by FTP access 0:32.
• Root access is achieved by decrypting a KeePass database found in the user's FTP directory using a cracked master password 0:45.
The challenge illustrates how exposed debug interfaces can inadvertently simplify exploitation chains, while also highlighting the importance of following intended vulnerability paths for comprehensive access.
Sources:
- 0:00 Introduction to the Sightless machine and initial Nmap enumeration
- 0:05 Identification of SQLPad SSRF and version 6.1.0
- 0:16 Exploiting template injection for RCE and Docker shell
- 0:21 Extracting SSH credentials from the Docker container
- [0:27](https://www.youtube.com/watch?v=6
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IC and today we'll be doing sightless from hack the box which is a nice easy box it starts off with finding an outdated version of SQL pad running which has several vulnerabilities we'll play with the server side request forgery but really this just gets us Recon information it doesn't really do anything valuable the key vulnerability is a template injection that leads to remote code execution and gives us shell on a Docker container which we find credentials that lets us SSH into the host from the HST there are two paths to Route the intended way involves exploiting a cross-site scripting vulnerability and fro but to simulate this xss there is a headless Chrome running with the debug Port exposed so we can skip the whole cross-site scripting by accessing th…