HackTheBox - Kotarak

For the unintentional method, I'm just downloading a file versus doing it live on the box because I wanted to save doing it live for another video. A really good SSRF Presentation: https://www.youtube.com/watch?v=D1S-G8rJrEk 01:38 - Start of nmap 03:40 - Accessing port 60000 06:20 - Manually enumerating ports on localhost via SSRF 07:00 - Using wfuzz to portscan localhost via SSRF 10:00 - Tomcat creds exposed & Uploading tomcat reverse shell 13:40 - Return of shell 14:20 - Extracting NTDS + SYSTEM Hive 20:20 - Using HashKiller to crack the hashes 21:30 - Escalating to Atanas & Identifying wget vulnerability 27:10 - Starting exploit 33:22 - Exploit failed, light debugging 35:40 - Issue found, not listening all interfaces 39:35 - Root shell returned. 40:10 - Unintentional Root Method (Edited Footage, IP Change)