Skip to main content
CPEBuddy
HackTheBox - Era

HackTheBox - Era

Source: YouTube · IppSec · published Nov 29, 2025 · 1:02:32

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

[BLUF] This video demonstrates a Hack The Box machine exploitation involving FTP enumeration, ID brute-forcing to extract signing keys and database credentials, and utilizing the PHP SSH wrapper to gain a reverse shell. 0:03

Key Takeaways:
• Initial reconnaissance identifies an FTP server and two web applications, one featuring unauthenticated file download functionality 0:06.
• Brute-forcing the download ID reveals signing keys and a website backup containing the database 0:13.
• Database credentials allow access to an Apache config backup, revealing the presence of the PHP SSH extension 0:26.
• The attacker leverages the PHP SSH wrapper to log into the box and execute commands, achieving a reverse shell 0:38.

[Closing statement] The challenge highlights the importance of checking for insecure direct object references and misconfigured PHP wrappers in web applications.

Sources:

  • 0:03 Introduction of the Hack The Box machine and initial FTP/web server findings.
  • 0:13 Brute-forcing the ID to obtain signing keys and database backups.
  • 0:26 Using credentials to find Apache config and identify PHP SSH wrapper.
  • 0:38 Exploiting the PHP SSH extension to gain a reverse shell.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on Youtube It's me doing Era from Hack the box. It starts off with finding an FTP web
server and two web applications. One of the web applications has a file
upload and download functionality, and there's no permission on the download. The only thing you need is the ID, so we brute force the ID and get
two other documents the signing keys, which comes in handy for the root step,
and also a backup of the website. The backup also has the database, which contains some credentials
which we can use against the FTP server to discover a backup of the Apache config
and the website. So as code shows, there is some
functionality around PHP wrappers. Looking at the Apache backup,
we see the PHP extension is installed, so you can use the ssh php wrapper to log into the box
and run a comma…