HackTheBox - Pollution

00:00 - Introduction 01:03 - Start of nmap 02:00 - Checking out the site, discovering an email (collect.htb) and setting up gobuster 06:00 - Discovering forum.collect.htb which is running MyBB, someone uploaded a Burp history file which contains API Information 09:30 - Manually examining the BurpSuite Backup File, and discovering it contains full HTTP Requests 12:12 - Sending a POST Request to /set/role/admin with the secret token 12:50 - The Admin Page has a separate registration forum, which sends an XML Request. Trying XXE and discovering Blind XXE 19:30 - Using my Blind XXE Script to make exfiltrating files quicker 23:20 - Trying to extract the Apache Configuration, getting the developers.collect.htb.conf file and then getting/cracking the htpasswd file 25:50 - Logging into developers.collect.htb, cannot login, going back to the Blind XXE getting source code and finding Redis Creds 28:50 - Enumerating Redis, seeing PHP Sessions, and changing our cookie to say we are an admin 36:50 - Using the PHP Filter Chain to get code execution on this include() which leads to a shell 44:20 - Looking at listening ports, seeing a few things on localhost. PHP FPM is listening on 9000, injecting code with fcgi.py into that and getting shell as Victor 52:45 - Grabbing the Pollution_API Source Code (listening on port 3000), then using Snyk to look for vulnerabilities 55:30 - Seeing where Lodash is used and talking about Prototype Pollution 59:30 - Logging into the API 1:02:00 - Our user is not an admin, logging into the MySQL Database and changing our role to admin 1:05:00 - Testing our ability to send messages 1:06:09 - Using Javscript Prototype pollution to set SHELL to a local file we created, which the exec() call uses and getting root. 1:07:00 - Doing this exploit without the need to drop a file by setting SHELL to /proc/self/exe