HackTheBox - Lantern
Source: YouTube · IppSec · published Nov 30, 2024 · 1:43:10
[BLUF] This walkthrough details the compromise of the "Lantern" Hack The Box machine, progressing from an SSRF vulnerability to SQL injection, and finally achieving root via a custom Go tool to decode keystrokes from a running process. 0:00
Key Takeaways:
• An SSRF in the Skipper Proxy allows enumeration of localhost ports, revealing an internal Blazer app on Port 5000. 0:05
• SQL injection in the internal app dumps the SQLite database to extract admin credentials. 0:16
• Credentials grant access to a second Blazer app with a directory traversal vulnerability in file uploads. 0:32
• A malicious .NET DLL is uploaded and executed via a module loader to achieve remote code execution. 0:37
• Privilege escalation to root involves using procmon to capture nano's write syscalls and decoding the typed password. 0:45
The video emphasizes chaining SSRF, SQLi, and file inclusion for initial access, followed by advanced eBPF analysis for privilege escalation.
Sources:
- 0:00 Introduction to Lantern and initial SSRF vector.
- 0:05 Enumerating localhost ports via SSRF to find internal services.
- 0:16 Exploiting SQL injection to dump the SQLite database.
- 0:21 Alternative credential extraction from DLL files.
- 0:32 Directory traversal in file upload and subsequent DLL execution.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC and we'll be doing lantern from hack the box which starts out with a server side request forgery and a web server which is SEC proy we can use this to enumerate ports listening on Local Host and discover an internal app is listening on Port 5000 and this app is vulnerable to SQL injection we can dump the sqlite database in order to get credentials but if this wasn't vulnerable to SQL injection the app is coded in Blazer and loading a dll directly so instead of doing the SQL injection we could also just extract it from the DL itself anyways this credential gives us access to another Blazer app which has two vulnerabilities the first is a directory traversal with file upload which is important because there's another endpoint that will load dlls so we can …