- Building a custom SQL injection & Gaining a shell
10
- Enumeration as the low-priv user
11
- Bypassing application whitelisting using msbuild
12
- Using certutil for file transfers & Gaining a Meterpreter shell
13
- Using the capcom.sys exploit to elevate privileges
14
- Discovering root.exe and reverse engineering the process
Description:
Explore a comprehensive walkthrough of exploiting HackTheBox's Fighter machine in this 47-minute video tutorial. Learn essential penetration testing techniques, including Nmap scanning, web application enumeration, SQL injection, shell acquisition, privilege escalation, and reverse engineering. Follow along as the instructor demonstrates subdomain enumeration, hidden directory discovery with Dirb, intercepting login requests using Burp Suite, and leveraging sqlmap for SQL injection testing. Gain insights into bypassing application whitelisting, utilizing file transfer methods, and exploiting the capcom.sys vulnerability for privilege escalation. Conclude with an analysis of the root.exe process through reverse engineering techniques.