Skip to main content
CPEBuddy
Attacking web servers and sandbox escaping | Hack The Box workshop

Attacking web servers and sandbox escaping | Hack The Box workshop

Source: YouTube · Hack The Box · published Jun 23, 2025 · 20:40

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

This video demonstrates how to solve a Hack the Box cybersecurity challenge by exploiting a vulnerable SPIP CMS instance to gain access and escalate privileges 0:08.

Key Takeaways:
• Initial setup involves scanning to find only port 80 open, which redirects to submerge.htb 0:47
• Adding domains to the host file allows accessing the main site and discovering a SPIP CMS subdomain 1:44
• The SPIP version 4.0.0 is vulnerable to remote code execution without authentication 8:54
• Using a Python exploit, they gain a reverse shell and find the user flag 15:14
• The challenge involves escalating privileges by mounting the Windows C drive through WSL to access the root flag 17:15

The workshop successfully demonstrates the process of reconnaissance, exploitation, and privilege escalation in a controlled cybersecurity challenge environment 19:58.

Sources:

  • 0:08 Introduction to the 4.1 difficulty challenge
  • 0:47 Initial scan results discovering port 80
  • 1:44 Adding domains to host file
  • 8:54 Discovering SPIP version 4.0.0 vulnerability
  • 15:14 Obtaining reverse shell and user flag
  • 17:15 Privilege escalation through WSL
  • 19:58 Summary of the challenge

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Hey everyone, this is Panos from Hack the Box and in this workshop we're going to take a look at a very easy challenge, a 4.1 from last year businessf. So before we already begin, I have done some steps to not have you sit through and watch people load. The first one was uh I spawn the machine. So we have the IP and nothing more. I also downloaded uh from this button right here the VPN file and uh I connected to the VPN. I also run the end mapap scan so we don't have uh to wait for the scan to finish. And we only found a single port running on the default HTTP port uh port 80. Um this is a NZX 1.18 whatever. So the first thing to do is to try and visit uh this web page. But what we see immediately if you take a closer look is immediately we get a redirect to submerge.htb and um our browser…