HackTheBox - LightWeight

00:45 - Begin of recon, Nmap 01:30 - Taking the CentOS Apache Version to find major version 03:20 - Running GoBuster with a Common-PHP-Files wordlist. 06:00 - Enumerating Ldap with ldapsearch 07:30 - Discovery of Password Hashes within ldap information 10:55 - Attempting to crack the hashes. (does not crack) 12:30 - Back to the web page 13:15 - Page says to login with ip@Lightweight with the password of your ip 15:35 - Running LinEnum 20:15 - Discovery of Extended Capabilities set on tcpdump 20:50 - Performing a packet capture over SSH without touching disk 23:45 - Examining the pcap created, don't see anything on ens33 24:20 - Performing a packet capture through SSH and piping live results to WireShark 26:00 - Discovery of LDAP Traffic, ldapuser2 password passed in clear-text 28:15 - Using bash to exfil a file over the network (backup.7z) 29:25 - Using 7z2john and hashcat to crack a 7zip file 32:05 - Examining extracted files to discover a new credential (ldapuser1) 33:30 - The openssl binary in ldapuser1 has an empty capability (which is all) 35:00 - Using GTFOBins to see what we can do with openssl 37:11 - Reading /etc/shadow with openssl 37:35 - Adding an entry into /etc/sudoers to allow us to escalate to root