HackTheBox - Dog
Source: YouTube · IppSec · published Jul 12, 2025 · 28:56
This video demonstrates rooting the "Dog" machine on Hack The Box by exploiting an open directory to find MySQL credentials, enumerating valid Backdrop CMS users via an unprotected endpoint, and installing a malicious plugin for initial access.
Key Takeaways:
• The initial foothold begins by discovering MySQL credentials in the open "dogget" directory, though the username is invalid for direct CMS login 0:00-0:15.
• Attackers must enumerate valid CMS users through an unprotected endpoint to bypass brute-force protection and perform a password spray attack 0:15-0:30.
• Successful login allows the installation of a malicious plugin, resulting in remote code execution and access to the Backdrop CMS 0:30-0:40.
• Privilege escalation to a second user is achieved via password reuse, followed by root access using the "B" tool which manages Backdrop via pseudo 0:40-0:49.
The walkthrough highlights the importance of checking for unprotected enumeration vectors and reusing credentials across services during penetration testing.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and we'll be doing dog from hack the box which is a nice and easy machine that is running backdrop CMS and has an open.get directory. If we pull the doggget directory we'll discover my SQL credentials but it doesn't give us anything right away because the username doesn't let us log in to Backdrop CMS. We'll have to find a way to enumerate valid users on this CMS so we can perform a password spray which gets a little bit tricky because some of the endpoints have brute force protection. But poking around we can find a way to enumerate users that is unprotected. So we can do that find valid users then perform a password spray login to backdrop and then we'll install a malicious plugin to get code execution and switch to another user through password reus…