HackTheBox - MonitorsTwo

00:00 - Intro 01:02 - Start of nmap 01:50 - Discovering Cacti version and finding a vulnerability 03:50 - Sending the payload from the description, discovering we need to set the X-FORWARDED-FOR 05:00 - Incrementing Host_ID and Local_Data_Ids and discovering different output 06:15 - Discovering with local_data_ids set to 6 and host_id set to 1, we can get code execution 06:50 - Showing the python exploit and showing it blindly spray, looking at the Metasploit module for some more info 10:40 - Getting a reverse shell 11:30 - Using Script to set up our PTY since python is not installed 13:40 - Connecting to the MySQL Database and then cracking passwords 18:25 - SSH into the box with Marcus and discovering mail on the box 20:20 - Discovering Docker is old and vulnerable to CVE-2021-41091 21:55 - Looking at the docker overlayfs directories, discovering we can go in them, finding the web container 23:10 - Using CapSH to escalate privileges on our docker container so we can make Bash a SetUID Binary 24:50 - Executing bash -p to get root