HackTheBox - Guardian
Source: YouTube · IppSec · published Feb 28, 2026 · 1:37:10
Guardian is a medium-to-hard Hack The Box machine where obtaining user access requires chaining multiple web vulnerabilities, while root access is achieved quickly afterward 0:00-0:13.
Key Takeaways:
• The initial web application phase involves brute-forcing accounts using default credentials and exploiting an iDrive vulnerability 0:15-0:19.
• The attacker reads chat messages to discover an outdated PHP Spreadsheet library vulnerable to Cross-Site Scripting (XSS) 0:19-0:23.
• The XSS vulnerability is used to steal cookies, which facilitates a Cross-Site Request Forgery (CSRF) attack to force an admin to create a new user account 0:23-0:29.
• Final privilege escalation is achieved by exploiting a PHP include statement using the PHP filter chain to obtain remote code execution 0:31-0:34.
This walkthrough demonstrates the importance of chaining seemingly minor web flaws to achieve significant access.
Sources:
- 0:00 Introduction to the Guardian machine difficulty and overview.
- 0:15 Initial web exploitation steps including brute-forcing and iDrive.
- 0:19 Discovery of the outdated PHP Spreadsheet library via chat.
- 0:23 Using XSS to steal cookies and leveraging CSRF for admin actions.
- 0:31 Exploiting PHP include for remote code execution.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing Guardian from Hack The Box, which is probably between a medium and hard difficulty as getting user can be tough as there's a multitude of web exploits we have to chain in order to get a shell, but once we get the shell the path to root is pretty quick. In the web app we will find a default password to brute force accounts with exploit an iDrive vulnerability and chat to read messages, discover an outdated version of PHP spreadsheet which is vulnerable to cross-site scripting which we will use to steal cookies with, abuse a cross-site request forgery vulnerability to get an admin to create a user on our behalf, and also exploit a PHP include statement with the PHP filter chain to get remote code execution. And then finally wi…