HackTheBox - FriendZone

00:45 - Begin of Recon 04:10 - Running SMBMap to identify and crawl file shares 05:00 - Downloading creds.txt from an smb share and checking FTP/SMB 06:50 - Checking the webpage and grabbing potential DNS Names for the box 10:40 - Using dig to perform a DNS Zone Transfer to obtain additional host names 12:00 - Adding all hostnames to /etc/hosts 12:55 - Running Aquatone to take screenshots of all the pages for quick examination 15:15 - Testing Uploads.Friendzone.red 16:30 - Testing admin.friendzone.red 17:00 - Testing administrator1.friendzone.red, logging in with creds found from SMB 18:35 - Found an LFI in the Dashboard.PHP script (PageName Variable) 20:15 - Using PHP Wrappers with the LFI To obtain PHP Script Source 23:00 - Revisiting recon to find ways to upload files, end up using SMBClient 25:10 - Gaining code execution through the LFI Exploit and SMB File Share 27:30 - Reverse Shell Returned 28:50 - Exploring /var/www/html to see if any troll directories had useful files in them, find creds to Friend user 31:20 - Running PSPY to identify cron jobs we don't have permission to see 33:15 - Running LinEnum.sh to enumerate the box and discover the Python OS Library is writeable 38:20 - Fixing our reverse shell by setting ROWS and COLUMNS of our terminal so we can use Vi 40:45 - Placing a reverse shell in the Python OS library