Skip to main content
CPEBuddy
HackTheBox - Checker

HackTheBox - Checker

Source: YouTube · IppSec · published May 31, 2025 · 1:10:21

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

BLUF: This video demonstrates a CTF walkthrough for the "Checker" box, exploiting SQL injection and SSRF to gain initial access and using binary reversal for privilege escalation 0:07.

Key Takeaways:
• The box features two applications: Bookstack and Team Pass, both requiring enumeration 0:08.
• An unauthenticated SQL injection in Team Pass yields credentials for the Bookstack application 0:20.
• An authenticated Server-Side Request Forgery (SSRF) in Bookstack is exploited using a PHP gadget chain 0:32.
• The PHP gadget converts the SSRF into a file disclosure vulnerability, revealing SSH keys for the "reader" user 0:37.
• Privilege escalation is achieved by reversing a custom binary that the user can run with sudo 0:44.

The walkthrough highlights the importance of chaining multiple vulnerabilities, from web exploits to binary analysis, to fully compromise a target system.

Sources:

  • 0:07 Introduction to the "Checker" box and its components
  • 0:20 Exploiting SQL injection in Team Pass
  • 0:32 Utilizing PHP gadgets for SSRF exploitation
  • 0:37 Gaining SSH access via file disclosure
  • 0:44 Privilege escalation through binary reversal

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPSAC and be doing Checker from Hack the Box which is a pretty unique box that has a lot of cool techniques. It starts off with two websites running some open source code. The first is Bookstack and the second is team pass. You can enumerate the version of them and discover an authenticated serverside request forgery and bookstack and unauthenticated SQL injection and team pass. Obviously, we start with the SQL injection and that will get us credentials over to the bookstack application and then we can exploit the serverside request forgery vulnerability. However, we're not going to just use it to make a web request. We're going to use a pretty cool PHP gadget that allows us to turn a SSRF into a file disclosure vulnerability, which leads us to an SSH sessi…