HackTheBox - WhiteRabbit

Why It Matters

The demonstration shows how a leaked HMAC secret can turn a secure webhook into an exploitable entry point, illustrating the cascading risk of weak integration practices for organizations that rely on third‑party services.

Summary

The video walks viewers through the Hack The Box “WhiteRabbit” machine, beginning with a standard Nmap scan that reveals three open ports: SSH on 22, HTTP on 80 served by Caddy, and a secondary SSH on 2222 likely running inside a Docker container. After adding the virtual host entries to the local hosts file, the presenter examines the single‑page Vue.js front‑end, discovers a public status subdomain, and identifies an uptime‑kuma instance. By fuzzing subdomains with ffuf, a hidden status page (status.white‑rabbit.htb) is uncovered, exposing a dashboard that hints at further services such as GoFish and Wiki.js.

The core of the exploitation chain revolves around a GoFish webhook that validates incoming POST bodies with an HMAC signature. The presenter finds the signing secret leaked in the source code, allowing them to forge valid signatures. Using Burp Suite’s match‑and‑replace feature, they automate the signature regeneration for each request, then pivot to the webhook’s SQL query, which concatenates the supplied email field directly into a SELECT statement. This classic SQL injection vector is confirmed with a manual payload, and the presenter demonstrates how to pipe the traffic through a custom Python proxy to feed tools like sqlmap for automated data extraction.

Alongside the SQL injection, the video highlights two additional privilege‑escalation avenues: an insecure Restic backup service and a custom password generator that seeds its randomness poorly. The presenter briefly shows how to exploit the backup service to retrieve configuration files and how the weak seed can be brute‑forced to recover admin credentials. Throughout, the narrator emphasizes the importance of chaining multiple low‑level findings—subdomain enumeration, HMAC key leakage, and injection—to achieve full machine compromise.

The walkthrough underscores the value of methodical reconnaissance, tool integration (ffuf, Burp Suite, sqlmap, custom proxies), and the habit of inspecting third‑party integrations for credential leaks. For penetration testers, WhiteRabbit serves as a textbook example of how a seemingly innocuous webhook can become the linchpin for a full compromise when combined with classic web‑application flaws.

Original Description

00:00 - Introduction

01:00 - Start of nmap

05:10 - Playing with a JavaScript Client app (Vue) to get information to do recon and finding public /status/ page

12:00 - Looking at the N8N Workflow with GoPhish

14:30 - Looking at the JSON Schema File that leaks a secret key and shows possible SQL Injection

18:00 - Using CyberChef to test the HMAC Key and confirm we can sign payloads

21:50 - Switching to Caido to show we can create WorkFlows on the Replay (repeater) functionality

25:20 - Creating a convert workflow to HMAC Sign all our requests

35:40 - Using the MITM Python Library to quickly write a proxy that would sign our requests that makes it easier for tools to test this endpoint

45:20 - SQLMap found the injection, dumping tables discovering a restic password

48:50 - Using the restic CLI to download a backup, then cracking the 7z file. Cracking fails the first time due to a weird collision.

57:00 - On the box, we can run restic with sudo, use password-command to give us a root shell

1:05:50 - Finding the neo password generator, discovering it uses random insecurely to set the seed and generate password.

1:18:45 - Adding milliseconds to our timestamp and then bruteforcing the password to get root