HackTheBox - Ready

00:00 - Intro
01:20 - Start of nmap discovering gitlab
02:30 - Registering for an account, then finding the version
04:30 - Searching the GitLab commit history to see the patch changing how localhost is verified
07:20 - Using the import repo from URL feature to force the server to make a request
09:10 - Attempting SSRF Attacks with Gopher
11:50 - Successfully got the server to connect back using git with line breaks
13:00 - Finding a gitlab RCE Path from SSRF using Redis
15:50 - Failing to gttempting to get RCE
20:30 - Ping isn't working, trying Whoami with NC
24:00 - Finally get RCE with whoami and putting a space at the end of our payload
26:20 - Attempting to get a Reverse Shell
29:40 - Using CyberChef to get rid of the plus in our base64 paylaod
33:00 - Reverse Shell Returned
37:00 - DeepCE didn't give us much, running linPEAS again
40:15 - Finding the SMTP Password in a backup which is the root password
41:40 - Mounting the hosts disk to get root

Видео HackTheBox - Ready канала IppSec