HackTheBox - Sandworm

00:00 - Introduction 01:00 - Start of nmap 03:10 - Finding their public key, then sending an encrypted message that contains a XSS Test payload 06:50 - Creating a PGP Key and sending our public key, so they can send an encrypted message back 08:40 - Decrypting the message they sent to us 09:50 - Signing a message, but not encrypting it for them to verify and see they give us the metadata back 12:40 - Testing a SSTI Payload in the username of the key, and seeing it will dump the config 15:25 - Finding a SSTI Payload with Jinja2 that gives code execution... First attempt fails 19:23 - Testing a different SSTI Payload and getting code execution 21:40 - Reverse shell returned, discovering we are in a jail, attempting to get chisel up and running and failing 26:55 - Finding admin.json which contains another credential and we can use this to SSH into the box 28:00 - Logging into MySQL and attempting to crack the hashes 31:00 - Identifying that a file in the cargo directory for atlas is being updated every 2 minutes. Running pspy to identify what is happening 35:55 - We can write to one of the libraries cargo using to build, putting a reverse shell in 43:50 - Identifying that Atlas can run Firejail as root, finding a exploit for Firejail and getting root