00:00 - Introduction 00:59 - Start of nmap 02:02 - Adding makesense.htb to our hosts file and looking at the website (Agency LLC), identifying it as WordPress and dropping an HTML/image tag into the contact form to test for injection 03:36 - Kicking off wpscan with aggressive plugin detection, then browsing wp-content and finding the uploads directory is listable with a voicemessage.wav that speaks Jake's password 08:01 - Opening the dev tools and digging through the speech-to-text plugin's JavaScript, finding a hardcoded encryption key and the AES-GCM encryptPayload function 10:55 - Setting breakpoints so we can call encryptPayload ourselves from the console, and reviewing how the plugin posts data to admin-ajax.php 15:02 - Rebuilding the voice submission in Burp Repeater, working out the save_voice_raw and save_voice_results actions and getting a post_id 18:53 - Encrypting a script payload into the transcription/summary fields to get XSS, confirming the bot fetches our JavaScript (same result you can get just by putting HTML in the contact form, the unintended path) 20:49 - Explaining the HTTPS to HTTP mixed-content block, and the Chrome Local Network Access prompt that would let a page reach internal HTTP services 23:54 - Grabbing WPForce's add_admin.js CSRF payload, filling in our new admin creds and base64 encoding it into the summary field 30:03 - Submitting the payload, waiting for the bot, and logging into wp-admin as our new administrator 32:02 - Appearance then Theme File Editor: writing a PHP webshell into the Twenty Twenty-Three theme's hidden-404.php (using isset to avoid noisy errors) and getting code execution as www-data 35:56 - Catching a reverse shell, reading wp-config.php for walter's password, and reusing it to SSH in as walter for the user flag 37:07 - Enumerating processes and ports, finding a root-owned PHP OCR server on localhost 8001, and SSH port forwarding to reach it 38:24 - Logging into the OCR app as walter, drawing text and saving the result, then planning to smuggle a PHP payload through the OCR as a .php file 41:07 - OCR keeps dropping the underscore, so switching to a hex2bin encoded payload, fighting a trailing-space issue by splitting it into p1.p2, and finally executing code to get a shell as root
Trust cues for videos
