UHC - Gobox

00:00 - Intro, box is playable on HackTheBox! 01:09 - Start of nmap and enumerating the page on port 80 03:45 - Discovering Port 8080 07:00 - Using ffuf to fuzz and discover SSTI 09:50 - Showing wfuzz doesn't need nearly as many parameters 10:30 - Reading up on GoLang SSTI 11:40 - Using GoLang {{ . }} to dump all variables and get password 11:54 - Logging in to get the Source Code and finding the DebugCmd Function 13:00 - Showing RCE through the GoLang SSTI 16:00 - The Docker is an internal docker, showing a bunch of hints towards AWS 17:20 - Using the aws commands to list buckets and upload a webshell via S3 21:30 - Getting a reverse shell 25:00 - Examining the NGINX Configuration -- LocalStack (used for s3) hack to enable authentication 26:26 - The "Command on" flag is for port 8000 in nginx config, googling it to see its a backdoor (NginxExecute) 28:28 - The backdoor isn't working, running strings against the module to see system.run was changed to ippsec.run and getting RCE as root 29:40 - Converting the RCE to a shell by uploading an SSH Key 33:40 - Entering the golang container to show some more about the SSTI Configuration, hoping to make the first step make sense 36:20 - Opening the nginx module in Ghidra