HackTheBox - Worker

00:00 - Intro 01:05 - Start of nmap 02:50 - Checkign out the open SVN Port 03:45 - Adding the discovered domains to /etc/hosts and checking out the websites 05:30 - Some grep magic to show only what we want, which is URLS 09:15 - Using GoBuster to see if there are any more more VHOSTS 11:00 - Checking out the SVN and seeing creds in a previous revision (commit) 13:00 - Logging into Azure Devops (devops.worker.htb) and discovering the pipelin to deploy master branch to a server 15:00 - Pushing our webshell to the git master branch and getting shell on the box 16:10 - Choosing the revshell out of the tennc github page 21:40 - Creating a powershell one liner to get a reverse shell via Nishang 24:30 - Discovering SVN Credentials and using CrackMapExec to find valid passwords 28:50 - CrackMapExec was giving me issues, installing it from source with Poetry 30:00 - Using CrackMapExec to test a list of credentials without bruteforcing all passwords to all users 32:10 - Using WinRM to get a shell as Robisl 35:10 - Logging into Azure Devops as Robisl and discovering we can edit the build pipeline 39:45 - Copying our reverse shell to the box, so we can easily execute it from the build pipeline and getting admin 41:30 - UNINTENDED: Doing the box via RoguePotato 42:50 - Poorly explaining why we need to use chisel 45:50 - Running Chisel to setup a reverse port forward between the target and our box 52:15 - Setting up SoCAT to go through our tunnel 52:50 - Executing RoguePotato to get an admin shell 53:30 - Explaining the tunneling again in MSPaint. Hope this helps. 1:01:40 - Doing RoguePotato without socat, just a single Chisel tunnel