Skip to main content
CPEBuddy
HackTheBox - Backfire

HackTheBox - Backfire

Source: YouTube · IppSec · published Jun 7, 2025 · 50:56

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video walks through hacking the Hack The Box "Backfire" machine by exploiting two distinct Command and Control (C2) frameworks to escalate from initial access to root 0:00-0:05.

Key Takeaways:
• The Havoc C2 is compromised by spoofing an implant to execute an SSRF attack via port forwarding, leading to command injection when instructing Havoc to compile a payload 0:05-0:23.
• Once on the box, the Hard Hat C2 is discovered and bypassed by crafting a forged JWT token, thanks to a hardcoded static signing key 0:25-0:34.
• Root access is obtained by leveraging sudo permissions for iptables and iptables-save, which inadvertently grants elevated file write capabilities 0:36-0:43.

The "Backfire" machine offers a fascinating look at chaining exploits across multiple C2 platforms to fully compromise a target system.

Sources:

  • 0:00-0:05 Introduction to the Backfire machine and its two C2 targets
  • 0:05-0:23 Havoc C2 exploit chain via SSRF and command injection
  • 0:25-0:34 Hard Hat C2 authentication bypass using static JWT keys
  • 0:36-0:43 Privilege escalation to root using sudo iptables

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPSC and be doing backfire from hack the box which has us hacking two different C2s. The first is Havoc which has a really cool exploit chain. We spoof an implant that enables us to perform a serverside request forgery attack via the port forwarding command feature which lets us set up a websocket connection to the administration interface authenticate as an operator and trigger a command injection vulnerability through telling Havoc to compile an implant with a payload. Once we get on the box, we discover hard hat C2 is running, which has a static signing key for its JWT tokens. So, we can craft a token to authenticate. And then hard hat C2 allows us just to run commands. Once you exploit that, you discover that the user can run IP tables and IP table save…