HackTheBox - Cypher

00:00 - Introduction 00:40 - Start of nmap 03:40 - Sending a single quote in login and causing an error that has a stack trace tied to it, can see the cypher query it is running 06:50 - Forcing the Cypher Query to return true creating an authentication bypass in cypher queries 08:05 - Also showing we can exfiltrate data through out of band injection with LOAD CSV in cypher queries 10:20 - Playing around with the neo4j database by running cypher queries 13:00 - Discovering a custom function getUrlStatusCode, finding the java source code and finding an RCE via command injection 18:00 - Getting a shell on the box by exploiting the custom function, finding a neo4j password that gets us the GraphASM User 20:00 - Also showing the /api/cypher endpoint didn't require authentication 24:30 - Finding out GraphASM can run bbot with sudo, showing we can leak partial files by just putting the file as a target 28:00 - Getting RCE by creating a malicious config that lets us load a custom bbot module