HackTheBox - TheFrizz

This video details a Hack the Box "Frizz" machine walkthrough, demonstrating a full attack chain from an initial PHP remote code execution via a file upload vulnerability to achieving root access through Group Policy manipulation 0:03.

Key Takeaways:
• The initial foothold is gained by exploiting an outdated Gibbon LMS application vulnerable to unrestricted file upload, leading directly to PHP remote code execution 0:06.
• Post-exploitation involves dumping the website's MySQL database to extract a salted SHA-256 hash, which is cracked to obtain domain user credentials 0:14.
• Enumerating the compromised user's recycle bin reveals a backup file containing a secondary set of credentials 0:20.
• The newly discovered account possesses Group Policy Creator Owners permissions, which is abused using SharpGPOAbuse to establish a malicious policy and gain system-level access 0:26.
• The reconnaissance phase begins with a standard nmap scan using default scripts and version enumeration 0:34.

The "Frizz" box provides an excellent exercise in chaining common web vulnerabilities with Active Directory misconfigurations to escalate privileges from a low-level web shell to full domain control.

Sources:

• 0:03 Overview of the full attack chain from web exploit to root
• 0:06 Discovery of the file upload vulnerability leading to PHP RCE
• 0:14 Database dump to obtain domain user credentials
• 0:20 Finding a backup with new credentials for privilege escalation