HackTheBox - Planning

00:00 - Introduction 01:00 - Start of nmap 02:40 - Using gobuster to discover the VHOST and running into a minor issue, I think gobuster changed how it handles the domain on VHOST Scans. 06:00 - Looking at the Nuclei Results 09:40 - Using the append-domain (ad) flag in gobuster to allow our VHOST scan to work and discovering the Grafana subdomain 12:00 - Discovering Grafana is running 11.0.0 and searching CVE's 13:40 - Finding CVE-2024-9264, and running it to get a shell on the Grafana docker container 21:00 - Looking at the env variables, discovering a credential that works to SSH into the box 25:50 - Looking at the crontab.db file, discovering a password 27:50 - Forwarding localhost:8000 back to us, so we can hit crontab-ui and logging in and creating a malicious cron to get root 29:35 - Showcasing FFUF to bruteforce HTTP Login by using bashful to append a string to our fuzz list and also use an encoder to b64 encode