HackTheBox - Pikaboo

00:00 - Intro 01:05 - Start of nmap 03:00 - Discovering the webserver is apache, despite nmap saying it is nginx 06:30 - Every request with /admin gets a 401, indication that nginx location may not end with / 07:30 - Doing the nginx lfi to grab apache server-stats and leak the /admin_staging/ directory 08:30 - Running gobuster in /admin_staging/ to discover more php scripts 09:20 - Testing index.php for lfi with a php filter 12:00 - Looking at the source and seeing it is using include() which allows for RCE if we can get it pointed at php code 13:50 - Playing with the LFI, eventually finding info.php which tells us open_basedir is set to /var/ which prevents the LFI from going out of that directory 16:35 - Using wfuzz with an LFI wordlist to search for files we can chain with this LFI, discovering ftp logs 19:00 - Poisoning the FTP log with a php reverse shell then using the LFI to trigger it 24:15 - Looking at the /opt/pokeapi directory to find a LDAP credentials 25:45 - Using ldapsearch to dump information out of the linux ldap server to get pwnmeow's credentials 28:25 - Using ftp with pwnmeow's credentials, then running linpeas 32:35 - Examining the CSVUpdate cron and finding a code injection vulnerability in the perl script 35:20 - Going over why perl will execute a variable starting or ending with | with an open() command 37:30 - Creating a revers shell file that begins with | 41:30 - Uploading our malicious file via FTP and getting root