HackTheBox - Pikaboo

00:00 - Intro
01:05 - Start of nmap
03:00 - Discovering the webserver is apache, despite nmap saying it is nginx
06:30 - Every request with /admin gets a 401, indication that nginx location may not end with /
07:30 - Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ directory
08:30 - Running gobuster in /admin_staging/ to discover more php scripts
09:20 - Testing index.php for lfi with a php filter
12:00 - Looking at the source and seeing it is using include() which allows for RCE if we can get it pointed at php code
13:50 - Playing with the LFI, eventually finding info.php which tells us open_basedir is set to /var/ which prevents the LFI from going out of that directory
16:35 - Using wfuzz with an LFI wordlist to search for files we can chain with this LFI, discovering ftp logs
19:00 - Poisoning the FTP log with a php reverse shell then using the LFI to trigger it
24:15 - Looking at the /opt/pokeapi directory to find a LDAP credentials
25:45 - Using ldapsearch to dump information out of the linux ldap server to get pwnmeow's credentials
28:25 - Using ftp with pwnmeow's credentials, then running linpeas
32:35 - Examining the CSVUpdate cron and finding a code injection vulnerability in the perl script
35:20 - Going over why perl will execute a variable starting or ending with | with an open() command
37:30 - Creating a revers shell file that begins with |
41:30 - Uploading our malicious file via FTP and getting root

Видео HackTheBox - Pikaboo канала IppSec