HackTheBox - Soccer

00:00 - Introduction 01:00 - Start of nmap, assuming the web app is NodeJS based upon a 404 message 04:20 - Running Gobuster and discovering Tiny File Manager 06:00 - Looking for the source code and finding a default password of admin@123 06:45 - Navigating to uploads and attempting to upload a php shell to the website 07:45 - Getting a reverse shell with our php shell 09:00 - Reverse shell returned 09:30 - Talking about hidepid=2 is set, so we can't see processes for other users 10:00 - Looking at nginx configuration to see what port 9091 is and discovering a new subdomain (soc-player.soccer.htb) 11:00 - Navigating to soc-player.soccer.htb and discovering a few more pages 12:00 - The /check endpoint looks like it is vulnerable to Boolean SQL Injection 13:00 - Intercepting the websocket in BurpSuite and showing 15:20 - Using SQLMap to dump the database, first time I've used SQLMap with websockets 23:30 - Attempting to ssh with creds found in the database and logging in as player 26:50 - Running LinPEAS 30:50 - Looks like we can run doas, which is like sudo. Looking at the command we can run and seeing dstat 33:30 - Creating a dstat plugin, then executing it with doas