Uploaded July 2023 | Updated September 2026, 5 hours ago

---

In this video, Tib3rius solves the medium rated "Celestial" box from Hack The Box.

0:00 - Intro
0:20 - Starting Celestial
2:00 - Explaining the advantages of DNSmasq
7:18 - Exploring the web server and cookie.
10:40 - Running a separate directory busting attack.
12:43 - Realizing the index page has changed since we now have a cookie.
13:29 - Playing around with the cookie values, attempting SSTI.
16:17 - Causing a detailed error message by changing the num parameter.
19:39 - Discovering code injection (via eval) in the num parameter.
24:24 - Debugging the code injection using the error messages.
28:30 - Attempting to execute OS commands via the code injection.
41:29 - Getting a reverse shell and the user flag.
46:10 - Running pspy to find the cron job commands.
48:05 - Creating a new version of script.py for root to run.
51:43 - Guessing (correctly) that the cron job runs every 5 minutes instead of 1, getting a root shell.
53:43 - Outro

Twitter: twitter.com/0xTib3rius
Twitch: twitch.tv/0xTib3rius
Courses: courses.tib3rius.com
Udemy: udemy.com/user/tib3rius
Discord: discord.com/invite/4qrvKMh
LinkedIn: linkedin.com/in/tib3rius
Facebook: facebook.com/0xTib3rius