CodePartTwo Hack The Box | CVE-2024-28397 js2py Escape | Gunicorn RCE | npbackup PrivEsc | Season 09 скачать в хорошем качестве

CodePartTwo Hack The Box | CVE-2024-28397 js2py Escape | Gunicorn RCE | npbackup PrivEsc | Season 09

CodePartTwo - Hack The Box (Easy | Linux) In this walkthrough, we exploit CodePartTwo, an Easy-rated Linux machine on Hack The Box. The box runs a Flask web application served by Gunicorn that uses js2py to execute user-supplied JavaScript — vulnerable to CVE-2024-28397, a sandbox escape allowing Remote Code Execution. After gaining a shell, we exfiltrate a SQLite database, crack MD5 hashes, SSH in as user marco, and escalate to root by injecting a SUID command into npbackup's pre_exec_commands configuration. 🔥 Exploitation Path: • Nmap enumeration → Flask app on port 8000 (Gunicorn 20.0.4) • Source code review of app.zip → /run_code endpoint using js2py.eval_js() • CVE-2024-28397: js2py sandbox escape via Python class hierarchy traversal → RCE • SQLite users.db exfiltration via netcat → MD5 hash cracking (CrackStation) • SSH login as marco with cracked credentials • Privilege escalation: npbackup-cli pre_exec_commands → chmod 4755 /bin/bash → SUID root shell 🛠️ Tools Used: • Nmap • Gunicorn / Flask source code review • js2py CVE-2024-28397 exploit (custom Go & Bash scripts) • Metasploit (attempted) • Netcat (reverse shell + data exfiltration) • SQLite3 • CrackStation (MD5 hash cracking) • SSH • npbackup-cli 📌 CVEs Exploited: • CVE-2024-28397 — js2py sandbox escape via Python type hierarchy traversal 🔗 Resources: • CVE-2024-28397 Exploit: https://github.com/Marven11/CVE-2024-... • My Exploit (Go & Bash): https://github.com/0xDTC/js2py-Sandbo... • HackTheBox: https://app.hackthebox.com/machines/C... ⚠️ Disclaimer: This video is for educational purposes only. Always obtain proper authorization before testing systems you do not own. Unauthorized access to computer systems is illegal. #hackthebox #htb #cybersecurity #ethicalhacking #pentesting #ctf #oscp #infosec #linux #cve #rce #privilegeescalation #0xdtc