HTB Season 8 Episodio 11 | Era - Medium | Review Y Consejos

Summary

In this Hack the Box video, the host dives into the challenges of a Linux machine that took considerable time to solve. He emphasizes the importance of reconnaissance and detailed code review in identifying vulnerabilities. Although the machine posed difficulties, especially in cracking passwords and exploiting misconfigurations, the host values the experience for its focus on skill development over relying on generic solutions. While not ranking it among his top machines, he encourages viewers to focus on learning and improving, rather than chasing rankings, and highlights the collaborative nature of the hacking community.

Takeaways

• 😀 The Hack the Box series is nearing its end, with only two more machines left to complete.
• 😀 The video arrives later than usual due to the creator taking a break after a party.
• 😀 This episode focuses on a Linux machine, which was challenging for the creator to solve, especially for initial access.
• 😀 Initial reconnaissance and information gathering are crucial for successfully completing the machine.
• 😀 The website provided in the machine’s challenge requires the user to register, but it’s important not to waste too much time here.
• 😀 A misconfiguration in user settings can allow for potential exploitation.
• 😀 The machine requires unconventional PHP webshells, which are different from typical exploitation methods.
• 😀 Cracking passwords is essential for progressing through the machine.
• 😀 The machine is a good exercise in reading and understanding code vulnerabilities, which is a valuable skill.
• 😀 The creator mentions that the machine wasn’t their favorite and wouldn't rank it in their top five Hack the Box machines.
• 😀 The creator advises viewers not to focus too much on rankings or the competition and to prioritize learning and skill development.

Q & A

What is the main focus of this video?

The video focuses on the walkthrough of a Hack the Box machine, offering tips and insights into the process of solving the machine, while discussing the importance of reconnaissance and code review in the hacking process.

Why was this video uploaded later than usual?

The video was delayed because the creator attended a party the previous day and wanted to take some time off before continuing with the machine.

What is the key to solving the machine, according to the video?

The key to solving the machine is the initial reconnaissance or information gathering. It's crucial to thoroughly investigate the website and understand the details about the user and system configuration.

What advice is given for handling the initial registration on the website?

The creator suggests registering on the website as a normal user, without wasting too much time. This will help avoid later issues such as misconfiguration, and ensure that the user is identified for further interaction with the system.

What type of vulnerabilities or misconfigurations should the viewer look out for during the process?

The viewer should look for misconfigurations, specifically in user management, such as being able to change certain user information or access files that could help in escalating privileges or gaining further access.

What role does code reading play in solving this machine?

Code reading plays a crucial role in this machine. The creator emphasizes that understanding the vulnerabilities in the code, rather than simply using pre-written exploits, is an essential part of solving the machine.

Why does the creator recommend playing around with the download feature?

The creator recommends experimenting with the download feature because it allows users to investigate files, explore potential vulnerabilities, and gain insights into the system's structure and behavior.

How does the creator feel about the difficulty of the machine?

The creator found the machine to be difficult, particularly when trying to get initial access. However, once the first breakthrough was made, the rest of the process was manageable.

What is the creator's opinion on the difficulty of Linux versus Windows machines in Hack the Box?

The creator expresses that they are not particularly comfortable with Linux machines but notes that the Hack the Box season has featured a variety of Windows and Linux machines, making it a necessary challenge.

What is the creator’s opinion on the overall quality of the machines in the season?

The creator did not particularly enjoy the last few machines, mentioning that the difficulty and overall experience made them feel demotivated. However, they also acknowledged that others might enjoy the challenge.