HackTheBox - Jerry

00:45 - Introduction, nmap 01:30 - Clicking around in Tomcat 02:20 - Playing around with HTTP Authentication 05:45 - Bruteforcing tomcat default creds with Hydra and seclists 08:20 - Sending hydra through a proxy to examine what is happening 12:50 - Logging into tomcat and using msfvenom + metasploit to upload a malicious war file 22:42 - Begin of doing this box without MSF 23:45 - Downloading a cmd jsp shell and making a malicious war file 26:25 - WebShell returned 28:00 - Begin of installing SilentTrinity 30:55 - SilentyTrinity Started, starting listener and generating a payload 33:00 - Pasting the payload into the webshell 34:00 - Debugging SSL Handshake errors 37:00 - Starting SilentTrinity back up, how to use modules 39:10 - Start of Execute-Assembly, compiling Watson 43:10 - Running Watson 43:30 - Start of Seatbelt and debugging why some dotNet code may not run (versioning issues) SilentTrinity Talk: https://www.youtube.com/watch?v=NaFiAx737qg