HackTheBox - FormulaX

00:00 - Introduction 01:00 - Start of nmap 04:30 - Examining the Change Password functionality 06:20 - Discovering XSS In the Contact Form 11:15 - Building an XSS Cradle that manipulates the DOM to load an external JS file 18:35 - Creating an XSS that will send interact with the webchat and exfil messages back to us 26:30 - Discovering a new subdomain from the Online Chat 30:15 - Showing why we could not use Script SRC with our XSS Attack and why we used the DOM Technique 37:34 - Looking at the Git Auto Report Generating and discovering it uses simple-git v3.14 which has an RCE Vulnerability 44:40 - Shell on the box, dumping the mongo database 52:00 - Shell as Frank_Dorky 52:30 - Looking at the services running on the box to enumerate what each port is 55:30 - Showing bad permissions on the LibreNMS Directory which allows us to read and execute files in /opt/librenms 59:30 - Using the Templates in LibreNMS to get code execution 01:04:00 - Showing the intended way to exploit LibreNMS which is using a malicious SNMP Trap to attack an admin via XSS 1:17:30 - Exploiting the OpenOffice network port