HackTheBox - Kobold

Description

00:00 - Introduciton 01:00 - Start of nmap 02:30 - Finding the bin and mcp subdomain with ffuf 06:00 - Searching for PrivateBin exploits within version 2.0.2, finding an LFI but having trouble getting Code Execution from it 10:28 - Looking at the MCP Subdomain, finding MCPJam 1.4.2, which has an easy RCE Exploit 16:00 - SSH into the box as ben after dropping ssh key. Looking at processes and ports 18:37 - Looking at Arcane, another website discovering the default user of "arcane" still exists based upon timing on login 21:20 - Using find to see what files we have access to because we are in operator, discovering we can edit privateBin which allows us to weaponize the LFI to switch to its user (www-data) 26:30 - Inside of the PrivateBin Docker, looking for sensitive files, getting a password this lets us into Arcane. 30:03 - Logged into Arcane, a docker management website. Starting a container mounting / of the host to /mnt of the container, then accessing the host disk for privesc 33:30 - Showing a really cool unintended vector, which is the gshadow file. Using newgrp to add ourself to the docker group